test: drop verified worthless tests across crates

[asto18089]

Summary

Repo-wide audit of every test file in the CodeWhale workspace, hunting three categories of provably worthless tests: never-executed or never-failing tests (C1), production code kept alive only by tests (C2), and strictly subsumed duplicate tests (C3) — followed by restoration passes for code explicitly staged for not-yet-landed work, and adversarial re-reviews (rounds 2–6) that closed the gaps earlier versions of this PR missed.

Method

Every candidate deletion carried mechanical evidence (workspace-wide reference greps, runner-wiring checks, assertion-containment quotes). A second adversarial pass independently re-verified all findings before deletion. A reservation audit then cross-checked every deletion against in-code reservation markers and the deltas of all open PRs, restoring anything explicitly staged for not-yet-landed work. Successive from-scratch re-review rounds extended that audit (see "Review round-2 fixes" through "Review round-5 fixes").

What changed (net vs pinvou3-clean@3118c36b8)

131 files, +405/−10,534 lines across themed commits: the audited sweep, eight restoration passes, sweep-residue doc cleanup, mechanical fixes for pre-existing test-target clippy lints that the --all-targets CI gate fires, and the round-4 through round-6 review fixes below.

Deliberately restored (reserved for pending work)

Whole staged modules and seams returned from the pre-sweep state with their tests and wiring: model_policy and review_repair (model-execution layer, follow-up wiring), route authority catalog + CatalogPolicy chain (Phase 1 hooks, codewhale-hq#5766), workroom module (protocol Phase-1 types per docs/rfcs/3209-workrooms.md), core session/journal placeholders (codewhale-hq#5261/codewhale-hq#5262), the state session-tree ops that implement those placeholders' semantics (fork_at_message, set_current_leaf_id, list_leaf_messages, clear_messages, delete_thread, find_thread_name_by_id + cascade test), OpEnvelope (Phase A1 extraction spec), tideline inbox scaffold (codewhale-hq#5698), resource_telemetry PressureLevel half, the network_policy Prompt-approval seam (NetworkPolicy::add_allow, NetworkSessionCache::approve/deny, NetworkPolicyDecider::approve_session/deny_session/approve_persistent, NetworkDenied — the module header reserves these for the /network allow <host>//network deny <host> wiring and the approval-modal hook, so the file is restored byte-identically with its five tests; net diff against the base is empty), ShellManager::remember_stale_job ("Remember a restart-stale job so the UI can show it instead of hiding it") — the sole writer of the stale_jobs map whose read side is live production code, restored byte-identically with the trimmed portion of test_job_list_poll_cancel_and_stale_snapshot, the menu_style selection-style quartet (round-5: the canonical trio, shared-background variant, disabled-muted row, and theme-variant pins — all four subjects are live and wired across context_menu/command_palette/provider_picker/model_picker/worktree_manager/feedback_picker, and the module itself keeps same-class exact-value assertions, so no C1/C2/C3 justification applied), LiveTranscriptOverlay::set_tail_mode with its mode() accessor and both pins (round-5: "exposed for callers that retain an overlay across a backtrack cancel" is a forward-looking reservation, the same class the sweep honored elsewhere), Settings::set_pinned_model_label plus the assertion the sweep dropped from pinned_models_are_exact_ordered_and_round_trip (round-5: "exposed through settings serialization first" is staged sequencing), HookExecutor::is_enabled (round-5: "Public API for hook system consumers" — the same public-contract reservation formula as the restored WhaleState::priority), rebind-hint cluster (codewhale-hq#128), goal_loop is_success (codewhale-hq#2666 token/time visibility), the codewhale-hq#4122 convergence seam (DelegateCard::as_workflow_history_panel + WorkflowPanel::render_history_card/from_direct_subagent + tests), stopship_gate_pipeline canonical constructor + re-export ("wire in later" scaffolding), ExecutionEnvelope::narrow (ratification UI), WorkshopVariables::take_raw (promote_to_context follow-up), system_prompt_for_mode_with_context wrapper (called by PR #90, merged 2026-10-12), the fleet-store half of the qualified-name flow (load_fleet + FleetStoreError::Ambiguous + the ambiguity round-trip test — its UI-side half was already marker-reserved in tui/views/fleet_list.rs), the ghost-text negative arm (ghost_text_hidden_when_input_not_empty: a suggestion must not render over non-empty input), the CALM_PERSONALITY overlay with its precedence-table entry and the codewhale-hq#2953 decision pin (Personality::Calm remains selectable), WhaleState::priority with its ordering pins (the same public-contract reservation formula as the restored for_shell_phase), the two lost live-behavior coverage pins (grouping_key_collapses_shell_flag_variants, current_on_empty_chain_returns_default_provider), the provider-reported context-window seam (round-4: ContextWindowSource::ProviderReported, ProviderReportedKimiCodeContext, the provider_reported_context parameter threading, OverrideSource::ProviderReportedContextWindow, the status/localization/locale surface, and both tests including the stale-metadata fallback pin), and others — see the restoration commit messages for the full list.

Deliberately kept deleted

Applied deletions remain for: tautological / no-assertion / never-run tests, byte-identical or assertion-subset duplicates, and dead code whose own docs sanction removal (computer_meter's "it must be deliberately wired as a local self-check or deleted" header; the underwater classic header marked "superseded by the Tideline shell" — this PR is the deletion slice that header deferred, taken with its cross-file cascade: WorkflowPanel::top_bar_chip (the codewhale-hq#5040 one-chip summary), the #39/#14 header chips, git_status::chrome_label/chrome_ink, and ShellPhase::color/phase_ink, all of it already invisible at the base commit). workflow/replay.rs stays deleted — unlike its restored siblings it carries no reservation markers. The third ghost-text arm (ghost_text_hidden_when_no_suggestion) also stays deleted: it stack-overflows on this host at the unmodified base 3118c36b8 itself (reproduced in a scratch worktree — the placeholder/locale render path recurses too deep here), so restoring it would add a macOS-red test; the sibling negative arm remains restored. ~120 LIKELY/FLAG-level findings were not applied.

Review round-2 fixes

• CI unblock. Removed the orphaned doc comment at tui/app.rs:855 (clippy empty_line_after_doc_comments, denied by the check job). Fixed the issue-link line format below. Fixed 7 pre-existing test-target clippy lint instances that the --all-targets gate fires on clippy 1.99 at the base commit itself (print_stderr ×3, redundant_closure, chunks_exact_to_as_chunks ×2 (lib-test and integration-test targets), clone_on_copy) — mechanical one-liners, disclosed as out-of-scope-but-CI-blocking. Also silenced the user_theme glob re-export for the integration-test crate. Post-rebase erratum: only the three print_stderr fixes and the palette glob allow remain in this PR's net diff — the redundant_closure/clone_on_copy/chunks_exact_to_as_chunks instances were fixed on the base by the merged fix: align model-facing text with engine reality #90–test(sandbox): ratchet-aware NoNewPrivs child matrices #98.
• Restoration completion. Restored the reservation-class seams the first pass missed (workroom, state tree ops, goal_loop is_success, v0.9.0 2.5: route workflow events to panel and compact history card codewhale-hq/Codewhale#4122 seam, stopship_gate_pipeline) and the two coverage pins listed above.
• Residue cleanup. Dropped the stale [crate::computer_meter] doc link and metering paragraph in cloud_dispatch.rs; fleet-dogfood.toml now references the live FleetSecretRef; tests/README.md no longer counts plugin_e2e_acceptance among Gherkin runners; WorkflowRunStatus::ReplayDiverged now documents that it is wire-compatible-only (its only producer, the replay executor, is what the sweep deleted).

Review round-3 fixes

• A fresh from-scratch adversarial re-review found four restoration gaps against this PR's own reservation standard, one misclassified deletion (the ghost-text negative arm — a negative path is not "subsumed" by a surviving positive test), and an inaccurate justification in the clippy commit's message. The final restoration commit closes all of them with byte-identical restores (load_fleet/Ambiguous, ghost-text negative arm, CALM_PERSONALITY + v0.8.56: Slim the default prompt path toward Codex-parity input tokens codewhale-hq/Codewhale#2953 pin, WhaleState::priority) and re-points the five scenario tests that the sweep had rewritten into inline replicas of render_history_card back at the restored constructor (assertions unchanged).
• The clippy commit's message now states exactly what it contains: the sweep-introduced tui/app.rs doc-comment removal, the seven pre-existing base-commit lint instances, and the user_theme glob allow with its real mechanism (the integration-test target #[path]-includes src/palette/mod.rs; in that test-crate context the re-export has no in-crate consumer, so the gate rejects it).
• Erratum for the sweep commit message: its gate list says "cli 6" — a dropped digit. The real post-sweep cli count is ~380 test attrs (380 executed at this head, re-measured on Linux; the earlier 359 under-counted).

Review round-4 fixes

A fresh from-scratch 12-lane re-review (deletion-class re-verification, collision census, restoration byte-identity, behavior/performance audit, smuggling sweep, local gate reproduction) confirmed the sweep's core and found two required gaps; both are closed here, plus the smaller items it flagged:

• Undisclosed seam deletion → restored (aac008a71 pre-rebase). The sweep had deleted the provider-reported context-window seam without disclosure: ContextWindowSource::ProviderReported, ProviderReportedKimiCodeContext with its freshness const, the provider_reported_context parameter on resolve_route_candidate_with_context_metadata/..._and_host_limits/plan_limit_overrides (and the None at all five production call sites), OverrideSource::ProviderReportedContextWindow, the status.rs rendering arm, MessageId::StatusContextSourceProviderReported with its key in all 15 locales, and both tests including the stale-metadata-falls-back-safely pin. Its doc comment stages the seam for an authenticated model-listing consumer — the same reservation class as model_policy and the feat(config): bind catalog and route resolution codewhale-hq/Codewhale#5766 route catalog — so it is restored byte-identically to the base commit (the duplicate missing-marker locale test stays deleted).
• Misclassified pins → restored (77d979770 pre-rebase). The type @/ and the TUI freezes and cannot be exited codewhale-hq/Codewhale#1921 negative-arm gate test should_try_local_reference_completion_skips_bare_separators_and_dots (the tested fn survives the sweep; no surviving test covered its positive arm or the ./../\/empty rejections — not C1, not C2, not C3), the four git-status classify_command row pins (the surviving classify_git_push pins a different row of the same table), and the prompts/text.rs module-doc line naming the restored CALM_PERSONALITY overlay — each byte-identical.
• C2 cascade edges completed (5bfa7892f pre-rebase). The deleted shadow-guard's one uncovered assertion (sensenova must not shadow a ProviderKind built-in) re-pointed onto the surviving sensenova test; FragmentCapError::TooManyFragments deleted (its only producer was C2-deleted, leaving an unconstructable variant); git_status::chrome_label/chrome_ink and their six pins deleted (the sweep had orphaned them by deleting their only caller — the underwater classic header — while deleting their sibling top_bar_chip); ShellPhase::color and phase_ink deleted with the test that pinned them — the last items still carrying the classic-header "deletion is its own slice" sanction. The stale "six runners" harness comment corrected (361d99f0e pre-rebase).
• Re-verification recorded. Zero added-code references to any of the 188 net-deleted symbols across all then-open PRs (14 other CW PRs including new fix(tui): scope checkpoint recognition by era #103, 20 parent-repo PRs at that time) and both main tips; every restoration re-diffed byte-identical against the base; every added line classified; gates re-measured at that head.
• Erratum for the 5bfa7892f commit message. It calls the deleted chrome_label/chrome_ink "unmarked", but git_status.rs carries a pre-existing module-wide allow, and says color/phase_ink "both carried the classic-header sanction" when only ShellPhase::color did (phase_ink is sanctioned transitively as its sole-called helper). The deletions themselves are substantively correct.

Review round-5 fixes (this push)

A fresh from-scratch eight-lane re-review at the rebased head (posted as a review comment) re-verified every significant deletion across all three classes, every restoration byte-against-base, 100% of the added lines, the kept-deleted claims, the collision census against all nine other open PRs, and the rebase interaction with the five newly merged base commits — the sweep's core held everywhere except the items below, all closed on this push:

• Rebase onto the advanced base. pinvou3-clean advanced to 3118c36b8 (merged: fix: align model-facing text with engine reality #90, fix(tui): preserve thinking across turns #91, fix(engine): 为终态事件保留原始回合及提交归属 #97, test(sandbox): ratchet-aware NoNewPrivs child matrices #98, fix(tui): align provider doc conformance guards (sampling, Gemini signature gate, DeepSeek note) #93). Two conflicts, both resolved in the sweep's favor after verification: tests/integration/reasoning_content_replayed_after_tool_call.rs stays deleted (the "assertion" inspected the request the test itself hand-built — a tautology at the old base too; fix(tui): preserve thinking across turns #91's engine tests now pin real replay on production-captured requests, so no coverage is lost), and client.rs::chat_messages_keeps_valid_tool_calls_intact stays deleted (strict assertion-subset duplicate of chat_messages_include_tool_results_when_call_present). A whole-tree check confirms all 23 fix(tui): preserve thinking across turns #91-added tests and the fix: align model-facing text with engine reality #90/fix(tui): align provider doc conformance guards (sampling, Gemini signature gate, DeepSeek note) #93/fix(engine): 为终态事件保留原始回合及提交归属 #97/test(sandbox): ratchet-aware NoNewPrivs child matrices #98 additions are intact at this head, and the collision census is re-verified against the nine other open PRs.
• Live-contract pins restored (4fb1c85f0). The menu_style quartet, set_tail_mode + mode() + both pins, set_pinned_model_label + its round-trip assertion, and HookExecutor::is_enabled — each restored byte-identically (whole-file diff verified for menu_style and live_transcript); see the restored list above for why each is not C1/C2/C3.
• Reservation seams restored (7058b69f1). The network_policy Prompt-approval write side (whole file byte-identical to base) and ShellManager::remember_stale_job with its test portion — the sweep had deleted the writers while keeping the headers' reservation language and the live readers, leaving query-only state nothing could write.
• Sweep classes applied uniformly (afff68178). Dropped the tautological steer-seed pins (assign + assert on submit_pending_steers_after_interrupt; drain_pending_scenario covers the real behavior) and the assertion-free detect_returns_some_shell / test_scroll_operations; the error_taxonomy auth-envelope pin now feeds a raw key and pins the classifier-not-redactor contract instead of asserting a string absent from its own pre-redacted input (renamed accordingly); the automation/tasks aliases_hide_from_model_and_force_action tests — whose alias subjects were C2-deleted — are renamed to canonical_visibility_and_per_action_approval (the GithubTool twin keeps its name: its alias machinery is live); two tools/subagent/mod.rs doc comments now cite apply_spillover_with_artifact instead of the deleted wrapper; and the deleted Unknown-label pin's assertion moved onto child_route_billing_fails_closed_for_every_ambiguous_provider.
• Hardening pins for surviving behavior (7bae0ff7b). deterministic_backoff_exponential_growth gains an attempt-63 saturation canary (the deleted no-assertion test was the only check that the retry path's shift/multiply guards stay finite at high exponents); control_node_result_serialization pins ReplayDiverged's snake_case wire spelling in both directions, enforcing the wire-compat promise in its doc.
• README correction (fe7113f46). The integration row now says 15 suites (it omitted lifecycle_outbox_exec — a pre-existing omission the sweep's 17−3 arithmetic propagated) and the link-count sentence matches.
• Host-environment findings (no code change). Under full-suite parallel load on this macOS host, the acp_server::tests family, cli_telemetry_acceptance_is_versioned_and_reuses_settings_persistence, and the ghost-text placeholder test above stack-overflow — all reproduced identically on the unmodified base 3118c36b8 in a scratch worktree, so they are pre-existing and environmental, not introduced here; they pass in isolation at both base and this head. Also noted: running the cucumber and integration targets in one invocation can cross-contaminate shared home state (20 spurious integration failures that vanish when the targets run separately) — CI runs them as separate jobs.

Review round-6 fixes (this push)

A fresh from-scratch eleven-lane re-review at the rebased head — deletion-class re-verification across all 132 then-changed files, whole-tree hunk classification with all 76 commit-level-only files byte-compared, a 100% added-line audit, commit-message accuracy, a collision census against all nine other open PRs and the parent app's in-tree consumption, a kept-deleted and body-claim audit, and local gate reproduction — re-confirmed the sweep's core: zero smuggled added lines, every restoration byte-identical to the base, zero references to any deleted symbol in any other open PR's added lines or the parent app, and all gates green. It closed the items below on this push:

• Three misclassified pins restored byte-identically (267c80d1e). rlm_eval_schema_names_the_runtime_content_variable (the eval schema's model-facing code description had no surviving schema pin — the kept assertion covers only the missing-code error message), default_threshold_is_32k_tokens (the only exact-value pin of DEFAULT_LARGE_OUTPUT_THRESHOLD_TOKENS — the same canary class as the attempt-63 backoff pin), and test_show_settings_loads_from_file (the only smoke pin of the live /config show branch). Restoring the first-of-kind byte-identical originals returns commands/groups/config/config.rs and tools/large_output_router.rs to base state, which is why the net file count drops to 131.
• The sweep's tautology class applied uniformly (c22b3ecbd). The deleted reasoning_content_replayed_after_tool_call.rs had an assertion-equivalent survivor: reasoning_replay_required_on_subsequent_turn hand-built the second request (Thinking block included), fed it to the mock, and asserted the mock's verbatim capture — no production code composed the asserted request, so it could not fail on a runtime regression. Dropped with its now-unused assistant_thinking helper; tests/README.md now points the V4 §5.1.1 replay bullet at the engine tests (multi_block_and_redacted_thinking_persist_into_followup_requests), which drive a real engine and assert on the production-composed follow-up request.
• Doc residue (2db56a5f5). named_fleet::sha256_label's doc no longer cross-references the deleted replay.rs; the integration harness header no longer cites a stale pre-harness binary count; and the deleted apply_spillover wrapper's doc paragraph no longer dangles above apply_spillover_with_artifact (its legacy-path contracts stay test-pinned; the artifact path deliberately does not skip error results, so the old "error results are skipped" sentence must not move onto it).
• Body erratum. The execpolicy per-crate count is 118 executed (116 lib + 1 doc + 1 authorization_order), not 119; corrected below.
• Round-6 findings verified as non-issues. The deleted default_settings_show_footer_water_strip was a strict assertion-subset of the surviving default_settings_use_comfortable_transcript_spacing (all three defaults re-asserted on Settings::default()), and the LocalOnly → Ready resolution keeps a direct pin in tui/setup/remote.rs.
• Residual inert state (disclosed, no change). FleetSchedulerReport::cancelled lost its last writer with the C2-deleted cancel_run, and GitStatusSnapshot::ahead/behind lost their last reader with the deleted classic-header chrome; both are harmless dead state on live structs, left in place to keep this PR deletion-only in production code.

Disclosures

• model_policy.rs is restored without an in-code reservation marker — it is the staged model-execution layer for follow-up wiring. Every other restored item is marker-verified; this one is called out explicitly.
• cloud_dispatch::should_auto_confirm is a marker-carrying deletion kept deleted: constant-false with only test callers at the base commit and no named future wiring (the module doc's leftover contract sentence stays).
• Hook::{with_condition, with_timeout, background, with_name} moved behind #[cfg(test)]. Hook::new stays public: the parent app's tests build hooks through it.
• The sweep turns the crate-root pub const DEFAULT_FLEET_WORKFLOW_MAX_AGENTS into a module-private const in experimental_search.rs (value identical, sole surviving consumer unchanged; the other two base-commit consumers — WorkflowFleetLimits::default() and a fleet-validation test — were themselves C2-deleted).
• The sweep also removed the thin v0.7.7: make spend/cost display monotonic and source-backed codewhale-hq/Codewhale#244 cost wrappers (accrue_session_cost, displayed_session_cost, accrue_subagent_cost); the monotonic-display invariant they wrapped survives with its own regression pins (ui/tests.rs, "Regression for issue v0.7.7: make spend/cost display monotonic and source-backed codewhale-hq/Codewhale#244"). It also removed push_pending_steer, the only producer feeding drain_pending_steers — that producer already had no production caller at the base commit, so behavior is unchanged, while the drain side keeps its three production call sites.
• AuthenticationErrorDetail::to_user_message now clones message directly; the AuthenticationErrorContext field it no longer reads had zero production constructors at the base commit (behavior-identical C2 cascade).
• Where a deleted production item was the subject of a still-useful pin, the sweep re-pointed the pin at its surviving equivalent rather than dropping it (~20 files — e.g. the spillover pin now exercises apply_spillover_with_artifact, the fleet-profile pins use the *_tolerant loaders, the redaction pin tests the caller-redacts contract). This includes widening skills::package_digest to pub(crate) for the re-pointed digest pins. Those re-points live inside the sweep commit; every deleted production item they replaced had only test callers at the base commit.
• Remaining queued conflict: CW feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54 (workspace-roots, open) overlaps this PR in tui/approval/elevation.rs plus the two clippy eprintln! lines in tools/js_execution.rs and core/engine/tests.rs (the earlier prediction of state/lib.rs/tools/approval_cache.rs conflicts was wrong — this PR does not touch those files); all three sites are trivial, either landing order. No other open PR adds callers to any deleted symbol (re-verified at each round; at the round-5 rebase against the 9 other open CW PRs).

Gates (re-measured at this head after the round-6 commits)

• cargo check --workspace --all-features: clean
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings (the CI check command): clean on clippy 1.99.0
• cargo fmt --all -- --check: clean; scripts/check-dead-code-budget.py: 398 attributes against the 420 ceiling (22 under)
• Per-crate cargo test --all-features: config 641, protocol 86, execpolicy 118, mcp 76, secrets 62, state 25, workflow 233 (+2 round-5 pins), workflow-js 85, agent 63, app-server 106, cli 380 — all green (re-measured at this head)
• codewhale-tui --lib: 11,994 tests, 0 failed (13 ignored) — green end-to-end; without a raised RUST_MIN_STACK the load-dependent overflow set from the round-5 environmental note can abort a run on this host (every member reproduces at the unmodified base); integration (265) and cucumber (28) targets green when run as separate targets, as CI does
• All commits signed off

No-Issue: verified worthless-test sweep with reservation audit and restoration; no tracking issue.

[asto18089]

Fresh review of PR #102 (7-lane adversarial re-review, from scratch)

Base freshness: pinvou3-clean is unchanged at 0bc868ff0 and this branch sits exactly on it, so no rebase was needed. The full net diff (166 files, +513/−11,885) was re-verified category by category: C1/C2/C3 classifications were independently checked for every slice, every net-deleted production item was re-grepped for references at BASE across the whole workspace, the parent app (pinvou3-app/src-tauri path-deps on codewhale-tui/config/secrets/execpolicy) and the deltas of all 13 other open PRs were swept for deleted-symbol consumption, and both commits' restorations were compared byte-for-byte against BASE.

The sweep itself holds up. Every net-deleted item I checked was genuinely dead, tautological, or strictly subsumed at BASE — including all whole-file deletions (computer_meter is sanctioned by its own "wire it or delete it" header; replay.rs has no reservation markers unlike its restored siblings; the deleted integration tests are env-gated no-ops, git-binary smokes, or a self-authoring tautology). Nothing is smuggled: every + line in the sweep is test rewiring, import fixups, or the value-identical DEFAULT_FLEET_WORKFLOW_MAX_AGENTS relocation. The parent app consumes zero deleted symbols; the Hook::new cross-repo claim is verified (pinvou3-app/src-tauri/src/features/assistant/platform/bridge.rs:7506). The two no_new_privs failures genuinely pre-exist at BASE (reproduced at 0bc868ff0 in a scratch worktree); the additional failures seen in full-suite runs here (remote_control::*, agent_mail_queue*) pass in isolation at both BASE and HEAD — host load flakes, not regressions.

However, the PR is not mergeable as it stands, and the restoration pass has real gaps. Findings below.

Blocking (required CI is red)

1. check job fails clippy -D warnings — deletion residue at crates/tui/src/tui/app.rs:855-856. Deleting the HeaderActionTarget compatibility alias left its doc comment ("Compatibility name retained for the first Tideline header slice…") plus an empty /// line floating above ViewportState; clippy denies empty_line_after_doc_comments. gate fails fast on check. Fix: remove the orphaned two doc lines (the "compatibility name" no longer exists, so the comment should go entirely, not be re-attached).
2. link job fails: the body's trailing No-Issue doesn't match the required format. The check greps for ^No-Issue: <reason> (or Closes #…). Change the last body line to e.g. No-Issue: verified worthless-test sweep; no tracking issue.
3. The body's Gates section claims everything clean, but the author's gate list omitted clippy, which is what CI denies. Please update the Gates section after re-running: cargo clippy --workspace --all-targets --all-features -- -D warnings (note: 7 further clippy errors reproduce at BASE itself with the same command — print_stderr in engine/tests.rs:20141 and js_execution.rs:386/428, redundant_closure engine/tests.rs:25056, chunks_exact_to_as_chunks shell_dispatcher.rs, clone_on_copy web_search.rs — so they pre-date this PR; after fixing item 1, re-run CI and disclose if CI's toolchain also fires those).

Must-fix before merge (restoration completeness / contradictions)

4. The body claims "workroom module" was restored — it was not. crates/protocol/src/workroom.rs (347 lines) is deleted at HEAD, while docs/rfcs/3209-workrooms.md:5 still says "Phase 1 shipped (protocol types + link parser in crates/protocol/src/workroom.rs)", and docs/WORKROOM_ARCHITECTURE.md / docs/WORKROOM_SECURITY.md list the deleted types as current protocol surface. This is exactly the reservation class the restore honored for OpEnvelope (codewhale-hq#5261 Phase A1). Either restore workroom.rs like its siblings, or update the three docs and the body — the current state is a false statement in the PR description.
5. Same-PR contradiction on the codewhale-hq#5261/codewhale-hq#5262 foundations. The restore returns the design placeholders (core/session.rs, core/journal.rs — "owns the current_leaf_id column in state.threads") and the session_tree appenders, while the sweep deleted the only working implementation of those semantics: StateStore::{fork_at_message, set_current_leaf_id, list_leaf_messages, clear_messages, delete_thread, find_thread_name_by_id}. The columns and migrations remain at HEAD (state/lib.rs:101,136,368-376,450-472) with no read/write API. Either restore the tree-op cluster (consistent with the PR's own reservation criterion) or explain in the body why codewhale-hq#5262 will re-implement rather than reuse them.
6. Reservation standard applied unevenly among #[allow(dead_code)] seams. Deleted and left deleted despite forward-looking markers: goal_loop.rs::is_success (doc cites "codewhale-hq#2666 token/time visibility" — the same issue the restore message cites for resource_telemetry), agent_card.rs::as_workflow_history_panel ("public codewhale-hq#4122 convergence API"; codewhale-hq#4122 references are still live at HEAD), and workflow/gates.rs::stopship_gate_pipeline (gates.rs header still says "Runtime execution and Lane status UI wire in later"; tests now carry an inline copy instead of the canonical constructor). Restore these or state per-item why they are exempt.
7. workflow/model_policy.rs (~660 lines) is restored with no traceable reservation. No Phase/#issue/follow-up marker anywhere in the file, zero consumers outside the pub use, no docs reference — the body's "(model-execution layer, follow-up wiring)" has no in-repo support. Contrast review_repair.rs, which carries #3832 in its header. Cite the concrete reservation or drop it from the restore.
8. Two live-behavior coverage pins lost. (a) grouping_key_collapses_shell_flag_variants was the only test of the documented v0.8.37 session-grant contract that approving cargo build also covers cargo build --release (build_approval_grouping_key, live at core/engine/turn_loop.rs:4629 and tui/approval.rs:185); survivors only pin the complement. Drift here is user-visible re-prompting or over-broad grants. (b) current_on_empty_chain_returns_default_provider was the only test of ProviderChain::current()'s empty-table unwrap_or_default() fallback (config/src/lib.rs:1514-1520); no surviving test builds an empty chain. Please restore both tests.

Should-fix (residue and accuracy)

9. Dangling intra-doc link [`crate::computer_meter`] plus stale metering prose in cloud_dispatch.rs:18-20 — will fail the scheduled cargo doc -Dwarnings job (not PR-gating, but it is this PR's residue; one hunk).
10. docs/examples/fleet-dogfood.toml:49 references the deleted config::resolve::SecretRef.
11. Restore-message inaccuracies: "SkillState consent filter" corresponds to nothing restored (the actual consent filter restored is mcp/external_import.rs::candidates_needing_consent; skill_state.rs was never touched), and "resource_telemetry … (Refs codewhale-hq#2666)" misattributes the ref (codewhale-hq#2666 lives in goal_loop.rs, which this PR deletes).
12. Body numbers: "Net: 201 files, −15,826/+690" is actually the sweep-commit churn (its net-deletion count 16,475−649=15,826; insertions are 649, not 690); the true net is 166 files, +513/−11,885. Per-crate counts measured at HEAD also don't match (config 631→640, protocol 75→76, workflow 211→233, cli "6"→359 total, tui 11899/2 vs 11898/3 here — the full-suite count is host-flake-sensitive; consider dropping exact numbers or annotating them).
13. tests/README.md still counts plugin_e2e_acceptance among the Gherkin runners, but its cucumber::World/steps were removed (the file is now plain PTY acceptance tests).

Non-blocking notes

• Coordination: landing this before #91 (preserve-thinking) creates a modify/delete conflict on tests/integration/reasoning_content_replayed_after_tool_call.rs (that PR adds two fields to the deleted file) plus a content conflict in client.rs; #54 (workspace-roots) conflicts in state/lib.rs, tools/approval_cache.rs, tui/approval/elevation.rs. No queued PR adds callers to any deleted symbol (verified against every branch delta), so both resolve mechanically — but worth a heads-up to those authors.
• Hook::{with_condition, with_timeout, background, with_name} moved behind #[cfg(test)]: parent-safe today (it sets fields directly), but a latent compile trap for future parent tests — worth a sentence next to the Hook::new claim in the commit message.
• WorkflowRunStatus::ReplayDiverged is now unconstructable (only producer was replay.rs); harmless and wire-conservative, but deserving of a comment.
• The sweep turns the crate-root pub const DEFAULT_FLEET_WORKFLOW_MAX_AGENTS into a module-private const in experimental_search.rs (value identical, sole consumer unchanged) — fine, but it is a pub-surface change inside a test-sweep commit and deserves a line in the body.
• Coverage nits accepted as-is, for the record: backoff .min(20) clamp branch (attempt ≥ 21) unpinned; compatible-template shadowing pin narrowed 5→4 templates (sensenova); ghost-text non-empty-input negative case; menu_style selected-row compositions; settings presentation defaults; invalid-parent-.git-marker edge.

What was verified and holds

C1/C2/C3 classifications for all 201 sweep files; zero non-test references at BASE for every net-deleted production item (workspace-wide, data-shape-first pitfalls hunted: serde arms, dispatch tables, registrations, fixtures, JS glue); zero parent-app and zero queued-PR consumers; restorations byte-identical to BASE except where the sweep's own test adaptations remain (no BASE-foreign content injected); no #[ignore]/env-gated tests deleted that actually asserted; fmt clean; both commit messages validate and carry DCO trailers. The no_new_privs pre-existing-failure claim is confirmed by direct reproduction at BASE.

Once items 1–8 are addressed (2 and 3 are body-only), this is close to mergeable — the underlying sweep is sound and useful.

[asto18089]

Round-2: all blocking and must-fix findings above are addressed (head 7cf5e2c)

CI is fully green on this push: check 14m12s including the --all-targets clippy gate, gate, link, CodeQL, all Analyze jobs.

Blocking fixes

• Removed the orphaned doc comment at tui/app.rs:855 (the empty_line_after_doc_comments clippy denial).
• Body's issue-link line is now the required No-Issue: <reason> format → link green.
• The remaining 7 lints fire at the base commit under the exact CI command on clippy 1.99 (verified at 0bc868ff0 in a scratch worktree), so check would have stayed red even after the residue fix. Fixed here as disclosed out-of-scope-but-blocking: print_stderr ×3 (the skip notices now write through writeln!(std::io::stderr()) — both tools/ and core/ deny both print lints for alt-screen safety), redundant_closure, clone_on_copy, chunks_exact_to_as_chunks, plus an #[allow(unused_imports)] on the user_theme glob for the integration harness crate — its last cfg(test) consumer there was the deleted palette/tests.rs, and its three sibling globs already carry the same allow. That one was deletion residue my original review missed; this round caught it via --all-targets.

Restoration completion (78161ae)

• protocol workroom module restored → docs/rfcs/3209-workrooms.md and docs/WORKROOM_*.md describe reality again.
• state session-tree ops restored with their cascade test and parity tail — the v0.9.5: extract the engine into crates/core + Thread/Session split codewhale-hq/Codewhale#5261/v0.9.5: session tree (append-only entry journal + /tree /branch /fork /resume) codewhale-hq/Codewhale#5262 placeholders no longer sit on top of a deleted implementation.
• stopship_gate_pipeline canonical constructor + re-export restored; the inline test copy is gone. (Needed the re-export back: the crate denies dead-code, and test callers alone don't keep a lib item alive.)
• goal_loop::is_success (telemetry: agents need visible token context and resource usage during long tasks codewhale-hq/Codewhale#2666) and the v0.9.0 2.5: route workflow events to panel and compact history card codewhale-hq/Codewhale#4122 convergence seam (DelegateCard::as_workflow_history_panel, WorkflowPanel::render_history_card/from_direct_subagent + tests) restored.
• Both lost coverage pins restored: grouping_key_collapses_shell_flag_variants (the documented approval session-grant family-collapse contract) and current_on_empty_chain_returns_default_provider (ProviderChain::current() empty-table fallback).
• WorkflowRunStatus::ReplayDiverged documented as wire-compatible-only.

Docs / accuracy (ee9a3df + body and commit-message edits)

• Stale metering paragraph + dangling [crate::computer_meter] link removed from cloud_dispatch.rs; fleet-dogfood.toml now cites the live FleetSecretRef; tests/README.md no longer counts plugin_e2e_acceptance among Gherkin runners.
• Restore-commit message corrected (external-import consent filter, #2666 misattribution) and model_policy's marker-less restoration disclosed there and in the body.
• Body numbers re-measured at this head: net 163 files, +449/−10,930; gates section now includes clippy on 1.99 + 1.98 with the exact CI command.

Verification at this head
cargo check --workspace --all-features clean; CI-command clippy clean locally on 1.99 and 1.98; fmt clean; per-crate tests green (config 641, protocol 85, state 25, workflow 233; tui 11,918 tests with only the 2 pre-existing no_new_privs failures — the remote_control/tools::pdf/agent_mail flakes observed under full-suite parallel load all pass in isolation at both BASE and this head).

Not applied, unchanged: the accepted coverage nits (backoff clamp, sensenova shadow pin, ghost-text negative case, menu_style compositions, settings defaults, invalid-git-marker edge), the CHANGELOG nit, and the #91/#54 rebase coordination (disclosed in the body; no queued PR adds callers to any deleted symbol).

[asto18089]

Fresh review of PR #102 (round-3 — full re-review from scratch)

Per review policy this round ignored all earlier conclusions and re-derived everything: base freshness check, a 9-lane adversarial re-review of the whole diff (body-vs-reality, hunk-level smuggling audit, both directions of the restoration audit, deletion-classification audit with a lost-coverage hunt, parent-app symbol impact, marker-claim verification with issue-tracker calibration, mutation verification of the restored pins, and a cross-check of all 13 other open PRs), plus local re-run of the gates.

Base freshness: pinvou3-clean is unchanged at 0bc868ff0 and the branch sat exactly on it, so no rebase was needed (base re-confirmed live via the API before review).

What held under fresh adversarial inspection

• The sweep's substance is real. All nine whole-file deletions and the sampled in-place deletions re-verified as C1/C2/C3 — including adversarial re-reads of the "tautology" claims (each deleted test's body was checked for self-derivation) and the C3 domination claims (survivor found, strictly stronger). A dedicated lost-coverage hunt over the ~205 truly-deleted test names found exactly one genuine loss (fixed below).
• No smuggled changes. All 163 then-changed files plus the 42 net-zero files were classified hunk-by-hunk; every one of the 449 added lines was checked against BASE. The only production-code edits are C2 cascades (behavior-identical at the base commit) and the disclosed demotions.
• Parent app unaffected. All 96 deleted pub symbols and all 8 deleted module/fixture paths grepped against pinvou3-app: zero compilable references. Conversely all 99 CodeWhale symbols the app actually imports verified present at the head; Hook::new is public and is the symbol the parent's bridge.rs test uses, exactly as disclosed.
• Restored code is faithful and alive. Every claimed restoration is byte-identical to BASE, linux-live, and legally kept alive under the workspace warnings = "deny"; workroom docs, v0.9.5: extract the engine into crates/core + Thread/Session split codewhale-hq/Codewhale#5261/v0.9.5: session tree (append-only entry journal + /tree /branch /fork /resume) codewhale-hq/Codewhale#5262 placeholders ↔ state-tree ops, and the v0.9.0 2.5: route workflow events to panel and compact history card codewhale-hq/Codewhale#4122 chain are internally consistent.
• The restored pins bite. Mutation-tested: current_on_empty_chain_returns_default_provider (empty-chain default swapped → red), stopship_gate_pipeline (spec dropped → red; board_persists_for_lane_status separately pinned via status_summary mutation → red), grouping_key_collapses_shell_flag_variants (collapse removed → red, plus its companion denial-key pin). All reverted cleanly.
• No queued PR collides. Added lines of all 13 other open PRs grepped against the full deleted-symbol inventory: zero references; the fix(tui): preserve thinking across turns #91/feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54 conflict disclosures in the body are accurate.
• The "pre-existing at BASE" clippy claim is true. Running the CI gate command at 0bc868ff0 fails with exactly the seven instances the commit describes; at the PR head it is clean on both clippy 1.99.0 and 1.98.1.

Findings (all fixed in this push, head 23ba93310)

1. MAJOR — reservation pair torn: the sweep deleted fleet/store.rs::load_fleet + FleetStoreError::Ambiguous + their ambiguity test ("Kept for the qualified-name flow" marker) while the UI-side half of the same reservation survives, marker-intact (fleet_list.rs: "OpenDetail/None are reserved for the qualified-name flow"). Undisclosed. → Restored byte-identical.
2. MAJOR — misclassified C3: ghost_text_hidden_when_input_not_empty pinned the negative arm of a live render branch (suggestion must not render over non-empty input); no surviving test covers it, so a regression rendering ghost text over user input would pass CI. A negative path is not "subsumed" by a surviving positive test. → Restored.
3. MINOR — reservation-standard consistency: CALM_PERSONALITY + its precedence entry + the v0.8.56: Slim the default prompt path toward Codex-parity input tokens codewhale-hq/Codewhale#2953 decision pin were deleted while Personality::Calm remains selectable at this head (same class as the #NNN pins the PR restored); and WhaleState::priority carries the same "public contract for surfaces that fold several children into one whale" formula as the restored for_shell_phase. → Both restored byte-identical.
4. MINOR — v0.9.0 2.5: route workflow events to panel and compact history card codewhale-hq/Codewhale#4122 seam under-pinned: the sweep had rewritten five scenario tests into inline replicas of render_history_card; the restoration restored the constructor but not its original scenario callers. → Reverted to the real calls (assertions unchanged; six seam tests green).
5. MINOR — clippy-commit message accuracy: the user_theme allow's stated justification ("the deleted palette/tests.rs smokes were its last consumer") doesn't match the tree, and the commit also contained the sweep-introduced tui/app.rs doc-comment removal unnamed. → Message rewritten to state what the commit actually contains and the verified mechanism (the integration-test target #[path]-includes src/palette/mod.rs; the re-export has no in-crate consumer there — necessity re-proven by removing the allow and watching the gate go red).
6. Disclosure gaps now covered in the body: the underwater deletion's cross-file cascade (top_bar_chip/v0.9.4: move persistent Workflow status from the composer area to the top status bar codewhale-hq/Codewhale#5040, docs(changelog): record keyless Bing search tail #39/fix(config): 严格直连 provider 大小写不敏感匹配自身目录行 #14 chips — this PR is the "deletion is its own slice" that header deferred), the v0.7.7: make spend/cost display monotonic and source-backed codewhale-hq/Codewhale#244 wrapper deletions (their monotonicity invariant survives with its own regression pins) and the push_pending_steer/drain_pending_steers producer-drain asymmetry, the display_message C2 cascade, the ~20 pin re-points inside the sweep commit, and an erratum for the sweep commit's "cli 6" miscount.

Refuted after investigation (no action): deleted user-commands/remote-setup/core-request/fleet-host-census tests (tautologies, no-assertion smokes, or strictly dominated by surviving stronger tests), resolve.rs "stale doc promising deleted machinery" (the doc was already cleaned), "off-by-one" in "7 pre-existing lints" (seven instances across six lint patterns, confirmed at BASE), ModelFamily/DynamicToolItemStatus/fragments deletions (zero callers, zero wire-round-trip exposure).

Gates at this head (all re-run locally)

cargo clippy --workspace --all-targets --all-features --locked -- -D warnings clean on 1.99.0 and 1.98.1; rustfmt clean; codewhale-tui --lib 11,922 tests: 11,903 passed + 13 ignored, the only failures being the 2 documented no_new_privs host failures (fail identically at 0bc868ff0) and 4 remote_control load flakes that pass in isolation here (re-verified); the restored tests all pass (ambiguity round-trip, ghost-text negative arm, codewhale-hq#2953 pin, priority ordering, five render_history_card scenarios); commit messages validate (subject ≤50, DCO).

Remaining non-blocking note for follow-up: model_policy stays restored-without-marker as disclosed; when its wiring PR lands it should carry a real #[allow(dead_code, reason = …)] reservation marker so the next sweep's C2 rule cannot eat it again.

[asto18089]

Fresh from-scratch review — round-4 (12 lanes, BASE 0bc868ff0 → HEAD 23ba93310)

Per policy this round ignored all earlier conclusions and re-verified the PR from zero with 12 independent lanes (6 per-area deletion-verification lanes + 6 cross-cutting lanes). Everything below was re-established from the trees and APIs this round; prior-round statements were not relied on.

Rebase check: pinvou3-clean tip is still 0bc868ff0 — identical to this PR's base, and the head sits exactly on it, so there is nothing to rebase.

What this round verified (evidence summary)

• Collision census. 188 net-deleted public/crate symbols were grepped as added code against all 14 other open PRs in this repo (including #103, opened after the round-3 push), all 20 open PRs in Pinvou/pinvou-agent, and both repos' main tips: zero references. Every generic-word hit was individually classified (e.g. #90's GithubTool::alias targets the surviving constructor; only AutomationTool::alias/TasksTool::alias were deleted). The disclosed #91 modify/delete and #54 three-file content conflicts are real, and no other open PR touches those five paths. The body's "13 other open PRs" is now 14 — still zero collisions.
• Behavior safety. All 384 added lines were enumerated and classified — zero unclassified. Every deleted production item was re-proven production-unreachable at BASE by full caller census (including the OverrideSource::ProviderReportedContextWindow serde chain: ReadyRouteCandidate deliberately does not derive Deserialize, so no persisted artifact can ever carry the removed tag). Performance neutral (route resolution actually loses one dead branch + one Utc::now()).
• Restoration fidelity. All 12 whole-file restores, ~46 partially-restored items, and the 5 re-pointed workflow_panel scenario tests were mechanically diffed against BASE — byte-identical, with exactly one exception (N1 below).
• Gates reproduced locally at this head (clippy/rustc 1.98.1): cargo check --workspace --all-features --locked clean (0 warnings); the CI clippy command (--workspace --all-targets --all-features --locked -- -D warnings) clean; cargo fmt --all -- --check clean; commit-message validation clean; per-crate test counts exact for config 641 / protocol 85 / execpolicy 119 / mcp 76 / secrets 62 / state 25 / workflow 233 / workflow-js 85 / agent 63 / app-server 106; tui --lib = 11,922 run / 13 ignored with exactly the 2 claimed stable no_new_privs failures (all other flakes pass in isolation).
• Smuggling. 0 added files, 0 renames, 0 mode changes, 0 submodule/gitlink changes; Cargo.toml/lock, CI workflows, VERSION, toolchain untouched; no whitespace/unicode concealment (checked via --ignore-all-space delta, NBSP/CR/BOM scans); every hunk of ee9a3dfc8 and 197e7bfcf maps to its commit message; all 6 commits authored/signed by the PR author.

The sweep's core value is real: the workflow-crate C2 cluster (incl. marker-free replay.rs), the sanctioned computer_meter deletion, the underwater cascade (genuinely invisible at BASE — #[allow(dead_code)]-gated, zero callers outside its own test module), the wired-evidence-dead integration tests, and the C3 subsumption calls this round re-verified all hold.

Required before merge

R1 — Undisclosed deletion of the provider-reported context-window seam (route_runtime.rs + config + 15 locales + tests).
The sweep deletes, in commit 638afb053: ContextWindowSource::ProviderReported, ProviderReportedKimiCodeContext + KIMI_CODE_REPORTED_CONTEXT_MAX_AGE_HOURS, the provider_reported_context parameter from resolve_route_candidate_with_context_metadata / ..._and_host_limits / plan_limit_overrides (production signatures), OverrideSource::ProviderReportedContextWindow (a pub serde variant in the config lib crate), the ProviderReported arm in status.rs::context_window_source_label, MessageId::StatusContextSourceProviderReported plus the key in all 15 locale files, and both tests — including the negative safety pin asserting stale (>24h) metadata falls back safely to StaticKimiCodeSafeFloor.
None of this is mentioned in the body or any commit message (grep: 0 hits for ProviderReported / provider_reported_context / locale). The behavior impact is zero — every BASE producer passed None; only #[cfg(test)] constructed the value — but by this PR's own precedents (model_policy.rs restored without a marker as staged work; system_prompt_for_mode_with_context restored for PR #90; the codewhale-hq#5766 route catalog restored), a documented forward-compat seam — its own doc says "an authenticated model-listing consumer may pass this value" — gets restored byte-identically or an explicit, justified disclosure. It got neither. The lost stale-metadata negative pin is also exactly the negative-arm class round-3 itself restored for ghost-text.
Fix: restore the whole cluster byte-identically (preferred — it is staged-seam code), or add a commit + body section disclosing and justifying the deletion with the same rigor as the model_policy erratum.

R2 — working_set.rs codewhale-hq#1921 negative-arm gate test deleted, but the tested gate survives.
should_try_local_reference_completion_skips_bare_separators_and_dots ("Regression for codewhale-hq#1921") was deleted, yet the tested fn should_try_local_reference_completion survives at HEAD (working_set.rs:798) and no surviving test calls it: the only remaining neighbor covers the bare-/ end-to-end path; nothing covers ., .., \\, "", or the positive needle arm. It fits none of C1/C2/C3 — not never-run, the fn was kept (so not C2), and no surviving test is an assertion superset (so not C3). This is the same misclassification class round-3 restored for ghost_text_hidden_when_input_not_empty.
Fix: restore the test byte-identically from 0bc868ff0 (working_set.rs:2423).

Recommended (small; fold into the R1/R2 fix commit)

• N1 prompts/text.rs — the sweep deleted the module-doc line "2. Personality overlay (CALM_PERSONALITY …)" and renumbered the list; commit 23ba93310 restored the const, precedence entry and codewhale-hq#2953 pin but not this line, while claiming "Restorations are byte-identical to the pre-sweep state". Restore the line (and renumbering) so the CALM cluster is truly byte-identical.
• N2 Body — "AuthenticationErrorDetail::display_message now clones message" names a method that does not exist at BASE or HEAD; the real method is to_user_message. Substance of the disclosure verified true (zero production AuthenticationErrorContext constructors at BASE); fix the name.
• N3 Body/erratum — "cli 359 executed at this head" is not reproducible: measured cargo test -p codewhale-cli --all-features = 380 executed, 0 failed, 0 ignored (350 lib + 30 integration; all 22 cfg-gated attrs are true on Linux). The gate is green either way; correct the number (359 likely came from a host where the 21 #[cfg(unix)] tests don't compile).
• N4 command_safety.rs — the deleted pins were the only tests exercising classify("git status"…) rows of the tui-local arity table whose doc calls itself a "central invariant"; the survivor pins only the git push row (different row → not a literal C3 superset). Restore one combined git-status classify pin.
• N5 provider_templates.rs — the deleted shadow-guard test was the only place asserting ProviderKind::parse has no sensenova id; the surviving enumeration covers 4 of 5 templates. Re-add the single assertion.
• N6 crates/core/src/fragments.rs — FragmentCapError::TooManyFragments is now unconstructable (its producer validate_fragment_set was C2-deleted). Delete the variant or state the error contract is kept whole.
• N7 git_status.rs — chrome_label/chrome_ink lost their sole caller (the deleted classic header) and are now test-only-dead with no reservation marker — the same C2 rule that deleted their sibling top_bar_chip. Delete them or disclose the keep.
• N8 Body — "this PR is the deletion slice that header deferred" is overbroad: ShellPhase::color still carries the identical "deletion is its own slice" marker at HEAD with only test callers. Delete it too or soften the sentence.

Notes (non-blocking)

• The tui flaky-list enumeration is incomplete: this run also flaked tools::dev_server_readiness::reports_last_http_status… and tui::clipboard::tmux_helper_reports_command_failure under load (both pass in isolation; the substantive "only stable failures are the 2 no_new_privs tests" claim verified true).
• tests/cucumber/main.rs:2-7 still says "six feature runners / six link jobs"; README correctly says five.
• All 6 commits carry a second Signed-off-by: asto <asto@users.noreply.github.com> trailer beside the matching one — harmless, but the base-branch norm is a single trailer.
• The skills pin re-point quietly widened mod package_digest to pub(crate) — mechanical and behavior-neutral, but worth naming in the re-point disclosure.
• Hotbar registry metadata-contract invariants (id uniqueness, label/width bounds) are no longer asserted anywhere after the C2 wrapper deletion — optional to re-express directly against action.metadata(locale).
• The rewritten auth-envelope test's !contains("tp-secret…") assertion is now trivially satisfied (fixture is pre-redacted); a fake raw key in the fixture would keep the negative arm meaningful.
• "~120 LIKELY/FLAG-level findings" and "240-agent audit" have no artifact backing (not contradicted either); codewhale-hq#5766 backs the route-catalog restore only via CHANGELOG; "wire it or delete it" is a paraphrase of "it must be deliberately wired as a local self-check or deleted".

Verdict

The PR does real, verifiable work and this round could not refute its core: every gate reproduces green, every restoration but one is byte-identical, nothing is smuggled, no consumer in flight breaks, and behavior is provably unchanged. Two required items remain — R1 (restore-or-disclose the provider-reported seam cluster) and R2 (restore the codewhale-hq#1921 negative-arm test) — plus small accuracy fixes N1–N8. With those landed this is ready to merge.

[asto18089]

Round-4 fixes: all required and recommended findings addressed (head 361d99f0e)

The fresh 12-lane re-review found two required gaps and eight smaller ones; all are fixed in four commits on this push, and the body now carries a "Review round-4 fixes" section:

• R1 — provider-reported context seam restored byte-identically (aac008a71). ContextWindowSource::ProviderReported, ProviderReportedKimiCodeContext + freshness const, the provider_reported_context parameter threading (including the None at all five production call sites), OverrideSource::ProviderReportedContextWindow, the status.rs rendering arm, MessageId::StatusContextSourceProviderReported with its key in all 15 locales, and both tests including the stale-metadata-falls-back-safely pin. Every restored file is now net-identical to pinvou3-clean@0bc868ff0 (the duplicate missing-marker locale test stays deleted).
• R2 — type @/ and the TUI freezes and cannot be exited codewhale-hq/Codewhale#1921 negative-arm gate test restored (77d979770), together with the four git-status classify_command row pins (N4) and the prompts/text.rs CALM module-doc line (N1) — all byte-identical; those files are likewise net-identical to base now.
• N5–N8 — C2 cascade edges completed (5bfa7892f). The sensenova shadow assertion re-pointed onto the surviving sensenova test; FragmentCapError::TooManyFragments deleted (unconstructable after its producer's C2 deletion); git_status::chrome_label/chrome_ink and their six pins deleted (orphaned by the sweep while their sibling top_bar_chip was deleted); ShellPhase::color + phase_ink + their test deleted — the last items carrying the classic-header "deletion is its own slice" sanction, so that kept-deleted claim is now literally complete. Stale "six runners" harness comment corrected (361d99f0e).
• N2/N3 + note-level items, body-side. to_user_message (correct method name), cli erratum and gate table corrected to 380 executed (re-measured on Linux), open-PR census updated to the current 14 (re-checked: still zero added-code references to any of the 188 net-deleted symbols across all 14 CW PRs, 20 open parent-repo PRs, and both main tips), the real computer_meter sanction quote, the package_digest pub(crate) widening named in the re-point disclosure, the flaky-test list marked illustrative, and net stats updated (136 files, +384/−10,715).

Gates re-measured at this head: the CI clippy command (--workspace --all-targets --all-features --locked -- -D warnings) clean; cargo fmt clean; commit-msg validation and DCO clean; per-crate cargo test --all-features: config 641, protocol 85, execpolicy 119, mcp 76, secrets 62, state 25, workflow 233, workflow-js 85, agent 63, app-server 106, cli 380 — all green; codewhale-tui --lib 11,920 tests (13 ignored) with only the 2 stable environmental no_new_privs failures — the other full-suite flakes (remote_control ×2, tools::pdf bounds) re-verified passing in isolation, and every restored/re-pointed pin re-run green individually.

[asto18089]

Fresh from-scratch review — round 5 (10 lanes + local gate reproduction, BASE 0bc868ff0 → HEAD 361d99f0e)

Per policy this round ignored all earlier conclusions and re-derived everything. Base freshness: pinvou3-clean is unchanged at 0bc868ff0 (verified via fetch and the branches API) and this branch sits directly on it (merge-base = base tip), so the rebase requirement is satisfied as a verified no-op; GitHub reports MERGEABLE/CLEAN. Today's PR set: 13 other open CW PRs (#90 merged 2026-10-12), 17 open parent PRs.

What this round verified as solid

• Gates all reproduce at this head. cargo fmt --check, the CI clippy command (--workspace --all-targets --all-features --locked -- -D warnings), and cargo check --workspace --all-features are clean. Per-crate executed counts match the body exactly: config 641, protocol 85, execpolicy 119, mcp 76, secrets 62, state 25, workflow 233, workflow-js 85, agent 63, app-server 106, cli 380 executed (I initially under-counted cli at 375 due to a truncated log and tui at 11,899 due to a missing --all-features; both re-measured correctly — the body's numbers are exact). codewhale-tui --lib --all-features: 11,920 tests, 13 ignored; the only failures are the 2 no_new_privs child-process tests (environmental on this host — the container forces NNP=1 on children) plus 5 in the disclosed timing-flake family, all of which pass in isolation (77/77 remote_control::* filter re-run green).
• No smuggling. The diff touches nothing outside crates/ and docs/ (no .github, scripts/, Cargo.toml/lock, gitlink, added files, or renames). All 384 added lines classify into restore/doc/lint/re-point buckets; the two production rewrites (tools/tasks.rs, tools/automation.rs forced_action/alias removal) were extensionally verified equivalent twice, independently (forced_action was #[cfg(test)]-only at BASE, private fields, production constructs only via new/read_only).
• Restores are honest. 73 files were touched by intermediate commits and reverted: all 73 net-diff byte-identical to BASE (exhaustive, not sampled), covering every byte-identity claim in the body including the 15 locale files.
• Zero collisions. 539 distinctive deleted symbols intersected against all 13 other open CW PRs (against pinvou3-clean, not main) and all 17 open parent PRs (95k+ added lines, per-file patches for codewhale-hq#507 which exceeds the diff-size cap): zero references to any deleted symbol. The disclosed #91 modify/delete and #54 three-file conflicts are real and precisely named; #54's only lexical hit (user_message) resolves to a helper #54 defines in its own diff.
• Parent boundary clean. The parent app reaches CW via four path deps and uses only Hook::new/HookExecutor::new — both alive; the #[cfg(test)]-moved builders have no external callers. The hooks disabled() → HooksConfig::default() re-point is behavior-identical (serde default_enabled feeds only the Deserialize missing-field branch; derive(Default) still yields enabled == false).
• Security/error-path pins survive. execpolicy deny/ask machinery untouched (deleted tests were constructor-duplicates); secrets lost only a byte-identical duplicate; snapshot safety classifications, redaction, and the live fragment-ceiling path (world_state.rs::validate_caps + runtime-contract script) keep their pins; a verifier lane re-derived 16 of the riskiest C1/C2/C3 verdicts from scratch and 15 held (the 16th is Recommended item 4 below).
• Body truthfulness. All 43 substantive claims audited: every verbatim quote is verbatim, every checkable number checks out (7 base-commit lint instances, five None call sites, three drain_pending_steers sites, six chrome pins, five scenario re-points, all named tests present at HEAD). No false claim found.

The sweep's core — deletions are mechanically justified, restorations are complete for everything this PR's own standard caught — remains intact after a fifth independent pass. Two reservation-class gaps survive, same class as the ones rounds 1–4 already fixed:

Required

R1 — Undisclosed reservation-class deletion: the network_policy Prompt-approval seam (crates/tui/src/network_policy.rs).
The module header — kept verbatim at HEAD — says the helpers are "exposed for future slash-command wiring (/network allow <host>, /network deny <host>) and for the approval-modal hook … until those call sites land" under a module-level #![allow(dead_code)]. This PR deleted exactly that staged write-side (~95 lines + 5 tests): NetworkPolicy::add_allow, NetworkSessionCache::approve/deny, NetworkPolicyDecider::approve_session/deny_session/approve_persistent, NetworkDenied + host(). Left behind: is_approved/is_denied (HEAD :382/:392) and the evaluate short-circuits (:502/:506) reading cache state no code can write anymore, an audit-doc format naming Prompt-Approved/Prompt-Denied records nothing can produce, and a PR-edited module doc line describing the now-hollow cache. No open PR lands the caller (checked), so this is not a collision — it violates the PR's own standard: the reservation language is the repo's canonical form, and the PR restored the identically-shaped resource_telemetry PressureLevel seam (module-level allow, no caller) and model_policy (disclosed marker-less). Fix: byte-identical restore, or disclose it like model_policy and complete the cascade (readers, Prompt arm, audit docs, header).

R2 — Undisclosed reservation-class deletion: ShellManager::remember_stale_job (crates/tui/src/tools/shell.rs, BASE :3420).
#[allow(dead_code)] pub fn whose doc states its purpose — "Remember a restart-stale job so the UI can show it instead of hiding it" — the same allow-plus-intent formula the PR honors elsewhere (WhaleState::priority, for_shell_phase "no consumer in this lane yet"). It is the sole writer of stale_jobs, and the read side is live production code at HEAD: inspect_job's stale arm (:3229), list_jobs merging stale entries (:3261), job_status_rank (:3263) — now reading a map that can never be populated. Neither the body nor any commit message mentions it. Fix: restore fn + its trimmed test portion byte-identically, or disclose with a removal sanction equal to computer_meter's header (and then the inert read side wants a look too).

Recommended

1. set_pinned_model_label (settings.rs, BASE :2103, #[allow(dead_code)] // label editing surface is exposed through settings serialization first) — C2-defensible (only test caller; label display + serde round-trip live on; no queued caller), but a marker-carrying deletion the body's "cross-checked every deletion against in-code reservation markers" claim should cover. One disclosure line (or the 18-line restore).
2. NetworkPolicy-adjacent smaller seams, same hygiene: cloud_dispatch::should_auto_confirm ("Codewhale may propose, but never confirm itself" — constant-false, behavior-identical removal, undisclosed) and the marker-carrying live_transcript::{set_tail_mode, mode()} / hooks::executor::is_enabled deletions — a one-line collective disclosure keeps the body's audit claim exact.
3. Body accuracy pack: (a) Summary still says "two review rounds" while the body carries a round-4 section; (b) "14 other open PRs"/"20 open parent-repo PRs" are now 13/17 and "(called by open PR #90)" — #90 is merged (which strengthens that restore's justification); (c) "the same snake_case assertions" is 3-of-4 ("on_failure":"abort" pinned the deleted FailurePolicy — nothing live is unpinned); (d) the 5bfa789 message says chrome_label/chrome_ink were "unmarked" (git_status.rs carries a pre-existing module-wide allow) and that color/phase_ink "both carried the classic-header sanction" (only color did; phase_ink is sanctioned transitively); (e) DEFAULT_FLEET_WORKFLOW_MAX_AGENTS had two other base-commit consumers, not one (the second was a test the sweep also deleted).
4. One escaped assertion pin (found by re-deriving the C3 verdicts): deleted routed_zai_child_never_claims_api_dollars_without_full_route_config was the only pin of BillingPresentation::Unknown.label() == Some("unknown") (route_billing.rs BASE :1616); the fail-closed money-safety assertions it also carried are fully covered by the unchanged child_route_billing_fails_closed_for_every_ambiguous_provider. Append the one-line label() assertion to that survivor or restore the 15-line test.
5. Residue cleanup missed two stale doc references to the deleted apply_spillover (tools/subagent/mod.rs, "mirroring apply_spillover" / "apply_spillover's passthrough posture") and tools/automation.rs's surviving test name aliases_hide_from_model_and_force_action (assertions valid; the alias machinery they name is gone).
6. One-sentence disclosure for the replay cascade into js_authoring.rs: deleting replay.rs also removed javascript_example_compiles_and_replays_with_mock_trace; compile coverage survives via the unchanged TUI end-to-end fixture test — worth naming.

Non-blocking notes

• deterministic_backoff_ms lost its only (assertion-free) attempt-63 panic canary — one assert! on a surviving backoff test would restore it; WorkflowRunStatus::ReplayDiverged is kept wire-compat-only correctly, but its snake_case spelling is unpinned — one line in control_node_result_serialization would enforce the new doc's promise.
• The tautological-class deletions did drop some exact-value display pins (hotbar compact-label strings, menu_style style trios); each deleted test restated its subject line-for-line, so this is polish, not a regression gate.
• AgentRunSnapshot remains zero-producer after job_record_to_agent_run was C2-deleted — fine: its module doc is an explicit staging reservation ("Consumers arrive with later slices").
• GitStatusSnapshot::{ahead, behind, repository_name} now have zero production readers (their only reader was the deleted chrome_label); the module-level "worktree manager wiring continues" marker covers them — flagged only for completeness.

Verification method

10 lanes from scratch (classification/smuggling; whole-file deletions; fix-wave commit audit; reservation + open-PR collision census across both repos; per-area deletion justifications for workflow / tui-presentation / tui-services / small crates; body-claims audit; adversarial verifier re-deriving the riskiest 16 verdicts), plus first-hand local gate reproduction (fmt, the exact CI clippy command, check, all 12 per-crate executed counts, isolation re-runs of every failing tui test). The two Required findings were verified directly against the BASE and HEAD trees, not taken from lane reports on faith.

[asto18089]

Round-5 fixes: all required findings restored, recommendations addressed (head a799485fb)

The fresh 10-lane round-5 review found two required reservation-class gaps; both are closed with byte-identical restores, and every recommendation is either fixed in code, disclosed in the body, or recorded as an erratum. Six commits:

• eb5b94eb7 — network_policy Prompt-approval seam restored byte-identically (R1): the staged write side (NetworkPolicy::add_allow, NetworkSessionCache::approve/deny, NetworkPolicyDecider::approve_session/deny_session/approve_persistent, NetworkDenied + its five tests) returns; the file's net diff against pinvou3-clean@0bc868ff0 is now empty, so the module header's /network allow|deny reservation and its read side are whole again.
• 0be0fea7f — ShellManager::remember_stale_job restored byte-identically (R2), including the trimmed portion of test_job_list_poll_cancel_and_stale_snapshot; the live stale_jobs readers have their writer back.
• af5195fa5 — the escaped BillingPresentation::Unknown.label() == Some("unknown") pin re-pointed into child_route_billing_fails_closed_for_every_ambiguous_provider's loop.
• 941abddcb — two hardening pins: attempt-63 backoff saturation canary (the deleted test was the only check that the retry path stays finite at high exponents) and the ReplayDiverged snake_case round-trip pin enforcing the wire-compat doc.
• d45f7eaa4 — the two stale apply_spillover doc references in tools/subagent/mod.rs dropped.
• a799485fb — the two alias-era tests in automation.rs/tasks.rs renamed to their real subject; GithubTool's twin keeps its name (its alias machinery is live and still exercised).

The four smaller marker-carrying deletions the review flagged (set_pinned_model_label, cloud_dispatch::should_auto_confirm, live_transcript::{set_tail_mode, mode()}, hooks::executor::is_enabled) are disclosed in the body's Disclosures section rather than restored — each had only test callers at the base commit and its marker describes present or possible usage rather than named future wiring. The body also gains a "Review round-5 fixes" section, the accuracy corrections (review-round count, PR-count refresh with #90 now merged, 3-of-4 snake_case wording, two-not-one former const consumers), and the 5bfa7892f message erratum.

Gates re-measured at a799485fb: fmt clean; the CI clippy command clean; workflow still 233 (assertion-only changes); codewhale-tui --lib now 11,925 tests (13 ignored) — the five restored network_policy tests join the suite — with only the 2 environmental no_new_privs failures plus the disclosed flake family (all 3 of today's flakes re-run green in isolation). The PR is now 134 files, +405/−10,523.

[asto18089]

Round-5 fixes rebased onto the advanced base (head cefcca1df on pinvou3-clean@3118c36b8)

While the round-5 fix wave was in flight, pinvou3-clean advanced to 3118c36b8 (merged: #90, #91, #97, #98, #93 — including the #91 modify/delete the round-4 section had predicted). The branch is rebased onto that tip; the body is updated with a "Rebase onto the advanced base" bullet.

Conflict resolution (one real conflict, one modify/delete):

• client.rs: fix(tui): preserve thinking across turns #91's field additions to chat_messages_keeps_valid_tool_calls_intact collided with this PR's deletion of it (C3: near-byte duplicate of the pre-existing chat_messages_include_tool_results_when_call_present). The deletion stands — the survivor exists unchanged at the new base and drives the same Thinking+ToolUse+ToolResult scenario with the same tool_calls.is_some() assertion.
• tests/integration/reasoning_content_replayed_after_tool_call.rs (modify/delete): deletion stands. fix(tui): preserve thinking across turns #91's change to the deleted file was the mechanical redacted_data/reasoning_details field addition to the Thinking literal, and the subsuming survivor reasoning_replay_required_on_subsequent_turn in integration_mock_llm.rs carries the same update — the C3 rationale holds at the new base.

Rebase verification: a whole-tree retention check confirms every line the five merged PRs added survives at this head — 19 files intersect both diffs; in 18 of them zero base-added lines are missing, and the only absent lines are #91's field updates inside the deliberately deleted test file, whose survivor retains them. The restored files (network_policy.rs, tools/shell.rs + its tests, model_policy.rs, and the rest of the reservation set) are untouched by the merged set and remain net-identical to their base state. The collision census holds against the current set (9 other open CW PRs, 17 open parent PRs).

Gates re-measured at cefcca1df: fmt clean; the CI clippy command (--workspace --all-targets --all-features --locked -- -D warnings) clean; per-crate executed counts: config 641, protocol 86 (+1 from the merged set), execpolicy 119, mcp 76, secrets 62, state 25, workflow 233, workflow-js 85, agent 63, app-server 106, cli 380 — all green. codewhale-tui --lib is now 11,996 tests (13 ignored) — the merged set's new tests join the suite, and a pleasant side effect of #98's ratchet-aware no_new_privs matrices: they now detect the kernel-pinned NNP in this container and skip, so the suite has no stable failures here anymore — only the known timing-flake family, both of today's flakes re-run green in isolation. Diff vs the new base: 134 files, +400/−10,524.

[asto18089]

Fresh from-scratch review at the rebased head b2207cb (branch rebased onto pinvou3-clean@3118c36b8 and pushed; rebase notes at the end). Method: eight independent verification lanes over the net diff — C1/C2/C3 deletion re-verification (every significant deletion, not sampled), restoration byte-identity against 0bc868ff0, a full added-line smuggling sweep, kept-deleted claim verification, reservation/collision census against all nine other open PRs, rebase-interaction audit against the five newly landed base commits (#90/#91/#93/#97/#98), plus local gate reproduction — with the load-bearing findings re-verified by hand.

What held (the core of the PR is sound)

• C1/C2/C3 re-verification: ~99% of the applied deletions are genuine. Every significant C1 deletion re-verified as never-run/tautological/self-mirroring (cache_guard, plugin_e2e substance, coordination_acceptance, qa_harness/view_log, eval/shell_dispatcher/mcp/turn_loop/tideline cfg(test) copies, the hand-built-request reasoning_content integration test, ~30 mixed files). Every C2 production deletion re-verified as zero-consumer at base with complete cascades (replay.rs, workflow IR/VM/fleet-shape clusters, computer_meter, underwater classic header, fragments cluster, ModelFamily, AuthenticationErrorContext cluster, config resolve engine, network_policy mutators, fleet strict loaders, tools alias plumbing, ~40 smaller items) — behavior-preserving, no dangling references, no registration side effects lost. All 13 checked C3 duplicates are strict assertion-subsets of survivors.
• Restorations are byte-identical to 0bc868ff0 (verified per item, including the provider-reported context seam across 15 locales and five None call sites); the model_policy.rs no-marker exception is disclosed accurately; rebase-forced deltas are exactly the mechanical fix(tui): preserve thinking across turns #91/fix(engine): 为终态事件保留原始回合及提交归属 #97 field additions.
• No smuggling in scope terms: the net diff touches only crates/** and one example doc; no Cargo/lockfile/CI/script changes; every production-region addition is a disclosed clippy one-liner or test re-point.
• Collision census clean: none of the nine other open PRs (feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54, refactor(skills): export install safety primitives #81, feat(memory): refuse sensitive notes at write time #82, feat(automation): archive terminal runs on delete #85, feat(execpolicy): builtin sensitive-path safety ruleset #87, fix(model): 保持账户路由逻辑调用在重试中的幂等身份 #92, fix(session): Windows 会话导出探测失败关闭 #96, fix(kimi): repair empty items instead of dropping #101, fix(tui): scope checkpoint recognition by era #103) adds a caller/reference to any net-deleted symbol (all raw grep hits triaged to prose/locals/self-defined helpers).
• Rebase interactions clean: all 23 fix(tui): preserve thinking across turns #91-added tests, and the fix: align model-facing text with engine reality #90/fix(tui): align provider doc conformance guards (sampling, Gemini signature gate, DeepSeek note) #93/fix(engine): 为终态事件保留原始回合及提交归属 #97/test(sandbox): ratchet-aware NoNewPrivs child matrices #98 additions, are present and intact at the rebased head; the sweep touches none of their modules. Gates at this head: cargo check --workspace --all-features clean; cargo clippy --workspace --all-targets --all-features --locked -- -D warnings clean; per-crate suites green. The two stack overflows seen under full-suite parallel load on this host (cli_telemetry_acceptance_is_versioned_and_reuses_settings_persistence, the acp_server::tests family) reproduce identically on the unmodified base 3118c36b8 in a scratch worktree — environmental, not introduced.

Two findings block approval, both cheap to fix; the MINOR list follows.

MAJOR

M1 — four deleted menu_style.rs pins are not worthless by any of the PR's own three classes. selected_row_style_is_the_canonical_trio, selected_row_variants_keep_the_shared_background, disabled_selected_row_is_muted_ink_on_elevated_surface, theme_variant_uses_the_previewed_themes_own_tokens are plain runnable lib-target tests with real assert_eq! exact-value assertions over live, wired production fns (selected_row_style → context_menu.rs, command_palette.rs, feedback_picker.rs; selected_row_style_with_fg → provider_picker.rs ×10+, worktree_manager.rs; disabled_selected_row_style → model_picker.rs). No surviving test dominates them — the module's only remaining selection-related assertion is the assert_ne! inequality in hovered_row_is_elevated_band_without_selection_ink. Restatement-of-constants cannot be the justification either, because the same module keeps exact-value style assertions of the identical class (assert_eq!(hovered, Style::default().bg(palette::SURFACE_ELEVATED)), status_tones_are_palette_status_tokens), and the PR restored the same-class git-status row pins, WhaleState::priority ordering pins, and the CALM_PERSONALITY precedence pin. Please restore these four (byte-identically) or state the classification that applies.

M2 — three deletions carry in-code reservation markers at base yet were neither restored nor disclosed, violating the PR's own reservation-audit claim. This is the same class the round-3/round-4 passes treated as required fixes:

• LiveTranscriptOverlay::set_tail_mode (base live_transcript.rs:166): #[allow(dead_code)] // exposed for callers that retain an overlay across a backtrack cancel; current UI just pops the view. — forward-looking, plus its pin set_tail_mode_re_arms_sticky went with it. (Sibling mode()'s "consumed only by tests" marker is C2-admissible; this one is not.)
• Settings::set_pinned_model_label (base settings.rs:2103): #[allow(dead_code)] // label editing surface is exposed through settings serialization first — staged-sequencing reservation; the surviving pinned-models test was also edited to drop its assertion.
• HookExecutor::is_enabled (base hooks/executor.rs:1614): #[allow(dead_code)] // Public API for hook system consumers — the same public-contract reservation formula the PR used to restore WhaleState::priority.
  Restore all three byte-identically (with their pins) or disclose each with a concrete reason the marker is not a reservation.

MINOR

1. Undisclosed production rewrites: tools/automation.rs (+21/−) and tools/tasks.rs remove the forced_action field and rewrite resolve_action/model_visible/description/input_schema/capabilities/approval_requirement. Verified behavior-identical (the only Some(_) producer was the #[cfg(test)] alias() constructor, so the field was always None in production), and a legitimate cascade completion — but no commit message or body paragraph names them. Disclose them (body + sweep-commit message erratum).
2. error_taxonomy/tests.rs:55 llm_auth_error_envelope_renders_context_without_secret now feeds pre-redacted input and then asserts !envelope.message.contains("tp-secret-token-plan-value") — vacuous (the string is not in the input), and the name overclaims ("renders context" — no context path is exercised). Delete the vacuous assert and rename, or restore the raw-key input form.
3. app/tests.rs:5345/5380 pending_steer_seed_arms_resend_flag / double_steer_seed_is_idempotent_on_flag assign submit_pending_steers_after_interrupt = true and assert it — tautological since no production code arms the flag anymore. Fold into the drain tests or drop.
4. widgets/mod.rs: ghost_text_hidden_when_no_suggestion (suggestion None → placeholder renders) was deleted while the sibling negative arm ghost_text_hidden_when_input_not_empty was explicitly restored in round 3 under the rule "a negative path is not subsumed by a surviving positive test". Same rule, same outcome expected: restore or justify.
5. tools/shell.rs: stale_jobs now has zero inserters at HEAD (6 surviving read-side references) — permanently-empty map and dead reader branches. Delete the field + readers or document why they stay.
6. Same-class leftovers the audit did not apply (its own C1 classes): shell_dispatcher.rs:657 detect_returns_some_shell (zero assertions), app/tests.rs:4422 test_scroll_operations (admits "just verify ... without panic"). Delete for consistency or note as accepted.
7. network_policy.rs:1-4: the module header still promises future /network allow|deny wiring for helpers the PR deleted (only is_approved/is_denied remain unused). Reword.
8. tests/README.md: integration row says 14 suites but integration/main.rs declares 15 (lifecycle_outbox_exec omitted — a pre-existing omission the sweep's arithmetic propagated); the same row's "instead of 17 times" is now stale twice over.
9. The HeaderActionTarget/HeaderHitbox compat-cluster deletion ("retained for the first Tideline header slice") is disclosed only implicitly via the underwater-header paragraph — name it.

Rebase notes (already pushed: test-cleanup-sweep → b2207cbe8)

• Rebased onto 3118c36b8 (fix: align model-facing text with engine reality #90, fix(tui): preserve thinking across turns #91, fix(tui): align provider doc conformance guards (sampling, Gemini signature gate, DeepSeek note) #93, fix(engine): 为终态事件保留原始回合及提交归属 #97, test(sandbox): ratchet-aware NoNewPrivs child matrices #98 landed). Two conflicts, both resolved in the sweep's favor after verification: tests/integration/reasoning_content_replayed_after_tool_call.rs kept deleted (tautological at base — the "assertion" inspected the request the test itself hand-built; fix(tui): preserve thinking across turns #91's engine tests now pin real replay on production-captured requests), and client.rs::chat_messages_keeps_valid_tool_calls_intact kept deleted (strict assertion-subset duplicate of chat_messages_include_tool_results_when_call_present).
• The body now needs a refresh: net numbers are +379/−10,716 vs 3118c36b8; the clippy paragraph is stale (only the three print_stderr fixes + the palette allow remain in the net diff — the redundant_closure/clone_on_copy/chunks_exact_to_as_chunks instances were fixed by the base commits); and the conflict-forecast paragraph is half wrong — state/lib.rs and tools/approval_cache.rs are not touched by this PR at all, while the real feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54 overlap is approval/elevation.rs plus the two eprintln! lines in js_execution.rs/engine/tests.rs (all trivial, either landing order).
• Post-rebase the re-verified claims stand: no open PR references deleted symbols; feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54's eventual rebase has three trivial conflict sites.

The sweep's core — the audit method, the deletion classifications, the restorations, and the disclosures — re-verified as sound across ~190 deleted symbols and ~100 deleted test functions. Fix M1 + M2 (one restoration commit) and the MINOR disclosures, and this is approvable.

[asto18089]

Round-5 fix wave pushed (4fb1c85..fe7113f, rebased lineage on 3118c36):

• Restored (byte-identical to 0bc868f, whole-file-diff verified): the menu_style selection-style quartet; LiveTranscriptOverlay::set_tail_mode + mode() + both pins; Settings::set_pinned_model_label + its round-trip assertion; HookExecutor::is_enabled; the network_policy Prompt-approval write side (file net-identical to base); ShellManager::remember_stale_job + its test portion.
• Applied the sweep's own classes uniformly: dropped the tautological steer-seed pins and the assertion-free detect_returns_some_shell / test_scroll_operations; the error_taxonomy auth pin now feeds a raw key and pins the classifier-not-redactor contract; the automation/tasks alias tests renamed to match what they now pin; two subagent doc comments re-pointed at apply_spillover_with_artifact; the Unknown-label assertion moved onto the surviving fails-closed loop; backoff attempt-63 saturation canary + ReplayDiverged snake_case wire pin added; tests/README integration row corrected to 15 suites.
• Environmental findings (no code change): the acp_server::tests family, cli_telemetry_acceptance_..., and ghost_text_hidden_when_no_suggestion stack-overflow on this host at the unmodified base 3118c36b8 itself (reproduced in scratch worktrees), so the ghost-text arm stays deleted and is disclosed as such in the body; full tui lib is green end-to-end (11,991 tests, 0 failed) and integration/cucumber are green when run as separate targets, as CI does.

Body updated to match the tree exactly (net +396/−10,450 across 132 files, corrected #54 conflict forecast, clippy-paragraph erratum, gates re-measured). All commits signed off.

[asto18089]

Fresh from-scratch review (round 6) — rebase first, then 11-lane re-verification

Rebase: no-op, verified before reviewing: ls-remote origin pinvou3-clean = 3118c36b8 = the merge-base with the then-head fe7113f46 (0 commits behind; main is the stale upstream branch, so pinjou3-clean remains the base of record). The review below ran to completion at the new head 2db56a5f5, which appends three fix commits found by this round (see "Fixed on this push").

Method: eleven independent lanes, all from scratch, none trusting earlier rounds: per-area deletion-class re-verification over every one of the then-132 changed files (C1 never-run/never-fail, C2 test-only-caller production code, C3 strict assertion-subsumption — each re-derived from BASE callers, reservation markers, and assertion comparison); a whole-tree hunk classification that byte-compared all 76 commit-level-only files; a 100% added-line audit; commit-by-commit message accuracy; a collision census against all nine other open CW PRs and the parent app's in-tree consumption; kept-deleted and body-claim audit; and local gate reproduction.

Verdict on the four criteria

1. Useful, complete, root-caused — yes, after this round's three restores. Every significant deletion was re-derived from the base tree. The C2 production deletions all hold: computer_meter (module header sanctions wire-or-delete; sole consumer meter_cloud_job test-only), the underwater classic header ("superseded by the Tideline shell"; genuinely invisible at base), workflow/replay.rs (zero non-test consumers at base, no reservation markers, ReplayDiverged kept wire-compatible and now pinned — strictly more conservative than the upstream deletion of the same executor), the workflow VM/WorkflowConfig surface, the llm_client auth-context family, the config-resolve provenance API, ModelFamily, DynamicToolItemStatus, the fragments budget API — every one verified zero non-test callers at base with no reservation language. The C1/C3 calls spot-checked to assertion level (e.g. cache_guard was a self-skipping suite no CI ever enabled; integration_mock_llm's deleted compaction smoke pinned a #[cfg(test)] helper the integration target could never even build against; the kept reasoning-replay twin was the same tautology as its deleted sibling — now deleted too, see below).
2. Elegant — yes. Restorations are byte-identical to base (76 no-op files cmp-verified; every claimed-identical region re-diffed), re-pointed pins now exercise production loaders rather than test mirrors, the route_billing deletions fold into a genuine 13-provider superset loop that even gains a label() pin, and the two new hardening pins (backoff attempt-63 saturation, ReplayDiverged snake_case round-trip) are real canaries, not noise. No reinvented wheels, no new framework, themed commit series.
3. Smuggling — none. All 396 then-added lines classified: ~317 mechanical rewrites onto surviving equivalents, ~44 new/strengthened pins, ~16 clippy mechanics, ~17 doc fixes, 2 blank lines; zero unclassifiable, zero behavior-bearing, zero CI/lockfile/Cargo/script changes (only docs/examples/fleet-dogfood.toml + tests/README.md, both verified correct). Every commit message checked against its own diff; three stale wordings noted below, all immaterial.
4. Bug-free (feature and performance) — yes at this head. Gates re-measured at 2db56a5f5: cargo check --workspace --all-features clean; CI's clippy command (--workspace --all-targets --all-features --locked -- -D warnings) clean; cargo fmt --check clean; dead-code budget 398/420; per-crate suites config 641, protocol 86, execpolicy 118 (body erratum below), mcp 76, secrets 62, state 25, workflow 233, workflow-js 85, agent 63, app-server 106, cli 380 — all green; tui --lib 11,994 passed / 0 failed (13 ignored, RUST_MIN_STACK raised as documented); integration 265; cucumber 28. Production-side deltas are exactly: C2 dead-code removals, #[cfg(test)] gating of the four test-only Hook builders (parent app imports none of them; Hook::new stays public), pub(crate) on skills::package_digest, the value-identical DEFAULT_FLEET_WORKFLOW_MAX_AGENTS privatization, and the behavior-identical to_user_message simplification — no runtime path changed, nothing perf-relevant touched. Collision census: landing test: drop verified worthless tests across crates #102 first breaks nothing — zero added-line references to any of the 164 net-deleted pub symbols across all nine other open PRs (merge-tree clean except feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54's three disclosed trivial conflicts, which contain no deleted-symbol usage), and the parent pinvou3-app (four in-tree path deps into this submodule) references none of them while everything it does import survives at this head.

Fixed on this push (fe7113f → 2db56a5)

• 267c80d1e — three misclassified pins restored byte-identically. rlm_eval_schema_names_the_runtime_content_variable: the live eval schema's model-facing code description (names content, teaches print(len(content)), rejects the old SOURCE spelling) had no surviving schema pin — the kept assertion covers only the missing-code error message. default_threshold_is_32k_tokens: the only exact-value pin of DEFAULT_LARGE_OUTPUT_THRESHOLD_TOKENS (same canary class as the attempt-63 backoff pin this PR itself added). test_show_settings_loads_from_file: the only smoke pin of the live /config show branch. None is C1 (each fails on regression), C2 (subjects live), or C3 (no surviving equivalent). Restoring the originals returns commands/groups/config/config.rs and tools/large_output_router.rs to base state, hence the net file count drops to 131 (+405/−10,534).
• c22b3ecbd — the sweep's tautology class applied uniformly. The deleted reasoning_content_replayed_after_tool_call.rs had an assertion-equivalent survivor: reasoning_replay_required_on_subsequent_turn hand-built the second request (Thinking block included), fed it to the mock, and asserted the mock's verbatim capture — no production code composed the asserted request, and its in-file comment claiming "runtime composes the next request" was false. Dropped with its now-unused assistant_thinking helper; tests/README.md now points the V4 §5.1.1 replay bullet at the engine tests (multi_block_and_redacted_thinking_persist_into_followup_requests), which drive a real engine and assert on the production-composed follow-up request.
• 2db56a5f5 — doc residue. named_fleet::sha256_label no longer cross-references the deleted replay.rs; the integration harness header no longer cites a stale pre-harness binary count (same count-neutral treatment as the cucumber header fix); the deleted apply_spillover wrapper's doc paragraph no longer dangles above apply_spillover_with_artifact — the old "error results are skipped" sentence must not move onto it because the artifact path deliberately does not skip error results (verified in apply_adaptive_evidence_inner).
• Body erratum corrected: execpolicy executes 118 tests (116 lib + 1 doc + 1 authorization_order), not 119; tui lib 11,994 and integration 265 updated for this push's changes.

Adjudicated as non-issues (checked by hand after lane disagreement)

• default_settings_show_footer_water_strip (deleted): strict assertion-subset of the surviving default_settings_use_comfortable_transcript_spacing, which re-asserts all three defaults (fancy_animations, !low_motion, "comfortable") on Settings::default() — clean C3.
• LocalOnly → Ready resolution: directly pinned at tui/setup/remote.rs (assert_eq!(by_mode(RemoteMode::LocalOnly), RemoteModeStatus::Ready)).
• models.rs compaction_threshold_for_model doc staleness and the #[allow(unused_imports)] palette glob: pre-existing/cosmetic, production symbols remain live.

Remaining observations (disclosed, no change requested)

• Inert state left behind by verified cascades: FleetSchedulerReport::cancelled (last writer was the C2-deleted cancel_run) and GitStatusSnapshot::ahead/behind (last reader was the deleted classic-header chrome). Harmless dead fields on live structs; removing them would add production-code edits to a sweep PR.
• The rewritten matched_strict_gate_labels fixture now exercises the empty-hooks path rather than the globally-disabled early return (the HookExecutor::disabled() subject was C2). The branch stays guarded by hooks_for_event's disabled path, which keeps its own test.
• Commit-message wordings, immaterial: afff68178 calls the GithubTool alias machinery "live" when GithubTool::alias is #[cfg(test)] (the keep-vs-rename asymmetry is still defensible — the twin test's alias halves stay meaningful there); 6694d6c4d's lint list is the pre-rebase one (already covered by the body's erratum); b8925b011's "(open PR fix: align model-facing text with engine reality #90 calls it)" is post-merge stale. Six commits carry an extra non-author Signed-off-by trailer alongside the author-matching one — DCO satisfied (CI green), cosmetic only.

All gates re-run locally at 2db56a5f5 after the fix commits; CI is green on the pushed head apart from the still-running check job at comment time.

[JensenChen28]

已按当前 base 3118c36b8 复核 exact head 2db56a5f。重点检查了 131 个改动文件中的非删除 hunks、生产 API 收缩与测试重定向，抽查 automation/tasks 统一入口、hooks 构造、fleet profile、workflow wire 兼容及 parent app 消费边界；未发现仍有生产调用的符号被误删，恢复项保持原行为，新增的饱和退避与 ReplayDiverged wire pin 覆盖了本轮高风险边界。

git diff --check 通过；exact-head CI 的 check、gate、CodeQL、DCO、Gitleaks 均成功。批准。

[JensenChen28]

Reviewed the cleanup against 3118c36, focusing on removed runtime/public helpers, canonical tasks/automation behavior, workflow wire compatibility, and the replacement of duplicate tests with checks against live code paths. I found no blocking regression in the reviewed paths. Searches of the current parent application did not identify callers of the specific removed APIs checked here; similarly named parent usage belongs to other types.

Independent local validation: codewhale-workflow library tests 217 passed; codewhale-agent 63 passed; codewhale-config 640 passed and 1 ignored. All required checks are passing for this head. I did not rerun the full TUI suite or compile every parent-platform target locally.

[asto18089]

Fresh round-7 review (from scratch, 11 lanes)

Rebase verification. Head 2db56a5f5 already contains both main (eed427344) and pinvou3-clean (3118c36b8) as ancestors — merge-base(head, main) = the main tip itself and merge-base(head, pinvou3-clean) = the base tip — so rebasing onto the latest main is a verified no-op (GitHub: MERGEABLE/CLEAN, all checks green).

Method. Eleven independent lanes re-derived every deletion from the base commit rather than trusting prior rounds: per-crate content lanes (workflow; computer_meter/underwater/cascade cluster; client/llm; tools+hooks; ui/widgets/setup; core/config/agent/small crates; fleet/engine/session/misc), a tests-dir/runner-wiring lane, a 100%-of-added-lines smuggle audit, a commit-message/body-claims lane, and a collision census (545 deleted symbols vs every open PR's added lines, the parent app, and a mechanical git merge-tree against CW #54).

Result: the sweep's core held everywhere. Zero BLOCKER and zero MAJOR findings stand after adjudication. The three lane-level MAJOR candidates were all resolved:

1. Gates numbers "cucumber (28)" / "tui lib 11,994" — verified, not stale. One lane statically concluded 28 was impossible at this head (measuring 13 by default). Re-measured directly at this head: cargo test -p codewhale-tui --test cucumber --all-features = 28 passed, cargo test -p codewhale-tui --lib --all-features = 11,994 passed / 13 ignored — both exactly as the Gates section states (its stated --all-features basis). Retracted.
2. error_taxonomy auth-envelope rename. The dropped no-leak assertion pinned from_http_response_with_request_context, which has zero production callers at base (its redaction behavior never shipped); the live from_http_response path is byte-unchanged and the rewritten pin correctly documents the live classifier contract, with caller-side redaction (redact_model_bound_text) still pinned on the live paths. Downgraded to M4 below.
3. top_bar_chip/HeaderHitbox vs "deletion is its own slice". Verified at base: the HeaderActionTarget compatibility alias's only remaining consumer was the licensed-dead classic renderer, so its "retained for the first Tideline header slice" purpose had already expired; the whole cluster is C2-correct, in-code licensed, and prominently disclosed. Adjudicated acceptable as a documented judgment call (a strict reading prefers a standalone slice).

Local gates at this head (macOS, clippy 1.99): fmt clean; cargo clippy --workspace --all-targets --locked -- -D warnings clean; tui lib 11,994/13 ignored green; integration 265 green; cucumber 28 green (last two: --all-features, run as separate targets); per-crate lib runs green (workflow 217, core 72, config 640+1 ign, agent 63, protocol 69, mcp 76, execpolicy 116, secrets 61+1 ign, cli 350, app-server 102, workflow-js 12); dead-code budget 398/420. Three script checks fail in this local environment only, each verified pre-existing/environmental: check-command-migration-manifest fails identically at the base commit; check-runtime-contract-budget fails with the identical identity-digest error at the base commit (CI runs it continue-on-error on PRs); check-gitleaks-config was invoked without its required argument (CI's Gitleaks job is green).

Added-line audit: 405/405 classified — 336 test pins/re-points/hardening, 37 mechanical clippy/import/glob-allow lines, 27 doc updates, 5 disclosed-exception lines (#[cfg(test)] on four Hook builders, pub(crate) package_digest). Zero smuggled production changes; zero Cargo.toml/Cargo.lock/.github changes; no #[ignore], derive, serde, tolerance, or timeout changes; the only visibility-bearing addition is the disclosed one.

Collision census: clean. Zero references to any of the 545 deleted symbols in the added lines of all 9 other open PRs; zero in the parent app (pinvou3-app path-depends on codewhale-tui/secrets/config/execpolicy — its 459 imported codewhale identifiers intersect the deleted list zero times); zero dangling references at head. git merge-tree of this head × #54 conflicts in exactly the 3 claimed files (4 hunks): the elevation.rs hunk is a small semantic merge (keep the #[cfg(test)] deletions, adopt #54's rewritten to_policy signature), the two others are writeln!/println! trivialities.

Remaining MINORs (non-blocking, author's discretion)

• M1 — key_hint::alt_prefix copy pin. Deleting alt_prefix_uses_deterministic_test_spelling removes the only pin of the user-visible macOS ⌥+ copy (head crates/tui/src/tui/widgets/key_hint.rs:10-19, live consumer at hotbar/setup.rs:473). It is not C1 (asserts a production constant) and not C3 (no survivor references it) — and the PR restored same-class exact-value pins elsewhere (menu_style quartet, DEFAULT_LARGE_OUTPUT_THRESHOLD_TOKENS), so by its own precedent this one is a misclassification. A copy regression would ship with zero failing tests. 3-line restore candidate.
• M2 — hotbar registry-metadata consistency pin. The deleted C2 chain is compiler-verified dead at base, but registry_metadata_contract_covers_registered_actions was the only cross-check that live metadata() impls stay consistent with id()/short_label()/category()/non-empty copy (every current impl constructs compact_label from short_label, so the invariant now holds only by construction; survivors pin only short_label widths and builtin categories). Same restore-or-conscious-sign-off call as M1.
• M3 — unguarded global env mutation in the re-pointed spillover test (client.rs ~7460-7468): raw unsafe { std::env::set_var/remove_var } brackets an expect() with no unwind guard, so a panic between them leaks CODEWHALE_CLASSIC_OUTPUT_ROUTING into sibling tests. crate::test_support::EnvVarGuard exists for exactly this and is used nearby.
• M4 — error_taxonomy disclosure nuance. The rename is accurately described, but the body could note that the dropped no-leak property has no user-visible-path equivalent: live 401 bodies are carried verbatim into error messages (unchanged base→head, pre-existing), and the old redacting constructor never shipped.
• M5 — docs staleness. 8334c9fea's gate list ("execpolicy 119", "cli 6") and a634d9037's mechanism claims are already errata'd in the body, but 6694d6c4d's message still lists three lint fixes absent from its diff while the round-3 body sentence "The clippy commit's message now states exactly what it contains" is itself inaccurate at this head; and the per-crate "--all-features" basis is vacuous for every non-tui crate (none defines a [features] section — the numbers reconcile exactly as lib+integration-target totals instead).

NOTEs (no action required)

impl Layer was removed wholesale while pub enum Layer survives — zero consumers today (in-repo, all PRs, parent app verified), but out-of-tree Layer::name/rank callers would break silently; production ALLOWED_COMMANDS rejection path in runtime_mcp remains unpinned (pre-existing; the deleted "pin" asserted the test's own constant, so nothing was lost); canonical_action.rs's "registered as hidden aliases" comment was already stale at base; the provider_templates replacement enumerates the current compatible ids explicitly, so future compatible templates lose the automatic shadowing check (comment discloses this); the pre-existing tests/README "shared helpers ... are untouched" sentence is now trivially stale re view_log; session_control_acceptance's surviving test name now overstates ("share one resolution" is no longer checked for threads — the dropped half was self-referential).

Verdict: approve-level. Nothing above blocks merge; M1/M2 are the only items with real (if small) coverage power, and they are judgment calls under the PR's own reservation precedent. All prior-round fix commits re-verified intact at this head (every spot-checked restoration byte-identical to base; 18/18 commits signed off).

[asto18089]

Fresh from-scratch review (round 7) — head 2db56a5f5, base pinvou3-clean@3118c36b8

No rebase was needed: pinvou3-clean is still at 3118c36b8 (compare API: behind_by=0, merge-base = 3118c36b8), so the pushed head is exactly what was reviewed. Method: both endpoints reconstructed locally from the API patch stream into a byte-exact twin (base tree 7a05698a6… and head tree 94d3eead9… both match the server-reported tree SHAs; 18 commits replayed), then audited by 8 independent lanes (deletion-class re-verification split across the tree, production-deletion caller census, restoration byte-identity, added-line classification, open-PR collision census + upstream burden, fork-policy conformance, commit-message accuracy, local gate reproduction) plus base-vs-head runtime probes for every host-dependent claim.

Verdict

The sweep's core holds everywhere my lanes could attack it. No blocker, no MAJOR. One MAJOR candidate raised during the audit was retracted after direct verification (below). What remains is a minor close-out list: four pin-restores that this PR's own round-4/5/6 standard calls for, four commit messages that are false at head (three already errata'd in the body — but the PR is unmerged, so rewording is the cheap permanent fix), a few disclosure-granularity gaps, and two stale body figures. None blocks merge on code-quality grounds; the message rewords are the items I'd most urge landing before merge.

Verified clean (evidence-backed, not trusted from the body)

• Net shape exact: 131 files, +405/−10,534, zero added files; all 9 deletions stay deleted; the round-6 "file count drops to 131" arithmetic is mechanically exact (78 touched files finish byte-identical to base).
• Deletion classes re-verified at base, including the risky cascades. Underwater classic header: zero call sites at base, sanction language verbatim (deletion is its own slice), the whole chrome/top_bar_chip/ShellPhase::color cascade is dead-at-base code. computer_meter: header sanctions deletion ("must be deliberately wired … or deleted"), unwired. Both reasoning-replay deletions (integration file + round-6 twin): each asserts on a request the test itself hand-built and fed to a mock — tautology at base too, with real engine coverage surviving (multi_block_and_redacted_thinking_persist_into_followup_requests). cache_guard (env-gated self-skip), coordination_acceptance (git-CLI fixture only, live engine survivor in subagent/tests.rs), view_log (zero consumers), plugin_e2e (asserts on a test-local mirror of the production scanner; production scan_plugin_dir keeps its own unit tests). workflow/replay.rs: literally zero comment lines in its 836 lines — "no reservation markers" is literally true; ReplayDiverged survives wire-pinned in both directions.
• One deletion I probed hard and confirmed correct: session_metrics_strip_is_on_by_default existed twice at base, byte-identical (mod tests :404 and mod neutrality_tests :1124 of phase_strip.rs); only the duplicate was deleted and the survivor pins both the default_footer()-contains-SessionMetrics default and the from_key("session_metrics") spelling at head.
• Production-deletion census: 165 deletions in 35 clusters, every one verified zero production callers at base — including pub items of published crates (ModelFamily, SecretRef + resolve helpers, Manager::update_sandbox_state, DynamicToolItemStatus, the ~35-item workflow config/plan/mock-executor layer). Parent app (pinvou3-app/src-tauri, which consumes the tui crate): zero references to any deleted symbol. No wire/locale/protocol surface touched. The two "residual inert state" disclosures (FleetSchedulerReport::cancelled writerless; GitStatusSnapshot::ahead/behind readerless) verified exact, and no undisclosed newly-dead state exists beyond them. Exactly one #[allow(...)]-class line added in the whole diff (the Hook::new comment).
• Restorations: all 86 verified byte-identical to base (whole-file or hunk-level); zero drift across the six rewrite rounds. Every fully-restored file is covered by a restoration commit message or the body; all 331 genuinely-new lines classify into the disclosed buckets (re-pointed pins with assertions preserved, renames, clippy fixes, the two hardening pins, doc residue). Smuggling: zero.
• Collision census re-run independently (not from the body): all 10 open CW PRs (feat(fork): multi-root workspace_roots authorization infrastructure (runtime lanes) on v0.9.12 #54, refactor(skills): export install safety primitives #81, feat(memory): refuse sensitive notes at write time #82, feat(automation): archive terminal runs on delete #85, feat(execpolicy): builtin sensitive-path safety ruleset #87, fix(model): 保持账户路由逻辑调用在重试中的幂等身份 #92, fix(session): Windows 会话导出探测失败关闭 #96, fix(kimi): repair empty items instead of dropping #101, fix(tui): scope checkpoint recognition by era #103, feat(tools): disable the deferred-toolbox size bounds #104 — one more than the body's 9): zero added lines reference any deleted symbol; none touches any of the 9 deleted files. Upstream burden is low and converging: 4 of the 9 deleted files are already deleted upstream (upstream Delete ~2,650 lines of crates/workflow with no production consumer; dedupe the isolated chat prompt and the YOLO alias parsers codewhale-hq/Codewhale#6517 removed replay.rs; the 2026-10-10 upstream commit removed computer_meter).
• Fork policy: conforming. Net drift moves −10,129 lines (improves the fork-policy §1.2 budget); §3.4 (no silent test deletion) is satisfied by the per-class evidence and kept-deleted justifications; zero forkguard_ surface touched (167 unique names at base and head; layer-2 test names intact); all CodeWhale-side fork-guard fingerprints still match at head.
• Gates re-measured at this head (clippy/rustc 1.99.0, --locked, --all-features): fmt PASS; check --workspace PASS; clippy --workspace --all-targets -- -D warnings PASS; dead-code budget 398/420 (22 under) — matches; config 641, protocol 86, mcp 76, secrets 62, state 25, workflow 233, workflow-js 85, agent 63, app-server 106 — all 0 failed, matching the body; execpolicy 119 on Linux (117 lib + 1 doc + 1 authorization_order); cli 380/0; tui-lib 12,000 total compiled (11,987 executed + 13 ignored on a quiet run); integration 265/0 — matches; cucumber 28/0 — matches. CI at this head: all 10 check-runs green. Note for future reviewers: the CI gate job runs only the filtered safety subset (command_safety auto_review authority sandbox + execpolicy) — the full-suite numbers rest on local runs, which I've now reproduced.
• Every host-dependent claim reproduced at the unmodified base on Linux: the default-stack full-suite stack-overflow set (cli_telemetry acceptance aborting the cli suite; acp_server family aborting tui-lib) aborts at base 3118c36b8 identically — confirmed pre-existing/environmental on a second OS. The four additional load-flakes I hit (below) pass in isolation at both base and head.

Findings (all minor; a close-out wave is recommended, not required for merge safety)

1. Four more pins in the exact class rounds 4–6 kept restoring (the sweep's one recurring false-negative mode — canary pins of live values):
   • mobile_defaults_to_loopback (base tui/src/lib.rs:12585) — the only pin of resolve_serve_bind_host(true, None); the survivors pin (false, None) and (true, Some("127.0.0.1")). Same shape as the round-4 git-status row-pin restores ("survivor pins a different row of the same table").
   • alt_prefix_uses_deterministic_test_spelling (base tui/src/tui/widgets/key_hint.rs:63) — the only exact-value pin of live alt_prefix(), which production UI text interpolates (hotbar/setup.rs:473). Same canary class as round-6's default_threshold_is_32k_tokens restore.
   • The hotbar recommended (slot, compact_label) mapping (deleted with its test-only wrapper recommended_hotbar_bindings): the live recommendations' slot order and label spellings are now unpinned (weakest form of the class — the ids const stays pinned).
   • automation/tasks canonical-schema detail pins: auto_approve default-false and the rrule description text; the surviving canonical_schema_lists_all_actions_and_union_fields pins union-field presence only. A re-point (this PR's own "~20 files" practice) would close it.
2. Commit messages false at head (reword while unmerged — errata in the body don't fix git log):
   • pr-05 6694d6c4d claims seven lint fixes; its diff contains three print_stderr + the palette allow + the tui/app.rs doc-comment removal. The redundant_closure/clone_on_copy/chunks_exact_to_as_chunks instances were fixed on the base by merged fix: align model-facing text with engine reality #90–test(sandbox): ratchet-aware NoNewPrivs child matrices #98. (Body round-2 admits this; the message still claims them.)
   • pr-01 8334c9fea still says "cli 6" (real: 380). (Body round-3 errata'd.)
   • pr-09 a634d9037 still says chrome_label/chrome_ink were "unmarked" (module-wide allow sits at git_status.rs:21) and that "both" color/phase_ink carried the classic-header sanction (only ShellPhase::color does); it also omits the 5th touched file (the phase_strip.rs test deletion). (Body round-4 errata'd.)
   • pr-12 7058b69f1's residual clause — "the files now differ from base only by the merged fix: align model-facing text with engine reality #90 description updates" — is wrong at this base: network_policy.rs, tools/shell.rs, tools/shell/tests.rs are byte-identical to base. Not errata'd anywhere. (Harmless direction — the truth is stronger than the claim.)
3. execpolicy 118-vs-119: the round-6 erratum's arithmetic ("118 executed (116 lib + 1 doc + 1 authorization_order)") is the wrong side on Linux: the linux-gated exact_workspace_file_allow_preserves_posix_case_boundaries runs here, giving 119 = 117 lib + 1 doc + 1 integration; on macOS it's 118. The commit message's "execpolicy 119" stands. Suggest the Gates section state both hosts.
4. Disclosure granularity (no code change implied): several C2 clusters were deleted unnamed while the body names far smaller items — agent::ModelFamily+model_family, config::resolve::{SecretRef, resolve_scalar, merge_maps, merge_provenance, Layer::name}, core::{job_record_to_agent_run, resume_pending}, mcp::Manager::update_sandbox_state, protocol::DynamicToolItemStatus, the workflow config/plan/fleet-shape/mock-executor layer (~35 items), the llm_client auth-context cluster (the body discloses only the to_user_message clone; the deletion is AuthenticationErrorContext + ~15 items incl. RetryPolicy::is_retryable_status and impl From<RetryConfig> — behavior-identity verified: the context field was provably always None in production), hotbar's 5-item cluster, ElevationView::{request, selected}, agent_card::with_workers, app::cycle_mode_reverse, the model_profile predicates, palette::ui_theme_from_settings, prompt_zones::from_messages, resource_telemetry::{from_estimated_text, compact_rate}, skill_state::disabled, HookExecutor::disabled, dispatch_runner::compose_pr_body, task_spec::record_verification_receipt. All verified test-only-at-base — this is a disclosure-completeness item only. Two smaller honesty nits in the same bucket: "Every other restored item is marker-verified" — review_repair.rs has no marker language either (its staging evidence is the v0.9.2: Design true Auto mode as a bounded review-repair loop codewhale-hq/Codewhale#3832 cite + design doc); and Hook::new's kept-pub comment cites parent-app tests, but the parent tree has zero Hook::new references (hooks arrive via serde) — stale justification, harmless API.
5. Stale body figures: "188 net-deleted symbols" (a round-4 snapshot; the current diff-level count is ~470–560) and "the 9 other open PRs" (now 10). The substance re-verifies clean either way; suggest updating the numbers.
6. Environmental-note addendum for this host: beyond the disclosed overflow set, one full-parallel tui-lib run on this Linux box failed four tests that pass in isolation at base and head: remote_control::tests::{runtime_chat_same_session_reconfigure_releases_then_reacquires_owner_lock, restart_rehydrates_runtime_chat_ownership_until_terminal_cursor, separate_predispatch_crashes_on_one_run_get_distinct_recovery_turn_ids}, tools::pdf::tests::shared_adapter_forwards_page_window_and_returns_stdout. Neither file is touched by this PR; consistent with the disclosed load-dependence class, but a future reviewer's full-suite run will hit them, so naming them in the note would save the repro detour.
7. Advisory (policy), no action required: the sweep is upstream-reusable in principle and the parent repo's upstream-first line would point it there; upstream has no equivalent sweep (4/9 files already converge). Staying fork-only is defensible since the deletion verdicts are base-specific, but a derived upstream proposal remains the policy-preferred extra step, and the body's only process line ("no tracking issue") leaves that unacknowledged.

Bottom line

Useful, complete within its stated scope, root-caused (every deletion carries reproducible mechanical evidence — the classes reproduced independently in ~150 re-verifications), elegant in its reservation-audit discipline, smuggling-free, and behavior-preserving in production code (the only production line-behavior change, to_user_message cloning message directly, is provably identical). Merge-ready from my side once the round of message rewords (finding 2, plus the pr-12 un-errata'd clause) and, ideally, the four pin restores (finding 1) land; the rest is disclosure polish at your discretion.