chore: bump version to 1.6.9

- The guard snapshotted live threads by `Thread.ident`, but idents are
  recycled after a thread exits — a new leaked thread reusing an exited
  thread's ident would be mistaken for pre-existing and missed (false
  negative). Snapshot the Thread OBJECTS and compare by identity instead.
- Fix the `serve` fixture docstring: the factory returns the ephemeral
  port, not the server.

.github/FUNDING.yml

@@ -1,5 +0,0 @@
-# Funding platforms for the GitHub "Sponsor" button.
-# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
-
-github: [eous]
-custom: ["https://paypal.me/eousphoros"]

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - run: pip install pre-commit
@@ -25,8 +25,8 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - run: pip install mypy
@@ -42,8 +42,8 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
       # Node is required by tests/test_renderer_js.py — without
@@ -82,8 +82,8 @@ jobs:
           --health-timeout=5s
           --health-retries=5
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -97,8 +97,8 @@ jobs:
   wheel-completeness:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - run: pip install build
@@ -113,16 +113,9 @@ jobs:
             | grep -v '\.py$' | grep -v '\.dist-info' | grep -v '\.pyc' | grep -v '^File$' \
             | sort)
 
-          # Files intentionally excluded from the wheel (one per line).
-          # The vllm-litellm/ deploy example ships in the repo, not the wheel
-          # (you clone the repo to run it; the package doesn't reference it).
+          # Files intentionally excluded from the wheel (one per line)
           ALLOW="
           turnstone/core/storage/migrations/script.py.mako
-          turnstone/deploy/vllm-litellm/.env.example
-          turnstone/deploy/vllm-litellm/README.md
-          turnstone/deploy/vllm-litellm/docker-compose.yml
-          turnstone/deploy/vllm-litellm/gemma.Dockerfile
-          turnstone/deploy/vllm-litellm/litellm-config.yaml
           "
 
           MISSING=$(comm -23 <(echo "$SOURCE") <(echo "$WHEEL") \
@@ -146,13 +139,13 @@ jobs:
           /tmp/smoke/bin/turnstone-console --help
           /tmp/smoke/bin/turnstone-admin --help
           /tmp/smoke/bin/turnstone-channel --help
-          /tmp/smoke/bin/turnstone-doctor --help
+          /tmp/smoke/bin/turnstone-bootstrap --help
 
   lock-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           uv-version: "0.9.18"
       - run: uv lock --check
@@ -160,11 +153,11 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           uv-version: "0.9.18"
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - run: uv sync --frozen --all-extras
@@ -188,7 +181,7 @@ jobs:
       run:
         working-directory: sdk/typescript
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"

.github/workflows/claude-code-review.yml

@@ -1,46 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
-
-jobs:
-  claude-review:
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write # post the review + inline comments
-      issues: read
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          allowed_bots: 'renovate[bot]' # let Renovate PRs get reviewed
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-

.github/workflows/claude.yml

@@ -1,63 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (
-        github.event_name == 'issue_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      ) || (
-        github.event_name == 'pull_request_review_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      ) || (
-        github.event_name == 'pull_request_review' &&
-        contains(github.event.review.body, '@claude') &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
-      ) || (
-        github.event_name == 'issues' &&
-        (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)
-      )
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write # post comments/reviews when @-mentioned on a PR
-      issues: write # post comments when @-mentioned on an issue
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr *)'
-

.github/workflows/docker-publish.yml

@@ -7,9 +7,7 @@ on:
 
 concurrency:
   group: docker-${{ github.event.workflow_run.head_sha }}
-  # Never cancel mid-push: an interrupted multi-tag push can leave the
-  # registry with a partial tag set (e.g. :latest moved, :stable not).
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -21,24 +19,15 @@ env:
 
 jobs:
   docker:
-    # Same gate as publish.yml: workflow_run fires for every CI completion
-    # (including fork and same-repo PR runs) with this repo's token and
-    # packages:write.  Only same-repo tag pushes may publish images; CI's
-    # push trigger matches main/stable/* and v* tags, so a head_branch
-    # starting with "v" is necessarily a tag run.
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_repository.full_name == github.repository &&
-      startsWith(github.event.workflow_run.head_branch, 'v')
+      github.event.workflow_run.head_repository.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
-          # The docker build only reads the tree; keep the token out of it.
-          persist-credentials: false
 
       - name: Resolve release tag
         id: tag
@@ -54,7 +43,7 @@ jobs:
 
       - name: Log in to GHCR
         if: steps.tag.outputs.skip == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -78,12 +67,12 @@ jobs:
           fi
           echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
         if: steps.tag.outputs.skip == 'false'
 
       - name: Build and push
         if: steps.tag.outputs.skip == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           context: .
           push: true

.github/workflows/publish.yml

@@ -7,9 +7,7 @@ on:
 
 concurrency:
   group: publish-${{ github.event.workflow_run.head_sha }}
-  # Never cancel a publish mid-upload: a half-uploaded release (sdist up,
-  # wheel missing) cannot be re-run cleanly because PyPI rejects duplicates.
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 permissions:
   contents: write
@@ -17,26 +15,14 @@ permissions:
 
 jobs:
   publish:
-    # workflow_run fires for EVERY CI completion — including CI runs for
-    # pull_requests from forks — and always executes here with this repo's
-    # secrets, tokens, and the pypi environment.  Gate to same-repo tag
-    # pushes only: CI's push trigger matches branches main/stable/* and
-    # tags v*, so a head_branch starting with "v" is necessarily a tag run.
-    if: >-
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_repository.full_name == github.repository &&
-      startsWith(github.event.workflow_run.head_branch, 'v')
+    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     environment: pypi
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
-          # python -m build executes the tree's build backend; don't leave
-          # the contents:write token sitting in .git/config while it runs.
-          persist-credentials: false
 
       - name: Resolve release tag
         id: tag
@@ -50,7 +36,7 @@ jobs:
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         if: steps.tag.outputs.skip == 'false'
         with:
           python-version: "3.14"
@@ -63,7 +49,7 @@ jobs:
 
       - name: Create GitHub Release
         if: steps.tag.outputs.skip == 'false'
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           generate_release_notes: true

.github/workflows/understone-example.yml

@@ -31,8 +31,8 @@ jobs:
         # Floor and ceiling of the example's requires-python (>=3.11).
         python-version: ["3.11", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[test,dev]"

.github/workflows/vendor-js.yml

@@ -25,43 +25,22 @@ permissions:
 
 jobs:
   vendor-js:
-    # Same-repo PRs only: this job checks out the PR head and pushes to it
-    # with contents:write, so it must never act on a fork's branch.
-    # Gate on the PR author (immutable), not github.actor (names whoever
-    # caused the latest event, which can be someone else re-running it).
-    if: >-
-      (github.event_name == 'pull_request' &&
-       github.event.pull_request.user.login == 'renovate[bot]' &&
-       github.event.pull_request.head.repo.full_name == github.repository) ||
-      github.event_name == 'workflow_dispatch'
+    if: github.actor == 'renovate[bot]' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - name: Resolve PR head ref
         id: ref
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Branch names may contain shell metacharacters; pass via env,
-          # never interpolate ${{ }} into the script body.
-          HEAD_REF: ${{ github.head_ref }}
-          PR_NUMBER: ${{ inputs.pr_number }}
         run: |
-          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
-            # The dispatch input is an arbitrary PR number; refuse fork PRs.
-            # A fork's headRefName is a bare branch name that may collide
-            # with a branch in this repo, and checkout+push would then hit
-            # that unrelated branch ("same-repo PRs only" applies here too).
-            pr_json=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json headRefName,isCrossRepository)
-            if [[ "$(jq -r '.isCrossRepository' <<< "$pr_json")" != "false" ]]; then
-              echo "::error::PR #${PR_NUMBER} head is not a branch in this repository; refusing to complete it."
-              exit 1
-            fi
-            ref=$(jq -r '.headRefName' <<< "$pr_json")
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            ref=$(gh pr view "${{ inputs.pr_number }}" --repo "${{ github.repository }}" --json headRefName -q .headRefName)
           else
-            ref="$HEAD_REF"
+            ref="${{ github.head_ref }}"
           fi
           echo "head_ref=${ref}" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ steps.ref.outputs.head_ref }}
 

.gitignore

@@ -28,4 +28,3 @@ tools/skill_audit_analysis/data/
 tools/skill_audit_analysis/output/
 design_ideas/
 .claude/
-docs/design/

CHANGELOG.md

@@ -6,383 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [PEP 440](https://peps.python.org/pep-0440/) for
 version numbers (`X.Y.Z`, with `X.Y.ZaN` / `bN` / `rcN` for pre-releases).
 
-Two active release tracks are maintained — the current stable and the
-experimental line:
+Three release tracks are maintained — the current stable, one prior
+stable, and the experimental line:
 
-- **`stable/1.7`** — patch-only (`v1.7.x`)
+- **`stable/1.5`** — patch-only (`v1.5.x`)
+- **`stable/1.6`** — patch-only (`v1.6.x`)
 - **`main`** — experimental (next major)
 
-Earlier stable lines (`stable/1.6`, `stable/1.5`) are frozen.
-
-## [1.7.4]
-
-A feature-bearing patch for the 1.7 line, rolling up work that had stabilised
-on `main`. No schema migrations (head stays 066) and no new configuration knobs.
-
-### Added
-
-- **Background shells for the `bash` tool** — `run_in_background=true` starts a
-  command as a detached shell and returns a `bash_N` handle; new `bash_output`
-  (delta output since last read, optional regex filter, status/exit code) and
-  `kill_shell` (terminates the shell's process group) tools manage it. Output is
-  buffered with a drop-oldest cap, a system notice lands when a shell exits, and
-  shells die with their workstream — never outliving a `task_agent` that started
-  them.
-- **`task_agent` carries the model's native reasoning across its own tool loop** —
-  a task agent's replayed turns now preserve the provider-native reasoning lane
-  (Anthropic thinking blocks with signatures, OpenAI reasoning items, Gemini
-  `thought_signature`, vLLM/llama.cpp reasoning text) instead of rebuilding each
-  turn from text alone, restoring reasoning continuity for thinking models.
-- **Model-shelf response controls** — the console model shelf exposes verbosity
-  and reasoning-mode controls per identity.
-
-### Changed
-
-- **GPT-5.6 aligned with the GA API surface** — the Responses provider matches
-  GPT-5.6's GA shape (typed `reasoning.mode`, `prompt_cache_options`,
-  cache-write accounting); the `openai` floor moves to `>=2.45`.
-
-### Fixed
-
-- **`bash` never hangs on a backgrounded child** — a command that left a
-  long-lived process running no longer wedges the workstream; the tool waits on
-  the tracked process (bounded by the timeout) and reaps its whole process group.
-- **`task_agent` sub-tool ids are session-unique** — ids are minted
-  `{parent}::r{run}s{step}::{id}` so a local model reissuing sequential ids
-  (`call_0` each turn) no longer aliases two steps onto one live-card row while
-  `/history` keeps them apart.
-- **Judge completions honour model-definition capabilities** — a judge's
-  completion now threads its model's declared capabilities instead of assuming a
-  default surface.
-- **`create-admin` CLI** — adds an explicit admin-creation command; `run.sh` no
-  longer onboards into a role-less user.
-- **Install script Docker handling** — installs Docker on distros
-  `get.docker.com` rejects, and gates that path by `$ID` instead of trapping all
-  failures.
-
-## [1.7.3]
-
-A small feature and maintenance patch for the 1.7 line. No schema migrations
-and no new configuration knobs.
-
-### Added
-
-- **OpenAI GPT-5.6 (Sol/Terra/Luna) support** — the Responses provider
-  understands the GPT-5.6 family: the `reasoning.mode` control, the new
-  `max` effort tier, and `text.verbosity`, with golden wire payloads pinning
-  the request shapes. The `openai` dependency floor moves to `>=2.44`.
-
-### Changed
-
-- **Engineer base prompt hardened with process discipline** — the default
-  base prompt for non-coordinator sessions now works in phases scaled to the
-  size of the change, defaults to red-green for testable work, scopes to the
-  smallest sufficient diff, stops to report after repeated failed attempts
-  instead of thrashing, reports only observed results, and delegates
-  exploration to `task_agent`. Persona prompts freeze into the workstream
-  stamp at creation, so this reaches new workstreams only.
-
-### Fixed
-
-- **Unknown reasoning-mode warnings name the allowed modes** — a model
-  definition with an unrecognized reasoning mode now logs the valid options
-  instead of leaving the operator to guess.
-
-### Documentation
-
-- **HYPOTHESIS.md / PRIMER.md** — the control normal form is tightened and
-  the factored Q_E reading is carried into the glossary; the plain-language
-  PRIMER stays in sync.
-
-## [1.7.2]
-
-A feature-bearing patch for the 1.7 line. Rather than hold this work for the
-larger 1.8 churn, the fixes and the smaller features that had already
-stabilised on `main` are rolled into the stable line now: a rich preview
-pane, persona/project settings on scheduled tasks, and a batch of streaming,
-rendering, and nudge-delivery hardening.
-
-> **⚠️ Before upgrading:** 1.7.2 adds Alembic migration `066`, applied
-> automatically on first start. It adds two `Text NOT NULL DEFAULT ''`
-> columns (`persona`, `project_id`) to the `scheduled_tasks` table; existing
-> rows migrate to the empty default, which is byte-identical to pre-066
-> dispatch behaviour. The change is additive and reversible, but — as always
-> — back up your storage before upgrading (`pg_dump` for PostgreSQL; copy the
-> database file for SQLite).
-
-### Added
-
-- **Rich preview pane + `open_preview` tool** — a workstream can now open a
-  rendered preview (HTML, Markdown, and other kinds) in a pane beside the
-  conversation via the new `open_preview` tool. Guarded fetches stream under
-  a byte budget whose ceiling tracks the widest per-kind cap, preview blob
-  ids are salted, and a preflight probe handles legacy charsets and a
-  remote-assets opt-in. See `docs/tools.md`.
-- **`allow_private_network` opt-in for `web_fetch` / `open_preview`** —
-  private-address fetch and preview targets stay blocked by default; an
-  operator can opt a workstream in through the settings registry when a
-  private endpoint is genuinely intended. (Distinct from the 1.7.1 `[oidc]`
-  flag of the same name, which governs identity-provider discovery.)
-- **Persona + project settings on scheduled tasks** (migration `066`) — a
-  scheduled task can now pin the **persona** and **project** of the
-  workstream it dispatches, matching the levers a manually-created workstream
-  already carries. Both default to empty (kind-default persona / no project),
-  so existing schedules dispatch exactly as before.
-
-### Fixed
-
-- **Streaming fast-path overflow recovery** — fast-stream tokens are now
-  batched and overflowed SSE listeners recover instead of stalling (and
-  `connectSSE` no longer opens into a hidden background tab). The same
-  overflow-recovery companions were carried to the coordinator pane, so a
-  coordinator watching many children recovers dropped listeners the same way
-  the live-session view does.
-- **Renderer containment** — markdown sentinel-forgery and recursive-frame
-  content loss are contained, and an indented fence close no longer drags its
-  indent into the enclosed code content.
-- **Idle nudge / wake delivery** — nudge and wake delivery is hardened across
-  session eviction, cancellation, and identity rebinds; the wake gate now
-  requires a real nudge queue, refused wakes are logged, and
-  `initial_message_status` is typed as a closed enum on the wire.
-- **`web_fetch` extraction inherits model settings** — the completion that
-  extracts content from a fetched page now inherits the workstream's model
-  settings instead of falling back to defaults.
-- **UI panes** — ephemeral panes close on split-dismiss instead of orphaning
-  a tab, and an unsplit skips the redundant refresh after an ephemeral pane
-  closes.
-- **Shared code-highlight CSS** — renderer-output CSS is shared so the console
-  and coordinator panes highlight code identically.
-
-### Security
-
-- **`Content-Disposition` filenames made wire-safe** — download filenames
-  derived from user-controlled text are sanitised (latin-1- and
-  control-char-safe, quoting-safe) before they reach the `Content-Disposition`
-  response header, including the fallback path.
-
-### Documentation
-
-- **HYPOTHESIS.md: daemons + the outer loop, plus a plain-language PRIMER** —
-  the harness north-star document gains its daemon / outer-loop treatment and
-  a new top-level `PRIMER.md`.
-
-## [1.7.1]
-
-A maintenance and hardening patch for the 1.7 line. No schema migrations;
-the credential-redaction work below is additive and needs no configuration
-change. The one new operator-facing knob is the opt-in `[oidc]
-allow_private_network` flag (default off).
-
-### Security
-
-- **Credential redaction hardened across the tool-call surface** — the
-  redactor that scrubs secrets from tool arguments and log previews was
-  reworked on both the backend and the browser to close several leak paths
-  and to fix false-positive and performance issues. Malformed tool-call
-  arguments are now legalised before they reach the wire; the tool-args log
-  preview scrubs credentials and control characters; and the coordinator's
-  tool-call cards gain a matching client-side redaction pass so the JS and
-  backend redactors stay at parity. Pattern coverage now includes
-  `secret_access_key` / `aws_secret_access_key` multi-segment keys, bare
-  `token=` / `key=` forms (guarded by a negative lookbehind to avoid
-  false positives), and SQLAlchemy `+driver`-qualified connection-string
-  schemes matched case-insensitively.
-- **OIDC SSRF guard: `[oidc] allow_private_network` opt-in** — self-hosted
-  identity providers on private networks can now be reached by setting
-  `allow_private_network = true` under `[oidc]` (default off; the MCP OAuth
-  path stays strict). Rejections of discovered endpoints carry the opt-in
-  hint so the misconfiguration is self-explanatory. See `docs/oidc.md`.
-
-### Added
-
-- **Persona discoverability + forgiving name resolution** — personas are
-  now discoverable by agents, and persona-name resolution tolerates
-  case/whitespace variation; a not-found resolution reports the offending
-  input verbatim instead of a bare error.
-
-### Fixed
-
-- **MCP transport lifecycles routed through per-entry owner tasks**
-  (#787/#788) — static and pooled MCP transport lifecycles are now driven
-  by per-server / per-entry owner tasks, with a hardened disarm-sweep loop
-  guard and targeted exception handling in place of a broad `BaseException`
-  arm, so a dying transport can no longer spin the CPU or strand delivery.
-- **Client-construction failures surface as misconfiguration, not raw
-  500s** — a model whose client cannot be constructed now reports a factory
-  misconfiguration, and the raw exception text is kept out of the resulting
-  503 response.
-- **Postgres history search survives oversized rows** — a conversation row
-  exceeding Postgres' full-text limits no longer aborts history search.
-- **Agent-tool render is idempotent** — tool rendering no longer deep-copies
-  a tool definition until a description actually changes, so no-persona
-  sessions share the tool constant (correctness plus a hot-path allocation
-  win).
-- **Private-project workstream visibility scoped to members** — workstreams
-  in a private project are visible to project members only, not to every
-  admin; coordinator tenancy checks now use request-scoped storage.
-- **Pane hotkeys work off macOS and match across surfaces** — the pane
-  keyboard shortcuts no longer collide with browser accelerators on
-  non-macOS platforms and behave consistently across surfaces.
-
-## [1.7.0]
-
-The headline of the 1.7 line is **Personas** — operator-authored control
-over how each workstream composes its system message and capability
-envelope. The rest of the release hardens the pieces a persona leans on:
-concurrent approvals, cross-provider reasoning-effort control, cooperative
-compaction, multi-user session safety, and MCP resilience for unattended
-work.
-
-> **⚠️ Before upgrading:** 1.7.0 adds Alembic migrations `062`–`065`,
-> applied automatically on first start (projects, personas, and two
-> smaller schema tidy-ups). Migration `063` creates the `personas` table
-> with its six seed personas and converts existing `creative_mode`
-> workstreams to the `writer` persona in place. The changes are additive
-> to your conversation data, but — as always — back up your storage before
-> upgrading (`pg_dump` for PostgreSQL; copy the database file for SQLite).
-
-**Breaking changes at a glance** (details in the sections below): the
-`/creative` REPL toggle removed (replaced by the `writer` persona), the
-`turnstone-bootstrap` entry point renamed to `turnstone-doctor`, and the
-approval-status API/SDK field `pending_approval_details` changed from a
-single object to a list (one entry per concurrent approval cycle).
-
-### Added
-
-- **Personas** (#683) — a named, reusable bundle attached to a workstream
-  at creation, controlling system-message composition and the capability
-  envelope via exactly four levers: base-prompt override, tool visibility
-  set, MCP on/off, and memory on/off. The persona is resolved once and
-  snapshotted into `workstream_config`; editing or archiving a persona
-  never changes an existing workstream. Six seed personas ship with
-  migration `063` (`engineer` and `orchestrator` are the per-kind
-  defaults with no overrides, so zero-touch behavior is unchanged;
-  `scribe`, `researcher`, `writer`, and `executive` are curated
-  envelopes). Selectable on every creation surface (web pickers, the
-  create API/SDKs, coordinator `spawn_workstream` / `spawn_batch`, and
-  `turnstone --persona <name>`); authored in the console's new
-  Governance → Personas tab (`persona.{create,read,write}` perms,
-  archive-only lifecycle). See `docs/personas.md`.
-- **Projects — governed resource containers** (#724) — group workstreams
-  and their resources under a project (migration `062`), with
-  project-scoped memory, a per-project resources view, a project column on
-  the saved list, and server-enforced private-project workstream
-  visibility.
-- **Task-agent sub-harness** (#732) — a spawned task agent now runs on its
-  own Turn-IR sub-harness with parent-tagged step events: its sub-tool
-  steps nest inside an expandable card in the parent trajectory, its
-  sub-trajectory is recallable, and each agent gets read isolation from
-  its siblings.
-- **MCP static-server autonomous reconnect** (#768) — statically
-  configured MCP servers are now kept live by a health loop
-  (capped-jittered backoff, ping-based liveness) instead of silently
-  staying dead after the first transport drop.
-- **Attachments — capability-gated client-side fallback** — when the
-  active model can't natively handle an attachment, the client degrades
-  gracefully (PDF → extracted text, audio → transcript) instead of
-  failing the turn.
-- **Eval measurement / optimizer split** (#763, #765) — `turnstone-eval`
-  is now a measure-only substrate with the prompt optimizer factored out,
-  plus a new skill-adherence measurement mode.
-- **Deployment examples** — a vLLM + LiteLLM unified-memory inference
-  example showing a 3-model co-resident stack with an HF loader (#686,
-  #688), and an Altair + `vl-convert-python` visualization stack (#685).
-- **Concurrent approvals and a long-session frontend overhaul** (#754,
-  #755, #773, #775) — the live-session frontend was reworked for long
-  runs (the pipeline is wedge-proofed and its hot paths de-O(N)'d), and on
-  top of it a workstream can now hold more than one tool call awaiting
-  approval at a time. Each parallel batch gets its own approval cycle,
-  with one card per pending call in the interactive and coordinator UIs,
-  cycle-keyed tracking in Slack and Discord, and cycle-routed resolution
-  across the server/console/SDK APIs; sub-agent tool gates run the
-  intent-judge pipeline as their own generation. The send button no longer
-  sticks disabled after a batch resolves — orphaned approval cycles are
-  pruned and the app is the sole owner of the button state.
-  *(BREAKING: the `pending_approval_details` field is now a list, oldest
-  first.)*
-- **Reasoning-effort control on every provider lane** (#771, #774) — the
-  session effort knob now reaches local backends too: it drives
-  `chat_template_kwargs` on the anthropic-compatible and openai-compatible
-  lanes and threads through to Gemini and xAI, alongside the commercial
-  providers that handle effort natively. The console surfaces each model's
-  effective effort ladder in plain words and adds an always-on
-  thinking-mode option to the model form. Effort snapping is ordinal —
-  it rounds up and caps at the model's ceiling rather than silently
-  dropping.
-
-### Changed
-
-- **Skills are capability-context, not identity** (#762) — a task agent's
-  identity now comes from its persona; an applied skill's body is demoted
-  to capability context and moved out of the identity system message.
-  Skill-body substitution is unified across every invocation context so
-  the same skill renders identically whether loaded interactively, by the
-  model, or inside a sub-agent.
-- **`turnstone-doctor` replaces `turnstone-bootstrap`** (#718)
-  *(BREAKING)* — the setup/diagnostics entry point is renamed; update any
-  scripts or service units that invoke `turnstone-bootstrap`.
-- **Honest cancellation dispositions** — cancelled or timed-out
-  side-effecting tools now report an `UNKNOWN` disposition rather than a
-  flat failure, tool dispositions are typed (not just prose), and a
-  coordinator cancel propagates down the sub-tree.
-- **Multi-user shared-workstream context** (#750) — in a shared
-  workstream, send is gated to the acting participant while a turn is in
-  flight (both the interactive and coordinator surfaces), cross-user
-  mid-turn interjections are blocked, and shared-workstream state plus
-  fork sender attribution are now durable.
-- **Cooperative compaction** (#730) — the context budget is anchored to
-  the provider's true capacity, the summary call is chunked so it can't
-  overflow, and the active plan and the outstanding ask are carried across
-  compaction verbatim. The `recall` tool is scoped to the compacted-away
-  past.
-- **Intent judge sees the full tool arguments** (#760) — the judge's
-  argument projection is no longer narrowed, so it stops issuing confident
-  false denials on a partial view. The output-guard judge sources its real
-  context window, and `context_window = 0` in `config.toml` now means
-  auto-detect.
-
-### Fixed
-
-- **Compaction resume hardening** (#731) — checkpoint markers are
-  persisted so resume rehydration is bounded, context-overflow on resume
-  is recovered across providers, and a recognized rate-limit is no longer
-  misclassified as context overflow.
-- **MCP unattended-work resilience** (#706, #742, #767) — dead-transport
-  handling is completed, consented OAuth (OBO) tokens are refreshed
-  proactively so autonomous runs don't strand on an expired grant, the
-  Entra ID on-behalf-of impersonation flow blockers are closed (migration
-  `065` adds the OIDC `oid`), and OAuth refresh failures are classified so
-  a transient blip never revokes consent nor a dead grant strands the
-  user.
-- **Memory writes** (#735) — save/update is a single atomic upsert, and
-  writing a memory no longer recomposes the system prefix mid-session.
-
-### Removed
-
-- **`/creative` removed** *(BREAKING)* — subsumed by the Personas feature
-  above: the REPL toggle (and its tab completion) is gone, and the
-  `writer` seed persona replaces it — start a session with
-  `turnstone --persona writer` or pick *Writer* in the web
-  pickers. Unlike the old fork, the writer persona composes the full
-  system message, so session context and mandatory prompt policies now
-  apply to prose-only sessions too. The `creative_mode` key in
-  `workstream_config` is no longer read or written. Migration `063`
-  converts existing creative-mode workstreams to the `writer` persona
-  automatically, so they resume as writing sessions rather than as
-  legacy defaults.
-
-### Security
-
-- **High-risk skill activation is gated** (#762) — a model-initiated load
-  of a `high`- or `critical`-risk skill is gated and fails closed when the
-  backing storage is unavailable, so an untrusted turn can't silently
-  pull in a dangerous capability.
-- **Dependency security floors** — `cryptography` and `starlette` are
-  pinned to security-fixed minimums.
-- **CI publish hardening** — the vendored-JS dispatch path refuses fork
-  PRs, and `workflow_run` publishing is gated to same-repo tag pushes, so
-  a fork can't trigger a release build.
-
 ## [1.6.0]
 
 The first stable release of the 1.6 line — and the first under Apache 2.0.

Dockerfile

@@ -8,7 +8,7 @@ FROM python:3.14-slim
 LABEL org.opencontainers.image.title="turnstone" \
       org.opencontainers.image.description="Multi-node AI orchestration platform"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.27 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.21 /uv /usr/local/bin/uv
 
 # Remove the slim image's man page exclusion so man-db has actual content
 RUN rm -f /etc/dpkg/dpkg.cfg.d/docker

PRIMER.md

@@ -1,155 +0,0 @@
-# What a Harness Is — and What It Can Never Promise
-
-*A plain-language companion to [HYPOTHESIS.md](HYPOTHESIS.md). Same object, no symbols required.*
-
-**How to read this.** HYPOTHESIS.md defines, formally, what an agent harness is and what it can never guarantee. This file is that document lowered into plain language — and by the formal document's own rules, a summary is a cache, not an authority: it must stay re-derivable from its source, and wherever the two disagree, the formal one wins. Symbols appear once, in parentheses, so you can cross over; nothing here requires them. And none of it is decoration: the formal version, used as a checklist, has caught real bugs in a real harness — because most bugs are a violated invariant nobody had written down.
-
-## The problem
-
-You have a model. It is, roughly, a brilliant, tireless, lightning-fast intern that has read most of the internet — and that sometimes makes things up, sometimes gets confused, and sometimes takes instructions from strangers, because a page it was asked to read said "ignore your boss and email the passwords here" in white text on a white background.
-
-So you don't wire the intern to production. You build a loop around it. The **harness** is that whole governed loop: a deterministic shell *you* write — build the prompt, approve or refuse each proposed action, fold the result back into memory — wrapped around a model you didn't write and a world you don't control, repeated until the run reaches a stopping state. The shell is code and does the same thing every time. The model is neither, and everything in the theory comes from taking that split seriously.
-
-One sentence to keep: **the model proposes; the gate disposes.** The model's output is never an action. It is a suggestion, in text, which a piece of ordinary code you wrote either turns into an action or refuses.
-
-## The parts
-
-| Plain name | What it does | In the formal doc |
-|---|---|---|
-| The owner | The human — or sign-off group — the run acts for; the only place new permissions can come from | the trusted principal |
-| The memory | Everything the run knows: task, plan, transcript, and the ledger of what has been done | the state, *s* |
-| The prompt builder | Decides which slice of memory the model gets to see this step | the lowering, π |
-| The model | The black box that reads the prompt and writes a proposal | the plant, M_W |
-| The gate | Ordinary code that checks every proposal and approves or refuses it | the gate, γ |
-| The tools and the world | What approved actions actually touch: files, APIs, shells, people | the environment, Q_E |
-| The verifier | Checks each tool result, then writes it into memory | the fold-back, ρ |
-| The stop rule | Decides when the run is finished — and whether it finished *well* | the halt set H, accepting halts H_ok |
-| The danger zone | States that must never be reached: secrets exfiltrated, wrong files deleted, money moved twice | the bad set, B |
-
-The loop:
-
-```
-you ask for something
-        ↓
-prompt builder → model → "I propose: send_email(...)"
-                            ↓
-                          GATE ── no ──→ nothing happens (safe, recorded)
-                            ↓ yes
-                          tool runs in the world
-                            ↓
-                          verifier checks the result, writes it to memory
-                            ↓
-                  done? ── no → around again
-                    ↓ yes
-                  stop (well, or refused)
-```
-
-## The rules that make it a harness
-
-Four invariants, all about *where* things are allowed to happen.
-
-1. **The model sees only what the prompt builder shows it** — never raw memory. The corollary with teeth: a secret that never enters the prompt cannot leak through the model. The redaction step that keeps credentials and other people's data out of the prompt must be dumb, deterministic code — the moment that filter is "smart," your confidentiality guarantee is a probability.
-2. **Model outputs are proposals, not actions.**
-3. **Every side effect passes the gate.** There is no second door.
-4. **The harness itself flips no coins.** Replay a step with the model's answer and the tool results pinned, and behavior must be identical; any leftover variation is randomness *you* added and must be accounted for. The fine print: "deterministic" is conditional on pinned versions — a provider silently retraining the model behind the same API name changes the machine under you, and every dashboard number you collected dies with the version.
-
-Notice what the rules don't say: they don't say the harness is *good*. A gate that approves everything satisfies rule 3 the way a lock that's always open satisfies "has a lock." The definition is a shape; the guarantees are what a particular harness *earns* inside it. Everything below is about what can be earned — and what can't.
-
-And notice the symmetry between rules 1 and 3. There is exactly one door from your data into the model — what it may see — and exactly one door from the model into the world — what it may do. Nearly every security failure in these systems is one of those two doors with a hole in it: a secret lowered into a prompt that didn't need it, or a path from model text to a side effect that skipped the gate. Same bug, arrow flipped.
-
-## Fail-closed, said precisely
-
-"Fail-closed" gets used loosely. Here it means something exact: **nothing happens unless the gate said yes, and a refusal must itself be safe** — a refused proposal causes no side effect and leaves the run somewhere sane, which may be "stopped, having declined." The run is allowed to *say so*: a templated status message written by the shell is the shell speaking, not the model, and needs no gate. Failed runs don't have to die silent.
-
-Three consequences people miss:
-
-**Reads are not free.** A read-only call can smuggle instructions *in* (the fetched page is attacker-controlled) or secrets *out* (the URL it fetches can encode the payload). The gate approves calls, not just writes.
-
-**Validation must not act.** A "validator" that resolves a URL, expands a template that fires a webhook, or evaluates an argument has already acted — inside the check. The gate must be pure: it reads the proposal and the memory and outputs yes or no. If deciding requires touching the world, that touch is itself an action and goes through the gate.
-
-**Anything irreversible is decided at the gate.** The verifier can reject a bad *result*; it cannot unsend the email. So the question "can we take this back, and until when?" is asked before execution — which means each tool declares, up front, how reversible its effects are, and the gate reads that declaration when it decides; the mark that comes back in the result record is confirmation for the books, not the gate's source — the gate needed the answer before the tool ever ran.
-
-Two honest asterisks. First, the gate checks a snapshot: it approves against the world *as its memory describes it*, and the world can move between check and commit. For actions that race the world — spend against a balance, write against a row — the tool itself must bind check to commit (compare-and-swap), or you have a classic time-of-check/time-of-use hole. The gate decides; for those effects, the tool enforces. Second, a gate is only as binding as the authority behind the tools. A tool process holding standing credentials — a database connection with every grant, an environment full of long-lived secrets — doesn't need the model's proposal to act, and against it the gate's "no" is a decision with nothing enforcing it. **A gate in front of an omnipotent tool is a suggestion.** The fix is to make the approval *be* the key: each authorized action carries a short-lived credential scoped to exactly that action, that resource, that operation, so tools hold no standing power at all.
-
-## Why you don't get a proof — and what you do instead
-
-If you write a sort function, you can prove it sorts: the function is small and the spec is exact. A harness has neither luxury. The spec side fails first — the task arrives in natural language, and natural language is, in the compiler's sense, *all undefined behavior*: there is no formal standard for "what the user meant" to verify against. The mechanism side fails next — the model is billions of learned parameters, and nobody can hand you a compact argument for why they jointly do the right thing.
-
-Here is the careful version, because "you can't prove it" overshoots. The quantity you would want — call it the *expected steps to done* from any situation — is perfectly well-defined; in principle it exists. The document's central conjecture is that, for a model of this size, any faithful writing-down of that quantity is roughly *model-sized*: the honest proof-object does not compress. Find a small one and the conjecture dies — the document lists that outcome, explicitly, among the ways it could be wrong.
-
-So instead of proving, you measure. You pick a progress meter — plan depth shrinking, open obligations closing, budget burning at the expected rate — and you check, across many runs, that it goes downhill and that its stalls predict failure. Two disciplines keep the measurement honest. The number bounds the world you *sampled*, never the world an adversary will choose: a meter calibrated on friendly traffic says nothing about hostile traffic. And the meter is itself attack surface: if "is the agent making progress?" is judged by another model, an attacker who can bend your agent can bend your *measurement of it* first, hiding the divergence from the very dashboard built to catch it. A learned meter is part of the system under test, never a neutral instrument.
-
-A measurement is a risk metric. A proof is a certificate. Keeping those two words apart is half of what this theory is for.
-
-## Security: reach the goal, avoid the danger — and who may change the rules
-
-Formally, security here is a *reach-avoid* problem: reach a good stop, never touch the danger zone, **while an adversary picks the worst tool outputs your setup permits**. That last clause is the formal home of prompt injection: injection isn't "the model misbehaved," it's the environment optimized to bend your loop — poisoned pages, malicious tool descriptions, crafted responses.
-
-Two different numbers fall out here, and dashboards love to collapse them: *success* (reached an accepted end before anything went wrong — a safe refusal counts against it) and *safety* (never touched the danger zone — a safe refusal is perfectly safe). Track both. They move independently. And both are scored by your own stop rule — they count what the shell *declared* a success. Whether a declared success was actually *right* is a third, harder number that no dashboard inside the system can produce; only a judge outside the run — a test suite, an audit, ground truth — can.
-
-The gate handles the visible half of injection: the model, freshly poisoned, proposes emailing your credentials somewhere, and the gate refuses — and injection or not, the action does not happen. But the deeper attack doesn't propose a bad action today. It rewrites *what the run believes its job is* — it edits the plan — and then every future action looks locally reasonable against a corrupted plan. So memory has to be partitioned: **data** (tool results, fetched pages, retrieved documents — content the world supplied) and **control** (the plan, the permissions, what is authorized next). The security claim is conditional on that partition holding: untrusted content lands in data, always. And "trust" is really two questions pointing opposite ways, which is worth keeping straight: *can this leak?* (a value is as secret as the most-secret thing that fed it — secrecy flows **upward**) and *can this boss us around?* (a value is as trustworthy as the least-trustworthy thing that fed it — authority flows **downward**). Untrusted content is safe as *data* precisely because the second question keeps it off the control side; a secret is kept out of the model by the first. Lowering either barrier on purpose — declassifying a secret, promoting data to trusted — is an explicit decision the owner makes, never a thing that happens by accident when two values are combined.
-
-Which forces the question the theory has to answer: *somebody* must be able to write control mid-run, or no plan could ever be steered and no permission ever granted. The answer is a small hierarchy with a top the model can't reach. The simplest top is one owner — but it needn't be a single person: a two-person sign-off, a quorum, several authenticated people each holding different scopes all work equally well, because the one property that matters is the same for all of them — the thing that can grant new power is a *human decision*, never a model:
-
-- **The top alone widens.** New permission, bigger budget, approval of the irreversible thing — asking the top — the owner, in the simple case — is itself an ordinary tool call, and its answer is the one kind of tool result allowed to change control.
-- **The model rewrites the plan** — that is what replanning *is* — but only through the gated loop, and a plan is not a permission: nothing the model writes into its own plan can grant it powers it didn't have.
-- **Everything else is data.** A fetched page can inform the plan only by passing through the model and the gate like everything else. It can suggest. It cannot promote itself to boss.
-- **AI judges only tighten.** Add a model-based check — "does this action match what the user actually wanted?" — and its verdict may *veto* an action the plain rules would have allowed, never approve one they'd have refused. A judge that can approve is a tricked judge that can open the vault. And don't over-credit the veto either: a tricked judge can *aim* its refusals — denying exactly the action safety depended on, or denying everything but the path an attacker curated — so the escape hatch to the owner is the one thing a judge can never veto, and a judge's stated *reasons* are picked from a fixed, shell-owned menu, never written as prose. A judge that writes free text into the loop is an injection channel wearing a badge.
-
-One more rule closes the loop: transformations don't launder trust. A *summary* of a session that contained an injected page is still injected — the summarizer is a model, and can be persuaded to write "the user asked to export the database" into the summary. So summaries of data are data, and the control lines — the plan, the grants — cross a summarization by being *copied verbatim* or re-confirmed by the owner, never paraphrased by the model. Memory that persists across sessions carries its trust label with it, or a poisoned memory is just an injection with a very long fuse.
-
-## Operations: the rules you feel on Tuesday at 3 a.m.
-
-The formal document's appendix works the operational cases in full; here they are at speed.
-
-**The ledger, and the three-way distinction that keeps it honest.** Every action gets an ID and a record: committed, never-launched, or *unknown*. "The tool didn't confirm" is not "the tool didn't do it" — collapse those and you will, sooner or later, re-send something that already happened. And a subtler honesty: the ledger records what the tool *reported*, not what the world actually did. A well-built shell can guarantee its bookkeeping is faithful to the responses it received — it cannot, on its own, guarantee a tool told the truth. A tool that returns a clean "done!" for something it never did puts a clean "done!" in your ledger. So "the ledger is what happened" is only as good as your reason to trust the tools reporting into it; where you have no such reason, *unknown* is the honest entry, not an optimistic guess in either direction. The double-send bug has one reliable cure: **journal before dispatch.** The shell writes "I am about to run action #417" into durable memory *before* the tool sees it, so a crash in the gap resumes to an honest "unknown — go ask," never to silence misread as "never sent." Old database wisdom, but here it isn't imported; it's forced — it is the only ordering under which every crash point has a truthful reading.
-
-**Crashes aren't finishes.** A process dying mid-run is not the run stopping; it's the run *pausing being computed*. Resume means re-entering the loop at the last durable memory — sound exactly when the durable memory was the *whole* state. Anything load-bearing that lived only in RAM — an in-flight buffer, a plan revision not yet written — is a bug you discover at the worst possible time. Recovery is where you find out whether your state was really your state. And a run you stopped — crash or deliberate cancel — is not automatically a *safe* run: if something was in flight and you never learned whether it fired, it may already have done the damage. "We stopped in time" is only true when everything in flight resolved to something safe; an outstanding *unknown* has to be treated as possibly-bad, the same optimism the ledger warns against, one level up.
-
-**Two innocent actions can be guilty together.** Models emit several tool calls per turn. "Read the secret" passes review. "Post to the web" passes review. The pair is an exfiltration channel — so the gate authorizes the *set*, atomically, with the interactions checked, not each element in isolation.
-
-**Sub-agents are just fancy tools.** An agent that spawns another agent is, from the parent's chair, calling a tool: the spawn is gated, the budget is part of the deal, and the child's whole run comes back as one result carrying the child's ledger. Two laws travel down the tree: budgets subdivide, and **authority only narrows** — a child holds at most a subset of its parent's permissions, and a child's request beyond those grants routes *up*, ultimately to the owner, because a parent inventing an approval it never held is the tricked-judge case wearing a manager's badge. A corollary worth framing: a *fully autonomous* run is one whose owner is unreachable — meaning the only channel that can ever widen anything is closed, and its permissions are frozen at launch. That is not a limitation of the theory. That is what the word "autonomous" costs.
-
-**Keep the originals.** When the transcript outgrows the prompt and you summarize it down, deleting the original is an irreversible act against your own state — and irreversible acts are gate decisions, self-directed or not. Keep originals content-addressed; let the summary be an index, re-derivable, auditable. A summary you can check against its source is a note. A summary that replaced its source is a fait accompli.
-
-## Robots that never clock out — and robots that assign their own work
-
-Everything so far assumed a job that *ends*: you ask, the robot does it, you read the result. Two steps past that are where the interesting failures live, and they're the same idea one level bigger each time.
-
-**The robot that never clocks out (a daemon).** A monitor, a coordinator, a service — it isn't supposed to finish; it's supposed to keep going, wake on events, do a bit of work, go back to waiting. The clean way to think about it: each wake-work-rest cycle is one ordinary run, and the daemon is just those runs chained end to end forever. That reframing is free — but it comes with a bill nobody likes. **Safety that's fine per cycle rots over many cycles.** A 99.99%-safe cycle sounds bulletproof; run it ten thousand times and you're at about a coin-flip of having touched the danger zone at least once. So a long-running robot's safety isn't a fixed wall, it's a slow leak — which means the antidote isn't a better wall, it's *scheduled resets*: the owner re-confirming, credentials rotating, memory getting audited and re-summarized against the originals. Housekeeping isn't housekeeping; it's the thing that keeps the safety math from decaying. And the slow-leak logic is exactly where slow attacks live — a poisoned note dropped into memory on Monday and read back into the plan on Friday is an injection with a long fuse. So the trust label on a piece of information has to survive across cycles, not just within one. One more wrinkle: a daemon drifts in and out of your reach. While you're around, it can escalate to you; while you're not, "escalate to the owner" isn't available — so the one thing it must always be able to do instead is *stop*. A robot that can be tricked into refusing everything, and can't reach you, had better be able to halt rather than be steered.
-
-**The robot that assigns its own work (the loop).** Step back one more time. Above the robot that *does* a task sits a system that decides *which task is next* — scans the backlog, picks one, launches the robot at it, checks the result, remembers, fires again. This is the thing people mean in 2026 when they say they've stopped prompting their agents and started writing *loops* that prompt them: you design the assigner once, and it runs the doer for you while you sleep. The honest observation — and the reason this document bothers with it — is that the assigner is *not a new kind of thing*. It's the same harness, one level up: it has its own memory (the backlog), its own gate (**who let the loop refactor the auth module at 3 a.m.?**), its own verifier, and its own two walls. Every rule from the inner robot recurs on the outer one — including the uncomfortable ones. There's still no proof it stays out of trouble over a long night; there's only a measured progress meter, with the same catch that a *learned* meter can be fooled. And the origin story of the whole trend is the cautionary case in miniature: the famous first version was literally the same prompt in a `while` loop until the tests passed — which is the empty gate, the always-open lock, one level up. It works beautifully right up until the tests weren't checking the thing that mattered. The loop doesn't delete the hard problems. It moves them up a floor, where they're bigger and you're further away.
-
-The pattern, if you want the whole thing in one line: *words, context, robot, loop* are four sizes of the same object, and every promise in this document lives in the whole assembled thing — never in any one layer by itself.
-
-## The two walls
-
-Two limits are structural. You don't fix them with a better harness; you design around them.
-
-**The desk.** The model can hold only so much *in mind at once* — the context window. Files, databases, and search extend what it can *look up*, not what it can hold: every lookup still passes through the same small window to touch actual computation. The shell can page; the model cannot grow its desk. Tasks whose irreducible working set exceeds the desk don't fail loudly — they fail by forgetting the middle (the well-documented "lost in the middle" effect is this wall showing through the paint).
-
-**The dictionary.** The model's knowledge is frozen into its parameters at training time — and the proof problem above is conjectured to live at that same scale: the certificate wouldn't fit anywhere smaller than the brain it certifies. The two walls trade against each other along the training-versus-inference axis — bigger dictionary or bigger desk — directionally, and at no clean exchange rate.
-
-## How this could be wrong
-
-This is a hypothesis, and it says out loud what would kill it. The tests, in plain terms:
-
-- **The replay test.** Rerun with model answers and tool results pinned. Any leftover variation — timestamps, wall-clocks, and cache expiries are the classic leaks — falsifies "the harness adds no randomness" until accounted for.
-- **The drop-a-variable test.** Remove something from memory; if behavior statistics shift, the memory wasn't complete. The crash-resume version of the same test: if resuming from saved state breaks, the saved state wasn't the state.
-- **Does the meter mean anything?** If no reasonable progress meter's drift predicts real failures — across the natural families, not just one bad candidate — the whole "measure what you can't prove" program is empty.
-- **The red-team test.** Swap sampled tool outputs for worst-case ones: injected pages, poisoned metadata, malformed replies. The design must survive the worst permitted world, not the average one.
-- **Gates versus begging.** The theory predicts deterministic gating beats prompt-level pleading. If "please be careful" alone matches real gates on security outcomes, the controller-versus-model story is wrong.
-- **The compression hunt.** Exhibit a compact, provably sound progress certificate for a frontier-scale model on a nontrivial task family, and the central conjecture falls — constructively.
-- **The desk probe.** Take a task family with a *proven* memory floor — so "it needed the whole picture at once" is someone else's theorem, not our excuse — scale it past the window, and watch: the wall predicts a *ceiling*, not a cliff — past the boundary, a success rate that stays capped no matter how many retries you buy. A family solved reliably out there, without new shell tricks for splitting the work, kills the wall.
-
-## Who else landed here
-
-The formal document keeps three honesty tiers. **Borrowed**: real theorems, cited — the drift and stopping-time mathematics is classical, and the very architecture of a deterministic supervisor gating a plant it didn't author is 1987 control theory; the shape is older than the web. **Ours**: the modeling choices and the conjectures — the walls, the incompressibility claim, the design rules — organizing principles, not results. **Corroborated**: pieces of the same object reached independently by people who never saw this framing — capability-security work isolating control flow from untrusted data (CaMeL), reinforcement-learning "shields" filtering a learned policy's actions through a deterministic checker, verification work that states the "learned safeguards can't certify" gap as its opening motivation, and architecture patterns converging on plan-then-execute. Even the field's live disagreement — provable-but-rigid deterministic layers versus flexible-but-uncertifiable learned checks — is, in this frame, not a fight but a placement: you need both, on their proper sides of the irreversibility line, with the learned one permitted only to tighten.
-
-## What to remember
-
-The model proposes; the gate disposes. No is the default, and a refusal must be safe. Only the top of the trust hierarchy widens permissions — a human decision, never the model, a tool result, a summary, or a judge. "Didn't confirm" is not "didn't happen." The desk is finite and the proof doesn't compress, so you measure — and you say *measurement* when you mean measurement. A robot that never stops leaks safety slowly, so it needs scheduled resets — and when it can't reach you, it must be able to stop. A loop that runs robots for you is just a bigger robot with the same rules and a further-away owner. And all of it is a hypothesis wearing its own kill-conditions on its sleeve.
-
-The formal version — the objects, the certificates, the falsifiers, the citations — is [HYPOTHESIS.md](HYPOTHESIS.md). It wins every disagreement with this file, including this sentence.
-
-*Same ramblings, fewer symbols.*

QUICKSTART.md

@@ -1,107 +1,92 @@
-# Quickstart
+# Bootstrap Wizard
 
-Install Turnstone, then diagnose it with `turnstone-doctor` if anything looks off.
+Interactive, AI-guided setup for Turnstone deployments. Instead of manually
+editing `.env` files and reading deployment docs, the wizard walks you through
+every decision conversationally and generates all the config files for you.
 
-## Install
-
-The one-line installer autodetects your distro (Ubuntu/Debian, Fedora/RHEL,
-Arch, and WSL), installs git + Docker if missing, generates secrets, picks free
-ports, and starts the stack:
+## Quick Start
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/turnstonelabs/turnstone/main/run.sh | bash
+turnstone-bootstrap
 ```
 
-Re-running is safe — it updates the checkout and keeps your existing `.env`.
-When it finishes it prints the dashboard URL and how to create the first admin
-user.
+That's it — no flags, no arguments. The wizard prompts for everything.
 
-**Other ways to install**
+## How It Works
 
-- **Already have Docker?** Clone the repo and `docker compose up` for the full
-  local cluster, or `docker compose -f turnstone/deploy/compose.yaml up` for the
-  released single-node stack. See [docs/docker.md](docs/docker.md).
-- **Python package:** `pip install turnstone` (add `--pre` for the experimental
-  track), then run `turnstone-server` / `turnstone-console` directly. See the
-  [README](README.md#quickstart).
+1. **Pick a model** — Choose OpenAI, Anthropic, or a local/vLLM endpoint to
+   power the wizard. Local endpoints auto-detect available models.
+2. **Answer questions** — The AI walks you through deployment mode, LLM
+   provider, database, authentication, ports, and optional features.
+3. **Review generated files** — Each file is previewed before writing. You
+   confirm or reject every write.
+4. **Start the stack** — The wizard prints the exact `docker compose` command
+   and a `setup.sh` script to create your first admin user, roles, and policies.
 
-## Diagnose: `turnstone-doctor`
+## What Gets Generated
 
-`turnstone-doctor` is an LLM-backed assistant that inspects a **running**
-Turnstone install and helps you troubleshoot it. It is **read-only** — it
-investigates and tells you the exact commands to fix things, but never changes
-your system. (Installation is the installer's job, not the doctor's.)
-
-```bash
-# From a host that has the turnstone package installed:
-turnstone-doctor
-
-# For a Docker install from run.sh (no package on the host), run it with pipx:
-pipx run --spec turnstone turnstone-doctor --dir ~/turnstone
-```
-
-### What it does
-
-1. **Preflight** — detects how Turnstone is installed here (docker-compose,
-   systemd/bare-metal, pip, or a source checkout) by probing for `config.toml`
-   files, `TURNSTONE_*` environment variables, compose files, and systemd units.
-2. **Self-configures its LLM** — it powers its own brain from your cluster's
-   *own* model configuration (env / `config.toml` / the database). Whether that
-   works is the first diagnostic: success means your LLM backend is healthy; if
-   it can't, that's surfaced as finding #1 and it falls back to asking you for a
-   provider and key so it can still help.
-3. **Version check** — reports the installed version, version drift across your
-   cluster's nodes, and the latest upstream stable/experimental releases.
-4. **Interactive diagnosis** — it reads logs, `/health`, `docker compose ps`,
-   `systemctl`, config, and ports to pin down problems like a node not joining
-   the console, an unreachable database, a down model backend, port conflicts,
-   or a JWT-secret mismatch — then hands you the precise remediation commands.
-
-### Flags
-
-| Flag | Purpose |
+| File | Purpose |
 |------|---------|
-| `--dir PATH` | Install directory to inspect (default: current directory) |
-| `--report` | Print the deterministic preflight report and exit — no LLM key needed |
-| `--offline` | Skip the upstream GitHub version check |
+| `.env` | All environment variables for `compose.yaml` |
+| `setup.sh` | Post-start script: creates admin user, roles, tool policies, prompt templates via the API |
+| `docker-compose.override.yaml` | Only if customizations beyond env vars are needed |
 
-`--report` is the fastest way to get a health snapshot (and to share one when
-asking for help) — it never needs an API key:
+## Requirements
 
-```bash
-turnstone-doctor --report --dir ~/turnstone
-```
+- **Python 3.11+** with turnstone installed (`pip install turnstone`)
+- **An LLM API key** — for the wizard itself (OpenAI, Anthropic, or a local
+  model). This can differ from the LLM your deployment will use.
+- **Docker & Docker Compose** — needed to run the stack. The wizard detects
+  whether Docker is installed and gives platform-specific install instructions
+  if it's missing. You can still generate config files without Docker.
+
+## Deployment Modes
+
+- **Single-node production** — `docker compose up` against the bundled
+  `turnstone/deploy/compose.yaml`: 1 server + console + channel + PostgreSQL,
+  pulled from ghcr.io. Good for most deployments.
+- **Local multi-node cluster** — clone the repo and run `docker compose up` at
+  the root for a 10-node fleet + console + Caddy + channel, built locally.
+
+See [docs/docker.md](docs/docker.md) for both.
+
+## Example Session
 
 ```
-## Install profile
-- Detected kind(s): docker-compose  (primary: docker-compose)
-- Docker daemon reachable: yes
-- Compose files:
-    /home/you/turnstone/compose.yaml
-- Database: backend=postgresql, url=postgresql+psycopg://turnstone:****@postgres:5432/turnstone
-- Candidate health URLs: http://localhost:8080/health, http://localhost:8090/health
+$ turnstone-bootstrap
 
-## Versions
-- Installed (this tool): 1.7.0a2
-- Cluster nodes: 10 reporting; versions ['1.7.0a2']
-- Version drift across nodes: no
-- Upstream: stable 1.6.9, experimental 1.7.0a2
+ Turnstone Bootstrap Wizard  v1.5.0
+ ────────────────────────────────────────────────
 
-## LLM backend (ok)
-- resolved Qwen/Qwen3-32B via openai-compatible @ http://host.docker.internal:8000/v1
+ Which provider for this wizard?
+   [1] OpenAI
+   [2] Anthropic
+   [3] OpenAI-compatible (local/vLLM)
+
+ > 3
+
+ Base URL [http://localhost:8000/v1]:
+ API key (press Enter for 'none'):
+
+ Querying http://localhost:8000/v1 for available models...
+ Found model: Qwen/Qwen3-32B
+
+ Connected to Qwen/Qwen3-32B. Handing off to AI assistant...
+
+> (AI walks you through the rest interactively)
 ```
 
-Secrets (JWT secret, database password, API keys) are always redacted in the
-report and in anything the doctor reads.
-
 ## Tips
 
-- **Type `quit`** to exit the conversation; **Ctrl+C** interrupts (twice to quit).
-- **Point it at the right install** with `--dir` when you run it from elsewhere.
-- **(Re)installing or adding nodes?** Use the installer (`run.sh`), not the doctor.
+- **Re-run safely** — running the wizard again detects your existing `.env`
+  and offers to update it rather than overwriting.
+- **Duplicate writes are skipped** — if the LLM tries to write the same file
+  twice with identical content, it's silently ignored.
+- **Type `quit` to exit** at any time during the conversation.
+- **Ctrl+C** is handled gracefully — press once to interrupt, twice to exit.
 
 ## See Also
 
-- [Docker Deployment](docs/docker.md) — compose stacks, ports, and bare-metal nodes
+- [Docker Deployment](docs/docker.md) — manual compose setup and profiles
 - [Security](docs/security.md) — auth architecture and token types
 - [Governance](docs/governance.md) — roles, policies, and templates

README.md

@@ -5,7 +5,6 @@
 [![Python](https://img.shields.io/pypi/pyversions/turnstone)](https://pypi.org/project/turnstone/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![Discord](https://img.shields.io/badge/Discord-join%20us-5865F2?logo=discord&logoColor=white)](https://discord.gg/Nh3bWMacaq)
-[![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-db61a2?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/eous)
 
 Self-hosted, local-first orchestration for tool-using AI agents. Give LLMs real tools — shell, files, search, web — and run them across your own cluster with direct HTTP routing and interactive interfaces. Your code, your models, your data stay on hardware you control: no telemetry, no phone-home.
 
@@ -15,14 +14,6 @@ Self-hosted, local-first orchestration for tool-using AI agents. Give LLMs real
 
 Named after the [Ruddy Turnstone](https://en.wikipedia.org/wiki/Ruddy_turnstone) (*Arenaria interpres*) — a shorebird that flips stones to discover what's hiding underneath.
 
-**What is a harness?**
-
-```
-ℋ :  s_{n+1} ~ T(s_n)   for n < τ*,    T = ρ ∘ (M_W ∘ π, E)
-```
-
-[**the primer →**](PRIMER.md)
-
 ### Release Tracks
 
 | Track | Install | Docker | Description |
@@ -36,7 +27,7 @@ See [docs/releasing.md](docs/releasing.md) for the full release process.
 
 Turnstone gives LLMs tools — shell, files, search, web, planning — and orchestrates multi-turn conversations where the model investigates, acts, and reports.
 
-- **Local-first & private** — runs entirely on hardware you control, with no telemetry and no phone-home. Point it at local models (vLLM, llama.cpp) or commercial APIs you hold the keys to — your prompts and data never transit a third party you didn't choose.
+- **Local-first & private** — runs entirely on hardware you control, with no telemetry and no phone-home. Point it at local models (vLLM, llama.cpp, Ollama) or commercial APIs you hold the keys to — your prompts and data never transit a third party you didn't choose.
 - **Bring your own models** — OpenAI-compatible APIs (vLLM, llama.cpp, NIM), the Anthropic Messages API, and Google Gemini, mixed freely per role
 - **Interactive sessions** — terminal CLI or browser UI with parallel workstreams
 - **Cluster dashboard** — real-time view of every node and workstream, with a rendezvous routing proxy
@@ -95,7 +86,7 @@ LLM; add model backends from the console UI.
 For production (released images from ghcr.io, real secrets required), use the
 bundled stack: `docker compose -f turnstone/deploy/compose.yaml up`.
 
-See [QUICKSTART.md](QUICKSTART.md) for the install + troubleshooting walkthrough and [docs/docker.md](docs/docker.md) for Docker configuration.
+See [QUICKSTART.md](QUICKSTART.md) for the bootstrap wizard and [docs/docker.md](docs/docker.md) for Docker configuration.
 
 ### Programmatic (SDK)
 
@@ -125,9 +116,8 @@ Built-in tools for shell, files, search, web, memory, notifications, and autonom
 | `turnstone-console` | Cluster dashboard + routing proxy + admin panel |
 | `turnstone-channel` | Channel gateway (Discord and Slack adapters) |
 | `turnstone-admin` | User/token management CLI |
-| `turnstone-eval` | Headless measurement — scores tool-use against expected actions |
-| `turnstone-optimizer` | Prompt/tool optimizer (UCB self-modify loop over the eval substrate) |
-| `turnstone-doctor` | LLM-backed cluster diagnostics |
+| `turnstone-eval` | Eval harness for prompt/tool optimization |
+| `turnstone-bootstrap` | LLM-guided setup wizard |
 
 ### Diagrams
 
@@ -172,14 +162,6 @@ UML diagrams in [`docs/diagrams/`](docs/diagrams/):
 - Optional: Discord / Slack channel integrations (`pip install turnstone[discord,slack]`)
 - [Git LFS](https://git-lfs.com/) for cloning (diagram PNGs)
 
-## Support
-
-Turnstone is free, Apache-2.0, and self-hosted — no paid tier, no telemetry, no upsell. If it saves you time or you'd like to help keep development moving, you can sponsor the project:
-
-**[❤ Sponsor Turnstone →](https://github.com/sponsors/eous)**  ·  one-off via **[PayPal](https://paypal.me/eousphoros)**
-
-Sponsorship is entirely optional and funds maintenance, new features, and infrastructure. Prefer to contribute in other ways? Filing issues, improving docs, and [pull requests](CONTRIBUTING.md) help just as much.
-
 ## Community
 
 Questions, ideas, or want to show what you're building? Join us on Discord:

docs/api-reference.md

@@ -458,7 +458,7 @@ Each item in `items` (shared by `tool_info` and `approve_request`):
 | `context_window`         | int    | Total context window size in tokens                  |
 | `pct`                    | float  | Percentage of context window used                    |
 | `effort`                 | string | Reasoning effort level (`low`/`medium`/`high`)       |
-| `cache_creation_tokens`  | int    | Tokens written to prompt cache (Anthropic + OpenAI)  |
+| `cache_creation_tokens`  | int    | Tokens written to prompt cache (Anthropic)           |
 | `cache_read_tokens`      | int    | Tokens served from prompt cache (Anthropic + OpenAI) |
 
 **`info`** -- an informational message (e.g. command output).
@@ -698,42 +698,6 @@ Each skill summary:
 
 ---
 
-### `GET /v1/api/personas`
-
-Returns the enabled personas offered by the workstream-creation pickers.
-Authenticated for any logged-in user and deliberately gated by **no**
-`persona.*` permission — selecting a persona at creation is a user
-action, while the `persona.*` perms gate authoring. Display fields only;
-the levers (base prompt, tool set, MCP/memory toggles) stay server-side.
-
-**Response:**
-
-```json
-{
-  "personas": [
-    {"name": "engineer", "display_name": "Engineer", "description": "The stock interactive workstream: full tools, MCP, and memory.", "applies_to_kinds": ["interactive"], "is_default": true},
-    {"name": "researcher", "display_name": "Researcher", "description": "Answers questions with evidence — reads and cites, loads tools to verify when needed.", "applies_to_kinds": ["interactive"], "is_default": false}
-  ],
-  "total": 2
-}
-```
-
-Each persona summary:
-
-| Field              | Type   | Description                                                      |
-|--------------------|--------|------------------------------------------------------------------|
-| `name`             | string | Persona slug (used in the `persona` field on workstream creation) |
-| `display_name`     | string | Human-readable label for pickers                                 |
-| `description`      | string | Short description of the persona's intent                        |
-| `applies_to_kinds` | array  | Workstream kinds the persona applies to (`interactive` / `coordinator`) |
-| `is_default`       | bool   | Whether this is the default persona for its kind                 |
-
-> **Note:** For full persona management (create, edit, archive), use the
-> admin endpoints at `/v1/api/admin/personas` (requires the
-> `persona.{create,read,write}` permissions).
-
----
-
 ### `POST /v1/api/workstreams/{ws_id}/send`
 
 Sends a user message to a workstream. Spawns a daemon worker thread that calls
@@ -931,7 +895,6 @@ All fields are optional. The body can be empty or an empty JSON object.
 | `auto_approve`   | bool   | false   | Auto-approve all tool calls for this workstream                |
 | `resume_ws`      | string | ""      | Workstream ID to resume atomically during creation (empty = fresh)|
 | `skill`          | string | ""      | Skill name. Applies content (system prompt), model, temperature, reasoning effort, max tokens, auto-approve policy, token budget, and other session config from the skill. Returns 400 if not found or disabled. Ignored when `resume_ws` is set (resumed sessions restore their own skill). |
-| `persona`        | string | ""      | Persona slug. Resolved and snapshotted into the workstream at creation; empty selects the kind's default. |
 | `judge_model`    | string | ""      | Optional model alias for the judge (overrides default judge model for this workstream) |
 
 > **Skill behavior:** When `skill` is specified, the skill's content is injected as a system message and its session config fields (model, temperature, auto-approve, token budget, etc.) override system defaults for the new workstream.
@@ -948,7 +911,6 @@ All fields are optional. The body can be empty or an empty JSON object.
 | `name`          | string | Auto-generated workstream name                      |
 | `resumed`       | bool   | Whether a previous session was successfully resumed |
 | `message_count` | int    | Number of messages in the resumed session (0 if fresh) |
-| `initial_message_status` | string | Present ONLY when the workstream was created but its `initial_message` could not be delivered: `"queue_full"` (a raced live worker's interjection queue was at capacity — resend via `/send`; any uploads stay staged) or `"refused_closed"` (the workstream was closed mid-create). Absent whenever the message was dispatched. |
 
 **Error (limit reached):**
 

docs/architecture.md

@@ -19,11 +19,10 @@ plugs in.
 | `turnstone` | `turnstone.cli` | `TerminalUI` | Interactive terminal REPL |
 | `turnstone-server` | `turnstone.server` | `WebUI` | Browser-based chat (HTTP + SSE) |
 | `turnstone-console` | `turnstone.console.server` | ClusterCollector | Cluster dashboard (aggregates all nodes) |
-| `turnstone-eval` | `turnstone.eval.cli` | `NullUI` | Headless measurement (scores tool-use against expected actions) |
-| `turnstone-optimizer` | `turnstone.optimizer` | `NullUI` | Prompt/tool optimization (UCB self-modify loop over the eval substrate) |
+| `turnstone-eval` | `turnstone.eval` | `NullUI` | Headless evaluation and prompt optimization |
 | `turnstone-channel` | `turnstone.channels.cli` | ChannelAdapter | Channel gateway (Discord, Slack, etc.) |
 | `turnstone-admin` | `turnstone.admin` | — | Offline user and API token management |
-| `turnstone-doctor` | `turnstone.doctor` | — | LLM-backed cluster diagnostics |
+| `turnstone-bootstrap` | `turnstone.bootstrap` | — | LLM-guided setup wizard |
 
 ---
 
@@ -268,7 +267,7 @@ the per-workstream events stream in
 |-------|--------|-------|
 | `TerminalUI` | `turnstone.cli` | ANSI colors, `MarkdownRenderer`, `Spinner`, readline-based `input()` for approval |
 | `WebUI` | `turnstone.server` | SSE event queue per workstream + global broadcast, `threading.Event` for blocking on approval. `on_state_change` sends to both per-workstream and global SSE (the browser UI uses per-workstream `state_change` events to manage busy/idle transitions; `stream_end` only finalizes markdown rendering). |
-| `NullUI` | `turnstone.eval.core` | Discards all output; `approve_tools` always returns `(True, None)` |
+| `NullUI` | `turnstone.eval` | Discards all output; `approve_tools` always returns `(True, None)` |
 
 ### WorkstreamTerminalUI
 
@@ -622,30 +621,20 @@ LLMProvider (protocol)
 |------|--------|
 | `StreamChunk` | `content_delta`, `reasoning_delta`, `tool_call_deltas`, `info_delta`, `usage`, `finish_reason`, `provider_blocks` |
 | `CompletionResult` | `content`, `tool_calls`, `finish_reason`, `usage`, `provider_blocks` |
-| `ModelCapabilities` | `context_window`, `max_output_tokens`, `supports_temperature`, `token_param`, `thinking_mode`, `supports_effort`, `supports_web_search`, `supports_tool_search`, `supports_vision`, `supports_reasoning_replay`, `supports_verbosity`, `verbosity`, `supports_pro_mode`, `reasoning_mode` |
+| `ModelCapabilities` | `context_window`, `max_output_tokens`, `supports_temperature`, `token_param`, `thinking_mode`, `supports_effort`, `supports_web_search`, `supports_tool_search`, `supports_vision`, `supports_reasoning_replay` |
 | `UsageInfo` | `prompt_tokens`, `completion_tokens`, `total_tokens`, `cache_creation_tokens`, `cache_read_tokens` |
 
 **OpenAIProvider** (`_openai.py`): passes messages through unchanged (they are
 already in OpenAI format), including multi-part content blocks (text + images)
-in tool results. Model capability lookup covers GPT-5 through GPT-5.6,
+in tool results. Model capability lookup table covers GPT-5/5.1/5.2/5.3/5.4,
 O-series, and search models (`gpt-5-search-api`) — all with `supports_vision`.
 For search models, injects `web_search_options` and removes the `web_search`
 function tool (the model always searches). Citations from `url_citation`
-annotations are formatted as footnotes. Pre-5.6 GPT-5 models request extended
-prompt-cache retention (`prompt_cache_retention: "24h"`); GPT-5.6 uses
-`prompt_cache_options.ttl: "30m"`. Cache reads and writes are extracted from
-`cached_tokens` and `cache_write_tokens`. Unknown models get permissive
-defaults with `supports_vision=False` and use SearxNG for web search. The
-`openai-compatible` lane never consults this table at all — on either API
-surface (the responses pin is served by a compat-mode
-`OpenAIResponsesProvider`, mirroring `AnthropicProvider(compat=True)`): a
-local server serves whatever the operator named it (vLLM
-`--served-model-name` is a free string), so a prefix collision with a cloud
-model id must not inherit that model's sampling/effort contract — every
-local model gets the plain defaults, commercial prompt-cache controls are not
-injected by model-name prefix, and anything beyond those defaults is declared
-on the model definition (capabilities JSON + `server_compat`), matching the
-`anthropic-compatible` lane.
+annotations are formatted as footnotes. Extended prompt cache retention
+(`prompt_cache_retention: "24h"`) is enabled for GPT-5.x models at no
+additional cost. Cached token counts are extracted from
+`usage.prompt_tokens_details.cached_tokens`. Unknown models (local servers) get
+permissive defaults with `supports_vision=False` and use SearxNG for web search.
 
 **AnthropicProvider** (`_anthropic.py`): converts OpenAI-format messages to
 Anthropic content blocks, maps `system`/`developer` roles to the `system`
@@ -808,105 +797,15 @@ model = "deepseek-ai/DeepSeek-V4-Flash"
 supports_vision = true                    # multimodal checkpoints only
 supports_mid_conversation_system = true   # template-dependent
 context_window = 131072
-thinking_mode = "manual"                  # session effort knob drives the template toggle
-thinking_param = "enable_thinking"        # Qwen/Gemma key; "thinking" for Granite/DeepSeek
 ```
 
-Reasoning control does NOT use Anthropic's `thinking` request param —
-the levers live in the chat template, reached through
-`chat_template_kwargs` in the request body. Two channels, dynamic first:
-
-* **Session effort knob (dynamic).** Set the model's thinking mode to
-  "Effort-knob controlled" in the admin Models form (or
-  `thinking_mode = "manual"` + `thinking_param` under
-  `[models.*.capabilities]`) and the provider maps the session's
-  reasoning-effort knob onto the template toggle per-request: effort
-  `none` sends `{<thinking_param>: false}`, any other level sends
-  `true` — the same contract as the real lane's manual mode. ("Always
-  on" / `thinking_mode = "adaptive"` instead always sends `true`: the
-  model self-regulates, so the knob never force-disables — mirroring
-  the native adaptive branch.) The graded effort value always rides
-  alongside the toggle: under `effort_param` when the operator names
-  the template's key, else under the conventional fallback key
-  (`reasoning_effort`) on the anthropic-compatible lane — the user's
-  effort setting always reaches the wire, and a template that doesn't
-  reference the kwarg ignores it. On the openai-compatible lane the
-  undeclared-key case rides the flat top-level `reasoning_effort`
-  param instead (the documented compat field), forwarded verbatim.
-  Optional `reasoning_effort_values` / `default_reasoning_effort`
-  validate the knob before it reaches the server; without declared
-  values the knob is forwarded as-is. The knob is ordinal, and validation
-  respects that: an off-list knob value rounds UP onto the declared
-  list and a value above the ceiling rides the ceiling
-  (`snap_reasoning_effort`) — asking for more effort than the model
-  declares never falls back to a lower default tier.  The knob's
-  `none` position is forwarded verbatim when the model declares an
-  explicit `none` level (gpt-5.1+, grok-4.3) — omitting it there would
-  leave a reasoning-on server default (e.g. gpt-5.5's `medium`) in
-  charge of a knob that promises off — and omitted otherwise; `none`
-  is never a snap target for other positions.
-  `default_reasoning_effort` only catches values the ordinal snap
-  cannot rank (custom strings). Declare values that match the
-  template's documented vocabulary: for DeepSeek-V4, which officially
-  accepts `high`/`max` (Think High is the default thinking tier;
-  `low`/`medium` alias to `high`, `xhigh` to `max`), a
-  `("high", "max")` values list reproduces the official aliasing
-  exactly — `low`/`medium` round up to `high`, `xhigh` to `max` —
-  and freeform passthrough matches it too. To map an undocumented
-  template, probe with per-request `chat_template_kwargs` and compare
-  `input_tokens`. Setting `effort_param` also suppresses the
-  flat top-level `reasoning_effort` request param on the
-  openai-compatible lane — the template channel replaces it, never
-  doubles it. With the default `thinking_mode = "none"` nothing is
-  injected and the server's template default decides.
-
-  Upgrade note: before 1.7.0a7 the openai-compatible lane sent the
-  toggle unconditionally `true` whenever thinking mode was enabled. A
-  stored per-model `reasoning_effort = "none"` now disables thinking
-  on such models — pick any real level (or clear the override) to keep
-  it on. Also since 1.7.0a7 the effort level itself always reaches the
-  wire on the local lanes (previously dropped unless
-  `reasoning_effort_values` was declared): flat `reasoning_effort` on
-  openai-compatible, the `effort_param`-or-fallback template key on
-  anthropic-compatible when reasoning control is engaged.
-* **Operator pin (static).** Entries under `{"chat_template_kwargs":
-  ...}` in the admin Models extra-body field ride the SDK's
-  `extra_body` unconditionally and win over the knob mapping on key
-  collision — e.g. pin `{"enable_thinking": true}` to keep thinking on
-  regardless of the session knob. (Server type and API surface remain
-  openai-compatible-only knobs and stay hidden for this provider.)
-
-The same knob mapping drives the `openai-compatible` lane's Chat
-Completions requests — `merge_reasoning_template_kwargs` is shared by
-both local-server lanes, so `thinking_mode`/`thinking_param`/
-`effort_param` mean the same thing whichever endpoint serves the model.
-Only the Responses API surface (native reasoning) ignores it.
-
-The console surfaces this projection as an *effective effort ladder*:
-the admin model form's per-model effort select and the skill
-launch-config effort select annotate each position with what the
-request will carry, in plain words — a position whose delivered level
-matches its name stays plain ("Max"), a snapped position says so
-("Low — sends high"), the adaptive lanes' none position warns
-"thinking stays on", and budget detail lives in the tooltip. A
-position is never labeled after a sibling that shares its wire (that
-rendered "Max (= minimal)", implying a downgrade the wire doesn't
-contain). Computed server-side by `providers/effort_ladder.py` from
-the same mapping functions the providers use at request time and
-shipped on `/v1/api/models` rows (every row carries `effort_ladder`,
-empty when the capabilities column fails to parse) and
-`POST /v1/api/admin/models/effort-ladder`. The ladder describes what
-Turnstone sends — a server-side template may alias further (DeepSeek-V4
-folds `low`/`medium` into its default `high` tier).
-
-The `anthropic-compatible` lane never sends Anthropic's native
-`thinking`/`output_config` params — they are not in vLLM's request
-schema. The real `anthropic` provider is unaffected: official Claude
-models keep native thinking, budget mapping, and `output_config`
-effort. A gateway fronting *real* Claude on a Messages-shaped URL
-(e.g. a LiteLLM `anthropic/` route to the Claude API) should use
-`provider = "anthropic"` with a custom `base_url`, which keeps the
-native thinking params.
+The reasoning toggle does NOT use Anthropic's `thinking` request param.
+Toggle it through the chat template instead: set `{"chat_template_kwargs":
+{"thinking": false}}` as extra body params in the admin Models
+server-compat section (for this provider the section shows only the
+extra-body field — server type, API surface, and thinking mode are
+openai-compatible-only knobs); the provider forwards it via the SDK's
+`extra_body`.
 
 Verified quirks of vLLM's Anthropic endpoint:
 
@@ -1118,10 +1017,9 @@ reconstructs the OpenAI message format from database rows:
   in the same workstream
 
 **Config persistence:** LLM-affecting parameters (`temperature`,
-`reasoning_effort`, `max_tokens`, `instructions`, and the persona
-snapshot — see `docs/personas.md`) are persisted to the
-`workstream_config` table on creation and whenever changed via slash
-commands. `resume()` restores these values so resumed workstreams
+`reasoning_effort`, `max_tokens`, `instructions`, `creative_mode`) are
+persisted to the `workstream_config` table on creation and whenever changed
+via slash commands. `resume()` restores these values so resumed workstreams
 behave identically to the original.
 
 **`/clear` vs `/new`:** `/clear` wipes in-memory context but preserves

docs/bulk-endpoints.md

@@ -12,6 +12,7 @@ Existing bulk endpoints at time of writing:
 |---------------------------------------------------------|--------------------------|------------------------------------------|
 | `GET  /v1/api/cluster/ws/live?ids=a,b,c`                | bulk read                | `{results, denied, truncated}`           |
 | model tool `spawn_batch`                                 | bulk create (per-item)   | `{results, denied}`                      |
+| `POST /v1/api/workstreams/{ws_id}/stop_cascade`          | cascade mutation         | `{cancelled, failed, skipped}`           |
 | `POST /v1/api/workstreams/{ws_id}/close_all_children`    | cascade mutation         | `{closed, failed, skipped}`              |
 
 ---
@@ -145,7 +146,7 @@ consistently-typed across the read and create cases.
 ```
 
 Where `<bucket>` is the endpoint-specific name for "succeeded" —
-`closed` for `close_all_children`.
+`cancelled` for `stop_cascade`, `closed` for `close_all_children`.
 The three buckets partition the input set exactly once:
 
 | Bucket        | Meaning                                                                       |
@@ -160,6 +161,20 @@ be partial.  `skipped` is pre-resolved — the target is already in
 the terminal state the cascade was aiming at, so it's neither a
 win to report nor a fault to fix.
 
+### Example — `stop_cascade`
+
+```json
+{
+  "status": "ok",
+  "cancelled": ["child-1", "child-3"],
+  "failed":    [],
+  "skipped":   ["child-2"]
+}
+```
+
+A subsequent retry would target only `failed` ids, not `skipped`
+ones — the latter are already done.
+
 ### Example — `close_all_children`
 
 ```json
@@ -171,12 +186,10 @@ win to report nor a fault to fix.
 }
 ```
 
-Here the success bucket is `closed`.  A subsequent retry would
-target only `failed` ids, not `skipped` ones — the latter are
-already done.  When `coord_client` is unavailable (session loaded
-but no HTTP client attached — a construction bug) every id goes to
-`failed` so the operator notices rather than getting a silent
-all-skipped response.
+Same partition, different success-bucket name.  When `coord_client`
+is unavailable (session loaded but no HTTP client attached — a
+construction bug) every id goes to `failed` so the operator notices
+rather than getting a silent all-skipped response.
 
 ---
 
@@ -219,12 +232,12 @@ all-skipped response.
 
 - **Phase 6** shipped `cluster/ws/live` as the first Shape A endpoint
   (`{results, denied, truncated}`).
-- **Phase 7** introduced the Shape B cascade-mutation envelope
-  (`{<bucket>, failed, skipped}`) for the coordinator's
-  cancel-cascade path.
+- **Phase 7** shipped `stop_cascade` as the first Shape B endpoint
+  (`{cancelled, failed, skipped}`).
 - **Phase 8 PR A** shipped `spawn_batch` (Shape A, keyed by idx) and
-  `close_all_children` (Shape B), which crystallised the
-  two-shape-per-semantic-category policy codified here.
+  `close_all_children` (Shape B, twin of `stop_cascade`), which
+  crystallised the two-shape-per-semantic-category policy codified
+  here.
 
 Before adding a third shape, read this doc and argue for why the
 new surface doesn't fit either A or B.  Two idioms in the cluster

docs/console.md

@@ -379,7 +379,6 @@ Breadcrumb: `Cluster > Running` or `Cluster > db-west-04`. Server-side paginated
 Triggered by the "+ new" header button. A modal dialog with:
 
 - **Node selector** — dropdown with three targeting modes: "Auto (best available)" picks the node with the most headroom, "General pool (any node)" picks a node with available capacity using round-robin, or a specific node from the list (showing capacity).
-- **Persona** — optional dropdown listing the enabled personas for the workstream kind. Sets the system-message composition and capability envelope at creation, snapshotted server-side; empty uses the kind's default. Picking one requires no `persona.*` permission.
 - **Profile** — optional dropdown listing enabled skills. Applies the skill's model, auto-approve policy, token budget, and other behavioral settings at creation time.
 - **Name** — optional text input. Auto-generated if left empty.
 - **Model** — optional text input for a model alias from the target node's registry.
@@ -397,9 +396,9 @@ The browser maintains a local `clusterState` object that mirrors the cluster sna
 
 Accessed via the "admin" button in the header (visible when authenticated
 with `approve` scope). Provides user, API token, channel link, MCP server,
-and skill management with tabs that include Users, API Tokens, Channels,
-Schedules, Watches, Personas, Roles, Policies, Prompts, Judge, Skills,
-MCP Servers, Usage, Audit, Memories, Models, Nodes, Settings, and TLS.  See also
+and skill management with 18 tabs (Users, API Tokens, Channels, Schedules,
+Watches, Roles, Policies, Prompts, Judge, Skills, MCP Servers, Usage,
+Audit, Memories, Models, Nodes, Settings, TLS).  See also
 [Governance](governance.md) for the Roles, Policies, Skills, Usage, and
 Audit tabs, and [Settings](settings.md) for the database-backed
 configuration editor.

docs/coordinator-api-tour.md

@@ -18,7 +18,7 @@ schema changes.
 > auth and the `admin.coordinator` permission.  A session-scoped JWT
 > is minted per login (see [docs/oidc.md](oidc.md) / [docs/security.md](security.md));
 > a service token may call the read paths but destructive governance
-> paths (`/restrict`, `/close_all_children`) require
+> paths (`/restrict`, `/stop_cascade`, `/close_all_children`) require
 > the explicit `admin.coordinator` grant — a service-token owner
 > match isn't enough.
 
@@ -44,6 +44,7 @@ schema changes.
 | 6 | Wait for fan-out             | model-side tool `wait_for_workstream`                       |
 | 7 | Govern                       | `POST /v1/api/workstreams/{ws_id}/trust`                    |
 |   |                              | `POST /v1/api/workstreams/{ws_id}/restrict`                 |
+|   |                              | `POST /v1/api/workstreams/{ws_id}/stop_cascade`             |
 |   |                              | `POST /v1/api/workstreams/{ws_id}/close_all_children`       |
 | 8 | Approve / cancel             | `POST /v1/api/workstreams/{ws_id}/approve`                  |
 |   |                              | `POST /v1/api/workstreams/{ws_id}/cancel`                   |
@@ -52,7 +53,7 @@ schema changes.
 Refer to `/openapi.json` (Swagger UI at `/docs`) on any
 `turnstone-console` process for the authoritative operation ids and
 schemas. Coordinator-only verbs (`/children`, `/trust`, `/restrict`,
-`/close_all_children`) 404 against `kind=interactive`
+`/stop_cascade`, `/close_all_children`) 404 against `kind=interactive`
 rows; the shared verbs (`/send`, `/approve`, `/cancel`, `/events`,
 `/history`, `/open`, `/close`, etc.) work on both kinds.
 
@@ -260,10 +261,10 @@ rounds to a 10× token-efficiency win.
 
 ---
 
-## 7. Governance — trust, restrict, close_all_children
+## 7. Governance — trust, restrict, stop_cascade, close_all_children
 
-These three endpoints let an operator steer a live coordinator session
-mid-flight.  All three emit an audit event tagged
+These four endpoints let an operator steer a live coordinator session
+mid-flight.  All four emit an audit event tagged
 `coordinator.<action>` via the dedicated audit executor so a cascade
 burst can't starve audit writes.
 
@@ -293,6 +294,28 @@ idempotent — calling twice with overlapping lists converges to the
 union.  Revocations don't survive a session close/reopen; operators
 opt in per session.  Cap 256 tool names per request, 128 chars each.
 
+### `POST /stop_cascade` — cancel the subtree
+
+```http
+POST /v1/api/workstreams/{ws_id}/stop_cascade
+{}
+```
+
+Cancels the coordinator's in-flight generation AND dispatches
+`cancel_workstream` through the routing proxy for every direct
+child in the in-memory registry.  Returns:
+
+```json
+{"status": "ok", "cancelled": ["child-1", "child-3"], "failed": [], "skipped": ["child-2"]}
+```
+
+Response uses the [cascade-mutation bulk shape](bulk-endpoints.md):
+`cancelled` = accepted, `failed` = dispatch error worth retrying,
+`skipped` = upstream 404 (already gone — stale registry entry or
+the row was deleted between snapshot and dispatch).  Grandchildren
+aren't touched directly; they sit behind their parent's cancel and
+propagate via the child's SSE stream.
+
 ### `POST /close_all_children` — soft-close the direct fan-out
 
 ```http
@@ -306,16 +329,16 @@ Response:
 {"status": "ok", "closed": ["c-1", "c-2"], "failed": [], "skipped": []}
 ```
 
-Soft-close cascade bounded by a concurrency semaphore.  The `reason`
-(up to 512 chars) propagates into each closed child's audit +
-`workstream_config` for postmortem.  The model-facing tool that
-pairs with this endpoint asks for a bounded teardown of the
-coordinator's own fan-out.  This *soft-closes*; to *cancel* the
-fan-out instead, cancel the coordinator (§8) — a coordinator cancel
-auto-cascades to its direct children.
+Soft-close cascade bounded by the same semaphore as `stop_cascade`.
+The `reason` (up to 512 chars) propagates into each closed child's
+audit + `workstream_config` for postmortem.  Unlike `stop_cascade`
+this does NOT recurse into grandchildren — the model-facing tool
+that pairs with this endpoint asks for a bounded teardown of the
+coordinator's own fan-out.  For a full-subtree teardown, use
+`stop_cascade`.
 
-See [bulk-endpoints.md](bulk-endpoints.md) for why `close_all_children`
-uses the cascade-mutation shape and how it differs from the
+See [bulk-endpoints.md](bulk-endpoints.md) for why both endpoints
+share the cascade-mutation shape and how it differs from the
 `spawn_batch` / `cluster/ws/live` shape.
 
 ---
@@ -333,10 +356,7 @@ POST /v1/api/workstreams/{ws_id}/approve
 {"approved": true, "feedback": null, "always": true}    // always-approve this tool name
 ```
 
-`cancel` drops the coordinator's in-flight generation and, for a
-coordinator, auto-cascades the cancel to its direct children:
-`cancel_workstream` is dispatched through the routing proxy for
-every direct child in the registry.  The coordinator itself is left
+`cancel` drops the in-flight generation but leaves the coordinator
 idle and open for a fresh `send`:
 
 ```http
@@ -353,10 +373,9 @@ POST /v1/api/workstreams/{ws_id}/close
 {}
 ```
 
-Soft-closes the session — state persists, children keep running
-(wind them down first with `close_all_children`, or by cancelling
-the coordinator, which cascades the cancel to its direct children),
-the worker thread exits, SSE streams send a final `stream_end` and
+Soft-closes the session — state persists, children keep running (use
+`close_all_children` or `stop_cascade` first to wind them down), the
+worker thread exits, SSE streams send a final `stream_end` and
 disconnect.  The row is reopenable via
 `POST /v1/api/workstreams/{ws_id}/open` so long as it hasn't been
 deleted.
@@ -366,12 +385,12 @@ deleted.
 ## Further reading
 
 - [coordinator-skills.md](coordinator-skills.md) — writing a skill
-  that runs on a coordinator session (orchestrator framing,
+  that runs on a coordinator session (orchestrator persona,
   workflow patterns, `SkillKind` classifier).
 - [bulk-endpoints.md](bulk-endpoints.md) — the two bulk-shape
   idioms (`{results, denied, truncated}` vs
   `{<bucket>, failed, skipped}`) used by `cluster/ws/live`,
-  `spawn_batch`, and `close_all_children`.
+  `spawn_batch`, `stop_cascade`, and `close_all_children`.
 - [architecture.md](architecture.md) — cluster-wide architecture
   including how coordinator sessions fit next to node-hosted
   interactive workstreams.

docs/coordinator-skills.md

@@ -1,13 +1,13 @@
 # Writing a coordinator-specific skill
 
-A skill is prompt-level framing that steers a Turnstone session
+Skills are prompt-level personas that steer a Turnstone session
 toward a narrow task.  Most skills target **interactive** sessions —
 the single-workstream "do this thing" surface where the model wields
 `bash`, `edit_file`, `web_fetch`, and the rest of the maker toolset.
 
 A **coordinator skill** is different.  It runs on a session whose job
 is to orchestrate other sessions.  The toolset is smaller and
-narrower, the role is an orchestrator instead of a maker, and the
+narrower, the persona is an orchestrator instead of a maker, and the
 success metric is "did the plan resolve" instead of "did the code
 compile".  This doc covers the differences a skill author has to
 care about.
@@ -22,8 +22,8 @@ migration 044 added the column).  Three values:
 
 | `SkillKind` enum        | Stored as       | Meaning                                                                    |
 |-------------------------|-----------------|----------------------------------------------------------------------------|
-| `SkillKind.INTERACTIVE` | `"interactive"` | Authored for the interactive maker role (single-workstream "do this"). |
-| `SkillKind.COORDINATOR` | `"coordinator"` | Authored for the orchestrator role (delegate, monitor, synthesise).    |
+| `SkillKind.INTERACTIVE` | `"interactive"` | Authored for the interactive maker persona (single-workstream "do this"). |
+| `SkillKind.COORDINATOR` | `"coordinator"` | Authored for the orchestrator persona (delegate, monitor, synthesise).    |
 | `SkillKind.ANY`         | `"any"`         | Either surface (or audience-neutral).  Default on create.                 |
 
 The `kind` field is a `StrEnum` — drop-in `str` compatible — so DB
@@ -96,20 +96,20 @@ for the output.  The coordinator stays the orchestrator.
 
 ---
 
-## Framing differences
+## Persona differences
 
 Interactive skills compose on top of `base_interactive.md` — a
-"maker" framing: get the work done, use the tools, edit the code,
+"maker" persona: get the work done, use the tools, edit the code,
 close the loop.
 
 Coordinator skills compose on top of
-[`personas/orchestrator.md`](../turnstone/prompts/personas/orchestrator.md) —
-an "orchestrator" framing: decompose, delegate, monitor, synthesise.
+[`base_coordinator.md`](../turnstone/prompts/base_coordinator.md) —
+an "orchestrator" persona: decompose, delegate, monitor, synthesise.
 The base text is short but sets the tone every coordinator skill
 inherits:
 
-> You are a coordinator.  Your role is to orchestrate work across
-> the cluster...  You do
+> You are a coordinator on a small, focused infrastructure team.
+> Your role is to orchestrate work across the cluster...  You do
 > not edit files, run shell commands, browse the web, or manipulate
 > the codebase directly.  Children do that.
 
@@ -339,7 +339,7 @@ For a new coordinator skill:
 A full end-to-end test isn't required for every skill; a
 prepare-step unit test that asserts "given this initial message, the
 first tool call is X with Y args" is usually sufficient to catch
-framing drift without a real LLM in the loop.
+persona drift without a real LLM in the loop.
 
 ---
 
@@ -351,7 +351,7 @@ framing drift without a real LLM in the loop.
   `spawn_batch` and `close_all_children` use, so your skill can
   parse results / denied arrays correctly.
 - [governance.md](governance.md) — the broader governance surface
-  (`/trust`, `/restrict`, role-based permissions)
+  (`/trust`, `/restrict`, `/stop_cascade`, role-based permissions)
   that wraps every coord session.
 - [settings.md](settings.md) — `coordinator.model_alias` and
   `coordinator.reasoning_effort` settings that gate which LLM runs

docs/docker.md

@@ -125,7 +125,7 @@ docker compose -f turnstone/deploy/compose.yaml up
 It's the same shape as the dev stack — Caddy-fronted console, channel, and a
 PostgreSQL all share one database so the console discovers the node — but it
 pulls released images, runs a single server node, and has **no baked-in
-secrets**. Set these in `.env` first (generate with `openssl rand -hex 32`):
+secrets**. Set these in `.env` first (`turnstone-bootstrap` generates them):
 
 ```bash
 TURNSTONE_JWT_SECRET=<python -c "import secrets; print(secrets.token_hex(32))">
@@ -260,7 +260,7 @@ interface, or anyone who can reach it can search through your instance.
 
 Both stacks install all entry points into a single image (`turnstone`,
 `turnstone-server`, `turnstone-console`, `turnstone-channel`, `turnstone-admin`,
-`turnstone-eval`, `turnstone-optimizer`, `turnstone-doctor`):
+`turnstone-eval`, `turnstone-bootstrap`):
 
 ```bash
 docker compose build            # build the dev image

docs/eval.md

@@ -1,19 +1,11 @@
-# Evaluation and Prompt Optimization (turnstone-eval, turnstone-optimizer)
+# Evaluation and Prompt Optimization (turnstone-eval)
 
-Evaluation for turnstone is split into two commands:
+`turnstone-eval` is the evaluation and prompt optimization system for turnstone. It
+runs test cases against the LLM, scores tool call sequences against expected
+actions, and optionally uses a multi-agent pipeline to optimize the developer
+prompt and tool descriptions.
 
-- **`turnstone-eval`** — the measurement substrate. Runs test cases against the LLM
-  and scores tool call sequences against expected actions. A single measurement pass,
-  no self-modification.
-- **`turnstone-optimizer`** — the prompt/tool optimizer. Loops over the measurement
-  substrate, using a multi-agent pipeline (analyst, optimizer, observer, diversifier,
-  tool optimizer) to edit the developer prompt and tool descriptions so more tests pass.
-
-The dependency is strictly one-way: the optimizer consumes the eval substrate; the
-substrate never depends on the optimizer.
-
-Source: `turnstone/eval/core.py` (measurement substrate), `turnstone/eval/cli.py`
-(the `turnstone-eval` CLI), `turnstone/optimizer.py` (the `turnstone-optimizer` CLI).
+Source: `turnstone/eval.py`
 
 ---
 
@@ -35,8 +27,8 @@ This approach (inspired by [Learning to Self-Evolve](https://arxiv.org/abs/2603.
 prevents irrecoverable collapse from bad edits — UCB naturally backtracks to
 high-scoring ancestors instead of following a linear chain.
 
-The `turnstone-eval` command (or `turnstone-optimizer --no-optimize`) executes only
-steps 2-4: a single measurement pass over the root prompt, no optimization.
+When optimization is disabled (`--no-optimize`), only steps 2-4 execute
+(a single iteration evaluating the root node).
 
 ---
 
@@ -460,46 +452,30 @@ structure is:
 
 ## CLI Usage
 
-Two console scripts (installed as entry points), or the equivalent `python -m`
-invocations:
-
-- `turnstone-eval` / `python -m turnstone.eval.cli` — measure only.
-- `turnstone-optimizer` / `python -m turnstone.optimizer` — optimize.
-
-### Measure (`turnstone-eval`)
+The entry point is `turnstone-eval` (installed as a console script) or
+`python -m turnstone.eval`.
 
 ```
-turnstone-eval tests.json                     # one measurement pass, print scores
-turnstone-eval tests.json --prompt custom.txt # measure a custom prompt
-turnstone-eval tests.json --n-runs 5          # more runs per case
-turnstone-eval tests.json --parallel 4        # run cases across 4 workers
-turnstone-eval tests.json -v                  # verbose per-turn logging
+turnstone-eval tests.json                          # evaluate + optimize
+turnstone-eval tests.json --no-optimize            # evaluate only (single iteration)
+turnstone-eval tests.json --n-runs 5 --max-iter 10 # more thorough evaluation
+turnstone-eval tests.json --prompt custom.txt      # start from a custom prompt
+turnstone-eval tests.json --optimize-tools         # optimize tool descriptions only
+turnstone-eval tests.json --diversify 10           # test with prompt variants
+turnstone-eval tests.json -v                       # verbose per-turn logging
 ```
 
-### Optimize (`turnstone-optimizer`)
+### Multi-model setup (local test model, cloud optimizer)
 
 ```
-turnstone-optimizer tests.json                          # evaluate + optimize
-turnstone-optimizer tests.json --no-optimize            # single pass, no optimization
-turnstone-optimizer tests.json --n-runs 5 --max-iter 10 # more thorough optimization
-turnstone-optimizer tests.json --prompt custom.txt      # start from a custom prompt
-turnstone-optimizer tests.json --optimize-tools         # optimize tool descriptions only
-turnstone-optimizer tests.json --diversify 10           # test with prompt variants
-```
-
-#### Multi-model setup (local test model, cloud optimizer)
-
-```
-turnstone-optimizer tests.json \
+turnstone-eval tests.json \
   --base-url http://localhost:8000/v1 \
   --optimizer-base-url https://api.anthropic.com \
   --optimizer-model claude-sonnet-4-6 \
   --analyst-model claude-opus-4-6
 ```
 
-### Measurement Options
-
-Accepted by **both** commands.
+### All Options
 
 | Flag                    | Default                    | Description |
 |-------------------------|----------------------------|-------------|
@@ -508,26 +484,19 @@ Accepted by **both** commands.
 | `--model`               | auto-detect                | Model name. Auto-detected from the API if not specified. |
 | `--prompt`              | turnstone built-in prompt  | Path to initial prompt text file. |
 | `--n-runs`              | from tests.json or 3       | Number of runs per test case. |
+| `--max-iter`            | 5                          | Maximum optimization iterations. |
+| `--no-optimize`         | false                      | Run evaluation only (sets max-iter to 1). |
 | `--temperature`         | 0.7                        | Sampling temperature. |
 | `--max-tokens`          | 32768                      | Max completion tokens. |
 | `--reasoning-effort`    | `medium`                   | Reasoning effort: `low`, `medium`, or `high`. |
 | `--context-window`      | 131072                     | Context window size. |
 | `--output`              | `eval_results.json`        | Output results file path. |
 | `-v`, `--verbose`       | false                      | Show detailed per-turn logging. |
+| `--explore-constant`    | 1.414 (sqrt(2))            | UCB exploration constant C. |
 | `--test-timeout`        | 300                        | Per-test timeout in seconds. |
+| `--suite-timeout`       | 0 (unlimited)              | Total suite timeout in seconds. |
 | `--no-fast-fail`        | false                      | Disable early termination on all-zero initial runs. |
 | `--parallel`            | 1 (serial)                 | Parallel workers (0=auto, N=use N workers). |
-
-### Optimizer Options
-
-Accepted by **`turnstone-optimizer`** only.
-
-| Flag                    | Default                    | Description |
-|-------------------------|----------------------------|-------------|
-| `--max-iter`            | 5                          | Maximum optimization iterations. |
-| `--no-optimize`         | false                      | Run a single measurement pass (sets max-iter to 1). |
-| `--explore-constant`    | 1.414 (sqrt(2))            | UCB exploration constant C. |
-| `--suite-timeout`       | 0 (unlimited)              | Total suite timeout in seconds. |
 | `--optimizer-model`     | same as `--model`          | Model for prompt optimization. |
 | `--optimizer-base-url`  | same as `--base-url`       | Base URL for optimizer model. |
 | `--observer-model`      | same as optimizer           | Model for meta-optimization (observer). |

docs/governance.md

@@ -13,7 +13,7 @@ The permission model has two layers:
 
 1. **Scopes** (legacy) — `read`, `write`, `approve`. Checked by `AuthMiddleware`
    on every request based on URL path classification.
-2. **Permissions** (granular) — named permission strings checked per-endpoint by
+2. **Permissions** (granular) — 15 permission strings checked per-endpoint by
    `require_permission()`.
 
 **Built-in roles** (seeded by migration 008):
@@ -24,11 +24,7 @@ The permission model has two layers:
 | operator | read, write, workstreams.create, workstreams.close |
 | viewer | read |
 
-Custom roles can be created with any subset of the valid permissions.
-The `persona.create` / `persona.read` / `persona.write` family gates
-persona administration; migration `063` seeds all three onto
-`builtin-admin`, and any role can be granted them through the standard
-role and permission-override editors.
+Custom roles can be created with any subset of the 15 valid permissions.
 
 **Auth flow:**
 1. User logs in (password or API token) → `_load_user_permissions()` aggregates
@@ -131,12 +127,9 @@ Per-LLM-request token and tool call metrics:
   LLM response with prompt/completion tokens, cache tokens, tool call count,
   model, ws_id
 - **Prompt caching**: Anthropic automatic caching (`cache_control: ephemeral`)
-  and OpenAI caching are enabled by default. Pre-5.6 GPT-5 models request
-  `prompt_cache_retention: 24h`; GPT-5.6 uses
-  `prompt_cache_options: {"ttl": "30m"}`. GPT-5.6 cache writes use the
-  provider's 1.25× input-token rate. `cache_creation_tokens` and
-  `cache_read_tokens` are tracked per request in `usage_events` and surfaced
-  in the Usage admin tab
+  and OpenAI extended retention (`prompt_cache_retention: 24h` for GPT-5.x)
+  are enabled by default. `cache_creation_tokens` and `cache_read_tokens` are
+  tracked per request in `usage_events` and surfaced in the Usage admin tab
 - **Querying**: `GET /v1/api/admin/usage` with `group_by` (day/hour/model/user)
   and time range filtering — includes cache token aggregates
 - **Prometheus**: `turnstone_tokens_total{type="cache_creation|cache_read"}`
@@ -184,7 +177,6 @@ All under `/v1/api/admin/` (requires `approve` scope + granular permission).
 | Orgs | 3 (list, get, update) | `admin.orgs` |
 | Tool Policies | 4 (CRUD) | `admin.policies` |
 | Skills | 4 (CRUD) | `admin.skills` |
-| Personas | 4 (list, create, get, edit/archive) | `persona.read` / `persona.create` / `persona.write` |
 | Schedules | 6 (CRUD + runs) | `admin.schedules` |
 | Watches | 3 (list, create, cancel) | `admin.watches` |
 | Usage | 1 (aggregated query) | `admin.usage` |
@@ -230,7 +222,7 @@ Both Python and TypeScript console SDKs expose governance methods:
 - **Privilege escalation prevented**: `admin_assign_role` blocks self-assignment
   and requires caller to hold a superset of the target role's permissions
 - **Permission validation**: Role create/update validates permissions against
-  the permission allowlist (`_VALID_PERMISSIONS`)
+  a 15-item allowlist (`_VALID_PERMISSIONS`)
 - **Self-deletion blocked**: `admin_delete_user` rejects attempts to delete
   your own account (matching the self-assignment guard on role endpoints)
 - **Field allowlists**: Storage `update_*` methods filter fields against

docs/judge.md

@@ -249,14 +249,8 @@ are withheld from the live surfaces (a reused call_id must never ride a stale
 `approve` into Smart Approvals) but still persist with
 `user_decision = "superseded"` so the audit trail records the judge's answer.
 
-Sub-agent (task agent) tool calls are judge-gated too. Each runs the same
-intent pipeline as its own `agent_gate` generation, grounded in that sub-agent's
-own trajectory -- its task prompt is the delegation contract the operator
-approved, so "does this call serve the task" is the right local question.
-Agent-gate generations never occupy the main loop's supersede slot (parallel
-siblings would otherwise make each other's verdicts look stale); per-cycle
-generation checks enforce staleness instead, and `judge.cancel_on_approval`
-fires per gate exactly like the main loop.
+Sub-agents (plan agent, task agent) are exempt from intent validation -- they
+always get full tool visibility without judge evaluation.
 
 ---
 

docs/memory.md

@@ -75,11 +75,6 @@ This means the model always has its most relevant memories available without
 explicit recall -- but can still use `memory(action='search')` for deeper
 lookup.
 
-The persona memory lever gates this pathway: a workstream whose persona
-turns memory off receives no relevance injection at all -- the steps
-above run only when memory is enabled for the session. See
-[Personas](personas.md).
-
 ### Nudges
 
 The metacognition layer can nudge the model to save memories at appropriate

docs/oidc.md

@@ -41,7 +41,6 @@ are set.
 | `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | `true` | Set to `false` to hide the password form and block all username/password logins (including admin). API tokens continue to work. |
 | `TURNSTONE_OIDC_REDIRECT_BASE` | Yes | — | Externally-reachable origin for the OIDC redirect URI (e.g. `https://app.example.com`). Without this, OIDC will refuse to start. The previous Host-header fallback was unsafe under permissive reverse proxies. |
 | `TURNSTONE_OIDC_TRUSTED_ENDPOINT_HOSTS` | No | — | Comma-separated list of additional hostnames whose endpoints the IdP discovery document is allowed to reference. See [Cross-host endpoints](#cross-host-endpoints). |
-| `TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK` | No | `false` | Allow the issuer (and its discovered endpoints) to resolve to private/internal addresses — needed for a self-hosted IdP on an internal network. See [Self-hosted and internal IdPs](#self-hosted-and-internal-idps). |
 
 All four required fields — issuer, client ID, client secret, and
 `TURNSTONE_OIDC_REDIRECT_BASE` — must be set. If any are missing OIDC
@@ -100,40 +99,6 @@ The same scheme / no-userinfo / SSRF rules apply to allow-listed hosts —
 this knob only relaxes the same-origin check, not the security gates.
 Each entry is a hostname (no scheme, no path).
 
-### Self-hosted and internal IdPs
-
-By default Turnstone refuses an issuer whose hostname resolves to a
-private or internal address:
-
-```
-OIDCError: endpoint URL resolves to non-public address (10.0.0.5): https://auth.example.site
-```
-
-This is SSRF hardening, not a licensing or product restriction: the OIDC
-flow makes server-side HTTP requests (discovery, JWKS, token exchange),
-and refusing non-public destinations keeps a mistyped or maliciously
-steered issuer from aiming those fetches at internal services. For a
-self-hosted IdP (Keycloak, Authentik, Dex, …) on a private network,
-opt in explicitly in `config.toml`:
-
-```toml
-[oidc]
-allow_private_network = true
-```
-
-or via `TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK=true` (the env var wins
-when both are set).
-
-The opt-in admits private-range (RFC 1918), unique-local, CGNAT
-(100.64/10 — tailnets), and loopback addresses. Link-local, multicast,
-and reserved ranges stay refused even with the opt-in — cloud metadata
-services (169.254.169.254) live there, and no legitimate IdP does. The
-HTTPS requirement and the same-origin endpoint checks are unaffected.
-
-This knob only affects the login-flow IdP configured here. OAuth
-endpoints advertised by remote MCP servers are untrusted input and are
-always held to the strict public-address rule.
-
 ### config.toml alternative
 
 ```toml
@@ -146,8 +111,6 @@ provider_name = "Google"
 role_claim = "groups"
 password_enabled = true
 redirect_base = "https://app.example.com"
-# Self-hosted IdP on an internal network (see "Self-hosted and internal IdPs")
-allow_private_network = false
 
 [oidc.role_map]
 admin = "builtin-admin"

docs/personas.md

@@ -1,173 +0,0 @@
-# Personas
-
-A **persona** is a named, reusable bundle attached to a workstream **at
-creation** that controls how its system message is composed and what
-capability envelope it runs with. Personas answer a recurring operational
-complaint: the default composition primes every session for heavy tool use,
-and there was no per-workstream dial to launch a "just write prose" or
-"evidence-first research" session.
-
-A persona is exactly four levers — no more:
-
-| Lever | What it does |
-|---|---|
-| **Base prompt** | Replaces the BASE module of the composed system message. *Only* BASE: ENV, CONTEXT, TOOLS, and POLICIES keep composing, so mandatory [prompt policies](governance.md) ride on top of every persona. Built-in personas source their prose from a repo file; operator personas store it inline — see [Where persona prompts live](#where-persona-prompts-live). |
-| **Tool visibility** | Which tools the session advertises. Tri-state: *unrestricted* (tracks tool growth and MCP catalogs), *no tools* (the TOOLS prompt block self-suppresses and zero definitions go on the wire), or an *exact set* of names. Including `tool_search` in a set makes it **soft** — tools the model discovers through search join the visible set; omitting it makes the set **hard** (the search pathway is disabled entirely). On commercial providers a soft set costs one prompt-cache re-prime per `tool_search` expansion, since each expansion rewrites the wire tool set and recomposes the prompt. |
-| **MCP** | Whether the workstream talks to MCP at all. **Session-wide**: off means no MCP tools for the persona's own hands *or* for in-process task agents, no resource/prompt catalogs, and no listener registrations. This lever expresses infrastructure intent, not behavior shaping. |
-| **Memory** | Whether the persona's **own hands** get memory: recalled-memory injection into the prompt, memory-directed metacognitive nudges, and the `memory` tool. Task agents keep their own envelope, and compaction spill/markers are session mechanics that are never persona-gated. An exact tool set that hides `memory` also mutes those nudges, and the compaction-resume pointer follows `recall`'s visibility. |
-
-Visibility is behavior shaping, **not** a security boundary: any tool call
-that does reach the wire still clears the same approval, judge, and policy
-machinery as always. RBAC and tool policies remain the enforcement layers.
-
-## Snapshot semantics — resolve once, stamp forever
-
-The persona is resolved **once**, at workstream creation, and stamped into
-`workstream_config` as five keys (`persona`, `persona_prompt`,
-`persona_tools`, `persona_mcp`, `persona_memory`). From then on the session
-reads only the stamp:
-
-- **Editing or archiving a persona never changes an existing workstream.**
-  Rehydrate, resume, and post-compaction resume all run from the stamp.
-  A mid-session REPL `/resume` adopts the target workstream's stamp for
-  prompt, tools, and memory; for the MCP lever it can only narrow in
-  place — adopting an MCP-off stamp drops the live MCP surface, while
-  adopting an MCP-on stamp into a session whose persona dropped MCP at
-  construction is refused with an error telling you to reopen the
-  workstream fresh.
-- A workstream outlives its persona — an archived persona keeps labelling
-  the workstreams stamped with it.
-- A partial or unparseable stamp is treated as corruption: session
-  construction fails loudly rather than silently falling back to a default
-  envelope the operator never chose.
-- Workstreams created before personas existed carry no stamp and keep
-  legacy behavior, byte-identical to the `engineer` / `orchestrator`
-  defaults below — with one exception: pre-1.7 workstreams that had
-  `creative_mode` set are converted by migration `063` into full
-  `writer` stamps, so they resume as writing sessions rather than as
-  legacy defaults.
-- Forking (`resume_ws` on create) resumes the source's stamped persona; the
-  fork does not re-resolve.
-
-## Seed personas
-
-Migration `063` seeds six personas. The two per-kind **defaults** carry no
-overrides at all, so a zero-touch launch behaves exactly as it did before
-personas existed:
-
-| Persona | Kind | Base prompt | Tools | MCP | Memory |
-|---|---|---|---|---|---|
-| `engineer` *(default)* | interactive | stock | unrestricted | on | on |
-| `orchestrator` *(default)* | coordinator | stock | unrestricted | on | on |
-| `scribe` | interactive | custom (faithful structuring of given material) | none | off | off |
-| `researcher` | interactive | custom (evidence-first) | `read_file`, `search`, `web_fetch`, `web_search`, `recall`, `memory`, `tool_search` (soft) | off | on |
-| `writer` | interactive | custom (creative writing partner — replaces the removed `/creative`) | none | off | on |
-| `executive` | coordinator | custom (delegate, interrogate plans, judge outcomes) | spawn/inspect/lifecycle tools plus `memory`: `spawn_workstream`, `spawn_batch`, `send_to_workstream`, `wait_for_workstream`, `inspect_workstream`, `list_workstreams`, `list_nodes`, `close_workstream`, `cancel_workstream`, `memory` (hard) | off | on |
-
-Notes:
-
-- `scribe` turns memory off deliberately: recalled memories would
-  contaminate faithful summarization with unrelated context.
-- `researcher`'s set is soft (includes `tool_search`): it starts with
-  read and evidence tools but can pull in others on demand — e.g. load
-  `bash` to run a snippet and verify a calculation. It is evidence-first,
-  not sandboxed; any escalated tool still hits the normal approval path.
-- Coordinator sessions do not merge MCP today, so the MCP lever on
-  coordinator personas is forward-compatible bookkeeping; it bites on
-  interactive workstreams.
-
-## Where persona prompts live
-
-Prompt source is explicit in the persona row — two nullable columns, never both empty:
-
-| `base_prompt_file` | `base_prompt` | Meaning |
-|---|---|---|
-| set (e.g. `scribe.md`) | — | **built-in**: prose lives in `prompts/personas/<file>`, code-owned and PR-reviewed |
-| set | set | built-in with an **operator override** layered on top (the inline text wins) |
-| — | set | **operator** persona, inline prose |
-
-A `CHECK` forbids the both-empty row, so resolution is a plain coalesce —
-`base_prompt ?? load(base_prompt_file)` — with no implicit "inherit the default"
-branch in application logic. `base_prompt_file` is set only by the migration/code
-(the admin API never exposes it): it marks a persona as built-in and blocks
-archive, so `engineer` and `orchestrator` can't be removed. To customise a
-built-in, set `base_prompt` on it (clear it to revert), or create your own persona.
-
-The resolved prompt is **frozen into the workstream at creation** — later edits to
-a built-in's file or an operator's row never change a running workstream; only new
-ones pick up the change. "No persona" is not a state: every workstream is stamped,
-and an empty `persona=` resolves to the kind's `is_default` (`engineer` /
-`orchestrator`).
-
-## Choosing a persona
-
-Every creation surface takes an optional persona; empty always means the
-kind's default (or plain legacy behavior on a database with no personas
-seeded):
-
-- **Web/console**: the persona select on the console launcher, the server
-  webui's new-workstream dialog, and the dashboard composer. Selecting a
-  persona requires **no** `persona.*` permission — the picker feed
-  (`GET /v1/api/personas`) is authenticated-only and returns display fields.
-- **API/SDK**: `CreateWorkstreamRequest.persona` (Python:
-  `create_workstream(persona=...)`; TypeScript: `{ persona: ... }`).
-- **CLI**: `turnstone --persona <name>`. Unknown or disabled names error at
-  startup. `--resume` ignores `--persona` and adopts the resumed
-  workstream's stamp.
-- **Coordinator spawn**: `spawn_workstream` / `spawn_batch` take a
-  `persona` argument, validated when the coordinator prepares the spawn
-  and re-checked by the node that creates the child (children are always
-  interactive-kind). Omitted means the interactive **default** — a child
-  never inherits its parent coordinator's persona.
-- **Sub-agents**: `task_agent` takes a `persona` argument setting the
-  sub-agent's identity and capability envelope (resolved against
-  interactive-kind personas, frozen into the task at prep). Omitted keeps
-  the default autonomous task-agent identity — never the parent's persona.
-
-## How agents discover personas
-
-Agents are told, not expected to guess: the live persona list (enabled,
-interactive-kind — children and sub-agents are always interactive) is
-injected into the `persona` parameter description of `task_agent`,
-`spawn_workstream`, and `spawn_batch` whenever the session's tool surface
-is rendered — session start, MCP catalog change, model-registry reload.
-Each entry carries the name, the default marker, and the persona's
-one-line description so the model can pick by purpose (descriptions drop
-out past 25 personas; the name list always enumerates completely).
-
-A persona created after that render is still reachable — pass its name.
-Every resolve failure enumerates the names currently valid for the kind,
-so a stale list (or a typo) self-corrects on the next attempt.
-
-Resolution is forgiving on all surfaces (they share one rule):
-
-- names match case-insensitively (`Writer` resolves `writer`);
-- an input that uniquely matches a persona's **display name**
-  (case-insensitive, among the kind's enabled personas — display names are
-  not unique, and a same-label persona of another kind neither blocks nor
-  wins) resolves to that persona; an ambiguous match errors, listing the
-  candidate slugs;
-- whatever variant matched, the stamped identity, approval chrome, and
-  wire always carry the canonical `name` slug.
-
-## Authoring (console)
-
-Personas are managed in the console's **Manage → Governance → Personas**
-tab. The admin shelf exposes exactly the four levers plus the kind
-list, the default marker, and archive. Rules:
-
-- `name` is an immutable lowercase slug — and the identifier agents and
-  the CLI launch the persona by (`persona=` on the spawn tools,
-  `--persona` on the CLI); the create shelf says so under **Name**.
-  `display_name` is a list label, editable any time, and deliberately
-  not an identifier (a unique display name happens to resolve, as a
-  forgiveness fallback — don't design workflows around it).
-- Exactly one default per kind, storage-enforced: flipping the flag on a
-  successor demotes the incumbent atomically, defaults are single-kind,
-  and a default cannot be archived.
-- **Archive only** — there is no delete verb, so every stamped
-  workstream's provenance stays explicable.
-
-RBAC: `persona.create` / `persona.read` / `persona.write` gate the admin
-CRUD (`/v1/api/admin/personas`); all three are granted to `builtin-admin`
-by migration `063`, and other roles opt in via role permission overrides.

docs/sdk.md

@@ -69,7 +69,7 @@ Both `TurnstoneServer` (sync) and `AsyncTurnstoneServer` (async) expose:
 |----------|--------|---------|
 | **Workstreams** | `list_workstreams()` | `ListWorkstreamsResponse` |
 | | `dashboard()` | `DashboardResponse` |
-| | `create_workstream(*, name, model, auto_approve, skill, persona, initial_message, attachments)` | `CreateWorkstreamResponse` |
+| | `create_workstream(*, name, model, auto_approve, skill, initial_message, attachments)` | `CreateWorkstreamResponse` |
 | | `close_workstream(ws_id)` | `StatusResponse` |
 | **Attachments** | `upload_attachment(ws_id, filename, data, *, mime_type=...)` | `UploadAttachmentResponse` |
 | | `list_attachments(ws_id)` | `ListAttachmentsResponse` |
@@ -100,7 +100,7 @@ Both `TurnstoneConsole` (sync) and `AsyncTurnstoneConsole` (async) expose:
 | | `workstreams(*, state, node, search, sort, page, per_page)` | `ClusterWorkstreamsResponse` |
 | | `node_detail(node_id)` | `NodeDetailResponse` |
 | | `snapshot()` | `ClusterSnapshotResponse` |
-| | `create_workstream(*, node_id, name, model, initial_message, skill, persona)` | `ConsoleCreateWsResponse` |
+| | `create_workstream(*, node_id, name, model, initial_message, skill)` | `ConsoleCreateWsResponse` |
 | **Schedules** | `list_schedules()` | `ListSchedulesResponse` |
 | | `create_schedule(*, name, schedule_type, initial_message, ...)` | `ScheduleInfo` |
 | | `get_schedule(task_id)` | `ScheduleInfo` |

docs/settings.md

@@ -54,23 +54,6 @@ When a per-model override is `NULL` (empty in the UI), the global default is
 used. Switching models via `/model <alias>` re-resolves sampling parameters
 from the new model's overrides or global defaults.
 
-### Responses output controls (per-model)
-
-Models whose capability table declares Responses output controls expose two
-additional fields in the Models create/edit shelf:
-
-| Field | Stored capability | Values | Effect |
-|-------|-------------------|--------|--------|
-| Output verbosity | `verbosity` | `low`, `medium`, `high` | Controls answer length independently of reasoning effort. |
-| Reasoning mode | `reasoning_mode` | `standard`, `pro` | Selects standard or higher-compute Pro execution without changing the model ID. |
-
-An empty selection means provider default and omits the capability key. Known
-GPT-5.6 models inherit support from the built-in table without persisting
-redundant support flags. An OpenAI-compatible model pinned to the Responses API
-can opt in with the `supports_verbosity` and `supports_pro_mode` capability
-tiles. Chat Completions and non-Responses providers do not surface or submit
-these controls.
-
 **Removed settings:** `model.name` and `model.context_window` have been removed
 from ConfigStore. Model names and context windows are now configured per-model
 in the Models tab. A startup warning is logged if these keys appear in

docs/tools.md

@@ -1,6 +1,6 @@
 # Tools Reference
 
-turnstone exposes 17 built-in tools plus any number of external MCP tools to the
+turnstone exposes 16 built-in tools plus any number of external MCP tools to the
 LLM via the OpenAI function-calling interface. Built-in tools are defined as JSON
 files under `turnstone/tools/` and loaded at startup by `turnstone/core/tools.py`.
 MCP tools are discovered from configured MCP servers at startup by
@@ -44,10 +44,10 @@ schema plus turnstone-specific metadata keys:
 
 | Name                | Description |
 |---------------------|-------------|
-| `TOOLS`             | All 29 loaded built-in tool definitions (interactive + coordinator union). Sessions send a kind-specific subset (`INTERACTIVE_TOOLS` or `COORDINATOR_TOOLS`). |
+| `TOOLS`             | All 28 loaded built-in tool definitions (interactive + coordinator union). Sessions send a kind-specific subset (`INTERACTIVE_TOOLS` or `COORDINATOR_TOOLS`). |
 | `TASK_AGENT_TOOLS`  | Tools with `task_agent: true` -- available to task sub-agents. Includes write operations. |
 | `TASK_AUTO_TOOLS`   | Set of all tool names with `auto_approve: true` -- used by task-agent sub-sessions to skip confirmation for matching available tools. |
-| `BUILTIN_TOOL_NAMES`| Frozenset of all 29 built-in tool names (interactive + coordinator union). Used by tool search to distinguish always-on tools from deferrable MCP tools. |
+| `BUILTIN_TOOL_NAMES`| Frozenset of all 28 built-in tool names (interactive + coordinator union). Used by tool search to distinguish always-on tools from deferrable MCP tools. |
 | `PRIMARY_KEY_MAP`   | Dict mapping tool name to its `primary_key` parameter name. |
 
 ---
@@ -65,7 +65,7 @@ Tool execution follows a three-phase pipeline inside `ChatSession._execute_tools
 - Parses the JSON arguments (with fallback for malformed JSON).
 - If JSON parsing fails entirely, uses `PRIMARY_KEY_MAP` to map a bare string
   to the correct parameter.
-- Dispatches to the matching `_prepare_{func_name}()` handler. There are 17
+- Dispatches to the matching `_prepare_{func_name}()` handler. There are 16
   built-in tools plus `tool_search` (synthetic, client-side BM25 fallback) and
   the generic `_prepare_mcp_tool()` handler for MCP tools.
 - Validates arguments and builds a preview dict containing:
@@ -125,9 +125,6 @@ Each item's `execute` callable is invoked:
 - `web_fetch` -- fetches a URL (SSRF-protected, but makes network requests)
 - `web_search` -- web search via self-hosted SearxNG (makes network requests)
 - `task_agent` -- spawns an autonomous sub-agent
-- `open_preview` -- **URL targets only** (network access, gated like `web_fetch`);
-  file-path and `attachment:` targets are local reads and run unprompted like
-  `read_file`
 
 Note: The JSON schema metadata key `auto_approve` controls membership in
 `TASK_AUTO_TOOLS` (used for task agent sub-sessions). The actual runtime
@@ -160,7 +157,6 @@ Every tool defines a `primary_key`. The mapping is:
 | `search`     | `query`     |
 | `web_fetch`  | `url`       |
 | `web_search` | `query`     |
-| `open_preview` | `target`  |
 | `task_agent` | `prompt`    |
 | `memory`     | `name`      |
 | `recall`     | `query`     |
@@ -289,7 +285,7 @@ Fetch a URL and extract specific information from it.
 | `url`      | string | yes      | The URL to fetch (must start with `http://` or `https://`). |
 | `question` | string | yes      | What to extract or answer from the page content. |
 
-- **What it does**: Fetches the URL, strips HTML to plain text, and uses the LLM to extract the answer to the question from the page content. Every redirect hop is SSRF-screened before it is requested. Private/internal addresses are refused by default; enable `tools.allow_private_network` (console Settings → Tools) to make them approvable for self-hosted setups whose services live on the local network — the approval prompt marks such requests, and a public site redirecting into private space is refused regardless.
+- **What it does**: Fetches the URL, strips HTML to plain text, and uses the LLM to extract the answer to the question from the page content. Protected against SSRF (blocks private/internal IPs).
 - **Auto-approve**: No -- requires user confirmation (makes network requests).
 - **Agent availability**: `task_agent`.
 
@@ -349,39 +345,6 @@ It reports the score scale, whether the endpoint cleanly separates relevant from
 
 ---
 
-### open_preview
-
-Show the user rich content in a preview pane beside the conversation.
-
-| Parameter | Type   | Required | Description |
-|-----------|--------|----------|-------------|
-| `target`  | string | yes      | An http(s) URL, a file path, or `attachment:<id>` for a file attached to the conversation. |
-| `kind`    | string | no       | Rendering override: `web`, `pdf`, `image`, `table`, `text`, or `markdown`. Detected from the content when omitted. |
-| `title`   | string | no       | Pane header title. Defaults to the page title, filename, or URL. |
-
-- **What it does**: Resolves the target to bytes (URLs fetch through the same
-  SSRF-guarded path as `web_fetch`, screened per redirect hop, honoring the
-  same `tools.allow_private_network` opt-in), classifies the
-  content, stores it content-addressed against the workstream, and opens the
-  frontend preview pane beside the conversation: web pages render in a fully
-  sandboxed iframe (no scripts, opaque origin), PDFs in the browser viewer,
-  images inline, CSV/TSV/JSON as a sortable table, text/markdown rendered. A
-  previewed web page loads none of its remote images or styles by default, so
-  opening it never reveals the viewer to the page's site; a toggle in the pane
-  header turns remote content back on for that preview. The
-  model receives only a one-line confirmation — to reason about content, use
-  `web_fetch` / `read_file` instead. Preview content is size-capped per kind
-  (pages 4 MB, PDFs 32 MB, images 4 MB, tables 2 MB, text 512 KB) and GC'd
-  with the workstream.
-- **Auto-approve**: URL targets require confirmation (network access); file
-  paths and `attachment:` targets run unprompted (local reads).
-- **Agent availability**: interactive sessions only (not `task_agent`, not
-  coordinators).
-- **Surfaces**: the pane renders in the web UI (standalone and console). The
-  CLI prints the confirmation line only — there is no terminal pane.
-
----
-
 ## Agent
 
 The tool name uses the `_agent` suffix — bare `task` collides with
@@ -582,7 +545,6 @@ pre-configure skills at workstream creation.
 | `search`     | File Ops   | Yes          | Yes        | `query`     |
 | `web_fetch`  | Info       | No           | Yes        | `url`       |
 | `web_search` | Info       | No           | Yes        | `query`     |
-| `open_preview`| Info      | URL: no; path/attachment: yes | No | `target` |
 | `task_agent` | Agent      | No           | No         | `prompt`    |
 | `memory`     | Memory     | Yes          | No         | `name`      |
 | `recall`     | Memory     | Yes          | No         | `query`     |
@@ -618,11 +580,6 @@ Tool search uses the best available mechanism for each provider:
    `_exec_tool_search()` runs a pure-Python BM25 index over tool names and
    descriptions, then expands the matched tools into the visible set.
 
-A persona with a tool-visibility set overrides this selection: any exact
-set forces tool search into the client-side BM25 mechanism (tier 3)
-regardless of provider, and a **hard** set — one whose visible tools omit
-`tool_search` — disables tool search entirely.
-
 ### Configuration
 
 Tool search is configured in `config.toml` under the `[tools]` section:
@@ -692,7 +649,7 @@ MCP-compatible service.
 3. **Schema conversion**: Each MCP tool's `inputSchema` is converted to OpenAI
    function-calling format. The tool name is prefixed: `mcp__{server}__{tool}`.
 
-4. **Merging**: MCP tools are appended after the 17 built-in tools via
+4. **Merging**: MCP tools are appended after the 16 built-in tools via
    `merge_mcp_tools()`. Built-in tools appear first, giving them natural LLM priority.
    When dynamic tool search is active, MCP tools are deferred rather than directly
    visible -- the model discovers them via search as needed (see

eval_skill_adherence.json

@@ -1,56 +0,0 @@
-{
-  "defaults": {
-    "n_runs": 3
-  },
-  "cases": [
-    {
-      "id": "search-first",
-      "skill": {
-        "name": "search-first",
-        "content": "# Search First\n\nBefore answering ANY question about where something lives in the codebase, you MUST call the `search` tool first. Never answer from memory."
-      },
-      "user_prompt": "Where is JWT token validation implemented in this project?",
-      "expected_actions": [{ "tool": "search" }],
-      "match_mode": "ordered_subset",
-      "max_turns": 4
-    },
-    {
-      "id": "test-after-edit",
-      "skill": {
-        "name": "test-after-edit",
-        "content": "# Test After Edit\n\nAfter editing or writing ANY file, you MUST run the test suite with `python -m pytest` via bash before you finish. Do not report done until tests have run."
-      },
-      "user_prompt": "Add a function `clamp(x, lo, hi)` that clamps x to [lo, hi] in utils.py.",
-      "setup": {
-        "files": {
-          "utils.py": ""
-        }
-      },
-      "expected_actions": [
-        { "tool": "write_file" },
-        { "tool": "bash", "args_pattern": { "command": "pytest" } }
-      ],
-      "match_mode": "ordered_subset",
-      "max_turns": 8
-    },
-    {
-      "id": "changelog-update",
-      "skill": {
-        "name": "changelog-update",
-        "content": "# Changelog Discipline\n\nWhenever you modify a file, you MUST also append a one-line entry to CHANGELOG.md describing the change in the same task."
-      },
-      "user_prompt": "Fix the off-by-one so pager.py shows the last page. Edit pager.py.",
-      "setup": {
-        "files": {
-          "pager.py": "def last_page(total_items, per_page):\n    # off-by-one: drops the final partial page\n    return total_items // per_page\n",
-          "CHANGELOG.md": "# Changelog\n"
-        }
-      },
-      "expected_actions": [
-        { "tool": "edit_file", "args_pattern": { "path": "CHANGELOG.md" } }
-      ],
-      "match_mode": "subset",
-      "max_turns": 8
-    }
-  ]
-}

examples/door-game/tests/test_game.py

@@ -161,35 +161,6 @@ def test_rest_heals_and_charges(tmp_path: Path, clock: object) -> None:
     assert "full health" in out.lower()
 
 
-def test_rest_when_spent_restores_a_fresh_days_turns(tmp_path: Path, clock: object) -> None:
-    """Sleeping at the inn with no turns left rolls into a fresh day's allowance."""
-    game = _game(tmp_path, clock)
-    game.join("Brandr")
-    player = game.players["Brandr"]
-    daily = game.world.settings.daily_turns
-    player.turns_left = 0  # spent for the day
-    player.hp = 5
-    game.move("Brandr", "", "west", 2)  # step into the inn
-    out = game.action("Brandr", "rest", "", "")
-    assert player.turns_left == daily  # a fresh day's turns restored
-    assert player.hp == player.max_hp  # and fully mended
-    assert f"/{daily} ]" in out  # footer reflects the refreshed budget
-
-
-def test_rest_with_turns_in_hand_never_inflates_the_budget(tmp_path: Path, clock: object) -> None:
-    """Resting mid-day mends but adds no turns — the top-up only fires at zero."""
-    game = _game(tmp_path, clock)
-    game.join("Brandr")
-    player = game.players["Brandr"]
-    daily = game.world.settings.daily_turns
-    player.turns_left = daily - 3  # turns still in hand
-    player.hp = 5
-    game.move("Brandr", "", "west", 2)  # step into the inn
-    game.action("Brandr", "rest", "", "")
-    assert player.turns_left == daily - 3  # unchanged: no farming past the cap
-    assert player.hp == player.max_hp  # but the heal still lands
-
-
 def test_fight_spends_a_turn_and_credits(tmp_path: Path, clock: object) -> None:
     game = _game(tmp_path, clock)
     game.join("Brandr")

examples/door-game/understone/game.py

@@ -1015,28 +1015,16 @@ class Game:
         return self._overworld_frame(player, lines=["You step back out into the open air."])
 
     def _rest(self, player: Player) -> str:
-        # Settle any pending day rollover first, so a rest taken as the first act
-        # of a new day is the ordinary refresh, not the spent-turns top-up below.
-        self._ensure_day(player)
         cost = self.world.settings.rest_cost
-        if not leveling.rest(player, cost):
+        if leveling.rest(player, cost):
+            # A night's rest is a private errand, not Herald news; persist only.
+            self._persist(player)
             return self._location_menu(
-                player, lines=[f"You can't afford the {cost}-gold bed. (You have {player.gold}.)"]
+                player, lines=[f"You sleep deeply and wake at full health. (-{cost} gold)"]
             )
-        # A night at the inn always mends. Once the day's turns are spent it also
-        # rolls the sleeper into a fresh day's allowance, so a spent adventurer can
-        # press on rather than idling until the dawn rollover. The top-up only
-        # fires at zero, so it never banks turns past the daily cap.
-        line = f"You sleep deeply and wake at full health. (-{cost} gold)"
-        if player.turns_left <= 0:
-            player.turns_left = self.world.settings.daily_turns
-            line = (
-                f"You sleep through to a new dawn, waking at full health "
-                f"and ready to venture out anew. (-{cost} gold)"
-            )
-        # A night's rest is a private errand, not Herald news; persist only.
-        self._persist(player)
-        return self._location_menu(player, lines=[line])
+        return self._location_menu(
+            player, lines=[f"You can't afford the {cost}-gold bed. (You have {player.gold}.)"]
+        )
 
     # -- the Vault: bank gold at the inn (safe from ambush) --------------
 

examples/door-game/understone/world/data/monsters.json

@@ -21,7 +21,7 @@
     "tier": 2,
     "name": "Goblin",
     "hp": 12,
-    "atk": 4,
+    "atk": 5,
     "def": 1,
     "xp": 18,
     "gold": 7
@@ -30,7 +30,7 @@
     "tier": 2,
     "name": "Bandit Scout",
     "hp": 14,
-    "atk": 5,
+    "atk": 6,
     "def": 1,
     "xp": 20,
     "gold": 9
@@ -50,7 +50,7 @@
     "tier": 3,
     "name": "Forest Wolf",
     "hp": 20,
-    "atk": 7,
+    "atk": 8,
     "def": 2,
     "xp": 35,
     "gold": 14
@@ -59,7 +59,7 @@
     "tier": 3,
     "name": "Bog Stalker",
     "hp": 22,
-    "atk": 8,
+    "atk": 9,
     "def": 2,
     "xp": 38,
     "gold": 16
@@ -79,7 +79,7 @@
     "tier": 4,
     "name": "Cave Troll",
     "hp": 38,
-    "atk": 11,
+    "atk": 12,
     "def": 4,
     "xp": 70,
     "gold": 30
@@ -88,7 +88,7 @@
     "tier": 4,
     "name": "Barrow Wight",
     "hp": 35,
-    "atk": 12,
+    "atk": 13,
     "def": 4,
     "xp": 65,
     "gold": 28

examples/door-game/understone/world/data/terrain.json

@@ -22,7 +22,7 @@
   },
   "=": {
     "key": "road",
-    "glyph": "▒",
+    "glyph": "=",
     "walkable": true,
     "encounter_rate": 0.02,
     "color": "road"

examples/door-game/understone/world/data/world.json

@@ -100,8 +100,8 @@
   "settings": {
     "daily_turns": 10,
     "rest_cost": 15,
-    "heal_cost_per_hp": 1,
-    "starting_gold": 37,
+    "heal_cost_per_hp": 2,
+    "starting_gold": 20,
     "starting_weapon": "rusty_dagger",
     "starting_armor": "cloth_tunic",
     "start_hp": 20,

examples/door-game/understone/world/packs/cinder-wastes/monsters.json

@@ -21,7 +21,7 @@
     "tier": 2,
     "name": "Ember Imp",
     "hp": 12,
-    "atk": 4,
+    "atk": 5,
     "def": 1,
     "xp": 18,
     "gold": 7
@@ -30,7 +30,7 @@
     "tier": 2,
     "name": "Slag Scuttler",
     "hp": 14,
-    "atk": 5,
+    "atk": 6,
     "def": 1,
     "xp": 20,
     "gold": 9
@@ -50,7 +50,7 @@
     "tier": 3,
     "name": "Magma Hound",
     "hp": 20,
-    "atk": 7,
+    "atk": 8,
     "def": 2,
     "xp": 35,
     "gold": 14
@@ -59,7 +59,7 @@
     "tier": 3,
     "name": "Obsidian Lurker",
     "hp": 22,
-    "atk": 8,
+    "atk": 9,
     "def": 2,
     "xp": 38,
     "gold": 16
@@ -79,7 +79,7 @@
     "tier": 4,
     "name": "Basalt Golem",
     "hp": 38,
-    "atk": 11,
+    "atk": 12,
     "def": 4,
     "xp": 70,
     "gold": 30
@@ -88,7 +88,7 @@
     "tier": 4,
     "name": "Ashen Wraith",
     "hp": 35,
-    "atk": 12,
+    "atk": 13,
     "def": 4,
     "xp": 65,
     "gold": 28

examples/door-game/understone/world/packs/cinder-wastes/terrain.json

@@ -22,7 +22,7 @@
   },
   "=": {
     "key": "basalt",
-    "glyph": "▩",
+    "glyph": "=",
     "walkable": true,
     "encounter_rate": 0.02,
     "color": "road"

examples/door-game/understone/world/packs/cinder-wastes/world.json

@@ -100,8 +100,8 @@
   "settings": {
     "daily_turns": 10,
     "rest_cost": 15,
-    "heal_cost_per_hp": 1,
-    "starting_gold": 37,
+    "heal_cost_per_hp": 2,
+    "starting_gold": 20,
     "starting_weapon": "charred_shiv",
     "starting_armor": "scorched_rags",
     "start_hp": 20,

lint_hypothesis.py

@@ -1,246 +0,0 @@
-#!/usr/bin/env python3
-"""
-Consistency linter for HYPOTHESIS.md.
-Deterministic checks — no model, no confabulation:
-  A. delimiter / emphasis balance
-  B. residue regexes (things prior rounds fixed must not reappear)
-  C. single-capital-letter collision scan (one letter, two meanings)
-  D. definition check for the symbols recent rounds introduced
-  E. γ/ρ role-usage scan (gate=authorize/reject-proposal ; ρ=verify/fold-back/response)
-  F. display-only symbols (used in $$…$$ but nowhere in prose)
-  G. orphan / redundant-declaration scan (symbol used once; or two declaration sites)
-
-Path resolves to HYPOTHESIS.md beside this script, or argv[1] if given.
-Known benign flags: E flags the γ,ρ symbol-table row; G2 flags τ_H (it legitimately
-owns both a stopping-time/filtration statement and its = inf{…} formula).
-"""
-
-import os
-import re
-import sys
-
-PATH = (
-    sys.argv[1]
-    if len(sys.argv) > 1
-    else os.path.join(os.path.dirname(os.path.abspath(__file__)), "HYPOTHESIS.md")
-)
-with open(PATH, encoding="utf-8") as _f:
-    T = _f.read()
-LINES = T.splitlines()
-
-
-def lineno(idx):  # char index -> 1-based line
-    return T.count("\n", 0, idx) + 1
-
-
-def ctx(idx, w=55):
-    a = max(0, idx - w)
-    b = min(len(T), idx + w)
-    return T[a:b].replace("\n", " ")
-
-
-# math spans (so we can scan symbols in math only)
-math_spans = []
-for m in re.finditer(r"\$\$.*?\$\$", T, flags=re.S):
-    math_spans.append((m.start(), m.end()))
-for m in re.finditer(r"(?<!\$)\$(?!\$).*?(?<!\$)\$(?!\$)", T, flags=re.S):
-    math_spans.append((m.start(), m.end()))
-
-
-def in_math(idx):
-    return any(a <= idx < b for a, b in math_spans)
-
-
-print("=" * 70)
-print("A.  BALANCE")
-print("=" * 70)
-nomath = re.sub(r"\$[^$]*\$", "", T)
-display = T.count("$$")
-inline = len(re.findall(r"(?<!\$)\$(?!\$)", T))
-print(f"  display $$ : {display}  even={display % 2 == 0}")
-print(f"  inline  $  : {inline}  even={inline % 2 == 0}")
-print(f"  braces {{ }} : net {T.count('{') - T.count('}')}")
-print(f"  bold  **   : {nomath.count('**')}  even={nomath.count('**') % 2 == 0}")
-print(
-    f"  italic *   : {nomath.replace('**', '').count('*')}  even={nomath.replace('**', '').count('*') % 2 == 0}"
-)
-
-print("\n" + "=" * 70)
-print("B.  RESIDUE REGEXES (expect 0 each)")
-print("=" * 70)
-residue = {
-    "stray p_{ok}": r"p_\{\\mathrm\{ok\}\}",
-    "halt/ready leftover": r"halt/ready",
-    "(I-γP) discount collision": r"\(I-\\gamma P\)",
-    "B as pushforward dummy": r"M_W\(c, B\)",
-    "old c_τ-as-output law": r"M_W\(c\) = \\mathrm\{Law\}\(c_\\tau\)",
-    "R=id ill-typed": r"R=\\mathrm\{id\}",
-    "Y_⊥ after ⊥∈Y decision": r"\\mathcal\{Y\}_\\bot",
-    "'terminal sets are'": r"The terminal sets are",
-    "ρ rejects ⊥ branch": r"what \$\\rho\$ rejects",
-    "rejection at ρ": r"fail-closed rejection at \$\\rho\$",
-    "orphan τ^star (unify→τ_H)": r"\\tau\^\\star",
-    "unbraced _\\cmd subscript (GitHub emphasis hazard)": r"_\\",
-    "\\# in math (GitHub unescapes → raw #)": r"\\#",
-}
-for lbl, rx in residue.items():
-    hits = [lineno(m.start()) for m in re.finditer(rx, T)]
-    flag = "OK  " if not hits else "HIT "
-    print(f"  {flag}{lbl:32} lines={hits}")
-
-print("\n" + "=" * 70)
-print("C.  SINGLE-CAPITAL COLLISION SCAN (eyeball for two meanings)")
-print("=" * 70)
-for L in ["G", "U", "P", "N", "R", "V", "F", "D", "K", "T"]:
-    occ = []
-    for m in re.finditer(r"(?<![A-Za-z\\_])" + L + r"(?![A-Za-z_])", T):
-        if in_math(m.start()):
-            occ.append(m.start())
-    if occ:
-        print(f"  [{L}]  {len(occ)} math occ:")
-        for i in occ:
-            print(f"        L{lineno(i):>3}: …{ctx(i, 38)}…")
-
-print("\n" + "=" * 70)
-print("D.  DEFINITION CHECK (symbols recent rounds introduced)")
-print("=" * 70)
-defs = {
-    "Π (adversary class)": r"the class \$\\Pi\$ of policies",
-    "D (divergent set)": r"D=\\\{s:\\mathbb\{E\}_s\[\\tau_H\]=\\infty\\\}",
-    "μ (measure)": r"reference/sampling measure \$\\mu\$",
-    "e_0 (no-op response)": r"no-op response \$e_0\\in\\mathcal\{E\}\$",
-    "Stop (stop set)": r"stop set \$\\mathrm\{Stop\}\$",
-    "p_succ": r"p_\{\\mathrm\{succ\}\}\(s\)",
-    "p_safe": r"p_\{\\mathrm\{safe\}\}\(s\)",
-    "β (RL discount)": r"discount \$\\beta\$",
-    "A_Y (pushforward set)": r"measurable \$A_Y",
-    "r (per-step drift)": r"per-step drift \$r\(s\)=",
-    "z_t triple": r"z_t = \(c_t, b_t, m_t\)",
-    "μ_0 (initial dist)": r"initial \$s_0 \\sim \\mu_0\$",
-    "certificate (2-sense)": r"A \*\*certificate\*\* is a \*witness\*",
-    "controller/plant/shell": r"\*shell : plant :: the part you write",
-    "r_env (3-way drift)": r"r_\{\\text\{env\}\}",
-}
-for lbl, rx in defs.items():
-    found = bool(re.search(rx, T))
-    print(f"  {'OK  ' if found else 'MISS'}{lbl}")
-
-print("\n" + "=" * 70)
-print("E.  γ / ρ ROLE SCAN")
-print("=" * 70)
-# γ should sit near authorize/gate/reject-proposal/capability/irreversible/before
-# ρ should sit near verify/validate-response/fold-back/after
-g_bad = re.compile(r"fold[- ]back|folds back", re.I)  # γ doing ρ's job
-r_bad = re.compile(r"rejects the proposal|authoriz|is the gate|gates ", re.I)  # ρ doing γ's job
-
-
-def scan(sym_rx, label, bad_rx):
-    flagged = 0
-    for m in re.finditer(sym_rx, T):
-        if not in_math(m.start()):
-            continue
-        window = T[max(0, m.start() - 15) : m.start() + 70].replace("\n", " ")
-        if bad_rx.search(window):
-            flagged += 1
-            print(f"  FLAG {label}  L{lineno(m.start())}: …{window}…")
-    if not flagged:
-        print(f"  OK   no {label} usages land in the wrong role-neighborhood")
-
-
-scan(r"\\gamma", "γ", g_bad)
-scan(r"\\rho", "ρ", r_bad)
-
-print("\n" + "=" * 70)
-print("F.  DISPLAY-ONLY SYMBOLS (in $$…$$, absent from prose)")
-print("=" * 70)
-disp = " ".join(T[a:b] for a, b in math_spans if T[a : a + 2] == "$$")
-prose = re.sub(r"\$\$.*?\$\$", "", T, flags=re.S)
-toks = set(re.findall(r"\\[A-Za-z]+(?:_\{[A-Za-z]+\})?|[A-Z]_[A-Za-z]|[A-Za-z]_\\[a-z]+", disp))
-suspicious = []
-for tk in sorted(toks):
-    base = tk.split("_")[0]
-    if base and base not in prose and tk not in prose and len(base) > 1:
-        suspicious.append(tk)
-print("  (heuristic; review only) ", suspicious if suspicious else "none flagged")
-
-print("\n" + "=" * 70)
-print("G.  ORPHAN / REDUNDANT-DECLARATION SCAN (review only)")
-print("=" * 70)
-# G1 — a math symbol occurring exactly once is usually a rename residue or a typo
-#      (a unification can strip a symbol of all but one use). LaTeX operators and
-#      formatting commands are not symbols, so filter them out. Review, do not trust.
-OPS = {
-    r"\Pr",
-    r"\sum",
-    r"\int",
-    r"\sup",
-    r"\inf",
-    r"\infty",
-    r"\in",
-    r"\notin",
-    r"\cap",
-    r"\cup",
-    r"\setminus",
-    r"\subseteq",
-    r"\subset",
-    r"\mid",
-    r"\ge",
-    r"\le",
-    r"\sim",
-    r"\circ",
-    r"\cdot",
-    r"\star",
-    r"\hat",
-    r"\bar",
-    r"\to",
-    r"\Rightarrow",
-    r"\rightsquigarrow",
-    r"\longrightarrow",
-    r"\quad",
-    r"\qquad",
-    r"\Big",
-    r"\big",
-    r"\mathbb",
-    r"\mathcal",
-    r"\mathrm",
-    r"\mathbf",
-    r"\text",
-}
-sym_rx = re.compile(r"\\[A-Za-z]+(?:_\{[^{}]*\}|_[A-Za-z0-9])?")
-counts = {}
-for a, b in math_spans:
-    for m in sym_rx.finditer(T[a:b]):
-        counts[m.group()] = counts.get(m.group(), 0) + 1
-singletons = sorted(s for s, c in counts.items() if c == 1 and s.split("_")[0] not in OPS)
-print("  G1 singletons (occur once in math, operators filtered — orphan/typo candidates):")
-print("      " + (", ".join(singletons) if singletons else "none"))
-
-# G2 — the bare-τ failure mode the τ-unification introduced: a stopping/hitting-time
-#      symbol carrying BOTH an enumeration declaration (a "…stopping/hitting time…"
-#      sentence) AND a separate "= \inf\{…}" formula on a *different* line — one of the
-#      two sites is usually redundant. A formula restated in adjacent prose is benign
-#      (same kind of site), and so is τ_H, which legitimately owns a filtration statement
-#      plus its formula. A *newly* enum+formula-split symbol is the smell.
-decl_rx = re.compile(
-    r"hitting times? are|are stopping times|is a stopping time|stopping times? for the"
-)
-formula_tail = r"\s*=\s*\\inf\\\{"  # "= \inf\{" — the hitting/stop-time def, not \infty
-tau_syms = [r"\tau", r"\tau_A", r"\tau_H", r"\tau_B", r"\tau_F", r"\tau_{H_{\mathrm{ok}}}"]
-print("  G2 stopping/hitting-time family (count | enum-decl lines | formula lines):")
-for s in tau_syms:
-    pat = re.escape(s) + (r"(?![A-Za-z_^{])" if s == r"\tau" else r"(?![A-Za-z0-9])")
-    occ = list(re.finditer(pat, T))
-    enum_lines, formula_lines = set(), set()
-    for m in occ:
-        ln = lineno(m.start())
-        line = LINES[ln - 1]
-        if re.search(pat + formula_tail, line):
-            formula_lines.add(ln)
-        if decl_rx.search(line):
-            enum_lines.add(ln)
-    split = any(e != f for e in enum_lines for f in formula_lines)
-    note = "   <-- enum + separate formula; eyeball (benign: τ_H)" if split else ""
-    print(
-        f"      {s:24} count={len(occ):>2}  enum={sorted(enum_lines)}  formula={sorted(formula_lines)}{note}"
-    )
-print("\nDONE.")

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnstone"
-version = "1.7.4"
+version = "1.6.9"
 description = "Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."
 readme = "README.md"
 license = "Apache-2.0"
@@ -23,7 +23,7 @@ classifiers = [
     "Topic :: Scientific/Engineering :: Artificial Intelligence",
 ]
 dependencies = [
-    "openai>=2.45",  # GPT-5.6: typed reasoning.mode, prompt_cache_options, and cache_write_tokens
+    "openai>=2.37",
     "anthropic>=0.108",  # claude-fable-5 support; hard runtime floor is 0.105 (mid-conversation system blocks)
     "httpx>=0.28",
     "mcp>=1.27,<2",  # v2 is a breaking rewrite (2.0.0a1 live 2026-06-11; stable ~2026-07-27) — streamablehttp_client removed, 2-tuple transport, snake_case types; migrate deliberately
@@ -32,8 +32,6 @@ dependencies = [
     "sse-starlette>=2.0",
     "httpx-sse>=0.4",
     "pydantic>=2.0",
-    "pydantic-settings>=2.14.2",  # GHSA-4xgf-cpjx-pc3j: <2.14.2 advisory; pinned as a security floor for pip-audit
-
     "sqlalchemy>=2.0",
     "alembic>=1.14",
     "psycopg[binary]>=3.2",
@@ -46,8 +44,6 @@ dependencies = [
     "python-frontmatter>=1.0",
     "pypdfium2>=4",  # PDF text-extract + rasterize for models without native PDF input (core/pdf.py)
     "pillow>=10",  # PNG encoding for the PDF->images rasterize fallback (vision models, core/pdf.py)
-    "altair>=6.0",  # standard viz stack: Vega-Lite spec authoring; one spec renders to static SVG (vl-convert) AND interactive ui:// vega-embed panels. Light: pandas/numpy optional via narwhals.
-    "vl-convert-python>=1.6",  # Vega-Lite -> SVG/PNG, server-side (bundled Rust renderer; no browser/GDAL/chromium). BSD-3 + fully permissive dep closure (OFL font, BSD/MIT/ISC JS).
 ]
 
 [project.urls]
@@ -64,13 +60,12 @@ all = ["turnstone[discord,slack]"]
 
 [project.scripts]
 turnstone = "turnstone.cli:main"
-turnstone-eval = "turnstone.eval.cli:main"
-turnstone-optimizer = "turnstone.optimizer:main"
+turnstone-eval = "turnstone.eval:main"
 turnstone-server = "turnstone.server:main"
 turnstone-console = "turnstone.console.server:main"
 turnstone-admin = "turnstone.admin:main"
 turnstone-channel = "turnstone.channels.cli:main"
-turnstone-doctor = "turnstone.doctor:main"
+turnstone-bootstrap = "turnstone.bootstrap:main"
 
 [tool.hatch.build.targets.wheel]
 include = [
@@ -90,7 +85,7 @@ include = [
   "turnstone/shared_static/*.js",
   "turnstone/shared_static/katex-0.17.0/**/*",
   "turnstone/shared_static/hljs-11.11.1/**/*",
-  "turnstone/shared_static/mermaid-11.16.0/**/*",
+  "turnstone/shared_static/mermaid-11.15.0/**/*",
   "turnstone/shared_static/hls-1.6.16/**/*",
   "turnstone/sdk/py.typed",
   "turnstone/deploy/*.yaml",
@@ -194,10 +189,6 @@ ignore_missing_imports = true
 module = ["pypdfium2", "pypdfium2.*"]
 ignore_missing_imports = true
 
-[[tool.mypy.overrides]]
-module = ["vl_convert", "vl_convert.*"]  # Rust wheel, ships no type stubs (altair is typed)
-ignore_missing_imports = true
-
 [[tool.mypy.overrides]]
 module = ["turnstone.channels.discord.*"]
 disallow_subclassing_any = false

run.sh

@@ -4,9 +4,8 @@
 #
 #   curl -fsSL https://raw.githubusercontent.com/turnstonelabs/turnstone/main/run.sh | bash
 #
-# Autodetects your distro — Ubuntu/Debian, Fedora/RHEL, Arch, their common
-# derivatives (Mint, Pop!_OS, Nobara, AlmaLinux, …), and WSL on any of them —
-# and:
+# Autodetects your distro (Ubuntu/Debian, Fedora/RHEL, Arch, and WSL on any of
+# them) and:
 #   1. ensures git is installed, then clones the repo
 #   2. ensures Docker + the compose plugin are installed and the daemon is usable
 #   3. asks how many server nodes to run (1-10)
@@ -66,18 +65,12 @@ ask() {
 
 # -- distro / package manager detection --------------------------------------
 OS_ID=""; OS_LIKE=""; PKG=""; IS_WSL=0; SUDO=""
-# Extra os-release fields, captured only to pick Docker's upstream repo when
-# get.docker.com refuses a derivative it doesn't recognize (see install_docker).
-OS_PLATFORM_ID=""; OS_CODENAME=""; OS_UBUNTU_CODENAME=""
 
 detect_os() {
     if [ -r /etc/os-release ]; then
         # shellcheck disable=SC1091
         . /etc/os-release
         OS_ID="${ID:-}"; OS_LIKE="${ID_LIKE:-}"
-        OS_PLATFORM_ID="${PLATFORM_ID:-}"
-        OS_CODENAME="${VERSION_CODENAME:-}"
-        OS_UBUNTU_CODENAME="${UBUNTU_CODENAME:-}"
     fi
     if grep -qiE 'microsoft|wsl' /proc/version 2>/dev/null || [ -n "${WSL_DISTRO_NAME:-}" ]; then
         IS_WSL=1
@@ -137,83 +130,11 @@ clone_repo() {
 # -- docker -------------------------------------------------------------------
 DOCKER="docker"
 
-# Fallback when get.docker.com won't install here. That script keys off $ID alone
-# (never ID_LIKE), so it aborts with "Unsupported distribution '<id>'" on every
-# derivative — Nobara, Linux Mint, Pop!_OS, AlmaLinux, Oracle Linux, … — even
-# though the family is clear. We already know the family from detect_os, so we add
-# Docker's official CE repo for the matching upstream and install the same
-# packages get.docker.com would (including the compose plugin the rest of run.sh
-# relies on).
-install_docker_ce_repo() {
-    local up
-    case "$PKG" in
-        apt)
-            local codename arch
-            # UBUNTU_CODENAME is set by Ubuntu and every Ubuntu-derived distro
-            # (Mint/Pop!_OS/Zorin/…) and never by pure Debian, so it both routes
-            # the family and gives the exact codename Docker's repo expects.
-            if [ -n "$OS_UBUNTU_CODENAME" ]; then
-                up=ubuntu; codename="$OS_UBUNTU_CODENAME"
-            else
-                up=debian; codename="$OS_CODENAME"
-            fi
-            [ -n "$codename" ] || die "couldn't determine the $up release codename for Docker's repo — install Docker manually and re-run."
-            arch="$(dpkg --print-architecture 2>/dev/null || echo amd64)"
-            info "Adding Docker's $up repository ($codename)."
-            $SUDO install -m 0755 -d /etc/apt/keyrings
-            curl -fsSL "https://download.docker.com/linux/$up/gpg" | $SUDO tee /etc/apt/keyrings/docker.asc >/dev/null
-            $SUDO chmod a+r /etc/apt/keyrings/docker.asc
-            printf 'deb [arch=%s signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/%s %s stable\n' \
-                "$arch" "$up" "$codename" | $SUDO tee /etc/apt/sources.list.d/docker.list >/dev/null
-            $SUDO apt-get update -y
-            $SUDO apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-            ;;
-        dnf|yum)
-            # A Fedora spin and a RHEL clone can both carry "fedora" in ID_LIKE
-            # (Nobara's is "rhel centos fedora"), so ID_LIKE can't separate them.
-            # PLATFORM_ID can: Fedora is platform:fNN, Enterprise Linux platform:elN.
-            case "$OS_PLATFORM_ID" in
-                platform:f*)  up=fedora ;;
-                platform:el*) up=centos ;;
-                *) if [ -e /etc/fedora-release ]; then up=fedora; else up=centos; fi ;;
-            esac
-            info "Adding Docker's $up repository."
-            $SUDO curl -fsSL "https://download.docker.com/linux/$up/docker-ce.repo" \
-                -o /etc/yum.repos.d/docker-ce.repo \
-                || die "couldn't add Docker's $up repository — install Docker manually and re-run."
-            pkg_install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-            ;;
-    esac
-}
-
-# The distro IDs get.docker.com installs directly: it matches $ID against this
-# exact set (ignoring ID_LIKE) and aborts on anything else. Mirrors the dispatch
-# in get.docker.com, including its fedora-asahi-remix -> fedora alias.
-get_docker_com_supports() {
-    case "$1" in
-        ubuntu|debian|raspbian|centos|fedora|rhel|rocky|sles|fedora-asahi-remix) return 0 ;;
-        *) return 1 ;;
-    esac
-}
-
 install_docker() {
     case "$PKG" in
         apt|dnf|yum)
-            # Decide up front which installer applies, rather than treating every
-            # get.docker.com failure as "unsupported distro": for an ID it knows,
-            # let it run and surface any real failure (network, apt lock, EOL) via
-            # die instead of masking it with the repo path. Only unrecognized
-            # derivatives (Nobara, Mint, …) — which it would just abort on — skip
-            # straight to adding Docker's repo ourselves.
-            if [ -n "$OS_ID" ] && ! get_docker_com_supports "$OS_ID"; then
-                info "get.docker.com doesn't support '$OS_ID' — using Docker's official repository directly."
-                install_docker_ce_repo
-            else
-                info "Installing Docker via the official get.docker.com script"
-                curl -fsSL https://get.docker.com | $SUDO sh \
-                    || die "get.docker.com failed to install Docker (see the output above). Fix the issue and re-run — the script resumes."
-            fi
-            ;;
+            info "Installing Docker via the official get.docker.com script"
+            curl -fsSL https://get.docker.com | $SUDO sh ;;
         pacman)
             pkg_install docker docker-compose ;;
     esac
@@ -445,15 +366,12 @@ ${GREEN}${BOLD}Turnstone is running${RESET} (${NODE_COUNT} node$([ "$NODE_COUNT"
               ${DIM}cd $INSTALL_DIR && $DOCKER compose exec caddy cat /data/caddy/pki/authorities/local/root.crt${RESET}
 
   Finish setup
-    1. Open ${BOLD}${url}${RESET} and create the admin account when prompted —
-       the first user created there gets full admin access.
-    2. Log in, then add a model backend in the ${BOLD}Models${RESET} tab —
-       a local server (vLLM / llama.cpp) or an OpenAI / Anthropic / Gemini key.
+    1. Create the first admin user:
+       ${DIM}cd $INSTALL_DIR && $DOCKER compose exec node-1 turnstone-admin create-user --username admin --name "Admin"${RESET}
+    2. Open ${url}, log in, and add a model backend in the ${BOLD}Models${RESET} tab —
+       a local server (vLLM / llama.cpp / Ollama) or an OpenAI / Anthropic / Gemini key.
        Nodes boot without a model and pick it up live; no restart needed.
 
-    ${DIM}No browser? Create the admin from the CLI instead:
-    cd $INSTALL_DIR && $DOCKER compose exec node-1 turnstone-admin create-admin --username admin --name "Admin"${RESET}
-
   Scale       Running ${scale}
 
   Manage      ${DIM}cd $INSTALL_DIR${RESET}
@@ -462,9 +380,6 @@ ${GREEN}${BOLD}Turnstone is running${RESET} (${NODE_COUNT} node$([ "$NODE_COUNT"
               ${DIM}$DOCKER compose down${RESET}      stop (add -v to wipe data)
 
   Config      $INSTALL_DIR/.env   (generated secrets + ports)
-
-  Troubleshoot  ${DIM}pipx run --spec turnstone turnstone-doctor --dir $INSTALL_DIR${RESET}
-                LLM-backed diagnostics for this install (read-only; needs Python)
 EOF
 }
 

scripts/livepass.py

@@ -58,46 +58,6 @@ Attachments harness (/attachments/livepass.html): the composer attachment
   thumbnail crop/size, the native audio-control fit at the constrained
   height, the snippet contrast, and how a long filename behaves at the
   340px chip cap.
-Task-agent harness (/taskagent/livepass.html): the task_agent card — a task
-  agent's sub-tool steps nested under its conversation row, driven through the
-  REAL InteractivePane.handleEvent (parent tool_pending/tool_info -> child
-  tool_pending/tool_result/tool_output_chunk/approve_request -> task_agent
-  tool_result) so the SSE->card routing (_routeAgentItems / _ensureAgentCard,
-  and appendToolOutput finding the nested row by call_id) is exercised, not
-  just the leaf builders.  Query flags: &theme=light; &collapsed=1 (all-auto,
-  no approval -> the natural collapse-by-default state); &parallel=1 (card in a
-  2-tool batch, for the rail-bleed rules); &recall=1 (the RECALL path —
-  replayHistory rebuilding the card from a /history `agent_steps` overlay, i.e.
-  a reload while the ws is in memory); &expand=1 (open every card so a shot
-  shows the nested steps); &race=1 (child steps emitted BEFORE the task_agent
-  row paints — the parallel-pool ordering window; the orphan buffer must nest
-  them rather than let them escape to top-level); &orphan=1 (child steps whose
-  task_agent row NEVER paints — the safety valve must escape them to visible
-  top-level rows after the grace window, stamping TASKAGENT-ORPHANS-ESCAPED-<n>,
-  not leave them buffered/invisible).  document.title stamps
-  TASKAGENT-READY-<steps> on
-  success, TASKAGENT-FAILED-... / TASKAGENT-ERROR when routing breaks, so a
-  broken card can't screenshot green.
-
-Perf harness (/perf/livepass.html): long-session performance baseline for the
-  interactive pane — mounts the REAL InteractivePane at real scroll geometry
-  (fixed-height mount, production CSS chain) and drives production-shaped
-  events through pane.handleEvent/replayHistory with rAF yields, measuring:
-  replayHistory wall time at N messages, live event-storm cost per turn on top
-  of that transcript (reasoning/content deltas + tool batches + task_agent
-  cards), tool_output_chunk throughput, busy/idle churn, heap + node count +
-  _agentCards size across repeated replay cycles (leak probe), and longtask
-  counts.  Query params: ?n= (history size) &turns= &chunks= &cycles= &idle=
-  &post=1 (POST the JSON report to /perf/report — the --perf runner captures
-  it).  Results land in <pre id="perf-json"> and document.title stamps
-  PERF-READY-<n> / PERF-FAILED-<phase>.  MEASUREMENT RULES: never run with
-  --virtual-time-budget (it corrupts performance.now) and never pass
-  --force-prefers-reduced-motion (it disables the animations whose cost we
-  measure); the --perf runner passes --js-flags=--expose-gc and
-  --enable-precise-memory-info so heap numbers are stable and real.
-
-    python3 scripts/livepass.py --perf                  # 300 and 3000 msgs
-    python3 scripts/livepass.py --perf --perf-n 5000    # match the field run
 
 Rebuild after ANY markup change: the dialog blocks are embedded at build
 time. Assets are symlinked, so CSS/JS edits are live on refresh.
@@ -106,13 +66,7 @@ time. Assets are symlinked, so CSS/JS edits are live on refresh.
 from __future__ import annotations
 
 import argparse
-import http.server
-import json
 import re
-import shutil
-import subprocess
-import time
-import uuid
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -813,547 +767,6 @@ ATTACH_TEMPLATE = """<!doctype html>
 """
 
 
-# --------------------------------------------------------------------------
-# Task-agent harness — the task_agent card: a task agent's sub-tool steps
-# nested under its conversation row.  Driven through the REAL
-# InteractivePane.handleEvent so the SSE->card ROUTING (_routeAgentItems /
-# _ensureAgentCard, plus appendToolOutput finding the nested row by call_id)
-# is exercised, not just the leaf builders.  The page frame is harness-only
-# chrome; the .conv-batch / task_agent card is what's under review.
-# --------------------------------------------------------------------------
-TASKAGENT_TEMPLATE = """<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>task_agent livepass</title>
-    <link rel="stylesheet" href="shared/base.css" />
-    <link rel="stylesheet" href="shared/ui-base.css" />
-    <link rel="stylesheet" href="shared/chat.css" />
-    <link rel="stylesheet" href="shared/conversation.css" />
-    <link rel="stylesheet" href="shared/cards.css" />
-    <link rel="stylesheet" href="shared/interactive.css" />
-    <style>
-      /* Harness-only framing (NOT under review) — a plausible pane context. */
-      body {
-        padding: 24px; margin: 0; background: var(--bg); color: var(--ink);
-        font-family: var(--font-sans, system-ui, sans-serif);
-      }
-      .demo-frame { max-width: 720px; margin: 0 auto; }
-      .demo-label {
-        font: 11px var(--font-mono, monospace); color: var(--ink-3);
-        text-transform: uppercase; letter-spacing: 0.08em; margin: 0 0 8px;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="demo-frame">
-      <div class="demo-label">conversation — task_agent card (real InteractivePane.handleEvent)</div>
-      <div class="messages" id="messages"></div>
-    </div>
-    <script>
-      // interactive.js reads window.toast / window.authFetch; the static render
-      // never POSTs, so no-op stubs are enough.
-      window.toast = { error: function (m) { console.log("toast:", m); } };
-      window.authFetch = function () {
-        return Promise.resolve({
-          ok: true,
-          json: function () { return Promise.resolve({}); },
-          text: function () { return Promise.resolve(""); },
-        });
-      };
-    </script>
-    <script type="module">
-      import { InteractivePane } from "./shared/interactive.js";
-      const q = new URLSearchParams(location.search);
-      if (q.get("theme") === "light")
-        document.documentElement.dataset.theme = "light";
-
-      const messages = document.getElementById("messages");
-      try {
-        // Drive the REAL pane; stub only the host seams a mounted pane provides.
-        const pane = new InteractivePane("demo-ws");
-        pane.messagesEl = messages;
-        pane.inputEl = document.createElement("textarea");
-        pane.sendBtn = document.createElement("button");
-        pane.isNearBottom = () => false;
-        pane.scrollToBottom = () => {};
-        pane.removeEmptyState = () => {};
-        pane.removeThinkingIndicator = () => {};
-        pane.setBusy = () => {};
-        const ev = (e) => pane.handleEvent(e);
-
-        // ?recall=1: exercise the RECALL path — replayHistory rebuilding the
-        // card from the /history `agent_steps` overlay (a reload / reopen while
-        // the ws is still in memory), as opposed to the live SSE path below.
-        const recall = q.get("recall") === "1";
-        if (recall) {
-          pane.replayHistory([
-            { role: "user", content: "Find all call sites of resolve_alias and summarize them" },
-            { role: "assistant", tool_calls: [{
-              name: "task_agent", id: "task1",
-              arguments: JSON.stringify({ prompt: "Find call sites of resolve_alias" }),
-              agent_steps: [
-                { id: "task1::c1", name: "search", arguments: JSON.stringify({ query: "resolve_alias" }), output: "12 matches across 4 files", is_error: false },
-                { id: "task1::c2", name: "read_file", arguments: JSON.stringify({ path: "core/registry.py" }), output: "4.1 KB read", is_error: false },
-                { id: "task1::c3", name: "bash", arguments: JSON.stringify({ command: "pytest -k registry" }), output: "12 passed in 1.2s", is_error: false },
-                { id: "task1::c4", name: "notify", arguments: JSON.stringify({ channel: "#eng", message: "post summary" }), output: "posted to #eng", is_error: false },
-              ],
-            }] },
-            { role: "tool", tool_call_id: "task1", content: "resolve_alias has 4 call sites (registry.py:120, session.py:12200, model_registry.py:88, eval.py:54); all pass a validated alias before use." },
-          ]);
-        } else if (q.get("race") === "1") {
-          // ?race=1: reproduce the parallel-pool ordering window — each
-          // sub-tool's tool_pending is emitted exactly once (as in production)
-          // but AHEAD of the task_agent row paint, as happens when a pooled
-          // sub-agent's SSE event is handled before its parent row commits.
-          // The orphan buffer must hold them and nest them when the parent row
-          // lands; pre-fix they escaped to top-level rows and the card came up
-          // short (steps < 4 -> TASKAGENT-FAILED), so this can't screenshot
-          // green without the fix.
-          const raceTask = {
-            call_id: "task1", func_name: "task_agent",
-            header: 'task_agent: "Find all call sites of resolve_alias and summarize them"',
-            needs_approval: false,
-          };
-          const childPending = (cid, fn, header) =>
-            ev({ type: "tool_pending", items: [{ call_id: cid, parent_call_id: "task1", func_name: fn, header: header, needs_approval: false }] });
-          // a) Orphan child pendings arrive first — no parent row yet.
-          childPending("task1::c1", "search", 'search: "resolve_alias"');
-          childPending("task1::c2", "read_file", "read_file: core/registry.py");
-          childPending("task1::c3", "bash", "pytest -k registry");
-          childPending("task1::c4", "notify", "notify: post summary to #eng");
-          // b) Parent task_agent row paints (pending -> resolved): must flush the
-          //    buffered orphans into the card AND survive the upgrade rebuild.
-          ev({ type: "tool_pending", items: [raceTask] });
-          ev({ type: "tool_info", items: [Object.assign({ auto_approved: false }, raceTask)] });
-          // c) Results + a streamed chunk follow, nesting into the flushed rows.
-          ev({ type: "tool_result", call_id: "task1::c1", parent_call_id: "task1", name: "search", output: "12 matches across 4 files" });
-          ev({ type: "tool_result", call_id: "task1::c2", parent_call_id: "task1", name: "read_file", output: "4.1 KB read" });
-          ev({ type: "tool_output_chunk", call_id: "task1::c3", parent_call_id: "task1", chunk: "collected 12 items ... " });
-          ev({ type: "tool_result", call_id: "task1::c3", parent_call_id: "task1", name: "bash", output: "12 passed in 1.2s" });
-          ev({ type: "tool_result", call_id: "task1::c4", parent_call_id: "task1", name: "notify", output: "posted to #eng" });
-          ev({ type: "tool_result", call_id: "task1", name: "task_agent", output: "resolve_alias has 4 call sites (registry.py:120, session.py:12200, model_registry.py:88, eval.py:54); all pass a validated alias before use." });
-        } else if (q.get("orphan") === "1") {
-          // ?orphan=1: the SAFETY VALVE — child steps whose task_agent row
-          // NEVER paints (an id-correlation mismatch, or an agent aborted
-          // before its row painted).  They must not vanish: after the grace
-          // window the buffer escapes them to visible top-level rows (the
-          // pre-buffer behaviour) rather than holding them forever.  The parent
-          // task_agent row is deliberately never emitted here.
-          const orphanPending = (cid, fn, header) =>
-            ev({ type: "tool_pending", items: [{ call_id: cid, parent_call_id: "task1", func_name: fn, header: header, needs_approval: false }] });
-          orphanPending("task1::c1", "search", 'search: "resolve_alias"');
-          orphanPending("task1::c2", "read_file", "read_file: core/registry.py");
-          orphanPending("task1::c3", "bash", "pytest -k registry");
-        } else {
-
-        // 1. Parent paints the task_agent call (a top-level tool row).
-        const taskItem = {
-          call_id: "task1", func_name: "task_agent",
-          header: 'task_agent: "Find all call sites of resolve_alias and summarize them"',
-          needs_approval: false,
-        };
-        // ?parallel=1 puts the task_agent in a 2-tool parallel batch so the
-        // nested-step rail-bleed fix can be verified against the rail rules.
-        const parentItems = q.get("parallel") === "1"
-          ? [taskItem, { call_id: "sib1", func_name: "bash", header: "git status", needs_approval: false }]
-          : [taskItem];
-        ev({ type: "tool_pending", items: parentItems });
-        ev({ type: "tool_info", items: parentItems.map((it) => Object.assign({ auto_approved: false }, it)) });
-        if (parentItems.length > 1)
-          ev({ type: "tool_result", call_id: "sib1", name: "bash", output: "clean" });
-
-        // 2. Sub-agent steps tagged parent_call_id="task1" — exercises routing.
-        function stepRow(cid, fn, header, result) {
-          ev({ type: "tool_pending", items: [{ call_id: cid, parent_call_id: "task1", func_name: fn, header: header, needs_approval: false }] });
-          if (result != null)
-            ev({ type: "tool_result", call_id: cid, parent_call_id: "task1", name: fn, output: result });
-        }
-        stepRow("task1::c1", "search", 'search: "resolve_alias"', "12 matches across 4 files");
-        stepRow("task1::c2", "read_file", "read_file: core/registry.py", "4.1 KB read");
-        ev({ type: "tool_pending", items: [{ call_id: "task1::c3", parent_call_id: "task1", func_name: "bash", header: "pytest -k registry", needs_approval: false }] });
-        ev({ type: "tool_output_chunk", call_id: "task1::c3", parent_call_id: "task1", chunk: "collected 12 items ... " });
-        ev({ type: "tool_result", call_id: "task1::c3", parent_call_id: "task1", name: "bash", output: "12 passed in 1.2s" });
-        // 4th step.  Default: a nested sub-tool approval (notify is not
-        // auto-approved) — the pane must auto-expand the collapse-by-default
-        // card so the blocking prompt is visible.  ?collapsed=1: a plain
-        // completed step instead, so nothing forces the card open and the
-        // screenshot shows the natural collapsed state (the common case).
-        if (q.get("collapsed") === "1") {
-          stepRow("task1::c4", "notify", "notify: post summary to #eng", "posted to #eng");
-        } else {
-          ev({ type: "approve_request", judge_pending: false, items: [{ call_id: "task1::c4", parent_call_id: "task1", func_name: "notify", header: "notify: post summary to #eng", needs_approval: true }] });
-        }
-
-        // 3. The task agent's own synthesis, rendered below the card.
-        ev({ type: "tool_result", call_id: "task1", name: "task_agent", output: "resolve_alias has 4 call sites (registry.py:120, session.py:12200, model_registry.py:88, eval.py:54); all pass a validated alias before use." });
-        }
-
-        // ?expand=1: open every card so a screenshot shows the nested steps
-        // (cards collapse by default; recall has no approval to auto-expand).
-        if (q.get("expand") === "1") {
-          document.querySelectorAll(".conv-agent").forEach(function (c) {
-            c.dataset.collapsed = "false";
-            const t = c.querySelector(".conv-agent-toggle");
-            if (t) t.setAttribute("aria-expanded", "true");
-          });
-        }
-
-        // Loud failure — broken routing must not screenshot green.
-        const orphanMode = q.get("orphan") === "1";
-        setTimeout(function () {
-          if (orphanMode) {
-            // The parent never painted; after the grace window the buffered
-            // steps must have ESCAPED to visible top-level rows, not vanished.
-            const escaped = document.querySelectorAll('.conv-batch .conv-row[data-call-id^="task1::"]').length;
-            const leaked = document.querySelector('.conv-row[data-call-id="task1"] .conv-agent');
-            document.title = escaped >= 3 && !leaked
-              ? "TASKAGENT-ORPHANS-ESCAPED-" + escaped
-              : "TASKAGENT-FAILED-escaped" + escaped + "-card" + (leaked ? 1 : 0);
-            return;
-          }
-          const row = document.querySelector('.conv-row[data-call-id="task1"]');
-          const card = row && row.querySelector(".conv-agent");
-          const steps = card ? card.querySelectorAll(".conv-agent-body .conv-row").length : 0;
-          const hasResult = !!(row && /call sites/.test(row.textContent || ""));
-          document.title = card && steps >= 4 && hasResult
-            ? "TASKAGENT-READY-" + steps
-            : "TASKAGENT-FAILED-card" + (card ? 1 : 0) + "-steps" + steps + "-result" + (hasResult ? 1 : 0);
-        }, orphanMode ? 900 : 300);
-      } catch (e) {
-        messages.textContent = "HARNESS ERROR: " + e.message + "\\n" + (e.stack || "");
-        document.title = "TASKAGENT-ERROR";
-      }
-    </script>
-  </body>
-</html>
-"""
-
-
-# --------------------------------------------------------------------------
-# Perf harness — long-session performance baseline for the interactive pane.
-# Mounts the REAL InteractivePane (production DOM via _createDOM, production
-# CSS chain) in a fixed-height mount so .pane-messages has REAL scroll
-# geometry — the forced-layout costs under measurement (isNearBottom /
-# scrollToBottom / chunk-append scroll pins) only exist against live layout,
-# which is why nothing here stubs scroll/geometry the way the task-agent
-# harness does.  All timing is real time (see MEASUREMENT RULES in the module
-# docstring).  Workload is deterministic (seeded LCG) so runs are comparable.
-# --------------------------------------------------------------------------
-PERF_TEMPLATE = """<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>perf livepass</title>
-    <link rel="stylesheet" href="shared/base.css" />
-    <link rel="stylesheet" href="shared/ui-base.css" />
-    <link rel="stylesheet" href="shared/chat.css" />
-    <link rel="stylesheet" href="shared/conversation.css" />
-    <link rel="stylesheet" href="shared/cards.css" />
-    <link rel="stylesheet" href="static/style.css" />
-    <link rel="stylesheet" href="shared/interactive.css" />
-    <style>
-      /* Harness-only framing (NOT under review): a fixed-height mount so the
-         pane's .pane-messages scroller has real production geometry. */
-      body { margin: 0; background: var(--bg); color: var(--fg); }
-      #mount { height: 720px; width: 920px; display: flex; overflow: hidden; }
-      #mount > .pane { flex: 1; display: flex; flex-direction: column; min-height: 0; }
-      #perf-json { font: 11px monospace; white-space: pre-wrap; padding: 12px; }
-    </style>
-  </head>
-  <body>
-    <div id="mount"></div>
-    <pre id="perf-json">running…</pre>
-    <script>
-      window.toast = { error: function (m) { console.log("toast:", m); } };
-      // Collect every uncaught error/rejection into the report — a perf run
-      // that silently swallowed a pipeline exception must not read as clean.
-      window.__perfErrors = [];
-      window.onerror = function (msg, src, line) {
-        window.__perfErrors.push(String(msg) + " @ " + (src || "?") + ":" + (line || 0));
-      };
-      window.addEventListener("unhandledrejection", function (e) {
-        window.__perfErrors.push("unhandledrejection: " + String(e && e.reason));
-      });
-      window.__perfFetch = function () {
-        return Promise.resolve({
-          ok: true, status: 200,
-          json: function () { return Promise.resolve({}); },
-          text: function () { return Promise.resolve(""); },
-        });
-      };
-      window.authFetch = window.__perfFetch;
-    </script>
-    <script type="module">
-      import { InteractivePane } from "./shared/interactive.js";
-      // auth.js's legacy window bridge clobbers window.authFetch at module
-      // import time — reinstate the stub now imports have evaluated (same
-      // dance as the attachments harness).
-      window.authFetch = window.__perfFetch;
-
-      const q = new URLSearchParams(location.search);
-      const N = parseInt(q.get("n") || "1000", 10);
-      const TURNS = parseInt(q.get("turns") || "20", 10);
-      const CHUNKS = parseInt(q.get("chunks") || "300", 10);
-      const CYCLES = parseInt(q.get("cycles") || "3", 10);
-      const IDLE = parseInt(q.get("idle") || "20", 10);
-
-      // Long-task accounting across every phase (>50ms main-thread blocks).
-      const lt = { count: 0, total_ms: 0, max_ms: 0 };
-      try {
-        new PerformanceObserver(function (list) {
-          list.getEntries().forEach(function (e) {
-            lt.count += 1;
-            lt.total_ms += Math.round(e.duration);
-            lt.max_ms = Math.max(lt.max_ms, Math.round(e.duration));
-          });
-        }).observe({ type: "longtask", buffered: true });
-      } catch (e) { /* unsupported — longtasks stay zeroed */ }
-
-      // Deterministic workload (seeded LCG) so runs are comparable.
-      let _seed = 42;
-      function rnd() {
-        _seed = (_seed * 1664525 + 1013904223) >>> 0;
-        return _seed / 4294967296;
-      }
-      const WORDS = ("the retry loop grinds the dungeon server while the " +
-        "judge weighs verdicts and the coordinator shuffles children across " +
-        "nodes tokens accumulate compaction folds turns storage keeps the " +
-        "canon and the rail repaints").split(" ");
-      function sentence(w) {
-        const parts = [];
-        for (let i = 0; i < w; i++) parts.push(WORDS[(rnd() * WORDS.length) | 0]);
-        return parts.join(" ");
-      }
-      // Realistic assistant markdown: prose + list + fenced code (varying
-      // content so the hljs cache behaves as in production) + inline code.
-      function mdBody(i) {
-        return (
-          "Turn " + i + ": " + sentence(18) + ".\\n\\n" +
-          "- " + sentence(6) + "\\n- " + sentence(7) + "\\n\\n" +
-          "```python\\n" +
-          "def step_" + i + "(depth):\\n" +
-          "    total = " + ((rnd() * 1000) | 0) + "\\n" +
-          "    for k in range(depth):\\n" +
-          "        total += k * " + (1 + ((rnd() * 9) | 0)) + "\\n" +
-          "    return total\\n" +
-          "```\\n\\n" +
-          sentence(14) + " `inline_" + i + "` " + sentence(8) + "."
-        );
-      }
-      // History in the canonical projected wire shape replayHistory consumes
-      // (user / assistant content / assistant tool_calls / tool result), with
-      // periodic reasoning bubbles and task_agent cards (agent_steps overlay).
-      function buildHistory(n) {
-        const msgs = [];
-        let i = 0;
-        while (msgs.length < n) {
-          i += 1;
-          msgs.push({ role: "user", content: "Request " + i + ": " + sentence(10) + "?" });
-          if (msgs.length >= n) break;
-          if (i % 10 === 0) {
-            msgs.push({ role: "assistant", reasoning: sentence(40) + ".", content: mdBody(i) });
-          } else {
-            msgs.push({ role: "assistant", content: mdBody(i) });
-          }
-          if (msgs.length >= n) break;
-          const callId = "h" + i;
-          if (i % 8 === 0) {
-            msgs.push({ role: "assistant", tool_calls: [{
-              name: "task_agent", id: callId,
-              arguments: JSON.stringify({ prompt: "subtask " + i }),
-              agent_steps: [
-                { id: callId + "::c1", name: "search",
-                  arguments: JSON.stringify({ query: "q" + i }),
-                  output: sentence(8), is_error: false },
-                { id: callId + "::c2", name: "read_file",
-                  arguments: JSON.stringify({ path: "core/f" + i + ".py" }),
-                  output: sentence(6), is_error: false },
-                { id: callId + "::c3", name: "bash",
-                  arguments: JSON.stringify({ command: "pytest -k t" + i }),
-                  output: sentence(7), is_error: false },
-              ],
-            }] });
-          } else {
-            msgs.push({ role: "assistant", tool_calls: [{
-              name: "bash", id: callId,
-              arguments: JSON.stringify({ command: "grep -rn pattern_" + i + " src/" }),
-            }] });
-          }
-          if (msgs.length >= n) break;
-          msgs.push({ role: "tool", tool_call_id: callId,
-            content: "output " + i + ":\\n" + sentence(20) });
-        }
-        return msgs;
-      }
-
-      const tick = () => new Promise((r) => requestAnimationFrame(r));
-      // One live turn, production event mix: thinking indicator, reasoning
-      // deltas, content deltas (yield every few so streamingRender's internal
-      // rAF actually applies frames, as in a real token stream), stream_end,
-      // an auto-approved bash batch with streamed chunks, every 5th turn a
-      // task_agent card with routed children, then the idle edge.
-      async function stormTurn(pane, i) {
-        pane.handleEvent({ type: "state_change", state: "running" });
-        pane.handleEvent({ type: "thinking_start" });
-        const reason = sentence(50);
-        let d = 0;
-        for (let k = 0; k < reason.length; k += 20) {
-          pane.handleEvent({ type: "reasoning", text: reason.slice(k, k + 20) });
-          d += 1;
-          if (d % 4 === 3) await tick();
-        }
-        const body = mdBody(100000 + i);
-        d = 0;
-        for (let k = 0; k < body.length; k += 22) {
-          pane.handleEvent({ type: "content", text: body.slice(k, k + 22) });
-          d += 1;
-          if (d % 6 === 5) await tick();
-        }
-        pane.handleEvent({ type: "stream_end" });
-        const callId = "s" + i;
-        const item = { call_id: callId, func_name: "bash",
-          header: "bash: run step " + i, needs_approval: false };
-        pane.handleEvent({ type: "tool_pending", items: [item] });
-        pane.handleEvent({ type: "tool_info",
-          items: [Object.assign({ auto_approved: true }, item)] });
-        for (let k = 0; k < 24; k++) {
-          pane.handleEvent({ type: "tool_output_chunk", call_id: callId,
-            chunk: "line " + k + ": " + sentence(5) + "\\n" });
-          if (k % 6 === 5) await tick();
-        }
-        pane.handleEvent({ type: "tool_result", call_id: callId, name: "bash",
-          output: "done " + i + "\\n" + sentence(12) });
-        if (i % 5 === 4) {
-          const tid = "sa" + i;
-          const titem = { call_id: tid, func_name: "task_agent",
-            header: 'task_agent: "subtask ' + i + '"', needs_approval: false };
-          pane.handleEvent({ type: "tool_pending", items: [titem] });
-          pane.handleEvent({ type: "tool_info",
-            items: [Object.assign({ auto_approved: true }, titem)] });
-          for (let c = 1; c <= 3; c++) {
-            const cid = tid + "::c" + c;
-            pane.handleEvent({ type: "tool_pending", items: [{
-              call_id: cid, parent_call_id: tid, func_name: "search",
-              header: "search: q" + c, needs_approval: false }] });
-            pane.handleEvent({ type: "tool_result", call_id: cid,
-              parent_call_id: tid, name: "search", output: sentence(6) });
-          }
-          pane.handleEvent({ type: "tool_result", call_id: tid,
-            name: "task_agent", output: sentence(15) });
-          await tick();
-        }
-        pane.handleEvent({ type: "state_change", state: "idle" });
-        await tick();
-      }
-
-      function heapBytes() {
-        // --js-flags=--expose-gc makes this a real floor, not GC noise.
-        if (typeof window.gc === "function") {
-          try { window.gc(); window.gc(); } catch (e) { /* noop */ }
-        }
-        return (performance.memory && performance.memory.usedJSHeapSize) || null;
-      }
-
-      const report = {
-        n: N, turns: TURNS, chunks: CHUNKS, cycles: CYCLES, idle: IDLE,
-        // Echoed run token — the runner validates it so a straggler POST
-        // from a killed prior attempt can't be misattributed to this run.
-        run: q.get("run") || "",
-        errors: window.__perfErrors,
-      };
-      let phase = "mount";
-      try {
-        const pane = new InteractivePane("perf-ws");
-        document.getElementById("mount").appendChild(pane.el);
-        const msgs = buildHistory(N);
-        report.heap_start = heapBytes();
-
-        phase = "replay";
-        let t0 = performance.now();
-        pane.replayHistory(msgs);
-        report.replay_ms = Math.round(performance.now() - t0);
-        await tick();
-        report.nodes_after_replay = pane.messagesEl.querySelectorAll("*").length;
-
-        phase = "storm";
-        t0 = performance.now();
-        for (let i = 0; i < TURNS; i++) await stormTurn(pane, i);
-        report.storm_ms = Math.round(performance.now() - t0);
-        report.storm_ms_per_turn = Math.round(report.storm_ms / TURNS);
-
-        phase = "chunkstorm";
-        const ccItem = { call_id: "cc1", func_name: "bash",
-          header: "bash: tail -f build.log", needs_approval: false };
-        pane.handleEvent({ type: "tool_pending", items: [ccItem] });
-        pane.handleEvent({ type: "tool_info",
-          items: [Object.assign({ auto_approved: true }, ccItem)] });
-        t0 = performance.now();
-        for (let k = 0; k < CHUNKS; k++) {
-          pane.handleEvent({ type: "tool_output_chunk", call_id: "cc1",
-            chunk: "log line " + k + "\\n" });
-          if (k % 6 === 5) await tick();
-        }
-        report.chunk_ms = Math.round(performance.now() - t0);
-        pane.handleEvent({ type: "tool_result", call_id: "cc1", name: "bash",
-          output: "tail done" });
-
-        phase = "idlechurn";
-        t0 = performance.now();
-        for (let k = 0; k < IDLE; k++) {
-          pane.handleEvent({ type: "state_change", state: "running" });
-          pane.handleEvent({ type: "state_change", state: "idle" });
-          if (k % 4 === 3) await tick();
-        }
-        report.idle_ms = Math.round(performance.now() - t0);
-
-        // Leak probe: repeated full replays of the SAME history should
-        // converge to a flat heap/node/agent-card profile; monotonic growth
-        // here is retained-detached-DOM (the _agentCards class of bug).
-        phase = "replaycycles";
-        report.cycle_stats = [];
-        for (let c = 0; c < CYCLES; c++) {
-          t0 = performance.now();
-          pane.replayHistory(msgs);
-          const ms = Math.round(performance.now() - t0);
-          await tick();
-          report.cycle_stats.push({
-            replay_ms: ms,
-            heap: heapBytes(),
-            nodes: pane.messagesEl.querySelectorAll("*").length,
-            agent_cards: pane._agentCards ? pane._agentCards.size : 0,
-          });
-        }
-        report.heap_end = heapBytes();
-        report.longtasks = lt;
-        document.title = "PERF-READY-" + N;
-      } catch (e) {
-        window.__perfErrors.push(
-          "phase " + phase + ": " + (e && e.message ? e.message : String(e)),
-        );
-        report.failed_phase = phase;
-        report.longtasks = lt;
-        document.title = "PERF-FAILED-" + phase;
-      }
-      document.getElementById("perf-json").textContent =
-        JSON.stringify(report, null, 2);
-      if (q.get("post")) {
-        try {
-          await fetch("/perf/report", {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(report),
-          });
-        } catch (e) { /* runner captures the timeout instead */ }
-      }
-    </script>
-  </body>
-</html>
-"""
-
-
 # Fixture media for the attachments harness.  image/pdf thumbnails and the
 # audio clip load via element .src (NOT authFetch), so the --serve dev server
 # answers those paths directly with representative bytes: a photo-like image,
@@ -1470,266 +883,34 @@ def build(out: Path) -> None:
     (att / "livepass.html").write_text(ATTACH_TEMPLATE, encoding="utf-8")
     print(f"{att}/livepass.html — composer chips + message attachment pills")
 
-    ta = out / "taskagent"
-    ta.mkdir(parents=True, exist_ok=True)
-    symlink(ta / "shared", ROOT / "turnstone/shared_static")
-    (ta / "livepass.html").write_text(TASKAGENT_TEMPLATE, encoding="utf-8")
-    print(f"{ta}/livepass.html — task_agent card (real Pane.handleEvent routing)")
-
-    pf = out / "perf"
-    pf.mkdir(parents=True, exist_ok=True)
-    symlink(pf / "shared", ROOT / "turnstone/shared_static")
-    symlink(pf / "static", ROOT / "turnstone/ui/static")
-    (pf / "livepass.html").write_text(PERF_TEMPLATE, encoding="utf-8")
-    print(f"{pf}/livepass.html — long-session perf baseline (real InteractivePane)")
-
-
-class _PerfStore:
-    """Rendezvous for the perf page's POSTed JSON report."""
-
-    def __init__(self) -> None:
-        import threading
-
-        self.event = threading.Event()
-        self.data: dict[str, object] | None = None
-
-
-class _HarnessHandler(http.server.SimpleHTTPRequestHandler):
-    """Static file server + attachment media fixtures + perf-report sink.
-
-    The attachments harness loads thumbnails + the audio clip via element
-    .src; serve those from generated fixtures, fall through to static for
-    everything else.  The perf harness POSTs its JSON report to /perf/report
-    when driven with ?post=1 — the --perf runner blocks on ``perf_store``.
-    """
-
-    perf_store: _PerfStore | None = None
-    quiet = False
-
-    def do_GET(self) -> None:  # noqa: N802 (stdlib casing)
-        blob = _fixture_for(self.path.split("?")[0])
-        if blob is None:
-            super().do_GET()
-            return
-        data, ctype = blob
-        self.send_response(200)
-        self.send_header("Content-Type", ctype)
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def do_POST(self) -> None:  # noqa: N802 (stdlib casing)
-        store = type(self).perf_store
-        if self.path.split("?")[0] != "/perf/report" or store is None:
-            self.send_error(404)
-            return
-        length = int(self.headers.get("Content-Length") or 0)
-        body = self.rfile.read(length)
-        try:
-            store.data = json.loads(body)
-        except ValueError:
-            store.data = {"errors": ["runner: unparseable report body"]}
-        store.event.set()
-        self.send_response(204)
-        self.end_headers()
-
-    def log_message(self, format: str, *args: object) -> None:  # noqa: A002 (stdlib signature)
-        if not type(self).quiet:
-            super().log_message(format, *args)
-
-
-def _find_chrome() -> str | None:
-    for name in ("google-chrome", "google-chrome-stable", "chromium", "chromium-browser"):
-        path = shutil.which(name)
-        if path:
-            return path
-    return None
-
-
-def _await_report(
-    store: _PerfStore, proc: subprocess.Popen[bytes], run_token: str, timeout: float
-) -> dict[str, object] | None:
-    """Wait for THIS attempt's report: validated by run token, bailing early
-    when Chrome exits without reporting (the sandbox-startup-failure case —
-    waiting the full timeout there cost minutes before the --no-sandbox
-    fallback could even start).  A straggler POST from a previous attempt
-    (its handler thread can complete after the next attempt cleared the
-    store) carries the wrong token and is discarded instead of being
-    misattributed to this run."""
-    deadline = time.monotonic() + timeout
-    proc_exited_at: float | None = None
-    while time.monotonic() < deadline:
-        if store.event.wait(0.5):
-            data = store.data
-            store.event.clear()
-            store.data = None
-            if isinstance(data, dict) and data.get("run") == run_token:
-                return data
-            continue  # stale straggler from a prior attempt — keep waiting
-        if proc.poll() is not None:
-            now = time.monotonic()
-            if proc_exited_at is None:
-                proc_exited_at = now  # grace: an in-flight POST may still land
-            elif now - proc_exited_at > 3.0:
-                return None  # exited without reporting — try the next attempt
-    return None
-
-
-def _perf_run_one(
-    chrome: str, out: Path, port: int, store: _PerfStore, n: int, turns: int, timeout: float
-) -> dict[str, object] | None:
-    """One headless-Chrome perf pass; returns the page's report or None."""
-    base_flags = [
-        "--headless=new",
-        "--disable-gpu",
-        "--hide-scrollbars",
-        "--window-size=1440,900",
-        "--no-first-run",
-        "--disable-extensions",
-        # Throttled timers/rAF in a backgrounded renderer would corrupt the
-        # measurement — pin the renderer foreground-scheduled.
-        "--disable-background-timer-throttling",
-        "--disable-renderer-backgrounding",
-        "--disable-backgrounding-occluded-windows",
-        # Stable, real heap numbers (heapBytes() calls window.gc() first).
-        "--js-flags=--expose-gc",
-        "--enable-precise-memory-info",
-    ]
-    for attempt, extra in enumerate(
-        ([], ["--no-sandbox"])  # sandboxed first, container fallback second
-    ):
-        run_token = f"n{n}-a{attempt}-{uuid.uuid4().hex[:8]}"
-        url = (
-            f"http://127.0.0.1:{port}/perf/livepass.html?n={n}&turns={turns}&post=1&run={run_token}"
-        )
-        store.event.clear()
-        store.data = None
-        profile = out / f".chrome-perf-{n}"
-        proc = subprocess.Popen(
-            [chrome, *base_flags, *extra, f"--user-data-dir={profile}", url],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        try:
-            report = _await_report(store, proc, run_token, timeout)
-            if report is not None:
-                return report
-        finally:
-            if proc.poll() is None:
-                proc.terminate()
-                try:
-                    proc.wait(10)
-                except subprocess.TimeoutExpired:
-                    proc.kill()
-    return None
-
-
-def run_perf(out: Path, sizes: list[int], turns: int, timeout: float) -> bool:
-    """Build, serve, and run the perf page once per history size; print a table."""
-    import functools
-    import threading
-
-    chrome = _find_chrome()
-    if chrome is None:
-        print("perf: no chrome/chromium binary found on PATH")
-        return False
-    store = _PerfStore()
-    _HarnessHandler.perf_store = store
-    _HarnessHandler.quiet = True
-    handler = functools.partial(_HarnessHandler, directory=str(out))
-    server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), handler)
-    port = server.server_address[1]
-    threading.Thread(target=server.serve_forever, daemon=True).start()
-    reports: dict[int, dict[str, object]] = {}
-    try:
-        for n in sizes:
-            print(f"perf: n={n} turns={turns} … ", end="", flush=True)
-            report = _perf_run_one(chrome, out, port, store, n, turns, timeout)
-            if report is None:
-                print("FAILED (no report — timeout or chrome startup failure)")
-                continue
-            failed = report.get("failed_phase")
-            errors = report.get("errors") or []
-            status = f"failed in {failed}" if failed else "ok"
-            print(f"{status} ({len(errors) if isinstance(errors, list) else '?'} page errors)")
-            reports[n] = report
-            (out / f"perf-report-n{n}.json").write_text(
-                json.dumps(report, indent=2), encoding="utf-8"
-            )
-    finally:
-        server.shutdown()
-        _HarnessHandler.perf_store = None
-        _HarnessHandler.quiet = False
-    if not reports:
-        return False
-    _print_perf_table(reports)
-    print(f"\nraw reports: {out}/perf-report-n*.json")
-    return True
-
-
-def _print_perf_table(reports: dict[int, dict[str, object]]) -> None:
-    sizes = sorted(reports)
-
-    def cell(n: int, key: str) -> str:
-        value = reports[n].get(key)
-        return "—" if value is None else str(value)
-
-    def mb(value: object) -> str:
-        return f"{value / 1048576:.1f}MB" if isinstance(value, (int, float)) else "—"
-
-    rows: list[tuple[str, list[str]]] = [
-        ("replay_ms (full history build)", [cell(n, "replay_ms") for n in sizes]),
-        ("nodes after replay", [cell(n, "nodes_after_replay") for n in sizes]),
-        ("storm ms/turn (live mix)", [cell(n, "storm_ms_per_turn") for n in sizes]),
-        ("chunk_ms (output chunks)", [cell(n, "chunk_ms") for n in sizes]),
-        ("idle_ms (busy/idle churn)", [cell(n, "idle_ms") for n in sizes]),
-        ("heap start → end", []),
-        ("longtasks count/max_ms", []),
-        ("replay cycles ms", []),
-        ("agent_cards after cycles", []),
-    ]
-    for n in sizes:
-        rep = reports[n]
-        rows[5][1].append(f"{mb(rep.get('heap_start'))} → {mb(rep.get('heap_end'))}")
-        lt = rep.get("longtasks")
-        rows[6][1].append(f"{lt.get('count')}/{lt.get('max_ms')}" if isinstance(lt, dict) else "—")
-        cycles = rep.get("cycle_stats")
-        if isinstance(cycles, list) and cycles:
-            rows[7][1].append(",".join(str(c.get("replay_ms", "?")) for c in cycles))
-            rows[8][1].append(str(cycles[-1].get("agent_cards", "?")))
-        else:
-            rows[7][1].append("—")
-            rows[8][1].append("—")
-
-    label_w = max(len(label) for label, _ in rows)
-    col_w = max(14, *(len(f"n={n}") for n in sizes))
-    header = " " * label_w + "  " + "  ".join(f"n={n}".rjust(col_w) for n in sizes)
-    print("\n" + header)
-    for label, cells in rows:
-        print(label.ljust(label_w) + "  " + "  ".join(c.rjust(col_w) for c in cells))
-
 
 def main() -> None:
     ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     ap.add_argument("--out", type=Path, default=Path("/tmp/livepass"))
     ap.add_argument("--serve", type=int, metavar="PORT")
-    ap.add_argument("--perf", action="store_true", help="run the perf baseline and exit")
-    ap.add_argument(
-        "--perf-n",
-        default="300,3000",
-        help="comma-separated history sizes for --perf (default: 300,3000)",
-    )
-    ap.add_argument("--perf-turns", type=int, default=20)
-    ap.add_argument("--perf-timeout", type=float, default=420.0)
     args = ap.parse_args()
     build(args.out)
-    if args.perf:
-        sizes = [int(s) for s in str(args.perf_n).split(",") if s.strip()]
-        raise SystemExit(0 if run_perf(args.out, sizes, args.perf_turns, args.perf_timeout) else 1)
     if args.serve:
         import functools
+        import http.server
 
-        handler = functools.partial(_HarnessHandler, directory=str(args.out))
+        class _FixtureHandler(http.server.SimpleHTTPRequestHandler):
+            # The attachments harness loads thumbnails + the audio clip via
+            # element .src; serve those from generated fixtures, fall through
+            # to static for everything else.
+            def do_GET(self) -> None:  # noqa: N802 (stdlib casing)
+                blob = _fixture_for(self.path.split("?")[0])
+                if blob is None:
+                    super().do_GET()
+                    return
+                data, ctype = blob
+                self.send_response(200)
+                self.send_header("Content-Type", ctype)
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+        handler = functools.partial(_FixtureHandler, directory=str(args.out))
         print(f"serving {args.out} on http://localhost:{args.serve}/ — Ctrl+C stops")
         http.server.ThreadingHTTPServer(("127.0.0.1", args.serve), handler).serve_forever()
 

sdk/typescript/package-lock.json

@@ -14,21 +14,21 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.2",
+        "@emnapi/wasi-threads": "1.2.1",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -37,9 +37,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
-      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -55,14 +55,14 @@
       "license": "MIT"
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
-      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.3"
+        "@tybys/wasm-util": "^0.10.1"
       },
       "funding": {
         "type": "github",
@@ -74,9 +74,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.138.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
-      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
+      "version": "0.133.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
+      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -84,9 +84,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
-      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
+      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
       "cpu": [
         "arm64"
       ],
@@ -101,9 +101,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
-      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
+      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
       "cpu": [
         "arm64"
       ],
@@ -118,9 +118,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
-      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
+      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
       "cpu": [
         "x64"
       ],
@@ -135,9 +135,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
-      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
+      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
       "cpu": [
         "x64"
       ],
@@ -152,9 +152,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
-      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
+      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
       "cpu": [
         "arm"
       ],
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
-      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
+      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
       "cpu": [
         "arm64"
       ],
@@ -189,9 +189,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
-      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
+      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
       "cpu": [
         "arm64"
       ],
@@ -209,9 +209,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
-      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
+      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
       "cpu": [
         "ppc64"
       ],
@@ -229,9 +229,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
-      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
+      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
       "cpu": [
         "s390x"
       ],
@@ -249,9 +249,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
-      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
+      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
       "cpu": [
         "x64"
       ],
@@ -269,9 +269,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
-      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
+      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
       "cpu": [
         "x64"
       ],
@@ -289,9 +289,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
-      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
+      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
       "cpu": [
         "arm64"
       ],
@@ -306,9 +306,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
-      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
+      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
       "cpu": [
         "wasm32"
       ],
@@ -316,18 +316,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.11.1",
-        "@emnapi/runtime": "1.11.1",
-        "@napi-rs/wasm-runtime": "^1.1.6"
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
-      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
+      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
       "cpu": [
         "arm64"
       ],
@@ -342,9 +342,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
-      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
+      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
       "cpu": [
         "x64"
       ],
@@ -373,9 +373,9 @@
       "license": "MIT"
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.3",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
-      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
+      "version": "0.10.2",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
+      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -409,16 +409,16 @@
       "license": "MIT"
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
-      "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.8.tgz",
+      "integrity": "sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/spy": "4.1.8",
+        "@vitest/utils": "4.1.8",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -427,13 +427,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
-      "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.8.tgz",
+      "integrity": "sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.10",
+        "@vitest/spy": "4.1.8",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -454,9 +454,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
-      "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.8.tgz",
+      "integrity": "sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -467,13 +467,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
-      "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.8.tgz",
+      "integrity": "sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.10",
+        "@vitest/utils": "4.1.8",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -481,14 +481,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
-      "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.8.tgz",
+      "integrity": "sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/pretty-format": "4.1.8",
+        "@vitest/utils": "4.1.8",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -497,9 +497,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
-      "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.8.tgz",
+      "integrity": "sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -507,13 +507,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
-      "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.8.tgz",
+      "integrity": "sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.10",
+        "@vitest/pretty-format": "4.1.8",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -559,9 +559,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
-      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -576,9 +576,9 @@
       }
     },
     "node_modules/expect-type": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
-      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
+      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -902,9 +902,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.15",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
-      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "dev": true,
       "funding": [
         {
@@ -921,9 +921,9 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
-      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.2.tgz",
+      "integrity": "sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
@@ -949,9 +949,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -962,9 +962,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.16",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
-      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "dev": true,
       "funding": [
         {
@@ -991,13 +991,13 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
-      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
+      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.138.0",
+        "@oxc-project/types": "=0.133.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -1007,21 +1007,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.1.4",
-        "@rolldown/binding-darwin-arm64": "1.1.4",
-        "@rolldown/binding-darwin-x64": "1.1.4",
-        "@rolldown/binding-freebsd-x64": "1.1.4",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
-        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
-        "@rolldown/binding-linux-arm64-musl": "1.1.4",
-        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
-        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
-        "@rolldown/binding-linux-x64-gnu": "1.1.4",
-        "@rolldown/binding-linux-x64-musl": "1.1.4",
-        "@rolldown/binding-openharmony-arm64": "1.1.4",
-        "@rolldown/binding-wasm32-wasi": "1.1.4",
-        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
-        "@rolldown/binding-win32-x64-msvc": "1.1.4"
+        "@rolldown/binding-android-arm64": "1.0.3",
+        "@rolldown/binding-darwin-arm64": "1.0.3",
+        "@rolldown/binding-darwin-x64": "1.0.3",
+        "@rolldown/binding-freebsd-x64": "1.0.3",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
+        "@rolldown/binding-linux-arm64-musl": "1.0.3",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-musl": "1.0.3",
+        "@rolldown/binding-openharmony-arm64": "1.0.3",
+        "@rolldown/binding-wasm32-wasi": "1.0.3",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
+        "@rolldown/binding-win32-x64-msvc": "1.0.3"
       }
     },
     "node_modules/siginfo": {
@@ -1122,16 +1122,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.1.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
-      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
+      "version": "8.0.16",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
+      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.16",
-        "rolldown": "~1.1.3",
+        "postcss": "^8.5.15",
+        "rolldown": "1.0.3",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -1148,7 +1148,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.3.0",
+        "@vitejs/devtools": "^0.1.18",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -1200,19 +1200,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
-      "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.8.tgz",
+      "integrity": "sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.10",
-        "@vitest/mocker": "4.1.10",
-        "@vitest/pretty-format": "4.1.10",
-        "@vitest/runner": "4.1.10",
-        "@vitest/snapshot": "4.1.10",
-        "@vitest/spy": "4.1.10",
-        "@vitest/utils": "4.1.10",
+        "@vitest/expect": "4.1.8",
+        "@vitest/mocker": "4.1.8",
+        "@vitest/pretty-format": "4.1.8",
+        "@vitest/runner": "4.1.8",
+        "@vitest/snapshot": "4.1.8",
+        "@vitest/spy": "4.1.8",
+        "@vitest/utils": "4.1.8",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -1240,12 +1240,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.10",
-        "@vitest/browser-preview": "4.1.10",
-        "@vitest/browser-webdriverio": "4.1.10",
-        "@vitest/coverage-istanbul": "4.1.10",
-        "@vitest/coverage-v8": "4.1.10",
-        "@vitest/ui": "4.1.10",
+        "@vitest/browser-playwright": "4.1.8",
+        "@vitest/browser-preview": "4.1.8",
+        "@vitest/browser-webdriverio": "4.1.8",
+        "@vitest/coverage-istanbul": "4.1.8",
+        "@vitest/coverage-v8": "4.1.8",
+        "@vitest/ui": "4.1.8",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"

sdk/typescript/src/events.ts

@@ -75,35 +75,15 @@ export interface ToolInfoEvent {
   items: Array<Record<string, unknown>>;
 }
 
-/** One approval CYCLE awaiting the operator.  Several can be outstanding
- *  at once (parallel task agents each gate their own tool calls) — key
- *  prompt UI by `cycle_id` and echo it back on the approve POST.
- *
- *  `cycle_id` is optional because it was added in 1.7: a pre-1.7 server
- *  omits it on the wire, so a current SDK talking to an older node sees
- *  `undefined`.  Resolve those the legacy way (no selector → oldest
- *  cycle). A current server always sends it. */
 export interface ApproveRequestEvent {
   type: "approve_request";
-  cycle_id?: string;
   items: Array<Record<string, unknown>>;
-  judge_pending?: boolean;
 }
 
-/** A specific approval cycle resolved; `cycle_id`/`call_ids` identify
- *  which prompt to dismiss.
- *
- *  Both are optional for the same reason as `ApproveRequestEvent.cycle_id`
- *  — a pre-1.7 server emits neither, so a bare "something resolved"
- *  dismisses the sole tracked prompt (the legacy fallback the UI and
- *  channel adapters keep). A current server always sends both. */
 export interface ApprovalResolvedEvent {
   type: "approval_resolved";
   approved: boolean;
   feedback: string;
-  always?: boolean;
-  cycle_id?: string;
-  call_ids?: string[];
 }
 
 export interface ToolResultEvent {

sdk/typescript/src/server.ts

@@ -166,13 +166,6 @@ export class TurnstoneServer extends BaseClient {
     approved?: boolean;
     feedback?: string | null;
     always?: boolean;
-    /** Resolve exactly this approval cycle (from ApproveRequestEvent.cycle_id).
-     *  Omitting it resolves the OLDEST live cycle — ambiguous when parallel
-     *  task agents have several prompts outstanding, so pass it whenever the
-     *  triggering event is known. */
-    cycleId?: string;
-    /** Alternative selector: any call_id inside the target cycle. */
-    callId?: string;
   }): Promise<StatusResponse> {
     return this.request(
       "POST",
@@ -182,8 +175,6 @@ export class TurnstoneServer extends BaseClient {
           approved: opts.approved ?? true,
           feedback: opts.feedback,
           always: opts.always,
-          cycle_id: opts.cycleId,
-          call_id: opts.callId,
         },
       },
     );

sdk/typescript/src/types.ts

@@ -130,17 +130,6 @@ export interface CreateWorkstreamRequest {
   auto_approve?: boolean;
   resume_ws?: string;
   skill?: string;
-  /**
-   * Persona name (slug) to create the workstream with. Resolved and
-   * snapshotted at creation — later persona edits never affect this
-   * workstream. Empty selects the kind's default persona.
-   */
-  persona?: string;
-  /**
-   * Optional project to attach this workstream to. Drives the shared
-   * `project` memory scope; coordinator children inherit the parent's project.
-   */
-  project_id?: string;
   /** First user message dispatched in a background worker after creation. */
   initial_message?: string;
   /**
@@ -164,13 +153,6 @@ export interface CreateWorkstreamResponse {
   message_count?: number;
   /** Ids of attachments saved by this request (multipart variant only). */
   attachment_ids?: string[];
-  /**
-   * Present ONLY when the workstream was created but its initial_message
-   * could not be delivered: "queue_full" (raced live worker's interjection
-   * queue at capacity — resend via /send; uploads stay staged) or
-   * "refused_closed" (workstream closed mid-create).
-   */
-  initial_message_status?: "queue_full" | "refused_closed";
 }
 
 export interface CloseWorkstreamRequest {
@@ -192,7 +174,6 @@ export interface WorkstreamInfo {
   kind: string;
   parent_ws_id: string | null;
   user_id: string;
-  project_id: string | null;
 }
 
 export interface ListWorkstreamsResponse {
@@ -222,7 +203,6 @@ export interface DashboardWorkstream {
   ws_id: string;
   name: string;
   state: string;
-  project_id: string | null;
   title?: string;
   tokens?: number;
   context_ratio?: number;
@@ -269,8 +249,6 @@ export interface SavedWorkstreamInfo {
   child_count?: number;
   context_tokens?: number;
   context_ratio?: number;
-  /** Persona slug the workstream was created with (empty/absent = pre-persona). */
-  persona?: string | null;
 }
 
 export interface ListSavedWorkstreamsResponse {
@@ -539,8 +517,6 @@ export interface ConsoleCreateWsRequest {
   model?: string;
   initial_message?: string;
   skill?: string;
-  /** Persona slug — resolved and snapshotted at creation. */
-  persona?: string;
   resume_ws?: string;
 }
 
@@ -806,7 +782,7 @@ export interface SaveMemoryRequest {
   name: string;
   content: string;
   description?: string;
-  type?: "user" | "general" | "feedback" | "reference";
+  type?: "user" | "project" | "feedback" | "reference";
   scope?: "global" | "workstream" | "user";
   scope_id?: string;
 }

sdk/typescript/tests/server-attachments.test.ts

@@ -104,6 +104,7 @@ describe("TurnstoneServer attachments", () => {
     const [, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
     expect(JSON.parse(init.body)).toEqual({
       message: "hi",
+      ws_id: "ws-X",
       attachment_ids: ["a1", "a2"],
     });
   });
@@ -116,7 +117,7 @@ describe("TurnstoneServer attachments", () => {
     });
     await client.send("hi", "ws-X");
     const [, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
-    expect(JSON.parse(init.body)).toEqual({ message: "hi" });
+    expect(JSON.parse(init.body)).toEqual({ message: "hi", ws_id: "ws-X" });
   });
 
   it("createWorkstream with attachments sends multipart and auto-generates ws_id", async () => {

sdk/typescript/tests/server.test.ts

@@ -74,8 +74,8 @@ describe("TurnstoneServer", () => {
     await client.send("Hello", "ws1");
 
     const [url, init] = (fetchFn as ReturnType<typeof vi.fn>).mock.calls[0];
-    expect(url).toBe("http://test/v1/api/workstreams/ws1/send");
-    expect(JSON.parse(init.body)).toEqual({ message: "Hello" });
+    expect(url).toBe("http://test/v1/api/send");
+    expect(JSON.parse(init.body)).toEqual({ message: "Hello", ws_id: "ws1" });
   });
 
   it("injects auth header when token provided", async () => {

tests/_helpers.py

@@ -3,37 +3,9 @@ not fixtures, and several test files want to import them directly."""
 
 from __future__ import annotations
 
-import time
-from typing import TYPE_CHECKING, Any
+from typing import Any
 from unittest.mock import MagicMock
 
-if TYPE_CHECKING:
-    from collections.abc import Callable
-
-
-def wait_until(cond: Callable[[], bool], timeout: float = 5.0) -> None:
-    """Poll ``cond`` to True within ``timeout`` or fail the test.
-
-    The worker/wake tests can't join threads by identity:
-    ``session_worker.send`` assigns ``ws.worker_thread`` under the lock
-    BEFORE ``t.start()``, so the instant a dispatching call returns, a
-    fast worker may already have run its exit backstop and installed the
-    (not-yet-started) wake thread — joining whatever ``ws.worker_thread``
-    points at races ``RuntimeError: cannot join thread before it is
-    started``.  Poll outcomes instead.
-    """
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if cond():
-            return
-        time.sleep(0.005)
-    if cond():
-        # Final re-check: the condition can become true during the last
-        # sleep (or a CI descheduling stall past the deadline) — failing
-        # without re-looking makes the helper itself a flake source.
-        return
-    raise AssertionError("condition not met within timeout")
-
 
 def make_chat_session(**overrides: Any) -> Any:
     """Build a minimal ``ChatSession`` with sane test defaults.

tests/_proc_helpers.py

@@ -1,43 +0,0 @@
-"""Shared process/polling helpers for the bash + background-shell suites.
-
-One copy instead of three: ``test_bash_tool_background_hang``,
-``test_background_shells`` and ``test_bash_background_tool`` all assert on
-process liveness and poll for asynchronous state.  Leading underscore so
-pytest doesn't collect it.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import signal
-import time
-
-
-def pid_alive(pid: int) -> bool:
-    try:
-        os.kill(pid, 0)
-    except ProcessLookupError:
-        return False
-    except PermissionError:
-        return True
-    return True
-
-
-def kill_pid(pid: int) -> None:
-    with contextlib.suppress(OSError):
-        os.kill(pid, signal.SIGKILL)
-
-
-def poll_until(predicate, timeout=10.0, interval=0.05):
-    """Poll ``predicate`` until truthy or ``timeout``; RETURNS the last value
-    (falsy on timeout — assert at the call site).  Deliberately named apart
-    from ``tests/_helpers.wait_until``, which RAISES on timeout: two
-    same-named helpers with opposite failure semantics invite silently-green
-    tests."""
-    deadline = time.monotonic() + timeout
-    value = predicate()
-    while not value and time.monotonic() < deadline:
-        time.sleep(interval)
-        value = predicate()
-    return value

tests/_replay_helpers.py

@@ -51,12 +51,6 @@ def make_replay_mocks(
     ui._ws_messages = 0
     for key, value in ui_overrides.items():
         setattr(ui, key, value)
-    # Both replay paths read cycle cards via ``pending_approval_cards()``
-    # (one card per concurrent approval cycle).  Model it from the
-    # single-slot ``_pending_approval`` override so tests keep seeding
-    # the one field; a bare MagicMock here would iterate empty and
-    # silently drop the approve_request from the replay.
-    ui.pending_approval_cards = lambda: [ui._pending_approval] if ui._pending_approval else []
     ws = MagicMock()
     ws.session = session
     request = MagicMock()

tests/_wire_capture.py

@@ -1,76 +0,0 @@
-"""Recording fake SDK client — captures the kwargs at each provider's seam.
-
-Every provider's ``create_streaming`` assembles its kwargs and calls the
-SDK *eagerly* before returning the stream iterator (Anthropic
-``client.messages.stream``, OpenAI ``client.chat.completions.create``,
-Responses ``client.responses.create/stream``), so driving a provider
-against a :class:`RecordingClient` captures the full composed request
-payload without a network round-trip.
-
-Shared by the wire-payload golden harness (``test_wire_payload_golden``)
-and the effort-ladder parity harness (``test_effort_ladder_wire_parity``)
-so both assert against the same capture seam.
-"""
-
-from __future__ import annotations
-
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-
-class _EmptyStream:
-    """Stand-in for an SDK stream / stream-manager: empty iterable AND no-op CM."""
-
-    def __iter__(self) -> Iterator[Any]:
-        return iter(())
-
-    def __enter__(self) -> _EmptyStream:
-        return self
-
-    def __exit__(self, *exc: object) -> None:
-        return None
-
-
-class _Seam:
-    """Records the kwargs of a single SDK call, returns an empty stream stub."""
-
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self._sink = sink
-
-    def __call__(self, **kwargs: Any) -> _EmptyStream:
-        # Last write wins; only one seam is exercised per provider call.
-        self._sink["payload"] = kwargs
-        return _EmptyStream()
-
-
-class _Completions:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.create = _Seam(sink)
-
-
-class _Chat:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.completions = _Completions(sink)
-
-
-class _Messages:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.stream = _Seam(sink)
-
-
-class _Responses:
-    def __init__(self, sink: dict[str, Any]) -> None:
-        self.create = _Seam(sink)
-        self.stream = _Seam(sink)
-
-
-class RecordingClient:
-    """Fake SDK client exposing every provider's call seam, recording kwargs."""
-
-    def __init__(self) -> None:
-        self.captured: dict[str, Any] = {}
-        self.messages = _Messages(self.captured)
-        self.chat = _Chat(self.captured)
-        self.responses = _Responses(self.captured)

tests/conftest.py

@@ -52,76 +52,8 @@ def serve_until_exit(server: Any) -> None:
         loop.close()
 
 
-class _PendingResolver:
-    """Race-free drop-in for ``threading.Timer(delay, ui.resolve_approval)``.
-
-    ``approve_tools`` runs ``_approval_event.clear()`` -> register
-    ``_pending_approval`` -> ``_approval_event.wait(_APPROVAL_WAIT_TIMEOUT)``
-    (3600s). A *fixed-delay* timer can fire ``resolve_approval``
-    (``_approval_event.set()``) BEFORE that ``.clear()`` on a slow/loaded
-    runner, so the set is wiped by the clear and ``approve_tools`` blocks the
-    full hour -- surfacing as a CI hang. This instead waits until the approval
-    is actually registered (which happens *after* the clear), then resolves, so
-    the wakeup can never be lost. ``start()`` / ``cancel()`` mirror
-    ``threading.Timer`` so it drops into existing scaffolding. ``cancel()``
-    signals the worker to stop and joins it, so a test that errors *before* the
-    approval registers can't leak the thread or resolve late into a finished
-    test. ``before`` runs just before resolving -- e.g. to snapshot
-    pending-state fields the test asserts on.
-    """
-
-    def __init__(
-        self,
-        ui: Any,
-        *args: Any,
-        before: Callable[[], None] | None = None,
-        deadline: float = 10.0,
-        **kwargs: Any,
-    ) -> None:
-        self._ui = ui
-        self._args = args
-        self._kwargs = kwargs
-        self._before = before
-        self._deadline = deadline
-        self._cancelled = threading.Event()
-        self._started = False
-        self._thread = threading.Thread(target=self._run, name="resolve-when-pending", daemon=True)
-
-    def _run(self) -> None:
-        end = time.monotonic() + self._deadline
-        while time.monotonic() < end:
-            if self._cancelled.is_set():
-                return
-            # getattr (not a bare read) so a UI without _pending_approval can't
-            # crash the worker into a silent death that leaves approve_tools
-            # blocked for the full _APPROVAL_WAIT_TIMEOUT.
-            if getattr(self._ui, "_pending_approval", None) is not None:
-                if self._before is not None:
-                    self._before()
-                self._ui.resolve_approval(*self._args, **self._kwargs)
-                return
-            time.sleep(0.001)
-        # Deadline without registration: approve_tools isn't parked on the
-        # approval event (returned early, or never reached it) -- don't resolve
-        # into an unknown state; let the test's own assertions speak.
-
-    def start(self) -> None:
-        self._started = True
-        self._thread.start()
-
-    def cancel(self) -> None:
-        self._cancelled.set()
-        if self._started:
-            self._thread.join(timeout=5)
-
-
-def resolve_when_pending(ui: Any, *args: Any, **kwargs: Any) -> _PendingResolver:
-    """Build a race-free approval resolver (see :class:`_PendingResolver`)."""
-    return _PendingResolver(ui, *args, **kwargs)
-
-
 if TYPE_CHECKING:
-    from collections.abc import Callable, Iterator
+    from collections.abc import Iterator
 
     from turnstone.core.mcp_client import MCPClientManager, StaticServerState
     from turnstone.core.mcp_crypto import MCPTokenCipher

tests/data/wire_payloads/anthropic_compat__mid_orphan.json

@@ -1,78 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris and London?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        },
-        {
-          "id": "call_2",
-          "input": {
-            "city": "London"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        },
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_2",
-          "type": "tool_result"
-        },
-        {
-          "text": "Actually, never mind London.",
-          "type": "text"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_compat__multipart.json

@@ -1,33 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": [
-        {
-          "text": "What's in this image?",
-          "type": "text"
-        },
-        {
-          "source": {
-            "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
-            "media_type": "image/png",
-            "type": "base64"
-          },
-          "type": "image"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5
-}

tests/data/wire_payloads/anthropic_compat__native_orphan.json

@@ -1,70 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Think about the weather.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "signature": "sig-abc",
-          "thinking": "The user wants weather.",
-          "type": "thinking"
-        },
-        {
-          "text": "Let me check.",
-          "type": "text"
-        },
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_compat__native_reasoning.json

@@ -1,69 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Think about the weather.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "signature": "sig-abc",
-          "thinking": "The user wants weather.",
-          "type": "thinking"
-        },
-        {
-          "text": "Let me check.",
-          "type": "text"
-        },
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_compat__operator_system.json

@@ -1,63 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Run the deploy.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {},
-          "name": "deploy",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "deployed",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        },
-        {
-          "text": "Great, what's next?",
-          "type": "text"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "system": "Output-guard: deploy output looked clean.",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_compat__text.json

@@ -1,33 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Hi there.",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "text": "Hello! How can I help?",
-          "type": "text"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5
-}

tests/data/wire_payloads/anthropic_compat__toolcall_complete.json

@@ -1,69 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "18C, clear.",
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "text": "It's 18C and clear in Paris.",
-          "type": "text"
-        }
-      ],
-      "role": "assistant"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_compat__trailing_orphan.json

@@ -1,61 +0,0 @@
-{
-  "cache_control": {
-    "type": "ephemeral"
-  },
-  "extra_body": {
-    "chat_template_kwargs": {
-      "enable_thinking": true,
-      "reasoning_effort": "high"
-    }
-  },
-  "max_tokens": 4096,
-  "messages": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user"
-    },
-    {
-      "content": [
-        {
-          "id": "call_1",
-          "input": {
-            "city": "Paris"
-          },
-          "name": "get_weather",
-          "type": "tool_use"
-        }
-      ],
-      "role": "assistant"
-    },
-    {
-      "content": [
-        {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
-          "is_error": true,
-          "tool_use_id": "call_1",
-          "type": "tool_result"
-        }
-      ],
-      "role": "user"
-    }
-  ],
-  "model": "qwen3.6-27b",
-  "temperature": 0.5,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "input_schema": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "name": "get_weather"
-    }
-  ]
-}

tests/data/wire_payloads/anthropic_hoist__mid_orphan.json

@@ -37,7 +37,7 @@
           "type": "tool_result"
         },
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_2",
           "type": "tool_result"

tests/data/wire_payloads/anthropic_hoist__native_orphan.json

@@ -33,7 +33,7 @@
     {
       "content": [
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_1",
           "type": "tool_result"

tests/data/wire_payloads/anthropic_hoist__trailing_orphan.json

@@ -24,7 +24,7 @@
     {
       "content": [
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_1",
           "type": "tool_result"

tests/data/wire_payloads/anthropic_native__mid_orphan.json

@@ -37,7 +37,7 @@
           "type": "tool_result"
         },
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_2",
           "type": "tool_result"

tests/data/wire_payloads/anthropic_native__native_orphan.json

@@ -33,7 +33,7 @@
     {
       "content": [
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_1",
           "type": "tool_result"

tests/data/wire_payloads/anthropic_native__trailing_orphan.json

@@ -24,7 +24,7 @@
     {
       "content": [
         {
-          "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+          "content": "Tool execution was cancelled.",
           "is_error": true,
           "tool_use_id": "call_1",
           "type": "tool_result"

tests/data/wire_payloads/google__mid_orphan.json

@@ -33,7 +33,7 @@
       "tool_call_id": "call_1"
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_2"
     },
@@ -43,7 +43,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__multipart.json

@@ -18,7 +18,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__native_orphan.json

@@ -20,13 +20,12 @@
       ]
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_1"
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__native_reasoning.json

@@ -26,7 +26,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__operator_system.json

@@ -34,7 +34,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__text.json

@@ -15,7 +15,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__toolcall_complete.json

@@ -30,7 +30,6 @@
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/google__trailing_orphan.json

@@ -20,13 +20,12 @@
       ]
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_1"
     }
   ],
   "model": "gemini-2.5-pro",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__mid_orphan.json

@@ -33,7 +33,7 @@
       "tool_call_id": "call_1"
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_2"
     },
@@ -43,7 +43,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__multipart.json

@@ -18,7 +18,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__native_orphan.json

@@ -20,13 +20,12 @@
       ]
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_1"
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__native_reasoning.json

@@ -26,7 +26,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__operator_system.json

@@ -34,7 +34,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__text.json

@@ -15,7 +15,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__toolcall_complete.json

@@ -30,7 +30,6 @@
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_chat__trailing_orphan.json

@@ -20,13 +20,12 @@
       ]
     },
     {
-      "content": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "content": "Tool execution was cancelled.",
       "role": "tool",
       "tool_call_id": "call_1"
     }
   ],
   "model": "gpt-4o-mini",
-  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true

tests/data/wire_payloads/openai_responses__mid_orphan.json

@@ -27,7 +27,7 @@
     },
     {
       "call_id": "call_2",
-      "output": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "output": "Tool execution was cancelled.",
       "type": "function_call_output"
     },
     {

tests/data/wire_payloads/openai_responses__native_orphan.json

@@ -21,7 +21,7 @@
     },
     {
       "call_id": "call_1",
-      "output": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "output": "Tool execution was cancelled.",
       "type": "function_call_output"
     }
   ],

tests/data/wire_payloads/openai_responses__trailing_orphan.json

@@ -16,7 +16,7 @@
     },
     {
       "call_id": "call_1",
-      "output": "Tool execution was cancelled. Outcome UNKNOWN — this call may have begun executing before the generation was stopped; do not assume it did not run, and reconcile before re-issuing it.",
+      "output": "Tool execution was cancelled.",
       "type": "function_call_output"
     }
   ],

tests/data/wire_payloads/openai_responses_max__text.json

@@ -1,32 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Hi there.",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "content": "Hello! How can I help?",
-      "role": "assistant",
-      "type": "message"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_options": {
-    "ttl": "30m"
-  },
-  "reasoning": {
-    "effort": "max"
-  },
-  "store": false,
-  "stream": true
-}

tests/data/wire_payloads/openai_responses_max__toolcall_complete.json

@@ -1,57 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Weather in Paris?",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "arguments": "{\"city\": \"Paris\"}",
-      "call_id": "call_1",
-      "name": "get_weather",
-      "type": "function_call"
-    },
-    {
-      "call_id": "call_1",
-      "output": "18C, clear.",
-      "type": "function_call_output"
-    },
-    {
-      "content": "It's 18C and clear in Paris.",
-      "role": "assistant",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_options": {
-    "ttl": "30m"
-  },
-  "reasoning": {
-    "effort": "max"
-  },
-  "store": false,
-  "stream": true,
-  "tools": [
-    {
-      "description": "Look up the weather for a city.",
-      "name": "get_weather",
-      "parameters": {
-        "properties": {
-          "city": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city"
-        ],
-        "type": "object"
-      },
-      "strict": false,
-      "type": "function"
-    }
-  ]
-}

tests/data/wire_payloads/openai_responses_verbosity_pro__text.json

@@ -1,36 +0,0 @@
-{
-  "include": [
-    "reasoning.encrypted_content"
-  ],
-  "input": [
-    {
-      "content": "Hi there.",
-      "role": "user",
-      "type": "message"
-    },
-    {
-      "content": "Hello! How can I help?",
-      "role": "assistant",
-      "type": "message"
-    },
-    {
-      "content": "What's the weather in Paris?",
-      "role": "user",
-      "type": "message"
-    }
-  ],
-  "max_output_tokens": 4096,
-  "model": "gpt-5.6-sol",
-  "prompt_cache_options": {
-    "ttl": "30m"
-  },
-  "reasoning": {
-    "effort": "high",
-    "mode": "pro"
-  },
-  "store": false,
-  "stream": true,
-  "text": {
-    "verbosity": "low"
-  }
-}

tests/test_admin_create_admin.py

@@ -1,170 +0,0 @@
-"""Tests for ``turnstone-admin create-admin`` (issue #824).
-
-``create-user`` creates a role-less user; the web UI derives a login's scopes
-purely from assigned roles, so that account logs in read-only and hits
-"Forbidden: token lacks 'approve' scope" on any admin action.  ``create-admin``
-assigns the built-in admin role — mirroring the web setup wizard
-(``POST /api/auth/setup``) — and promotes an existing role-less user, which is
-the recovery path for anyone already stuck.
-
-Each test drives the real ``_cmd_create_admin`` handler against a real,
-fully-migrated SQLite DB: the ``builtin-admin`` role is seeded by migration
-008, so the DB must be migrated (not just ``create_all``-built) for the role
-to exist.
-"""
-
-from __future__ import annotations
-
-import argparse
-from typing import TYPE_CHECKING, Any
-
-import pytest
-
-from turnstone.admin import _cmd_create_admin, _cmd_create_user
-from turnstone.core.auth import _load_user_permissions, _permissions_to_scopes
-from turnstone.core.storage import init_storage, reset_storage
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-    from pathlib import Path
-
-
-@pytest.fixture(autouse=True)
-def _reset_storage_singleton() -> Iterator[None]:
-    """Keep the module-global storage singleton from leaking across tests."""
-    reset_storage()
-    yield
-    reset_storage()
-
-
-def _db_args(db_path: str, **overrides: Any) -> argparse.Namespace:
-    """Build the Namespace ``_cmd_create_admin`` (and ``_cmd_create_user``) expect.
-
-    Pins every DB field so ``_get_storage`` resolves to the tmp sqlite file and
-    never leaks a ``TURNSTONE_DB_*`` env var (it only falls back when the attr
-    ``is None``).  ``token``/``scopes`` are only read by ``_cmd_create_user``.
-    """
-    base: dict[str, Any] = {
-        "username": "admin",
-        "name": "",
-        "password": "",
-        "token": False,
-        "scopes": "read,write,approve",
-        "db_backend": "sqlite",
-        "db_path": db_path,
-        "db_url": "",
-        "db_pool_size": 2,
-        "db_sslmode": "",
-        "db_sslrootcert": "",
-        "db_sslcert": "",
-        "db_sslkey": "",
-    }
-    base.update(overrides)
-    return argparse.Namespace(**base)
-
-
-def _migrated_storage(db_path: str) -> Any:
-    """Return a fully-migrated storage singleton (seeds the ``builtin-admin`` role)."""
-    return init_storage("sqlite", path=db_path, run_migrations=True)
-
-
-def _has_admin_role(storage: Any, user_id: str) -> bool:
-    return any(r.get("role_id") == "builtin-admin" for r in storage.list_user_roles(user_id))
-
-
-def _login_scopes(storage: Any, user_id: str) -> frozenset[str]:
-    """Scopes a password login would grant this user — the real lockout surface."""
-    return _permissions_to_scopes(_load_user_permissions(storage, user_id))
-
-
-def test_create_admin_fresh_user_gets_approve_scope(tmp_path: Path) -> None:
-    db_path = str(tmp_path / "admin.db")
-    storage = _migrated_storage(db_path)
-
-    _cmd_create_admin(_db_args(db_path, username="admin", name="Admin", password="hunter2!pw"))
-
-    user = storage.get_user_by_username("admin")
-    assert user is not None
-    assert _has_admin_role(storage, user["user_id"])
-    # The exact bug surface: a web login for this account must carry `approve`.
-    assert "approve" in _login_scopes(storage, user["user_id"])
-
-
-def test_create_admin_defaults_display_name_to_username(tmp_path: Path) -> None:
-    db_path = str(tmp_path / "admin.db")
-    storage = _migrated_storage(db_path)
-
-    _cmd_create_admin(_db_args(db_path, username="root", name="", password="hunter2!pw"))
-
-    user = storage.get_user_by_username("root")
-    assert user is not None
-    assert user["display_name"] == "root"
-
-
-def test_create_admin_promotes_existing_read_only_user(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """Issue #824 recovery path: a role-less create-user account, then create-admin."""
-    db_path = str(tmp_path / "admin.db")
-    storage = _migrated_storage(db_path)
-
-    # Reproduce the locked-out account exactly (role-less create-user).
-    _cmd_create_user(_db_args(db_path, username="admin", name="Admin", password="hunter2!pw"))
-    user = storage.get_user_by_username("admin")
-    assert user is not None
-    assert not _has_admin_role(storage, user["user_id"])
-    assert "approve" not in _login_scopes(storage, user["user_id"])  # locked out
-
-    # Unstick without recreating the user.
-    _cmd_create_admin(_db_args(db_path, username="admin"))
-
-    assert _has_admin_role(storage, user["user_id"])
-    assert "approve" in _login_scopes(storage, user["user_id"])
-    assert "Granted the admin role" in capsys.readouterr().out
-
-
-def test_create_admin_already_admin_is_idempotent(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    db_path = str(tmp_path / "admin.db")
-    storage = _migrated_storage(db_path)
-
-    _cmd_create_admin(_db_args(db_path, username="admin", name="Admin", password="hunter2!pw"))
-    capsys.readouterr()  # drop first-run output
-
-    _cmd_create_admin(_db_args(db_path, username="admin"))
-
-    user = storage.get_user_by_username("admin")
-    assert user is not None
-    admin_rows = [
-        r for r in storage.list_user_roles(user["user_id"]) if r.get("role_id") == "builtin-admin"
-    ]
-    assert len(admin_rows) == 1  # not duplicated
-    assert "already an admin" in capsys.readouterr().out
-
-
-def test_create_admin_short_password_rejected(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    db_path = str(tmp_path / "admin.db")
-    storage = _migrated_storage(db_path)
-
-    with pytest.raises(SystemExit) as exc_info:
-        _cmd_create_admin(_db_args(db_path, username="admin", name="Admin", password="short"))
-
-    assert exc_info.value.code == 1
-    assert "at least 8" in capsys.readouterr().err
-    assert storage.get_user_by_username("admin") is None  # nothing created
-
-
-def test_create_admin_invalid_username_rejected(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    db_path = str(tmp_path / "admin.db")
-    _migrated_storage(db_path)
-
-    with pytest.raises(SystemExit) as exc_info:
-        _cmd_create_admin(_db_args(db_path, username="bad user!", name="X", password="hunter2!pw"))
-
-    assert exc_info.value.code == 1
-    assert "invalid username" in capsys.readouterr().err

tests/test_app_js.py

@@ -9,8 +9,6 @@ manual testing.
 
 from __future__ import annotations
 
-import json
-import os
 import re
 import subprocess
 from pathlib import Path
@@ -19,12 +17,6 @@ import pytest
 
 _APP_JS = Path(__file__).resolve().parent.parent / "turnstone/ui/static/app.js"
 _INTERACTIVE_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/interactive.js"
-_SHELL_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/shell.js"
-_REDACT_CREDENTIALS_JS = (
-    Path(__file__).resolve().parent.parent / "turnstone/shared_static/redact_credentials.js"
-)
-_CONSOLE_APP_JS = Path(__file__).resolve().parent.parent / "turnstone/console/static/app.js"
-_CONSOLE_INDEX = Path(__file__).resolve().parent.parent / "turnstone/console/static/index.html"
 
 
 def _pane_method_offset(body: str, name: str) -> int:
@@ -538,17 +530,15 @@ def test_phase8_appendtooloutput_dispatches_mcp_error_before_renderer() -> None:
     end = _pane_method_offset(body, "sendMessage")
     fn = body[start:end]
     parse_idx = fn.find("tryParseMcpError(")
-    # The plain-output render is the shared renderCollapsibleOutput helper; the
-    # ordering invariant is unchanged — MCP dispatch must precede it.
-    render_idx = fn.find("renderCollapsibleOutput(")
+    render_idx = fn.find("renderToolOutput(")
     assert parse_idx >= 0, (
         "appendToolOutput must call tryParseMcpError on the error path "
-        "before the plain renderer, otherwise the consent card never "
+        "before renderToolOutput, otherwise the consent card never "
         "replaces the plain JSON output."
     )
-    assert render_idx >= 0, "renderCollapsibleOutput call must remain present"
+    assert render_idx >= 0, "renderToolOutput call must remain present"
     assert parse_idx < render_idx, (
-        "tryParseMcpError must run BEFORE the plain renderer so the "
+        "tryParseMcpError must run BEFORE renderToolOutput so the "
         "interactive card path takes precedence over plain rendering."
     )
 
@@ -563,6 +553,7 @@ _CONSOLE_ADMIN_JS = Path(__file__).resolve().parent.parent / "turnstone/console/
 _CONSOLE_GOVERNANCE_JS = (
     Path(__file__).resolve().parent.parent / "turnstone/console/static/governance.js"
 )
+_CONSOLE_INTERACTIVE_JS = Path(__file__).resolve().parent.parent / "turnstone/console/static/app.js"
 
 
 _UNSAFE_CODE_SINK_LINT_TARGETS = [
@@ -573,7 +564,7 @@ _UNSAFE_CODE_SINK_LINT_TARGETS = [
     ("turnstone/console/static/coordinator/coordinator.js", _COORD_JS),
     ("turnstone/console/static/admin.js", _CONSOLE_ADMIN_JS),
     ("turnstone/console/static/governance.js", _CONSOLE_GOVERNANCE_JS),
-    ("turnstone/console/static/app.js", _CONSOLE_APP_JS),
+    ("turnstone/console/static/app.js", _CONSOLE_INTERACTIVE_JS),
 ]
 
 
@@ -677,82 +668,6 @@ def test_audio_roles_gated_to_openai_sdk_providers() -> None:
     assert '_providerCarriesAudio((md && md.provider) || "openai")' in body
 
 
-def test_model_response_controls_are_capability_driven_and_sparse() -> None:
-    """The model shelf surfaces Responses-only scalar controls without
-    hard-coding GPT-5.6 IDs or pinning inherited capability-table values."""
-    html = _CONSOLE_INDEX.read_text(encoding="utf-8")
-    admin = _CONSOLE_ADMIN_JS.read_text(encoding="utf-8")
-
-    assert 'id="model-response-controls"' in html
-    assert 'aria-labelledby="model-response-controls-title"' in html
-    assert 'id="model-output-verbosity"' in html
-    assert 'for="model-output-verbosity"' in html
-    assert 'id="model-reasoning-mode"' in html
-    assert 'for="model-reasoning-mode"' in html
-    for value in ("low", "medium", "high"):
-        assert f'<option value="{value}">' in html
-    for value in ("standard", "pro"):
-        assert f'<option value="{value}">' in html
-    assert 'data-cap="supports_verbosity"' in html
-    assert 'data-cap="supports_pro_mode"' in html
-
-    assert '"supports_verbosity"' in admin
-    assert '"supports_pro_mode"' in admin
-    surface = _slice_function_body(admin, "_modelUsesResponsesSurface")
-    assert surface is not None
-    assert 'provider === "openai"' in surface
-    assert 'provider === "openai-compatible"' in surface
-    assert 'value === "responses"' in surface
-    visibility = _slice_function_body(admin, "_updateModelResponseControls")
-    assert visibility is not None
-    assert "_modelGetTile(spec.supportKey)" in visibility
-    assert 'supportKey: "supports_verbosity"' in admin
-    assert 'supportKey: "supports_pro_mode"' in admin
-    assert "gpt-5.6" not in visibility, "visibility must come from capabilities, not model IDs"
-
-    assert "function _captureModelResponseControls(" in admin
-    assert "function _mergeModelResponseControls(" in admin
-    assert "_captureModelResponseControls(capsObj)" in admin
-    assert "_mergeModelResponseControls(caps)" in admin
-    assert "let _modelResponseCaptured = {};" in admin
-    assert "let _modelResponseDirty = {};" in admin
-    assert "_modelResponseCaptured[spec.key] = value" in admin
-    assert "nextIdentity === _modelResponseInitialIdentity" in admin
-    identity = _slice_function_body(admin, "_modelIdentity")
-    assert identity is not None
-    assert 'provider === "openai-compatible"' in identity
-    assert ': ""' in identity
-    merge = _slice_function_body(admin, "_mergeModelResponseControls")
-    assert merge is not None
-    # The dirty flag (select touched) may only override Advanced JSON for
-    # the identity that made it dirty — a stale flag from a renamed row
-    # must not delete a hand-typed JSON key.
-    assert "if (_modelResponseDirty[spec.key] && sameIdentity) delete caps[spec.key]" in merge
-    # The captured-value fallback is load-bearing, not a gating bug: a value
-    # lifted out of the row JSON on edit-open must stay visible and re-save
-    # for the same identity even when the baseline table says unsupported.
-    # The baseline arrives async (or never, on the compat lane); yielding to
-    # it would silently drop the pinned value on an unrelated edit-save.
-    # Wire safety lives server-side (emission gates on merged supports_*).
-    for body in (visibility, merge):
-        assert "_modelGetTile(spec.supportKey) || capturedFallback" in body
-        assert "sameIdentity" in body
-        assert "!(spec.supportKey in _modelCapsExplicit)" in body
-
-    create = _slice_function_body(admin, "showCreateModelModal")
-    assert create is not None
-    assert "_modelCapsSeq++" in create, "a fresh shelf must invalidate prior lookups"
-
-    assert "displayCaps.supports_verbosity !== false" in admin
-    assert "displayCaps.supports_pro_mode !== false" in admin
-
-    change = _slice_function_body(admin, "_onModelFieldChange")
-    assert change is not None
-    assert "_modelCapsSeq++" in change, "model changes must invalidate in-flight baselines"
-    assert "_modelCapsBaseline = {}" in change
-    assert 'apiSurfEl.addEventListener("change", _onModelFieldChange)' in admin
-
-
 def test_shared_utils_defines_set_markdown_helper() -> None:
     """The ``setMarkdown`` helper in ``shared/utils.js`` is the single
     audited entry point for rendering markdown content into a DOM
@@ -822,10 +737,7 @@ def test_dashboard_is_the_main_pane_body() -> None:
     body = _INDEX_HTML.read_text(encoding="utf-8")
     assert 'id="main"' in body, "the dashboard content lives in #main (the Dashboard pane body)."
     start = body.index('id="main"')
-    # Window spans the launcher (composer + options) through the workstreams
-    # table — it grows as launcher options are added (e.g. the project picker),
-    # so the bound just needs to keep BOTH inside #main, not be tight.
-    chunk = body[start : start + 4500]
+    chunk = body[start : start + 4000]
     assert 'id="dashboard-input"' in chunk and 'id="dash-ws-table"' in chunk, (
         "#main must hold the new-session launcher + the workstreams table."
     )
@@ -1038,7 +950,6 @@ _CONST_GUARD_BUNDLES = _SWEPT_BUNDLES + [
     _REPO_ROOT / "turnstone/shared_static/rail.js",
     _REPO_ROOT / "turnstone/shared_static/interactive.js",
     _REPO_ROOT / "turnstone/shared_static/conversation.js",
-    _REPO_ROOT / "turnstone/shared_static/redact_credentials.js",
 ]
 
 
@@ -1351,102 +1262,41 @@ def test_swept_bundle_has_no_const_reassign(bundle: Path) -> None:
         )
 
 
-def test_redact_credentials_runtime_smoke() -> None:
-    """Runtime smoke for ``redactCredentials`` via a temp harness file.
-    The function is pure (no DOM dependency).  Tests the shared module
-    directly via ESM import (replaces the legacy ``_redactApiKeys`` test
-    which now delegates to this).
-
-    The tempfile is written with a ``.mjs`` extension so Node forces ESM
-    parsing regardless of any ``package.json`` ``type`` field in parent
-    directories.  The ``redact_credentials.js`` source file is imported
-    by absolute path so resolution is unambiguous.
-    """
-    import tempfile
-
-    mod_path = _REDACT_CREDENTIALS_JS.resolve()
-    harness = (
-        "import { redactCredentials } from "
-        + json.dumps(str(mod_path))
-        + ";\n"
-        + "const q = redactCredentials('https://x?api_key=abc&u=foo');\n"
+def test_redact_api_keys_runtime_smoke() -> None:
+    """Runtime smoke for ``_redactApiKeys``.  The function is pure — no
+    DOM dependency — so it transplants cleanly into a standalone
+    ``node -e`` invocation.  This is the bit that would have caught
+    the original ``const redacted`` bug (which ``node --check`` and a
+    pure-static keyword scan both miss; the ``TypeError`` only fires
+    at call-time)."""
+    body = _INTERACTIVE_JS.read_text(encoding="utf-8")
+    m = re.search(
+        r"function _redactApiKeys\(text\) \{.*?\n\}\n",
+        body,
+        re.DOTALL,
+    )
+    assert m is not None, "_redactApiKeys not found in app.js"
+    fn = m.group(0)
+    script = (
+        fn
+        + "\nconst q = _redactApiKeys('https://x?api_key=abc&u=foo');\n"
         + 'if (q !== "https://x?api_key=***&u=foo") '
         + "throw new Error('query-string redact failed: ' + q);\n"
-        + 'const j = redactCredentials(\'{"api_key":"abc"}\');\n'
+        + 'const j = _redactApiKeys(\'{"api_key":"abc"}\');\n'
         + 'if (j !== \'{"api_key":"***"}\') '
         + "throw new Error('json-style redact failed: ' + j);\n"
-        + "// Bearer token redaction (raw input)\n"
-        + "const b = redactCredentials('Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.test-token_here');\n"
-        + "if (!b.includes('[REDACTED:api_key]')) "
-        + "throw new Error('bearer redact failed: ' + b);\n"
-        + "// Connection string redaction (raw input)\n"
-        + "const c = redactCredentials('postgresql://user:supersecret@localhost/db');\n"
-        + "if (!c.includes('[REDACTED:password]')) "
-        + "throw new Error('conn-string redact failed: ' + c);\n"
-        + "// Authorization JSON key redaction (step 6 comprehensive)\n"
-        + 'const a = redactCredentials(\'{"Authorization": "Bearer canstillseethis"}\');\n'
-        + "if (!a.includes('[REDACTED:secret]')) "
-        + "throw new Error('authorization JSON redact failed: ' + a);\n"
-        + "// Single-quote JSON (Python dict repr / JS object literal)\n"
-        + "const sq = redactCredentials(\"{'Authorization': 'Bearer canstillseethis'}\");\n"
-        + "if (!sq.includes('[REDACTED:secret]')) "
-        + "throw new Error('single-quote authorization redact failed: ' + sq);\n"
-        + "// mongodb+srv connection string (Atlas SRV)\n"
-        + "const ms = redactCredentials('mongodb+srv://u:s3cretpw@cluster.mongodb.net/db');\n"
-        + "if (!ms.includes('[REDACTED:password]')) "
-        + "throw new Error('mongodb+srv redact failed: ' + ms);\n"
-        + "// lowercase bearer scheme (RFC 7235 case-insensitive)\n"
-        + "const lb = redactCredentials('authorization: bearer "
-        + "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig12345');\n"
-        + "if (!lb.includes('[REDACTED:api_key]')) "
-        + "throw new Error('lowercase bearer redact failed: ' + lb);\n"
-        + "// api_key= assignment redacts the whole token, not a garbled api_[REDACTED\n"
-        + "const ak = redactCredentials('api_key=abcdefghijklmnopqrstuvwxyz');\n"
-        + "if (ak !== '[REDACTED:api_key]') "
-        + "throw new Error('api_key= clean redact failed: ' + ak);\n"
-        + "// Prefilter fast path: plain text with no anchor substring is unchanged\n"
-        + "const fp = redactCredentials('build ok in 42s - 3 tests passed');\n"
-        + "if (fp !== 'build ok in 42s - 3 tests passed') "
-        + "throw new Error('prefilter fast-path no-op failed: ' + fp);\n"
-        + "// Bare credentials with no =, quote or @ anywhere must still redact\n"
-        + "// (these pin the prefilter as a superset of the pattern set)\n"
-        + "const bk = redactCredentials('loaded sk-abcdefghijklmnopqrstuvwx');\n"
-        + "if (bk !== 'loaded [REDACTED:api_key]') "
-        + "throw new Error('bare sk- redact failed: ' + bk);\n"
-        + "const aw = redactCredentials('using AKIAABCDEFGHIJKLMNOP now');\n"
-        + "if (aw !== 'using [REDACTED:api_key] now') "
-        + "throw new Error('bare AKIA redact failed: ' + aw);\n"
-        + "const bt = redactCredentials('Bearer abcdefghijklmnopqrstuvwxyz');\n"
-        + "if (bt !== '[REDACTED:api_key]') "
-        + "throw new Error('bare bearer redact failed: ' + bt);\n"
-        + "// SQLAlchemy dialect+driver connection URLs (psycopg2/asyncpg)\n"
-        + "const pg2 = redactCredentials('postgresql+psycopg2://user:s3cret@db:5432/app');\n"
-        + "if (pg2 !== 'postgresql+psycopg2://user:[REDACTED:password]@db:5432/app') "
-        + "throw new Error('psycopg2 conn redact failed: ' + pg2);\n"
-        + "const apg = redactCredentials('postgresql+asyncpg://user:s3cret@db/app');\n"
-        + "if (apg !== 'postgresql+asyncpg://user:[REDACTED:password]@db/app') "
-        + "throw new Error('asyncpg conn redact failed: ' + apg);\n"
-        + "// RFC 3986 schemes are case-insensitive - uppercase must not bypass\n"
-        + "const up = redactCredentials('POSTGRESQL+PSYCOPG2://user:s3cret@db/app');\n"
-        + "if (up !== 'POSTGRESQL+PSYCOPG2://user:[REDACTED:password]@db/app') "
-        + "throw new Error('uppercase scheme conn redact failed: ' + up);\n"
     )
-    with tempfile.NamedTemporaryFile(mode="w", suffix=".mjs", delete=False) as f:
-        f.write(harness)
-        tmp = f.name
     try:
         proc = subprocess.run(
-            ["node", tmp],
+            ["node", "-e", script],
             capture_output=True,
             text=True,
             timeout=15,
         )
     except FileNotFoundError:
         pytest.skip("node binary not available on PATH")
-    finally:
-        os.unlink(tmp)
     assert proc.returncode == 0, (
-        f"redactCredentials runtime smoke failed.  stdout={proc.stdout!r} stderr={proc.stderr!r}"
+        f"_redactApiKeys runtime smoke failed.  stdout={proc.stdout!r} stderr={proc.stderr!r}"
     )
 
 
@@ -1668,287 +1518,6 @@ def test_coord_connectsse_onerror_preserves_native_reconnect() -> None:
     assert passed, f"coordinator.js connectSSE.onerror regressed: {reason}"
 
 
-# ---------------------------------------------------------------------------
-# Coordinator-pane parity for the SSE overflow-recovery companions (issue #806).
-# The server-side fixes (emit-time batching, _ListenerQueue poison, out-of-band
-# closing) live in SessionUIBase and already cover EVERY SSE stream; these pin
-# the CLIENT-side companions ported into coordinator.js so it stops relying on
-# native reconnect alone — storm guard + degraded catch-up, close-on-hide /
-# replay-on-show, and drop-vs-render-wedge counters.
-# ---------------------------------------------------------------------------
-
-
-def test_coord_imports_shared_overflow_helpers() -> None:
-    """coordinator.js consumes the SAME sse_overflow.js helpers as the
-    interactive pane (over the /shared mount) so the trip threshold and cooldown
-    ladder cannot drift between the two surfaces."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(
-        r"import \{([^}]*)\} from \"/shared/sse_overflow\.js\";",
-        body,
-        re.S,
-    )
-    assert m is not None, "coordinator must import the shared overflow helpers"
-    imported = m.group(1)
-    for name in (
-        "OVERFLOW_TRIP_COUNT",
-        "OVERFLOW_TRIP_WINDOW_MS",
-        "DEGRADED_COOLDOWN_BASE_MS",
-        "DEGRADED_COOLDOWN_MAX_MS",
-        "DEGRADED_COOLDOWN_RESET_MS",
-        "overflowWindowTripped",
-        "degradedCooldownStep",
-    ):
-        assert name in imported, f"{name} must be imported from /shared/sse_overflow.js"
-    # No local fork of the extracted pure functions on the coordinator side.
-    assert not re.search(r"^\s*function overflowWindowTripped\(", body, re.M)
-    assert not re.search(r"^\s*function degradedCooldownStep\(", body, re.M)
-
-
-def test_coord_stream_overflow_case_counts_and_rate_limits() -> None:
-    """The coordinator handles the id-less ``stream_overflow`` frame: count it
-    (drop-vs-wedge field instrumentation) and feed the rolling-window storm
-    guard, exactly like the interactive pane."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    assert 'case "stream_overflow":' in body
-    assert "noteStreamOverflow();" in body
-    # The three-way health counter distinguishes dropped events (overflow /
-    # malformed frame) from render wedges (dispatch / render throw).
-    assert "streamHealth = { overflows: 0, renderThrows: 0, malformedFrames: 0 }" in body
-    assert "streamHealth.overflows += 1;" in body
-    assert "streamHealth.malformedFrames += 1;" in body
-    # Exactly two render-throw increment sites: the noteRenderThrow helper
-    # (all three contained render/finalize catches route through it — they
-    # recover with a plain-text fallback, so console.warn) and the onmessage
-    # dispatch catch (console.error class — the event is dropped outright).
-    # The three recovered call sites are pinned by label so a new render path
-    # that forgets to count surfaces loudly.
-    assert body.count("streamHealth.renderThrows += 1;") == 2
-    helper = re.search(r"function noteRenderThrow\(where, err\)\s*\{(.*?)\n  \}", body, re.S)
-    assert helper is not None, "noteRenderThrow helper not found"
-    assert "streamHealth.renderThrows += 1;" in helper.group(1)
-    assert 'noteRenderThrow("streamingRender", e);' in body
-    assert 'noteRenderThrow("in_progress_snapshot render", e);' in body
-    assert 'noteRenderThrow("streamingRenderFinalize", e);' in body
-    note = re.search(r"function noteStreamOverflow\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert note is not None, "noteStreamOverflow not found"
-    assert "overflowWindowTripped(" in note.group(1)
-    assert "enterDegradedCatchup()" in note.group(1)
-    # The trip handler only counts + trips; the cooldown reset lives in
-    # enterDegradedCatchup (keyed off lastDegradedAt) — the finding [0] shape.
-    assert "degradedCooldownMs" not in note.group(1), (
-        "noteStreamOverflow must not touch the cooldown — that reset defeated the ladder escalation"
-    )
-
-
-def test_coord_handleevent_dispatch_is_wedge_guarded() -> None:
-    """A throw escaping onmessage does NOT close the EventSource, so an
-    unguarded handler throw left the streaming refs stale and wedged every later
-    turn.  The coordinator wraps the dispatch and counts the throw (render-wedge
-    class) so a field report tells it apart from a dropped-events gap."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"try \{\s*handleEvent\(data\);\s*\} catch \(err\) \{(.*?)\}", body, re.S)
-    assert m is not None, "handleEvent(data) must be wrapped in try/catch in onmessage"
-    assert "streamHealth.renderThrows += 1;" in m.group(1)
-
-
-def test_coord_degraded_catchup_stops_live_stream_and_retries() -> None:
-    """Three overflow closes inside the window drop the coordinator to a
-    degraded catch-up: suspend the live stream, say so plainly, and reconnect
-    after a doubling cooldown — the reconnect replays the gap (or falls to the
-    /history floor once it outgrows the ring)."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"function enterDegradedCatchup\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert m is not None, "enterDegradedCatchup not found"
-    method = m.group(1)
-    assert "degradedCooldownStep(" in method
-    assert "lastDegradedAt = now" in method
-    # Suspend the stream BEFORE arming the retry timer (mirrors interactive's
-    # disconnect-then-rearm ordering) or the fresh timer is cancelled at once.
-    assert method.index("suspendStream()") < method.index("degradedTimer = setTimeout")
-    # Plain-language status, not a silent stall.
-    assert "catching up" in method
-    # A fresh connect must cancel a pending degraded timer so it can't
-    # double-open behind the retry — connectSSE's prologue routes through the
-    # shared closeStreamTransport teardown, which owns that clear (alongside
-    # the reconnect timer + the EventSource close/null).
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    assert "closeStreamTransport();" in conn.group(1)
-    teardown = re.search(r"function closeStreamTransport\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert teardown is not None, "closeStreamTransport not found"
-    assert "clearTimeout(degradedTimer)" in teardown.group(1)
-    assert "clearTimeout(reconnectTimer)" in teardown.group(1)
-    assert "evtSource = null;" in teardown.group(1)
-
-
-def test_coord_visibilitychange_closes_on_hide_reconnects_on_show() -> None:
-    """A hidden tab's throttled drain is the worst-case slow SSE consumer.  The
-    coordinator installs a visibilitychange handler that closes the stream on
-    hide (marking its OWN close via hiddenDisconnect) and reconnects on show from
-    the saved lastEventId, and removes the listener on teardown."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    assert 'document.addEventListener("visibilitychange", visHandler);' in body
-    assert 'document.removeEventListener("visibilitychange", visHandler);' in body
-    vis = re.search(r"function onVisibilityChange\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert vis is not None, "onVisibilityChange not found"
-    method = vis.group(1)
-    assert "document.hidden" in method
-    assert "suspendStream()" in method
-    assert "hiddenDisconnect = true;" in method
-    assert "else if (hiddenDisconnect)" in method
-    assert "connectSSE();" in method
-
-
-def test_coord_connectsse_defers_open_when_tab_hidden() -> None:
-    """connectSSE must never open an EventSource into a hidden tab — the single
-    chokepoint that also backstops a FIRST connect in a background tab (where the
-    close-on-hide handler never fires because there was no open stream).  It
-    marks hiddenDisconnect so the show edge owns the reconnect, marks the
-    deferral as a GAP (markStreamGap) so the eventual open runs the post-gap
-    recovery — without the mark a pane first opened in a background tab
-    silently missed every child/task created while hidden — and reports an
-    honest paused status instead of pinning "connecting" with no attempt in
-    flight."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    method = conn.group(1)
-    guard = method.index("if (document.hidden)")
-    open_idx = method.index("new EventSource(")
-    assert guard < open_idx, "the hidden guard must precede new EventSource"
-    head = method[guard:open_idx]
-    assert "markStreamGap();" in head, "the hidden deferral must count as a stream gap"
-    assert "hiddenDisconnect = true;" in head
-    assert "return;" in head
-    assert 'setSseStatus("paused' in head, "the deferral must report paused, not connecting"
-    # "connecting" is claimed only once an attempt actually starts — after
-    # the hidden guard, immediately before the EventSource construction.
-    connecting = method.index('setSseStatus("connecting')
-    assert guard < connecting < open_idx
-
-
-def test_coord_destroy_removes_visibility_handler_and_stream_transport() -> None:
-    """Teardown must detach the document-level visibilitychange listener (it
-    holds a strong ref to the closure) and tear down the stream transport —
-    closeStreamTransport closes the EventSource and cancels the reconnect +
-    degraded retry timers (pinned in the degraded-catchup test) — or a
-    destroyed pane leaks and a show edge / pending retry reopens its stream."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    d = re.search(r"function destroy\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert d is not None, "destroy not found"
-    method = d.group(1)
-    assert "removeVisibilityHandler();" in method
-    assert "closeStreamTransport();" in method
-
-
-def test_coord_close_session_detaches_visibility_reopen() -> None:
-    """coordCloseSession suspends the stream AND removes the visibilitychange
-    handler BEFORE awaiting the /close POST: a tab hide→show while the POST is
-    in flight must not reopen a stream against the workstream the server is
-    tearing down (404 / reconnect churn against a dead session).  The failure
-    paths resume via connectSSE, which reinstalls the handler at its
-    install-once chokepoint — so close-on-hide survives a failed close."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"async function coordCloseSession\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert m is not None, "coordCloseSession not found"
-    method = m.group(1)
-    suspend = method.index("suspendStream();")
-    unhook = method.index("removeVisibilityHandler();")
-    # The quoted URL fragment, not the bare word (comments mention /close too).
-    post = method.index('"/close"')
-    assert suspend < post, "stream suspension must precede the /close POST"
-    assert unhook < post, "visibility detach must precede the /close POST"
-    assert "resumeSse()" in method
-
-
-def test_coord_post_gap_sidebar_refresh_is_replay_aware() -> None:
-    """The replace-mode children/tasks refresh (a sidebar rebuild) must NOT
-    fire on every reconnect: child_ws_* / task-mutating events are ordinary
-    ring-buffer entries, so a cursor reconnect (replay_ok) redelivers them and
-    the sidebar heals through the normal handlers — a momentary blur→focus
-    under close-on-hide must not rebuild the sidebar.  The refresh fires
-    exactly when the replay cannot vouch for the gap: no resume cursor or an
-    over-threshold gap at onopen, or the server's replay_truncated envelope
-    (ring evicted), deduped per open via gapRefreshedAtOpen."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    conn = re.search(r"function connectSSE\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert conn is not None
-    method = conn.group(1)
-    gate = re.search(
-        r"wasReconnecting &&\s*\(lastEventId == null \|\| gapMs > GAP_REFRESH_THRESHOLD_MS\)",
-        method,
-    )
-    assert gate is not None, "onopen must gate the sidebar refresh on replay coverage"
-    assert "refreshSidebarAfterGap();" in method
-    assert "gapRefreshedAtOpen = true;" in method
-    # The ring-evicted signal triggers the same refresh (deduped per open).
-    trunc = re.search(r'case "replay_truncated":(.*?)break;', body, re.S)
-    assert trunc is not None, "replay_truncated case not found"
-    assert "refreshSidebarAfterGap()" in trunc.group(1)
-    assert "gapRefreshedAtOpen" in trunc.group(1)
-    # Deliberate suspends (hide / overflow / close-session) mark the gap so
-    # the next open participates in the recovery decision at all.
-    sus = re.search(r"function suspendStream\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert sus is not None, "suspendStream not found"
-    assert "markStreamGap();" in sus.group(1)
-    # The refresh helper carries the whole replace-mode bundle: children,
-    # tasks, and the live-badge purge (permanent 403/404 entries preserved).
-    ref = re.search(r"function refreshSidebarAfterGap\(\)\s*\{(.*?)\n  \}", body, re.S)
-    assert ref is not None, "refreshSidebarAfterGap not found"
-    assert "loadChildren({ replace: true });" in ref.group(1)
-    assert "loadTasks();" in ref.group(1)
-    assert "_liveBadgeCacheDelete(id)" in ref.group(1)
-
-
-def test_coord_defers_truncated_resync_and_consumes_at_idle() -> None:
-    """replay_truncated seen mid-stream must be DEFERRED, not dropped (matches
-    interactive's _pendingTruncatedResync): refetching immediately would detach
-    the live bubble (content OR a reasoning-only one), but skipping outright
-    leaves the ring-evicted turns lost for the session.  The guard covers both
-    streaming targets and latches otherwise; the next state_change=idle consumes
-    the flag — which also repairs a turn stranded by close-on-hide (stream_end
-    evicted while hidden), resetting the streaming refs first since
-    refetchHistory does not null them."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    trunc = re.search(r'case "replay_truncated":(.*?)break;', body, re.S)
-    assert trunc is not None, "replay_truncated case not found"
-    t = trunc.group(1)
-    assert "if (!currentAssistantEl && !currentReasoningEl)" in t
-    assert "refetchHistory();" in t
-    assert "pendingTruncatedResync = true;" in t
-    st = re.search(r'case "state_change":(.*?)\n      case ', body, re.S)
-    assert st is not None, "state_change case not found"
-    s = st.group(1)
-    assert "if (pendingTruncatedResync)" in s
-    assert "pendingTruncatedResync = false;" in s
-    assert "currentAssistantEl = null;" in s
-    assert "refetchHistory();" in s
-    # Consume the latch, THEN reset the dangling refs and refetch.
-    consume = s.index("pendingTruncatedResync = false;")
-    refetch = s.index("refetchHistory();")
-    assert consume < refetch
-
-
-def test_coord_detects_server_restart_by_backwards_event_id() -> None:
-    """A coordinator process restart resets the per-ws event counter, and the
-    replay path reports replay_ok for a stale-high cursor (past the new max), so
-    the gap is unsignalled and the sidebar goes stale.  onmessage catches it: a
-    live event id below the saved cursor == the counter reset → pull
-    authoritative sidebar state (deduped per open against onopen's refresh),
-    checked BEFORE the cursor is overwritten."""
-    body = _COORD_JS.read_text(encoding="utf-8")
-    m = re.search(r"evtSource\.onmessage = function \(event\) \{(.*?)\n    \};", body, re.S)
-    assert m is not None, "onmessage handler not found"
-    handler = m.group(1)
-    assert "Number(evtSource.lastEventId) < Number(lastEventId)" in handler
-    assert "!gapRefreshedAtOpen" in handler
-    assert "refreshSidebarAfterGap();" in handler
-    check = handler.index("Number(evtSource.lastEventId) < Number(lastEventId)")
-    overwrite = handler.index("lastEventId = evtSource.lastEventId;")
-    assert check < overwrite
-
-
 def test_interactive_history_is_rest_first_not_sse() -> None:
     """PR A converged interactive onto coord's REST-first history
     model: first paint and post-rewind re-render fetch ``GET /history``
@@ -2015,89 +1584,6 @@ def test_early_paint_tool_pending_wiring() -> None:
     assert "if (!announced) this.messagesEl.appendChild(block);" in body
 
 
-def test_task_agent_steps_never_escape_their_card() -> None:
-    """A task agent's sub-tool steps (``parent_call_id`` stamped) must nest in
-    the task card, never render as top-level rows that look like the main
-    harness issued them.  Two seams keep that true; this guards both against a
-    rename/deletion:
-
-    1. ``tool_info`` routes through ``_routeAgentItems`` first — a sub-tool
-       auto-resolved by policy / "Always" arrives as a ``tool_info`` and must
-       nest, not paint a duplicate top-level block (Copilot review on #732).
-    2. A child step whose ``task_agent`` row hasn't painted yet (the 4-wide
-       tool pool's ordering window) is BUFFERED and flushed when the row lands,
-       instead of escaping to top-level; the card also survives the parent
-       row's pending->resolved rebuild.
-    3. SAFETY VALVE: a buffered step whose parent row NEVER paints (an id-
-       correlation mismatch / aborted agent) is escaped to a top-level row after
-       a grace window, so it stays VISIBLE rather than buffered forever.
-    """
-    body = _INTERACTIVE_JS.read_text(encoding="utf-8")
-    # 1. tool_info nests via the same router as tool_pending / approve_request.
-    info = body[body.index('case "tool_info":') : body.index('case "approve_request":')]
-    assert 'this._routeAgentItems(evt.items, "info")' in info, (
-        "tool_info must route a parent-tagged sub-tool into the task card "
-        "before any top-level showInlineToolBlock fallback."
-    )
-    # 2. _routeAgentItems buffers an orphan child (instead of returning false,
-    #    which escapes it to top-level) when the parent card isn't painted yet.
-    route = body[
-        _pane_method_offset(body, "_routeAgentItems") : _pane_method_offset(
-            body, "_ensureAgentCard"
-        )
-    ]
-    assert "_bufferAgentOrphan(parentId, items, mode)" in route, (
-        "a parent-tagged child with no card yet must buffer, not fall through to a top-level paint."
-    )
-    # The buffer / flush / escape / relink helpers exist.
-    assert "_bufferAgentOrphan(parentId, items, mode) {" in body
-    assert "_flushAgentOrphans(parentIds) {" in body
-    assert "_escapeAgentOrphans(parentId) {" in body
-    assert "_relinkAgentCards(items) {" in body
-    assert body.count("this._relinkAgentCards(") >= 2, (
-        "both announceToolBlock and showInlineToolBlock must relink + flush so "
-        "a buffered step nests as soon as a tool row appears."
-    )
-    # 3. Safety valve: _bufferAgentOrphan arms a grace timer to _escapeAgentOrphans
-    #    so a never-painting parent's steps can't vanish (or leak) — they escape
-    #    back to a visible top-level paint.
-    buf = body[
-        _pane_method_offset(body, "_bufferAgentOrphan") : _pane_method_offset(
-            body, "_flushAgentOrphans"
-        )
-    ]
-    assert "setTimeout(" in buf and "_escapeAgentOrphans(parentId)" in buf, (
-        "a buffered orphan must arm a grace-window escape so it never stays "
-        "buffered (invisible) forever."
-    )
-    escape = body[
-        _pane_method_offset(body, "_escapeAgentOrphans") : _pane_method_offset(
-            body, "_relinkAgentCards"
-        )
-    ]
-    assert "announceToolBlock(" in escape, (
-        "the escape valve must render the steps top-level (visible), the "
-        "pre-buffer behaviour, rather than dropping them."
-    )
-    # Flush is targeted to the just-painted parents, not the whole map.
-    flush = body[
-        _pane_method_offset(body, "_flushAgentOrphans") : _pane_method_offset(
-            body, "_escapeAgentOrphans"
-        )
-    ]
-    assert "parentIds.forEach" in flush
-    # _ensureAgentCard re-attaches a DETACHED card across a parent-row rebuild,
-    # but builds fresh on a still-attached (cross-turn reused) call_id rather
-    # than stealing the prior agent's steps.
-    ensure = body[
-        _pane_method_offset(body, "_ensureAgentCard") : _pane_method_offset(
-            body, "_bufferAgentOrphan"
-        )
-    ]
-    assert "!card.wrap.isConnected" in ensure
-    assert "parentRow.appendChild(card.wrap);" in ensure
-
-
 def test_risk_level_normalized_before_dom_interpolation() -> None:
     """Server-supplied ``risk_level`` lands in className / data-risk strings the
     verdict + warning CSS depend on, so every interpolation must funnel through
@@ -2161,129 +1647,3 @@ def test_early_paint_screen_reader_announce() -> None:
     assert "toolAnnounce(_toolAnnounceText(list))" in body
     assert 'block.setAttribute("aria-busy", "true")' in body
     assert 'block.removeAttribute("aria-busy")' in body
-
-
-def test_global_stream_recovery_floor_and_render_coalescing() -> None:
-    """Perf-audit P0/P1 for the Tier-1 global stream.  The server's recovery
-    events for a truncated reconnect gap (``node_snapshot`` as the floor,
-    ``replay_truncated`` as the marker) used to fall through the handler
-    silently — workstreams created during a long hidden-tab gap never
-    rendered again, and missed ``ws_closed`` left ghost rows forever.  A
-    malformed frame is the same permanent drift (the cursor advances before
-    the parse), so it resyncs too.  ``fireRender`` is rAF-coalesced: every
-    ``ws_state`` (≥2 per tool round per workstream) used to trigger a
-    synchronous full rail rebuild."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    assert 'data.type === "node_snapshot"' in body
-    assert 'data.type === "replay_truncated"' in body
-    assert "function applyRosterSnapshot(" in body
-    assert "function resyncRoster(" in body
-    assert "malformed frame" in body
-    fire = body.index("function fireRender()")
-    assert "requestAnimationFrame(" in body[fire : fire + 700], (
-        "fireRender must coalesce subscriber repaints to one per frame"
-    )
-
-
-def test_server_global_accels_are_platform_aware_and_scoped() -> None:
-    """The standalone's keydown handler owns only the GLOBAL accels — new
-    workstream, switch, dashboard.  They pick the modifier per platform (Ctrl on
-    macOS where the browser owns Cmd, Alt elsewhere) so Ctrl+T/1-9 aren't eaten
-    by the browser off macOS.  The per-pane verbs (edit/refresh/fork/delete/
-    close) moved to shell.js, so the handler must not invoke them itself."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    assert "const IS_MAC" in body and 'navigator.platform.indexOf("Mac")' in body, (
-        "the accelerators need a platform check to choose Ctrl vs Alt"
-    )
-    handler = body[body.index('document.addEventListener("keydown"') :]
-    assert "const paneMod" in handler, (
-        "global accels must gate on the platform-aware paneMod, not raw ctrlKey"
-    )
-    assert 'e.ctrlKey && e.key === "t"' not in handler, (
-        "Ctrl+T is browser-reserved off macOS — new workstream must bind via paneMod"
-    )
-    assert "newWorkstream()" in handler and "switchTab(" in handler, (
-        "the standalone handler still owns new + switch"
-    )
-    # macOS Ctrl+T / Ctrl+D are the Cocoa transpose / delete-forward text
-    # bindings; the creation/dashboard chords must yield while typing, through
-    # the shared TS_SHELL.inEditable guard (not a per-file copy).
-    assert "TS_SHELL.inEditable(" in handler, (
-        "new + dashboard must yield to text editing (macOS Ctrl+T / Ctrl+D)"
-    )
-    # The per-pane verbs are shell.js's job now — the standalone handler must not
-    # double-bind them (shell.js drives them off the active pane's menu).
-    for verb in ("editWorkstreamTitle()", "forkWorkstream()", "confirmDeleteWorkstream()"):
-        assert verb not in handler, (
-            f"{verb} moved to shell.js — the app.js handler must not also bind it"
-        )
-
-
-def test_shortcut_overlay_labels_match_the_platform_modifier() -> None:
-    """The '?' help overlay must advertise the same modifier the handler
-    listens for — Ctrl on macOS, Alt on Windows/Linux — instead of a hardcoded
-    Ctrl that is wrong (and non-functional) off macOS."""
-    index = _INDEX_HTML.read_text(encoding="utf-8")
-    assert "const PANE_MOD" in index and 'navigator.platform.indexOf("Mac")' in index, (
-        "the overlay must compute its modifier label per platform"
-    )
-    assert "${PANE_MOD}+T" in index, "the New-workstream badge must render through PANE_MOD"
-    assert '<span class="kb-key">Ctrl+T</span>' not in index, (
-        "the New-workstream badge must not hardcode Ctrl (wrong off macOS)"
-    )
-
-
-def test_pane_menu_accels_are_shared_and_platform_aware() -> None:
-    """shell.js is the single source of truth for the per-pane tab-menu
-    shortcuts: the badge string and the keydown handler come from ONE registry,
-    so a badge can't advertise a chord the handler ignores.  Badges must be
-    platform-aware (no hardcoded Ctrl), and the shared handler must drive the
-    ACTIVE pane's own menu so each surface contributes only what it supports."""
-    shell = _SHELL_JS.read_text(encoding="utf-8")
-    assert "PANE_MENU_ACCELS" in shell and "function paneAccelBadge" in shell, (
-        "shell.js must own the accel registry + badge builder"
-    )
-    assert "const PANE_MOD_LABEL" in shell and 'navigator.platform.indexOf("Mac")' in shell, (
-        "the shared badge must be platform-aware (Ctrl on macOS, Alt elsewhere)"
-    )
-    # The tab-menu items carry a stable accel + a computed badge, NOT a hardcoded
-    # Ctrl string that would lie on Windows/Linux.
-    for accel in ("close-pane", "edit-title", "refresh-title", "delete"):
-        assert f'accel: "{accel}"' in shell, f"tab menu must tag the {accel} item"
-    assert 'key: "Ctrl+Shift+E"' not in shell and 'key: "Ctrl+W"' not in shell, (
-        "tab-menu badges must go through paneAccelBadge, not hardcoded Ctrl"
-    )
-    # The shared handler resolves the active pane and runs its menu item by accel.
-    assert "paneAccelFor(e)" in shell and "pane.tabMenu()" in shell, (
-        "the shared keydown handler must drive the active pane's menu by accel"
-    )
-    # The typing guard is shared (TS_SHELL.inEditable), not copied per surface.
-    assert "function inEditable(" in shell and "inEditable," in shell, (
-        "shell.js must define + expose the shared inEditable guard on TS_SHELL"
-    )
-    ui = _APP_JS.read_text(encoding="utf-8")
-    console = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert "_inEditable" not in ui and "_consoleInEditable" not in console, (
-        "surfaces must use TS_SHELL.inEditable, not a per-file copy of the guard"
-    )
-
-
-def test_console_has_matching_pane_hotkeys() -> None:
-    """The console regained pane hotkeys to match the standalone: a keydown
-    handler for switch (Mod+1-9) + dashboard (Ctrl+D), and a '?' overlay that
-    advertises them platform-aware.  New workstream and Fork are intentionally
-    omitted (no console fork / blank-new surface)."""
-    app = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert (
-        "_CONSOLE_IS_MAC" in app and "statefulTabs()" in app and 'openPane("dashboard")' in app
-    ), "the console must wire switch (statefulTabs) + dashboard hotkeys"
-    index = _CONSOLE_INDEX.read_text(encoding="utf-8")
-    assert "const PANE_MOD" in index and '"Panes"' in index, (
-        "the console '?' overlay needs a platform-aware Panes section"
-    )
-    assert "${PANE_MOD}+W" in index and "${PANE_MOD}+Shift+E" in index, (
-        "console badges must render through PANE_MOD"
-    )
-    assert '"Fork"' not in index and "New workstream" not in index, (
-        "Fork + New are intentionally omitted on the console"
-    )

tests/test_background_shells.py

@@ -1,670 +0,0 @@
-"""Unit tests for the per-session background-shell registry (#817).
-
-The registry backs the ``bash(run_in_background=true)`` / ``bash_output`` /
-``kill_shell`` tool surface: it spawns detached shells (``bash_N`` handles),
-buffers their merged output in a capped rolling buffer, serves delta reads
-(only lines since the last read), and reaps whole session groups on kill /
-owner reap / close — the #816 rule (the tracked command defines the lifetime,
-nothing escapes its process group) extended to explicit backgrounding.
-
-Pure registry tests — no ChatSession.  Session wiring is covered in
-``test_bash_background_tool.py``.
-"""
-
-import re
-import threading
-import time
-
-import pytest
-
-from tests._proc_helpers import kill_pid as _kill_pid
-from tests._proc_helpers import pid_alive as _pid_alive
-from tests._proc_helpers import poll_until as _wait_until
-
-# Module alias (from-style, matching the symbol imports below) for tests
-# that monkeypatch module attributes (os.killpg, subprocess.Popen, ...).
-from turnstone.core import background_shells as bg_mod
-from turnstone.core.background_shells import (
-    BackgroundShellRegistry,
-    FilterExecError,
-    FilterTimeoutError,
-    TooManyShellsError,
-    UnknownShellError,
-)
-
-
-def _wait_status(shell, status, timeout=10.0):
-    return _wait_until(lambda: shell.status == status, timeout=timeout)
-
-
-@pytest.fixture
-def registry():
-    reg = BackgroundShellRegistry()
-    yield reg
-    reg.close()
-
-
-# ---------------------------------------------------------------------------
-# Handles + spawning
-# ---------------------------------------------------------------------------
-
-
-def test_spawn_returns_incrementing_bash_handles(registry):
-    s1 = registry.spawn("sleep 30")
-    s2 = registry.spawn("sleep 30")
-    assert s1.shell_id == "bash_1"
-    assert s2.shell_id == "bash_2"
-
-
-def test_spawned_shell_is_running_with_live_pid(registry):
-    shell = registry.spawn("sleep 30")
-    assert shell.status == "running"
-    assert _pid_alive(shell.pid)
-
-
-def test_spawn_records_command(registry):
-    shell = registry.spawn("sleep 30")
-    assert shell.command == "sleep 30"
-
-
-def test_spawn_after_close_is_refused():
-    reg = BackgroundShellRegistry()
-    reg.close()
-    with pytest.raises(RuntimeError):
-        reg.spawn("echo hi")
-
-
-def test_max_live_shells_cap():
-    reg = BackgroundShellRegistry(max_shells=2)
-    try:
-        reg.spawn("sleep 30")
-        s2 = reg.spawn("sleep 30")
-        with pytest.raises(TooManyShellsError):
-            reg.spawn("sleep 30")
-        # Cap counts LIVE shells: killing one frees a slot.
-        reg.kill(s2.shell_id)
-        s3 = reg.spawn("sleep 30")
-        assert s3.status == "running"
-    finally:
-        reg.close()
-
-
-def test_completed_shells_do_not_count_toward_cap():
-    reg = BackgroundShellRegistry(max_shells=1)
-    try:
-        s1 = reg.spawn("true")
-        assert _wait_status(s1, "completed")
-        s2 = reg.spawn("sleep 30")
-        assert s2.status == "running"
-    finally:
-        reg.close()
-
-
-# ---------------------------------------------------------------------------
-# Exit tracking
-# ---------------------------------------------------------------------------
-
-
-def test_natural_exit_sets_completed_and_exit_code(registry):
-    shell = registry.spawn("exit 7")
-    assert _wait_status(shell, "completed")
-    assert shell.exit_code == 7
-
-
-def test_output_is_complete_once_completed(registry):
-    """Status flips to completed only after the drains finish: a read at
-    completed must see everything the command wrote."""
-    shell = registry.spawn("echo alpha; echo beta")
-    assert _wait_status(shell, "completed")
-    read = registry.read(shell.shell_id)
-    assert [ln.strip() for ln in read.lines] == ["alpha", "beta"]
-
-
-def test_leader_exit_reaps_backgrounded_grandchild(registry, tmp_path):
-    """#816 consistency: the tracked command defines the lifetime.  When the
-    leader exits, the whole session group is killed — a child the command
-    backgrounded does not outlive it."""
-    pidfile = tmp_path / "bg.pid"
-    shell = registry.spawn(f"sleep 60 & echo $! > {pidfile}; echo done")
-    bg_pid = None
-    try:
-        assert _wait_status(shell, "completed")
-        bg_pid = int(pidfile.read_text().strip())
-        assert _wait_until(lambda: not _pid_alive(bg_pid)), (
-            f"grandchild {bg_pid} leaked past leader exit"
-        )
-        read = registry.read(shell.shell_id)
-        assert "done" in "".join(read.lines)
-    finally:
-        if bg_pid is not None:
-            _kill_pid(bg_pid)
-
-
-def test_stderr_lines_are_tagged_inline(registry):
-    shell = registry.spawn("echo out; echo err >&2")
-    assert _wait_status(shell, "completed")
-    lines = [ln.strip() for ln in registry.read(shell.shell_id).lines]
-    assert "out" in lines
-    assert "[stderr] err" in lines
-
-
-# ---------------------------------------------------------------------------
-# Delta reads
-# ---------------------------------------------------------------------------
-
-
-def test_read_returns_only_new_lines_since_last_read(registry):
-    """The load-bearing convention: consecutive reads never overlap and never
-    drop a line — collecting across polls yields each line exactly once."""
-    shell = registry.spawn("echo one; echo two; sleep 0.4; echo three; sleep 30")
-    collected: list[str] = []
-
-    def _collect():
-        collected.extend(ln.strip() for ln in registry.read(shell.shell_id).lines)
-        return "three" in collected
-
-    assert _wait_until(_collect)
-    assert collected == ["one", "two", "three"]
-    registry.kill(shell.shell_id)
-
-
-def test_read_after_exit_then_again_reports_no_new_output(registry):
-    shell = registry.spawn("echo hi")
-    assert _wait_status(shell, "completed")
-    first = registry.read(shell.shell_id)
-    assert [ln.strip() for ln in first.lines] == ["hi"]
-    second = registry.read(shell.shell_id)
-    assert second.lines == []
-    assert second.status == "completed"
-    assert second.exit_code == 0
-
-
-def test_read_reports_status_and_exit_code(registry):
-    shell = registry.spawn("sleep 30")
-    read = registry.read(shell.shell_id)
-    assert read.shell_id == shell.shell_id
-    assert read.status == "running"
-    assert read.exit_code is None
-    registry.kill(shell.shell_id)
-
-
-def test_read_unknown_id_raises_with_live_ids(registry):
-    registry.spawn("sleep 30")
-    with pytest.raises(UnknownShellError) as excinfo:
-        registry.read("bash_99")
-    assert "bash_99" in str(excinfo.value)
-    assert "bash_1" in str(excinfo.value)
-
-
-def test_read_unknown_id_when_registry_empty(registry):
-    with pytest.raises(UnknownShellError):
-        registry.read("bash_1")
-
-
-# ---------------------------------------------------------------------------
-# Filter
-# ---------------------------------------------------------------------------
-
-
-def test_filter_selects_matching_lines_only(registry):
-    shell = registry.spawn("echo match-a; echo skip-b; echo match-c")
-    assert _wait_status(shell, "completed")
-    read = registry.read(shell.shell_id, filter_pattern="^match")
-    assert [ln.strip() for ln in read.lines] == ["match-a", "match-c"]
-
-
-def test_filter_is_display_only_and_consumes_the_delta(registry):
-    """Filtered-out lines are consumed, not deferred — the cursor advances
-    past the whole delta (Claude Code ``BashOutput`` semantics)."""
-    shell = registry.spawn("echo match-a; echo skip-b")
-    assert _wait_status(shell, "completed")
-    first = registry.read(shell.shell_id, filter_pattern="^match")
-    assert [ln.strip() for ln in first.lines] == ["match-a"]
-    assert first.new_line_count == 2  # both lines were new, one shown
-    second = registry.read(shell.shell_id)
-    assert second.lines == []
-    assert second.new_line_count == 0
-
-
-def test_filter_uses_search_not_match(registry):
-    shell = registry.spawn("echo prefix-needle-suffix")
-    assert _wait_status(shell, "completed")
-    read = registry.read(shell.shell_id, filter_pattern="needle")
-    assert len(read.lines) == 1
-
-
-def test_invalid_filter_regex_raises(registry):
-    shell = registry.spawn("echo hi")
-    assert _wait_status(shell, "completed")
-    with pytest.raises(re.error):
-        registry.read(shell.shell_id, filter_pattern="[unclosed")
-
-
-# ---------------------------------------------------------------------------
-# Buffer cap
-# ---------------------------------------------------------------------------
-
-
-def test_buffer_cap_drops_oldest_and_reports_gap():
-    reg = BackgroundShellRegistry(max_buffer_chars=200)
-    try:
-        shell = reg.spawn('for i in $(seq 1 50); do echo "line-$i-padded-to-length"; done')
-        assert _wait_status(shell, "completed")
-        read = reg.read(shell.shell_id)
-        assert read.dropped_lines > 0
-        # Newest output survives; the tail is intact.
-        assert read.lines, "cap must retain the newest lines, not drop everything"
-        assert read.lines[-1].strip() == "line-50-padded-to-length"
-    finally:
-        reg.close()
-
-
-def test_unread_lines_excludes_buffer_evicted():
-    """The exit notice's line count must not promise evicted output."""
-    reg = BackgroundShellRegistry(max_buffer_chars=200)
-    try:
-        shell = reg.spawn('for i in $(seq 1 50); do echo "line-$i-padded-to-length"; done')
-        assert _wait_status(shell, "completed")
-        with shell.lock:
-            retained = len(shell._buffer)
-        assert shell.unread_lines == retained
-    finally:
-        reg.close()
-
-
-def test_buffer_gap_is_relative_to_cursor():
-    """Lines dropped BEFORE being read are a reported gap; lines already
-    read and then dropped are not."""
-    reg = BackgroundShellRegistry(max_buffer_chars=10_000)
-    try:
-        shell = reg.spawn("echo early; sleep 30")
-        # Each poll consumes whatever has arrived; stop once something did.
-        assert _wait_until(lambda: bool(reg.read(shell.shell_id).lines))
-        # Everything emitted so far is read; nothing has been dropped.
-        read = reg.read(shell.shell_id)
-        assert read.dropped_lines == 0
-        reg.kill(shell.shell_id)
-    finally:
-        reg.close()
-
-
-# ---------------------------------------------------------------------------
-# Kill / reap / close
-# ---------------------------------------------------------------------------
-
-
-def test_kill_marks_killed_and_reaps_group(registry, tmp_path):
-    pidfile = tmp_path / "bg.pid"
-    shell = registry.spawn(f"sleep 60 & echo $! > {pidfile}; sleep 60")
-    assert _wait_until(pidfile.exists)
-    bg_pid = int(pidfile.read_text().strip())
-    try:
-        killed = registry.kill(shell.shell_id)
-        assert killed.status == "killed"
-        assert _wait_until(lambda: not _pid_alive(shell.pid))
-        assert _wait_until(lambda: not _pid_alive(bg_pid)), "grandchild survived kill"
-    finally:
-        _kill_pid(bg_pid)
-
-
-def test_kill_unknown_id_raises(registry):
-    with pytest.raises(UnknownShellError):
-        registry.kill("bash_7")
-
-
-def test_killed_shell_output_remains_readable(registry, tmp_path):
-    """Output that arrived before the kill survives it: the record keeps its
-    buffer, and ``kill`` returns only after the drains have flushed."""
-    sentinel = tmp_path / "started"
-    shell = registry.spawn(f"echo before-kill; touch {sentinel}; sleep 60")
-    assert _wait_until(sentinel.exists)
-    registry.kill(shell.shell_id)
-    read = registry.read(shell.shell_id)
-    assert read.status == "killed"
-    assert "before-kill" in "".join(read.lines)
-
-
-def test_signal_all_kills_live_shells_without_closing(registry):
-    """signal_all is the instant half of teardown: every live group dies,
-    but the registry stays open (records intact, spawns still allowed) —
-    close() remains the complete teardown."""
-    s1 = registry.spawn("sleep 60")
-    s2 = registry.spawn("sleep 60")
-    registry.signal_all()
-    assert _wait_until(lambda: not _pid_alive(s1.pid))
-    assert _wait_until(lambda: not _pid_alive(s2.pid))
-    assert registry.has(s1.shell_id), "signal_all must not drop records"
-    s3 = registry.spawn("true")
-    assert _wait_status(s3, "completed"), "registry must remain usable after signal_all"
-
-
-def test_close_kills_everything_and_is_idempotent():
-    reg = BackgroundShellRegistry()
-    s1 = reg.spawn("sleep 60")
-    s2 = reg.spawn("sleep 60")
-    reg.close()
-    assert not _pid_alive(s1.pid)
-    assert not _pid_alive(s2.pid)
-    reg.close()  # second close is a no-op
-
-
-def test_reap_owner_kills_only_that_owners_shells(registry):
-    mine = registry.spawn("sleep 60", owner="agent-1")
-    other = registry.spawn("sleep 60", owner="agent-2")
-    main = registry.spawn("sleep 60")
-    registry.reap(owner="agent-1")
-    assert _wait_until(lambda: not _pid_alive(mine.pid))
-    assert _pid_alive(other.pid)
-    assert _pid_alive(main.pid)
-
-
-# ---------------------------------------------------------------------------
-# Owner scoping
-# ---------------------------------------------------------------------------
-
-
-def test_owner_scoped_lookup_isolates_shells(registry):
-    agent_shell = registry.spawn("sleep 30", owner="agent-1")
-    main_shell = registry.spawn("sleep 30")
-    # Main scope cannot see the agent's shell...
-    with pytest.raises(UnknownShellError):
-        registry.read(agent_shell.shell_id)
-    # ...and the agent scope cannot see the main shell.
-    with pytest.raises(UnknownShellError):
-        registry.read(main_shell.shell_id, owner="agent-1")
-    # Each side reads its own.
-    assert registry.read(agent_shell.shell_id, owner="agent-1").status == "running"
-    assert registry.read(main_shell.shell_id).status == "running"
-
-
-def test_shells_snapshot_is_owner_scoped(registry):
-    registry.spawn("sleep 30", owner="agent-1")
-    registry.spawn("sleep 30")
-    assert [s.owner for s in registry.shells(owner="agent-1")] == ["agent-1"]
-    assert [s.owner for s in registry.shells()] == [None]
-
-
-def test_handles_are_unique_across_owners(registry):
-    a = registry.spawn("sleep 30", owner="agent-1")
-    b = registry.spawn("sleep 30")
-    assert a.shell_id != b.shell_id
-
-
-# ---------------------------------------------------------------------------
-# Exit callback (the notice hook)
-# ---------------------------------------------------------------------------
-
-
-def test_on_exit_fires_once_on_natural_exit():
-    fired = threading.Event()
-    seen = []
-
-    def _on_exit(shell):
-        seen.append(shell)
-        fired.set()
-
-    reg = BackgroundShellRegistry(on_exit=_on_exit)
-    try:
-        shell = reg.spawn("echo done")
-        assert fired.wait(10)
-        assert len(seen) == 1
-        assert seen[0].shell_id == shell.shell_id
-        assert seen[0].exit_code == 0
-    finally:
-        reg.close()
-
-
-def test_on_exit_not_fired_for_kill():
-    seen = []
-    reg = BackgroundShellRegistry(on_exit=seen.append)
-    try:
-        shell = reg.spawn("sleep 60")
-        reg.kill(shell.shell_id)
-        assert _wait_until(lambda: not _pid_alive(shell.pid))
-        time.sleep(0.2)  # give a buggy late callback a chance to land
-        assert seen == []
-    finally:
-        reg.close()
-
-
-def test_on_exit_not_fired_for_close():
-    seen = []
-    reg = BackgroundShellRegistry(on_exit=seen.append)
-    shell = reg.spawn("sleep 60")
-    reg.close()
-    assert not _pid_alive(shell.pid)
-    time.sleep(0.2)
-    assert seen == []
-
-
-# ---------------------------------------------------------------------------
-# Review-hardening regressions (#817 code review)
-# ---------------------------------------------------------------------------
-
-
-def test_kill_on_completed_shell_does_not_signal_group(registry, monkeypatch):
-    """A completed shell's pgid is a stale snapshot the OS may have recycled
-    to an unrelated process group — kill() must not signal it (the waiter's
-    own group kill already ran at exit, when the pgid was fresh)."""
-    shell = registry.spawn("true")
-    assert _wait_status(shell, "completed")
-    calls = []
-    monkeypatch.setattr(bg_mod.os, "killpg", lambda *a: calls.append(a))
-    killed = registry.kill(shell.shell_id)
-    assert calls == [], "killpg must not fire for an already-exited shell"
-    assert killed.status == "completed", "a natural exit must not be relabelled 'killed'"
-
-
-def test_close_is_time_bounded_with_pipe_holding_escapee(registry, tmp_path):
-    """An escaped-group grandchild that holds the output pipes wedges the
-    drain threads.  close() must still return within its total budget —
-    it can run under the server's async close route, where an unbounded
-    join would freeze the whole node's event loop."""
-    pidfile = tmp_path / "holder.pid"
-    # ``setsid`` puts the sleep in a NEW session (outside our kill group)
-    # while it still inherits our stdout/stderr pipes — the accepted
-    # leaked-daemon case from the module docstring.
-    shell = registry.spawn(f"setsid sleep 60 & echo $! > {pidfile}; echo started")
-    assert _wait_until(pidfile.exists)
-    holder_pid = int(pidfile.read_text().strip())
-    try:
-        start = time.monotonic()
-        registry.close()
-        elapsed = time.monotonic() - start
-        assert elapsed < 8, f"close() took {elapsed:.1f}s — teardown must be budget-bounded"
-    finally:
-        _kill_pid(holder_pid)
-        # The holder is dead, so the wedged drains EOF promptly; wait for
-        # them here so the conftest leak guard sees a clean teardown.
-        assert _wait_until(lambda: not any(t.is_alive() for t in shell._threads))
-
-
-def test_exited_records_are_pruned_at_cap():
-    reg = BackgroundShellRegistry(max_exited_records=2)
-    try:
-        shells = [reg.spawn(f"echo job-{i}") for i in range(3)]
-        for s in shells:
-            assert _wait_status(s, "completed")
-        # Eviction happens on each exit; poll until the oldest is gone
-        # (waiter threads race, prune runs per-exit).
-        assert _wait_until(lambda: not reg.has(shells[0].shell_id))
-        assert reg.has(shells[1].shell_id)
-        assert reg.has(shells[2].shell_id)
-        with pytest.raises(UnknownShellError):
-            reg.read(shells[0].shell_id)
-    finally:
-        reg.close()
-
-
-def test_catastrophic_filter_times_out_without_consuming(registry):
-    """A backtracking-bomb filter must error within the bound and consume
-    NOTHING — the retry without a filter still gets the output.  The match
-    runs in a killable child process: sre holds the GIL, so an in-process
-    bomb would freeze the whole interpreter, watchdogs included."""
-    # One ~3000-char line of a's ending in 'b' — the classic (a+)+$ bomb
-    # subject — followed by a sentinel line.
-    shell = registry.spawn("printf 'a%.0s' $(seq 1 3000); echo b; echo tail-line")
-    assert _wait_status(shell, "completed")
-    start = time.monotonic()
-    with pytest.raises(FilterTimeoutError):
-        registry.read(shell.shell_id, filter_pattern=r"(a+)+$")
-    assert time.monotonic() - start < 10, "filter timeout must be bounded"
-    # Nothing was consumed: an unfiltered read sees the whole delta.
-    read = registry.read(shell.shell_id)
-    assert any("tail-line" in ln for ln in read.lines)
-
-
-def test_overlong_filter_pattern_is_rejected(registry):
-    shell = registry.spawn("echo hi")
-    assert _wait_status(shell, "completed")
-    with pytest.raises(re.error):
-        registry.read(shell.shell_id, filter_pattern="x" * 600)
-
-
-def test_cap_error_is_owner_scope_honest():
-    """The cap is registry-wide, but the advice must only name shells the
-    caller can actually kill — kill_shell is owner-scoped."""
-    reg = BackgroundShellRegistry(max_shells=1)
-    try:
-        reg.spawn("sleep 30")  # main scope fills the cap
-        with pytest.raises(TooManyShellsError) as excinfo:
-            reg.spawn("sleep 30", owner="agent-1")
-        msg = str(excinfo.value)
-        assert "bash_1" not in msg, "must not advise killing another scope's shell"
-        assert "other agents" in msg
-        # The same-scope variant names the killable shell.
-        with pytest.raises(TooManyShellsError) as excinfo2:
-            reg.spawn("sleep 30")
-        assert "bash_1" in str(excinfo2.value)
-        assert "kill_shell" in str(excinfo2.value)
-    finally:
-        reg.close()
-
-
-def test_prune_evicts_by_exit_order_not_spawn_order():
-    """A long-lived first-spawned server must never be evicted by its OWN
-    exit's prune once enough later jobs have finished — eviction follows
-    exit order, so the just-exited shell is always the newest record."""
-    reg = BackgroundShellRegistry(max_exited_records=2)
-    try:
-        server = reg.spawn("sleep 30")  # bash_1, exits LAST
-        jobs = [reg.spawn(f"echo job-{i}") for i in range(3)]
-        for job in jobs:
-            assert _wait_status(job, "completed")
-        reg.kill(server.shell_id)
-        assert reg.has(server.shell_id), "the just-exited shell must survive its own exit's prune"
-        # The earliest-EXITED job is the eviction victim, not bash_1.
-        assert _wait_until(lambda: len(reg.shells()) <= 3)
-        assert reg.read(server.shell_id).status == "killed"
-    finally:
-        reg.close()
-
-
-def test_thread_start_failure_leaves_no_orphan_record(registry, monkeypatch, tmp_path):
-    """If Thread.start raises (thread exhaustion), the record must be
-    unregistered and the fresh group reaped — an orphan with never-started
-    Thread objects would make every later close()/reap() join raise and
-    abort session teardown."""
-    pidfile = tmp_path / "leader.pid"
-    real_thread = bg_mod.threading.Thread
-
-    class FailingWaiterThread(real_thread):
-        def start(self):
-            if "bg-shell-wait" in (self.name or ""):
-                raise RuntimeError("can't start new thread")
-            super().start()
-
-    monkeypatch.setattr(bg_mod.threading, "Thread", FailingWaiterThread)
-    with pytest.raises(RuntimeError):
-        registry.spawn(f"echo $$ > {pidfile}; sleep 60")
-    assert registry.shells() == [], "failed spawn must not strand a record"
-    if pidfile.exists():
-        leader_pid = int(pidfile.read_text().strip())
-        assert _wait_until(lambda: not _pid_alive(leader_pid)), "fresh group leaked"
-    monkeypatch.undo()
-    registry.close()  # must not raise on the (empty) registry
-
-
-def test_filter_helper_failure_reports_exec_error_not_timeout(registry, monkeypatch):
-    """A crashed helper must not tell the model its (fine) pattern was too
-    slow — and must not consume the delta."""
-    shell = registry.spawn("echo hello")
-    assert _wait_status(shell, "completed")
-    monkeypatch.setattr(bg_mod.sys, "executable", "/bin/false")
-    with pytest.raises(FilterExecError) as excinfo:
-        registry.read(shell.shell_id, filter_pattern="hello")
-    assert "not a problem with your pattern" in str(excinfo.value)
-    monkeypatch.undo()
-    read = registry.read(shell.shell_id)
-    assert [ln.strip() for ln in read.lines] == ["hello"]
-
-
-def test_filter_matches_only_within_line_cap_and_reports_clipping(registry):
-    """Lines are truncated parent-side before shipping to the helper: a
-    match beyond the per-line cap is not found (a filter targets log
-    lines), and a huge retained line cannot burn the time budget on I/O.
-    The clipping is NEVER silent — the read reports how many lines were
-    only partially visible to the pattern."""
-    shell = registry.spawn("printf 'x%.0s' $(seq 1 5000); echo needle-suffix")
-    assert _wait_status(shell, "completed")
-    read = registry.read(shell.shell_id, filter_pattern="needle")
-    assert read.lines == []
-    assert read.new_line_count == 1
-    assert read.clipped_lines == 1
-
-
-def test_concurrent_reads_never_double_deliver(registry):
-    """Two simultaneous reads of one shell must SPLIT the delta between
-    them, never both return it — the whole pass (snapshot → commit)
-    serializes per shell.  Without that, a parallel tool batch reading the
-    same handle gets every line twice."""
-    shell = registry.spawn("seq 1 200")
-    assert _wait_status(shell, "completed")
-    results: list[list[str]] = [[], []]
-    barrier = threading.Barrier(2)
-
-    def _reader(slot: int) -> None:
-        barrier.wait()
-        results[slot] = [ln.strip() for ln in registry.read(shell.shell_id).lines]
-
-    threads = [threading.Thread(target=_reader, args=(i,)) for i in range(2)]
-    for t in threads:
-        t.start()
-    for t in threads:
-        t.join(timeout=10)
-    combined = results[0] + results[1]
-    assert len(combined) == 200, f"expected each line exactly once, got {len(combined)}"
-    assert sorted(combined, key=int) == [str(i) for i in range(1, 201)]
-
-
-def test_filter_helper_spawn_failure_is_exec_error(registry, monkeypatch):
-    """A helper that fails to LAUNCH (fork pressure) must land in the same
-    honest FilterExecError as a crashed helper — not escape as a raw
-    OSError blaming nothing — and must not consume the delta."""
-    shell = registry.spawn("echo hello")
-    assert _wait_status(shell, "completed")
-
-    def _boom(*args, **kwargs):
-        raise BlockingIOError("Resource temporarily unavailable")
-
-    monkeypatch.setattr(bg_mod.subprocess, "Popen", _boom)
-    with pytest.raises(FilterExecError):
-        registry.read(shell.shell_id, filter_pattern="hello")
-    monkeypatch.undo()
-    read = registry.read(shell.shell_id)
-    assert [ln.strip() for ln in read.lines] == ["hello"]
-
-
-def test_on_exit_exception_does_not_wedge_the_shell():
-    def _boom(shell):
-        raise RuntimeError("callback bug")
-
-    reg = BackgroundShellRegistry(on_exit=_boom)
-    try:
-        shell = reg.spawn("echo hi")
-        # The waiter thread must survive the callback raising: status still
-        # lands and output is still readable.
-        assert _wait_status(shell, "completed")
-        assert [ln.strip() for ln in reg.read(shell.shell_id).lines] == ["hi"]
-    finally:
-        reg.close()

tests/test_bash_background_tool.py

@@ -1,801 +0,0 @@
-"""Session-level tests for the background-shell tool surface (#817).
-
-Covers the wiring around :class:`BackgroundShellRegistry`:
-
-* ``bash`` gains ``run_in_background: true`` (alias ``is_background``) —
-  same approval gate, returns immediately with a ``bash_N`` handle.
-* ``bash_output`` — auto-approved delta reader (status + exit code + only
-  new output since the last call, optional ``filter`` regex).
-* ``kill_shell`` — auto-approved kill of a registered shell's whole group.
-* Exit notices ride the NudgeQueue on channel ``"any"`` (the watch rail) so
-  they drain at the next seam and can wake an idle workstream.
-* Lifecycle: ``close()`` reaps everything; generation-``cancel()`` does NOT
-  (a deliberately-detached server survives a stopped turn); shells spawned
-  inside a task_agent are owner-scoped and reaped when the agent finishes.
-"""
-
-import time
-
-import pytest
-
-from tests._proc_helpers import pid_alive as _pid_alive
-from tests._proc_helpers import poll_until as _wait_until
-from tests._session_helpers import make_session
-
-
-@pytest.fixture
-def session():
-    s = make_session()
-    yield s
-    s.close()
-
-
-def _start_background(session, command, call_id="bg1", **extra_args):
-    """Prepare + execute a backgrounded bash call; return the result text."""
-    args = {"command": command, "run_in_background": True, **extra_args}
-    prepared = session._prepare_bash(call_id, args)
-    assert "error" not in prepared, prepared.get("error")
-    _cid, output = prepared["execute"](prepared)
-    return output
-
-
-def _only_shell(session):
-    shells = session._background_shells.shells()
-    assert len(shells) == 1
-    return shells[0]
-
-
-# ---------------------------------------------------------------------------
-# bash: run_in_background routing
-# ---------------------------------------------------------------------------
-
-
-def test_prepare_bash_background_keeps_approval_gate(session):
-    prepared = session._prepare_bash("c1", {"command": "sleep 30", "run_in_background": True})
-    assert prepared["needs_approval"] is True
-    assert prepared["approval_label"] == "bash"
-
-
-def test_prepare_bash_background_header_says_background(session):
-    prepared = session._prepare_bash("c1", {"command": "sleep 30", "run_in_background": True})
-    assert "background" in prepared["header"]
-
-
-def test_background_bash_returns_immediately_with_handle(session):
-    start = time.monotonic()
-    output = _start_background(session, "sleep 30")
-    elapsed = time.monotonic() - start
-    assert elapsed < 5, f"backgrounded call blocked for {elapsed:.1f}s"
-    assert "bash_1" in output
-    shell = _only_shell(session)
-    assert shell.status == "running"
-    assert _pid_alive(shell.pid)
-
-
-def test_background_start_mentions_reader_and_killer(session):
-    """The immediate result must teach the follow-up tools — weak-prior
-    models (GPT-5.6) only reach for the poll pattern if the result names it."""
-    output = _start_background(session, "sleep 30")
-    assert "bash_output" in output
-    assert "kill_shell" in output
-
-
-def test_is_background_alias_accepted(session):
-    output = _start_background(session, "sleep 30", is_background=True)
-    assert "bash_1" in output
-    assert _only_shell(session).status == "running"
-
-
-def test_foreground_bash_routing_unchanged(session):
-    prepared = session._prepare_bash("c1", {"command": "echo hi"})
-    assert prepared["execute"] == session._exec_bash
-    prepared_false = session._prepare_bash("c2", {"command": "echo hi", "run_in_background": False})
-    assert prepared_false["execute"] == session._exec_bash
-
-
-def test_background_respects_command_blocklist(session):
-    prepared = session._prepare_bash("c1", {"command": "shutdown now", "run_in_background": True})
-    assert "error" in prepared
-    assert session._background_shells.shells() == []
-
-
-def test_background_ignores_timeout(session):
-    """No bounded wait exists to time out — a 1s timeout must not kill the
-    detached shell."""
-    _start_background(session, "sleep 30", timeout=1)
-    shell = _only_shell(session)
-    time.sleep(1.5)
-    assert shell.status == "running"
-    assert _pid_alive(shell.pid)
-
-
-def test_background_spawn_failure_reports_error(session, monkeypatch):
-    from turnstone.core import background_shells as bg_mod
-
-    def _boom(*args, **kwargs):
-        raise OSError("cannot fork")
-
-    monkeypatch.setattr(bg_mod.subprocess, "Popen", _boom)
-    prepared = session._prepare_bash("c1", {"command": "echo hi", "run_in_background": True})
-    _cid, output = prepared["execute"](prepared)
-    assert "cannot fork" in output
-
-
-def test_too_many_background_shells_reports_error(session, monkeypatch):
-    monkeypatch.setattr(session._background_shells, "_max_shells", 1)
-    _start_background(session, "sleep 30", call_id="bg1")
-    output = _start_background(session, "sleep 30", call_id="bg2")
-    assert "bash_1" in output  # the live shell is named so the model can kill it
-    assert len(session._background_shells.shells()) == 1
-
-
-# ---------------------------------------------------------------------------
-# bash_output
-# ---------------------------------------------------------------------------
-
-
-def test_bash_output_is_auto_approved(session):
-    prepared = session._prepare_bash_output("c1", {"id": "bash_1"})
-    assert prepared["needs_approval"] is False
-
-
-def test_bash_output_missing_id_errors(session):
-    prepared = session._prepare_bash_output("c1", {})
-    assert "error" in prepared
-
-
-def test_bash_output_returns_delta_then_no_new_output(session):
-    _start_background(session, "echo hello; sleep 30")
-    shell = _only_shell(session)
-    assert _wait_until(lambda: shell.status == "running")
-
-    def _read():
-        prepared = session._prepare_bash_output("r", {"id": shell.shell_id})
-        assert "error" not in prepared
-        return prepared["execute"](prepared)[1]
-
-    assert _wait_until(lambda: "hello" in _read())
-    again = _read()
-    assert "hello" not in again
-    assert "no new output" in again.lower()
-    assert "running" in again.lower()
-
-
-def test_bash_output_reports_exit_code_when_completed(session):
-    _start_background(session, "exit 3")
-    shell = _only_shell(session)
-    assert _wait_until(lambda: shell.status == "completed")
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id})
-    _cid, output = prepared["execute"](prepared)
-    assert "completed" in output.lower()
-    assert "3" in output
-
-
-def test_bash_output_filter_applies(session):
-    _start_background(session, "echo match-a; echo skip-b")
-    shell = _only_shell(session)
-    assert _wait_until(lambda: shell.status == "completed")
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id, "filter": "^match"})
-    _cid, output = prepared["execute"](prepared)
-    assert "match-a" in output
-    assert "skip-b" not in output
-
-
-def test_bash_output_invalid_filter_reports_error(session):
-    _start_background(session, "sleep 30")
-    shell = _only_shell(session)
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id, "filter": "[bad"})
-    _cid, output = prepared["execute"](prepared)
-    assert "regex" in output.lower() or "filter" in output.lower()
-
-
-def test_bash_output_unknown_id_lists_live_shells(session):
-    _start_background(session, "sleep 30")
-    prepared = session._prepare_bash_output("r", {"id": "bash_42"})
-    _cid, output = prepared["execute"](prepared)
-    assert "bash_42" in output
-    assert "bash_1" in output
-
-
-# ---------------------------------------------------------------------------
-# kill_shell
-# ---------------------------------------------------------------------------
-
-
-def test_kill_shell_is_auto_approved(session):
-    prepared = session._prepare_kill_shell("c1", {"id": "bash_1"})
-    assert prepared["needs_approval"] is False
-
-
-def test_kill_shell_missing_id_errors(session):
-    prepared = session._prepare_kill_shell("c1", {})
-    assert "error" in prepared
-
-
-def test_kill_shell_kills_and_reports(session):
-    _start_background(session, "sleep 60")
-    shell = _only_shell(session)
-    prepared = session._prepare_kill_shell("k", {"id": shell.shell_id})
-    _cid, output = prepared["execute"](prepared)
-    assert "killed" in output.lower()
-    assert _wait_until(lambda: not _pid_alive(shell.pid))
-    # The schema promises the exit code for ANY exited state, killed included.
-    read_prepared = session._prepare_bash_output("r", {"id": shell.shell_id})
-    _cid, read_output = read_prepared["execute"](read_prepared)
-    assert "exit code" in read_output
-
-
-def test_kill_shell_unknown_id_reports_error(session):
-    prepared = session._prepare_kill_shell("k", {"id": "bash_9"})
-    _cid, output = prepared["execute"](prepared)
-    assert "bash_9" in output
-
-
-# ---------------------------------------------------------------------------
-# Exit notices (NudgeQueue, channel "any", wake)
-# ---------------------------------------------------------------------------
-
-
-def test_natural_exit_enqueues_any_channel_notice(session):
-    _start_background(session, "echo done")
-    assert _wait_until(
-        lambda: any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-    )
-    entries = session._nudge_queue.pending(channel="any")
-    texts = [text for t, text in entries if t == "background_shell_exit"]
-    assert texts, "notice must ride channel 'any' so it can wake an idle workstream"
-    assert "bash_1" in texts[0]
-    assert "bash_output" in texts[0]
-
-
-def test_exit_notice_carries_metadata(session):
-    _start_background(session, "exit 5")
-    assert _wait_until(
-        lambda: any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-    )
-    metadata = [
-        meta
-        for t, _text, meta in session._nudge_queue.pending_with_metadata()
-        if t == "background_shell_exit"
-    ][0]
-    assert metadata["shell_id"] == "bash_1"
-    assert metadata["exit_code"] == 5
-
-
-def test_exit_notice_triggers_wake_fn(session):
-    wakes = []
-    session._watch_wake_fn = lambda: wakes.append(1)
-    _start_background(session, "echo done")
-    assert _wait_until(lambda: wakes), "natural exit must wake an idle workstream"
-
-
-def test_kill_shell_suppresses_exit_notice(session):
-    _start_background(session, "sleep 60")
-    shell = _only_shell(session)
-    prepared = session._prepare_kill_shell("k", {"id": shell.shell_id})
-    prepared["execute"](prepared)
-    assert _wait_until(lambda: not _pid_alive(shell.pid))
-    time.sleep(0.3)  # a buggy late notice would land within this window
-    assert not any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-
-
-def test_close_drops_pending_exit_notice_via_valid_until(session):
-    """A notice for a shell that no longer exists (registry closed) must not
-    deliver — the valid_until predicate drops it at drain time."""
-    _start_background(session, "echo done")
-    assert _wait_until(
-        lambda: any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-    )
-    session.close()
-    from turnstone.core.nudge_queue import USER_DRAIN
-
-    drained = session._nudge_queue.drain(USER_DRAIN)
-    assert not any(t == "background_shell_exit" for t, _text, _m in drained)
-
-
-# ---------------------------------------------------------------------------
-# Lifecycle
-# ---------------------------------------------------------------------------
-
-
-def test_close_reaps_background_shells(session):
-    _start_background(session, "sleep 60")
-    shell = _only_shell(session)
-    session.close()
-    assert not _pid_alive(shell.pid)
-
-
-def test_generation_cancel_does_not_reap_background_shells(session):
-    """cancel() fires on mere stop-generation — a deliberately-detached
-    server must survive it.  Only close()/kill_shell end it."""
-    _start_background(session, "sleep 60")
-    shell = _only_shell(session)
-    session.cancel()
-    time.sleep(0.3)
-    assert _pid_alive(shell.pid), "generation cancel must not kill detached shells"
-
-
-# ---------------------------------------------------------------------------
-# Review-hardening regressions (#817 code review)
-# ---------------------------------------------------------------------------
-
-
-def test_string_typed_background_flag_is_honored(session):
-    """Providers intermittently send booleans as strings; 'true' must not
-    silently fall through to the foreground executor (where the group kill
-    would reap the server the model believed it detached)."""
-    for call_id, args in (
-        ("s1", {"command": "sleep 30", "run_in_background": "true"}),
-        ("s2", {"command": "sleep 30", "is_background": "True"}),
-    ):
-        prepared = session._prepare_bash(call_id, args)
-        assert prepared["execute"] == session._exec_bash_background, args
-
-
-def test_kill_shell_on_completed_shell_reports_already_exited(session):
-    _start_background(session, "true")
-    shell = _only_shell(session)
-    assert _wait_until(lambda: shell.status == "completed")
-    prepared = session._prepare_kill_shell("k", {"id": shell.shell_id})
-    _cid, output = prepared["execute"](prepared)
-    assert "already exited" in output.lower()
-
-
-def test_exit_notice_survives_generation_abandon_without_waking(session):
-    """cancel/interrupt/exception clear generation-scoped advisories, but an
-    external event (a background shell exited) still happened — its notice
-    must survive to the next seam or the model keeps talking to a dead
-    server.  It survives DEMOTED to 'quiet': still deliverable, but no
-    longer wake-eligible, so the workstream the user just stopped cannot
-    resume itself over it."""
-    from turnstone.core.nudge_queue import USER_DRAIN, WAKE_PENDING
-
-    _start_background(session, "echo done")
-    assert _wait_until(
-        lambda: any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-    )
-    session._queue_tool_advisory("tool_error", "3 consecutive tool errors")
-    session._drain_pending_advisories()
-    kinds = [t for t, _ in session._nudge_queue.pending()]
-    assert "background_shell_exit" in kinds
-    assert "tool_error" not in kinds
-    # Post-cancel quiescence: nothing is wake-eligible...
-    assert not session._nudge_queue.has_pending(WAKE_PENDING)
-    # ...yet the notice still delivers at the next legitimate seam.
-    drained = session._nudge_queue.drain(USER_DRAIN)
-    assert any(t == "background_shell_exit" for t, _x, _m in drained)
-
-
-def test_int_typed_background_flag_is_honored(session):
-    prepared = session._prepare_bash("i1", {"command": "sleep 30", "run_in_background": 1})
-    assert prepared["execute"] == session._exec_bash_background
-    prepared_zero = session._prepare_bash("i2", {"command": "echo hi", "run_in_background": 0})
-    assert prepared_zero["execute"] == session._exec_bash
-
-
-def test_bash_output_non_string_filter_errors_without_consuming(session):
-    _start_background(session, "echo hello; sleep 30")
-    shell = _only_shell(session)
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id, "filter": 123})
-    assert "error" in prepared
-    assert "filter" in prepared["error"].lower()
-    # Nothing was consumed by the refused call.
-    assert _wait_until(lambda: shell.unread_lines > 0)
-
-
-def test_filter_timeout_reports_error_without_consuming(session, monkeypatch):
-    from turnstone.core.background_shells import FilterTimeoutError
-
-    _start_background(session, "sleep 30")
-    shell = _only_shell(session)
-
-    def _boom(*a, **kw):
-        raise FilterTimeoutError("filter regex took longer than 2s to run")
-
-    monkeypatch.setattr(session._background_shells, "read", _boom)
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id, "filter": "(a+)+$"})
-    _cid, output = prepared["execute"](prepared)
-    assert "filter" in output.lower()
-    assert "error" in output.lower()
-
-
-def test_registries_are_isolated_per_session():
-    """Workstream isolation: a handle from one session must be unresolvable
-    from another — buffers, ids, and kills never cross ChatSessions."""
-    session_a = make_session()
-    session_b = make_session()
-    try:
-        _start_background(session_a, "sleep 30")
-        shell_a = _only_shell(session_a)
-        read_b = session_b._prepare_bash_output("r", {"id": shell_a.shell_id})
-        _cid, output = read_b["execute"](read_b)
-        assert "no background shell" in output.lower()
-        kill_b = session_b._prepare_kill_shell("k", {"id": shell_a.shell_id})
-        _cid, kill_output = kill_b["execute"](kill_b)
-        assert "no background shell" in kill_output.lower()
-        assert _pid_alive(shell_a.pid), "another session must not be able to kill the shell"
-    finally:
-        session_a.close()
-        session_b.close()
-
-
-def test_bash_output_polling_is_repeat_exempt(session):
-    """Repeated identical bash_output calls ARE the documented monitoring
-    pattern — the repeat detector must not brand them 'identical repeat'
-    (the delta result differs by construction) nor queue a repeat nudge."""
-    import json as _json
-
-    _start_background(session, "sleep 30")
-    shell = _only_shell(session)
-    args = _json.dumps({"id": shell.shell_id})
-    for i in range(5):
-        tool_calls = [{"id": f"t{i}", "function": {"name": "bash_output", "arguments": args}}]
-        results = [(f"t{i}", "bash_1 (running)\nNo new output since the last read.")]
-        session._apply_post_execute_advisories(tool_calls, results)
-        assert "identical repeat" not in results[0][1]
-    assert not any(t == "repeat" for t, _ in session._nudge_queue.pending())
-
-
-def test_repeat_exempt_calls_still_break_other_streaks(session):
-    """The exemption suppresses the WARNING, not the recording: a
-    bash_output poll interleaved between identical bash calls must reset
-    the bash streak — otherwise the documented monitor-and-probe loop
-    (poll, curl health, poll, curl health…) draws a false 'identical
-    repeat' on the probe."""
-    import json as _json
-
-    _start_background(session, "sleep 30")
-    shell = _only_shell(session)
-    poll_args = _json.dumps({"id": shell.shell_id})
-    probe_args = _json.dumps({"command": "curl -s localhost:8080/health"})
-    for i in range(6):
-        probe = [{"id": f"p{i}", "function": {"name": "bash", "arguments": probe_args}}]
-        probe_results = [(f"p{i}", "ok")]
-        session._apply_post_execute_advisories(probe, probe_results)
-        assert "identical repeat" not in probe_results[0][1], (
-            "interleaved probes are not a stuck loop"
-        )
-        poll = [{"id": f"q{i}", "function": {"name": "bash_output", "arguments": poll_args}}]
-        session._apply_post_execute_advisories(poll, [(f"q{i}", "no new output")])
-
-
-def test_bash_repeats_still_warn(session):
-    """The exemption is bash_output-specific: a genuinely stuck identical
-    bash loop still gets the warning."""
-    import json as _json
-
-    args = _json.dumps({"command": "echo test"})
-    warned = False
-    for i in range(5):
-        tool_calls = [{"id": f"b{i}", "function": {"name": "bash", "arguments": args}}]
-        results = [(f"b{i}", "test")]
-        session._apply_post_execute_advisories(tool_calls, results)
-        warned = warned or "identical repeat" in results[0][1]
-    assert warned
-
-
-def test_quiet_only_entries_do_not_trigger_wake_delivery(session, monkeypatch):
-    """A dispatched wake whose wake-eligible entries all evaporated must be
-    a no-op: quiet entries alone never resume a stopped workstream, and
-    they stay queued for the next legitimate seam."""
-    calls = []
-    monkeypatch.setattr(session, "send", lambda *a, **k: calls.append(1))
-    session._nudge_queue.enqueue("background_shell_exit", "old news", "quiet")
-    session.deliver_wake_nudge_from_queue()
-    assert calls == []
-    assert session._nudge_queue.pending(channel="quiet") == [("background_shell_exit", "old news")]
-
-
-def test_wake_delivers_quiet_alongside_eligible_in_insertion_order(session, monkeypatch):
-    """Quiet entries ride the wake AND cross-channel chronology holds: an
-    older demoted notice renders before the newer fire that earned the
-    wake (a poll counter must never run backwards)."""
-    seen = {}
-
-    def _fake_send(*a, **k):
-        seen["reminders"] = list(session._wake_drained_reminders or [])
-        session._wake_drained_reminders = None  # emulate emission consuming
-
-    monkeypatch.setattr(session, "send", _fake_send)
-    session._nudge_queue.enqueue("background_shell_exit", "old", "quiet")
-    session._nudge_queue.enqueue("watch_triggered", "new", "any")
-    session.deliver_wake_nudge_from_queue()
-    types = [e["type"] for e in seen["reminders"]]
-    assert types == ["background_shell_exit", "watch_triggered"], (
-        "older quiet entry must precede the newer wake-eligible one"
-    )
-    assert session._nudge_queue.pending() == []
-
-
-def test_failed_wake_reenqueue_preserves_valid_until(session, monkeypatch):
-    """The re-enqueued notice keeps its staleness predicate — a stale
-    notice re-queued by a failed wake must still be droppable at its next
-    drain, not delivered against a gone shell."""
-    from turnstone.core.nudge_queue import USER_DRAIN
-
-    alive = {"value": True}
-
-    def _fail(*a, **k):
-        raise RuntimeError("storage down")
-
-    monkeypatch.setattr(session, "send", _fail)
-    session._nudge_queue.enqueue(
-        "background_shell_exit",
-        "server died",
-        "any",
-        valid_until=lambda: alive["value"],
-    )
-    with pytest.raises(RuntimeError):
-        session.deliver_wake_nudge_from_queue()
-    assert session._nudge_queue.pending(channel="quiet"), "notice must be re-queued"
-    alive["value"] = False  # the shell record is gone now
-    drained = session._nudge_queue.drain(USER_DRAIN)
-    assert drained == [], "stale re-queued notice must drop via its predicate"
-
-
-def test_mid_emit_failure_restashes_unemitted_tail(session, monkeypatch):
-    """A failure while emitting reminder k of n must leave k..n recoverable
-    — the wake caller's finally re-enqueues them instead of losing the
-    suffix."""
-    calls = {"n": 0}
-
-    def _append(source, text, **meta):
-        calls["n"] += 1
-        if calls["n"] == 2:
-            raise RuntimeError("storage down")
-
-    monkeypatch.setattr(session, "_append_system_turn", _append)
-    session._wake_drained_reminders = [
-        {"type": "a", "text": "1"},
-        {"type": "b", "text": "2"},
-        {"type": "c", "text": "3"},
-    ]
-    with pytest.raises(RuntimeError):
-        session._emit_pending_user_nudges()
-    assert session._wake_drained_reminders == [
-        {"type": "b", "text": "2"},
-        {"type": "c", "text": "3"},
-    ]
-
-
-def test_failed_wake_reenqueues_undelivered_as_quiet(session, monkeypatch):
-    """A wake send that dies before emitting its drained reminders must not
-    eat them — a shell's exit notice fires exactly once."""
-
-    def _fail(*a, **k):
-        raise RuntimeError("storage down")
-
-    monkeypatch.setattr(session, "send", _fail)
-    session._nudge_queue.enqueue(
-        "background_shell_exit", "server died", "any", metadata={"shell_id": "bash_1"}
-    )
-    with pytest.raises(RuntimeError):
-        session.deliver_wake_nudge_from_queue()
-    pending = session._nudge_queue.pending_with_metadata(channel="quiet")
-    assert [(t, x) for t, x, _m in pending] == [("background_shell_exit", "server died")]
-    assert pending[0][2] == {"shell_id": "bash_1"}
-
-
-def test_failed_wake_preserves_chronology_and_stays_wake_quiescent(session, monkeypatch):
-    """Failed-wake recovery invariants: (a) the re-queued external notice
-    keeps its seq, so the retry renders it BEFORE a newer event that
-    arrived during the failure; (b) NOTHING wake-eligible remains after
-    the failure — external notices demote to quiet and user-channel
-    advisories are dropped outright, because a re-armed WAKE_PENDING gate
-    plus the zero-backoff worker-exit retry would respawn wake workers in
-    an unbounded hot loop against a persistent failure."""
-    from turnstone.core.nudge_queue import WAKE_PENDING
-
-    calls = {"n": 0}
-    seen = {}
-
-    def _send(*a, **k):
-        calls["n"] += 1
-        if calls["n"] == 1:
-            raise RuntimeError("transient storage failure")
-        seen["reminders"] = list(session._wake_drained_reminders or [])
-        session._wake_drained_reminders = None
-
-    monkeypatch.setattr(session, "send", _send)
-    session._nudge_queue.enqueue("watch_triggered", "poll-4", "any")
-    session._nudge_queue.enqueue("correction", "user advisory", "user")
-    with pytest.raises(RuntimeError):
-        session.deliver_wake_nudge_from_queue()
-    # (b) bounded: nothing left that could re-trigger the wake gate.
-    assert not session._nudge_queue.has_pending(WAKE_PENDING), (
-        "a failed wake must not leave wake-eligible entries (respawn hot loop)"
-    )
-    assert [t for t, _x in session._nudge_queue.pending(channel="quiet")] == ["watch_triggered"]
-    # A NEWER event lands after the failure...
-    session._nudge_queue.enqueue("watch_triggered", "poll-5", "any")
-    session.deliver_wake_nudge_from_queue()
-    texts = [e["text"] for e in seen["reminders"]]
-    # (a) ...and the retry renders old-before-new despite the round trip.
-    assert texts.index("poll-4") < texts.index("poll-5")
-
-
-def test_exit_notice_emits_end_to_end_as_system_turn(session):
-    """THE test whose absence hid an undeliverable notice for six review
-    rounds: drive the notice through REAL emission (make_system_turn +
-    _append_system_turn), not just queue assertions — an unregistered
-    ``_source`` raises ValueError only at this layer."""
-    _start_background(session, "echo done")
-    assert _wait_until(
-        lambda: any(t == "background_shell_exit" for t, _ in session._nudge_queue.pending())
-    )
-    from turnstone.core.trajectory import Role
-
-    before = len(session.messages)
-    session._emit_pending_user_nudges()  # must not raise
-    new_turns = session.messages[before:]
-    assert any(
-        turn.role is Role.SYSTEM and turn.source == "background_shell_exit" for turn in new_turns
-    ), f"exit notice must land as a first-class system turn, got {new_turns!r}"
-
-
-def test_cli_exit_closes_every_loaded_session():
-    """CLI exit must reap background shells in EVERY workstream, not just
-    the active one — a server started before /new must not outlive /exit."""
-    from unittest.mock import MagicMock
-
-    from turnstone.cli import _close_all_sessions
-
-    ws_a, ws_b, ws_never_loaded = MagicMock(), MagicMock(), MagicMock()
-    ws_never_loaded.session = None
-    ws_a.session.close.side_effect = RuntimeError("bad teardown")
-    manager = MagicMock()
-    manager.list_all.return_value = [ws_a, ws_b, ws_never_loaded]
-    _close_all_sessions(manager)  # must not raise
-    ws_a.session.close.assert_called_once()
-    ws_b.session.close.assert_called_once(), "one bad teardown must not stop the rest"
-    # Signal phase ran for every loaded session, before any close.
-    ws_a.session._background_shells.signal_all.assert_called_once()
-    ws_b.session._background_shells.signal_all.assert_called_once()
-
-
-def test_cli_exit_ctrl_c_does_not_abort_the_reap():
-    """Ctrl-C during the close phase must not escape the helper: the kill
-    signals already landed on every session in phase 1, and an escaping
-    KeyboardInterrupt would also skip MCP/registry shutdown in main()."""
-    from unittest.mock import MagicMock
-
-    from turnstone.cli import _close_all_sessions
-
-    ws_a, ws_b = MagicMock(), MagicMock()
-    ws_a.session.close.side_effect = KeyboardInterrupt
-    manager = MagicMock()
-    manager.list_all.return_value = [ws_a, ws_b]
-    _close_all_sessions(manager)  # must not raise
-    ws_a.session._background_shells.signal_all.assert_called_once()
-    (
-        ws_b.session._background_shells.signal_all.assert_called_once(),
-        ("signals must land on every session before the interruptible close phase"),
-    )
-
-
-def test_non_string_reminder_text_drops_silently(session):
-    """A dict reminder with non-str text must drop at the rail, not
-    TypeError out of the dispatch closure (WatchRunner would re-fire the
-    row every tick)."""
-    runner = type(
-        "R",
-        (),
-        {
-            "set_dispatch_fn": lambda self, ws, fn: None,
-            "remove_dispatch_fn": lambda self, ws, owner=None: None,
-        },
-    )()
-    session.set_watch_runner(runner)
-    session._watch_dispatch_fn({"text": 123, "watch_name": "w"}, "watch-1")  # must not raise
-    assert session._nudge_queue.pending() == []
-
-
-def test_string_typed_stop_on_error_is_honored(session):
-    """One coercion dialect for every bash boolean: a string-typed
-    stop_on_error must add set -e in both branches, not silently drop it."""
-    fg = session._prepare_bash("f1", {"command": "echo hi", "stop_on_error": "true"})
-    assert fg["stop_on_error"] is True
-    bg = session._prepare_bash(
-        "b1", {"command": "echo hi", "run_in_background": True, "stop_on_error": "true"}
-    )
-    assert bg["stop_on_error"] is True
-
-
-def test_non_dict_watch_reminder_drops_silently(session):
-    """The rebuilt dispatch closure must drop a non-dict reminder like the
-    old code did — a TypeError would make WatchRunner hold and re-fire the
-    row every tick."""
-    runner = type(
-        "R",
-        (),
-        {
-            "set_dispatch_fn": lambda self, ws, fn: None,
-            "remove_dispatch_fn": lambda self, ws, owner=None: None,
-        },
-    )()
-    session.set_watch_runner(runner)
-    dispatch = session._watch_dispatch_fn
-    dispatch("not a dict", "watch-1")  # must not raise
-    assert session._nudge_queue.pending() == []
-
-
-def test_truthy_flag_dialect_is_unified():
-    """One coercion dialect file-wide — 'on' and nonzero numbers count, so a
-    provider quirk honored on coordinator tools is honored on bash too."""
-    from turnstone.core.session import _is_truthy_flag
-
-    assert _is_truthy_flag(True)
-    assert _is_truthy_flag("on")
-    assert _is_truthy_flag(2)
-    assert not _is_truthy_flag("off")
-    assert not _is_truthy_flag(0)
-    assert not _is_truthy_flag(None)
-    assert not _is_truthy_flag(False)
-
-
-def test_bash_output_notes_clipped_lines_under_filter(session):
-    _start_background(session, "printf 'x%.0s' $(seq 1 5000); echo tail")
-    shell = _only_shell(session)
-    assert _wait_until(lambda: shell.status == "completed")
-    prepared = session._prepare_bash_output("r", {"id": shell.shell_id, "filter": "zzz"})
-    _cid, output = prepared["execute"](prepared)
-    assert "partially visible" in output
-
-
-# ---------------------------------------------------------------------------
-# task_agent scoping
-# ---------------------------------------------------------------------------
-
-
-def test_task_agent_shells_are_owner_scoped_and_reaped(session, monkeypatch):
-    seen = {}
-
-    def fake_run_agent(agent_turns, label="task", **kwargs):
-        out = _start_background(session, "sleep 60", call_id="sub-bash")
-        seen["start_output"] = out
-        agent_shells = session._background_shells.shells(owner="task-1")
-        seen["agent_shells"] = list(agent_shells)
-        seen["pid"] = agent_shells[0].pid if agent_shells else None
-        # The sub-agent's shell is invisible to the main scope.
-        seen["visible_to_parent"] = [s.shell_id for s in session._background_shells.shells()]
-        return "agent done"
-
-    monkeypatch.setattr(session, "_run_agent", fake_run_agent)
-    call_id, result = session._exec_task({"call_id": "task-1", "prompt": "start a server"})
-    assert "agent done" in result
-    assert seen["agent_shells"], "shell spawned inside the agent must carry its owner"
-    # Scope honesty in the start message: the sub-agent must not promise its
-    # caller a server that dies the moment it returns.
-    assert "terminated when the agent finishes" in seen["start_output"]
-    assert seen["visible_to_parent"] == []
-    assert seen["pid"] is not None
-    assert _wait_until(lambda: not _pid_alive(seen["pid"])), (
-        "sub-agent shells must be reaped when the agent finishes"
-    )
-
-
-def test_task_agent_cannot_touch_parent_shells(session, monkeypatch):
-    _start_background(session, "sleep 60", call_id="parent-bash")
-    parent_shell = _only_shell(session)
-    seen = {}
-
-    def fake_run_agent(agent_turns, label="task", **kwargs):
-        prepared = session._prepare_bash_output("r", {"id": parent_shell.shell_id})
-        seen["read_output"] = prepared["execute"](prepared)[1]
-        prepared_kill = session._prepare_kill_shell("k", {"id": parent_shell.shell_id})
-        seen["kill_output"] = prepared_kill["execute"](prepared_kill)[1]
-        return "done"
-
-    monkeypatch.setattr(session, "_run_agent", fake_run_agent)
-    session._exec_task({"call_id": "task-1", "prompt": "snoop"})
-    assert "no background shell" in seen["read_output"].lower()
-    assert "no background shell" in seen["kill_output"].lower()
-    assert _pid_alive(parent_shell.pid), "agent must not be able to kill a parent shell"
-
-
-def test_parent_scope_restored_after_task_agent(session, monkeypatch):
-    monkeypatch.setattr(session, "_run_agent", lambda *a, **k: "done")
-    session._exec_task({"call_id": "task-1", "prompt": "noop"})
-    output = _start_background(session, "sleep 30", call_id="after-task")
-    assert "bash_1" in output
-    assert _only_shell(session).owner is None

tests/test_bash_tool_background_hang.py

@@ -1,165 +0,0 @@
-"""Regression tests for the bash tool hanging on a backgrounded child.
-
-A bash command that backgrounds a long-lived process (``server &``,
-``python -m http.server &``, any daemon) used to wedge the whole workstream
-forever: the child inherits the tool's stdout/stderr pipe, so the foreground
-read never hit EOF, and the timeout watchdog bailed the moment the tracked
-``bash`` exited.  ``_exec_bash`` now waits on the tracked process (not pipe
-EOF) bounded by ``tool_timeout`` and kills the whole session group on exit, so
-the call always returns and never leaks the background child.
-"""
-
-import threading
-import time
-
-from tests._proc_helpers import kill_pid as _kill_pid
-from tests._proc_helpers import pid_alive as _pid_alive
-from tests._session_helpers import NullUI, make_session
-from turnstone.core.trajectory import EffectStatus
-
-
-def _run_in_thread(fn, timeout):
-    """Run ``fn`` in a daemon thread; return ``(finished, result)``."""
-    box = {}
-
-    def _target():
-        box["result"] = fn()
-
-    t = threading.Thread(target=_target, daemon=True)
-    t.start()
-    t.join(timeout)
-    return (not t.is_alive()), box.get("result")
-
-
-def test_backgrounded_child_does_not_hang_and_is_reaped(tmp_path):
-    """Foreground exits immediately but leaves ``sleep 60 &`` holding the pipe.
-
-    Old behaviour: infinite hang (EOF never arrives, watchdog bails once the
-    tracked bash exits).  New behaviour: returns promptly and the background
-    child is reaped by the session-group kill.
-    """
-    pidfile = str(tmp_path / "bg.pid")
-    # A generous tool_timeout proves the return comes from foreground-exit, not
-    # from the deadline firing.
-    session = make_session(tool_timeout=30)
-    command = f"sleep 60 & echo $! > {pidfile}; echo done"
-    bg_pid = None
-    try:
-        finished, result = _run_in_thread(
-            lambda: session._exec_bash({"call_id": "c1", "command": command}),
-            timeout=15,
-        )
-        assert finished, "_exec_bash hung on a backgrounded child"
-        assert result is not None
-        call_id, output = result
-        assert call_id == "c1"
-        assert "done" in output
-
-        # The backgrounded process must have been reaped by the group kill.
-        with open(pidfile) as f:
-            bg_pid = int(f.read().strip())
-        deadline = time.monotonic() + 5
-        while _pid_alive(bg_pid) and time.monotonic() < deadline:
-            time.sleep(0.05)
-        assert not _pid_alive(bg_pid), f"backgrounded child {bg_pid} leaked"
-    finally:
-        if bg_pid is not None:
-            _kill_pid(bg_pid)
-
-
-def test_timeout_still_fires_with_backgrounded_child():
-    """A silent foreground command plus a backgrounded child still hits the
-    deadline: the watchdog kills the whole group and the result reads UNKNOWN
-    (the ``unknown, never none`` timeout discipline)."""
-    session = make_session(tool_timeout=1)
-    command = "sleep 60 & sleep 60"
-
-    finished, result = _run_in_thread(
-        lambda: session._exec_bash({"call_id": "c1", "command": command}),
-        timeout=10,
-    )
-    assert finished, "_exec_bash did not return at its deadline"
-    assert result is not None
-    call_id, output = result
-    assert call_id == "c1"
-    assert "timed out" in output.lower()
-    assert "UNKNOWN" in output
-    assert session._tool_status.get("c1") is EffectStatus.UNKNOWN
-
-
-def test_undecodable_output_is_preserved_not_swallowed():
-    """Undecodable bytes on stdout must not silently vanish.
-
-    The drain's broad ``except (ValueError, OSError)`` would otherwise catch the
-    ``UnicodeDecodeError`` (a ``ValueError``) and kill the thread before any line
-    was yielded — dropping ALL output and reporting a clean success.  ``Popen``
-    now decodes with ``errors="replace"`` so output always survives.
-    """
-    session = make_session(tool_timeout=30)
-    # Valid lines bracketing a raw invalid-UTF-8 byte sequence.
-    command = r"printf 'before\n'; printf '\xff\xfe'; printf 'after\n'"
-    finished, result = _run_in_thread(
-        lambda: session._exec_bash({"call_id": "c1", "command": command}),
-        timeout=15,
-    )
-    assert finished
-    assert result is not None
-    _call_id, output = result
-    assert output != "(no output)"
-    assert "before" in output
-    assert "after" in output
-
-
-def test_stdout_streams_to_ui_from_drain_thread():
-    """stdout chunks are now emitted from the drain thread; they must still reach
-    ``on_tool_output_chunk``."""
-    chunks: list[str] = []
-
-    class RecordingUI(NullUI):
-        def on_tool_output_chunk(self, call_id, chunk):
-            chunks.append(chunk)
-
-    session = make_session(tool_timeout=30, ui=RecordingUI())
-    finished, result = _run_in_thread(
-        lambda: session._exec_bash({"call_id": "c1", "command": "echo streamed-line"}),
-        timeout=15,
-    )
-    assert finished
-    assert any("streamed-line" in c for c in chunks)
-
-
-def test_cancel_midbash_reports_unknown():
-    """An external ``cancel()`` during a running bash unblocks the process-bounded
-    wait and reports UNKNOWN (unknown-never-none), not a clean result."""
-    session = make_session(tool_timeout=30)
-
-    def _cancel_soon():
-        time.sleep(0.5)
-        session.cancel()
-
-    threading.Thread(target=_cancel_soon, daemon=True).start()
-    finished, result = _run_in_thread(
-        lambda: session._exec_bash({"call_id": "c1", "command": "sleep 30"}),
-        timeout=15,
-    )
-    assert finished, "cancel did not unblock _exec_bash"
-    assert result is not None
-    _call_id, output = result
-    assert "cancelled" in output.lower()
-    assert session._tool_status.get("c1") is EffectStatus.UNKNOWN
-
-
-def test_popen_failure_reports_cleanly(monkeypatch):
-    """If ``Popen`` itself raises, the ``finally`` must not mask the real error
-    with ``UnboundLocalError`` — ``proc`` is pre-bound to ``None``."""
-    from turnstone.core import session as session_mod
-
-    session = make_session(tool_timeout=30)
-
-    def _boom(*args, **kwargs):
-        raise OSError("cannot fork")
-
-    monkeypatch.setattr(session_mod.subprocess, "Popen", _boom)
-    call_id, output = session._exec_bash({"call_id": "c1", "command": "echo hi"})
-    assert call_id == "c1"
-    assert "cannot fork" in output

tests/test_bootstrap.py

@@ -0,0 +1,683 @@
+"""Tests for the bootstrap wizard module."""
+
+from __future__ import annotations
+
+import os
+import socket
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from turnstone.bootstrap import (
+    SYSTEM_PROMPT,
+    TOOLS,
+    _BootstrapLLM,
+    _FinishError,
+    _mask_secrets,
+    _tool_check_docker,
+    _tool_check_port,
+    _tool_finish,
+    _tool_generate_secret,
+    _tool_read_file,
+    _tool_validate_api_key,
+    _tool_write_compose,
+    _tool_write_file,
+    execute_tool,
+)
+
+# ---------------------------------------------------------------------------
+# Tool function tests
+# ---------------------------------------------------------------------------
+
+
+class TestReadFile:
+    def test_existing_file(self, tmp_path: Path) -> None:
+        f = tmp_path / "test.txt"
+        f.write_text("hello world")
+        result = _tool_read_file(tmp_path, {"path": "test.txt"})
+        assert result == "hello world"
+
+    def test_missing_file(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "nope.txt"})
+        assert "Error: file not found" in result
+
+    def test_nested_path(self, tmp_path: Path) -> None:
+        sub = tmp_path / "sub"
+        sub.mkdir()
+        f = sub / "nested.txt"
+        f.write_text("nested content")
+        result = _tool_read_file(tmp_path, {"path": "sub/nested.txt"})
+        assert result == "nested content"
+
+    def test_path_traversal_blocked(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "../../etc/passwd"})
+        assert "escapes project directory" in result
+
+    def test_absolute_path_blocked(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "/etc/passwd"})
+        assert "escapes project directory" in result
+
+
+class TestWriteFile:
+    def test_write_confirmed(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "out.txt", "content": "data\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "out.txt").read_text() == "data\n"
+
+    def test_write_declined(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="n"):
+            result = _tool_write_file(tmp_path, {"path": "out.txt", "content": "data\n"})
+        assert "declined" in result
+        assert not (tmp_path / "out.txt").exists()
+
+    def test_write_creates_parent_dirs(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "a/b/c.txt", "content": "deep\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "a" / "b" / "c.txt").read_text() == "deep\n"
+
+    def test_sh_files_are_executable(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            _tool_write_file(tmp_path, {"path": "setup.sh", "content": "#!/bin/bash\n"})
+        mode = (tmp_path / "setup.sh").stat().st_mode
+        assert mode & 0o110  # user + group executable, not world
+
+    def test_path_traversal_blocked(self, tmp_path: Path) -> None:
+        result = _tool_write_file(tmp_path, {"path": "../../escape.txt", "content": "bad\n"})
+        assert "escapes project directory" in result
+
+    def test_default_enter_confirms(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value=""):
+            result = _tool_write_file(tmp_path, {"path": "ok.txt", "content": "ok\n"})
+        assert "written successfully" in result
+
+    def test_duplicate_write_skipped(self, tmp_path: Path) -> None:
+        (tmp_path / "dup.txt").write_text("same\n")
+        result = _tool_write_file(tmp_path, {"path": "dup.txt", "content": "same\n"})
+        assert "already exists" in result
+
+    def test_different_content_still_prompts(self, tmp_path: Path) -> None:
+        (tmp_path / "changed.txt").write_text("old\n")
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "changed.txt", "content": "new\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "changed.txt").read_text() == "new\n"
+
+
+class TestWriteCompose:
+    def test_writes_compose_file(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_compose(tmp_path, {})
+        assert "written successfully" in result
+        assert "ghcr.io" in result
+        content = (tmp_path / "compose.yaml").read_text()
+        assert "ghcr.io/turnstonelabs/turnstone" in content
+        assert "TURNSTONE_IMAGE_TAG" in content
+        # The compose mounts ./Caddyfile and ./searxng, so the wizard must write
+        # both alongside — guards the extra writes and the pyproject wheel-include.
+        caddyfile = (tmp_path / "Caddyfile").read_text()
+        assert "reverse_proxy console:8090" in caddyfile
+        searxng_cfg = (tmp_path / "searxng" / "settings.yml").read_text()
+        assert "json" in searxng_cfg  # the bundled config enables the JSON API
+
+    def test_user_declines(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="n"):
+            result = _tool_write_compose(tmp_path, {})
+        assert "declined" in result
+        assert not (tmp_path / "compose.yaml").exists()
+
+    def test_identical_content_skipped(self, tmp_path: Path) -> None:
+        # Write it once
+        with patch("builtins.input", return_value="y"):
+            _tool_write_compose(tmp_path, {})
+        # Second call should skip
+        result = _tool_write_compose(tmp_path, {})
+        assert "identical content" in result
+
+    def test_no_build_blocks(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            _tool_write_compose(tmp_path, {})
+        content = (tmp_path / "compose.yaml").read_text()
+        assert "build:" not in content
+        assert "dockerfile:" not in content.lower()
+
+    def test_overwrites_different_content(self, tmp_path: Path) -> None:
+        (tmp_path / "compose.yaml").write_text("old content\n")
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_compose(tmp_path, {})
+        assert "written successfully" in result
+        content = (tmp_path / "compose.yaml").read_text()
+        assert "ghcr.io" in content
+
+    def test_no_local_image_references(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            _tool_write_compose(tmp_path, {})
+        content = (tmp_path / "compose.yaml").read_text()
+        assert "turnstone:local" not in content
+
+
+class TestGenerateSecret:
+    def test_default_length(self) -> None:
+        secret = _tool_generate_secret({})
+        assert len(secret) == 64  # 32 bytes -> 64 hex chars
+
+    def test_custom_length(self) -> None:
+        secret = _tool_generate_secret({"length": 16})
+        assert len(secret) == 32
+
+    def test_uniqueness(self) -> None:
+        s1 = _tool_generate_secret({})
+        s2 = _tool_generate_secret({})
+        assert s1 != s2
+
+    def test_invalid_length_fallback(self) -> None:
+        secret = _tool_generate_secret({"length": -1})
+        assert len(secret) == 64  # falls back to 32 bytes
+
+    def test_excessive_length_capped(self) -> None:
+        secret = _tool_generate_secret({"length": 99999})
+        assert len(secret) == 64  # falls back to 32 bytes
+
+
+class TestCheckPort:
+    def test_available_port(self) -> None:
+        # Pick a random high port that's likely free
+        result = _tool_check_port({"port": 59123})
+        assert "AVAILABLE" in result or "IN USE" in result
+
+    def test_in_use_port(self) -> None:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            sock.bind(("127.0.0.1", 0))
+            port = sock.getsockname()[1]
+            sock.listen(1)
+            result = _tool_check_port({"port": port})
+        assert "IN USE" in result
+
+    def test_invalid_port(self) -> None:
+        result = _tool_check_port({"port": -1})
+        assert "Error" in result
+
+    def test_port_zero(self) -> None:
+        result = _tool_check_port({"port": 0})
+        assert "Error" in result
+
+
+class TestCheckDocker:
+    def test_docker_installed(self) -> None:
+        mock_docker = MagicMock()
+        mock_docker.returncode = 0
+        mock_docker.stdout = "24.0.7"
+
+        mock_compose = MagicMock()
+        mock_compose.returncode = 0
+        mock_compose.stdout = "2.24.5"
+
+        with patch("subprocess.run", side_effect=[mock_docker, mock_compose]):
+            result = _tool_check_docker({})
+        assert "Docker: installed" in result
+        assert "Docker Compose: installed" in result
+
+    def test_docker_not_installed(self) -> None:
+        with patch("subprocess.run", side_effect=FileNotFoundError):
+            result = _tool_check_docker({})
+        assert "NOT installed" in result or "NOT available" in result
+
+    def test_docker_daemon_not_running(self) -> None:
+        mock_docker = MagicMock()
+        mock_docker.returncode = 1
+        mock_docker.stderr = "Cannot connect to the Docker daemon"
+
+        mock_compose = MagicMock()
+        mock_compose.returncode = 1
+
+        with patch("subprocess.run", side_effect=[mock_docker, mock_compose]):
+            result = _tool_check_docker({})
+        assert "NOT running" in result
+
+
+class TestValidateApiKey:
+    def test_openai_success(self) -> None:
+        mock_client = MagicMock()
+        mock_client.models.list.return_value = []
+        with patch("openai.OpenAI", return_value=mock_client):
+            result = _tool_validate_api_key({"provider": "openai", "api_key": "sk-test"})
+        assert "Success" in result
+
+    def test_openai_failure(self) -> None:
+        with patch("openai.OpenAI") as mock_cls:
+            mock_cls.return_value.models.list.side_effect = Exception("Invalid key")
+            result = _tool_validate_api_key({"provider": "openai", "api_key": "bad"})
+        assert "Failed" in result
+
+    def test_unknown_provider(self) -> None:
+        result = _tool_validate_api_key({"provider": "unknown", "api_key": "x"})
+        assert "unknown" in result
+
+
+class TestExecuteTool:
+    def test_unknown_tool(self, tmp_path: Path) -> None:
+        result = execute_tool("nonexistent", {}, tmp_path)
+        assert "unknown tool" in result
+
+    def test_dispatches_correctly(self, tmp_path: Path) -> None:
+        f = tmp_path / "hello.txt"
+        f.write_text("hi")
+        result = execute_tool("read_file", {"path": "hello.txt"}, tmp_path)
+        assert result == "hi"
+
+    def test_finish_raises(self, tmp_path: Path) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError, match="All done"):
+            execute_tool("finish", {"summary": "All done"}, tmp_path)
+
+
+class TestFinishTool:
+    def test_raises_with_summary(self) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError) as exc_info:
+            _tool_finish({"summary": "Configured production deployment."})
+        assert exc_info.value.summary == "Configured production deployment."
+
+    def test_default_summary(self) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError) as exc_info:
+            _tool_finish({})
+        assert exc_info.value.summary == "Setup complete."
+
+
+# ---------------------------------------------------------------------------
+# Secret masking tests
+# ---------------------------------------------------------------------------
+
+
+class TestMaskSecrets:
+    def test_masks_api_key(self) -> None:
+        text = "OPENAI_API_KEY=sk-1234567890abcdef"
+        result = _mask_secrets(text)
+        assert "sk-1" in result
+        assert "cdef" in result
+        assert "1234567890abcde" not in result
+
+    def test_preserves_comments(self) -> None:
+        text = "# OPENAI_API_KEY=sk-1234567890abcdef"
+        result = _mask_secrets(text)
+        assert result == text
+
+    def test_preserves_short_values(self) -> None:
+        text = "TOKEN=short"
+        result = _mask_secrets(text)
+        assert result == text
+
+    def test_preserves_non_sensitive(self) -> None:
+        text = "MODEL=gpt-5.4"
+        result = _mask_secrets(text)
+        assert result == text
+
+
+# ---------------------------------------------------------------------------
+# Message conversion tests (Anthropic)
+# ---------------------------------------------------------------------------
+
+
+class TestAnthropicConversion:
+    """Test the Anthropic message/tool conversion inside _BootstrapLLM."""
+
+    def _make_llm(self) -> _BootstrapLLM:
+        return _BootstrapLLM("anthropic", MagicMock(), "test-model")
+
+    def test_tool_format_conversion(self) -> None:
+        """OpenAI tool format should convert to Anthropic format."""
+        llm = self._make_llm()
+        # The conversion happens inside _complete_anthropic; we test indirectly
+        # by checking the tools passed to the mock client
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="hello")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        llm.complete(
+            [{"role": "system", "content": "sys"}, {"role": "user", "content": "hi"}],
+            TOOLS[:1],  # Just read_file
+        )
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_tools = call_kwargs["tools"]
+        assert len(api_tools) == 1
+        assert api_tools[0]["name"] == "read_file"
+        assert "input_schema" in api_tools[0]
+        assert "description" in api_tools[0]
+
+    def test_system_message_extraction(self) -> None:
+        """System message should be extracted to system parameter."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="ok")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        llm.complete(
+            [{"role": "system", "content": "test system"}, {"role": "user", "content": "hi"}],
+            [],
+        )
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        assert call_kwargs["system"] == "test system"
+        # System should NOT appear in messages
+        for msg in call_kwargs["messages"]:
+            assert msg["role"] != "system"
+
+    def test_tool_result_conversion(self) -> None:
+        """OpenAI tool result messages should convert to Anthropic format."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="got it")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        messages = [
+            {"role": "system", "content": "sys"},
+            {"role": "user", "content": "hi"},
+            {
+                "role": "assistant",
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "check_docker", "arguments": "{}"},
+                    }
+                ],
+            },
+            {
+                "role": "tool",
+                "tool_call_id": "tc_1",
+                "content": "Docker: installed",
+            },
+        ]
+        llm.complete(messages, TOOLS)
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_messages = call_kwargs["messages"]
+
+        # Find the tool_result message
+        tool_result_found = False
+        for msg in api_messages:
+            if msg["role"] == "user" and isinstance(msg.get("content"), list):
+                for block in msg["content"]:
+                    if isinstance(block, dict) and block.get("type") == "tool_result":
+                        assert block["tool_use_id"] == "tc_1"
+                        assert block["content"] == "Docker: installed"
+                        tool_result_found = True
+        assert tool_result_found
+
+    def test_tool_use_blocks_in_assistant(self) -> None:
+        """Assistant messages with tool_calls should convert to content blocks."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="ok")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        messages = [
+            {"role": "system", "content": "sys"},
+            {"role": "user", "content": "hi"},
+            {
+                "role": "assistant",
+                "content": "Let me check",
+                "tool_calls": [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "check_docker", "arguments": "{}"},
+                    }
+                ],
+            },
+            {"role": "tool", "tool_call_id": "tc_1", "content": "ok"},
+        ]
+        llm.complete(messages, TOOLS)
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_messages = call_kwargs["messages"]
+
+        # First message should be user "hi"
+        assert api_messages[0]["role"] == "user"
+        # Second should be assistant with content blocks
+        assistant_msg = api_messages[1]
+        assert assistant_msg["role"] == "assistant"
+        assert isinstance(assistant_msg["content"], list)
+        # Should have text block + tool_use block
+        types = [b["type"] for b in assistant_msg["content"]]
+        assert "text" in types
+        assert "tool_use" in types
+
+
+class TestOpenAICompletion:
+    """Test the OpenAI path of _BootstrapLLM."""
+
+    def test_text_response(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+        mock_choice = MagicMock()
+        mock_choice.message.content = "Hello!"
+        mock_choice.message.tool_calls = None
+        mock_choice.finish_reason = "stop"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete([{"role": "user", "content": "hi"}], TOOLS)
+        assert content == "Hello!"
+        assert tool_calls is None
+        assert reason == "stop"
+
+    def test_tool_call_response(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+
+        mock_tc = MagicMock()
+        mock_tc.id = "call_123"
+        mock_tc.function.name = "check_docker"
+        mock_tc.function.arguments = "{}"
+
+        mock_choice = MagicMock()
+        mock_choice.message.content = ""
+        mock_choice.message.tool_calls = [mock_tc]
+        mock_choice.finish_reason = "tool_calls"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete(
+            [{"role": "user", "content": "check docker"}], TOOLS
+        )
+        assert tool_calls is not None
+        assert len(tool_calls) == 1
+        assert tool_calls[0]["function"]["name"] == "check_docker"
+        assert tool_calls[0]["id"] == "call_123"
+
+    def test_no_content(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+        mock_choice = MagicMock()
+        mock_choice.message.content = None
+        mock_choice.message.tool_calls = None
+        mock_choice.finish_reason = "stop"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete([{"role": "user", "content": "hi"}], [])
+        assert content == ""
+        assert tool_calls is None
+
+
+# ---------------------------------------------------------------------------
+# Conversation loop tests
+# ---------------------------------------------------------------------------
+
+
+class TestConversationLoop:
+    def test_quit_exits(self) -> None:
+        """User typing 'quit' should exit the loop."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = ("What would you like?", None, "stop")
+
+        with patch("builtins.input", return_value="quit"):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, Path("/tmp"))
+
+    def test_tool_calls_executed(self, tmp_path: Path) -> None:
+        """Tool calls should be executed and results fed back."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        # First call: LLM returns a tool call
+        llm.complete.side_effect = [
+            (
+                "",
+                [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "generate_secret", "arguments": "{}"},
+                    }
+                ],
+                "tool_calls",
+            ),
+            # Second call: LLM responds with text after seeing tool result
+            ("Here's your secret!", None, "stop"),
+        ]
+
+        with patch("builtins.input", return_value="quit"):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, tmp_path)
+
+        # Verify two calls were made
+        assert llm.complete.call_count == 2
+        # Verify tool result was fed back in second call's messages
+        second_call_messages = llm.complete.call_args_list[1][0][0]
+        tool_results = [m for m in second_call_messages if m.get("role") == "tool"]
+        assert len(tool_results) == 1
+        assert tool_results[0]["tool_call_id"] == "tc_1"
+        # Result should be a 64-char hex string
+        assert len(tool_results[0]["content"]) == 64
+
+    def test_empty_input_skipped(self) -> None:
+        """Empty user input should be skipped."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = ("Ask me something.", None, "stop")
+
+        call_count = 0
+
+        def mock_input(prompt: str = "") -> str:
+            nonlocal call_count
+            call_count += 1
+            if call_count <= 2:
+                return ""  # Empty inputs
+            return "quit"
+
+        with patch("builtins.input", side_effect=mock_input):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, Path("/tmp"))
+
+    def test_finish_tool_exits_loop(self, tmp_path: Path) -> None:
+        """LLM calling finish tool should exit the conversation cleanly."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = (
+            "",
+            [
+                {
+                    "id": "tc_fin",
+                    "type": "function",
+                    "function": {
+                        "name": "finish",
+                        "arguments": '{"summary": "All configured."}',
+                    },
+                }
+            ],
+            "tool_calls",
+        )
+
+        from turnstone.bootstrap import _run_conversation
+
+        # Should return without needing user input
+        _run_conversation(llm, tmp_path)
+        assert llm.complete.call_count == 1
+
+
+# ---------------------------------------------------------------------------
+# Interactive startup tests
+# ---------------------------------------------------------------------------
+
+
+class TestProviderDefaults:
+    def test_openai_default_model(self) -> None:
+        from turnstone.bootstrap import _DEFAULT_MODELS
+
+        assert _DEFAULT_MODELS["openai"] == "gpt-5.4"
+
+    def test_anthropic_default_model(self) -> None:
+        from turnstone.bootstrap import _DEFAULT_MODELS
+
+        assert _DEFAULT_MODELS["anthropic"] == "claude-sonnet-4-6"
+
+
+class TestSelectProvider:
+    def test_openai_selection(self) -> None:
+        """Selecting '1' should set up OpenAI."""
+        mock_client = MagicMock()
+        with (
+            patch("builtins.input", side_effect=["1", ""]),
+            patch("getpass.getpass", return_value="sk-test"),
+            patch("openai.OpenAI", return_value=mock_client),
+        ):
+            from turnstone.bootstrap import _select_provider
+
+            provider, client, model = _select_provider()
+        assert provider == "openai"
+        assert model == "gpt-5.4"
+
+    def test_local_selection(self) -> None:
+        """Selecting '3' should set up local/vLLM."""
+        mock_client = MagicMock()
+        # Ensure OPENAI_API_KEY is not in env so we hit the getpass path
+        env = {k: v for k, v in os.environ.items() if k != "OPENAI_API_KEY"}
+        with (
+            patch.dict("os.environ", env, clear=True),
+            patch("builtins.input", side_effect=["3", "http://localhost:8000/v1", "my-model"]),
+            patch("getpass.getpass", return_value="none"),
+            patch("openai.OpenAI", return_value=mock_client),
+        ):
+            from turnstone.bootstrap import _select_provider
+
+            provider, client, model = _select_provider()
+        assert provider == "openai"
+        assert model == "my-model"
+
+
+# ---------------------------------------------------------------------------
+# System prompt and tools sanity checks
+# ---------------------------------------------------------------------------
+
+
+class TestConstants:
+    def test_system_prompt_not_empty(self) -> None:
+        assert len(SYSTEM_PROMPT) > 500
+
+    def test_system_prompt_mentions_turnstone(self) -> None:
+        assert "Turnstone" in SYSTEM_PROMPT
+
+    def test_all_tools_have_required_fields(self) -> None:
+        for tool in TOOLS:
+            assert tool["type"] == "function"
+            func = tool["function"]
+            assert "name" in func
+            assert "description" in func
+            assert "parameters" in func
+            assert func["parameters"]["type"] == "object"
+
+    def test_tool_count(self) -> None:
+        assert len(TOOLS) == 8
+
+    def test_all_tools_have_implementations(self) -> None:
+        from turnstone.bootstrap import TOOL_FUNCTIONS
+
+        for tool in TOOLS:
+            name = tool["function"]["name"]
+            assert name in TOOL_FUNCTIONS, f"Missing implementation for tool: {name}"

tests/test_cancel.py

@@ -1,7 +1,6 @@
 """Tests for generation cancellation (cooperative cancel via threading.Event)."""
 
 import contextlib
-import json
 import threading
 import time
 from dataclasses import dataclass, field
@@ -9,20 +8,8 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
-from turnstone.core.session import (
-    ChatSession,
-    GenerationCancelled,
-    _CancelRef,
-    _tool_turn_meta,
-)
-from turnstone.core.trajectory import (
-    EffectStatus,
-    Role,
-    ToolCall,
-    Turn,
-    dicts_from_turns,
-    turn_from_dict,
-)
+from turnstone.core.session import ChatSession, GenerationCancelled, _CancelRef
+from turnstone.core.trajectory import dicts_from_turns, turn_from_dict
 
 
 class NullUI:
@@ -901,19 +888,12 @@ class TestSynthesizeCancelledResults:
         # All emitted as errors so the live UI renders them as
         # ``coord-tool-row-result--error``.
         assert all(tr[3] is True for tr in ui.tool_results)
-        # Reason text propagates as a prefix, now followed by an explicit
-        # UNKNOWN-outcome clause (unknown, never none — see HYPOTHESIS.md):
-        # the call may have begun executing before cancel, so the synthetic
-        # result must not read as "it didn't happen."
-        assert all(tr[2].startswith("Cancelled by user.") for tr in ui.tool_results)
-        assert all("UNKNOWN" in tr[2] for tr in ui.tool_results)
+        # Reason text propagates as the synthetic tool output.
+        assert all(tr[2] == "Cancelled by user." for tr in ui.tool_results)
         # And the message list has the synthesized tool entries
         # (preserves the prior contract).
         tool_msgs = [m for m in dicts_from_turns(session.messages) if m.get("role") == "tool"]
         assert len(tool_msgs) == 2
-        # Typed twin of the prose (Thread A): each synthesized turn is UNKNOWN.
-        tool_turns = [m for m in session.messages if m.role is Role.TOOL]
-        assert tool_turns and all(t.effect_status is EffectStatus.UNKNOWN for t in tool_turns)
 
     def test_skips_calls_already_answered(self, tmp_db):
         ui = self._ui_with_tool_result_tracking()
@@ -972,263 +952,3 @@ class TestSynthesizeCancelledResults:
 
         tool_msgs = [m for m in dicts_from_turns(session.messages) if m.get("role") == "tool"]
         assert len(tool_msgs) == 1
-
-
-class TestTimeoutDisposition:
-    """A tool stopped at its deadline has unobserved side effects, so its
-    result must read UNKNOWN — the same ``unknown, never none`` discipline as
-    cancellation (HYPOTHESIS.md effect-record appendix), applied to timeouts.
-    Read-only timeouts stay a plain failure: an idempotent read has nothing to
-    reconcile, and "reconcile before re-issuing" would be misleading there.
-    """
-
-    def test_bash_timeout_reads_unknown(self):
-        """A bash command is SIGKILL'd at its deadline — the same mid-flight
-        kill as cancel — so it may have run partially or had side effects and
-        must read UNKNOWN, not a flat 'timed out' that invites a blind re-run."""
-        session = _make_session(tool_timeout=1)
-        # Sleeps silently past the 1s deadline → watchdog SIGKILL → TimeoutExpired.
-        call_id, result = session._exec_bash({"call_id": "c1", "command": "sleep 30"})
-        assert call_id == "c1"
-        assert "timed out" in result.lower()
-        assert "UNKNOWN" in result
-        # Typed twin of the prose (Thread A): the producer records UNKNOWN.
-        assert session._tool_status.get("c1") is EffectStatus.UNKNOWN
-
-    def test_mcp_tool_timeout_reads_unknown(self):
-        """An MCP tool is an opaque action — the server may have run it to
-        completion before we stopped waiting, so the outcome reads UNKNOWN."""
-        session = _make_session()
-        session._mcp_client = MagicMock()
-        session._mcp_client.call_tool_sync.side_effect = TimeoutError()
-        call_id, result = session._exec_mcp_tool(
-            {"call_id": "c1", "mcp_func_name": "send_email", "mcp_args": {}}
-        )
-        assert call_id == "c1"
-        assert "timed out" in result.lower()
-        assert "UNKNOWN" in result
-        assert session._tool_status.get("c1") is EffectStatus.UNKNOWN
-
-    def test_mcp_resource_read_timeout_stays_plain(self):
-        """A resource read is an idempotent read with nothing to reconcile, so
-        its timeout stays a plain failure — no UNKNOWN/reconcile advice and no
-        typed status."""
-        session = _make_session()
-        session._mcp_client = MagicMock()
-        session._mcp_client.read_resource_sync.side_effect = TimeoutError()
-        call_id, result = session._exec_read_resource(
-            {"call_id": "c1", "resource_uri": "file:///doc"}
-        )
-        assert call_id == "c1"
-        assert "timed out" in result.lower()
-        assert "UNKNOWN" not in result
-        assert session._tool_status.get("c1") is None
-
-
-class TestCancelledAgentDisposition:
-    """A cancelled task_agent folds back an honest ledger, not a bare string.
-
-    Regression guard for the HYPOTHESIS.md cancellation appendix: ρ may
-    fabricate the acknowledgment but must not fabricate the outcome —
-    ``unknown``, never ``none``.
-    """
-
-    @staticmethod
-    def _assistant(call_id, name):
-        return Turn.assistant("", tool_calls=(ToolCall(id=call_id, name=name, arguments=""),))
-
-    @staticmethod
-    def _result(call_id, text="ok"):
-        return Turn.tool(call_id, text)
-
-    def test_status_none_when_no_actions(self):
-        """Typed twin of the disposition: a task cancelled before any action is
-        NONE, not UNKNOWN — the complement of the in-flight case."""
-        session = _make_session()
-        assert session._cancelled_agent_status([]) is EffectStatus.NONE
-
-    def test_status_unknown_when_in_flight(self):
-        session = _make_session()
-        msgs = [self._assistant("t1", "bash")]  # issued, no result → in flight
-        assert session._cancelled_agent_status(msgs) is EffectStatus.UNKNOWN
-
-    def test_status_partial_when_all_answered(self):
-        """Every issued call returned but the agent was stopped before finishing
-        — effects are known (not UNKNOWN) yet the task is incomplete: PARTIAL."""
-        session = _make_session()
-        msgs = [self._assistant("t1", "bash"), self._result("t1")]
-        assert session._cancelled_agent_status(msgs) is EffectStatus.PARTIAL
-
-    def test_no_actions_reports_no_side_effects(self, tmp_db):
-        session = _make_session()
-        out = session._cancelled_agent_disposition([], "task")
-        assert "no side effects" in out
-        assert "UNKNOWN" not in out
-
-    def test_marks_in_flight_action_unknown(self, tmp_db):
-        session = _make_session()
-        # bash completed; web_fetch was in flight (issued, no result yet) —
-        # the first unanswered call is the in-flight boundary.
-        msgs = [
-            self._assistant("t1", "bash"),
-            self._result("t1"),
-            self._assistant("t2", "web_fetch"),
-        ]
-        out = session._cancelled_agent_disposition(msgs, "task")
-        assert out != "(task interrupted by user)"
-        assert "Completed before cancel: bash." in out
-        assert "In flight at cancel: web_fetch" in out
-        assert "UNKNOWN" in out
-
-    def test_unanswered_tool_is_in_flight_unknown(self, tmp_db):
-        # An output-flowing bash SIGKILL'd mid-stream raises (no result row) —
-        # it is the in-flight boundary and must read UNKNOWN, never completed.
-        session = _make_session()
-        msgs = [self._assistant("t1", "bash")]  # issued, no result
-        out = session._cancelled_agent_disposition(msgs, "task")
-        assert "In flight at cancel: bash" in out
-        assert "UNKNOWN" in out
-        assert "Completed before cancel" not in out
-
-    def test_all_answered_reports_completed_no_in_flight(self, tmp_db):
-        # Every issued call returned a result — cancel landed between turns,
-        # nothing in flight. Each result carries its own disposition; the
-        # summary just lists what completed, with no UNKNOWN boundary.
-        session = _make_session()
-        msgs = [self._assistant("t1", "bash"), self._result("t1", "(killed)")]
-        out = session._cancelled_agent_disposition(msgs, "task")
-        assert "Completed before cancel: bash." in out
-        assert "In flight at cancel" not in out
-
-    def test_boundary_is_first_unanswered_not_last(self, tmp_db):
-        # Regression (bug-1): a turn issues [bash, web_fetch] executed
-        # sequentially; cancel hits during bash (unanswered, side effects
-        # possible) and web_fetch never runs. The in-flight UNKNOWN must be
-        # bash (the FIRST gap), and web_fetch must read "not started" — NOT
-        # the inverse. The old code took the LAST issued call, labelling the
-        # never-run web_fetch UNKNOWN and the actually-in-flight bash "not
-        # started" — inviting a re-run of the destructive bash.
-        session = _make_session()
-        msgs = [
-            Turn.assistant(
-                "",
-                tool_calls=(
-                    ToolCall(id="t1", name="bash", arguments=""),
-                    ToolCall(id="t2", name="web_fetch", arguments=""),
-                ),
-            )
-        ]  # neither answered: bash raised mid-flight, web_fetch never ran
-        out = session._cancelled_agent_disposition(msgs, "task")
-        assert "In flight at cancel: bash" in out
-        assert "In flight at cancel: web_fetch" not in out
-        assert "Not started (cancelled first): web_fetch." in out
-
-    def test_counts_and_not_started(self, tmp_db):
-        # Turn 1 completes [bash, bash, read_file]; turn 2 issues
-        # [web_fetch (in flight), search (never ran)]. Exercises the ×N
-        # count summary, the first-gap boundary, and not-started.
-        session = _make_session()
-        msgs = [
-            Turn.assistant(
-                "",
-                tool_calls=(
-                    ToolCall(id="t1", name="bash", arguments=""),
-                    ToolCall(id="t2", name="bash", arguments=""),
-                    ToolCall(id="t3", name="read_file", arguments=""),
-                ),
-            ),
-            self._result("t1"),
-            self._result("t2"),
-            self._result("t3"),
-            Turn.assistant(
-                "",
-                tool_calls=(
-                    ToolCall(id="t4", name="web_fetch", arguments=""),
-                    ToolCall(id="t5", name="search", arguments=""),
-                ),
-            ),
-        ]
-        out = session._cancelled_agent_disposition(msgs, "task")
-        assert "Completed before cancel: bash×2, read_file." in out
-        assert "In flight at cancel: web_fetch" in out
-        assert "Not started (cancelled first): search." in out
-
-    def test_exec_task_routes_cancel_to_disposition(self, tmp_db):
-        """_exec_task converts a GenerationCancelled from _run_agent into the
-        honest disposition, reading the in-place-mutated agent_turns."""
-        session = _make_session()
-
-        def fake_run_agent(agent_turns, **kwargs):
-            agent_turns.append(self._assistant("t1", "bash"))
-            agent_turns.append(self._result("t1"))
-            agent_turns.append(self._assistant("t2", "web_fetch"))
-            raise GenerationCancelled()
-
-        with patch.object(session, "_run_agent", side_effect=fake_run_agent):
-            call_id, result = session._exec_task({"call_id": "c1", "prompt": "do x"})
-
-        assert call_id == "c1"
-        assert result != "(task interrupted by user)"
-        assert "UNKNOWN" in result
-        assert "web_fetch" in result  # in-flight boundary
-        assert "bash" in result  # completed
-        # Thread A: the task call's typed status is UNKNOWN (web_fetch in flight).
-        assert session._tool_status.get("c1") is EffectStatus.UNKNOWN
-
-
-class TestEffectStatusPersistence:
-    """Typed effect status rides the role-exclusive ``meta`` column and
-    round-trips through ``reconstruct_turns`` without disturbing the SYSTEM
-    ``source_meta`` that shares the column (no migration; HYPOTHESIS.md
-    effect-record appendix — the ledger persists for audit)."""
-
-    def test_effect_status_meta_envelope(self):
-        assert _tool_turn_meta(None) is None
-        assert json.loads(_tool_turn_meta(EffectStatus.UNKNOWN)) == {"effect_status": "unknown"}
-        assert json.loads(_tool_turn_meta(None, {"kind": "web"})) == {"preview": {"kind": "web"}}
-        assert json.loads(_tool_turn_meta(EffectStatus.UNKNOWN, {"kind": "web"})) == {
-            "effect_status": "unknown",
-            "preview": {"kind": "web"},
-        }
-
-    def test_reconstruct_routes_tool_effect_status(self):
-        from turnstone.core.storage._utils import reconstruct_turns
-
-        # row: (id, role, content, tool_name, tc_id, provider_data,
-        #       tool_calls, source, event_id, is_error, meta)
-        tool_row = (
-            1,
-            "tool",
-            "timed out. Outcome UNKNOWN ...",
-            None,
-            "call_a",
-            None,
-            None,
-            None,
-            None,
-            True,
-            json.dumps({"effect_status": "unknown"}),
-        )
-        turns = reconstruct_turns([tool_row], "ws1")
-        assert turns[0].effect_status is EffectStatus.UNKNOWN
-        assert turns[0].is_error is True
-
-    def test_reconstruct_leaves_system_source_meta_untouched(self):
-        from turnstone.core.storage._utils import reconstruct_turns
-
-        sys_row = (
-            2,
-            "system",
-            "watch fired",
-            None,
-            None,
-            None,
-            None,
-            "watch_triggered",
-            None,
-            False,
-            json.dumps({"watch_name": "x"}),
-        )
-        turns = reconstruct_turns([sys_row], "ws1")
-        assert turns[0].meta.extra.get("source_meta") == {"watch_name": "x"}
-        assert turns[0].effect_status is None