chore: bump version to 1.7.4

Deciding the installer up front — get.docker.com for the IDs it recognizes,
Docker's repo directly for unrecognized derivatives — avoids treating a
transient get.docker.com failure (network, apt lock, EOL sleep) on a supported
distro as an "unsupported distro" and silently routing it into the repo path.

Recognized IDs now surface the real failure via die instead of masking it;
unrecognized derivatives (Nobara, Mint, …) skip the doomed call and its
"Unsupported distribution" output entirely rather than running it to fail.

Addresses review feedback on #829.

(cherry picked from commit f4e54ce814)

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"
       - run: pip install pre-commit
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"
       - run: pip install mypy
@@ -43,14 +43,14 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
       # Node is required by tests/test_renderer_js.py — without
       # explicit setup, that suite silently skips if the runner
       # image happens not to ship Node, masking regressions in
       # the browser-side renderer.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
       - run: pip install -e ".[test]"
@@ -83,10 +83,10 @@ jobs:
           --health-retries=5
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
       - run: pip install -e ".[test]"
@@ -98,7 +98,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"
       - run: pip install build
@@ -152,7 +152,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
         with:
           uv-version: "0.9.18"
       - run: uv lock --check
@@ -161,10 +161,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
         with:
           uv-version: "0.9.18"
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"
       - run: uv sync --frozen --all-extras
@@ -189,7 +189,7 @@ jobs:
         working-directory: sdk/typescript
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
       - run: npm ci

.github/workflows/claude-code-review.yml

@@ -0,0 +1,46 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
+
+jobs:
+  claude-review:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # post the review + inline comments
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          allowed_bots: 'renovate[bot]' # let Renovate PRs get reviewed
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+

.github/workflows/claude.yml

@@ -0,0 +1,63 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (
+        github.event_name == 'issue_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+      ) || (
+        github.event_name == 'pull_request_review_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+      ) || (
+        github.event_name == 'pull_request_review' &&
+        contains(github.event.review.body, '@claude') &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
+      ) || (
+        github.event_name == 'issues' &&
+        (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # post comments/reviews when @-mentioned on a PR
+      issues: write # post comments when @-mentioned on an issue
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr *)'
+

.github/workflows/publish.yml

@@ -50,7 +50,7 @@ jobs:
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         if: steps.tag.outputs.skip == 'false'
         with:
           python-version: "3.14"
@@ -58,12 +58,12 @@ jobs:
         if: steps.tag.outputs.skip == 'false'
       - run: python -m build
         if: steps.tag.outputs.skip == 'false'
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         if: steps.tag.outputs.skip == 'false'
 
       - name: Create GitHub Release
         if: steps.tag.outputs.skip == 'false'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           generate_release_notes: true

.github/workflows/understone-example.yml

@@ -32,7 +32,7 @@ jobs:
         python-version: ["3.11", "3.13"]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[test,dev]"

CHANGELOG.md

@@ -14,408 +14,51 @@ experimental line:
 
 Earlier stable lines (`stable/1.6`, `stable/1.5`) are frozen.
 
-## [Unreleased]
+## [1.7.4]
+
+A feature-bearing patch for the 1.7 line, rolling up work that had stabilised
+on `main`. No schema migrations (head stays 066) and no new configuration knobs.
 
 ### Added
 
-- **Compaction is visible now: lifecycle events, a progress bar, and a
-  persistent transcript card.** Context compaction (manual `/compact` and
-  auto) emits a first-class `compaction` SSE event
-  (`start` / `progress` / `end` — see the API reference) instead of loose
-  info lines. The web UI renders an in-transcript card with a real progress
-  bar (determinate `part k of N` during chunked summarization, indeterminate
-  for single-call compactions) that settles into a result card — token delta
-  plus the summary behind a fold — in both the interactive pane and the
-  coordinator viewer. The result survives reloads: the persisted compaction
-  marker now projects through `/history` as a `role="system"`,
-  `source="compaction"` entry (resume/export/search unchanged), stamped with
-  the end event's id so repaint and SSE replay can't double-render. The
-  marker's `meta` additionally records `before_tokens` / `after_tokens` /
-  `trigger`. Python and TypeScript SDKs gain a typed `CompactionEvent`.
-
-- **One provider transport: every model call now streams (#831).**
-  The per-adapter non-streaming entry (`create_completion`) is retired;
-  single-shot lanes — judges, titles, compaction, web-fetch extraction,
-  perception, eval, optimizer — sample through the same streaming entry
-  the chat loop uses and accumulate via one shared drain, so request
-  shaping can no longer drift between the two consumption styles. Two
-  operator-visible consequences: long single-shot generations (a thinking
-  model composing a title, a slow local judge) no longer sit in a single
-  blocking read that can hit client read-timeouts — the same reason the
-  Anthropic adapter already streamed internally — and judge timeouts now
-  *abort* the underlying HTTP read instead of abandoning a worker thread
-  on a dead call. Because every call now streams, an alias pointed at a
-  model or org that cannot stream (OpenAI's verified-org streaming
-  entitlement, a gateway api-version predating `stream_options` — e.g.
-  older Azure OpenAI deployments) fails at request time where 1.7's
-  non-streaming single-shot call succeeded; remediation is on the
-  serving side (verify the org, bump the api-version/gateway) — there is
-  deliberately no per-model non-streaming fallback left to configure. These lanes are also complete-or-error now: a stream
-  that ends without any finish signal is treated as a generation that
-  died mid-response and retried, instead of storing the partial text as
-  a clean result (previously a half-generated compaction summary could
-  silently replace real history). Caveats: these lanes now carry the
-  same `stream_options: {include_usage: true}` the chat loop always
-  sent — OpenAI-compatible servers old enough to *ignore* it stop
-  producing usage rows on these lanes, and servers strict enough to
-  *reject* unknown fields (pre-2024 llama.cpp/proxy builds) will 400 —
-  such a server already couldn't serve turnstone's chat loop, but a
-  judge/utility alias pointed at one worked on 1.7 and needs to move to
-  a current server. Transient mid-stream deaths (connection drop, proxy
-  hiccup) are re-issued in place up to twice with exponential backoff —
-  the retry the SDK's request loop used to provide these lanes
-  invisibly. Each lane accepts its own terminal marker (Anthropic
-  `message_stop`, Responses terminal events); a lax server/gateway that
-  never sends any terminal signal needs
-  `{"finish_reason_optional": true}` in the model definition's
-  capabilities JSON, which restores 1.7's tolerance (clean end-of-stream
-  after output = completion) for that model on every lane — without it
-  such streams fail as died-mid-generation, because SSE gives no way to
-  tell the two apart and the default favors catching truncation. The
-  unread `supports_streaming` capability flag (and its admin tile) is
-  gone; the o-series models it described are dropped from the capability
-  table entirely (see Removed).
-
-- **One turn interface for every model call: `core/model_turn.py` (#827).**
-  Judges (intent + output guard), perception, title generation, compaction,
-  web-fetch extraction, the eval harness, the optimizer's meta lanes, and
-  task agents all advance a trajectory through the same plant-call
-  primitive the agent seam pioneered — Turn IR in, one shared lowering
-  (argument sanitize → minted-id restore → vLLM reasoning attach), one
-  shared re-ingest (blank-id repair → native-lane finalize). The judges'
-  hand-built OpenAI-dict path is gone, and with it the Gemini judge's
-  tool-blindness: evidence tools now work on Google models because the
-  native lane round-trips `thought_signature` (with pairwise repair for
-  blank-id compat responses). Provider adapters still take lowered wire
-  dicts — the transport collapse and main-loop migration are tracked as
-  #831 / #832.
-
-- **task_agent keeps its model's reasoning across its own tool loop — on
-  every provider lane.** A task agent's replayed turns now carry the
-  provider-native reasoning lane the model produced — Anthropic thinking
-  blocks with their signatures (commercial or an anthropic-compatible
-  server), OpenAI Responses reasoning items, Gemini `thought_signature`
-  fidelity blocks, and the reasoning text a vLLM `--reasoning-parser` /
-  llama.cpp `reasoning_format` surfaces on the Chat Completions lane —
-  instead of each turn being rebuilt from text + tool calls with the
-  reasoning dropped. On a thinking model this restores reasoning continuity
-  across the agent's own multi-turn tool use. On the wire the agent's
-  session-minted sub-tool ids are mapped back to the provider's own ids
-  (`restore_provider_tool_ids`), so the native block — replayed verbatim,
-  its signature never touched — the `tool_calls` mirror, and each tool
-  result always agree; internally the minted ids still key the live card,
-  recall, and the cancel ledger unchanged. Replay honors the same per-model
-  `replay_reasoning_to_model` flag the main loop uses on every lane: the
-  vLLM Chat-Completions field replay keeps its server-type gate, and
-  llama.cpp stays capture-only, matching main-loop behavior. The native
-  lane is finalized by the same shared builder as the main loop's, so the
-  two harnesses cannot drift.
-
-- **Background shells: `bash` gains `run_in_background`, plus `bash_output` /
-  `kill_shell`.** Setting `run_in_background=true` starts the command as a
-  detached shell and returns immediately with a `bash_N` handle — "start a dev
-  server, use it in a later call" is back as an explicit opt-in (the shape
-  follows the convention the major coding agents converged on). `bash_output`
-  returns only output produced since the previous read (optionally filtered by
-  a regex) plus status and exit code; `kill_shell` terminates the shell's
-  whole process group. Output is buffered per shell with a drop-oldest cap, so
-  a chatty server can't grow memory unbounded. When a background shell exits,
-  a system notice lands at the next seam (waking an idle workstream if
-  needed). Shells survive a generation cancel, die with the workstream, and
-  never outlive a task_agent that started them; anything a background shell
-  itself backgrounds is still reaped when that shell exits — the no-leak
-  guarantee below is unchanged.
+- **Background shells for the `bash` tool** — `run_in_background=true` starts a
+  command as a detached shell and returns a `bash_N` handle; new `bash_output`
+  (delta output since last read, optional regex filter, status/exit code) and
+  `kill_shell` (terminates the shell's process group) tools manage it. Output is
+  buffered with a drop-oldest cap, a system notice lands when a shell exits, and
+  shells die with their workstream — never outliving a `task_agent` that started
+  them.
+- **`task_agent` carries the model's native reasoning across its own tool loop** —
+  a task agent's replayed turns now preserve the provider-native reasoning lane
+  (Anthropic thinking blocks with signatures, OpenAI reasoning items, Gemini
+  `thought_signature`, vLLM/llama.cpp reasoning text) instead of rebuilding each
+  turn from text alone, restoring reasoning continuity for thinking models.
+- **Model-shelf response controls** — the console model shelf exposes verbosity
+  and reasoning-mode controls per identity.
 
 ### Changed
 
-- **Breaking (1.8): compaction feedback moved from `info` events to the
-  typed `compaction` SSE event.** Pre-1.8 SSE/SDK clients that ignore
-  unknown event types no longer see compaction lines (they are
-  deliberately not dual-emitted — dual emission would double-render on
-  every current client). Consume the `compaction` lifecycle event (see
-  the API reference and the `CompactionEvent` SDK type); embedders
-  driving `ChatSession` through a duck-typed `SessionUI` are unaffected
-  (the classic `on_info` lines are restored for them — see Fixed).
-
-- **Sampling knobs (temperature, reasoning effort) now ride one assignment
-  scheme: per-model alias value → operator-stored global setting → the
-  model definition's declared default (effort only) → field omitted.**
-  Turnstone previously manufactured values onto every unconfigured
-  request — a hidden `temperature: 0.5` and a `reasoning_effort: "medium"`
-  baked in at three layers — overriding serving-side defaults like a vLLM
-  model's `generation_config`. Unconfigured installs now send neither
-  field and the inference engine's own defaults rule; `model.temperature`
-  is blank by default ("inherit each model's own default") and
-  `model.reasoning_effort` defaults to the empty "inherit" choice. The
-  per-model → global resolution lives in one shared resolver used by the
-  session factories, the `/model` switch, and every `model_turn` lane, so
-  the same alias samples identically on every surface. CLI
-  `--temperature` / `--reasoning-effort` likewise default to inherit.
-
-  **Upgrade notes:**
-  - The empty (`""`) reasoning-effort choice changed meaning from
-    "explicitly disable thinking" to "inherit the model/serving default".
-    On local manual-thinking models (e.g. Qwen templates with
-    `enable_thinking`), a stored `""` previously sent
-    `enable_thinking: false`; it now sends nothing, so the template's own
-    default (often thinking ON) applies. Use **`none`** to actually
-    disable reasoning.
-  - Workstreams saved by earlier versions carry the old defaults
-    (`temperature=0.5`, `reasoning_effort=medium`) in their persisted
-    config and keep that exact behavior on resume; they pick up the new
-    inherit semantics the next time you change the model or a sampling
-    knob in that workstream. New workstreams inherit from the start.
-
-### Removed
-
-- **O-series and pre-5.4 GPT-5 rows dropped from the OpenAI capability
-  table.** `o1`, `o1-mini`, `o3`, `o3-mini`, `o3-pro`, `o4-mini`,
-  `gpt-5`, `gpt-5-mini`, `gpt-5-nano`, `gpt-5-pro`, `gpt-5.1`,
-  `gpt-5.1-codex-max`, `gpt-5.2`, `gpt-5.2-pro`, and `gpt-5.3` no longer
-  have built-in capability rows — OpenAI has retired these model ids
-  from the API, so the rows described contracts no request can reach
-  anymore. The table floor is now `gpt-5.4`; the search-api and
-  audio/STT/TTS rows are unchanged. An alias still pinning a retired id
-  fails at OpenAI itself; any other unlisted commercial id resolves to
-  the generic commercial defaults (temperature sent, no declared
-  reasoning-effort vocabulary, 200K window) — declare the contract on
-  the model definition's capabilities JSON if you run one, or move to a
-  current model.
+- **GPT-5.6 aligned with the GA API surface** — the Responses provider matches
+  GPT-5.6's GA shape (typed `reasoning.mode`, `prompt_cache_options`,
+  cache-write accounting); the `openai` floor moves to `>=2.45`.
 
 ### Fixed
 
-- **A failed worker-thread spawn no longer wedges the workstream — at
-  either spawn site — and never masquerades as success.** If
-  `Thread.start()` itself raised (thread exhaustion, out-of-memory), the
-  dispatcher had already claimed the worker slot but the flag's only
-  clearer lived in the never-started thread — the workstream looked idle
-  forever while every subsequent message queued behind a worker that
-  didn't exist, until an operator force-cancel. The claim is now rolled
-  back under the lock and the error propagates, so the workstream is
-  dispatchable again as soon as resources recover. Affected every
-  dispatch path (sends, wakes, retries, deferred-send drain, init). The
-  same failure at the deferred-send drain's own spawn rolls back the
-  just-accepted entry and answers the retryable `queue_full` (previously
-  a 500 landed *after* the entry was registered — an invisible,
-  unretractable phantom that later dispatched as duplicate turns), and a
-  `/command` whose worker never spawned now answers **503**
-  `{"status": "error"}` instead of the generic 200 ok that told SDK
-  callers their `/clear` or `/resume` had applied.
-
-- **Manual `/compact` from the web UI: no phantom user turn, no frozen
-  server, cancellable.** A slash command typed into the web composer no
-  longer renders as a user chat bubble (it echoes as a distinct command
-  chip — commands aren't conversation turns and were never persisted as
-  such). `/compact` itself now dispatches onto the workstream's worker
-  slot instead of running inline on the server's event loop — previously a
-  long compaction froze every SSE stream on the node for its whole
-  duration, which is also why its own progress only ever arrived as one
-  burst after the fact. The manual path carries `send()`'s full generation
-  discipline (`compact_now()`): a force-abandoned compaction goes stale
-  instead of swapping history under a successor turn — and retires at its
-  next checkpoint instead of running out its remaining summary calls,
-  with its late lifecycle events fenced off (`compaction_id` on every
-  event, `superseded` on end events — both in the SDKs) so they can't
-  animate, tear down, re-title, or falsely narrate a successor's card or
-  activity pill; a cancel aimed at it is consumed on exit (previously it
-  bricked every `/compact` retry until the next message); a Stop click on
-  an idle session can't pre-abort the next compaction; a Stop that lands
-  in the completion tail — after the last cancel check, or during a retry
-  backoff (which now aborts immediately instead of sleeping it out) — is
-  honored rather than silently eaten; and Stop now aborts the in-flight
-  summary HTTP call itself (the compaction lane registers its stream in
-  the same abort seam the main loop uses), so cancelling a compaction is
-  immediate instead of waiting out a model call.
-
-- **Sends during a command window are deferred, ordered, bounded, and
-  honestly rendered — never silently truncated or lost.** Messages sent
-  while any slash command holds the worker slot are **deferred**: answered
-  `{"status": "queued", "msg_id"}` immediately and dispatched as ordinary
-  full-fidelity sends (attachments and sender identity included) when the
-  command finishes — never routed through the mid-turn interjection
-  queue, whose semantics are turn-shaped: previously a send during a
-  manual `/compact` was silently truncated to 2,000 characters, a second
-  participant in a shared workstream was locked out with a misleading
-  "another participant's turn" 409 for the whole compaction, and a
-  message queued across a `/resume`/`/new` could be answered into the
-  post-swap workstream. Because the response is immediate,
-  timeout-bounded callers — the coordinator's `send_message`, the console
-  proxy, SDKs, anything behind a stock reverse proxy — can no longer lose
-  a message to a multi-minute command window; the deferred send is
-  retractable until dispatch via the same `DELETE .../send` used for
-  queued interjections (node-local, in-memory — the API reference
-  documents the at-most-once durability contract). Deferred responses
-  carry `"deferred": true`; the pending list is the **order authority**
-  (a fresh send — or a coordinator dispatch, or a queued-nudge wake —
-  lines up behind acknowledged entries instead of overtaking them, with
-  the two-term barrier defined once on the workstream so the wake gate
-  also honors a claimed entry whose dispatch is mid-flight, and the gate
-  re-arms at the drain's exit even when everything pending was
-  retracted); acceptance is **bounded** (10 pending per workstream — the
-  interjection queue's own backpressure contract; the 11th answers the
-  retryable `queue_full` instead of pinning attachment bytes without
-  limit and then running one unattended turn per entry); a dispatch
-  crash re-queues the entry instead of eating an acknowledged message,
-  and a drain thread that fails to *start* rolls the acceptance back and
-  answers `queue_full` rather than parking a phantom the client can
-  neither see nor retract; each dispatch emits a pane-tier
-  `message_dispatched` event (`folded: true` for interjection fold-ins)
-  so queued-bubble UI keeps its retract affordance exactly until the
-  message truly leaves — including when the send was accepted by a pane
-  that believed the workstream idle, which now renders a real queued
-  chip instead of a sent-looking bubble, releases the composer (a
-  deferred send has no running worker to wait on), and cleans up fully
-  when the send is refused or the chip retracted instead of stranding
-  the pane in Stop mode. Dismissing a queued bubble — interjection or
-  deferred — is a server-confirmed `DELETE`, and retracting a deferred
-  send that carried attachments tells the user they were discarded
-  instead of silently expiring them.
-
-- **Slash commands hold the worker slot with a loud contract.**
-  A `/compact` raced against an in-flight turn is refused with an
-  explicit busy response. Every other slash command runs through the same
-  worker slot too — mutual exclusion against sends, a running compaction,
-  and each other, with a busy answer replacing the old silent interleave —
-  while the endpoint still awaits quick commands' completion off-loop
-  (without parking an executor thread per request); the post-command pane
-  refreshes (`clear_ui` after `/clear`/`/new`/`/resume`, the
-  workstream-name sync) ride the worker itself, so a command that
-  outlives the endpoint's 25s response backstop still refreshes every
-  pane on completion (the backstop sits under the console proxy's 30s
-  client timeout so the degraded `running` answer can actually traverse
-  a proxied pane, which now surfaces it instead of silence; the
-  `/command` response contract — `ok` / `running`, with busy refusals
-  answering a loud HTTP 409 rather than a silent 200 — is now documented
-  in the API reference and the OpenAPI spec).
-
-- **Compaction status stays truthful across every UI surface.** Manual
-  compaction
-  success also refreshes the status line/context pill immediately (parity
-  with auto-compaction), compaction failures keep feeding the typed
-  `error` event and the node error counter (while a CLI Ctrl-C reports as
-  cancelled, not a failure), one Stop prints one notice (a cancelled
-  auto-compaction no longer stacks "Compaction cancelled." on top of
-  send's own "[Generation cancelled]"), the workstream activity pill
-  shows "Compacting context…" for the whole summarize phase, restores
-  cleanly afterwards, and can no longer be stranded by a force-stopped
-  compaction (a new turn's generation claim breaks a stale latch). Every
-  retry backoff on the session (stream retries, task agents, notify
-  delivery, compaction) now aborts immediately on Stop via one shared
-  cancel-aware helper instead of sleeping out its exponential delay.
-
-- **Compaction failures report exactly once, to the right owner.** A
-  compaction failure reports
-  exactly once (auto-compaction errors defer to the turn's fatal handler
-  instead of doubling the red row and the error metric), failed-end
-  notice suppression is computed once by the emitter (a `notice` bool on
-  the end event — in the SDKs — replaces hand-synced client policy), and
-  a manual `/compact` failure no longer crashes the CLI REPL. `/compact`
-  on a workstream showing the `error` badge restores the badge on exit
-  instead of stamping `idle` over it (the compaction neither retried nor
-  resolved the failed turn). A force-cancelled initial send that
-  completes late still delivers its scheduled-run completion
-  notification (the only completion signal unattended workstreams have);
-  the other post-command pane refreshes and error notices remain
-  owner-guarded, so a force-cancelled wedged command that unwedges late
-  can't wipe panes or inject stray notices into a successor turn.
-
-- **Pre-1.8 embedder UIs keep their compaction lines.** Embedders
-  driving `ChatSession` with a pre-1.8 duck-typed `SessionUI`
-  (no `on_compaction` hook) get the classic `on_info` compaction lines
-  back — threshold notice, `part k/N`, retry waits, token delta +
-  summary box — instead of silent history swaps. (See the breaking
-  event-contract note under **Changed** for SSE/SDK clients.)
-
-- **Static MCP servers: a pushed catalog change no longer wedges the shared
-  session (#839).** The static-path `*/list_changed` handler awaited its
-  catalog refresh inline in the SDK's receive loop, but the refresh's own
-  request can only be answered by that (now parked) loop — the refresh never
-  completed, and every user's in-flight calls on the shared per-node session
-  stalled behind it, unbounded, until the health loop's ping timeout tore the
-  transport down (which was also the only way the changed catalog ever
-  landed). Push refreshes now run as spawned tasks — debounced, coalesced per
-  (server, kind), bounded by the connect timeout, and serialized on the
-  per-server connect lock — and the manual and post-reconnect refreshes
-  publish under that same lock, so a slower publisher can no longer land a
-  staler catalog over a fresher one. Every teardown path now also clears the
-  notification debounce stamp, so a reconnected server's first push refreshes
-  immediately. Push-refresh debouncing is now per (server, kind) on BOTH the
-  static and per-user pool paths — a tools push no longer swallows a prompts
-  push arriving in the same 5-second window. A change genuinely lost to the
-  debounce window (a same-kind push landing after the prior refresh finished,
-  which the server will never re-announce) is recovered by an automatic
-  health-tick retry rather than staying invisible until an unrelated push or
-  a reconnect. The resource-refresh fan-out on both paths no longer orphans
-  its sibling list call when one of the pair fails fast — the real error
-  surfaces immediately (not masked as a 30-second timeout) and the surviving
-  sibling is cancelled and reaped, under a bounded grace, inside the scope. A
-  push refresh that fails while the connection stays up is likewise retried on
-  the next health-loop tick until one completes — previously a single
-  transient blip left the shared catalog stale for every user on the node
-  until an operator intervened. An operator `/mcp refresh` no longer parks
-  behind a busy per-server connect lock (a slow reconnect attempt could eat
-  the whole 30-second refresh budget and fail the pass for every healthy
-  server behind it) — the busy server is skipped on both the connected and
-  disconnected branches, reported distinctly as "skipped" rather than as a
-  false "no changes", the skip arms the automatic retry, and a
-  force-reconnect drops the session up front so queued push refreshes can't
-  starve it. Static-path resource and prompt catalogs are now size-capped
-  like the pool path's (and like static tools) at discovery and on every
-  refresh, so a misbehaving server's push can't balloon the node's merged
-  catalogs. Deleting or reconfiguring a server can no longer leave it
-  half-removed: the config removal and all cleanup are serialized under the
-  connect lock (a cancelled removal completes its cleanup rather than
-  stranding a live session and published catalog with the config already
-  gone), and `reconcile_sync` retries a removal that timed out instead of
-  marking it done — previously a DB-driven delete of a busy server could be a
-  silent, permanent no-op until process restart. A refresh outcome now
-  threads consistently to every operator surface off one source of truth
-  (the per-server `last_refresh_outcome`): a busy-skip and a genuine failure
-  are each reported distinctly from a real "no changes" — `/mcp refresh`
-  prints "skipped" or "failed" rather than a false "no changes", and the
-  node-internal refresh endpoint returns `202 skipped` instead of a
-  misleading `200 ok` for a refresh that never ran. A single-kind push
-  refresh no longer paints the whole server healthy: because the
-  error/outcome state is server-scoped, a successful tools push while the
-  prompts catalog is still broken (or vice versa) no longer clears the
-  failure — only a full refresh pass declares "ok".
-
-- **OpenAI Responses streaming: truncated and refused responses no longer
-  vanish.** A response that hit `max_output_tokens` terminates the stream
-  with `response.incomplete`, which the stream consumer did not handle —
-  the turn was mislabeled `finish_reason: stop` and its final usage and
-  collected output items were dropped. Refusal parts had no streaming
-  handler at all, so a refusal rendered as empty content instead of the
-  `[Refused: …]` text the non-streaming path produced. Both now match:
-  truncation maps to `length` with usage/items intact, refusals render
-  in content. Applies to the chat loop and every drained single-shot
-  lane (#831).
-
-- **task_agent: sub-tool ids no longer alias across a local model's reused
-  ids.** A local model that reissues per-response sequential tool-call ids
-  (`call_0` every turn) made two of a task agent's steps share one id — the
-  live card collapsed both onto one DOM row while `/history` recall kept them
-  apart, so the two views disagreed. Sub-tool ids are now minted
-  `{parent}::r{run}s{step}::{id}`, unique within the session (across an
-  agent's turns and across concurrent or sequential runs), and that one id
-  keys the nesting registry, the live rows, recall, and the cancel ledger.
-  On the wire the agent's self-built history carries the provider's own ids,
-  restored from the mint map (see the reasoning-lane entry under Added), and
-  malformed tool-call arguments are legalized the same way the main loop's
-  wire prep does.
-
-- **bash tool: never hang on a backgrounded child.** A command that left a
-  long-lived process running (`server &`, a daemon) could wedge the whole
-  workstream forever — the tool read stdout/stderr to EOF, which never arrived
-  because the child inherited the pipe, and the timeout watchdog bailed once the
-  foreground `bash` had exited. The tool now waits on the tracked process
-  (bounded by the tool timeout) and terminates its whole process group on
-  return, so the call always completes. Undecodable output is preserved
-  (`errors="replace"`) instead of being dropped as a spurious error.
-  - **Behavior change:** a process the command backgrounds no longer survives
-    the call — nothing persists across bash invocations. (First-class
-    "run this in the background" support landed separately — see
-    `run_in_background` under Added.)
+- **`bash` never hangs on a backgrounded child** — a command that left a
+  long-lived process running no longer wedges the workstream; the tool waits on
+  the tracked process (bounded by the timeout) and reaps its whole process group.
+- **`task_agent` sub-tool ids are session-unique** — ids are minted
+  `{parent}::r{run}s{step}::{id}` so a local model reissuing sequential ids
+  (`call_0` each turn) no longer aliases two steps onto one live-card row while
+  `/history` keeps them apart.
+- **Judge completions honour model-definition capabilities** — a judge's
+  completion now threads its model's declared capabilities instead of assuming a
+  default surface.
+- **`create-admin` CLI** — adds an explicit admin-creation command; `run.sh` no
+  longer onboards into a role-less user.
+- **Install script Docker handling** — installs Docker on distros
+  `get.docker.com` rejects, and gates that path by `$ID` instead of trapping all
+  failures.
 
 ## [1.7.3]
 

Dockerfile

@@ -8,7 +8,7 @@ FROM python:3.14-slim
 LABEL org.opencontainers.image.title="turnstone" \
       org.opencontainers.image.description="Multi-node AI orchestration platform"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.29 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.27 /uv /usr/local/bin/uv
 
 # Remove the slim image's man page exclusion so man-db has actual content
 RUN rm -f /etc/dpkg/dpkg.cfg.d/docker
@@ -60,12 +60,8 @@ COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 WORKDIR /data
 RUN chown turnstone:turnstone /data
 
-# Workspace mount point — bind-mount a host directory here.  The env var
-# surfaces the path in the model's shell/file tool descriptions
-# (config.get_workspace_dir); without it the mount is invisible to the
-# model, whose cwd is /data below.
+# Workspace mount point — bind-mount a host directory here
 RUN mkdir -p /workspace && chown turnstone:turnstone /workspace
-ENV TURNSTONE_WORKSPACE=/workspace
 
 USER turnstone
 

deploy/helm/turnstone/Chart.yaml

@@ -7,6 +7,6 @@ appVersion: "0.3.0"
 
 dependencies:
   - name: postgresql
-    version: ~18.8.0
+    version: ~18.7.0
     repository: https://charts.bitnami.com/bitnami
     condition: postgresql.enabled

docs/api-reference.md

@@ -467,46 +467,6 @@ Each item in `items` (shared by `tool_info` and `approve_request`):
 {"type": "info", "message": "Session cleared."}
 ```
 
-**`compaction`** -- context-compaction lifecycle (manual `/compact` and
-auto-compaction). `phase: "start"` opens the operation (`trigger` is
-`"manual"` or `"auto"`; auto adds `where` — e.g. `"mid-turn"` — and, when
-the percentage threshold actually fired, `pct`; the context-overflow retry
-path compacts without a `pct` since no threshold was evaluated).
-`phase: "progress"` reports chunked summarization (`part`/`total`/`depth`,
-where depth 0 summarizes transcript batches and deeper levels merge partial
-summaries), a transient-error retry wait (`retry_in` seconds + `error`), or
-`warning: "summary_truncated"`. `phase: "end"` settles it: `ok: true`
-carries `before_tokens`/`after_tokens` and the produced `summary`;
-`ok: false` carries a `reason`
-(`"not_enough_messages"` / `"irreducible"` / `"empty_summary"` /
-`"cancelled"` / `"error"`) and a human-readable `message` — for
-`reason: "error"` the same message is also emitted as a paired typed
-`error` event (that is the renderable error surface; the end event is
-card-teardown). Failed ends also carry `notice`: the emitter-computed
-display verdict — show `message` only when it is `true` (the server
-suppresses error-reason, superseded, and cancelled-auto notices once,
-centrally, so clients don't re-derive that policy). Every end (ok or
-failed) carries `trigger`, and every event carries `compaction_id` — an
-opaque integer correlating the start/progress/end of one compaction run (a
-client that force-stopped one compaction can use it to ignore stragglers
-from the abandoned run). End events also carry `superseded`: `true` marks
-a force-abandoned compaction retiring after a successor generation took
-over (an OK end's result card still stands: the history swap happened).
-Superseded start/progress events are never emitted.
-Exactly one `start` and one `end` are emitted per attempt,
-so clients can key an in-progress affordance (progress bar) on the pair. A
-successful end is also persisted: the summary replays from `/history` as a
-`role: "system"`, `source: "compaction"` entry whose `meta` carries
-`{watermark, before_tokens, after_tokens, trigger}` and whose `event_id`
-matches the end event's id (dedup across repaint + replay).
-
-```json
-{"type": "compaction", "phase": "start", "compaction_id": 7, "trigger": "auto", "where": "mid-turn", "pct": 80}
-{"type": "compaction", "phase": "progress", "compaction_id": 7, "part": 2, "total": 5, "depth": 0}
-{"type": "compaction", "phase": "end", "ok": true, "compaction_id": 7, "trigger": "auto",
- "before_tokens": 128400, "after_tokens": 9200, "summary": "## Decisions\n..."}
-```
-
 **`error`** -- an error message.
 
 ```json
@@ -788,41 +748,32 @@ Sends a user message to a workstream. Spawns a daemon worker thread that calls
 **Request body:**
 
 ```json
-{"message": "Explain how the server works", "attachment_ids": ["a1"]}
+{"message": "Explain how the server works"}
 ```
 
-| Field            | Type       | Required | Description                                          |
-|------------------|------------|----------|------------------------------------------------------|
-| `message`        | string     | yes      | The user's message text                              |
-| `attachment_ids` | string[]   | no       | Staged uploads to attach (omit = auto-consume; `[]` = none) |
+| Field     | Type   | Required | Description             |
+|-----------|--------|----------|-------------------------|
+| `message` | string | yes      | The user's message text |
 
-**Response.** Every 200 body carries `attached_ids` and
-`dropped_attachment_ids` (empty lists when no attachments are involved):
+**Response (success):**
 
-- `{"status": "ok", ...}` — a fresh turn was dispatched.
-- `{"status": "queued", "priority", "msg_id", ...}` — folded into the live
-  turn's interjection queue; delivered at the next tool-result seam.
-  `DELETE .../send` with the `msg_id` retracts it before delivery.
-- `{"status": "queued", "deferred": true, ...}` — parked on the deferred-send
-  list (a command window holds the slot, or earlier deferred sends are
-  pending) and dispatched as its own full-fidelity send afterwards; see the
-  defer contract under `POST /v1/api/command`.
-- `{"status": "queue_full", ...}` — the send was refused with retry-shortly
-  semantics: the live worker's interjection queue is at capacity, the
-  deferred-send list hit its saturation bound (10 pending — the same
-  backpressure contract), or the deferred-send drain could not be started
-  under resource exhaustion (the message was **not** accepted; nothing is
-  parked).
-- `{"status": "attachments_busy", ...}` — attachments can't ride a queued
-  turn; the staged uploads survive for a retry once the worker idles.
+```json
+{"status": "ok"}
+```
+
+**Response (busy):** Returned if the workstream's worker thread is still alive
+from a previous request. Also pushes a `busy_error` event to the SSE stream.
+
+```json
+{"status": "busy"}
+```
 
 **Error responses:**
 
-| Status | Body                                            | Condition                              |
-|--------|-------------------------------------------------|----------------------------------------|
-| 400    | `{"error": "message is required"}`              | Message is empty                       |
-| 404    | `{"error": "Unknown workstream"}`               | `ws_id` not found (or closed mid-send) |
-| 409    | `{"status": "cross_user_interjection", ...}`    | Another participant's turn is in flight |
+| Status | Body                               | Condition              |
+|--------|------------------------------------|------------------------|
+| 400    | `{"error": "Empty message"}`       | Message is empty       |
+| 404    | `{"error": "Unknown workstream"}`  | `ws_id` not found      |
 
 ---
 
@@ -865,56 +816,7 @@ automatically approved without prompting.
 
 ### `POST /v1/api/command`
 
-Executes a slash command in the given workstream. Commands run on the
-workstream's worker slot (mutual exclusion against sends, a running
-compaction, and each other) — the endpoint is **not** unconditionally
-synchronous:
-
-- **Quick commands** (everything except `/compact`): the endpoint waits for
-  completion, so `{"status": "ok"}` means the command ran. A command still
-  running after 25 s answers `{"status": "running"}` — the worker keeps
-  going, its output reaches the pane via SSE, and the post-command pane
-  refreshes below still fire when it completes. (The bound sits under
-  common 30 s client/proxy timeouts — the console proxy's included — so
-  the degraded answer actually reaches bounded callers.)
-- **`/compact`**: dispatched fire-and-forget — `{"status": "ok"}` means the
-  compaction *started*. A large context can legitimately compact for many
-  minutes; progress streams as `compaction` SSE events (see the event
-  reference) and the persisted marker row lands on completion. Do not read
-  `/history` expecting the compacted transcript immediately after the
-  response.
-- **Busy refusal**: if a turn or another command holds the worker slot, the
-  command is refused with HTTP **409** `{"status": "busy", "error": ...}` and
-  did **not** run. Retry after the current turn finishes. (The old inline
-  endpoint executed commands unconditionally mid-turn; the 409 makes the
-  refusal loud for callers that only check the HTTP status.)
-
-While a command holds the slot — and afterwards, while earlier deferred
-sends are still waiting (the pending list is the order authority: a fresh
-send never overtakes a message already acknowledged) — `POST .../send`
-requests are **deferred**: the server answers `{"status": "queued",
-"deferred": true, "msg_id": ...}` immediately and dispatches the message
-as an ordinary full-fidelity send (attachments and sender identity
-included) in arrival order once the slot frees — it is never routed
-through the mid-turn interjection queue (no length cap, no cross-user
-rejection). The response arrives within normal round-trip time, so
-timeout-bounded clients (SDKs, proxies, the coordinator) need no special
-handling. To retract a deferred send before it dispatches, issue the same
-`DELETE .../send` with its `msg_id` used for queued interjections —
-`{"status": "removed"}` confirms it will not dispatch; `"not_found"` means
-it already dispatched (or is dispatching). Retracting a deferred send
-discards any attachments it carried; re-attach to send them again. When a
-deferred send dispatches, panes receive a `message_dispatched` event
-(`msg_id`, plus `folded: true` when it folded into a live turn's
-interjection queue rather than spawning its own turn) so queued-message
-UI can settle the right way.
-
-Durability: deferred sends are **node-local and in-memory** (the same
-lifetime as the interjection queue). `"queued"` is at-most-once intake, not
-durable acceptance — if the workstream is closed or the node restarts before
-the window ends, the message is dropped. Anything that must survive a
-restart should be re-sent after confirming dispatch (the turn appears on the
-SSE stream / in `/history`).
+Executes a slash command in the given workstream.
 
 **Request body:**
 
@@ -927,12 +829,10 @@ SSE stream / in `/history`).
 | `command` | string | yes      | The slash command (e.g. `/clear`)  |
 | `ws_id`   | string | yes      | Target workstream ID               |
 
-If the command is `/clear`, `/new`, or `/resume`, the server pushes a
-`clear_ui` SSE event to instruct the client to reset its message display and
-re-fetch the transcript via `GET .../history` (there is no SSE event that
-carries the messages themselves). These follow-ups are emitted by the
-command worker itself, so they fire even when the endpoint already answered
-`{"status": "running"}`.
+If the command is `/clear` or `/new`, the server pushes a `clear_ui` SSE event
+to instruct the client to reset its message display. If the command is
+`/resume`, the server pushes `clear_ui` followed by a `history` event
+containing the resumed session's messages.
 
 **Response:**
 
@@ -940,16 +840,12 @@ command worker itself, so they fire even when the endpoint already answered
 {"status": "ok"}
 ```
 
-or `{"status": "running"}` as above.
-
 **Error responses:**
 
-| Status | Body                                | Condition                                        |
-|--------|-------------------------------------|--------------------------------------------------|
-| 400    | `{"error": "Empty command"}`        | Command is empty                                 |
-| 404    | `{"error": "Unknown workstream"}`   | `ws_id` not found                                |
-| 409    | `{"status": "busy", "error": ...}`  | A turn/command holds the worker                  |
-| 503    | `{"status": "error", "error": ...}` | The command worker could not be started (resource exhaustion) — the command did **not** run; retry shortly |
+| Status | Body                               | Condition            |
+|--------|------------------------------------|----------------------|
+| 400    | `{"error": "Empty command"}`       | Command is empty     |
+| 404    | `{"error": "Unknown workstream"}`  | `ws_id` not found    |
 
 ---
 

docs/architecture.md

@@ -91,7 +91,7 @@ turnstone/
     discord/          Discord adapter (bot, cog, views, streaming, config)
     slack/            Slack adapter (Socket Mode bot, DM routing, approval buttons)
   shared_static/      Shared design system (base.css, auth.js, theme.js, toast.js, utils.js, kb.js)
-    katex-0.18.1/    Vendored KaTeX math rendering library (MIT, woff2 fonts)
+    katex-0.17.0/    Vendored KaTeX math rendering library (MIT, woff2 fonts)
   ui/
     colors.py         ANSI color constants with NO_COLOR support
     markdown.py       Streaming terminal markdown renderer (line-buffered)
@@ -609,7 +609,8 @@ LLMProvider (protocol)
 
 | Method | Purpose |
 |--------|---------|
-| `create_streaming()` | The one transport: streaming request, yields normalized `StreamChunk` objects (single-shot callers accumulate via `drain_stream()` into a `CompletionResult`) |
+| `create_streaming()` | Streaming request, yields normalized `StreamChunk` objects |
+| `create_completion()` | Non-streaming request, returns `CompletionResult` |
 | `get_capabilities()` | Per-model flags (`ModelCapabilities`) |
 | `convert_tools()` | Translate OpenAI tool schemas to provider format |
 | `retryable_error_names` | Exception class names that trigger retry |
@@ -662,7 +663,7 @@ display). Automatic prompt caching is enabled via top-level `cache_control:
 cacheable block and advances it as conversations grow (90% input cost
 reduction on cache hits, 1.25x write on first turn). Cache metrics
 (`cache_creation_input_tokens`, `cache_read_input_tokens`) are extracted from
-the stream's usage events. The `anthropic` SDK is a core
+both streaming and non-streaming responses. The `anthropic` SDK is a core
 dependency — the Anthropic provider is first-class alongside OpenAI.
 
 **GoogleProvider** (`_google.py`): extends `OpenAIChatCompletionsProvider` for
@@ -1149,30 +1150,20 @@ Named (aliased) workstreams are never age-pruned. Configure with
 
 ### API Retry
 
-Every model call streams (#831); retry lives at two stacked layers:
+`ChatSession._create_stream_with_retry()` (streaming path) and the agent
+`_api_call()` (non-streaming) both use the same retry pattern:
 
-- **Caller ladders** — `ChatSession._create_stream_with_retry()` (chat
-  loop) and the agent `_api_call()` (drained via `model_turn`) use the
-  same pattern: 4 total attempts (1 initial + 3 retries,
-  `_MAX_RETRIES = 3`), exponential backoff base 1 second
-  (`delay = 1s * 2^attempt`), `ui.on_info()` on retry, exception
-  propagates on final failure. `_compact_messages()` wraps its drained
-  call in the same loop.
-- **`model_turn`'s drain ladder** — inside every single-shot call,
-  mid-stream deaths (errors raised while draining, e.g.
-  `IncompleteStreamError`) are re-issued up to 2 more times with a
-  0.5s-base exponential backoff (±50% jitter); request-time failures
-  keep the SDK's own retry policy. The two ladders stack
-  multiplicatively on transient-shaped failures.
-- **Retryable errors** are matched by class name against each
-  provider's `retryable_error_names` (avoids importing
-  backend-specific exception hierarchies): `RateLimitError`,
-  `APITimeoutError`, `APIConnectionError`, `InternalServerError`,
-  `ServiceUnavailableError`, `APIError`, plus the drained-transport
-  errors `IncompleteStreamError` (stream ended with no terminal
-  signal — for servers that never send one, declare
-  `finish_reason_optional` in the model's capabilities JSON) and
-  `ResponsesStreamFailedError` (transient in-band Responses failure).
+- **Retries**: 4 total attempts (1 initial + 3 retries, `_MAX_RETRIES = 3`)
+- **Backoff**: exponential, base 1 second (`delay = 1s * 2^attempt`)
+- **Retryable errors**: `RateLimitError`, `APITimeoutError`,
+  `APIConnectionError`, `InternalServerError`, `ServiceUnavailableError`,
+  `APIError` (matched by class name to avoid importing backend-specific
+  exception hierarchies)
+- On retry: `ui.on_info()` notification
+- On final failure: exception propagates
+
+`_compact_messages()` also wraps its non-streaming API call in the same
+retry loop.
 
 ### Finish Reason Handling
 
@@ -1185,7 +1176,7 @@ Every model call streams (#831); retry lives at two stacked layers:
   blocked.
 
 Agent sub-sessions (`_run_agent()`) check `finish_reason` on each
-drained turn and stop the agent early on `"length"` or
+non-streaming response and stop the agent early on `"length"` or
 `"content_filter"`.
 
 `_compact_messages()` checks `finish_reason` on the compaction response and

docs/diagrams/03-core-engine-classes.puml

@@ -66,7 +66,8 @@ class "NullUI" as NullUI {
 interface "LLMProvider" as LLMProvider <<Protocol>> {
     + provider_name: str {property}
     + get_capabilities(model) → ModelCapabilities
-    + create_streaming(client, model, messages, ..., cancel_ref, replay_reasoning_to_model) → Iterator[StreamChunk]
+    + create_streaming(client, model, messages, ..., replay_reasoning_to_model) → Iterator[StreamChunk]
+    + create_completion(client, model, messages, ..., replay_reasoning_to_model) → CompletionResult
     + convert_tools(tools) → list[dict]
     + extract_reasoning_text(provider_blocks) → str
     + retryable_error_names: frozenset[str] {property}
@@ -176,7 +177,7 @@ class "HeadlessSession" as HeadlessSession {
     + send_headless(input, max_turns, ...)
     - _override_system_prompt(content)
     --
-    eval.py: drained single-shot turns,
+    eval.py: non-streaming,
     records all tool calls
 }
 

docs/diagrams/22-judge-architecture.puml

@@ -84,8 +84,8 @@ end note
 
 loop up to 3 turns (timeout budget)
 
-    Judge -> LLM : model_turn(lane, judge_turns,\ntools=[read_file, list_directory])\nvia drained create_streaming
-    LLM --> Judge : ModelTurnResult
+    Judge -> LLM : create_completion(\nmodel, judge_messages,\ntools=[read_file, list_directory])
+    LLM --> Judge : CompletionResult
 
     alt tool_calls present (turn < 3)
         Judge -> Judge : _exec_read_only_tool()

docs/docker.md

@@ -252,7 +252,6 @@ interface, or anyone who can reach it can search through your instance.
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `WORKSPACE_MOUNT` | empty volume | Host directory bind-mounted at `/workspace` for the model to read/write |
-| `TURNSTONE_WORKSPACE` | `/workspace` (image env) | Directory named as the user's workspace in the model's tool descriptions; informational only — see [Working directory](#working-directory) |
 | `SKIP_PERMISSIONS` | — | Set to any value to auto-approve all tool calls (dev only) |
 | `MCP_CONFIG` | — | Path to an MCP server config file |
 | `TURNSTONE_IMAGE_TAG` | `latest` | ghcr.io image tag — production stack |
@@ -277,35 +276,6 @@ docker compose build --no-cache # rebuild from scratch
 | `workspace` | `/workspace` (unless `WORKSPACE_MOUNT` is set) |
 | `caddy-data` / `caddy-config` | Caddy's local CA and config (dev stack) |
 
-## Working directory
-
-Node processes run with `/data` as their working directory (the image's
-`WORKDIR`), and that is where the model's shell commands execute and
-relative file paths resolve — **not** `/workspace`. The shell and file
-tool descriptions state both paths (the working directory, and the
-workspace named by `TURNSTONE_WORKSPACE`), so the model knows to look in
-`/workspace` for your files without being told each session.
-
-To make tools start inside the mount instead, override the working
-directory on the node services:
-
-```yaml
-services:
-  turnstone-node:
-    working_dir: /workspace
-```
-
-Two caveats before overriding:
-
-- **SQLite fallback**: when a node runs without PostgreSQL, its fallback
-  database `.turnstone.db` is created in the process working directory.
-  Changing `working_dir` on an existing SQLite-fallback deployment makes
-  the node create a fresh database inside the mount and your prior state
-  appears lost (it is still in the `turnstone-data` volume under `/data`).
-  The stock compose stacks use PostgreSQL and are unaffected.
-- Migrations (`entrypoint.sh`) run in the same working directory, so the
-  same SQLite caveat applies to them.
-
 ## Cleanup
 
 ```bash

docs/mcp-oauth.md

@@ -17,9 +17,8 @@ The MCP server admin form exposes three authorization modes ("Multitenant Author
 | `none` | No headers attached. Open MCP server (or one gated by network policy only). | Internal MCP servers on a trusted network. |
 | `static` | One static bearer token, configured per server, sent on every request from every user. | Service-to-service MCP servers where per-user attribution doesn't matter, or single-tenant deployments. |
 | `oauth_user` *(recommended for user-data servers)* | Each user authorizes separately via OAuth 2.1 + PKCE; Turnstone stores per-user tokens encrypted at rest. | MCP servers that expose user-specific data or that want per-user audit attribution. |
-| `oauth_obo` *(sign-in passthrough)* | Each user's Turnstone **org sign-in** (OIDC) mints a per-server access token on demand — no separate per-server consent. One captured credential per user covers every `oauth_obo` server. | Enterprise deployments where the identity provider governs access (Entra, Keycloak) and you want zero per-user connect clicks. See the dedicated section below. |
 
-Switching `auth_type` away from `oauth_user` / `oauth_obo` **deletes** that server's per-user rows (consents / minted cache) — see the transition table below. Switching back later starts clean: users re-consent (or re-mint) on next use. The admin **bulk-revoke** / **flush cache** affordance clears rows without an auth-type change.
+Switching `auth_type` away from `oauth_user` orphans existing per-user tokens. Use the admin **bulk-revoke** affordance on the server row (Phase 9) to clear them, or let them expire naturally — they're inert without the matching `auth_type` value.
 
 ---
 
@@ -66,58 +65,6 @@ Keep this in `config.toml` rather than environment variables. An in-process LLM
 
 ---
 
-## `auth_type=oauth_obo` — single-credential sign-in passthrough
-
-Where `oauth_user` makes each user complete a **separate** browser consent per MCP server, `oauth_obo` reuses the user's Turnstone **org sign-in** (OIDC). Turnstone captures one refresh credential per user at login and, on each tool call, mints a short-lived access token scoped to that server's audience. There is no per-server connect step, and one credential covers every `oauth_obo` server. This is the right shape when your identity provider already governs who may reach each backend (an Entra tenant with Entra-protected MCP servers; a Keycloak realm with token exchange).
-
-Access is governed **downstream** by the IdP: a user can only mint a token for a server their delegated permissions allow. Removing that grant at the IdP cuts the user off regardless of their Turnstone state.
-
-### Deployment configuration (`[oidc]` in `config.toml`)
-
-`oauth_obo` requires OIDC SSO to be configured (it is the credential source), plus:
-
-```toml
-[oidc]
-# ... your existing issuer / client_id / client_secret ...
-capture_user_credential = true          # persist the IdP refresh token at login
-obo_grant_profile = "entra"             # "entra" | "rfc8693" — how tokens are minted
-```
-
-- **`capture_user_credential`** (default `false`): when enabled, Turnstone appends `offline_access` to the login scopes and stores the returned refresh token, encrypted with the same `[security] mcp_token_encryption_key` as `oauth_user` tokens. **The encryption key is required** — Turnstone refuses to start with an `oauth_obo` row (or capture enabled) and no key.
-- **`obo_grant_profile`** picks the mint mechanism (the IdP determines which one is valid; this is deployment-wide, not per-server):
-  - **`entra`** — redeems the user's refresh token directly for a token scoped to `<audience>/.default`. `oauth_scopes` on the server row is **not used** (the admin form rejects it under this profile).
-  - **`rfc8693`** — a refresh grant for a subject token, then an RFC 8693 token exchange for the server audience. Per-server `oauth_scopes` **are** sent on the exchange (some IdPs require the audience scope explicitly).
-
-### Adding an `oauth_obo` server
-
-In the admin MCP form, choose **Sign-in passthrough** and set **Audience** (required — the downstream resource the token is minted for, e.g. `api://<app-id>` on Entra or the client id on Keycloak). The client-id / secret / registration fields do not apply and are hidden.
-
-`oauth_obo` servers are accepted only when **OIDC sign-in is configured and enabled** and `[oidc] obo_grant_profile` is a valid profile — the write is rejected otherwise, since a row that can never mint would surface to users as a permanent "please retry" that never heals.
-
-### Identity-provider setup
-
-**Entra (`obo_grant_profile = "entra"`):**
-1. Turnstone's app registration must hold **delegated permissions** to each MCP server's exposed API, with **admin consent granted** (or the MCP app listed in Turnstone's `preAuthorizedApplications`).
-2. Set the server row's Audience to the MCP app's Application ID URI (`api://<guid>`).
-3. **Gotcha (verified):** admin-consent issued *immediately* after creating the app/service principal can silently skip a not-yet-propagated resource — the only symptom is `AADSTS65001` at mint time. Verify the delegated grant landed (`az ad app permission list-grants` / the portal's *API permissions* blade shows *Granted*), or grant it explicitly per resource. A missing grant surfaces in Turnstone as a re-login prompt on the affected server (same rail as a revoked credential), and the `mcp_server.oauth.obo_mint_rejected` log line carries the raw `AADSTS…` text.
-
-**Keycloak / RFC 8693 (`obo_grant_profile = "rfc8693"`):**
-1. Enable **standard token exchange** on Turnstone's client.
-2. Grant the audience: add an audience client scope for each MCP client and attach it to Turnstone's client (optional scopes must be requested — set the server row's Scopes to that scope, or the exchange returns *"Requested audience not available"*).
-3. Set the server row's Audience to the downstream client id.
-
-### Revocation & custody
-
-The captured credential is a single per-user secret that can mint for every `oauth_obo` server, so treat it like any long-lived credential:
-
-- **Cut off one user:** unlink their OIDC identity in the admin console (**Users → OIDC identities → delete**). This revokes the captured credential **and** purges their minted cache rows, so future mints fail and cached tokens are dropped. (Warmed in-memory sessions on server nodes self-expire at the access-token TTL; there is no cross-node per-user session-kill.) Removing the user's access at the IdP is the authoritative cut-off.
-- **Flush a server's minted tokens** (e.g. after narrowing its audience): the server row's **flush cache** action drops all users' cached tokens for that server. This is **not** a revocation — users re-mint on next use from their still-valid sign-in. It is surfaced honestly (audit `mcp_server.oauth.obo_cache_flushed`, response `effect: cache_flush_remints`) so it is never mistaken for cutting access.
-- Per-server revocation in the `oauth_user` sense does not exist for `oauth_obo` — the credential is issuer-scoped and IdP-governed. Revoke at the IdP.
-
-> **Interim for Entra without OBO:** if you don't want host-side minting, admin consent + `preAuthorizedApplications` on each MCP app registration removes the second consent prompt for the plain `oauth_user` flow too (a tenant-config change, no Turnstone code). Tracked in issue #682. It does not remove the per-server connect clicks or per-(user, server) token custody — that is what `oauth_obo` is for.
-
----
-
 ## Lifecycle
 
 1. **First tool call** for a user against an `oauth_user` MCP server: pool dispatch finds no stored token, returns `mcp_consent_required` to the agent. Dashboard renders an inline "Connect" action card.
@@ -128,7 +75,7 @@ The captured credential is a single per-user secret that can mint for every `oau
 
 4. **Step-up scope**: when a tool call hits `403` with `WWW-Authenticate: error="insufficient_scope"`, Turnstone emits `mcp_insufficient_scope` with the parsed scope set; the dashboard offers a "Connect with additional scopes" affordance that opens `/v1/api/mcp/oauth/start?server=<name>&scopes=<extra>` so the union of original + new scopes flows into the AS authorize request.
 
-5. **User revoke** (settings modal): `DELETE /v1/api/mcp/oauth/connections/{server_name}` runs the authoritative local delete + best-effort RFC 7009 upstream revoke (fire-and-forget, capped at 256 concurrent in-flight tasks). `oauth_obo` servers are excluded: their rows are mint cache, not consents — deleting one only forces a re-mint — so the connections list hides them and the endpoint refuses them with `409` (revocation for sign-in passthrough happens at the identity layer: unlink the identity or revoke at the IdP).
+5. **User revoke** (settings modal): `DELETE /v1/api/mcp/oauth/connections/{server_name}` runs the authoritative local delete + best-effort RFC 7009 upstream revoke (fire-and-forget, capped at 256 concurrent in-flight tasks).
 
 6. **Admin bulk-revoke** (Phase 9): `POST /v1/api/admin/mcp-servers/{name}/bulk-revoke` drops every user's token for the server. Upstream RFC 7009 revoke is intentionally **not** attempted in bulk (avoids N upstream HTTP calls per admin click); tokens at the AS expire naturally. Use the per-user revoke endpoint if you need guaranteed upstream invalidation.
 
@@ -150,13 +97,10 @@ Additional indicators (circuit-breaker state, encryption-key mismatch) are expos
 | From | To | What happens |
 |---|---|---|
 | `none` / `static` → `oauth_user` | — | New code path activates for this server. Existing static headers (if any) are no longer sent. Users must authorize on first use. |
-| `oauth_user` → `none` / `static` | — | Existing `mcp_user_tokens` rows are **deleted**: the tokens are bound to the auth model + URL active at consent time, and rows left behind could silently rebind if a row with the old name/URL reappears. Switching back to `oauth_user` later starts clean — users re-consent on next use. This is **not reversible**; the AS-side grants are untouched (revoke upstream via the AS if needed). |
+| `oauth_user` → `none` / `static` | — | Existing `mcp_user_tokens` rows are **orphaned** — inert without a matching `auth_type`. Use admin bulk-revoke to drop them, or let them expire. Switching back to `oauth_user` later re-activates the orphaned rows if they haven't been deleted. |
 | OAuth `client_id` or `client_secret` rotated | — | Existing tokens may stop refreshing if the AS treats them as bound to the previous client. Bulk-revoke after rotation. |
-| `oauth_user` ↔ `oauth_obo` | — | The per-user rows are **deleted** on the flip (they mean different things: per-server AS refresh tokens vs. minted cache). `oauth_audience` and `oauth_scopes` mean different things in each model (a resource indicator vs. an IdP app identifier; AS-consent scopes vs. an rfc8693 exchange scope), so on a flip they **never carry** — each is taken from the request for the target model or set NULL. The admin console clears these fields when you change the auth type, so re-enter the correct values for the new mode; via the API, supply them explicitly (a flip into `oauth_obo` with no `oauth_audience` is rejected, and a non-empty `oauth_scopes` under the `entra` profile is rejected since that leg pins `<audience>/.default`). |
-| `oauth_obo` → `none` / `static` | — | Minted cache rows are deleted. |
-| `oauth_obo` **audience**, **URL**, or **`oauth_scopes`** changed | — | Minted cache rows are **deleted** (tokens are bound to the audience/URL/scopes at mint time), forcing a fresh mint — so an audience or scope narrowing takes effect immediately, not at token expiry. |
 
-Every transition that changes what a stored row *means* deletes the rows outright — a stale consent or minted token must never be served under new semantics. There is no orphan-and-reactivate path.
+The orphan-by-default behavior is chosen so switching back to `oauth_user` is non-destructive. Bulk-revoke is the explicit cleanup path.
 
 ---
 
@@ -169,9 +113,5 @@ Every transition that changes what a stored row *means* deletes the rows outrigh
 | `mcp_oauth_url_insecure` | MCP server URL is `http://` (not `https://`) on a non-loopback host | Use `https://`. Per-user bearers must not transit cleartext. |
 | Tools fail in scheduled / Discord / Slack runs | OAuth-MCP requires browser-based consent | Users must pre-consent via the web UI. Phase 9 dashboard badge surfaces deferred consents from these runs on next login. |
 | Circuit breaker open repeatedly | Transport-level errors on the MCP server (DNS, TLS, 5xx) | Check the per-server error pill; auth errors do not trip the breaker. |
-| **`oauth_obo`**: every tool call fails, log shows `obo_misconfigured` | Server row has no Audience, or `obo_grant_profile` is unset/unknown | Set the Audience on the server row; set `[oidc] obo_grant_profile` to `entra` or `rfc8693`. |
-| **`oauth_obo`**: `obo_mint_rejected` with `AADSTS65001` | Turnstone's app lacks the (admin-consented) delegated grant to this MCP app — often admin consent that didn't propagate | Grant + admin-consent the delegated permission for this resource; verify it shows *Granted*. See the Entra gotcha above. |
-| **`oauth_obo`**: "Sign in to Turnstone again" on one server | Captured credential missing/rejected, or a Conditional Access challenge | User re-logs into Turnstone (re-captures the credential). If it persists, check the IdP grant / CA policy. |
-| **`oauth_obo`**: tools don't appear at all for a user | User has not signed in since `capture_user_credential` was enabled (no credential captured) | User logs out and back in via OIDC so the refresh credential is captured. |
 
 See also: `docs/operations/mcp-oauth-headless.md` for the cron / channel-driven run caveat.

docs/oidc.md

@@ -77,17 +77,17 @@ IdP from redirecting the token-exchange POST (which carries
 being aimed at internal services.
 
 A few public IdPs legitimately split endpoints across hostnames. Google
-and Microsoft Entra ID are the canonical examples:
+is the canonical example:
 
-| IdP | Issuer host | Cross-host endpoint(s) |
-|-----|-------------|------------------------|
-| Google | `accounts.google.com` | `oauth2.googleapis.com`, `www.googleapis.com`, `openidconnect.googleapis.com` |
-| Microsoft Entra | `login.microsoftonline.com` | `graph.microsoft.com` (userinfo) |
+| Field | Hostname |
+|-------|----------|
+| issuer | `accounts.google.com` |
+| token_endpoint | `oauth2.googleapis.com` |
+| jwks_uri | `www.googleapis.com` |
+| userinfo_endpoint | `openidconnect.googleapis.com` |
 
-Both sets are built in — operators using `https://accounts.google.com` or
-`https://login.microsoftonline.com/<tenant>/v2.0` need no extra
-configuration. (Entra's discovery document advertises `userinfo_endpoint`
-on `graph.microsoft.com`, distinct from the issuer host.)
+Google's set is built in — operators using `https://accounts.google.com`
+need no extra configuration.
 
 For other IdPs whose discovery document references a non-issuer host,
 extend the allow-list explicitly:

docs/tools.md

@@ -28,19 +28,13 @@ schema plus turnstone-specific metadata keys:
 }
 ```
 
-**Metadata keys** (stripped before sending the schema to the model; the full
-set lives in `_META_KEYS` in `turnstone/core/tools.py`):
+**Metadata keys** (stripped before sending the schema to the model):
 
-| Key              | Type | Meaning |
-|------------------|------|---------|
-| `task_agent`     | bool | Tool is available to task sub-agents. |
-| `coordinator`    | bool | Tool is available to coordinator sessions. Without `interactive: true` alongside it, this reads as coord-only and the tool is stripped from interactive sessions. |
-| `interactive`    | bool | Opt a `coordinator: true` tool back into interactive sessions (dual-kind tools like `memory`). |
-| `auto_approve`   | bool | Tool runs without user confirmation (read-only, safe operations). |
-| `primary_key`    | str  | When the model sends a bare string instead of JSON args, map it to this parameter name. |
-| `kind_variants`  | dict | Per-kind description / parameter-schema overlays so each session kind sees only the surface it can use (see `memory.json`). |
-| `cwd_note`       | str  | Sentence appended to the description at session build time with `{working_dir}` substituted — declare on tools whose semantics depend on the process working directory (see `bash.json`, `apply_cwd_context`). |
-| `workspace_note` | str  | Companion sentence naming the operator-configured workspace directory, `{workspace_dir}` substituted; dropped when no workspace is configured. |
+| Key            | Type | Meaning |
+|----------------|------|---------|
+| `task_agent`   | bool | Tool is available to task sub-agents. |
+| `auto_approve` | bool | Tool runs without user confirmation (read-only, safe operations). |
+| `primary_key`  | str  | When the model sends a bare string instead of JSON args, map it to this parameter name. |
 
 ---
 
@@ -785,10 +779,7 @@ MCP tool lists stay up-to-date without restart through two mechanisms:
 1. **Push notifications** -- MCP servers that declare `tools.listChanged: true` in
    their capabilities send `notifications/tools/list_changed` when their tool list
    changes. `MCPClientManager` registers a `message_handler` on each `ClientSession`
-   that triggers an immediate refresh for that server (debounced per server and
-   notification kind, and run off the receive loop). A refresh that fails while
-   the connection stays up is retried automatically on the next health-loop tick
-   until one completes.
+   that triggers an immediate refresh for that server.
 
 2. **Manual** -- `/mcp refresh` re-fetches tools from all servers immediately.
    `/mcp refresh <server>` targets a single server. If a server has disconnected,
@@ -796,10 +787,6 @@ MCP tool lists stay up-to-date without restart through two mechanisms:
    same controls (refresh / reconnect buttons per server) for cluster-wide
    fan-out.
 
-Reconnects (health-loop, dispatch-driven, or operator-forced) always end in a
-full catalog rediscovery, so a server that changed its tools while disconnected
-comes back current.
-
 When tools change, `MCPClientManager` rebuilds its merged tool list using copy-on-write
 (new list/dict objects assigned atomically) and notifies all active `ChatSession`
 instances via registered listener callbacks. Each session rebuilds its `_tools`,
@@ -870,16 +857,13 @@ catalog.
 
 ### Refresh
 
-Resource lists stay current through the same mechanisms as tool lists:
+Resource lists stay current through the same three-tier mechanism as tool lists:
 
 1. **Push** -- Servers declaring `resources.listChanged: true` send
-   `notifications/resources/list_changed`, triggering an immediate refresh
-   (with the same failed-refresh retry on the health-loop tick).
-2. **Manual** -- `/mcp refresh` re-fetches resources alongside tools.
-
-Servers without push support are refreshed whenever they reconnect (every
-reconnect ends in full rediscovery) or when an operator refreshes manually;
-there is no periodic polling.
+   `notifications/resources/list_changed`, triggering an immediate refresh.
+2. **Periodic** -- Servers without push are polled on the configured refresh
+   interval (default 4 hours, same timer as tools).
+3. **Manual** -- `/mcp refresh` re-fetches resources alongside tools.
 
 ---
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnstone"
-version = "1.8.0a3"
+version = "1.7.4"
 description = "Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."
 readme = "README.md"
 license = "Apache-2.0"
@@ -88,7 +88,7 @@ include = [
   "turnstone/console/static/coordinator/*.js",
   "turnstone/shared_static/*.css",
   "turnstone/shared_static/*.js",
-  "turnstone/shared_static/katex-0.18.1/**/*",
+  "turnstone/shared_static/katex-0.17.0/**/*",
   "turnstone/shared_static/hljs-11.11.1/**/*",
   "turnstone/shared_static/mermaid-11.16.0/**/*",
   "turnstone/shared_static/hls-1.6.16/**/*",

scripts/livepass.py

@@ -399,7 +399,7 @@ CONSOLE_TEMPLATE = """<!doctype html>
               known: true,
               capabilities: {
                 context_window: 200000, supports_tools: true,
-                supports_vision: true,
+                supports_streaming: true, supports_vision: true,
                 supports_web_search: true, supports_temperature: true,
                 supports_effort: true,
               },

scripts/obo-e2e/.env.example

@@ -1,19 +0,0 @@
-# Entra config for the Entra e2e / spike harnesses. Copy to `.env` (gitignored)
-# and fill in from your tenant. `entra_setup.sh setup` creates the app
-# registrations and writes a populated `.env` for you.
-#
-#   cp scripts/obo-e2e/.env.example scripts/obo-e2e/.env
-#   # then edit, or run: ./scripts/obo-e2e/entra_setup.sh setup
-
-export ENTRA_TENANT_ID=<tenant-guid-or-domain>
-export ENTRA_CLIENT_ID=<turnstone-spike-app-client-id>
-export ENTRA_CLIENT_SECRET=<client-secret>
-export SPIKE_AUDIENCE_A=api://<resource-app-a-guid>   # a consented resource
-export SPIKE_AUDIENCE_B=api://<resource-app-b-guid>   # a second consented resource
-export SPIKE_AUDIENCE_UNCONSENTED=api://<resource-app-c-guid>  # NOT granted (negative case)
-export SPIKE_RUN_OBO=1
-# export SPIKE_PORT=8765            # redirect-listener port (default 8765)
-# export SPIKE_CALLBACK_FILE=/tmp/obo_cb.txt   # remote-browser mode: paste the redirect URL here
-
-# The Keycloak / OSS-path harness needs no config — keycloak_e2e.sh sets
-# everything and stands up an ephemeral container.

scripts/obo-e2e/README.md

@@ -1,214 +0,0 @@
-# OBO e2e harnesses — single-credential MCP token minting (`auth_type=oauth_obo`)
-
-Manual test harnesses for the `oauth_obo` feature (issue #551). They exercise
-the **real** Turnstone mint path (`get_obo_access_token_classified` →
-`_obo_mint_entra` / `_obo_mint_rfc8693`) against a real identity provider — not
-mocks, not the unit suite. Two grant legs:
-
-- **Entra** (`entra_e2e.py`) — real tenant, one interactive sign-in.
-- **Keycloak / RFC 8693** (`keycloak_e2e.py` + `.sh`) — ephemeral docker, fully
-  headless.
-
-There is also `entra_spike.py` (raw-OAuth **wire** probe, pre-implementation
-reference) and `entra_setup.sh` (creates the Entra app registrations + writes a
-populated `.env`).
-
-**Secrets:** these read config from env. Real credentials live in a **gitignored
-`.env`** (copy `.env.example`); nothing tenant-specific is committed. The only
-literal secret in the tree is the ephemeral Keycloak container's throwaway
-`spike-secret`, which lives and dies with the container.
-
-Not part of CI — run by hand when validating the feature against a live IdP.
-
-## `entra_e2e.py` — end-to-end product exercise (post-implementation)
-
-`entra_spike.py` verified the raw OAuth WIRE (before code existed). `entra_e2e.py`
-verifies the SHIPPED Turnstone code: it does a real Entra login, feeds the
-credential through the real `MCPTokenStore.upsert_oidc_credential` (the call the
-OIDC callback makes on capture), then drives the real
-`get_obo_access_token_classified` → `_obo_mint_entra` against the live Entra token
-endpoint. Checks E1–E7: real mint + aud claim, cache-hit (0 Entra calls),
-single-credential→audiences A&B, rotation write-back, force_refresh re-mint,
-unconsented-audience classification with the credential surviving, and
-flush→re-mint. Reuses the same `.env` and interactive login (SPIKE_CALLBACK_FILE
-for remote browser).
-
-```bash
-source scripts/obo-e2e/.env
-uv run python scripts/obo-e2e/entra_e2e.py
-# one interactive sign-in; E1–E7 then run against the real product code. Results below.
-```
-
-Results — RUN 2026-07-12 on the real tenant, ALL VERIFIED (exit 0): capture
-persisted; E1 mint A (aud=A app-id, cache row refresh_token_ct NULL); E2 cache
-hit (0 extra Entra calls); E3 mint B from the SAME credential (aud=B app-id); E4
-rotation write-back (RT rotated 2040→2091 chars, newest persisted); E5
-force_refresh re-mint (1 Entra call); E6 unconsented C → refresh_failed and the
-credential SURVIVES; E7 flush→re-mint. The real `get_obo_access_token_classified`
-→ `_obo_mint_entra` path against the live Entra token endpoint.
-
-## `keycloak_e2e.py` + `keycloak_e2e.sh` — OSS path (RFC 8693), headless
-
-The rfc8693 equivalent of `entra_e2e.py`: `keycloak_e2e.sh` spins up ephemeral
-Keycloak, configures the realm (turnstone client with standard token exchange,
-mcp-a/b/c clients, aud-mcp-a/b audience scopes, a test user), runs the harness
-against the real `get_obo_access_token_classified` → `_obo_mint_rfc8693`
-(refresh grant → token exchange), then tears down. No browser (password grant).
-
-```bash
-./scripts/obo-e2e/keycloak_e2e.sh
-```
-
-Results — RUN 2026-07-12, ALL VERIFIED: capture persisted; E1 mint A
-(refresh→exchange, aud=mcp-a, cache row refresh_token_ct NULL); E2 cache hit (0
-extra KC calls); E3 mint B from the SAME credential (aud=mcp-b); E4 rotation
-write-back (KC rotated the RT on the refresh leg, newest persisted); E5
-force_refresh re-mint (**2 KC calls** = the two-leg chain); E6 unconsented C →
-refresh_failed_transient (KC returns invalid_request for a missing audience
-scope → classified transient; credential SURVIVES either way); E7 flush→re-mint.
-Gotcha: dev-mode Keycloak boot is slow on a loaded host — the script now waits on
-kcadm auth (up to ~6 min) rather than a fixed sleep. Port 8091 (8090 = the dev
-console).
-
-## Leg 1 — Entra (`entra_spike.py`) — NEEDS TENANT ACCESS
-
-### Tenant / app-registration setup (one-time, ~15 min)
-
-1. **Spike client app** (stands in for Turnstone's OIDC app registration):
-   - New app registration, single tenant. Platform **Web**, redirect URI
-     `http://localhost:8765/callback`. Create a **client secret**.
-2. **Two resource apps** (stand in for MCP servers A and B):
-   - New app registrations `spike-mcp-a`, `spike-mcp-b`. In each:
-     **Expose an API** → set Application ID URI (`api://<guid>`) → add a scope
-     (e.g. `mcp.access`).
-3. **Delegated grants** (this is metaclassing's "proper tenant and app reg setup"):
-   - On the spike client app → **API permissions** → add delegated permission to
-     `spike-mcp-a` and `spike-mcp-b` scopes → **Grant admin consent**.
-   - Optionally also add the spike client's app id to each resource app's
-     `preAuthorizedApplications` (Expose an API → Add a client application) to
-     compare against pure admin consent.
-4. **Unconsented control** (for V5): a third resource app `spike-mcp-c` with an
-   exposed API but NO permission granted to the spike client.
-
-### Run
-
-```bash
-export ENTRA_TENANT_ID=... ENTRA_CLIENT_ID=... ENTRA_CLIENT_SECRET=...
-export SPIKE_AUDIENCE_A=api://<a-guid> SPIKE_AUDIENCE_B=api://<b-guid>
-export SPIKE_AUDIENCE_UNCONSENTED=api://<c-guid>   # optional (V5)
-export SPIKE_RUN_OBO=1                              # optional (V6)
-uv run python scripts/obo-e2e/entra_spike.py
-```
-
-A browser opens for one interactive login (any tenant user). Everything after is
-non-interactive — that IS the feature.
-
-### What each check pins down
-
-| Check | Design assumption it verifies |
-| --- | --- |
-| V1 | `offline_access` on the login yields a client-bound RT (capture layer) |
-| V2/V3 | ONE RT redeems for access tokens of DIFFERENT audiences (`scope=<aud>/.default`) — the load-bearing Entra behavior |
-| V4 | rotation semantics → whether RT write-back on every mint is convenience or correctness-critical |
-| V5 | unconsented audience fails `AADSTS65001 consent_required` → maps to the reconnect-rail fallback, never a silent failure |
-| V6 | OBO jwt-bearer middle-tier variant works with the same app registration (comparison data only) |
-
-Also record (manual): whether Conditional Access / MFA policies in the tenant
-produce `interaction_required` on redemption — that's the fallback path's other
-trigger.
-
-### Results — RUN 2026-07-11 on a real tenant, ALL SIX VERIFIED
-
-Tenant: personal default directory (Global Admin), user is an MSA member.
-Setup via `entra_setup.sh setup`; V3 initially failed (see gotcha below),
-passed after fixing the grant. Second run: V1-V6 all VERIFIED, exit 0.
-
-| Check | Result |
-| --- | --- |
-| V1 offline_access login -> RT | VERIFIED (confidential client + PKCE, RT ~2KB) |
-| V2 RT -> audience A token | VERIFIED (`aud=<A app guid>`, ~70 min TTL, new RT returned) |
-| V3 SAME RT -> audience B token | **VERIFIED — the load-bearing claim: one RT, many audiences** |
-| V4 rotation | VERIFIED: RT rotates on every redemption, but the OLD RT stays valid (reuse HTTP 200) -> write-back-newest is required; races are benign on Entra |
-| V5 unconsented audience | VERIFIED: `invalid_grant` + `AADSTS65001` (error_codes=[65001]) -> clean mapping to the reconnect-rail fallback |
-| V6 OBO jwt-bearer variant | VERIFIED: middle-tier shape also works with the same app registration |
-
-**Operator gotcha (feeds #682 + product docs):** `az ad app permission
-admin-consent` run immediately after SP creation SILENTLY skips
-not-yet-propagated resource SPs — grant A landed, grant B didn't, and the only
-symptom was AADSTS65001 at redemption. Verify grants after consent
-(`oauth2PermissionGrants` filter on the client SP) or write them directly with
-`az ad app permission grant --id <client> --api <resource> --scope <scope>`.
-Product-side implication: a missing tenant grant for a NEW oauth_obo server
-surfaces as AADSTS65001 -> the same reconnect-rail path as revocation; the
-admin docs must say "grant first, then add the server".
-
-## Leg 2 — Keycloak RFC 8693 (portability check) — runnable locally
-
-Ephemeral `quay.io/keycloak/keycloak:26.3` (`start-dev`, port 8089), realm
-`spike`, confidential client `turnstone` with **standard token exchange**
-enabled, resource clients `mcp-a`/`mcp-b`, user `alice`. Pipeline mirrors the
-product design for a generic-8693 IdP:
-
-```
-stored user RT --(refresh grant)--> user AT --(RFC 8693 exchange, audience=mcp-X)--> audience-scoped AT
-```
-
-i.e. the per-user credential stays ONE refresh token; per-server tokens are
-minted via standard token exchange instead of Entra's multi-resource RT
-redemption. Same substrate, different grant leg.
-
-### Results — RUN 2026-07-11, VERIFIED (Keycloak 26.3, ephemeral)
-
-```
-alice ONE stored RT
-  -> refresh grant                      -> user AT (azp=turnstone); RT ROTATED on refresh
-  -> 8693 exchange audience=mcp-a scope=aud-mcp-a -> AT aud=mcp-a user=alice 300s, NO RT
-  -> 8693 exchange audience=mcp-b scope=aud-mcp-b -> AT aud=mcp-b (same subject AT)
-  negative control audience=mcp-c       -> invalid_client "Audience not found"
-```
-
-Findings that feed the design:
-1. **One per-user credential -> N audience tokens: VERIFIED on a second IdP.**
-   The substrate is portable; only the grant leg differs per IdP.
-2. **Exchanged tokens are cache-shaped** (short TTL, no RT) — per-server
-   `mcp_user_tokens` rows as short-lived mint cache is the right model.
-3. **RT rotation happens here too** — newest-RT write-back on every redemption
-   is a correctness requirement of the capture layer, not an Entra quirk.
-4. **The IdP-side "delegated grant" has a per-IdP shape**: Entra = API
-   permissions + admin consent; Keycloak = audience client scopes attached to
-   the requester client (optional scopes activate via `scope=` at exchange).
-   Operator runbooks are per-IdP (#682 pattern), code is not.
-5. Gotchas hit: KC user needs a complete profile for direct grant ("Account is
-   not fully set up"); optional audience scope must be requested explicitly or
-   the exchange 400s with "Requested audience not available".
-
-Repro (ephemeral, ~2 min):
-
-```bash
-docker run -d --name kc-obo-spike -p 127.0.0.1:8089:8080 \
-  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
-  quay.io/keycloak/keycloak:26.3 start-dev
-KC="docker exec kc-obo-spike /opt/keycloak/bin/kcadm.sh"
-$KC config credentials --server http://localhost:8080 --realm master --user admin --password admin
-$KC create realms -s realm=spike -s enabled=true
-$KC create clients -r spike -s clientId=turnstone -s enabled=true -s publicClient=false \
-  -s secret=spike-secret -s directAccessGrantsEnabled=true \
-  -s 'attributes={"standard.token.exchange.enabled":"true"}'
-$KC create clients -r spike -s clientId=mcp-a -s enabled=true -s publicClient=false -s secret=x
-$KC create clients -r spike -s clientId=mcp-b -s enabled=true -s publicClient=false -s secret=x
-$KC create users -r spike -s username=alice -s enabled=true -s email=a@s.test \
-  -s emailVerified=true -s firstName=A -s lastName=S
-$KC set-password -r spike --username alice --new-password alice-pw
-TURNSTONE_UUID=$($KC get clients -r spike -q clientId=turnstone --fields id --format csv --noquotes)
-for t in mcp-a mcp-b; do
-  SID=$($KC create client-scopes -r spike -s name=aud-$t -s protocol=openid-connect -i)
-  $KC create client-scopes/$SID/protocol-mappers/models -r spike -s name=aud-$t \
-    -s protocol=openid-connect -s protocolMapper=oidc-audience-mapper \
-    -s "config={\"included.client.audience\":\"$t\",\"access.token.claim\":\"true\"}"
-  $KC update clients/$TURNSTONE_UUID/optional-client-scopes/$SID -r spike
-done
-# then: password grant -> refresh grant -> token-exchange with
-# grant_type=urn:ietf:params:oauth:grant-type:token-exchange,
-# subject_token=<user AT>, subject_token_type=...:access_token,
-# audience=mcp-a, scope=aud-mcp-a
-```

scripts/obo-e2e/entra_e2e.py

@@ -1,286 +0,0 @@
-"""End-to-end exercise of the oauth_obo feature against a REAL Entra tenant.
-
-Unlike ``entra_spike.py`` (which verified the raw OAuth wire shapes), this
-drives the ACTUAL Turnstone product code — real ``MCPTokenStore``, real
-``get_obo_access_token_classified`` → ``_obo_mint_entra`` → the real Entra
-token endpoint — so a green run proves the shipped mint engine works against
-live Entra, not just that the protocol does.
-
-Flow:
-  1. Interactive Entra login (auth-code + PKCE + offline_access) → a real
-     refresh credential. This is what ``handle_oidc_callback`` receives.
-  2. Persist it via ``MCPTokenStore.upsert_oidc_credential`` — the exact call
-     the OIDC callback makes on capture (auth.py). The rest of the callback
-     (JWKS validation, user provisioning) is OIDC-generic and unit-tested; the
-     novel path is capture + mint, which this exercises for real.
-  3. Seed real ``oauth_obo`` ``mcp_servers`` rows (audiences A/B consented, C
-     not) and drive ``get_obo_access_token_classified`` — the real dispatch-time
-     entry point — asserting on the minted tokens, cache, rotation, and
-     classification.
-
-Checks (VERIFIED / FAILED per line):
-  E1  mint for audience A → kind=token; decoded aud == A; cache row written with
-      refresh_token_ct NULL (cache, not custody); expires_at set
-  E2  second call for A → cache hit, ZERO additional Entra calls
-  E3  mint for audience B from the SAME captured credential → aud == B
-      (the single-credential-many-audiences thesis, through the real engine)
-  E4  rotation write-back: the stored credential holds the newest refresh token
-  E5  force_refresh → a fresh mint (Entra call count increments)
-  E6  unconsented audience C → NOT kind=token, and the shared credential SURVIVES
-      (never auto-deleted — the load-bearing custody invariant)
-  E7  cache flush → re-mint: deleting the cache row makes the next call re-mint
-
-Run:
-  source scripts/obo-e2e/.env
-  uv run python scripts/obo-e2e/entra_e2e.py
-Env (from .env): ENTRA_TENANT_ID, ENTRA_CLIENT_ID, ENTRA_CLIENT_SECRET,
-  SPIKE_AUDIENCE_A, SPIKE_AUDIENCE_B, SPIKE_AUDIENCE_UNCONSENTED, SPIKE_PORT.
-Remote browser: set SPIKE_CALLBACK_FILE to paste the redirect URL (as before).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import base64
-import os
-import sys
-import tempfile
-from types import SimpleNamespace
-from typing import Any
-
-import httpx
-
-# Reuse the verified interactive-login machinery from the wire spike.
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from entra_spike import interactive_login, jwt_claims_unverified, redact  # noqa: E402
-
-from turnstone.core.mcp_crypto import (  # noqa: E402
-    MCPTokenCipher,
-    MCPTokenCipherConfig,
-    MCPTokenStore,
-)
-from turnstone.core.mcp_oauth import get_obo_access_token_classified  # noqa: E402
-from turnstone.core.oidc import OIDCConfig  # noqa: E402
-from turnstone.core.storage._sqlite import SQLiteBackend  # noqa: E402
-
-USER = "e2e-user"
-RESULTS: list[tuple[str, str]] = []
-
-
-def record(status: str, msg: str) -> None:
-    RESULTS.append((status, msg))
-    print(f"[{status:>8}] {msg}")
-
-
-def aud_matches(token: str, want_audience: str) -> tuple[bool, str]:
-    """Compare a minted access token's aud claim to the configured audience.
-
-    Entra returns aud as the bare app-id GUID or the full ``api://<guid>`` URI;
-    accept either.
-    """
-    claims = jwt_claims_unverified(token)
-    aud = str(claims.get("aud", "<none>"))
-    want = want_audience.removeprefix("api://")
-    return aud in (want, want_audience), aud
-
-
-class _CountingClient:
-    """Wraps httpx.AsyncClient, counting token-endpoint POSTs so cache hits
-    (which must issue zero) are observable."""
-
-    def __init__(self, inner: httpx.AsyncClient) -> None:
-        self._inner = inner
-        self.posts = 0
-
-    async def post(self, *args: Any, **kwargs: Any) -> httpx.Response:
-        self.posts += 1
-        return await self._inner.post(*args, **kwargs)
-
-
-def _make_app_state(
-    storage: SQLiteBackend,
-    store: MCPTokenStore,
-    oidc_config: OIDCConfig,
-    http_client: _CountingClient,
-) -> SimpleNamespace:
-    return SimpleNamespace(
-        auth_storage=storage,
-        mcp_token_store=store,
-        oidc_config=oidc_config,
-        obo_http_client=http_client,
-        mcp_oauth_refresh_locks={},
-        mcp_oauth_refresh_backoff={},
-    )
-
-
-def _seed_obo_server(storage: SQLiteBackend, name: str, audience: str) -> None:
-    storage.create_mcp_server(
-        server_id=f"{name}-id",
-        name=name,
-        transport="streamable-http",
-        url="https://mcp.example.invalid/sse",
-        auth_type="oauth_obo",
-        oauth_audience=audience,
-    )
-
-
-async def _run(cfg: dict[str, str], refresh_token: str) -> None:
-    tenant = cfg["ENTRA_TENANT_ID"]
-    issuer = f"https://login.microsoftonline.com/{tenant}/v2.0"
-    token_endpoint = f"https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token"
-    aud_a = cfg["SPIKE_AUDIENCE_A"]
-    aud_b = cfg["SPIKE_AUDIENCE_B"]
-    aud_c = cfg.get("SPIKE_AUDIENCE_UNCONSENTED", "")
-
-    # Real Turnstone objects.
-    db_path = os.path.join(tempfile.mkdtemp(prefix="obo-e2e-"), "e2e.db")
-    storage = SQLiteBackend(db_path)
-    from cryptography.fernet import Fernet
-
-    raw = base64.urlsafe_b64decode(Fernet.generate_key())
-    store = MCPTokenStore(storage, MCPTokenCipher(MCPTokenCipherConfig(keys=(raw,))), node_id="e2e")
-    oidc_config = OIDCConfig(
-        enabled=True,
-        issuer=issuer,
-        client_id=cfg["ENTRA_CLIENT_ID"],
-        client_secret=cfg["ENTRA_CLIENT_SECRET"],
-        token_endpoint=token_endpoint,
-        obo_grant_profile="entra",
-        capture_user_credential=True,
-    )
-
-    # Step 2 — CAPTURE: the exact storage call handle_oidc_callback makes.
-    store.upsert_oidc_credential(USER, issuer, refresh_token=refresh_token)
-    cap = store.get_oidc_credential(USER, issuer)
-    if cap and cap["refresh_token"] == refresh_token:
-        record("VERIFIED", f"capture: credential persisted for {USER} ({redact(refresh_token)})")
-    else:
-        record("FAILED", "capture: credential did not round-trip")
-        return
-
-    _seed_obo_server(storage, "e2e-a", aud_a)
-    _seed_obo_server(storage, "e2e-b", aud_b)
-    if aud_c:
-        _seed_obo_server(storage, "e2e-c", aud_c)
-
-    inner = httpx.AsyncClient(timeout=20.0)
-    client = _CountingClient(inner)
-    app_state = _make_app_state(storage, store, oidc_config, client)
-    try:
-        # E1 — real mint for audience A.
-        r = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="e2e-a"
-        )
-        if r.kind == "token" and r.token:
-            ok, aud = aud_matches(r.token, aud_a)
-            row = storage.get_mcp_user_token(USER, "e2e-a")
-            cache_ok = (
-                row is not None and row["refresh_token_ct"] is None and bool(row["expires_at"])
-            )
-            record(
-                "VERIFIED" if ok and cache_ok else "FAILED",
-                f"E1 mint A: kind=token aud={aud} want={aud_a} cache_row_refreshless={cache_ok}",
-            )
-        else:
-            record("FAILED", f"E1 mint A: kind={r.kind} (expected token)")
-            return
-
-        # E2 — cache hit issues zero Entra calls.
-        posts_before = client.posts
-        r2 = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="e2e-a"
-        )
-        record(
-            "VERIFIED" if r2.kind == "token" and client.posts == posts_before else "FAILED",
-            f"E2 cache hit: kind={r2.kind} extra_entra_calls={client.posts - posts_before} (want 0)",
-        )
-
-        # E3 — same credential, audience B.
-        rb = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="e2e-b"
-        )
-        if rb.kind == "token" and rb.token:
-            ok_b, aud_bclaim = aud_matches(rb.token, aud_b)
-            record(
-                "VERIFIED" if ok_b else "FAILED",
-                f"E3 mint B from SAME credential: aud={aud_bclaim} want={aud_b}",
-            )
-        else:
-            record("FAILED", f"E3 mint B: kind={rb.kind}")
-
-        # E4 — rotation write-back: the stored credential is still redeemable
-        # (holds the newest RT — Entra rotates on redemption).
-        cred_now = store.get_oidc_credential(USER, issuer)
-        record(
-            "VERIFIED" if cred_now is not None else "FAILED",
-            f"E4 rotation write-back: credential persisted {redact(cred_now['refresh_token']) if cred_now else '<gone>'}",
-        )
-
-        # E5 — force_refresh re-mints (a real Entra call).
-        posts_before = client.posts
-        rf = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="e2e-a", force_refresh=True
-        )
-        record(
-            "VERIFIED" if rf.kind == "token" and client.posts > posts_before else "FAILED",
-            f"E5 force_refresh re-mint: kind={rf.kind} entra_calls={client.posts - posts_before} (want >=1)",
-        )
-
-        # E6 — unconsented audience: not a token, and the credential SURVIVES.
-        if aud_c:
-            rc = await get_obo_access_token_classified(
-                app_state=app_state, user_id=USER, server_name="e2e-c"
-            )
-            cred_after = store.get_oidc_credential(USER, issuer)
-            record(
-                "VERIFIED" if rc.kind != "token" and cred_after is not None else "FAILED",
-                f"E6 unconsented C: kind={rc.kind} (not token) credential_survives={cred_after is not None}",
-            )
-        else:
-            record("SKIPPED", "E6 unconsented C: SPIKE_AUDIENCE_UNCONSENTED not set")
-
-        # E7 — cache flush → re-mint.
-        store.delete_user_token(USER, "e2e-a")
-        posts_before = client.posts
-        r7 = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="e2e-a"
-        )
-        record(
-            "VERIFIED" if r7.kind == "token" and client.posts > posts_before else "FAILED",
-            f"E7 flush→re-mint: kind={r7.kind} entra_calls={client.posts - posts_before} (want >=1)",
-        )
-    finally:
-        await inner.aclose()
-
-
-def main() -> int:
-    required = [
-        "ENTRA_TENANT_ID",
-        "ENTRA_CLIENT_ID",
-        "ENTRA_CLIENT_SECRET",
-        "SPIKE_AUDIENCE_A",
-        "SPIKE_AUDIENCE_B",
-    ]
-    cfg = {k: os.environ[k] for k in os.environ if k.startswith(("ENTRA_", "SPIKE_"))}
-    missing = [k for k in required if not cfg.get(k)]
-    if missing:
-        print(f"Missing env: {', '.join(missing)} — did you `source scripts/obo-e2e/.env`?")
-        return 2
-
-    print("Signing in to Entra (this is the login the feature captures)...")
-    tokens = interactive_login(cfg)
-    refresh_token = tokens.get("refresh_token")
-    if not isinstance(refresh_token, str) or not refresh_token:
-        print(f"No refresh_token from login (keys={sorted(tokens)}) — offline_access missing?")
-        return 1
-
-    asyncio.run(_run(cfg, refresh_token))
-
-    print("\n=== summary ===")
-    for status, msg in RESULTS:
-        print(f"  {status:>8}  {msg}")
-    return 0 if all(s in ("VERIFIED", "SKIPPED") for s, _ in RESULTS) else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/obo-e2e/entra_setup.sh

@@ -1,134 +0,0 @@
-#!/usr/bin/env bash
-# Entra spike setup for entra_spike.py (#551 re-scope boundary spike).
-# Manual test tooling — not run in CI. Creates throwaway Entra app registrations.
-#
-#   ./entra_setup.sh setup     create app registrations + consent + .env
-#   ./entra_setup.sh cleanup   delete everything it created (incl. .env)
-#
-# Creates in the logged-in tenant (az login first):
-#   spike-turnstone   confidential client (stands in for Turnstone's OIDC app)
-#   spike-mcp-a/b     resource apps exposing scope mcp.access, admin-consented
-#   spike-mcp-c       resource app with NO grant to the client (V5 control)
-# Requires: the logged-in user can create apps + grant admin consent
-# (Global Admin on a personal tenant qualifies).
-
-set -euo pipefail
-cd "$(dirname "$0")"
-ENV_FILE=".env"
-NAMES=(spike-turnstone spike-mcp-a spike-mcp-b spike-mcp-c)
-
-log() { printf '>> %s\n' "$*"; }
-
-graph_patch_api() { # $1=appId  $2=scope-uuid  $3=display-name
-  local obj_id
-  obj_id=$(az ad app show --id "$1" --query id -o tsv)
-  az rest --method PATCH \
-    --url "https://graph.microsoft.com/v1.0/applications/${obj_id}" \
-    --headers 'Content-Type=application/json' \
-    --body "{
-      \"identifierUris\": [\"api://$1\"],
-      \"api\": {
-        \"requestedAccessTokenVersion\": 2,
-        \"oauth2PermissionScopes\": [{
-          \"id\": \"$2\",
-          \"value\": \"mcp.access\",
-          \"type\": \"Admin\",
-          \"isEnabled\": true,
-          \"adminConsentDisplayName\": \"Access $3\",
-          \"adminConsentDescription\": \"Spike scope for $3\"
-        }]
-      }
-    }"
-}
-
-make_resource_app() { # $1=display-name ; echoes "appId scopeId"
-  local app_id scope_id
-  app_id=$(az ad app create --display-name "$1" \
-    --sign-in-audience AzureADMyOrg --query appId -o tsv)
-  scope_id=$(python3 -c 'import uuid; print(uuid.uuid4())')
-  graph_patch_api "$app_id" "$scope_id" "$1" >/dev/null
-  az ad sp create --id "$app_id" >/dev/null 2>&1 || true
-  echo "$app_id $scope_id"
-}
-
-cmd_setup() {
-  local tenant_id
-  tenant_id=$(az account show --query tenantId -o tsv)
-  log "tenant: ${tenant_id}"
-
-  log "creating resource apps (a, b, c)..."
-  read -r APP_A SCOPE_A <<<"$(make_resource_app spike-mcp-a)"
-  read -r APP_B SCOPE_B <<<"$(make_resource_app spike-mcp-b)"
-  read -r APP_C _ <<<"$(make_resource_app spike-mcp-c)"
-  log "  a=${APP_A}  b=${APP_B}  c=${APP_C} (c stays unconsented)"
-
-  log "creating confidential client spike-turnstone..."
-  CLIENT_ID=$(az ad app create --display-name spike-turnstone \
-    --sign-in-audience AzureADMyOrg \
-    --web-redirect-uris "http://localhost:8765/callback" \
-    --query appId -o tsv)
-  az ad sp create --id "$CLIENT_ID" >/dev/null 2>&1 || true
-  # No stderr suppression here: the secret is load-bearing (it lands in .env),
-  # so under `set -e` a reset failure must abort LOUDLY, not silently.
-  SECRET=$(az ad app credential reset --id "$CLIENT_ID" \
-    --display-name spike --years 1 --query password -o tsv)
-
-  log "adding delegated permissions (a, b — NOT c)..."
-  # Tolerated failures (|| log): a re-run hits "permission already exists" and
-  # SP-propagation delays are common right after app creation — the
-  # admin-consent retry loop below is the real gate. `set -e` would otherwise
-  # turn a suppressed non-zero here into a silent mid-script abort.
-  az ad app permission add --id "$CLIENT_ID" \
-    --api "$APP_A" --api-permissions "${SCOPE_A}=Scope" \
-    || log "  warn: permission add for a failed (may already exist); admin-consent below will confirm"
-  az ad app permission add --id "$CLIENT_ID" \
-    --api "$APP_B" --api-permissions "${SCOPE_B}=Scope" \
-    || log "  warn: permission add for b failed (may already exist); admin-consent below will confirm"
-
-  log "granting admin consent (retries while SPs propagate)..."
-  local ok=""
-  for i in 1 2 3 4 5; do
-    if az ad app permission admin-consent --id "$CLIENT_ID" 2>/dev/null; then
-      ok=1; break
-    fi
-    log "  not yet (attempt $i) — waiting 15s"
-    sleep 15
-  done
-  [ -n "$ok" ] || { log "admin-consent failed after retries — grant manually in the portal (API permissions blade) and re-run the spike"; }
-
-  # Single-quote the values in the generated .env: the AS-issued client secret
-  # can contain $ / backtick, and an unquoted RHS would be re-expanded (or
-  # partially executed) when the operator `source`s the file. The heredoc still
-  # interpolates ${...} into the single-quoted output; sourcing then treats the
-  # result literally. (Azure secrets are base64-ish — no single quotes to escape.)
-  umask 177
-  cat > "$ENV_FILE" <<EOF
-export ENTRA_TENANT_ID='${tenant_id}'
-export ENTRA_CLIENT_ID='${CLIENT_ID}'
-export ENTRA_CLIENT_SECRET='${SECRET}'
-export SPIKE_AUDIENCE_A='api://${APP_A}'
-export SPIKE_AUDIENCE_B='api://${APP_B}'
-export SPIKE_AUDIENCE_UNCONSENTED='api://${APP_C}'
-export SPIKE_RUN_OBO=1
-EOF
-  log "wrote ${ENV_FILE} (chmod 600). Next:"
-  log "  source scripts/obo-e2e/.env && uv run python scripts/obo-e2e/entra_spike.py"
-  log "cleanup later with: ./entra_setup.sh cleanup"
-}
-
-cmd_cleanup() {
-  for name in "${NAMES[@]}"; do
-    for app_id in $(az ad app list --display-name "$name" --query '[].appId' -o tsv); do
-      log "deleting ${name} (${app_id})"
-      az ad app delete --id "$app_id"
-    done
-  done
-  rm -f "$ENV_FILE"
-  log "cleanup done (app registrations + .env removed)"
-}
-
-case "${1:-}" in
-  setup)   cmd_setup ;;
-  cleanup) cmd_cleanup ;;
-  *) echo "usage: $0 setup|cleanup"; exit 2 ;;
-esac

scripts/obo-e2e/entra_spike.py

@@ -1,333 +0,0 @@
-"""Entra boundary spike for single-credential MCP token minting (#551 re-scope).
-
-Verifies, against a REAL Entra tenant, the assumptions behind the oauth_obo
-design (one IdP refresh token per user; per-MCP access tokens minted on
-demand). Each check prints VERIFIED / FAILED / SKIPPED plus redacted evidence.
-
-  V1  interactive confidential-client login (auth-code + PKCE + offline_access)
-      -> refresh token captured                        [capture layer works]
-  V2  RT redeemed with scope=<AUDIENCE_A>/.default     -> aud claim == A
-  V3  SAME credential redeemed for <AUDIENCE_B>        -> aud claim == B
-      KEY CHECK: Entra RTs are client-bound, not resource-bound.
-  V4  rotation semantics: does each redemption return a new RT, and does the
-      PREVIOUS RT keep working?                        [write-back design]
-  V5  redemption for an unconsented audience -> AADSTS65001 consent_required
-      [maps to the reconnect-rail fallback]
-  V6  optional: OBO jwt-bearer leg (requested_token_use=on_behalf_of) using a
-      Turnstone-audience access token as assertion     [middle-tier variant]
-
-Run:  uv run python scripts/obo-e2e/entra_spike.py
-Env:  ENTRA_TENANT_ID       tenant GUID or domain
-      ENTRA_CLIENT_ID       Turnstone spike app registration (confidential)
-      ENTRA_CLIENT_SECRET   client secret for the above
-      SPIKE_AUDIENCE_A      e.g. api://<guid-a>  (exposes a scope, consented)
-      SPIKE_AUDIENCE_B      e.g. api://<guid-b>  (exposes a scope, consented)
-      SPIKE_AUDIENCE_UNCONSENTED  optional, for V5
-      SPIKE_RUN_OBO         optional "1" to run V6
-      SPIKE_PORT            redirect listener port (default 8765; register
-                            http://localhost:<port>/callback as a Web
-                            redirect URI on the spike app registration)
-
-App-registration setup checklist: see README.md next to this file.
-"""
-
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-import os
-import secrets
-import sys
-import threading
-import urllib.parse
-import webbrowser
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from typing import Any
-
-import httpx
-
-RESULTS: list[tuple[str, str, str]] = []  # (check, status, evidence)
-
-
-def record(check: str, status: str, evidence: str) -> None:
-    RESULTS.append((check, status, evidence))
-    print(f"[{status:>8}] {check}: {evidence}")
-
-
-def b64url_json(segment: str) -> dict[str, Any]:
-    pad = "=" * (-len(segment) % 4)
-    out: dict[str, Any] = json.loads(base64.urlsafe_b64decode(segment + pad))
-    return out
-
-
-def jwt_claims_unverified(token: str) -> dict[str, Any]:
-    """Spike-only unverified decode. NEVER do this in product code."""
-    try:
-        return b64url_json(token.split(".")[1])
-    except Exception:
-        return {}
-
-
-def redact(token: str | None) -> str:
-    if not token:
-        return "<absent>"
-    return f"{token[:8]}...({len(token)} chars)"
-
-
-class _CodeCatcher(BaseHTTPRequestHandler):
-    code: str | None = None
-    state: str | None = None
-    event = threading.Event()
-
-    def do_GET(self) -> None:  # noqa: N802 - stdlib API name
-        q = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
-        _CodeCatcher.code = (q.get("code") or [None])[0]
-        _CodeCatcher.state = (q.get("state") or [None])[0]
-        body = b"Spike login captured - return to the terminal."
-        if q.get("error"):
-            body = f"IdP error: {q}".encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "text/plain")
-        self.end_headers()
-        self.wfile.write(body)
-        _CodeCatcher.event.set()
-
-    def log_message(self, *args: Any) -> None:
-        pass
-
-
-def interactive_login(cfg: dict[str, str]) -> dict[str, Any]:
-    """V1: authorization-code + PKCE + offline_access as a confidential client.
-
-    Mirrors production shape: same grant Turnstone's OIDC login uses
-    (core/oidc.py exchange_code), plus offline_access.
-    """
-    port = int(cfg.get("SPIKE_PORT", "8765"))
-    redirect_uri = f"http://localhost:{port}/callback"
-    verifier = secrets.token_urlsafe(48)
-    challenge = (
-        base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
-    )
-    state = secrets.token_urlsafe(16)
-    authorize = (
-        f"https://login.microsoftonline.com/{cfg['ENTRA_TENANT_ID']}/oauth2/v2.0/authorize?"
-        + urllib.parse.urlencode(
-            {
-                "client_id": cfg["ENTRA_CLIENT_ID"],
-                "response_type": "code",
-                "redirect_uri": redirect_uri,
-                "response_mode": "query",
-                # offline_access is THE capture-layer delta vs today's login.
-                # No resource scope here: the RT is minted client-bound.
-                "scope": "openid profile offline_access",
-                "state": state,
-                "code_challenge": challenge,
-                "code_challenge_method": "S256",
-            }
-        )
-    )
-    server = HTTPServer(("127.0.0.1", port), _CodeCatcher)
-    threading.Thread(target=server.serve_forever, daemon=True).start()
-    print(f"\nOpen (or auto-opened) in a browser with a tenant user:\n  {authorize}\n")
-    cb_file = cfg.get("SPIKE_CALLBACK_FILE", "")
-    if cb_file:
-        print(
-            "Remote-browser mode: after sign-in the browser lands on a broken\n"
-            f"http://localhost:{port}/callback?... page. Copy that FULL URL and run:\n"
-            f"  echo '<url>' > {cb_file}\n"
-        )
-
-    def _watch_callback_file() -> None:
-        # Driver-friendly fallback: the sign-in can happen on any device;
-        # whoever signed in drops the redirected URL into SPIKE_CALLBACK_FILE.
-        import time as _time
-
-        while not _CodeCatcher.event.is_set():
-            try:
-                with open(cb_file) as _f:
-                    pasted = _f.read().strip()
-            except OSError:
-                pasted = ""
-            if "?" in pasted:
-                q = urllib.parse.parse_qs(urllib.parse.urlparse(pasted).query)
-                _CodeCatcher.code = (q.get("code") or [None])[0]
-                _CodeCatcher.state = (q.get("state") or [None])[0]
-                _CodeCatcher.event.set()
-                return
-            _time.sleep(1.0)
-
-    if cb_file:
-        threading.Thread(target=_watch_callback_file, daemon=True).start()
-    webbrowser.open(authorize)
-    if not _CodeCatcher.event.wait(timeout=600):
-        server.shutdown()
-        raise SystemExit("Timed out waiting for the redirect (10 min).")
-    server.shutdown()
-    if _CodeCatcher.state != state:
-        raise SystemExit("state mismatch on redirect - aborting.")
-    if not _CodeCatcher.code:
-        raise SystemExit("No code on redirect (IdP error page shown in browser).")
-    resp = httpx.post(
-        f"https://login.microsoftonline.com/{cfg['ENTRA_TENANT_ID']}/oauth2/v2.0/token",
-        data={
-            "grant_type": "authorization_code",
-            "code": _CodeCatcher.code,
-            "redirect_uri": redirect_uri,
-            "client_id": cfg["ENTRA_CLIENT_ID"],
-            "client_secret": cfg["ENTRA_CLIENT_SECRET"],
-            "code_verifier": verifier,
-        },
-        timeout=15.0,
-    )
-    tokens: dict[str, Any] = resp.json()
-    if resp.status_code != 200:
-        raise SystemExit(f"code exchange failed: {json.dumps(tokens, indent=2)[:800]}")
-    return tokens
-
-
-def redeem(cfg: dict[str, str], refresh_token: str, scope: str) -> tuple[int, dict[str, Any]]:
-    """Redeem a refresh token for an access token with the given scope."""
-    resp = httpx.post(
-        f"https://login.microsoftonline.com/{cfg['ENTRA_TENANT_ID']}/oauth2/v2.0/token",
-        data={
-            "grant_type": "refresh_token",
-            "refresh_token": refresh_token,
-            "client_id": cfg["ENTRA_CLIENT_ID"],
-            "client_secret": cfg["ENTRA_CLIENT_SECRET"],
-            "scope": scope,
-        },
-        timeout=15.0,
-    )
-    body: dict[str, Any] = resp.json()
-    return resp.status_code, body
-
-
-def obo_exchange(cfg: dict[str, str], assertion: str, scope: str) -> tuple[int, dict[str, Any]]:
-    """V6: middle-tier OBO variant (jwt-bearer + requested_token_use)."""
-    resp = httpx.post(
-        f"https://login.microsoftonline.com/{cfg['ENTRA_TENANT_ID']}/oauth2/v2.0/token",
-        data={
-            "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
-            "assertion": assertion,
-            "client_id": cfg["ENTRA_CLIENT_ID"],
-            "client_secret": cfg["ENTRA_CLIENT_SECRET"],
-            "scope": scope,
-            "requested_token_use": "on_behalf_of",
-        },
-        timeout=15.0,
-    )
-    body: dict[str, Any] = resp.json()
-    return resp.status_code, body
-
-
-def check_aud(label: str, status: int, body: dict[str, Any], want_aud: str) -> str | None:
-    """Common V2/V3 assertion: 200 + aud matches. Returns the new RT if any."""
-    if status != 200:
-        record(label, "FAILED", f"HTTP {status}: {json.dumps(body)[:300]}")
-        return None
-    claims = jwt_claims_unverified(body.get("access_token", ""))
-    aud = str(claims.get("aud", "<none>"))
-    ok = aud == want_aud or aud == want_aud.removeprefix("api://")
-    record(
-        label,
-        "VERIFIED" if ok else "FAILED",
-        f"aud={aud} want={want_aud} expires_in={body.get('expires_in')} "
-        f"new_rt={redact(body.get('refresh_token'))}",
-    )
-    new_rt = body.get("refresh_token")
-    return str(new_rt) if isinstance(new_rt, str) else None
-
-
-def main() -> int:
-    required = [
-        "ENTRA_TENANT_ID",
-        "ENTRA_CLIENT_ID",
-        "ENTRA_CLIENT_SECRET",
-        "SPIKE_AUDIENCE_A",
-        "SPIKE_AUDIENCE_B",
-    ]
-    cfg = {k: os.environ[k] for k in required if k in os.environ}
-    missing = [k for k in required if k not in cfg]
-    if missing:
-        print(f"Missing env: {', '.join(missing)}\nSee module docstring.")
-        return 2
-    for opt in ("SPIKE_AUDIENCE_UNCONSENTED", "SPIKE_PORT", "SPIKE_RUN_OBO"):
-        if opt in os.environ:
-            cfg[opt] = os.environ[opt]
-
-    # V1 - capture
-    tokens = interactive_login(cfg)
-    rt0 = tokens.get("refresh_token")
-    if isinstance(rt0, str) and rt0:
-        record("V1 capture (offline_access -> RT)", "VERIFIED", redact(rt0))
-    else:
-        record("V1 capture (offline_access -> RT)", "FAILED", f"keys={sorted(tokens.keys())}")
-        return 1
-
-    # V2 - mint for audience A
-    a = cfg["SPIKE_AUDIENCE_A"]
-    s2, b2 = redeem(cfg, rt0, f"{a}/.default")
-    rt_after_a = check_aud("V2 mint audience A from RT", s2, b2, a)
-
-    # V3 - SAME credential, audience B (the design-critical check)
-    b = cfg["SPIKE_AUDIENCE_B"]
-    s3, b3 = redeem(cfg, rt0, f"{b}/.default")
-    check_aud("V3 mint audience B from SAME RT", s3, b3, b)
-
-    # V4 - rotation semantics
-    if rt_after_a and rt_after_a != rt0:
-        s4, _ = redeem(cfg, rt0, f"{a}/.default")
-        record(
-            "V4 rotation (new RT returned; old still valid?)",
-            "VERIFIED" if s4 == 200 else "VERIFIED",
-            f"rotated=yes old_rt_reuse_http={s4} "
-            "(design: persist newest RT on every mint; "
-            f"{'old stays valid - benign race window' if s4 == 200 else 'old INVALIDATED - write-back is correctness-critical'})",
-        )
-    else:
-        record(
-            "V4 rotation",
-            "VERIFIED",
-            "no rotation observed on redemption (same/absent RT) - "
-            "write-back still required for the rotating case",
-        )
-
-    # V5 - unconsented audience -> consent_required
-    unc = cfg.get("SPIKE_AUDIENCE_UNCONSENTED")
-    if unc:
-        s5, b5 = redeem(cfg, rt0, f"{unc}/.default")
-        codes = b5.get("error_codes", [])
-        hit = s5 == 400 and (65001 in codes or b5.get("suberror") == "consent_required")
-        record(
-            "V5 unconsented audience -> AADSTS65001",
-            "VERIFIED" if hit else "FAILED",
-            f"http={s5} error={b5.get('error')} codes={codes}",
-        )
-    else:
-        record("V5 unconsented audience", "SKIPPED", "SPIKE_AUDIENCE_UNCONSENTED not set")
-
-    # V6 - optional OBO middle-tier variant
-    if cfg.get("SPIKE_RUN_OBO") == "1":
-        s6a, b6a = redeem(cfg, rt0, f"{cfg['ENTRA_CLIENT_ID']}/.default")
-        at_self = b6a.get("access_token", "") if s6a == 200 else ""
-        if at_self:
-            s6, b6 = obo_exchange(cfg, at_self, f"{a}/.default")
-            check_aud("V6 OBO jwt-bearer variant", s6, b6, a)
-        else:
-            record(
-                "V6 OBO jwt-bearer variant",
-                "FAILED",
-                f"could not mint self-audience assertion: HTTP {s6a}",
-            )
-    else:
-        record("V6 OBO jwt-bearer variant", "SKIPPED", "SPIKE_RUN_OBO != 1")
-
-    print("\n=== summary ===")
-    for check, status, _ in RESULTS:
-        print(f"  {status:>8}  {check}")
-    return 0 if all(s != "FAILED" for _, s, _ in RESULTS) else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/obo-e2e/keycloak_e2e.py

@@ -1,271 +0,0 @@
-"""End-to-end exercise of the oauth_obo feature on the OSS path (RFC 8693).
-
-Parallel to ``entra_e2e.py`` but for ``obo_grant_profile="rfc8693"`` against an
-ephemeral Keycloak — the open-source / non-Entra deployment shape. Fully
-headless (password grant, no browser), so it runs unattended.
-
-Drives the REAL Turnstone code: ``MCPTokenStore.upsert_oidc_credential`` (capture)
-then ``get_obo_access_token_classified`` → ``_obo_mint_rfc8693`` (refresh grant →
-RFC 8693 token exchange) against the live Keycloak token endpoint.
-
-Checks E1–E7 mirror the Entra harness:
-  E1 mint audience A → token, aud claim carries A, cache row refresh_token_ct NULL
-  E2 second call → cache hit, ZERO extra Keycloak calls
-  E3 audience B from the SAME captured credential → aud carries B
-  E4 rotation write-back (KC rotates the RT on the refresh leg)
-  E5 force_refresh → re-mint (Keycloak call count increments)
-  E6 unconsented audience C → NOT token, credential SURVIVES
-  E7 cache flush → re-mint
-
-Env (set by keycloak_e2e.sh):
-  KC_TOKEN_ENDPOINT, KC_ISSUER, KC_CLIENT_ID, KC_CLIENT_SECRET,
-  KC_USER, KC_PASSWORD, AUD_A, SCOPE_A, AUD_B, SCOPE_B, AUD_C
-"""
-
-from __future__ import annotations
-
-import asyncio
-import base64
-import json
-import os
-import sys
-import tempfile
-from types import SimpleNamespace
-from typing import Any
-
-import httpx
-
-from turnstone.core.mcp_crypto import (
-    MCPTokenCipher,
-    MCPTokenCipherConfig,
-    MCPTokenStore,
-)
-from turnstone.core.mcp_oauth import get_obo_access_token_classified
-from turnstone.core.oidc import OIDCConfig
-from turnstone.core.storage._sqlite import SQLiteBackend
-
-USER = "e2e-user"
-RESULTS: list[tuple[str, str]] = []
-
-
-def record(status: str, msg: str) -> None:
-    RESULTS.append((status, msg))
-    print(f"[{status:>8}] {msg}")
-
-
-def redact(token: str | None) -> str:
-    return f"{token[:8]}...({len(token)} chars)" if token else "<absent>"
-
-
-def jwt_claims(token: str) -> dict[str, Any]:
-    seg = token.split(".")[1]
-    pad = "=" * (-len(seg) % 4)
-    out: dict[str, Any] = json.loads(base64.urlsafe_b64decode(seg + pad))
-    return out
-
-
-def aud_carries(token: str, want: str) -> tuple[bool, str]:
-    """KC puts the exchanged audience in the aud claim (str or list)."""
-    aud = jwt_claims(token).get("aud", [])
-    auds = aud if isinstance(aud, list) else [aud]
-    return want in auds, str(aud)
-
-
-class _CountingClient:
-    def __init__(self, inner: httpx.AsyncClient) -> None:
-        self._inner = inner
-        self.posts = 0
-
-    async def post(self, *args: Any, **kwargs: Any) -> httpx.Response:
-        self.posts += 1
-        return await self._inner.post(*args, **kwargs)
-
-
-def _password_login(cfg: dict[str, str]) -> str:
-    """Headless direct-access grant → a real refresh token for the user."""
-    resp = httpx.post(
-        cfg["KC_TOKEN_ENDPOINT"],
-        data={
-            "grant_type": "password",
-            "client_id": cfg["KC_CLIENT_ID"],
-            "client_secret": cfg["KC_CLIENT_SECRET"],
-            "username": cfg["KC_USER"],
-            "password": cfg["KC_PASSWORD"],
-            "scope": "openid",
-        },
-        timeout=15.0,
-    )
-    resp.raise_for_status()
-    return str(resp.json()["refresh_token"])
-
-
-def _seed(storage: SQLiteBackend, name: str, audience: str, scopes: str | None) -> None:
-    storage.create_mcp_server(
-        server_id=f"{name}-id",
-        name=name,
-        transport="streamable-http",
-        url="https://mcp.example.invalid/sse",
-        auth_type="oauth_obo",
-        oauth_audience=audience,
-        oauth_scopes=scopes,
-    )
-
-
-async def _run(cfg: dict[str, str], refresh_token: str) -> None:
-    issuer = cfg["KC_ISSUER"]
-    db_path = os.path.join(tempfile.mkdtemp(prefix="obo-kc-e2e-"), "e2e.db")
-    storage = SQLiteBackend(db_path)
-    from cryptography.fernet import Fernet
-
-    raw = base64.urlsafe_b64decode(Fernet.generate_key())
-    store = MCPTokenStore(storage, MCPTokenCipher(MCPTokenCipherConfig(keys=(raw,))), node_id="e2e")
-    oidc_config = OIDCConfig(
-        enabled=True,
-        issuer=issuer,
-        client_id=cfg["KC_CLIENT_ID"],
-        client_secret=cfg["KC_CLIENT_SECRET"],
-        token_endpoint=cfg["KC_TOKEN_ENDPOINT"],
-        obo_grant_profile="rfc8693",
-        capture_user_credential=True,
-    )
-
-    store.upsert_oidc_credential(USER, issuer, refresh_token=refresh_token)
-    cap = store.get_oidc_credential(USER, issuer)
-    if cap and cap["refresh_token"] == refresh_token:
-        record("VERIFIED", f"capture: credential persisted ({redact(refresh_token)})")
-    else:
-        record("FAILED", "capture: credential did not round-trip")
-        return
-
-    _seed(storage, "kc-a", cfg["AUD_A"], cfg.get("SCOPE_A"))
-    _seed(storage, "kc-b", cfg["AUD_B"], cfg.get("SCOPE_B"))
-    if cfg.get("AUD_C"):
-        _seed(storage, "kc-c", cfg["AUD_C"], None)  # no audience scope → unconsented
-
-    inner = httpx.AsyncClient(timeout=20.0)
-    client = _CountingClient(inner)
-    app_state = SimpleNamespace(
-        auth_storage=storage,
-        mcp_token_store=store,
-        oidc_config=oidc_config,
-        obo_http_client=client,
-        mcp_oauth_refresh_locks={},
-        mcp_oauth_refresh_backoff={},
-    )
-    try:
-        # E1 — rfc8693 mint (refresh grant → token exchange) for audience A.
-        r = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="kc-a"
-        )
-        if r.kind == "token" and r.token:
-            ok, aud = aud_carries(r.token, cfg["AUD_A"])
-            row = storage.get_mcp_user_token(USER, "kc-a")
-            cache_ok = row is not None and row["refresh_token_ct"] is None
-            record(
-                "VERIFIED" if ok and cache_ok else "FAILED",
-                f"E1 mint A (refresh→exchange): kind=token aud={aud} want={cfg['AUD_A']} "
-                f"cache_row_refreshless={cache_ok}",
-            )
-        else:
-            record("FAILED", f"E1 mint A: kind={r.kind} (expected token)")
-            return
-
-        # E2 — cache hit.
-        posts_before = client.posts
-        r2 = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="kc-a"
-        )
-        record(
-            "VERIFIED" if r2.kind == "token" and client.posts == posts_before else "FAILED",
-            f"E2 cache hit: kind={r2.kind} extra_kc_calls={client.posts - posts_before} (want 0)",
-        )
-
-        # E3 — audience B from the SAME credential.
-        rb = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="kc-b"
-        )
-        if rb.kind == "token" and rb.token:
-            ok_b, aud_b = aud_carries(rb.token, cfg["AUD_B"])
-            record(
-                "VERIFIED" if ok_b else "FAILED",
-                f"E3 mint B from SAME credential: aud={aud_b} want={cfg['AUD_B']}",
-            )
-        else:
-            record("FAILED", f"E3 mint B: kind={rb.kind}")
-
-        # E4 — rotation write-back (KC rotates the RT on the refresh leg).
-        cred_now = store.get_oidc_credential(USER, issuer)
-        rotated = cred_now is not None and cred_now["refresh_token"] != refresh_token
-        record(
-            "VERIFIED" if cred_now is not None else "FAILED",
-            f"E4 rotation write-back: persisted={redact(cred_now['refresh_token']) if cred_now else '<gone>'} "
-            f"rotated_from_initial={rotated}",
-        )
-
-        # E5 — force_refresh re-mints.
-        posts_before = client.posts
-        rf = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="kc-a", force_refresh=True
-        )
-        record(
-            "VERIFIED" if rf.kind == "token" and client.posts > posts_before else "FAILED",
-            f"E5 force_refresh re-mint: kind={rf.kind} kc_calls={client.posts - posts_before} (want >=1)",
-        )
-
-        # E6 — unconsented audience: not a token, credential survives.
-        if cfg.get("AUD_C"):
-            rc = await get_obo_access_token_classified(
-                app_state=app_state, user_id=USER, server_name="kc-c"
-            )
-            cred_after = store.get_oidc_credential(USER, issuer)
-            record(
-                "VERIFIED" if rc.kind != "token" and cred_after is not None else "FAILED",
-                f"E6 unconsented C: kind={rc.kind} (not token) credential_survives={cred_after is not None}",
-            )
-        else:
-            record("SKIPPED", "E6 unconsented C: AUD_C not set")
-
-        # E7 — cache flush → re-mint.
-        store.delete_user_token(USER, "kc-a")
-        posts_before = client.posts
-        r7 = await get_obo_access_token_classified(
-            app_state=app_state, user_id=USER, server_name="kc-a"
-        )
-        record(
-            "VERIFIED" if r7.kind == "token" and client.posts > posts_before else "FAILED",
-            f"E7 flush→re-mint: kind={r7.kind} kc_calls={client.posts - posts_before} (want >=1)",
-        )
-    finally:
-        await inner.aclose()
-
-
-def main() -> int:
-    required = [
-        "KC_TOKEN_ENDPOINT",
-        "KC_ISSUER",
-        "KC_CLIENT_ID",
-        "KC_CLIENT_SECRET",
-        "KC_USER",
-        "KC_PASSWORD",
-        "AUD_A",
-        "AUD_B",
-    ]
-    cfg = {k: os.environ[k] for k in os.environ if k.startswith(("KC_", "AUD_", "SCOPE_"))}
-    missing = [k for k in required if not cfg.get(k)]
-    if missing:
-        print(f"Missing env: {', '.join(missing)} — run via keycloak_e2e.sh")
-        return 2
-
-    print("Headless password login to Keycloak (the credential the feature captures)...")
-    refresh_token = _password_login(cfg)
-
-    asyncio.run(_run(cfg, refresh_token))
-
-    print("\n=== summary ===")
-    for status, msg in RESULTS:
-        print(f"  {status:>8}  {msg}")
-    return 0 if all(s in ("VERIFIED", "SKIPPED") for s, _ in RESULTS) else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/obo-e2e/keycloak_e2e.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# OSS-path (RFC 8693) end-to-end: spin up ephemeral Keycloak, configure the
-# realm, run keycloak_e2e.py against the REAL Turnstone mint engine, tear down.
-# Fully headless — no browser. Manual test tooling, not run in CI.
-set -euo pipefail
-cd "$(dirname "$0")/../.."   # repo root (uv run needs it)
-
-CONTAINER=kc-obo-e2e
-PORT=8091
-KC="docker exec $CONTAINER /opt/keycloak/bin/kcadm.sh"
-
-cleanup() { docker rm -f "$CONTAINER" >/dev/null 2>&1 || true; }
-trap cleanup EXIT
-cleanup
-
-echo ">> starting Keycloak 26.3 (ephemeral)..."
-docker run -d --name "$CONTAINER" -p "127.0.0.1:${PORT}:8080" \
-  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
-  quay.io/keycloak/keycloak:26.3 start-dev >/dev/null
-
-echo ">> waiting for Keycloak (dev-mode boot can take a few minutes on a loaded host)..."
-# Wait on kcadm auth succeeding directly — more reliable than the host HTTP port,
-# and generous enough for a resource-starved boot (up to ~6 min).
-ready=""
-for _ in $(seq 1 90); do
-  if $KC config credentials --server http://localhost:8080 --realm master \
-      --user admin --password admin >/dev/null 2>&1; then
-    ready=1
-    break
-  fi
-  sleep 4
-done
-[ -n "$ready" ] || { echo "Keycloak did not become ready in time"; docker logs "$CONTAINER" 2>&1 | tail -15; exit 1; }
-
-echo ">> configuring realm 'spike'..."
-$KC create realms -s realm=spike -s enabled=true >/dev/null
-# Confidential client with standard token exchange (the RFC 8693 leg) + direct
-# access grant (headless password login to fetch the user's refresh token).
-$KC create clients -r spike -s clientId=turnstone -s enabled=true -s publicClient=false \
-  -s secret=spike-secret -s directAccessGrantsEnabled=true \
-  -s 'attributes={"standard.token.exchange.enabled":"true"}' >/dev/null
-for t in mcp-a mcp-b mcp-c; do
-  $KC create clients -r spike -s clientId=$t -s enabled=true -s publicClient=false -s secret=x >/dev/null
-done
-$KC create users -r spike -s username=e2e-user -s enabled=true -s email=e2e@spike.test \
-  -s emailVerified=true -s firstName=E2E -s lastName=User >/dev/null
-$KC set-password -r spike --username e2e-user --new-password e2e-pw >/dev/null
-
-TURNSTONE_UUID=$($KC get clients -r spike -q clientId=turnstone --fields id --format csv --noquotes)
-# Audience client scopes for mcp-a and mcp-b ONLY (mcp-c stays unconsented → E6).
-for t in mcp-a mcp-b; do
-  SID=$($KC create client-scopes -r spike -s name=aud-$t -s protocol=openid-connect -i)
-  $KC create "client-scopes/$SID/protocol-mappers/models" -r spike -s name=aud-$t \
-    -s protocol=openid-connect -s protocolMapper=oidc-audience-mapper \
-    -s "config={\"included.client.audience\":\"$t\",\"access.token.claim\":\"true\"}" >/dev/null
-  $KC update "clients/$TURNSTONE_UUID/optional-client-scopes/$SID" -r spike >/dev/null
-done
-
-echo ">> running the product e2e harness..."
-export KC_TOKEN_ENDPOINT="http://127.0.0.1:${PORT}/realms/spike/protocol/openid-connect/token"
-export KC_ISSUER="http://127.0.0.1:${PORT}/realms/spike"
-export KC_CLIENT_ID=turnstone KC_CLIENT_SECRET=spike-secret
-export KC_USER=e2e-user KC_PASSWORD=e2e-pw
-export AUD_A=mcp-a SCOPE_A=aud-mcp-a AUD_B=mcp-b SCOPE_B=aud-mcp-b AUD_C=mcp-c
-uv run python scripts/obo-e2e/keycloak_e2e.py

sdk/typescript/openapi-console.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "turnstone Console API",
-    "version": "1.8.0a2",
+    "version": "1.7.0rc1",
     "description": "Cluster-wide visibility and control across all turnstone nodes."
   },
   "paths": {
@@ -7791,12 +7791,6 @@
             "title": "Persona",
             "type": "string"
           },
-          "project_id": {
-            "default": "",
-            "description": "Project to attach the workstream to (validated against membership, empty = none)",
-            "title": "Project Id",
-            "type": "string"
-          },
           "resume_ws": {
             "default": "",
             "description": "Workstream ID to resume (loads previous conversation)",
@@ -8502,18 +8496,6 @@
             "title": "Skill",
             "type": "string"
           },
-          "persona": {
-            "default": "",
-            "description": "Persona slug (empty = kind default)",
-            "title": "Persona",
-            "type": "string"
-          },
-          "project_id": {
-            "default": "",
-            "description": "Project to attach the workstream to",
-            "title": "Project Id",
-            "type": "string"
-          },
           "notify_targets": {
             "description": "Notification targets on completion (channel_type + channel_id/user_id)",
             "items": {
@@ -8677,30 +8659,6 @@
             "default": null,
             "title": "Skill"
           },
-          "persona": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "title": "Persona"
-          },
-          "project_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "title": "Project Id"
-          },
           "notify_targets": {
             "anyOf": [
               {
@@ -8796,16 +8754,6 @@
             "title": "Skill",
             "type": "string"
           },
-          "persona": {
-            "default": "",
-            "title": "Persona",
-            "type": "string"
-          },
-          "project_id": {
-            "default": "",
-            "title": "Project Id",
-            "type": "string"
-          },
           "notify_targets": {
             "items": {
               "additionalProperties": {

sdk/typescript/openapi-server.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "turnstone Server API",
-    "version": "1.8.0a2",
+    "version": "1.7.0rc1",
     "description": "Single-node workstream management, chat interaction, and real-time streaming."
   },
   "paths": {
@@ -228,16 +228,6 @@
                 }
               }
             }
-          },
-          "409": {
-            "description": "Error 409",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorResponse"
-                }
-              }
-            }
           }
         }
       },
@@ -400,26 +390,6 @@
                 }
               }
             }
-          },
-          "409": {
-            "description": "Error 409",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorResponse"
-                }
-              }
-            }
-          },
-          "503": {
-            "description": "Error 503",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorResponse"
-                }
-              }
-            }
           }
         }
       }
@@ -2290,23 +2260,16 @@
       "SendResponse": {
         "properties": {
           "status": {
-            "description": "'ok' (fresh turn dispatched), 'queued' (folded into the live turn's interjection queue, or \u2014 when `deferred` is true \u2014 parked for dispatch after the current command window), 'queue_full', 'attachments_busy' (attachments can't ride a queued turn; retry when idle), or 'cross_user_interjection' (another participant's turn is in flight; carried on the 409 body).",
+            "description": "'ok', 'busy', 'queued', or 'queue_full'",
             "examples": [
               "ok",
+              "busy",
               "queued",
-              "queue_full",
-              "attachments_busy",
-              "cross_user_interjection"
+              "queue_full"
             ],
             "title": "Status",
             "type": "string"
           },
-          "deferred": {
-            "default": false,
-            "description": "Set on `queued` responses: the message is parked on the workstream's deferred-send list (a slash-command window holds the worker slot, or earlier deferred sends are still pending) and dispatches as an ordinary full-fidelity send afterwards \u2014 it is NOT in a live turn's interjection queue. `DELETE .../send` retracts it until dispatch. Node-local and in-memory: a node restart before dispatch drops it (at-most-once intake).",
-            "title": "Deferred",
-            "type": "boolean"
-          },
           "attached_ids": {
             "description": "Attachment ids actually attached to this turn. Subset of the request's `attachment_ids` (or the auto-consumed pending set). Empty when the send carries no attachments.",
             "items": {

sdk/typescript/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.4.0",
       "license": "Apache-2.0",
       "devDependencies": {
-        "typescript": "^7.0.0",
+        "typescript": "^6.0.0",
         "vitest": "^4.1"
       }
     },
@@ -74,9 +74,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.139.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.139.0.tgz",
-      "integrity": "sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==",
+      "version": "0.138.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
+      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -84,9 +84,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
-      "integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
+      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
       "cpu": [
         "arm64"
       ],
@@ -101,9 +101,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
-      "integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
+      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
       "cpu": [
         "arm64"
       ],
@@ -118,9 +118,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
-      "integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
+      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
       "cpu": [
         "x64"
       ],
@@ -135,9 +135,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
-      "integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
+      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
       "cpu": [
         "x64"
       ],
@@ -152,9 +152,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
-      "integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
+      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
       "cpu": [
         "arm"
       ],
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
-      "integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
+      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
       "cpu": [
         "arm64"
       ],
@@ -189,9 +189,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
-      "integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
+      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
       "cpu": [
         "arm64"
       ],
@@ -209,9 +209,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
-      "integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
+      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
       "cpu": [
         "ppc64"
       ],
@@ -229,9 +229,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
-      "integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
+      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
       "cpu": [
         "s390x"
       ],
@@ -249,9 +249,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
-      "integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
+      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
       "cpu": [
         "x64"
       ],
@@ -269,9 +269,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
-      "integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
+      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
       "cpu": [
         "x64"
       ],
@@ -289,9 +289,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
-      "integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
+      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
       "cpu": [
         "arm64"
       ],
@@ -306,9 +306,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
-      "integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
+      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
       "cpu": [
         "wasm32"
       ],
@@ -325,9 +325,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
-      "integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
+      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
       "cpu": [
         "arm64"
       ],
@@ -342,9 +342,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
-      "integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
+      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
       "cpu": [
         "x64"
       ],
@@ -408,346 +408,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
     "node_modules/@vitest/expect": {
       "version": "4.1.10",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
@@ -899,9 +559,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
-      "integrity": "sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
       "dev": true,
       "license": "MIT"
     },
@@ -959,9 +619,9 @@
       }
     },
     "node_modules/lightningcss": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
-      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
@@ -975,23 +635,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.33.0",
-        "lightningcss-darwin-arm64": "1.33.0",
-        "lightningcss-darwin-x64": "1.33.0",
-        "lightningcss-freebsd-x64": "1.33.0",
-        "lightningcss-linux-arm-gnueabihf": "1.33.0",
-        "lightningcss-linux-arm64-gnu": "1.33.0",
-        "lightningcss-linux-arm64-musl": "1.33.0",
-        "lightningcss-linux-x64-gnu": "1.33.0",
-        "lightningcss-linux-x64-musl": "1.33.0",
-        "lightningcss-win32-arm64-msvc": "1.33.0",
-        "lightningcss-win32-x64-msvc": "1.33.0"
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
-      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
       "cpu": [
         "arm64"
       ],
@@ -1010,9 +670,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
-      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
       "cpu": [
         "arm64"
       ],
@@ -1031,9 +691,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
-      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
       "cpu": [
         "x64"
       ],
@@ -1052,9 +712,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
-      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
       "cpu": [
         "x64"
       ],
@@ -1073,9 +733,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
-      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
       "cpu": [
         "arm"
       ],
@@ -1094,9 +754,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
-      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
       "cpu": [
         "arm64"
       ],
@@ -1118,9 +778,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
-      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
       "cpu": [
         "arm64"
       ],
@@ -1142,9 +802,9 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
-      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
       "cpu": [
         "x64"
       ],
@@ -1166,9 +826,9 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
-      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
       "cpu": [
         "x64"
       ],
@@ -1190,9 +850,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
-      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
       "cpu": [
         "arm64"
       ],
@@ -1211,9 +871,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
-      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
       "cpu": [
         "x64"
       ],
@@ -1242,9 +902,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "dev": true,
       "funding": [
         {
@@ -1261,9 +921,9 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz",
-      "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
+      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
@@ -1302,9 +962,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.20",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.20.tgz",
-      "integrity": "sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==",
+      "version": "8.5.16",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
       "dev": true,
       "funding": [
         {
@@ -1322,7 +982,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.16",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -1331,13 +991,13 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.5.tgz",
-      "integrity": "sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
+      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.139.0",
+        "@oxc-project/types": "=0.138.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -1347,21 +1007,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.1.5",
-        "@rolldown/binding-darwin-arm64": "1.1.5",
-        "@rolldown/binding-darwin-x64": "1.1.5",
-        "@rolldown/binding-freebsd-x64": "1.1.5",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.1.5",
-        "@rolldown/binding-linux-arm64-gnu": "1.1.5",
-        "@rolldown/binding-linux-arm64-musl": "1.1.5",
-        "@rolldown/binding-linux-ppc64-gnu": "1.1.5",
-        "@rolldown/binding-linux-s390x-gnu": "1.1.5",
-        "@rolldown/binding-linux-x64-gnu": "1.1.5",
-        "@rolldown/binding-linux-x64-musl": "1.1.5",
-        "@rolldown/binding-openharmony-arm64": "1.1.5",
-        "@rolldown/binding-wasm32-wasi": "1.1.5",
-        "@rolldown/binding-win32-arm64-msvc": "1.1.5",
-        "@rolldown/binding-win32-x64-msvc": "1.1.5"
+        "@rolldown/binding-android-arm64": "1.1.4",
+        "@rolldown/binding-darwin-arm64": "1.1.4",
+        "@rolldown/binding-darwin-x64": "1.1.4",
+        "@rolldown/binding-freebsd-x64": "1.1.4",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
+        "@rolldown/binding-linux-arm64-musl": "1.1.4",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-musl": "1.1.4",
+        "@rolldown/binding-openharmony-arm64": "1.1.4",
+        "@rolldown/binding-wasm32-wasi": "1.1.4",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
+        "@rolldown/binding-win32-x64-msvc": "1.1.4"
       }
     },
     "node_modules/siginfo": {
@@ -1389,9 +1049,9 @@
       "license": "MIT"
     },
     "node_modules/std-env": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
-      "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
+      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -1448,51 +1108,30 @@
       "optional": true
     },
     "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc"
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
+        "node": ">=14.17"
       }
     },
     "node_modules/vite": {
-      "version": "8.1.5",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.5.tgz",
-      "integrity": "sha512-7ULLwsCdYx/nRyrpiEwvqb5TFHrMVZyBt+rg/OAXT7rgj/z+DtTDyKFeLAdDkubDVDKD8jOsndmy7m55XcfUsw==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
+      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.5",
-        "postcss": "^8.5.17",
-        "rolldown": "~1.1.5",
+        "picomatch": "^4.0.4",
+        "postcss": "^8.5.16",
+        "rolldown": "~1.1.3",
         "tinyglobby": "^0.2.17"
       },
       "bin": {

sdk/typescript/package.json

@@ -32,7 +32,7 @@
   ],
   "license": "Apache-2.0",
   "devDependencies": {
-    "typescript": "^7.0.0",
+    "typescript": "^6.0.0",
     "vitest": "^4.1"
   }
 }

sdk/typescript/src/events.ts

@@ -157,49 +157,6 @@ export interface CancelledEvent {
   type: "cancelled";
 }
 
-/**
- * Context-compaction lifecycle. `start` carries `trigger` ("manual"/"auto";
- * auto adds `where` + `pct`); `progress` carries chunked-summarization
- * `part`/`total`/`depth` (or `retry_in`/`error` for a retry wait); `end`
- * carries `ok` plus either `before_tokens`/`after_tokens`/`summary` or the
- * failure `reason`/`message`. The successful end's summary also replays from
- * `/history` as a `role: "system"`, `source: "compaction"` entry.
- */
-export interface CompactionEvent {
-  type: "compaction";
-  phase: "start" | "progress" | "end";
-  /** Correlates every event of one compaction run (0 from legacy emitters). */
-  compaction_id?: number;
-  /**
-   * End events only: true marks a force-abandoned compaction retiring
-   * after a successor generation took over — skip failure notices for
-   * those (an OK end's result still stands; the history swap happened).
-   */
-  superseded?: boolean;
-  /**
-   * Failed ends only: the emitter-computed display verdict — show
-   * `message` only when true, instead of re-deriving suppression from
-   * reason/trigger/superseded client-side.
-   */
-  notice?: boolean;
-  /** Present on start and on every end (ok or failed). */
-  trigger?: "manual" | "auto";
-  where?: string;
-  pct?: number;
-  part?: number;
-  total?: number;
-  depth?: number;
-  retry_in?: number;
-  error?: string;
-  warning?: string;
-  ok?: boolean;
-  reason?: string;
-  message?: string;
-  before_tokens?: number;
-  after_tokens?: number;
-  summary?: string;
-}
-
 // Global events
 
 export interface WsStateEvent {
@@ -255,7 +212,6 @@ export type ServerEvent =
   | BusyErrorEvent
   | ClearUiEvent
   | CancelledEvent
-  | CompactionEvent
   | WsStateEvent
   | WsActivityEvent
   | WsRenameEvent

tests/_session_helpers.py

@@ -14,12 +14,9 @@ collect it as a test file — it's an importable utility, not a test.
 
 from __future__ import annotations
 
-import json
-from types import SimpleNamespace
 from typing import Any
 from unittest.mock import MagicMock
 
-from turnstone.core.providers import StreamChunk, ToolCallDelta
 from turnstone.core.session import ChatSession
 from turnstone.core.session_ui_base import SessionUIBase
 
@@ -46,304 +43,3 @@ def make_session(**kwargs: Any) -> ChatSession:
     }
     defaults.update(kwargs)
     return ChatSession(**defaults)
-
-
-def mock_completion_result(
-    content: str = "",
-    tool_calls: list[dict[str, Any]] | None = None,
-) -> MagicMock:
-    """A provider result shaped like ``CompletionResult``.
-
-    Callers that route through ``model_turn`` (judges, task agents, and
-    every lane #827 migrates) hit its re-ingest, which iterates
-    ``tool_calls``/``provider_blocks`` and joins ``reasoning`` — a bare
-    MagicMock attribute would TypeError deep inside the seam, so every
-    field the re-ingest reads is pinned to a real value here.  ONE shared
-    definition: when the re-ingest starts reading a new CompletionResult
-    field, add it here and every suite moves together.
-    """
-    result = MagicMock()
-    result.content = content
-    result.tool_calls = tool_calls
-    result.finish_reason = "stop"
-    result.usage = None
-    result.provider_blocks = []
-    result.reasoning = ""
-    return result
-
-
-def fake_chat_stream(
-    *,
-    content: str | None = None,
-    tool_calls: list[dict[str, str]] | None = None,
-    finish_reason: str = "stop",
-    prompt_tokens: int = 10,
-    completion_tokens: int = 5,
-    reasoning_content: str | None = None,
-    reasoning: str | None = None,
-) -> list[Any]:
-    """Fake OpenAI Chat Completions SSE chunks for driving the REAL
-    ``OpenAIChatCompletionsProvider`` through a fake SDK client::
-
-        client.chat.completions.create = lambda **kw: fake_chat_stream(...)
-
-    Exercises the adapter's ``_iter_stream`` plus ``drain_stream`` end to
-    end (the highest-fidelity fake lane), unlike ``as_stream`` which fakes
-    at the provider boundary.  ``tool_calls`` entries are
-    ``{"id", "name", "arguments"}`` dicts.  ``SimpleNamespace`` (not
-    ``MagicMock``) so absent SDK fields read as real ``None`` — an
-    auto-created mock attribute would leak into ``len()``/string paths.
-
-    Emits the realistic three-phase shape: data chunk(s), a finish-reason
-    chunk, then the ``stream_options.include_usage`` usage-only chunk with
-    empty ``choices``.
-    """
-
-    def _delta(
-        content_val: str | None = None,
-        tcs: list[Any] | None = None,
-        rc: str | None = None,
-        rsn: str | None = None,
-    ) -> SimpleNamespace:
-        return SimpleNamespace(
-            content=content_val,
-            tool_calls=tcs,
-            reasoning=rsn,
-            reasoning_content=rc,
-            annotations=None,
-        )
-
-    chunks: list[Any] = []
-    if reasoning_content is not None or reasoning is not None:
-        chunks.append(
-            SimpleNamespace(
-                choices=[
-                    SimpleNamespace(
-                        finish_reason=None, delta=_delta(rc=reasoning_content, rsn=reasoning)
-                    )
-                ],
-                usage=None,
-            )
-        )
-    if content is not None:
-        chunks.append(
-            SimpleNamespace(
-                choices=[SimpleNamespace(finish_reason=None, delta=_delta(content))],
-                usage=None,
-            )
-        )
-    if tool_calls:
-        tcs = [
-            SimpleNamespace(
-                index=i,
-                id=tc.get("id", ""),
-                function=SimpleNamespace(
-                    name=tc.get("name", ""), arguments=tc.get("arguments", "")
-                ),
-            )
-            for i, tc in enumerate(tool_calls)
-        ]
-        chunks.append(
-            SimpleNamespace(
-                choices=[SimpleNamespace(finish_reason=None, delta=_delta(None, tcs))],
-                usage=None,
-            )
-        )
-    chunks.append(
-        SimpleNamespace(
-            choices=[SimpleNamespace(finish_reason=finish_reason, delta=_delta())],
-            usage=None,
-        )
-    )
-    chunks.append(
-        SimpleNamespace(
-            choices=[],
-            usage=SimpleNamespace(
-                prompt_tokens=prompt_tokens,
-                completion_tokens=completion_tokens,
-                total_tokens=prompt_tokens + completion_tokens,
-                prompt_tokens_details=None,
-                input_tokens_details=None,
-            ),
-        )
-    )
-    return chunks
-
-
-class _ScriptedClient:
-    """Callable client-method fake following a script of stream builders.
-
-    Call N returns the stream described by ``scripts[N]``; the last script
-    repeats for any further calls.  Each script is a dict of kwargs for
-    the bound stream builder, or a pre-built return value.  Records every
-    call's kwargs on ``.calls`` — read ``len(fn.calls)`` where a test
-    previously kept its own counter cell, and ``fn.calls[i]["messages"]``
-    where it captured request bodies.
-    """
-
-    def __init__(self, scripts: tuple[Any, ...], to_stream: Any) -> None:
-        self._scripts = scripts
-        self._to_stream = to_stream
-        self.calls: list[dict[str, Any]] = []
-
-    def __call__(self, **kwargs: Any) -> Any:
-        self.calls.append(kwargs)
-        script = self._scripts[min(len(self.calls) - 1, len(self._scripts) - 1)]
-        return self._to_stream(**script) if isinstance(script, dict) else script
-
-
-def scripted_chat_client(*scripts: Any) -> _ScriptedClient:
-    """A scripted ``client.chat.completions.create`` — dict scripts are
-    :func:`fake_chat_stream` kwargs."""
-    return _ScriptedClient(scripts, fake_chat_stream)
-
-
-def scripted_anthropic_client(*scripts: Any) -> _ScriptedClient:
-    """A scripted ``client.messages.stream`` — dict scripts are
-    :func:`fake_anthropic_stream` kwargs (``blocks`` plus optional
-    ``stop_reason``/``usage``)."""
-    return _ScriptedClient(scripts, fake_anthropic_stream)
-
-
-class FakeAnthropicBlock:
-    """A full-content Anthropic content-block fake for
-    :func:`fake_anthropic_stream` — plain attributes plus the
-    ``model_dump()`` the provider's block capture reads."""
-
-    def __init__(self, **fields: Any) -> None:
-        self._fields = fields
-        for key, value in fields.items():
-            setattr(self, key, value)
-
-    def model_dump(self, **_kw: Any) -> dict[str, Any]:
-        return dict(self._fields)
-
-
-def fake_anthropic_stream(
-    blocks: list[Any],
-    *,
-    stop_reason: str | None = "end_turn",
-    usage: Any = None,
-) -> Any:
-    """Fake Anthropic SDK stream context manager for tests that drive the
-    REAL ``AnthropicProvider`` through a fake client::
-
-        client.messages.stream = lambda **kw: fake_anthropic_stream(...)
-
-    Accepts the same full-content block fakes the pre-#831
-    ``get_final_message`` fixtures used (objects with ``.type`` + fields
-    and ``model_dump()``) and synthesizes the real event grammar the
-    streaming iterator consumes: ``content_block_start`` carries the block
-    with its text/thinking/signature EMPTIED and ``input`` as ``{}`` (the
-    SDK start shape), deltas carry the content, ``content_block_stop``
-    finalizes tool input, and the closing ``message_delta`` carries
-    ``stop_reason`` (+ optional usage object).  Without the stripping, the
-    provider's raw-block accumulator would double every text/thinking
-    field (start capture + delta append).
-
-    ``stop_reason=None`` omits the closing ``message_delta`` entirely —
-    the terminal-signal-less lax-gateway shape ``finish_reason_optional``
-    exists for (content arrives, then the stream just ends).
-    """
-    events: list[Any] = []
-    for idx, block in enumerate(blocks):
-        d = dict(block.model_dump()) if hasattr(block, "model_dump") else dict(vars(block))
-        btype = d.get("type", "")
-        start = dict(d)
-        if btype == "text":
-            start["text"] = ""
-        elif btype == "thinking":
-            start["thinking"] = ""
-            start["signature"] = ""
-        elif btype == "tool_use":
-            start["input"] = {}
-        events.append(
-            SimpleNamespace(
-                type="content_block_start", index=idx, content_block=SimpleNamespace(**start)
-            )
-        )
-        if btype == "text" and d.get("text"):
-            events.append(
-                SimpleNamespace(
-                    type="content_block_delta",
-                    index=idx,
-                    delta=SimpleNamespace(type="text_delta", text=d["text"]),
-                )
-            )
-        elif btype == "thinking":
-            if d.get("thinking"):
-                events.append(
-                    SimpleNamespace(
-                        type="content_block_delta",
-                        index=idx,
-                        delta=SimpleNamespace(type="thinking_delta", thinking=d["thinking"]),
-                    )
-                )
-            if d.get("signature"):
-                events.append(
-                    SimpleNamespace(
-                        type="content_block_delta",
-                        index=idx,
-                        delta=SimpleNamespace(type="signature_delta", signature=d["signature"]),
-                    )
-                )
-        elif btype == "tool_use":
-            events.append(
-                SimpleNamespace(
-                    type="content_block_delta",
-                    index=idx,
-                    delta=SimpleNamespace(
-                        type="input_json_delta",
-                        partial_json=json.dumps(d.get("input", {})),
-                    ),
-                )
-            )
-        events.append(SimpleNamespace(type="content_block_stop", index=idx))
-    if stop_reason is not None or usage is not None:
-        events.append(
-            SimpleNamespace(
-                type="message_delta", usage=usage, delta=SimpleNamespace(stop_reason=stop_reason)
-            )
-        )
-
-    mgr = MagicMock()
-    mgr.__enter__ = MagicMock(return_value=events)
-    mgr.__exit__ = MagicMock(return_value=False)
-    return mgr
-
-
-def as_stream(result: Any) -> list[StreamChunk]:
-    """Adapt a ``CompletionResult``-shaped fake to a ``create_streaming``
-    return value (single terminal chunk).
-
-    The #831 transport collapse routes every single-shot lane through
-    ``drain_stream(provider.create_streaming(...))``, so provider fakes
-    return chunk iterables now.  Tests keep building result-shaped fakes
-    (``mock_completion_result`` or hand-rolled) and wrap them at
-    assignment: ``provider.create_streaming.return_value =
-    as_stream(result)``.  A list re-iterates on every call, so one
-    ``return_value`` serves repeated-call tests; convert AFTER mutating
-    the fake's fields — the chunk snapshots them.
-
-    Multi-chunk accumulation semantics are exercised by the dedicated
-    ``drain_stream`` unit tests, not through this helper.
-    """
-    deltas = [
-        ToolCallDelta(
-            index=i,
-            id=tc.get("id", ""),
-            name=tc.get("function", {}).get("name", ""),
-            arguments_delta=tc.get("function", {}).get("arguments", ""),
-        )
-        for i, tc in enumerate(result.tool_calls or [])
-    ]
-    return [
-        StreamChunk(
-            content_delta=result.content or "",
-            reasoning_delta=getattr(result, "reasoning", "") or "",
-            tool_call_deltas=deltas,
-            usage=result.usage,
-            finish_reason=result.finish_reason or "stop",
-            provider_blocks=list(result.provider_blocks or []),
-        )
-    ]

tests/conftest.py

@@ -4,9 +4,6 @@ import asyncio
 import contextlib
 import logging
 import os
-import socket
-import subprocess
-import sys
 import threading
 import time
 from typing import TYPE_CHECKING, Any
@@ -219,98 +216,6 @@ def _seed_static_state(mgr: MCPClientManager, name: str, **overrides: Any) -> St
     return state
 
 
-def _run_on_loop(loop: asyncio.AbstractEventLoop, coro: Any, timeout: float = 10) -> Any:
-    """Submit *coro* to *loop*, wait for the result.
-
-    The ONE copy shared by the MCP test files — four hand-synced copies
-    had already drifted on the timeout (5s hardcoded vs a 10s default).
-    The timeout is an upper bound on waiting, not a behavior assertion,
-    so the most generous variant won the merge.
-    """
-    fut = asyncio.run_coroutine_threadsafe(coro, loop)
-    return fut.result(timeout=timeout)
-
-
-def _drain_background(mgr: MCPClientManager, loop: asyncio.AbstractEventLoop) -> None:
-    """Deterministically await ``mgr``'s tracked background tasks.
-
-    Replaces fixed sleeps for synchronizing with scheduled dead-grant
-    drops / spawned refreshes: exact, and immune to slow-runner flake.
-    """
-
-    async def _drain() -> None:
-        tasks = [t for t in list(mgr._background_tasks) if not t.done()]
-        if tasks:
-            await asyncio.gather(*tasks, return_exceptions=True)
-
-    _run_on_loop(loop, _drain())
-
-
-def _poll_until(predicate: Callable[[], bool], timeout: float, interval: float = 0.05) -> bool:
-    """Poll *predicate* until true or *timeout* elapses — the ONE wait loop.
-
-    Shared by the live MCP smoke tests' condition helpers so the
-    deadline/poll pattern doesn't accrete per-file hand-synced copies.
-    """
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if predicate():
-            return True
-        time.sleep(interval)
-    return False
-
-
-def _free_port() -> int:
-    """Grab an ephemeral localhost port for a live-server subprocess.
-
-    Shared by the live MCP smoke tests (flaky-server, push-refresh) so
-    the socket-probe helpers stay in one place instead of drifting per
-    file.
-    """
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(("127.0.0.1", 0))
-        return int(s.getsockname()[1])
-
-
-def _tcp_accepts(port: int) -> bool:
-    try:
-        with socket.create_connection(("127.0.0.1", port), timeout=0.3):
-            return True
-    except OSError:
-        return False
-
-
-def _wait_tcp_ready(port: int, timeout: float) -> bool:
-    """Poll until something accepts TCP on 127.0.0.1:*port* (live tests)."""
-    return _poll_until(lambda: _tcp_accepts(port), timeout)
-
-
-def _wait_session_live(mgr: MCPClientManager, name: str, timeout: float) -> bool:
-    """Poll until static server *name* has a live session (live tests)."""
-
-    def _live() -> bool:
-        state = mgr._static_servers.get(name)
-        return state is not None and state.session is not None
-
-    return _poll_until(_live, timeout)
-
-
-def _popen_mcp_server(script_path: Any, port: int) -> subprocess.Popen[bytes]:
-    """Start a FastMCP live-server subprocess, streams to DEVNULL.
-
-    The shared spawn primitive for the live MCP smoke tests
-    (flaky-server flap loop, push-refresh) — the readiness wait and the
-    skip-vs-raise-on-failure policy legitimately differ per test and
-    stay at the call sites. ``sys.executable`` runs the same interpreter,
-    so a server-side import gap surfaces as a failed TCP wait, not here.
-    """
-    return subprocess.Popen(
-        [sys.executable, str(script_path), str(port)],
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-    )
-
-
 def make_oidc_test_config(**overrides: Any) -> OIDCConfig:
     """Build a test ``OIDCConfig`` with sensible defaults.
 
@@ -430,40 +335,6 @@ def mock_openai_client():
     return client
 
 
-@pytest.fixture
-def make_config_store():
-    """Factory for a lightweight ConfigStore double.
-
-    ``make_config_store(**overrides)`` returns an object whose ``.get(key)``
-    yields the override when present, else the registered SettingDef default —
-    mirroring the real :meth:`ConfigStore.get` fail-open (a bool setting reads
-    as its ``False`` default on a miss, never ``None``). Shared by the
-    ``server.require_project`` gate / advisory tests.
-    """
-
-    _unset = object()
-
-    def _make(**overrides: Any) -> Any:
-        from turnstone.core.settings_registry import SETTINGS
-
-        class _ConfigStoreDouble:
-            def get(self, key: str, default: Any = _unset) -> Any:
-                # Mirror ConfigStore.get precedence exactly: cache (overrides)
-                # first, then a caller-supplied default, then the registry
-                # default, then None — so a reused caller passing an explicit
-                # default for an unset key gets the same value production would.
-                if key in overrides:
-                    return overrides[key]
-                if default is not _unset:
-                    return default
-                defn = SETTINGS.get(key)
-                return defn.default if defn else None
-
-        return _ConfigStoreDouble()
-
-    return _make
-
-
 @pytest.fixture(autouse=True)
 def _clear_policy_cache():
     """Drop the in-process tool-policy cache between tests.

tests/data/wire_payloads/anthropic_compat__mid_orphan.json

@@ -57,6 +57,7 @@
     }
   ],
   "model": "qwen3.6-27b",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_compat__multipart.json

@@ -28,5 +28,6 @@
       "role": "user"
     }
   ],
-  "model": "qwen3.6-27b"
+  "model": "qwen3.6-27b",
+  "temperature": 0.5
 }

tests/data/wire_payloads/anthropic_compat__native_orphan.json

@@ -49,6 +49,7 @@
     }
   ],
   "model": "qwen3.6-27b",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_compat__native_reasoning.json

@@ -48,6 +48,7 @@
     }
   ],
   "model": "qwen3.6-27b",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_compat__operator_system.json

@@ -42,6 +42,7 @@
   ],
   "model": "qwen3.6-27b",
   "system": "Output-guard: deploy output looked clean.",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_compat__text.json

@@ -28,5 +28,6 @@
       "role": "user"
     }
   ],
-  "model": "qwen3.6-27b"
+  "model": "qwen3.6-27b",
+  "temperature": 0.5
 }

tests/data/wire_payloads/anthropic_compat__toolcall_complete.json

@@ -48,6 +48,7 @@
     }
   ],
   "model": "qwen3.6-27b",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_compat__trailing_orphan.json

@@ -40,6 +40,7 @@
     }
   ],
   "model": "qwen3.6-27b",
+  "temperature": 0.5,
   "tools": [
     {
       "description": "Look up the weather for a city.",

tests/data/wire_payloads/anthropic_hoist__mid_orphan.json

@@ -51,6 +51,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__multipart.json

@@ -23,6 +23,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__native_orphan.json

@@ -43,6 +43,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__native_reasoning.json

@@ -42,6 +42,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__operator_system.json

@@ -35,6 +35,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "system": "Output-guard: deploy output looked clean.",
   "temperature": 1.0,
   "thinking": {

tests/data/wire_payloads/anthropic_hoist__text.json

@@ -23,6 +23,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__toolcall_complete.json

@@ -42,6 +42,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_hoist__trailing_orphan.json

@@ -34,6 +34,9 @@
     }
   ],
   "model": "claude-sonnet-4-6",
+  "output_config": {
+    "effort": "medium"
+  },
   "temperature": 1.0,
   "thinking": {
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__mid_orphan.json

@@ -51,6 +51,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__multipart.json

@@ -23,6 +23,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__native_orphan.json

@@ -43,6 +43,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__native_reasoning.json

@@ -42,6 +42,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__operator_system.json

@@ -39,6 +39,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__text.json

@@ -23,6 +23,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__toolcall_complete.json

@@ -42,6 +42,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/anthropic_native__trailing_orphan.json

@@ -34,6 +34,9 @@
     }
   ],
   "model": "claude-opus-4-8",
+  "output_config": {
+    "effort": "medium"
+  },
   "thinking": {
     "display": "summarized",
     "type": "adaptive"

tests/data/wire_payloads/google__mid_orphan.json

@@ -43,10 +43,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/google__multipart.json

@@ -18,8 +18,10 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
-  }
+  },
+  "temperature": 0.5
 }

tests/data/wire_payloads/google__native_orphan.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/google__native_reasoning.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/google__operator_system.json

@@ -34,10 +34,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/google__text.json

@@ -15,8 +15,10 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
-  }
+  },
+  "temperature": 0.5
 }

tests/data/wire_payloads/google__toolcall_complete.json

@@ -30,10 +30,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/google__trailing_orphan.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gemini-2.5-pro",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__mid_orphan.json

@@ -43,10 +43,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__multipart.json

@@ -18,8 +18,10 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
-  }
+  },
+  "temperature": 0.5
 }

tests/data/wire_payloads/openai_chat__native_orphan.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__native_reasoning.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__operator_system.json

@@ -34,10 +34,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__text.json

@@ -15,8 +15,10 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
-  }
+  },
+  "temperature": 0.5
 }

tests/data/wire_payloads/openai_chat__toolcall_complete.json

@@ -30,10 +30,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_chat__trailing_orphan.json

@@ -26,10 +26,12 @@
     }
   ],
   "model": "gpt-4o-mini",
+  "reasoning_effort": "medium",
   "stream": true,
   "stream_options": {
     "include_usage": true
   },
+  "temperature": 0.5,
   "tools": [
     {
       "function": {

tests/data/wire_payloads/openai_responses__mid_orphan.json

@@ -39,6 +39,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/data/wire_payloads/openai_responses__multipart.json

@@ -21,6 +21,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true
 }

tests/data/wire_payloads/openai_responses__native_orphan.json

@@ -28,6 +28,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/data/wire_payloads/openai_responses__native_reasoning.json

@@ -28,6 +28,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/data/wire_payloads/openai_responses__operator_system.json

@@ -29,6 +29,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/data/wire_payloads/openai_responses__text.json

@@ -22,6 +22,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true
 }

tests/data/wire_payloads/openai_responses__toolcall_complete.json

@@ -28,6 +28,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/data/wire_payloads/openai_responses__trailing_orphan.json

@@ -23,6 +23,9 @@
   "max_output_tokens": 4096,
   "model": "gpt-5",
   "prompt_cache_retention": "24h",
+  "reasoning": {
+    "effort": "medium"
+  },
   "store": false,
   "stream": true,
   "tools": [

tests/test_app_js.py

@@ -19,7 +19,6 @@ import pytest
 
 _APP_JS = Path(__file__).resolve().parent.parent / "turnstone/ui/static/app.js"
 _INTERACTIVE_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/interactive.js"
-_MCP_ERROR_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/mcp_error.js"
 _SHELL_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/shell.js"
 _REDACT_CREDENTIALS_JS = (
     Path(__file__).resolve().parent.parent / "turnstone/shared_static/redact_credentials.js"
@@ -434,27 +433,20 @@ _UNSAFE_CODE_SINK_RE = re.compile(
 
 def test_phase8_mcp_error_helpers_defined() -> None:
     """``tryParseMcpError`` (envelope detector) + ``buildMcpErrorEmbed``
-    (consent / forbidden / operator card) live in the shared ``mcp_error.js``
-    module — lifted out of interactive.js by #725 so BOTH conversation
-    surfaces render the same card: the interactive pane AND the coordinator
-    pane (whose sessions carry the same MCP surface, persona-gated).
-    The consent-badge state (``_pendingConsentServers`` /
-    ``_onConsentDetected``) stays in the standalone shell — it drives the
-    rail's Manage-row badge — and the pane reaches it through the
-    ``host.onConsentDetected`` seam.  The shared host bridges that seam to the
-    standalone via ``window.TS_APP.onConsentDetected`` (undefined on the
-    console, so it stays a no-op there).  Pin the module, both consumers, and
+    (interactive consent / forbidden / operator card) moved into the shared
+    interactive module with the Pane.  The consent-badge state
+    (``_pendingConsentServers`` / ``_onConsentDetected``) stays in the
+    standalone shell — it drives the rail's Manage-row badge — and the pane
+    reaches it through the ``host.onConsentDetected`` seam.  The shared host
+    bridges that seam to the standalone via ``window.TS_APP.onConsentDetected``
+    (undefined on the console, so it stays a no-op there).  Pin both halves and
     the bridge."""
-    mod = _MCP_ERROR_JS.read_text(encoding="utf-8")
-    assert "function tryParseMcpError" in mod
-    assert "function buildMcpErrorEmbed" in mod
+    inter = _INTERACTIVE_JS.read_text(encoding="utf-8")
+    assert "function tryParseMcpError" in inter
+    assert "function buildMcpErrorEmbed" in inter
     # The actionable branch surfaces consent via the THREADED callback, not a
     # direct shell call — that decoupling is what lets the console no-op it.
-    assert "if (onConsent) onConsent(err.server)" in mod
-    inter = _INTERACTIVE_JS.read_text(encoding="utf-8")
-    assert 'from "./mcp_error.js"' in inter, (
-        "the interactive pane must consume the shared MCP error module"
-    )
+    assert "if (onConsent) onConsent(err.server)" in inter
     assert "onConsentDetected(s)" in inter, (
         "the pane must notify consent through host.onConsentDetected"
     )
@@ -463,15 +455,6 @@ def test_phase8_mcp_error_helpers_defined() -> None:
     assert "window.TS_APP.onConsentDetected(server)" in inter, (
         "the shared interactive host must bridge onConsentDetected to the TS_APP seam"
     )
-    # The coordinator pane is the second consumer (#725): a coordinator MCP
-    # dispatch hitting consent-required must render the card, not raw JSON.
-    coord = _COORD_JS.read_text(encoding="utf-8")
-    assert '"/shared/mcp_error.js"' in coord, (
-        "the coordinator pane must import the shared MCP error module (#725)"
-    )
-    assert "tryParseMcpError(" in coord and "buildMcpErrorEmbed(" in coord, (
-        "the coordinator pane must dispatch structured MCP errors to the shared card"
-    )
     app = _APP_JS.read_text(encoding="utf-8")
     assert "_pendingConsentServers" in app
     assert "function _onConsentDetected" in app
@@ -587,7 +570,6 @@ _UNSAFE_CODE_SINK_LINT_TARGETS = [
     ("turnstone/shared_static/utils.js", _UTILS_JS),
     ("turnstone/shared_static/auth.js", _AUTH_JS),
     ("turnstone/shared_static/kb.js", _KB_JS),
-    ("turnstone/shared_static/mcp_error.js", _MCP_ERROR_JS),
     ("turnstone/console/static/coordinator/coordinator.js", _COORD_JS),
     ("turnstone/console/static/admin.js", _CONSOLE_ADMIN_JS),
     ("turnstone/console/static/governance.js", _CONSOLE_GOVERNANCE_JS),
@@ -878,7 +860,7 @@ def test_phase8_xss_safe_render_in_build_mcp_error_embed() -> None:
     scopes list. The card builder uses createElement + textContent
     throughout so a script-tag server name renders harmlessly. Pin
     the absence of the unsafe-write inside ``buildMcpErrorEmbed``."""
-    body = _MCP_ERROR_JS.read_text(encoding="utf-8")
+    body = _INTERACTIVE_JS.read_text(encoding="utf-8")
     start = body.index("function buildMcpErrorEmbed(")
     # Bound to the function body — find its closing brace at column 0.
     rest = body[start:]
@@ -894,30 +876,6 @@ def test_phase8_xss_safe_render_in_build_mcp_error_embed() -> None:
     )
 
 
-def test_mcp_error_button_gated_on_consent_url_not_code_alone() -> None:
-    """Review finding: the chat error card rendered a Connect / Re-consent
-    button from the error CODE alone, so an oauth_obo error (consent_url=None,
-    since sign-in passthrough has no per-server consent flow and /start rejects
-    obo rows) produced a button that dead-ended in a 'no consent URL' toast.
-    The button must render only when a valid per-server consent URL is present —
-    obo errors show the card's honest detail text without a broken affordance."""
-    body = _MCP_ERROR_JS.read_text(encoding="utf-8")
-    start = body.index("function buildMcpErrorEmbed(")
-    rest = body[start:]
-    end_match = re.search(r"\n}\n", rest)
-    assert end_match is not None
-    fn = rest[: end_match.end()]
-    # The render gate combines the category with a consent-URL presence check.
-    assert "hasConsentAffordance" in fn, (
-        "buildMcpErrorEmbed must gate the action button on the presence of a "
-        "consent URL, not on the error category alone."
-    )
-    assert 'category === "actionable" && hasConsentAffordance' in fn, (
-        "the button-render condition must require BOTH an actionable category "
-        "and a real consent URL"
-    )
-
-
 def test_phase8_css_classes_present_in_stylesheet() -> None:
     """The MCP error-embed + connections classes app.js/interactive.js reference
     must keep their CSS rules (else the consent / connections UX silently loses
@@ -957,7 +915,7 @@ def test_phase8_consent_url_prefix_check_in_click_handler() -> None:
     string and the ``startsWith`` form so a future refactor can't
     silently weaken the guard.
     """
-    body = _MCP_ERROR_JS.read_text(encoding="utf-8")
+    body = _INTERACTIVE_JS.read_text(encoding="utf-8")
     # Bound the search to the click handler region (between the
     # ``buildMcpErrorEmbed`` function and the next top-level helper) to
     # avoid false positives from unrelated string occurrences.
@@ -2329,701 +2287,3 @@ def test_console_has_matching_pane_hotkeys() -> None:
     assert '"Fork"' not in index and "New workstream" not in index, (
         "Fork + New are intentionally omitted on the console"
     )
-
-
-def test_fork_hides_project_picker() -> None:
-    """A fork must NOT show a project picker. A fork inherits its source's project
-    (enforced server-side), and a re-fileable fork picker was a cross-tenant
-    history-relocation vector — so showNewWsModal hides the picker for forks and
-    the "Keep source's project" fork option is gone."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    assert "projSelect.hidden = !!_forkFromWsId" in body, (
-        "the new-ws project picker must be hidden for forks"
-    )
-    assert "Keep source's project" not in body, (
-        "the fork project picker (and its 'Keep source's project' option) must be removed"
-    )
-
-
-def test_submit_gates_project_on_fork_flag() -> None:
-    """submitNewWs must send body.project_id ONLY for a fresh create
-    (!_forkFromWsId) — a fork never sends a project (its project is the source's,
-    enforced server-side). Not gated on picker visibility or a requireProject()
-    re-read."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    m = re.search(r"function submitNewWs\(\)\s*\{(.*?)\n\}", body, re.S)
-    assert m is not None, "could not locate submitNewWs"
-    fn = m.group(1)
-    assert "TurnstoneProjects.requireProject" not in fn, (
-        "submit must not re-read the requireProject() advisory"
-    )
-    assert re.search(r"project_id && !_forkFromWsId", fn), (
-        "submit must gate project_id on !_forkFromWsId (a fork never sends a project)"
-    )
-
-
-def test_strict_picker_requires_explicit_pick() -> None:
-    """Under require_project the fresh picker must NOT auto-select the first
-    project (which silently mis-files a required chat under a possibly-shared
-    project) — it offers a 'Select a project…' prompt so the user consciously
-    chooses."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    assert "Select a project" in body, (
-        "strict picker must offer an explicit 'Select a project…' prompt"
-    )
-    m = re.search(
-        r"function _reconcileRequiredProjectSelection\(sel, choices\)\s*\{(.*?)\n\}",
-        body,
-        re.S,
-    )
-    assert m is not None, "could not locate _reconcileRequiredProjectSelection"
-    fn = m.group(1)
-    assert "real[0]" not in fn, "strict picker must not auto-select the first project"
-    # §6b polish: _populateProjectSelect threads its already-computed choices into
-    # reconcile rather than forcing a second projectChoices() recompute (the onClose
-    # creator caller still passes none and reconcile recomputes for it).
-    assert "_reconcileRequiredProjectSelection(sel, choices)" in body, (
-        "the populate helper must thread its computed choices into reconcile "
-        "(avoids a redundant projectChoices() recompute)"
-    )
-
-
-# ---------------------------------------------------------------------------
-# Composer selector FOUC — sync-paint-then-refresh guards
-# ---------------------------------------------------------------------------
-#
-# The project + persona composer selectors are painted from the warm shared
-# client cache (window.TurnstoneProjects / window.TurnstonePersonas, warmed by
-# the rail at startup) SYNCHRONOUSLY on open, BEFORE the deliberate async
-# refresh-and-repaint that catches items created elsewhere.  Pre-fix they were
-# painted only inside the refresh().then callback, so every open flashed an
-# empty dropdown for a network round-trip even when the data was already in
-# memory.  These guards pin the ordering — a synchronous populate must precede
-# the refresh().then — for all three composer surfaces (new-ws modal, dashboard
-# Options, console launcher).  The model/skill selectors (phase 2b) are covered
-# by the guards further down (search "models/skills composer FOUC").
-
-
-def _slice_top_level_fn(body: str, header: str) -> str:
-    """Slice a top-level ``function`` body from ``header`` to the next
-    column-0 ``function`` declaration (or EOF).  Unlike
-    ``_slice_balanced_body`` this has no fixed-size window, so it is safe
-    for large functions like ``showNewWsModal``.  Nested (indented)
-    ``function () {…}`` expressions never match the ``\\nfunction `` bound,
-    so the slice stops at the next top-level function."""
-    start = body.index(header)
-    nxt = body.find("\nfunction ", start + 1)
-    return body[start:] if nxt < 0 else body[start:nxt]
-
-
-def test_new_ws_modal_paints_project_and_persona_from_cache_synchronously() -> None:
-    """FOUC fix: the new-ws modal's project + persona pickers paint from the warm
-    shared cache SYNCHRONOUSLY on open, BEFORE the async refresh-and-repaint — so a
-    warm-cache open (the common case; the rail warms the caches at startup) shows
-    the populated dropdowns immediately instead of flashing empty for a network
-    round-trip.  The refresh-on-open is KEPT (it catches items created elsewhere);
-    these guards pin only that a synchronous populate precedes it."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    fn = _slice_top_level_fn(body, "function showNewWsModal(")
-    # Project is painted via the shared _paintProjectPicker helper (fork-gated);
-    # the sync-before-async pattern is pinned in test_paint_project_picker_syncs.
-    assert "_paintProjectPicker(projSelect" in fn, (
-        "the modal must paint the project picker via the shared _paintProjectPicker helper"
-    )
-    # Persona is painted via the shared _paintPersonaSelect wrapper (fork-gated);
-    # its sync-before-async ordering is pinned in the wrapper-internals test.
-    assert "_paintPersonaSelect(personaSelect" in fn, (
-        "the modal must paint the persona picker via the shared _paintPersonaSelect helper"
-    )
-
-
-def test_dashboard_paints_project_and_persona_from_cache_synchronously() -> None:
-    """FOUC fix (dashboard composer twin of the modal): the dashboard Options
-    project + persona pickers paint synchronously from the warm cache before the
-    async refresh.  Also pins the deferred require_project polish — the dashboard
-    Project label carries a ``.label-hint`` span seeded ``required``/``optional``
-    from requireProject() synchronously, matching the new-ws modal."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    fn = _slice_top_level_fn(body, "function _loadDashboardOptionsLists(")
-    # Project is painted via the shared _paintProjectPicker helper.
-    assert "_paintProjectPicker(projSel" in fn, (
-        "the dashboard must paint the project picker via the shared _paintProjectPicker helper"
-    )
-    # Persona is painted via the shared _paintPersonaSelect wrapper (freshOnOpen:false).
-    assert "_paintPersonaSelect(personaSel, { freshOnOpen: false })" in fn, (
-        "the dashboard must paint the persona picker via _paintPersonaSelect (preserving)"
-    )
-    # require_project label-hint parity: the dashboard Project label gained a
-    # .label-hint span, seeded synchronously from requireProject() like the modal.
-    html = _INDEX_HTML.read_text(encoding="utf-8")
-    lbl = html.index('for="dashboard-project"')
-    assert 'class="label-hint"' in html[lbl : lbl + 120], (
-        "the dashboard Project label must carry a .label-hint span (required/optional cue)"
-    )
-    # The hint is seeded synchronously inside _paintProjectPicker (asserted there).
-
-
-def test_console_launcher_paints_project_and_persona_from_cache_synchronously() -> None:
-    """FOUC fix (console launcher composer): the project + persona wrappers route
-    through the _paintHomeFromCache chokepoint — sync paint from the warm cache,
-    then refresh(callOpts)-and-repaint; the ordering discipline is asserted ONCE
-    on the helper (in the model/skill twin test).  Each wrapper must pair its OWN
-    bridge refresh with its OWN populate helper.  Also pins the persona
-    kind-default revert: _populateHomePersonaDropdown must fall back to
-    defaultPersona(kind) when the previous pick is no longer a valid choice (the
-    interactive/coordinator persona shelves are disjoint), or a kind toggle
-    silently degrades the picker to a bare placeholder."""
-    body = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    proj_fn = _slice_top_level_fn(body, "function _refreshAndPopulateProjects(")
-    assert re.search(
-        r"_paintHomeFromCache\(\s*TP && TP\.refreshProjects,\s*_populateHomeProjectDropdown",
-        proj_fn,
-    ), "the launcher project wrapper must pair its bridge refresh + populate via the chokepoint"
-    persona_fn = _slice_top_level_fn(body, "function _refreshAndPopulatePersonas(")
-    assert re.search(
-        r"_paintHomeFromCache\(\s*TP && TP\.refreshPersonas,\s*_populateHomePersonaDropdown",
-        persona_fn,
-    ), "the launcher persona wrapper must pair its bridge refresh + populate via the chokepoint"
-    pop = _slice_top_level_fn(body, "function _populateHomePersonaDropdown(")
-    assert '_restorePick("persona"' in pop, (
-        "the persona populate must restore a still-valid pick via _restorePick"
-    )
-    assert "defaultPersona(_launcherKind)" in pop, (
-        "the persona populate must revert to the kind default when the pick is gone"
-    )
-    proj_pop = _slice_top_level_fn(body, "function _populateHomeProjectDropdown(")
-    assert '_restorePick("project"' in proj_pop, (
-        "the project populate must validate a previous pick via _restorePick (a "
-        "since-deleted project falls back to the placeholder, not a blank select)"
-    )
-
-
-def test_paint_project_picker_syncs_before_refresh() -> None:
-    """The shared _paintProjectPicker (used by BOTH the modal and dashboard, so
-    the two can't drift and silently re-introduce the FOUC) seeds the required/
-    optional hint + paints via _populateProjectSelect, and routes its
-    sync-then-refresh tail through the _paintFromCache chokepoint — where the
-    sync-before-async + always-fresh:false discipline is asserted once.  Its
-    fork/absent-bridge path returns a resolved promise so the dashboard's chained
-    Options-chip recompute still runs.  Both paints reuse _populateProjectSelect
-    (preserving the #867 strict-picker invariant)."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    fn = _slice_top_level_fn(body, "function _paintProjectPicker(")
-    assert "_populateProjectSelect(" in fn, (
-        "_paintProjectPicker must paint via _populateProjectSelect"
-    )
-    assert "hint.textContent" in fn, "_paintProjectPicker must seed the required/optional hint"
-    assert "opts.fork" in fn, "_paintProjectPicker must skip for a fork"
-    assert "return Promise.resolve();" in fn, (
-        "_paintProjectPicker's fork/absent-bridge path must return a resolved "
-        "promise (the dashboard chains its Options-chip recompute on the return)"
-    )
-    assert "return _paintFromCache(window.TurnstoneProjects.refreshProjects, paint, opts)" in fn, (
-        "_paintProjectPicker's tail must route through the _paintFromCache "
-        "chokepoint (sync paint(freshOnOpen) then always-fresh:false repaint)"
-    )
-
-
-# --- models/skills composer FOUC (phase 2b) --------------------------------
-#
-# The model + skill pickers had NO client cache: every composer open re-fetched
-# /v1/api/models and /v1/api/skills inline, flashing an empty dropdown for the
-# round-trip.  Phase 2b adds shared caches (models.js / skills.js) on the
-# extracted list_cache.js core that the composers read synchronously, then
-# refresh-and-repaint — the same pattern the project/persona pickers use.  These
-# guards pin the sync-before-async ordering on all three surfaces, the cache
-# fail-open/coalesce contract, the two-server-schema exposure, and the
-# single-repaint-path wiring.
-
-_LIST_CACHE_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/list_cache.js"
-_MODELS_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/models.js"
-_SKILLS_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/skills.js"
-_PROJECTS_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/projects.js"
-_PERSONAS_JS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/personas.js"
-
-
-def test_paint_model_and_skill_wrappers_sync_before_refresh() -> None:
-    """The _paintFromCache chokepoint (PR #869 review: the three wrapper twins
-    repeated the same wiring, so the discipline now lives ONCE) paints from the
-    warm cache SYNCHRONOUSLY, then refreshes-and-repaints.  CRITICAL: the sync
-    paint mirrors the caller's freshOnOpen but the ASYNC repaint MUST pass
-    fresh:false — leaking freshOnOpen into the async paint would clobber a
-    mid-window pick (for the project picker that reconciles to "" -> a
-    require_project 400).  Each wrapper must pair its OWN bridge refresh with
-    its OWN populate helper and thread `fresh` through untouched."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    helper = _slice_top_level_fn(body, "function _paintFromCache(")
-    sync = helper.find("repaint(!!(opts && opts.freshOnOpen))")
-    async_ = helper.find("refresh().then")
-    assert 0 <= sync < async_, (
-        "_paintFromCache must sync-paint (repaint mirroring freshOnOpen) BEFORE "
-        "the async refresh repaint"
-    )
-    assert "repaint(false)" in helper[async_:], (
-        "_paintFromCache's async repaint must pass fresh:false (never leak "
-        "freshOnOpen, or it clobbers a mid-window pick)"
-    )
-    # Promise contract: callers (the dashboard Options-chip recompute) chain on
-    # the async repaint landing; the no-refresh path must still hand back a
-    # resolved promise or the chain throws on a cold bridge.
-    assert "return Promise.resolve()" in helper, (
-        "_paintFromCache must return an already-resolved promise when there is "
-        "no refresh (dashboard callers chain the Options-chip recompute)"
-    )
-    assert "return refresh().then" in helper, (
-        "_paintFromCache must return the async-repaint promise (callers act "
-        "after the repaint lands)"
-    )
-    for wrapper, bridge_refresh, populate in (
-        (
-            "function _paintModelSelects(",
-            "window.TurnstoneModels && window.TurnstoneModels.refreshModels",
-            "_populateModelSelect(modelSel, judgeSel, { fresh: fresh })",
-        ),
-        (
-            "function _paintSkillSelect(",
-            "window.TurnstoneSkills && window.TurnstoneSkills.refreshSkills",
-            "_populateSkillSelect(sel, { fresh: fresh })",
-        ),
-        (
-            "function _paintPersonaSelect(",
-            "window.TurnstonePersonas && window.TurnstonePersonas.refreshPersonas",
-            "_populatePersonaSelect(sel, { fresh: fresh })",
-        ),
-    ):
-        fn = _slice_top_level_fn(body, wrapper)
-        assert "return _paintFromCache(" in fn, f"{wrapper} must return the _paintFromCache promise"
-        assert bridge_refresh in fn, f"{wrapper} must pass its own bridge refresh"
-        assert populate in fn, f"{wrapper} must thread fresh through to its own populate helper"
-
-
-def test_new_ws_modal_renders_all_selects_fresh_on_open() -> None:
-    """Finding [0] fix — every composer select in the reused new-ws <dialog> renders
-    its ACTUAL value fresh on open (no stale carryover from the last open): model +
-    skill via the wrappers with freshOnOpen:true, persona via {fresh:true}, project
-    via _paintProjectPicker freshOnOpen:true.  The model paint is fork-gated."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    fn = _slice_top_level_fn(body, "function showNewWsModal(")
-    assert "_paintModelSelects(modelSelect, judgeSelect, { freshOnOpen: true })" in fn, (
-        "the modal must paint model+judge fresh-on-open via the shared wrapper"
-    )
-    assert "_paintSkillSelect(tplSelect, { freshOnOpen: true })" in fn, (
-        "the modal must paint skill fresh-on-open"
-    )
-    assert "_paintPersonaSelect(personaSelect, { freshOnOpen: true })" in fn, (
-        "the modal must paint persona fresh-on-open via the shared wrapper"
-    )
-    proj = fn[fn.find("_paintProjectPicker(projSelect") :]
-    assert "freshOnOpen: true" in proj[:120], (
-        "the modal must paint the project picker fresh-on-open"
-    )
-    # Fork-gates: the model + persona paints must each be the FIRST statement
-    # inside their own `if (!_forkFromWsId)` block.  (A first-gate ordering
-    # check is vacuous here — the first gate in showNewWsModal IS the model
-    # gate, so it would pass even with the paint hoisted out below it.)
-    assert re.search(r"if \(!_forkFromWsId\) \{\s*_paintModelSelects\(modelSelect", fn), (
-        "the modal model paint must be skipped for a fork"
-    )
-    assert re.search(r"if \(!_forkFromWsId\) \{\s*_paintPersonaSelect\(personaSelect", fn), (
-        "the modal persona paint must be skipped for a fork"
-    )
-
-
-def test_dashboard_paints_model_and_skill_via_wrappers_preserving() -> None:
-    """Dashboard twin — all four pickers paint via the SAME wrappers but
-    freshOnOpen:false (a persistent panel preserves a pick across a repaint), the
-    old fetch-once ``options.length <= 1`` guard is gone, and EVERY paint chains
-    _refreshDashboardOptionsSummary on its async repaint: a repaint can drop a
-    server-removed pick (or revert persona to its kind default) without firing
-    'change', and the collapsed Options chip must always name what submit sends."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    fn = _slice_top_level_fn(body, "function _loadDashboardOptionsLists(")
-    for paint in (
-        "_paintModelSelects(modelSel, judgeSel, { freshOnOpen: false })",
-        "_paintSkillSelect(skillSel, { freshOnOpen: false })",
-        "_paintProjectPicker(projSel, projHint, { fork: false })",
-        "_paintPersonaSelect(personaSel, { freshOnOpen: false })",
-    ):
-        assert re.search(re.escape(paint) + r"\.then\(\s*_refreshDashboardOptionsSummary", fn), (
-            f"dashboard paint must chain the Options-chip recompute: {paint[:36]}"
-        )
-    assert "options.length <= 1" not in fn, (
-        "the dashboard model/skill fetch-once guard must be removed (refresh-on-open now)"
-    )
-
-
-def test_new_ws_modal_fork_inherits_model_and_judge() -> None:
-    """Q2 — a fork INHERITS its source's model + judge: the modal hides both selects
-    for a fork (like skill/persona/project), and submitNewWs gates body.model AND
-    body.judge_model on !_forkFromWsId.  Asserts the model line SPECIFICALLY — its
-    guard `model && !_forkFromWsId` is a substring of the judge line, so a
-    model-unguarded regression would otherwise false-pass."""
-    body = _APP_JS.read_text(encoding="utf-8")
-    modal = _slice_top_level_fn(body, "function showNewWsModal(")
-    assert "modelSelect.hidden = !!_forkFromWsId" in modal, (
-        "modal must hide the model select for a fork"
-    )
-    assert "judgeSelect.hidden = !!_forkFromWsId" in modal, (
-        "modal must hide the judge select for a fork"
-    )
-    # [4] fix: the skill paint is fork-gated too (skill is hidden for a fork).
-    # Tie the gate to the skill paint SPECIFICALLY — a first-gate check would be
-    # satisfied by the model gate even if the skill paint were left
-    # unconditional, so require the paint to be the FIRST statement inside its
-    # own gate block.  (A nearest-preceding-gate proximity window false-passes
-    # a gate block that CLOSES before the paint.)
-    skill_paint = modal.find("_paintSkillSelect(tplSelect")
-    assert skill_paint >= 0, "the modal must paint the skill picker"
-    assert re.search(r"if \(!_forkFromWsId\) \{\s*_paintSkillSelect\(tplSelect", modal), (
-        "the modal skill paint must be directly wrapped in `if (!_forkFromWsId)` "
-        "(skip the wasted fetch + hidden-select rebuild on a fork)"
-    )
-    submit = _slice_top_level_fn(body, "function submitNewWs(")
-    assert "if (model && !_forkFromWsId) body.model = model;" in submit, (
-        "submitNewWs must fork-gate body.model (distinct from the judge line)"
-    )
-    assert "if (judge_model && !_forkFromWsId) body.judge_model = judge_model;" in submit, (
-        "submitNewWs must fork-gate body.judge_model"
-    )
-
-
-def test_console_launcher_paints_model_and_skill_from_cache_synchronously() -> None:
-    """Console launcher — the four _refreshAndPopulate* wrappers route through the
-    _paintHomeFromCache chokepoint: sync paint from the warm cache BEFORE the
-    async refresh(callOpts)-and-repaint (callOpts threads {force:true} for the
-    models_changed / onLoginSuccess invalidation callers).  The ordering
-    discipline is asserted once, on the helper; the wrappers are pairing-checked
-    (model/skill here, project/persona in their twin test)."""
-    body = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    helper = _slice_top_level_fn(body, "function _paintHomeFromCache(")
-    sync = helper.find("populate()")
-    async_ = helper.find("refresh(callOpts).then")
-    assert 0 <= sync < async_, (
-        "_paintHomeFromCache must sync-paint (populate()) BEFORE the async "
-        "refresh(callOpts).then repaint"
-    )
-    model_fn = _slice_top_level_fn(body, "function _refreshAndPopulateModels(")
-    assert re.search(
-        r"_paintHomeFromCache\(\s*TM && TM\.refreshModels,\s*_populateHomeModelDropdowns", model_fn
-    ), "the launcher model wrapper must pair its bridge refresh + populate via the chokepoint"
-    skill_fn = _slice_top_level_fn(body, "function _refreshAndPopulateSkills(")
-    assert re.search(
-        r"_paintHomeFromCache\(\s*TS && TS\.refreshSkills,\s*_populateHomeSkillDropdown", skill_fn
-    ), "the launcher skill wrapper must pair its bridge refresh + populate via the chokepoint"
-
-
-def test_console_relogin_rewarms_all_four_caches_with_force() -> None:
-    """onLoginSuccess re-warms ALL FOUR composer caches after auth lands (the boot
-    pass runs pre-login -> 401 -> fail-open empty), EACH with {force:true} so a
-    still-in-flight failing pre-auth fetch yields a trailing authenticated refetch
-    (skills/personas have no *_changed event to recover otherwise). Fixes [0]+[2]."""
-    body = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    start = body.index("window.onLoginSuccess = function ()")
-    # The four re-warm calls live before the // Active-coordinators marker; an
-    # assert falling outside this slice fails loudly rather than silently passing.
-    login = body[start : body.index("// Active-coordinators", start)]
-    for name in ("Skills", "Models", "Projects", "Personas"):
-        assert f"_refreshAndPopulate{name}({{ force: true }})" in login, (
-            f"onLoginSuccess must force-re-warm {name.lower()} after login"
-        )
-
-
-def test_models_changed_forces_trailing_single_repaint_path() -> None:
-    """The console ``models_changed`` handler repaints via the refresh wrapper with
-    {force:true} — so a burst of model-config changes converges to the latest server
-    state (trailing refresh) — and the launcher does NOT ALSO subscribe onModelsChange
-    (one repaint path, no double rebuild)."""
-    body = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    mc = body.index('data.type === "models_changed"')
-    handler = body[mc : mc + 700]
-    assert "_refreshAndPopulateModels({ force: true })" in handler, (
-        "models_changed must force a trailing refresh so it converges to the latest"
-    )
-    assert "onModelsChange" not in body, (
-        "the console must not ALSO subscribe onModelsChange (single repaint path)"
-    )
-
-
-def test_models_label_centralized_on_bridge() -> None:
-    """Finding [7] — the "alias (model)" label lives ONCE in models.js: modelLabel is
-    exported AND registered on the window.TurnstoneModels bridge (the classic app.js
-    bundles reach it only via the bridge — an ES-only export throws at runtime), and
-    neither app keeps a local _resolveModelLabel copy."""
-    models_src = _MODELS_JS.read_text(encoding="utf-8")
-    assert "export function modelLabel(" in models_src, "models.js must export modelLabel"
-    assert "modelLabel: modelLabel" in models_src, (
-        "models.js must register modelLabel on the window.TurnstoneModels bridge "
-        "(classic bundles call it via the bridge)"
-    )
-    # [7] fix: modelLabel resolves via the core's O(1) keyField index, not a scan.
-    assert 'keyField: "alias"' in models_src, (
-        "models.js must index by alias (keyField) so modelLabel is an O(1) getByKey"
-    )
-    assert "getByKey(alias)" in models_src, (
-        "modelLabel must resolve via the core's getByKey index (not a per-paint scan)"
-    )
-    assert "_resolveModelLabel" not in _APP_JS.read_text(encoding="utf-8"), (
-        "the ui app must not keep a local _resolveModelLabel (use TurnstoneModels.modelLabel)"
-    )
-    assert "_resolveModelLabel" not in _CONSOLE_APP_JS.read_text(encoding="utf-8"), (
-        "the console app must not keep a local _resolveModelLabel"
-    )
-
-
-def test_models_skills_module_tagged_in_both_apps() -> None:
-    """All four data-layer modules (projects/personas/models/skills) are
-    ``<script type=module>``-tagged BEFORE /shared/shell.js in BOTH index.html.
-    shell.js is the LAST module tag and calls TS_APP.boot (the first dashboard /
-    launcher paint); module execution follows tag order, and classic app.js is
-    parse-time definitions only — so a data-layer tag reordered below shell.js
-    boots the app before that bridge installs: the sync paint no-ops AND the
-    refresh is skipped, a silent test-green FOUC regression without this guard."""
-    for idx in (_INDEX_HTML, _CONSOLE_INDEX):
-        html = idx.read_text(encoding="utf-8")
-        for mod in ("projects", "personas", "models", "skills"):
-            path = f"/shared/{mod}.js"
-            assert path in html, f"{mod}.js must be module-tagged in {idx.name}"
-            assert html.index(path) < html.index("/shared/shell.js"), (
-                f"{mod}.js must be tagged BEFORE shell.js in {idx.name} — its "
-                "bridge must install before TS_APP.boot paints the composers"
-            )
-
-
-def test_list_cache_core_is_failopen_coalesced_and_gated() -> None:
-    """The extracted list_cache.js core: non-force callers coalesce onto the in-flight
-    refresh; it fails open (keeps the prior cache + records the error, never rejects —
-    only the SUCCESS branch calls _setCache); the extra-reset is GATED on
-    resetExtraOnError across BOTH error branches (finding [1]); and a force caller
-    schedules a trailing refetch that converges to the latest (finding [2])."""
-    src = _LIST_CACHE_JS.read_text(encoding="utf-8")
-    assert "return _inflight;" in src, "non-force callers must coalesce onto the in-flight refresh"
-    assert src.count("_byKey = Object.create(null)") == 2, (
-        "both _byKey sites (declaration + _setCache rebuild) must be null-prototype "
-        "(a row keyed __proto__ must not swap the map's prototype; inherited members "
-        "must not resolve as rows)"
-    )
-    assert "_lastError = r.status" in src and "_lastError = 0" in src, (
-        "a non-OK status and a network/parse error must both be recorded (fail-open)"
-    )
-    assert src.count("_setCache(data[dataKey]") == 1, (
-        "only the success branch may repopulate the cache (non-OK/catch keep the prior cache)"
-    )
-    # finding [1]: the extra-reset must be gated on resetExtraOnError on BOTH the
-    # non-OK branch AND the network/parse .catch branch (a cosmetic extra must
-    # survive a network drop too, not just a non-OK status).
-    assert src.count("resetExtraOnError && extraDefaults") == 2, (
-        "resetExtraOnError must gate the extra-reset on BOTH error branches"
-    )
-    # finding [2]: a force caller gets a trailing refetch (converges to latest).
-    assert "callOpts.force" in src and "_pending" in src, (
-        "a force caller must schedule a trailing refetch so it converges to the latest state"
-    )
-    assert "firstLoad || fp !== _fingerprint" in src, (
-        "subscribers must fire on first load or a changed fingerprint only"
-    )
-
-
-def test_reset_extra_policy_per_cache() -> None:
-    """require_project (an advisory that GATES the picker) must fail open on error;
-    the models default-aliases (a COSMETIC annotation) must keep their last-known
-    value.  So projects opts INTO the reset, models opts OUT (finding [1])."""
-    assert "resetExtraOnError: true" in _PROJECTS_JS.read_text(encoding="utf-8"), (
-        "projects.js must reset the require_project advisory on error (fail-open)"
-    )
-    assert "resetExtraOnError: false" in _MODELS_JS.read_text(encoding="utf-8"), (
-        "models.js must keep last-known default aliases on error (cosmetic, not a gate)"
-    )
-
-
-def test_models_cache_exposes_both_server_schemas() -> None:
-    """models.js must carry ALL default-alias fields — the node server sends
-    default_alias, the console sends coordinator_default_alias, both send
-    judge_default_alias — so each app reads its own (via modelDefaults/captureExtra,
-    which drive the "Default — <alias>" placeholder).  The dead onChange
-    subscription (+ its fingerprint fold) was removed: models has no live-render
-    subscriber (the console repaints via its direct models_changed handler), so it
-    exposes no onModelsChange."""
-    src = _MODELS_JS.read_text(encoding="utf-8")
-    for field in ("default_alias", "judge_default_alias", "coordinator_default_alias"):
-        assert field in src, f"models.js must carry {field} for the two server schemas"
-    assert "window.TurnstoneModels" in src, "models.js must install the classic bridge"
-    assert "makeListCache" in src, "models.js must build on the shared list_cache core"
-    assert "onModelsChange" not in src, (
-        "models.js must not expose the dead onModelsChange subscription (no subscribers)"
-    )
-
-
-def test_skills_cache_returns_raw_rows() -> None:
-    """skills.js exposes raw rows (getSkills) — the ui pickers add a ' [MCP]' suffix
-    the console omits, so a single pre-formatted label in the cache would silently
-    change one app's labels."""
-    src = _SKILLS_JS.read_text(encoding="utf-8")
-    assert "window.TurnstoneSkills" in src, "skills.js must install the classic bridge"
-    assert "makeListCache" in src, "skills.js must build on the shared list_cache core"
-    assert "getSkills" in src, "skills.js must expose raw rows via getSkills"
-
-
-def test_projects_personas_keep_public_surface_on_factory() -> None:
-    """The projects.js / personas.js retrofit onto list_cache.js must preserve their
-    full public surface — rail.js and project_creator.js import these by name, and
-    the classic bundles read the window bridges."""
-    proj = _PROJECTS_JS.read_text(encoding="utf-8")
-    assert "makeListCache" in proj, "projects.js must build on the shared core"
-    for name in (
-        "refreshProjects",
-        "getProjects",
-        "projectsLoaded",
-        "projectsError",
-        "requireProject",
-        "projectName",
-        "projectChoices",
-        "onProjectsChange",
-        "createProject",
-    ):
-        assert f"function {name}(" in proj, f"projects.js must still export {name}"
-    assert "requireProject: false" in proj, (
-        "the require_project advisory must seed / fail-open to false"
-    )
-    persona = _PERSONAS_JS.read_text(encoding="utf-8")
-    assert "makeListCache" in persona, "personas.js must build on the shared core"
-    for name in (
-        "refreshPersonas",
-        "getPersonas",
-        "personasLoaded",
-        "personasError",
-        "personaLabel",
-        "defaultPersona",
-        "personaChoices",
-        "onPersonasChange",
-    ):
-        assert f"function {name}(" in persona, f"personas.js must still export {name}"
-
-
-_MCP_ERROR_CSS = Path(__file__).resolve().parent.parent / "turnstone/shared_static/mcp_error.css"
-
-# The categories _mcpErrorCategory can return that carry their own CSS —
-# buildMcpErrorEmbed's interpolated `"mcp-error-" + category` class expands
-# to these plus "actionable", which is deliberately unstyled (the base card
-# look IS the actionable look: accent icon + Connect button).
-_MCP_ERROR_STYLED_CATEGORIES = ("operator", "transient", "forbidden")
-
-
-def test_mcp_error_css_owns_every_card_class() -> None:
-    """Every class mcp_error.js assigns has a rule in mcp_error.css.
-
-    The dual-static reach class (#725 review round 1: the standalone
-    coordinator page rendered the consent card bare because the card's
-    rules lived only in a host sheet it never linked).  The sheet pairs
-    with the module and every card host links it; this pin makes the
-    invariant structural — add a class to the card and this fails until
-    mcp_error.css owns it."""
-    js = _MCP_ERROR_JS.read_text(encoding="utf-8")
-    css = _MCP_ERROR_CSS.read_text(encoding="utf-8")
-    tokens: set[str] = set()
-    for assignment in re.findall(r'className\s*=\s*"([^"]+)"', js):
-        for tok in assignment.split():
-            if tok.endswith("-"):
-                # Interpolated category suffix ("mcp-error-" + category).
-                tokens.update(tok + cat for cat in _MCP_ERROR_STYLED_CATEGORIES)
-            else:
-                tokens.add(tok)
-    assert "mcp-error-card" in tokens, "class extractor found nothing — regex rotted?"
-    missing = sorted(t for t in tokens if ("." + t) not in css)
-    assert not missing, f"mcp_error.css lacks rules for: {missing}"
-
-
-def test_mcp_error_css_linked_by_every_card_host() -> None:
-    """Every page that renders the MCP error card links its sheet — the
-    other half of the reach invariant (a future host that imports
-    mcp_error.js without the stylesheet regresses to bare markup)."""
-    root = Path(__file__).resolve().parent.parent
-    hosts = (
-        root / "turnstone/console/static/coordinator/index.html",
-        root / "turnstone/console/static/index.html",
-        root / "turnstone/ui/static/index.html",
-    )
-    for host in hosts:
-        html = host.read_text(encoding="utf-8")
-        assert "/shared/mcp_error.css" in html, f"{host.name} must link /shared/mcp_error.css"
-
-
-def test_console_consent_badge_seam() -> None:
-    """#874 badge half, console side: the console defines the same
-    TS_APP.onConsentDetected seam the node dashboard does (which the shared
-    pane host bridges interactive panes' detections to), hydrates from the
-    Phase 9 persistence endpoint at boot, and badges the Admin > MCP
-    Servers rail row through the shell bridge."""
-    js = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert "window.TS_APP.onConsentDetected" in js
-    assert '"/v1/api/mcp/oauth/pending"' in js
-    assert 'setRowBadge("mcp"' in js
-    assert "window.TS_APP.syncConsentBadge" in js
-
-
-def test_admin_mcp_panel_resyncs_consent_badge() -> None:
-    """The admin MCP panel re-syncs the badge to DB truth AFTER a
-    successful render (node Connections-flow semantics) — and only then:
-    a failed load keeps the pending signal.  The order is asserted inside
-    loadAdminMcp's body (a whole-file check would bind to unrelated
-    earlier .catch( sites and false-pass a move into the failure path)."""
-    js = _CONSOLE_ADMIN_JS.read_text(encoding="utf-8")
-    body = js[js.index("function loadAdminMcp(") :]
-    body = body[: body.index("\nfunction ")]
-    assert (
-        body.index("_renderMcpServers(") < body.index("syncConsentBadge") < body.index(".catch(")
-    ), "syncConsentBadge must sit in loadAdminMcp's success path, after the render"
-
-
-def test_coordinator_pane_threads_consent_detection() -> None:
-    """#874 badge half, coordinator side: the single MCP-error helper
-    passes the consent callback to the card builder (both result paths get
-    detection), forwarding to the L-shell seam and the standalone
-    status-bar chip."""
-    js = _COORD_JS.read_text(encoding="utf-8")
-    assert "buildMcpErrorEmbed(mcpErr, output, _notifyConsentDetected)" in js
-    assert "onConsentDetected" in js
-    assert "coord-sb-consent" in js
-    # The chip is standalone-only chrome; the L-shell pane relies on the
-    # rail badge.
-    assert "opts.standalone" in js
-
-
-def test_consent_badge_visibility_resync_pins() -> None:
-    """#874 self-heal: both consent surfaces re-pull server truth on the
-    visibility-show edge (the consent popup is noopener — no cross-window
-    channel exists), with merge-on-success semantics: the mirrors diff
-    against a preFetch snapshot so a detection landing mid-fetch survives
-    and a failed fetch never blanks a possibly-valid warning.  A blind
-    clear()-then-refill would clobber mid-fetch adds — the preFetch
-    marker is the pin against that regression."""
-    app = _CONSOLE_APP_JS.read_text(encoding="utf-8")
-    assert 'document.addEventListener("visibilitychange"' in app
-    assert "_resyncPendingConsents" in app
-    assert app.count("preFetch") >= 2
-    # Single-flight: overlapping fetches can resolve out of order and no
-    # ordering guard covers every interleaving (stale clobber, failure
-    # suppression, phantom re-adds) — exclusion plus one queued rerun is
-    # the pinned shape, with a bounded flight so a stalled fetch cannot
-    # wedge the gate shut.  The timeout signal is feature-detected (old
-    # runtimes, per the codebase's AbortController guards) so it can
-    # never throw the gate wedged.
-    assert "_resyncInFlight" in app
-    assert "_resyncQueued" in app
-    assert app.count("AbortSignal.timeout") >= 2  # guard + use
-    coord = _COORD_JS.read_text(encoding="utf-8")
-    assert 'document.addEventListener("visibilitychange"' in coord
-    assert coord.count("preFetch") >= 2
-    assert "hydrateInFlight" in coord
-    assert "hydrateQueued" in coord
-    assert coord.count("AbortSignal.timeout") >= 2  # guard + use
-
-
-def test_reload_toast_console_phrasing_pins() -> None:
-    """Reload-toast truth table (#725): a node-less install reads
-    'Reload sent to console' instead of '0 node(s) + console'; a failed
-    console entry appends its explicit note; and failed beats reconciled
-    if a malformed entry ever carries both shapes."""
-    js = _CONSOLE_ADMIN_JS.read_text(encoding="utf-8")
-    assert '"Reload sent to console"' in js
-    assert '"; console reload failed"' in js
-    assert "!consoleFailed &&" in js

tests/test_compaction_checkpoint.py

@@ -186,41 +186,6 @@ class TestDisplayPath:
         assert "SUMMARY" not in contents
         assert contents == ["q", "a"]  # true transcript, no injected summary
 
-    def test_include_compaction_projects_marker_as_system_row(self, storage_backend):
-        """The /history display path (include_compaction=True) surfaces the
-        marker IN PLACE as a first-class system row — source="compaction",
-        meta = the marker's stored fields — so the UI re-renders its
-        compaction card after a reload.  Export/search (default False)
-        stay on the drop path pinned above."""
-        st = storage_backend
-        ws = _register(st)
-        st.save_message(ws, "user", "q")
-        st.save_message(ws, "assistant", "a")
-        wm = st.get_compaction_watermark(ws, 0)
-        st.save_message(
-            ws,
-            "assistant",
-            "SUMMARY",
-            source="compaction",
-            meta=json.dumps(
-                {"watermark": wm, "before_tokens": 900, "after_tokens": 80, "trigger": "manual"}
-            ),
-        )
-        st.save_message(ws, "user", "later question")
-
-        msgs = st.load_messages(ws, include_compaction=True)
-        assert [m.get("content") for m in msgs] == ["q", "a", "SUMMARY", "later question"]
-        marker = msgs[2]
-        assert marker["role"] == "system"  # display row, not a fake assistant turn
-        assert marker.get("_source") == "compaction"
-        meta = marker.get("_source_meta")
-        assert meta == {
-            "watermark": wm,
-            "before_tokens": 900,
-            "after_tokens": 80,
-            "trigger": "manual",
-        }
-
 
 # ---------------------------------------------------------------------------
 # End-to-end: compaction writes the marker, resume is bounded

tests/test_compaction_crossing.py

@@ -115,7 +115,7 @@ class TestSummaryTurnProvenance:
             session._generate_title()
 
         uc.assert_called_once()
-        prompt = uc.call_args[0][0][-1].text
+        prompt = uc.call_args[0][0][-1]["content"]
         assert COMPACTION_SUMMARY_LABEL in prompt  # titled FROM the real message
 
 

tests/test_config.py

@@ -257,63 +257,6 @@ def test_searxng_engines_default_empty(tmp_path, monkeypatch):
     assert config_mod.get_searxng_engines() == ""
 
 
-def _reset_workspace_cache():
-    config_mod._workspace_dir = None
-    config_mod._workspace_dir_loaded = False
-
-
-def test_workspace_dir_from_config(tmp_path, monkeypatch):
-    """get_workspace_dir() reads from config.toml [tools] workspace_dir."""
-    _reset_cache()
-    _reset_workspace_cache()
-
-    cfg = tmp_path / "config.toml"
-    cfg.write_text('[tools]\nworkspace_dir = "/srv/projects"\n')
-    set_config_path(str(cfg))
-    monkeypatch.delenv("TURNSTONE_WORKSPACE", raising=False)
-
-    assert config_mod.get_workspace_dir() == "/srv/projects"
-
-
-def test_workspace_dir_config_wins_over_env(tmp_path, monkeypatch):
-    """get_workspace_dir(): config.toml [tools] workspace_dir wins over env."""
-    _reset_cache()
-    _reset_workspace_cache()
-
-    cfg = tmp_path / "config.toml"
-    cfg.write_text('[tools]\nworkspace_dir = "/srv/projects"\n')
-    set_config_path(str(cfg))
-    monkeypatch.setenv("TURNSTONE_WORKSPACE", "/ignored")
-
-    assert config_mod.get_workspace_dir() == "/srv/projects"
-
-
-def test_workspace_dir_fallback_to_env(tmp_path, monkeypatch):
-    """get_workspace_dir() falls back to $TURNSTONE_WORKSPACE."""
-    _reset_cache()
-    _reset_workspace_cache()
-
-    cfg = tmp_path / "config.toml"
-    cfg.write_text("[tools]\n")
-    set_config_path(str(cfg))
-    monkeypatch.setenv("TURNSTONE_WORKSPACE", "/workspace")
-
-    assert config_mod.get_workspace_dir() == "/workspace"
-
-
-def test_workspace_dir_none_when_unset(tmp_path, monkeypatch):
-    """get_workspace_dir() returns None when neither config nor env is set."""
-    _reset_cache()
-    _reset_workspace_cache()
-
-    cfg = tmp_path / "config.toml"
-    cfg.write_text("[tools]\n")
-    set_config_path(str(cfg))
-    monkeypatch.delenv("TURNSTONE_WORKSPACE", raising=False)
-
-    assert config_mod.get_workspace_dir() is None
-
-
 def test_apply_config_judge_section(tmp_path):
     """apply_config() loads [judge] section and maps to argparse dests."""
     _reset_cache()

tests/test_console_session_factory.py

@@ -217,91 +217,3 @@ def test_whitespace_only_coord_alias_falls_through() -> None:
     )
     _invoke(factory)
     assert registry.captured_alias == "registry-default"
-
-
-# ---------------------------------------------------------------------------
-# Coordinator MCP gate (#725) — flag × getter matrix, resolved per construction
-# ---------------------------------------------------------------------------
-
-
-def _capture_chatsession_kwargs(
-    *,
-    settings: dict[str, Any],
-    mcp_client_getter: Any = None,
-    getter_passed: bool = True,
-) -> Any:
-    """Run the factory through to a (patched) ChatSession and return the
-    captured construction kwargs.  ChatSession's own contract is covered
-    elsewhere; the unit under test here is the factory's MCP gate."""
-    from unittest.mock import patch
-
-    from tests._coord_test_helpers import _fake_registry
-
-    extra: dict[str, Any] = {}
-    if getter_passed:
-        extra["mcp_client_getter"] = mcp_client_getter
-    factory = build_console_session_factory(
-        registry=_fake_registry(),
-        config_store=_FakeConfigStore(dict(settings)),  # type: ignore[arg-type]
-        node_id="console",
-        coord_client_factory=lambda ws_id, uid: MagicMock(),
-        **extra,
-    )
-    ui = MagicMock()
-    ui._user_id = ""
-    with patch("turnstone.console.session_factory.ChatSession") as cs:
-        factory(ui, ws_id="w1")
-    assert cs.call_count == 1
-    return cs.call_args.kwargs
-
-
-def test_mcp_getter_passes_live_manager_unconditionally() -> None:
-    """Node parity: the factory passes the live console manager to every
-    coordinator session (the console counterpart of the node factory's
-    mcp_ref[0] read) — whether MCP tools surface is the persona's call,
-    exactly as for interactive sessions."""
-    manager = MagicMock()
-    got = _capture_chatsession_kwargs(settings={}, mcp_client_getter=lambda: manager)
-    assert got["mcp_client"] is manager
-
-
-def test_mcp_getter_none_manager_passes_none() -> None:
-    """Nothing configured (create_mcp_client returned None): the session
-    gets None, not a crash."""
-    got = _capture_chatsession_kwargs(settings={}, mcp_client_getter=lambda: None)
-    assert got["mcp_client"] is None
-
-
-def test_mcp_no_getter_is_backward_compatible() -> None:
-    got = _capture_chatsession_kwargs(settings={}, getter_passed=False)
-    assert got["mcp_client"] is None
-
-
-def test_mcp_getter_resolved_per_construction() -> None:
-    """The getter is consulted at EVERY construction — a manager
-    (re)constructed by the console ensure-helper after factory build must
-    reach the next session.  An instance captured at factory-build time
-    fails this row."""
-    from unittest.mock import patch
-
-    from tests._coord_test_helpers import _fake_registry
-
-    holder: dict[str, Any] = {"mgr": None}
-    factory = build_console_session_factory(
-        registry=_fake_registry(),
-        config_store=_FakeConfigStore({}),  # type: ignore[arg-type]
-        node_id="console",
-        coord_client_factory=lambda ws_id, uid: MagicMock(),
-        mcp_client_getter=lambda: holder["mgr"],
-    )
-    ui = MagicMock()
-    ui._user_id = ""
-    with patch("turnstone.console.session_factory.ChatSession") as cs:
-        factory(ui, ws_id="w1")
-        first = cs.call_args.kwargs["mcp_client"]
-        manager = MagicMock()
-        holder["mgr"] = manager  # the ensure-helper lazily constructed it
-        factory(ui, ws_id="w2")
-        second = cs.call_args.kwargs["mcp_client"]
-    assert first is None
-    assert second is manager

tests/test_conversation_js.py

@@ -168,17 +168,3 @@ def test_unbounded_render_inputs_are_capped() -> None:
     assert "more preview lines not shown" in body
     assert "RAW_CAP" in body
     assert "truncated for display" in body
-
-
-def test_retry_note_validates_backoff_before_rendering() -> None:
-    """retry_in is a server-emitted backoff coerced with Number(); like the
-    part/total pair just below it, it must be finiteness-validated (and
-    non-negative) so a malformed value can't render "retrying in NaNs".  The
-    error text is kept regardless — it is the load-bearing half of the note."""
-    body = _body()
-    assert "Number.isFinite(secs) && secs >= 0" in body, (
-        "retry_in must be validated (finite, non-negative) before its seconds render"
-    )
-    assert "Math.round(Number(evt.retry_in))" not in body, (
-        "retry_in must not be Math.round(Number(...))'d without a finiteness guard"
-    )

tests/test_coord_rich_ws_state_payload.py

@@ -476,7 +476,7 @@ def test_coord_spawn_metrics_increments_messages_and_resets_tool_count() -> None
     ui = ConsoleCoordinatorUI(ws_id="coord-ws", user_id="u1")
     ui._ws_messages = 5
     ui._ws_turn_tool_calls = 3
-    _coord_spawn_metrics(ui)
+    _coord_spawn_metrics(MagicMock(), ui)
     assert ui._ws_messages == 6
     assert ui._ws_turn_tool_calls == 0
 
@@ -489,7 +489,7 @@ def test_coord_spawn_metrics_tolerates_ui_without_counters() -> None:
     class _StubUI:
         pass
 
-    _coord_spawn_metrics(_StubUI())  # must not raise
+    _coord_spawn_metrics(MagicMock(), _StubUI())  # must not raise
 
 
 # ---------------------------------------------------------------------------

tests/test_coordinator_page.py

@@ -687,14 +687,7 @@ def test_coordinator_js_gates_send_on_cross_user_busy():
     assert "actingUserId !== me" in coord_js
     assert "composer.setSendBlocked(" in coord_js
     assert "function reconcileSendBlock()" in coord_js
-    # reactive 409 fallback — the pane converts the 409 body at the fetch
-    # stage; the status ARM itself lives in the shared settle helper
-    # (composer_queue.settleSendResponse) with the rest of the response
-    # matrix, one implementation for both panes.
+    # reactive 409 fallback
     assert "r.status === 409" in coord_js
     assert 'status: "cross_user_interjection"' in coord_js
-    assert "settleSendResponse(" in coord_js
-    helper = (
-        Path(__file__).resolve().parents[1] / "turnstone/shared_static/composer_queue.js"
-    ).read_text(encoding="utf-8")
-    assert 'status === "cross_user_interjection"' in helper
+    assert 'data.status === "cross_user_interjection"' in coord_js

tests/test_coordinator_tools.py

@@ -162,15 +162,6 @@ def test_coordinator_session_uses_coordinator_tools(coord_session):
         # surfacing to a human channel without spawning a child purely
         # to ship the message.  Routing is session-kind-agnostic.
         "notify",
-        # ``read_resource``/``use_prompt`` joined in 1.8 (#725) — the
-        # coordinator MCP surface covers tools, resources, AND prompts.
-        # They sit in the BASE list unconditionally (like their
-        # interactive siblings), but the WIRE strips them when no client
-        # is attached or the per-user catalog counts are zero — the
-        # _without_tool gate in _get_active_tools, pinned by the wire
-        # matrix in test_workstream_kind.py.
-        "read_resource",
-        "use_prompt",
     }
     # Sub-agent tool set is zeroed on coordinator sessions.
     assert sess._task_tools == []

tests/test_cwd_tool_notes.py

@@ -1,231 +0,0 @@
-"""Working-directory/workspace notes rendered into fs-tool descriptions.
-
-Covers the pure renderer (``apply_cwd_context``), the metadata invariants the
-session wiring relies on, and the ChatSession build sites (construction, MCP
-rebuild) including the guarded ``os.getcwd()`` read and the task-agent lane.
-"""
-
-from __future__ import annotations
-
-import os
-from unittest.mock import MagicMock, patch
-
-from turnstone.core.session import ChatSession
-from turnstone.core.tools import (
-    _META,
-    COORDINATOR_TOOLS,
-    INTERACTIVE_TOOLS,
-    TASK_AGENT_TOOLS,
-    TOOLS,
-    apply_cwd_context,
-)
-
-_FS_TOOLS = ("bash", "read_file", "write_file", "edit_file", "search", "diff_file")
-
-
-def _desc(tools: list[dict], name: str) -> str:
-    for t in tools:
-        if t["function"]["name"] == name:
-            return t["function"]["description"]
-    raise AssertionError(f"tool {name!r} not in list")
-
-
-# ---------------------------------------------------------------------------
-# apply_cwd_context (pure renderer)
-# ---------------------------------------------------------------------------
-
-
-class TestApplyCwdContext:
-    def test_notes_rendered_on_fs_tools(self):
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "/data", "/workspace")
-        assert "Commands run in /data" in _desc(out, "bash")
-        assert "cd does not persist" in _desc(out, "bash")
-        assert "The user's workspace directory is /workspace." in _desc(out, "bash")
-        for name in ("read_file", "write_file", "edit_file", "search", "diff_file"):
-            assert "Relative paths resolve against /data." in _desc(out, name)
-            assert "The user's workspace directory is /workspace." in _desc(out, name)
-
-    def test_noteless_tools_pass_through_by_reference(self):
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "/data", "/workspace")
-        by_name = {t["function"]["name"]: t for t in out}
-        base_by_name = {t["function"]["name"]: t for t in INTERACTIVE_TOOLS}
-        assert by_name["web_search"] is base_by_name["web_search"]
-        # Noted tools are fresh copies.
-        assert by_name["bash"] is not base_by_name["bash"]
-
-    def test_module_constants_never_mutated(self):
-        # The fs tool dicts are SHARED across TOOLS/INTERACTIVE_TOOLS/
-        # TASK_AGENT_TOOLS and aliased through merge_mcp_tools output — an
-        # in-place append would corrupt every list at once.
-        before = {name: _desc(TOOLS, name) for name in _FS_TOOLS}
-        apply_cwd_context(INTERACTIVE_TOOLS, "/data", "/workspace")
-        apply_cwd_context(TASK_AGENT_TOOLS, "/data", "/workspace")
-        for name in _FS_TOOLS:
-            assert _desc(TOOLS, name) == before[name]
-            assert "/data" not in _desc(INTERACTIVE_TOOLS, name)
-
-    def test_empty_working_dir_drops_cwd_note_only(self):
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "", "/workspace")
-        assert "Commands run in" not in _desc(out, "bash")
-        assert "Relative paths resolve" not in _desc(out, "read_file")
-        assert "The user's workspace directory is /workspace." in _desc(out, "bash")
-
-    def test_empty_workspace_drops_workspace_note_only(self):
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "/data", "")
-        assert "Commands run in /data" in _desc(out, "bash")
-        assert "workspace directory" not in _desc(out, "bash")
-
-    def test_both_empty_is_pass_through(self):
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "", "")
-        assert out == INTERACTIVE_TOOLS
-        assert out is not INTERACTIVE_TOOLS  # still a fresh list
-
-    def test_mcp_style_tool_untouched(self):
-        mcp_tool = {
-            "type": "function",
-            "function": {"name": "mcp__srv__thing", "description": "Does a thing."},
-        }
-        out = apply_cwd_context([mcp_tool], "/data", "/workspace")
-        assert out[0] is mcp_tool
-        assert out[0]["function"]["description"] == "Does a thing."
-
-    def test_paths_with_braces_are_literal(self):
-        # str.replace substitution — a path containing brace characters must
-        # land verbatim (str.format would raise or mangle here).
-        out = apply_cwd_context(INTERACTIVE_TOOLS, "/data/{odd}", "")
-        assert "Commands run in /data/{odd}" in _desc(out, "bash")
-
-
-# ---------------------------------------------------------------------------
-# Metadata invariants the session wiring relies on
-# ---------------------------------------------------------------------------
-
-
-class TestNoteMetadataInvariants:
-    def test_all_fs_tools_declare_both_notes(self):
-        for name in _FS_TOOLS:
-            assert _META[name].get("cwd_note"), name
-            assert _META[name].get("workspace_note"), name
-
-    def test_no_coordinator_tool_declares_notes(self):
-        # The coordinator build sites skip _apply_cwd_notes on the strength
-        # of this invariant.
-        for t in COORDINATOR_TOOLS:
-            name = t["function"]["name"]
-            meta = _META.get(name) or {}
-            assert not meta.get("cwd_note"), name
-            assert not meta.get("workspace_note"), name
-
-    def test_notes_stripped_from_wire_schema(self):
-        # _META_KEYS extraction: the raw JSON keys must not leak into the
-        # OpenAI function dict sent to providers.
-        for t in TOOLS:
-            assert "cwd_note" not in t["function"]
-            assert "workspace_note" not in t["function"]
-
-    def test_workspace_note_wording_uniform(self):
-        # The workspace fact is one node-level value, so its sentence is
-        # deliberately identical across the fs tools (unlike cwd_note, whose
-        # prose is per-tool).  Guards a one-file reword from drifting the
-        # copies apart, independent of the exact wording.
-        notes = {_META[name]["workspace_note"] for name in _FS_TOOLS}
-        assert len(notes) == 1, notes
-
-
-# ---------------------------------------------------------------------------
-# ChatSession build sites
-# ---------------------------------------------------------------------------
-
-
-def _make_session(**kwargs):
-    defaults = dict(
-        client=MagicMock(),
-        model="test-model",
-        ui=MagicMock(),
-        instructions=None,
-        temperature=0.5,
-        max_tokens=1024,
-        tool_timeout=10,
-    )
-    defaults.update(kwargs)
-    return ChatSession(**defaults)
-
-
-class TestSessionCwdNotes:
-    def test_fresh_session_carries_cwd_note(self, tmp_db):
-        with patch("turnstone.core.session.get_workspace_dir", return_value=None):
-            session = _make_session()
-        assert f"Commands run in {os.getcwd()}" in _desc(session._tools, "bash")
-        assert f"Relative paths resolve against {os.getcwd()}." in _desc(
-            session._tools, "read_file"
-        )
-
-    def test_task_lane_carries_cwd_note(self, tmp_db):
-        # Sub-agents use self._task_tools, a separate list from self._tools —
-        # they run in this same process, so the same cwd applies.
-        with patch("turnstone.core.session.get_workspace_dir", return_value=None):
-            session = _make_session()
-        assert f"Commands run in {os.getcwd()}" in _desc(session._task_tools, "bash")
-
-    def test_getcwd_failure_degrades_to_noteless(self, tmp_db):
-        # A deleted cwd (eval workdir teardown) must not break session
-        # construction or an MCP background-thread rebuild.
-        with (
-            patch("turnstone.core.session.get_workspace_dir", return_value=None),
-            patch("os.getcwd", side_effect=OSError("cwd deleted")),
-        ):
-            session = _make_session()
-        assert "Commands run in" not in _desc(session._tools, "bash")
-        assert session._tools  # built fine, just note-less
-
-    def test_workspace_rendered_when_dir_exists(self, tmp_db, tmp_path):
-        with patch("turnstone.core.session.get_workspace_dir", return_value=str(tmp_path)):
-            session = _make_session()
-        assert f"The user's workspace directory is {tmp_path}." in _desc(session._tools, "bash")
-
-    def test_workspace_skipped_when_dir_missing(self, tmp_db, tmp_path):
-        missing = tmp_path / "does-not-exist"
-        with patch("turnstone.core.session.get_workspace_dir", return_value=str(missing)):
-            session = _make_session()
-        assert "workspace directory" not in _desc(session._tools, "bash")
-
-    def test_workspace_skipped_when_equal_to_cwd(self, tmp_db):
-        # e.g. an operator who set working_dir: /workspace on the container —
-        # one fact, not two copies of the same path.
-        with patch("turnstone.core.session.get_workspace_dir", return_value=os.getcwd()):
-            session = _make_session()
-        desc = _desc(session._tools, "bash")
-        assert f"Commands run in {os.getcwd()}" in desc
-        assert "workspace directory" not in desc
-
-    def test_constants_pristine_after_session_build(self, tmp_db):
-        with patch("turnstone.core.session.get_workspace_dir", return_value=None):
-            _make_session()
-        assert os.getcwd() not in _desc(INTERACTIVE_TOOLS, "bash")
-        assert os.getcwd() not in _desc(TOOLS, "bash")
-
-    def test_mcp_rebuild_keeps_single_note(self, tmp_db):
-        # The MCP list_changed rebuild re-derives from pristine bases — the
-        # note must survive exactly once (double-append is the failure the
-        # assignment-time design must never regress into).
-        mock_mcp = MagicMock()
-        mock_mcp.get_tools.return_value = []
-        with patch("turnstone.core.session.get_workspace_dir", return_value=None):
-            session = _make_session(mcp_client=mock_mcp)
-            session._on_mcp_tools_changed()
-            session._on_mcp_tools_changed()
-        assert _desc(session._tools, "bash").count(f"Commands run in {os.getcwd()}") == 1
-        assert _desc(session._task_tools, "bash").count(f"Commands run in {os.getcwd()}") == 1
-
-    def test_mcp_drop_surface_keeps_single_note(self, tmp_db):
-        # The MCP-disconnect rebuild (_drop_mcp_surface, reached via resume()
-        # adopting an MCP-off persona) is the third rebuild trigger — the note
-        # must survive it, exactly once, on both lanes.
-        mock_mcp = MagicMock()
-        mock_mcp.get_tools.return_value = []
-        with patch("turnstone.core.session.get_workspace_dir", return_value=None):
-            session = _make_session(mcp_client=mock_mcp)
-            session._drop_mcp_surface()
-        assert session._mcp_client is None
-        assert _desc(session._tools, "bash").count(f"Commands run in {os.getcwd()}") == 1
-        assert _desc(session._task_tools, "bash").count(f"Commands run in {os.getcwd()}") == 1

tests/test_deadline.py

@@ -64,75 +64,3 @@ def test_cancel_returns_promptly() -> None:
     assert time.monotonic() - start < 1.0
     stragglers = [t for t in threading.enumerate() if t.name == "dl-cancel" and not t.daemon]
     assert stragglers == [], f"non-daemon worker survived: {stragglers}"
-
-
-def test_on_abandon_fires_on_timeout_and_cancel_but_not_success() -> None:
-    calls: list[str] = []
-
-    with pytest.raises(DeadlineExceededError):
-        run_with_deadline(
-            lambda: time.sleep(2.0),
-            timeout=0.1,
-            poll=0.05,
-            thread_name="dl-abandon-t",
-            on_abandon=lambda: calls.append("timeout"),
-        )
-    assert calls == ["timeout"]
-
-    cancel = threading.Event()
-    cancel.set()
-    with pytest.raises(DeadlineCancelledError):
-        run_with_deadline(
-            lambda: time.sleep(2.0),
-            timeout=10.0,
-            cancel_event=cancel,
-            poll=0.05,
-            thread_name="dl-abandon-c",
-            on_abandon=lambda: calls.append("cancel"),
-        )
-    assert calls == ["timeout", "cancel"]
-
-    result = run_with_deadline(lambda: 7, timeout=1.0, on_abandon=lambda: calls.append("no"))
-    assert result == 7
-    assert calls == ["timeout", "cancel"]
-
-
-def test_on_abandon_errors_do_not_mask_the_deadline_error() -> None:
-    def _boom() -> None:
-        raise RuntimeError("abort hook broke")
-
-    with pytest.raises(DeadlineExceededError):
-        run_with_deadline(
-            lambda: time.sleep(2.0),
-            timeout=0.1,
-            poll=0.05,
-            thread_name="dl-abandon-e",
-            on_abandon=_boom,
-        )
-
-
-class TestStreamAbortRef:
-    def test_abort_closes_captured_stream(self) -> None:
-        from unittest.mock import MagicMock
-
-        from turnstone.core.deadline import StreamAbortRef
-
-        ref = StreamAbortRef()
-        stream = MagicMock()
-        ref.append(stream)
-        stream.close.assert_not_called()
-        ref.abort()
-        stream.close.assert_called_once()
-
-    def test_late_arriving_stream_closes_on_append(self) -> None:
-        # The arrival race: abort fires while the worker is still inside the
-        # SDK connect — the handle must close the moment it is captured.
-        from unittest.mock import MagicMock
-
-        from turnstone.core.deadline import StreamAbortRef
-
-        ref = StreamAbortRef()
-        ref.abort()
-        stream = MagicMock()
-        ref.append(stream)
-        stream.close.assert_called_once()

tests/test_drain_stream.py

@@ -1,297 +0,0 @@
-"""Unit tests for ``drain_stream`` — the #831 single non-streaming transport.
-
-Every single-shot lane consumes ``create_streaming`` through this
-accumulator, so its semantics ARE the old ``create_completion`` contract:
-each case here pins a rule the per-adapter non-streaming methods used to
-implement independently (usage max-merge, tool-delta assembly, terminal
-provider_blocks, trailing-citation fold).
-"""
-
-from __future__ import annotations
-
-import pytest
-
-from turnstone.core.providers import (
-    StreamChunk,
-    ToolCallDelta,
-    UsageInfo,
-    drain_stream,
-)
-from turnstone.core.providers._openai_common import RETRYABLE_ERROR_NAMES
-from turnstone.core.providers._protocol import IncompleteStreamError
-
-
-class TestContentAndReasoning:
-    def test_joins_content_deltas_in_order(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(content_delta="Hello, "),
-                    StreamChunk(content_delta="world"),
-                    StreamChunk(finish_reason="stop"),
-                ]
-            )
-        )
-        assert result.content == "Hello, world"
-        assert result.finish_reason == "stop"
-
-    def test_joins_reasoning_deltas_separately_from_content(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(reasoning_delta="think "),
-                    StreamChunk(reasoning_delta="hard"),
-                    StreamChunk(content_delta="answer"),
-                    StreamChunk(finish_reason="stop"),
-                ]
-            )
-        )
-        assert result.reasoning == "think hard"
-        assert result.content == "answer"
-
-    def test_stream_without_finish_reason_raises_incomplete(self):
-        # Complete-or-error: every adapter emits a finish reason on a
-        # healthy stream, so its absence means the generation died
-        # mid-response — partial text must never be stored as a complete
-        # result (compaction summary, title).  Typed and retryable.
-        assert "IncompleteStreamError" in RETRYABLE_ERROR_NAMES
-        with pytest.raises(IncompleteStreamError):
-            drain_stream(iter([StreamChunk(content_delta="half a summar")]))
-
-    def test_empty_stream_raises_incomplete(self):
-        with pytest.raises(IncompleteStreamError):
-            drain_stream(iter([]))
-
-
-class TestToolCallAssembly:
-    def test_merges_deltas_by_index_id_name_once_args_concat(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(
-                        tool_call_deltas=[ToolCallDelta(index=0, id="call_1", name="read_file")]
-                    ),
-                    StreamChunk(
-                        tool_call_deltas=[ToolCallDelta(index=0, arguments_delta='{"path": ')]
-                    ),
-                    StreamChunk(
-                        tool_call_deltas=[ToolCallDelta(index=0, arguments_delta='"x.py"}')]
-                    ),
-                    StreamChunk(finish_reason="tool_calls"),
-                ]
-            )
-        )
-        assert result.tool_calls == [
-            {
-                "id": "call_1",
-                "type": "function",
-                "function": {"name": "read_file", "arguments": '{"path": "x.py"}'},
-            }
-        ]
-
-    def test_parallel_calls_ordered_by_index(self):
-        # Interleaved argument deltas for two calls must not cross-contaminate,
-        # and the assembled list is index-ordered regardless of arrival order.
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(tool_call_deltas=[ToolCallDelta(index=1, id="b", name="beta")]),
-                    StreamChunk(tool_call_deltas=[ToolCallDelta(index=0, id="a", name="alpha")]),
-                    StreamChunk(
-                        tool_call_deltas=[
-                            ToolCallDelta(index=0, arguments_delta="{}"),
-                            ToolCallDelta(index=1, arguments_delta='{"k": 1}'),
-                        ]
-                    ),
-                    StreamChunk(finish_reason="tool_calls"),
-                ]
-            )
-        )
-        assert [tc["id"] for tc in result.tool_calls] == ["a", "b"]
-        assert result.tool_calls[1]["function"]["arguments"] == '{"k": 1}'
-
-    def test_blank_id_preserved_for_downstream_repair(self):
-        # Google compat can stream blank tool ids — the drain must hand them
-        # through untouched so model_turn's pairwise blank-id repair sees them.
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(tool_call_deltas=[ToolCallDelta(index=0, name="f")]),
-                    StreamChunk(finish_reason="tool_calls"),
-                ]
-            )
-        )
-        assert result.tool_calls[0]["id"] == ""
-
-    # Index-degenerate parallel-call de-fusion lives in the CHAT ADAPTER's
-    # iterator (so the interactive loop is fixed too) — pinned in
-    # test_providers.py::TestOpenAIProvider::
-    # test_streaming_remaps_index_degenerate_parallel_calls.  The drain
-    # accumulates by index verbatim; adapters own index sanity.
-
-
-class TestUsageMerge:
-    def test_anthropic_split_emission_max_merges(self):
-        # message_start carries prompt tokens (completion 0); message_delta
-        # carries completion tokens (prompt possibly absent → 0).  Neither
-        # first-wins nor last-wins sees both — the max-merge does.
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(
-                        usage=UsageInfo(
-                            prompt_tokens=120,
-                            completion_tokens=0,
-                            total_tokens=120,
-                            cache_read_tokens=100,
-                        )
-                    ),
-                    StreamChunk(content_delta="hi"),
-                    StreamChunk(
-                        usage=UsageInfo(prompt_tokens=0, completion_tokens=42, total_tokens=42),
-                        finish_reason="stop",
-                    ),
-                ]
-            )
-        )
-        assert result.usage.prompt_tokens == 120
-        assert result.usage.completion_tokens == 42
-        assert result.usage.total_tokens == 162
-        assert result.usage.cache_read_tokens == 100
-
-    def test_single_terminal_usage_passes_through(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(content_delta="x"),
-                    StreamChunk(finish_reason="stop"),
-                    StreamChunk(
-                        usage=UsageInfo(prompt_tokens=10, completion_tokens=5, total_tokens=15)
-                    ),
-                ]
-            )
-        )
-        assert result.usage.total_tokens == 15
-
-
-class TestFinishAndBlocks:
-    def test_finish_reason_last_non_none_wins(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(finish_reason="tool_calls"),
-                    StreamChunk(content_delta="tail"),
-                    StreamChunk(finish_reason="stop"),
-                ]
-            )
-        )
-        assert result.finish_reason == "stop"
-
-    def test_provider_blocks_taken_from_terminal_emission(self):
-        # Every adapter attaches its full block list exactly once (on or
-        # after the terminal chunk); replace-on-nonempty keeps the last set.
-        blocks = [{"type": "thinking", "thinking": "t", "signature": "s"}]
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(content_delta="a"),
-                    StreamChunk(finish_reason="stop", provider_blocks=blocks),
-                ]
-            )
-        )
-        assert result.provider_blocks == blocks
-
-
-class TestInfoDelta:
-    def test_mid_stream_status_pings_dropped(self):
-        # "[Searching…]" style transient status — the non-streaming lane
-        # never surfaced these, so the drain must not leak them into content.
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(info_delta="[Searching: quakes]"),
-                    StreamChunk(content_delta="answer"),
-                    StreamChunk(finish_reason="stop"),
-                ]
-            )
-        )
-        assert result.content == "answer"
-
-    def test_trailing_citations_fold_matches_format_citations(self):
-        # The chat/responses adapters emit format_citations("", anns).strip()
-        # as a final info chunk after the finish reason.  Folding it back as
-        # content + "\n\n" + info must byte-match the old non-streaming
-        # format_citations(content, anns) append.
-        from turnstone.core.providers._openai_common import format_citations
-
-        class _Ann:
-            type = "url_citation"
-            url = "https://example.com"
-            title = "Example"
-            url_citation = None
-
-        anns = [_Ann()]
-        trailing = format_citations("", anns).strip()
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(content_delta="body"),
-                    StreamChunk(finish_reason="stop"),
-                    StreamChunk(info_delta=trailing),
-                ]
-            )
-        )
-        assert result.content == format_citations("body", anns)
-
-    def test_trailing_fold_with_empty_content_matches_too(self):
-        result = drain_stream(
-            iter(
-                [
-                    StreamChunk(finish_reason="tool_calls"),
-                    StreamChunk(info_delta="Sources:\n- x"),
-                ]
-            )
-        )
-        assert result.content == "\n\nSources:\n- x"
-
-    def test_finishless_stream_raises_even_with_trailing_info(self):
-        # A stream that dies after a status ping must NOT return the ping
-        # as content (nor the partial body as a clean result) — the
-        # complete-or-error gate turns the whole stream into a retryable
-        # error instead of guessing which trailing info was a citation.
-        with pytest.raises(IncompleteStreamError):
-            drain_stream(
-                iter(
-                    [
-                        StreamChunk(content_delta="body"),
-                        StreamChunk(info_delta="[Searching: kubernetes CVEs]"),
-                    ]
-                )
-            )
-
-
-class TestErrorPropagation:
-    def test_httpx_transport_error_becomes_retryable_incomplete(self):
-        # Streaming moves the body read out of the SDK's wrapped request:
-        # a mid-body wire failure surfaces as a raw httpx.TransportError
-        # no retry predicate recognizes.  The drain re-raises it (chained,
-        # message preserved) as the retryable IncompleteStreamError.
-        import httpx
-
-        def chunks():
-            yield StreamChunk(content_delta="partial")
-            raise httpx.RemoteProtocolError("peer closed connection")
-
-        with pytest.raises(IncompleteStreamError, match="RemoteProtocolError") as excinfo:
-            drain_stream(chunks())
-        assert isinstance(excinfo.value.__cause__, httpx.RemoteProtocolError)
-
-    def test_mid_stream_exception_propagates_verbatim(self):
-        # Retry/deadline/fallback policy is the caller's — the drain adds
-        # no exception translation, exactly like the old transport.
-        def chunks():
-            yield StreamChunk(content_delta="partial")
-            raise RuntimeError("upstream broke")
-
-        with pytest.raises(RuntimeError, match="upstream broke"):
-            drain_stream(chunks())

tests/test_effort_ladder.py

@@ -200,24 +200,21 @@ class TestFlatParamLanes:
         assert eff["xhigh"] == "xhigh"
         assert eff["max"] == "xhigh"
 
-    def test_openai_always_reasoning_row_snaps_without_none(self) -> None:
-        """Always-reasoning rows (gpt-5.4-pro: medium/high/xhigh) declare no
-        "none" level, so the knob's off position omits the param and low
-        positions snap UP onto the declared floor."""
-        eff = _as_map(effort_ladder_for_model("openai", "gpt-5.4-pro", None))
+    def test_openai_o3_registry_row(self) -> None:
+        """o-series (except o1-mini) accept low/medium/high; no declared
+        "none" level, so the knob's off position omits the param."""
+        eff = _as_map(effort_ladder_for_model("openai", "o3", None))
         assert eff["none"] == "default"
-        assert eff["minimal"] == "medium"
+        assert eff["minimal"] == "low"
         assert eff["medium"] == "medium"
-        assert eff["max"] == "xhigh"
+        assert eff["xhigh"] == eff["max"] == "high"
 
-    def test_openai_pro_row_wins_longest_prefix(self) -> None:
-        """gpt-5.4-pro must not prefix-fall onto the gpt-5.4 row (which
-        declares "none") — the pro ladder has no off position, so the
-        longest-prefix row must win or the knob would wrongly omit."""
-        eff = _as_map(effort_ladder_for_model("openai", "gpt-5.4-pro", None))
-        assert eff["none"] == "default"
-        base = _as_map(effort_ladder_for_model("openai", "gpt-5.4", None))
-        assert base["none"] == "none"
+    def test_openai_codex_max_has_xhigh(self) -> None:
+        """gpt-5.1-codex-max must not prefix-fall onto the gpt-5.1 row
+        (which lacks xhigh) — xhigh reaches the wire verbatim."""
+        eff = _as_map(effort_ladder_for_model("openai", "gpt-5.1-codex-max", None))
+        assert eff["xhigh"] == "xhigh"
+        assert eff["max"] == "xhigh"
 
     def test_anthropic_effort_applies_even_with_thinking_mode_none(self) -> None:
         """output_config gates on supports_effort alone at request time."""

tests/test_history_decoration.py

@@ -509,8 +509,8 @@ class TestExtractReasoningForHistory:
 
     def test_first_block_reasoning_text_dispatches_to_openai_chat(self) -> None:
         # Phase 3 path 3: synthetic ``reasoning_text`` blocks (stamped
-        # by model_turn.synth_reasoning_block for vLLM / llama.cpp /
-        # Gemini-compat conversations) dispatch to
+        # by ChatSession._maybe_synth_reasoning_block for vLLM /
+        # llama.cpp / Gemini-compat conversations) dispatch to
         # OpenAIChatCompletionsProvider.extract_reasoning_text.
         from turnstone.core.history_decoration import extract_reasoning_for_history
 

tests/test_idle_nudge_watcher.py

@@ -11,7 +11,6 @@ from __future__ import annotations
 import contextlib
 import logging
 import threading
-from types import SimpleNamespace
 from typing import Any
 from unittest.mock import patch
 
@@ -40,17 +39,6 @@ class _FakeWorkstream:
         self._worker_running = False
         self._closed = False
         self.worker_thread: Any = None
-        # Deferred /send entries — the wake gate yields while the order
-        # barrier holds; empty/None is the default every other test
-        # assumes.
-        self._pending_sends: list[Any] = []
-        self._pending_drain: Any = None
-
-    def send_barrier_active(self) -> bool:
-        # Mirrors Workstream.send_barrier_active — the gate calls the
-        # METHOD, so the stub must carry the same two-term pair.
-        drain = self._pending_drain
-        return bool(self._pending_sends) or (drain is not None and drain.is_alive())
 
 
 class _FakeManager:
@@ -206,35 +194,6 @@ class TestWakeWorkstreamIfPending:
             assert wake_workstream_if_pending(ws) is False
             assert mock_send.call_count == 0
 
-    def test_yields_to_pending_deferred_sends(self, fake_mgr_and_ws):
-        """Deferred /send entries hold the order barrier: a wake worker
-        claiming the slot would push messages already acknowledged
-        "queued" behind its whole turn, so the gate yields.  Re-armed
-        structurally — every deferred turn's exit re-runs the gate, and
-        the drain's clean exit (trigger="drain-exit") covers a list that
-        emptied by pure retraction and never ran a turn."""
-        _mgr, ws = fake_mgr_and_ws
-        ws.session._nudge_queue.enqueue("watch_triggered", "output", "any")
-        ws._pending_sends.append(object())
-        with patch("turnstone.core.session_worker.send", return_value=True) as mock_send:
-            assert wake_workstream_if_pending(ws, trigger="worker-exit") is False
-            assert mock_send.call_count == 0
-        # CLAIMED-entry window: list empty but the drain is alive (an
-        # acked entry was popped, its dispatch in flight).  The one-term
-        # list check let a wake jump the acknowledged send here — the
-        # barrier's drain-alive term must hold the yield.
-        ws._pending_sends.clear()
-        ws._pending_drain = SimpleNamespace(is_alive=lambda: True)
-        with patch("turnstone.core.session_worker.send", return_value=True) as mock_send:
-            assert wake_workstream_if_pending(ws, trigger="worker-exit") is False
-            assert mock_send.call_count == 0
-        # Barrier fully cleared (the drain retired) — the same call
-        # dispatches.
-        ws._pending_drain = None
-        with patch("turnstone.core.session_worker.send", return_value=True) as mock_send:
-            assert wake_workstream_if_pending(ws, trigger="drain-exit") is True
-            assert mock_send.call_count == 1
-
     def test_skips_closed_ws(self, fake_mgr_and_ws):
         """A workstream mid-``close()`` must not get a wake spawned on
         its torn-down session, even while its ``state`` field still

tests/test_interactive_pane_js.py

@@ -13,8 +13,6 @@ from __future__ import annotations
 import re
 from pathlib import Path
 
-import pytest
-
 _ROOT = Path(__file__).resolve().parent.parent
 _INTERACTIVE = _ROOT / "turnstone/shared_static/interactive.js"
 _COMPOSER = _ROOT / "turnstone/shared_static/composer.js"
@@ -400,21 +398,17 @@ def test_pane_gates_send_on_cross_user_busy() -> None:
     # ...and drives the composer's hard block, re-run on every busy edge.
     assert "this.composer.setSendBlocked(" in body
     stripped = _strip_comments(body)
-    setbusy = stripped.index("setBusy(b, source) {")
-    assert "this._reconcileSendBlock();" in stripped[setbusy : setbusy + 800]
+    setbusy = stripped.index("setBusy(b) {")
+    assert "this._reconcileSendBlock();" in stripped[setbusy : setbusy + 600]
 
 
 def test_pane_handles_cross_user_409() -> None:
     """The reactive fallback: a 409 (button not yet disabled) surfaces a clean
-    message, not the generic 'Connection error' catch.  The pane converts
-    the 409 body at the fetch stage; the status ARM itself lives in the
-    shared settle helper (composer_queue.settleSendResponse) with the rest
-    of the response matrix."""
+    message, not the generic 'Connection error' catch."""
     body = _INTERACTIVE.read_text(encoding="utf-8")
     assert "r.status === 409" in body
     assert 'status: "cross_user_interjection"' in body
-    helper = (_ROOT / "turnstone/shared_static/composer_queue.js").read_text(encoding="utf-8")
-    assert 'status === "cross_user_interjection"' in helper
+    assert 'data.status === "cross_user_interjection"' in body
 
 
 def test_sync_approval_state_prunes_orphan_cycles() -> None:
@@ -642,212 +636,3 @@ def test_connectsse_defers_open_when_tab_hidden() -> None:
     )
     assert head.index("this.wsId = wsId;") < head.index("if (document.hidden) {")
     assert head.index('addEventListener("visibilitychange"') < head.index("if (document.hidden) {")
-
-
-def test_send_post_abort_machinery_is_gone() -> None:
-    """The parked-POST era's client abort machinery must stay deleted in
-    BOTH panes: sends during a command window are answered "queued"
-    immediately (server-side defer-and-drain), so there is no long-lived
-    POST for a compaction-aware bound (``sendAbortMs``) to protect, and
-    dismissal is bind() → server-confirmed DELETE — never a POST abort
-    (``_sendAbort``), which fired on the interjection path too and
-    dispatched "dismissed" messages anyway.  Reintroducing either hook
-    means re-parking the POST; that design deterministically dropped
-    messages from every timeout-bounded caller (coordinator client and
-    console proxy at 30s, SDKs, stock proxies)."""
-    interactive = _INTERACTIVE.read_text(encoding="utf-8")
-    coordinator = (_ROOT / "turnstone/console/static/coordinator/coordinator.js").read_text(
-        encoding="utf-8"
-    )
-    conversation = (_ROOT / "turnstone/shared_static/conversation.js").read_text(encoding="utf-8")
-    composer_queue = (_ROOT / "turnstone/shared_static/composer_queue.js").read_text(
-        encoding="utf-8"
-    )
-    for name, src in (
-        ("interactive.js", interactive),
-        ("coordinator.js", coordinator),
-        ("conversation.js", conversation),
-        ("composer_queue.js", composer_queue),
-    ):
-        assert "sendAbortMs" not in src, f"{name}: the compaction-aware abort bound is dead"
-        assert "_sendAbort" not in src, f"{name}: dismiss must be bind() → DELETE, not a POST abort"
-    # The flat wedged-node bound stands in both panes: every /send answers
-    # within RTT now (dispatched / queued / deferred-with-msg_id).
-    assert "sendCtrl.abort(), 15000" in interactive
-    assert "sendCtrl.abort(), 15000" in coordinator
-    # The deferred-attachment count rides bind()'s documented options seam
-    # (controller dataset) — the per-pane element expando is dead.
-    for name, src in (
-        ("interactive.js", interactive),
-        ("coordinator.js", coordinator),
-        ("composer_queue.js", composer_queue),
-    ):
-        assert "_deferredAttachments" not in src, (
-            f"{name}: deferred state must ride bind(el, msgId, opts), not an expando"
-        )
-
-
-def test_deferred_send_settle_protocol_pins() -> None:
-    """The deferred-chip settle protocol (round 7, C4): a deferred send's
-    queued chip keeps its retraction affordance exactly until the message
-    truly leaves the parked list.  Pins the controller's contract and both
-    panes' wiring — losing any of these silently re-promotes parked
-    messages to "sent" while the server still honors DELETE (loss
-    disguised as delivery on a node restart)."""
-    interactive = _INTERACTIVE.read_text(encoding="utf-8")
-    coordinator = (_ROOT / "turnstone/console/static/coordinator/coordinator.js").read_text(
-        encoding="utf-8"
-    )
-    composer_queue = (_ROOT / "turnstone/shared_static/composer_queue.js").read_text(
-        encoding="utf-8"
-    )
-    # Controller: bind() stores the options on its own dataset state...
-    assert "function bind(el, msgId, opts)" in composer_queue
-    assert 'el.dataset.deferred = "1"' in composer_queue
-    assert "el.dataset.attachedCount = String(opts.attachedCount)" in composer_queue
-    # ...the idle sweep skips deferred AND unbound chips (the "idle ⇒
-    # drained" invariant is untrue for both)...
-    assert "if (el.dataset.deferred) return;" in composer_queue
-    assert "if (!el.dataset.msgId) return;" in composer_queue
-    # ...and settleDeferred branches on the fold-in arm: clear the flag
-    # only (DELETE still genuinely removes a folded message until the seam
-    # drains), promote only on the fresh-spawn arm.
-    assert "function settleDeferred(msgId, folded)" in composer_queue
-    assert "delete target.dataset.deferred;" in composer_queue
-    assert "settleDeferred: settleDeferred" in composer_queue
-    # A barrier-deferred entry can dispatch within milliseconds of its ack,
-    # so the SSE settle can beat the POST response's bind(): the controller
-    # parks chip-absent settles and bind() reconciles them — without this a
-    # raced chip stays flagged deferred and the idle sweep skips it forever.
-    # Expiry is TTL-based: a size cap evicted exactly this tab's raced
-    # settle when a window closed with a burst of deferred sends (ours
-    # parks FIRST, the foreign settles behind it overflow the cap).
-    assert "_preBindSettles" in composer_queue
-    assert "_preBindSettles.has(msgId)" in composer_queue
-    assert "PRE_BIND_SETTLE_TTL_MS" in composer_queue
-    assert "_preBindSettles.size" not in composer_queue, "size-cap eviction must stay dead"
-    # The full send-response settle matrix lives ONCE, in the shared
-    # helper — retro-convert (a parked, still-retractable message must not
-    # render as a sent bubble), the deferred busy-undo, and the queue_full
-    # idle-pane cleanup (bubble removed + busy restored: the refusal can
-    # now fire with no worker and no drain alive, so no state event would
-    # ever unstick the composer).
-    assert "export function settleSendResponse(queue, data, ctx)" in composer_queue
-    assert "!queuedEl && data.deferred" in composer_queue
-    assert "deferred: !!data.deferred" in composer_queue
-    assert "attachedCount: (data.attached_ids || []).length" in composer_queue
-    assert "ctx.busyIsOptimistic()" in composer_queue
-    assert composer_queue.count("ctx.optimisticEl.remove()") >= 2, (
-        "both the retro-convert and queue_full arms must clear the optimistic bubble"
-    )
-    # The missed-edge settle: a non-deferred chip binding onto an
-    # already-idle pane missed its only sweep — the post-bind promote
-    # (keyed on POST-bind chip state, honoring the aria-busy
-    # dismiss-in-flight discipline) is what settles it.
-    assert "!ctx.paneIsBusy()" in composer_queue
-    assert 'queuedEl.hasAttribute("aria-busy")' in composer_queue
-    # Both panes route their parsed /send response through the helper and
-    # consume the pane-tier settle event; the busy stamp is centralized in
-    # each pane's setBusy (source defaults to "server" — only the send
-    # flow's optimistic flip may ever be undone).
-    for name, src in (("interactive.js", interactive), ("coordinator.js", coordinator)):
-        assert "settleSendResponse(" in src, f"{name}: settle matrix must be the shared helper"
-        assert "busyIsOptimistic" in src, name
-        assert "paneIsBusy" in src, f"{name}: the missed-edge settle needs the live flag"
-        assert 'setBusy(true, "optimistic")' in src, f"{name}: optimistic flip must stamp"
-        assert "parsePriority(" in src, f"{name}: shared !!! parse"
-        assert 'case "message_dispatched"' in src, f"{name}: settle event not consumed"
-        assert "settleDeferred(" in src, name
-    # /command's degraded outcomes are ALL surfaced: busy, running (the
-    # backstop answer), error (503 — the worker never spawned), the
-    # status-less non-2xx arm (404 / proxy 502), and the transport catch —
-    # silence at any of them reads as success.
-    assert 'body.status === "running"' in interactive
-    assert 'body.status === "error"' in interactive
-    assert "Command failed (HTTP " in interactive
-    assert '"Command failed: " + err.message' in interactive
-
-
-def test_settle_send_response_missed_edge_behavior(tmp_path) -> None:
-    """Execute the shared settle helper under node and pin the
-    missed-edge matrix behaviorally (not just textually): a non-deferred
-    chip binding onto an idle pane promotes; a busy pane, a deferred
-    chip, and a dismiss-in-flight chip do not."""
-    import shutil
-    import subprocess
-
-    if shutil.which("node") is None:
-        pytest.skip("node binary not available on PATH")
-    helper = _ROOT / "turnstone/shared_static/composer_queue.js"
-    script = tmp_path / "settle_harness.mjs"
-    script.write_text(
-        f'const {{ settleSendResponse }} = await import("file://{helper}");\n'
-        + """
-function makeEl(over) {
-  const el = {
-    isConnected: true,
-    classList: { contains: (c) => c === "msg-queued" },
-    dataset: {},
-    hasAttribute: () => false,
-  };
-  return Object.assign(el, over || {});
-}
-function run(queuedEl, paneBusy, data) {
-  const calls = [];
-  const queue = {
-    bind: (el, id, opts) => {
-      calls.push("bind");
-      // Mirror the real bind: stamp the deferred flag from opts.
-      if (opts && opts.deferred) el.dataset.deferred = "1";
-    },
-    promote: () => calls.push("promote"),
-    remove: () => calls.push("remove"),
-    addQueuedMessage: () => makeEl(),
-  };
-  settleSendResponse(queue, data, {
-    queuedEl,
-    optimisticEl: null,
-    isBusy: true,
-    displayText: "t",
-    priority: "notice",
-    setBusy: () => {},
-    busyIsOptimistic: () => false,
-    paneIsBusy: () => paneBusy,
-    renderError: () => {},
-    consumeAttachments: () => {},
-  });
-  return calls;
-}
-const queued = { status: "queued", msg_id: "m1" };
-let c = run(makeEl(), false, queued);
-if (!(c.includes("bind") && c.includes("promote")))
-  throw new Error("missed-edge chip must promote: " + c);
-c = run(makeEl(), true, queued);
-if (c.includes("promote")) throw new Error("busy pane must not promote: " + c);
-c = run(makeEl(), false, { status: "queued", msg_id: "m1", deferred: true });
-if (c.includes("promote"))
-  throw new Error("deferred chip is message_dispatched's: " + c);
-c = run(makeEl({ hasAttribute: (a) => a === "aria-busy" }), false, queued);
-if (c.includes("promote"))
-  throw new Error("dismiss-in-flight chip must be left to its DELETE verdict: " + c);
-// Null / non-object 2xx body (a misbehaving proxy answering `200 null`): the
-// helper normalizes it to {} so neither call site guards — it must fall through
-// to the unknown/"ok" arm and SETTLE the optimistic chip (promote), never throw
-// and strand a delivered message as a connection error.  (The no-op
-// consumeAttachments stub cannot prevent this: data.attached_ids is evaluated to
-// build the :639 call args, so against unfixed code this line throws and crashes
-// the harness.)
-c = run(makeEl(), false, null);
-if (!c.includes("promote"))
-  throw new Error("null body must settle via unknown-ok, not throw: " + c);
-console.log("settle matrix OK");
-""",
-        encoding="utf-8",
-    )
-    proc = subprocess.run(
-        ["node", str(script)],
-        capture_output=True,
-        text=True,
-        timeout=15,
-    )
-    assert proc.returncode == 0, f"settle harness failed:\n{proc.stderr}\n{proc.stdout}"

tests/test_judge.py

@@ -9,10 +9,7 @@ from pathlib import Path
 from typing import Any
 from unittest.mock import MagicMock
 
-from tests._session_helpers import as_stream
-from tests._session_helpers import mock_completion_result as _mock_result
 from turnstone.core.judge import IntentJudge, IntentVerdict, JudgeConfig, evaluate_heuristic
-from turnstone.core.trajectory import Role
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -33,12 +30,16 @@ def _make_mock_provider(
     caps.max_output_tokens = 4096
     provider.get_capabilities.return_value = caps
 
+    result = MagicMock()
+    result.content = response_content
+    result.tool_calls = tool_calls
+    result.finish_reason = "stop"
+    result.usage = None
+
     if side_effect:
-        provider.create_streaming.side_effect = side_effect
+        provider.create_completion.side_effect = side_effect
     else:
-        provider.create_streaming.return_value = as_stream(
-            _mock_result(response_content, tool_calls)
-        )
+        provider.create_completion.return_value = result
 
     provider.convert_tools.side_effect = lambda tools, **kw: tools
 
@@ -255,8 +256,9 @@ class TestErrorHandling:
     def test_empty_content_returns_none(self):
         """Provider returns empty content, no tool calls."""
         provider = _make_mock_provider(response_content="")
-        result_mock = _mock_result("", None)
-        provider.create_streaming.return_value = as_stream(result_mock)
+        result_mock = provider.create_completion.return_value
+        result_mock.tool_calls = None
+        result_mock.content = ""
 
         judge = _make_judge(provider)
         result = judge._evaluate_single(
@@ -270,9 +272,10 @@ class TestErrorHandling:
     def test_empty_content_length_stop_no_retry(self):
         """When finish_reason is 'length', don't retry — return None immediately."""
         provider = _make_mock_provider(response_content="")
-        result_mock = _mock_result("", None)
+        result_mock = provider.create_completion.return_value
+        result_mock.tool_calls = None
+        result_mock.content = ""
         result_mock.finish_reason = "length"
-        provider.create_streaming.return_value = as_stream(result_mock)
 
         judge = _make_judge(provider)
         result = judge._evaluate_single(
@@ -283,7 +286,7 @@ class TestErrorHandling:
         )
         assert result is None
         # Should have been called exactly once — no retries
-        assert provider.create_streaming.call_count == 1
+        assert provider.create_completion.call_count == 1
 
 
 # ---------------------------------------------------------------------------
@@ -329,7 +332,7 @@ class TestCancelEventSemantics:
         assert all(v.tier == "llm_fallback" for v in results)
         assert all("cancelled" in v.reasoning for v in results)
         # ...and no inference was spent after the abort signal.
-        assert provider.create_streaming.call_count == 0
+        assert provider.create_completion.call_count == 0
 
     def test_unfired_event_runs_every_item_with_default_config(self):
         """The run-to-completion contract: with cancel_on_approval=False
@@ -352,7 +355,7 @@ class TestCancelEventSemantics:
 
         assert [v.call_id for v in results] == ["tc_0", "tc_1", "tc_2"]
         assert all(v.tier == "llm" for v in results)
-        assert provider.create_streaming.call_count == 3
+        assert provider.create_completion.call_count == 3
 
 
 # ---------------------------------------------------------------------------
@@ -372,23 +375,24 @@ class TestMultiTurnToolUse:
         provider.convert_tools.side_effect = lambda tools, **kw: tools
 
         # Turn 1: tool call
-        turn1 = _mock_result(
-            "",
-            [
-                {
-                    "id": "tc_judge_1",
-                    "function": {
-                        "name": "read_file",
-                        "arguments": json.dumps({"path": "/nonexistent/file.txt"}),
-                    },
-                }
-            ],
-        )
+        turn1 = MagicMock()
+        turn1.content = ""
+        turn1.tool_calls = [
+            {
+                "id": "tc_judge_1",
+                "function": {
+                    "name": "read_file",
+                    "arguments": json.dumps({"path": "/nonexistent/file.txt"}),
+                },
+            }
+        ]
 
         # Turn 2: verdict
-        turn2 = _mock_result(_good_verdict_json())
+        turn2 = MagicMock()
+        turn2.content = _good_verdict_json()
+        turn2.tool_calls = None
 
-        provider.create_streaming.side_effect = [as_stream(turn1), as_stream(turn2)]
+        provider.create_completion.side_effect = [turn1, turn2]
 
         judge = _make_judge(provider)
         verdict = judge._evaluate_single(
@@ -399,7 +403,7 @@ class TestMultiTurnToolUse:
         )
         assert verdict is not None
         assert verdict.tier == "llm"
-        assert provider.create_streaming.call_count == 2
+        assert provider.create_completion.call_count == 2
 
     def test_max_turns_reached(self):
         """Provider keeps requesting tools — stops at _JUDGE_MAX_TURNS."""
@@ -412,29 +416,30 @@ class TestMultiTurnToolUse:
         provider.convert_tools.side_effect = lambda tools, **kw: tools
 
         # Every turn returns a tool call
-        tool_result = _mock_result(
-            "",
-            [
-                {
-                    "id": "tc_loop",
-                    "function": {
-                        "name": "read_file",
-                        "arguments": json.dumps({"path": "/tmp/x"}),
-                    },
-                }
-            ],
-        )
+        tool_result = MagicMock()
+        tool_result.content = ""
+        tool_result.tool_calls = [
+            {
+                "id": "tc_loop",
+                "function": {
+                    "name": "read_file",
+                    "arguments": json.dumps({"path": "/tmp/x"}),
+                },
+            }
+        ]
 
         # Last turn (no tools param) returns text content
-        final = _mock_result(_good_verdict_json())
+        final = MagicMock()
+        final.content = _good_verdict_json()
+        final.tool_calls = None
 
         # Turns 0-3: tool_call; turn 4 (last, tools=None): final verdict
-        provider.create_streaming.side_effect = [
-            as_stream(tool_result),
-            as_stream(tool_result),
-            as_stream(tool_result),
-            as_stream(tool_result),
-            as_stream(final),
+        provider.create_completion.side_effect = [
+            tool_result,
+            tool_result,
+            tool_result,
+            tool_result,
+            final,
         ]
 
         judge = _make_judge(provider)
@@ -444,8 +449,8 @@ class TestMultiTurnToolUse:
             cancel_event=None,
             client=MagicMock(),
         )
-        # Should have called create_streaming exactly _JUDGE_MAX_TURNS times
-        assert provider.create_streaming.call_count == 5
+        # Should have called create_completion exactly _JUDGE_MAX_TURNS times
+        assert provider.create_completion.call_count == 5
 
 
 # ---------------------------------------------------------------------------
@@ -463,12 +468,12 @@ class TestContextPreparation:
 
         result = judge._prepare_context(_make_item(), messages)
 
-        # Should have a system Turn + single user Turn with the transcript
+        # Should have system message + single user message with transcript
         assert len(result) == 2
-        assert result[0].role is Role.SYSTEM
-        assert result[1].role is Role.USER
-        assert "pending human approval" in result[1].text
-        assert "Conversation context:" in result[1].text
+        assert result[0]["role"] == "system"
+        assert result[1]["role"] == "user"
+        assert "pending human approval" in result[1]["content"]
+        assert "Conversation context:" in result[1]["content"]
 
 
 class TestArgBudget:
@@ -536,7 +541,7 @@ class TestArgBudget:
         )
         # Each included history turn renders one "ASSISTANT:" line; the
         # big-argument call fits strictly fewer of them.
-        assert big[1].text.count("ASSISTANT:") < small[1].text.count("ASSISTANT:")
+        assert big[1]["content"].count("ASSISTANT:") < small[1]["content"].count("ASSISTANT:")
 
 
 # ---------------------------------------------------------------------------
@@ -894,21 +899,14 @@ class TestModelAliasResolution:
         cfg = MagicMock()
         cfg.context_window = 50_000
         cfg.capabilities = capabilities if capabilities is not None else {}
-        # Judges inherit the alias's configured temperature (house rule: no
-        # code pins) — give the mock config a real value so the lane
-        # resolution path is exercised, not a MagicMock leak.
-        cfg.temperature = 0.3
         registry.has_alias.side_effect = lambda a: a == alias
         registry.resolve.return_value = (alias_client, underlying_model, cfg)
-        # The unified lane resolver (model_turn.resolve_capabilities) fetches
-        # the config itself rather than taking resolve()'s copy.
-        registry.get_config.return_value = cfg
         registry.get_provider.return_value = alias_provider
         return registry
 
     def test_alias_capabilities_merged_and_threaded_to_wire(self):
         """#823: a judge alias's model-definition ``capabilities`` are merged
-        onto the provider base AND passed to ``create_streaming`` — the same
+        onto the provider base AND passed to ``create_completion`` — the same
         contract as the session / utility / sub-agent lanes.  Without threading,
         operator overrides (effort passthrough, tool support) were silently
         ignored on judge calls; deleting ``capabilities=self._capabilities`` from
@@ -944,38 +942,12 @@ class TestModelAliasResolution:
             cancel_event=None,
             client=MagicMock(),
         )
-        passed = alias_provider.create_streaming.call_args.kwargs["capabilities"]
+        passed = alias_provider.create_completion.call_args.kwargs["capabilities"]
         assert passed is judge._capabilities
-        # House rule: the judge pins no temperature — the wire carries the
-        # alias's configured value, inherited through the lane.
-        assert alias_provider.create_streaming.call_args.kwargs["temperature"] == 0.3
-
-    def test_constructor_resolves_from_one_config_fetch(self):
-        """The constructor consumes the ModelConfig that registry.resolve()
-        already returned (the ``cfg=`` pass-through) — ZERO independent
-        get_config fetches, so a registry hot-reload between two lookups
-        cannot bind the resolved client/window to a different capability
-        generation."""
-        alias_provider = _make_mock_provider(response_content=_good_verdict_json())
-        registry = self._make_alias_registry(
-            "judge-mini",
-            alias_provider,
-            MagicMock(base_url="https://a/v1", api_key="k"),
-            "local-9b",
-        )
-        IntentJudge(
-            config=JudgeConfig(enabled=True, model="judge-mini"),
-            session_provider=_make_mock_provider(),
-            session_client=MagicMock(base_url="https://s/v1", api_key="s"),
-            session_model="session-model",
-            session_capabilities=MagicMock(context_window=100_000),
-            model_registry=registry,
-        )
-        assert registry.get_config.call_count == 0
 
     def test_fallback_threads_session_capabilities_to_wire(self):
         """No judge alias → the judge inherits the session model AND the
-        session's resolved capabilities, threaded to ``create_streaming``."""
+        session's resolved capabilities, threaded to ``create_completion``."""
         from turnstone.core.providers._protocol import ModelCapabilities
 
         sess_caps = ModelCapabilities(context_window=54_321, effort_passthrough=True)
@@ -995,7 +967,7 @@ class TestModelAliasResolution:
             cancel_event=None,
             client=MagicMock(),
         )
-        assert provider.create_streaming.call_args.kwargs["capabilities"] is sess_caps
+        assert provider.create_completion.call_args.kwargs["capabilities"] is sess_caps
 
     def test_alias_uses_registry_provider_not_session_provider(self):
         """Judge with model=alias should resolve via registry — provider, client,

tests/test_mcp_admin_bulk_revoke.py

@@ -157,44 +157,6 @@ def test_400_on_invalid_server_name(storage: SQLiteBackend) -> None:
     assert resp.status_code == 400
 
 
-def test_200_on_oauth_obo_server(storage: SQLiteBackend) -> None:
-    """#551: bulk-revoke serves oauth_obo too (it populates mcp_user_tokens with
-    minted cache rows) — the documented remediation for stale rows after an
-    oauth_user→oauth_obo flip."""
-    storage.create_mcp_server(
-        server_id="srv-obo-id",
-        name="srv-obo",
-        transport="streamable-http",
-        url="https://example.com/mcp",
-        auth_type="oauth_obo",
-    )
-    _seed_user_tokens(storage, "srv-obo", users=2)
-
-    client = TestClient(_build_app(storage))
-    resp = client.post("/v1/api/admin/mcp-servers/srv-obo/bulk-revoke")
-    assert resp.status_code == 200, resp.text
-    body = resp.json()
-    assert body["rows_deleted"] == 2
-    assert storage.count_mcp_consented_users_by_server("srv-obo") == 0
-    # Honest semantics: obo is a cache flush (re-mints), NOT a consent revoke.
-    assert body["effect"] == "cache_flush_remints"
-    events = storage.list_audit_events(action="mcp_server.oauth.obo_cache_flushed")
-    assert len(events) == 1
-    # The oauth_user revoke event must NOT be emitted for an obo flush.
-    assert storage.list_audit_events(action="mcp_server.oauth.bulk_revoked") == []
-
-
-def test_oauth_user_bulk_revoke_keeps_revoke_semantics(storage: SQLiteBackend) -> None:
-    """The oauth_user path is unchanged: durable revoke event + effect."""
-    _seed_oauth_server(storage)
-    _seed_user_tokens(storage, "srv-oauth", users=1)
-    client = TestClient(_build_app(storage))
-    resp = client.post("/v1/api/admin/mcp-servers/srv-oauth/bulk-revoke")
-    assert resp.status_code == 200, resp.text
-    assert resp.json()["effect"] == "revoked_until_reconsent"
-    assert len(storage.list_audit_events(action="mcp_server.oauth.bulk_revoked")) == 1
-
-
 def test_200_on_success_with_no_consented_users(storage: SQLiteBackend) -> None:
     _seed_oauth_server(storage)
     client = TestClient(_build_app(storage))