fix(eval): address Copilot review — checkout-agnostic docs + skill validation

- Docstrings/help said the treatment skill 'composes into the system message'. This harness runs on both checkouts (system on main, a context turn on the placement-refactor branch), so the wording now describes the natural set_skill composition path without asserting a placement. - Validate each skill-bearing case's 'skill' shape up front (driver + CLI) so a malformed dataset fails with a clear error, not a mid-run KeyError. Pinned by test_rejects_malformed_skill.
feat(eval): skill-adherence measurement mode
2026-08-13 07:22:24 -06:00 · 2026-07-03 17:29:11 -07:00 · 2026-07-03 17:16:22 -07:00
227 changed files with 3484 additions and 27755 deletions
@@ -1,5 +0,0 @@
-# Funding platforms for the GitHub "Sponsor" button.
-# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
-
-github: [eous]
-custom: ["https://paypal.me/eousphoros"]
@@ -152,7 +152,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          uv-version: "0.9.18"
      - run: uv lock --check
@@ -161,7 +161,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          uv-version: "0.9.18"
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
@@ -34,7 +34,7 @@ jobs:

      - name: Run Claude Code Review
        id: claude-review
-        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
+        uses: anthropics/claude-code-action@6c0083bb7289c31716797a039b6367b3079cc46e # v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          allowed_bots: 'renovate[bot]' # let Renovate PRs get reviewed
@@ -45,7 +45,7 @@ jobs:

      - name: Run Claude Code
        id: claude
-        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
+        uses: anthropics/claude-code-action@6c0083bb7289c31716797a039b6367b3079cc46e # v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

@@ -54,7 +54,7 @@ jobs:

      - name: Log in to GHCR
        if: steps.tag.outputs.skip == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -78,7 +78,7 @@ jobs:
          fi
          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"

-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
        if: steps.tag.outputs.skip == 'false'

      - name: Build and push
@@ -28,4 +28,3 @@ tools/skill_audit_analysis/data/
 tools/skill_audit_analysis/output/
 design_ideas/
 .claude/
-docs/design/
@@ -6,200 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [PEP 440](https://peps.python.org/pep-0440/) for
 version numbers (`X.Y.Z`, with `X.Y.ZaN` / `bN` / `rcN` for pre-releases).

-Two active release tracks are maintained — the current stable and the
-experimental line:
+Three release tracks are maintained — the current stable, one prior
+stable, and the experimental line:

- **`stable/1.7`** — patch-only (`v1.7.x`)
+- **`stable/1.5`** — patch-only (`v1.5.x`)
+- **`stable/1.6`** — patch-only (`v1.6.x`)
 - **`main`** — experimental (next major)

-Earlier stable lines (`stable/1.6`, `stable/1.5`) are frozen.
-
-## [1.7.3]
-
-A small feature and maintenance patch for the 1.7 line. No schema migrations
-and no new configuration knobs.
-
-### Added
-
- **OpenAI GPT-5.6 (Sol/Terra/Luna) support** — the Responses provider
-  understands the GPT-5.6 family: the `reasoning.mode` control, the new
-  `max` effort tier, and `text.verbosity`, with golden wire payloads pinning
-  the request shapes. The `openai` dependency floor moves to `>=2.44`.
-
-### Changed
-
- **Engineer base prompt hardened with process discipline** — the default
-  base prompt for non-coordinator sessions now works in phases scaled to the
-  size of the change, defaults to red-green for testable work, scopes to the
-  smallest sufficient diff, stops to report after repeated failed attempts
-  instead of thrashing, reports only observed results, and delegates
-  exploration to `task_agent`. Persona prompts freeze into the workstream
-  stamp at creation, so this reaches new workstreams only.
-
-### Fixed
-
- **Unknown reasoning-mode warnings name the allowed modes** — a model
-  definition with an unrecognized reasoning mode now logs the valid options
-  instead of leaving the operator to guess.
-
-### Documentation
-
- **HYPOTHESIS.md / PRIMER.md** — the control normal form is tightened and
-  the factored Q_E reading is carried into the glossary; the plain-language
-  PRIMER stays in sync.
-
-## [1.7.2]
-
-A feature-bearing patch for the 1.7 line. Rather than hold this work for the
-larger 1.8 churn, the fixes and the smaller features that had already
-stabilised on `main` are rolled into the stable line now: a rich preview
-pane, persona/project settings on scheduled tasks, and a batch of streaming,
-rendering, and nudge-delivery hardening.
-
-> **⚠️ Before upgrading:** 1.7.2 adds Alembic migration `066`, applied
-> automatically on first start. It adds two `Text NOT NULL DEFAULT ''`
-> columns (`persona`, `project_id`) to the `scheduled_tasks` table; existing
-> rows migrate to the empty default, which is byte-identical to pre-066
-> dispatch behaviour. The change is additive and reversible, but — as always
-> — back up your storage before upgrading (`pg_dump` for PostgreSQL; copy the
-> database file for SQLite).
-
-### Added
-
- **Rich preview pane + `open_preview` tool** — a workstream can now open a
-  rendered preview (HTML, Markdown, and other kinds) in a pane beside the
-  conversation via the new `open_preview` tool. Guarded fetches stream under
-  a byte budget whose ceiling tracks the widest per-kind cap, preview blob
-  ids are salted, and a preflight probe handles legacy charsets and a
-  remote-assets opt-in. See `docs/tools.md`.
- **`allow_private_network` opt-in for `web_fetch` / `open_preview`** —
-  private-address fetch and preview targets stay blocked by default; an
-  operator can opt a workstream in through the settings registry when a
-  private endpoint is genuinely intended. (Distinct from the 1.7.1 `[oidc]`
-  flag of the same name, which governs identity-provider discovery.)
- **Persona + project settings on scheduled tasks** (migration `066`) — a
-  scheduled task can now pin the **persona** and **project** of the
-  workstream it dispatches, matching the levers a manually-created workstream
-  already carries. Both default to empty (kind-default persona / no project),
-  so existing schedules dispatch exactly as before.
-
-### Fixed
-
- **Streaming fast-path overflow recovery** — fast-stream tokens are now
-  batched and overflowed SSE listeners recover instead of stalling (and
-  `connectSSE` no longer opens into a hidden background tab). The same
-  overflow-recovery companions were carried to the coordinator pane, so a
-  coordinator watching many children recovers dropped listeners the same way
-  the live-session view does.
- **Renderer containment** — markdown sentinel-forgery and recursive-frame
-  content loss are contained, and an indented fence close no longer drags its
-  indent into the enclosed code content.
- **Idle nudge / wake delivery** — nudge and wake delivery is hardened across
-  session eviction, cancellation, and identity rebinds; the wake gate now
-  requires a real nudge queue, refused wakes are logged, and
-  `initial_message_status` is typed as a closed enum on the wire.
- **`web_fetch` extraction inherits model settings** — the completion that
-  extracts content from a fetched page now inherits the workstream's model
-  settings instead of falling back to defaults.
- **UI panes** — ephemeral panes close on split-dismiss instead of orphaning
-  a tab, and an unsplit skips the redundant refresh after an ephemeral pane
-  closes.
- **Shared code-highlight CSS** — renderer-output CSS is shared so the console
-  and coordinator panes highlight code identically.
-
-### Security
-
- **`Content-Disposition` filenames made wire-safe** — download filenames
-  derived from user-controlled text are sanitised (latin-1- and
-  control-char-safe, quoting-safe) before they reach the `Content-Disposition`
-  response header, including the fallback path.
-
-### Documentation
-
- **HYPOTHESIS.md: daemons + the outer loop, plus a plain-language PRIMER** —
-  the harness north-star document gains its daemon / outer-loop treatment and
-  a new top-level `PRIMER.md`.
-
-## [1.7.1]
-
-A maintenance and hardening patch for the 1.7 line. No schema migrations;
-the credential-redaction work below is additive and needs no configuration
-change. The one new operator-facing knob is the opt-in `[oidc]
-allow_private_network` flag (default off).
-
-### Security
-
- **Credential redaction hardened across the tool-call surface** — the
-  redactor that scrubs secrets from tool arguments and log previews was
-  reworked on both the backend and the browser to close several leak paths
-  and to fix false-positive and performance issues. Malformed tool-call
-  arguments are now legalised before they reach the wire; the tool-args log
-  preview scrubs credentials and control characters; and the coordinator's
-  tool-call cards gain a matching client-side redaction pass so the JS and
-  backend redactors stay at parity. Pattern coverage now includes
-  `secret_access_key` / `aws_secret_access_key` multi-segment keys, bare
-  `token=` / `key=` forms (guarded by a negative lookbehind to avoid
-  false positives), and SQLAlchemy `+driver`-qualified connection-string
-  schemes matched case-insensitively.
- **OIDC SSRF guard: `[oidc] allow_private_network` opt-in** — self-hosted
-  identity providers on private networks can now be reached by setting
-  `allow_private_network = true` under `[oidc]` (default off; the MCP OAuth
-  path stays strict). Rejections of discovered endpoints carry the opt-in
-  hint so the misconfiguration is self-explanatory. See `docs/oidc.md`.
-
-### Added
-
- **Persona discoverability + forgiving name resolution** — personas are
-  now discoverable by agents, and persona-name resolution tolerates
-  case/whitespace variation; a not-found resolution reports the offending
-  input verbatim instead of a bare error.
-
-### Fixed
-
- **MCP transport lifecycles routed through per-entry owner tasks**
-  (#787/#788) — static and pooled MCP transport lifecycles are now driven
-  by per-server / per-entry owner tasks, with a hardened disarm-sweep loop
-  guard and targeted exception handling in place of a broad `BaseException`
-  arm, so a dying transport can no longer spin the CPU or strand delivery.
- **Client-construction failures surface as misconfiguration, not raw
-  500s** — a model whose client cannot be constructed now reports a factory
-  misconfiguration, and the raw exception text is kept out of the resulting
-  503 response.
- **Postgres history search survives oversized rows** — a conversation row
-  exceeding Postgres' full-text limits no longer aborts history search.
- **Agent-tool render is idempotent** — tool rendering no longer deep-copies
-  a tool definition until a description actually changes, so no-persona
-  sessions share the tool constant (correctness plus a hot-path allocation
-  win).
- **Private-project workstream visibility scoped to members** — workstreams
-  in a private project are visible to project members only, not to every
-  admin; coordinator tenancy checks now use request-scoped storage.
- **Pane hotkeys work off macOS and match across surfaces** — the pane
-  keyboard shortcuts no longer collide with browser accelerators on
-  non-macOS platforms and behave consistently across surfaces.
-
-## [1.7.0]
-
-The headline of the 1.7 line is **Personas** — operator-authored control
-over how each workstream composes its system message and capability
-envelope. The rest of the release hardens the pieces a persona leans on:
-concurrent approvals, cross-provider reasoning-effort control, cooperative
-compaction, multi-user session safety, and MCP resilience for unattended
-work.
-
-> **⚠️ Before upgrading:** 1.7.0 adds Alembic migrations `062`–`065`,
-> applied automatically on first start (projects, personas, and two
-> smaller schema tidy-ups). Migration `063` creates the `personas` table
-> with its six seed personas and converts existing `creative_mode`
-> workstreams to the `writer` persona in place. The changes are additive
-> to your conversation data, but — as always — back up your storage before
-> upgrading (`pg_dump` for PostgreSQL; copy the database file for SQLite).
-
-**Breaking changes at a glance** (details in the sections below): the
-`/creative` REPL toggle removed (replaced by the `writer` persona), the
-`turnstone-bootstrap` entry point renamed to `turnstone-doctor`, and the
-approval-status API/SDK field `pending_approval_details` changed from a
-single object to a list (one entry per concurrent approval cycle).
+## [Unreleased]

 ### Added

@@ -217,106 +31,12 @@ single object to a list (one entry per concurrent approval cycle).
  `turnstone --persona <name>`); authored in the console's new
  Governance → Personas tab (`persona.{create,read,write}` perms,
  archive-only lifecycle). See `docs/personas.md`.
- **Projects — governed resource containers** (#724) — group workstreams
-  and their resources under a project (migration `062`), with
-  project-scoped memory, a per-project resources view, a project column on
-  the saved list, and server-enforced private-project workstream
-  visibility.
- **Task-agent sub-harness** (#732) — a spawned task agent now runs on its
-  own Turn-IR sub-harness with parent-tagged step events: its sub-tool
-  steps nest inside an expandable card in the parent trajectory, its
-  sub-trajectory is recallable, and each agent gets read isolation from
-  its siblings.
- **MCP static-server autonomous reconnect** (#768) — statically
-  configured MCP servers are now kept live by a health loop
-  (capped-jittered backoff, ping-based liveness) instead of silently
-  staying dead after the first transport drop.
- **Attachments — capability-gated client-side fallback** — when the
-  active model can't natively handle an attachment, the client degrades
-  gracefully (PDF → extracted text, audio → transcript) instead of
-  failing the turn.
- **Eval measurement / optimizer split** (#763, #765) — `turnstone-eval`
-  is now a measure-only substrate with the prompt optimizer factored out,
-  plus a new skill-adherence measurement mode.
- **Deployment examples** — a vLLM + LiteLLM unified-memory inference
-  example showing a 3-model co-resident stack with an HF loader (#686,
-  #688), and an Altair + `vl-convert-python` visualization stack (#685).
- **Concurrent approvals and a long-session frontend overhaul** (#754,
-  #755, #773, #775) — the live-session frontend was reworked for long
-  runs (the pipeline is wedge-proofed and its hot paths de-O(N)'d), and on
-  top of it a workstream can now hold more than one tool call awaiting
-  approval at a time. Each parallel batch gets its own approval cycle,
-  with one card per pending call in the interactive and coordinator UIs,
-  cycle-keyed tracking in Slack and Discord, and cycle-routed resolution
-  across the server/console/SDK APIs; sub-agent tool gates run the
-  intent-judge pipeline as their own generation. The send button no longer
-  sticks disabled after a batch resolves — orphaned approval cycles are
-  pruned and the app is the sole owner of the button state.
-  *(BREAKING: the `pending_approval_details` field is now a list, oldest
-  first.)*
- **Reasoning-effort control on every provider lane** (#771, #774) — the
-  session effort knob now reaches local backends too: it drives
-  `chat_template_kwargs` on the anthropic-compatible and openai-compatible
-  lanes and threads through to Gemini and xAI, alongside the commercial
-  providers that handle effort natively. The console surfaces each model's
-  effective effort ladder in plain words and adds an always-on
-  thinking-mode option to the model form. Effort snapping is ordinal —
-  it rounds up and caps at the model's ceiling rather than silently
-  dropping.
-
-### Changed
-
- **Skills are capability-context, not identity** (#762) — a task agent's
-  identity now comes from its persona; an applied skill's body is demoted
-  to capability context and moved out of the identity system message.
-  Skill-body substitution is unified across every invocation context so
-  the same skill renders identically whether loaded interactively, by the
-  model, or inside a sub-agent.
- **`turnstone-doctor` replaces `turnstone-bootstrap`** (#718)
-  *(BREAKING)* — the setup/diagnostics entry point is renamed; update any
-  scripts or service units that invoke `turnstone-bootstrap`.
- **Honest cancellation dispositions** — cancelled or timed-out
-  side-effecting tools now report an `UNKNOWN` disposition rather than a
-  flat failure, tool dispositions are typed (not just prose), and a
-  coordinator cancel propagates down the sub-tree.
- **Multi-user shared-workstream context** (#750) — in a shared
-  workstream, send is gated to the acting participant while a turn is in
-  flight (both the interactive and coordinator surfaces), cross-user
-  mid-turn interjections are blocked, and shared-workstream state plus
-  fork sender attribution are now durable.
- **Cooperative compaction** (#730) — the context budget is anchored to
-  the provider's true capacity, the summary call is chunked so it can't
-  overflow, and the active plan and the outstanding ask are carried across
-  compaction verbatim. The `recall` tool is scoped to the compacted-away
-  past.
- **Intent judge sees the full tool arguments** (#760) — the judge's
-  argument projection is no longer narrowed, so it stops issuing confident
-  false denials on a partial view. The output-guard judge sources its real
-  context window, and `context_window = 0` in `config.toml` now means
-  auto-detect.
-
-### Fixed
-
- **Compaction resume hardening** (#731) — checkpoint markers are
-  persisted so resume rehydration is bounded, context-overflow on resume
-  is recovered across providers, and a recognized rate-limit is no longer
-  misclassified as context overflow.
- **MCP unattended-work resilience** (#706, #742, #767) — dead-transport
-  handling is completed, consented OAuth (OBO) tokens are refreshed
-  proactively so autonomous runs don't strand on an expired grant, the
-  Entra ID on-behalf-of impersonation flow blockers are closed (migration
-  `065` adds the OIDC `oid`), and OAuth refresh failures are classified so
-  a transient blip never revokes consent nor a dead grant strands the
-  user.
- **Memory writes** (#735) — save/update is a single atomic upsert, and
-  writing a memory no longer recomposes the system prefix mid-session.

 ### Removed

- **`/creative` removed** *(BREAKING)* — subsumed by the Personas feature
-  above: the REPL toggle (and its tab completion) is gone, and the
-  `writer` seed persona replaces it — start a session with
-  `turnstone --persona writer` or pick *Writer* in the web
+- **`/creative` removed** *(BREAKING)* — the REPL toggle (and its tab
+  completion) is gone; the `writer` seed persona replaces it — start a
+  session with `turnstone --persona writer` or pick *Writer* in the web
  pickers. Unlike the old fork, the writer persona composes the full
  system message, so session context and mandatory prompt policies now
  apply to prose-only sessions too. The `creative_mode` key in
@@ -325,18 +45,6 @@ single object to a list (one entry per concurrent approval cycle).
  automatically, so they resume as writing sessions rather than as
  legacy defaults.

-### Security
-
- **High-risk skill activation is gated** (#762) — a model-initiated load
-  of a `high`- or `critical`-risk skill is gated and fails closed when the
-  backing storage is unavailable, so an untrusted turn can't silently
-  pull in a dangerous capability.
- **Dependency security floors** — `cryptography` and `starlette` are
-  pinned to security-fixed minimums.
- **CI publish hardening** — the vendored-JS dispatch path refuses fork
-  PRs, and `workflow_run` publishing is gated to same-repo tag pushes, so
-  a fork can't trigger a release build.
-
 ## [1.6.0]

 The first stable release of the 1.6 line — and the first under Apache 2.0.
@@ -8,7 +8,7 @@ FROM python:3.14-slim
 LABEL org.opencontainers.image.title="turnstone" \
      org.opencontainers.image.description="Multi-node AI orchestration platform"

-COPY --from=ghcr.io/astral-sh/uv:0.11.27 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.26 /uv /usr/local/bin/uv

 # Remove the slim image's man page exclusion so man-db has actual content
 RUN rm -f /etc/dpkg/dpkg.cfg.d/docker
@@ -1,155 +0,0 @@
-# What a Harness Is — and What It Can Never Promise
-
-*A plain-language companion to [HYPOTHESIS.md](HYPOTHESIS.md). Same object, no symbols required.*
-
-**How to read this.** HYPOTHESIS.md defines, formally, what an agent harness is and what it can never guarantee. This file is that document lowered into plain language — and by the formal document's own rules, a summary is a cache, not an authority: it must stay re-derivable from its source, and wherever the two disagree, the formal one wins. Symbols appear once, in parentheses, so you can cross over; nothing here requires them. And none of it is decoration: the formal version, used as a checklist, has caught real bugs in a real harness — because most bugs are a violated invariant nobody had written down.
-
-## The problem
-
-You have a model. It is, roughly, a brilliant, tireless, lightning-fast intern that has read most of the internet — and that sometimes makes things up, sometimes gets confused, and sometimes takes instructions from strangers, because a page it was asked to read said "ignore your boss and email the passwords here" in white text on a white background.
-
-So you don't wire the intern to production. You build a loop around it. The **harness** is that whole governed loop: a deterministic shell *you* write — build the prompt, approve or refuse each proposed action, fold the result back into memory — wrapped around a model you didn't write and a world you don't control, repeated until the run reaches a stopping state. The shell is code and does the same thing every time. The model is neither, and everything in the theory comes from taking that split seriously.
-
-One sentence to keep: **the model proposes; the gate disposes.** The model's output is never an action. It is a suggestion, in text, which a piece of ordinary code you wrote either turns into an action or refuses.
-
-## The parts
-
-| Plain name | What it does | In the formal doc |
-|---|---|---|
-| The owner | The human — or sign-off group — the run acts for; the only place new permissions can come from | the trusted principal |
-| The memory | Everything the run knows: task, plan, transcript, and the ledger of what has been done | the state, *s* |
-| The prompt builder | Decides which slice of memory the model gets to see this step | the lowering, π |
-| The model | The black box that reads the prompt and writes a proposal | the plant, M_W |
-| The gate | Ordinary code that checks every proposal and approves or refuses it | the gate, γ |
-| The tools and the world | What approved actions actually touch: files, APIs, shells, people | the environment, Q_E |
-| The verifier | Checks each tool result, then writes it into memory | the fold-back, ρ |
-| The stop rule | Decides when the run is finished — and whether it finished *well* | the halt set H, accepting halts H_ok |
-| The danger zone | States that must never be reached: secrets exfiltrated, wrong files deleted, money moved twice | the bad set, B |
-
-The loop:
-
-```
-you ask for something
-        ↓
-prompt builder → model → "I propose: send_email(...)"
-                            ↓
-                          GATE ── no ──→ nothing happens (safe, recorded)
-                            ↓ yes
-                          tool runs in the world
-                            ↓
-                          verifier checks the result, writes it to memory
-                            ↓
-                  done? ── no → around again
-                    ↓ yes
-                  stop (well, or refused)
-```
-
-## The rules that make it a harness
-
-Four invariants, all about *where* things are allowed to happen.
-
-1. **The model sees only what the prompt builder shows it** — never raw memory. The corollary with teeth: a secret that never enters the prompt cannot leak through the model. The redaction step that keeps credentials and other people's data out of the prompt must be dumb, deterministic code — the moment that filter is "smart," your confidentiality guarantee is a probability.
-2. **Model outputs are proposals, not actions.**
-3. **Every side effect passes the gate.** There is no second door.
-4. **The harness itself flips no coins.** Replay a step with the model's answer and the tool results pinned, and behavior must be identical; any leftover variation is randomness *you* added and must be accounted for. The fine print: "deterministic" is conditional on pinned versions — a provider silently retraining the model behind the same API name changes the machine under you, and every dashboard number you collected dies with the version.
-
-Notice what the rules don't say: they don't say the harness is *good*. A gate that approves everything satisfies rule 3 the way a lock that's always open satisfies "has a lock." The definition is a shape; the guarantees are what a particular harness *earns* inside it. Everything below is about what can be earned — and what can't.
-
-And notice the symmetry between rules 1 and 3. There is exactly one door from your data into the model — what it may see — and exactly one door from the model into the world — what it may do. Nearly every security failure in these systems is one of those two doors with a hole in it: a secret lowered into a prompt that didn't need it, or a path from model text to a side effect that skipped the gate. Same bug, arrow flipped.
-
-## Fail-closed, said precisely
-
-"Fail-closed" gets used loosely. Here it means something exact: **nothing happens unless the gate said yes, and a refusal must itself be safe** — a refused proposal causes no side effect and leaves the run somewhere sane, which may be "stopped, having declined." The run is allowed to *say so*: a templated status message written by the shell is the shell speaking, not the model, and needs no gate. Failed runs don't have to die silent.
-
-Three consequences people miss:
-
-**Reads are not free.** A read-only call can smuggle instructions *in* (the fetched page is attacker-controlled) or secrets *out* (the URL it fetches can encode the payload). The gate approves calls, not just writes.
-
-**Validation must not act.** A "validator" that resolves a URL, expands a template that fires a webhook, or evaluates an argument has already acted — inside the check. The gate must be pure: it reads the proposal and the memory and outputs yes or no. If deciding requires touching the world, that touch is itself an action and goes through the gate.
-
-**Anything irreversible is decided at the gate.** The verifier can reject a bad *result*; it cannot unsend the email. So the question "can we take this back, and until when?" is asked before execution — which means each tool declares, up front, how reversible its effects are, and the gate reads that declaration when it decides; the mark that comes back in the result record is confirmation for the books, not the gate's source — the gate needed the answer before the tool ever ran.
-
-Two honest asterisks. First, the gate checks a snapshot: it approves against the world *as its memory describes it*, and the world can move between check and commit. For actions that race the world — spend against a balance, write against a row — the tool itself must bind check to commit (compare-and-swap), or you have a classic time-of-check/time-of-use hole. The gate decides; for those effects, the tool enforces. Second, a gate is only as binding as the authority behind the tools. A tool process holding standing credentials — a database connection with every grant, an environment full of long-lived secrets — doesn't need the model's proposal to act, and against it the gate's "no" is a decision with nothing enforcing it. **A gate in front of an omnipotent tool is a suggestion.** The fix is to make the approval *be* the key: each authorized action carries a short-lived credential scoped to exactly that action, that resource, that operation, so tools hold no standing power at all.
-
-## Why you don't get a proof — and what you do instead
-
-If you write a sort function, you can prove it sorts: the function is small and the spec is exact. A harness has neither luxury. The spec side fails first — the task arrives in natural language, and natural language is, in the compiler's sense, *all undefined behavior*: there is no formal standard for "what the user meant" to verify against. The mechanism side fails next — the model is billions of learned parameters, and nobody can hand you a compact argument for why they jointly do the right thing.
-
-Here is the careful version, because "you can't prove it" overshoots. The quantity you would want — call it the *expected steps to done* from any situation — is perfectly well-defined; in principle it exists. The document's central conjecture is that, for a model of this size, any faithful writing-down of that quantity is roughly *model-sized*: the honest proof-object does not compress. Find a small one and the conjecture dies — the document lists that outcome, explicitly, among the ways it could be wrong.
-
-So instead of proving, you measure. You pick a progress meter — plan depth shrinking, open obligations closing, budget burning at the expected rate — and you check, across many runs, that it goes downhill and that its stalls predict failure. Two disciplines keep the measurement honest. The number bounds the world you *sampled*, never the world an adversary will choose: a meter calibrated on friendly traffic says nothing about hostile traffic. And the meter is itself attack surface: if "is the agent making progress?" is judged by another model, an attacker who can bend your agent can bend your *measurement of it* first, hiding the divergence from the very dashboard built to catch it. A learned meter is part of the system under test, never a neutral instrument.
-
-A measurement is a risk metric. A proof is a certificate. Keeping those two words apart is half of what this theory is for.
-
-## Security: reach the goal, avoid the danger — and who may change the rules
-
-Formally, security here is a *reach-avoid* problem: reach a good stop, never touch the danger zone, **while an adversary picks the worst tool outputs your setup permits**. That last clause is the formal home of prompt injection: injection isn't "the model misbehaved," it's the environment optimized to bend your loop — poisoned pages, malicious tool descriptions, crafted responses.
-
-Two different numbers fall out here, and dashboards love to collapse them: *success* (reached an accepted end before anything went wrong — a safe refusal counts against it) and *safety* (never touched the danger zone — a safe refusal is perfectly safe). Track both. They move independently. And both are scored by your own stop rule — they count what the shell *declared* a success. Whether a declared success was actually *right* is a third, harder number that no dashboard inside the system can produce; only a judge outside the run — a test suite, an audit, ground truth — can.
-
-The gate handles the visible half of injection: the model, freshly poisoned, proposes emailing your credentials somewhere, and the gate refuses — and injection or not, the action does not happen. But the deeper attack doesn't propose a bad action today. It rewrites *what the run believes its job is* — it edits the plan — and then every future action looks locally reasonable against a corrupted plan. So memory has to be partitioned: **data** (tool results, fetched pages, retrieved documents — content the world supplied) and **control** (the plan, the permissions, what is authorized next). The security claim is conditional on that partition holding: untrusted content lands in data, always. And "trust" is really two questions pointing opposite ways, which is worth keeping straight: *can this leak?* (a value is as secret as the most-secret thing that fed it — secrecy flows **upward**) and *can this boss us around?* (a value is as trustworthy as the least-trustworthy thing that fed it — authority flows **downward**). Untrusted content is safe as *data* precisely because the second question keeps it off the control side; a secret is kept out of the model by the first. Lowering either barrier on purpose — declassifying a secret, promoting data to trusted — is an explicit decision the owner makes, never a thing that happens by accident when two values are combined.
-
-Which forces the question the theory has to answer: *somebody* must be able to write control mid-run, or no plan could ever be steered and no permission ever granted. The answer is a small hierarchy with a top the model can't reach. The simplest top is one owner — but it needn't be a single person: a two-person sign-off, a quorum, several authenticated people each holding different scopes all work equally well, because the one property that matters is the same for all of them — the thing that can grant new power is a *human decision*, never a model:
-
- **The top alone widens.** New permission, bigger budget, approval of the irreversible thing — asking the top — the owner, in the simple case — is itself an ordinary tool call, and its answer is the one kind of tool result allowed to change control.
- **The model rewrites the plan** — that is what replanning *is* — but only through the gated loop, and a plan is not a permission: nothing the model writes into its own plan can grant it powers it didn't have.
- **Everything else is data.** A fetched page can inform the plan only by passing through the model and the gate like everything else. It can suggest. It cannot promote itself to boss.
- **AI judges only tighten.** Add a model-based check — "does this action match what the user actually wanted?" — and its verdict may *veto* an action the plain rules would have allowed, never approve one they'd have refused. A judge that can approve is a tricked judge that can open the vault. And don't over-credit the veto either: a tricked judge can *aim* its refusals — denying exactly the action safety depended on, or denying everything but the path an attacker curated — so the escape hatch to the owner is the one thing a judge can never veto, and a judge's stated *reasons* are picked from a fixed, shell-owned menu, never written as prose. A judge that writes free text into the loop is an injection channel wearing a badge.
-
-One more rule closes the loop: transformations don't launder trust. A *summary* of a session that contained an injected page is still injected — the summarizer is a model, and can be persuaded to write "the user asked to export the database" into the summary. So summaries of data are data, and the control lines — the plan, the grants — cross a summarization by being *copied verbatim* or re-confirmed by the owner, never paraphrased by the model. Memory that persists across sessions carries its trust label with it, or a poisoned memory is just an injection with a very long fuse.
-
-## Operations: the rules you feel on Tuesday at 3 a.m.
-
-The formal document's appendix works the operational cases in full; here they are at speed.
-
-**The ledger, and the three-way distinction that keeps it honest.** Every action gets an ID and a record: committed, never-launched, or *unknown*. "The tool didn't confirm" is not "the tool didn't do it" — collapse those and you will, sooner or later, re-send something that already happened. And a subtler honesty: the ledger records what the tool *reported*, not what the world actually did. A well-built shell can guarantee its bookkeeping is faithful to the responses it received — it cannot, on its own, guarantee a tool told the truth. A tool that returns a clean "done!" for something it never did puts a clean "done!" in your ledger. So "the ledger is what happened" is only as good as your reason to trust the tools reporting into it; where you have no such reason, *unknown* is the honest entry, not an optimistic guess in either direction. The double-send bug has one reliable cure: **journal before dispatch.** The shell writes "I am about to run action #417" into durable memory *before* the tool sees it, so a crash in the gap resumes to an honest "unknown — go ask," never to silence misread as "never sent." Old database wisdom, but here it isn't imported; it's forced — it is the only ordering under which every crash point has a truthful reading.
-
-**Crashes aren't finishes.** A process dying mid-run is not the run stopping; it's the run *pausing being computed*. Resume means re-entering the loop at the last durable memory — sound exactly when the durable memory was the *whole* state. Anything load-bearing that lived only in RAM — an in-flight buffer, a plan revision not yet written — is a bug you discover at the worst possible time. Recovery is where you find out whether your state was really your state. And a run you stopped — crash or deliberate cancel — is not automatically a *safe* run: if something was in flight and you never learned whether it fired, it may already have done the damage. "We stopped in time" is only true when everything in flight resolved to something safe; an outstanding *unknown* has to be treated as possibly-bad, the same optimism the ledger warns against, one level up.
-
-**Two innocent actions can be guilty together.** Models emit several tool calls per turn. "Read the secret" passes review. "Post to the web" passes review. The pair is an exfiltration channel — so the gate authorizes the *set*, atomically, with the interactions checked, not each element in isolation.
-
-**Sub-agents are just fancy tools.** An agent that spawns another agent is, from the parent's chair, calling a tool: the spawn is gated, the budget is part of the deal, and the child's whole run comes back as one result carrying the child's ledger. Two laws travel down the tree: budgets subdivide, and **authority only narrows** — a child holds at most a subset of its parent's permissions, and a child's request beyond those grants routes *up*, ultimately to the owner, because a parent inventing an approval it never held is the tricked-judge case wearing a manager's badge. A corollary worth framing: a *fully autonomous* run is one whose owner is unreachable — meaning the only channel that can ever widen anything is closed, and its permissions are frozen at launch. That is not a limitation of the theory. That is what the word "autonomous" costs.
-
-**Keep the originals.** When the transcript outgrows the prompt and you summarize it down, deleting the original is an irreversible act against your own state — and irreversible acts are gate decisions, self-directed or not. Keep originals content-addressed; let the summary be an index, re-derivable, auditable. A summary you can check against its source is a note. A summary that replaced its source is a fait accompli.
-
-## Robots that never clock out — and robots that assign their own work
-
-Everything so far assumed a job that *ends*: you ask, the robot does it, you read the result. Two steps past that are where the interesting failures live, and they're the same idea one level bigger each time.
-
-**The robot that never clocks out (a daemon).** A monitor, a coordinator, a service — it isn't supposed to finish; it's supposed to keep going, wake on events, do a bit of work, go back to waiting. The clean way to think about it: each wake-work-rest cycle is one ordinary run, and the daemon is just those runs chained end to end forever. That reframing is free — but it comes with a bill nobody likes. **Safety that's fine per cycle rots over many cycles.** A 99.99%-safe cycle sounds bulletproof; run it ten thousand times and you're at about a coin-flip of having touched the danger zone at least once. So a long-running robot's safety isn't a fixed wall, it's a slow leak — which means the antidote isn't a better wall, it's *scheduled resets*: the owner re-confirming, credentials rotating, memory getting audited and re-summarized against the originals. Housekeeping isn't housekeeping; it's the thing that keeps the safety math from decaying. And the slow-leak logic is exactly where slow attacks live — a poisoned note dropped into memory on Monday and read back into the plan on Friday is an injection with a long fuse. So the trust label on a piece of information has to survive across cycles, not just within one. One more wrinkle: a daemon drifts in and out of your reach. While you're around, it can escalate to you; while you're not, "escalate to the owner" isn't available — so the one thing it must always be able to do instead is *stop*. A robot that can be tricked into refusing everything, and can't reach you, had better be able to halt rather than be steered.
-
-**The robot that assigns its own work (the loop).** Step back one more time. Above the robot that *does* a task sits a system that decides *which task is next* — scans the backlog, picks one, launches the robot at it, checks the result, remembers, fires again. This is the thing people mean in 2026 when they say they've stopped prompting their agents and started writing *loops* that prompt them: you design the assigner once, and it runs the doer for you while you sleep. The honest observation — and the reason this document bothers with it — is that the assigner is *not a new kind of thing*. It's the same harness, one level up: it has its own memory (the backlog), its own gate (**who let the loop refactor the auth module at 3 a.m.?**), its own verifier, and its own two walls. Every rule from the inner robot recurs on the outer one — including the uncomfortable ones. There's still no proof it stays out of trouble over a long night; there's only a measured progress meter, with the same catch that a *learned* meter can be fooled. And the origin story of the whole trend is the cautionary case in miniature: the famous first version was literally the same prompt in a `while` loop until the tests passed — which is the empty gate, the always-open lock, one level up. It works beautifully right up until the tests weren't checking the thing that mattered. The loop doesn't delete the hard problems. It moves them up a floor, where they're bigger and you're further away.
-
-The pattern, if you want the whole thing in one line: *words, context, robot, loop* are four sizes of the same object, and every promise in this document lives in the whole assembled thing — never in any one layer by itself.
-
-## The two walls
-
-Two limits are structural. You don't fix them with a better harness; you design around them.
-
-**The desk.** The model can hold only so much *in mind at once* — the context window. Files, databases, and search extend what it can *look up*, not what it can hold: every lookup still passes through the same small window to touch actual computation. The shell can page; the model cannot grow its desk. Tasks whose irreducible working set exceeds the desk don't fail loudly — they fail by forgetting the middle (the well-documented "lost in the middle" effect is this wall showing through the paint).
-
-**The dictionary.** The model's knowledge is frozen into its parameters at training time — and the proof problem above is conjectured to live at that same scale: the certificate wouldn't fit anywhere smaller than the brain it certifies. The two walls trade against each other along the training-versus-inference axis — bigger dictionary or bigger desk — directionally, and at no clean exchange rate.
-
-## How this could be wrong
-
-This is a hypothesis, and it says out loud what would kill it. The tests, in plain terms:
-
- **The replay test.** Rerun with model answers and tool results pinned. Any leftover variation — timestamps, wall-clocks, and cache expiries are the classic leaks — falsifies "the harness adds no randomness" until accounted for.
- **The drop-a-variable test.** Remove something from memory; if behavior statistics shift, the memory wasn't complete. The crash-resume version of the same test: if resuming from saved state breaks, the saved state wasn't the state.
- **Does the meter mean anything?** If no reasonable progress meter's drift predicts real failures — across the natural families, not just one bad candidate — the whole "measure what you can't prove" program is empty.
- **The red-team test.** Swap sampled tool outputs for worst-case ones: injected pages, poisoned metadata, malformed replies. The design must survive the worst permitted world, not the average one.
- **Gates versus begging.** The theory predicts deterministic gating beats prompt-level pleading. If "please be careful" alone matches real gates on security outcomes, the controller-versus-model story is wrong.
- **The compression hunt.** Exhibit a compact, provably sound progress certificate for a frontier-scale model on a nontrivial task family, and the central conjecture falls — constructively.
- **The desk probe.** Take a task family with a *proven* memory floor — so "it needed the whole picture at once" is someone else's theorem, not our excuse — scale it past the window, and watch: the wall predicts a *ceiling*, not a cliff — past the boundary, a success rate that stays capped no matter how many retries you buy. A family solved reliably out there, without new shell tricks for splitting the work, kills the wall.
-
-## Who else landed here
-
-The formal document keeps three honesty tiers. **Borrowed**: real theorems, cited — the drift and stopping-time mathematics is classical, and the very architecture of a deterministic supervisor gating a plant it didn't author is 1987 control theory; the shape is older than the web. **Ours**: the modeling choices and the conjectures — the walls, the incompressibility claim, the design rules — organizing principles, not results. **Corroborated**: pieces of the same object reached independently by people who never saw this framing — capability-security work isolating control flow from untrusted data (CaMeL), reinforcement-learning "shields" filtering a learned policy's actions through a deterministic checker, verification work that states the "learned safeguards can't certify" gap as its opening motivation, and architecture patterns converging on plan-then-execute. Even the field's live disagreement — provable-but-rigid deterministic layers versus flexible-but-uncertifiable learned checks — is, in this frame, not a fight but a placement: you need both, on their proper sides of the irreversibility line, with the learned one permitted only to tighten.
-
-## What to remember
-
-The model proposes; the gate disposes. No is the default, and a refusal must be safe. Only the top of the trust hierarchy widens permissions — a human decision, never the model, a tool result, a summary, or a judge. "Didn't confirm" is not "didn't happen." The desk is finite and the proof doesn't compress, so you measure — and you say *measurement* when you mean measurement. A robot that never stops leaks safety slowly, so it needs scheduled resets — and when it can't reach you, it must be able to stop. A loop that runs robots for you is just a bigger robot with the same rules and a further-away owner. And all of it is a hypothesis wearing its own kill-conditions on its sleeve.
-
-The formal version — the objects, the certificates, the falsifiers, the citations — is [HYPOTHESIS.md](HYPOTHESIS.md). It wins every disagreement with this file, including this sentence.
-
-*Same ramblings, fewer symbols.*
@@ -5,7 +5,6 @@
 [![Python](https://img.shields.io/pypi/pyversions/turnstone)](https://pypi.org/project/turnstone/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![Discord](https://img.shields.io/badge/Discord-join%20us-5865F2?logo=discord&logoColor=white)](https://discord.gg/Nh3bWMacaq)
-[![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-db61a2?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/eous)

 Self-hosted, local-first orchestration for tool-using AI agents. Give LLMs real tools — shell, files, search, web — and run them across your own cluster with direct HTTP routing and interactive interfaces. Your code, your models, your data stay on hardware you control: no telemetry, no phone-home.

@@ -21,7 +20,7 @@ Named after the [Ruddy Turnstone](https://en.wikipedia.org/wiki/Ruddy_turnstone)
 ℋ :  s_{n+1} ~ T(s_n)   for n < τ*,    T = ρ ∘ (M_W ∘ π, E)
 ```

-[**the primer →**](PRIMER.md)
+[**the hypothesis →**](HYPOTHESIS.md)

 ### Release Tracks

@@ -172,14 +171,6 @@ UML diagrams in [`docs/diagrams/`](docs/diagrams/):
 - Optional: Discord / Slack channel integrations (`pip install turnstone[discord,slack]`)
 - [Git LFS](https://git-lfs.com/) for cloning (diagram PNGs)

-## Support
-
-Turnstone is free, Apache-2.0, and self-hosted — no paid tier, no telemetry, no upsell. If it saves you time or you'd like to help keep development moving, you can sponsor the project:
-
-**[❤ Sponsor Turnstone →](https://github.com/sponsors/eous)**  ·  one-off via **[PayPal](https://paypal.me/eousphoros)**
-
-Sponsorship is entirely optional and funds maintenance, new features, and infrastructure. Prefer to contribute in other ways? Filing issues, improving docs, and [pull requests](CONTRIBUTING.md) help just as much.
-
 ## Community

 Questions, ideas, or want to show what you're building? Join us on Discord:
@@ -948,7 +948,6 @@ All fields are optional. The body can be empty or an empty JSON object.
 | `name`          | string | Auto-generated workstream name                      |
 | `resumed`       | bool   | Whether a previous session was successfully resumed |
 | `message_count` | int    | Number of messages in the resumed session (0 if fresh) |
-| `initial_message_status` | string | Present ONLY when the workstream was created but its `initial_message` could not be delivered: `"queue_full"` (a raced live worker's interjection queue was at capacity — resend via `/send`; any uploads stay staged) or `"refused_closed"` (the workstream was closed mid-create). Absent whenever the message was dispatched. |

 **Error (limit reached):**

@@ -634,17 +634,8 @@ function tool (the model always searches). Citations from `url_citation`
 annotations are formatted as footnotes. Extended prompt cache retention
 (`prompt_cache_retention: "24h"`) is enabled for GPT-5.x models at no
 additional cost. Cached token counts are extracted from
-`usage.prompt_tokens_details.cached_tokens`. Unknown models get permissive
-defaults with `supports_vision=False` and use SearxNG for web search. The
-`openai-compatible` lane never consults this table at all — on either API
-surface (the responses pin is served by a compat-mode
-`OpenAIResponsesProvider`, mirroring `AnthropicProvider(compat=True)`): a
-local server serves whatever the operator named it (vLLM
-`--served-model-name` is a free string), so a prefix collision with a cloud
-model id must not inherit that model's sampling/effort contract — every
-local model gets the plain defaults, and anything beyond them is declared on
-the model definition (capabilities JSON + `server_compat`), matching the
-`anthropic-compatible` lane.
+`usage.prompt_tokens_details.cached_tokens`. Unknown models (local servers) get
+permissive defaults with `supports_vision=False` and use SearxNG for web search.

 **AnthropicProvider** (`_anthropic.py`): converts OpenAI-format messages to
 Anthropic content blocks, maps `system`/`developer` roles to the `system`
@@ -807,105 +798,15 @@ model = "deepseek-ai/DeepSeek-V4-Flash"
 supports_vision = true                    # multimodal checkpoints only
 supports_mid_conversation_system = true   # template-dependent
 context_window = 131072
-thinking_mode = "manual"                  # session effort knob drives the template toggle
-thinking_param = "enable_thinking"        # Qwen/Gemma key; "thinking" for Granite/DeepSeek
 ```

-Reasoning control does NOT use Anthropic's `thinking` request param —
-the levers live in the chat template, reached through
-`chat_template_kwargs` in the request body. Two channels, dynamic first:
-
-* **Session effort knob (dynamic).** Set the model's thinking mode to
-  "Effort-knob controlled" in the admin Models form (or
-  `thinking_mode = "manual"` + `thinking_param` under
-  `[models.*.capabilities]`) and the provider maps the session's
-  reasoning-effort knob onto the template toggle per-request: effort
-  `none` sends `{<thinking_param>: false}`, any other level sends
-  `true` — the same contract as the real lane's manual mode. ("Always
-  on" / `thinking_mode = "adaptive"` instead always sends `true`: the
-  model self-regulates, so the knob never force-disables — mirroring
-  the native adaptive branch.) The graded effort value always rides
-  alongside the toggle: under `effort_param` when the operator names
-  the template's key, else under the conventional fallback key
-  (`reasoning_effort`) on the anthropic-compatible lane — the user's
-  effort setting always reaches the wire, and a template that doesn't
-  reference the kwarg ignores it. On the openai-compatible lane the
-  undeclared-key case rides the flat top-level `reasoning_effort`
-  param instead (the documented compat field), forwarded verbatim.
-  Optional `reasoning_effort_values` / `default_reasoning_effort`
-  validate the knob before it reaches the server; without declared
-  values the knob is forwarded as-is. The knob is ordinal, and validation
-  respects that: an off-list knob value rounds UP onto the declared
-  list and a value above the ceiling rides the ceiling
-  (`snap_reasoning_effort`) — asking for more effort than the model
-  declares never falls back to a lower default tier.  The knob's
-  `none` position is forwarded verbatim when the model declares an
-  explicit `none` level (gpt-5.1+, grok-4.3) — omitting it there would
-  leave a reasoning-on server default (e.g. gpt-5.5's `medium`) in
-  charge of a knob that promises off — and omitted otherwise; `none`
-  is never a snap target for other positions.
-  `default_reasoning_effort` only catches values the ordinal snap
-  cannot rank (custom strings). Declare values that match the
-  template's documented vocabulary: for DeepSeek-V4, which officially
-  accepts `high`/`max` (Think High is the default thinking tier;
-  `low`/`medium` alias to `high`, `xhigh` to `max`), a
-  `("high", "max")` values list reproduces the official aliasing
-  exactly — `low`/`medium` round up to `high`, `xhigh` to `max` —
-  and freeform passthrough matches it too. To map an undocumented
-  template, probe with per-request `chat_template_kwargs` and compare
-  `input_tokens`. Setting `effort_param` also suppresses the
-  flat top-level `reasoning_effort` request param on the
-  openai-compatible lane — the template channel replaces it, never
-  doubles it. With the default `thinking_mode = "none"` nothing is
-  injected and the server's template default decides.
-
-  Upgrade note: before 1.7.0a7 the openai-compatible lane sent the
-  toggle unconditionally `true` whenever thinking mode was enabled. A
-  stored per-model `reasoning_effort = "none"` now disables thinking
-  on such models — pick any real level (or clear the override) to keep
-  it on. Also since 1.7.0a7 the effort level itself always reaches the
-  wire on the local lanes (previously dropped unless
-  `reasoning_effort_values` was declared): flat `reasoning_effort` on
-  openai-compatible, the `effort_param`-or-fallback template key on
-  anthropic-compatible when reasoning control is engaged.
-* **Operator pin (static).** Entries under `{"chat_template_kwargs":
-  ...}` in the admin Models extra-body field ride the SDK's
-  `extra_body` unconditionally and win over the knob mapping on key
-  collision — e.g. pin `{"enable_thinking": true}` to keep thinking on
-  regardless of the session knob. (Server type and API surface remain
-  openai-compatible-only knobs and stay hidden for this provider.)
-
-The same knob mapping drives the `openai-compatible` lane's Chat
-Completions requests — `merge_reasoning_template_kwargs` is shared by
-both local-server lanes, so `thinking_mode`/`thinking_param`/
-`effort_param` mean the same thing whichever endpoint serves the model.
-Only the Responses API surface (native reasoning) ignores it.
-
-The console surfaces this projection as an *effective effort ladder*:
-the admin model form's per-model effort select and the skill
-launch-config effort select annotate each position with what the
-request will carry, in plain words — a position whose delivered level
-matches its name stays plain ("Max"), a snapped position says so
-("Low — sends high"), the adaptive lanes' none position warns
-"thinking stays on", and budget detail lives in the tooltip. A
-position is never labeled after a sibling that shares its wire (that
-rendered "Max (= minimal)", implying a downgrade the wire doesn't
-contain). Computed server-side by `providers/effort_ladder.py` from
-the same mapping functions the providers use at request time and
-shipped on `/v1/api/models` rows (every row carries `effort_ladder`,
-empty when the capabilities column fails to parse) and
-`POST /v1/api/admin/models/effort-ladder`. The ladder describes what
-Turnstone sends — a server-side template may alias further (DeepSeek-V4
-folds `low`/`medium` into its default `high` tier).
-
-The `anthropic-compatible` lane never sends Anthropic's native
-`thinking`/`output_config` params — they are not in vLLM's request
-schema. The real `anthropic` provider is unaffected: official Claude
-models keep native thinking, budget mapping, and `output_config`
-effort. A gateway fronting *real* Claude on a Messages-shaped URL
-(e.g. a LiteLLM `anthropic/` route to the Claude API) should use
-`provider = "anthropic"` with a custom `base_url`, which keeps the
-native thinking params.
+The reasoning toggle does NOT use Anthropic's `thinking` request param.
+Toggle it through the chat template instead: set `{"chat_template_kwargs":
+{"thinking": false}}` as extra body params in the admin Models
+server-compat section (for this provider the section shows only the
+extra-body field — server type, API surface, and thinking mode are
+openai-compatible-only knobs); the provider forwards it via the SDK's
+`extra_body`.

 Verified quirks of vLLM's Anthropic endpoint:

@@ -41,7 +41,6 @@ are set.
 | `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | `true` | Set to `false` to hide the password form and block all username/password logins (including admin). API tokens continue to work. |
 | `TURNSTONE_OIDC_REDIRECT_BASE` | Yes | — | Externally-reachable origin for the OIDC redirect URI (e.g. `https://app.example.com`). Without this, OIDC will refuse to start. The previous Host-header fallback was unsafe under permissive reverse proxies. |
 | `TURNSTONE_OIDC_TRUSTED_ENDPOINT_HOSTS` | No | — | Comma-separated list of additional hostnames whose endpoints the IdP discovery document is allowed to reference. See [Cross-host endpoints](#cross-host-endpoints). |
-| `TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK` | No | `false` | Allow the issuer (and its discovered endpoints) to resolve to private/internal addresses — needed for a self-hosted IdP on an internal network. See [Self-hosted and internal IdPs](#self-hosted-and-internal-idps). |

 All four required fields — issuer, client ID, client secret, and
 `TURNSTONE_OIDC_REDIRECT_BASE` — must be set. If any are missing OIDC
@@ -100,40 +99,6 @@ The same scheme / no-userinfo / SSRF rules apply to allow-listed hosts —
 this knob only relaxes the same-origin check, not the security gates.
 Each entry is a hostname (no scheme, no path).

-### Self-hosted and internal IdPs
-
-By default Turnstone refuses an issuer whose hostname resolves to a
-private or internal address:
-
-```
-OIDCError: endpoint URL resolves to non-public address (10.0.0.5): https://auth.example.site
-```
-
-This is SSRF hardening, not a licensing or product restriction: the OIDC
-flow makes server-side HTTP requests (discovery, JWKS, token exchange),
-and refusing non-public destinations keeps a mistyped or maliciously
-steered issuer from aiming those fetches at internal services. For a
-self-hosted IdP (Keycloak, Authentik, Dex, …) on a private network,
-opt in explicitly in `config.toml`:
-
-```toml
-[oidc]
-allow_private_network = true
-```
-
-or via `TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK=true` (the env var wins
-when both are set).
-
-The opt-in admits private-range (RFC 1918), unique-local, CGNAT
-(100.64/10 — tailnets), and loopback addresses. Link-local, multicast,
-and reserved ranges stay refused even with the opt-in — cloud metadata
-services (169.254.169.254) live there, and no legitimate IdP does. The
-HTTPS requirement and the same-origin endpoint checks are unaffected.
-
-This knob only affects the login-flow IdP configured here. OAuth
-endpoints advertised by remote MCP servers are untrusted input and are
-always held to the strict public-address rule.
-
 ### config.toml alternative

 ```toml
@@ -146,8 +111,6 @@ provider_name = "Google"
 role_claim = "groups"
 password_enabled = true
 redirect_base = "https://app.example.com"
-# Self-hosted IdP on an internal network (see "Self-hosted and internal IdPs")
-allow_private_network = false

 [oidc.role_map]
 admin = "builtin-admin"
@@ -118,37 +118,9 @@ seeded):
  `persona` argument, validated when the coordinator prepares the spawn
  and re-checked by the node that creates the child (children are always
  interactive-kind). Omitted means the interactive **default** — a child
-  never inherits its parent coordinator's persona.
- **Sub-agents**: `task_agent` takes a `persona` argument setting the
-  sub-agent's identity and capability envelope (resolved against
-  interactive-kind personas, frozen into the task at prep). Omitted keeps
-  the default autonomous task-agent identity — never the parent's persona.
-
-## How agents discover personas
-
-Agents are told, not expected to guess: the live persona list (enabled,
-interactive-kind — children and sub-agents are always interactive) is
-injected into the `persona` parameter description of `task_agent`,
-`spawn_workstream`, and `spawn_batch` whenever the session's tool surface
-is rendered — session start, MCP catalog change, model-registry reload.
-Each entry carries the name, the default marker, and the persona's
-one-line description so the model can pick by purpose (descriptions drop
-out past 25 personas; the name list always enumerates completely).
-
-A persona created after that render is still reachable — pass its name.
-Every resolve failure enumerates the names currently valid for the kind,
-so a stale list (or a typo) self-corrects on the next attempt.
-
-Resolution is forgiving on all surfaces (they share one rule):
-
- names match case-insensitively (`Writer` resolves `writer`);
- an input that uniquely matches a persona's **display name**
-  (case-insensitive, among the kind's enabled personas — display names are
-  not unique, and a same-label persona of another kind neither blocks nor
-  wins) resolves to that persona; an ambiguous match errors, listing the
-  candidate slugs;
- whatever variant matched, the stamped identity, approval chrome, and
-  wire always carry the canonical `name` slug.
+  never inherits its parent coordinator's persona. Sub-agents spawned via
+  `task_agent` have no persona parameter at all; they keep their own
+  identity and envelope.

 ## Authoring (console)

@@ -156,12 +128,7 @@ Personas are managed in the console's **Manage → Governance → Personas**
 tab. The admin shelf exposes exactly the four levers plus the kind
 list, the default marker, and archive. Rules:

- `name` is an immutable lowercase slug — and the identifier agents and
-  the CLI launch the persona by (`persona=` on the spawn tools,
-  `--persona` on the CLI); the create shelf says so under **Name**.
-  `display_name` is a list label, editable any time, and deliberately
-  not an identifier (a unique display name happens to resolve, as a
-  forgiveness fallback — don't design workflows around it).
+- `name` is an immutable lowercase slug; edit `display_name` instead.
 - Exactly one default per kind, storage-enforced: flipping the flag on a
  successor demotes the incumbent atomically, defaults are single-kind,
  and a default cannot be archived.
@@ -1,6 +1,6 @@
 # Tools Reference

-turnstone exposes 17 built-in tools plus any number of external MCP tools to the
+turnstone exposes 16 built-in tools plus any number of external MCP tools to the
 LLM via the OpenAI function-calling interface. Built-in tools are defined as JSON
 files under `turnstone/tools/` and loaded at startup by `turnstone/core/tools.py`.
 MCP tools are discovered from configured MCP servers at startup by
@@ -44,10 +44,10 @@ schema plus turnstone-specific metadata keys:

 | Name                | Description |
 |---------------------|-------------|
-| `TOOLS`             | All 29 loaded built-in tool definitions (interactive + coordinator union). Sessions send a kind-specific subset (`INTERACTIVE_TOOLS` or `COORDINATOR_TOOLS`). |
+| `TOOLS`             | All 28 loaded built-in tool definitions (interactive + coordinator union). Sessions send a kind-specific subset (`INTERACTIVE_TOOLS` or `COORDINATOR_TOOLS`). |
 | `TASK_AGENT_TOOLS`  | Tools with `task_agent: true` -- available to task sub-agents. Includes write operations. |
 | `TASK_AUTO_TOOLS`   | Set of all tool names with `auto_approve: true` -- used by task-agent sub-sessions to skip confirmation for matching available tools. |
-| `BUILTIN_TOOL_NAMES`| Frozenset of all 29 built-in tool names (interactive + coordinator union). Used by tool search to distinguish always-on tools from deferrable MCP tools. |
+| `BUILTIN_TOOL_NAMES`| Frozenset of all 28 built-in tool names (interactive + coordinator union). Used by tool search to distinguish always-on tools from deferrable MCP tools. |
 | `PRIMARY_KEY_MAP`   | Dict mapping tool name to its `primary_key` parameter name. |

 ---
@@ -65,7 +65,7 @@ Tool execution follows a three-phase pipeline inside `ChatSession._execute_tools
 - Parses the JSON arguments (with fallback for malformed JSON).
 - If JSON parsing fails entirely, uses `PRIMARY_KEY_MAP` to map a bare string
  to the correct parameter.
- Dispatches to the matching `_prepare_{func_name}()` handler. There are 17
+- Dispatches to the matching `_prepare_{func_name}()` handler. There are 16
  built-in tools plus `tool_search` (synthetic, client-side BM25 fallback) and
  the generic `_prepare_mcp_tool()` handler for MCP tools.
 - Validates arguments and builds a preview dict containing:
@@ -125,9 +125,6 @@ Each item's `execute` callable is invoked:
 - `web_fetch` -- fetches a URL (SSRF-protected, but makes network requests)
 - `web_search` -- web search via self-hosted SearxNG (makes network requests)
 - `task_agent` -- spawns an autonomous sub-agent
- `open_preview` -- **URL targets only** (network access, gated like `web_fetch`);
-  file-path and `attachment:` targets are local reads and run unprompted like
-  `read_file`

 Note: The JSON schema metadata key `auto_approve` controls membership in
 `TASK_AUTO_TOOLS` (used for task agent sub-sessions). The actual runtime
@@ -160,7 +157,6 @@ Every tool defines a `primary_key`. The mapping is:
 | `search`     | `query`     |
 | `web_fetch`  | `url`       |
 | `web_search` | `query`     |
-| `open_preview` | `target`  |
 | `task_agent` | `prompt`    |
 | `memory`     | `name`      |
 | `recall`     | `query`     |
@@ -289,7 +285,7 @@ Fetch a URL and extract specific information from it.
 | `url`      | string | yes      | The URL to fetch (must start with `http://` or `https://`). |
 | `question` | string | yes      | What to extract or answer from the page content. |

- **What it does**: Fetches the URL, strips HTML to plain text, and uses the LLM to extract the answer to the question from the page content. Every redirect hop is SSRF-screened before it is requested. Private/internal addresses are refused by default; enable `tools.allow_private_network` (console Settings → Tools) to make them approvable for self-hosted setups whose services live on the local network — the approval prompt marks such requests, and a public site redirecting into private space is refused regardless.
+- **What it does**: Fetches the URL, strips HTML to plain text, and uses the LLM to extract the answer to the question from the page content. Protected against SSRF (blocks private/internal IPs).
 - **Auto-approve**: No -- requires user confirmation (makes network requests).
 - **Agent availability**: `task_agent`.

@@ -349,39 +345,6 @@ It reports the score scale, whether the endpoint cleanly separates relevant from

 ---

-### open_preview
-
-Show the user rich content in a preview pane beside the conversation.
-
-| Parameter | Type   | Required | Description |
-|-----------|--------|----------|-------------|
-| `target`  | string | yes      | An http(s) URL, a file path, or `attachment:<id>` for a file attached to the conversation. |
-| `kind`    | string | no       | Rendering override: `web`, `pdf`, `image`, `table`, `text`, or `markdown`. Detected from the content when omitted. |
-| `title`   | string | no       | Pane header title. Defaults to the page title, filename, or URL. |
-
- **What it does**: Resolves the target to bytes (URLs fetch through the same
-  SSRF-guarded path as `web_fetch`, screened per redirect hop, honoring the
-  same `tools.allow_private_network` opt-in), classifies the
-  content, stores it content-addressed against the workstream, and opens the
-  frontend preview pane beside the conversation: web pages render in a fully
-  sandboxed iframe (no scripts, opaque origin), PDFs in the browser viewer,
-  images inline, CSV/TSV/JSON as a sortable table, text/markdown rendered. A
-  previewed web page loads none of its remote images or styles by default, so
-  opening it never reveals the viewer to the page's site; a toggle in the pane
-  header turns remote content back on for that preview. The
-  model receives only a one-line confirmation — to reason about content, use
-  `web_fetch` / `read_file` instead. Preview content is size-capped per kind
-  (pages 4 MB, PDFs 32 MB, images 4 MB, tables 2 MB, text 512 KB) and GC'd
-  with the workstream.
- **Auto-approve**: URL targets require confirmation (network access); file
-  paths and `attachment:` targets run unprompted (local reads).
- **Agent availability**: interactive sessions only (not `task_agent`, not
-  coordinators).
- **Surfaces**: the pane renders in the web UI (standalone and console). The
-  CLI prints the confirmation line only — there is no terminal pane.
-
---
-
 ## Agent

 The tool name uses the `_agent` suffix — bare `task` collides with
@@ -582,7 +545,6 @@ pre-configure skills at workstream creation.
 | `search`     | File Ops   | Yes          | Yes        | `query`     |
 | `web_fetch`  | Info       | No           | Yes        | `url`       |
 | `web_search` | Info       | No           | Yes        | `query`     |
-| `open_preview`| Info      | URL: no; path/attachment: yes | No | `target` |
 | `task_agent` | Agent      | No           | No         | `prompt`    |
 | `memory`     | Memory     | Yes          | No         | `name`      |
 | `recall`     | Memory     | Yes          | No         | `query`     |
@@ -692,7 +654,7 @@ MCP-compatible service.
 3. **Schema conversion**: Each MCP tool's `inputSchema` is converted to OpenAI
   function-calling format. The tool name is prefixed: `mcp__{server}__{tool}`.

-4. **Merging**: MCP tools are appended after the 17 built-in tools via
+4. **Merging**: MCP tools are appended after the 16 built-in tools via
   `merge_mcp_tools()`. Built-in tools appear first, giving them natural LLM priority.
   When dynamic tool search is active, MCP tools are deferred rather than directly
   visible -- the model discovers them via search as needed (see
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"

 [project]
 name = "turnstone"
-version = "1.7.3"
+version = "1.7.0a6"
 description = "Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."
 readme = "README.md"
 license = "Apache-2.0"
@@ -23,7 +23,7 @@ classifiers = [
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
 ]
 dependencies = [
-    "openai>=2.44",  # GPT-5.6 (Sol/Terra/Luna): Responses reasoning.mode + effort "max" + text.verbosity
+    "openai>=2.37",
    "anthropic>=0.108",  # claude-fable-5 support; hard runtime floor is 0.105 (mid-conversation system blocks)
    "httpx>=0.28",
    "mcp>=1.27,<2",  # v2 is a breaking rewrite (2.0.0a1 live 2026-06-11; stable ~2026-07-27) — streamablehttp_client removed, 2-tuple transport, snake_case types; migrate deliberately
@@ -2,7 +2,7 @@
  "openapi": "3.1.0",
  "info": {
    "title": "turnstone Console API",
-    "version": "1.7.0rc1",
+    "version": "1.7.0a6",
    "description": "Cluster-wide visibility and control across all turnstone nodes."
  },
  "paths": {
@@ -6688,7 +6688,7 @@
        "tags": [
          "Coordinator"
        ],
-        "description": "Aggregates the persisted row, a best-effort live block from the owning node (or the in-process coordinator manager for ``kind=\"coordinator\"`` rows), and the tail of the message history.  Gated on the ``admin.cluster.inspect`` permission (granted to ``builtin-admin`` via migration 040; revoke or reassign to a custom role for tighter control).  A workstream attached to a *private* project stays confidential to its members: a permitted caller who isn't its owner / creator / project member gets a 404 (same masking as an unknown id).  ``live`` is null on node unreachability / 5xx so callers can degrade gracefully.",
+        "description": "Aggregates the persisted row, a best-effort live block from the owning node (or the in-process coordinator manager for ``kind=\"coordinator\"`` rows), and the tail of the message history.  Gated on the ``admin.cluster.inspect`` permission (granted to ``builtin-admin`` via migration 040; revoke or reassign to a custom role for tighter control).  ``live`` is null on node unreachability / 5xx so callers can degrade gracefully.",
        "parameters": [
          {
            "name": "ws_id",
@@ -11201,7 +11201,6 @@
              }
            ],
            "default": null,
-            "description": "Inline BASE override \u2014 required. Every persona must name a prompt source; built-in file-backed personas are seeded by migration, not created here, so an operator-created persona must supply base_prompt.",
            "title": "Base Prompt"
          },
          "tool_allowlist": {
@@ -11260,7 +11259,7 @@
        "type": "object"
      },
      "UpdatePersonaRequest": {
-        "description": "PATCH body \u2014 absent fields are left unchanged.\n\nExplicit ``null`` resets ``tool_allowlist`` to unrestricted, and \u2014 on a\nBUILT-IN persona only \u2014 clears ``base_prompt`` (the operator override),\nreverting to that persona's file-backed prompt.  An OPERATOR persona has no\nfallback source, so ``base_prompt: null`` on one is rejected: every persona\nmust name a prompt source.  ``null`` on the boolean flags or\n``applies_to_kinds`` is ignored (treated as absent), so a client serializing\nunset optionals as null cannot archive a persona or flip levers by accident.\n\nArchive = ``{\"enabled\": false}``; default flip = ``{\"is_default\": true}``\non the successor (storage demotes the incumbent atomically).  ``name``\nis immutable; existing workstreams are never affected by edits.",
+        "description": "PATCH body \u2014 absent fields are left unchanged.\n\nExplicit ``null`` is meaningful only on the two resettable fields:\n``base_prompt: null`` clears the override back to the kind's stock\nBASE, and ``tool_allowlist: null`` resets to unrestricted.  ``null``\non the boolean flags or ``applies_to_kinds`` is ignored (treated as\nabsent), so a client serializing unset optionals as null cannot\narchive a persona or flip levers by accident.\n\nArchive = ``{\"enabled\": false}``; default flip = ``{\"is_default\": true}``\non the successor (storage demotes the incumbent atomically).  ``name``\nis immutable; existing workstreams are never affected by edits.",
        "properties": {
          "display_name": {
            "anyOf": [
@@ -13306,17 +13305,21 @@
          },
          "pending_approval": {
            "default": false,
-            "description": "True when at least one approval cycle is live (a gate thread parked awaiting an operator approve/deny).  Mirrors the same field on ``DashboardWorkstream`` / cluster live projections so a freshly-loaded chat tab can render the inline approval gate from the detail snapshot before SSE replay arrives.",
+            "description": "True when the workstream is parked on ``_approval_event`` awaiting an operator approve/deny.  Mirrors the same field on ``DashboardWorkstream`` / cluster live projections so a freshly-loaded chat tab can render the inline approval gate from the detail snapshot before SSE replay arrives.",
            "title": "Pending Approval",
            "type": "boolean"
          },
-          "pending_approval_details": {
-            "description": "Inline approval payloads, one per live cycle, oldest first \u2014 same shape as ``DashboardWorkstream.pending_approval_details``.  Empty when no approval is pending.  Lets a reload paint every action row + judge verdicts immediately instead of relying on the SSE approve_request replay timing window.  Replaces 1.6's ``pending_approval_detail`` single-object field (breaking, 1.7).",
-            "items": {
-              "$ref": "#/components/schemas/PendingApprovalDetail"
-            },
-            "title": "Pending Approval Details",
-            "type": "array"
+          "pending_approval_detail": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PendingApprovalDetail"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "description": "Inline approval payload \u2014 same shape as ``DashboardWorkstream.pending_approval_detail``.  ``None`` when no approval is pending.  Lets a reload paint the action row + judge verdicts immediately instead of relying on the SSE approve_request replay timing window."
          }
        },
        "required": [
@@ -13329,14 +13332,8 @@
        "type": "object"
      },
      "PendingApprovalDetail": {
-        "description": "Inline approval payload merged into ``DashboardWorkstream``.\n\nOne entry per live approval CYCLE \u2014 a gate thread parked in\n``approve_tools`` awaiting the operator.  Parallel task agents run\nconcurrent gates, so a workstream can have several of these at\nonce (``pending_approval_details``, oldest first).  Cross-tenant\nexposure here follows the same trusted-team posture as\n``activity`` / ``tokens`` \u2014 see ``server.py``'s ``dashboard``\nhandler comment.",
+        "description": "Inline approval payload merged into ``DashboardWorkstream``.\n\nSet when a workstream's ``approve_tools`` is parked on\n``_approval_event``; ``None`` (omitted) otherwise. Cross-tenant\nexposure here follows the same trusted-team posture as\n``activity`` / ``tokens`` \u2014 see ``server.py``'s ``dashboard``\nhandler comment.",
        "properties": {
-          "cycle_id": {
-            "default": "",
-            "description": "Identity of this approval cycle.  Echo it back on ``POST /v1/api/workstreams/{ws_id}/approve`` to resolve exactly this round \u2014 required for correctness when several cycles are live (parallel task agents).",
-            "title": "Cycle Id",
-            "type": "string"
-          },
          "call_id": {
            "default": "",
            "description": "Primary call_id \u2014 first non-empty call_id in items list order. Matches the 409 ``current_call_id`` response from ``POST /v1/api/workstreams/{ws_id}/approve`` so the UI can render the same identifier the server reports as current.",
@@ -13361,7 +13358,7 @@
        "type": "object"
      },
      "PendingApprovalItem": {
-        "description": "One pending tool-call inside a ``PendingApprovalDetail`` envelope.\n\nMirrors the dict ``SessionUIBase.serialize_pending_approval_details``\nemits per item inside each cycle entry. ``heuristic_verdict`` / ``judge_verdict`` are kept\nloosely-typed because the underlying verdict shape varies by tier;\nconsumers that want the full structure can decode against\n:class:`turnstone.sdk.events.IntentVerdictEvent`.",
+        "description": "One pending tool-call inside a ``PendingApprovalDetail`` envelope.\n\nMirrors the dict ``SessionUIBase.serialize_pending_approval_detail``\nemits per item. ``heuristic_verdict`` / ``judge_verdict`` are kept\nloosely-typed because the underlying verdict shape varies by tier;\nconsumers that want the full structure can decode against\n:class:`turnstone.sdk.events.IntentVerdictEvent`.",
        "properties": {
          "call_id": {
            "default": "",
@@ -2,7 +2,7 @@
  "openapi": "3.1.0",
  "info": {
    "title": "turnstone Server API",
-    "version": "1.7.0rc1",
+    "version": "1.7.0a6",
    "description": "Single-node workstream management, chat interaction, and real-time streaming."
  },
  "paths": {
@@ -2564,23 +2564,6 @@
            },
            "title": "Attachment Ids",
            "type": "array"
-          },
-          "initial_message_status": {
-            "anyOf": [
-              {
-                "enum": [
-                  "queue_full",
-                  "refused_closed"
-                ],
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "description": "Present ONLY when the workstream was created but its initial_message could not be delivered: 'queue_full' (a raced live worker's interjection queue was at capacity \u2014 resend via /send; any uploads stay staged) or 'refused_closed' (the workstream was closed mid-create). Absent whenever the message was dispatched.",
-            "title": "Initial Message Status"
          }
        },
        "required": [
@@ -2709,17 +2692,21 @@
          },
          "pending_approval": {
            "default": false,
-            "description": "True when at least one approval cycle is live (a gate thread parked awaiting an operator approve/deny).  Mirrors the same field on ``DashboardWorkstream`` / cluster live projections so a freshly-loaded chat tab can render the inline approval gate from the detail snapshot before SSE replay arrives.",
+            "description": "True when the workstream is parked on ``_approval_event`` awaiting an operator approve/deny.  Mirrors the same field on ``DashboardWorkstream`` / cluster live projections so a freshly-loaded chat tab can render the inline approval gate from the detail snapshot before SSE replay arrives.",
            "title": "Pending Approval",
            "type": "boolean"
          },
-          "pending_approval_details": {
-            "description": "Inline approval payloads, one per live cycle, oldest first \u2014 same shape as ``DashboardWorkstream.pending_approval_details``.  Empty when no approval is pending.  Lets a reload paint every action row + judge verdicts immediately instead of relying on the SSE approve_request replay timing window.  Replaces 1.6's ``pending_approval_detail`` single-object field (breaking, 1.7).",
-            "items": {
-              "$ref": "#/components/schemas/PendingApprovalDetail"
-            },
-            "title": "Pending Approval Details",
-            "type": "array"
+          "pending_approval_detail": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PendingApprovalDetail"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "description": "Inline approval payload \u2014 same shape as ``DashboardWorkstream.pending_approval_detail``.  ``None`` when no approval is pending.  Lets a reload paint the action row + judge verdicts immediately instead of relying on the SSE approve_request replay timing window."
          }
        },
        "required": [
@@ -2732,14 +2719,8 @@
        "type": "object"
      },
      "PendingApprovalDetail": {
-        "description": "Inline approval payload merged into ``DashboardWorkstream``.\n\nOne entry per live approval CYCLE \u2014 a gate thread parked in\n``approve_tools`` awaiting the operator.  Parallel task agents run\nconcurrent gates, so a workstream can have several of these at\nonce (``pending_approval_details``, oldest first).  Cross-tenant\nexposure here follows the same trusted-team posture as\n``activity`` / ``tokens`` \u2014 see ``server.py``'s ``dashboard``\nhandler comment.",
+        "description": "Inline approval payload merged into ``DashboardWorkstream``.\n\nSet when a workstream's ``approve_tools`` is parked on\n``_approval_event``; ``None`` (omitted) otherwise. Cross-tenant\nexposure here follows the same trusted-team posture as\n``activity`` / ``tokens`` \u2014 see ``server.py``'s ``dashboard``\nhandler comment.",
        "properties": {
-          "cycle_id": {
-            "default": "",
-            "description": "Identity of this approval cycle.  Echo it back on ``POST /v1/api/workstreams/{ws_id}/approve`` to resolve exactly this round \u2014 required for correctness when several cycles are live (parallel task agents).",
-            "title": "Cycle Id",
-            "type": "string"
-          },
          "call_id": {
            "default": "",
            "description": "Primary call_id \u2014 first non-empty call_id in items list order. Matches the 409 ``current_call_id`` response from ``POST /v1/api/workstreams/{ws_id}/approve`` so the UI can render the same identifier the server reports as current.",
@@ -2764,7 +2745,7 @@
        "type": "object"
      },
      "PendingApprovalItem": {
-        "description": "One pending tool-call inside a ``PendingApprovalDetail`` envelope.\n\nMirrors the dict ``SessionUIBase.serialize_pending_approval_details``\nemits per item inside each cycle entry. ``heuristic_verdict`` / ``judge_verdict`` are kept\nloosely-typed because the underlying verdict shape varies by tier;\nconsumers that want the full structure can decode against\n:class:`turnstone.sdk.events.IntentVerdictEvent`.",
+        "description": "One pending tool-call inside a ``PendingApprovalDetail`` envelope.\n\nMirrors the dict ``SessionUIBase.serialize_pending_approval_detail``\nemits per item. ``heuristic_verdict`` / ``judge_verdict`` are kept\nloosely-typed because the underlying verdict shape varies by tier;\nconsumers that want the full structure can decode against\n:class:`turnstone.sdk.events.IntentVerdictEvent`.",
        "properties": {
          "call_id": {
            "default": "",
@@ -3023,13 +3004,17 @@
            "default": null,
            "title": "Project Id"
          },
-          "pending_approval_details": {
-            "description": "Inline approval payload for the coordinator children-tree UI: EVERY live approval cycle, oldest first \u2014 parallel task agents gate concurrently, so a workstream can hold several prompts at once.  Each entry carries the cycle's items + per-call_id LLM verdict cache so a coord can render approve/deny buttons + judge pill without a separate per-child round-trip; resolve each with its ``cycle_id``.  Empty when no approval is pending.  Also surfaced (verbatim) on ``GET /v1/api/cluster/ws/live`` via the ``_CLUSTER_WS_LIVE_KEYS`` projection.  Replaces 1.6's ``pending_approval_detail`` single-object field (breaking, 1.7).",
-            "items": {
-              "$ref": "#/components/schemas/PendingApprovalDetail"
-            },
-            "title": "Pending Approval Details",
-            "type": "array"
+          "pending_approval_detail": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PendingApprovalDetail"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "description": "Inline approval payload for the coordinator children-tree UI. Carries the merged ``_pending_approval`` items list + per-call_id LLM verdict cache so a coord can render approve/deny buttons + judge pill without a separate per-child round-trip. ``None`` when no approval is pending. Also surfaced (verbatim) on ``GET /v1/api/cluster/ws/live`` via the ``_CLUSTER_WS_LIVE_KEYS`` projection."
          },
          "recent_auto_approvals": {
            "description": "Per-ws ring buffer (cap 10) of recent tool calls that bypassed the operator approval gate. Surfaces ``WebUI._recent_auto_approvals`` so the coord-tree row can render an 'auto-approved by ...' pill when the child's skill / blanket / admin-policy rules silently let a tool through. Also projected onto ``GET /v1/api/cluster/ws/live`` via ``_CLUSTER_WS_LIVE_KEYS``.",
@@ -409,16 +409,16 @@
      "license": "MIT"
    },
    "node_modules/@vitest/expect": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
-      "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
+      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@standard-schema/spec": "^1.1.0",
        "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
        "chai": "^6.2.2",
        "tinyrainbow": "^3.1.0"
      },
@@ -427,13 +427,13 @@
      }
    },
    "node_modules/@vitest/mocker": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
-      "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
+      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@vitest/spy": "4.1.10",
+        "@vitest/spy": "4.1.9",
        "estree-walker": "^3.0.3",
        "magic-string": "^0.30.21"
      },
@@ -454,9 +454,9 @@
      }
    },
    "node_modules/@vitest/pretty-format": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
-      "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -467,13 +467,13 @@
      }
    },
    "node_modules/@vitest/runner": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
-      "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
+      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@vitest/utils": "4.1.10",
+        "@vitest/utils": "4.1.9",
        "pathe": "^2.0.3"
      },
      "funding": {
@@ -481,14 +481,14 @@
      }
    },
    "node_modules/@vitest/snapshot": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
-      "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
+      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@vitest/pretty-format": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/utils": "4.1.9",
        "magic-string": "^0.30.21",
        "pathe": "^2.0.3"
      },
@@ -497,9 +497,9 @@
      }
    },
    "node_modules/@vitest/spy": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
-      "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
      "dev": true,
      "license": "MIT",
      "funding": {
@@ -507,13 +507,13 @@
      }
    },
    "node_modules/@vitest/utils": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
-      "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@vitest/pretty-format": "4.1.10",
+        "@vitest/pretty-format": "4.1.9",
        "convert-source-map": "^2.0.0",
        "tinyrainbow": "^3.1.0"
      },
@@ -949,9 +949,9 @@
      "license": "ISC"
    },
    "node_modules/picomatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -1122,9 +1122,9 @@
      }
    },
    "node_modules/vite": {
-      "version": "8.1.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
-      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
+      "version": "8.1.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.2.tgz",
+      "integrity": "sha512-6YYPbRXTxx6bRXmOn7XdnQAy5DQNHhDgtjhDHI13oe4pY93kkcdGJWxpGwOm++/Wh0QpQhDrpIoVMrmrsI5AGQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1200,19 +1200,19 @@
      }
    },
    "node_modules/vitest": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
-      "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
+      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@vitest/expect": "4.1.10",
-        "@vitest/mocker": "4.1.10",
-        "@vitest/pretty-format": "4.1.10",
-        "@vitest/runner": "4.1.10",
-        "@vitest/snapshot": "4.1.10",
-        "@vitest/spy": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/expect": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/runner": "4.1.9",
+        "@vitest/snapshot": "4.1.9",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
        "es-module-lexer": "^2.0.0",
        "expect-type": "^1.3.0",
        "magic-string": "^0.30.21",
@@ -1240,12 +1240,12 @@
        "@edge-runtime/vm": "*",
        "@opentelemetry/api": "^1.9.0",
        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.10",
-        "@vitest/browser-preview": "4.1.10",
-        "@vitest/browser-webdriverio": "4.1.10",
-        "@vitest/coverage-istanbul": "4.1.10",
-        "@vitest/coverage-v8": "4.1.10",
-        "@vitest/ui": "4.1.10",
+        "@vitest/browser-playwright": "4.1.9",
+        "@vitest/browser-preview": "4.1.9",
+        "@vitest/browser-webdriverio": "4.1.9",
+        "@vitest/coverage-istanbul": "4.1.9",
+        "@vitest/coverage-v8": "4.1.9",
+        "@vitest/ui": "4.1.9",
        "happy-dom": "*",
        "jsdom": "*",
        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -75,35 +75,15 @@ export interface ToolInfoEvent {
  items: Array<Record<string, unknown>>;
 }

-/** One approval CYCLE awaiting the operator.  Several can be outstanding
- *  at once (parallel task agents each gate their own tool calls) — key
- *  prompt UI by `cycle_id` and echo it back on the approve POST.
- *
- *  `cycle_id` is optional because it was added in 1.7: a pre-1.7 server
- *  omits it on the wire, so a current SDK talking to an older node sees
- *  `undefined`.  Resolve those the legacy way (no selector → oldest
- *  cycle). A current server always sends it. */
 export interface ApproveRequestEvent {
  type: "approve_request";
-  cycle_id?: string;
  items: Array<Record<string, unknown>>;
-  judge_pending?: boolean;
 }

-/** A specific approval cycle resolved; `cycle_id`/`call_ids` identify
- *  which prompt to dismiss.
- *
- *  Both are optional for the same reason as `ApproveRequestEvent.cycle_id`
- *  — a pre-1.7 server emits neither, so a bare "something resolved"
- *  dismisses the sole tracked prompt (the legacy fallback the UI and
- *  channel adapters keep). A current server always sends both. */
 export interface ApprovalResolvedEvent {
  type: "approval_resolved";
  approved: boolean;
  feedback: string;
-  always?: boolean;
-  cycle_id?: string;
-  call_ids?: string[];
 }

 export interface ToolResultEvent {
@@ -166,13 +166,6 @@ export class TurnstoneServer extends BaseClient {
    approved?: boolean;
    feedback?: string | null;
    always?: boolean;
-    /** Resolve exactly this approval cycle (from ApproveRequestEvent.cycle_id).
-     *  Omitting it resolves the OLDEST live cycle — ambiguous when parallel
-     *  task agents have several prompts outstanding, so pass it whenever the
-     *  triggering event is known. */
-    cycleId?: string;
-    /** Alternative selector: any call_id inside the target cycle. */
-    callId?: string;
  }): Promise<StatusResponse> {
    return this.request(
      "POST",
@@ -182,8 +175,6 @@ export class TurnstoneServer extends BaseClient {
          approved: opts.approved ?? true,
          feedback: opts.feedback,
          always: opts.always,
-          cycle_id: opts.cycleId,
-          call_id: opts.callId,
        },
      },
    );
@@ -164,13 +164,6 @@ export interface CreateWorkstreamResponse {
  message_count?: number;
  /** Ids of attachments saved by this request (multipart variant only). */
  attachment_ids?: string[];
-  /**
-   * Present ONLY when the workstream was created but its initial_message
-   * could not be delivered: "queue_full" (raced live worker's interjection
-   * queue at capacity — resend via /send; uploads stay staged) or
-   * "refused_closed" (workstream closed mid-create).
-   */
-  initial_message_status?: "queue_full" | "refused_closed";
 }

 export interface CloseWorkstreamRequest {
@@ -104,6 +104,7 @@ describe("TurnstoneServer attachments", () => {
    const [, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
    expect(JSON.parse(init.body)).toEqual({
      message: "hi",
+      ws_id: "ws-X",
      attachment_ids: ["a1", "a2"],
    });
  });
@@ -116,7 +117,7 @@ describe("TurnstoneServer attachments", () => {
    });
    await client.send("hi", "ws-X");
    const [, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
-    expect(JSON.parse(init.body)).toEqual({ message: "hi" });
+    expect(JSON.parse(init.body)).toEqual({ message: "hi", ws_id: "ws-X" });
  });

  it("createWorkstream with attachments sends multipart and auto-generates ws_id", async () => {
@@ -74,8 +74,8 @@ describe("TurnstoneServer", () => {
    await client.send("Hello", "ws1");

    const [url, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
-    expect(url).toBe("http://test/v1/api/workstreams/ws1/send");
-    expect(JSON.parse(init.body)).toEqual({ message: "Hello" });
+    expect(url).toBe("http://test/v1/api/send");
+    expect(JSON.parse(init.body)).toEqual({ message: "Hello", ws_id: "ws1" });
  });

  it("injects auth header when token provided", async () => {
@@ -3,37 +3,9 @@ not fixtures, and several test files want to import them directly."""

 from __future__ import annotations

-import time
-from typing import TYPE_CHECKING, Any
+from typing import Any
 from unittest.mock import MagicMock

-if TYPE_CHECKING:
-    from collections.abc import Callable
-
-
-def wait_until(cond: Callable[[], bool], timeout: float = 5.0) -> None:
-    """Poll ``cond`` to True within ``timeout`` or fail the test.
-
-    The worker/wake tests can't join threads by identity:
-    ``session_worker.send`` assigns ``ws.worker_thread`` under the lock
-    BEFORE ``t.start()``, so the instant a dispatching call returns, a
-    fast worker may already have run its exit backstop and installed the
-    (not-yet-started) wake thread — joining whatever ``ws.worker_thread``
-    points at races ``RuntimeError: cannot join thread before it is
-    started``.  Poll outcomes instead.
-    """
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if cond():
-            return
-        time.sleep(0.005)
-    if cond():
-        # Final re-check: the condition can become true during the last
-        # sleep (or a CI descheduling stall past the deadline) — failing
-        # without re-looking makes the helper itself a flake source.
-        return
-    raise AssertionError("condition not met within timeout")
-

 def make_chat_session(**overrides: Any) -> Any:
    """Build a minimal ``ChatSession`` with sane test defaults.
@@ -51,12 +51,6 @@ def make_replay_mocks(
    ui._ws_messages = 0
    for key, value in ui_overrides.items():
        setattr(ui, key, value)
-    # Both replay paths read cycle cards via ``pending_approval_cards()``
-    # (one card per concurrent approval cycle).  Model it from the
-    # single-slot ``_pending_approval`` override so tests keep seeding
-    # the one field; a bare MagicMock here would iterate empty and
-    # silently drop the approve_request from the replay.
-    ui.pending_approval_cards = lambda: [ui._pending_approval] if ui._pending_approval else []
    ws = MagicMock()
    ws.session = session
    request = MagicMock()
@@ -1,76 +0,0 @@
-"""Recording fake SDK client — captures the kwargs at each provider's seam.
-
-Every provider's ``create_streaming`` assembles its kwargs and calls the
-SDK *eagerly* before returning the stream iterator (Anthropic
-``client.messages.stream``, OpenAI ``client.chat.completions.create``,
-Responses ``client.responses.create/stream``), so driving a provider
-against a :class:`RecordingClient` captures the full composed request
-payload without a network round-trip.
-
-Shared by the wire-payload golden harness (``test_wire_payload_golden``)
-and the effort-ladder parity harness (``test_effort_ladder_wire_parity``)
-so both assert against the same capture seam.
-"""
-
-from __future__ import annotations
-
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-
-class _EmptyStream:
-    """Stand-in for an SDK stream / stream-manager: empty iterable AND no-op CM."""
-
-    def __iter__(self) -> Iterator[Any]:
-        return iter(())
-
-    def __enter__(self) -> _EmptyStream:
-        return self
-
-    def __exit__(self, *exc: object) -> None:
-        return None
-
-
-class _Seam:
-    """Records the kwargs of a single SDK call, returns an empty stream stub."""
-
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self._sink = sink
-
-    def __call__(self, **kwargs: Any) -> _EmptyStream:
-        # Last write wins; only one seam is exercised per provider call.
-        self._sink["payload"] = kwargs
-        return _EmptyStream()
-
-
-class _Completions:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.create = _Seam(sink)
-
-
-class _Chat:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.completions = _Completions(sink)
-
-
-class _Messages:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.stream = _Seam(sink)
-
-
-class _Responses:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.create = _Seam(sink)
-        self.stream = _Seam(sink)
-
-
-class RecordingClient:
-    """Fake SDK client exposing every provider's call seam, recording kwargs."""
-
-    def __init__(self) -> None:
-        self.captured: dict[str, Any] = {}
-        self.messages = _Messages(self.captured)
-        self.chat = _Chat(self.captured)
-        self.responses = _Responses(self.captured)
@@ -52,76 +52,8 @@ def serve_until_exit(server: Any) -> None:
        loop.close()


-class _PendingResolver:
-    """Race-free drop-in for ``threading.Timer(delay, ui.resolve_approval)``.
-
-    ``approve_tools`` runs ``_approval_event.clear()`` -> register
-    ``_pending_approval`` -> ``_approval_event.wait(_APPROVAL_WAIT_TIMEOUT)``
-    (3600s). A *fixed-delay* timer can fire ``resolve_approval``
-    (``_approval_event.set()``) BEFORE that ``.clear()`` on a slow/loaded
-    runner, so the set is wiped by the clear and ``approve_tools`` blocks the
-    full hour -- surfacing as a CI hang. This instead waits until the approval
-    is actually registered (which happens *after* the clear), then resolves, so
-    the wakeup can never be lost. ``start()`` / ``cancel()`` mirror
-    ``threading.Timer`` so it drops into existing scaffolding. ``cancel()``
-    signals the worker to stop and joins it, so a test that errors *before* the
-    approval registers can't leak the thread or resolve late into a finished
-    test. ``before`` runs just before resolving -- e.g. to snapshot
-    pending-state fields the test asserts on.
-    """
-
-    def __init__(
-        self,
-        ui: Any,
-        *args: Any,
-        before: Callable[[], None] | None = None,
-        deadline: float = 10.0,
-        **kwargs: Any,
-    ) -> None:
-        self._ui = ui
-        self._args = args
-        self._kwargs = kwargs
-        self._before = before
-        self._deadline = deadline
-        self._cancelled = threading.Event()
-        self._started = False
-        self._thread = threading.Thread(target=self._run, name="resolve-when-pending", daemon=True)
-
-    def _run(self) -> None:
-        end = time.monotonic() + self._deadline
-        while time.monotonic() < end:
-            if self._cancelled.is_set():
-                return
-            # getattr (not a bare read) so a UI without _pending_approval can't
-            # crash the worker into a silent death that leaves approve_tools
-            # blocked for the full _APPROVAL_WAIT_TIMEOUT.
-            if getattr(self._ui, "_pending_approval", None) is not None:
-                if self._before is not None:
-                    self._before()
-                self._ui.resolve_approval(*self._args, **self._kwargs)
-                return
-            time.sleep(0.001)
-        # Deadline without registration: approve_tools isn't parked on the
-        # approval event (returned early, or never reached it) -- don't resolve
-        # into an unknown state; let the test's own assertions speak.
-
-    def start(self) -> None:
-        self._started = True
-        self._thread.start()
-
-    def cancel(self) -> None:
-        self._cancelled.set()
-        if self._started:
-            self._thread.join(timeout=5)
-
-
-def resolve_when_pending(ui: Any, *args: Any, **kwargs: Any) -> _PendingResolver:
-    """Build a race-free approval resolver (see :class:`_PendingResolver`)."""
-    return _PendingResolver(ui, *args, **kwargs)
-
-
 if TYPE_CHECKING:
-    from collections.abc import Callable, Iterator
+    from collections.abc import Iterator

    from turnstone.core.mcp_client import MCPClientManager, StaticServerState
    from turnstone.core.mcp_crypto import MCPTokenCipher
@@ -1,78 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris and London?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        },
-        {
-          "id": "call_2",
-          "input": {
-            "city": "London"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        },
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_2",
-          "type": "tool_result"
-        },
-        {
-          "text": "Actually, never mind London.",
-          "type": "text"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -1,33 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": [
-        {
-          "text": "What's in this image?",
-          "type": "text"
-        },
-        {
-          "source": {
-            "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
-            "media_type": "image/png",
-            "type": "base64"
-          },
-          "type": "image"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5
-}
@@ -1,70 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Think about the weather.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "signature": "sig-abc",
-          "thinking": "The user wants weather.",
-          "type": "thinking"
-        },
-        {
-          "text": "Let me check.",
-          "type": "text"
-        },
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -1,69 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Think about the weather.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "signature": "sig-abc",
-          "thinking": "The user wants weather.",
-          "type": "thinking"
-        },
-        {
-          "text": "Let me check.",
-          "type": "text"
-        },
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -1,63 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Run the deploy.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {},
-          "name": "deploy",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "deployed",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        },
-        {
-          "text": "Great, what's next?",
-          "type": "text"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "system": "Output-guard: deploy output looked clean.",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -1,33 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Hi there.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "text": "Hello! How can I help?",
-          "type": "text"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5
-}
@@ -1,69 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "text": "It's 18C and clear in Paris.",
-          "type": "text"
-        }
-      ],
-      "role": "assistant"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -1,61 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}
@@ -43,7 +43,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -18,7 +18,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -34,7 +34,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -15,7 +15,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -30,7 +30,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -43,7 +43,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -18,7 +18,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -34,7 +34,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -15,7 +15,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -30,7 +30,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -26,7 +26,6 @@
    }
  ],
  "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
  "stream": true,
  "stream_options": {
    "include_usage": true
@@ -1,30 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Hi there.",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "content": "Hello! How can I help?",
-      "role": "assistant",
-      "type": "message"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_retention": "24h",
-  "reasoning": {
-    "effort": "max"
-  },
-  "store": false,
-  "stream": true
-}
@@ -1,55 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "arguments": "{\"city\": \"Paris\"}",
-      "call_id": "call_1",
-      "name": "get_weather",
-      "type": "function_call"
-    },
-    {
-      "call_id": "call_1",
-      "output": "18C, clear.",
-      "type": "function_call_output"
-    },
-    {
-      "content": "It's 18C and clear in Paris.",
-      "role": "assistant",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_retention": "24h",
-  "reasoning": {
-    "effort": "max"
-  },
-  "store": false,
-  "stream": true,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "name": "get_weather",
-      "parameters": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "strict": false,
-      "type": "function"
-    }
-  ]
-}
@@ -1,34 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Hi there.",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "content": "Hello! How can I help?",
-      "role": "assistant",
-      "type": "message"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_retention": "24h",
-  "reasoning": {
-    "effort": "high",
-    "mode": "pro"
-  },
-  "store": false,
-  "stream": true,
-  "text": {
-    "verbosity": "low"
-  }
-}
@@ -9,8 +9,6 @@ manual testing.

 from __future__ import annotations

-import json
-import os
 import re
 import subprocess
 from pathlib import Path
@@ -19,12 +17,6 @@ import pytest

 _APP_JS = Path(__file__).resolve().parent.parent / "turnstone/ui/static/app.js"
 _INTERACTIVE_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/interactive.js"
-_SHELL_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/shell.js"
-_REDACT_CREDENTIALS_JS = (
-    Path(__file__).resolve().parent.parent / "turnstone/shared_static/redact_credentials.js"
-)
-_CONSOLE_APP_JS = Path(__file__).resolve().parent.parent / "turnstone/console/static/app.js"
-_CONSOLE_INDEX = Path(__file__).resolve().parent.parent / "turnstone/console/static/index.html"


 def _pane_method_offset(body: str, name: str) -> int:
@@ -563,6 +555,7 @@ _CONSOLE_ADMIN_JS = Path(__file__).resolve().parent.parent / "turnstone/console/
 _CONSOLE_GOVERNANCE_JS = (
    Path(__file__).resolve().parent.parent / "turnstone/console/static/governance.js"
 )
+_CONSOLE_INTERACTIVE_JS = Path(__file__).resolve().parent.parent / "turnstone/console/static/app.js"


 _UNSAFE_CODE_SINK_LINT_TARGETS = [
@@ -573,7 +566,7 @@ _UNSAFE_CODE_SINK_LINT_TARGETS = [
    ("turnstone/console/static/coordinator/coordinator.js", _COORD_JS),
    ("turnstone/console/static/admin.js", _CONSOLE_ADMIN_JS),
    ("turnstone/console/static/governance.js", _CONSOLE_GOVERNANCE_JS),
-    ("turnstone/console/static/app.js", _CONSOLE_APP_JS),
+    ("turnstone/console/static/app.js", _CONSOLE_INTERACTIVE_JS),
 ]


@@ -962,7 +955,6 @@ _CONST_GUARD_BUNDLES = _SWEPT_BUNDLES + [
    _REPO_ROOT / "turnstone/shared_static/rail.js",
    _REPO_ROOT / "turnstone/shared_static/interactive.js",
    _REPO_ROOT / "turnstone/shared_static/conversation.js",
-    _REPO_ROOT / "turnstone/shared_static/redact_credentials.js",
 ]


@@ -1275,102 +1267,41 @@ def test_swept_bundle_has_no_const_reassign(bundle: Path) -> None:
        )


-def test_redact_credentials_runtime_smoke() -> None:
-    """Runtime smoke for ``redactCredentials`` via a temp harness file.
-    The function is pure (no DOM dependency).  Tests the shared module
-    directly via ESM import (replaces the legacy ``_redactApiKeys`` test
-    which now delegates to this).
-
-    The tempfile is written with a ``.mjs`` extension so Node forces ESM
-    parsing regardless of any ``package.json`` ``type`` field in parent
-    directories.  The ``redact_credentials.js`` source file is imported
-    by absolute path so resolution is unambiguous.
-    """
-    import tempfile
-
-    mod_path = _REDACT_CREDENTIALS_JS.resolve()
-    harness = (
-        "import { redactCredentials } from "
-        + json.dumps(str(mod_path))
-        + ";\n"
-        + "const q = redactCredentials('https://x?api_key=abc&u=foo');\n"
+def test_redact_api_keys_runtime_smoke() -> None:
+    """Runtime smoke for ``_redactApiKeys``.  The function is pure — no
+    DOM dependency — so it transplants cleanly into a standalone
+    ``node -e`` invocation.  This is the bit that would have caught
+    the original ``const redacted`` bug (which ``node --check`` and a
+    pure-static keyword scan both miss; the ``TypeError`` only fires
+    at call-time)."""
+    body = _INTERACTIVE_JS.read_text(encoding="utf-8")
+    m = re.search(
+        r"function _redactApiKeys\(text\) \{.*?\n\}\n",
+        body,
+        re.DOTALL,
+    )
+    assert m is not None, "_redactApiKeys not found in app.js"
+    fn = m.group(0)
+    script = (
+        fn
+        + "\nconst q = _redactApiKeys('https://x?api_key=abc&u=foo');\n"
        + 'if (q !== "https://x?api_key=***&u=foo") '
        + "throw new Error('query-string redact failed: ' + q);\n"
-        + 'const j = redactCredentials(\'{"api_key":"abc"}\');\n'
+        + 'const j = _redactApiKeys(\'{"api_key":"abc"}\');\n'
        + 'if (j !== \'{"api_key":"***"}\') '
        + "throw new Error('json-style redact failed: ' + j);\n"
-        + "// Bearer token redaction (raw input)\n"
-        + "const b = redactCredentials('Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.test-token_here');\n"
-        + "if (!b.includes('[REDACTED:api_key]')) "
-        + "throw new Error('bearer redact failed: ' + b);\n"
-        + "// Connection string redaction (raw input)\n"
-        + "const c = redactCredentials('postgresql://user:supersecret@localhost/db');\n"
-        + "if (!c.includes('[REDACTED:password]')) "
-        + "throw new Error('conn-string redact failed: ' + c);\n"
-        + "// Authorization JSON key redaction (step 6 comprehensive)\n"
-        + 'const a = redactCredentials(\'{"Authorization": "Bearer canstillseethis"}\');\n'
-        + "if (!a.includes('[REDACTED:secret]')) "
-        + "throw new Error('authorization JSON redact failed: ' + a);\n"
-        + "// Single-quote JSON (Python dict repr / JS object literal)\n"
-        + "const sq = redactCredentials(\"{'Authorization': 'Bearer canstillseethis'}\");\n"
-        + "if (!sq.includes('[REDACTED:secret]')) "
-        + "throw new Error('single-quote authorization redact failed: ' + sq);\n"
-        + "// mongodb+srv connection string (Atlas SRV)\n"
-        + "const ms = redactCredentials('mongodb+srv://u:s3cretpw@cluster.mongodb.net/db');\n"
-        + "if (!ms.includes('[REDACTED:password]')) "
-        + "throw new Error('mongodb+srv redact failed: ' + ms);\n"
-        + "// lowercase bearer scheme (RFC 7235 case-insensitive)\n"
-        + "const lb = redactCredentials('authorization: bearer "
-        + "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig12345');\n"
-        + "if (!lb.includes('[REDACTED:api_key]')) "
-        + "throw new Error('lowercase bearer redact failed: ' + lb);\n"
-        + "// api_key= assignment redacts the whole token, not a garbled api_[REDACTED\n"
-        + "const ak = redactCredentials('api_key=abcdefghijklmnopqrstuvwxyz');\n"
-        + "if (ak !== '[REDACTED:api_key]') "
-        + "throw new Error('api_key= clean redact failed: ' + ak);\n"
-        + "// Prefilter fast path: plain text with no anchor substring is unchanged\n"
-        + "const fp = redactCredentials('build ok in 42s - 3 tests passed');\n"
-        + "if (fp !== 'build ok in 42s - 3 tests passed') "
-        + "throw new Error('prefilter fast-path no-op failed: ' + fp);\n"
-        + "// Bare credentials with no =, quote or @ anywhere must still redact\n"
-        + "// (these pin the prefilter as a superset of the pattern set)\n"
-        + "const bk = redactCredentials('loaded sk-abcdefghijklmnopqrstuvwx');\n"
-        + "if (bk !== 'loaded [REDACTED:api_key]') "
-        + "throw new Error('bare sk- redact failed: ' + bk);\n"
-        + "const aw = redactCredentials('using AKIAABCDEFGHIJKLMNOP now');\n"
-        + "if (aw !== 'using [REDACTED:api_key] now') "
-        + "throw new Error('bare AKIA redact failed: ' + aw);\n"
-        + "const bt = redactCredentials('Bearer abcdefghijklmnopqrstuvwxyz');\n"
-        + "if (bt !== '[REDACTED:api_key]') "
-        + "throw new Error('bare bearer redact failed: ' + bt);\n"
-        + "// SQLAlchemy dialect+driver connection URLs (psycopg2/asyncpg)\n"
-        + "const pg2 = redactCredentials('postgresql+psycopg2://user:s3cret@db:5432/app');\n"
-        + "if (pg2 !== 'postgresql+psycopg2://user:[REDACTED:password]@db:5432/app') "
-        + "throw new Error('psycopg2 conn redact failed: ' + pg2);\n"
-        + "const apg = redactCredentials('postgresql+asyncpg://user:s3cret@db/app');\n"
-        + "if (apg !== 'postgresql+asyncpg://user:[REDACTED:password]@db/app') "
-        + "throw new Error('asyncpg conn redact failed: ' + apg);\n"
-        + "// RFC 3986 schemes are case-insensitive - uppercase must not bypass\n"
-        + "const up = redactCredentials('POSTGRESQL+PSYCOPG2://user:s3cret@db/app');\n"
-        + "if (up !== 'POSTGRESQL+PSYCOPG2://user:[REDACTED:password]@db/app') "
-        + "throw new Error('uppercase scheme conn redact failed: ' + up);\n"
    )
-    with tempfile.NamedTemporaryFile(mode="w", suffix=".mjs", delete=False) as f:
-        f.write(harness)
-        tmp = f.name
    try:
        proc = subprocess.run(
-            ["node", tmp],
+            ["node", "-e", script],
            capture_output=True,
            text=True,
            timeout=15,
        )
    except FileNotFoundError:
        pytest.skip("node binary not available on PATH")
-    finally:
-        os.unlink(tmp)
    assert proc.returncode == 0, (
-        f"redactCredentials runtime smoke failed.  stdout={proc.stdout!r} stderr={proc.stderr!r}"
+        f"_redactApiKeys runtime smoke failed.  stdout={proc.stdout!r} stderr={proc.stderr!r}"
    )


@@ -1592,287 +1523,6 @@ def test_coord_connectsse_onerror_preserves_native_reconnect() -> None:
    assert passed, f"coordinator.js connectSSE.onerror regressed: {reason}"


-# ---------------------------------------------------------------------------
-# Coordinator-pane parity for the SSE overflow-recovery companions (issue #806).
-# The server-side fixes (emit-time batching, _ListenerQueue poison, out-of-band
-# closing) live in SessionUIBase and already cover EVERY SSE stream; these pin
-# the CLIENT-side companions ported into coordinator.js so it stops relying on
-# native reconnect alone — storm guard + degraded catch-up, close-on-hide /
-# replay-on-show, and drop-vs-render-wedge counters.
-# ---------------------------------------------------------------------------
-
-
-def test_coord_imports_shared_overflow_helpers() -> None:
-    """coordinator.js consumes the SAME sse_overflow.js helpers as the
-    interactive pane (over the /shared mount) so the trip threshold and cooldown
-    ladder cannot drift between the two surfaces."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(
-        r"import \{([^}]*)\} from \"/shared/sse_overflow\.js\";",
-        body,
-        re.S,
-    )
-    assert m is not None, "coordinator must import the shared overflow helpers"
-    imported = m.group(1)
-    for name in (
-        "OVERFLOW_TRIP_COUNT",
-        "OVERFLOW_TRIP_WINDOW_MS",
-        "DEGRADED_COOLDOWN_BASE_MS",
-        "DEGRADED_COOLDOWN_MAX_MS",
-        "DEGRADED_COOLDOWN_RESET_MS",
-        "overflowWindowTripped",
-        "degradedCooldownStep",
-    ):
-        assert name in imported, f"{name} must be imported from /shared/sse_overflow.js"
-    # No local fork of the extracted pure functions on the coordinator side.
-    assert not re.search(r"^\s*function overflowWindowTripped\(", body, re.M)
-    assert not re.search(r"^\s*function degradedCooldownStep\(", body, re.M)
-
-
-def test_coord_stream_overflow_case_counts_and_rate_limits() -> None:
-    """The coordinator handles the id-less ``stream_overflow`` frame: count it
-    (drop-vs-wedge field instrumentation) and feed the rolling-window storm
-    guard, exactly like the interactive pane."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    assert 'case "stream_overflow":' in body
-    assert "noteStreamOverflow();" in body
-    # The three-way health counter distinguishes dropped events (overflow /
-    # malformed frame) from render wedges (dispatch / render throw).
-    assert "streamHealth = { overflows: 0, renderThrows: 0, malformedFrames: 0 }" in body
-    assert "streamHealth.overflows += 1;" in body
-    assert "streamHealth.malformedFrames += 1;" in body
-    # Exactly two render-throw increment sites: the noteRenderThrow helper
-    # (all three contained render/finalize catches route through it — they
-    # recover with a plain-text fallback, so console.warn) and the onmessage
-    # dispatch catch (console.error class — the event is dropped outright).
-    # The three recovered call sites are pinned by label so a new render path
-    # that forgets to count surfaces loudly.
-    assert body.count("streamHealth.renderThrows += 1;") == 2
-    helper = re.search(r"function noteRenderThrow\(where, err\)\s*\{(.*?)\n  \}", body, re.S)
-    assert helper is not None, "noteRenderThrow helper not found"
-    assert "streamHealth.renderThrows += 1;" in helper.group(1)
-    assert 'noteRenderThrow("streamingRender", e);' in body
-    assert 'noteRenderThrow("in_progress_snapshot render", e);' in body
-    assert 'noteRenderThrow("streamingRenderFinalize", e);' in body
-    note = re.search(r"function noteStreamOverflow\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert note is not None, "noteStreamOverflow not found"
-    assert "overflowWindowTripped(" in note.group(1)
-    assert "enterDegradedCatchup()" in note.group(1)
-    # The trip handler only counts + trips; the cooldown reset lives in
-    # enterDegradedCatchup (keyed off lastDegradedAt) — the finding [0] shape.
-    assert "degradedCooldownMs" not in note.group(1), (
-        "noteStreamOverflow must not touch the cooldown — that reset defeated the ladder escalation"
-    )
-
-
-def test_coord_handleevent_dispatch_is_wedge_guarded() -> None:
-    """A throw escaping onmessage does NOT close the EventSource, so an
-    unguarded handler throw left the streaming refs stale and wedged every later
-    turn.  The coordinator wraps the dispatch and counts the throw (render-wedge
-    class) so a field report tells it apart from a dropped-events gap."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"try \{\s*handleEvent\(data\);\s*\} catch \(err\) \{(.*?)\}", body, re.S)
-    assert m is not None, "handleEvent(data) must be wrapped in try/catch in onmessage"
-    assert "streamHealth.renderThrows += 1;" in m.group(1)
-
-
-def test_coord_degraded_catchup_stops_live_stream_and_retries() -> None:
-    """Three overflow closes inside the window drop the coordinator to a
-    degraded catch-up: suspend the live stream, say so plainly, and reconnect
-    after a doubling cooldown — the reconnect replays the gap (or falls to the
-    /history floor once it outgrows the ring)."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"function enterDegradedCatchup\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert m is not None, "enterDegradedCatchup not found"
-    method = m.group(1)
-    assert "degradedCooldownStep(" in method
-    assert "lastDegradedAt = now" in method
-    # Suspend the stream BEFORE arming the retry timer (mirrors interactive's
-    # disconnect-then-rearm ordering) or the fresh timer is cancelled at once.
-    assert method.index("suspendStream()") < method.index("degradedTimer = setTimeout")
-    # Plain-language status, not a silent stall.
-    assert "catching up" in method
-    # A fresh connect must cancel a pending degraded timer so it can't
-    # double-open behind the retry — connectSSE's prologue routes through the
-    # shared closeStreamTransport teardown, which owns that clear (alongside
-    # the reconnect timer + the EventSource close/null).
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    assert "closeStreamTransport();" in conn.group(1)
-    teardown = re.search(r"function closeStreamTransport\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert teardown is not None, "closeStreamTransport not found"
-    assert "clearTimeout(degradedTimer)" in teardown.group(1)
-    assert "clearTimeout(reconnectTimer)" in teardown.group(1)
-    assert "evtSource = null;" in teardown.group(1)
-
-
-def test_coord_visibilitychange_closes_on_hide_reconnects_on_show() -> None:
-    """A hidden tab's throttled drain is the worst-case slow SSE consumer.  The
-    coordinator installs a visibilitychange handler that closes the stream on
-    hide (marking its OWN close via hiddenDisconnect) and reconnects on show from
-    the saved lastEventId, and removes the listener on teardown."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    assert 'document.addEventListener("visibilitychange", visHandler);' in body
-    assert 'document.removeEventListener("visibilitychange", visHandler);' in body
-    vis = re.search(r"function onVisibilityChange\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert vis is not None, "onVisibilityChange not found"
-    method = vis.group(1)
-    assert "document.hidden" in method
-    assert "suspendStream()" in method
-    assert "hiddenDisconnect = true;" in method
-    assert "else if (hiddenDisconnect)" in method
-    assert "connectSSE();" in method
-
-
-def test_coord_connectsse_defers_open_when_tab_hidden() -> None:
-    """connectSSE must never open an EventSource into a hidden tab — the single
-    chokepoint that also backstops a FIRST connect in a background tab (where the
-    close-on-hide handler never fires because there was no open stream).  It
-    marks hiddenDisconnect so the show edge owns the reconnect, marks the
-    deferral as a GAP (markStreamGap) so the eventual open runs the post-gap
-    recovery — without the mark a pane first opened in a background tab
-    silently missed every child/task created while hidden — and reports an
-    honest paused status instead of pinning "connecting" with no attempt in
-    flight."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    method = conn.group(1)
-    guard = method.index("if (document.hidden)")
-    open_idx = method.index("new EventSource(")
-    assert guard < open_idx, "the hidden guard must precede new EventSource"
-    head = method[guard:open_idx]
-    assert "markStreamGap();" in head, "the hidden deferral must count as a stream gap"
-    assert "hiddenDisconnect = true;" in head
-    assert "return;" in head
-    assert 'setSseStatus("paused' in head, "the deferral must report paused, not connecting"
-    # "connecting" is claimed only once an attempt actually starts — after
-    # the hidden guard, immediately before the EventSource construction.
-    connecting = method.index('setSseStatus("connecting')
-    assert guard < connecting < open_idx
-
-
-def test_coord_destroy_removes_visibility_handler_and_stream_transport() -> None:
-    """Teardown must detach the document-level visibilitychange listener (it
-    holds a strong ref to the closure) and tear down the stream transport —
-    closeStreamTransport closes the EventSource and cancels the reconnect +
-    degraded retry timers (pinned in the degraded-catchup test) — or a
-    destroyed pane leaks and a show edge / pending retry reopens its stream."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    d = re.search(r"function destroy\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert d is not None, "destroy not found"
-    method = d.group(1)
-    assert "removeVisibilityHandler();" in method
-    assert "closeStreamTransport();" in method
-
-
-def test_coord_close_session_detaches_visibility_reopen() -> None:
-    """coordCloseSession suspends the stream AND removes the visibilitychange
-    handler BEFORE awaiting the /close POST: a tab hide→show while the POST is
-    in flight must not reopen a stream against the workstream the server is
-    tearing down (404 / reconnect churn against a dead session).  The failure
-    paths resume via connectSSE, which reinstalls the handler at its
-    install-once chokepoint — so close-on-hide survives a failed close."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"async function coordCloseSession\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert m is not None, "coordCloseSession not found"
-    method = m.group(1)
-    suspend = method.index("suspendStream();")
-    unhook = method.index("removeVisibilityHandler();")
-    # The quoted URL fragment, not the bare word (comments mention /close too).
-    post = method.index('"/close"')
-    assert suspend < post, "stream suspension must precede the /close POST"
-    assert unhook < post, "visibility detach must precede the /close POST"
-    assert "resumeSse()" in method
-
-
-def test_coord_post_gap_sidebar_refresh_is_replay_aware() -> None:
-    """The replace-mode children/tasks refresh (a sidebar rebuild) must NOT
-    fire on every reconnect: child_ws_* / task-mutating events are ordinary
-    ring-buffer entries, so a cursor reconnect (replay_ok) redelivers them and
-    the sidebar heals through the normal handlers — a momentary blur→focus
-    under close-on-hide must not rebuild the sidebar.  The refresh fires
-    exactly when the replay cannot vouch for the gap: no resume cursor or an
-    over-threshold gap at onopen, or the server's replay_truncated envelope
-    (ring evicted), deduped per open via gapRefreshedAtOpen."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    method = conn.group(1)
-    gate = re.search(
-        r"wasReconnecting &&\s*\(lastEventId == null \|\| gapMs > GAP_REFRESH_THRESHOLD_MS\)",
-        method,
-    )
-    assert gate is not None, "onopen must gate the sidebar refresh on replay coverage"
-    assert "refreshSidebarAfterGap();" in method
-    assert "gapRefreshedAtOpen = true;" in method
-    # The ring-evicted signal triggers the same refresh (deduped per open).
-    trunc = re.search(r'case "replay_truncated":(.*?)break;', body, re.S)
-    assert trunc is not None, "replay_truncated case not found"
-    assert "refreshSidebarAfterGap()" in trunc.group(1)
-    assert "gapRefreshedAtOpen" in trunc.group(1)
-    # Deliberate suspends (hide / overflow / close-session) mark the gap so
-    # the next open participates in the recovery decision at all.
-    sus = re.search(r"function suspendStream\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert sus is not None, "suspendStream not found"
-    assert "markStreamGap();" in sus.group(1)
-    # The refresh helper carries the whole replace-mode bundle: children,
-    # tasks, and the live-badge purge (permanent 403/404 entries preserved).
-    ref = re.search(r"function refreshSidebarAfterGap\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert ref is not None, "refreshSidebarAfterGap not found"
-    assert "loadChildren({ replace: true });" in ref.group(1)
-    assert "loadTasks();" in ref.group(1)
-    assert "_liveBadgeCacheDelete(id)" in ref.group(1)
-
-
-def test_coord_defers_truncated_resync_and_consumes_at_idle() -> None:
-    """replay_truncated seen mid-stream must be DEFERRED, not dropped (matches
-    interactive's _pendingTruncatedResync): refetching immediately would detach
-    the live bubble (content OR a reasoning-only one), but skipping outright
-    leaves the ring-evicted turns lost for the session.  The guard covers both
-    streaming targets and latches otherwise; the next state_change=idle consumes
-    the flag — which also repairs a turn stranded by close-on-hide (stream_end
-    evicted while hidden), resetting the streaming refs first since
-    refetchHistory does not null them."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    trunc = re.search(r'case "replay_truncated":(.*?)break;', body, re.S)
-    assert trunc is not None, "replay_truncated case not found"
-    t = trunc.group(1)
-    assert "if (!currentAssistantEl && !currentReasoningEl)" in t
-    assert "refetchHistory();" in t
-    assert "pendingTruncatedResync = true;" in t
-    st = re.search(r'case "state_change":(.*?)\n      case ', body, re.S)
-    assert st is not None, "state_change case not found"
-    s = st.group(1)
-    assert "if (pendingTruncatedResync)" in s
-    assert "pendingTruncatedResync = false;" in s
-    assert "currentAssistantEl = null;" in s
-    assert "refetchHistory();" in s
-    # Consume the latch, THEN reset the dangling refs and refetch.
-    consume = s.index("pendingTruncatedResync = false;")
-    refetch = s.index("refetchHistory();")
-    assert consume < refetch
-
-
-def test_coord_detects_server_restart_by_backwards_event_id() -> None:
-    """A coordinator process restart resets the per-ws event counter, and the
-    replay path reports replay_ok for a stale-high cursor (past the new max), so
-    the gap is unsignalled and the sidebar goes stale.  onmessage catches it: a
-    live event id below the saved cursor == the counter reset → pull
-    authoritative sidebar state (deduped per open against onopen's refresh),
-    checked BEFORE the cursor is overwritten."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"evtSource\.onmessage = function \(event\) \{(.*?)\n    \};", body, re.S)
-    assert m is not None, "onmessage handler not found"
-    handler = m.group(1)
-    assert "Number(evtSource.lastEventId) < Number(lastEventId)" in handler
-    assert "!gapRefreshedAtOpen" in handler
-    assert "refreshSidebarAfterGap();" in handler
-    check = handler.index("Number(evtSource.lastEventId) < Number(lastEventId)")
-    overwrite = handler.index("lastEventId = evtSource.lastEventId;")
-    assert check < overwrite
-
-
 def test_interactive_history_is_rest_first_not_sse() -> None:
    """PR A converged interactive onto coord's REST-first history
    model: first paint and post-rewind re-render fetch ``GET /history``
@@ -2107,107 +1757,3 @@ def test_global_stream_recovery_floor_and_render_coalescing() -> None:
    assert "requestAnimationFrame(" in body[fire : fire + 700], (
        "fireRender must coalesce subscriber repaints to one per frame"
    )
-
-
-def test_server_global_accels_are_platform_aware_and_scoped() -> None:
-    """The standalone's keydown handler owns only the GLOBAL accels — new
-    workstream, switch, dashboard.  They pick the modifier per platform (Ctrl on
-    macOS where the browser owns Cmd, Alt elsewhere) so Ctrl+T/1-9 aren't eaten
-    by the browser off macOS.  The per-pane verbs (edit/refresh/fork/delete/
-    close) moved to shell.js, so the handler must not invoke them itself."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    assert "const IS_MAC" in body and 'navigator.platform.indexOf("Mac")' in body, (
-        "the accelerators need a platform check to choose Ctrl vs Alt"
-    )
-    handler = body[body.index('document.addEventListener("keydown"') :]
-    assert "const paneMod" in handler, (
-        "global accels must gate on the platform-aware paneMod, not raw ctrlKey"
-    )
-    assert 'e.ctrlKey && e.key === "t"' not in handler, (
-        "Ctrl+T is browser-reserved off macOS — new workstream must bind via paneMod"
-    )
-    assert "newWorkstream()" in handler and "switchTab(" in handler, (
-        "the standalone handler still owns new + switch"
-    )
-    # macOS Ctrl+T / Ctrl+D are the Cocoa transpose / delete-forward text
-    # bindings; the creation/dashboard chords must yield while typing, through
-    # the shared TS_SHELL.inEditable guard (not a per-file copy).
-    assert "TS_SHELL.inEditable(" in handler, (
-        "new + dashboard must yield to text editing (macOS Ctrl+T / Ctrl+D)"
-    )
-    # The per-pane verbs are shell.js's job now — the standalone handler must not
-    # double-bind them (shell.js drives them off the active pane's menu).
-    for verb in ("editWorkstreamTitle()", "forkWorkstream()", "confirmDeleteWorkstream()"):
-        assert verb not in handler, (
-            f"{verb} moved to shell.js — the app.js handler must not also bind it"
-        )
-
-
-def test_shortcut_overlay_labels_match_the_platform_modifier() -> None:
-    """The '?' help overlay must advertise the same modifier the handler
-    listens for — Ctrl on macOS, Alt on Windows/Linux — instead of a hardcoded
-    Ctrl that is wrong (and non-functional) off macOS."""
-    index = _INDEX_HTML.read_text(encoding="utf-8")
-    assert "const PANE_MOD" in index and 'navigator.platform.indexOf("Mac")' in index, (
-        "the overlay must compute its modifier label per platform"
-    )
-    assert "${PANE_MOD}+T" in index, "the New-workstream badge must render through PANE_MOD"
-    assert '<span class="kb-key">Ctrl+T</span>' not in index, (
-        "the New-workstream badge must not hardcode Ctrl (wrong off macOS)"
-    )
-
-
-def test_pane_menu_accels_are_shared_and_platform_aware() -> None:
-    """shell.js is the single source of truth for the per-pane tab-menu
-    shortcuts: the badge string and the keydown handler come from ONE registry,
-    so a badge can't advertise a chord the handler ignores.  Badges must be
-    platform-aware (no hardcoded Ctrl), and the shared handler must drive the
-    ACTIVE pane's own menu so each surface contributes only what it supports."""
-    shell = _SHELL_JS.read_text(encoding="utf-8")
-    assert "PANE_MENU_ACCELS" in shell and "function paneAccelBadge" in shell, (
-        "shell.js must own the accel registry + badge builder"
-    )
-    assert "const PANE_MOD_LABEL" in shell and 'navigator.platform.indexOf("Mac")' in shell, (
-        "the shared badge must be platform-aware (Ctrl on macOS, Alt elsewhere)"
-    )
-    # The tab-menu items carry a stable accel + a computed badge, NOT a hardcoded
-    # Ctrl string that would lie on Windows/Linux.
-    for accel in ("close-pane", "edit-title", "refresh-title", "delete"):
-        assert f'accel: "{accel}"' in shell, f"tab menu must tag the {accel} item"
-    assert 'key: "Ctrl+Shift+E"' not in shell and 'key: "Ctrl+W"' not in shell, (
-        "tab-menu badges must go through paneAccelBadge, not hardcoded Ctrl"
-    )
-    # The shared handler resolves the active pane and runs its menu item by accel.
-    assert "paneAccelFor(e)" in shell and "pane.tabMenu()" in shell, (
-        "the shared keydown handler must drive the active pane's menu by accel"
-    )
-    # The typing guard is shared (TS_SHELL.inEditable), not copied per surface.
-    assert "function inEditable(" in shell and "inEditable," in shell, (
-        "shell.js must define + expose the shared inEditable guard on TS_SHELL"
-    )
-    ui = _APP_JS.read_text(encoding="utf-8")
-    console = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert "_inEditable" not in ui and "_consoleInEditable" not in console, (
-        "surfaces must use TS_SHELL.inEditable, not a per-file copy of the guard"
-    )
-
-
-def test_console_has_matching_pane_hotkeys() -> None:
-    """The console regained pane hotkeys to match the standalone: a keydown
-    handler for switch (Mod+1-9) + dashboard (Ctrl+D), and a '?' overlay that
-    advertises them platform-aware.  New workstream and Fork are intentionally
-    omitted (no console fork / blank-new surface)."""
-    app = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert (
-        "_CONSOLE_IS_MAC" in app and "statefulTabs()" in app and 'openPane("dashboard")' in app
-    ), "the console must wire switch (statefulTabs) + dashboard hotkeys"
-    index = _CONSOLE_INDEX.read_text(encoding="utf-8")
-    assert "const PANE_MOD" in index and '"Panes"' in index, (
-        "the console '?' overlay needs a platform-aware Panes section"
-    )
-    assert "${PANE_MOD}+W" in index and "${PANE_MOD}+Shift+E" in index, (
-        "console badges must render through PANE_MOD"
-    )
-    assert '"Fork"' not in index and "New workstream" not in index, (
-        "Fork + New are intentionally omitted on the console"
-    )
@@ -13,7 +13,7 @@ from turnstone.core.session import (
    ChatSession,
    GenerationCancelled,
    _CancelRef,
-    _tool_turn_meta,
+    _effect_status_meta,
 )
 from turnstone.core.trajectory import (
    EffectStatus,
@@ -1183,13 +1183,8 @@ class TestEffectStatusPersistence:
    effect-record appendix — the ledger persists for audit)."""

    def test_effect_status_meta_envelope(self):
-        assert _tool_turn_meta(None) is None
-        assert json.loads(_tool_turn_meta(EffectStatus.UNKNOWN)) == {"effect_status": "unknown"}
-        assert json.loads(_tool_turn_meta(None, {"kind": "web"})) == {"preview": {"kind": "web"}}
-        assert json.loads(_tool_turn_meta(EffectStatus.UNKNOWN, {"kind": "web"})) == {
-            "effect_status": "unknown",
-            "preview": {"kind": "web"},
-        }
+        assert _effect_status_meta(None) is None
+        assert json.loads(_effect_status_meta(EffectStatus.UNKNOWN)) == {"effect_status": "unknown"}

    def test_reconstruct_routes_tool_effect_status(self):
        from turnstone.core.storage._utils import reconstruct_turns
@@ -41,11 +41,6 @@ def _bind_ws_event_handlers(bot, cls):
            attr = getattr(cls, name)
            if callable(attr):
                setattr(bot, name, attr.__get__(bot, cls))
-    # ``_handle_stream_end`` delegates the all-cycles sweep to
-    # ``_pop_ws_approvals``; bind the real method too so dispatcher
-    # tests observe the pop instead of a spec'd AsyncMock no-op.
-    if hasattr(cls, "_pop_ws_approvals"):
-        bot._pop_ws_approvals = cls._pop_ws_approvals.__get__(bot, cls)


 def _make_message(*, bot=False, guild=True, content="hello", channel=None, reference=None):
@@ -542,7 +537,7 @@ class TestApprovalVerdictDisplay:
                },
            }
        ]
-        event = ApproveRequestEvent(ws_id="ws-1", cycle_id="cyc-1", items=items)
+        event = ApproveRequestEvent(ws_id="ws-1", items=items)
        _run(bot._on_ws_event("ws-1", thread, event))

        # thread.send was called with an embed containing a verdict field
@@ -556,8 +551,8 @@ class TestApprovalVerdictDisplay:
        assert "HIGH" in field.value
        assert "85%" in field.value

-        # Pending approval message tracked under (ws_id, cycle_id).
-        assert ("ws-1", "cyc-1") in bot._pending_approval_msgs
+        # Pending approval message tracked
+        assert "ws-1" in bot._pending_approval_msgs

    def test_approval_without_verdict(self):
        """ApproveRequestEvent items without verdict still work normally."""
@@ -590,11 +585,10 @@ class TestApprovalVerdictDisplay:
        embed = MagicMock()
        msg.embeds = [embed]
        msg.edit = AsyncMock()
-        bot._pending_approval_msgs[("ws-1", "cyc-1")] = (msg, frozenset({"c-1"}))
+        bot._pending_approval_msgs["ws-1"] = msg

        event = IntentVerdictEvent(
            ws_id="ws-1",
-            call_id="c-1",
            func_name="bash",
            risk_level="high",
            recommendation="deny",
@@ -634,10 +628,7 @@ class TestApprovalVerdictDisplay:
        bot._streaming = {}
        bot._thinking_msgs = {}
        bot._tool_info_msgs = {}
-        bot._pending_approval_msgs = {
-            ("ws-1", "cyc-1"): (MagicMock(), frozenset()),
-            ("ws-1", "cyc-2"): (MagicMock(), frozenset()),
-        }
+        bot._pending_approval_msgs = {"ws-1": MagicMock()}
        bot._notify_reply_channels = {}
        _bind_ws_event_handlers(bot, TurnstoneBot)

@@ -645,8 +636,7 @@ class TestApprovalVerdictDisplay:
        event = StreamEndEvent(ws_id="ws-1")
        _run(bot._on_ws_event("ws-1", thread, event))

-        # ALL of the ws's cycles are swept, not just one entry.
-        assert not bot._pending_approval_msgs
+        assert "ws-1" not in bot._pending_approval_msgs


 class TestStreamEndBehavior:
@@ -1667,21 +1657,19 @@ class TestApprovalResolved:
        bot = self._make_bot()
        thread = AsyncMock()

-        # Set up a pending approval message with components.  The event
-        # below carries no cycle_id (pre-multi-cycle server) — the
-        # legacy fallback clears the ws's single tracked entry.
+        # Set up a pending approval message with components.
        approval_msg = MagicMock()
        approval_msg.embeds = [MagicMock()]
        approval_msg.components = []
        approval_msg.edit = AsyncMock()
-        bot._pending_approval_msgs[("ws-1", "cyc-1")] = (approval_msg, frozenset())
+        bot._pending_approval_msgs["ws-1"] = approval_msg

        event = ApprovalResolvedEvent(ws_id="ws-1", approved=False, feedback="timeout")
        _run(bot._on_ws_event("ws-1", thread, event))

        approval_msg.edit.assert_awaited_once()
        # Pending approval message should be removed.
-        assert not bot._pending_approval_msgs
+        assert "ws-1" not in bot._pending_approval_msgs

    def test_disables_buttons_on_approved(self):
        from turnstone.sdk.events import ApprovalResolvedEvent
@@ -1693,11 +1681,9 @@ class TestApprovalResolved:
        approval_msg.embeds = [MagicMock()]
        approval_msg.components = []
        approval_msg.edit = AsyncMock()
-        bot._pending_approval_msgs[("ws-1", "cyc-1")] = (approval_msg, frozenset())
+        bot._pending_approval_msgs["ws-1"] = approval_msg

-        # Cycle-routed resolution: the event's cycle_id selects exactly
-        # this tracked message.
-        event = ApprovalResolvedEvent(ws_id="ws-1", approved=True, cycle_id="cyc-1")
+        event = ApprovalResolvedEvent(ws_id="ws-1", approved=True)
        _run(bot._on_ws_event("ws-1", thread, event))

        approval_msg.edit.assert_awaited_once()
@@ -87,7 +87,7 @@ class TestSendApproval:
        monkeypatch.setattr(router._server, "approve", mock_approve)
        await router.send_approval("ws-1", "corr-abc", approved=True, feedback="ok")
        mock_approve.assert_awaited_once_with(
-            ws_id="ws-1", approved=True, feedback="ok", always=False, cycle_id="corr-abc"
+            ws_id="ws-1", approved=True, feedback="ok", always=False
        )

    @pytest.mark.anyio
@@ -99,7 +99,7 @@ class TestSendApproval:
        monkeypatch.setattr(router._server, "approve", mock_approve)
        await router.send_approval("ws-1", "corr-abc", approved=False)
        mock_approve.assert_awaited_once_with(
-            ws_id="ws-1", approved=False, feedback=None, always=False, cycle_id="corr-abc"
+            ws_id="ws-1", approved=False, feedback=None, always=False
        )

    @pytest.mark.anyio
@@ -110,9 +110,7 @@ class TestSendApproval:
        mock_approve = AsyncMock()
        monkeypatch.setattr(console_router._console, "route_approve", mock_approve)
        await console_router.send_approval("ws-1", "corr-abc", approved=True, always=True)
-        mock_approve.assert_awaited_once_with(
-            ws_id="ws-1", approved=True, feedback="", always=True, cycle_id="corr-abc"
-        )
+        mock_approve.assert_awaited_once_with(ws_id="ws-1", approved=True, feedback="", always=True)


 class TestDeleteRoute:
@@ -576,11 +576,10 @@ class TestApprovalOwnership:

        bot, router, client = _make_bot()
        ws_id = "ws-1"
-        bot._pending_approval[(ws_id, "corr-1")] = PendingApproval(  # type: ignore[attr-defined]
+        bot._pending_approval[ws_id] = PendingApproval(  # type: ignore[attr-defined]
            channel="C01SAPU5414",
            message_ts="111.222",
            owner_user_id="U_OWNER",
-            cycle_id="corr-1",
        )

        body = {
@@ -599,11 +598,10 @@ class TestApprovalOwnership:

        bot, router, client = _make_bot()
        ws_id = "ws-1"
-        bot._pending_approval[(ws_id, "corr-1")] = PendingApproval(  # type: ignore[attr-defined]
+        bot._pending_approval[ws_id] = PendingApproval(  # type: ignore[attr-defined]
            channel="C01SAPU5414",
            message_ts="111.222",
            owner_user_id="U_OWNER",
-            cycle_id="corr-1",
        )

        body = {
@@ -622,11 +620,10 @@ class TestApprovalOwnership:

        bot, router, client = _make_bot()
        ws_id = "ws-1"
-        bot._pending_approval[(ws_id, "corr-1")] = PendingApproval(  # type: ignore[attr-defined]
+        bot._pending_approval[ws_id] = PendingApproval(  # type: ignore[attr-defined]
            channel="C01SAPU5414",
            message_ts="111.222",
            owner_user_id="U_OWNER",
-            cycle_id="corr-1",
        )

        body = {
@@ -779,9 +776,7 @@ class TestWsEventDispatch:
        bot, client = self._make_ws_bot()

        event = ApproveRequestEvent(
-            ws_id="ws-1",
-            cycle_id="cyc-1",
-            items=[{"call_id": "c-1", "func_name": "bash", "needs_approval": True}],
+            ws_id="ws-1", items=[{"func_name": "bash", "needs_approval": True}]
        )
        route = SlackRoute(channel="C1", user_id="U12345", thread_ts="123.456")
        _run(bot._on_ws_event("ws-1", route, event))  # type: ignore[attr-defined]
@@ -789,12 +784,8 @@ class TestWsEventDispatch:
        client.chat_postMessage.assert_awaited_once()
        call_kwargs = client.chat_postMessage.call_args[1]
        assert "blocks" in call_kwargs
-        # Tracked under (ws_id, cycle_id) so concurrent cycles each get
-        # their own Slack message.
-        entry = bot._pending_approval[("ws-1", "cyc-1")]  # type: ignore[attr-defined]
-        assert entry.owner_user_id == "U12345"
-        assert entry.cycle_id == "cyc-1"
-        assert entry.call_ids == frozenset({"c-1"})
+        assert "ws-1" in bot._pending_approval  # type: ignore[attr-defined]
+        assert bot._pending_approval["ws-1"].owner_user_id == "U12345"  # type: ignore[attr-defined]

    def test_intent_verdict_updates_approval_message(self) -> None:
        from turnstone.channels.slack.bot import PendingApproval
@@ -806,17 +797,14 @@ class TestWsEventDispatch:
            return_value={"ok": True, "messages": [{"blocks": []}]}
        )

-        bot._pending_approval[("ws-1", "cyc-1")] = PendingApproval(  # type: ignore[attr-defined]
+        bot._pending_approval["ws-1"] = PendingApproval(  # type: ignore[attr-defined]
            channel="C1",
            message_ts="999.000",
            owner_user_id="U12345",
-            cycle_id="cyc-1",
-            call_ids=frozenset({"c-1"}),
        )

        event = IntentVerdictEvent(
            ws_id="ws-1",
-            call_id="c-1",
            func_name="bash",
            risk_level="high",
            confidence=0.9,
@@ -833,20 +821,17 @@ class TestWsEventDispatch:
        from turnstone.sdk.events import ApprovalResolvedEvent

        bot, client = self._make_ws_bot()
-        bot._pending_approval[("ws-1", "cyc-9")] = PendingApproval(  # type: ignore[attr-defined]
+        bot._pending_approval["ws-1"] = PendingApproval(  # type: ignore[attr-defined]
            channel="C1",
            message_ts="999.000",
            owner_user_id="U12345",
-            cycle_id="cyc-9",
        )

-        # Event WITHOUT a cycle_id (pre-multi-cycle server): the legacy
-        # fallback clears the ws's single tracked entry, as before.
        event = ApprovalResolvedEvent(ws_id="ws-1", approved=True)
        route = SlackRoute(channel="C1", user_id="U12345", thread_ts="123.456")
        _run(bot._on_ws_event("ws-1", route, event))  # type: ignore[attr-defined]

-        assert not bot._pending_approval  # type: ignore[attr-defined]
+        assert "ws-1" not in bot._pending_approval  # type: ignore[attr-defined]
        client.chat_update.assert_awaited_once()

    def test_link_prefix_does_not_hijack_regular_prompt(self) -> None:
@@ -1600,82 +1600,6 @@ class TestConsoleProxy:
            # browser's interactive UI 403-loops on every retry.
            assert sse_mock.await_args.kwargs.get("use_service_auth") is True

-    def test_proxy_events_global_403_without_cluster_inspect(self, mock_collector):
-        """A plain authenticated user (no service scope, no
-        admin.cluster.inspect) cannot reach the node's cross-tenant
-        firehose through the proxy: elevating to the console's service
-        identity would bypass per-user filtering, so the path is
-        operator-gated. _proxy_sse must NOT be reached."""
-        from unittest.mock import AsyncMock, patch
-
-        from starlette.responses import Response
-        from starlette.testclient import TestClient
-
-        from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import JWT_AUD_CONSOLE, create_jwt
-
-        _load_static()
-        app = create_app(collector=mock_collector, jwt_secret=_TEST_JWT_SECRET)
-        user_jwt = create_jwt(
-            user_id="plain-user",
-            scopes=frozenset({"read"}),
-            source="test",
-            secret=_TEST_JWT_SECRET,
-            audience=JWT_AUD_CONSOLE,
-            permissions=frozenset(),
-        )
-        user_client = TestClient(
-            app,
-            raise_server_exceptions=False,
-            headers={"Authorization": f"Bearer {user_jwt}"},
-        )
-        with patch(
-            "turnstone.console.server._proxy_sse",
-            new_callable=AsyncMock,
-            return_value=Response("ok", status_code=200),
-        ) as sse_mock:
-            resp = user_client.get("/node/node-a/v1/api/events/global")
-        assert resp.status_code == 403
-        assert sse_mock.await_count == 0
-        user_client.close()
-
-    def test_proxy_events_global_allows_cluster_inspect(self, mock_collector):
-        """An operator holding admin.cluster.inspect passes the gate and
-        reaches the SSE proxy with the service token."""
-        from unittest.mock import AsyncMock, patch
-
-        from starlette.responses import Response
-        from starlette.testclient import TestClient
-
-        from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import JWT_AUD_CONSOLE, create_jwt
-
-        _load_static()
-        app = create_app(collector=mock_collector, jwt_secret=_TEST_JWT_SECRET)
-        op_jwt = create_jwt(
-            user_id="operator",
-            scopes=frozenset({"read"}),
-            source="test",
-            secret=_TEST_JWT_SECRET,
-            audience=JWT_AUD_CONSOLE,
-            permissions=frozenset({"admin.cluster.inspect"}),
-        )
-        op_client = TestClient(
-            app,
-            raise_server_exceptions=False,
-            headers={"Authorization": f"Bearer {op_jwt}"},
-        )
-        with patch(
-            "turnstone.console.server._proxy_sse",
-            new_callable=AsyncMock,
-            return_value=Response("ok", status_code=200),
-        ) as sse_mock:
-            resp = op_client.get("/node/node-a/v1/api/events/global")
-        assert resp.status_code == 200
-        assert sse_mock.await_count == 1
-        assert sse_mock.await_args.kwargs.get("use_service_auth") is True
-        op_client.close()
-
    def test_proxy_api_per_ws_events_uses_user_auth_not_service(self, client, mock_collector):
        """Per-ws events route uses the user's re-minted JWT, not the
        service token — the upstream per-ws SSE handler scopes by
@@ -2690,56 +2614,3 @@ class TestCollectorMCPAggregation:
        assert overview["mcp_servers"] == 3
        assert overview["mcp_resources"] == 10
        assert overview["mcp_prompts"] == 7
-
-
-class TestProxyGetHeaderPassThrough:
-    """The generic /node/{id} GET proxy must carry the node's hardening
-    headers through — dropping Content-Security-Policy would serve previewed
-    attacker HTML from the CONSOLE origin with no CSP sandbox (review
-    finding, preview-pane branch)."""
-
-    def test_security_headers_forwarded(self, monkeypatch):
-        from types import SimpleNamespace
-        from unittest.mock import MagicMock
-
-        import httpx
-
-        from turnstone.console import server as csrv
-
-        upstream = httpx.Response(
-            200,
-            content=b"<html>page</html>",
-            headers={
-                "content-type": "text/html; charset=utf-8",
-                "content-security-policy": "sandbox",
-                "x-content-type-options": "nosniff",
-                "content-disposition": 'inline; filename="p"',
-                "cache-control": "private, no-store",
-                "server": "upstream-internal",  # hop metadata: must NOT pass
-            },
-            request=httpx.Request("GET", "http://n:1/x"),
-        )
-
-        async def _mock_get(*a, **kw):
-            return upstream
-
-        proxy_client = MagicMock(spec=httpx.AsyncClient)
-        proxy_client.get = MagicMock(side_effect=_mock_get)
-        request = SimpleNamespace(
-            app=SimpleNamespace(state=SimpleNamespace(proxy_client=proxy_client)),
-            url=SimpleNamespace(query=""),
-        )
-        monkeypatch.setattr(csrv, "_proxy_auth_headers", lambda r: {})
-
-        resp = asyncio.run(csrv._proxy_get(request, "http://n:1", "v1/api/x"))
-
-        assert resp.status_code == 200
-        assert resp.headers["content-security-policy"] == "sandbox"
-        assert resp.headers["x-content-type-options"] == "nosniff"
-        assert resp.headers["content-disposition"] == 'inline; filename="p"'
-        assert resp.headers["cache-control"] == "private, no-store"
-        assert resp.headers["content-type"].startswith("text/html")
-        assert (
-            "server" not in {k.lower() for k in resp.headers}
-            or resp.headers.get("server") != "upstream-internal"
-        )
@@ -336,88 +336,10 @@ def test_channel_default_alias_blanked_when_disabled(


 def test_models_payload_strips_secret_fields(storage: SQLiteBackend) -> None:
-    """Regression guard: only alias/model/provider (+ the derived
-    effort_ladder) land in the response, never api_key / base_url /
-    context_window / raw capabilities."""
+    """Regression guard: only alias/model/provider land in the response,
+    never api_key / base_url / context_window / capabilities."""
    _seed_model(storage, definition_id="m1", alias="primary")
    body = _get_models(_make_client(storage))
-    assert len(body["models"]) == 1
-    entry = body["models"][0]
-    assert set(entry) == {"alias", "model", "provider", "effort_ladder"}
-    assert entry["alias"] == "primary"
-    assert entry["model"] == "model-x"
-    assert entry["provider"] == "openai-compatible"
-
-
-def test_effort_ladder_parses_string_capabilities(storage: SQLiteBackend) -> None:
-    """The capabilities column is a JSON STRING — the ladder must survive
-    the parse (regression: .items() on the raw string threw and the
-    guard silently dropped the field from every row)."""
-    storage.create_model_definition(
-        definition_id="m1",
-        alias="qwen",
-        model="qwen3.6-27b",
-        provider="anthropic-compatible",
-        base_url="http://localhost:8000",
-        api_key="dummy",
-        context_window=262144,
-        capabilities='{"thinking_mode": "manual", "thinking_param": "enable_thinking"}',
-        enabled=True,
-        created_by="admin",
-    )
-    body = _get_models(_make_client(storage))
-    ladder = {r["value"]: r["effective"] for r in body["models"][0]["effort_ladder"]}
-    assert ladder["none"] == "off"
-    assert ladder["medium"] == "on+medium"
-    assert ladder["max"] == "on+max"
-
-
-def test_effort_ladder_key_survives_malformed_capabilities(
-    storage: SQLiteBackend,
-) -> None:
-    """A capabilities column that fails to parse must not drop the key —
-    every row carries ``effort_ladder`` (empty on failure) so clients can
-    index it unconditionally instead of null-checking per row."""
-    storage.create_model_definition(
-        definition_id="m1",
-        alias="broken",
-        model="model-x",
-        provider="openai-compatible",
-        base_url="http://localhost:8000/v1",
-        api_key="dummy",
-        context_window=131072,
-        capabilities="{not valid json",
-        enabled=True,
-        created_by="admin",
-    )
-    body = _get_models(_make_client(storage))
-    entry = body["models"][0]
-    assert set(entry) == {"alias", "model", "provider", "effort_ladder"}
-    assert entry["effort_ladder"] == []
-
-
-def test_effort_ladder_honors_responses_api_surface(storage: SQLiteBackend) -> None:
-    """server_compat.api_surface (namespaced inside the capabilities JSON)
-    switches the projection to the flat-param path — no template toggle."""
-    caps = (
-        '{"thinking_mode": "manual", "thinking_param": "enable_thinking",'
-        ' "reasoning_effort_values": ["low", "medium", "high"],'
-        ' "server_compat": {"api_surface": "responses"}}'
-    )
-    storage.create_model_definition(
-        definition_id="m1",
-        alias="mistral",
-        model="mistral-medium",
-        provider="openai-compatible",
-        base_url="http://localhost:8000/v1",
-        api_key="dummy",
-        context_window=131072,
-        capabilities=caps,
-        enabled=True,
-        created_by="admin",
-    )
-    body = _get_models(_make_client(storage))
-    ladder = {r["value"]: r["effective"] for r in body["models"][0]["effort_ladder"]}
-    # Responses surface: flat param only — no "on+"/"off" toggle tokens.
-    assert ladder["medium"] == "medium"
-    assert ladder["none"] == "default"
+    assert body["models"] == [
+        {"alias": "primary", "model": "model-x", "provider": "openai-compatible"}
+    ]
@@ -1,106 +0,0 @@
-"""``POST /v1/api/admin/models/effort-ladder`` — live modal projection.
-
-Pure computation over (provider, model, unsaved capability overrides,
-api_surface); every malformed input must land as a 400, never a 500 —
-the body is operator-typed form state.
-"""
-
-from __future__ import annotations
-
-from typing import Any
-
-from starlette.applications import Starlette
-from starlette.middleware import Middleware
-from starlette.routing import Route
-from starlette.testclient import TestClient
-
-from tests._coord_test_helpers import _AuthMiddleware
-from turnstone.console.server import admin_effort_ladder
-
-
-def _make_client() -> TestClient:
-    app = Starlette(
-        routes=[Route("/v1/api/admin/models/effort-ladder", admin_effort_ladder, methods=["POST"])],
-        middleware=[Middleware(_AuthMiddleware)],
-    )
-    client = TestClient(app)
-    client.headers.update({"X-Test-User": "admin", "X-Test-Perms": "admin.models"})
-    return client
-
-
-def _post(client: TestClient, body: Any) -> Any:
-    return client.post("/v1/api/admin/models/effort-ladder", json=body)
-
-
-def test_valid_request_returns_ladder() -> None:
-    resp = _post(
-        _make_client(),
-        {
-            "provider": "anthropic-compatible",
-            "model": "qwen3.6-27b",
-            "capabilities": {"thinking_mode": "manual", "thinking_param": "enable_thinking"},
-        },
-    )
-    assert resp.status_code == 200, resp.text
-    ladder = {r["value"]: r["effective"] for r in resp.json()["ladder"]}
-    assert ladder["none"] == "off"
-    assert ladder["high"] == "on+high"
-
-
-def test_api_surface_switches_projection() -> None:
-    body = {
-        "provider": "openai-compatible",
-        "model": "m",
-        "capabilities": {
-            "thinking_mode": "manual",
-            "reasoning_effort_values": ["low", "medium", "high"],
-        },
-    }
-    client = _make_client()
-    chat = {r["value"]: r["effective"] for r in _post(client, body).json()["ladder"]}
-    body["api_surface"] = "responses"
-    responses = {r["value"]: r["effective"] for r in _post(client, body).json()["ladder"]}
-    assert chat["medium"] == "on+medium"  # toggle + flat on the chat surface
-    assert responses["medium"] == "medium"  # flat only on the responses surface
-
-
-def test_non_dict_json_body_is_400_not_500() -> None:
-    client = _make_client()
-    for body in (None, [], "x", 7):
-        resp = _post(client, body)
-        assert resp.status_code == 400, (body, resp.status_code, resp.text)
-
-
-def test_unknown_provider_is_400() -> None:
-    resp = _post(_make_client(), {"provider": "nope", "model": "m"})
-    assert resp.status_code == 400
-
-
-def test_missing_model_is_400() -> None:
-    resp = _post(_make_client(), {"provider": "openai", "model": ""})
-    assert resp.status_code == 400
-
-
-def test_non_dict_capabilities_is_400() -> None:
-    resp = _post(_make_client(), {"provider": "openai", "model": "m", "capabilities": [1]})
-    assert resp.status_code == 400
-
-
-def test_garbage_capability_value_types_are_400() -> None:
-    """Wrong-typed override values raise inside the resolver → clean 400."""
-    resp = _post(
-        _make_client(),
-        {
-            "provider": "anthropic",
-            "model": "claude-fable-5",
-            "capabilities": {"supports_effort": True, "effort_levels": 5},
-        },
-    )
-    assert resp.status_code == 400
-
-
-def test_requires_admin_models_permission() -> None:
-    client = _make_client()
-    client.headers.update({"X-Test-Perms": "read"})
-    resp = _post(client, {"provider": "openai", "model": "m"})
-    assert resp.status_code in (401, 403)
@@ -114,16 +114,11 @@ def test_coord_on_aux_usage_leaves_live_counters_untouched() -> None:
    assert ui._ws_context_ratio == 0.0


-def test_coord_on_content_token_accumulates(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_coord_on_content_token_accumulates() -> None:
    """Pre-lift coord ``on_content_token`` only enqueued; lift turns it
    into the same per-ws accumulator WebUI uses so the collector
    broadcast can piggyback the joined turn content on the IDLE
-    state-change event.
-
-    Batch window forced to 0 (per-token flush) — pins the accumulator
-    wiring, not the batching cadence (test_sse_token_batching.py)."""
-
-    monkeypatch.setattr("turnstone.core.session_ui_base._TOKEN_BATCH_WINDOW_SECS", 0.0)
+    state-change event."""
    ui = ConsoleCoordinatorUI(ws_id="coord-ws", user_id="u1")
    ui.on_content_token("Hello ")
    ui.on_content_token("world")
@@ -16,10 +16,10 @@ to ``SessionUIBase`` automatically enables:

 from __future__ import annotations

+import threading
 from typing import Any
 from unittest.mock import MagicMock, patch

-from tests.conftest import resolve_when_pending
 from turnstone.console.coordinator_ui import ConsoleCoordinatorUI


@@ -153,7 +153,7 @@ def test_coord_heuristic_verdict_persists_to_storage() -> None:
    items[0]["_heuristic_verdict"] = hv

    storage = MagicMock()
-    timer = resolve_when_pending(ui, False)
+    timer = threading.Timer(0.05, lambda: ui.resolve_approval(False))
    timer.start()
    try:
        with _patch_storage(storage):
@@ -246,8 +246,9 @@ def test_coord_pending_approval_sets_activity_tag() -> None:
    def _capture_activity() -> None:
        captured["activity"] = ui._ws_current_activity
        captured["state"] = ui._ws_activity_state
+        ui.resolve_approval(False)

-    timer = resolve_when_pending(ui, False, before=_capture_activity)
+    timer = threading.Timer(0.05, _capture_activity)
    timer.start()
    try:
        with _patch_storage(MagicMock()):
@@ -291,7 +292,7 @@ def test_coord_judge_pending_flag_dynamic_when_heuristic_present() -> None:
    captured_events: list[dict[str, Any]] = []
    ui._enqueue = captured_events.append  # type: ignore[method-assign]

-    timer = resolve_when_pending(ui, False)
+    timer = threading.Timer(0.05, lambda: ui.resolve_approval(False))
    timer.start()
    try:
        with _patch_storage(MagicMock()):
@@ -337,7 +338,7 @@ def test_coord_judge_pending_false_when_no_heuristic_verdict() -> None:
    captured_events: list[dict[str, Any]] = []
    ui._enqueue = captured_events.append  # type: ignore[method-assign]

-    timer = resolve_when_pending(ui, False)
+    timer = threading.Timer(0.05, lambda: ui.resolve_approval(False))
    timer.start()
    try:
        with _patch_storage(MagicMock()):
@@ -409,7 +410,7 @@ def test_coord_budget_override_prompts_even_under_blanket_auto_approve() -> None
    captured_events: list[dict[str, Any]] = []
    ui._enqueue = captured_events.append  # type: ignore[method-assign]

-    timer = resolve_when_pending(ui, True)
+    timer = threading.Timer(0.05, lambda: ui.resolve_approval(True))
    timer.start()
    try:
        with _patch_storage(MagicMock()):
@@ -452,7 +453,7 @@ def test_coord_budget_override_survives_wildcard_allow_policy() -> None:
    captured_events: list[dict[str, Any]] = []
    ui._enqueue = captured_events.append  # type: ignore[method-assign]

-    timer = resolve_when_pending(ui, True)
+    timer = threading.Timer(0.05, lambda: ui.resolve_approval(True))
    timer.start()
    try:
        with _patch_storage(MagicMock()), _patch_policies({"__budget_override__": "allow"}):
@@ -525,16 +526,12 @@ class TestBroadcastApprovalResolved:
        collector = MagicMock()
        ConsoleCoordinatorUI._collector = collector
        try:
-            ui._broadcast_approval_resolved(
-                True, "lgtm", always=True, cycle_id="cyc-1", call_ids=("c-1", "c-2")
-            )
+            ui._broadcast_approval_resolved(True, "lgtm", always=True)
            collector.emit_console_ws_approval_resolved.assert_called_once_with(
                "coord-a",
                approved=True,
                feedback="lgtm",
                always=True,
-                cycle_id="cyc-1",
-                call_ids=["c-1", "c-2"],
            )
        finally:
            ConsoleCoordinatorUI._collector = None
@@ -550,8 +547,6 @@ class TestBroadcastApprovalResolved:
                approved=False,
                feedback="",
                always=False,
-                cycle_id="",
-                call_ids=[],
            )
        finally:
            ConsoleCoordinatorUI._collector = None
@@ -195,21 +195,6 @@ def test_emit_tolerates_collector_exception() -> None:
 # ---------------------------------------------------------------------------


-def test_cleanup_ui_sweeps_all_approval_cycles_on_registry_uis() -> None:
-    """The real ConsoleCoordinatorUI carries the approval-cycle
-    registry: cleanup denies + wakes EVERY parked gate via
-    ``resolve_all_approvals`` (parallel task agents can hold several),
-    not the pre-cycle single-slot kick."""
-    adapter, _ = _make_adapter()
-    ws = _make_ws()
-    ws.ui.resolve_all_approvals = MagicMock(return_value=2)  # type: ignore[attr-defined]
-    adapter.cleanup_ui(ws)
-    ws.ui.resolve_all_approvals.assert_called_once_with(  # type: ignore[attr-defined]
-        False, "Workstream closed"
-    )
-    assert ws.ui._fg_event.is_set()  # type: ignore[attr-defined]
-
-
 def test_cleanup_ui_unblocks_events_and_broadcasts_to_listeners() -> None:
    adapter, _ = _make_adapter()
    ws = _make_ws()
@@ -245,24 +230,6 @@ def test_cleanup_ui_tolerates_missing_session_and_ui() -> None:
    ws.session = None
    ws.ui = None
    adapter.cleanup_ui(ws)  # no crash
-    assert ws._closed is True  # still marked dead
-
-
-def test_cleanup_ui_marks_workstream_closed() -> None:
-    """Every teardown path — close, close_idle, EVICTION, delete,
-    discard — funnels through cleanup_ui, which marks the object dead
-    under ``ws._lock`` BEFORE the teardown body runs.  The wake paths
-    that hold OBJECT references (the watch ``wake_fn``,
-    ``session_worker``'s exit backstop) gate on ``_closed``, and
-    ``session_worker.send`` re-checks it under the same lock — without
-    this write here, a wake racing an eviction or delete (which never
-    set the flag) would spawn a full unattended turn on the torn-down
-    session."""
-    adapter, _ = _make_adapter()
-    ws = _make_ws()
-    assert ws._closed is False
-    adapter.cleanup_ui(ws)
-    assert ws._closed is True


 # ---------------------------------------------------------------------------
@@ -42,7 +42,6 @@ from turnstone.console.server import (
    _coord_create_post_install,
    _coord_create_validate_request,
    _coord_saved_loaded_lookup,
-    _coordinator_tenant_check,
    _require_admin_coordinator,
    _require_coord_mgr,
    cluster_ws_detail,
@@ -84,24 +83,15 @@ def _coord_attach_owner(request, ws_id, mgr):

    Kind-strict — coord attachments can only be accessed for
    workstreams currently held by ``coord_mgr``; no storage fallback
-    so cross-kind ws_ids 404 instead of leaking through storage. Also
-    project-tenancy-strict: mirrors ``_coord_attachment_owner`` so a
-    private-project coordinator's attachments 404-mask non-members.
+    so cross-kind ws_ids 404 instead of leaking through storage.
    """
    from starlette.responses import JSONResponse

-    from turnstone.core.auth import WorkstreamProjectVisibility
    from turnstone.core.web_helpers import auth_user_id

    ws = mgr.get(ws_id)
    if ws is None:
        return "", JSONResponse({"error": "coordinator not found"}, status_code=404)
-    storage = getattr(request.app.state, "auth_storage", None)
-    if storage is None:
-        return "", JSONResponse({"error": "coordinator not found"}, status_code=404)
-    visibility = WorkstreamProjectVisibility.for_request(request, storage=storage)
-    if not visibility.ws_visible(getattr(ws, "project_id", "") or "", ws_owner=ws.user_id or ""):
-        return "", JSONResponse({"error": "coordinator not found"}, status_code=404)
    return ws.user_id or auth_user_id(request), None


@@ -111,7 +101,7 @@ def _coord_attach_owner(request, ws_id, mgr):
 _coord_endpoint_config = SessionEndpointConfig(
    permission_gate=_require_admin_coordinator,
    manager_lookup=_require_coord_mgr,
-    tenant_check=_coordinator_tenant_check,
+    tenant_check=None,
    not_found_label="coordinator not found",
    audit_action_prefix="coordinator",
    supports_attachments=True,
@@ -1113,7 +1103,18 @@ def test_approve_resolves_ui_event(storage):
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
    assert isinstance(ws.ui, ConsoleCoordinatorUI)
-    cycle = _seed_pending(ws, "c-1")
+    ws.ui._pending_approval = {
+        "type": "approve_request",
+        "items": [
+            {
+                "call_id": "c-1",
+                "func_name": "spawn_workstream",
+                "approval_label": "spawn_workstream",
+                "needs_approval": True,
+            }
+        ],
+    }
+    ws.ui._approval_event.clear()
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1121,46 +1122,34 @@ def test_approve_resolves_ui_event(storage):
        headers=_COORD_HEADERS,
    )
    assert resp.status_code == 200
-    assert resp.json()["cycle_id"] == cycle.cycle_id
-    assert cycle.event.is_set()
-    assert cycle.result == (True, None)
+    assert ws.ui._approval_event.is_set()
+    assert ws.ui._approval_result == (True, None)
    assert "spawn_workstream" in ws.ui.auto_approve_tools


-def _seed_pending(ws, *call_ids: str, func_name: str = "spawn_workstream"):
-    """Register a live ApprovalCycle on the coord UI the way its
-    ``approve_tools`` gate does, returning the cycle for direct
-    event/result assertions (the pre-cycle singleton
-    ``_approval_event`` / ``_approval_result`` slots are gone)."""
-    from turnstone.core.session_ui_base import ApprovalCycle
-
-    items = [
-        {
-            "call_id": cid,
-            "func_name": func_name,
-            "approval_label": func_name,
-            "needs_approval": True,
-        }
-        for cid in call_ids
-    ]
-    card = {
+def _seed_pending(ws, *call_ids: str) -> None:
+    ws.ui._pending_approval = {
        "type": "approve_request",
-        "cycle_id": f"cyc-{'-'.join(call_ids)}",
-        "items": ws.ui._serialize_approval_items(items),
-        "judge_pending": False,
+        "items": [
+            {
+                "call_id": cid,
+                "func_name": "spawn_workstream",
+                "approval_label": "spawn_workstream",
+                "needs_approval": True,
+            }
+            for cid in call_ids
+        ],
    }
-    cycle = ApprovalCycle(items, card, None)
-    ws.ui._register_approval_cycle(cycle)
-    return cycle
+    ws.ui._approval_event.clear()


 def test_approve_409_on_stale_call_id(storage):
    """Body call_id doesn't match any pending item → 409 with the
-    current primary call_id + cycle_id so the UI can re-render
-    against the new round."""
+    current primary call_id so the UI can re-render against the
+    new round."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    cycle = _seed_pending(ws, "c-current")
+    _seed_pending(ws, "c-current")
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1171,17 +1160,17 @@ def test_approve_409_on_stale_call_id(storage):
    body = resp.json()
    assert body["error"] == "stale call_id"
    assert body["current_call_id"] == "c-current"
-    assert body["current_cycle_id"] == cycle.cycle_id
-    # The live cycle must NOT have been resolved.
-    assert not cycle.event.is_set()
+    # Approval event must NOT be set — no resolve_approval ran.
+    assert not ws.ui._approval_event.is_set()


 def test_approve_409_when_no_pending_and_call_id_sent(storage):
-    """Body sends a call_id but the UI has no live cycle — 409 with
-    current_call_id=None so the UI knows to clear the row."""
+    """Body sends a call_id but the UI has no pending approval —
+    409 with current_call_id=None so the UI knows to clear the row."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    # No cycle registered.
+    # No _pending_approval seeded → ui._pending_approval is None.
+    ws.ui._approval_event.clear()
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1190,18 +1179,18 @@ def test_approve_409_when_no_pending_and_call_id_sent(storage):
    )
    assert resp.status_code == 409
    body = resp.json()
-    assert body["error"] == "stale call_id"
+    assert body["error"] == "no pending approval"
    assert body["current_call_id"] is None
-    assert body["current_cycle_id"] is None
+    assert not ws.ui._approval_event.is_set()


 def test_approve_no_call_id_preserves_backward_compat(storage):
    """Existing clients (CLI, channel adapters) that omit call_id
-    must still resolve approvals — a selector-less body lands on the
-    oldest live cycle."""
+    must still resolve approvals — the guard only kicks in when
+    call_id is present in the body."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    cycle = _seed_pending(ws, "c-1")
+    _seed_pending(ws, "c-1")
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1209,18 +1198,18 @@ def test_approve_no_call_id_preserves_backward_compat(storage):
        headers=_COORD_HEADERS,
    )
    assert resp.status_code == 200
-    assert resp.json()["cycle_id"] == cycle.cycle_id
-    assert cycle.event.is_set()
+    assert ws.ui._approval_event.is_set()


-def test_approve_no_call_id_no_pending_resolves_nothing(storage):
-    """Legacy clients (no call_id) calling approve with no live cycle:
-    200 with ``cycle_id: null`` — the handler resolves NOTHING rather
-    than racing a cycle that registers between its lookup and its
-    resolve (the client can't have been looking at one)."""
+def test_approve_no_call_id_no_pending_falls_through(storage):
+    """Legacy clients (no call_id) calling approve when pending is
+    None hit the existing resolve_approval no-op path — the new
+    guard must not change that behavior. Regression guard for the
+    legacy code path that the call_id check intentionally bypasses."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    # No cycle registered.
+    ws.ui._approval_event.clear()
+    # No _pending_approval seeded.
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1228,7 +1217,7 @@ def test_approve_no_call_id_no_pending_resolves_nothing(storage):
        headers=_COORD_HEADERS,
    )
    assert resp.status_code == 200
-    assert resp.json()["cycle_id"] is None
+    assert ws.ui._approval_event.is_set()


 def test_approve_call_id_matches_any_item_in_multi_envelope(storage):
@@ -1237,7 +1226,7 @@ def test_approve_call_id_matches_any_item_in_multi_envelope(storage):
    one-boolean semantics of resolve_approval."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    cycle = _seed_pending(ws, "c-1", "c-2", "c-3")
+    _seed_pending(ws, "c-1", "c-2", "c-3")
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(
        f"/v1/api/workstreams/{ws.id}/approve",
@@ -1245,61 +1234,7 @@ def test_approve_call_id_matches_any_item_in_multi_envelope(storage):
        headers=_COORD_HEADERS,
    )
    assert resp.status_code == 200
-    assert cycle.event.is_set()
-
-
-def test_selectorless_always_whitelists_only_the_resolved_oldest_cycle(storage):
-    """sweep-3 regression: with several live cycles, a selector-less
-    "Approve + Always" must whitelist the tools of the cycle it
-    actually resolved (the oldest) — not a sibling's."""
-    mgr = _build_mgr(storage)
-    ws = mgr.create(user_id="user-1")
-    oldest = _seed_pending(ws, "a-1", func_name="spawn_workstream")
-    newer = _seed_pending(ws, "b-1", func_name="send_message")
-    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
-    resp = client.post(
-        f"/v1/api/workstreams/{ws.id}/approve",
-        json={"approved": True, "always": True},  # no selector
-        headers=_COORD_HEADERS,
-    )
-    assert resp.status_code == 200
-    assert resp.json()["cycle_id"] == oldest.cycle_id
-    assert oldest.event.is_set()
-    assert not newer.event.is_set()
-    assert "spawn_workstream" in ws.ui.auto_approve_tools
-    assert "send_message" not in ws.ui.auto_approve_tools
-
-
-def test_approve_always_skips_whitelist_when_pinned_cycle_lost_the_race(storage):
-    """sweep-3 regression: the handler collects always-names from the
-    cycle its lookup pinned; if that cycle is resolved by someone else
-    (gate timeout, peer tab) between lookup and resolve, the whitelist
-    must NOT grow — approving a card that already resolved must not
-    auto-approve anything."""
-    mgr = _build_mgr(storage)
-    ws = mgr.create(user_id="user-1")
-    _seed_pending(ws, "a-1", func_name="spawn_workstream")
-    ui = ws.ui
-    real_find = ui.find_approval_cycle
-
-    def racing_find(**kwargs):
-        card = real_find(**kwargs)
-        if card is not None:
-            # A concurrent resolver wins the gap between the handler's
-            # lookup and its (pinned) resolve.
-            ui.resolve_approval(False, "raced", cycle_id=card["cycle_id"])
-        return card
-
-    ui.find_approval_cycle = racing_find
-    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
-    resp = client.post(
-        f"/v1/api/workstreams/{ws.id}/approve",
-        json={"approved": True, "always": True},
-        headers=_COORD_HEADERS,
-    )
-    assert resp.status_code == 200
-    assert resp.json()["cycle_id"] is None
-    assert "spawn_workstream" not in ws.ui.auto_approve_tools
+    assert ws.ui._approval_event.is_set()


 # ---------------------------------------------------------------------------
@@ -1418,110 +1353,6 @@ def test_history_any_admin_coordinator_caller_can_read(storage):
    assert resp.json()["ws_id"] == ws.id


-def test_history_private_project_hidden_from_non_member(storage):
-    # admin.coordinator gates the surface, but a coordinator in a private
-    # project the caller isn't a member of is 404-masked — the conversation
-    # does not leak to a non-member operator.
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.register_workstream(
-        "c" * 32, kind="coordinator", user_id="alice", project_id="proj-secret"
-    )
-    storage.save_message("c" * 32, "user", "secret plan")
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{'c' * 32}/history",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 404
-
-
-def test_history_private_project_visible_to_member(storage):
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.add_project_member("proj-secret", "member-bob")
-    storage.register_workstream(
-        "c" * 32, kind="coordinator", user_id="alice", project_id="proj-secret"
-    )
-    storage.save_message("c" * 32, "user", "secret plan")
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{'c' * 32}/history",
-        headers={"X-Test-User": "member-bob", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 200
-    assert any(m.get("content") == "secret plan" for m in resp.json()["messages"])
-
-
-def test_export_private_project_hidden_from_non_member(storage):
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.register_workstream(
-        "c" * 32, kind="coordinator", user_id="alice", project_id="proj-secret"
-    )
-    storage.save_message("c" * 32, "user", "secret plan")
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{'c' * 32}/export",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 404
-
-
-def test_children_private_project_hidden_from_non_member(storage):
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.register_workstream(
-        "c" * 32, kind="coordinator", user_id="alice", project_id="proj-secret"
-    )
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{'c' * 32}/children",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 404
-
-
-def test_open_private_project_hidden_from_non_member(storage):
-    # `open` rehydrates + returns the auto-titled name, so an ungated open is a
-    # private-project existence/metadata oracle AND an unauthorized resurrection.
-    # The tenant_check must fire before the already-loaded shortcut and mgr.open.
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.register_workstream(
-        "c" * 32, kind="coordinator", user_id="alice", project_id="proj-secret"
-    )
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.post(
-        f"/v1/api/workstreams/{'c' * 32}/open",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 404
-
-
-def test_coord_attachments_private_project_hidden_from_non_member(storage):
-    # Attachment list/serve resolves the owner as the coord owner and only
-    # enforced cross-kind before — a non-member operator could enumerate and
-    # download the owner's staged blobs. Now 404-masked by project tenancy.
-    storage.create_project("proj-secret", "Secret", "alice")
-    mgr = _build_mgr(storage)
-    ws = mgr.create(user_id="alice", project_id="proj-secret")
-    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{ws.id}/attachments",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 404
-
-
-def test_coord_attachments_private_project_visible_to_member(storage):
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.add_project_member("proj-secret", "member-bob")
-    mgr = _build_mgr(storage)
-    ws = mgr.create(user_id="alice", project_id="proj-secret")
-    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/workstreams/{ws.id}/attachments",
-        headers={"X-Test-User": "member-bob", "X-Test-Perms": "admin.coordinator"},
-    )
-    assert resp.status_code == 200
-
-
 def test_history_serves_storage_only_workstream(storage):
    """Persisted-but-not-loaded coordinators (closed / evicted) are still
    readable via /history without rehydrating. Mirrors the pre-lift
@@ -1690,19 +1521,15 @@ def test_export_404_when_kind_interactive(storage):


 def test_cancel_resolves_pending_approval(storage):
-    """Cancel addresses the workstream, not one batch — EVERY live
-    cycle resolves (parallel task agents can hold several gates)."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
    assert isinstance(ws.ui, ConsoleCoordinatorUI)
-    first = _seed_pending(ws, "c-1")
-    second = _seed_pending(ws, "c-2")
+    ws.ui._pending_approval = {"type": "approve_request", "items": []}
+    ws.ui._approval_event.clear()
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post(f"/v1/api/workstreams/{ws.id}/cancel", headers=_COORD_HEADERS)
    assert resp.status_code == 200
-    assert first.event.is_set()
-    assert second.event.is_set()
-    assert first.result == (False, "Cancelled by user")
+    assert ws.ui._approval_event.is_set()


 def test_cancel_response_always_includes_dropped_key(storage):
@@ -2222,10 +2049,6 @@ def test_open_any_admin_coordinator_caller_succeeds_in_memory(storage):

 def test_open_rehydrates_when_not_in_memory(storage, monkeypatch):
    mgr = _build_mgr(storage)
-    # The tenancy gate resolves the row from storage before rehydrating, so a
-    # legitimately-openable coordinator must exist there (it always does in
-    # production — open rehydrates a persisted row).
-    storage.register_workstream("coord-rehy", kind="coordinator", user_id="user-1")
    rehydrated = MagicMock()
    rehydrated.id = "coord-rehy"
    rehydrated.name = "rehydrated"
@@ -2259,7 +2082,6 @@ def test_open_503_on_coord_mgr_unavailable(storage):

 def test_open_correlation_id_on_factory_failure(storage, monkeypatch):
    mgr = _build_mgr(storage)
-    storage.register_workstream("bad-ws", kind="coordinator", user_id="user-1")
    monkeypatch.setattr(mgr, "open", MagicMock(side_effect=RuntimeError("boom")))
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post("/v1/api/workstreams/bad-ws/open", headers=_COORD_HEADERS)
@@ -2270,7 +2092,6 @@ def test_open_correlation_id_on_factory_failure(storage, monkeypatch):
 def test_open_503_when_open_raises_value_error(storage, monkeypatch):
    """ValueError from the factory surfaces as 503 with the remediation text."""
    mgr = _build_mgr(storage)
-    storage.register_workstream("bad-ws", kind="coordinator", user_id="user-1")
    monkeypatch.setattr(mgr, "open", MagicMock(side_effect=ValueError("coord registry missing")))
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
    resp = client.post("/v1/api/workstreams/bad-ws/open", headers=_COORD_HEADERS)
@@ -2436,8 +2257,7 @@ def test_cluster_inspect_invalid_ws_id_400(storage):


 def test_cluster_inspect_any_inspect_caller_sees_detail(storage):
-    # A project-less workstream has no tenancy to enforce, so any
-    # admin.cluster.inspect caller sees it (trusted-team default).
+    # Trusted-team visibility: admin.cluster.inspect sees every row.
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="owner")
    client = _make_client(storage, coord_mgr=mgr, registry=_fake_registry())
@@ -2449,46 +2269,6 @@ def test_cluster_inspect_any_inspect_caller_sees_detail(storage):
    assert resp.json()["persisted"]["ws_id"] == ws.id


-def test_cluster_inspect_private_project_hidden_from_non_member(storage):
-    # admin.cluster.inspect gates the surface, but a workstream in a
-    # private project the caller isn't a member of is masked as 404 —
-    # no private-project oracle even for a cluster admin.
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.register_workstream(
-        "c" * 32,
-        node_id="console",
-        user_id="alice",
-        kind="coordinator",
-        project_id="proj-secret",
-    )
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/cluster/ws/{'c' * 32}/detail",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.cluster.inspect"},
-    )
-    assert resp.status_code == 404
-
-
-def test_cluster_inspect_private_project_visible_to_member(storage):
-    # A project member (even a non-owner) still sees the persisted row.
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.add_project_member("proj-secret", "member-bob")
-    storage.register_workstream(
-        "c" * 32,
-        node_id="console",
-        user_id="alice",
-        kind="coordinator",
-        project_id="proj-secret",
-    )
-    client = _make_client(storage, coord_mgr=_build_mgr(storage), registry=_fake_registry())
-    resp = client.get(
-        f"/v1/api/cluster/ws/{'c' * 32}/detail",
-        headers={"X-Test-User": "member-bob", "X-Test-Perms": "admin.cluster.inspect"},
-    )
-    assert resp.status_code == 200
-    assert resp.json()["persisted"]["ws_id"] == "c" * 32
-
-
 def test_cluster_inspect_coordinator_self_path(storage):
    """A coordinator row returns live from the in-process manager."""
    mgr = _build_mgr(storage)
@@ -2619,7 +2399,6 @@ def test_cluster_inspect_node_backed_pending_approval_detail_passes_through(stor
    ws_id = "f0" * 16
    _seed_node_workstream(storage, ws_id=ws_id, node_id="node-a")
    detail = {
-        "cycle_id": "cyc-bash",
        "call_id": "c-bash",
        "judge_pending": False,
        "items": [
@@ -2648,7 +2427,7 @@ def test_cluster_inspect_node_backed_pending_approval_detail_passes_through(stor
                "activity_state": "approval",
                "activity": "awaiting approval",
                "tokens": 100,
-                "pending_approval_details": [detail],
+                "pending_approval_detail": detail,
            }
        ]
    }
@@ -2659,7 +2438,7 @@ def test_cluster_inspect_node_backed_pending_approval_detail_passes_through(stor
    assert resp.status_code == 200
    live = resp.json()["live"]
    assert live["pending_approval"] is True  # derived bool, existing behavior
-    assert live["pending_approval_details"] == [detail]  # full payload passthrough
+    assert live["pending_approval_detail"] == detail  # full payload, new behavior


 def test_cluster_inspect_node_backed_pending_approval_synthesized(storage):
@@ -313,17 +313,17 @@ def test_coordinator_js_handle_child_state_no_longer_reads_sse_pending_approval_
    )

    # The merge body must preserve BOTH pending_approval and
-    # pending_approval_details from prev — preserving only one would
+    # pending_approval_detail from prev — preserving only one would
    # render a row with a phantom badge but no buttons (or vice versa).
    merge_body = re.search(
        r"mergedLive\s*=\s*Object\.assign\(\s*\{\}\s*,\s*live\s*,\s*\{"
        r"[^}]*pending_approval:\s*prev\.live\.pending_approval[^}]*"
-        r"pending_approval_details:\s*prev\.live\.pending_approval_details",
+        r"pending_approval_detail:\s*prev\.live\.pending_approval_detail",
        body,
    )
    assert merge_body is not None, (
        "Merge body must preserve both pending_approval AND "
-        "pending_approval_details from prev.live — preserving only one "
+        "pending_approval_detail from prev.live — preserving only one "
        "creates a half-rendered approval row."
    )

@@ -35,14 +35,7 @@ class _StubUI:
    def on_error(self, msg: str) -> None:
        self.errors.append(msg)

-    def on_tool_result(
-        self,
-        call_id: str,
-        name: str,
-        output: str,
-        is_error: bool = False,
-        preview: dict[str, Any] | None = None,
-    ) -> None:
+    def on_tool_result(self, call_id: str, name: str, output: str, is_error: bool = False) -> None:
        self.tool_results.append((call_id, name, output, is_error))

    # Other SessionUI methods — only stubs, not exercised here.
@@ -205,23 +198,6 @@ def test_spawn_prepare_needs_approval(coord_session):
    assert item["skill"] == "s"


-def test_spawn_prepare_denies_high_risk_skill(coord_session):
-    """Review fix: the high/critical-risk gate that blocks skills(load) also
-    blocks spawn_workstream(skill=…), so a child spawn can't route around it."""
-    sess, _coord, _ui = coord_session
-    with patch("turnstone.core.session.get_storage") as gs:
-        gs.return_value.get_prompt_template_by_name.return_value = {
-            "name": "danger",
-            "risk_level": "critical",
-        }
-        item = sess._prepare_tool(
-            _tc("spawn_workstream", {"initial_message": "go", "skill": "danger"})
-        )
-    assert "error" in item
-    assert "/skill danger" in item["error"]
-    assert item.get("needs_approval") is not True
-
-
 def test_spawn_exec_calls_client_and_returns_summary(coord_session):
    sess, coord, _ui = coord_session
    coord.spawn.return_value = {
@@ -1,239 +0,0 @@
-"""Tests for the effective effort-ladder projection.
-
-The ladder must mirror the request-time mapping functions exactly —
-equal ``effective`` tokens promise byte-identical effort behavior on
-the wire, which is what the UI annotations lean on.
-"""
-
-from __future__ import annotations
-
-from turnstone.core.providers._protocol import ModelCapabilities
-from turnstone.core.providers.effort_ladder import (
-    KNOB_VALUES,
-    effort_ladder,
-    effort_ladder_for_model,
-)
-
-
-def _as_map(ladder: list[dict[str, str]]) -> dict[str, str]:
-    assert [r["value"] for r in ladder] == list(KNOB_VALUES)
-    return {r["value"]: r["effective"] for r in ladder}
-
-
-class TestLocalLanes:
-    def test_toggle_engaged_carries_graded_value_per_position(self) -> None:
-        """No declared effort key: the toggle rides the knob AND the graded
-        value is forwarded under the fallback template key — the user's
-        effort setting always reaches the wire (a template that doesn't
-        reference the kwarg ignores it), so every position is distinct."""
-        caps = ModelCapabilities(thinking_mode="manual", thinking_param="enable_thinking")
-        eff = _as_map(effort_ladder("anthropic-compatible", caps))
-        assert eff["none"] == "off"
-        assert eff["minimal"] == "on+minimal"
-        assert eff["max"] == "on+max"
-        assert len({eff[k] for k in KNOB_VALUES}) == len(KNOB_VALUES)
-
-    def test_freeform_effort_param_forwards_each_value(self) -> None:
-        """deepseek-style config: toggle + verbatim effort per position."""
-        caps = ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="thinking",
-            effort_param="reasoning_effort",
-        )
-        eff = _as_map(effort_ladder("anthropic-compatible", caps))
-        assert eff["none"] == "off"
-        assert eff["low"] == "on+low"
-        assert eff["max"] == "on+max"
-
-    def test_validated_effort_param_shows_snapping(self) -> None:
-        """Off-list positions round up onto the declared values; above the
-        ceiling they ride the ceiling — never the (possibly lower) default."""
-        caps = ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="enable_thinking",
-            effort_param="reasoning_effort",
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        )
-        eff = _as_map(effort_ladder("openai-compatible", caps))
-        assert eff["minimal"] == "on+low"
-        assert eff["high"] == "on+high"
-        assert eff["xhigh"] == "on+high"
-        assert eff["max"] == "on+high"
-
-    def test_openai_compatible_flat_param_without_effort_param(self) -> None:
-        caps = ModelCapabilities(
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        )
-        eff = _as_map(effort_ladder("openai-compatible", caps))
-        assert eff["none"] == "default"
-        assert eff["high"] == "high"
-        assert eff["xhigh"] == "high"  # ceiling, not default
-
-    def test_adaptive_local_never_off(self) -> None:
-        caps = ModelCapabilities(thinking_mode="adaptive", thinking_param="enable_thinking")
-        eff = _as_map(effort_ladder("openai-compatible", caps))
-        assert eff["none"] == "on"
-        assert eff["max"] == "on"
-
-
-class TestNativeAnthropicLane:
-    def test_adaptive_with_effort_levels(self) -> None:
-        caps = ModelCapabilities(
-            thinking_mode="adaptive",
-            supports_effort=True,
-            effort_levels=("low", "medium", "high", "xhigh", "max"),
-        )
-        eff = _as_map(effort_ladder("anthropic", caps))
-        assert eff["none"] == "adaptive"  # thinking on, model decides
-        assert eff["minimal"] == "low"  # rounds up onto the declared levels
-        assert eff["low"] == "low"
-        assert eff["max"] == "max"
-
-    def test_sonnet_5_registry_row(self) -> None:
-        """claude-sonnet-5: adaptive + full effort ladder incl. xhigh/max —
-        every knob level above none is a distinct wire behavior."""
-        eff = _as_map(effort_ladder_for_model("anthropic", "claude-sonnet-5", None))
-        assert eff["none"] == "adaptive"
-        assert eff["minimal"] == "low"  # rounds up onto declared levels
-        assert eff["low"] == "low"
-        assert eff["xhigh"] == "xhigh"
-        assert eff["max"] == "max"
-
-    def test_sonnet_4_6_xhigh_rides_max(self) -> None:
-        """Sonnet 4.6 declares (low, medium, high, max) — no xhigh, so the
-        knob's xhigh snaps up onto max rather than down onto high."""
-        eff = _as_map(effort_ladder_for_model("anthropic", "claude-sonnet-4-6", None))
-        assert eff["high"] == "high"
-        assert eff["xhigh"] == "max"
-        assert eff["max"] == "max"
-
-    def test_manual_budget_ladder(self) -> None:
-        """Budgets are monotone over the whole knob domain."""
-        caps = ModelCapabilities(thinking_mode="manual")
-        eff = _as_map(effort_ladder("anthropic", caps))
-        assert eff["none"] == "off"
-        assert eff["minimal"] == eff["low"] == "budget:1024"  # 1024 = API floor
-        assert eff["medium"] == "budget:4096"
-        assert eff["high"] == "budget:16384"
-        assert eff["xhigh"] == "budget:32768"
-        assert eff["max"] == "budget:65536"
-
-
-class TestFlatParamLanes:
-    def test_google_default_caps(self) -> None:
-        eff = _as_map(effort_ladder_for_model("google", "gemini-3-flash", None))
-        assert eff["none"] == "default"
-        assert eff["minimal"] == "minimal"
-        assert eff["high"] == "high"
-        assert eff["xhigh"] == eff["max"] == "high"
-
-    def test_google_override_routes_through_chat_lane(self) -> None:
-        """GoogleProvider inherits _finalize_extra_body — a thinking_mode
-        override changes real requests, and the ladder must mirror it."""
-        eff = _as_map(
-            effort_ladder_for_model(
-                "google",
-                "gemini-3-flash",
-                {"thinking_mode": "manual", "thinking_param": "enable_thinking"},
-            )
-        )
-        assert eff["none"] == "off"
-        assert eff["medium"] == "on+medium"  # toggle + inherited flat param
-
-    def test_responses_surface_projects_flat_only(self) -> None:
-        caps_overrides = {
-            "thinking_mode": "manual",
-            "reasoning_effort_values": ["low", "medium", "high"],
-        }
-        chat = _as_map(effort_ladder_for_model("openai-compatible", "m", caps_overrides))
-        responses = _as_map(
-            effort_ladder_for_model(
-                "openai-compatible", "m", caps_overrides, api_surface="responses"
-            )
-        )
-        assert chat["medium"] == "on+medium"
-        assert responses["medium"] == "medium"
-        assert responses["none"] == "default"
-
-    def test_xai_projects_flat_only(self) -> None:
-        """grok-4.3 declares values (none/low/medium/high, default low);
-        knob positions above the ceiling ride the ceiling (high).  The
-        declared "none" IS forwarded for the knob's off position (xAI
-        documents it as disabling reasoning) but is never a snap target
-        for other positions."""
-        eff = _as_map(effort_ladder_for_model("xai", "grok-4.3", None))
-        assert eff["none"] == "none"  # explicit disable, declared by grok
-        assert eff["minimal"] == "low"
-        assert eff["low"] == "low"
-        assert eff["high"] == "high"
-        assert eff["xhigh"] == eff["max"] == "high"
-
-    def test_xai_ignores_template_overrides(self) -> None:
-        """XAIProvider subclasses OpenAIResponsesProvider, which drops
-        extra_body — a thinking_mode/effort_param override cannot change
-        an xai request, so it must not change the ladder either."""
-        eff = _as_map(
-            effort_ladder_for_model(
-                "xai",
-                "grok-4.3",
-                {
-                    "thinking_mode": "manual",
-                    "thinking_param": "enable_thinking",
-                    "effort_param": "reasoning_effort",
-                },
-            )
-        )
-        assert eff["none"] == "none"  # flat channel, not an "off" toggle
-        assert eff["medium"] == "medium"
-        assert all("+" not in v and v not in ("on", "off") for v in eff.values())
-
-    def test_openai_gpt55_registry_row(self) -> None:
-        """gpt-5.5 declares none/low/medium/high/xhigh with default medium:
-        knob none sends the explicit "none" level (server default is
-        MEDIUM, so omission would not disable), max rides the xhigh
-        ceiling, minimal rounds up to low."""
-        eff = _as_map(effort_ladder_for_model("openai", "gpt-5.5", None))
-        assert eff["none"] == "none"
-        assert eff["minimal"] == "low"
-        assert eff["xhigh"] == "xhigh"
-        assert eff["max"] == "xhigh"
-
-    def test_openai_o3_registry_row(self) -> None:
-        """o-series (except o1-mini) accept low/medium/high; no declared
-        "none" level, so the knob's off position omits the param."""
-        eff = _as_map(effort_ladder_for_model("openai", "o3", None))
-        assert eff["none"] == "default"
-        assert eff["minimal"] == "low"
-        assert eff["medium"] == "medium"
-        assert eff["xhigh"] == eff["max"] == "high"
-
-    def test_openai_codex_max_has_xhigh(self) -> None:
-        """gpt-5.1-codex-max must not prefix-fall onto the gpt-5.1 row
-        (which lacks xhigh) — xhigh reaches the wire verbatim."""
-        eff = _as_map(effort_ladder_for_model("openai", "gpt-5.1-codex-max", None))
-        assert eff["xhigh"] == "xhigh"
-        assert eff["max"] == "xhigh"
-
-    def test_anthropic_effort_applies_even_with_thinking_mode_none(self) -> None:
-        """output_config gates on supports_effort alone at request time."""
-        caps = ModelCapabilities(
-            thinking_mode="none",
-            supports_effort=True,
-            effort_levels=("low", "medium", "high"),
-        )
-        eff = _as_map(effort_ladder("anthropic", caps))
-        assert eff["high"] == "high"
-        assert eff["none"] == "default"
-
-    def test_overrides_merge_and_unknown_keys_ignored(self) -> None:
-        eff = _as_map(
-            effort_ladder_for_model(
-                "google",
-                "gemini-3-flash",
-                {"reasoning_effort_values": [], "not_a_field": True},
-            )
-        )
-        # Operator cleared the values → nothing effort-related is sent.
-        assert set(eff.values()) == {"default"}
@@ -1,410 +0,0 @@
-"""Ladder↔wire parity harness — the effort ladder must tell the truth.
-
-``effort_ladder`` *projects* the session effort knob through the same
-mapping functions the providers use at request time.  This suite proves
-that projection against the REAL request path: for every provider lane
-and capability shape, each knob position is driven through the actual
-provider ``create_streaming`` against a recording fake client (the same
-SDK-seam capture the wire-payload goldens use), the effort-relevant
-subset of the captured kwargs is extracted, and it must equal what the
-ladder token decodes to.  Two invariants per shape:
-
-1. **Semantics** — each ladder token decodes to an expected wire subset
-   (``on``/``off`` ⇒ the chat-template toggle, ``budget:N`` ⇒ Anthropic
-   thinking budget, a bare level ⇒ the lane's flat/effort channel) and
-   the observed wire subset must match it exactly.
-2. **Grouping** — the ladder's core promise: two knob positions carry
-   equal ``effective`` tokens if and only if they produce identical
-   effort-relevant wire payloads.
-
-A failure here means the UI annotates behavior the wire does not have —
-the bug class that shipped xai in the ladder's chat-lane set even though
-``XAIProvider`` rides the Responses surface, which drops ``extra_body``.
-
-The harness goes through ``create_provider`` (not direct classes) so the
-provider ROUTING the ladder assumes — e.g. ``api_surface="responses"``
-selecting the Responses adapter — is itself under test.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import dataclasses
-import itertools
-from typing import Any
-
-import pytest
-
-from tests._wire_capture import RecordingClient
-from turnstone.core.providers import create_provider
-from turnstone.core.providers._protocol import (
-    EFFORT_TEMPLATE_FALLBACK_PARAM,
-    ModelCapabilities,
-)
-from turnstone.core.providers.effort_ladder import KNOB_VALUES, effort_ladder
-
-# Above the largest manual-mode thinking budget (max: 65536) so the
-# request path's budget<max_tokens clamp never fires — the ladder
-# documents budgets unclamped, so the capture must be too.  (At small
-# per-request max_tokens the clamp can genuinely alias adjacent budget
-# tiers on the wire; that is the ladder's documented approximation, not
-# a parity break.)
-_MAX_TOKENS = 128_000
-
-
-@dataclasses.dataclass(frozen=True)
-class Shape:
-    """One (provider lane, capability shape) point of the parity matrix."""
-
-    id: str
-    provider: str
-    caps: ModelCapabilities
-    api_surface: str = ""
-    model: str = "m"
-
-
-# Real registry rows for the lanes whose defaults carry effort values —
-# parity should cover what ships, not only synthetic shapes.
-_GEMINI_CAPS = create_provider("google").get_capabilities("gemini-3-flash")
-_GROK_CAPS = create_provider("xai").get_capabilities("grok-4.3")
-_GPT55_CAPS = create_provider("openai").get_capabilities("gpt-5.5")
-
-SHAPES: tuple[Shape, ...] = (
-    # -- anthropic-compatible (vLLM /v1/messages): template channel only --
-    Shape(
-        "compat-toggle-manual",
-        "anthropic-compatible",
-        ModelCapabilities(thinking_mode="manual", thinking_param="enable_thinking"),
-    ),
-    Shape(
-        "compat-toggle-adaptive",
-        "anthropic-compatible",
-        ModelCapabilities(thinking_mode="adaptive", thinking_param="enable_thinking"),
-    ),
-    Shape(
-        "compat-freeform-effort",
-        "anthropic-compatible",
-        ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="thinking",
-            effort_param="reasoning_effort",
-        ),
-    ),
-    Shape(
-        # DeepSeek-V4 official contract: toggle + effort in {high, max}.
-        "compat-validated-effort",
-        "anthropic-compatible",
-        ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="thinking",
-            effort_param="reasoning_effort",
-            reasoning_effort_values=("high", "max"),
-            default_reasoning_effort="high",
-        ),
-    ),
-    Shape(
-        "compat-inert",
-        "anthropic-compatible",
-        ModelCapabilities(thinking_mode="none"),
-    ),
-    # -- openai-compatible on the Chat Completions surface: both channels --
-    Shape(
-        "oc-toggle-only",
-        "openai-compatible",
-        ModelCapabilities(thinking_mode="manual", thinking_param="enable_thinking"),
-    ),
-    Shape(
-        "oc-toggle-plus-flat",
-        "openai-compatible",
-        ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="enable_thinking",
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        ),
-    ),
-    Shape(
-        "oc-effort-param-suppresses-flat",
-        "openai-compatible",
-        ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="enable_thinking",
-            effort_param="reasoning_effort",
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        ),
-    ),
-    Shape(
-        "oc-flat-only",
-        "openai-compatible",
-        ModelCapabilities(
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        ),
-    ),
-    Shape(
-        "oc-adaptive",
-        "openai-compatible",
-        ModelCapabilities(thinking_mode="adaptive", thinking_param="enable_thinking"),
-    ),
-    # -- openai-compatible pinned to the Responses surface: template caps
-    #    become inert and only the native flat channel remains --
-    Shape(
-        "oc-responses-surface",
-        "openai-compatible",
-        ModelCapabilities(
-            thinking_mode="manual",
-            thinking_param="enable_thinking",
-            effort_param="reasoning_effort",
-            reasoning_effort_values=("low", "medium", "high"),
-            default_reasoning_effort="medium",
-        ),
-        api_surface="responses",
-    ),
-    # -- commercial flat lanes --
-    Shape(
-        # Real registry row: none/low/medium/high/xhigh, default medium.
-        # Knob none must send the EXPLICIT "none" level (omission would
-        # leave the server default medium reasoning on); knob max rides
-        # the xhigh ceiling.
-        "openai-gpt-5.5",
-        "openai",
-        _GPT55_CAPS,
-        model="gpt-5.5",
-    ),
-    Shape("google-default", "google", _GEMINI_CAPS, model="gemini-3-flash"),
-    Shape(
-        # GoogleProvider subclasses the chat provider, so a template
-        # override DOES change real requests — hybrid toggle + flat.
-        "google-manual-override",
-        "google",
-        dataclasses.replace(_GEMINI_CAPS, thinking_mode="manual", thinking_param="enable_thinking"),
-        model="gemini-3-flash",
-    ),
-    Shape("xai-default", "xai", _GROK_CAPS, model="grok-4.3"),
-    Shape(
-        # XAIProvider rides the Responses surface: template overrides are
-        # inert on the wire, and the ladder must not pretend otherwise.
-        "xai-template-override-inert",
-        "xai",
-        dataclasses.replace(
-            _GROK_CAPS,
-            thinking_mode="manual",
-            thinking_param="enable_thinking",
-            effort_param="reasoning_effort",
-        ),
-        model="grok-4.3",
-    ),
-    # -- native Anthropic --
-    Shape(
-        "anthropic-adaptive-effort",
-        "anthropic",
-        ModelCapabilities(
-            thinking_mode="adaptive",
-            supports_effort=True,
-            effort_levels=("low", "medium", "high", "xhigh", "max"),
-        ),
-        model="claude-fable-5",
-    ),
-    Shape(
-        "anthropic-adaptive-plain",
-        "anthropic",
-        ModelCapabilities(thinking_mode="adaptive"),
-        model="claude-fable-5",
-    ),
-    Shape(
-        "anthropic-manual-budgets",
-        "anthropic",
-        ModelCapabilities(thinking_mode="manual"),
-        model="claude-3-7-sonnet-latest",
-    ),
-    Shape(
-        "anthropic-manual-plus-effort",
-        "anthropic",
-        ModelCapabilities(
-            thinking_mode="manual",
-            supports_effort=True,
-            effort_levels=("low", "medium", "high"),
-        ),
-        model="claude-3-7-sonnet-latest",
-    ),
-    Shape(
-        "anthropic-none-effort",
-        "anthropic",
-        ModelCapabilities(
-            thinking_mode="none",
-            supports_effort=True,
-            effort_levels=("low", "medium", "high"),
-        ),
-        model="claude-3-5-haiku-latest",
-    ),
-    Shape(
-        "anthropic-inert",
-        "anthropic",
-        ModelCapabilities(thinking_mode="none"),
-        model="claude-3-5-haiku-latest",
-    ),
-)
-
-
-# --------------------------------------------------------------------------- #
-# Wire capture + effort-subset extraction
-# --------------------------------------------------------------------------- #
-
-
-def _wire_payload(shape: Shape, knob: str) -> dict[str, Any]:
-    """Drive the real provider request path; return the captured SDK kwargs."""
-    provider = create_provider(shape.provider, api_surface=shape.api_surface or None)
-    client = RecordingClient()
-    gen = provider.create_streaming(
-        client=client,
-        model=shape.model,
-        messages=[{"role": "user", "content": "hi"}],
-        max_tokens=_MAX_TOKENS,
-        reasoning_effort=knob,
-        capabilities=shape.caps,
-    )
-    # kwargs are recorded eagerly during the call above; close the
-    # unconsumed iterator so stream-manager cleanup runs on the stub.
-    close = getattr(gen, "close", None)
-    if callable(close):
-        with contextlib.suppress(Exception):
-            close()
-    assert "payload" in client.captured, f"{shape.id}: provider made no SDK call"
-    return dict(client.captured["payload"])
-
-
-def _effort_wire_subset(payload: dict[str, Any], shape: Shape) -> dict[str, Any]:
-    """Every effort-related lever in *payload*, normalized across lanes.
-
-    Keys: ``thinking`` (native Anthropic param), ``output_effort``
-    (Anthropic ``output_config.effort``), ``flat`` (Chat Completions
-    ``reasoning_effort`` / Responses ``reasoning.effort``), ``toggle``
-    and ``template_effort`` (``extra_body.chat_template_kwargs`` — the
-    graded key is ``caps.effort_param``, else the fallback template key
-    on the anthropic-compatible lane, whose only effort channel is the
-    template).
-    """
-    caps = shape.caps
-    effort_key = caps.effort_param or (
-        EFFORT_TEMPLATE_FALLBACK_PARAM if shape.provider == "anthropic-compatible" else ""
-    )
-    subset: dict[str, Any] = {}
-    if "thinking" in payload:
-        subset["thinking"] = payload["thinking"]
-    output_config = payload.get("output_config")
-    if isinstance(output_config, dict) and "effort" in output_config:
-        subset["output_effort"] = output_config["effort"]
-    if "reasoning_effort" in payload:
-        subset["flat"] = payload["reasoning_effort"]
-    reasoning = payload.get("reasoning")
-    if isinstance(reasoning, dict) and "effort" in reasoning:
-        subset["flat"] = reasoning["effort"]
-    extra_body = payload.get("extra_body")
-    ctk = extra_body.get("chat_template_kwargs") if isinstance(extra_body, dict) else None
-    if isinstance(ctk, dict):
-        known = {caps.thinking_param, effort_key} - {""}
-        unexpected = set(ctk) - known
-        assert not unexpected, f"unexpected chat_template_kwargs keys: {unexpected}"
-        if caps.thinking_param in ctk:
-            subset["toggle"] = ctk[caps.thinking_param]
-        if effort_key and effort_key in ctk:
-            subset["template_effort"] = ctk[effort_key]
-    return subset
-
-
-# --------------------------------------------------------------------------- #
-# Ladder-token decoding — the token grammar, made executable
-# --------------------------------------------------------------------------- #
-
-
-def _decode_token(shape: Shape, token: str) -> dict[str, Any]:
-    """Expected effort wire subset for a ladder ``effective`` token."""
-    caps = shape.caps
-    if shape.provider == "anthropic":
-        return _decode_native(caps, token)
-    if shape.provider in ("openai", "xai") or shape.api_surface == "responses":
-        return {} if token == "default" else {"flat": token}
-    return _decode_template(shape.provider, caps, token)
-
-
-def _decode_native(caps: ModelCapabilities, token: str) -> dict[str, Any]:
-    if caps.thinking_mode == "adaptive":
-        # Thinking is unconditionally adaptive; a non-"adaptive" token is
-        # the output_config effort level riding on top.
-        expected: dict[str, Any] = {"thinking": {"type": "adaptive"}}
-        if token != "adaptive":
-            expected["output_effort"] = token
-        return expected
-    if token in ("default", "off"):
-        return {}
-    effort, sep, budget = token.partition("·budget:")
-    if sep:
-        return {
-            "output_effort": effort,
-            "thinking": {"type": "enabled", "budget_tokens": int(budget)},
-        }
-    if token.startswith("budget:"):
-        budget_tokens = int(token.removeprefix("budget:"))
-        return {"thinking": {"type": "enabled", "budget_tokens": budget_tokens}}
-    return {"output_effort": token}
-
-
-def _decode_template(provider: str, caps: ModelCapabilities, token: str) -> dict[str, Any]:
-    if token == "default":
-        return {}
-    parts = token.split("+")
-    expected: dict[str, Any] = {}
-    if parts[0] in ("on", "off"):
-        expected["toggle"] = parts[0] == "on"
-        parts = parts[1:]
-    if parts:
-        assert len(parts) == 1, f"unparseable ladder token: {token!r}"
-        if caps.effort_param or provider == "anthropic-compatible":
-            # Declared graded key, or the anthropic-compatible fallback
-            # template key — that lane has no flat channel, so a graded
-            # part there is always template-borne.
-            expected["template_effort"] = parts[0]
-        else:
-            expected["flat"] = parts[0]
-    return expected
-
-
-# --------------------------------------------------------------------------- #
-# The parity tests
-# --------------------------------------------------------------------------- #
-
-
-@pytest.mark.parametrize("shape", SHAPES, ids=lambda s: s.id)
-def test_ladder_tokens_match_wire(shape: Shape) -> None:
-    """Invariant 1: each token's decoded meaning equals the captured wire."""
-    ladder = effort_ladder(shape.provider, shape.caps, shape.api_surface)
-    assert [row["value"] for row in ladder] == list(KNOB_VALUES)
-    for row in ladder:
-        knob, token = row["value"], row["effective"]
-        observed = _effort_wire_subset(_wire_payload(shape, knob), shape)
-        expected = _decode_token(shape, token)
-        assert observed == expected, (
-            f"{shape.id}/knob={knob}: ladder says {token!r} which decodes to "
-            f"{expected}, but the wire carries {observed}"
-        )
-
-
-@pytest.mark.parametrize("shape", SHAPES, ids=lambda s: s.id)
-def test_equal_tokens_iff_equal_wire(shape: Shape) -> None:
-    """Invariant 2: token equality ⇔ effort-wire equality, per shape."""
-    tokens = {
-        row["value"]: row["effective"]
-        for row in effort_ladder(shape.provider, shape.caps, shape.api_surface)
-    }
-    subsets = {knob: _effort_wire_subset(_wire_payload(shape, knob), shape) for knob in KNOB_VALUES}
-    for a, b in itertools.combinations(KNOB_VALUES, 2):
-        same_token = tokens[a] == tokens[b]
-        same_wire = subsets[a] == subsets[b]
-        assert same_token == same_wire, (
-            f"{shape.id}: knobs {a!r}/{b!r} have "
-            f"{'equal' if same_token else 'distinct'} tokens "
-            f"({tokens[a]!r} vs {tokens[b]!r}) but "
-            f"{'identical' if same_wire else 'different'} wire subsets "
-            f"({subsets[a]} vs {subsets[b]})"
-        )
@@ -28,10 +28,8 @@ from unittest.mock import MagicMock, patch

 import pytest

-from tests._helpers import wait_until as _wait_until
 from tests.test_session_manager import FakeStorage
-from turnstone.core import session_worker
-from turnstone.core.idle_nudge_watcher import IdleNudgeWatcher, wake_workstream_if_pending
+from turnstone.core.idle_nudge_watcher import IdleNudgeWatcher
 from turnstone.core.session import ChatSession
 from turnstone.core.session_manager import SessionManager
 from turnstone.core.trajectory import dicts_from_turns, turn_from_dict
@@ -301,72 +299,6 @@ def test_idle_event_with_empty_queue_does_not_dispatch_wake(real_mgr, tmp_db):
        watcher.shutdown()


-def test_watch_fire_on_already_idle_session_drives_wake_send(real_mgr, tmp_db):
-    """A watch firing on an ALREADY-idle workstream sees no IDLE
-    transition, so :class:`IdleNudgeWatcher` never re-checks the queue —
-    the dispatch closure's ``wake_fn`` must drive the wake itself.
-
-    Boundary path under test (only the LLM stream is patched):
-      dispatch closure (real, built by ``set_watch_runner``)
-        → NudgeQueue.enqueue (real)
-        → wake_fn → wake_workstream_if_pending (real)
-        → session_worker.send (real) → daemon thread
-        → ChatSession.deliver_wake_nudge_from_queue (real)
-        → ChatSession.send("") → watch_triggered system turn in history
-    """
-    mgr, _adapter = real_mgr
-    ws = mgr.create(user_id="u1", name="watch-wake-int", skill=None)
-    assert ws.session is not None
-
-    captured: dict[str, Any] = {}
-
-    class _StubRunner:
-        def set_dispatch_fn(self, ws_id: str, fn: Any) -> None:
-            captured["fn"] = fn
-
-    # Production wiring shape (server.py): wake_fn closes over the
-    # Workstream OBJECT — not its id — so eviction+restore id drift
-    # can't strand the wake.
-    ws.session.set_watch_runner(
-        _StubRunner(), wake_fn=lambda: wake_workstream_if_pending(ws, trigger="watch-fire")
-    )
-
-    with (
-        patch.object(ws.session, "_create_stream_with_retry", return_value=iter([])),
-        patch.object(
-            ws.session,
-            "_stream_response",
-            return_value={"role": "assistant", "content": "ok"},
-        ),
-        patch.object(ws.session, "_update_token_table"),
-        patch.object(ws.session, "_print_status_line"),
-        patch.object(ws.session, "_visible_memory_count", return_value=0),
-        patch("turnstone.core.session.save_message"),
-    ):
-        ws.session._title_generated = True
-        # Idle all along — no worker, and no state transition coming.
-        assert ws.state is WorkstreamState.IDLE
-
-        # Simulate the WatchRunner poll thread delivering a fire.
-        captured["fn"]({"type": "watch_triggered", "text": "deploy finished: OK"}, "watch-1")
-
-        _wait_for_worker_done(ws)
-
-    # Queue drained by the wake — not parked until the next user message.
-    assert len(ws.session._nudge_queue) == 0
-
-    msgs = dicts_from_turns(ws.session.messages)
-    user_msgs = [m for m in msgs if m.get("role") == "user"]
-    assert user_msgs, "expected a synthesized user message from the wake"
-    assert user_msgs[-1]["content"] == ""
-    assert user_msgs[-1].get("_source") == "system_nudge"
-    sys_turns = [m for m in msgs if m.get("role") == "system"]
-    assert any(
-        m.get("_source") == "watch_triggered" and "deploy finished: OK" in m.get("content", "")
-        for m in sys_turns
-    ), f"expected a watch_triggered system turn, got {sys_turns!r}"
-
-
@pytest.fixture
 def coord_mgr() -> tuple[SessionManager, _BuildRealSessionAdapter, FakeStorage]:
    """Real coord-side SessionManager with the adapter's kind set to
@@ -479,120 +411,3 @@ def test_coord_idle_with_active_children_emits_envelope_via_real_managers(coord_
    finally:
        watcher.shutdown()
        observer.shutdown()
-
-
-def test_coord_idle_emitted_from_worker_thread_still_wakes(coord_mgr, tmp_db):
-    """The production-shaped race the test above does NOT exercise: in
-    production, IDLE is emitted from INSIDE the worker (``set_state``
-    subscribers fire on the calling thread — the coord's send emits IDLE
-    before its worker exits).  The watcher's wake dispatch therefore
-    lands on ``session_worker.send``'s reuse path while the
-    transitioning worker still owns the flag, and no-ops.  Without the
-    ownership-clear backstop the ``idle_children`` nudge strands until
-    the next user message — a coord that forgot ``wait_for_workstream``
-    never revives.
-
-    Boundary path under test:
-      worker thread: mgr.set_state(IDLE)
-        → observer enqueues (real) → watcher wake no-ops (worker owns flag)
-        → run() returns → session_worker._runner finally clears the flag
-        → _retry_pending_wake → wake_workstream_if_pending (real)
-        → wake daemon → deliver_wake_nudge_from_queue → send("")
-        → idle_children system turn in history
-    """
-    from turnstone.console.coordinator_idle_observer import CoordinatorIdleObserver
-    from turnstone.core.workstream import WorkstreamKind as _Kind
-
-    mgr, adapter, storage = coord_mgr
-    observer = CoordinatorIdleObserver(mgr, storage)
-    observer.start()
-    watcher = IdleNudgeWatcher(mgr)
-    watcher.start()
-
-    try:
-        coord = mgr.create(user_id="u1", name="parent-coord-2", skill=None)
-        assert coord.session is not None
-
-        storage.register_workstream(
-            "child-x",
-            user_id="u1",
-            name="crawl-docs",
-            kind=_Kind.INTERACTIVE,
-            parent_ws_id=coord.id,
-            state="running",
-        )
-
-        coord.session.messages.append(turn_from_dict({"role": "user", "content": "spawn 1"}))
-        coord.session.messages.append(turn_from_dict({"role": "assistant", "content": "ok"}))
-
-        with (
-            patch.object(coord.session, "_create_stream_with_retry", return_value=iter([])),
-            patch.object(
-                coord.session,
-                "_stream_response",
-                return_value={"role": "assistant", "content": "ack"},
-            ),
-            patch.object(coord.session, "_full_messages", return_value=[]),
-            patch.object(coord.session, "_update_token_table"),
-            patch.object(coord.session, "_print_status_line"),
-            patch.object(coord.session, "_visible_memory_count", return_value=0),
-            patch("turnstone.core.session.save_message"),
-        ):
-            coord.session._title_generated = True
-
-            # Drive the IDLE transition from INSIDE a session_worker
-            # worker, as production does.
-            ok = session_worker.send(
-                coord,
-                enqueue=lambda: None,
-                run=lambda: mgr.set_state(coord.id, WorkstreamState.IDLE),
-                thread_name="coord-send-sim",
-            )
-            assert ok is True
-            # Without the backstop the queue never drains (the watcher's
-            # transition-time wake no-opped against the sim worker) and
-            # this poll times out.  Queue-empty implies the wake worker's
-            # drain ran, so the follow-up flag poll waits for ITS exit.
-            _wait_until(lambda: len(coord.session._nudge_queue) == 0)
-            _wait_for_worker_done(coord)
-
-        # Queue drained by the wake, not waiting on the next user message.
-        assert len(coord.session._nudge_queue) == 0
-        msgs = dicts_from_turns(coord.session.messages)
-        user_msgs = [m for m in msgs if m.get("role") == "user"]
-        wake_msg = user_msgs[-1]
-        assert wake_msg["content"] == ""
-        assert wake_msg.get("_source") == "system_nudge"
-        idle_turns = [
-            m for m in msgs if m.get("role") == "system" and m["_source"] == "idle_children"
-        ]
-        assert len(idle_turns) == 1
-        assert "crawl-docs" in idle_turns[0]["content"]
-        assert "wait_for_workstream" in idle_turns[0]["content"]
-    finally:
-        watcher.shutdown()
-        observer.shutdown()
-
-
-def test_wake_delivery_contains_generation_cancelled(tmp_db):
-    """A close/force-cancel racing the wake turn raises
-    ``GenerationCancelled`` (a BaseException) out of ``send("")`` — the
-    wake method must contain it: it IS the wake worker's ``run()``
-    closure, and ``session_worker._runner`` catches only ``Exception``,
-    so an escape would land in ``threading.excepthook`` as stderr noise
-    on every close-vs-wake race."""
-    from tests._helpers import make_chat_session
-    from turnstone.core.session import GenerationCancelled
-
-    session = make_chat_session()
-    session._nudge_queue.enqueue("idle_children", "kids waiting", "any")
-
-    def _cancelled_send(*_a: Any, **_k: Any) -> None:
-        raise GenerationCancelled
-
-    session.send = _cancelled_send  # type: ignore[method-assign]
-
-    session.deliver_wake_nudge_from_queue()  # must not raise
-
-    assert session._wake_source_tag == ""
-    assert session._wake_drained_reminders is None
@@ -9,14 +9,13 @@ module-level function to capture calls without spawning real threads.
 from __future__ import annotations

 import contextlib
-import logging
 import threading
 from typing import Any
 from unittest.mock import patch

 import pytest

-from turnstone.core.idle_nudge_watcher import IdleNudgeWatcher, wake_workstream_if_pending
+from turnstone.core.idle_nudge_watcher import IdleNudgeWatcher
 from turnstone.core.nudge_queue import NudgeQueue
 from turnstone.core.workstream import WorkstreamState

@@ -33,7 +32,6 @@ class _FakeSession:
 class _FakeWorkstream:
    def __init__(self, ws_id: str = "ws-test") -> None:
        self.id = ws_id
-        self.state = WorkstreamState.IDLE
        self.session: _FakeSession | None = _FakeSession()
        self._lock = threading.Lock()
        self._worker_running = False
@@ -165,154 +163,3 @@ class TestIdleNudgeWatcher:
        watcher.start()
        watcher.shutdown()
        watcher.shutdown()  # no error
-
-
-class TestWakeWorkstreamIfPending:
-    """Direct tests for the shared wake gate.
-
-    The IDLE-transition path (via the watcher) is covered above; these
-    pin the gates the watch dispatch closure relies on when it calls
-    the helper directly, with no state event involved.
-    """
-
-    def test_wakes_idle_ws_with_pending_entry(self, fake_mgr_and_ws):
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        with patch("turnstone.core.session_worker.send", return_value=True) as mock_send:
-            assert wake_workstream_if_pending(ws) is True
-            assert mock_send.call_count == 1
-            kwargs = mock_send.call_args.kwargs
-            assert kwargs["enqueue"]() is None
-            kwargs["run"]()
-            assert ws.session.deliver_wake_nudge_from_queue_called == 1
-            assert kwargs["thread_name"].startswith("wake-nudge-")
-
-    def test_skips_session_none(self, fake_mgr_and_ws):
-        _mgr, ws = fake_mgr_and_ws
-        ws.session = None
-        with patch("turnstone.core.session_worker.send") as mock_send:
-            assert wake_workstream_if_pending(ws) is False
-            assert mock_send.call_count == 0
-
-    def test_skips_closed_ws(self, fake_mgr_and_ws):
-        """A workstream mid-``close()`` must not get a wake spawned on
-        its torn-down session, even while its ``state`` field still
-        reads IDLE (there is no CLOSED member — close uses the
-        ``_closed`` tombstone)."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        ws._closed = True
-        with patch("turnstone.core.session_worker.send") as mock_send:
-            assert wake_workstream_if_pending(ws) is False
-            assert mock_send.call_count == 0
-
-    def test_skips_non_idle_states(self, fake_mgr_and_ws):
-        """Busy states imply a live worker that drains at its own seams;
-        ERROR stays parked for the operator — neither gets a wake."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        with patch("turnstone.core.session_worker.send") as mock_send:
-            for state in (
-                WorkstreamState.RUNNING,
-                WorkstreamState.THINKING,
-                WorkstreamState.ATTENTION,
-                WorkstreamState.ERROR,
-            ):
-                ws.state = state
-                assert wake_workstream_if_pending(ws) is False
-            assert mock_send.call_count == 0
-
-    def test_skips_tool_only_entries(self, fake_mgr_and_ws):
-        """Tool-channel entries belong to the next tool-result seam — a
-        synthetic empty user turn can't drain them, so no wake."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("tool_error", "check memories", "tool")
-        with patch("turnstone.core.session_worker.send") as mock_send:
-            assert wake_workstream_if_pending(ws) is False
-            assert mock_send.call_count == 0
-
-    def test_refuses_non_nudgequeue_stub(self, fake_mgr_and_ws):
-        """The gate refuses on TYPE, not just presence: a mock session's
-        auto-created ``_nudge_queue`` answers ``has_pending`` truthily
-        while its ``deliver_wake_nudge_from_queue`` consumes nothing —
-        with the worker-exit backstop re-running this gate after every
-        exit, one worker on such a session would respawn wake workers
-        forever (the storm that took down the full-suite CI run).  Only
-        a real :class:`NudgeQueue` carries the drain semantics the wake
-        contract needs."""
-        from unittest.mock import MagicMock
-
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue = MagicMock()  # truthy has_pending, no real drain
-        with patch("turnstone.core.session_worker.send") as mock_send:
-            assert wake_workstream_if_pending(ws) is False
-            assert mock_send.call_count == 0
-
-    def test_dispatched_path_logs_trigger(self, fake_mgr_and_ws, caplog):
-        """A fresh spawn — ``send`` returns True without touching the
-        passed ``enqueue`` — emits ``nudge_wake.dispatched`` tagged with
-        the trigger label (structlog renders the event name + ``%s``
-        placeholders into ``msg``; substring-match like the sibling
-        nudge_queue tests)."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        with (
-            patch("turnstone.core.session_worker.send", return_value=True) as mock_send,
-            caplog.at_level(logging.INFO, logger="turnstone.core.idle_nudge_watcher"),
-        ):
-            assert wake_workstream_if_pending(ws, trigger="idle-transition") is True
-            assert mock_send.call_count == 1
-        dispatched = [r for r in caplog.records if "nudge_wake.dispatched" in r.getMessage()]
-        assert len(dispatched) == 1
-        assert dispatched[0].levelno == logging.INFO
-        assert "trigger=" in dispatched[0].getMessage()
-        # The reuse-path drop line must not appear on a fresh spawn.
-        assert not any("nudge_wake.deferred_worker_busy" in r.getMessage() for r in caplog.records)
-
-    def test_deferred_path_logs_worker_busy(self, fake_mgr_and_ws, caplog):
-        """The reuse path — ``send`` invokes the passed ``enqueue`` and
-        returns True — emits ``nudge_wake.deferred_worker_busy`` instead
-        of ``dispatched``.  The entry stays owed to the owning worker's
-        exit backstop; the return value is still True."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-
-        def _reuse_send(_ws: Any, *, enqueue: Any, run: Any, thread_name: Any) -> bool:
-            # Mimic a live worker owning the workstream: send routes the
-            # wake to the no-op enqueue rather than spawning a daemon.
-            enqueue()
-            return True
-
-        with (
-            patch("turnstone.core.session_worker.send", side_effect=_reuse_send) as mock_send,
-            caplog.at_level(logging.INFO, logger="turnstone.core.idle_nudge_watcher"),
-        ):
-            assert wake_workstream_if_pending(ws, trigger="idle-transition") is True
-            assert mock_send.call_count == 1
-        deferred = [
-            r for r in caplog.records if "nudge_wake.deferred_worker_busy" in r.getMessage()
-        ]
-        assert len(deferred) == 1
-        assert deferred[0].levelno == logging.INFO
-        assert "trigger=" in deferred[0].getMessage()
-        assert not any("nudge_wake.dispatched" in r.getMessage() for r in caplog.records)
-
-    def test_refused_path_logs_refusal(self, fake_mgr_and_ws, caplog):
-        """``send`` refusing outright — its authoritative under-lock
-        ``_closed`` re-check caught a teardown the gate's lockless peek
-        missed — emits ``nudge_wake.refused``: a dropped wake must stay
-        traceable to its trigger, not vanish silently."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        with (
-            patch("turnstone.core.session_worker.send", return_value=False) as mock_send,
-            caplog.at_level(logging.INFO, logger="turnstone.core.idle_nudge_watcher"),
-        ):
-            assert wake_workstream_if_pending(ws, trigger="watch-fire") is False
-            assert mock_send.call_count == 1
-        refused = [r for r in caplog.records if "nudge_wake.refused" in r.getMessage()]
-        assert len(refused) == 1
-        assert refused[0].levelno == logging.INFO
-        assert "trigger=" in refused[0].getMessage()
-        assert not any("nudge_wake.dispatched" in r.getMessage() for r in caplog.records)
-        assert not any("nudge_wake.deferred_worker_busy" in r.getMessage() for r in caplog.records)
@@ -409,230 +409,3 @@ def test_pane_handles_cross_user_409() -> None:
    assert "r.status === 409" in body
    assert 'status: "cross_user_interjection"' in body
    assert 'data.status === "cross_user_interjection"' in body
-
-
-def test_sync_approval_state_prunes_orphan_cycles() -> None:
-    """``_syncApprovalState`` prunes cycles whose block elements are no longer
-    in the living DOM (``.isConnected === false``).  This covers the rare case
-    where an ``approve_request`` event is processed between a DOM wipe
-    (``clear_ui`` / ``replay_truncated`` / ``replaceChildren``) and the
-    refetch-restore — the cycle card lives in a detached subtree, the matching
-    ``approval_resolved`` never arrives, and the send button stays disabled
-    forever without this guard.  The pin guards against a future refactor that
-    drops the orphan prune but doesn't otherwise break ``_syncApprovalState``."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    fn_start = body.index("_syncApprovalState() {")
-    assert "entry.blockEls && !entry.blockEls.some((el) => el.isConnected)" in body, (
-        "orphan pruning must check .isConnected on block elements"
-    )
-    tail = body[fn_start : body.index("_oldestCycleId()", fn_start)]
-    assert "this.approvalCycles.delete(cid);" in tail, (
-        "orphan pruning must delete the cycle from the Map"
-    )
-
-
-# ---------------------------------------------------------------------------
-# SSE overflow recovery + close-on-hide (fast-stream corruption fixes)
-# ---------------------------------------------------------------------------
-
-
-def test_stream_overflow_case_counts_and_rate_limits() -> None:
-    """The server closes an overflowed stream after an id-less
-    ``stream_overflow`` frame; the pane must count it (field
-    instrumentation for the drop-vs-render-wedge diagnosis) and route it
-    through the reconnect limiter so a persistently slow consumer trips
-    the degraded catch-up instead of churning reconnect/replay cycles."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    assert 'case "stream_overflow":' in body
-    assert "this._noteStreamOverflow();" in body
-    assert "_streamHealth = { overflows: 0, renderThrows: 0, malformedFrames: 0 }" in body
-    # Both wedge-class catch sites increment the render-throw counter,
-    # and the malformed-frame drop counts too — the C-OVERDETERMINED
-    # instrumentation that tells drops apart from wedges in the field.
-    assert body.count("this._streamHealth.renderThrows += 1;") == 2
-    assert "this._streamHealth.malformedFrames += 1;" in body
-    assert "this._streamHealth.overflows += 1;" in body
-
-
-def test_degraded_catchup_stops_live_stream_and_retries() -> None:
-    """Degraded catch-up contract: close the stream FIRST (which also
-    clears any earlier degraded timer — disconnectSSE owns that), show a
-    plain-language status, then arm the retry timer with a doubling
-    cooldown.  The retry must defer to the show edge when the tab is
-    hidden (reopening into a throttled tab would overflow again)."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    m = re.search(r"_enterDegradedCatchup\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert m is not None, "_enterDegradedCatchup method not found"
-    method = m.group(1)
-    # Order matters: disconnect before arming the timer, or the fresh
-    # timer would be cancelled by its own disconnect.
-    assert method.index("this.disconnectSSE()") < method.index("this._degradedTimer = setTimeout")
-    assert "Connection is slow" in method, "degraded state must use plain language"
-    assert "DEGRADED_COOLDOWN_MAX_MS" in method
-    assert "document.hidden" in method
-    # disconnectSSE owns the timer teardown (ws-switch / giveUp / destroy
-    # all supersede a pending degraded retry through it).
-    dis = re.search(r"disconnectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert dis is not None
-    assert "clearTimeout(this._degradedTimer)" in dis.group(1)
-
-
-def test_visibilitychange_closes_on_hide_reconnects_on_show() -> None:
-    """Close-on-hide / replay-on-show: a hidden tab's throttled drain is
-    the likeliest slow consumer behind server-side overflow (the old
-    "PR-G closes those connections on hide" comment described a handler
-    that never existed).  The pane installs one visibilitychange
-    listener, marks ITS OWN hide-closes via ``_hiddenDisconnect`` so a
-    show edge never resurrects a deliberately-closed stream, and the
-    factory's destroy removes the listener (it strongly references the
-    pane)."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    assert 'document.addEventListener("visibilitychange", this._visHandler);' in body
-    assert 'document.removeEventListener("visibilitychange", this._visHandler);' in body
-    vis = re.search(r"_onVisibilityChange\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert vis is not None, "_onVisibilityChange method not found"
-    method = vis.group(1)
-    assert "this.disconnectSSE();" in method
-    assert "this._hiddenDisconnect = true;" in method
-    assert "this.connectSSE(this.wsId);" in method
-    # Reconnect only consumes OUR hide-close marker.
-    assert "else if (this._hiddenDisconnect)" in method
-    # Teardown: the factory controller removes the listener on destroy.
-    assert "pane._removeVisibilityHandler();" in body
-    # The streaming buffers survive a hide-close: disconnectSSE stays
-    # transport-only (no contentBuffer wipe) so the visible tail is
-    # intact when the tab returns.
-    dis = re.search(r"disconnectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert dis is not None
-    assert "contentBuffer" not in dis.group(1)
-
-
-def test_no_global_sse_gap_detector() -> None:
-    """Live event ids are NOT strictly monotonic across concurrent
-    tool+content emit (the fan-out runs outside the listeners lock), so
-    a naive ``id !== lastEventId + 1`` gap check would false-positive.
-    Recovery is server-signalled (``stream_overflow``) + reconnect
-    replay instead.  This tripwire pins the absence of the naive
-    arithmetic — if gap detection is ever added, it must be scoped to
-    the content stream only (content-vs-content never reorders)."""
-    code = _strip_comments(_INTERACTIVE.read_text(encoding="utf-8"))
-    assert not re.search(r"_lastEventId\s*[+\-]\s*1", code), (
-        "found lastEventId +/- 1 arithmetic — a global gap detector "
-        "false-positives on legal concurrent tool/content id inversion"
-    )
-
-
-def test_overflow_helpers_extracted_to_shared_module() -> None:
-    """The storm-guard constants + the two pure helpers were extracted to the
-    shared ``sse_overflow.js`` module (its own runtime probes live in
-    ``test_sse_overflow_js.py``) so the interactive and coordinator panes can't
-    drift.  Pin that the pane IMPORTS them rather than re-declaring a local
-    copy: a stray local ``function overflowWindowTripped`` / ``const
-    OVERFLOW_TRIP_COUNT`` would silently fork the trip math again."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    m = re.search(
-        r"import \{([^}]*)\} from \"\./sse_overflow\.js\";",
-        body,
-        re.S,
-    )
-    assert m is not None, "interactive pane must import the shared overflow helpers"
-    imported = m.group(1)
-    for name in (
-        "OVERFLOW_TRIP_COUNT",
-        "OVERFLOW_TRIP_WINDOW_MS",
-        "DEGRADED_COOLDOWN_BASE_MS",
-        "DEGRADED_COOLDOWN_MAX_MS",
-        "DEGRADED_COOLDOWN_RESET_MS",
-        "overflowWindowTripped",
-        "degradedCooldownStep",
-    ):
-        assert name in imported, f"{name} must be imported from sse_overflow.js"
-    # No local fork of the extracted definitions.
-    assert not re.search(r"^function overflowWindowTripped\(", body, re.M), (
-        "overflowWindowTripped must be imported, not re-declared locally"
-    )
-    assert not re.search(r"^function degradedCooldownStep\(", body, re.M), (
-        "degradedCooldownStep must be imported, not re-declared locally"
-    )
-    assert not re.search(r"^const OVERFLOW_TRIP_COUNT\s*=", body, re.M), (
-        "the trip constants must be imported, not re-declared locally"
-    )
-
-
-def test_note_stream_overflow_does_not_reset_cooldown() -> None:
-    """The exact finding [0] bug shape must not regress: _noteStreamOverflow
-    only counts + trips; it must NOT touch _degradedCooldownMs (the reset
-    that defeated the ladder lived here).  The ladder decision lives solely
-    in _enterDegradedCatchup, keyed off _lastDegradedAt via
-    degradedCooldownStep."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    note = re.search(r"_noteStreamOverflow\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert note is not None, "_noteStreamOverflow not found"
-    assert "_degradedCooldownMs" not in note.group(1), (
-        "_noteStreamOverflow must not write _degradedCooldownMs — that reset "
-        "was the bug that stopped the ladder escalating"
-    )
-    enter = re.search(r"_enterDegradedCatchup\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert enter is not None
-    assert "degradedCooldownStep(" in enter.group(1)
-    assert "this._lastDegradedAt = now" in enter.group(1)
-
-
-def test_recover_beat_defers_reconnect_when_tab_hidden() -> None:
-    """Review round-2 finding [1]: the factory's transient-error recovery
-    beat (recoverTimer) must NOT reopen an EventSource into a hidden tab —
-    that re-creates the throttled slow-consumer overflow that close-on-hide
-    exists to prevent.  It guards on document.hidden and defers to the
-    visibilitychange show edge (marking _hiddenDisconnect)."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    beat = re.search(r"recoverTimer = setTimeout\(\(\) => \{(.*?)\n      \}, 5000\);", body, re.S)
-    assert beat is not None, "recoverTimer setTimeout body not found"
-    b = beat.group(1)
-    assert "document.hidden" in b, "recovery beat must guard on document.hidden"
-    assert "pane._hiddenDisconnect = true" in b, (
-        "recovery beat must defer to the show edge when hidden"
-    )
-    # The hidden guard must precede the reconnect (connectSSE) so it can't fall
-    # through to reopening the stream.
-    assert b.index("document.hidden") < b.index("pane.connectSSE(pane.wsId)")
-
-
-def test_giveup_removes_visibility_handler() -> None:
-    """Review round-2 finding [3]: giveUp() (markDead) must detach the
-    visibility handler and clear _hiddenDisconnect, or a tab hidden before
-    the give-up resurrects the dead controller's stream on return (the show
-    edge would connectSSE the closed ws and 404-reconnect it forever)."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    give = re.search(r"const giveUp = function \(\) \{(.*?)\n  \};", body, re.S)
-    assert give is not None, "giveUp function body not found"
-    g = give.group(1)
-    assert "pane._removeVisibilityHandler();" in g, (
-        "giveUp must remove the visibility handler so a show edge can't resurrect a dead controller"
-    )
-    # _removeVisibilityHandler also clears _hiddenDisconnect (pinned in its body).
-    rvh = re.search(r"_removeVisibilityHandler\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert rvh is not None
-    assert "this._hiddenDisconnect = false" in rvh.group(1)
-
-
-def test_connectsse_defers_open_when_tab_hidden() -> None:
-    """PR #805 review (Copilot + R3): connectSSE is the single connect
-    chokepoint and must not open an EventSource into a hidden tab.  The
-    fresh-connect path (_loadHistoryThenConnect) has no timer guard, so a
-    first load in a background tab would otherwise open a throttled stream —
-    the slow-consumer overflow this PR exists to prevent.  The guard sits
-    AFTER the visibilitychange-handler install (so the show edge can
-    reconnect) and AFTER the wsId assignment (so it targets the right ws),
-    and BEFORE `new EventSource` (so nothing opens)."""
-    body = _INTERACTIVE.read_text(encoding="utf-8")
-    start = body.index("connectSSE(wsId) {")
-    open_at = body.index("new EventSource(evtUrl)", start)
-    head = body[start:open_at]  # connectSSE up to the EventSource open
-    assert "if (document.hidden) {" in head, (
-        "connectSSE must guard on document.hidden BEFORE opening the stream"
-    )
-    assert "this._hiddenDisconnect = true;" in head, (
-        "the deferred connect must mark _hiddenDisconnect so the show edge reconnects"
-    )
-    assert head.index("this.wsId = wsId;") < head.index("if (document.hidden) {")
-    assert head.index('addEventListener("visibilitychange"') < head.index("if (document.hidden) {")
@@ -11,16 +11,12 @@ this pins the behaviour the old ``_anthropic`` ``pc_tool_ids`` /

 from __future__ import annotations

-import json
 from typing import Any

 from turnstone.core.lowering import (
    CANCELLED_TOOL_RESULT,
    _find_orphaned_tool_calls,
    repair_wire_messages,
-    sanitize_tool_call_arguments,
-    tool_args_preview,
-    wire_valid_arguments,
 )


@@ -184,159 +180,3 @@ def test_repair_does_not_mutate_input() -> None:
    repair_wire_messages(msgs)
    assert len(msgs) == original_len  # caller's list untouched
    assert "tool_calls" in msgs[0]
-
-
-# --------------------------------------------------------------------------- #
-# wire_valid_arguments — the shared "is this renderable" predicate
-# --------------------------------------------------------------------------- #
-def test_wire_valid_arguments_accepts_json_objects() -> None:
-    assert wire_valid_arguments("{}") is True
-    assert wire_valid_arguments('{"command": "ls -la"}') is True
-    assert wire_valid_arguments('  { "a": 1 }\n') is True  # surrounding whitespace ok
-
-
-def test_wire_valid_arguments_rejects_unrenderable() -> None:
-    assert wire_valid_arguments('{"command": "cat /va') is False  # unterminated (the incident)
-    assert wire_valid_arguments("") is False  # empty (no-arg call) — json.loads raises
-    assert wire_valid_arguments("[]") is False  # array, not object
-    assert wire_valid_arguments("5") is False  # bare scalar
-    assert wire_valid_arguments('"hi"') is False  # bare string
-    assert wire_valid_arguments(None) is False  # missing
-    assert wire_valid_arguments({"a": 1}) is False  # raw dict — not a string on the wire
-
-
-def test_wire_valid_arguments_totals_on_deeply_nested_json() -> None:
-    # Deeply-nested JSON makes json.loads raise RecursionError (not a ValueError);
-    # the predicate must return False, not propagate and crash the send.
-    deep = "[" * 5000 + "]" * 5000
-    assert wire_valid_arguments(deep) is False
-
-
-def test_tool_args_preview_stringifies_and_caps() -> None:
-    assert tool_args_preview("x" * 500) == "x" * 120
-    assert tool_args_preview(None) == "None"
-    assert tool_args_preview({"a": 1}) == "{'a': 1}"
-
-
-def test_tool_args_preview_redacts_credentials() -> None:
-    # Secrets in tool args (bash commands, tokens) must not reach logs — the preview
-    # runs output_guard.redact_credentials over the full value first (PR #778 review).
-    out = tool_args_preview('{"command": "aws configure set key AKIAIOSFODNN7EXAMPLE"}')
-    assert "AKIAIOSFODNN7EXAMPLE" not in out
-    assert "[REDACTED:api_key]" in out
-
-
-def test_tool_args_preview_is_single_line() -> None:
-    # Control chars (LF/CR/TAB) collapse to spaces so the preview stays one log line.
-    raw = "line1" + chr(10) + "line2" + chr(13) + "end" + chr(9) + "z"
-    out = tool_args_preview(raw)
-    assert chr(10) not in out and chr(13) not in out and chr(9) not in out
-    assert "line1" in out and "end" in out
-
-
-# --------------------------------------------------------------------------- #
-# sanitize_tool_call_arguments — the legalize pass
-# --------------------------------------------------------------------------- #
-def _call(call_id: str, arguments: Any, name: str = "bash") -> dict[str, Any]:
-    return {"id": call_id, "type": "function", "function": {"name": name, "arguments": arguments}}
-
-
-def _assistant_calls(*calls: dict[str, Any]) -> dict[str, Any]:
-    return {"role": "assistant", "content": "", "tool_calls": list(calls)}
-
-
-def test_sanitize_identity_when_all_valid() -> None:
-    msgs = [_assistant_calls(_call("c1", "{}"), _call("c2", '{"a": 1}')), _tool("c1"), _tool("c2")]
-    # Every arguments already a JSON object → same object returned (allocation-free).
-    assert sanitize_tool_call_arguments(msgs) is msgs
-
-
-def test_sanitize_identity_when_no_tool_calls() -> None:
-    msgs = [{"role": "user", "content": "hi"}, {"role": "assistant", "content": "yo"}]
-    assert sanitize_tool_call_arguments(msgs) is msgs
-
-
-def test_sanitize_legalizes_unterminated_arguments() -> None:
-    # The production incident: deepseek-v4-flash emitted an unterminated args string
-    # with a non-``length`` finish reason, so it was committed and replayed verbatim.
-    msgs = [_assistant_calls(_call("c1", '{"command": "cat /va')), _tool("c1", "retry")]
-    out = sanitize_tool_call_arguments(msgs)
-    assert out is not msgs  # copied on repair
-    assert out[0]["tool_calls"][0]["function"]["arguments"] == "{}"
-    assert json.loads(out[0]["tool_calls"][0]["function"]["arguments"]) == {}
-
-
-def test_sanitize_legalizes_empty_arguments() -> None:
-    # A no-arg tool call sends ``""``; json.loads("") raises, so deepseek_v4 would 400.
-    out = sanitize_tool_call_arguments([_assistant_calls(_call("c1", ""))])
-    assert out[0]["tool_calls"][0]["function"]["arguments"] == "{}"
-
-
-def test_sanitize_legalizes_non_object_json() -> None:
-    out = sanitize_tool_call_arguments([_assistant_calls(_call("c1", "[]"), _call("c2", "5"))])
-    assert [tc["function"]["arguments"] for tc in out[0]["tool_calls"]] == ["{}", "{}"]
-
-
-def test_sanitize_serializes_raw_dict_arguments() -> None:
-    out = sanitize_tool_call_arguments([_assistant_calls(_call("c1", {"command": "ls"}))])
-    got = out[0]["tool_calls"][0]["function"]["arguments"]
-    assert isinstance(got, str) and json.loads(got) == {"command": "ls"}
-
-
-def test_sanitize_falls_back_when_dict_not_serializable() -> None:
-    # Defensive branch: a dict arguments carrying a non-JSON-encodable value
-    # (a set) makes json.dumps raise TypeError — it collapses to "{}", not a crash.
-    out = sanitize_tool_call_arguments([_assistant_calls(_call("c1", {"x": {1, 2, 3}}))])
-    assert out[0]["tool_calls"][0]["function"]["arguments"] == "{}"
-
-
-def test_sanitize_touches_only_the_offending_call() -> None:
-    good = _call("c1", '{"a": 1}')
-    bad = _call("c2", "{oops")
-    out = sanitize_tool_call_arguments([_assistant_calls(good, bad)])
-    # Valid sibling preserved by identity; only the bad call is rebuilt.
-    assert out[0]["tool_calls"][0] is good
-    assert out[0]["tool_calls"][1]["function"]["arguments"] == "{}"
-
-
-def test_sanitize_does_not_mutate_input() -> None:
-    raw = '{"command": "cat /va'
-    bad = _call("c1", raw)
-    msgs = [_assistant_calls(bad)]
-    sanitize_tool_call_arguments(msgs)
-    assert bad["function"]["arguments"] == raw  # caller's dict untouched
-    assert msgs[0]["tool_calls"][0] is bad
-
-
-# --------------------------------------------------------------------------- #
-# legalize ∘ repair — the two send-time validity passes compose
-# --------------------------------------------------------------------------- #
-def test_legalize_then_repair_answered_call() -> None:
-    # Malformed-but-answered (the poison-pill shape): args legalized, no orphan added.
-    msgs = [_assistant_calls(_call("c1", "{bad")), _tool("c1", "retry with valid JSON")]
-    out = repair_wire_messages(sanitize_tool_call_arguments(msgs))
-    assert [m["role"] for m in out] == ["assistant", "tool"]
-    assert json.loads(out[0]["tool_calls"][0]["function"]["arguments"]) == {}
-
-
-def test_legalize_then_repair_orphaned_call() -> None:
-    # Malformed AND unanswered: legalized args + a synthesized cancellation result.
-    msgs = [_assistant_calls(_call("c1", "{bad"))]
-    out = repair_wire_messages(sanitize_tool_call_arguments(msgs))
-    assert [m["role"] for m in out] == ["assistant", "tool"]
-    assert json.loads(out[0]["tool_calls"][0]["function"]["arguments"]) == {}
-    assert out[1]["content"] == CANCELLED_TOOL_RESULT
-
-
-def test_pipeline_every_emitted_arguments_is_a_json_object() -> None:
-    # The end-state invariant a strict renderer relies on.
-    msgs = [
-        _assistant_calls(_call("c1", ""), _call("c2", "{oops"), _call("c3", '{"ok": true}')),
-        _tool("c1"),
-        _tool("c2"),
-        _tool("c3"),
-    ]
-    out = repair_wire_messages(sanitize_tool_call_arguments(msgs))
-    for m in out:
-        for tc in m.get("tool_calls", []):
-            assert isinstance(json.loads(tc["function"]["arguments"]), dict)
@@ -1,207 +0,0 @@
-"""Live flaky-server smoke test: SIGKILL-flap a real MCP server, no CPU spin.
-
-End-to-end regression for the flaky-server 100%-CPU incident: a real
-streamable-http MCP server (FastMCP, subprocess) is SIGKILLed and restarted
-several times underneath a real ``MCPClientManager`` with the health loop
-running on compressed timings. The production failure signature was armed
-anyio ``CancelScope``s — each one re-delivers cancellation via ``call_soon``
-every event-loop iteration, forever (~10^5+ callbacks/s), one more per flap
-cycle — so the pass criterion is structural: after the flaps settle, ZERO
-armed scopes exist on the mcp-loop, exactly one transport owner is alive, the
-health loop still runs, and a real tool call round-trips.
-
-Self-contained (spawns its own server; no LLM backend, no network beyond
-127.0.0.1) — deliberately NOT marked ``live``. Wall clock ~10-15s.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import gc
-import signal
-import socket
-import subprocess
-import sys
-import textwrap
-import time
-from typing import TYPE_CHECKING
-from unittest.mock import patch
-
-import pytest
-
-from turnstone.core.mcp_client import MCPClientManager
-
-if TYPE_CHECKING:
-    from pathlib import Path
-
-SERVER_SRC = textwrap.dedent(
-    '''
-    """Healthy streamable-http MCP server; the test SIGKILLs it to flap."""
-    import sys
-
-    from mcp.server.fastmcp import FastMCP
-
-    port = int(sys.argv[1])
-    mcp = FastMCP("flaky-victim", host="127.0.0.1", port=port)
-
-
-    @mcp.tool()
-    def ping_me(x: int) -> int:
-        """Return x + 1."""
-        return x + 1
-
-
-    if __name__ == "__main__":
-        mcp.run(transport="streamable-http")
-    '''
-).lstrip()
-
-
-def _free_port() -> int:
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(("127.0.0.1", 0))
-        return int(s.getsockname()[1])
-
-
-def _wait_tcp_ready(port: int, timeout: float) -> bool:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        try:
-            with socket.create_connection(("127.0.0.1", port), timeout=0.3):
-                return True
-        except OSError:
-            time.sleep(0.05)
-    return False
-
-
-def _wait_session_live(mgr: MCPClientManager, name: str, timeout: float) -> bool:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        state = mgr._static_servers.get(name)
-        if state is not None and state.session is not None:
-            return True
-        time.sleep(0.05)
-    return False
-
-
-async def _armed_scope_count() -> int:
-    """Armed scopes hosted on THIS (the mcp) loop — mirrors the production
-    disarm sweep's scoping, and keeps an unrelated scope on another loop that
-    is momentarily mid-cancellation from flaking the assertion."""
-    import asyncio as _asyncio
-
-    from anyio._backends._asyncio import CancelScope
-
-    this_loop = _asyncio.get_running_loop()
-    armed = 0
-    for obj in gc.get_objects():
-        if not isinstance(obj, CancelScope):
-            continue
-        if getattr(obj, "_cancel_handle", None) is None:
-            continue
-        host = getattr(obj, "_host_task", None)
-        if host is not None and host.get_loop() is not this_loop:
-            continue
-        armed += 1
-    return armed
-
-
-async def _live_owner_count() -> int:
-    return sum(
-        1
-        for t in asyncio.all_tasks()
-        if t.get_name().startswith("mcp-transport-owner:") and not t.done()
-    )
-
-
-class TestFlakyServerNoSpin:
-    def test_sigkill_flap_cycle_no_armed_scopes_and_recovers(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        # The subprocess runs sys.executable, so importability HERE is a
-        # faithful proxy for the server side. Environment gaps skip, not fail.
-        pytest.importorskip("mcp.server.fastmcp")
-        script = tmp_path / "flaky_srv.py"
-        script.write_text(SERVER_SRC)
-        port = _free_port()
-
-        # Compress recovery timings so 3 flap cycles fit a unit-test budget.
-        monkeypatch.setattr(MCPClientManager, "_CONNECT_TIMEOUT", 3)
-        monkeypatch.setattr(MCPClientManager, "_TCP_PROBE_TIMEOUT", 1)
-        monkeypatch.setattr(MCPClientManager, "_STATIC_RECONNECT_ATTEMPT_TIMEOUT_S", 5.0)
-        monkeypatch.setattr(MCPClientManager, "_STATIC_RECONNECT_CALLER_TIMEOUT_S", 6.0)
-        monkeypatch.setattr(MCPClientManager, "_STATIC_RECONNECT_BASE_S", 0.2)
-        monkeypatch.setattr(MCPClientManager, "_STATIC_RECONNECT_MAX_S", 0.8)
-        monkeypatch.setattr(MCPClientManager, "_STATIC_HEALTH_PING_TIMEOUT_S", 1.5)
-
-        def _spawn_server(*, initial: bool = False) -> subprocess.Popen[bytes]:
-            proc = subprocess.Popen(
-                [sys.executable, str(script), str(port)],
-                stdout=subprocess.DEVNULL,
-                stderr=subprocess.DEVNULL,
-            )
-            if not _wait_tcp_ready(port, 10.0):
-                proc.kill()
-                proc.wait(timeout=5)
-                if initial:
-                    # Environment gap (loaded CI runner, sandboxed sockets) —
-                    # not a regression signal. Mid-test respawns DO fail: the
-                    # server already bound once, so a vanishing rebind is real.
-                    pytest.skip("flaky-server subprocess did not come up")
-                raise AssertionError("flaky server did not come back up mid-test")
-            return proc
-
-        proc: subprocess.Popen[bytes] | None = None
-        mgr: MCPClientManager | None = None
-        try:
-            proc = _spawn_server(initial=True)
-            with patch(
-                "turnstone.core.mcp_client.load_config",
-                return_value={"static_health_check_seconds": 0.4},
-            ):
-                mgr = MCPClientManager(
-                    {"flaky": {"type": "http", "url": f"http://127.0.0.1:{port}/mcp"}}
-                )
-            mgr.start()
-            assert _wait_session_live(mgr, "flaky", 8.0), "initial connect failed"
-
-            for _cycle in range(3):
-                proc.send_signal(signal.SIGKILL)
-                proc.wait()
-                time.sleep(0.6)  # dead window: health loop sees the corpse
-                proc = _spawn_server()
-                assert _wait_session_live(mgr, "flaky", 10.0), (
-                    f"no reconnect after flap cycle {_cycle}"
-                )
-
-            # Let in-flight teardown/backoff machinery fully settle.
-            time.sleep(1.5)
-
-            assert mgr._loop is not None
-            armed = asyncio.run_coroutine_threadsafe(_armed_scope_count(), mgr._loop).result(
-                timeout=10
-            )
-            owners = asyncio.run_coroutine_threadsafe(_live_owner_count(), mgr._loop).result(
-                timeout=10
-            )
-            health = mgr._static_health_task
-
-            # The production failure signature: one armed scope per flap cycle.
-            assert armed == 0, f"{armed} armed cancel scope(s) — the CPU-spin signature"
-            # Exactly the current session's owner is alive; the flapped ones
-            # all unwound instead of leaking.
-            assert owners == 1
-            # The recovery machinery itself survived every flap.
-            assert health is not None and not health.done()
-            # The structural fix did the work — the disarm backstop never ran.
-            assert mgr._last_scope_disarm == 0.0
-
-            # And the recovered session actually dispatches.
-            out = mgr.call_tool_sync("mcp__flaky__ping_me", {"x": 41}, timeout=10)
-            assert "42" in out
-        finally:
-            if mgr is not None:
-                mgr.shutdown()
-            if proc is not None:
-                proc.send_signal(signal.SIGKILL)
-                proc.wait(timeout=5)
@@ -630,6 +630,8 @@ class TestCallback:
            server_name="srv-oauth",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id="ws-1",
+            last_tool_call_id="tool-1",
            now_iso="2026-05-11T12:00:00",
        )
        storage.upsert_mcp_pending_consent(
@@ -637,6 +639,8 @@ class TestCallback:
            server_name="srv-oauth",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso="2026-05-11T12:00:00",
        )
        token_store = _make_token_store(storage)
@@ -408,97 +408,6 @@ class TestRefreshFailureClassification:
        assert ("user-1", "srv-oauth") not in state.mcp_oauth_refresh_locks


-class TestObserveOnlyLookup:
-    """``revoke_on_failure=False`` (the background token-freshness sweep): still
-    refresh a healthy token, but on failure NEVER delete a token or mutate the
-    shared streak — a timer must not destroy consent or move a foreground user's
-    revoke threshold. A permanent rejection surfaces as ``refresh_failed`` with
-    the row INTACT; an ambiguous one as transient with the streak untouched."""
-
-    def _lookup(self, state: SimpleNamespace) -> Any:
-        from turnstone.core.mcp_oauth import get_user_access_token_classified
-
-        async def _run() -> Any:
-            with _public_addr_patch():
-                return await get_user_access_token_classified(
-                    app_state=state,
-                    user_id="user-1",
-                    server_name="srv-oauth",
-                    force_refresh=True,
-                    revoke_on_failure=False,
-                )
-
-        return asyncio.run(_run())
-
-    def test_permanent_invalid_grant_does_not_revoke(self, storage: SQLiteBackend) -> None:
-        """The exact contrast to ``test_permanent_invalid_grant_revokes``: same
-        dead-grant signal, but observe-only leaves the row for the lazy path."""
-        _seed_server(storage)
-        client = MagicMock(spec=httpx.AsyncClient)
-        client.get = AsyncMock(return_value=_mk_response(200, _good_as_metadata_doc()))
-        client.post = AsyncMock(return_value=_mk_response(400, {"error": "invalid_grant"}))
-        state = _make_app_state(storage, http_client=client)
-        _seed_token(state, expires_in_seconds=-1000)
-
-        result = self._lookup(state)
-
-        assert result.kind == "refresh_failed"
-        assert state.mcp_token_store.get_user_token("user-1", "srv-oauth") is not None
-
-    def test_ambiguous_does_not_touch_shared_streak(self, storage: SQLiteBackend) -> None:
-        """Repeated observe-mode ambiguous failures never bump the shared
-        ambiguous_streak, so a later foreground dispatch is not pushed over the
-        escalation edge by background activity (the finding this guards)."""
-        _seed_server(storage)
-        client = MagicMock(spec=httpx.AsyncClient)
-        client.get = AsyncMock(return_value=_mk_response(200, _good_as_metadata_doc()))
-        client.post = AsyncMock(return_value=_mk_response(400, None))
-        state = _make_app_state(storage, http_client=client)
-        _seed_token(state, expires_in_seconds=-1000)
-
-        with patch("turnstone.core.mcp_oauth._AMBIGUOUS_ESCALATION_THRESHOLD", 2):
-            for _ in range(5):
-                assert self._lookup(state).kind == "refresh_failed_transient"
-
-        backoff = getattr(state, "mcp_oauth_refresh_backoff", {})
-        entry = backoff.get(("user-1", "srv-oauth"))
-        assert entry is None or entry.ambiguous_streak == 0
-        assert state.mcp_token_store.get_user_token("user-1", "srv-oauth") is not None
-
-    def test_expired_no_refresh_does_not_revoke(self, storage: SQLiteBackend) -> None:
-        """An expired token with no refresh token surfaces as a dead grant but is
-        NOT deleted on the observe path."""
-        _seed_server(storage)
-        client = MagicMock(spec=httpx.AsyncClient)
-        client.get = AsyncMock(return_value=_mk_response(200, _good_as_metadata_doc()))
-        state = _make_app_state(storage, http_client=client)
-        _seed_token(state, expires_in_seconds=-1000, refresh=None)
-
-        result = self._lookup(state)
-
-        assert result.kind == "refresh_failed"
-        assert state.mcp_token_store.get_user_token("user-1", "srv-oauth") is not None
-
-    def test_healthy_token_still_refreshes(self, storage: SQLiteBackend) -> None:
-        """Observe mode is not read-only: a near-expiry token is still refreshed
-        (only the destructive failure paths change)."""
-        _seed_server(storage)
-        client = MagicMock(spec=httpx.AsyncClient)
-        client.get = AsyncMock(return_value=_mk_response(200, _good_as_metadata_doc()))
-        client.post = AsyncMock(
-            return_value=_mk_response(
-                200, {"access_token": "fresh-bbb", "expires_in": 3600, "token_type": "Bearer"}
-            )
-        )
-        state = _make_app_state(storage, http_client=client)
-        _seed_token(state, expires_in_seconds=-1000)
-
-        result = self._lookup(state)
-
-        assert result.kind == "token"
-        assert result.token == "fresh-bbb"
-
-
 # ---------------------------------------------------------------------------
 # Happy paths
 # ---------------------------------------------------------------------------
@@ -108,6 +108,8 @@ def _seed_pending(
        server_name=server_name,
        error_code=error_code,
        scopes_required=None,
+        last_ws_id=None,
+        last_tool_call_id=None,
        now_iso=now_iso,
    )

@@ -24,6 +24,8 @@ class TestUpsertAndList:
            server_name="srv-x",
            error_code="mcp_consent_required",
            scopes_required="read write",
+            last_ws_id="ws-1",
+            last_tool_call_id="tool-1",
            now_iso=_iso(),
        )
        rows = backend.list_mcp_pending_consent_by_user("user-a")
@@ -33,6 +35,8 @@ class TestUpsertAndList:
        assert r["server_name"] == "srv-x"
        assert r["error_code"] == "mcp_consent_required"
        assert r["scopes_required"] == "read write"
+        assert r["last_ws_id"] == "ws-1"
+        assert r["last_tool_call_id"] == "tool-1"
        assert r["occurrence_count"] == 1
        assert r["first_seen_at"] == r["last_seen_at"]

@@ -42,6 +46,8 @@ class TestUpsertAndList:
            server_name="srv-x",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso="2026-05-11T12:00:00",
        )
        backend.upsert_mcp_pending_consent(
@@ -49,6 +55,8 @@ class TestUpsertAndList:
            server_name="srv-x",
            error_code="mcp_insufficient_scope",
            scopes_required="read",
+            last_ws_id="ws-2",
+            last_tool_call_id="tool-2",
            now_iso="2026-05-11T13:00:00",
        )
        rows = backend.list_mcp_pending_consent_by_user("user-a")
@@ -58,6 +66,8 @@ class TestUpsertAndList:
        assert r["occurrence_count"] == 2
        assert r["error_code"] == "mcp_insufficient_scope"
        assert r["scopes_required"] == "read"
+        assert r["last_ws_id"] == "ws-2"
+        assert r["last_tool_call_id"] == "tool-2"
        assert r["last_seen_at"] == "2026-05-11T13:00:00"
        # first_seen_at preserved — that's the load-bearing audit value.
        assert r["first_seen_at"] == "2026-05-11T12:00:00"
@@ -68,6 +78,8 @@ class TestUpsertAndList:
            server_name="srv-old",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso="2026-05-11T10:00:00",
        )
        backend.upsert_mcp_pending_consent(
@@ -75,6 +87,8 @@ class TestUpsertAndList:
            server_name="srv-new",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso="2026-05-11T11:00:00",
        )
        rows = backend.list_mcp_pending_consent_by_user("user-a")
@@ -86,6 +100,8 @@ class TestUpsertAndList:
            server_name="srv",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso=_iso(),
        )
        assert backend.list_mcp_pending_consent_by_user("user-b") == []
@@ -98,6 +114,8 @@ class TestDelete:
            server_name="srv-x",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso=_iso(),
        )
        assert backend.delete_mcp_pending_consent("user-a", "srv-x") is True
@@ -115,6 +133,8 @@ class TestDelete:
                server_name=name,
                error_code="mcp_consent_required",
                scopes_required=None,
+                last_ws_id=None,
+                last_tool_call_id=None,
                now_iso=_iso(),
            )
        # Cross-user row that must NOT be touched.
@@ -123,6 +143,8 @@ class TestDelete:
            server_name="srv-z",
            error_code="mcp_consent_required",
            scopes_required=None,
+            last_ws_id=None,
+            last_tool_call_id=None,
            now_iso=_iso(),
        )
        assert backend.delete_all_mcp_pending_consent_by_user("user-a") == 3
@@ -1033,22 +1033,20 @@ class TestStaticPathUnchanged:

        from turnstone.core import mcp_client

-        # The static path's streamablehttp_client call site lives in the
-        # transport owner task (``_static_transport_owner``); ``_connect_one``
-        # is a per-name-lock wrapper and ``_connect_one_locked`` only waits on
-        # the owner's readiness.
-        source = inspect.getsource(mcp_client.MCPClientManager._static_transport_owner)
+        source = inspect.getsource(mcp_client.MCPClientManager._connect_one)

        # The static path's streamablehttp_client invocation should NOT
        # mention ``httpx_client_factory``. Pool path keeps it.
+        # Find the streamablehttp_client(...) call inside _connect_one.
        assert "streamablehttp_client" in source
-        # The call site in the owner is bare — no factory keyword. We grep by
-        # line: the factory keyword must not appear in the static-path source.
+        # The call site in _connect_one is bare — no factory keyword.
+        # We grep by line: the factory keyword must not appear in the
+        # static-path source.
        for line in source.splitlines():
            if "httpx_client_factory" in line:
                pytest.fail(
-                    "_static_transport_owner (static path) passes httpx_client_factory "
-                    "to streamablehttp_client; hard invariant 1 violated."
+                    "_connect_one (static path) passes httpx_client_factory to "
+                    "streamablehttp_client; hard invariant 1 violated."
                )


@@ -1,478 +0,0 @@
-"""Pool transport owner-task lifecycle + anyio cancel-scope regressions.
-
-The pool (auth_type=oauth_user) sibling of ``test_mcp_transport_owner.py``.
-Each ``(user, server)`` pool entry's transport + ``ClientSession`` cms are now
-entered, parked, and exited by ONE long-lived owner task
-(``_pool_transport_owner``) with a one-cancel close protocol, so a cancel scope
-whose host task has finished can never be left re-delivering cancellation in a
-``call_soon`` loop (the SDK #2147 100%-CPU spin). These fast mock-transport
-tests pin that protocol for the pool path; the real-server integration coverage
-lives in ``test_mcp_pool_auth_integration.py``.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-import threading
-import time
-from contextlib import asynccontextmanager
-from typing import Any
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-
-from turnstone.core.mcp_client import MCPClientManager, PoolEntryState, _AuthCapture
-
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-@pytest.fixture
-def running_loop_mgr():
-    """Background-loop fixture matching the pool-path test convention.
-
-    Teardown drains the eviction / sweep / health tasks AND any parked pool
-    transport owner a successful connect left installed — the conftest fails
-    leaked threads and an undrained owner is destroyed pending at GC.
-    """
-    cfg: dict[str, Any] = {}
-    mgr = MCPClientManager(cfg)
-    loop = asyncio.new_event_loop()
-    thread = threading.Thread(target=loop.run_forever, daemon=True, name="mcp-pool-owner-test-loop")
-    thread.start()
-    mgr._loop = loop
-    try:
-        yield mgr, loop, thread
-    finally:
-
-        async def _drain(m: MCPClientManager) -> None:
-            for attr in (
-                "_user_pool_eviction_task",
-                "_user_token_sweep_task",
-                "_static_health_task",
-            ):
-                task = getattr(m, attr)
-                if task is not None:
-                    task.cancel()
-                    await asyncio.gather(task, return_exceptions=True)
-                    setattr(m, attr, None)
-            for entry in list(m._user_pool_entries.values()):
-                owner = entry.owner_task
-                if owner is not None and not owner.done():
-                    if entry.close_requested is not None:
-                        entry.close_requested.set()
-                    owner.cancel()
-                    await asyncio.gather(owner, return_exceptions=True)
-
-        with contextlib.suppress(Exception):
-            asyncio.run_coroutine_threadsafe(_drain(mgr), loop).result(timeout=5)
-        loop.call_soon_threadsafe(loop.stop)
-        thread.join(timeout=5)
-        if not thread.is_alive():
-            loop.close()
-
-
-def _run(loop: asyncio.AbstractEventLoop, coro: Any, timeout: float = 5.0) -> Any:
-    return asyncio.run_coroutine_threadsafe(coro, loop).result(timeout=timeout)
-
-
-def _http_cfg() -> dict[str, Any]:
-    return {"type": "streamable-http", "url": "https://mcp.example.com/mcp", "headers": {}}
-
-
-def _make_pool_session_mock() -> AsyncMock:
-    """A ClientSession-shaped mock good enough for pool connect + discovery."""
-    session = AsyncMock()
-    session.initialize = AsyncMock()
-    # None caps → resources/prompts discovery is skipped; only list_tools runs.
-    session.get_server_capabilities = MagicMock(return_value=None)
-    session.list_tools = AsyncMock(return_value=MagicMock(tools=[]))
-    return session
-
-
-def _fake_transport_and_session(patches: dict[str, Any]) -> dict[str, Any]:
-    """Build fake streamable-http transport + ClientSession cms.
-
-    Records enter/exit events and captures the kwargs that reach
-    ``streamablehttp_client`` (so the bearer-header / factory contract is
-    observable).
-    """
-    events: list[str] = []
-    captured_kwargs: dict[str, Any] = {}
-    session = _make_pool_session_mock()
-
-    @asynccontextmanager
-    async def fake_streamablehttp_client(**kwargs: Any):
-        captured_kwargs.clear()
-        captured_kwargs.update(kwargs)
-        events.append("transport_enter")
-        try:
-            yield (AsyncMock(), AsyncMock(), lambda: None)
-        finally:
-            events.append("transport_exit")
-
-    @asynccontextmanager
-    async def fake_client_session_cm():
-        events.append("session_enter")
-        try:
-            yield session
-        finally:
-            events.append("session_exit")
-
-    def fake_client_session(_read: Any, _write: Any, message_handler: Any = None):
-        return fake_client_session_cm()
-
-    patches["streamablehttp_client"] = fake_streamablehttp_client
-    patches["ClientSession"] = fake_client_session
-    return {"events": events, "session": session, "kwargs": captured_kwargs}
-
-
-async def _connect_under_lock(
-    mgr: MCPClientManager, key: tuple[str, str], cfg: dict[str, Any], **kw: Any
-) -> PoolEntryState:
-    """Drive ``_connect_one_pool`` the way production does — under open_lock."""
-    entry = await mgr._ensure_pool_entry(key)
-    async with entry.open_lock:
-        return await mgr._connect_one_pool(key, cfg, "tok-aaa", **kw)
-
-
-# ---------------------------------------------------------------------------
-# Owner lifecycle
-# ---------------------------------------------------------------------------
-
-
-class TestPoolTransportOwnerLifecycle:
-    def test_connect_installs_owner_and_teardown_closes_gracefully(self, running_loop_mgr) -> None:
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-        key = ("user-1", "pool-srv")
-
-        with (
-            patch(
-                "turnstone.core.mcp_client.streamablehttp_client", patches["streamablehttp_client"]
-            ),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            entry = _run(loop, _connect_under_lock(mgr, key, _http_cfg()))
-            assert entry.session is fake["session"]
-            owner = entry.owner_task
-            assert owner is not None and not owner.done()
-            assert entry.close_requested is not None
-            assert fake["events"] == ["transport_enter", "session_enter"]
-
-            _run(loop, mgr._teardown_pool_entry(key))
-
-        # Graceful close: the parked owner exits via the event — no cancel —
-        # and unwinds BOTH cms in-task, inner-out (session before transport).
-        assert owner.done() and not owner.cancelled()
-        assert fake["events"] == [
-            "transport_enter",
-            "session_enter",
-            "session_exit",
-            "transport_exit",
-        ]
-        assert entry.session is None
-        assert entry.owner_task is None
-        assert entry.close_requested is None
-        # The entry itself is NOT popped — teardown leaves map/catalog cleanup
-        # to callers.
-        assert key in mgr._user_pool_entries
-
-    def test_owner_death_during_discovery_fails_fast(self, running_loop_mgr) -> None:
-        """The owner-died branch of ``_await_owner_discovery`` — the reason the
-        helper exists: discovery runs in the caller while the transport is
-        hosted by the owner, so a transport collapse mid-discovery cancels the
-        OWNER and a bare await on the response stream would hang until the 30s
-        phase timeout. The race must convert that into a PROMPT
-        ``ConnectionError``, reap the parked discovery future, and leave the
-        entry torn down."""
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-        key = ("user-1", "pool-srv")
-
-        discovery_parked = asyncio.Event()
-
-        async def _parked_list_tools() -> Any:
-            discovery_parked.set()
-            await asyncio.sleep(3600)  # the transport never answers
-
-        fake["session"].list_tools = AsyncMock(side_effect=_parked_list_tools)
-
-        async def _drive() -> tuple[float, BaseException | None]:
-            entry = await mgr._ensure_pool_entry(key)
-
-            async def _collapse_owner_when_parked() -> None:
-                await discovery_parked.wait()
-                owner = entry.owner_task  # installed before discovery begins
-                assert owner is not None
-                # The transport task group collapsing under live discovery
-                # (e.g. an upstream 401) surfaces as the owner being cancelled.
-                owner.cancel()
-
-            collapser = asyncio.create_task(_collapse_owner_when_parked())
-            t0 = asyncio.get_running_loop().time()
-            exc: BaseException | None = None
-            try:
-                async with entry.open_lock:
-                    await mgr._connect_one_pool(key, _http_cfg(), "tok-aaa")
-            except Exception as e:
-                # The expected ConnectionError; anything else (a cancel leak,
-                # an interpreter exit) propagates and fails the test loudly.
-                exc = e
-            _ = await collapser  # synchronization point; failures propagate
-            return asyncio.get_running_loop().time() - t0, exc
-
-        with (
-            patch(
-                "turnstone.core.mcp_client.streamablehttp_client", patches["streamablehttp_client"]
-            ),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            elapsed, exc = _run(loop, _drive(), timeout=15)
-
-        assert isinstance(exc, ConnectionError)
-        assert "died during discovery" in str(exc)
-        assert elapsed < 5.0  # prompt fail — not the 30s phase timeout
-        entry = mgr._user_pool_entries[key]
-        assert entry.session is None  # discovery-failure teardown ran
-        assert entry.owner_task is None
-
-    def test_cancelled_discovery_future_converts_to_connection_error(
-        self, running_loop_mgr
-    ) -> None:
-        """A discovery future that completes CANCELLED without this race's own
-        reap (an SDK-internal cancellation shape) is the transport-failure
-        class, not the caller's cancellation — ``_await_owner_discovery`` must
-        surface it as ``ConnectionError``, never a bare ``CancelledError`` the
-        caller would misread as its own cancel."""
-        mgr, loop, _ = running_loop_mgr
-
-        async def _drive() -> BaseException | None:
-            parked = asyncio.Event()
-
-            async def _parked_owner() -> None:
-                await parked.wait()
-
-            owner = asyncio.create_task(_parked_owner())
-            await asyncio.sleep(0)
-
-            async def _self_cancelling_discovery() -> Any:
-                # A coroutine raising CancelledError makes its wrapping task
-                # complete CANCELLED — the shape of an SDK-internal cancel.
-                raise asyncio.CancelledError
-
-            exc: BaseException | None = None
-            try:
-                await mgr._await_owner_discovery(owner, _self_cancelling_discovery())
-            except (Exception, asyncio.CancelledError) as e:
-                # Exception covers the expected ConnectionError; CancelledError
-                # covers the exact regression this test guards (the bare cancel
-                # leaking through instead of being converted).
-                exc = e
-            parked.set()
-            _ = await owner  # synchronization point; failures propagate
-            return exc
-
-        exc = _run(loop, _drive())
-        assert isinstance(exc, ConnectionError)
-        assert "cancelled by transport failure" in str(exc)
-
-    def test_teardown_single_cancel_escalation(self, running_loop_mgr) -> None:
-        """A parked owner whose in-task unwind stalls past the graceful window
-        gets EXACTLY ONE cancel — never a second (a second abandons an anyio
-        scope exit mid-flight and mints the zombie the protocol prevents)."""
-        mgr, loop, _ = running_loop_mgr
-        mgr._OWNER_CLOSE_GRACE_S = 0.1
-        mgr._OWNER_CANCEL_GRACE_S = 1.0
-
-        events: list[str] = []
-        cancels = {"n": 0}
-        session = _make_pool_session_mock()
-
-        @asynccontextmanager
-        async def fake_streamablehttp_client(**_kwargs: Any):
-            events.append("transport_enter")
-            try:
-                yield (AsyncMock(), AsyncMock(), lambda: None)
-            finally:
-                events.append("transport_exit")
-
-        @asynccontextmanager
-        async def fake_session_cm():
-            events.append("session_enter")
-            try:
-                yield session
-            finally:
-                # Stall the graceful unwind so teardown must escalate; count
-                # each cancellation that reaches this in-task exit.
-                try:
-                    await asyncio.sleep(3600)
-                except asyncio.CancelledError:
-                    cancels["n"] += 1
-                    raise
-                finally:
-                    events.append("session_exit")
-
-        def fake_session(_read: Any, _write: Any, message_handler: Any = None):
-            return fake_session_cm()
-
-        key = ("user-1", "pool-srv")
-        with (
-            patch("turnstone.core.mcp_client.streamablehttp_client", fake_streamablehttp_client),
-            patch("turnstone.core.mcp_client.ClientSession", fake_session),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            entry = _run(loop, _connect_under_lock(mgr, key, _http_cfg()))
-            owner = entry.owner_task
-            assert owner is not None
-            _run(loop, mgr._teardown_pool_entry(key), timeout=10)
-
-        assert owner.done() and owner.cancelled()
-        assert cancels["n"] == 1
-        assert events[-1] == "transport_exit"
-        assert entry.session is None and entry.owner_task is None
-
-    def test_owner_death_evicts_session_keeps_entry_and_catalog(self, running_loop_mgr) -> None:
-        """The transport collapsing under a live session (owner dies with no
-        requested close) evicts the session via the done-callback but leaves the
-        entry AND its discovered catalog in place for the next dispatch."""
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-        key = ("user-1", "pool-srv")
-
-        with (
-            patch(
-                "turnstone.core.mcp_client.streamablehttp_client", patches["streamablehttp_client"]
-            ),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            entry = _run(loop, _connect_under_lock(mgr, key, _http_cfg()))
-            owner = entry.owner_task
-            assert owner is not None and entry.session is fake["session"]
-            # Seed a catalog so we can prove the death-callback leaves it alone.
-            entry.tools = [{"name": "mcp__pool-srv__ping", "server": "pool-srv"}]
-
-            # Simulate the transport task group collapsing: the owner gets a
-            # stray cancellation (exactly what anyio's scope delivery does).
-            loop.call_soon_threadsafe(owner.cancel)
-            deadline = time.monotonic() + 5
-            while time.monotonic() < deadline and entry.owner_task is not None:
-                time.sleep(0.02)
-
-        assert owner.done()
-        assert entry.session is None  # evicted by the done-callback
-        assert entry.owner_task is None
-        assert key in mgr._user_pool_entries  # entry kept
-        assert entry.tools == [
-            {"name": "mcp__pool-srv__ping", "server": "pool-srv"}
-        ]  # catalog kept
-        # The cms were still unwound in-task despite the stray cancel.
-        assert fake["events"][-2:] == ["session_exit", "transport_exit"]
-
-    def test_caller_cancel_mid_connect_does_not_abandon_cms(self, running_loop_mgr) -> None:
-        """Cancelling the CONNECTING caller (an eviction giving up, shutdown, a
-        sync boundary timing out) must close the owner via the one-cancel
-        protocol — the transport cm still exits, in-task."""
-        mgr, loop, _ = running_loop_mgr
-        events: list[str] = []
-        entered = asyncio.Event()
-        key = ("user-1", "pool-srv")
-
-        @asynccontextmanager
-        async def hanging_streamablehttp_client(**_kwargs: Any):
-            events.append("transport_enter")
-            try:
-                entered.set()
-                await asyncio.sleep(3600)  # server accepted, then stalled
-                yield (AsyncMock(), AsyncMock(), lambda: None)
-            finally:
-                events.append("transport_exit")
-
-        async def _drive() -> None:
-            entry = await mgr._ensure_pool_entry(key)
-
-            async def _connect() -> None:
-                async with entry.open_lock:
-                    await mgr._connect_one_pool(key, _http_cfg(), "tok-aaa")
-
-            connect = asyncio.create_task(_connect())
-            await asyncio.wait_for(entered.wait(), timeout=5)
-            connect.cancel()  # the attempt-timeout / shutdown shape
-            with contextlib.suppress(asyncio.CancelledError):
-                _ = await connect  # only the expected cancel is absorbed
-            # The owner must be closed (one cancel) and fully unwound.
-            deadline = asyncio.get_running_loop().time() + 5
-            while asyncio.get_running_loop().time() < deadline:
-                owners = [
-                    t
-                    for t in asyncio.all_tasks()
-                    if t.get_name().startswith("mcp-pool-owner:") and not t.done()
-                ]
-                if not owners:
-                    return
-                await asyncio.sleep(0.02)
-            raise AssertionError("owner task still alive after caller cancel")
-
-        with (
-            patch("turnstone.core.mcp_client.streamablehttp_client", hanging_streamablehttp_client),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            _run(loop, _drive(), timeout=15)
-
-        assert events == ["transport_enter", "transport_exit"]
-        assert mgr._user_pool_entries[key].session is None
-
-
-# ---------------------------------------------------------------------------
-# Client-kwargs contract (bearer header + auth-capture factory)
-# ---------------------------------------------------------------------------
-
-
-class TestPoolOwnerClientKwargs:
-    def test_client_factory_present_iff_auth_capture(self, running_loop_mgr) -> None:
-        """The caller builds ``client_kwargs`` and the owner passes them to
-        ``streamablehttp_client`` verbatim: the auth-capture
-        ``httpx_client_factory`` is present exactly when a carrier is supplied,
-        and the per-user bearer always reaches the wire."""
-        mgr, loop, _ = running_loop_mgr
-        key = ("user-1", "pool-srv")
-
-        # With auth_capture → factory present.
-        patches_a: dict[str, Any] = {}
-        fake_a = _fake_transport_and_session(patches_a)
-        with (
-            patch(
-                "turnstone.core.mcp_client.streamablehttp_client",
-                patches_a["streamablehttp_client"],
-            ),
-            patch("turnstone.core.mcp_client.ClientSession", patches_a["ClientSession"]),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            _run(loop, _connect_under_lock(mgr, key, _http_cfg(), auth_capture=_AuthCapture()))
-            assert "httpx_client_factory" in fake_a["kwargs"]
-            assert fake_a["kwargs"]["headers"]["Authorization"] == "Bearer tok-aaa"
-            _run(loop, mgr._teardown_pool_entry(key))
-
-        # Without auth_capture → factory absent (but bearer still present).
-        patches_b: dict[str, Any] = {}
-        fake_b = _fake_transport_and_session(patches_b)
-        with (
-            patch(
-                "turnstone.core.mcp_client.streamablehttp_client",
-                patches_b["streamablehttp_client"],
-            ),
-            patch("turnstone.core.mcp_client.ClientSession", patches_b["ClientSession"]),
-            patch.object(mgr, "_tcp_probe", new=AsyncMock()),
-        ):
-            _run(loop, _connect_under_lock(mgr, key, _http_cfg()))
-            assert "httpx_client_factory" not in fake_b["kwargs"]
-            assert fake_b["kwargs"]["headers"]["Authorization"] == "Bearer tok-aaa"
-            _run(loop, mgr._teardown_pool_entry(key))
@@ -1,488 +0,0 @@
-"""Transport owner-task lifecycle + anyio cancel-scope zombie regressions.
-
-Covers the two bugs behind the flaky-MCP-server 100%-CPU incident:
-
-* Bug 1 — an anyio cancel scope whose host task has finished can never be
-  exited; once cancelled (SDK task-group child death, or a teardown racing a
-  connect) anyio re-delivers cancellation to it via ``call_soon`` every loop
-  iteration, forever. The fix routes every transport cm through a long-lived
-  per-server OWNER task (enter, park, exit — all in one task) with a
-  one-cancel close protocol; these tests pin the protocol's behavior.
-* Bug 2 — ``BaseExceptionGroup`` (BaseException-derived) escaping
-  ``except Exception`` killed ``_connect_all`` before the health/sweep loops
-  were created, silently disabling all autonomous recovery.
-
-The live end-to-end flap test (real server, SIGKILL cycle) lives in
-``test_mcp_live_flaky_server.py``; these are fast mock-transport unit tests.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-import threading
-import time
-from contextlib import asynccontextmanager
-from typing import Any
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-
-from turnstone.core.mcp_client import MCPClientManager
-
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-@pytest.fixture
-def running_loop_mgr():
-    """Background-loop fixture matching the static-path test convention."""
-    cfg: dict[str, Any] = {"srv": {"type": "stdio", "command": "fake-cmd"}}
-    mgr = MCPClientManager(cfg)
-    loop = asyncio.new_event_loop()
-    thread = threading.Thread(target=loop.run_forever, daemon=True, name="mcp-owner-test-loop")
-    thread.start()
-    mgr._loop = loop
-    try:
-        yield mgr, loop, thread
-    finally:
-
-        async def _drain(m: MCPClientManager) -> None:
-            for attr in (
-                "_user_pool_eviction_task",
-                "_user_token_sweep_task",
-                "_static_health_task",
-            ):
-                task = getattr(m, attr)
-                if task is not None:
-                    task.cancel()
-                    await asyncio.gather(task, return_exceptions=True)
-                    setattr(m, attr, None)
-            for state in m._static_servers.values():
-                owner = state.owner_task
-                if owner is not None and not owner.done():
-                    if state.close_requested is not None:
-                        state.close_requested.set()
-                    owner.cancel()
-                    await asyncio.gather(owner, return_exceptions=True)
-
-        with contextlib.suppress(Exception):
-            asyncio.run_coroutine_threadsafe(_drain(mgr), loop).result(timeout=5)
-        loop.call_soon_threadsafe(loop.stop)
-        thread.join(timeout=5)
-        if not thread.is_alive():
-            loop.close()
-
-
-def _run(loop: asyncio.AbstractEventLoop, coro: Any, timeout: float = 5.0) -> Any:
-    return asyncio.run_coroutine_threadsafe(coro, loop).result(timeout=timeout)
-
-
-def _make_session_mock() -> AsyncMock:
-    """A ClientSession-shaped mock good enough for connect + discovery."""
-    session = AsyncMock()
-    session.initialize = AsyncMock()
-    session.get_server_capabilities = MagicMock(return_value=None)
-    session.list_tools = AsyncMock(return_value=MagicMock(tools=[]))
-    return session
-
-
-def _fake_transport_and_session(mgr_module_patches: dict[str, Any]) -> dict[str, Any]:
-    """Build fake stdio transport + ClientSession cms, recording enter/exit."""
-    events: list[str] = []
-    session = _make_session_mock()
-
-    @asynccontextmanager
-    async def fake_stdio_client(_params: Any):
-        events.append("transport_enter")
-        try:
-            yield (AsyncMock(), AsyncMock())
-        finally:
-            events.append("transport_exit")
-
-    @asynccontextmanager
-    async def fake_client_session_cm():
-        events.append("session_enter")
-        try:
-            yield session
-        finally:
-            events.append("session_exit")
-
-    def fake_client_session(_read: Any, _write: Any, message_handler: Any = None):
-        return fake_client_session_cm()
-
-    mgr_module_patches["stdio_client"] = fake_stdio_client
-    mgr_module_patches["ClientSession"] = fake_client_session
-    return {"events": events, "session": session}
-
-
-# ---------------------------------------------------------------------------
-# Owner lifecycle
-# ---------------------------------------------------------------------------
-
-
-class TestTransportOwnerLifecycle:
-    def test_connect_installs_owner_and_teardown_closes_gracefully(self, running_loop_mgr) -> None:
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-
-        with (
-            patch("turnstone.core.mcp_client.stdio_client", patches["stdio_client"]),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-        ):
-            _run(loop, mgr._connect_one_locked("srv", mgr._server_configs["srv"]))
-            state = mgr._static_servers["srv"]
-            assert state.session is fake["session"]
-            owner = state.owner_task
-            assert owner is not None and not owner.done()
-            assert state.close_requested is not None
-            assert fake["events"] == ["transport_enter", "session_enter"]
-
-            _run(loop, mgr._teardown_static_session("srv"))
-
-        # Graceful close: the parked owner exits via the event — no cancel —
-        # and unwinds BOTH cms in-task, inner-out.
-        assert owner.done() and not owner.cancelled()
-        assert fake["events"] == [
-            "transport_enter",
-            "session_enter",
-            "session_exit",
-            "transport_exit",
-        ]
-        assert state.session is None
-        assert state.owner_task is None
-        assert state.close_requested is None
-
-    def test_owner_death_evicts_session(self, running_loop_mgr) -> None:
-        """Trigger-A observer: the transport collapsing under a live session
-        (owner task dies without a requested close) evicts the session so the
-        health loop / next dispatch reconnects instead of probing a corpse."""
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-
-        with (
-            patch("turnstone.core.mcp_client.stdio_client", patches["stdio_client"]),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-        ):
-            _run(loop, mgr._connect_one_locked("srv", mgr._server_configs["srv"]))
-            state = mgr._static_servers["srv"]
-            owner = state.owner_task
-            assert owner is not None and state.session is fake["session"]
-
-            # Simulate the transport task group collapsing: the owner gets a
-            # stray cancellation (exactly what anyio's scope delivery does).
-            loop.call_soon_threadsafe(owner.cancel)
-            deadline = time.monotonic() + 5
-            while time.monotonic() < deadline and state.owner_task is not None:
-                time.sleep(0.02)
-
-        assert owner.done()
-        assert state.session is None  # evicted by the done-callback
-        assert state.owner_task is None
-        # The cms were still unwound in-task despite the stray cancel.
-        assert fake["events"][-2:] == ["session_exit", "transport_exit"]
-
-    def test_owner_death_during_discovery_fails_fast(self, running_loop_mgr) -> None:
-        """The static sibling of the pool's owner-death discovery race:
-        discovery runs in the connecting caller while the transport is hosted
-        by the owner, so a transport collapse mid-discovery cancels the OWNER
-        and a bare await on the response stream would hang to the caller-side
-        attempt timeout (~45s). ``_await_owner_discovery`` must convert it
-        into a PROMPT ``ConnectionError`` and leave the state torn down."""
-        mgr, loop, _ = running_loop_mgr
-        patches: dict[str, Any] = {}
-        fake = _fake_transport_and_session(patches)
-
-        discovery_parked = asyncio.Event()
-
-        async def _parked_list_tools() -> Any:
-            discovery_parked.set()
-            await asyncio.sleep(3600)  # the transport never answers
-
-        fake["session"].list_tools = AsyncMock(side_effect=_parked_list_tools)
-
-        async def _drive() -> tuple[float, BaseException | None]:
-            async def _collapse_owner_when_parked() -> None:
-                await discovery_parked.wait()
-                owner = mgr._static_servers["srv"].owner_task
-                assert owner is not None
-                owner.cancel()  # the transport task group collapsing
-
-            collapser = asyncio.create_task(_collapse_owner_when_parked())
-            t0 = asyncio.get_running_loop().time()
-            exc: BaseException | None = None
-            try:
-                await mgr._connect_one_locked("srv", mgr._server_configs["srv"])
-            except Exception as e:
-                # The expected ConnectionError; anything else (a cancel leak,
-                # an interpreter exit) propagates and fails the test loudly.
-                exc = e
-            _ = await collapser  # synchronization point; failures propagate
-            return asyncio.get_running_loop().time() - t0, exc
-
-        with (
-            patch("turnstone.core.mcp_client.stdio_client", patches["stdio_client"]),
-            patch("turnstone.core.mcp_client.ClientSession", patches["ClientSession"]),
-        ):
-            elapsed, exc = _run(loop, _drive(), timeout=15)
-
-        assert isinstance(exc, ConnectionError)
-        assert "died during discovery" in str(exc)
-        assert elapsed < 5.0  # prompt fail — not the attempt-timeout hang
-        assert mgr._static_servers["srv"].session is None
-        # The owner unwound its cms despite dying mid-discovery.
-        assert fake["events"][-2:] == ["session_exit", "transport_exit"]
-
-    def test_base_exception_escape_resolves_waiter_and_propagates(self, running_loop_mgr) -> None:
-        """A BaseException-derived escape that is neither CancelledError nor
-        Exception/group (a library control-flow escape; SystemExit and
-        KeyboardInterrupt take the same path but additionally stop the loop —
-        asyncio semantics, unobservable in-process) is NOT swallowed — it
-        propagates from the owner task — but the waiter must still be resolved
-        with a transport-failure error, or the connecting caller would block
-        until its outer bound (and ``_connect_all``'s initial connect has
-        none)."""
-        mgr, loop, _ = running_loop_mgr
-
-        class _TransportLibraryEscape(BaseException):
-            pass
-
-        @asynccontextmanager
-        async def escaping_stdio_client(_params: Any):
-            raise _TransportLibraryEscape("control-flow escape")
-            yield  # pragma: no cover
-
-        async def _drive() -> tuple[BaseException | None, BaseException | None]:
-            ready: asyncio.Future[Any] = asyncio.get_running_loop().create_future()
-            close_requested = asyncio.Event()
-            owner = asyncio.create_task(
-                mgr._static_transport_owner(
-                    "srv", mgr._server_configs["srv"], ready, close_requested
-                )
-            )
-            waiter_exc: BaseException | None = None
-            try:
-                await ready
-            except (Exception, _TransportLibraryEscape) as e:
-                # Exception covers the expected ConnectionError; the escape
-                # type covers the exact regression this test guards (the raw
-                # escape leaking to the waiter instead of being converted).
-                waiter_exc = e
-            await asyncio.wait({owner}, timeout=5)
-            owner_exc = owner.exception() if owner.done() and not owner.cancelled() else None
-            return waiter_exc, owner_exc
-
-        with patch("turnstone.core.mcp_client.stdio_client", escaping_stdio_client):
-            waiter_exc, owner_exc = _run(loop, _drive(), timeout=10)
-
-        assert isinstance(waiter_exc, ConnectionError)  # waiter resolved, never hung
-        assert isinstance(owner_exc, _TransportLibraryEscape)  # propagated, unswallowed
-
-    def test_connect_failure_unwinds_owner_and_raises(self, running_loop_mgr) -> None:
-        mgr, loop, _ = running_loop_mgr
-
-        @asynccontextmanager
-        async def failing_stdio_client(_params: Any):
-            raise ConnectionError("refused")
-            yield  # pragma: no cover
-
-        with (
-            patch("turnstone.core.mcp_client.stdio_client", failing_stdio_client),
-            pytest.raises(ConnectionError, match="refused"),
-        ):
-            _run(loop, mgr._connect_one_locked("srv", mgr._server_configs["srv"]))
-
-        state = mgr._static_servers["srv"]
-        assert state.session is None
-        assert state.owner_task is None
-
-        async def _no_owner_tasks() -> int:
-            return sum(
-                1
-                for t in asyncio.all_tasks()
-                if t.get_name().startswith("mcp-transport-owner:") and not t.done()
-            )
-
-        assert _run(loop, _no_owner_tasks()) == 0
-
-    def test_caller_cancel_mid_connect_does_not_abandon_cms(self, running_loop_mgr) -> None:
-        """Bug-1 core regression: cancelling the CONNECTING caller (attempt
-        timeout, shutdown, sync boundary giving up) must close the owner via
-        the one-cancel protocol — the transport cm still exits, in-task."""
-        mgr, loop, _ = running_loop_mgr
-        events: list[str] = []
-        entered = asyncio.Event()
-
-        @asynccontextmanager
-        async def hanging_stdio_client(_params: Any):
-            events.append("transport_enter")
-            try:
-                entered.set()
-                await asyncio.sleep(3600)  # server accepted, then stalled
-                yield (AsyncMock(), AsyncMock())
-            finally:
-                events.append("transport_exit")
-
-        async def _drive() -> None:
-            connect = asyncio.create_task(
-                mgr._connect_one_locked("srv", mgr._server_configs["srv"])
-            )
-            await asyncio.wait_for(entered.wait(), timeout=5)
-            connect.cancel()  # the attempt-timeout / shutdown shape
-            with contextlib.suppress(asyncio.CancelledError):
-                _ = await connect  # only the expected cancel is absorbed
-            # The owner must be closed (one cancel) and fully unwound.
-            deadline = asyncio.get_running_loop().time() + 5
-            while asyncio.get_running_loop().time() < deadline:
-                owners = [
-                    t
-                    for t in asyncio.all_tasks()
-                    if t.get_name().startswith("mcp-transport-owner:") and not t.done()
-                ]
-                if not owners:
-                    return
-                await asyncio.sleep(0.02)
-            raise AssertionError("owner task still alive after caller cancel")
-
-        with patch("turnstone.core.mcp_client.stdio_client", hanging_stdio_client):
-            _run(loop, _drive(), timeout=15)
-
-        assert events == ["transport_enter", "transport_exit"]
-        assert mgr._static_servers["srv"].session is None
-
-
-# ---------------------------------------------------------------------------
-# Bug 2: BaseExceptionGroup vs except Exception
-# ---------------------------------------------------------------------------
-
-
-class TestBaseExceptionGroupHardening:
-    def test_connect_all_survives_group_and_starts_loops(self, running_loop_mgr) -> None:
-        """A transport failure wrapped in BaseExceptionGroup (e.g. an
-        accept-then-RST server collapsing the SDK task group with a stray
-        CancelledError inside) must not kill ``_connect_all`` before the
-        health/sweep loops are started — that silently disabled ALL
-        autonomous recovery."""
-        mgr, loop, _ = running_loop_mgr
-        # Pin the loop cadences: the assertions below require both loops to be
-        # ENABLED, independent of whatever mcp config the environment carries.
-        mgr._user_token_sweep_s = 240.0
-        mgr._static_health_check_s = 30.0
-
-        async def _exploding_connect(name: str, _cfg: dict[str, Any]) -> None:
-            raise BaseExceptionGroup("transport collapsed", [asyncio.CancelledError()])
-
-        with patch.object(mgr, "_connect_one", side_effect=_exploding_connect):
-            _run(loop, mgr._connect_all())
-
-        assert mgr._connected.is_set()
-        assert "srv" in mgr._last_error
-        health = mgr._static_health_task
-        sweep = mgr._user_token_sweep_task
-        assert health is not None and not health.done()
-        assert sweep is not None and not sweep.done()
-
-    def test_health_loop_survives_group(self, running_loop_mgr) -> None:
-        mgr, loop, _ = running_loop_mgr
-        ticks: list[int] = []
-
-        async def _tick_then_group() -> float:
-            ticks.append(1)
-            if len(ticks) == 1:
-                raise BaseExceptionGroup("boom", [asyncio.CancelledError()])
-            return 3600.0
-
-        mgr._static_health_check_s = 0.05  # quick recovery sleep after the group
-        with patch.object(mgr, "_static_health_tick", side_effect=_tick_then_group):
-
-            async def _drive() -> asyncio.Task[None]:
-                task = asyncio.create_task(mgr._static_health_loop())
-                deadline = asyncio.get_running_loop().time() + 5
-                while asyncio.get_running_loop().time() < deadline and len(ticks) < 2:
-                    await asyncio.sleep(0.02)
-                assert len(ticks) >= 2, "loop died on BaseExceptionGroup"
-                assert not task.done()
-                task.cancel()
-                with contextlib.suppress(asyncio.CancelledError):
-                    _ = await task  # only the expected cancel is absorbed
-                return task
-
-            _run(loop, _drive(), timeout=10)
-
-
-# ---------------------------------------------------------------------------
-# Orphaned-scope disarm backstop
-# ---------------------------------------------------------------------------
-
-
-class TestScopeDisarmBackstop:
-    def test_disarms_exactly_the_all_done_scope_on_this_loop(self, running_loop_mgr) -> None:
-        """One sweep over three armed scopes must touch EXACTLY the true
-        orphan: the all-done-tasks scope hosted on the mcp-loop. The
-        live-task scope (its task may still drain the scope) and the
-        hostless scope (loop unknown — not ours to reach into) stay armed.
-        Asserting ``disarmed == 1`` discriminates both failure directions:
-        a no-op sweep and an over-eager one."""
-        mgr, loop, _ = running_loop_mgr
-
-        async def _arm_and_sweep() -> dict[str, Any]:
-            from anyio._backends._asyncio import CancelScope
-
-            this_loop = asyncio.get_running_loop()
-
-            async def _noop() -> None:
-                return None
-
-            blocker = asyncio.Event()
-
-            async def _parked() -> None:
-                await blocker.wait()
-
-            done_task = asyncio.create_task(_noop())
-            _ = await done_task  # synchronization point; failures propagate
-            live_task = asyncio.create_task(_parked())
-            await asyncio.sleep(0)
-
-            orphan = CancelScope()
-            orphan._host_task = done_task
-            orphan._tasks.add(done_task)
-            orphan._cancel_handle = this_loop.call_soon(lambda: None)
-
-            live_scope = CancelScope()
-            live_scope._host_task = live_task
-            live_scope._tasks.add(live_task)
-            live_scope._cancel_handle = this_loop.call_soon(lambda: None)
-
-            hostless = CancelScope()
-            hostless._tasks.add(done_task)
-            hostless._cancel_handle = this_loop.call_soon(lambda: None)
-
-            mgr._last_scope_disarm = 0.0
-            disarmed = mgr._maybe_disarm_orphaned_scopes("unit test")
-            results = {
-                "disarmed": disarmed,
-                "orphan_handle_cleared": orphan._cancel_handle is None,
-                "orphan_tasks_cleared": len(orphan._tasks) == 0,
-                "live_still_armed": live_scope._cancel_handle is not None,
-                "live_task_kept": live_task in live_scope._tasks,
-                "hostless_still_armed": hostless._cancel_handle is not None,
-                "rate_limited_second": mgr._maybe_disarm_orphaned_scopes("again"),
-            }
-            for scope in (live_scope, hostless):
-                if scope._cancel_handle is not None:
-                    scope._cancel_handle.cancel()
-                    scope._cancel_handle = None
-                scope._tasks.clear()
-            blocker.set()
-            _ = await live_task  # synchronization point; failures propagate
-            return results
-
-        r = _run(loop, _arm_and_sweep())
-        assert r["disarmed"] == 1
-        assert r["orphan_handle_cleared"] and r["orphan_tasks_cleared"]
-        assert r["live_still_armed"] and r["live_task_kept"]
-        assert r["hostless_still_armed"]
-        assert r["rate_limited_second"] == 0
@@ -15,13 +15,13 @@ from __future__ import annotations
 import asyncio
 import contextlib
 import json
-import logging
 import threading
 import time
+from contextlib import AsyncExitStack
 from datetime import UTC, datetime, timedelta
 from types import SimpleNamespace
 from typing import Any
-from unittest.mock import AsyncMock, MagicMock, patch
+from unittest.mock import AsyncMock, MagicMock

 import pytest

@@ -114,31 +114,12 @@ def running_loop_mgr():
        # handlers don't fire after pytest has torn its handlers down. Mirrors
        # the production ``shutdown()`` shape.
        async def _drain(m: MCPClientManager) -> None:
-            # ``_static_health_task`` included: since the BaseExceptionGroup
-            # hardening, ``_connect_all`` reliably starts (and keeps alive) the
-            # health loop even when every configured connect fails — a test
-            # that drives ``_connect_all`` must drain it like production
-            # ``shutdown()`` does, or the task is destroyed pending at GC.
-            for attr in (
-                "_user_pool_eviction_task",
-                "_user_token_sweep_task",
-                "_static_health_task",
-            ):
-                task = getattr(m, attr)
-                if task is not None:
-                    task.cancel()
-                    await asyncio.gather(task, return_exceptions=True)
-                    setattr(m, attr, None)
-            # Close any parked pool transport owners a successful
-            # ``_connect_one_pool`` left installed, mirroring production
-            # ``shutdown()`` — an undrained owner is destroyed pending at GC.
-            for entry in list(m._user_pool_entries.values()):
-                owner = entry.owner_task
-                if owner is not None and not owner.done():
-                    if entry.close_requested is not None:
-                        entry.close_requested.set()
-                    owner.cancel()
-                    await asyncio.gather(owner, return_exceptions=True)
+            task = m._user_pool_eviction_task
+            if task is not None:
+                task.cancel()
+                with contextlib.suppress(BaseException):
+                    await task
+                m._user_pool_eviction_task = None

        with contextlib.suppress(Exception):
            asyncio.run_coroutine_threadsafe(_drain(mgr), loop).result(timeout=2)
@@ -360,42 +341,25 @@ class TestEviction:
        assert ("u4", "pool-srv") in mgr._user_pool_entries
        assert ("u3", "pool-srv") in mgr._user_pool_entries

-    def test_eviction_resilient_to_owner_unwind_errors(self, running_loop_mgr) -> None:
-        """Owner-model successor to the old ``resilient_to_close_errors`` test.
-
-        Teardown reaps the entry's owner through a bounded ``asyncio.wait`` that
-        never re-raises, so even an owner whose in-task unwind raises cannot
-        break eviction. The old failure mode this guarded — a cross-task
-        ``stack.aclose()`` raising ``RuntimeError('...different task...')`` — is
-        structurally impossible now: the transport cms live in, and unwind in,
-        the owner task, never the evictor.
-        """
+    def test_eviction_resilient_to_close_errors(self, running_loop_mgr) -> None:
        mgr, loop, _ = running_loop_mgr
        mgr._user_pool_idle_ttl_s = 0.0

+        broken_stack = MagicMock(spec=AsyncExitStack)
+        broken_stack.aclose = AsyncMock(side_effect=RuntimeError("close failed"))
+
        async def _seed() -> None:
            for i in range(2):
-                key = (f"u{i}", "pool-srv")
-                entry = await mgr._ensure_pool_entry(key)
-                event = asyncio.Event()
-
-                async def _owner(ev: asyncio.Event = event) -> None:
-                    await ev.wait()
-                    raise RuntimeError("unwind failed")
-
-                owner = asyncio.create_task(_owner(), name=f"mcp-pool-owner-test:{i}")
-                # Retrieve the exception so the raising owner doesn't warn at GC.
-                owner.add_done_callback(lambda t: None if t.cancelled() else t.exception())
+                entry = await mgr._ensure_pool_entry((f"u{i}", "pool-srv"))
                entry.session = MagicMock()
-                entry.owner_task = owner
-                entry.close_requested = event
+                entry.stack = broken_stack

        _run_on_loop(loop, _seed())

        async def _evict() -> None:
            await mgr._evict_idle_pool_entries()

-        # Eviction must not raise even if the owner's unwind raises.
+        # Eviction must not raise even if close fails.
        _run_on_loop(loop, _evict())
        # All entries removed from the dict regardless.
        assert mgr._user_pool_entries == {}
@@ -1005,400 +969,3 @@ class TestUserIdThreadThrough:
        assert result == "static-output"
        # No pool entries were created.
        assert mgr._user_pool_entries == {}
-
-
-# ---------------------------------------------------------------------------
-# Background token-freshness sweep (oauth_user keep-hot, no connection warming)
-# ---------------------------------------------------------------------------
-
-
-class TestUserTokenFreshnessSweep:
-    """The background sweep that keeps every consented ``oauth_user`` grant hot
-    for unattended / autonomous work: refresh-on-expiry via the canonical path,
-    proactive dead-grant badging, once-only surfacing, and — the load-bearing
-    property — total invisibility to static / no-auth deployments."""
-
-    def _wire(self, mgr: MCPClientManager, storage: SQLiteBackend, cipher: Any) -> None:
-        mgr.set_storage(storage)
-        mgr.set_app_state(_make_app_state(storage, cipher=cipher))
-        mgr._oauth_user_server_names = {"pool-srv"}
-
-    @staticmethod
-    def _classified(kind: str, token: str | None = None):
-        async def _fake(**kwargs: Any) -> Any:
-            return SimpleNamespace(kind=kind, token=token)
-
-        return _fake
-
-    # -- no-auth / static safety: the sweep must be structurally invisible ----
-
-    def test_sweep_noop_without_oauth_servers(self, running_loop_mgr, storage) -> None:
-        """A static-only / no-auth deployment: the OBO gate returns before any
-        DB scan or AS round-trip — the single most important property."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        mgr._oauth_user_server_names = set()  # no oauth_user server configured
-        storage.list_mcp_user_token_reconcile_targets = MagicMock(return_value=[])  # type: ignore[method-assign]
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=AsyncMock(),
-        ) as classified:
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        storage.list_mcp_user_token_reconcile_targets.assert_not_called()  # no token-table scan
-        classified.assert_not_awaited()  # no AS round-trip
-
-    def test_sweep_noop_before_storage_wired(self, running_loop_mgr) -> None:
-        mgr, loop, _ = running_loop_mgr
-        mgr._oauth_user_server_names = {"pool-srv"}  # oauth configured but app not wired yet
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=AsyncMock(),
-        ) as classified:
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        classified.assert_not_awaited()
-
-    def test_sweep_skips_server_not_in_oauth_set(self, running_loop_mgr, storage) -> None:
-        """A token row lingering for a since-demoted / renamed server is not
-        reconciled — only pairs whose server is currently ``oauth_user``."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="ghost-srv")
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=AsyncMock(),
-        ) as classified:
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        classified.assert_not_awaited()  # ghost-srv is not in _oauth_user_server_names
-
-    # -- classification branches --------------------------------------------
-
-    def test_healthy_token_no_badge(self, running_loop_mgr, storage) -> None:
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.upsert_mcp_pending_consent = MagicMock()  # type: ignore[method-assign]
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("token", token="access-aaa"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        storage.upsert_mcp_pending_consent.assert_not_called()
-        assert ("u1", "pool-srv") not in mgr._token_sweep_warned
-
-    def test_dead_grant_badges_once_and_dedups(self, running_loop_mgr, storage, caplog) -> None:
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.upsert_mcp_pending_consent = MagicMock()  # type: ignore[method-assign]
-
-        with (
-            patch(
-                "turnstone.core.mcp_client.get_user_access_token_classified",
-                new=self._classified("refresh_failed"),
-            ),
-            caplog.at_level(logging.WARNING, logger="turnstone.core.mcp_client"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())  # second tick: no re-badge
-
-        # Badge raised exactly once, proactively, with the dashboard's code.
-        storage.upsert_mcp_pending_consent.assert_called_once()
-        assert (
-            storage.upsert_mcp_pending_consent.call_args.kwargs["error_code"]
-            == "mcp_consent_required"
-        )
-        assert ("u1", "pool-srv") in mgr._token_sweep_warned
-        escalations = [r for r in caplog.records if "needs re-consent" in r.getMessage()]
-        assert len(escalations) == 1  # logged loud-once, not every tick
-
-    def test_decrypt_failure_warns_but_does_not_badge(self, running_loop_mgr, storage) -> None:
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.upsert_mcp_pending_consent = MagicMock()  # type: ignore[method-assign]
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("decrypt_failure"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        # Operator-actionable (key unknown) — surfaced in the warned set, but NOT
-        # a user-consent badge (outside the dashboard's scope).
-        storage.upsert_mcp_pending_consent.assert_not_called()
-        assert ("u1", "pool-srv") in mgr._token_sweep_warned
-
-    def test_transient_failure_is_silent(self, running_loop_mgr, storage) -> None:
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.upsert_mcp_pending_consent = MagicMock()  # type: ignore[method-assign]
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("refresh_failed_transient"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        storage.upsert_mcp_pending_consent.assert_not_called()
-        assert ("u1", "pool-srv") not in mgr._token_sweep_warned  # retryable, not surfaced
-
-    def test_recovery_rearms_and_clears_badge(self, running_loop_mgr, storage) -> None:
-        """A dead grant that later returns healthy clears its warned pin AND drops
-        the stale badge — the self-heal for a spurious invalid_grant that has
-        since recovered. Production-reachable now that the observe-only sweep no
-        longer deletes the row on refresh_failed, so the pair keeps enumerating."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.delete_mcp_pending_consent = MagicMock(return_value=True)  # type: ignore[method-assign]
-        key = ("u1", "pool-srv")
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("refresh_failed"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert key in mgr._token_sweep_warned
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("token", token="access-aaa"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert key not in mgr._token_sweep_warned  # recovered → re-armed
-        storage.delete_mcp_pending_consent.assert_called_once_with("u1", "pool-srv")
-
-    def test_dead_grant_not_pinned_when_badge_persist_fails(
-        self, running_loop_mgr, storage
-    ) -> None:
-        """If the badge write fails, the pair is NOT pinned, so the next tick
-        retries — a single failed persist must not permanently lose the only
-        proactive signal for a sweep-detected dead grant."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        storage.upsert_mcp_pending_consent = MagicMock(  # type: ignore[method-assign]
-            side_effect=RuntimeError("db down")
-        )
-        key = ("u1", "pool-srv")
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("refresh_failed"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-            assert key not in mgr._token_sweep_warned  # not pinned — will retry
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        # Retried on the second tick rather than deduped away by a phantom pin.
-        assert storage.upsert_mcp_pending_consent.call_count == 2
-
-    def test_sweep_uses_non_revoking_observe_mode(self, running_loop_mgr, storage) -> None:
-        """The background sweep MUST call the canonical lookup non-destructively:
-        a timer may never delete a token or move a foreground user's revoke
-        threshold."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        seen_kwargs: list[dict[str, Any]] = []
-
-        async def _spy(**kwargs: Any) -> Any:
-            seen_kwargs.append(kwargs)
-            return SimpleNamespace(kind="token", token="access-aaa")
-
-        with patch("turnstone.core.mcp_client.get_user_access_token_classified", new=_spy):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert seen_kwargs and seen_kwargs[0]["revoke_on_failure"] is False
-        assert seen_kwargs[0]["revoke_ambiguous_escalation"] is False
-
-    # -- keepalive refresh (exercise the refresh token before it idles out) ---
-
-    def test_keepalive_refresh_due_logic(self) -> None:
-        mgr = MCPClientManager({})
-        mgr._user_token_refresh_keepalive_s = 3600.0
-        old = (datetime.now(UTC) - timedelta(hours=2)).strftime("%Y-%m-%dT%H:%M:%S")
-        recent = (datetime.now(UTC) - timedelta(minutes=1)).strftime("%Y-%m-%dT%H:%M:%S")
-        assert mgr._keepalive_refresh_due(old) is True  # past the window → force
-        assert mgr._keepalive_refresh_due(recent) is False  # still warm
-        assert mgr._keepalive_refresh_due(None) is True  # unknown → force once, safe
-        assert mgr._keepalive_refresh_due("not-a-date") is True  # unparseable → force
-        mgr._user_token_refresh_keepalive_s = 0.0
-        assert mgr._keepalive_refresh_due(old) is False  # disabled → never force
-
-    def test_keepalive_due_forces_refresh(self, running_loop_mgr, storage) -> None:
-        """A grant whose refresh token has idled past the window is force-refreshed
-        even though its access token may be fresh — the [6] fix: keep the refresh
-        token alive so an unattended run never finds it aged out."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        mgr._user_token_refresh_keepalive_s = 1800.0
-        stale = (datetime.now(UTC) - timedelta(hours=2)).strftime("%Y-%m-%dT%H:%M:%S")
-        storage.list_mcp_user_token_reconcile_targets = MagicMock(  # type: ignore[method-assign]
-            return_value=[("u1", "pool-srv", stale)]
-        )
-        seen_kwargs: list[dict[str, Any]] = []
-
-        async def _spy(**kwargs: Any) -> Any:
-            seen_kwargs.append(kwargs)
-            return SimpleNamespace(kind="token", token="access-aaa")
-
-        with patch("turnstone.core.mcp_client.get_user_access_token_classified", new=_spy):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert seen_kwargs and seen_kwargs[0]["force_refresh"] is True
-
-    def test_keepalive_not_due_does_not_force(self, running_loop_mgr, storage) -> None:
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        mgr._user_token_refresh_keepalive_s = 1800.0
-        recent = (datetime.now(UTC) - timedelta(minutes=1)).strftime("%Y-%m-%dT%H:%M:%S")
-        storage.list_mcp_user_token_reconcile_targets = MagicMock(  # type: ignore[method-assign]
-            return_value=[("u1", "pool-srv", recent)]
-        )
-        seen_kwargs: list[dict[str, Any]] = []
-
-        async def _spy(**kwargs: Any) -> Any:
-            seen_kwargs.append(kwargs)
-            return SimpleNamespace(kind="token", token="access-aaa")
-
-        with patch("turnstone.core.mcp_client.get_user_access_token_classified", new=_spy):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert seen_kwargs and seen_kwargs[0]["force_refresh"] is False  # still warm
-
-    def test_warned_set_pruned_to_consented_pairs(self, running_loop_mgr, storage) -> None:
-        """A warned pair that is no longer consented (row gone) is dropped from
-        the dedup set so it can't grow unbounded across transient dead grants."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        _seed_user_token(storage, cipher, user_id="u1", server_name="pool-srv")
-        mgr._token_sweep_warned = {("gone-user", "pool-srv"), ("u1", "pool-srv")}
-
-        with patch(
-            "turnstone.core.mcp_client.get_user_access_token_classified",
-            new=self._classified("token", token="access-aaa"),
-        ):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert ("gone-user", "pool-srv") not in mgr._token_sweep_warned  # pruned
-        assert ("u1", "pool-srv") not in mgr._token_sweep_warned  # healthy → cleared
-
-    def test_per_pair_failure_isolated(self, running_loop_mgr, storage) -> None:
-        """One pair raising must not starve the rest of the pass."""
-        mgr, loop, _ = running_loop_mgr
-        cipher = make_mcp_token_cipher()
-        self._wire(mgr, storage, cipher)
-        mgr._oauth_user_server_names = {"pool-srv"}
-        _seed_user_token(storage, cipher, user_id="u-bad", server_name="pool-srv")
-        _seed_user_token(storage, cipher, user_id="u-ok", server_name="pool-srv")
-        seen: list[str] = []
-
-        async def _flaky(**kwargs: Any) -> Any:
-            uid = kwargs["user_id"]
-            seen.append(uid)
-            if uid == "u-bad":
-                raise RuntimeError("boom")
-            return SimpleNamespace(kind="token", token="access-aaa")
-
-        with patch("turnstone.core.mcp_client.get_user_access_token_classified", new=_flaky):
-            _run_on_loop(loop, mgr._sweep_user_token_freshness())
-        assert {"u-bad", "u-ok"} <= set(seen)  # both attempted despite one raising
-
-    def test_sweep_loop_cancel_returns_cleanly(self, running_loop_mgr) -> None:
-        """The loop body exits on cancellation without raising (mirrors the
-        eviction loop's teardown contract)."""
-        mgr, loop, _ = running_loop_mgr
-        mgr._user_token_sweep_s = 999.0  # park in the sleep
-
-        async def _spawn() -> asyncio.Task[None]:
-            return asyncio.ensure_future(mgr._user_token_sweep_loop())
-
-        task = _run_on_loop(loop, _spawn())
-
-        async def _cancel() -> None:
-            task.cancel()
-            with contextlib.suppress(BaseException):
-                await task
-
-        _run_on_loop(loop, _cancel())
-        assert task.cancelled() or task.done()
-
-    def test_connect_all_starts_the_sweep_task(self, running_loop_mgr) -> None:
-        """Wiring guard: ``_connect_all`` must start the sweep once, even with no
-        servers configured — otherwise the whole keep-hot mechanism is dead code."""
-        mgr, loop, _ = running_loop_mgr
-        assert mgr._user_token_sweep_task is None
-
-        _run_on_loop(loop, mgr._connect_all())
-        try:
-            task = mgr._user_token_sweep_task
-            assert task is not None and not task.done()  # live, single instance
-        finally:
-
-            async def _drain() -> None:
-                t = mgr._user_token_sweep_task
-                if t is not None:
-                    t.cancel()
-                    with contextlib.suppress(BaseException):
-                        await t
-                    mgr._user_token_sweep_task = None
-
-            _run_on_loop(loop, _drain())
-
-    def test_disabled_sweep_not_started_by_connect_all(self, running_loop_mgr) -> None:
-        """Cadence <= 0 disables the sweep entirely — no task is spawned."""
-        mgr, loop, _ = running_loop_mgr
-        mgr._user_token_sweep_s = 0.0
-        _run_on_loop(loop, mgr._connect_all())
-        assert mgr._user_token_sweep_task is None
-
-    @pytest.mark.parametrize(
-        ("configured", "expected"),
-        [
-            (0, 0.0),  # explicit disable
-            (-5, 0.0),  # negative disables (no busy-loop)
-            (1, 30.0),  # tiny positive floored to _MIN_USER_TOKEN_SWEEP_S
-            (600, 600.0),  # normal value passes through
-        ],
-    )
-    def test_cadence_clamped_or_disabled(self, configured, expected) -> None:
-        """The config cadence is floored (positive) or disabled (<= 0) so an
-        ``asyncio.sleep(0)`` busy-loop is unreachable."""
-        with patch(
-            "turnstone.core.mcp_client.load_config",
-            return_value={"user_token_sweep_seconds": configured},
-        ):
-            mgr = MCPClientManager({})
-        assert mgr._user_token_sweep_s == expected
-
-    # -- storage enumerator --------------------------------------------------
-
-    def test_reconcile_targets_pairs_expiry_unfiltered_with_last_exercised(self, storage) -> None:
-        cipher = make_mcp_token_cipher()
-        # alice consents to two servers → two rows.
-        _seed_user_token(storage, cipher, user_id="alice", server_name="srv-a")
-        _seed_user_token(storage, cipher, user_id="alice", server_name="srv-b")
-        # bob's access token is expired but the refresh token is live — still a
-        # consented, reconcilable grant, so bob must be enumerated.
-        _seed_user_token(
-            storage, cipher, user_id="bob", server_name="srv-a", expires_in_seconds=-999
-        )
-        targets = storage.list_mcp_user_token_reconcile_targets()
-        # (user, server) identity, all three grants present regardless of expiry.
-        assert sorted((u, s) for u, s, _ in targets) == [
-            ("alice", "srv-a"),
-            ("alice", "srv-b"),
-            ("bob", "srv-a"),
-        ]
-        # last_exercised = COALESCE(last_refreshed, created); never-refreshed rows
-        # fall back to created, so it is always populated (drives the keepalive).
-        assert all(last_exercised for _, _, last_exercised in targets)
@@ -1,104 +0,0 @@
-"""Tests for alembic migration 065 (capture Entra oid/tid on oidc_identities).
-
-Drives ``command.upgrade``/``downgrade`` against an isolated SQLite database per
-test (the 060/062/063 harness pattern), then asserts:
-
-* upgrade adds the ``oid``/``tid`` columns and the ``idx_oidc_identities_oid``
-  index;
-* a pre-065 row migrates cleanly, gaining ``""`` for the new columns;
-* downgrade removes the columns + index, returning ``oidc_identities`` to its
-  exact pre-065 shape — this pins the **clean-rollback** guarantee (the change
-  can be backed out with no orphaned state if the upstream PR is rejected).
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import sqlalchemy as sa
-from alembic import command
-from alembic.config import Config
-
-_MIGRATIONS_DIR = str(
-    Path(__file__).resolve().parent.parent / "turnstone" / "core" / "storage" / "migrations"
-)
-
-
-def _alembic_cfg(db_path: Path) -> Config:
-    cfg = Config()
-    cfg.set_main_option("script_location", _MIGRATIONS_DIR)
-    cfg.set_main_option("sqlalchemy.url", f"sqlite:///{db_path}")
-    return cfg
-
-
-class TestMigration065:
-    def test_upgrade_adds_oid_tid_and_index(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "065-up.db"
-        command.upgrade(_alembic_cfg(db_path), "065")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            insp = sa.inspect(engine)
-            cols = {c["name"] for c in insp.get_columns("oidc_identities")}
-            assert {"oid", "tid"} <= cols
-            idx = {i["name"] for i in insp.get_indexes("oidc_identities")}
-            assert "idx_oidc_identities_oid" in idx
-        finally:
-            engine.dispose()
-
-    def test_preexisting_row_migrates_with_empty_default(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "065-default.db"
-        cfg = _alembic_cfg(db_path)
-        # Stop at 064, insert a pre-065 identity, THEN upgrade to 065.
-        command.upgrade(cfg, "064")
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            with engine.begin() as conn:
-                conn.execute(
-                    sa.text(
-                        "INSERT INTO oidc_identities "
-                        "(issuer, subject, user_id, email, created, last_login) "
-                        "VALUES ('iss', 'sub', 'u1', '', "
-                        "'2026-01-01T00:00:00', '2026-01-01T00:00:00')"
-                    )
-                )
-            command.upgrade(cfg, "065")
-            with engine.connect() as conn:
-                row = conn.execute(
-                    sa.text("SELECT oid, tid FROM oidc_identities WHERE subject = 'sub'")
-                ).fetchone()
-            assert row is not None
-            assert row[0] == "" and row[1] == ""
-        finally:
-            engine.dispose()
-
-    def test_downgrade_removes_oid_tid_and_index(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "065-down.db"
-        cfg = _alembic_cfg(db_path)
-        command.upgrade(cfg, "065")
-        command.downgrade(cfg, "064")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            insp = sa.inspect(engine)
-            cols = {c["name"] for c in insp.get_columns("oidc_identities")}
-            assert "oid" not in cols and "tid" not in cols
-            idx = {i["name"] for i in insp.get_indexes("oidc_identities")}
-            assert "idx_oidc_identities_oid" not in idx
-        finally:
-            engine.dispose()
-
-    def test_downgrade_then_upgrade_round_trip(self, tmp_path: Path) -> None:
-        """up -> down -> up must land cleanly (no leftover column/index conflict)."""
-        db_path = tmp_path / "065-roundtrip.db"
-        cfg = _alembic_cfg(db_path)
-        command.upgrade(cfg, "065")
-        command.downgrade(cfg, "064")
-        command.upgrade(cfg, "065")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            cols = {c["name"] for c in sa.inspect(engine).get_columns("oidc_identities")}
-            assert {"oid", "tid"} <= cols
-        finally:
-            engine.dispose()
@@ -1,103 +0,0 @@
-"""Tests for alembic migration 066 (persona + project on scheduled_tasks).
-
-Drives ``command.upgrade``/``downgrade`` against an isolated SQLite database per
-test (the 060/062/063/065 harness pattern), then asserts:
-
-* upgrade adds the ``persona`` and ``project_id`` columns to ``scheduled_tasks``;
-* a pre-066 scheduled task migrates cleanly, gaining ``""`` for both new columns
-  — the empty default that means "kind default persona" / "no project" and
-  preserves byte-identical dispatch behaviour to pre-066;
-* downgrade removes both columns, returning ``scheduled_tasks`` to its exact
-  pre-066 shape — pinning the clean-rollback guarantee;
-* up -> down -> up lands cleanly with no leftover-column conflict.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import sqlalchemy as sa
-from alembic import command
-from alembic.config import Config
-
-_MIGRATIONS_DIR = str(
-    Path(__file__).resolve().parent.parent / "turnstone" / "core" / "storage" / "migrations"
-)
-
-
-def _alembic_cfg(db_path: Path) -> Config:
-    cfg = Config()
-    cfg.set_main_option("script_location", _MIGRATIONS_DIR)
-    cfg.set_main_option("sqlalchemy.url", f"sqlite:///{db_path}")
-    return cfg
-
-
-def _insert_pre066_task(engine: sa.Engine) -> None:
-    with engine.begin() as conn:
-        conn.execute(
-            sa.text(
-                "INSERT INTO scheduled_tasks "
-                "(task_id, name, schedule_type, initial_message, created, updated) "
-                "VALUES ('t1', 'Nightly', 'cron', 'run', "
-                "'2026-01-01T00:00:00', '2026-01-01T00:00:00')"
-            )
-        )
-
-
-class TestMigration066:
-    def test_upgrade_adds_persona_and_project_columns(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "066-up.db"
-        command.upgrade(_alembic_cfg(db_path), "066")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            cols = {c["name"] for c in sa.inspect(engine).get_columns("scheduled_tasks")}
-            assert {"persona", "project_id"} <= cols
-        finally:
-            engine.dispose()
-
-    def test_preexisting_row_migrates_with_empty_default(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "066-default.db"
-        cfg = _alembic_cfg(db_path)
-        # Stop at 065, insert a pre-066 scheduled task, THEN upgrade to 066.
-        command.upgrade(cfg, "065")
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            _insert_pre066_task(engine)
-            command.upgrade(cfg, "066")
-            with engine.connect() as conn:
-                row = conn.execute(
-                    sa.text("SELECT persona, project_id FROM scheduled_tasks WHERE task_id = 't1'")
-                ).fetchone()
-            assert row is not None
-            assert row[0] == "" and row[1] == ""
-        finally:
-            engine.dispose()
-
-    def test_downgrade_removes_persona_and_project_columns(self, tmp_path: Path) -> None:
-        db_path = tmp_path / "066-down.db"
-        cfg = _alembic_cfg(db_path)
-        command.upgrade(cfg, "066")
-        command.downgrade(cfg, "065")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            cols = {c["name"] for c in sa.inspect(engine).get_columns("scheduled_tasks")}
-            assert "persona" not in cols and "project_id" not in cols
-        finally:
-            engine.dispose()
-
-    def test_downgrade_then_upgrade_round_trip(self, tmp_path: Path) -> None:
-        """up -> down -> up must land cleanly (no leftover column conflict)."""
-        db_path = tmp_path / "066-roundtrip.db"
-        cfg = _alembic_cfg(db_path)
-        command.upgrade(cfg, "066")
-        command.downgrade(cfg, "065")
-        command.upgrade(cfg, "066")
-
-        engine = sa.create_engine(f"sqlite:///{db_path}")
-        try:
-            cols = {c["name"] for c in sa.inspect(engine).get_columns("scheduled_tasks")}
-            assert {"persona", "project_id"} <= cols
-        finally:
-            engine.dispose()
@@ -167,43 +167,6 @@ class TestModelRegistry:
        with pytest.raises(ValueError, match="Unknown model alias"):
            reg.get_client("nonexistent")

-    def test_client_construction_failure_is_value_error(self) -> None:
-        # Environment failures inside SDK construction (e.g. httpx raising
-        # FileNotFoundError for a CA bundle deleted by a venv rebuild) must
-        # surface as ValueError so routes answer 503-with-message instead
-        # of an opaque 500.
-        reg = self._make_registry()
-        with (
-            patch(
-                "turnstone.core.model_registry.create_client",
-                side_effect=FileNotFoundError(2, "No such file", "/gone/cacert.pem"),
-            ),
-            pytest.raises(ValueError, match="'default'.*FileNotFoundError") as excinfo,
-        ):
-            reg.get_client("default")
-        assert isinstance(excinfo.value.__cause__, FileNotFoundError)
-        # The message is echoed in 503 bodies: exception TYPE only — the
-        # raw exception text can embed filesystem paths and must stay in
-        # the server log.
-        assert "/gone/cacert.pem" not in str(excinfo.value)
-        assert "No such file" not in str(excinfo.value)
-        # Nothing half-constructed may be cached — a later call with a
-        # repaired environment must construct for real.
-        assert "default" not in reg._clients
-
-    def test_client_construction_value_error_passes_through(self) -> None:
-        # create_client's own misconfig ValueErrors already carry
-        # remediation text and must not be double-wrapped.
-        reg = self._make_registry()
-        with (
-            patch(
-                "turnstone.core.model_registry.create_client",
-                side_effect=ValueError("anthropic-compatible requires base_url"),
-            ),
-            pytest.raises(ValueError, match="^anthropic-compatible requires base_url$"),
-        ):
-            reg.get_client("default")
-
    def test_shutdown(self) -> None:
        reg = self._make_registry()
        reg.get_client("default")
@@ -15,7 +15,6 @@ import pytest

 from turnstone.core.oauth_ssrf import (
    OAuthSSRFError,
-    OAuthSSRFPrivateAddressError,
    effective_port,
    is_localhost,
    validate_discovered_endpoint,
@@ -87,55 +86,6 @@ class TestValidateUrlNoSSRF:
        ):
            validate_url_no_ssrf("https://corp.example.com", allow_http=False)

-    def test_private_address_raises_distinct_subclass(self) -> None:
-        # Callers with an operator opt-in (OIDC) catch the subclass to
-        # append the remediation hint; plain OAuthSSRFError catches still work.
-        with (
-            patch("socket.getaddrinfo", return_value=self._PRIVATE_ADDR),
-            pytest.raises(OAuthSSRFPrivateAddressError),
-        ):
-            validate_url_no_ssrf("https://corp.example.com", allow_http=False)
-
-    def test_allow_private_accepts_rfc1918(self) -> None:
-        with patch("socket.getaddrinfo", return_value=self._PRIVATE_ADDR):
-            parsed = validate_url_no_ssrf(
-                "https://auth.corp.example.com", allow_http=False, allow_private=True
-            )
-        assert parsed.hostname == "auth.corp.example.com"
-
-    def test_allow_private_accepts_cgnat(self) -> None:
-        # 100.64/10 (RFC 6598, shared address space) — e.g. a tailnet-hosted IdP.
-        with patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("100.64.0.7", 0))]):
-            validate_url_no_ssrf("https://idp.tail.example", allow_http=False, allow_private=True)
-
-    def test_allow_private_accepts_loopback_hostname(self) -> None:
-        # A non-localhost hostname resolving to loopback (IdP behind a
-        # local reverse proxy) is operator-trusted under the opt-in.
-        with patch("socket.getaddrinfo", return_value=self._LOOPBACK_ADDR):
-            validate_url_no_ssrf("https://auth.internal", allow_http=False, allow_private=True)
-
-    def test_allow_private_still_rejects_link_local(self) -> None:
-        # Cloud metadata services live on link-local; no legitimate IdP does.
-        with (
-            patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("169.254.169.254", 0))]),
-            pytest.raises(OAuthSSRFError, match="refused even with private"),
-        ):
-            validate_url_no_ssrf("https://md.example.com", allow_http=False, allow_private=True)
-
-    def test_allow_private_still_rejects_unspecified(self) -> None:
-        # The message names the class so 0.0.0.0/:: rejections are unambiguous.
-        with (
-            patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("0.0.0.0", 0))]),
-            pytest.raises(OAuthSSRFError, match="unspecified"),
-        ):
-            validate_url_no_ssrf("https://zero.example.com", allow_http=False, allow_private=True)
-
-    def test_allow_private_does_not_relax_https(self) -> None:
-        with pytest.raises(OAuthSSRFError, match="must use HTTPS"):
-            validate_url_no_ssrf(
-                "http://auth.corp.example.com", allow_http=False, allow_private=True
-            )
-
    def test_rejects_unresolvable(self) -> None:
        import socket

@@ -172,19 +122,6 @@ class TestValidateDiscoveredEndpoint:
                trusted_endpoint_hosts=frozenset(),
            )

-    def test_allow_private_passes_through(self) -> None:
-        # Same-origin endpoint on a private-resolving issuer host is accepted
-        # when the operator opted in.
-        issuer = urllib.parse.urlparse("https://auth.corp.example.com")
-        with patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]):
-            validate_discovered_endpoint(
-                "https://auth.corp.example.com/token",
-                issuer,
-                allow_http=False,
-                trusted_endpoint_hosts=frozenset(),
-                allow_private=True,
-            )
-
    def test_trusted_endpoint_host_passes(self) -> None:
        issuer = urllib.parse.urlparse("https://idp.example.com")
        with patch("socket.getaddrinfo", return_value=self._PUBLIC_ADDR):
@@ -90,42 +90,6 @@ class TestLoadOIDCConfig:
        assert cfg.scopes == "openid"
        assert cfg.provider_name == "Okta"

-    def test_load_oidc_config_allow_private_network_env(self, monkeypatch):
-        monkeypatch.setenv("TURNSTONE_OIDC_ISSUER", "https://auth.internal.example")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_ID", "cid")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_SECRET", "csecret")
-        monkeypatch.setenv("TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK", "true")
-
-        with patch("turnstone.core.config.load_config", return_value={}):
-            cfg = load_oidc_config()
-
-        assert cfg.allow_private_network is True
-
-    def test_load_oidc_config_allow_private_network_toml(self, monkeypatch):
-        monkeypatch.setenv("TURNSTONE_OIDC_ISSUER", "https://auth.internal.example")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_ID", "cid")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_SECRET", "csecret")
-        monkeypatch.delenv("TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK", raising=False)
-
-        with patch(
-            "turnstone.core.config.load_config",
-            return_value={"allow_private_network": True},
-        ):
-            cfg = load_oidc_config()
-
-        assert cfg.allow_private_network is True
-
-    def test_load_oidc_config_allow_private_network_default_off(self, monkeypatch):
-        monkeypatch.setenv("TURNSTONE_OIDC_ISSUER", "https://auth.example.com")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_ID", "cid")
-        monkeypatch.setenv("TURNSTONE_OIDC_CLIENT_SECRET", "csecret")
-        monkeypatch.delenv("TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK", raising=False)
-
-        with patch("turnstone.core.config.load_config", return_value={}):
-            cfg = load_oidc_config()
-
-        assert cfg.allow_private_network is False
-
    def test_load_oidc_config_disabled_when_missing(self, monkeypatch):
        monkeypatch.delenv("TURNSTONE_OIDC_ISSUER", raising=False)
        monkeypatch.delenv("TURNSTONE_OIDC_CLIENT_ID", raising=False)
@@ -381,27 +345,6 @@ class TestValidateIssuerURL:
        ):
            validate_issuer_url("https://idp.example.com")

-    def test_private_address_hint_mentions_opt_in(self):
-        """The rejection message points the operator at allow_private_network."""
-        with (
-            patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]),
-            pytest.raises(OIDCError, match="allow_private_network"),
-        ):
-            validate_issuer_url("https://auth.internal.example")
-
-    def test_allow_private_accepts_private_issuer(self):
-        """The opt-in accepts an issuer resolving to RFC 1918 space."""
-        with patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]):
-            validate_issuer_url("https://auth.internal.example", allow_private=True)
-
-    def test_allow_private_still_rejects_link_local(self):
-        """Link-local (cloud metadata) is refused even with the opt-in."""
-        with (
-            patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("169.254.169.254", 0))]),
-            pytest.raises(OIDCError, match="refused even with private"),
-        ):
-            validate_issuer_url("https://md.internal.example", allow_private=True)
-
    def test_rejects_http_non_localhost(self):
        """HTTP is rejected for non-localhost hosts."""
        with pytest.raises(OIDCError, match="must use HTTPS"):
@@ -565,20 +508,6 @@ class TestValidateDiscoveredEndpoint:
                trusted_endpoint_hosts=frozenset(),
            )

-    def test_private_endpoint_hint_mentions_opt_in(self):
-        """A discovered endpoint resolving private carries the opt-in hint
-        just like the issuer does — the remediation is the same knob."""
-        with (
-            patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]),
-            pytest.raises(OIDCError, match="allow_private_network"),
-        ):
-            validate_discovered_endpoint(
-                "https://idp.example.com/token",
-                self._issuer(),
-                allow_http=False,
-                trusted_endpoint_hosts=frozenset(),
-            )
-
    def test_rejects_http_when_issuer_is_https(self):
        """http:// discovered endpoint rejected when issuer is https://."""
        with (
@@ -1714,65 +1643,6 @@ class TestProvisionOIDCUser:

        storage.assign_role.assert_not_called()

-    def test_provision_oidc_user_null_oid_tid_collapse_to_empty(self):
-        """A present-but-null oid/tid claim must store "" — never the string "None".
-
-        `claims.get("oid", "")` returns None (not the "" default) when the key is
-        present with a JSON null, and str(None) == "None" would slip past both the
-        server_default and the truthy backfill guard, storing a bogus non-empty
-        sentinel that collides across every null-emitting user. New-user path.
-        """
-        config = _make_config()
-        storage = _mock_storage()
-        storage.get_user.return_value = {
-            "user_id": "u-new",
-            "username": "bob",
-            "display_name": "Bob",
-            "password_hash": "!oidc",
-        }
-
-        claims = {"sub": "sub-null", "preferred_username": "bob", "oid": None, "tid": None}
-        with patch("turnstone.core.oidc.uuid") as mock_uuid:
-            mock_uuid.uuid4.return_value = MagicMock(hex="u-new-hex-00000000000000000000")
-            provision_oidc_user(storage, config, claims)
-
-        kwargs = storage.create_oidc_user.call_args.kwargs
-        assert kwargs["oid"] == ""
-        assert kwargs["tid"] == ""
-
-    def test_provision_oidc_user_null_oid_tid_not_backfilled_existing(self):
-        """Existing-identity path: null oid/tid claims must not backfill "None".
-
-        The truthy guard in update_oidc_identity_login only protects against ""; a
-        "None" produced by str(None) is truthy and would be written, clobbering a
-        real value captured on an earlier login.
-        """
-        config = _make_config()
-        existing_user = {
-            "user_id": "u1",
-            "username": "alice",
-            "display_name": "Alice",
-            "password_hash": "!oidc",
-        }
-        existing_identity = {
-            "issuer": "https://idp.example.com",
-            "subject": "sub-123",
-            "user_id": "u1",
-            "email": "alice@example.com",
-            "created": "2024-01-01T00:00:00",
-            "last_login": "2024-01-01T00:00:00",
-            "oid": "obj-real",
-            "tid": "ten-real",
-        }
-        storage = _mock_storage(identity=existing_identity, user=existing_user)
-
-        claims = {"sub": "sub-123", "email": "alice@example.com", "oid": None, "tid": None}
-        provision_oidc_user(storage, config, claims)
-
-        kwargs = storage.update_oidc_identity_login.call_args.kwargs
-        assert kwargs["oid"] == ""
-        assert kwargs["tid"] == ""
-
    def test_existing_identity_self_heals_zero_roles(self):
        """Existing identity user with zero roles -> safety-net assigns builtin-viewer.

@@ -2237,58 +2107,6 @@ class TestDiscoverOIDC:

        asyncio.run(_run())

-    def test_discover_oidc_private_issuer_rejected_by_default(self):
-        """Without the opt-in, a private-resolving issuer disables OIDC."""
-        config = _make_config(
-            issuer="https://auth.internal.example",
-            authorization_endpoint="",
-            token_endpoint="",
-            userinfo_endpoint="",
-            jwks_uri="",
-        )
-
-        async def _run():
-            with patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]):
-                result = await discover_oidc(config)
-            assert result.enabled is False
-
-        asyncio.run(_run())
-
-    def test_discover_oidc_private_issuer_with_opt_in(self):
-        """allow_private_network=True lets a private-resolving IdP discover."""
-        config = _make_config(
-            issuer="https://auth.internal.example",
-            allow_private_network=True,
-            authorization_endpoint="",
-            token_endpoint="",
-            userinfo_endpoint="",
-            jwks_uri="",
-        )
-
-        discovery_doc = {
-            "authorization_endpoint": "https://auth.internal.example/authorize",
-            "token_endpoint": "https://auth.internal.example/token",
-            "userinfo_endpoint": "https://auth.internal.example/userinfo",
-            "jwks_uri": "https://auth.internal.example/jwks",
-        }
-
-        mock_response = MagicMock()
-        mock_response.json.return_value = discovery_doc
-        mock_response.raise_for_status = MagicMock()
-
-        async def _run():
-            client = _mock_async_client(lambda url: _async_return(mock_response))
-            with (
-                patch("socket.getaddrinfo", return_value=[(2, 1, 6, "", ("10.0.0.5", 0))]),
-                patch("httpx.AsyncClient", return_value=client),
-            ):
-                result = await discover_oidc(config)
-
-            assert result.enabled is True
-            assert result.token_endpoint == "https://auth.internal.example/token"
-
-        asyncio.run(_run())
-
    def test_discover_oidc_failure(self):
        """Mock httpx error -> enabled=False returned."""
        config = _make_config(
@@ -84,40 +84,6 @@ class TestCreateOIDCUser:
        assert identity is not None
        assert identity["user_id"] == "u-other"

-    def test_create_oidc_user_captures_oid_tid(self, db):
-        """Entra oid/tid are persisted and returned on the identity."""
-        db.create_oidc_user(
-            user_id="u-oid",
-            username="carol",
-            display_name="Carol",
-            password_hash="!oidc",
-            issuer="https://idp.example.com",
-            subject="sub-oid",
-            email="carol@example.com",
-            oid="obj-123",
-            tid="tenant-abc",
-        )
-        identity = db.get_oidc_identity("https://idp.example.com", "sub-oid")
-        assert identity is not None
-        assert identity["oid"] == "obj-123"
-        assert identity["tid"] == "tenant-abc"
-
-    def test_create_oidc_user_oid_tid_default_empty(self, db):
-        """Omitting oid/tid (non-Entra IdP) stores "" — never NULL."""
-        db.create_oidc_user(
-            user_id="u-noid",
-            username="dave",
-            display_name="Dave",
-            password_hash="!oidc",
-            issuer="https://idp.example.com",
-            subject="sub-noid",
-            email="dave@example.com",
-        )
-        identity = db.get_oidc_identity("https://idp.example.com", "sub-noid")
-        assert identity is not None
-        assert identity["oid"] == ""
-        assert identity["tid"] == ""
-

 # ---------------------------------------------------------------------------
 # OIDC Identity CRUD
@@ -171,33 +137,6 @@ class TestOIDCIdentityCRUD:
        result = db.update_oidc_identity_login("https://idp.example.com", "sub-999")
        assert result is False

-    def test_update_oidc_identity_login_backfills_oid_tid(self, db):
-        """A login carrying oid/tid backfills them onto a pre-existing row."""
-        db.create_oidc_identity("https://idp.example.com", "sub-bf", "u1", "a@example.com")
-        before = db.get_oidc_identity("https://idp.example.com", "sub-bf")
-        assert before is not None and before["oid"] == ""
-
-        db.update_oidc_identity_login("https://idp.example.com", "sub-bf", oid="obj-9", tid="ten-9")
-
-        after = db.get_oidc_identity("https://idp.example.com", "sub-bf")
-        assert after is not None
-        assert after["oid"] == "obj-9"
-        assert after["tid"] == "ten-9"
-
-    def test_update_oidc_identity_login_omitted_does_not_clobber_oid_tid(self, db):
-        """A later login WITHOUT oid/tid must not wipe previously-captured values."""
-        db.create_oidc_identity("https://idp.example.com", "sub-keep", "u1", "a@example.com")
-        db.update_oidc_identity_login(
-            "https://idp.example.com", "sub-keep", oid="obj-keep", tid="ten-keep"
-        )
-        # Simulate a subsequent login where the token omitted oid/tid.
-        db.update_oidc_identity_login("https://idp.example.com", "sub-keep")
-
-        identity = db.get_oidc_identity("https://idp.example.com", "sub-keep")
-        assert identity is not None
-        assert identity["oid"] == "obj-keep"
-        assert identity["tid"] == "ten-keep"
-
    def test_list_oidc_identities_for_user(self, db):
        """Two identities for same user, list returns both."""
        db.create_oidc_identity("https://idp1.example.com", "sub-A", "u1", "alice@idp1.com")
@@ -1,815 +0,0 @@
-"""End-to-end coverage for the ``open_preview`` tool wiring.
-
-Spans the seams the preview descriptor rides: preparer validation +
-approval posture, executor target resolution (mocked ``httpx`` for URLs,
-tmp files for paths, monkeypatched storage for attachments), the
-``_tool_previews`` side channel + live SSE event, the ``Turn.meta``
-round-trip, the ``/history`` projection, the storage reconstruct routing,
-and the auth scope of the serving route.
-"""
-
-from __future__ import annotations
-
-from types import SimpleNamespace
-from unittest.mock import MagicMock
-
-from turnstone.core.session import ChatSession
-from turnstone.core.trajectory import Role, turn_from_dict, turn_to_dict
-
-PNG_1x1 = (
-    b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
-    b"\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\rIDATx\x9cc\xfc\xcf"
-    b"\xc0\xc0\xc0\x00\x00\x00\x05\x00\x01\xa5\xf6E@\x00\x00\x00\x00IEND\xaeB`\x82"
-)
-
-
-class _RecordingUI:
-    """SessionUI double that records tool_result calls (kwargs included)."""
-
-    def __init__(self):
-        self.tool_results = []
-
-    def __getattr__(self, name):
-        # Every other SessionUI hook is an inert no-op.
-        def _noop(*args, **kwargs):
-            return None
-
-        return _noop
-
-    def on_tool_result(self, call_id, name, output, **kwargs):
-        self.tool_results.append((call_id, name, output, kwargs))
-
-
-def _make_session(**kwargs):
-    defaults = dict(
-        client=MagicMock(),
-        model="test-model",
-        ui=_RecordingUI(),
-        instructions=None,
-        temperature=0.5,
-        max_tokens=4096,
-        tool_timeout=5,
-    )
-    defaults.update(kwargs)
-    return ChatSession(**defaults)
-
-
-def _fake_response(url, body, content_type):
-    import httpx
-
-    resp = SimpleNamespace()
-    # A real httpx.URL so the executor's userinfo-strip path runs unmocked.
-    resp.url = httpx.URL(url)
-    resp.content = body
-    resp.text = body.decode("utf-8", errors="replace")
-    resp.headers = {"content-type": content_type}
-    resp.raise_for_status = lambda: None
-    return resp
-
-
-# ---------------------------------------------------------------------------
-# Preparer
-# ---------------------------------------------------------------------------
-
-
-class TestPrepareOpenPreview:
-    def test_missing_target_errors(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {})
-        assert item["error"].startswith("Error: missing target")
-
-    def test_invalid_kind_errors(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "a.txt", "kind": "hologram"})
-        assert "kind must be one of" in item["error"]
-
-    def test_url_target_needs_approval(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "https://example.com/x"})
-        assert item["needs_approval"] is True
-        assert item["target_kind"] == "url"
-        assert item["approval_label"] == "open_preview"
-        assert "error" not in item
-
-    def test_private_url_blocked_pre_approval(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "http://169.254.169.254/meta"})
-        assert "error" in item
-        assert item["needs_approval"] is False
-
-    def test_path_target_runs_unprompted(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "~/notes.md"})
-        assert item["needs_approval"] is False
-        assert item["target_kind"] == "path"
-        assert not item["path"].startswith("~")
-
-    def test_attachment_target(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "attachment:abc123"})
-        assert item["needs_approval"] is False
-        assert item["target_kind"] == "attachment"
-        assert item["attachment_id"] == "abc123"
-        empty = s._prepare_open_preview("c1", {"target": "attachment:"})
-        assert "error" in empty
-
-
-# ---------------------------------------------------------------------------
-# Executor
-# ---------------------------------------------------------------------------
-
-
-class TestExecOpenPreview:
-    def test_url_html_builds_web_descriptor(self, monkeypatch):
-        s = _make_session()
-        body = b"<html><head><title>Acme Pricing</title></head><body>x</body></html>"
-        monkeypatch.setattr(
-            "turnstone.core.session.fetch_with_ssrf_guard",
-            lambda url, **kw: _fake_response(url, body, "text/html; charset=utf-8"),
-        )
-        item = s._prepare_open_preview("c1", {"target": "https://acme.com/pricing"})
-        call_id, msg = s._exec_open_preview(item)
-        assert call_id == "c1"
-        assert "Acme Pricing" in msg
-        descriptor, att = s._tool_previews["c1"]
-        assert descriptor["kind"] == "web"
-        assert descriptor["title"] == "Acme Pricing"
-        assert descriptor["source"] == "https://acme.com/pricing"
-        assert descriptor["content_type"].startswith("text/html")
-        assert att.kind == "preview"
-        # The stored bytes gained a base for relative-asset resolution.
-        assert b'<base href="https://acme.com/pricing">' in att.content
-        # The live event carried the descriptor.
-        results = s.ui.tool_results
-        assert results and results[-1][3].get("preview") == descriptor
-
-    def test_url_userinfo_stripped_from_descriptor(self, monkeypatch):
-        s = _make_session()
-        body = b"<html><head></head><body>x</body></html>"
-        monkeypatch.setattr(
-            "turnstone.core.session.fetch_with_ssrf_guard",
-            lambda url, **kw: _fake_response(url, body, "text/html"),
-        )
-        item = s._prepare_open_preview("c1", {"target": "https://user:sekret@acme.com/page"})
-        s._exec_open_preview(item)
-        descriptor, att = s._tool_previews["c1"]
-        assert "sekret" not in descriptor["source"]
-        assert "sekret" not in descriptor["title"]
-        assert b"sekret" not in att.content  # the injected <base href>
-
-    def test_redirect_into_private_space_blocked(self, monkeypatch):
-        s = _make_session()
-
-        # The guarded fetch raises BEFORE requesting a private hop — the
-        # executor's ValueError lane turns that into a tool error.
-        def _blocked(url, **kw):
-            raise ValueError("Blocked: URL resolves to private/internal address (169.254.169.254)")
-
-        monkeypatch.setattr("turnstone.core.session.fetch_with_ssrf_guard", _blocked)
-        item = s._prepare_open_preview("c1", {"target": "https://innocent.example/"})
-        _, msg = s._exec_open_preview(item)
-        assert msg.startswith("Error: fetch failed: Blocked")
-        assert "c1" not in s._tool_previews
-
-    def test_oversized_web_content_errors(self, monkeypatch):
-        s = _make_session()
-        big = b"<html>" + b"x" * (4 * 1024 * 1024 + 16) + b"</html>"
-        monkeypatch.setattr(
-            "turnstone.core.session.fetch_with_ssrf_guard",
-            lambda url, **kw: _fake_response(url, big, "text/html"),
-        )
-        item = s._prepare_open_preview("c1", {"target": "https://example.com/big"})
-        _, msg = s._exec_open_preview(item)
-        assert msg.startswith("Error:")
-        assert "too large" in msg
-
-    def test_url_pdf_over_10mb_previews_to_kind_cap(self, monkeypatch):
-        # Review finding (PR #800): a flat 10 MB URL pre-check rejected PDFs
-        # the 32 MiB pdf kind cap allows — the fetch ceiling must track the
-        # widest kind cap and leave the per-kind caps as the authority.
-        from turnstone.core.preview import PREVIEW_SIZE_CAPS
-
-        s = _make_session()
-        body = b"%PDF-1.7\n" + b"a" * (12 * 1024 * 1024)
-        seen = {}
-
-        def _capture(url, **kw):
-            seen.update(kw)
-            return _fake_response(url, body, "application/pdf")
-
-        monkeypatch.setattr("turnstone.core.session.fetch_with_ssrf_guard", _capture)
-        item = s._prepare_open_preview("c1", {"target": "https://acme.com/report.pdf"})
-        _, msg = s._exec_open_preview(item)
-        assert not msg.startswith("Error:")
-        descriptor, _ = s._tool_previews["c1"]
-        assert descriptor["kind"] == "pdf"
-        assert descriptor["size"] == len(body)
-        assert seen["max_bytes"] == max(PREVIEW_SIZE_CAPS.values())
-
-    def test_path_image(self, tmp_path):
-        s = _make_session()
-        p = tmp_path / "chart.png"
-        p.write_bytes(PNG_1x1)
-        item = s._prepare_open_preview("c1", {"target": str(p)})
-        _, msg = s._exec_open_preview(item)
-        assert not msg.startswith("Error:")
-        descriptor, att = s._tool_previews["c1"]
-        assert descriptor["kind"] == "image"
-        assert descriptor["content_type"] == "image/png"
-        assert descriptor["title"] == "chart.png"
-        assert att.content == PNG_1x1
-
-    def test_preview_blob_id_salted_out_of_upload_namespace(self, tmp_path):
-        import hashlib
-
-        s = _make_session()
-        p = tmp_path / "chart.png"
-        p.write_bytes(PNG_1x1)
-        item = s._prepare_open_preview("c1", {"target": str(p)})
-        s._exec_open_preview(item)
-        _, att = s._tool_previews["c1"]
-        # Uploads are keyed bare sha256(body) and save_attachment freezes
-        # `kind` at first insert — an unsalted preview of identical bytes
-        # would collide with (or pre-empt) a real upload's row.
-        assert att.attachment_id != hashlib.sha256(PNG_1x1).hexdigest()
-        assert att.attachment_id == hashlib.sha256(b"preview:" + PNG_1x1).hexdigest()
-
-    def test_path_csv_is_table(self, tmp_path):
-        s = _make_session()
-        p = tmp_path / "results.csv"
-        p.write_text("name,score\na,1\nb,2\n")
-        item = s._prepare_open_preview("c1", {"target": str(p)})
-        s._exec_open_preview(item)
-        descriptor, _ = s._tool_previews["c1"]
-        assert descriptor["kind"] == "table"
-        assert descriptor["content_type"].startswith("text/csv")
-
-    def test_path_missing_errors(self):
-        s = _make_session()
-        item = s._prepare_open_preview("c1", {"target": "/nonexistent/nowhere.txt"})
-        _, msg = s._exec_open_preview(item)
-        assert msg.startswith("Error: file not found")
-
-    def test_path_binary_unpreviewable(self, tmp_path):
-        s = _make_session()
-        p = tmp_path / "blob.bin"
-        p.write_bytes(b"\x00\x01\x02\x03" * 64)
-        item = s._prepare_open_preview("c1", {"target": str(p)})
-        _, msg = s._exec_open_preview(item)
-        assert "not previewable" in msg
-
-    def test_attachment_target_requires_ws_reference(self, monkeypatch):
-        s = _make_session(ws_id="ws-1")
-        monkeypatch.setattr(
-            "turnstone.core.memory.get_attachment",
-            lambda aid: {"content": b"# doc", "mime_type": "text/markdown", "filename": "d.md"},
-        )
-        monkeypatch.setattr(
-            "turnstone.core.memory.attachment_referenced_in_ws",
-            lambda aid, ws: False,
-        )
-        item = s._prepare_open_preview("c1", {"target": "attachment:deadbeef"})
-        _, msg = s._exec_open_preview(item)
-        assert msg.startswith("Error: attachment not found")
-
-    def test_attachment_target_happy_path(self, monkeypatch):
-        s = _make_session(ws_id="ws-1")
-        monkeypatch.setattr(
-            "turnstone.core.memory.get_attachment",
-            lambda aid: {"content": b"# doc", "mime_type": "text/markdown", "filename": "d.md"},
-        )
-        monkeypatch.setattr(
-            "turnstone.core.memory.attachment_referenced_in_ws",
-            lambda aid, ws: True,
-        )
-        item = s._prepare_open_preview("c1", {"target": "attachment:deadbeef"})
-        _, msg = s._exec_open_preview(item)
-        assert not msg.startswith("Error:")
-        descriptor, _ = s._tool_previews["c1"]
-        assert descriptor["kind"] == "markdown"
-        assert descriptor["title"] == "d.md"
-
-    def test_legacy_charset_table_stored_as_utf8(self, monkeypatch):
-        # A latin-1 CSV attachment previews as a table, and the executor
-        # transcodes it to UTF-8 at store time so "café" round-trips instead of
-        # erroring "not previewable".
-        s = _make_session(ws_id="ws-1")
-        latin1_csv = "name,city\nRené,Montréal\n".encode("iso-8859-1")
-        monkeypatch.setattr(
-            "turnstone.core.memory.get_attachment",
-            lambda aid: {
-                "content": latin1_csv,
-                "mime_type": "text/csv; charset=iso-8859-1",
-                "filename": "people.csv",
-            },
-        )
-        monkeypatch.setattr(
-            "turnstone.core.memory.attachment_referenced_in_ws",
-            lambda aid, ws: True,
-        )
-        item = s._prepare_open_preview("c1", {"target": "attachment:deadbeef"})
-        _, msg = s._exec_open_preview(item)
-        assert not msg.startswith("Error:")
-        descriptor, att = s._tool_previews["c1"]
-        assert descriptor["kind"] == "table"
-        assert descriptor["content_type"].startswith("text/csv")
-        # Stored bytes are valid UTF-8 with the accented characters preserved.
-        assert att.content.decode("utf-8") == "name,city\nRené,Montréal\n"
-
-    def test_title_override_wins(self, tmp_path):
-        s = _make_session()
-        p = tmp_path / "x.csv"
-        p.write_text("a,b\n")
-        item = s._prepare_open_preview("c1", {"target": str(p), "title": "Q3 numbers"})
-        s._exec_open_preview(item)
-        descriptor, _ = s._tool_previews["c1"]
-        assert descriptor["title"] == "Q3 numbers"
-
-
-# ---------------------------------------------------------------------------
-# Trajectory / history / storage seams
-# ---------------------------------------------------------------------------
-
-
-class TestDescriptorSeams:
-    DESCRIPTOR = {
-        "kind": "web",
-        "title": "T",
-        "source": "https://a.io",
-        "attachment_id": "abc",
-        "content_type": "text/html; charset=utf-8",
-        "size": 7,
-    }
-
-    def test_turn_roundtrip(self):
-        turn = turn_from_dict(
-            {
-                "role": "tool",
-                "tool_call_id": "c1",
-                "content": "Preview shown",
-                "_preview": self.DESCRIPTOR,
-            }
-        )
-        assert turn.meta.extra["preview"] == self.DESCRIPTOR
-        out = turn_to_dict(turn)
-        assert out["_preview"] == self.DESCRIPTOR
-
-    def test_history_projection_carries_preview(self):
-        from turnstone.core.history_decoration import project_history_messages
-
-        msgs = [
-            {
-                "role": "assistant",
-                "content": "",
-                "tool_calls": [
-                    {"id": "c1", "function": {"name": "open_preview", "arguments": "{}"}}
-                ],
-            },
-            {
-                "role": "tool",
-                "tool_call_id": "c1",
-                "content": "Preview shown to the user: T (web, 7 bytes)",
-                "_preview": self.DESCRIPTOR,
-            },
-        ]
-        history = project_history_messages(msgs)
-        tool_entries = [h for h in history if h.get("role") == "tool"]
-        assert tool_entries and tool_entries[0]["preview"] == self.DESCRIPTOR
-
-    def test_reconstruct_routes_tool_preview_meta(self):
-        import json
-
-        from turnstone.core.storage._utils import reconstruct_turns
-
-        # Row layout per reconstruct_turns' unpack: (row_id, role, content,
-        # tool_name, tool_call_id, provider_data, tool_calls_json, source,
-        # event_id, is_error, meta).
-        row = (
-            1,
-            "tool",
-            "ok",
-            "open_preview",
-            "c1",
-            None,
-            None,
-            None,
-            7,
-            0,
-            json.dumps({"effect_status": "unknown", "preview": self.DESCRIPTOR}),
-        )
-        turns = reconstruct_turns([row], "ws-1", attachments_by_msg={})
-        assert turns[0].role is Role.TOOL
-        assert turns[0].meta.extra["preview"] == self.DESCRIPTOR
-        assert turns[0].meta.extra["effect_status"] == "unknown"
-
-    def test_reconstruct_skips_preview_blob_refs(self):
-        """A preview blob on a tool row's ref-list must NOT become a content
-        block — it is meta-addressed frontend content, and a content block
-        would be materialized onto the wire on reload."""
-        from turnstone.core.storage._utils import reconstruct_turns
-
-        row = (
-            1,
-            "tool",
-            "ok",
-            "open_preview",
-            "c1",
-            None,
-            None,
-            None,
-            None,
-            0,
-            None,
-        )
-        atts = {
-            1: [
-                {
-                    "attachment_id": "abc",
-                    "kind": "preview",
-                    "filename": "preview-web",
-                    "mime_type": "text/html; charset=utf-8",
-                    "size_bytes": 7,
-                },
-                {
-                    "attachment_id": "img1",
-                    "kind": "image",
-                    "filename": "shot.png",
-                    "mime_type": "image/png",
-                    "size_bytes": 9,
-                },
-            ]
-        }
-        turns = reconstruct_turns([row], "ws-1", attachments_by_msg=atts)
-        kinds = [b.kind for b in turns[0].content if b.__class__.__name__ == "AttachmentRef"]
-        # The vision lane still reconstructs; the preview blob does not.
-        assert kinds == ["image"]
-
-    def test_preview_route_scope_is_read(self):
-        from turnstone.core.auth import required_scope
-
-        assert required_scope("GET", "/v1/api/workstreams/ws1/attachments/abc/preview") == "read"
-        assert (
-            required_scope("GET", "/node/n1/v1/api/workstreams/ws1/attachments/abc/preview")
-            == "read"
-        )
-
-
-# ---------------------------------------------------------------------------
-# fetch_with_ssrf_guard — per-hop redirect screening (core/web.py)
-# ---------------------------------------------------------------------------
-
-
-class _FakeHop:
-    """client.stream() double: a context manager yielding chunked body bytes."""
-
-    def __init__(self, status, headers=None, body=b""):
-        self.status_code = status
-        self.headers = headers or {}
-        self._chunks = body if isinstance(body, list) else [body]
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, *a):
-        return False
-
-    def iter_bytes(self):
-        yield from self._chunks
-
-
-class _FakeClient:
-    """httpx.Client double: serves a scripted {url: response} table."""
-
-    calls: list[str] = []
-    table: dict[str, _FakeHop] = {}
-
-    def __init__(self, **kwargs):
-        pass
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, *a):
-        return False
-
-    def stream(self, method, url):
-        _FakeClient.calls.append(url)
-        return _FakeClient.table[url]
-
-
-class TestFetchWithSsrfGuard:
-    def _wire(self, monkeypatch, table):
-        _FakeClient.calls = []
-        _FakeClient.table = table
-        monkeypatch.setattr("turnstone.core.web.httpx.Client", _FakeClient)
-
-    def test_follows_public_redirect_chain(self, monkeypatch):
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {
-                "https://a.example/": _FakeHop(302, {"location": "https://b.example/x"}),
-                "https://b.example/x": _FakeHop(200, {}, body=b"landed"),
-            },
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        resp = fetch_with_ssrf_guard("https://a.example/", timeout=5)
-        assert resp.status_code == 200
-        assert _FakeClient.calls == ["https://a.example/", "https://b.example/x"]
-
-    def test_private_hop_blocked_before_request(self, monkeypatch):
-        import pytest
-
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {
-                "https://a.example/": _FakeHop(302, {"location": "http://169.254.169.254/latest"}),
-            },
-        )
-        blocked = {"http://169.254.169.254/latest": "Blocked: private"}
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: blocked.get(url))
-        with pytest.raises(ValueError, match="Blocked: private"):
-            fetch_with_ssrf_guard("https://a.example/", timeout=5)
-        # The load-bearing assertion: the private hop was NEVER requested.
-        assert _FakeClient.calls == ["https://a.example/"]
-
-    def test_relative_location_resolves_against_current(self, monkeypatch):
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {
-                "https://a.example/start": _FakeHop(301, {"location": "/moved"}),
-                "https://a.example/moved": _FakeHop(200, {}),
-            },
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        resp = fetch_with_ssrf_guard("https://a.example/start", timeout=5)
-        assert resp.status_code == 200
-        # The realized response carries the FINAL hop's URL — open_preview's
-        # descriptor source and stored <base href> both key off it.
-        assert str(resp.url) == "https://a.example/moved"
-
-    def test_redirect_loop_capped(self, monkeypatch):
-        import pytest
-
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {"https://a.example/": _FakeHop(302, {"location": "https://a.example/"})},
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        with pytest.raises(ValueError, match="redirects"):
-            fetch_with_ssrf_guard("https://a.example/", timeout=5)
-
-    def test_body_over_budget_aborts(self, monkeypatch):
-        import pytest
-
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {"https://a.example/": _FakeHop(200, {}, body=[b"aaaa", b"bbbb", b"cccc"])},
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        with pytest.raises(ValueError, match="fetch limit"):
-            fetch_with_ssrf_guard("https://a.example/", timeout=5, max_bytes=10)
-
-    def test_redirect_hop_body_never_read(self, monkeypatch):
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        class _BodyBomb(_FakeHop):
-            def iter_bytes(self):
-                raise AssertionError("redirect hop body must not be read")
-
-        self._wire(
-            monkeypatch,
-            {
-                "https://a.example/": _BodyBomb(302, {"location": "https://b.example/x"}),
-                "https://b.example/x": _FakeHop(200, {}, body=b"ok"),
-            },
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        resp = fetch_with_ssrf_guard("https://a.example/", timeout=5)
-        assert resp.status_code == 200
-        assert resp.content == b"ok"
-
-    def test_stale_framing_headers_dropped(self, monkeypatch):
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        self._wire(
-            monkeypatch,
-            {
-                "https://a.example/": _FakeHop(
-                    200,
-                    {
-                        "content-encoding": "gzip",
-                        "content-length": "999",
-                        "content-type": "text/html; charset=utf-8",
-                    },
-                    body=b"<html>hi</html>",
-                )
-            },
-        )
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", lambda url: None)
-        resp = fetch_with_ssrf_guard("https://a.example/", timeout=5)
-        # iter_bytes() hands the guard content-DECODED bytes — a surviving
-        # content-encoding would make .text try to gunzip plain text, and the
-        # upstream content-length no longer describes the body carried.
-        assert "content-encoding" not in resp.headers
-        assert resp.headers.get("content-length") != "999"
-        assert resp.headers.get("content-type") == "text/html; charset=utf-8"
-        assert resp.text == "<html>hi</html>"
-
-
-# ---------------------------------------------------------------------------
-# Cancelled-batch synthesis — a staged preview whose descriptor already
-# reached the frontend must commit, not vanish (session.py review fix)
-# ---------------------------------------------------------------------------
-
-
-class TestCancelledBatchPreservesPreview:
-    def test_synthesize_commits_staged_preview(self, monkeypatch):
-        import json as _json
-
-        from turnstone.core.attachments import Attachment
-        from turnstone.core.trajectory import Turn
-
-        s = _make_session(ws_id="ws-1")
-        descriptor = {
-            "kind": "web",
-            "title": "T",
-            "source": "https://a.io",
-            "attachment_id": "abc",
-            "content_type": "text/html; charset=utf-8",
-            "size": 7,
-        }
-        att = Attachment(
-            attachment_id="abc",
-            filename="preview-web",
-            mime_type="text/html; charset=utf-8",
-            kind="preview",
-            content=b"<p>x</p>",
-        )
-        s._tool_previews["c1"] = (descriptor, att)
-        # Assistant turn with one UNANSWERED call — the cancel shape.
-        s.messages.append(
-            turn_from_dict(
-                {
-                    "role": "assistant",
-                    "content": "",
-                    "tool_calls": [
-                        {
-                            "id": "c1",
-                            "type": "function",
-                            "function": {"name": "open_preview", "arguments": "{}"},
-                        }
-                    ],
-                }
-            )
-        )
-        s._msg_tokens.append(1)
-
-        saved = {}
-        monkeypatch.setattr(
-            "turnstone.core.session.save_message",
-            lambda ws, role, content, name, **kw: (
-                saved.update({"meta": kw.get("meta"), "row": 42}) or 42
-            ),
-        )
-        persisted = {}
-        monkeypatch.setattr(
-            ChatSession,
-            "_persist_attachment_refs",
-            lambda self, row_id, atts, origin="upload": persisted.update(
-                {"row": row_id, "ids": [a.attachment_id for a in atts], "origin": origin}
-            ),
-        )
-
-        s._synthesize_cancelled_results("Cancelled by user.")
-
-        # Side channel drained; descriptor + blob committed with the turn.
-        assert "c1" not in s._tool_previews
-        meta = _json.loads(saved["meta"])
-        assert meta["preview"] == descriptor
-        assert meta["effect_status"] == "unknown"
-        assert persisted == {"row": 42, "ids": ["abc"], "origin": "tool"}
-        # The in-memory synthesized turn carries the descriptor too.
-        tool_turns = [t for t in s.messages if isinstance(t, Turn) and t.role is Role.TOOL]
-        assert tool_turns and tool_turns[-1].meta.extra.get("preview") == descriptor
-
-
-# ---------------------------------------------------------------------------
-# tools.allow_private_network — the self-hoster opt-in (admin Settings → Tools)
-# ---------------------------------------------------------------------------
-
-
-class TestAllowPrivateNetwork:
-    def test_screen_public_url_passes(self):
-        from turnstone.core.session import _screen_tool_url
-
-        err, private = _screen_tool_url("https://example.com/x", False)
-        assert err is None and private is False
-
-    def test_screen_private_blocked_with_discoverable_hint(self):
-        from turnstone.core.session import _screen_tool_url
-
-        err, private = _screen_tool_url("http://10.0.0.7/grafana", False)
-        assert err is not None and private is False
-        # The refusal teaches the knob (mirrors the oidc opt-in hint pattern).
-        assert "tools.allow_private_network" in err
-        assert "Settings" in err
-
-    def test_screen_private_allowed_when_opted_in(self):
-        from turnstone.core.session import _screen_tool_url
-
-        err, private = _screen_tool_url("http://10.0.0.7/grafana", True)
-        assert err is None and private is True
-
-    def test_screen_invalid_url_never_hints(self):
-        from turnstone.core.session import _screen_tool_url
-
-        err, private = _screen_tool_url("http://", True)
-        assert err is not None and private is False
-        assert "allow_private_network" not in err
-
-    def test_bare_session_defaults_strict(self):
-        # No ConfigStore (CLI / eval surface) → no admin opted in → strict.
-        s = _make_session()
-        assert s._allow_private_network() is False
-
-    def test_prepare_web_fetch_private_opted_in(self, monkeypatch):
-        s = _make_session()
-        monkeypatch.setattr(ChatSession, "_allow_private_network", lambda self: True)
-        item = s._prepare_web_fetch(
-            "c1", {"url": "http://192.168.1.50:3000/d/home", "question": "what is shown?"}
-        )
-        assert "error" not in item
-        assert item["needs_approval"] is True  # the human gate stays
-        assert "(private network)" in item["header"]
-        assert item["allow_private_origin"] is True
-
-    def test_prepare_open_preview_private_opted_in(self, monkeypatch):
-        s = _make_session()
-        monkeypatch.setattr(ChatSession, "_allow_private_network", lambda self: True)
-        item = s._prepare_open_preview("c1", {"target": "http://192.168.1.50:3000/d/home"})
-        assert "error" not in item
-        assert item["needs_approval"] is True
-        assert "(private network)" in item["header"]
-        assert item["allow_private_origin"] is True
-
-    def test_prepare_private_still_blocked_by_default(self, monkeypatch):
-        s = _make_session()
-        monkeypatch.setattr(ChatSession, "_allow_private_network", lambda self: False)
-        for prepare, args in (
-            (s._prepare_web_fetch, {"url": "http://10.0.0.7/x", "question": "q"}),
-            (s._prepare_open_preview, {"target": "http://10.0.0.7/x"}),
-        ):
-            item = prepare("c1", args)
-            assert "error" in item
-            assert "tools.allow_private_network" in item["error"]
-
-    def test_executor_passes_private_origin_to_guard(self, monkeypatch):
-        s = _make_session()
-        monkeypatch.setattr(ChatSession, "_allow_private_network", lambda self: True)
-        seen = {}
-
-        def _capture(url, **kw):
-            seen.update(kw, url=url)
-            return _fake_response(url, b"<html><head></head><body>x</body></html>", "text/html")
-
-        monkeypatch.setattr("turnstone.core.session.fetch_with_ssrf_guard", _capture)
-        item = s._prepare_open_preview("c1", {"target": "http://10.0.0.7/status"})
-        s._exec_open_preview(item)
-        assert seen["allow_private_origin"] is True
-
-    def test_guard_skips_hop_screen_for_private_origin(self, monkeypatch):
-        from turnstone.core.web import fetch_with_ssrf_guard
-
-        _FakeClient.calls = []
-        _FakeClient.table = {
-            "http://10.0.0.7/a": _FakeHop(302, {"location": "http://10.0.0.8/b"}),
-            "http://10.0.0.8/b": _FakeHop(200, {}),
-        }
-        monkeypatch.setattr("turnstone.core.web.httpx.Client", _FakeClient)
-
-        def _explode(url):
-            raise AssertionError("hop screening must be skipped for a private origin")
-
-        monkeypatch.setattr("turnstone.core.web.check_ssrf", _explode)
-        resp = fetch_with_ssrf_guard("http://10.0.0.7/a", timeout=5, allow_private_origin=True)
-        assert resp.status_code == 200
-        assert _FakeClient.calls == ["http://10.0.0.7/a", "http://10.0.0.8/b"]
-
-    def test_registry_entry_shape(self):
-        from turnstone.core.settings_registry import SETTINGS
-
-        d = SETTINGS["tools.allow_private_network"]
-        assert d.type == "bool"
-        assert d.default is False
-        assert d.section == "tools"
-        assert d.help  # the admin form renders this — it must explain the caveat
@@ -8,7 +8,6 @@ capability-gated emission in ``ChatSession._init_system_messages``.

 from __future__ import annotations

-import json
 import logging
 from typing import TYPE_CHECKING

@@ -331,38 +330,3 @@ class TestEmptyUserTurnDrop:
        assert len(user_turns) == 1
        assert f"[start system-reminder_{nonce}]" in user_turns[0]["content"]
        assert "child done" in user_turns[0]["content"]
-
-
-class TestToolArgumentLegalization:
-    """``_prepare_wire_messages`` legalizes malformed tool-call ``arguments`` so a
-    strict renderer (vLLM ``deepseek_v4``) can ``json.loads`` every arguments string
-    — the sibling send-time validity pass to orphan repair."""
-
-    def test_unterminated_arguments_legalized_on_the_wire(self) -> None:
-        s = make_session()
-        msgs = [
-            {"role": "user", "content": "go"},
-            {
-                "role": "assistant",
-                "content": "",
-                "tool_calls": [
-                    {
-                        "id": "c1",
-                        "type": "function",
-                        "function": {"name": "bash", "arguments": '{"command": "cat /va'},
-                    }
-                ],
-            },
-            {"role": "tool", "tool_call_id": "c1", "content": "retry with valid JSON"},
-        ]
-        out = s._prepare_wire_messages(msgs)
-        emitted = [
-            tc["function"]["arguments"]
-            for m in out
-            if m.get("role") == "assistant"
-            for tc in m.get("tool_calls", [])
-        ]
-        assert emitted == ["{}"]
-        assert json.loads(emitted[0]) == {}
-        # Canonical input is untouched — legalization is wire-copy only.
-        assert msgs[1]["tool_calls"][0]["function"]["arguments"] == '{"command": "cat /va'
@@ -2,11 +2,7 @@

 from __future__ import annotations

-from turnstone.core.output_guard import (
-    evaluate_output,
-    merge_guard_display_payload,
-    redact_credentials,
-)
+from turnstone.core.output_guard import evaluate_output, merge_guard_display_payload


 class TestBenignOutput:
@@ -209,73 +205,6 @@ class TestCredentialLeakage:
        )
        assert "credential_leak" not in r.flags

-    def test_single_quote_json_secret(self) -> None:
-        # Python dict reprs / JS object literals emit single quotes; these must
-        # be detected and redacted just like the double-quoted JSON form.
-        r = evaluate_output("headers = {'Authorization': 'Bearer canstillseethis'}")
-        assert "credential_leak" in r.flags
-        assert "json_secret_leak" in r.flags
-        assert r.sanitized is not None
-        assert "canstillseethis" not in r.sanitized
-
-    def test_single_quote_password(self) -> None:
-        r = evaluate_output("{'password': 'hunter2hunter2'}")
-        assert "json_secret_leak" in r.flags
-        assert r.sanitized is not None
-        assert "hunter2hunter2" not in r.sanitized
-
-    def test_mongodb_srv_connection_string(self) -> None:
-        r = evaluate_output("uri: mongodb+srv://admin:s3cretpw@cluster.mongodb.net/db")
-        assert "connection_string_leak" in r.flags
-        assert r.sanitized is not None
-        assert "s3cretpw" not in r.sanitized
-
-    def test_rediss_connection_string(self) -> None:
-        r = evaluate_output("rediss://user:s3cretpw@redis.host:6380/0")
-        assert "connection_string_leak" in r.flags
-        assert r.sanitized is not None
-        assert "s3cretpw" not in r.sanitized
-
-    def test_sqlalchemy_driver_connection_string(self) -> None:
-        # SQLAlchemy dialect+driver URLs must match — the bare-dialect
-        # list alone leaked these (only +psycopg was enumerated).
-        for url in (
-            "postgresql+psycopg2://admin:s3cret_pass@db.internal:5432/prod",
-            "postgresql+asyncpg://admin:s3cret_pass@db.internal/prod",
-            "mysql+pymysql://admin:s3cret_pass@db.internal/prod",
-        ):
-            r = evaluate_output(url)
-            assert "connection_string_leak" in r.flags, url
-            assert r.sanitized is not None, url
-            assert "s3cret_pass" not in r.sanitized, url
-            assert ":[REDACTED:password]@" in r.sanitized, url
-
-    def test_uppercase_scheme_connection_string(self) -> None:
-        # RFC 3986 schemes are case-insensitive; an uppercase scheme must
-        # not bypass redaction.
-        for url in (
-            "POSTGRESQL+PSYCOPG2://admin:s3cret_pass@db.internal/prod",
-            "HTTPS://admin:s3cret_pass@api.internal/x",
-        ):
-            r = evaluate_output(url)
-            assert "connection_string_leak" in r.flags, url
-            assert r.sanitized is not None, url
-            assert "s3cret_pass" not in r.sanitized, url
-
-    def test_bearer_scheme_case_insensitive(self) -> None:
-        # RFC 7235 scheme name is case-insensitive.
-        r = evaluate_output("authorization: bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig12345")
-        assert "credential_leak" in r.flags
-
-    def test_prefixed_key_assignment_redacts_whole_token(self) -> None:
-        # api_key=/secret_key=/access_token= must redact the entire assignment,
-        # not chew only the tail into a garbled "api_[REDACTED:api_key]".
-        secret = "abcdefghijklmnopqrstuvwxyz"
-        for prefix in ("api_key", "secret_key", "session_key", "access_token", "key", "token"):
-            out = redact_credentials(f"{prefix}={secret}")
-            assert secret not in out, (prefix, out)
-            assert out == "[REDACTED:api_key]", (prefix, out)
-

 class TestEncodedPayloads:
    """Detect encoded/obfuscated payloads."""
@@ -521,21 +521,16 @@ class TestSpawnPersona:


 # ---------------------------------------------------------------------------
-# Guard 7 — task_agent HAS a persona parameter: a sub-agent's identity comes
-# from a persona (default = the built-in task-agent identity), validated at
-# prep against the interactive kind.  Revises the original "no persona for
-# task agents" stance now that personas are first-class on every path.
+# Guard 7 — task_agent has no persona parameter (sub-agents keep their own
+# identity; persona is a workstream-level concept).
 # ---------------------------------------------------------------------------


-def test_task_agent_schema_has_persona_param() -> None:
+def test_task_agent_schema_has_no_persona_param() -> None:
    from turnstone.core.tools import TOOLS

    task_agent = next(t for t in TOOLS if t["function"]["name"] == "task_agent")
-    props = task_agent["function"]["parameters"]["properties"]
-    assert "persona" in props
-    # skill= is capability now — the description frames it that way.
-    assert "capability" in props["skill"]["description"].lower()
+    assert "persona" not in task_agent["function"]["parameters"]["properties"]


 # ---------------------------------------------------------------------------
@@ -1329,180 +1324,3 @@ class TestCreateStampsPersona:
        assert ws is not None and ws.session is not None
        assert ws.session._persona_name == ""
        assert not ws.persona
-
-
-# ---------------------------------------------------------------------------
-# Guard 10 — discovery: the calling LLM is TOLD which personas exist.  The
-# live enabled interactive-kind list rides the `persona` parameter
-# description of task_agent / spawn_workstream / spawn_batch, rebuilt from
-# the pristine TOOLS base on every render; storage-less sessions keep the
-# base text untouched.  Resolution is forgiving (case, unique display name)
-# but everything downstream carries the canonical slug.
-# ---------------------------------------------------------------------------
-
-
-def _persona_desc(session: ChatSession, tool_name: str) -> str:
-    tool = next(t for t in session._tools if t.get("function", {}).get("name") == tool_name)
-    prop = ChatSession._persona_property(tool["function"]["parameters"]["properties"])
-    assert prop is not None, f"{tool_name} has no persona parameter"
-    return prop["description"]
-
-
-def _pristine_persona_desc(tool_name: str) -> str:
-    from turnstone.core.tools import TOOLS
-
-    tool = next(t for t in TOOLS if t["function"]["name"] == tool_name)
-    prop = ChatSession._persona_property(tool["function"]["parameters"]["properties"])
-    assert prop is not None, f"{tool_name} has no persona parameter"
-    return prop["description"]
-
-
-class TestPersonaDiscovery:
-    def _seed(self) -> None:
-        get_storage().create_persona(
-            {
-                "persona_id": "p-eng",
-                "name": "engineer",
-                "display_name": "Engineer",
-                "description": "Default engineering identity",
-                "base_prompt": "E",
-                "applies_to_kinds": ["interactive"],
-                "is_default": True,
-            }
-        )
-        get_storage().create_persona(
-            {
-                "persona_id": "p-wri",
-                "name": "writer",
-                "display_name": "Creative Writer",
-                "description": "Prose-first writing partner",
-                "base_prompt": "W",
-                "applies_to_kinds": ["interactive"],
-            }
-        )
-
-    def _coord_session(self, mock_openai_client: Any) -> ChatSession:
-        return _session(
-            mock_openai_client,
-            kind=WorkstreamKind.COORDINATOR,
-            user_id="u1",
-            coord_client=MagicMock(),
-        )
-
-    def test_task_agent_description_lists_personas(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        session = _session(mock_openai_client)
-        desc = _persona_desc(session, "task_agent")
-        assert desc.startswith(_pristine_persona_desc("task_agent"))
-        assert "Available personas:" in desc
-        # Default first, then A→Z, each with its one-line description.
-        assert desc.index("`engineer` (default)") < desc.index("`writer`")
-        assert "Prose-first writing partner" in desc
-
-    def test_spawn_tools_list_personas_for_coordinators(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        session = self._coord_session(mock_openai_client)
-        for tool_name in ("spawn_workstream", "spawn_batch"):
-            desc = _persona_desc(session, tool_name)
-            assert desc.startswith(_pristine_persona_desc(tool_name))
-            assert "Available personas:" in desc
-            assert "`engineer` (default)" in desc
-
-    def test_coordinator_kind_personas_are_not_offered(self, tmp_db, mock_openai_client) -> None:
-        # Children and sub-agents are always interactive-kind; a
-        # coordinator-only persona in the list would be a guaranteed error.
-        self._seed()
-        get_storage().create_persona(
-            {
-                "persona_id": "p-exe",
-                "name": "executive",
-                "base_prompt": "X",
-                "applies_to_kinds": ["coordinator"],
-            }
-        )
-        session = self._coord_session(mock_openai_client)
-        assert "`executive`" not in _persona_desc(session, "spawn_workstream")
-
-    def test_storage_down_keeps_pristine_base(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        with patch("turnstone.core.storage.is_storage_initialized", return_value=False):
-            session = _session(mock_openai_client)
-        assert _persona_desc(session, "task_agent") == _pristine_persona_desc("task_agent")
-
-    def test_rerender_is_idempotent_and_tracks_archive(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        session = _session(mock_openai_client)
-        session._render_agent_tool_descriptions()
-        session._render_agent_tool_descriptions()
-        desc = _persona_desc(session, "task_agent")
-        assert desc.count("Available personas:") == 1
-        # Archive one persona; the next render must drop it, not append.
-        storage = get_storage()
-        writer = storage.get_persona_by_name("writer")
-        assert writer is not None
-        storage.update_persona(writer["persona_id"], enabled=False)
-        session._render_agent_tool_descriptions()
-        desc = _persona_desc(session, "task_agent")
-        assert "`writer`" not in desc
-        assert desc.count("Available personas:") == 1
-
-    def test_large_shelf_drops_prose_keeps_every_name(self, tmp_db, mock_openai_client) -> None:
-        storage = get_storage()
-        for i in range(26):
-            storage.create_persona(
-                {
-                    "persona_id": f"p-{i:02d}",
-                    "name": f"persona-{i:02d}",
-                    "description": "UNIQUE-PROSE-MARKER",
-                    "base_prompt": "x",
-                    "applies_to_kinds": ["interactive"],
-                }
-            )
-        session = _session(mock_openai_client)
-        desc = _persona_desc(session, "task_agent")
-        for i in range(26):
-            assert f"`persona-{i:02d}`" in desc
-        assert "UNIQUE-PROSE-MARKER" not in desc
-
-    def test_spawn_forgives_case_and_display_name_but_stamps_slug(
-        self, tmp_db, mock_openai_client
-    ) -> None:
-        self._seed()
-        session = self._coord_session(mock_openai_client)
-        for variant in ("WRITER", "Writer", "Creative Writer"):
-            item = session._prepare_spawn_workstream("c1", {"persona": variant})
-            assert not item.get("error"), item.get("error")
-            assert item["persona"] == "writer"
-
-    def test_spawn_batch_rows_land_on_canonical_slug(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        session = self._coord_session(mock_openai_client)
-        item = session._prepare_spawn_batch(
-            "c1",
-            {
-                "children": [
-                    {"initial_message": "a", "persona": "WRITER"},
-                    {"initial_message": "b", "persona": "Creative Writer"},
-                ]
-            },
-        )
-        assert not item.get("error"), item.get("error")
-        personas = [c["persona"] for c in item["children"] if "_error" not in c]
-        assert personas == ["writer", "writer"]
-
-    def test_task_agent_prep_canonicalizes_header_and_stamp(
-        self, tmp_db, mock_openai_client
-    ) -> None:
-        self._seed()
-        session = _session(mock_openai_client)
-        item = session._prepare_task("t1", {"prompt": "go", "persona": "Writer"})
-        assert not item.get("error"), item.get("error")
-        assert item["persona"] == "writer"
-        assert "persona: writer" in item["header"]
-
-    def test_unknown_persona_error_enumerates_live_names(self, tmp_db, mock_openai_client) -> None:
-        self._seed()
-        session = self._coord_session(mock_openai_client)
-        item = session._prepare_spawn_workstream("c1", {"persona": "nope"})
-        assert item.get("error")
-        assert "Available for interactive: engineer (default), writer" in item["error"]
@@ -125,191 +125,3 @@ class TestConfigParsing:
        cfg["persona_memory"] = "True"
        with pytest.raises(ValueError, match="persona_memory"):
            snapshot_from_config(cfg)
-
-
-class _FakeStorage:
-    """Minimal storage double for resolve tests — exact-name index + list."""
-
-    def __init__(self, rows: list[dict]) -> None:
-        self._rows = rows
-
-    def get_persona_by_name(self, name: str) -> dict | None:
-        return next((dict(r) for r in self._rows if r["name"] == name), None)
-
-    def list_personas(self, include_disabled: bool = False) -> list[dict]:
-        return [dict(r) for r in self._rows if include_disabled or r.get("enabled")]
-
-
-def _rows() -> list[dict]:
-    return [
-        {
-            "name": "engineer",
-            "display_name": "Engineer",
-            "enabled": True,
-            "is_default": True,
-            "applies_to_kinds": ["interactive"],
-        },
-        {
-            "name": "writer",
-            "display_name": "Creative Writer",
-            "enabled": True,
-            "applies_to_kinds": ["interactive"],
-        },
-        {
-            "name": "executive",
-            "display_name": "Executive",
-            "enabled": True,
-            "applies_to_kinds": ["coordinator"],
-        },
-        {
-            "name": "retired",
-            "display_name": "Retired Persona",
-            "enabled": False,
-            "applies_to_kinds": ["interactive"],
-        },
-    ]
-
-
-class TestForgivingResolution:
-    """resolve_persona_for_kind — one shared rule, forgiving on all surfaces.
-
-    Exact slug first, then the lowercased input, then a UNIQUE
-    case-insensitive display-name match; every failure enumerates the
-    kind's live names (the self-correction path for stale tool
-    descriptions), and callers stamp the returned row's canonical slug.
-    """
-
-    def _resolve(self, name: str, kind: str = "interactive", rows: list[dict] | None = None):
-        from turnstone.core.personas import resolve_persona_for_kind
-
-        return resolve_persona_for_kind(_FakeStorage(rows or _rows()), name, kind)
-
-    def test_exact_slug_resolves(self) -> None:
-        row, err = self._resolve("writer")
-        assert err == "" and row is not None and row["name"] == "writer"
-
-    def test_case_variants_resolve_to_canonical_row(self) -> None:
-        for variant in ("Writer", "WRITER", " writer "):
-            row, err = self._resolve(variant)
-            assert err == "" and row is not None and row["name"] == "writer"
-
-    def test_unique_display_name_resolves_to_slug(self) -> None:
-        for variant in ("Creative Writer", "creative writer"):
-            row, err = self._resolve(variant)
-            assert err == "" and row is not None and row["name"] == "writer"
-
-    def test_ambiguous_display_name_names_the_candidates(self) -> None:
-        rows = _rows() + [
-            {
-                "name": "novelist",
-                "display_name": "creative writer",
-                "enabled": True,
-                "applies_to_kinds": ["interactive"],
-            }
-        ]
-        row, err = self._resolve("Creative Writer", rows=rows)
-        assert row is None
-        assert "more than one display name" in err
-        assert "novelist" in err and "writer" in err
-        assert "use the exact name" in err
-
-    def test_same_display_name_across_kinds_resolves_per_kind(self) -> None:
-        # The label the caller saw came from a kind-filtered surface, so a
-        # same-label persona of the OTHER kind must neither block (spurious
-        # ambiguity) nor win (cross-kind resolution).
-        rows = _rows() + [
-            {
-                "name": "helper-coord",
-                "display_name": "Helper",
-                "enabled": True,
-                "applies_to_kinds": ["coordinator"],
-            },
-            {
-                "name": "helper-int",
-                "display_name": "Helper",
-                "enabled": True,
-                "applies_to_kinds": ["interactive"],
-            },
-        ]
-        row, err = self._resolve("Helper", rows=rows)
-        assert err == "" and row is not None and row["name"] == "helper-int"
-        row, err = self._resolve("Helper", kind="coordinator", rows=rows)
-        assert err == "" and row is not None and row["name"] == "helper-coord"
-
-    def test_wrong_kind_display_match_is_not_found_with_choices(self) -> None:
-        # Display names are labels, not identifiers: a label that only exists
-        # on another kind's persona reads as unknown for THIS kind (with the
-        # kind's live choices attached) — never as a cross-kind resolution.
-        rows = _rows() + [
-            {
-                "name": "chief",
-                "display_name": "The Chief",
-                "enabled": True,
-                "applies_to_kinds": ["coordinator"],
-            }
-        ]
-        row, err = self._resolve("The Chief", rows=rows)
-        assert row is None
-        assert "not found or disabled" in err
-        assert "Available for interactive: engineer (default), writer" in err
-
-    def test_whitespace_input_never_matches_blank_display_names(self) -> None:
-        # display_name defaults to "" — a whitespace-only input (reachable via
-        # CLI `--persona "  "`) must read as unknown, never resolve to a
-        # blank-labelled persona or report a bogus ambiguity.
-        rows = _rows() + [
-            {
-                "name": "unlabelled",
-                "display_name": "",
-                "enabled": True,
-                "applies_to_kinds": ["interactive"],
-            },
-            {
-                "name": "unlabelled-too",
-                "display_name": "   ",
-                "enabled": True,
-                "applies_to_kinds": ["interactive"],
-            },
-        ]
-        for raw in ("", " ", "   "):
-            row, err = self._resolve(raw, rows=rows)
-            assert row is None
-            assert "not found or disabled" in err
-            assert "more than one display name" not in err
-
-    def test_unknown_error_lists_kind_names_default_first(self) -> None:
-        row, err = self._resolve("nope")
-        assert row is None
-        assert "Persona not found or disabled: 'nope'" in err
-        assert "Available for interactive: engineer (default), writer" in err
-        assert "executive" not in err  # wrong kind
-        assert "retired" not in err  # disabled
-
-    def test_kind_mismatch_reports_canonical_slug_and_choices(self) -> None:
-        row, err = self._resolve("Executive")  # case-forgiven, then kind-refused
-        assert row is None
-        assert "'executive' does not apply to kind 'interactive'" in err
-        assert "Available for interactive: engineer (default), writer" in err
-
-    def test_disabled_persona_is_not_resolvable_by_any_route(self) -> None:
-        for variant in ("retired", "RETIRED", "Retired Persona"):
-            row, err = self._resolve(variant)
-            assert row is None
-            assert "not found or disabled" in err
-
-    def test_storage_none_is_a_distinct_error(self) -> None:
-        from turnstone.core.personas import resolve_persona_for_kind
-
-        row, err = resolve_persona_for_kind(None, "writer", "interactive")
-        assert row is None and err == "persona storage unavailable"
-
-    def test_listing_failure_degrades_to_plain_error(self) -> None:
-        class _Broken(_FakeStorage):
-            def list_personas(self, include_disabled: bool = False) -> list[dict]:
-                raise RuntimeError("db gone")
-
-        from turnstone.core.personas import resolve_persona_for_kind
-
-        row, err = resolve_persona_for_kind(_Broken(_rows()), "nope", "interactive")
-        assert row is None
-        assert "Persona not found or disabled: 'nope'" in err
@@ -179,10 +179,10 @@ def test_bulk_live_admin_bypass_returns_live(storage):


 def test_bulk_live_cluster_wide_visibility(storage):
-    """A project-less workstream has no tenancy to enforce, so any
-    ``admin.cluster.inspect`` caller sees it in ``results``.  ``denied``
-    is reserved for ids that don't correspond to a persisted workstream
-    (no existence oracle for unknown ids)."""
+    """Trusted-team visibility: any ``admin.cluster.inspect`` caller
+    sees every row in ``results``.  ``denied`` is reserved for ids
+    that don't correspond to a persisted workstream (no existence
+    oracle for unknown ids)."""
    ws_id = "b" * 32
    _seed_workstream(storage, ws_id=ws_id, node_id="node-a", user_id="stranger")
    client = _make_client(storage, coord_mgr=_build_mgr(storage))
@@ -196,48 +196,6 @@ def test_bulk_live_cluster_wide_visibility(storage):
    assert body["denied"] == []


-def test_bulk_live_private_project_row_routes_to_denied(storage):
-    """A workstream in a private project the caller isn't a member of
-    routes to ``denied``, not ``results`` — a cluster admin gets no
-    private-project oracle from the bulk surface either."""
-    storage.create_project("proj-secret", "Secret", "alice")
-    ws_id = "c" * 32
-    storage.register_workstream(ws_id, node_id="node-a", user_id="alice", project_id="proj-secret")
-    client = _make_client(storage, coord_mgr=_build_mgr(storage))
-    resp = client.get(
-        f"/v1/api/cluster/ws/live?ids={ws_id}",
-        headers={"X-Test-User": "stranger", "X-Test-Perms": "admin.cluster.inspect"},
-    )
-    assert resp.status_code == 200
-    body = resp.json()
-    assert body["results"] == {}
-    assert body["denied"] == [ws_id]
-
-
-def test_bulk_live_private_project_row_visible_to_member(storage):
-    """A project member sees the row (routes to ``results``); the live
-    block is null only because the coordinator row isn't loaded."""
-    storage.create_project("proj-secret", "Secret", "alice")
-    storage.add_project_member("proj-secret", "member-bob")
-    ws_id = "c" * 32
-    storage.register_workstream(
-        ws_id,
-        node_id="console",
-        user_id="alice",
-        kind="coordinator",
-        project_id="proj-secret",
-    )
-    client = _make_client(storage, coord_mgr=_build_mgr(storage))
-    resp = client.get(
-        f"/v1/api/cluster/ws/live?ids={ws_id}",
-        headers={"X-Test-User": "member-bob", "X-Test-Perms": "admin.cluster.inspect"},
-    )
-    assert resp.status_code == 200
-    body = resp.json()
-    assert ws_id in body["results"]
-    assert body["denied"] == []
-
-
 def test_bulk_live_unknown_ids_route_to_denied(storage):
    """Unknown ids (not in storage) land in ``denied`` so the endpoint
    can't be used as an existence oracle."""
@@ -270,42 +228,34 @@ def test_bulk_live_coordinator_row_uses_manager_snapshot(storage):
    live = body["results"][ws.id]
    assert live is not None
    assert "pending_approval" in live
-    # The details list is always present on the wire — empty when no
-    # approval is pending so the JS can `key in row` without surprise.
-    # Replaces 1.6's singular ``pending_approval_detail`` null
-    # (breaking, 1.7).
-    assert "pending_approval_details" in live
-    assert live["pending_approval_details"] == []
+    # New field always present on the wire — None when no approval
+    # is pending so the JS can `key in row` without surprise.
+    assert "pending_approval_detail" in live
+    assert live["pending_approval_detail"] is None


-def test_bulk_live_coordinator_row_includes_pending_approval_details(storage):
-    """When an approval cycle is live on a coord UI, the live block
-    surfaces one detail entry per cycle with merged items +
-    judge_verdict through the coord-pseudo-node path. End-to-end
-    equivalent of the dashboard test in test_server_authz, but for
-    the console live-bulk endpoint that the coord tree UI actually
-    consumes."""
-    from turnstone.core.session_ui_base import ApprovalCycle
-
+def test_bulk_live_coordinator_row_includes_pending_approval_detail(storage):
+    """When _pending_approval is set on a coord UI, the live block
+    surfaces the merged items + judge_verdict payload through the
+    coord-pseudo-node path. End-to-end equivalent of the dashboard
+    test in test_server_authz, but for the console live-bulk
+    endpoint that the coord tree UI actually consumes."""
    mgr = _build_mgr(storage)
    ws = mgr.create(user_id="user-1")
-    items = [
-        {
-            "call_id": "c-99",
-            "header": "spawn_workstream",
-            "preview": "{...}",
-            "func_name": "spawn_workstream",
-            "approval_label": "spawn_workstream",
-            "needs_approval": True,
-        }
-    ]
-    card = {
+    ws.ui._pending_approval = {
        "type": "approve_request",
-        "cycle_id": "cyc-99",
-        "items": ws.ui._serialize_approval_items(items),
+        "items": [
+            {
+                "call_id": "c-99",
+                "header": "spawn_workstream",
+                "preview": "{...}",
+                "func_name": "spawn_workstream",
+                "approval_label": "spawn_workstream",
+                "needs_approval": True,
+            }
+        ],
        "judge_pending": False,
    }
-    ws.ui._register_approval_cycle(ApprovalCycle(items, card, None))
    ws.ui._llm_verdicts["c-99"] = {
        "recommendation": "approve",
        "risk_level": "low",
@@ -319,10 +269,8 @@ def test_bulk_live_coordinator_row_includes_pending_approval_details(storage):
    assert resp.status_code == 200
    live = resp.json()["results"][ws.id]
    assert live["pending_approval"] is True  # boolean derived flag
-    details = live["pending_approval_details"]
-    assert len(details) == 1
-    detail = details[0]
-    assert detail["cycle_id"] == "cyc-99"
+    detail = live["pending_approval_detail"]
+    assert detail is not None
    assert detail["call_id"] == "c-99"
    assert detail["items"][0]["func_name"] == "spawn_workstream"
    assert detail["items"][0]["judge_verdict"]["recommendation"] == "approve"
@@ -1,305 +0,0 @@
-"""Unit tests for the preview-content policy module (``turnstone/core/preview.py``).
-
-Pure-function coverage: kind resolution precedence (magic bytes → MIME hint →
-extension → UTF-8 fallback), the explicit ``kind`` override lanes, base-href
-injection, title extraction, and the per-MIME serving headers the route
-attaches.  The tool executor and the HTTP route are covered separately
-(``test_open_preview_tool.py`` / ``test_server_attachments_endpoints.py``).
-"""
-
-from __future__ import annotations
-
-from turnstone.core.attachments import IMAGE_SIZE_CAP, PDF_SIZE_CAP, TEXT_DOC_SIZE_CAP
-from turnstone.core.preview import (
-    PREVIEW_BLOB_KIND,
-    PREVIEW_KINDS,
-    PREVIEW_SERVE_MIMES,
-    PREVIEW_SIZE_CAPS,
-    build_preview_descriptor,
-    inject_base_href,
-    page_title,
-    preview_response_headers,
-    resolve_preview_kind,
-    transcode_text,
-)
-
-PNG_1x1 = (
-    b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
-    b"\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\rIDATx\x9cc\xfc\xcf"
-    b"\xc0\xc0\xc0\x00\x00\x00\x05\x00\x01\xa5\xf6E@\x00\x00\x00\x00IEND\xaeB`\x82"
-)
-PDF_MIN = b"%PDF-1.4 fake body"
-HTML_DOC = b"<html><head><title>Acme Pricing</title></head><body>hi</body></html>"
-
-
-class TestResolvePreviewKind:
-    def test_magic_bytes_win_over_everything(self):
-        # A PNG claiming to be CSV by both MIME and extension is an image.
-        assert resolve_preview_kind("text/csv", "data.csv", PNG_1x1) == ("image", "image/png")
-        assert resolve_preview_kind("text/plain", "doc.txt", PDF_MIN) == (
-            "pdf",
-            "application/pdf",
-        )
-
-    def test_mime_hint_html(self):
-        kind, mime = resolve_preview_kind("text/html; charset=iso-8859-1", "page", HTML_DOC)
-        assert kind == "web"
-        assert mime == "text/html; charset=utf-8"
-
-    def test_mime_hint_families(self):
-        assert resolve_preview_kind("text/csv", "x", b"a,b\n1,2")[0] == "table"
-        assert resolve_preview_kind("application/json", "x", b"[]") == (
-            "table",
-            "application/json",
-        )
-        assert resolve_preview_kind("text/markdown", "x", b"# hi")[0] == "markdown"
-        assert resolve_preview_kind("text/x-log", "x", b"line")[0] == "text"
-
-    def test_extension_fallback_when_no_mime(self):
-        assert resolve_preview_kind("", "report.html", HTML_DOC)[0] == "web"
-        assert resolve_preview_kind("", "data.tsv", b"a\tb")[0] == "table"
-        assert resolve_preview_kind("", "notes.md", b"# t")[0] == "markdown"
-        # URL tails strip query/fragment before the extension check.
-        assert resolve_preview_kind("", "https://x.io/a.csv?dl=1#f", b"a,b")[0] == "table"
-
-    def test_utf8_text_fallback(self):
-        assert resolve_preview_kind("", "LICENSE", b"MIT License") == (
-            "text",
-            "text/plain; charset=utf-8",
-        )
-
-    def test_binary_is_not_previewable(self):
-        assert resolve_preview_kind("", "blob.bin", b"\x00\x01\x02\x03" * 8) is None
-        # Text-DECLARED binary is misdeclared, not previewable text.
-        assert resolve_preview_kind("text/plain", "x", b"\x00\xff" * 8) is None
-        assert resolve_preview_kind("application/octet-stream", "x", b"\x00" * 32) is None
-
-    def test_override_validates_bytes(self):
-        # image override on non-image bytes fails rather than mislabeling.
-        assert resolve_preview_kind("", "x", b"not an image", "image") is None
-        assert resolve_preview_kind("", "x", PNG_1x1, "image") == ("image", "image/png")
-        assert resolve_preview_kind("", "x", b"not a pdf", "pdf") is None
-        # Text-family override on binary bytes fails.
-        assert resolve_preview_kind("", "x", b"\x00\x01", "text") is None
-
-    def test_override_forces_view(self):
-        # kind='text' on an HTML doc = view source.
-        assert resolve_preview_kind("text/html", "p.html", HTML_DOC, "text")[0] == "text"
-        # kind='table' keeps the real payload type for the client parser.
-        assert resolve_preview_kind("application/json", "d", b"[1]", "table") == (
-            "table",
-            "application/json",
-        )
-        assert resolve_preview_kind("", "d.tsv", b"a\tb", "table") == (
-            "table",
-            "text/tab-separated-values; charset=utf-8",
-        )
-        assert resolve_preview_kind("", "d.txt", b"a,b", "table") == (
-            "table",
-            "text/csv; charset=utf-8",
-        )
-
-    def test_unknown_override_rejected(self):
-        assert resolve_preview_kind("text/plain", "x", b"hi", "hologram") is None
-
-
-class TestHtmlHelpers:
-    def test_base_href_inserted_after_head(self):
-        out = inject_base_href("<html><head><meta x></head></html>", "https://a.io/p/q")
-        assert out.startswith('<html><head><base href="https://a.io/p/q">')
-
-    def test_base_href_prepended_without_head(self):
-        out = inject_base_href("<p>bare</p>", "https://a.io/")
-        assert out.startswith('<base href="https://a.io/">')
-
-    def test_existing_base_untouched(self):
-        doc = '<head><base href="https://original/"></head>'
-        assert inject_base_href(doc, "https://other/") == doc
-
-    def test_base_href_attribute_escaped(self):
-        out = inject_base_href("<head></head>", 'https://a.io/"><script>x</script>')
-        assert "<script>" not in out
-        assert "&quot;&gt;&lt;script&gt;" in out
-
-    def test_page_title_extraction(self):
-        assert page_title(HTML_DOC.decode()) == "Acme Pricing"
-        assert page_title("<title>a &amp; b\n   c</title>") == "a & b c"
-        assert page_title("<p>no title</p>") is None
-        assert page_title("<title></title>") is None
-
-
-_LOCKED_HTML_CSP = (
-    "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:"
-)
-
-
-class TestServingPolicy:
-    def test_html_default_locks_out_remote_assets(self):
-        # Default (no opt-in): sandboxed AND off the network — inline styling +
-        # data-URI images render, but the page can fetch nothing, so previewing
-        # never discloses the viewer to the origin site.
-        h = preview_response_headers("text/html", "page.html")
-        assert h["Content-Security-Policy"] == _LOCKED_HTML_CSP
-        assert h["X-Content-Type-Options"] == "nosniff"
-        assert h["Cache-Control"] == "private, no-store"
-        assert h["Content-Disposition"].startswith("inline;")
-
-    def test_html_assets_opt_in_gets_bare_sandbox_csp(self):
-        # allow_remote_assets=True drops back to the bare sandbox so the page's
-        # own images / CSS load.
-        h = preview_response_headers("text/html", "page.html", allow_remote_assets=True)
-        assert h["Content-Security-Policy"] == "sandbox"
-        assert h["X-Content-Type-Options"] == "nosniff"
-
-    def test_assets_flag_does_not_touch_non_html_kinds(self):
-        for mime in ("application/pdf", "image/png", "text/csv", "text/plain"):
-            assert preview_response_headers(
-                mime, "f", allow_remote_assets=True
-            ) == preview_response_headers(mime, "f")
-
-    def test_pdf_gets_no_csp(self):
-        h = preview_response_headers("application/pdf", "doc.pdf")
-        assert "Content-Security-Policy" not in h
-        assert h["X-Content-Type-Options"] == "nosniff"
-
-    def test_other_kinds_keep_full_csp(self):
-        for mime in ("image/png", "text/csv", "text/plain"):
-            h = preview_response_headers(mime, "f")
-            assert h["Content-Security-Policy"] == "default-src 'none'; sandbox"
-
-    def test_filename_header_injection_stripped(self):
-        h = preview_response_headers("text/plain", 'a"\r\nX-Evil: 1')
-        assert "\r" not in h["Content-Disposition"]
-        assert "\n" not in h["Content-Disposition"]
-        assert '"' not in h["Content-Disposition"].split("filename=")[1].strip('"')
-
-    def test_serve_allowlist_covers_every_stored_kind(self):
-        for mime in (
-            "text/html",
-            "application/pdf",
-            "image/png",
-            "image/webp",
-            "text/csv",
-            "text/tab-separated-values",
-            "application/json",
-            "text/markdown",
-            "text/plain",
-        ):
-            assert mime in PREVIEW_SERVE_MIMES
-
-    def test_caps_reuse_attachment_constants(self):
-        assert PREVIEW_SIZE_CAPS["image"] == IMAGE_SIZE_CAP
-        assert PREVIEW_SIZE_CAPS["pdf"] == PDF_SIZE_CAP
-        assert PREVIEW_SIZE_CAPS["text"] == TEXT_DOC_SIZE_CAP
-        assert set(PREVIEW_SIZE_CAPS) == set(PREVIEW_KINDS)
-
-    def test_blob_kind_is_outside_model_vocabulary(self):
-        assert PREVIEW_BLOB_KIND not in ("image", "text", "pdf", "audio")
-
-    def test_descriptor_shape(self):
-        d = build_preview_descriptor(
-            kind="web",
-            title="T",
-            source="https://a.io",
-            attachment_id="abc",
-            content_type="text/html; charset=utf-8",
-            size=7,
-        )
-        assert d == {
-            "kind": "web",
-            "title": "T",
-            "source": "https://a.io",
-            "attachment_id": "abc",
-            "content_type": "text/html; charset=utf-8",
-            "size": 7,
-        }
-
-
-class TestReviewHardening:
-    """Pins for the review-round fixes (2026-07-07)."""
-
-    def test_filename_folds_to_latin1_safe_ascii(self):
-        # Starlette encodes header values latin-1; em dashes / CJK titles
-        # must fold, not 500 the serving route.
-        h = preview_response_headers("text/html", "Docs — v1.7 日本語.html")
-        h["Content-Disposition"].encode("latin-1")  # must not raise
-        h2 = preview_response_headers("text/plain", "——")
-        h2["Content-Disposition"].encode("latin-1")
-        assert (
-            'filename="preview"' in h2["Content-Disposition"]
-            or "filename=" in h2["Content-Disposition"]
-        )
-
-    def test_base_href_never_precedes_doctype(self):
-        doc = "<!DOCTYPE html><body>no head</body>"
-        out = inject_base_href(doc, "https://a.io/")
-        assert out.startswith("<!DOCTYPE html>")
-        assert '<base href="https://a.io/">' in out
-        # <html> without <head> also keeps document order.
-        doc2 = "<!doctype html><html lang=en><body>x</body></html>"
-        out2 = inject_base_href(doc2, "https://a.io/")
-        assert out2.startswith("<!doctype html><html lang=en>")
-        assert out2.index("<base") > out2.index("<html")
-
-    def test_legacy_charset_web_pages_stay_previewable(self):
-        # windows-1252 / iso-8859-1 bytes are not UTF-8; web kind must not
-        # reject them (the executor transcodes at store time).
-        latin1_html = "<html><body>café</body></html>".encode("latin-1")
-        assert resolve_preview_kind("text/html; charset=iso-8859-1", "p", latin1_html) == (
-            "web",
-            "text/html; charset=utf-8",
-        )
-        # Extension lane and explicit override agree.
-        assert resolve_preview_kind("", "page.html", latin1_html)[0] == "web"
-        assert resolve_preview_kind("", "page.bin", latin1_html, "web")[0] == "web"
-        # Non-web text kinds now transcode too — a declared text/csv MIME on
-        # legacy-charset bytes is previewable (was strict-UTF-8-only before).
-        assert resolve_preview_kind("text/csv", "d.csv", latin1_html) == (
-            "table",
-            "text/csv; charset=utf-8",
-        )
-        # …but binary declared as text (a NUL byte) is still rejected.
-        assert resolve_preview_kind("text/csv", "d.csv", b"\x00\x01\x02" * 8) is None
-
-
-class TestLegacyCharsetText:
-    """Text-family kinds transcode legacy charsets at store time; only the
-    undeclared fallback lane stays strict UTF-8 (2026-07-07 follow-up)."""
-
-    def test_declared_latin1_csv_is_a_table(self):
-        latin1_csv = "name,city\nRené,Montréal\n".encode("iso-8859-1")
-        # MIME hint carrying the charset.
-        assert resolve_preview_kind("text/csv; charset=iso-8859-1", "d", latin1_csv) == (
-            "table",
-            "text/csv; charset=utf-8",
-        )
-        # Extension lane and explicit override agree — all "declared text".
-        assert resolve_preview_kind("", "data.csv", latin1_csv)[0] == "table"
-        assert resolve_preview_kind("", "data.bin", latin1_csv, "table")[0] == "table"
-
-    def test_declared_text_nul_byte_still_binary(self):
-        # The ladder never fails, so the NUL check is the only binary gate left
-        # for declared text — it must hold in every declared lane.
-        nul = b"a,b\n1,\x00\n"
-        assert resolve_preview_kind("text/csv", "d.csv", nul) is None
-        assert resolve_preview_kind("", "d.csv", nul) is None
-        assert resolve_preview_kind("", "d", nul, "table") is None
-
-    def test_undeclared_non_utf8_still_rejected(self):
-        # No MIME hint, no text-family extension, no override: the bare
-        # fallback lane stays strict UTF-8 — cp1252+replace would otherwise
-        # classify arbitrary binary as text.
-        assert resolve_preview_kind("", "mystery", b"caf\xe9 nonsense \xff\xfe") is None
-
-    def test_transcode_ladder_rungs(self):
-        # (a) charset= parameter honored.
-        assert transcode_text("café".encode("iso-8859-1"), "text/csv; charset=iso-8859-1") == "café"
-        # (b) UTF-8 when the charset is absent / unknown.
-        assert transcode_text("héllo".encode(), "text/plain") == "héllo"
-        assert transcode_text("héllo".encode(), "text/plain; charset=made-up") == "héllo"
-        # (c) cp1252 fallback rung: smart quotes are invalid UTF-8 (the shape a
-        # legacy .txt with no charset takes — empty mime hint), decoded via the
-        # last rung rather than erroring.
-        smart = b"he said \x93hi\x94"
-        out = transcode_text(smart, "")
-        assert "“" in out and "”" in out
@@ -1,214 +0,0 @@
-"""Static guards for the preview pane frontend (shared_static/preview.js and
-its wiring through conversation.js / interactive.js / shell.js).
-
-Same posture as ``test_shell_js.py``: Python-side string-presence assertions
-that catch the silent one-line regression (a renamed export, a dropped
-sandbox attribute, a de-registered pane type).  Parse + sink + var guards for
-``preview.js`` itself live in ``test_shell_js.py``'s bundle sweeps.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-_ROOT = Path(__file__).resolve().parent.parent
-_SHARED = _ROOT / "turnstone/shared_static"
-_PANE_JS = _SHARED / "pane.js"
-_PREVIEW_JS = _SHARED / "preview.js"
-_CONVERSATION_JS = _SHARED / "conversation.js"
-_INTERACTIVE_JS = _SHARED / "interactive.js"
-_SHELL_JS = _SHARED / "shell.js"
-_PREVIEW_CSS = _SHARED / "preview.css"
-_UI_INDEX = _ROOT / "turnstone/ui/static/index.html"
-_CONSOLE_INDEX = _ROOT / "turnstone/console/static/index.html"
-
-
-def _read(p: Path) -> str:
-    return p.read_text(encoding="utf-8")
-
-
-class TestPreviewPaneModule:
-    def test_factory_exported(self) -> None:
-        assert "export function createPreviewPane" in _read(_PREVIEW_JS)
-
-    def test_web_iframe_is_fully_sandboxed(self) -> None:
-        """The web renderer must keep the empty-sandbox attribute — every
-        capability (scripts, same-origin, forms, popups) stays off.  Dropping
-        or loosening it turns fetched pages into live documents."""
-        body = _read(_PREVIEW_JS)
-        assert 'frame.setAttribute("sandbox", "")' in body
-        assert 'frame.setAttribute("referrerpolicy", "no-referrer")' in body
-
-    def test_pdf_iframe_is_not_sandboxed(self) -> None:
-        """Deliberate asymmetry: Chromium's PDF viewer refuses to paint in a
-        sandboxed context.  The renderer comment carries the rationale; this
-        pins that renderPdf never gained a sandbox attribute by copy-paste."""
-        body = _read(_PREVIEW_JS)
-        pdf_fn = body.split("const renderPdf")[1].split("const renderImage")[0]
-        assert "sandbox" not in pdf_fn or "No sandbox attribute" in pdf_fn
-
-    def test_content_loads_through_authfetch_probe(self) -> None:
-        """src-loaded kinds preflight with a probe request (authFetch of
-        ?probe=1), NOT a HEAD.  The console reverse proxy forwards a HEAD as a
-        full GET, so a real HEAD would drag the whole blob across the hop just
-        to discard it; the probe still surfaces the persist race + auth
-        failures as a typed error card and rides the 401-refresh retry a bare
-        iframe/img src can't."""
-        body = _read(_PREVIEW_JS)
-        assert "authFetch(probeUrl)" in body
-        assert "probe=1" in body
-        # The old full-GET HEAD preflight is gone.
-        assert 'method: "HEAD"' not in body
-
-    def test_markdown_uses_the_sanctioned_html_lane(self) -> None:
-        body = _read(_PREVIEW_JS)
-        assert "setSafeHtml(doc, renderMarkdown(text))" in body
-
-    def test_markdown_runs_vendor_post_pass(self) -> None:
-        """The pane runs renderer.js's post-render pass (hljs token coloring +
-        mermaid) like the conversation pane — dropping it silently regresses
-        code highlighting and diagram rendering in previews."""
-        body = _read(_PREVIEW_JS)
-        assert "postRenderMarkdown(" in body
-
-    def test_remote_assets_toggle_is_default_off(self) -> None:
-        """The remote-assets opt-in defaults OFF: a previewed page must not
-        contact its origin site until the user asks.  Pins the label / tooltip
-        copy and the sticky-boolean initializer."""
-        body = _read(_PREVIEW_JS)
-        assert "Load remote images & styles" in body
-        assert "Off keeps this preview from contacting the site" in body
-        assert "pane._assetsOn = false" in body
-
-    def test_assets_flag_only_rides_behind_toggle(self) -> None:
-        """assets=1 reaches the URL only when the per-pane toggle is on."""
-        body = _read(_PREVIEW_JS)
-        assert "assets=1" in body
-        assert "pane._assetsOn" in body
-
-    def test_history_is_bounded(self) -> None:
-        assert "HISTORY_CAP" in _read(_PREVIEW_JS)
-
-    def test_table_renderer_caps_rows(self) -> None:
-        assert "TABLE_ROW_CAP" in _read(_PREVIEW_JS)
-
-    def test_url_builder_encodes_path_parts(self) -> None:
-        body = _read(_PREVIEW_JS)
-        assert "encodeURIComponent(ws)" in body
-        assert 'encodeURIComponent(descriptor.attachment_id || "")' in body
-
-
-class TestTranscriptChip:
-    def test_chip_builder_exported(self) -> None:
-        assert "export function buildPreviewChip" in _read(_CONVERSATION_JS)
-
-    def test_live_path_gates_auto_open_on_focus(self) -> None:
-        """A backgrounded session must not commandeer the split — the live
-        path auto-opens only while the originating pane is focused; the chip
-        is the deliberate reopen everywhere else."""
-        body = _read(_INTERACTIVE_JS)
-        assert "if (this._host.isFocused(this)) this._host.onPreview(preview);" in body
-
-    def test_replay_path_renders_chip_without_auto_open(self) -> None:
-        body = _read(_INTERACTIVE_JS)
-        # The replay branch builds the chip…
-        assert "buildPreviewChip(msg.preview" in body
-        # …and the auto-open call appears exactly once (the live path).
-        assert body.count("this._host.onPreview(preview)") == 1
-
-    def test_tool_result_event_passes_preview(self) -> None:
-        assert "evt.preview," in _read(_INTERACTIVE_JS)
-
-    def test_host_bridge_carries_transport_ctx(self) -> None:
-        """The preview pane fetches blobs from the ORIGINATING workstream
-        through the same node proxy — the bridge must pass both base and
-        wsId, not just the descriptor."""
-        body = _read(_INTERACTIVE_JS)
-        assert "window.TS_SHELL.openPreview(descriptor, { base: base, wsId: wsId })" in body
-
-
-class TestShellWiring:
-    def test_pane_type_registered(self) -> None:
-        body = _read(_SHELL_JS)
-        assert 'pm.registerType("preview"' in body
-        assert "createPreviewPane" in body
-
-    def test_opens_beside_the_conversation(self) -> None:
-        """openPaneBeside is the load-bearing gesture — the preview coexists
-        with the conversation that spawned it instead of replacing it."""
-        body = _read(_SHELL_JS)
-        assert 'pm.openPaneBeside("preview")' in body
-
-    def test_seam_exported_on_ts_shell(self) -> None:
-        assert "openPreview," in _read(_SHELL_JS)
-
-
-class TestStylesheets:
-    def test_both_surfaces_link_preview_css(self) -> None:
-        for page in (_UI_INDEX, _CONSOLE_INDEX):
-            assert "/shared/preview.css" in _read(page), page.name
-
-    def test_stylesheet_uses_ds_tokens_not_legacy_vars(self) -> None:
-        """conv-* card rule: DS tokens only — chat.css legacy vars
-        (--green/--red/--fg) must not creep into the new sheet."""
-        body = _read(_PREVIEW_CSS)
-        assert "var(--ink-" in body
-        assert "var(--hair)" in body
-        for legacy in ("var(--green)", "var(--red)", "var(--fg)"):
-            assert legacy not in body
-
-
-class TestEphemeralDismiss:
-    """The preview is an ephemeral pane: dismissing its split cell CLOSES it
-    (tab and content gone) instead of parking an orphan tab whose only reopen
-    is the transcript chip.  Regression guard for the pane/tab desync."""
-
-    def test_preview_pane_is_ephemeral(self) -> None:
-        """createPreviewPane must flag the pane ephemeral — the whole fix keys
-        off this bit."""
-        body = _read(_PREVIEW_JS)
-        assert "ephemeral: true" in body, "the preview pane must declare itself ephemeral"
-
-    def test_shellpane_carries_the_ephemeral_flag(self) -> None:
-        body = _read(_PANE_JS)
-        assert "this.ephemeral = opts.ephemeral || false;" in body, (
-            "ShellPane must accept and default the ephemeral flag"
-        )
-
-    def test_cell_chip_closes_ephemeral_pane_outright(self) -> None:
-        """In a split the ✕ chip normally HIDES the cell (closeCell); for an
-        ephemeral pane it must fall through to close() — the `!pane.ephemeral`
-        guard is what routes it there.  Pin BOTH the guard and where the
-        skipped case lands (the else), or gutting the else regresses the fix
-        while the guard string survives verbatim."""
-        body = _read(_PANE_JS)
-        assert "if (this._layout && this._leafFor(pane.id) && !pane.ephemeral)" in body, (
-            "the cell chip must skip closeCell for an ephemeral pane"
-        )
-        assert "else this.close(pane.id);" in body, (
-            "the skipped (ephemeral / single-pane) case must land on close()"
-        )
-
-    def test_cell_chip_signals_destruction_for_ephemeral(self) -> None:
-        """The glyph/label must not lie: an ephemeral pane's split chip reads
-        as a destructive close (✕ + danger hover + 'Close pane'), never the
-        reversible '− / Hide from split'."""
-        body = _read(_PANE_JS)
-        assert "const destroys = !multi || pane.ephemeral;" in body, (
-            "chip mode must treat ephemeral panes as destructive even in a split"
-        )
-
-    def test_unsplit_closes_ephemeral_non_survivors(self) -> None:
-        """Collapsing the split from the OTHER pane must not orphan the preview
-        either — unsplit closes ephemeral panes it isn't keeping."""
-        body = _read(_PANE_JS)
-        assert "const keep = this._activeId;" in body, (
-            "the unsplit survivor must be the FOCUSED pane — the filter's "
-            "`id !== keep` guard is only correct if keep is _activeId"
-        )
-        assert "for (const id of doomed) this.close(id);" in body, (
-            "unsplit must destroy ephemeral panes it does not keep"
-        )
-        assert "return id !== keep && p && p.ephemeral;" in body, (
-            "unsplit must spare the focused survivor and non-ephemeral panes"
-        )
--- a/Show More
+++ b/Show More