fix(tools): reject mixed-root freeform patches

.coderabbit.yaml

@@ -29,9 +29,6 @@ reviews:
     - path: "tests/**/*.ts"
       instructions: |
         Review tests for Bun test idioms, deterministic behavior, and meaningful coverage of safety decisions, provider/runtime flows, session events, and TUI command behavior.
-    - path: "**/*.go"
-      instructions: |
-        Do not request Plan 9 or other unsupported GOOS/GOARCH shims. The five native prebuilt release targets are linux-x64, linux-arm64, macos-arm64, macos-x64, and windows-x64. Android/Termux is also a supported runtime through the documented android-arm64 source build and Linux artifact fallback. Other GOOS/GOARCH combinations are not a review criterion.
   tools:
     github-checks:
       timeout_ms: 300000

.github/workflows/ci.yml

@@ -6,109 +6,10 @@ on:
     branches:
       - main
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-permissions:
-  contents: read
-
 jobs:
-  quality:
-    name: Code Quality & Lint
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Check formatting
-        run: make fmt-check
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: deadcode (advisory)
-        continue-on-error: true
-        run: make deadcode
-
-      - name: golangci-lint (advisory)
-        continue-on-error: true
-        run: make lint-static
-
-  test:
-    name: Unit Tests & Coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Test with coverage
-        run: |
-          go test -count=1 -coverprofile=coverage.out -covermode=atomic ./...
-
-      - name: Publish coverage summary
-        if: always()
-        shell: bash
-        run: |
-          if [ -f coverage.out ]; then
-            go tool cover -func=coverage.out | awk '
-            BEGIN {
-              total = "unknown"
-              rows = ""
-            }
-            $1 == "total:" {
-              total = $3
-              next
-            }
-            {
-              rows = rows sprintf("| `%s` | `%s` | **%s** |\n", $1, $2, $3)
-            }
-            END {
-              print "### 📊 Test Coverage Summary: **" total "**"
-              print "<details><summary>Coverage per function</summary>\n"
-              print "| File | Function | Coverage |"
-              print "| :--- | :--- | :--- |"
-              printf "%s", rows
-              print "</details>"
-            }' >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Upload coverage artifact
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: zero-coverage-report
-          path: coverage.out
-          if-no-files-found: warn
-
   smoke:
     name: Smoke (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -117,40 +18,6 @@ jobs:
           - macos-latest
           - windows-latest
 
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Test (Fast Non-Race)
-        run: go test ./...
-
-      - name: Build binary
-        run: go run ./cmd/zero-release build
-
-      - name: Smoke binary
-        run: go run ./cmd/zero-release smoke
-
-  race:
-    name: Race Detector
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    # A race the detector newly reports can present as a deadlock rather than a
-    # failure, and the default job timeout is six hours. This job is expected to
-    # be the longest in the workflow, so the ceiling is generous but finite.
-    timeout-minutes: 30
-
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -163,29 +30,72 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      # Invoke the Makefile target rather than repeating its flags. `make test`
-      # is already `go test ./... -race -count=1`, so running it here is what
-      # stops the project's declared test command and what CI actually runs
-      # from drifting apart again. The race detector needs cgo, which the
-      # hosted ubuntu runner supplies without an extra setup step.
-      - name: Test with the race detector
-        run: make test
+      - name: Install Make on Windows
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: choco install make --no-progress -y
+
+      - name: Validate quality targets with stock macOS Make
+        if: matrix.os == 'macos-latest'
+        env:
+          GIT_CONFIG_COUNT: 1
+          GIT_CONFIG_KEY_0: grep.patternType
+          GIT_CONFIG_VALUE_0: fixed
+        run: make -n vulncheck
+
+      - name: Check vulnerabilities through native Windows Make
+        if: matrix.os == 'windows-latest'
+        shell: cmd
+        run: make vulncheck
+
+      - name: Check dead code through native Windows Make
+        if: matrix.os == 'windows-latest'
+        continue-on-error: true
+        shell: cmd
+        run: make deadcode
+
+      - name: Run static lint through native Windows Make
+        if: matrix.os == 'windows-latest'
+        continue-on-error: true
+        shell: cmd
+        run: make lint-static
+
+      - name: Check formatting
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "gofmt needed on:" >&2
+            echo "$unformatted" >&2
+            exit 1
+          fi
+
+      - name: Vet
+        if: matrix.os == 'ubuntu-latest'
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+      - name: Build binary
+        run: go run ./cmd/zero-release build
+
+      - name: Smoke binary
+        run: go run ./cmd/zero-release smoke
 
   performance:
     name: Performance Smoke
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
         with:
           go-version-file: go.mod
           cache: true
@@ -194,39 +104,51 @@ jobs:
         run: go run ./cmd/zero-release build
 
       - name: Performance smoke
-        run: |
-          mkdir -p dist/perf
-          go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci
+        run: go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci
 
       - name: Upload performance report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: zero-performance-smoke
           path: dist/perf/perf-bench.json
           if-no-files-found: warn
 
   security:
-    name: Security & Code Health
+    name: Security & code health
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
         with:
           go-version-file: go.mod
           cache: true
 
-      - name: govulncheck (linux)
+      # Hard gate: fails the build when code reaches a known vulnerability. A stdlib
+      # CVE is cleared by a toolchain bump (see go.mod). May also flag a newly
+      # published advisory on an unrelated PR — intentional: do not ship known vulns.
+      - name: govulncheck
         run: make vulncheck
 
-      - name: govulncheck (windows)
-        run: make vulncheck-windows
+      # Advisory: reports functions unreachable from any cmd/* main so dormant
+      # code is visible in CI. Non-blocking while the dormant subsystems are
+      # still being wired or removed.
+      - name: deadcode (advisory)
+        continue-on-error: true
+        run: make deadcode
+
+      # Advisory: catches what deadcode's whole-program reachability analysis
+      # doesn't, unused private functions/assignments reachable within a
+      # package but never actually called, plus staticcheck-style correctness
+      # and readability issues. Scoped to a few linters rather than the full
+      # default battery, and non-blocking, while the existing findings across
+      # the repo are cleaned up incrementally (see #527).
+      - name: golangci-lint (advisory)
+        continue-on-error: true
+        run: make lint-static

.github/workflows/pr-auto-review.yml

@@ -24,7 +24,6 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff

.github/workflows/release-artifacts.yml

@@ -34,15 +34,12 @@ jobs:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.ref == '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       - name: Checkout requested ref
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.ref != '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.ref }}
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -132,8 +129,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       # No registry-url here on purpose: setup-node's registry-url writes an
       # .npmrc line referencing $NODE_AUTH_TOKEN, and npm hard-fails on the

.github/workflows/zero-action-smoke.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
   push:
     branches:
@@ -14,13 +12,8 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
 
-permissions:
-  contents: read
-
 jobs:
   validate:
     name: Validate action.yml
@@ -31,14 +24,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-
-      - name: Run action-summary test suite
-        run: node --test scripts/action-summary.test.mjs
-
       - name: Parse action.yml and assert documented inputs
         shell: bash
         run: |

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.9.0"}
+{".":"0.8.0"}

AGENTS.md

@@ -81,13 +81,6 @@ These classes drive multi-round reviews. Fix them before requesting review:
   assert raw `t.TempDir()` spellings (`/var` vs `/private/var` on macOS, short
   paths on Windows). Prefer one cross-platform function with small `GOOS`
   checks over duplicated helpers that drift.
-- **Supported targets only:** CONTRIBUTING.md names the five native prebuilt
-  release artifacts (`linux-x64`, `linux-arm64`, `macos-arm64`, `macos-x64`,
-  `windows-x64`) and the additional supported Android/Termux source-build and
-  artifact-fallback path. Other `GOOS`/`GOARCH` combinations, including
-  `plan9`, are unsupported and are not a review criterion. Do not block a PR
-  for failing to compile on an unsupported `GOOS`/`GOARCH`. Tests may use
-  `plan9` as a fixture for "unsupported".
 - **Security edges:** Keep secrets out of argv, env dumps, and logs. Redact
   success and error paths (including stderr). Fail closed on ownership, lease,
   and permission checks. Do not rely on pre-open path resolution

CHANGELOG.md

@@ -6,61 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
-## [0.9.0](https://github.com/Gitlawb/zero/compare/v0.8.0...v0.9.0) (2026-09-15)
-
-
-### Features
-
-* **acp:** add standard session list and resume ([#914](https://github.com/Gitlawb/zero/issues/914)) ([c1937df](https://github.com/Gitlawb/zero/commit/c1937dfac72e6ad0e5ade6e48e2d9c17d9c3e5d6))
-* **acp:** emit structured file changes in tool updates ([#999](https://github.com/Gitlawb/zero/issues/999)) ([faec8ee](https://github.com/Gitlawb/zero/commit/faec8ee2017fdd6d0c2c347add892cb73eb413d7))
-* **acp:** surface safe browser tool metadata ([#1000](https://github.com/Gitlawb/zero/issues/1000)) ([a6ec043](https://github.com/Gitlawb/zero/commit/a6ec0435e36b9bea9793b2fd97f2ecd30e3a0f9b))
-* **exec:** default headless runs to the turn-budget ceiling ([#1049](https://github.com/Gitlawb/zero/issues/1049)) ([9e609c5](https://github.com/Gitlawb/zero/commit/9e609c52420fd322f047fc238c04ac81dd623fdd))
-* **tui:** interactive terminal attach for tty exec sessions ([#1055](https://github.com/Gitlawb/zero/issues/1055)) ([d73ec81](https://github.com/Gitlawb/zero/commit/d73ec81e2d3facb5377bc9ad0fe2aa314628a0c0))
-* **tui:** offer mid-run model escalation behind --allow-escalation ([#1019](https://github.com/Gitlawb/zero/issues/1019)) ([91d921f](https://github.com/Gitlawb/zero/commit/91d921f4c5b8289a9e437f786218f1b48f2add5a))
-* **tui:** richer /resume session browser ([#1047](https://github.com/Gitlawb/zero/issues/1047)) ([2f53117](https://github.com/Gitlawb/zero/commit/2f531178f614e587b629e4f81e0470adda647fbd))
-
-
-### Bug Fixes
-
-* **acp:** make configured MCP tools callable ([#1003](https://github.com/Gitlawb/zero/issues/1003)) ([7f5e5af](https://github.com/Gitlawb/zero/commit/7f5e5af7bbdbe5bb4d91706146072d461c0234a4))
-* **agent:** stop the tool-schema ratchet meaning a different thing per host ([#1017](https://github.com/Gitlawb/zero/issues/1017)) ([f909266](https://github.com/Gitlawb/zero/commit/f9092668a832ea73a69551f0ea2df4f6eaf356df))
-* **background:** treat POSIX zombie leader as already-exited ([#981](https://github.com/Gitlawb/zero/issues/981)) ([1aacf38](https://github.com/Gitlawb/zero/commit/1aacf38b727d31b5ca09949316d6afa8292aec46))
-* **config:** lock config read-modify-write across processes ([#960](https://github.com/Gitlawb/zero/issues/960)) ([b04fe96](https://github.com/Gitlawb/zero/commit/b04fe96e9ef3f2deda4fb2a972270300629079d2))
-* **config:** preserve unknown top-level fields ([#984](https://github.com/Gitlawb/zero/issues/984)) ([488def6](https://github.com/Gitlawb/zero/commit/488def68dcc6d36701fdf171e94a74a436b090fc))
-* **daemon:** publish status files atomically ([#949](https://github.com/Gitlawb/zero/issues/949)) ([9001421](https://github.com/Gitlawb/zero/commit/90014210d2ada2e3d61f4eca5087d3f35a3c4b8b))
-* **installtxn:** put back an install a killed commit left behind ([#997](https://github.com/Gitlawb/zero/issues/997)) ([2837f5e](https://github.com/Gitlawb/zero/commit/2837f5efb38dcd3c69771b0ba31565f98a206120))
-* let the configured forward proxy through the loopback guard ([#1025](https://github.com/Gitlawb/zero/issues/1025)) ([1e4db7c](https://github.com/Gitlawb/zero/commit/1e4db7c6643ca7e2c3d8e4b8b30371cfbe43561e))
-* **lockutil:** use kernel-held advisory locks ([#950](https://github.com/Gitlawb/zero/issues/950)) ([6fe0d1e](https://github.com/Gitlawb/zero/commit/6fe0d1edcdbadea6d566800fbcca739c1cd54ea1))
-* **mcp:** discover OAuth through protected resource metadata ([#991](https://github.com/Gitlawb/zero/issues/991)) ([1b5db17](https://github.com/Gitlawb/zero/commit/1b5db1765672820caac1684b168c9898b5ba3593))
-* **mcp:** reject a server-initiated request as a streamable-HTTP response ([#1054](https://github.com/Gitlawb/zero/issues/1054)) ([2479d94](https://github.com/Gitlawb/zero/commit/2479d946c15dbf74ee3c04a637e97181d1786f08))
-* **oauth:** force-close loopback callback connections past the shutdown deadline ([#1051](https://github.com/Gitlawb/zero/issues/1051)) ([176f5a2](https://github.com/Gitlawb/zero/commit/176f5a242b754a86ea4c7121a8dcc1c0d72cf2e4))
-* **oauth:** Split an oversized keyring token blob across entries ([#1007](https://github.com/Gitlawb/zero/issues/1007)) ([275e248](https://github.com/Gitlawb/zero/commit/275e2486695338ce38193a6e3319f8b6a9a5c33c))
-* **providerio:** close idle connections periodically to prevent HTTP/2 PROTOCOL_ERROR ([#1058](https://github.com/Gitlawb/zero/issues/1058)) ([b76c764](https://github.com/Gitlawb/zero/commit/b76c764b77926891aa67163e6605a2d8540aacaa))
-* **providers:** register Atomic Chat as local OpenAI-compatible runtime ([#550](https://github.com/Gitlawb/zero/issues/550)) ([79fa142](https://github.com/Gitlawb/zero/commit/79fa1422ef1a3691b93342788453ebc284d57f9c))
-* **redaction:** split camelCase keys in normalizeKey ([#994](https://github.com/Gitlawb/zero/issues/994)) ([08fbea7](https://github.com/Gitlawb/zero/commit/08fbea7a3221d2061d88038924f90a4cba9af1ac))
-* **sandbox:** keep a derived ACL target inside the write root it came from ([#1040](https://github.com/Gitlawb/zero/issues/1040)) ([3b43c43](https://github.com/Gitlawb/zero/commit/3b43c43eca968c8619adadc81fcc1a17e220216a))
-* **sandbox:** keep Windows restricted-token SIDs narrow and fail closed on DenyRead ([#1006](https://github.com/Gitlawb/zero/issues/1006)) ([0207f2b](https://github.com/Gitlawb/zero/commit/0207f2b2697149a73ecc89a5ab5db0bd665f1911))
-* **sandbox:** Make WSL backend tests deterministic. ([#948](https://github.com/Gitlawb/zero/issues/948)) ([e59bf78](https://github.com/Gitlawb/zero/commit/e59bf78cabc2703678778b904c27c8bc8ef82bc8))
-* **sandbox:** protect worktree git pointers ([#805](https://github.com/Gitlawb/zero/issues/805)) ([f30f550](https://github.com/Gitlawb/zero/commit/f30f550e6037c53f8521ba2d59c984ae6c574917))
-* **sandbox:** refcount temporary roots so one holder's cleanup cannot revoke another's ([#911](https://github.com/Gitlawb/zero/issues/911)) ([7acac7a](https://github.com/Gitlawb/zero/commit/7acac7acee65565e25089f2a7b5813c086ce65eb))
-* **sessions:** carry an interrupted turn's work into the resume prompt ([#1016](https://github.com/Gitlawb/zero/issues/1016)) ([6ae8396](https://github.com/Gitlawb/zero/commit/6ae8396f0282a5f18a431f0c0ef1a272ecc2ca2b))
-* **sessions:** render resume context fields in key order ([#1043](https://github.com/Gitlawb/zero/issues/1043)) ([da244bc](https://github.com/Gitlawb/zero/commit/da244bcbfcfa05e414567ac0acc3cf8ba745ad7d))
-* **specialist:** keep the pinned model when a specialist is resumed ([#1009](https://github.com/Gitlawb/zero/issues/1009)) ([aadb4a2](https://github.com/Gitlawb/zero/commit/aadb4a27e9cdb41e774e8e1a8f23cf9c2fb50db2))
-* **swarm:** stop original member before handoff ([#957](https://github.com/Gitlawb/zero/issues/957)) ([0021475](https://github.com/Gitlawb/zero/commit/0021475d4c58c91911098f414795512cf60a0b56))
-* **tools:** an edit keeps the reads it did not disturb ([#908](https://github.com/Gitlawb/zero/issues/908)) ([1649008](https://github.com/Gitlawb/zero/commit/1649008506da0e675431dc056251a01891b15cc8))
-* **tools:** make apply_patch tolerant and re-expose edit_file ([#956](https://github.com/Gitlawb/zero/issues/956)) ([2749447](https://github.com/Gitlawb/zero/commit/2749447cdce4ae5dd333538b36fa919b80ecc66d))
-* **tools:** reject fuzzy edits with drifted content ([#983](https://github.com/Gitlawb/zero/issues/983)) ([8b3d1b1](https://github.com/Gitlawb/zero/commit/8b3d1b1597b04bfa6d4bc7f912abc13ca80a6298))
-* **tools:** say when format-on-write ran out of time ([#1044](https://github.com/Gitlawb/zero/issues/1044)) ([6937a30](https://github.com/Gitlawb/zero/commit/6937a309cf00825572210a7610a1f3ea8b74c2f9))
-* **tui:** move voice capture to Ctrl+Space ([#968](https://github.com/Gitlawb/zero/issues/968)) ([eeea330](https://github.com/Gitlawb/zero/commit/eeea3308fed38b37b203522624babaf2f30df91f))
-* **update:** keep Windows failed-restore state in trusted recovery records ([#979](https://github.com/Gitlawb/zero/issues/979)) ([a3852ba](https://github.com/Gitlawb/zero/commit/a3852bac595e06c5d3ca9da22212b281b8796802))
-
-
-### Performance Improvements
-
-* **agent:** cheap compaction — dedicated summarizer model, input cap… ([#532](https://github.com/Gitlawb/zero/issues/532)) ([6645f97](https://github.com/Gitlawb/zero/commit/6645f9744b37dda4d52ecc4631578d62cefc89de))
-* **providers:** parallelize isolated provider unit tests and shrink retry backoffs ([#955](https://github.com/Gitlawb/zero/issues/955)) ([d6b25fc](https://github.com/Gitlawb/zero/commit/d6b25fc3039a6b7d72a5703a87a097449792b102))
-* reduce startup and turn overhead ([#932](https://github.com/Gitlawb/zero/issues/932)) ([1fde941](https://github.com/Gitlawb/zero/commit/1fde941803c4295c11a4a14559f3c5217d1a9e69))
-
 ## [0.8.0](https://github.com/Gitlawb/zero/compare/v0.7.0...v0.8.0) (2026-08-21)
 
 

CONTRIBUTING.md

@@ -126,31 +126,6 @@ not enough. Dependency changes need a clear project benefit, such as fixing a
 specific bug, addressing a security issue, improving compatibility, or supporting
 an approved feature.
 
-## Supported platforms
-
-Zero publishes five native prebuilt artifacts from
-`.github/workflows/release-artifacts.yml`:
-
-- `linux-x64` (`linux/amd64`)
-- `linux-arm64` (`linux/arm64`)
-- `macos-arm64` (`darwin/arm64`)
-- `macos-x64` (`darwin/amd64`)
-- `windows-x64` (`windows/amd64`)
-
-The shell installer and npm wrapper resolve the applicable artifacts from that
-list. The PowerShell installer supports the published `windows-x64` artifact;
-there is no native Windows ARM64 artifact. Windows on ARM users can run the x64
-build under emulation or build from source.
-
-Android/Termux is also supported even though it has no distinct release
-artifact. The npm wrapper maps Android to the Linux artifact, and
-`docs/INSTALL.md` documents the native `android/arm64` source build needed on
-devices whose seccomp policy blocks the Linux build's syscall path.
-
-Other `GOOS`/`GOARCH` values, including Plan 9, are unsupported. They are not a
-review criterion. Do not block a pull request for failing to compile on an
-unsupported target. Tests may use `plan9` as a fixture for an unsupported OS.
-
 ## What We Prioritize
 
 The core team will prioritize:

Makefile

@@ -7,7 +7,7 @@ DEADCODE_VERSION := v0.46.0
 GOLANGCI_LINT_VERSION := v2.12.2
 GOVULNCHECK_VERSION := v1.3.0
 
-.PHONY: build build-all test test-race vet fmt fmt-check lint lint-static deadcode vulncheck vulncheck-windows tidy clean baseline help
+.PHONY: build build-all test test-race vet fmt fmt-check lint lint-static deadcode vulncheck tidy clean baseline help
 
 # Build the main CLI binary into ./zero.
 build:
@@ -44,8 +44,7 @@ lint: fmt-check vet
 # the possibly stale Go toolchain or consulting a multi-module GOWORK. git grep
 # works with both POSIX shells and cmd.exe, including GNU Make 3.81 on macOS.
 # The target-specific export is shell-independent.
-lint-static deadcode vulncheck vulncheck-windows: export GOTOOLCHAIN = $(GO_TOOLCHAIN)
-lint-static deadcode vulncheck vulncheck-windows: export GOWORK = off
+lint-static deadcode vulncheck: export GOTOOLCHAIN = $(GO_TOOLCHAIN)
 
 lint-static:
 	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run --enable-only unused,ineffassign,staticcheck ./...
@@ -56,11 +55,6 @@ deadcode:
 vulncheck:
 	go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
 
-vulncheck-windows:
-	mkdir -p "$(CURDIR)/.cache/gobin"
-	GOBIN="$(CURDIR)/.cache/gobin" go install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
-	GOOS=windows "$(CURDIR)/.cache/gobin/govulncheck" ./...
-
 tidy:
 	go mod tidy
 
@@ -83,4 +77,4 @@ baseline: build
 		--output internal/perfbench/reports/baseline.json
 
 help:
-	@echo "Targets: build (default), build-all, test, test-quick, vet, fmt, fmt-check, lint, lint-static, deadcode, vulncheck, vulncheck-windows, tidy, clean, baseline"
+	@echo "Targets: build (default), build-all, test, test-quick, vet, fmt, fmt-check, lint, lint-static, deadcode, vulncheck, tidy, clean, baseline"

README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.9+" src="https://img.shields.io/badge/Go-1.26.9+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
   <br>
@@ -26,7 +26,7 @@ zero exec --output-format stream-json < turns.jsonl
 ## Why Zero
 
 - **Use the model you want.** Bring OpenAI, Anthropic, Gemini, Groq, OpenRouter,
-  DeepSeek, Mistral, xAI, Qwen, Kimi, GitHub Models, Ollama, LM Studio, Atomic Chat, or any
+  DeepSeek, Mistral, xAI, Qwen, Kimi, GitHub Models, Ollama, LM Studio, or any
   OpenAI-/Anthropic-compatible endpoint.
 - **Stay in control.** File writes, shell commands, network access, and
   out-of-workspace writes go through Zero's permission and sandbox policy.
@@ -76,7 +76,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 
 ### From source
 
-Source builds require Go 1.26.9+.
+Source builds require Go 1.26.6+.
 
 ```bash
 git clone https://github.com/Gitlawb/zero.git
@@ -182,12 +182,8 @@ zero providers add custom-openai-compatible \
   --set-active
 ```
 
-For local models, run Ollama, LM Studio, or the [Atomic Chat](https://atomic.chat)
-desktop app, then use `zero setup` or `zero providers detect`. For Atomic Chat,
-load a model and enable its local OpenAI-compatible API (default
-`http://127.0.0.1:1337/v1`). Choose `atomic-chat-local`; detection includes the
-loaded model ID in the add command. If no usable ID is discovered, load a model
-and retry. Model IDs requiring shell-specific quoting use interactive setup.
+For local models, run Ollama or LM Studio and then use `zero setup` or
+`zero providers detect`.
 
 ## Daily Use
 
@@ -277,19 +273,6 @@ zero sandbox grants list
 Zero includes local file/search/edit/shell tools, `web_fetch` for public URLs,
 and MCP support for additional tools.
 
-`web_fetch` refuses loopback, private and other special-use addresses: it checks
-the URL before asking permission, resolves the host, and dials the address it
-validated so a name cannot resolve to something else in between.
-
-If `HTTP_PROXY`/`HTTPS_PROXY` is set, `web_fetch` and the provider connectivity
-probe use it, and that last step changes: the proxy is dialed and the target
-hostname is sent to it, so the proxy decides which address the request actually
-reaches. The URL is still checked and resolved locally first, but a proxy that
-answers differently can reach a private service. A forward proxy already sees
-and can rewrite every request through it, so this is the trust you accept by
-configuring one. Leave the variables unset for the checks to be enforced end to
-end.
-
 For local dev servers, use shell commands such as `curl` through `exec_command`
 so the normal sandbox and permission policy applies. Long-running commands stay
 attached to a background terminal session and can be listed or stopped from the
@@ -331,13 +314,6 @@ zero update --check   check for newer releases
 zero upgrade          download, verify, and install the latest release
 ```
 
-Cron keeps the newest 1,000 run outcomes per job in `runs.jsonl`. Each new run
-atomically replaces the history with the retained tail; existing larger histories
-are trimmed on their next run. Archive the file before that run if you need older
-outcomes. This retention does not delete session directories or reset fire counts.
-Malformed records and legacy lines of 1 MiB or more are skipped when reading or
-compacting history; new records of that size are rejected.
-
 ## Extending Zero
 
 ### Project and personal instructions

README_ZH.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.9+" src="https://img.shields.io/badge/Go-1.26.9+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
   <br>
@@ -23,7 +23,7 @@ zero exec --output-format stream-json < turns.jsonl
 
 ## 为什么选择 Zero
 
-- **使用你想要的模型。** 支持 OpenAI、Anthropic、Gemini、Groq、OpenRouter、DeepSeek、Mistral、xAI、Qwen、Kimi、GitHub Models、Ollama、LM Studio、Atomic Chat，或任何 OpenAI/Anthropic 兼容端点。
+- **使用你想要的模型。** 支持 OpenAI、Anthropic、Gemini、Groq、OpenRouter、DeepSeek、Mistral、xAI、Qwen、Kimi、GitHub Models、Ollama、LM Studio，或任何 OpenAI/Anthropic 兼容端点。
 - **保持控制权。** 文件写入、Shell 命令、网络访问和工作区外写入都经过 Zero 的权限和沙箱策略。
 - **在终端中工作。** TUI 具有模型/提供商选择器、图片输入、斜杠命令、实时计划/工具渲染、回滚滚动、主题以及恢复/分叉支持。
 - **无 TUI 也能工作。** `zero exec` 可脚本化，支持文本/JSON/stream-JSON I/O、隔离的工作树、规范优先运行，以及用于 CI 的有意义的退出码。
@@ -57,7 +57,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 
 ### 从源码构建
 
-源码构建需要 Go 1.26.9+。
+源码构建需要 Go 1.26.6+。
 
 ```bash
 git clone https://github.com/Gitlawb/zero.git
@@ -114,11 +114,7 @@ export LONGCAT_API_KEY=...
 zero providers setup longcat --set-active
 ```
 
-对于本地模型，运行 Ollama、LM Studio 或 [Atomic Chat](https://atomic.chat) 桌面应用，
-然后使用 `zero setup` 或 `zero providers detect`。使用 Atomic Chat 时，请先加载模型并启用
-本地 OpenAI 兼容 API（默认地址为 `http://127.0.0.1:1337/v1`），再选择 `atomic-chat-local`。
-检测生成的添加命令会包含已加载的模型 ID；如果未发现可用的 ID，请加载模型后重试。
-对于需要特定 Shell 转义的模型 ID，请使用交互式设置。
+对于本地模型，运行 Ollama 或 LM Studio，然后使用 `zero setup` 或 `zero providers detect`。
 
 ## 日常使用
 

docs/HOW_ZERO_WORKS.md

@@ -302,9 +302,8 @@ Conceptually, one requested tool goes through these phases:
    the model can inspect it and decide what to do next.
 6. **Render and persist** — the result is surfaced to the TUI, stream-JSON
    writer, or ACP client. TUI and exec record rich tool/session events for
-   resume/history; ACP persists conversational messages and completed tool-call
-   starts/results for load replay. Live streaming details and permission
-   exchanges remain client notifications rather than durable history.
+   resume/history; ACP currently persists conversational messages and streams
+   tool/permission updates to the client.
 
 Tool success and failure are both informative context. A successful `read_file`
 result gives the model file contents; a failed `edit_file` result gives the model
@@ -628,12 +627,7 @@ Core tool groups include:
   skills, `ask_user`, permission requests.
 - **Write tools**: `write_file`, `edit_file`, `apply_patch`, `update_plan`.
 - **Shell tools**: `exec_command`, `write_stdin`, legacy `bash`.
-- **Network tools**: `web_fetch` and optional web search backend. `web_fetch`
-  validates the URL before the permission prompt, refuses loopback/private/
-  special-use addresses, and dials the address it resolved. With
-  `HTTP_PROXY`/`HTTPS_PROXY` set, the proxy is dialed instead and resolves the
-  target itself, so destination enforcement ends at the proxy; see the note in
-  the README.
+- **Network tools**: `web_fetch` and optional web search backend.
 - **Local-control tools**: config-gated wrappers for browser, terminal, desktop,
   and artifact helpers backed by packages such as `internal/localcontrol` and
   `internal/browser`.

docs/INSTALL.md

@@ -153,7 +153,7 @@ describe a version that is no longer on disk. Prefer `mise upgrade`.
 go install github.com/Gitlawb/zero/cmd/zero@latest
 ```
 
-This builds from source, so it needs Go 1.26.9+ and it does not go through the
+This builds from source, so it needs Go 1.26.6+ and it does not go through the
 release archives. Two consequences worth knowing before you pick it:
 
 - On Linux you also need the sandbox helper, which is a separate binary and is
@@ -180,7 +180,7 @@ Build a local binary:
 go build -o zero ./cmd/zero
 ```
 
-Source builds require Go 1.26.9+.
+Source builds require Go 1.26.6+.
 
 ### Sandbox Helpers For Source Builds
 

docs/UPDATE.md

@@ -93,24 +93,14 @@ binary:
 
 | State on disk | Meaning |
 |---|---|
-| `<binary>.old` (or `<binary>.<suffix>.old`) plus a `.keep` marker, or a per-user update-recovery record naming that copy | A previous update could not restore the original binary. The `.old` file may be the last binary the updater verified; the installed one may be unverified. The `.keep` marker is in the installation directory and can be deleted; the identity-bound record is not, so deleting the marker alone does not end the refusal. |
+| `<binary>.old` (or `<binary>.<suffix>.old`) plus a `.keep` marker | A previous update could not restore the original binary. The `.old` file may be the last binary the updater verified; the installed one may be unverified. |
 | `<binary>.…old.<suffix>.recovery` | A previous update could not even write the marker, so it moved the last verified binary to that name. |
 | The binary is missing and one or more `*.old` files exist | The previous attempt was interrupted between moves. |
 
 The refusal names the paths involved and the two moves that end the state:
 either move the recovery binary back over the executable path, or — if the
-installed binary is the one you want — delete the recovery copy itself (not
-only the `.keep` marker) after verifying the installed binary, then update
-again. Deleting the marker alone is not enough: a failed restore also records
-that copy in per-user state outside the installation directory, and the next
-update consults that record even if the marker is gone.
-
-That trusted record lives under `%AppData%\zero\update-recovery` (per-user).
-The recovery copy and its `.keep` marker sit in the installation directory
-(per-machine). A second Windows account on the same machine does not see the
-first account's unresolved record; the sibling marker is the machine-visible
-signal for every account. There is no separate machine-wide store: writing one
-would need a shared writable location and ACL rules the updater does not own.
+installed binary is the one you want — delete the `.keep` marker (or the
+`.recovery` copy, once you have verified the installed binary) and update again.
 
 This is deliberately fail-closed and differs from older releases, which deleted
 `<binary>.old` and proceeded. The trade-off is that anyone who can write in the

go.mod

@@ -1,6 +1,6 @@
 module github.com/Gitlawb/zero
 
-go 1.26.9
+go 1.26.6
 
 require (
 	charm.land/bubbles/v2 v2.1.1
@@ -18,7 +18,6 @@ require (
 	github.com/ledongthuc/pdf v0.0.0-20250511090121-5959a4027728
 	golang.org/x/image v0.45.0
 	golang.org/x/sys v0.47.0
-	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/sh/v3 v3.13.1
 )
 

go.sum

@@ -70,9 +70,5 @@ golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
 mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=

internal/acp/agent.go

@@ -2,24 +2,18 @@ package acp
 
 import (
 	"context"
-	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"log"
-	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/modelregistry"
 	"github.com/Gitlawb/zero/internal/providercatalog"
 	"github.com/Gitlawb/zero/internal/providermodelcatalog"
 	"github.com/Gitlawb/zero/internal/providermodeldiscovery"
-	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/sandbox"
 	"github.com/Gitlawb/zero/internal/sessions"
 	"github.com/Gitlawb/zero/internal/tools"
@@ -36,42 +30,15 @@ type Deps struct {
 	DiscoverModels func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
 	NewProvider    func(profile config.ProviderProfile) (zeroruntime.Provider, error)
 	RunAgent       func(ctx context.Context, prompt string, provider zeroruntime.Provider, opts agent.Options) (agent.Result, error)
-	// BuildWorkspace creates the per-turn scoped tool workspace for a validated
-	// workspace root. Its Close method releases any resources the registry owns
-	// (notably MCP server connections) after the turn completes or is cancelled.
-	// Shell tools remain confined exactly like the exec surface — never unconfined
-	// on the host.
-	BuildWorkspace func(ctx context.Context, workspaceRoot string, resolved config.ResolvedConfig, mode agent.PermissionMode) (*Workspace, error)
+	// BuildWorkspace builds the SCOPED tool registry and the sandbox engine for a
+	// validated workspace root, so ACP shell tools (bash/exec_command) are confined
+	// exactly like the exec surface — never run unconfined on the host.
+	BuildWorkspace func(workspaceRoot string, resolved config.ResolvedConfig) (*tools.Registry, *sandbox.Engine, error)
 	// ResolveWorkspaceRoot validates + normalizes a client-supplied cwd (must be an
 	// existing directory; never the bare root). It is the file-tool confinement root.
 	ResolveWorkspaceRoot func(cwd string) (string, error)
-	// PersistEvents is an optional test seam for injecting event-store failures.
-	// It receives a COMPLETED TURN as one batch, never one event at a time: the
-	// batch is the unit the shared store keeps contiguous (see persistTurn).
-	PersistEvents func(sessionID string, inputs []sessions.AppendEventInput) error
-	Store         *sessions.Store
-	AgentInfo     Implementation
-}
-
-// Workspace is the per-turn execution environment passed to the agent. ACP does
-// not retain it across turns because MCP connections belong to the registry that
-// advertised their tools; keeping a stale registry after a cancelled turn would
-// leak its server process and its permission state into the next turn.
-type Workspace struct {
-	Registry       *tools.Registry
-	Sandbox        *sandbox.Engine
-	DeferThreshold int
-	Notices        []string
-	Cleanup        func() error
-}
-
-// Close releases resources created with the workspace. A nil cleanup is valid
-// for core-only workspaces.
-func (w *Workspace) Close() error {
-	if w == nil || w.Cleanup == nil {
-		return nil
-	}
-	return w.Cleanup()
+	Store                *sessions.Store
+	AgentInfo            Implementation
 }
 
 // Agent is the ACP agent server bound to one JSON-RPC connection (one editor).
@@ -107,14 +74,6 @@ type acpSession struct {
 	restrictModels bool
 	cancel         context.CancelFunc
 	history        []turnRecord
-
-	// readOnly marks a session published by session/load for a kind that is
-	// not resumable (a child, side or spec sub-run). Load still replays its
-	// transcript, which is the render-only use a client needs, but a prompt
-	// would continue the sub-run as a standalone conversation, which every
-	// other resume path refuses (sessions.IsResumableKind). Set once when the
-	// session is first registered and never changed, so it is read without mu.
-	readOnly bool
 }
 
 // NewAgent builds the ACP server and registers its method handlers on conn.
@@ -123,8 +82,6 @@ func NewAgent(conn *Conn, deps Deps) *Agent {
 	conn.Handle(MethodInitialize, a.handleInitialize)
 	conn.Handle(MethodSessionNew, a.handleSessionNew)
 	conn.Handle(MethodSessionLoad, a.handleSessionLoad)
-	conn.Handle(MethodSessionList, a.handleSessionList)
-	conn.Handle(MethodSessionResume, a.handleSessionResume)
 	conn.Handle(MethodSessionPrompt, a.handleSessionPrompt)
 	conn.Handle(MethodSessionSetMode, a.handleSetMode)
 	conn.Handle(MethodSessionSetConfigOption, a.handleSetConfigOption)
@@ -153,11 +110,11 @@ func (a *Agent) handleInitialize(_ context.Context, params json.RawMessage) (any
 	return InitializeResult{
 		ProtocolVersion: negotiated,
 		AgentCapabilities: AgentCapabilities{
-			// ACP v1 optional methods are advertised as empty capability objects;
-			// clients must gate session/list and session/resume on their presence.
-			LoadSession:         true,
-			PromptCapabilities:  PromptCapabilities{Image: true},
-			SessionCapabilities: &SessionCapabilities{List: &struct{}{}, Resume: &struct{}{}},
+			// Only advertise what ZERO actually implements: session/load (loadSession)
+			// and image prompts. session/resume + the session-capability sub-object
+			// are intentionally omitted since there is no resume handler yet.
+			LoadSession:        true,
+			PromptCapabilities: PromptCapabilities{Image: true},
 		},
 		AgentInfo: &info,
 		// ZERO owns credentials (BYOK) and does not delegate auth to the editor.
@@ -167,41 +124,12 @@ func (a *Agent) handleInitialize(_ context.Context, params json.RawMessage) (any
 
 // ---- session lifecycle ----
 
-// requestedWorkspace is the single rule for a cwd that arrived from the client,
-// applied before the value can reach ResolveWorkspaceRoot.
-//
-// THE REQUEST'S OWN CWD IS THE ONLY THING ALLOWED TO PICK A ROOT. Every params
-// type spells cwd as a plain string, so an absent field and an empty one decode
-// to exactly the same "", and the resolver treats "" as "use the directory this
-// process was started in" and joins a relative cwd onto it. Those two defaults
-// meet in the middle: `{"sessionId":"known"}` used to activate a persisted
-// session, and `{}` used to create one, both rooted at wherever the editor
-// happened to spawn `zero acp` — which then becomes the sandbox and file-tool
-// confinement root. The client never named that directory, so it is a root the
-// server invented, and ACP requires an absolute cwd on every method carrying
-// one. Rejecting here is what keeps a missing field from being answered with a
-// guess.
-func requestedWorkspace(cwd string) (string, error) {
-	trimmed := strings.TrimSpace(cwd)
-	if trimmed == "" {
-		return "", RPCError(codeInvalidParams, "cwd is required and must be an absolute path")
-	}
-	if !filepath.IsAbs(trimmed) {
-		return "", RPCError(codeInvalidParams, "cwd must be an absolute path: "+trimmed)
-	}
-	return trimmed, nil
-}
-
 func (a *Agent) handleSessionNew(ctx context.Context, params json.RawMessage) (any, error) {
 	var p NewSessionParams
 	if err := json.Unmarshal(params, &p); err != nil {
 		return nil, RPCError(codeInvalidParams, "invalid session/new params")
 	}
-	cwd, err := requestedWorkspace(p.Cwd)
-	if err != nil {
-		return nil, err
-	}
-	root, err := a.deps.ResolveWorkspaceRoot(cwd)
+	root, err := a.deps.ResolveWorkspaceRoot(p.Cwd)
 	if err != nil {
 		return nil, RPCError(codeInvalidParams, err.Error())
 	}
@@ -213,7 +141,7 @@ func (a *Agent) handleSessionNew(ctx context.Context, params json.RawMessage) (a
 	if err != nil {
 		return nil, RPCError(codeInternalError, "create session: "+err.Error())
 	}
-	sess, _ := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels, false)
+	sess := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels)
 	return NewSessionResult{
 		SessionID:     sess.id,
 		ConfigOptions: a.configOptions(sess),
@@ -226,90 +154,22 @@ func (a *Agent) handleSessionLoad(ctx context.Context, params json.RawMessage) (
 	if err := json.Unmarshal(params, &p); err != nil {
 		return nil, RPCError(codeInvalidParams, "invalid session/load params")
 	}
-	return a.activatePersistedSession(ctx, p, persistedSessionLoad)
-}
-
-func (a *Agent) handleSessionResume(ctx context.Context, params json.RawMessage) (any, error) {
-	var p ResumeSessionParams
-	if err := json.Unmarshal(params, &p); err != nil {
-		return nil, RPCError(codeInvalidParams, "invalid session/resume params")
-	}
-	return a.activatePersistedSession(ctx, p, persistedSessionResume)
-}
-
-type persistedSessionOperation uint8
-
-const (
-	persistedSessionLoad persistedSessionOperation = iota
-	persistedSessionResume
-)
-
-// activatePersistedSession restores the agent's internal conversation context
-// for both lifecycle methods. session/load additionally replays user-visible
-// history as ordered session/update notifications; session/resume deliberately
-// does not, which makes it safe for an already-rendered desktop reconnect.
-func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParams, operation persistedSessionOperation) (any, error) {
-	// BOTH METHODS, BEFORE ANYTHING IS LOOKED UP. session/resume shares this
-	// params type with session/load, so the wire cannot tell an omitted cwd from
-	// an empty one; the blank case used to be answered with the persisted cwd,
-	// which made {"sessionId":"known"} a complete, successful activation request.
-	// Validating here rather than in one handler is what keeps the two entry
-	// points from drifting apart.
-	cwd, err := requestedWorkspace(p.Cwd)
-	if err != nil {
-		return nil, err
-	}
 	meta, err := a.deps.Store.Get(p.SessionID)
 	if err != nil || meta == nil {
 		return nil, RPCError(codeInvalidParams, "session not found: "+p.SessionID)
 	}
-	if operation == persistedSessionResume && !sessions.IsResumableKind(meta.SessionKind) {
-		return nil, RPCError(codeInvalidParams, "session is not resumable: "+p.SessionID)
+	cwdInput := p.Cwd
+	if strings.TrimSpace(cwdInput) == "" {
+		cwdInput = meta.Cwd
 	}
-	if strings.TrimSpace(meta.Cwd) == "" {
-		return nil, RPCError(codeInvalidParams, "session has no persisted workspace: "+p.SessionID)
-	}
-	// SAME RULE ON THE WAY IN. Omitting a relative entry from the listing is not
-	// enough: a stored "." still resolves against this process's directory, so a
-	// client that hands back that same directory as its cwd would be sold the
-	// invented root as a match. A workspace that cannot be identified is not one
-	// this session can be restored into.
-	if !filepath.IsAbs(meta.Cwd) {
-		return nil, RPCError(codeInvalidParams, "session workspace is not an absolute path, so it cannot be identified: "+p.SessionID)
-	}
-	persistedRoot, err := a.deps.ResolveWorkspaceRoot(meta.Cwd)
-	if err != nil {
-		return nil, RPCError(codeInvalidParams, "persisted session workspace is unavailable: "+err.Error())
-	}
-	root, err := a.deps.ResolveWorkspaceRoot(cwd)
+	root, err := a.deps.ResolveWorkspaceRoot(cwdInput)
 	if err != nil {
 		return nil, RPCError(codeInvalidParams, err.Error())
 	}
-	// ACP session cwd is immutable. Loading history under a different root
-	// would give a conversation from one workspace access to another
-	// workspace's configuration, files, and tools.
-	if !sameWorkspace(root, persistedRoot) {
-		return nil, RPCError(codeInvalidParams, "session cwd does not match its persisted workspace")
-	}
 	// Load history BEFORE publishing the session so no concurrent prompt observes
 	// a half-initialized session (registerSession sets history under the lock and
 	// reuses an already-live session rather than orphaning its in-flight turn).
-	requireHistoryLog := operation == persistedSessionResume && meta.EventCount > 0
-	history, messages, historyWarning, historyErr := a.loadHistory(meta.SessionID, requireHistoryLog)
-	// RESUME PROMISES RESTORED CONTEXT, SO A FAILED RESTORATION IS A FAILED
-	// RESUME. historyErr used to do nothing but suppress replay and raise a
-	// warning: the session was registered and reported ready regardless, so a
-	// corrupt record or an unreadable events file left the caller holding a live,
-	// promptable session ID whose next prompt ran as a brand-new conversation
-	// under the old identity. Nothing in the response said so.
-	//
-	// Publication is now gated on restoration for resume. LOAD keeps the
-	// best-effort policy deliberately rather than by inheriting this helper: it
-	// replays what it has and warns about the rest, which is the right trade for
-	// a client rebuilding a transcript it can still scroll. Reported by @jatmn.
-	if operation == persistedSessionResume && historyErr != nil {
-		return nil, RPCError(codeInternalError, "restore session history: "+historyErr.Error())
-	}
+	history, historyErr := a.loadHistory(meta.SessionID)
 	model, models, restrictModels, err := a.resolveModelChoices(ctx, root)
 	if err != nil {
 		return nil, RPCError(codeInternalError, "config: "+err.Error())
@@ -320,39 +180,12 @@ func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParam
 			models = append(models, SessionConfigOptionValue{Value: persistedModel, Name: persistedModel})
 		}
 	}
-	// Resume has already refused a non-resumable kind above, so only load can
-	// reach here with one, and it publishes that session for viewing only.
-	readOnly := !sessions.IsResumableKind(meta.SessionKind)
-	sess, existed := a.registerSession(meta.SessionID, root, history, model, models, restrictModels, readOnly)
-	if existed {
-		_, messages, historyWarning, historyErr = a.refreshSessionHistory(sess, requireHistoryLog)
-		if operation == persistedSessionResume && historyErr != nil {
-			return nil, RPCError(codeInternalError, "restore session history: "+historyErr.Error())
-		}
-	}
-	note := &notifier{conn: a.conn, sessionID: sess.id}
-	if operation == persistedSessionLoad && historyErr == nil {
-		for _, message := range messages {
-			if message.tool != nil {
-				note.send(*message.tool)
-				continue
-			}
-			note.send(replayMessageChunk(message.role, replayMessageID(message.eventID), message.content))
-		}
-	}
+	sess := a.registerSession(meta.SessionID, root, history, model, models, restrictModels)
 	a.warnPersistence(
-		note,
-		"rehydrate session compaction",
-		"Could not apply session compaction. Raw session history was restored instead.",
-		historyWarning,
-		operation == persistedSessionLoad,
-	)
-	a.warnPersistence(
-		note,
+		&notifier{conn: a.conn, sessionID: sess.id},
 		"load session history",
 		"Could not load session history. The session is open, but earlier turns may be missing until storage recovers.",
 		historyErr,
-		operation == persistedSessionLoad,
 	)
 	return LoadSessionResult{
 		ConfigOptions: a.configOptions(sess),
@@ -360,80 +193,6 @@ func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParam
 	}, nil
 }
 
-func (a *Agent) handleSessionList(_ context.Context, params json.RawMessage) (any, error) {
-	var p ListSessionsParams
-	if len(params) > 0 {
-		if err := json.Unmarshal(params, &p); err != nil {
-			return nil, RPCError(codeInvalidParams, "invalid session/list params")
-		}
-	}
-	if p.Cursor != "" {
-		return nil, RPCError(codeInvalidParams, "invalid session/list cursor")
-	}
-	items, err := a.deps.Store.ListResumable()
-	if err != nil {
-		return nil, RPCError(codeInternalError, "list sessions: "+err.Error())
-	}
-	// The filter is the one cwd ACP leaves optional, so a blank one means "no
-	// filter" rather than an error — but a relative one is rebased onto this
-	// process's directory exactly like the others, and would then silently answer
-	// about a workspace the client never named.
-	var cwd string
-	if strings.TrimSpace(p.Cwd) != "" {
-		filter, err := requestedWorkspace(p.Cwd)
-		if err != nil {
-			return nil, err
-		}
-		cwd, err = a.deps.ResolveWorkspaceRoot(filter)
-		if err != nil {
-			return nil, RPCError(codeInvalidParams, err.Error())
-		}
-	}
-	result := ListSessionsResult{Sessions: make([]SessionInfo, 0, len(items))}
-	for _, item := range items {
-		// EVERY ENTRY IS RESOLVED, FILTER OR NO FILTER. Listing is a menu, and
-		// every item on it has to be orderable: activatePersistedSession
-		// resolves the persisted workspace and refuses what it cannot reach, so
-		// anything this loop cannot resolve is something the client would be
-		// offered and then denied.
-		//
-		// Resolving only when a cwd filter was supplied left two shapes through —
-		// a session whose workspace has since been deleted, and a legacy entry
-		// holding a relative path, which was then reported as cwd "." even though
-		// ACP requires SessionInfo.cwd to be absolute.
-		if strings.TrimSpace(item.Cwd) == "" {
-			continue
-		}
-		// A RELATIVE PERSISTED CWD HAS NO RECOVERABLE IDENTITY. Resolving one
-		// rebases it onto wherever this ACP server happens to be running and
-		// advertises that invented absolute path as the session's workspace — so a
-		// conversation created for one project could be resumed against another
-		// project's configuration, files and tools. The original base is not
-		// knowable from the metadata, so the honest answer is to omit the entry
-		// rather than to guess at it.
-		if !filepath.IsAbs(item.Cwd) {
-			continue
-		}
-		itemRoot, err := a.deps.ResolveWorkspaceRoot(item.Cwd)
-		if err != nil {
-			continue
-		}
-		if cwd != "" && !sameWorkspace(itemRoot, cwd) {
-			continue
-		}
-		result.Sessions = append(result.Sessions, SessionInfo{
-			SessionID: item.SessionID,
-			Title:     item.Title,
-			// The RESOLVED root, not the stored string: absolute as ACP
-			// requires, and the same value the client will hand back on resume.
-			Cwd:       itemRoot,
-			UpdatedAt: item.UpdatedAt,
-			Meta:      &SessionInfoMeta{ModelID: item.ModelID, CreatedAt: item.CreatedAt},
-		})
-	}
-	return result, nil
-}
-
 // ---- prompt turn ----
 
 func (a *Agent) handleSessionPrompt(ctx context.Context, params json.RawMessage) (any, error) {
@@ -445,9 +204,6 @@ func (a *Agent) handleSessionPrompt(ctx context.Context, params json.RawMessage)
 	if sess == nil {
 		return nil, RPCError(codeInvalidParams, "unknown session: "+p.SessionID)
 	}
-	if sess.readOnly {
-		return nil, RPCError(codeInvalidParams, "session is not resumable, so it was loaded for viewing only and cannot be prompted: "+p.SessionID)
-	}
 
 	// Serialize turns for this session so two prompts can't interleave history or
 	// fight over the single cancel slot. session/cancel still works concurrently
@@ -485,67 +241,13 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 	if err != nil {
 		return "", RPCError(codeInternalError, "provider: "+err.Error())
 	}
-	mode := sess.currentMode()
 	// Build the SCOPED registry + sandbox engine for this session's workspace so
 	// shell/file tools are confined to the workspace exactly like the exec surface.
-	// The workspace can also own MCP connections, which must be closed after every
-	// turn even if the agent run returns an error or the client cancels it.
-	workspace, err := a.deps.BuildWorkspace(ctx, sess.cwd, resolved, mode)
+	registry, sandboxEngine, err := a.deps.BuildWorkspace(sess.cwd, resolved)
 	if err != nil {
 		return "", RPCError(codeInternalError, "workspace: "+err.Error())
 	}
-	if workspace == nil || workspace.Registry == nil {
-		if workspace != nil {
-			_ = workspace.Close()
-		}
-		return "", RPCError(codeInternalError, "workspace: missing tool registry")
-	}
-	defer func() {
-		if err := workspace.Close(); err != nil {
-			log.Printf("acp: close workspace: %v", err)
-		}
-	}()
-	registry := workspace.Registry
-	sandboxEngine := workspace.Sandbox
 	note := &notifier{conn: a.conn, sessionID: sess.id}
-	for _, notice := range workspace.Notices {
-		if text := strings.TrimSpace(redaction.RedactString(notice, redaction.Options{})); text != "" {
-			note.text("\n\n[zero warning] " + text + "\n")
-		}
-	}
-	// Buffer the complete turn until RunAgent has a valid ACP outcome. A hard run
-	// failure is an aborted turn: neither live history nor durable history may
-	// retain its user/tool prefix under an RPC error. StopCancelled is a valid
-	// outcome and commits through the same boundary below.
-	pendingEvents := make([]sessions.AppendEventInput, 0, 4)
-	queue := func(input sessions.AppendEventInput) {
-		pendingEvents = append(pendingEvents, input)
-	}
-	queue(messageEvent("user", userText))
-
-	visionCache := make(map[string]bool)
-	var visionCacheMu sync.Mutex
-	supportsVision := func(modelID string) bool {
-		modelID = strings.TrimSpace(modelID)
-		if modelID == "" {
-			return false
-		}
-		visionCacheMu.Lock()
-		defer visionCacheMu.Unlock()
-		if cached, ok := visionCache[modelID]; ok {
-			return cached
-		}
-		supported := a.modelSupportsVision(ctx, resolved.Provider, modelID)
-		visionCache[modelID] = supported
-		return supported
-	}
-	effectivePrompt := userText
-	if len(images) > 0 && !supportsVision(resolved.Provider.Model) {
-		msg := fmt.Sprintf("Model %s does not support image input; ignoring %d prompt image(s).", resolved.Provider.Model, len(images))
-		note.text("[zero] " + msg + "\n\n")
-		effectivePrompt = fmt.Sprintf("[Note: %s]\n\n%s", msg, userText)
-		images = nil
-	}
 
 	opts := agent.Options{
 		Cwd:            sess.cwd,
@@ -554,19 +256,13 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		Model:          resolved.Provider.Model,
 		Registry:       registry,
 		Sandbox:        sandboxEngine,
-		PermissionMode: mode,
-		DeferThreshold: workspace.DeferThreshold,
+		PermissionMode: sess.currentMode(),
 		MaxTurns:       resolved.MaxTurns,
 		Images:         images,
-		SupportsVision: supportsVision,
 		OnText:         note.text,
 		OnReasoning:    note.thought,
-		OnToolCall: func(call agent.ToolCall) {
-			queue(toolCallEvent(call))
-			note.toolCall(call)
-		},
+		OnToolCall:     note.toolCall,
 		OnToolResult: func(result agent.ToolResult) {
-			queue(toolResultEvent(result))
 			note.toolResult(result)
 			if result.Name == "update_plan" {
 				a.emitPlan(registry, note)
@@ -577,38 +273,21 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		},
 	}
 
-	agentPrompt := buildPrompt(sess.snapshotHistory(), effectivePrompt)
+	agentPrompt := buildPrompt(sess.snapshotHistory(), userText)
 	result, runErr := a.deps.RunAgent(ctx, agentPrompt, provider, opts)
-	if result.FinalAnswer != "" {
-		queue(messageEvent("assistant", result.FinalAnswer))
-	}
+
 	reason, stopErr := stopReasonFor(result, runErr)
 	if stopErr != nil {
 		return "", RPCError(codeInternalError, stopErr.Error())
 	}
-	// ONE BATCH, ONE LOCK. The outcome gate above decides WHETHER the turn is
-	// committed; the store batch decides WHICH RECORDS STAY TOGETHER relative to
-	// other writers, and these are different guarantees. Persisting the buffer
-	// one event per call took and released the store's session lock between
-	// events, so a second ACP instance holding the same session — its turnMu is
-	// its own, only the store is shared — could append its whole turn in the
-	// gap: user A, user B, answer B, answer A. Every write was individually
-	// locked and the log was valid, but a fresh load pairs prose by order and
-	// reconstructed three wrong turns from two right ones. Before this branch,
-	// persistTurn handed the user and assistant events to AppendEvents together;
-	// buffering until the outcome is known was correct, splitting the commit
-	// into singleton writes was not. The store writes a batch under one lock and
-	// one file write, which is the contiguity restored here — not a disk
-	// transaction, and not a promise about crashes mid-fsync. Reported by @jatmn.
-	persistenceErr := a.persistTurn(sess.id, pendingEvents)
-	sess.appendHistory(turnRecord{user: userText, assistant: result.FinalAnswer})
-	a.warnPersistence(
-		note,
-		"save session history",
-		"Could not save session history. This turn is available in memory, but future resume may miss it until storage recovers.",
-		persistenceErr,
-		true,
-	)
+	if err := a.persistTurn(sess, userText, result.FinalAnswer); err != nil {
+		a.warnPersistence(
+			note,
+			"save session history",
+			"Could not save session history. This turn is available in memory, but future resume may miss it until storage recovers.",
+			err,
+		)
+	}
 	return reason, nil
 }
 
@@ -867,159 +546,39 @@ func (a *Agent) configOptions(s *acpSession) []SessionConfigOption {
 
 // ---- persistence + continuity ----
 
-// persistTurn commits a completed turn's buffered events as one store batch, so
-// no other writer's records can land between them. A failure is the failure of
-// the whole batch: nothing after a failed prerequisite is appended on its own.
-func (a *Agent) persistTurn(sessionID string, inputs []sessions.AppendEventInput) error {
-	if len(inputs) == 0 {
-		return nil
-	}
-	if a.deps.PersistEvents != nil {
-		return a.deps.PersistEvents(sessionID, inputs)
-	}
+func (a *Agent) persistTurn(sess *acpSession, user, assistant string) error {
+	defer sess.appendHistory(turnRecord{user: user, assistant: assistant})
 	if a.deps.Store == nil {
 		return nil
 	}
-	_, err := a.deps.Store.AppendEvents(sessionID, inputs)
+	events := []sessions.AppendEventInput{
+		{
+			Type:    sessions.EventMessage,
+			Payload: map[string]any{"role": "user", "content": user},
+		},
+	}
+	if assistant != "" {
+		events = append(events, sessions.AppendEventInput{
+			Type:    sessions.EventMessage,
+			Payload: map[string]any{"role": "assistant", "content": assistant},
+		})
+	}
+	_, err := a.deps.Store.AppendEvents(sess.id, events)
 	return err
 }
 
-func messageEvent(role, content string) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type:    sessions.EventMessage,
-		Payload: map[string]any{"role": role, "content": content},
-	}
-}
-
-func toolCallEvent(call agent.ToolCall) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type: sessions.EventToolCall,
-		Payload: map[string]any{
-			"toolCallId": call.ID,
-			"name":       call.Name,
-			"arguments":  call.Arguments,
-		},
-	}
-}
-
-func toolResultEvent(result agent.ToolResult) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type: sessions.EventToolResult,
-		Payload: map[string]any{
-			"toolCallId":   result.ToolCallID,
-			"name":         result.Name,
-			"status":       result.Status,
-			"output":       result.Output,
-			"changedFiles": append([]string(nil), result.ChangedFiles...),
-		},
-	}
-}
-
-// persistedMessage is one entry of the restored transcript in stored order. It
-// is either a message (role/content) or a tool-call notification (tool), never
-// both: keeping them in ONE ordered slice is what preserves the interleaving a
-// client needs to redraw the conversation as it originally happened.
-type persistedMessage struct {
-	eventID string
-	role    string
-	content string
-	// tool is set for a replayed tool call or its result, and is already in wire
-	// shape — it comes from the same toolCallStart/toolCallResult mapping the
-	// live turn uses, so a replayed tool call renders identically to a fresh one
-	// and there is no second mapping to drift out of sync.
-	tool *ToolCallUpdate
-}
-
-func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRecord, []persistedMessage, error, error) {
+func (a *Agent) loadHistory(sessionID string) ([]turnRecord, error) {
 	if a.deps.Store == nil {
-		return nil, nil, nil, nil
+		return nil, nil
 	}
-	// THE EFFECTIVE CONVERSATION, NOT THE RAW LOG. A compacted session keeps its
-	// original prefix on disk alongside an EventCompaction that names the events
-	// it replaced and carries their durable summary. ReadEvents hands back both,
-	// so restoring from it replayed superseded turns AND dropped the summary that
-	// replaced them — resume then seeded the next turn with context the
-	// conversation had already moved past, and load visibly resurrected
-	// transcript entries the user had seen compacted away.
-	//
-	// ReadRehydratedEvents is the projection the TUI and exec paths already use
-	// (internal/tui/session.go, internal/sessions/exec_session.go), so all three
-	// now agree on what the conversation IS. Switching readers alone is not
-	// enough: rehydration substitutes the compaction event in place of the events
-	// it replaced, so a loop that skips everything but EventMessage would drop the
-	// summary exactly as before. It is projected below. Reported by @jatmn.
-	events, eventLogPresent, err := a.deps.Store.ReadRehydratedEventsWithPresence(sessionID)
-	var rehydrateWarning error
+	events, err := a.deps.Store.ReadEvents(sessionID)
 	if err != nil {
-		rehydrateWarning = err
-		events, eventLogPresent, err = a.deps.Store.ReadEventsWithPresence(sessionID)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-	}
-	if requireHistoryLog && !eventLogPresent {
-		return nil, nil, nil, fmt.Errorf("zero session %s event log is missing", sessionID)
+		return nil, err
 	}
 	var records []turnRecord
-	var messages []persistedMessage
-	activeToolCalls := make(map[string]string)
 	var pendingUser string
 	havePending := false
 	for _, e := range events {
-		if e.Type == sessions.EventCompaction {
-			// The summary stands in for the turns it replaced, so it enters the
-			// history as an assistant message: it is prior context the next turn
-			// must see, and the wire has no separate role for it.
-			raw, marshalErr := json.Marshal(e.Payload)
-			if marshalErr != nil {
-				continue
-			}
-			var payload struct {
-				Summary string `json:"summary"`
-			}
-			if json.Unmarshal(raw, &payload) != nil || strings.TrimSpace(payload.Summary) == "" {
-				continue
-			}
-			messages = append(messages, persistedMessage{
-				eventID: persistedMessageIdentity(sessionID, e),
-				role:    "assistant",
-				content: payload.Summary,
-			})
-			records = append(records, turnRecord{user: pendingUser, assistant: payload.Summary})
-			pendingUser = ""
-			havePending = false
-			continue
-		}
-		// TOOL ACTIVITY IS PART OF THE TRANSCRIPT, NOT DECORATION. A restored
-		// conversation that shows only the prose reads as if the agent asserted
-		// its edits and command output from nowhere: the user sees "I updated
-		// scope.go" with no record that any tool ran. These are collected for
-		// replay only. They deliberately do NOT enter turnRecord, so the prompt
-		// context a resumed turn receives stays byte-identical to what it was —
-		// load and resume continue to consume the SAME effective history, and
-		// only the wire rendering differs. Reported by @jatmn.
-		if e.Type == sessions.EventToolCall || e.Type == sessions.EventToolResult {
-			if upd := replayToolUpdate(e); upd != nil {
-				rawID := upd.ToolCallID
-				if e.Type == sessions.EventToolResult {
-					replayID, ok := activeToolCalls[rawID]
-					if !ok {
-						continue
-					}
-					upd.ToolCallID = replayID
-					delete(activeToolCalls, rawID)
-				} else {
-					replayID := replayToolCallID(persistedMessageIdentity(sessionID, e))
-					activeToolCalls[rawID] = replayID
-					upd.ToolCallID = replayID
-				}
-				messages = append(messages, persistedMessage{
-					eventID: persistedMessageIdentity(sessionID, e),
-					tool:    upd,
-				})
-			}
-			continue
-		}
 		if e.Type != sessions.EventMessage {
 			continue
 		}
@@ -1036,14 +595,12 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 		}
 		switch msg.Role {
 		case "user":
-			messages = append(messages, persistedMessage{eventID: persistedMessageIdentity(sessionID, e), role: msg.Role, content: msg.Content})
 			if havePending {
 				records = append(records, turnRecord{user: pendingUser})
 			}
 			pendingUser = msg.Content
 			havePending = true
 		case "assistant":
-			messages = append(messages, persistedMessage{eventID: persistedMessageIdentity(sessionID, e), role: msg.Role, content: msg.Content})
 			records = append(records, turnRecord{user: pendingUser, assistant: msg.Content})
 			pendingUser = ""
 			havePending = false
@@ -1052,89 +609,10 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 	if havePending {
 		records = append(records, turnRecord{user: pendingUser})
 	}
-	return records, messages, rehydrateWarning, nil
+	return records, nil
 }
 
-// replayToolUpdate rebuilds the ACP notification for one stored tool event.
-//
-// The stored toolCallId is returned here as a correlation key. loadHistory maps
-// each call occurrence to a stable session-wide replay identity and applies that
-// identity to its result. Older records wrote the field as "id", so both
-// spellings are accepted — the TUI projection already does the same
-// (internal/tui/session.go).
-//
-// A record that carries no usable id is skipped rather than replayed under a
-// synthesized one: an unpairable update is worse than a missing row.
-func replayToolUpdate(event sessions.Event) *ToolCallUpdate {
-	raw, err := json.Marshal(event.Payload)
-	if err != nil {
-		return nil
-	}
-	var payload struct {
-		Name         string   `json:"name"`
-		ToolCallID   string   `json:"toolCallId"`
-		ID           string   `json:"id"`
-		Arguments    string   `json:"arguments"`
-		Status       string   `json:"status"`
-		Output       string   `json:"output"`
-		ChangedFiles []string `json:"changedFiles"`
-	}
-	if json.Unmarshal(raw, &payload) != nil {
-		return nil
-	}
-	id := payload.ToolCallID
-	if id == "" {
-		id = payload.ID
-	}
-	if id == "" {
-		return nil
-	}
-	if event.Type == sessions.EventToolCall {
-		upd := toolCallStart(agent.ToolCall{ID: id, Name: payload.Name, Arguments: payload.Arguments})
-		return &upd
-	}
-	status := tools.Status(payload.Status)
-	if status == "" {
-		status = tools.StatusOK
-	}
-	upd := toolCallResult(agent.ToolResult{
-		ToolCallID:   id,
-		Name:         payload.Name,
-		Status:       status,
-		Output:       payload.Output,
-		ChangedFiles: append([]string(nil), payload.ChangedFiles...),
-	})
-	return &upd
-}
-
-func persistedMessageIdentity(sessionID string, event sessions.Event) string {
-	if event.ID != "" {
-		return event.ID
-	}
-	return fmt.Sprintf("%s:%d", sessionID, event.Sequence)
-}
-
-// replayMessageID maps ZERO's stable event identity to a standards-shaped UUID
-// without leaking or parsing the event id on the wire. The same stored message
-// receives the same opaque id across loads, which also gives clients an exact
-// chunk boundary when two adjacent persisted messages have the same role.
-func replayMessageID(eventID string) string {
-	return replayOpaqueID("message", eventID)
-}
-
-func replayToolCallID(eventID string) string {
-	return replayOpaqueID("tool-call", eventID)
-}
-
-func replayOpaqueID(kind, eventID string) string {
-	sum := sha256.Sum256([]byte("zero-acp-" + kind + ":" + eventID))
-	b := sum[:16]
-	b[6] = (b[6] & 0x0f) | 0x50
-	b[8] = (b[8] & 0x3f) | 0x80
-	return fmt.Sprintf("%x-%x-%x-%x-%x", b[:4], b[4:6], b[6:8], b[8:10], b[10:16])
-}
-
-func (a *Agent) warnPersistence(note *notifier, action string, message string, err error, notify bool) {
+func (a *Agent) warnPersistence(note *notifier, action string, message string, err error) {
 	if err == nil {
 		return
 	}
@@ -1143,7 +621,7 @@ func (a *Agent) warnPersistence(note *notifier, action string, message string, e
 		sessionID = note.sessionID
 	}
 	log.Printf("zero acp: failed to %s for session %s: %v", action, sessionID, err)
-	if note != nil && notify {
+	if note != nil {
 		note.text("\n\n[zero warning] " + message + "\n")
 	}
 }
@@ -1190,34 +668,18 @@ func promptImages(blocks []ContentBlock) []zeroruntime.ImageBlock {
 
 // registerSession publishes a session under the agent's lock. If one is already
 // registered for id (e.g. a re-load of an in-flight session) the existing live
-// session is returned rather than orphaning its turn or resetting its mode/model.
-// The bool reports that case so persisted activation can re-read and apply disk
-// history under turnMu. history is set BEFORE first publication so no concurrent
-// prompt can read a half-initialized session.
-func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool, readOnly bool) (*acpSession, bool) {
+// session is returned unchanged rather than orphaning its turn or resetting its
+// mode/model. history is set BEFORE publishing so no concurrent prompt can read a
+// half-initialized session.
+func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool) *acpSession {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 	if existing := a.sessions[id]; existing != nil {
-		return existing, true
+		return existing
 	}
-	sess := &acpSession{id: id, cwd: cwd, mode: agent.PermissionModeAuto, model: model, models: models, restrictModels: restrictModels, history: history, readOnly: readOnly}
+	sess := &acpSession{id: id, cwd: cwd, mode: agent.PermissionModeAuto, model: model, models: models, restrictModels: restrictModels, history: history}
 	a.sessions[id] = sess
-	return sess, false
-}
-
-// refreshSessionHistory is the activation apply boundary for an already-live
-// session. The history is read while prompts are excluded, then applied to the
-// same object the prompt path uses. Re-reading here avoids overwriting a turn
-// that committed between activatePersistedSession's pre-publication read and
-// discovering that another activation had already registered the session.
-func (a *Agent) refreshSessionHistory(sess *acpSession, requireHistoryLog bool) ([]turnRecord, []persistedMessage, error, error) {
-	sess.turnMu.Lock()
-	defer sess.turnMu.Unlock()
-	history, messages, warning, err := a.loadHistory(sess.id, requireHistoryLog)
-	if err == nil {
-		sess.setHistory(history)
-	}
-	return history, messages, warning, err
+	return sess
 }
 
 func (a *Agent) session(id string) *acpSession {
@@ -1300,77 +762,8 @@ func (s *acpSession) appendHistory(rec turnRecord) {
 	s.mu.Unlock()
 }
 
-func (s *acpSession) setHistory(history []turnRecord) {
-	s.mu.Lock()
-	s.history = append([]turnRecord(nil), history...)
-	s.mu.Unlock()
-}
-
 func (s *acpSession) snapshotHistory() []turnRecord {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	return append([]turnRecord(nil), s.history...)
 }
-
-// sameWorkspace reports whether two resolved roots name the same directory.
-//
-// STRING EQUALITY IS NOT DIRECTORY IDENTITY. ResolveWorkspaceRoot is abs plus
-// filepath.Clean plus a stat: it does not fold case and does not resolve
-// junctions, so one directory reached by two spellings produces two different
-// roots. A session persisted from the TUI was then unresumable from an editor
-// holding a different spelling of the same project folder, and session/list
-// filtered by the other spelling returned nothing — not a failed resume but an
-// invisible one, on exactly the case this feature exists for.
-//
-// filepath.EvalSymlinks is NOT the fix on Windows: it normalises a drive letter
-// but returns a junction path unchanged, so the alias survives it. Junctions need
-// no privilege, so this is ordinary rather than exotic. os.SameFile compares the
-// filesystem's own identity for the two directories, which is the question being
-// asked.
-//
-// The string comparison stays as the fast path, and a stat failure falls back to
-// it rather than widening the match — this gate refuses access to another
-// workspace's files and configuration, so an unanswerable comparison denies.
-func sameWorkspace(left, right string) bool {
-	if left == right {
-		return true
-	}
-	leftInfo, err := os.Stat(left)
-	if err != nil {
-		return false
-	}
-	rightInfo, err := os.Stat(right)
-	if err != nil {
-		return false
-	}
-	return os.SameFile(leftInfo, rightInfo)
-}
-
-func (a *Agent) modelSupportsVision(ctx context.Context, profile config.ProviderProfile, modelID string) bool {
-	trimmed := strings.TrimSpace(modelID)
-	if trimmed == "" {
-		return false
-	}
-	if a.deps.DiscoverModels != nil {
-		if discovered, err := a.deps.DiscoverModels(ctx, profile); err == nil {
-			for _, dm := range discovered {
-				if strings.EqualFold(strings.TrimSpace(dm.ID), trimmed) {
-					if len(dm.InputModalities) > 0 {
-						for _, mod := range dm.InputModalities {
-							if strings.EqualFold(strings.TrimSpace(mod), "image") {
-								return true
-							}
-						}
-						return false
-					}
-					break
-				}
-			}
-		}
-	}
-	reg, _ := modelregistry.DefaultRegistry()
-	if entry, known := reg.Resolve(trimmed); known {
-		return entry.Supports(modelregistry.ModelCapabilityVision)
-	}
-	return modelregistry.SupportsVision(reg, trimmed)
-}

internal/acp/jsonrpc.go

@@ -89,13 +89,6 @@ type Conn struct {
 
 	handlers  map[string]HandlerFunc
 	notifiers map[string]NotifyFunc
-	// Notifications for one method are an ordered stream: session/update in
-	// particular is stateful, so dispatching every frame in an unrelated
-	// goroutine can make a later chunk overtake an earlier one. Different
-	// methods retain independent tails, keeping session/cancel responsive while
-	// an update handler is busy.
-	notifyMu    sync.Mutex
-	notifyTails map[string]chan struct{}
 
 	mu      sync.Mutex
 	nextID  int64
@@ -113,12 +106,11 @@ type Conn struct {
 // lifetime.
 func NewConn(r io.Reader, w io.Writer) *Conn {
 	return &Conn{
-		rawReader:   r,
-		w:           w,
-		handlers:    make(map[string]HandlerFunc),
-		notifiers:   make(map[string]NotifyFunc),
-		notifyTails: make(map[string]chan struct{}),
-		pending:     make(map[int64]chan rpcMessage),
+		rawReader: r,
+		w:         w,
+		handlers:  make(map[string]HandlerFunc),
+		notifiers: make(map[string]NotifyFunc),
+		pending:   make(map[int64]chan rpcMessage),
 	}
 }
 
@@ -311,7 +303,11 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 		}(msg)
 	case msg.isNotify():
 		if fn := c.notifiers[msg.Method]; fn != nil {
-			c.dispatchNotification(ctx, msg, fn)
+			c.wg.Add(1)
+			go func(m rpcMessage) {
+				defer c.wg.Done()
+				fn(ctx, m.Params)
+			}(msg)
 		}
 	default:
 		// Malformed frame; reply only if we can identify a request id.
@@ -321,35 +317,6 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 	}
 }
 
-// dispatchNotification preserves wire order within one method without making
-// unrelated notification methods wait for each other. The read loop installs
-// each tail before starting its goroutine, so goroutine scheduling cannot
-// reorder the chain it observes.
-func (c *Conn) dispatchNotification(ctx context.Context, msg rpcMessage, fn NotifyFunc) {
-	c.notifyMu.Lock()
-	previous := c.notifyTails[msg.Method]
-	done := make(chan struct{})
-	c.notifyTails[msg.Method] = done
-	c.notifyMu.Unlock()
-
-	c.wg.Add(1)
-	go func() {
-		defer c.wg.Done()
-		defer func() {
-			close(done)
-			c.notifyMu.Lock()
-			if c.notifyTails[msg.Method] == done {
-				delete(c.notifyTails, msg.Method)
-			}
-			c.notifyMu.Unlock()
-		}()
-		if previous != nil {
-			<-previous
-		}
-		fn(ctx, msg.Params)
-	}()
-}
-
 func (c *Conn) dispatchRequest(ctx context.Context, msg rpcMessage) {
 	fn := c.handlers[msg.Method]
 	if fn == nil {

internal/acp/jsonrpc_test.go

@@ -360,86 +360,6 @@ func TestConnNotification(t *testing.T) {
 	}
 }
 
-func TestConnNotificationsForOneMethodStayInWireOrder(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	firstStarted := make(chan struct{})
-	releaseFirst := make(chan struct{})
-	delivered := make(chan int, 2)
-	b.HandleNotify("update", func(_ context.Context, params json.RawMessage) {
-		var in struct{ Sequence int }
-		_ = json.Unmarshal(params, &in)
-		if in.Sequence == 1 {
-			close(firstStarted)
-			<-releaseFirst
-		}
-		delivered <- in.Sequence
-	})
-
-	if err := a.Notify("update", map[string]int{"Sequence": 1}); err != nil {
-		t.Fatalf("first notify: %v", err)
-	}
-	select {
-	case <-firstStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("first notification did not start")
-	}
-	if err := a.Notify("update", map[string]int{"Sequence": 2}); err != nil {
-		t.Fatalf("second notify: %v", err)
-	}
-	select {
-	case sequence := <-delivered:
-		t.Fatalf("notification %d overtook the blocked first notification", sequence)
-	case <-time.After(25 * time.Millisecond):
-	}
-	close(releaseFirst)
-	for want := 1; want <= 2; want++ {
-		select {
-		case got := <-delivered:
-			if got != want {
-				t.Fatalf("notification order = ...,%d; want %d", got, want)
-			}
-		case <-time.After(2 * time.Second):
-			t.Fatalf("notification %d was not delivered", want)
-		}
-	}
-}
-
-func TestConnDifferentNotificationMethodsStayConcurrent(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	updateStarted := make(chan struct{})
-	releaseUpdate := make(chan struct{})
-	cancelDelivered := make(chan struct{})
-	b.HandleNotify("update", func(context.Context, json.RawMessage) {
-		close(updateStarted)
-		<-releaseUpdate
-	})
-	b.HandleNotify("cancel", func(context.Context, json.RawMessage) {
-		close(cancelDelivered)
-	})
-
-	if err := a.Notify("update", nil); err != nil {
-		t.Fatalf("update notify: %v", err)
-	}
-	select {
-	case <-updateStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("update notification did not start")
-	}
-	if err := a.Notify("cancel", nil); err != nil {
-		t.Fatalf("cancel notify: %v", err)
-	}
-	select {
-	case <-cancelDelivered:
-	case <-time.After(2 * time.Second):
-		t.Fatal("different notification method was blocked behind update")
-	}
-	close(releaseUpdate)
-}
-
 func TestConnMethodNotFound(t *testing.T) {
 	a, _, stop := connPair(t)
 	defer stop()

internal/acp/permission.go

@@ -142,15 +142,13 @@ func actionOffered(optionID string, offered []PermissionOption) bool {
 // session/request_permission request from a ZERO permission request.
 func permissionToolCall(req agent.PermissionRequest) ToolCallUpdate {
 	args := marshalArgs(req.Args)
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		ToolCallID: req.ToolCallID,
 		Title:      toolTitle(req.ToolName, string(args)),
 		Kind:       toolKindFor(req.ToolName),
 		Status:     ToolStatusPending,
 		RawInput:   rawInputBytes(args),
 	}
-	attachBrowserToolDetails(&upd, req.ToolName)
-	return upd
 }
 
 func marshalArgs(args map[string]any) []byte {

internal/acp/permission_test.go

@@ -82,17 +82,3 @@ func TestPermissionToolCall(t *testing.T) {
 		t.Error("expected rawInput from args")
 	}
 }
-
-func TestPermissionToolCallKeepsTheBrowserDescriptor(t *testing.T) {
-	call := permissionToolCall(agent.PermissionRequest{
-		ToolCallID: "browser-1",
-		ToolName:   "browser_connect",
-		Args:       map[string]any{"target": "127.0.0.1:9222"},
-	})
-	if got := browserDescriptor(t, call); got != (BrowserToolDetails{Version: 1, Command: "connect"}) {
-		t.Fatalf("browser descriptor = %#v", got)
-	}
-	if call.Title != "browser connect" {
-		t.Fatalf("title = %q", call.Title)
-	}
-}

internal/acp/translate.go

@@ -2,10 +2,7 @@ package acp
 
 import (
 	"encoding/json"
-	"net/url"
-	"path/filepath"
 	"strings"
-	"unicode"
 	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/agent"
@@ -20,14 +17,6 @@ func agentMessageChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentMessageChunk, Content: TextBlock(delta)}
 }
 
-func replayMessageChunk(role, messageID, text string) ContentChunk {
-	update := UpdateAgentMessageChunk
-	if role == "user" {
-		update = UpdateUserMessageChunk
-	}
-	return ContentChunk{SessionUpdate: update, MessageID: messageID, Content: TextBlock(text)}
-}
-
 func agentThoughtChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentThoughtChunk, Content: TextBlock(delta)}
 }
@@ -55,125 +44,12 @@ func toolKindFor(name string) string {
 
 // toolTitle builds a concise human title, e.g. "read_file src/main.go".
 func toolTitle(name, rawArgs string) string {
-	if browser, ok := browserToolDetails(name); ok {
-		return browserToolTitle(browser.Command, rawArgs)
-	}
 	if hint := primaryArgHint(rawArgs); hint != "" {
 		return name + " " + hint
 	}
 	return name
 }
 
-// browserToolDetails identifies ZERO's local browser helpers without treating
-// similarly named MCP tools as browser automation. The descriptor intentionally
-// contains no request data: ACP tool input is already protocol-visible, but a
-// durable UI must not need to retain text, local CDP targets, or full URLs just
-// to recognise the browser operation.
-func browserToolDetails(name string) (*BrowserToolDetails, bool) {
-	const prefix = "browser_"
-	command, ok := strings.CutPrefix(name, prefix)
-	if !ok {
-		return nil, false
-	}
-	switch command {
-	case "install", "launch", "connect", "open", "snapshot", "click", "type", "press", "action":
-		return &BrowserToolDetails{Version: 1, Command: command}, true
-	default:
-		return nil, false
-	}
-}
-
-const zeroBrowserMetaKey = "github.com/Gitlawb/zero/browser"
-
-// attachBrowserToolDetails stores ZERO's browser descriptor in ACP's reserved
-// extension channel. Keeping this in one helper prevents start, result, and
-// permission payloads from drifting onto different wire shapes.
-func attachBrowserToolDetails(update *ToolCallUpdate, name string) {
-	browser, ok := browserToolDetails(name)
-	if !ok {
-		return
-	}
-	raw, err := json.Marshal(browser)
-	if err != nil {
-		return
-	}
-	update.Meta = map[string]json.RawMessage{zeroBrowserMetaKey: raw}
-}
-
-// browserToolTitle avoids putting browser_type text, an attached DevTools
-// endpoint, or a URL query/fragment in a tool-card title. Those values can
-// carry credentials or session data; the UI only needs the operation and, for
-// navigation, a human-recognisable origin.
-func browserToolTitle(command, rawArgs string) string {
-	switch command {
-	case "action":
-		action, ok := exactJSONStringArg(rawArgs, "command")
-		if !ok {
-			return "browser action"
-		}
-		if action, ok := tools.NormalizedBrowserActionCommand(action); ok {
-			return "browser action " + action
-		}
-		return "browser action"
-	case "open":
-		rawURL, ok := exactJSONStringArg(rawArgs, "url")
-		if !ok {
-			return "browser open"
-		}
-		normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-		if err != nil {
-			return "browser open"
-		}
-		u, err := url.Parse(normalized)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			return "browser open"
-		}
-		origin := u.Scheme + "://" + u.Host
-		if !browserTitleTextSafe(origin) {
-			return "browser open"
-		}
-		return "browser open " + truncateHint(origin)
-	default:
-		return "browser " + command
-	}
-}
-
-// browserTitleTextSafe validates text after URL parsing has decoded escaped
-// UTF-8 in the host. Valid UTF-8 alone is not presentation-safe: control,
-// format/bidi, and line/paragraph separator runes can reorder or split the
-// permission label shown to a user. The execution URL remains unchanged.
-func browserTitleTextSafe(text string) bool {
-	if !utf8.ValidString(text) {
-		return false
-	}
-	for _, r := range text {
-		if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-			return false
-		}
-	}
-	return true
-}
-
-// exactJSONStringArg mirrors ZERO's map-based tool argument decoding: only the
-// exact JSON key is considered, and a non-string value is invalid. In
-// particular, an incidental "URL" key must not change a permission title when
-// browser_open will only read "url".
-func exactJSONStringArg(rawArgs, key string) (string, bool) {
-	var args map[string]json.RawMessage
-	if json.Unmarshal([]byte(rawArgs), &args) != nil {
-		return "", false
-	}
-	raw, ok := args[key]
-	if !ok {
-		return "", false
-	}
-	var value string
-	if json.Unmarshal(raw, &value) != nil {
-		return "", false
-	}
-	return value, true
-}
-
 // primaryArgHint extracts the most relevant argument (path/pattern/command) from
 // raw JSON arguments. Best-effort; returns "" when it can't parse.
 func primaryArgHint(rawArgs string) string {
@@ -213,7 +89,7 @@ func rawInput(args string) json.RawMessage {
 // toolCallStart maps an advertised ZERO tool call to the initial ACP "tool_call"
 // update (status in_progress — ZERO executes immediately after advertising).
 func toolCallStart(call agent.ToolCall) ToolCallUpdate {
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		SessionUpdate: UpdateToolCall,
 		ToolCallID:    call.ID,
 		Title:         toolTitle(call.Name, call.Arguments),
@@ -221,8 +97,6 @@ func toolCallStart(call agent.ToolCall) ToolCallUpdate {
 		Status:        ToolStatusInProgress,
 		RawInput:      rawInput(call.Arguments),
 	}
-	attachBrowserToolDetails(&upd, call.Name)
-	return upd
 }
 
 // toolCallResult maps a finished ZERO tool result to a "tool_call_update".
@@ -242,64 +116,26 @@ func toolCallResult(result agent.ToolResult) ToolCallUpdate {
 	if locs := toolResultLocations(result); len(locs) > 0 {
 		upd.Locations = locs
 	}
-	attachBrowserToolDetails(&upd, result.Name)
 	return upd
 }
 
 func toolResultContent(result agent.ToolResult) []ToolCallContent {
-	content := make([]ToolCallContent, 0, 1+len(result.FileDiffs))
 	text := strings.TrimRight(result.Output, "\n")
 	if text == "" {
 		text = result.Display.Summary
 	}
 	if text == "" {
-		return appendToolResultDiffs(content, result.FileDiffs)
+		return nil
 	}
-	content = append(content, ToolContent(TextBlock(text)))
-	return appendToolResultDiffs(content, result.FileDiffs)
-}
-
-func appendToolResultDiffs(content []ToolCallContent, diffs []tools.FileDiff) []ToolCallContent {
-	for _, diff := range diffs {
-		if !filepath.IsAbs(diff.Path) || (!diff.OldExists && !diff.NewExists) {
-			continue
-		}
-		var oldText *string
-		if diff.OldExists {
-			old := diff.OldText
-			oldText = &old
-		}
-		var newText *string
-		if diff.NewExists {
-			updated := diff.NewText
-			newText = &updated
-		}
-		content = append(content, ToolCallContent{Type: "diff", Path: diff.Path, OldText: oldText, NewText: newText})
-	}
-	return content
+	return []ToolCallContent{ToolContent(TextBlock(text))}
 }
 
 func toolResultLocations(result agent.ToolResult) []ToolCallLocation {
-	locs := make([]ToolCallLocation, 0, len(result.FileDiffs)+len(result.ChangedFiles))
-	seen := make(map[string]bool, len(result.FileDiffs)+len(result.ChangedFiles))
-	for _, diff := range result.FileDiffs {
-		path := diff.Path
-		if path == "" || seen[path] {
-			continue
-		}
-		seen[path] = true
-		locs = append(locs, ToolCallLocation{Path: path})
-	}
-	// FileDiff.Path is canonical absolute path data while ChangedFiles is
-	// normally workspace-relative. Without the trusted workspace root these
-	// coordinate systems cannot be correlated safely: a suffix match would let
-	// /workspace/sub/a.go consume the fallback for a distinct root a.go. The
-	// shared seen set deduplicates only identities already exactly comparable.
+	locs := make([]ToolCallLocation, 0, len(result.ChangedFiles))
 	for _, f := range result.ChangedFiles {
-		if f == "" || seen[f] {
+		if strings.TrimSpace(f) == "" {
 			continue
 		}
-		seen[f] = true
 		locs = append(locs, ToolCallLocation{Path: f})
 	}
 	return locs

internal/acp/translate_test.go

@@ -1,30 +1,14 @@
 package acp
 
 import (
-	"encoding/json"
-	"path/filepath"
 	"strings"
 	"testing"
-	"unicode"
 	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/tools"
 )
 
-func browserDescriptor(t *testing.T, update ToolCallUpdate) BrowserToolDetails {
-	t.Helper()
-	raw, ok := update.Meta[zeroBrowserMetaKey]
-	if !ok {
-		t.Fatalf("browser metadata = %#v, want %q", update.Meta, zeroBrowserMetaKey)
-	}
-	var details BrowserToolDetails
-	if err := json.Unmarshal(raw, &details); err != nil {
-		t.Fatalf("decode browser metadata: %v", err)
-	}
-	return details
-}
-
 func TestAgentMessageAndThoughtChunks(t *testing.T) {
 	m := agentMessageChunk("hello")
 	if m.SessionUpdate != UpdateAgentMessageChunk || m.Content.Type != "text" || m.Content.Text != "hello" {
@@ -72,217 +56,6 @@ func TestToolTitleAndHint(t *testing.T) {
 	}
 }
 
-func TestBrowserToolUpdatesAreStructuredAndPresentationSafe(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{
-		ID:        "browser-1",
-		Name:      "browser_open",
-		Arguments: `{"url":"https://example.com/settings?token=not-for-a-title#account"}`,
-	})
-	if got := browserDescriptor(t, start); got != (BrowserToolDetails{Version: 1, Command: "open"}) {
-		t.Fatalf("browser descriptor = %#v, want open", got)
-	}
-	if start.Title != "browser open https://example.com" {
-		t.Fatalf("browser title = %q", start.Title)
-	}
-	if strings.Contains(start.Title, "token=") || strings.Contains(start.Title, "#account") {
-		t.Fatalf("browser title leaked URL-sensitive data: %q", start.Title)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wire struct {
-		Meta map[string]json.RawMessage `json:"_meta"`
-	}
-	if err := json.Unmarshal(encoded, &wire); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := wire.Meta[zeroBrowserMetaKey]; !ok {
-		t.Fatalf("browser wire metadata = %#v", wire.Meta)
-	}
-
-	typed := toolCallStart(agent.ToolCall{
-		ID:        "browser-2",
-		Name:      "browser_type",
-		Arguments: `{"ref":"email","text":"[email protected]"}`,
-	})
-	if got := browserDescriptor(t, typed); got.Command != "type" {
-		t.Fatalf("browser type descriptor = %#v", got)
-	}
-	if typed.Title != "browser type" || strings.Contains(typed.Title, "[email protected]") {
-		t.Fatalf("browser type title = %q", typed.Title)
-	}
-
-	action := toolCallStart(agent.ToolCall{
-		ID:        "browser-3",
-		Name:      "browser_action",
-		Arguments: `{"command":"keyboard_insert_text","args":["[email protected]"]}`,
-	})
-	if action.Title != "browser action keyboard_insert_text" {
-		t.Fatalf("browser action title = %q", action.Title)
-	}
-
-	result := toolCallResult(agent.ToolResult{
-		ToolCallID: "browser-2",
-		Name:       "browser_type",
-		Status:     tools.StatusOK,
-	})
-	if got := browserDescriptor(t, result); got.Command != "type" {
-		t.Fatalf("browser result descriptor = %#v", got)
-	}
-}
-
-func TestBrowserDescriptorSurvivesProtocolShapedRoundTrip(t *testing.T) {
-	updates := []ToolCallUpdate{
-		toolCallStart(agent.ToolCall{
-			ID:        "start",
-			Name:      "browser_open",
-			Arguments: `{"url":"https://user:[email protected]/private?token=secret#fragment"}`,
-		}),
-		toolCallResult(agent.ToolResult{
-			ToolCallID: "result",
-			Name:       "browser_type",
-			Status:     tools.StatusOK,
-		}),
-		permissionToolCall(agent.PermissionRequest{
-			ToolCallID: "permission",
-			ToolName:   "browser_connect",
-			Args:       map[string]any{"target": "127.0.0.1:9222"},
-		}),
-	}
-
-	type protocolToolCallUpdate struct {
-		SessionUpdate string                     `json:"sessionUpdate,omitempty"`
-		ToolCallID    string                     `json:"toolCallId"`
-		Title         string                     `json:"title,omitempty"`
-		Kind          string                     `json:"kind,omitempty"`
-		Status        string                     `json:"status,omitempty"`
-		RawInput      json.RawMessage            `json:"rawInput,omitempty"`
-		Content       []ToolCallContent          `json:"content,omitempty"`
-		Locations     []ToolCallLocation         `json:"locations,omitempty"`
-		Meta          map[string]json.RawMessage `json:"_meta,omitempty"`
-	}
-
-	for _, update := range updates {
-		encoded, err := json.Marshal(update)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var root map[string]json.RawMessage
-		if err := json.Unmarshal(encoded, &root); err != nil {
-			t.Fatal(err)
-		}
-		if _, ok := root["browser"]; ok {
-			t.Fatalf("browser descriptor escaped ACP _meta: %s", encoded)
-		}
-
-		var protocol protocolToolCallUpdate
-		if err := json.Unmarshal(encoded, &protocol); err != nil {
-			t.Fatal(err)
-		}
-		forwarded, err := json.Marshal(protocol)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var roundTripped ToolCallUpdate
-		if err := json.Unmarshal(forwarded, &roundTripped); err != nil {
-			t.Fatal(err)
-		}
-		details := browserDescriptor(t, roundTripped)
-		if details.Version != 1 || details.Command == "" {
-			t.Fatalf("round-tripped browser descriptor = %#v", details)
-		}
-		descriptorJSON := string(roundTripped.Meta[zeroBrowserMetaKey])
-		for _, secret := range []string{"password", "private", "token", "fragment", "127.0.0.1", "9222"} {
-			if strings.Contains(descriptorJSON, secret) {
-				t.Fatalf("browser descriptor leaked %q: %s", secret, descriptorJSON)
-			}
-		}
-	}
-}
-
-func TestBrowserPermissionTitlesMirrorSafeToolArguments(t *testing.T) {
-	if got := browserToolTitle("open", `{"url":"evil.example.test/pay?token=hidden#fragment"}`); got != "browser open https://evil.example.test" {
-		t.Fatalf("bare-host title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test"}`); got != "browser open" {
-		t.Fatalf("case-variant URL title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test","url":"https://actual.example.test/path"}`); got != "browser open https://actual.example.test" {
-		t.Fatalf("exact URL key title = %q", got)
-	}
-	if got := browserToolTitle("action", `{"command":"not an action"}`); got != "browser action" {
-		t.Fatalf("unknown browser action title = %q", got)
-	}
-
-	longHost := "https://" + strings.Repeat("a", 200) + ".example.test/path?token=hidden"
-	title := browserToolTitle("open", `{"url":"`+longHost+`"}`)
-	if !utf8.ValidString(title) || utf8.RuneCountInString(title) > len("browser open ")+61 || strings.Contains(title, "token=") {
-		t.Fatalf("bounded browser origin title = %q", title)
-	}
-}
-
-func TestBrowserOpenTitlesRejectDecodedUnicodePresentationControls(t *testing.T) {
-	for _, rawURL := range []string{
-		"https://safe.example%E2%80%AEevil.test/path",
-		"https://safe.example%E2%81%A6evil.test/path",
-		"https://safe.example%C2%85evil.test/path",
-		"https://safe.example%E2%80%A8evil.test/path",
-		"https://safe.example%E2%80%A9evil.test/path",
-	} {
-		t.Run(rawURL, func(t *testing.T) {
-			normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-			if err != nil {
-				t.Fatalf("execution URL rejected: %v", err)
-			}
-			if normalized != rawURL {
-				t.Fatalf("execution URL = %q, want unchanged %q", normalized, rawURL)
-			}
-
-			args, err := json.Marshal(map[string]any{"url": rawURL})
-			if err != nil {
-				t.Fatal(err)
-			}
-			updates := []ToolCallUpdate{
-				toolCallStart(agent.ToolCall{ID: "start", Name: "browser_open", Arguments: string(args)}),
-				permissionToolCall(agent.PermissionRequest{ToolCallID: "permission", ToolName: "browser_open", Args: map[string]any{"url": rawURL}}),
-			}
-			for _, update := range updates {
-				encoded, err := json.Marshal(update)
-				if err != nil {
-					t.Fatal(err)
-				}
-				var decoded ToolCallUpdate
-				if err := json.Unmarshal(encoded, &decoded); err != nil {
-					t.Fatal(err)
-				}
-				if decoded.Title != "browser open" {
-					t.Fatalf("unsafe browser title survived wire round trip: %q", decoded.Title)
-				}
-				for _, r := range decoded.Title {
-					if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-						t.Fatalf("browser title contains unsafe presentation rune %U: %q", r, decoded.Title)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestBrowserDescriptorDoesNotClaimSimilarlyNamedMCPTools(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{ID: "mcp-1", Name: "browser_plugin_open", Arguments: `{}`})
-	if len(start.Meta) != 0 {
-		t.Fatalf("MCP-like tool received built-in browser metadata: %#v", start.Meta)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(encoded), `"browser"`) {
-		t.Fatalf("non-browser tool encoded browser field: %s", encoded)
-	}
-}
-
 func TestToolCallStart(t *testing.T) {
 	upd := toolCallStart(agent.ToolCall{ID: "tc1", Name: "read_file", Arguments: `{"path":"a.go"}`})
 	if upd.SessionUpdate != UpdateToolCall {
@@ -301,26 +74,21 @@ func TestToolCallStart(t *testing.T) {
 }
 
 func TestToolCallResult(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "a.go")
 	ok := toolCallResult(agent.ToolResult{
 		ToolCallID:   "tc1",
 		Name:         "edit_file",
 		Status:       tools.StatusOK,
 		Output:       "applied\n",
 		ChangedFiles: []string{"a.go", ""},
-		FileDiffs:    []tools.FileDiff{{Path: path, OldExists: true, NewExists: true, OldText: "before\n", NewText: "after\n"}},
 	})
 	if ok.SessionUpdate != UpdateToolCallUpdate || ok.Status != ToolStatusCompleted {
 		t.Fatalf("unexpected ok result: %+v", ok)
 	}
-	if len(ok.Content) != 2 || ok.Content[0].Type != "content" || ok.Content[0].Content.Text != "applied" {
+	if len(ok.Content) != 1 || ok.Content[0].Type != "content" || ok.Content[0].Content.Text != "applied" {
 		t.Fatalf("unexpected content: %+v", ok.Content)
 	}
-	if diff := ok.Content[1]; diff.Type != "diff" || diff.Path != path || diff.OldText == nil || *diff.OldText != "before\n" || diff.NewText == nil || *diff.NewText != "after\n" {
-		t.Fatalf("unexpected diff content: %+v", diff)
-	}
-	if len(ok.Locations) != 2 || ok.Locations[0].Path != path || ok.Locations[1].Path != "a.go" {
-		t.Fatalf("unproven absolute/relative aliases must both remain visible, got %+v", ok.Locations)
+	if len(ok.Locations) != 1 || ok.Locations[0].Path != "a.go" {
+		t.Fatalf("blank changed files should be dropped, got %+v", ok.Locations)
 	}
 
 	failed := toolCallResult(agent.ToolResult{ToolCallID: "tc2", Status: tools.StatusError, Output: "boom"})
@@ -329,190 +97,6 @@ func TestToolCallResult(t *testing.T) {
 	}
 }
 
-func TestToolCallDiffJSONDistinguishesEmptyFilesAndDeletion(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "empty.txt")
-	content := appendToolResultDiffs(nil, []tools.FileDiff{
-		{Path: path, OldExists: false, NewExists: true, NewText: ""},
-		{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: ""},
-		{Path: path, OldExists: true, NewExists: false, OldText: "before"},
-	})
-	if len(content) != 3 {
-		t.Fatalf("diff content = %#v", content)
-	}
-	for index, diff := range content {
-		encoded, err := json.Marshal(diff)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var wire map[string]any
-		if err := json.Unmarshal(encoded, &wire); err != nil {
-			t.Fatal(err)
-		}
-		if wire["path"] != path {
-			t.Fatalf("wire diff %d = %s", index, encoded)
-		}
-		switch index {
-		case 0:
-			oldText, present := wire["oldText"]
-			if !present || oldText != nil || wire["newText"] != "" {
-				t.Fatalf("create diff = %s, want null oldText and empty newText", encoded)
-			}
-		case 1:
-			if wire["oldText"] != "before" || wire["newText"] != "" {
-				t.Fatalf("empty replacement diff = %s", encoded)
-			}
-		case 2:
-			newText, present := wire["newText"]
-			if wire["oldText"] != "before" || !present || newText != nil {
-				t.Fatalf("deletion diff = %s, want oldText and null newText", encoded)
-			}
-		}
-	}
-}
-
-func TestToolResultLocationsPreserveDistinctPathIdentities(t *testing.T) {
-	root := t.TempDir()
-	rootPath := filepath.Join(root, "a.go")
-	nestedPath := filepath.Join(root, "sub", "a.go")
-	diff := func(path string) tools.FileDiff {
-		return tools.FileDiff{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: "after"}
-	}
-	for _, tc := range []struct {
-		name  string
-		diffs []tools.FileDiff
-		want  []string
-	}{
-		{name: "both rich", diffs: []tools.FileDiff{diff(rootPath), diff(nestedPath)}, want: []string{rootPath, nestedPath, "a.go", filepath.Join("sub", "a.go")}},
-		{name: "root rich", diffs: []tools.FileDiff{diff(rootPath)}, want: []string{rootPath, "a.go", filepath.Join("sub", "a.go")}},
-		{name: "nested rich", diffs: []tools.FileDiff{diff(nestedPath)}, want: []string{nestedPath, "a.go", filepath.Join("sub", "a.go")}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			locations := toolResultLocations(agent.ToolResult{
-				ChangedFiles: []string{"a.go", filepath.Join("sub", "a.go")},
-				FileDiffs:    tc.diffs,
-			})
-			if len(locations) != len(tc.want) {
-				t.Fatalf("locations = %#v, want %#v", locations, tc.want)
-			}
-			for index := range tc.want {
-				if locations[index].Path != tc.want[index] {
-					t.Fatalf("locations = %#v, want %#v", locations, tc.want)
-				}
-			}
-		})
-	}
-}
-
-func TestToolCallResultPreservesWhitespaceInFilePaths(t *testing.T) {
-	relativePath := " report.txt "
-	absolutePath := filepath.Join(t.TempDir(), relativePath)
-	update := toolCallResult(agent.ToolResult{
-		ChangedFiles: []string{relativePath},
-		FileDiffs: []tools.FileDiff{{
-			Path: absolutePath, OldExists: true, NewExists: true, OldText: "before", NewText: "after",
-		}},
-	})
-	if len(update.Content) != 1 || update.Content[0].Path != absolutePath {
-		t.Fatalf("diff content path = %#v, want %q", update.Content, absolutePath)
-	}
-	if len(update.Locations) != 2 || update.Locations[0].Path != absolutePath || update.Locations[1].Path != relativePath {
-		t.Fatalf("locations = %#v, want exact paths %q and %q", update.Locations, absolutePath, relativePath)
-	}
-}
-
-func TestToolResultLocationsDeduplicateOnlyExactPaths(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "a.go")
-	locations := toolResultLocations(agent.ToolResult{
-		ChangedFiles: []string{path, path},
-		FileDiffs:    []tools.FileDiff{{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: "after"}},
-	})
-	if len(locations) != 1 || locations[0].Path != path {
-		t.Fatalf("exact duplicate locations = %#v", locations)
-	}
-}
-
-func TestDeletedFileEmitsDiffAndKeepsLocations(t *testing.T) {
-	relativePath := "deleted.go"
-	absolutePath := filepath.Join(t.TempDir(), relativePath)
-	update := toolCallResult(agent.ToolResult{
-		ChangedFiles: []string{relativePath},
-		FileDiffs: []tools.FileDiff{{
-			Path: absolutePath, OldExists: true, NewExists: false, OldText: "before",
-		}},
-	})
-	if len(update.Content) != 1 || update.Content[0].OldText == nil || *update.Content[0].OldText != "before" || update.Content[0].NewText != nil {
-		t.Fatalf("deleted file diff = %#v, want oldText with null newText", update.Content)
-	}
-	if len(update.Locations) != 2 || update.Locations[0].Path != absolutePath || update.Locations[1].Path != relativePath {
-		t.Fatalf("deleted file locations = %#v", update.Locations)
-	}
-}
-
-func TestToolCallResultEmitsOnlyRedactedFileDiffs(t *testing.T) {
-	secret := "sk-proj-abcdefghijklmnopqrstuvwxyz"
-	path := filepath.Join(t.TempDir(), "secret.txt")
-	scrubbed := tools.ScrubResultSecrets(tools.Result{FileDiffs: []tools.FileDiff{{
-		Path: path, OldExists: true, NewExists: true, OldText: "token=" + secret, NewText: "safe",
-	}}})
-	update := toolCallResult(agent.ToolResult{ToolCallID: "call", Status: tools.StatusError, FileDiffs: scrubbed.FileDiffs})
-	if len(update.Content) != 1 || update.Content[0].OldText == nil || strings.Contains(*update.Content[0].OldText, secret) {
-		t.Fatalf("ACP content leaked unredacted diff: %#v", update.Content)
-	}
-}
-
-func TestToolCallResultOmitsSemanticallyUnchangedRedactedDiff(t *testing.T) {
-	oldSecret := "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-	newSecret := "ghp_9876543210ZYXWVUTSRQPONMLKJIHGFEDCBA"
-	scrubbed := tools.ScrubResultSecrets(tools.Result{
-		ChangedFiles: []string{"credentials.txt"},
-		FileDiffs: []tools.FileDiff{{
-			Path: filepath.Join(t.TempDir(), "credentials.txt"), OldExists: true, NewExists: true,
-			OldText: "token=" + oldSecret, NewText: "token=" + newSecret,
-		}},
-	})
-	update := toolCallResult(agent.ToolResult{
-		ToolCallID: "call", Status: tools.StatusOK,
-		ChangedFiles: scrubbed.ChangedFiles, FileDiffs: scrubbed.FileDiffs,
-	})
-	if len(update.Content) != 0 {
-		t.Fatalf("ACP emitted semantically unchanged redacted diff: %#v", update.Content)
-	}
-	if len(update.Locations) != 1 || update.Locations[0].Path != "credentials.txt" {
-		t.Fatalf("ACP path fallback = %#v", update.Locations)
-	}
-}
-
-func TestToolCallResultOmitsDefaultIgnorableSplitSecretsOnEitherSide(t *testing.T) {
-	secret := "sk-ant-api03-AAAABBBBCCCCDDDDEEEEFFFFGGGG"
-	for name, separator := range map[string]string{
-		"combining grapheme joiner": "\u034f",
-		"variation selector":        "\ufe0f",
-	} {
-		for _, side := range []string{"old", "new"} {
-			t.Run(name+" "+side, func(t *testing.T) {
-				obfuscated := secret[:20] + separator + secret[20:]
-				diff := tools.FileDiff{
-					Path: filepath.Join(t.TempDir(), "secret.txt"), OldExists: true, NewExists: true,
-					OldText: "safe old", NewText: "safe new",
-				}
-				if side == "old" {
-					diff.OldText = obfuscated
-				} else {
-					diff.NewText = obfuscated
-				}
-				scrubbed := tools.ScrubResultSecrets(tools.Result{FileDiffs: []tools.FileDiff{diff}})
-				if !scrubbed.Redacted || len(scrubbed.FileDiffs) != 0 {
-					t.Fatalf("registry boundary retained an obfuscated secret: %#v", scrubbed)
-				}
-				update := toolCallResult(agent.ToolResult{ToolCallID: "call", Status: tools.StatusOK, FileDiffs: scrubbed.FileDiffs})
-				if len(update.Content) != 0 {
-					t.Fatalf("ACP content retained an obfuscated secret: %#v", update.Content)
-				}
-			})
-		}
-	}
-}
-
 func TestPlanUpdateAndStatus(t *testing.T) {
 	upd := planUpdate([]tools.PlanItem{
 		{Content: "step a", Status: "completed"},

internal/acp/types.go

@@ -12,8 +12,6 @@ const (
 	MethodAuthenticate           = "authenticate"
 	MethodSessionNew             = "session/new"
 	MethodSessionLoad            = "session/load"
-	MethodSessionList            = "session/list"
-	MethodSessionResume          = "session/resume"
 	MethodSessionPrompt          = "session/prompt"
 	MethodSessionCancel          = "session/cancel" // notification
 	MethodSessionUpdate          = "session/update" // notification (agent -> client)
@@ -64,16 +62,8 @@ type PromptCapabilities struct {
 }
 
 type AgentCapabilities struct {
-	LoadSession         bool                 `json:"loadSession"`
-	PromptCapabilities  PromptCapabilities   `json:"promptCapabilities"`
-	SessionCapabilities *SessionCapabilities `json:"sessionCapabilities,omitempty"`
-}
-
-// Empty capability objects are presence flags in ACP v1. Pointers preserve
-// the wire distinction between an advertised `{}` and an omitted capability.
-type SessionCapabilities struct {
-	List   *struct{} `json:"list,omitempty"`
-	Resume *struct{} `json:"resume,omitempty"`
+	LoadSession        bool               `json:"loadSession"`
+	PromptCapabilities PromptCapabilities `json:"promptCapabilities"`
 }
 
 type AuthMethod struct {
@@ -127,14 +117,9 @@ type McpServer struct {
 }
 
 type NewSessionParams struct {
-	Cwd        string      `json:"cwd"`
-	McpServers []McpServer `json:"mcpServers"`
-	// AdditionalDirectories is declared by the protocol and consumed nowhere in
-	// this repo yet. When it is wired up it must go through requestedWorkspace
-	// like Cwd does: these are client-supplied paths with no absoluteness rule of
-	// their own, which is the same shape as the resume-cwd hole that made
-	// {"sessionId":"known"} activate a session against this process's directory.
-	AdditionalDirectories []string `json:"additionalDirectories,omitempty"`
+	Cwd                   string      `json:"cwd"`
+	McpServers            []McpServer `json:"mcpServers"`
+	AdditionalDirectories []string    `json:"additionalDirectories,omitempty"`
 }
 
 type NewSessionResult struct {
@@ -155,39 +140,6 @@ type LoadSessionResult struct {
 	Modes         *SessionModeState     `json:"modes,omitempty"`
 }
 
-// ListSessionsParams and the following types implement ACP v1 session/list.
-// Transcript contents stay behind session/load; this method returns metadata
-// only and leaves the optional pagination cursor opaque.
-type ListSessionsParams struct {
-	Cwd    string `json:"cwd,omitempty"`
-	Cursor string `json:"cursor,omitempty"`
-}
-
-type SessionInfoMeta struct {
-	ModelID   string `json:"modelId,omitempty"`
-	CreatedAt string `json:"createdAt,omitempty"`
-}
-
-type SessionInfo struct {
-	SessionID string           `json:"sessionId"`
-	Cwd       string           `json:"cwd"`
-	Title     string           `json:"title,omitempty"`
-	UpdatedAt string           `json:"updatedAt,omitempty"`
-	Meta      *SessionInfoMeta `json:"_meta,omitempty"`
-}
-
-type ListSessionsResult struct {
-	Sessions   []SessionInfo `json:"sessions"`
-	NextCursor string        `json:"nextCursor,omitempty"`
-}
-
-// session/resume takes session/load's wire shape, so its cwd is a plain string
-// too and an omitted one decodes exactly like an empty one. Sharing the type is
-// safe only because activatePersistedSession requires an absolute cwd from the
-// request itself — nothing downstream may supply a default for either method.
-type ResumeSessionParams = LoadSessionParams
-type ResumeSessionResult = LoadSessionResult
-
 // ---- prompt turn ----
 
 type PromptParams struct {
@@ -222,7 +174,6 @@ type SessionNotification struct {
 // ContentBlock under "content"; the variant is set via SessionUpdate.
 type ContentChunk struct {
 	SessionUpdate string       `json:"sessionUpdate"`
-	MessageID     string       `json:"messageId,omitempty"`
 	Content       ContentBlock `json:"content"`
 }
 
@@ -259,21 +210,6 @@ type ToolCallUpdate struct {
 	RawInput      json.RawMessage    `json:"rawInput,omitempty"`
 	Content       []ToolCallContent  `json:"content,omitempty"`
 	Locations     []ToolCallLocation `json:"locations,omitempty"`
-	// Meta is ACP's extension channel. ZERO-owned values must remain beneath a
-	// namespaced key so protocol-shaped clients can preserve them while decoding
-	// and re-encoding a tool call.
-	Meta map[string]json.RawMessage `json:"_meta,omitempty"`
-}
-
-// BrowserToolDetails identifies the browser helper operation behind a tool
-// call. Version is the schema version for this optional ZERO extension;
-// Command is one of install, launch, connect, open, snapshot, click, type,
-// press, or action. Future fields must remain display-safe and must not
-// include browser profile data, cookies, typed text, URL paths/queries, or
-// DevTools endpoints.
-type BrowserToolDetails struct {
-	Version int    `json:"version"`
-	Command string `json:"command"`
 }
 
 // ToolCallContent is a tool call's rendered output. ZERO emits "content" (a
@@ -284,30 +220,9 @@ type ToolCallContent struct {
 	// type == "content"
 	Content *ContentBlock `json:"content,omitempty"`
 	// type == "diff"
-	Path    string  `json:"path,omitempty"`
-	OldText *string `json:"oldText,omitempty"`
-	NewText *string `json:"newText,omitempty"`
-}
-
-// MarshalJSON preserves ACP's discriminated content union. A diff always has
-// path, while nullable oldText/newText distinguish creation, deletion, and an
-// existing file replaced with empty content. Other content variants omit all
-// diff fields rather than serializing irrelevant nulls.
-func (content ToolCallContent) MarshalJSON() ([]byte, error) {
-	if content.Type == "diff" {
-		return json.Marshal(struct {
-			Type    string  `json:"type"`
-			Path    string  `json:"path"`
-			OldText *string `json:"oldText"`
-			NewText *string `json:"newText"`
-		}{
-			Type: content.Type, Path: content.Path, OldText: content.OldText, NewText: content.NewText,
-		})
-	}
-	return json.Marshal(struct {
-		Type    string        `json:"type"`
-		Content *ContentBlock `json:"content,omitempty"`
-	}{Type: content.Type, Content: content.Content})
+	Path    string `json:"path,omitempty"`
+	OldText string `json:"oldText,omitempty"`
+	NewText string `json:"newText,omitempty"`
 }
 
 func ToolContent(block ContentBlock) ToolCallContent {

internal/agent/async_diagnostics_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Gitlawb/zero/internal/testutil"
 	"github.com/Gitlawb/zero/internal/tools"
 	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
@@ -112,11 +111,7 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	diagnostics := newAsyncDiagnostics(check, "/ws")
 
 	diagnostics.enqueue(context.Background(), []string{"a.go"})
-	testutil.WaitFor(t, "worker idle", func() bool {
-		diagnostics.mu.Lock()
-		defer diagnostics.mu.Unlock()
-		return diagnostics.working == nil
-	})
+	waitForIdle(t, diagnostics)
 	mu.Lock()
 	response = "ERR new"
 	mu.Unlock()
@@ -128,6 +123,23 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	}
 }
 
+func waitForIdle(t *testing.T, diagnostics *asyncDiagnostics) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		diagnostics.mu.Lock()
+		busy := diagnostics.working
+		diagnostics.mu.Unlock()
+		if busy == nil {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("worker never went idle")
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+}
+
 // changedFilesTool is a fake mutating tool reporting a changed file without
 // touching the filesystem.
 type changedFilesTool struct{}

internal/agent/compaction.go

@@ -4,9 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strconv"
 	"strings"
-	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/trace"
 	"github.com/Gitlawb/zero/internal/zeroruntime"
@@ -398,27 +396,6 @@ type compactionState struct {
 	// starts at 1.0 and converges via an EMA as each turn reports actual usage, so
 	// later turns compact nearer to real capacity. Zero is treated as 1.0.
 	calibrationRatio float64
-
-	// summarizerFactory lazily builds the dedicated (cheap) summarizer provider
-	// (Options.Summarizer) for the current main model. summarizerProvider
-	// memoizes the built provider and summarizerResolved records that the
-	// factory ran (it may legitimately return no provider: the main model is
-	// already the cheap one). summarizerBroken is the sticky fallback: once a
-	// build or call fails, the run stays on the main provider until the next
-	// model switch — a misconfigured cheap model must never break (or
-	// repeatedly delay) compaction.
-	summarizerFactory  func(ctx context.Context, mainModelID string) (Provider, error)
-	summarizerProvider Provider
-	summarizerResolved bool
-	summarizerBroken   bool
-	// window is the context window the threshold was derived from. The
-	// reactive free-prune stage compares against it (the limit the provider
-	// enforces), not against the 70% proactive threshold — a pruned history
-	// between the two would still succeed on retry.
-	window int
-	// mainModel is the model the run currently streams on; the summarizer
-	// choice is made against it and remade after a mid-run switch.
-	mainModel string
 }
 
 // calibrate folds one turn's (rawEstimate, actualPromptTokens) sample into the
@@ -453,88 +430,17 @@ func (state *compactionState) calibratedTokens(raw int) int {
 
 func newCompactionState(options Options, task *taskState) *compactionState {
 	state := &compactionState{
-		enabled:           options.ContextWindow > 0,
-		threshold:         compactionThreshold(options.ContextWindow),
-		window:            options.ContextWindow,
-		mainModel:         options.Model,
-		preserveLast:      options.CompactionPreserveLast,
-		onUsage:           options.OnUsage,
-		task:              task,
-		planner:           newContextPlanner(contextPlannerConfig{contextWindow: options.ContextWindow, serviceTier: options.ServiceTier}),
-		trace:             options.Trace,
-		summarizerFactory: options.Summarizer,
+		enabled:      options.ContextWindow > 0,
+		threshold:    compactionThreshold(options.ContextWindow),
+		preserveLast: options.CompactionPreserveLast,
+		onUsage:      options.OnUsage,
+		task:         task,
+		planner:      newContextPlanner(contextPlannerConfig{contextWindow: options.ContextWindow, serviceTier: options.ServiceTier}),
+		trace:        options.Trace,
 	}
 	return state
 }
 
-// updateWindow re-derives the compaction threshold after a mid-run model
-// switch. The low-water mark is reset: it was measured against the old
-// threshold, and keeping it could suppress a compaction the smaller window
-// now requires. <= 0 (unknown model) leaves everything unchanged.
-func (state *compactionState) updateWindow(window int) {
-	if window <= 0 {
-		return
-	}
-	state.enabled = true
-	state.window = window
-	state.threshold = compactionThreshold(window)
-	state.lowWaterMark = 0
-	if state.planner != nil {
-		state.planner.config.contextWindow = window
-	}
-}
-
-// switchModel records a mid-run model switch: the window is re-derived
-// (window <= 0 keeps the old one) and the summarizer choice is forgotten so
-// the next compaction re-resolves it against the new main model. A run that
-// started on the cheap model (no dedicated summarizer) and escalated to an
-// expensive one therefore regains cheap summaries — the exact workflow a
-// dedicated summarizer exists for.
-func (state *compactionState) switchModel(modelID string, window int) {
-	state.mainModel = modelID
-	state.updateWindow(window)
-	state.summarizerProvider = nil
-	state.summarizerResolved = false
-	state.summarizerBroken = false
-}
-
-// summarizeProvider returns the provider summarization calls should use and
-// whether it is the dedicated summarizer: that one when it applies to the
-// current main model and is healthy, else the main provider. The factory runs
-// at most once per main model; a build error marks the summarizer broken for
-// that model. Callers branch on the boolean rather than comparing Provider
-// values — interface comparison panics on a non-comparable dynamic type.
-func (state *compactionState) summarizeProvider(ctx context.Context, main Provider) (Provider, bool) {
-	if state.summarizerFactory == nil || state.summarizerBroken {
-		return main, false
-	}
-	if !state.summarizerResolved {
-		state.summarizerResolved = true
-		built, err := state.summarizerFactory(ctx, state.mainModel)
-		if err != nil {
-			state.summarizerBroken = true
-			return main, false
-		}
-		state.summarizerProvider = built
-	}
-	if state.summarizerProvider == nil {
-		return main, false
-	}
-	return state.summarizerProvider, true
-}
-
-// fitsWindow reports whether a calibrated size is safely under the limit the
-// provider enforces. The proactive threshold (70% of the window) is a trigger
-// for the paid summarizer, not the hard limit; the reactive path compares
-// against the window itself, with a small margin for estimate error, so a
-// history pruned to, say, 85% of the window takes the free retry.
-func (state *compactionState) fitsWindow(size int) bool {
-	if state.window <= 0 {
-		return size <= state.threshold
-	}
-	return size <= state.window-state.window/20
-}
-
 // maybeCompact runs proactive compaction at the top of a turn. It returns the
 // (possibly compacted) message slice. It is a no-op when compaction is disabled,
 // when the history is under threshold, or when the history has not grown past
@@ -628,34 +534,10 @@ func (state *compactionState) recover(
 		// context-limit error never triggers an unexpected summarization call.
 		return messages, false, nil
 	}
-	if !isContextLimitError(errorMessage) {
+	if state.reactiveAttempted {
 		return messages, false, nil
 	}
-
-	// CHEAP FIRST STAGE (mirrors maybeCompact): a context-limit failure can
-	// often be fixed for free by dropping superseded reads and pruning old
-	// tool-result bodies. It runs regardless of the one-shot reactive budget
-	// (it costs nothing and cannot loop: a second pass finds nothing left to
-	// prune). The free retry is taken only when the pruned history fits the
-	// window the provider enforces — otherwise a retry would fail the same
-	// way, so fall through to the paid summarizer in this same call.
-	toolTokens := estimateToolDefTokens(tools)
-	prunedAny := false
-	if pruned, reclaimed := pruneSupersededReadResults(messages); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if pruned, reclaimed := pruneStaleToolOutput(messages, state.preserveLast); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if prunedAny {
-		size := state.calibratedTokens(estimateTokens(messages) + toolTokens)
-		if state.fitsWindow(size) {
-			state.lowWaterMark = size
-			return messages, true, nil
-		}
-	}
-
-	if state.reactiveAttempted {
+	if !isContextLimitError(errorMessage) {
 		return messages, false, nil
 	}
 
@@ -695,21 +577,11 @@ func (state *compactionState) recover(
 // provider call. The summary stream intentionally does NOT forward OnText (so
 // compaction stays invisible on the user-facing surface), but it DOES forward
 // OnUsage so the summarizer's token cost is still counted by usage/budgeting.
-// The call goes to the dedicated (cheap) summarizer when one applies; if that
-// call fails the summarizer is marked broken for the current model and the
-// same slice is retried once on the main provider, so the caller sees at most
-// one (main-provider-quality) error.
 func (state *compactionState) summarizeClosure(ctx context.Context, provider Provider) func([]zeroruntime.Message) (string, error) {
 	if state.planner == nil {
 		state.planner = newContextPlanner(contextPlannerConfig{})
 	}
 	return func(toSummarize []zeroruntime.Message) (string, error) {
-		chosen, dedicated := state.summarizeProvider(ctx, provider)
-		summary, err := summarizeWithPlanner(ctx, chosen, toSummarize, state.onUsage, state.planner, state.trace)
-		if err == nil || !dedicated {
-			return summary, err
-		}
-		state.summarizerBroken = true
 		return summarizeWithPlanner(ctx, provider, toSummarize, state.onUsage, state.planner, state.trace)
 	}
 }
@@ -793,41 +665,8 @@ func summarizeMessagesOnce(ctx context.Context, provider Provider, messages []ze
 	return summary, nil
 }
 
-// summaryToolResultClamp bounds each tool-result body in the summarizer input.
-// Tool outputs dominate the elided middle's bulk (build logs, file reads,
-// search results), yet the summary instructions only need their gist — the
-// model that ACTED on the full output already turned it into decisions the
-// surrounding messages record. 2,000 chars (~500 tokens) keeps the useful
-// head+tail of a result while cutting the summarizer input by 5-10x on
-// tool-heavy sessions; the summarizer's own cost is the price being cut.
-const summaryToolResultClamp = 2000
-
-// summaryToolArgsClamp bounds each tool-call argument blob in the transcript:
-// a write_file call carries the whole file body in its arguments.
-const summaryToolArgsClamp = 500
-
-// clampForSummary head+tail-truncates text for the summarizer transcript,
-// snapping to rune boundaries so the clamp never splits a UTF-8 sequence.
-func clampForSummary(text string, max int) string {
-	if max <= 0 || len(text) <= max {
-		return text
-	}
-	head := max * 3 / 4
-	tail := max - head
-	for head > 0 && !utf8.RuneStart(text[head]) {
-		head--
-	}
-	start := len(text) - tail
-	for start < len(text) && !utf8.RuneStart(text[start]) {
-		start++
-	}
-	return text[:head] + "\n…[" + strconv.Itoa(len(text)-head-(len(text)-start)) + " chars omitted for summarization]…\n" + text[start:]
-}
-
 // renderTranscript flattens messages into a plain-text transcript for the
 // summarizer. Secret scrubbing already happened upstream at the tool boundary.
-// Tool-result bodies and tool-call arguments are clamped (see the constants
-// above): the summary needs what was done and decided, not the raw payloads.
 func renderTranscript(messages []zeroruntime.Message) string {
 	lines := make([]string, 0, len(messages))
 	for _, message := range messages {
@@ -837,13 +676,13 @@ func renderTranscript(messages []zeroruntime.Message) string {
 			if len(message.ToolCalls) > 0 {
 				calls := make([]string, 0, len(message.ToolCalls))
 				for _, call := range message.ToolCalls {
-					calls = append(calls, call.Name+"("+clampForSummary(call.Arguments, summaryToolArgsClamp)+")")
+					calls = append(calls, call.Name+"("+call.Arguments+")")
 				}
 				line += "\n[tool calls: " + strings.Join(calls, "; ") + "]"
 			}
 			lines = append(lines, line)
 		case zeroruntime.MessageRoleTool:
-			lines = append(lines, "tool result: "+clampForSummary(message.Content, summaryToolResultClamp))
+			lines = append(lines, "tool result: "+message.Content)
 		default:
 			lines = append(lines, string(message.Role)+": "+message.Content)
 		}

internal/agent/compaction_cheap_test.go

@@ -1,469 +0,0 @@
-package agent
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// compactableHistory returns a history whose middle is large enough to trip
-// the proactive threshold for a 1000-token window.
-func compactableHistory() []zeroruntime.Message {
-	return []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "sys"},
-		{Role: zeroruntime.MessageRoleUser, Content: strings.Repeat("u", 4000)},
-		{Role: zeroruntime.MessageRoleAssistant, Content: strings.Repeat("a", 4000)},
-		{Role: zeroruntime.MessageRoleUser, Content: "u2"},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "a2"},
-		{Role: zeroruntime.MessageRoleUser, Content: "u3"},
-	}
-}
-
-// Summarization must run on the dedicated (cheap) summarizer when one is
-// configured — the main provider sees no summarize traffic at all.
-func TestMaybeCompactUsesDedicatedSummarizer(t *testing.T) {
-	cheap := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "CHEAP SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	main := &mockProvider{}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return cheap, nil
-		},
-	}, nil)
-
-	compacted := state.maybeCompact(context.Background(), main, compactableHistory(), nil)
-
-	if len(cheap.requests) == 0 {
-		t.Fatal("dedicated summarizer never received the summarize call")
-	}
-	if len(main.requests) != 0 {
-		t.Fatalf("main provider must see no summarize traffic, got %d requests", len(main.requests))
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("summarizer factory calls = %d, want 1 (lazy, memoized)", factoryCalls)
-	}
-	if estimateTokens(compacted) >= estimateTokens(compactableHistory()) {
-		t.Fatal("compaction did not shrink the history")
-	}
-	found := false
-	for _, message := range compacted {
-		if strings.Contains(message.Content, "CHEAP SUMMARY") {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatal("cheap summarizer's summary missing from the compacted history")
-	}
-}
-
-// A failing summarizer falls back to the main provider for the SAME slice and
-// stays broken for the rest of the run — no repeated failed cheap calls.
-func TestSummarizerFailureFallsBackToMainAndSticks(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY 2"}, {Type: zeroruntime.StreamEventDone}},
-	}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return broken, nil },
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-	input := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}
-
-	summary, err := summarize(input)
-	if err != nil {
-		t.Fatalf("fallback must succeed via the main provider: %v", err)
-	}
-	if summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, want the main provider's", summary)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer requests = %d, want exactly 1", len(broken.requests))
-	}
-	if !state.summarizerBroken {
-		t.Fatal("a failed summarizer must be marked broken for the run")
-	}
-
-	// Second summarization: straight to main, no cheap retry.
-	if _, err := summarize(input); err != nil {
-		t.Fatal(err)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer was retried (%d requests)", len(broken.requests))
-	}
-	if len(main.requests) != 2 {
-		t.Fatalf("main provider requests = %d, want 2", len(main.requests))
-	}
-}
-
-// A factory that errors (misconfigured model) is equivalent to no summarizer:
-// main provider used, factory not retried.
-func TestSummarizerFactoryErrorFallsBack(t *testing.T) {
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return nil, errors.New("unknown model")
-		},
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-
-	summary, err := summarize([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, err = %v; want main provider fallback", summary, err)
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory calls = %d, want 1 (sticky failure)", factoryCalls)
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("after a factory failure the run must stay on the main provider")
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory retried after failure (%d calls)", factoryCalls)
-	}
-}
-
-// Tool payloads are clamped in the summarizer transcript: results to
-// summaryToolResultClamp, call arguments to summaryToolArgsClamp.
-func TestRenderTranscriptClampsToolPayloads(t *testing.T) {
-	bigResult := strings.Repeat("r", 50_000)
-	bigArgs := strings.Repeat("w", 20_000)
-	transcript := renderTranscript([]zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleAssistant, Content: "editing", ToolCalls: []zeroruntime.ToolCall{
-			{ID: "c1", Name: "write_file", Arguments: bigArgs},
-		}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "c1", Content: bigResult},
-		{Role: zeroruntime.MessageRoleUser, Content: "keep going"},
-	})
-
-	if len(transcript) > summaryToolResultClamp+summaryToolArgsClamp+1024 {
-		t.Fatalf("transcript is %d bytes; clamps did not apply", len(transcript))
-	}
-	if !strings.Contains(transcript, "chars omitted for summarization") {
-		t.Fatal("clamped transcript must carry the omission marker")
-	}
-	if !strings.Contains(transcript, "keep going") {
-		t.Fatal("non-tool content must survive unclamped")
-	}
-	// Head AND tail of the clamped payloads survive.
-	if !strings.HasPrefix(transcript[strings.Index(transcript, "tool result: ")+len("tool result: "):], "r") ||
-		!strings.Contains(transcript, "rrr\n\nuser: keep going") {
-		t.Fatalf("head/tail of the tool result lost:\n%s", transcript[:200])
-	}
-}
-
-// bigToolHistory returns a history with n large tool results (~40k estimated
-// tokens each): the trailing protection window keeps the newest verbatim,
-// the older ones are prunable.
-func bigToolHistory(n int) []zeroruntime.Message {
-	bigBody := strings.Repeat("x", 160_000)
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleSystem, Content: "sys"}}
-	for i := 0; i < n; i++ {
-		id := string(rune('a' + i))
-		messages = append(messages,
-			zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: id, Name: "read_file", Arguments: "{\"path\":\"" + id + "\"}"}}},
-			zeroruntime.Message{Role: zeroruntime.MessageRoleTool, ToolCallID: id, Content: bigBody},
-		)
-	}
-	return append(messages, zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "go"})
-}
-
-func summaryProvider(text string) *mockProvider {
-	return &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-	}}
-}
-
-// A context-limit error is first answered with the free prune stage; when the
-// pruned history fits the window the retry is free (no summarizer call) and
-// the one-shot reactive budget is untouched. The paid summarizer only runs
-// when a later error finds nothing left to prune.
-func TestRecoverPrunesBeforeSummarizing(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// The protected trailing tool output (~40k tokens) must fit the window.
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("prunable history that fits must produce a free retry")
-	}
-	if len(provider.requests) != 0 {
-		t.Fatalf("free prune stage must not call the summarizer (%d requests)", len(provider.requests))
-	}
-	if state.reactiveAttempted {
-		t.Fatal("a free prune retry must not consume the reactive budget")
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-
-	// Second context-limit error on the pruned history: nothing meaningfully
-	// prunable remains, so the paid summarizer fires and consumes the budget.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("second recover must compact and retry")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("second recover must reach the summarizer")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("a paid recover must consume the reactive budget")
-	}
-}
-
-// When pruning reclaims something but the pruned history still exceeds the
-// window, recover falls through to the paid summarizer in the SAME call
-// instead of spending a retry that would fail the same way.
-func TestRecoverFallsThroughToSummarizerWhenPruneIsInsufficient(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// A 1,000-token window: even the protected trailing output overflows it.
-	state := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	compacted, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("insufficient prune must still end in a retry via summarization")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("insufficient prune must reach the summarizer in the same recover call")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("the paid summarizer consumes the reactive budget")
-	}
-	if estimateTokens(compacted) >= estimateTokens(messages) {
-		t.Fatal("recover did not shrink the history")
-	}
-}
-
-// The free prune stage is not gated behind the one-shot budget: after a paid
-// reactive compaction, a later context-limit error still gets a free retry
-// when pruning makes the history fit.
-func TestRecoverFreePruneRunsAfterBudgetIsSpent(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	state.reactiveAttempted = true
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("free prune must retry without the summarizer even when the budget is spent (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-	// With nothing left to prune and the budget spent, the caller keeps its
-	// original error — recover neither loops nor summarizes.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil || retried || len(provider.requests) != 0 {
-		t.Fatalf("spent budget must not summarize again (retried=%v, requests=%d, err=%v)", retried, len(provider.requests), err)
-	}
-}
-
-// The free-retry gate compares against the window the provider enforces, not
-// the 70% proactive threshold: a history pruned to ~80% of the window still
-// takes the free retry.
-func TestRecoverFreeRetryGateUsesWindowNotThreshold(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	messages := bigToolHistory(5)
-	pruned, _ := pruneStaleToolOutput(messages, 2)
-	prunedTokens := estimateTokens(pruned)
-	// Choose a window so the pruned size sits between 70% and 95% of it.
-	window := prunedTokens * 100 / 80
-	state := newCompactionState(Options{ContextWindow: window, CompactionPreserveLast: 2}, nil)
-	if prunedTokens <= state.threshold {
-		t.Fatalf("test setup: pruned size %d must exceed the proactive threshold %d", prunedTokens, state.threshold)
-	}
-
-	_, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("a history that fits the window must take the free retry (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-}
-
-// After a mid-run model switch the summarizer is re-resolved against the new
-// main model: a run that started on the cheap model (no dedicated summarizer)
-// and escalated gets a cheap summarizer, and a previously broken one is
-// retried for the new model.
-func TestSwitchModelReresolvesSummarizer(t *testing.T) {
-	cheap := summaryProvider("CHEAP SUMMARY")
-	main := summaryProvider("MAIN SUMMARY")
-	var factoryModels []string
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Model:                  "cheap-model",
-		Summarizer: func(_ context.Context, mainModelID string) (Provider, error) {
-			factoryModels = append(factoryModels, mainModelID)
-			if mainModelID == "cheap-model" {
-				return nil, nil // main already is the cheap model
-			}
-			return cheap, nil
-		},
-	}, nil)
-
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("on the cheap model the main provider must summarize")
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated || len(factoryModels) != 1 {
-		t.Fatalf("factory must run once per main model, calls=%v", factoryModels)
-	}
-
-	state.switchModel("big-model", 400_000)
-	if state.threshold != compactionThreshold(400_000) || state.window != 400_000 {
-		t.Fatalf("switchModel must re-derive the window, got threshold=%d window=%d", state.threshold, state.window)
-	}
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("after escalating to an expensive model the dedicated cheap summarizer must be used")
-	}
-	if len(factoryModels) != 2 || factoryModels[1] != "big-model" {
-		t.Fatalf("factory must be re-invoked with the new main model, calls=%v", factoryModels)
-	}
-
-	// A broken summarizer is retried after the next switch.
-	state.summarizerBroken = true
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("a broken summarizer must fall back to main")
-	}
-	state.switchModel("other-model", 0)
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("a model switch must clear the broken flag and rebuild the summarizer")
-	}
-}
-
-func TestCompactionUpdateWindow(t *testing.T) {
-	state := newCompactionState(Options{ContextWindow: 100_000, CompactionPreserveLast: 2}, nil)
-	state.lowWaterMark = 50_000
-	before := state.threshold
-
-	state.updateWindow(0) // unknown model: unchanged
-	if state.threshold != before || state.lowWaterMark != 50_000 {
-		t.Fatal("updateWindow(0) must be a no-op")
-	}
-
-	state.updateWindow(10_000)
-	if state.threshold >= before {
-		t.Fatalf("threshold = %d, want re-derived below %d", state.threshold, before)
-	}
-	if state.lowWaterMark != 0 {
-		t.Fatal("low-water mark must reset on a window change")
-	}
-	if !state.enabled {
-		t.Fatal("a positive window must keep compaction enabled")
-	}
-}
-
-// End-to-end: after escalate_model switches providers, the loop re-derives the
-// context window via ContextWindowFor, visible in the OnContext report.
-func TestRunEscalationRederivesContextWindow(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(escalatingTool{target: "big-model"})
-	switched := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "done"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "escalate"},
-		{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{}`},
-		{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-
-	var windows []int
-	result, err := Run(context.Background(), "go", provider, Options{
-		Registry:      registry,
-		ContextWindow: 100_000,
-		Model:         "small-model",
-		ModelSwitcher: func(context.Context, string) (Provider, error) { return switched, nil },
-		ContextWindowFor: func(modelID string) int {
-			if modelID == "big-model" {
-				return 400_000
-			}
-			return 0
-		},
-		OnContext: func(breakdown ContextBreakdown) { windows = append(windows, breakdown.ContextWindow) },
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q", result.FinalAnswer)
-	}
-	if len(windows) < 2 {
-		t.Fatalf("expected at least 2 OnContext reports, got %d", len(windows))
-	}
-	if windows[0] != 100_000 {
-		t.Fatalf("turn 1 window = %d, want the original 100000", windows[0])
-	}
-	if windows[len(windows)-1] != 400_000 {
-		t.Fatalf("post-escalation window = %d, want 400000", windows[len(windows)-1])
-	}
-}
-
-// nonComparableProvider has a slice field, so comparing two Provider interface
-// values holding it would panic; the summarizer path must never compare them.
-type nonComparableProvider struct {
-	inner *mockProvider
-	tags  []string
-}
-
-func (p nonComparableProvider) StreamCompletion(ctx context.Context, request zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	return p.inner.StreamCompletion(ctx, request)
-}
-
-func TestSummarizeClosureNeverComparesProviderValues(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := nonComparableProvider{inner: summaryProvider("MAIN SUMMARY"), tags: []string{"x"}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return nonComparableProvider{inner: broken}, nil },
-	}, nil)
-	summary, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("fallback with non-comparable providers must not panic and must use main, got %q err=%v", summary, err)
-	}
-	// And with no dedicated summarizer at all the closure still works.
-	state = newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	if _, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}); err != nil {
-		t.Fatal(err)
-	}
-}

internal/agent/loop.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/Gitlawb/zero/internal/execution"
 	"github.com/Gitlawb/zero/internal/hooks"
-	"github.com/Gitlawb/zero/internal/modelregistry"
 	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/sandbox"
 	"github.com/Gitlawb/zero/internal/streamjson"
@@ -26,18 +25,14 @@ const maxTurnsAnswer = "Agent reached maximum number of turns without a final an
 const maxTurnsFinalAnswerPrompt = "You have reached the tool-turn limit. Do not call tools. Give a concise final answer now: summarize what you completed, what you found, and any remaining blockers."
 
 // maxStreamStallRetries bounds how many times a turn that timed out (idle/stall)
-// OR hit a mid-stream transport abort (#973) with no answer text yet is re-issued
-// on a fresh connection before giving up. Incomplete tool-call previews are
-// allowed through the gate (they are never dispatched before the error return).
-// The safety claim is only that visible answer prose is not duplicated on retry —
-// not that every partial stream shape is excluded. Covers a stalled/dead pooled
-// connection or a socket abort before tool dispatch.
+// WITH NO OUTPUT yet is re-issued on a fresh connection before giving up. Only
+// the no-output case is retried (a partial turn would duplicate), so this is a
+// safe recovery for a stalled/dead pooled connection.
 //
 // Set to 1 (not 2): each attempt can itself idle for the full stream timeout
 // (~5min) before the stall is even detected, so 2 retries left an interactive
 // session frozen for ~15min. One retry keeps the common single-hiccup recovery
-// while bounding the worst case to ~2× the idle timeout. Mid-stream transport
-// aborts share this bound (do not raise it for #973).
+// while bounding the worst case to ~2× the idle timeout.
 const maxStreamStallRetries = 1
 
 const (
@@ -379,11 +374,7 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 					rec.StampFirstToken()
 				}
 				if onText != nil {
-					// Zero-length chunks are not committed answer prose; counting
-					// them would block an eligible mid-stream abort retry.
-					if s != "" {
-						forwardedVisibleText = true
-					}
+					forwardedVisibleText = true
 					onText(s)
 				}
 			}
@@ -459,14 +450,9 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			result.Messages = copyMessages(messages)
 			return result, ctx.Err()
 		}
-		// A stream idle/stall timeout OR mid-stream transport abort (#973 — wsarecv /
-		// connection reset / unexpected EOF / connection closed / broken pipe) is
-		// safely re-issued when the turn committed NO answer text — no forwarded
-		// visible prose (forwardedVisibleText) and no collected final text
-		// (collected.Text). The abort gate matches midStreamAbortNeedles only, not
-		// the full shouldReconnect list: connect-phase timeouts and connection
-		// refused are NOT retried here (a slow healthy server must not cost a
-		// second prefill). This covers three cases:
+		// A stream idle/stall timeout is safely re-issued when the turn committed NO
+		// answer text — no forwarded visible prose (forwardedVisibleText) and no
+		// collected final text (collected.Text). This covers two cases:
 		//   1. Nothing streamed at all before the connection died (the original
 		//      macOS stale-pooled-connection hang past the response-header timeout).
 		//   2. The model streamed transient reasoning and began a tool call (e.g. a
@@ -477,27 +463,13 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		//      re-render is transient previews, not duplicated answer text. This is
 		//      why the gate no longer excludes collected.ToolCalls: an incomplete
 		//      tool call from a timed-out stream is discard-and-retry, not output.
-		//   3. Mid-stream socket abort after connect succeeded (Windows WSAECONNABORTED /
-		//      wsarecv, connection reset by peer). Same no-tool-executed safety: the
-		//      error returns before tool dispatch, so a bounded retry is safe.
 		// A turn that forwarded real prose is NOT retried (it would duplicate visible
 		// answer text) and falls through to the error return below. Capped +
 		// exponential backoff, with a user-visible notice per attempt.
 		for attempt := 1; attempt <= maxStreamStallRetries &&
-			(isStreamTimeoutError(collected.Error) || isMidStreamTransportAbort(collected.Error)) &&
-			!forwardedVisibleText &&
+			isStreamTimeoutError(collected.Error) && !forwardedVisibleText &&
 			collected.Text == ""; attempt++ {
-			var notify reconnectNotifier
-			if isStreamTimeoutError(collected.Error) {
-				notify = stallRetryNoticeFor(options)
-			} else {
-				notify = reconnectNoticeFor(options)
-				// Count this post-connect reissue even when the replacement
-				// connect succeeds immediately. streamWithReconnect only
-				// increments reconnect_count after a failed connect attempt.
-				options.Trace.Counter(trace.CounterReconnectCount, 1)
-			}
-			if notify != nil {
+			if notify := stallRetryNoticeFor(options); notify != nil {
 				notify(attempt, maxStreamStallRetries)
 			}
 			if err := sleepWithContext(ctx, backoffFor(attempt)); err != nil {
@@ -510,22 +482,12 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			retryStream, retryErr := streamWithReconnect(ctx, provider, retryRequest, reconnectNoticeFor(options))
 			if retryErr != nil {
 				result.Messages = copyMessages(messages)
-				if ctx.Err() != nil {
-					return result, ctx.Err()
-				}
 				return result, retryErr
 			}
 			stallGenSpan := options.Trace.Span(trace.SpanGeneration)
 			collected = zeroruntime.CollectStreamWithOptions(ctx, retryStream, forwardingOpts)
 			stallGenSpan.End()
 		}
-		// Recheck ctx after a retried CollectStream: helpers.go stores
-		// ctx.Err().Error() in collected.Error, and errors.New of that string
-		// drops the context.Canceled sentinel ACP branches on.
-		if ctx.Err() != nil {
-			result.Messages = copyMessages(messages)
-			return result, ctx.Err()
-		}
 		if collected.Error != "" {
 			// Route a reissued stream's non-stall error through the SAME recovery as
 			// the initial stream (image-rejection wrapping / context-limit compaction)
@@ -536,10 +498,6 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				result.Messages = copyMessages(messages)
 				return result, stop
 			}
-			if ctx.Err() != nil {
-				result.Messages = copyMessages(messages)
-				return result, ctx.Err()
-			}
 			if collected.Error != "" {
 				result.Messages = copyMessages(messages)
 				return result, errors.New(collected.Error)
@@ -688,25 +646,9 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		// recorded. They travel as user messages, and a user message between two
 		// tool_results breaks strict provider replay — Anthropic coalesces them
 		// into one user block list and requires the tool_result blocks first, so
-		// Images ride a following USER message rather than the tool result
-		// above. Every provider drops images on a tool-role message —
-		// Anthropic's tool_result content is a string, Gemini's is a
-		// functionResponse, and OpenAI guards its image parts to the user role
-		// — so attaching them there would silently deliver nothing. A separate
-		// message also keeps the one-tool-result-per-tool-call pairing intact,
-		// which the providers validate. Vision-gate evaluation is deferred until
-		// after any model switch this turn resolves, so images can reach an
-		// escalated vision-capable model.
-		var toolResultsWithImages []ToolResult
-		buildToolImageMessages := func() []zeroruntime.Message {
-			var out []zeroruntime.Message
-			for _, tr := range toolResultsWithImages {
-				if imageMessage, ok := toolResultImageMessage(tr, options); ok {
-					out = append(out, imageMessage)
-				}
-			}
-			return out
-		}
+		// interleaving yields [tool_result, text, image, tool_result] and a 400.
+		// Same reason the self-correction feedback below is deferred.
+		var toolImageMessages []zeroruntime.Message
 		// Parallel read-ahead state: results for calls[precomputedStart:precomputedEnd]
 		// executed concurrently, consumed strictly in order below.
 		var precomputed []precomputedToolResult
@@ -763,8 +705,15 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				IsError:            toolResult.Status == tools.StatusError,
 				ChangedFiles:       append([]string(nil), toolResult.ChangedFiles...),
 			})
-			if len(toolResult.Images) > 0 {
-				toolResultsWithImages = append(toolResultsWithImages, toolResult)
+			// Images ride a following USER message rather than the tool result
+			// above. Every provider drops images on a tool-role message —
+			// Anthropic's tool_result content is a string, Gemini's is a
+			// functionResponse, and OpenAI guards its image parts to the user role
+			// — so attaching them there would silently deliver nothing. A separate
+			// message also keeps the one-tool-result-per-tool-call pairing intact,
+			// which the providers validate.
+			if imageMessage, ok := toolResultImageMessage(toolResult); ok {
+				toolImageMessages = append(toolImageMessages, imageMessage)
 			}
 
 			// A tool may demand the run ABORT — a canceled/timed-out ask_user prompt
@@ -776,13 +725,13 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			}
 			if abortErr != nil {
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.Messages = copyMessages(messages)
 				return result, abortErr
 			}
 			if stopReason := stopReasonFromToolResult(toolResult); stopReason != "" {
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.FinalAnswer = toolResult.ModelOutput()
 				result.StopReason = stopReason
 				result.Messages = copyMessages(messages)
@@ -806,7 +755,7 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				// messages stay valid for a strict provider replay (Anthropic
 				// rejects a tool_use with no answering tool_result).
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.FinalAnswer = toolFailureStopAnswer(call.Name, outcome.Count)
 				result.Messages = copyMessages(messages)
 				return result, nil
@@ -825,6 +774,10 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				postEditDiagnostics.enqueue(ctx, toolResult.ChangedFiles)
 			}
 		}
+		// Every tool_result for this turn is now recorded, including aborted
+		// placeholders, so the images can follow without splitting them.
+		messages = append(messages, toolImageMessages...)
+		toolImageMessages = nil
 
 		// Run post-edit self-correction once over the union of files this turn
 		// changed, then append any feedback after every tool_result is recorded so
@@ -893,31 +846,15 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 					options.ServiceTier = ""
 					planner.config.serviceTier = ""
 					options.Trace.Counter(trace.CounterModelSwitches, 1)
-					// Re-derive the context window for the new model so compaction and
-					// the OnContext budget report track the model actually in force —
-					// without this a switch to a smaller-window model can overflow the
-					// target, and a switch to a larger one over-compacts. An unknown
-					// model (<= 0) keeps the original window. The compactor also
-					// re-resolves its dedicated summarizer against the new model.
-					window := 0
-					if options.ContextWindowFor != nil {
-						window = options.ContextWindowFor(turnRequestedModel)
-					}
-					if window > 0 {
-						options.ContextWindow = window
-						planner.config.contextWindow = window
-					}
-					compactor.switchModel(turnRequestedModel, window)
+					// KNOWN LIMITATION (deferred): the compactor's context-window budget
+					// is fixed at run start from options.ContextWindow and is NOT updated
+					// here, so a switch to a model with a different window keeps compacting
+					// against the original budget. Fixing it needs the switcher to also
+					// report the new window — out of scope for this change.
 				}
 			}
 		}
 
-		// Every tool_result, self-correct notice, and model-switch update for this
-		// turn is now in place; evaluate and append image messages against the
-		// effective (potentially escalated) model.
-		messages = append(messages, buildToolImageMessages()...)
-		toolResultsWithImages = nil
-
 		// A turn can mix valid tool calls with a dropped (nameless) one. The valid
 		// calls executed above; surface the dropped call too so it is never
 		// silently ignored just because the turn also did real work. This is
@@ -1580,7 +1517,6 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 		Images:          result.Images,
 		Redacted:        result.Redacted,
 		ChangedFiles:    result.ChangedFiles,
-		FileDiffs:       result.FileDiffs,
 		ChangeSummaries: result.ChangeSummaries,
 		Display:         result.HumanDisplay(),
 		Outcome:         result.Outcome,
@@ -1887,10 +1823,6 @@ func runToolForUnsandboxedRetry(ctx context.Context, registry *tools.Registry, n
 }
 
 func toolResultFromPrePermissionReject(call ToolCall, result tools.Result) ToolResult {
-	// PrePermissionRejecter runs before Registry.RunWithOptions, so it must
-	// explicitly cross the same transcript/redaction boundary before its result
-	// can be forwarded through ACP.
-	result = tools.ScrubResultSecrets(result)
 	output, outputRedacted := scrubInterceptedOutput(result.Output)
 	display := result.Display
 	summary, summaryRedacted := scrubInterceptedOutput(display.Summary)
@@ -1918,7 +1850,6 @@ func toolResultFromPrePermissionReject(call ToolCall, result tools.Result) ToolR
 		Meta:            meta,
 		Redacted:        result.Redacted || outputRedacted || summaryRedacted || metaRedacted,
 		ChangedFiles:    result.ChangedFiles,
-		FileDiffs:       result.FileDiffs,
 		ChangeSummaries: result.ChangeSummaries,
 		Display:         display,
 		LoadedTools:     loadedToolsFromResult(meta),
@@ -2212,7 +2143,6 @@ func askUserFallbackResult(ctx context.Context, registry *tools.Registry, call T
 			Meta:            result.Meta,
 			Redacted:        result.Redacted,
 			ChangedFiles:    result.ChangedFiles,
-			FileDiffs:       result.FileDiffs,
 			ChangeSummaries: result.ChangeSummaries,
 			Display:         result.HumanDisplay(),
 			Outcome:         result.Outcome,
@@ -3517,10 +3447,8 @@ func copyMessages(messages []Message) []Message {
 //
 // The text names the tool so the model can tell which call an image came from
 // when several ran in one turn — the images arrive detached from their tool
-// result, so nothing else associates them. If the effective model cannot
-// accept images, the tool's text result is left unchanged and this follow-up
-// is a notice with no image parts, matching the CLI/TUI vision gate.
-func toolResultImageMessage(result ToolResult, options Options) (zeroruntime.Message, bool) {
+// result, so nothing else associates them.
+func toolResultImageMessage(result ToolResult) (zeroruntime.Message, bool) {
 	images := make([]zeroruntime.ImageBlock, 0, len(result.Images))
 	for _, image := range result.Images {
 		if len(image.Data) == 0 {
@@ -3541,26 +3469,9 @@ func toolResultImageMessage(result ToolResult, options Options) (zeroruntime.Mes
 	if label == "" {
 		label = "tool"
 	}
-	if !modelAcceptsToolImages(options) {
-		return zeroruntime.Message{
-			Role:    zeroruntime.MessageRoleUser,
-			Content: "Image output from " + label + " was not sent because the current model does not support image input. Switch to a vision-capable model before retrying image delivery, including any images skipped by the tool's image budget.",
-		}, true
-	}
 	return zeroruntime.Message{
 		Role:    zeroruntime.MessageRoleUser,
 		Content: "Image output from " + label + ":",
 		Images:  images,
 	}, true
 }
-
-func modelAcceptsToolImages(options Options) bool {
-	if options.SupportsVision != nil {
-		return options.SupportsVision(options.Model)
-	}
-	registry, err := modelregistry.DefaultRegistry()
-	if err != nil {
-		return modelregistry.VisionCapableByName(options.Model)
-	}
-	return modelregistry.SupportsVision(registry, options.Model)
-}

internal/agent/loop_test.go

@@ -27,23 +27,6 @@ type mockProvider struct {
 	requests []zeroruntime.CompletionRequest
 }
 
-func TestPrePermissionRejectScrubsFileDiffs(t *testing.T) {
-	secret := "sk-proj-abcdefghijklmnopqrstuvwxyz"
-	result := toolResultFromPrePermissionReject(ToolCall{ID: "call", Name: "test"}, tools.Result{
-		Status: tools.StatusError,
-		FileDiffs: []tools.FileDiff{{
-			Path:      filepath.Join(t.TempDir(), "secret.txt"),
-			OldExists: true,
-			NewExists: true,
-			OldText:   "token=" + secret,
-			NewText:   "safe",
-		}},
-	})
-	if len(result.FileDiffs) != 1 || strings.Contains(result.FileDiffs[0].OldText, secret) || !result.Redacted {
-		t.Fatalf("pre-permission FileDiff = %#v, redacted = %t", result.FileDiffs, result.Redacted)
-	}
-}
-
 func TestTypedExecutionOutcomeOverridesLegacySandboxHeuristics(t *testing.T) {
 	engine := sandbox.NewEngine(sandbox.EngineOptions{WorkspaceRoot: t.TempDir(), Policy: sandbox.DefaultPolicy()})
 	call := ToolCall{Name: tools.ExecCommandToolName}

internal/agent/midstream_retry_test.go

@@ -1,487 +0,0 @@
-package agent
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// midStreamAbortProvider connects successfully but emits a transport-abort
-// StreamEventError on the first abortBefore calls, then succeeds with "done".
-// hangOnCall, if > 0, makes that 1-based call block until ctx is done so a
-// cancel during the retried CollectStream can be reproduced.
-// connectFailFrom, if > 0, makes that 1-based call and later return a
-// reconnectable connect error so streamWithReconnect enters its backoff.
-type midStreamAbortProvider struct {
-	calls           int32
-	abortBefore     int32
-	abortError      string
-	partialText     string
-	emptyTextEvent  bool
-	partialToolCall string
-	hangOnCall      int32
-	connectFailFrom int32
-	connectErr      string
-	started         chan struct{}
-}
-
-func (p *midStreamAbortProvider) StreamCompletion(ctx context.Context, _ zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	n := atomic.AddInt32(&p.calls, 1)
-	if p.connectFailFrom > 0 && n >= p.connectFailFrom {
-		if p.started != nil {
-			select {
-			case <-p.started:
-			default:
-				close(p.started)
-			}
-		}
-		errMsg := p.connectErr
-		if errMsg == "" {
-			errMsg = "connection reset by peer"
-		}
-		return nil, errors.New(errMsg)
-	}
-	if p.hangOnCall > 0 && n == p.hangOnCall {
-		if p.started != nil {
-			close(p.started)
-		}
-		ch := make(chan zeroruntime.StreamEvent)
-		go func() {
-			<-ctx.Done()
-			close(ch)
-		}()
-		return ch, nil
-	}
-	ch := make(chan zeroruntime.StreamEvent, 5)
-	if n <= p.abortBefore {
-		if p.emptyTextEvent {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: ""}
-		}
-		if p.partialText != "" {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: p.partialText}
-		}
-		if p.partialToolCall != "" {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "tc_1", ToolName: p.partialToolCall}
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "tc_1", ArgumentsFragment: `{"path":"x.html","content":"<!doctype`}
-		}
-		errMsg := p.abortError
-		if errMsg == "" {
-			errMsg = "provider stream error: read: connection reset by peer"
-		}
-		ch <- zeroruntime.StreamEvent{
-			Type:  zeroruntime.StreamEventError,
-			Error: errMsg,
-		}
-		close(ch)
-		return ch, nil
-	}
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: "done"}
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventDone}
-	close(ch)
-	return ch, nil
-}
-
-func TestRunRetriesMidStreamConnectionReset(t *testing.T) {
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("a mid-stream connection reset should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunRetriesMidStreamWindowsAbort(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: read: wsarecv: An established connection was aborted by the software in your host machine",
-	}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("a Windows mid-stream abort should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-// wsarecv alone (no "connection was aborted" substring) must still retry, so
-// deleting the wsarecv needle cannot go green.
-func TestRunRetriesMidStreamWsarecvNeedle(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: read: wsarecv: 10053",
-	}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("wsarecv without 'connection was aborted' should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunDoesNotRetryMidStreamAbortAfterPartialOutput(t *testing.T) {
-	sawText := 0
-	p := &midStreamAbortProvider{abortBefore: 1, partialText: "partial"}
-	_, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		OnText:   func(string) { sawText++ },
-	})
-	if err == nil {
-		t.Fatal("a mid-stream abort after partial output must NOT be retried; want an error")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("partial-then-abort must not retry, got %d calls", got)
-	}
-	if sawText == 0 {
-		t.Fatal("OnText must have fired so forwardedVisibleText is the named guard")
-	}
-}
-
-// A zero-length OnText chunk is not committed answer prose, so an eligible
-// transport abort still retries.
-func TestRunRetriesMidStreamAbortAfterEmptyTextEvent(t *testing.T) {
-	p := &midStreamAbortProvider{abortBefore: 1, emptyTextEvent: true}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		OnText:   func(string) {},
-	})
-	if err != nil {
-		t.Fatalf("empty OnText must not block mid-stream abort retry, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunRetriesMidStreamAbortAfterIncompleteToolCall(t *testing.T) {
-	starts := 0
-	dispatched := 0
-	p := &midStreamAbortProvider{abortBefore: 1, partialToolCall: "write_file"}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry:        tools.NewRegistry(),
-		OnToolCallStart: func(string, string) { starts++ },
-		OnToolCallDelta: func(string, string) {},
-		OnToolCall:      func(ToolCall) { dispatched++ },
-	})
-	if err != nil {
-		t.Fatalf("a mid-stream abort mid-incomplete-tool-call should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-	if starts != 1 {
-		t.Fatalf("the incomplete tool call should have been forwarded once before the abort, got %d starts", starts)
-	}
-	if dispatched != 0 {
-		t.Fatalf("OnToolCall must never fire for an incomplete aborted tool call (no dispatch), got %d", dispatched)
-	}
-}
-
-func TestRunGivesUpAfterMaxMidStreamAbortRetries(t *testing.T) {
-	if maxStreamStallRetries != 1 {
-		t.Fatalf("maxStreamStallRetries = %d, want 1 (#973 must not raise this bound)", maxStreamStallRetries)
-	}
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	p := &midStreamAbortProvider{abortBefore: 99}
-	_, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err == nil {
-		t.Fatal("a persistent mid-stream abort must surface an error after exhausting retries")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry); pin the bound at 1, got %d", got)
-	}
-}
-
-func TestRunMidStreamAbortUsesReconnectNotice(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	var notices string
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	})
-	if err != nil {
-		t.Fatalf("retry should succeed, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	lower := strings.ToLower(notices)
-	if !strings.Contains(lower, "connection lost") || !strings.Contains(lower, "reconnecting") {
-		t.Fatalf("transport abort must use reconnect wording, notices = %q", notices)
-	}
-	if strings.Contains(lower, "model stalled") {
-		t.Fatalf("transport abort must not use stall wording, notices = %q", notices)
-	}
-}
-
-func TestRunCancelDuringMidStreamRetryPreservesContextCanceled(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	started := make(chan struct{})
-	p := &midStreamAbortProvider{abortBefore: 1, hangOnCall: 2, started: started}
-	errCh := make(chan error, 1)
-	go func() {
-		_, err := Run(ctx, "go", p, Options{Registry: tools.NewRegistry()})
-		errCh <- err
-	}()
-	select {
-	case <-started:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for retried stream")
-	}
-	cancel()
-	err := <-errCh
-	if err == nil {
-		t.Fatal("want context.Canceled after cancel during retried stream")
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("cancel during retried stream must keep the sentinel, got %q (errors.Is Canceled = false)", err)
-	}
-}
-
-func TestRunCancelDuringReplacementConnectBackoffPreservesContextCanceled(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = 200 * time.Millisecond
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	started := make(chan struct{})
-	p := &midStreamAbortProvider{abortBefore: 1, connectFailFrom: 2, started: started}
-	errCh := make(chan error, 1)
-	go func() {
-		_, err := Run(ctx, "go", p, Options{Registry: tools.NewRegistry()})
-		errCh <- err
-	}()
-	select {
-	case <-started:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for replacement connect failure")
-	}
-	cancel()
-	err := <-errCh
-	if err == nil {
-		t.Fatal("want context.Canceled after cancel during replacement connect backoff")
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("cancel during replacement connect backoff must keep the sentinel, got %q (errors.Is Canceled = false)", err)
-	}
-}
-
-func TestRunMidStreamAbortRecordsReconnectCountOnImmediateReplacement(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	rec := trace.NewRecorder("midstream-abort", "run-1", "test")
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		Trace:    rec,
-	})
-	if err != nil {
-		t.Fatalf("retry should succeed, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 immediate replacement), got %d", got)
-	}
-	gotTrace := rec.Finish()
-	if got := gotTrace.Counter(trace.CounterReconnectCount); got != 1 {
-		t.Fatalf("reconnect_count = %d, want 1 for a successful replacement connection", got)
-	}
-	if got := gotTrace.Counter(trace.CounterModelRequests); got != 2 {
-		t.Fatalf("model_requests = %d, want 2 (initial + replacement)", got)
-	}
-}
-
-func TestRunDoesNotRetryResponseHeaderTimeout(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 99,
-		abortError:  "net/http: timeout awaiting response headers",
-	}
-	_, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err == nil {
-		t.Fatal("a response-header timeout must not be retried as a mid-stream abort")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("header timeout must not retry, got %d calls", got)
-	}
-}
-
-func TestIsMidStreamTransportAbort(t *testing.T) {
-	aborts := []string{
-		"provider stream error: read: connection reset by peer",
-		"provider stream error: unexpected EOF",
-		"provider stream error: read: wsarecv: 10053",
-		"provider stream error: read: wsarecv: An established connection was aborted by the software in your host machine",
-		"An existing connection was forcibly closed by the remote host",
-		"provider stream error: read: connection closed",
-		"write: broken pipe",
-		"provider stream error: server closed the connection",
-		"provider stream error: software caused connection abort",
-	}
-	for _, m := range aborts {
-		if !isMidStreamTransportAbort(m) {
-			t.Fatalf("want mid-stream transport abort: %q", m)
-		}
-	}
-	notAborts := []string{
-		"",
-		"context length exceeded",
-		"rate limit error: slow down",
-		"model not found",
-		"net/http: timeout awaiting response headers",
-		"dial tcp 10.0.0.1:443: connect: connection refused",
-		"i/o timeout",
-		"500 Internal Server Error",
-		"502 Bad Gateway",
-		"503 Service Unavailable",
-		"504 Gateway Timeout",
-		"provider request error: request does not satisfy oneOf schema",
-		"provider request error: connection closed is not a supported finish reason",
-		"provider error: connection closed is not a supported finish reason",
-		"provider error: upstream connection reset by peer",
-		"provider error: unexpected EOF while reading upstream response",
-		"provider error: 502 Bad Gateway",
-		"auth error: connection reset by peer",
-		"rate limit error: server closed",
-		"schema error: property oneOf is invalid",
-	}
-	for _, m := range notAborts {
-		if isMidStreamTransportAbort(m) {
-			t.Fatalf("must NOT classify as mid-stream transport abort: %q", m)
-		}
-	}
-}
-
-func TestRunDoesNotRetryClassifiedProviderErrorWithSocketPhrase(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider request error: connection closed is not a supported finish reason",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("classified provider error with 'connection closed' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if !strings.Contains(err.Error(), "connection closed") {
-		t.Fatalf("expected original error preserved, got %v", err)
-	}
-}
-
-func TestRunDoesNotRetryProviderErrorWithSocketPhrase(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider error: unexpected EOF while reading upstream response",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("provider error with 'unexpected EOF' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if got := err.Error(); got != p.abortError {
-		t.Fatalf("error = %q, want original provider error %q", got, p.abortError)
-	}
-}
-
-func TestRunDoesNotRetryApplicationErrorContainingEOFSubstring(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider request error: request does not satisfy oneOf schema",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("application error with 'oneOf' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if !strings.Contains(err.Error(), "oneOf") {
-		t.Fatalf("expected original error preserved, got %v", err)
-	}
-}
-
-func TestRunRetriesMidStreamUnexpectedEOF(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: unexpected EOF",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	result, err := Run(context.Background(), "go", p, opts)
-	if err != nil {
-		t.Fatalf("unexpected EOF should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-	lower := strings.ToLower(notices)
-	if !strings.Contains(lower, "connection lost") || !strings.Contains(lower, "reconnecting") {
-		t.Fatalf("expected reconnect notice, got %q", notices)
-	}
-}

internal/agent/prompt_budget_test.go

@@ -1,11 +1,9 @@
 package agent
 
 import (
-	"strings"
 	"testing"
 
 	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // These ceilings are a deliberate ratchet on Zero's fixed per-turn overhead — the
@@ -35,24 +33,7 @@ const (
 	// The ratchet did its job: it caught the creep and forced a decision instead
 	// of a drift. That is the point of it, so keep raising it deliberately rather
 	// than reflexively.
-	//
-	// THIS COUNTS THE SCHEMAS ONLY, NOT THE HOST'S SHELL GUIDANCE. Until
-	// 2026-09-07 it counted both, and that made it a different measurement on
-	// every machine: exec_command appends shell guidance whose size depends on
-	// which shell was detected, so the same tree measured 3498 on Linux, ~3600 on
-	// a Windows host with pwsh 7, and 3653 on Windows PowerShell 5.1, which is
-	// stock Windows. The 5.1 case has been over this ceiling since view_image
-	// landed, so `go test ./...` failed for anyone on a stock Windows box while
-	// CI stayed green, because the runners have pwsh 7 and take the cheaper
-	// branch. A budget that passes or fails on which PowerShell happens to be
-	// installed is not ratcheting anything.
 	maxEagerToolSchemaTokens = 3650
-	// The host-specific half, ratcheted on its own so it cannot creep either.
-	// Measured 2026-09-07: Windows PowerShell 5.1 is the most expensive host at
-	// 155 tokens (722 chars), pwsh 7 is 110, cmd.exe is 87, and every POSIX host
-	// is 0 because no guidance is appended there. Set above the worst case, not
-	// above whatever this machine happens to be.
-	maxExecCommandShellGuidanceTokens = 200
 )
 
 func TestSystemPromptTokenBudget(t *testing.T) {
@@ -75,35 +56,8 @@ func TestEagerToolSchemaTokenBudget(t *testing.T) {
 	// Options{} keeps DeferThreshold at 0, so deferral is inactive and every core
 	// tool is exposed eagerly — exactly what a plugin-free session sends each turn.
 	exposed, _ := partitionTools(registry, PermissionModeAuto, Options{}, map[string]bool{})
-	total := estimateToolDefTokens(exposed)
-	// exec_command's description carries this host's shell guidance, and that
-	// guidance is the one part of the eager set that is not the same everywhere.
-	// Charged separately below rather than folded in here, or this ceiling would
-	// mean a different thing on every machine. See the constants above.
-	//
-	// Removed from the description BEFORE estimating rather than subtracted from
-	// the total afterwards. ApproxTextTokens is an integer division, so
-	// floor((schema+guidance)/4) - floor(guidance/4) comes out one token high
-	// whenever the two remainders add past four, and which side of that line a
-	// host lands on depends on the length of its guidance: exactly the
-	// host-dependence this number is supposed to be rid of.
-	guidance := tools.HostExecCommandShellGuidance()
-	schemas := make([]zeroruntime.ToolDefinition, len(exposed))
-	copy(schemas, exposed)
-	stripped := 0
-	for index := range schemas {
-		without := strings.TrimSuffix(schemas[index].Description, guidance)
-		if without != schemas[index].Description {
-			stripped++
-		}
-		schemas[index].Description = without
-	}
-	if guidance != "" && stripped != 1 {
-		t.Fatalf("SETUP INVALID: this host's shell guidance came off %d descriptions, want exactly exec_command's; internal/tools pins it as that description's tail", stripped)
-	}
-	got := estimateToolDefTokens(schemas)
-	guidanceTokens := ApproxTextTokens(guidance)
-	t.Logf("eager core tool schemas: %d tokens across %d tools (%d total, %d host shell guidance)", got, len(exposed), total, guidanceTokens)
+	got := estimateToolDefTokens(exposed)
+	t.Logf("eager core tool schemas: %d tokens across %d tools", got, len(exposed))
 	if got > maxEagerToolSchemaTokens {
 		// NOT "defer a tool": this test pins DeferThreshold at 0, so marking a
 		// tool deferred leaves it exposed here and changes nothing. Deferral is
@@ -112,9 +66,6 @@ func TestEagerToolSchemaTokenBudget(t *testing.T) {
 		// deliberate raise.
 		t.Fatalf("eager tool schemas are %d tokens, over the %d ceiling — trim a schema, drop a core tool, or raise the ceiling deliberately (deferring will NOT help: this test disables deferral)", got, maxEagerToolSchemaTokens)
 	}
-	if guidanceTokens > maxExecCommandShellGuidanceTokens {
-		t.Fatalf("this host's exec_command shell guidance is %d tokens, over the %d ceiling — trim the guidance in internal/tools/shell_runtime.go or raise the ceiling deliberately", guidanceTokens, maxExecCommandShellGuidanceTokens)
-	}
 }
 
 func TestAgentAdvertisesBothEditTools(t *testing.T) {

internal/agent/reconnect.go

@@ -144,15 +144,6 @@ func shouldReconnect(ctx context.Context, err error) bool {
 		"i/o timeout",
 		"server closed",
 		"unexpected end",
-		// Windows mid-stream aborts (WSAECONNABORTED / wsarecv) — host or AV
-		// forcibly closes an established socket during CollectStream.
-		// "software caused connection abort" is the Unix/macOS ECONNABORTED
-		// text; it also appears in midStreamAbortNeedles, which must stay a
-		// subset of this list.
-		"wsarecv",
-		"connection was aborted",
-		"software caused connection abort",
-		"forcibly closed",
 	} {
 		if strings.Contains(msg, needle) {
 			return true
@@ -161,86 +152,6 @@ func shouldReconnect(ctx context.Context, err error) bool {
 	return false
 }
 
-// midStreamAbortNeedles are the transport-abort classes retried AFTER connect
-// succeeded and the stream body has started. This is a subset of shouldReconnect:
-// connect-phase signals (timeout, connection refused, "temporarily unavailable")
-// stay on the connect retry path, because matching them here would re-prefill a
-// healthy-but-slow server (ollama cloud header timeouts) and tell the user the
-// connection was lost. Issue #973 names WSAECONNABORTED / connection reset /
-// unexpected stream EOF.
-var midStreamAbortNeedles = []string{
-	"unexpected end",
-	"connection reset",
-	"broken pipe",
-	"connection closed",
-	"server closed",
-	"wsarecv",
-	"connection was aborted",
-	"software caused connection abort",
-	"forcibly closed",
-}
-
-var classifiedNonTransportPrefixes = []string{
-	"provider request error:",
-	"provider error:",
-	"auth error:",
-	"rate limit error:",
-}
-
-// isMidStreamTransportAbort reports whether a collected stream error string is a
-// retryable mid-stream transport abort. It does NOT delegate to shouldReconnect:
-// that list is a connect-phase argument ("no response was received"). The stream
-// body has already started here, so only abort/reset/EOF/close classes retry.
-//
-// Used for failures DURING the stream body AFTER a successful connect and BEFORE
-// tool dispatch — the incomplete turn committed no answer text and executed no
-// tools, so a bounded re-issue is safe (same safety rules as the stall path).
-func isMidStreamTransportAbort(message string) bool {
-	lowered := strings.ToLower(strings.TrimSpace(message))
-	if lowered == "" || isContextLimitError(lowered) {
-		return false
-	}
-	for _, prefix := range classifiedNonTransportPrefixes {
-		if strings.Contains(lowered, prefix) {
-			return false
-		}
-	}
-	if errhint.HasStatusCode(lowered, "500", "502", "503", "504") {
-		return false
-	}
-	if containsWordBoundary(lowered, "eof") {
-		return true
-	}
-	for _, needle := range midStreamAbortNeedles {
-		if strings.Contains(lowered, needle) {
-			return true
-		}
-	}
-	return false
-}
-
-func containsWordBoundary(text, word string) bool {
-	start := 0
-	for {
-		idx := strings.Index(text[start:], word)
-		if idx < 0 {
-			return false
-		}
-		pos := start + idx
-		endPos := pos + len(word)
-		leftBoundary := pos == 0 || !isAlphaNumByte(text[pos-1])
-		rightBoundary := endPos == len(text) || !isAlphaNumByte(text[endPos])
-		if leftBoundary && rightBoundary {
-			return true
-		}
-		start = pos + 1
-	}
-}
-
-func isAlphaNumByte(c byte) bool {
-	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_'
-}
-
 // backoffFor is the deterministic exponential base delay for a 1-based attempt,
 // capped at streamReconnectMax. Jitter is layered on separately (jitteredBackoff).
 func backoffFor(attempt int) time.Duration {

internal/agent/reconnect_test.go

@@ -92,12 +92,6 @@ func TestShouldReconnectClassification(t *testing.T) {
 	disconnects := []string{
 		"unexpected EOF", "connection reset by peer", "broken pipe",
 		"i/o timeout", "server closed the connection", "connection refused",
-		// Windows socket aborts also remain reconnectable at connect time.
-		"wsarecv: An established connection was aborted by the software in your host machine",
-		"read: connection was aborted",
-		// Unix/macOS ECONNABORTED text.
-		"read: software caused connection abort",
-		"An existing connection was forcibly closed by the remote host",
 	}
 	for _, m := range disconnects {
 		if !shouldReconnect(ctx, errors.New(m)) {

internal/agent/tool_result_images_test.go

@@ -10,24 +10,6 @@ import (
 	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
-func TestNonVisionImageNoticeQualifiesBudgetRecovery(t *testing.T) {
-	result := ToolResult{
-		Name:   "mcp_screenshot",
-		Output: "One image exceeded this result's remaining image budget. Retrying with fewer images can recover this payload.",
-		Images: []zeroruntime.ImageBlock{{MediaType: "image/png", Data: []byte("image")}},
-	}
-	notice, ok := toolResultImageMessage(result, Options{
-		SupportsVision: func(string) bool { return false },
-	})
-	if !ok || len(notice.Images) != 0 {
-		t.Fatal("non-vision delivery must produce a text-only notice")
-	}
-	if !strings.Contains(notice.Content, "Switch to a vision-capable model before retrying") ||
-		!strings.Contains(notice.Content, "budget") {
-		t.Fatalf("notice does not qualify budget recovery: %s", notice.Content)
-	}
-}
-
 // imageTool returns a tool result carrying an image, the way a screenshot tool
 // should be able to.
 type imageTool struct {
@@ -80,7 +62,6 @@ func TestRunDeliversToolResultImagesToTheModel(t *testing.T) {
 	result, err := Run(context.Background(), "screenshot please", provider, Options{
 		Registry: registry,
 		MaxTurns: 2,
-		Model:    "gpt-4o",
 	})
 	if err != nil {
 		t.Fatalf("Run: %v", err)
@@ -105,16 +86,11 @@ func TestRunDeliversToolResultImagesToTheModel(t *testing.T) {
 
 	// The tool-result pairing must be untouched: one tool result per tool call.
 	toolResults := 0
-	var toolText string
 	for _, message := range result.Messages {
 		if message.Role == zeroruntime.MessageRoleTool {
 			toolResults++
-			toolText = message.Content
 		}
 	}
-	if toolText != "Captured a screenshot." {
-		t.Fatalf("tool text = %q, want preserved", toolText)
-	}
 	if toolResults != 1 {
 		t.Errorf("got %d tool-result messages for 1 tool call", toolResults)
 	}
@@ -160,7 +136,7 @@ func TestRunKeepsToolResultsContiguousWhenAToolReturnsAnImage(t *testing.T) {
 		{{Type: zeroruntime.StreamEventText, Content: "done"}, {Type: zeroruntime.StreamEventDone}},
 	}}
 
-	result, err := Run(context.Background(), "two calls", provider, Options{Registry: registry, MaxTurns: 2, Model: "gpt-4o"})
+	result, err := Run(context.Background(), "two calls", provider, Options{Registry: registry, MaxTurns: 2})
 	if err != nil {
 		t.Fatalf("Run: %v", err)
 	}
@@ -229,176 +205,3 @@ func messageShape(messages []zeroruntime.Message) string {
 	}
 	return "[" + strings.Join(parts, " ") + "]"
 }
-
-func TestRunDropsToolResultImagesForANonVisionModel(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(imageTool{media: "image/png", data: []byte("\x89PNG\r\n\x1a\nfake")})
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{
-			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call_1", ToolName: "capture"},
-			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call_1", ArgumentsFragment: `{}`},
-			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call_1"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-		{{Type: zeroruntime.StreamEventText, Content: "ok"}, {Type: zeroruntime.StreamEventDone}},
-	}}
-
-	result, err := Run(context.Background(), "screenshot please", provider, Options{
-		Registry: registry,
-		MaxTurns: 2,
-		Model:    "totally-made-up-model",
-	})
-	if err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-	var toolText string
-	var noticed bool
-	for _, message := range result.Messages {
-		if message.Role == zeroruntime.MessageRoleTool {
-			toolText = message.Content
-		}
-		if len(message.Images) > 0 {
-			t.Fatalf("non-vision model received image bytes on %q: %s", message.Role, messageShape(result.Messages))
-		}
-		if strings.Contains(message.Content, "does not support image input") {
-			noticed = true
-		}
-	}
-	if toolText != "Captured a screenshot." {
-		t.Fatalf("tool text = %q, want preserved on the non-vision path", toolText)
-	}
-	if !noticed {
-		t.Fatalf("non-vision model was not told the image was dropped; recorded %s", messageShape(result.Messages))
-	}
-}
-
-type switchAndCaptureTool struct {
-	targetModel string
-}
-
-func (switchAndCaptureTool) Name() string        { return "switch_and_capture" }
-func (switchAndCaptureTool) Description() string { return "Switches model and captures image" }
-func (switchAndCaptureTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", Properties: map[string]tools.PropertySchema{}}
-}
-func (switchAndCaptureTool) Safety() tools.Safety {
-	return tools.Safety{Permission: tools.PermissionAllow}
-}
-func (t switchAndCaptureTool) Run(context.Context, map[string]any) tools.Result {
-	return tools.Result{
-		Status: tools.StatusOK,
-		Output: "[image returned by tool]",
-		Images: []zeroruntime.ImageBlock{{MediaType: "image/png", Data: []byte("\x89PNG\r\n\x1a\nfake")}},
-		Meta:   map[string]string{"escalate_to_model": t.targetModel},
-	}
-}
-
-func TestRunToolImagesRespectsModelSwitch(t *testing.T) {
-	t.Run("Non-vision to vision model escalation forwards images", func(t *testing.T) {
-		registry := tools.NewRegistry()
-		registry.Register(switchAndCaptureTool{targetModel: "gpt-4o"})
-
-		provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-			{
-				{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call_1", ToolName: "switch_and_capture"},
-				{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call_1", ArgumentsFragment: `{}`},
-				{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call_1"},
-				{Type: zeroruntime.StreamEventDone},
-			},
-			{
-				{Type: zeroruntime.StreamEventText, Content: "I see it on gpt-4o."},
-				{Type: zeroruntime.StreamEventDone},
-			},
-		}}
-
-		switched := false
-		switcher := func(_ context.Context, modelID string) (Provider, error) {
-			switched = true
-			return provider, nil
-		}
-
-		result, err := Run(context.Background(), "test", provider, Options{
-			Registry:      registry,
-			MaxTurns:      2,
-			Model:         "non-vision-initial",
-			ModelSwitcher: switcher,
-			SupportsVision: func(modelID string) bool {
-				return modelID == "gpt-4o"
-			},
-		})
-		if err != nil {
-			t.Fatalf("Run: %v", err)
-		}
-		if !switched {
-			t.Fatal("expected model switch to occur")
-		}
-
-		var carrier *zeroruntime.Message
-		for index := range result.Messages {
-			if len(result.Messages[index].Images) > 0 {
-				carrier = &result.Messages[index]
-			}
-			if strings.Contains(result.Messages[index].Content, "does not support image input") {
-				t.Fatalf("images were unexpectedly dropped after switch to vision model: %v", result.Messages[index])
-			}
-		}
-		if carrier == nil {
-			t.Fatal("expected image carrier message after escalation to vision model")
-		}
-	})
-
-	t.Run("Vision to non-vision model switch drops images with notice", func(t *testing.T) {
-		registry := tools.NewRegistry()
-		registry.Register(switchAndCaptureTool{targetModel: "text-only-dest"})
-
-		provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-			{
-				{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call_1", ToolName: "switch_and_capture"},
-				{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call_1", ArgumentsFragment: `{}`},
-				{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call_1"},
-				{Type: zeroruntime.StreamEventDone},
-			},
-			{
-				{Type: zeroruntime.StreamEventText, Content: "ok."},
-				{Type: zeroruntime.StreamEventDone},
-			},
-		}}
-
-		switcher := func(_ context.Context, modelID string) (Provider, error) {
-			return provider, nil
-		}
-
-		result, err := Run(context.Background(), "test", provider, Options{
-			Registry:      registry,
-			MaxTurns:      2,
-			Model:         "gpt-4o",
-			ModelSwitcher: switcher,
-			SupportsVision: func(modelID string) bool {
-				return modelID == "gpt-4o"
-			},
-		})
-		if err != nil {
-			t.Fatalf("Run: %v", err)
-		}
-
-		var noticed bool
-		var toolOutputSeen bool
-		for _, m := range result.Messages {
-			if len(m.Images) > 0 {
-				t.Fatalf("image delivered to non-vision destination model: %v", m)
-			}
-			if strings.Contains(m.Content, "does not support image input") {
-				noticed = true
-			}
-			if strings.Contains(m.Content, "[image returned by tool]") {
-				toolOutputSeen = true
-			}
-		}
-		if !noticed {
-			t.Fatal("expected drop notice when switching to non-vision model")
-		}
-		if !toolOutputSeen {
-			t.Fatal("expected tool output preserved in message history")
-		}
-	})
-}

internal/agent/types.go

@@ -84,7 +84,6 @@ type ToolResult struct {
 	Images       []zeroruntime.ImageBlock
 	Redacted     bool
 	ChangedFiles []string
-	FileDiffs    []tools.FileDiff
 	// ChangeSummaries are non-selectable generated-tree summaries emitted by
 	// command execution; callers must not schedule per-file work from them.
 	ChangeSummaries []execution.Change
@@ -341,11 +340,6 @@ type Options struct {
 	// nil for text-only runs (the seeded message then carries no images, exactly
 	// as before).
 	Images []zeroruntime.ImageBlock
-	// SupportsVision, when set, reports whether the effective model accepts
-	// image input. Tool-produced images are dropped at the shared delivery
-	// boundary when this is false. nil uses the curated catalog plus the
-	// name heuristic via modelregistry.SupportsVision.
-	SupportsVision func(modelID string) bool
 	// ContextWindow is the model's maximum input token budget. When > 0 the agent
 	// loop compacts long conversations once the estimated size crosses a fraction
 	// of this window. 0 DISABLES compaction entirely (every existing caller/test
@@ -354,26 +348,10 @@ type Options struct {
 	// CompactionPreserveLast is how many trailing messages compaction keeps
 	// verbatim. <= 0 falls back to defaultCompactionPreserveLast.
 	CompactionPreserveLast int
-	// Summarizer, when set, lazily builds the provider used for compaction
-	// summarization calls — typically a cheap/fast model, since summaries at
-	// main-model prices are the single most expensive recurring event in a
-	// long run. It receives the main model currently in force and may return
-	// (nil, nil) when no dedicated summarizer applies to it (the main model is
-	// already the cheap one). Built on the first paid compaction and again
-	// after a mid-run model switch. Any failure (build or call) falls back to
-	// the run's main provider until the next switch, so a misconfigured
-	// summarizer can never break compaction. nil keeps today's behavior.
-	Summarizer func(ctx context.Context, mainModelID string) (Provider, error)
-	// ContextWindowFor, when set, resolves a model ID to its context window so
-	// the compactor can re-derive its threshold after a mid-run model switch
-	// (escalate_model). Without it a switch keeps compacting against the
-	// original model's window — overflowing a smaller target or over-compacting
-	// a larger one. Return <= 0 when the model is unknown (window unchanged).
-	ContextWindowFor func(modelID string) int
-	Registry         *tools.Registry
-	PermissionMode   PermissionMode
-	Autonomy         string
-	Sandbox          *sandbox.Engine
+	Registry               *tools.Registry
+	PermissionMode         PermissionMode
+	Autonomy               string
+	Sandbox                *sandbox.Engine
 	// FileTracker records per-session file read/write versions so the write tools
 	// can detect a file changed on disk outside Zero since it was last read. nil
 	// disables the check. Created once per session and threaded into every tool run.

internal/background/process_posix.go

@@ -3,9 +3,7 @@
 package background
 
 import (
-	"errors"
 	"os/exec"
-	"syscall"
 	"time"
 
 	"github.com/Gitlawb/zero/internal/execution"
@@ -47,16 +45,6 @@ func terminateProcess(pid int) error {
 // rediscovery after an owned leader exits. Ordinary commands fall back to the
 // safe PID/tree path rather than assuming their PID is also a process-group ID.
 //
-// The bool result is whether the leader had already exited before termination
-// was attempted — the POSIX analogue of Windows GetExitCodeProcess returning a
-// value other than STILL_ACTIVE. A waitable zombie is already-exited: Wait can
-// collect it, but kill(0) still succeeds, and when ps is unavailable
-// signalTargetRunning conservatively treats that as "still running".
-// TerminateCommand uses the flag to discard the resulting spurious
-// SIGKILL-timeout once the reap has independently succeeded. The flag is about
-// the leader only; group/tree termination is still invoked so live descendants
-// are signalled.
-//
 // The Setpgid && Pgid == 0 guard only recognizes ConfigureChildProcessGroup's
 // own convention. A command made its own session leader via Setsid (as opposed
 // to Setpgid) is also its own process-group leader in practice, but takes the
@@ -64,20 +52,8 @@ func terminateProcess(pid int) error {
 // because TerminateCommand has exactly one caller in this codebase; worth
 // covering explicitly if Setsid-configured commands start using this path too.
 func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
-	alreadyExited := leaderWaitableExited(cmd.Process.Pid)
 	if cmd.SysProcAttr != nil && cmd.SysProcAttr.Setpgid && cmd.SysProcAttr.Pgid == 0 {
-		return alreadyExited, execution.TerminateProcessGroup(cmd.Process.Pid, terminationGracePeriod, terminationPollInterval)
+		return false, execution.TerminateProcessGroup(cmd.Process.Pid, terminationGracePeriod, terminationPollInterval)
 	}
-	return alreadyExited, terminateProcess(cmd.Process.Pid)
-}
-
-// terminationTargetGoneAfterReap independently checks the exact signal target
-// used for an owned command. In particular, reaping a zombie group leader does
-// not make this return true while any descendant still occupies that group.
-func terminationTargetGoneAfterReap(cmd *exec.Cmd) bool {
-	target := cmd.Process.Pid
-	if cmd.SysProcAttr != nil && cmd.SysProcAttr.Setpgid && cmd.SysProcAttr.Pgid == 0 {
-		target = -target
-	}
-	return errors.Is(syscall.Kill(target, syscall.Signal(0)), syscall.ESRCH)
+	return false, terminateProcess(cmd.Process.Pid)
 }

internal/background/process_posix_test.go

@@ -6,7 +6,6 @@ import (
 	"bufio"
 	"errors"
 	"os/exec"
-	"runtime"
 	"strconv"
 	"strings"
 	"syscall"
@@ -221,109 +220,6 @@ func TestTerminateCommandKillsChildAfterLeaderExits(t *testing.T) {
 	}
 }
 
-func TestTerminateCommandZombieLeaderWithoutPS(t *testing.T) {
-	if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
-		t.Skip("waitable-exited leader probe is implemented on linux and darwin")
-	}
-
-	grace, poll := terminationGracePeriod, terminationPollInterval
-	terminationGracePeriod, terminationPollInterval = 150*time.Millisecond, 10*time.Millisecond
-	t.Cleanup(func() { terminationGracePeriod, terminationPollInterval = grace, poll })
-
-	// Issue #862: a zombie group leader with ps unresolvable used to burn both
-	// grace periods (kill(0) succeeds against a zombie) and return
-	// "did not exit after SIGKILL" even though cmd.Wait reaped exit status 0.
-	// The already-exited probe must answer without ps so TerminateCommand can
-	// discard that spurious timeout after a successful reap.
-	cmd := exec.Command("sh", "-c", "exit 0")
-	ConfigureChildProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	t.Cleanup(func() {
-		if cmd.ProcessState == nil {
-			_ = cmd.Process.Kill()
-			_ = cmd.Wait()
-		}
-	})
-
-	deadline := time.Now().Add(5 * time.Second)
-	for !leaderWaitableExited(pid) {
-		if time.Now().After(deadline) {
-			t.Fatalf("leader %d did not become waitable-exited within 5s", pid)
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	t.Setenv("PATH", "")
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v, want nil (zombie leader with ps unavailable must not report SIGKILL timeout)", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("zombie leader was not reaped")
-	}
-}
-
-func TestTerminateCommandPreservesGroupFailureWithExitedLeaderAndLiveChild(t *testing.T) {
-	if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
-		t.Skip("waitable-exited leader probe is implemented on linux and darwin")
-	}
-
-	cmd := exec.Command("sh", "-c", "sleep 300 & echo $!; exit 0")
-	ConfigureChildProcessGroup(cmd)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	line, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil {
-		t.Fatalf("read forked child pid: %v", err)
-	}
-	childPID, err := strconv.Atoi(strings.TrimSpace(line))
-	if err != nil {
-		t.Fatalf("parse forked child pid %q: %v", line, err)
-	}
-	t.Cleanup(func() {
-		_ = syscall.Kill(childPID, syscall.SIGKILL)
-		if cmd.ProcessState == nil {
-			_ = cmd.Wait()
-		}
-	})
-
-	deadline := time.Now().Add(5 * time.Second)
-	for !leaderWaitableExited(cmd.Process.Pid) {
-		if time.Now().After(deadline) {
-			t.Fatalf("leader %d did not become waitable-exited within 5s", cmd.Process.Pid)
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	treeErr := errors.New("process group could not be terminated")
-	originalTerminateOwnedProcess := terminateOwnedProcessForTest
-	terminateOwnedProcessForTest = func(got *exec.Cmd) (bool, error) {
-		if got != cmd {
-			t.Fatalf("terminate called with %p, want %p", got, cmd)
-		}
-		return true, treeErr
-	}
-	t.Cleanup(func() { terminateOwnedProcessForTest = originalTerminateOwnedProcess })
-
-	err = TerminateCommand(cmd)
-	if !errors.Is(err, treeErr) {
-		t.Fatalf("TerminateCommand error = %v, want live-group termination failure", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("exited leader was not reaped")
-	}
-	if processStopped(childPID) {
-		t.Fatalf("child %d unexpectedly stopped; failure boundary needs a live group member", childPID)
-	}
-}
-
 func processStopped(pid int) bool {
 	if errors.Is(syscall.Kill(pid, syscall.Signal(0)), syscall.ESRCH) {
 		return true

internal/background/process_waitable_darwin.go

@@ -1,28 +0,0 @@
-//go:build darwin
-
-package background
-
-import "golang.org/x/sys/unix"
-
-// szomb is sys/proc.h SZOMB: the process has exited and is waiting to be reaped.
-const szomb int8 = 5
-
-// leaderWaitableExited reports whether pid has already exited and is waiting
-// to be reaped. This is the POSIX analogue of Windows GetExitCodeProcess
-// returning a value other than STILL_ACTIVE: the leader is a zombie, waitable
-// as exited, without collecting it. A true result does not mean the process
-// group is empty — descendants may still be running.
-//
-// Darwin has no /proc and x/sys/unix does not wrap waitid here, so the probe
-// is kern.proc.pid via sysctl. It does not use ps, which is the #862 failure
-// mode when PATH cannot resolve ps.
-func leaderWaitableExited(pid int) bool {
-	if pid <= 1 {
-		return false
-	}
-	kinfo, err := unix.SysctlKinfoProc("kern.proc.pid", pid)
-	if err != nil {
-		return false
-	}
-	return kinfo.Proc.P_stat == szomb
-}

internal/background/process_waitable_linux.go

@@ -1,68 +0,0 @@
-//go:build linux
-
-package background
-
-import (
-	"bytes"
-	"os"
-	"strconv"
-
-	"golang.org/x/sys/unix"
-)
-
-// POSIX waitid si_code values for an already-exited child (bits/waitflags.h).
-const (
-	cldExited int32 = 1
-	cldKilled int32 = 2
-	cldDumped int32 = 3
-)
-
-// leaderWaitableExited reports whether pid has already exited and is waiting
-// to be reaped. This is the POSIX analogue of Windows GetExitCodeProcess
-// returning a value other than STILL_ACTIVE: the leader is waitable as exited
-// (typically a zombie) without collecting it. A true result does not mean the
-// process group is empty — descendants may still be running.
-//
-// Detection does not use ps. waitid(WNOHANG|WNOWAIT) asks the kernel whether
-// an exit status is already available. /proc/<pid>/stat state Z is the
-// fallback when waitid cannot answer (for example if procfs is the only
-// usable source). Either path is independent of PATH, which is the #862
-// failure mode: empty PATH makes ps unresolvable and kill(0) still succeeds
-// against a zombie.
-func leaderWaitableExited(pid int) bool {
-	if pid <= 1 {
-		return false
-	}
-	if waitidAlreadyExited(pid) {
-		return true
-	}
-	return procIsZombie(pid)
-}
-
-func waitidAlreadyExited(pid int) bool {
-	var info unix.Siginfo
-	err := unix.Waitid(unix.P_PID, pid, &info, unix.WEXITED|unix.WNOHANG|unix.WNOWAIT, nil)
-	if err != nil {
-		return false
-	}
-	switch info.Code {
-	case cldExited, cldKilled, cldDumped:
-		return true
-	}
-	return false
-}
-
-func procIsZombie(pid int) bool {
-	data, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-	if err != nil {
-		return false
-	}
-	// /proc/<pid>/stat: pid (comm) state ... — comm may contain spaces or
-	// parentheses, so the state is the first field after the last ')'.
-	i := bytes.LastIndexByte(data, ')')
-	if i < 0 || i+1 >= len(data) {
-		return false
-	}
-	rest := bytes.TrimSpace(data[i+1:])
-	return len(rest) > 0 && rest[0] == 'Z'
-}

internal/background/process_waitable_other.go

@@ -1,10 +0,0 @@
-//go:build !windows && !linux && !darwin
-
-package background
-
-// leaderWaitableExited cannot positively identify a waitable-exited leader on
-// this platform without ps. Returning false keeps TerminateCommand's existing
-// conservative behaviour: a termination error is not discarded after reap.
-func leaderWaitableExited(pid int) bool {
-	return false
-}

internal/background/process_windows.go

@@ -4,7 +4,6 @@ package background
 
 import (
 	"fmt"
-	"os"
 	"os/exec"
 
 	"github.com/Gitlawb/zero/internal/execution"
@@ -47,18 +46,7 @@ func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
 		terminateErr = terminateProcessForTest(cmd.Process.Pid)
 	})
 	if err != nil {
-		// WithHandle refuses only a process that has already been waited or
-		// released, so it has finished. Say so in the form exec.Cmd understands:
-		// a Cancel error wrapping os.ErrProcessDone is "nothing to cancel", where
-		// the unexported "already released" error it would otherwise carry made
-		// Wait report a spurious cancel failure. A dead root has no tree left to
-		// find either way.
-		return true, fmt.Errorf("pin process %d for termination: %w: %w", cmd.Process.Pid, os.ErrProcessDone, err)
+		return false, fmt.Errorf("pin process %d for termination: %w", cmd.Process.Pid, err)
 	}
 	return alreadyExited, terminateErr
 }
-
-// Windows has no persistent process-group identity to query after a dead root
-// is reaped. Preserve TerminateCommand's existing, documented dead-root
-// behavior; the stronger independent target check is available on POSIX.
-func terminationTargetGoneAfterReap(*exec.Cmd) bool { return true }

internal/background/terminate.go

@@ -9,10 +9,6 @@ import (
 
 const commandReapTimeout = 3 * time.Second
 
-// terminateOwnedProcessForTest is a seam for the failure-boundary tests. Tests
-// replace it only while no other test in this package is running in parallel.
-var terminateOwnedProcessForTest = terminateOwnedProcess
-
 // TerminateProcess stops a background process by PID — on Windows its process
 // tree; on POSIX its whole process group when the PID leads its own group (the
 // invariant ConfigureChildProcessGroup establishes for processes started through
@@ -30,15 +26,11 @@ func TerminateProcess(pid int) error {
 // have exclusive ownership of cmd: it must not have previously called Wait or
 // Process.Release, and no goroutine may call either concurrently. On POSIX it
 // stops the whole group when the command was configured as its leader; ordinary
-// commands safely fall back to PID/tree discovery. When POSIX observes a
-// waitable-zombie leader before signalling, a termination error is discarded
-// after reap only if the launch-time signal target is independently gone; the
-// leader observation alone says nothing about descendants. Windows retains its
-// existing behavior of ignoring the expected kill-attempt error when
-// GetExitCodeProcess shows that the root was already dead. Windows cannot
-// rediscover a tree from a dead root, so descendants may survive there. `zero
-// daemon start` needs this operation when readiness times out: it launched the
-// child, so it must both stop the tree and collect the leader.
+// commands safely fall back to PID/tree discovery. On Windows, success for a
+// leader that was already dead confirms only that the leader was reaped;
+// descendants may survive because Windows cannot rediscover a tree from a dead
+// root. `zero daemon start` needs this operation when readiness times out: it
+// launched the child, so it must both stop the tree and collect the leader.
 //
 // The order matters: the tree is signalled first, because Wait releases the
 // leader's PID and a later group lookup could then resolve to nothing (or, worse,
@@ -52,7 +44,7 @@ func TerminateCommand(cmd *exec.Cmd) error {
 	if cmd == nil || cmd.Process == nil {
 		return errors.New("terminate command: process was never started")
 	}
-	leaderAlreadyExited, terminateErr := terminateOwnedProcessForTest(cmd)
+	leaderAlreadyExited, terminateErr := terminateOwnedProcess(cmd)
 	reapErr := waitForTerminatedCommandWithin(cmd, commandReapTimeout)
 	if reapErr != nil {
 		if terminateErr != nil {
@@ -60,42 +52,15 @@ func TerminateCommand(cmd *exec.Cmd) error {
 		}
 		return reapErr
 	}
-	if terminateErr != nil {
-		if !leaderAlreadyExited || !terminationTargetGoneAfterReap(cmd) {
-			return terminateErr
-		}
+	if terminateErr != nil && !leaderAlreadyExited {
+		return terminateErr
 	}
-	// On POSIX, discard a termination error only when the leader was already
-	// exited and the launch-time signal target is independently gone after reap.
-	// A successful leader reap alone says nothing about live descendants.
-	// Windows retains its existing dead-root semantics because it has no
-	// persistent group identity to query after the root exits.
+	// Only discard a termination error when the platform demonstrated before
+	// attempting termination that the leader had already exited. A successful
+	// reap alone says nothing about whether a live descendant tree was stopped.
 	return nil
 }
 
-// TerminateCommandGroup stops a started command's process group on POSIX, or its
-// process tree on Windows, WITHOUT reaping it.
-//
-// It is TerminateCommand without the Wait, for a caller whose Wait already runs
-// somewhere else: a worker pool waiting on the command in its own goroutine, or
-// the command's own Cancel hook, which exec.Cmd invokes while its Wait is in
-// progress. TerminateCommand would be a second Wait there. Both used to pass
-// cmd.Process.Pid to TerminateProcess, which rediscovers the group at signal time
-// with Getpgid, and once the leader has exited that lookup fails, so only the dead
-// leader was signalled and its descendants kept running. When cmd was configured
-// by ConfigureChildProcessGroup the group now comes from that launch-time
-// configuration instead. On Windows it is the tree kill TerminateProcess performs,
-// with the process handle pinned while it runs so the PID cannot be recycled
-// underneath it; once the command has been waited that pin fails with an error
-// wrapping os.ErrProcessDone.
-func TerminateCommandGroup(cmd *exec.Cmd) error {
-	if cmd == nil || cmd.Process == nil {
-		return nil
-	}
-	_, err := terminateOwnedProcess(cmd)
-	return err
-}
-
 // classifyWaitError treats a non-zero exit status as success: a process being
 // terminated is expected to report one (or a signal), so the only interesting
 // failure is Wait itself not working.

internal/background/terminate_group_test.go

@@ -1,71 +0,0 @@
-package background
-
-import (
-	"errors"
-	"os"
-	"os/exec"
-	"runtime"
-	"testing"
-	"time"
-)
-
-// TerminateCommandGroup LEAVES THE WAIT TO ITS CALLER. Its callers already have a
-// Wait running or about to run: the daemon pool waits on its workers, and
-// exec.Cmd calls the Cancel hook from inside Wait. Reaping here, the way
-// TerminateCommand does, would make their Wait fail with "Wait was already
-// called" instead of reporting how the command ended.
-func TestTerminateCommandGroupLeavesTheWaitToTheCaller(t *testing.T) {
-	cmd := exec.Command("sleep", "30")
-	if runtime.GOOS == "windows" {
-		cmd = exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command", "Start-Sleep -Seconds 30")
-	}
-	ConfigureChildProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	if err := TerminateCommandGroup(cmd); err != nil {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-		t.Fatalf("TerminateCommandGroup: %v", err)
-	}
-
-	waited := make(chan error, 1)
-	go func() { waited <- cmd.Wait() }()
-	select {
-	case err := <-waited:
-		var exitErr *exec.ExitError
-		if err != nil && !errors.As(err, &exitErr) {
-			t.Fatalf("the caller's own Wait failed after TerminateCommandGroup: %v", err)
-		}
-	case <-time.After(10 * time.Second):
-		_ = cmd.Process.Kill()
-		t.Fatal("the command was still running 10s after TerminateCommandGroup")
-	}
-}
-
-// A command that was never started, or a nil one, is nothing to stop.
-func TestTerminateCommandGroupWithNoProcessIsANoOp(t *testing.T) {
-	if err := TerminateCommandGroup(nil); err != nil {
-		t.Fatalf("nil command: %v", err)
-	}
-	if err := TerminateCommandGroup(exec.Command("sleep", "1")); err != nil {
-		t.Fatalf("unstarted command: %v", err)
-	}
-}
-
-// After the caller has waited, Windows cannot pin the process any more. The error
-// must still read as "already finished", which is what exec.Cmd's Cancel contract
-// and the pool both treat as nothing wrong.
-func TestTerminateCommandGroupAfterWaitReportsProcessDone(t *testing.T) {
-	if runtime.GOOS != "windows" {
-		t.Skip("POSIX signals the group, which is simply gone after the wait")
-	}
-	cmd := exec.Command("cmd.exe", "/c", "exit", "0")
-	ConfigureChildProcessGroup(cmd)
-	if err := cmd.Run(); err != nil {
-		t.Fatalf("run: %v", err)
-	}
-	if err := TerminateCommandGroup(cmd); err != nil && !errors.Is(err, os.ErrProcessDone) {
-		t.Fatalf("after Wait the error is %v, want nil or one wrapping os.ErrProcessDone", err)
-	}
-}

internal/cli/acp.go

@@ -10,11 +10,9 @@ import (
 	"github.com/Gitlawb/zero/internal/acp"
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/execution"
-	"github.com/Gitlawb/zero/internal/mcp"
 	"github.com/Gitlawb/zero/internal/providermodeldiscovery"
-	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 const acpUsage = `zero acp — serve the Agent Client Protocol (ACP) over stdio
@@ -59,8 +57,20 @@ func runACP(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int
 		// surface — no ACP-specific credential handling needed.
 		NewProvider: deps.newProvider,
 		RunAgent:    agent.Run,
-		BuildWorkspace: func(ctx context.Context, workspaceRoot string, resolved config.ResolvedConfig, mode agent.PermissionMode) (*acp.Workspace, error) {
-			return buildACPWorkspace(ctx, workspaceRoot, resolved, mode, deps)
+		// Build the SCOPED registry + sandbox engine per workspace, exactly like the
+		// exec surface, so ACP shell/file tools are confined — never run unconfined.
+		BuildWorkspace: func(workspaceRoot string, resolved config.ResolvedConfig) (*tools.Registry, *sandbox.Engine, error) {
+			scope, err := sandbox.NewScope(workspaceRoot, resolved.Sandbox.AdditionalWriteRoots)
+			if err != nil {
+				return nil, nil, err
+			}
+			engine, err := buildExecSandboxEngine(workspaceRoot, resolved, deps, scope)
+			if err != nil {
+				return nil, nil, err
+			}
+			registry := newCoreRegistryScoped(workspaceRoot, scope)
+			registerLocalControlTools(registry, workspaceRoot, resolved.LocalControl)
+			return registry, engine, nil
 		},
 		ResolveWorkspaceRoot: acpWorkspaceRootResolver(deps),
 		Store:                deps.newSessionStore(),
@@ -75,76 +85,6 @@ func runACP(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int
 	return exitSuccess
 }
 
-// buildACPWorkspace matches exec's registry construction for one ACP turn. MCP
-// servers use the same sandbox-prepared execution runner, project configuration is
-// gated by the validated workspace's trust state, and their runtime is released
-// when acp.Agent completes the turn. ACP deliberately stays at low autonomy: an
-// editor connection never upgrades MCP permissions beyond an interactive prompt.
-func buildACPWorkspace(ctx context.Context, workspaceRoot string, resolved config.ResolvedConfig, mode agent.PermissionMode, deps appDeps) (*acp.Workspace, error) {
-	scope, err := sandbox.NewScope(workspaceRoot, resolved.Sandbox.AdditionalWriteRoots)
-	if err != nil {
-		return nil, err
-	}
-	engine, err := buildExecSandboxEngine(workspaceRoot, resolved, deps, scope)
-	if err != nil {
-		return nil, err
-	}
-	registry := newCoreRegistryScoped(workspaceRoot, scope)
-
-	workspace := &acp.Workspace{
-		Registry: registry, Sandbox: engine,
-		DeferThreshold: resolved.Tools.DeferThreshold,
-	}
-	if mode != agent.PermissionModePlan {
-		// MCP stdio servers are subprocesses. Passing the engine to their runner
-		// keeps them inside the exact sandbox / lifecycle path used by zero exec.
-		runtime, trustSkip, err := registerMCPToolsForWorkspaceWithOptions(
-			ctx, workspaceRoot, registry, deps, mcp.AutonomyLow, workspaceRoot,
-			mcp.RegisterOptions{Execution: execution.NewRunner(engine), AdvertiseInAuto: true},
-		)
-		if err != nil {
-			// RegisterTools may have connected an earlier server before reporting a
-			// later failure, so do not orphan a partial runtime on this error path.
-			if runtime != nil {
-				_ = runtime.Close()
-			}
-			return nil, err
-		}
-		workspace.Cleanup = runtime.Close
-		workspace.Notices = acpMCPSetupNotices(trustSkip, runtime)
-	}
-	registerLocalControlTools(registry, workspaceRoot, resolved.LocalControl)
-	// MCP tools are deferred-eligible. Register their loader only after every
-	// ACP-visible tool is present, using the same mode the agent receives.
-	registerToolSearchIfEligible(registry, resolved.Tools.DeferThreshold, mode, nil, nil)
-	return workspace, nil
-}
-
-func acpMCPSetupNotices(skip trustSkip, runtime mcpToolRuntime) []string {
-	var notices []string
-	if skip.excludedProjectConfig {
-		if skip.trustCheckErrored {
-			notices = append(notices, "The workspace-trust store could not be read; project MCP servers were ignored (fail-closed). Run 'zero trust' to enable them.")
-		} else {
-			notices = append(notices, "Project MCP servers were ignored in this untrusted workspace. Run 'zero trust' to enable them.")
-		}
-	}
-	if runtime == nil {
-		return notices
-	}
-	for _, skipped := range runtime.Skipped() {
-		if skipped.UnconfiguredDefault {
-			continue
-		}
-		message := fmt.Sprintf("MCP server %s unavailable, skipped", skipped.Name)
-		if skipped.Err != nil {
-			message += ": " + redaction.ErrorMessage(skipped.Err, redaction.Options{})
-		}
-		notices = append(notices, redaction.RedactString(message, redaction.Options{}))
-	}
-	return notices
-}
-
 // acpWorkspaceRootResolver validates a client-supplied cwd into a confinement
 // root. It reuses exec's resolveWorkspaceRoot (abs+clean, must be an existing
 // dir) and additionally rejects the filesystem root and the home directory — an

internal/cli/acp_test.go

@@ -5,19 +5,10 @@ import (
 	"context"
 	"errors"
 	"io"
-	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
 	"time"
-
-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/mcp"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/workspacetrust"
 )
 
 type acpTestReader func([]byte) (int, error)
@@ -117,198 +108,6 @@ func TestRunACPIdleCancellationExitsCleanly(t *testing.T) {
 	}
 }
 
-func TestBuildACPWorkspaceRegistersSandboxedMCPToolsAndClosesThem(t *testing.T) {
-	setTrustConfigRoot(t)
-	workspaceRoot := t.TempDir()
-	if err := workspacetrust.Trust(workspaceRoot); err != nil {
-		t.Fatalf("trust workspace: %v", err)
-	}
-	grantStore, err := sandbox.NewGrantStore(sandbox.StoreOptions{FilePath: t.TempDir() + "/grants.json"})
-	if err != nil {
-		t.Fatalf("new grant store: %v", err)
-	}
-
-	var gotExclude, registered, closed bool
-	deps := fillAppDeps(appDeps{
-		resolveMCPConfig: func(root string, excludeProject bool) (config.MCPConfig, error) {
-			if root != workspaceRoot {
-				t.Fatalf("MCP workspace root = %q, want %q", root, workspaceRoot)
-			}
-			gotExclude = excludeProject
-			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"docs": {Type: "stdio", Command: "fake-docs"},
-			}}, nil
-		},
-		newMCPStore:     func() (*mcp.PermissionStore, error) { return nil, nil },
-		newSandboxStore: func() (*sandbox.GrantStore, error) { return grantStore, nil },
-		registerMCPTools: func(ctx context.Context, registry *tools.Registry, cfg config.MCPConfig, options mcp.RegisterOptions) (mcpToolRuntime, error) {
-			if ctx == nil {
-				t.Fatal("MCP registration received nil context")
-			}
-			if len(cfg.Servers) != 1 || cfg.Servers["docs"].Command != "fake-docs" {
-				t.Fatalf("MCP config = %+v", cfg)
-			}
-			if options.Autonomy != mcp.AutonomyLow {
-				t.Fatalf("MCP autonomy = %q, want low", options.Autonomy)
-			}
-			if options.Execution == nil {
-				t.Fatal("MCP stdio server was not given the sandbox execution runner")
-			}
-			if options.WorkspaceRoot != workspaceRoot {
-				t.Fatalf("MCP execution workspace = %q, want %q", options.WorkspaceRoot, workspaceRoot)
-			}
-			if !options.AdvertiseInAuto {
-				t.Fatal("ACP MCP tools must be advertised in auto mode without being pre-approved")
-			}
-			registered = true
-			registry.Register(cliFakeDeferredTool{
-				name: "mcp_docs_search", permission: tools.PermissionPrompt,
-				advertiseInAuto: options.AdvertiseInAuto,
-			})
-			return closeFunc(func() error {
-				closed = true
-				return nil
-			}), nil
-		},
-	})
-
-	workspace, err := buildACPWorkspace(context.Background(), workspaceRoot, config.ResolvedConfig{
-		Tools: config.ToolsConfig{DeferThreshold: 1},
-	}, agent.PermissionModeAuto, deps)
-	if err != nil {
-		t.Fatalf("buildACPWorkspace: %v", err)
-	}
-	if gotExclude {
-		t.Fatal("trusted ACP workspace excluded project MCP configuration")
-	}
-	if !registered {
-		t.Fatal("ACP workspace did not register configured MCP tools")
-	}
-	if _, ok := workspace.Registry.Get("mcp_docs_search"); !ok {
-		t.Fatal("MCP tool is absent from ACP agent registry")
-	}
-	if _, ok := workspace.Registry.Get(tools.ToolSearchToolName); !ok {
-		t.Fatal("ACP registry is missing tool_search for deferred MCP tools")
-	}
-	if workspace.DeferThreshold != 1 {
-		t.Fatalf("workspace defer threshold = %d, want 1", workspace.DeferThreshold)
-	}
-	if err := workspace.Close(); err != nil {
-		t.Fatalf("close ACP workspace: %v", err)
-	}
-	if !closed {
-		t.Fatal("ACP workspace did not close its MCP runtime")
-	}
-}
-
-func TestBuildACPWorkspacePreservesRedactedMCPSetupNotices(t *testing.T) {
-	setTrustConfigRoot(t)
-	workspaceRoot := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(workspaceRoot, ".zero"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	projectConfig := `{"mcp":{"servers":{"project-docs":{"type":"stdio","command":"project-docs"}}}}`
-	if err := os.WriteFile(filepath.Join(workspaceRoot, ".zero", "config.json"), []byte(projectConfig), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	secret := "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-	grantStore, err := sandbox.NewGrantStore(sandbox.StoreOptions{FilePath: filepath.Join(t.TempDir(), "grants.json")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	deps := fillAppDeps(appDeps{
-		resolveMCPConfig: func(string, bool) (config.MCPConfig, error) {
-			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"docs": {Type: "stdio", Command: "fake-docs"},
-			}}, nil
-		},
-		newMCPStore:     func() (*mcp.PermissionStore, error) { return nil, nil },
-		newSandboxStore: func() (*sandbox.GrantStore, error) { return grantStore, nil },
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return fakeMCPRuntimeWithSkips{skipped: []mcp.SkippedServer{{
-				Name: "docs", Err: errors.New("token=" + secret),
-			}}}, nil
-		},
-	})
-
-	workspace, err := buildACPWorkspace(context.Background(), workspaceRoot, config.ResolvedConfig{}, agent.PermissionModeAuto, deps)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	joined := strings.Join(workspace.Notices, "\n")
-	if !strings.Contains(joined, "untrusted workspace") || !strings.Contains(joined, "MCP server docs unavailable") {
-		t.Fatalf("workspace notices = %#v", workspace.Notices)
-	}
-	if strings.Contains(joined, secret) || !strings.Contains(joined, "[REDACTED]") {
-		t.Fatalf("workspace notices leaked secret: %q", joined)
-	}
-}
-
-func TestBuildACPWorkspaceSkipsMCPInPlanMode(t *testing.T) {
-	grantStore, err := sandbox.NewGrantStore(sandbox.StoreOptions{FilePath: t.TempDir() + "/grants.json"})
-	if err != nil {
-		t.Fatalf("new grant store: %v", err)
-	}
-	called := false
-	deps := fillAppDeps(appDeps{
-		resolveMCPConfig: func(string, bool) (config.MCPConfig, error) {
-			called = true
-			return config.MCPConfig{}, nil
-		},
-		newSandboxStore: func() (*sandbox.GrantStore, error) { return grantStore, nil },
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			called = true
-			return nil, nil
-		},
-	})
-
-	workspace, err := buildACPWorkspace(context.Background(), t.TempDir(), config.ResolvedConfig{}, agent.PermissionModePlan, deps)
-	if err != nil {
-		t.Fatalf("buildACPWorkspace: %v", err)
-	}
-	if called {
-		t.Fatal("plan-mode ACP workspace must not resolve or start MCP servers")
-	}
-	if err := workspace.Close(); err != nil {
-		t.Fatalf("close plan workspace: %v", err)
-	}
-}
-
-func TestBuildACPWorkspaceClosesPartialMCPRuntimeOnRegistrationError(t *testing.T) {
-	grantStore, err := sandbox.NewGrantStore(sandbox.StoreOptions{FilePath: t.TempDir() + "/grants.json"})
-	if err != nil {
-		t.Fatalf("new grant store: %v", err)
-	}
-	closed := false
-	deps := fillAppDeps(appDeps{
-		resolveMCPConfig: func(string, bool) (config.MCPConfig, error) {
-			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"partial": {Type: "stdio", Command: "fake-partial"},
-			}}, nil
-		},
-		newMCPStore:     func() (*mcp.PermissionStore, error) { return nil, nil },
-		newSandboxStore: func() (*sandbox.GrantStore, error) { return grantStore, nil },
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return closeFunc(func() error {
-				closed = true
-				return nil
-			}), errors.New("second MCP server failed")
-		},
-	})
-
-	workspace, err := buildACPWorkspace(context.Background(), t.TempDir(), config.ResolvedConfig{}, agent.PermissionModeAuto, deps)
-	if err == nil {
-		t.Fatal("buildACPWorkspace succeeded after MCP registration error")
-	}
-	if workspace != nil {
-		t.Fatal("buildACPWorkspace returned a workspace after MCP registration error")
-	}
-	if !closed {
-		t.Fatal("partial MCP runtime was not closed after registration error")
-	}
-}
-
 type acpNotifyingReadCloser struct {
 	io.ReadCloser
 	readStarted chan<- struct{}

internal/cli/app.go

@@ -311,35 +311,40 @@ func runWithDeps(args []string, stdout io.Writer, stderr io.Writer, deps appDeps
 	// cache file on the machine. The refresh itself is fired in exec/TUI startup.
 	modelregistry.EnableModelsDevOverlay()
 
-	// --add-dir, --theme and --allow-escalation may be written in any order;
-	// see splitLeadingRootFlags for why they are split together.
-	root, args, err := splitLeadingRootFlags(args)
+	addDirs, args, err := splitLeadingAddDirFlags(args)
 	if err != nil {
 		return writeAppError(stderr, err.Error(), 1)
 	}
-	addDirs, theme, allowEscalation := root.addDirs, root.theme, root.allowEscalation
+	// --theme <name> selects the TUI palette non-interactively (auto or any registered
+	// theme; populates tui.Options.Theme, which resolveThemeMode prefers over
+	// ZERO_THEME). Re-split --add-dir afterward so it may appear on either side of --theme.
+	theme, args, err := splitLeadingThemeFlag(args)
+	if err != nil {
+		return writeAppError(stderr, err.Error(), 1)
+	}
+	moreDirs, args, err := splitLeadingAddDirFlags(args)
+	if err != nil {
+		return writeAppError(stderr, err.Error(), 1)
+	}
+	addDirs = append(addDirs, moreDirs...)
 
 	if len(args) == 0 {
-		return runInteractiveTUI(stderr, deps, agent.PermissionModeAsk, addDirs, theme, allowEscalation)
+		return runInteractiveTUI(stderr, deps, agent.PermissionModeAsk, addDirs, theme)
 	}
 
-	// --add-dir grants an extra write root and --allow-escalation opts a run
-	// into mid-run model escalation; only the interactive TUI and exec consume
-	// either. Both are forwarded to exec below and rejected loudly everywhere
-	// else rather than silently discarded, including help/version, which run
-	// no agent and could only ignore them. The allowlist names exactly the
-	// cases below that forward; a future subcommand is rejected by default
-	// until it opts in here.
-	forwardsRootFlags := false
-	switch args[0] {
-	case "--skip-permissions-unsafe", "-p", "--prompt", "exec":
-		forwardsRootFlags = true
-	}
-	if len(addDirs) > 0 && !forwardsRootFlags {
-		return writeAppError(stderr, "--add-dir is only supported for the interactive TUI and exec", 1)
-	}
-	if allowEscalation && !forwardsRootFlags {
-		return writeAppError(stderr, "--allow-escalation is only supported for the interactive TUI and exec", 1)
+	// --add-dir grants an extra write root, and only the interactive TUI and
+	// exec dispatch paths consume one. Fail loud everywhere else rather than
+	// silently discarding an explicit grant — including help/version, which
+	// run no agent and could only ignore it. The allowlist names exactly the
+	// cases below that forward addDirs; a future subcommand is rejected by
+	// default until it opts in here.
+	if len(addDirs) > 0 {
+		switch args[0] {
+		case "--skip-permissions-unsafe", "-p", "--prompt", "exec":
+			// Forwarded by the matching case below.
+		default:
+			return writeAppError(stderr, "--add-dir is only supported for the interactive TUI and exec", 1)
+		}
 	}
 
 	switch args[0] {
@@ -349,24 +354,26 @@ func runWithDeps(args []string, stdout io.Writer, stderr io.Writer, deps appDeps
 		// reach unsafe mode in the shell — and the "!" shell escape (which is
 		// gated behind unsafe) was therefore unreachable.
 		//
-		// The root flags may legally appear on either side of this flag, so
-		// split them again from what follows it and merge with what the root
-		// already took. Any trailing non-flag args were ignored on this path
-		// before --add-dir existed and still are, but an --add-dir hidden
-		// BEHIND one would be silently dropped with them, so reject that
-		// misplacement loudly below.
-		more, rest, err := splitLeadingRootFlags(args[1:])
+		// --add-dir may legally appear on either side of the flag, so re-split
+		// the remaining args and merge with the dirs already collected. Any
+		// trailing non-flag args were ignored on this path before --add-dir
+		// existed and still are — but an --add-dir hidden BEHIND one would be
+		// silently dropped with them, so reject that misplacement loudly.
+		moreDirs, rest, err := splitLeadingAddDirFlags(args[1:])
 		if err != nil {
 			return writeAppError(stderr, err.Error(), 1)
 		}
-		moreDirs := more.addDirs
-		// A --theme written before the flag was taken at the root and used to be
-		// dropped here; one written after it wins, as the last occurrence does.
-		skipTheme := theme
-		if more.theme != "" {
-			skipTheme = more.theme
+		// --theme may appear here too; extract it before the stray-arg checks so it is
+		// not rejected as an unexpected positional, then re-split --add-dir after it.
+		skipTheme, rest, err := splitLeadingThemeFlag(rest)
+		if err != nil {
+			return writeAppError(stderr, err.Error(), 1)
 		}
-		skipAllowEscalation := more.allowEscalation
+		evenMoreDirs, rest, err := splitLeadingAddDirFlags(rest)
+		if err != nil {
+			return writeAppError(stderr, err.Error(), 1)
+		}
+		moreDirs = append(moreDirs, evenMoreDirs...)
 		// A misplaced --add-dir anywhere in the remainder is the more specific error,
 		// so check for it across all of rest before rejecting stray args.
 		for _, arg := range rest {
@@ -383,7 +390,7 @@ func runWithDeps(args []string, stdout io.Writer, stderr io.Writer, deps appDeps
 				return writeAppError(stderr, "--skip-permissions-unsafe launches the interactive TUI and takes no prompt or subcommand; for a one-shot unsafe run use `zero exec --skip-permissions-unsafe -p \"...\"`", 1)
 			}
 		}
-		return runInteractiveTUI(stderr, deps, agent.PermissionModeUnsafe, append(append([]string{}, addDirs...), moreDirs...), skipTheme, allowEscalation || skipAllowEscalation)
+		return runInteractiveTUI(stderr, deps, agent.PermissionModeUnsafe, append(append([]string{}, addDirs...), moreDirs...), skipTheme)
 	case "-h", "--help", "help":
 		if err := writeHelp(stdout); err != nil {
 			return 1
@@ -416,16 +423,16 @@ func runWithDeps(args []string, stdout io.Writer, stderr io.Writer, deps appDeps
 		if len(args) < 2 {
 			return writePromptRequired(stderr)
 		}
-		// Forward the root flags exec consumes so its own parser collects them.
+		// Forward leading --add-dir occurrences so exec's own parser collects them.
 		// Use the inline --prompt=<value> form so a prompt whose first character is a
 		// dash (e.g. `zero -p "-foo"`) is taken verbatim instead of being mistaken for
 		// a flag and rejected with "--prompt requires a value" (matches the cron path).
-		execArgs := append(rootFlagArgs(addDirs, allowEscalation), "--prompt="+args[1])
+		execArgs := append(addDirFlagArgs(addDirs), "--prompt="+args[1])
 		execArgs = append(execArgs, args[2:]...)
 		return runExec(execArgs, stdout, stderr, deps)
 	case "exec":
-		// Forward the root flags exec consumes so its own parser collects them.
-		return runExec(append(rootFlagArgs(addDirs, allowEscalation), args[1:]...), stdout, stderr, deps)
+		// Forward leading --add-dir occurrences so exec's own parser collects them.
+		return runExec(append(addDirFlagArgs(addDirs), args[1:]...), stdout, stderr, deps)
 	case "completions":
 		return runCompletions(args[1:], stdout, stderr)
 	case "daemon":
@@ -687,15 +694,15 @@ func fillAppDeps(deps appDeps) appDeps {
 	return deps
 }
 
-func runInteractiveTUI(stderr io.Writer, deps appDeps, permissionMode agent.PermissionMode, addDirs []string, theme string, allowEscalation bool) int {
-	return runInteractiveTUIWithSetup(stderr, deps, permissionMode, addDirs, theme, false, allowEscalation)
+func runInteractiveTUI(stderr io.Writer, deps appDeps, permissionMode agent.PermissionMode, addDirs []string, theme string) int {
+	return runInteractiveTUIWithSetup(stderr, deps, permissionMode, addDirs, theme, false)
 }
 
-func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode agent.PermissionMode, addDirs []string, theme string, forceSetup bool, allowEscalation bool) int {
+func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode agent.PermissionMode, addDirs []string, theme string, forceSetup bool) int {
 	// Refresh the models.dev pricing/limits cache in the background when stale;
 	// the overlay is read at registry construction from the cache file, so this
 	// benefits the next run and never blocks or fails this one.
-	modelregistry.StartModelsDevRefresh()
+	go func() { _ = modelregistry.RefreshModelsDevCache(context.Background()) }()
 
 	workspaceRoot, err := deps.getwd()
 	if err != nil {
@@ -727,13 +734,7 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 			resolved.Provider = usable
 			resolved.ActiveProvider = usable.Name
 		} else {
-			// Fresh-onboarding reset, but the user's notification preference is
-			// NOT config-to-redo: clearing it here would surface as an empty
-			// Options.Notify, and the TUI's unconfigured default (both/unfocused)
-			// would then resurrect alerts a user explicitly turned off while the
-			// setup wizard runs (maintainer review, PR #1001). Carry the stored
-			// block through; other wizard-visible state starts clean as before.
-			resolved = config.ResolvedConfig{Notify: resolved.Notify}
+			resolved = config.ResolvedConfig{}
 			forceSetup = true
 		}
 	}
@@ -789,14 +790,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 
 	registry := newCoreRegistryScoped(workspaceRoot, scope)
 	registerLocalControlTools(registry, workspaceRoot, resolved.LocalControl)
-	// Mid-run model escalation is opt-in on this surface too. The tool is present
-	// only when the operator asked for it with --allow-escalation, and the
-	// switchers that make it do anything ride on the same flag through
-	// Options.AllowEscalation below. Registering one without the other ships a
-	// tool the loop will never act on, which looks like a feature and is not.
-	if allowEscalation {
-		registry.Register(tools.NewEscalateModelTool())
-	}
 	executionRunner := execution.NewRunner(nil)
 	sandboxStore, err := deps.newSandboxStore()
 	if err != nil {
@@ -965,9 +958,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 	// notice when project hooks/plugins were dropped for an untrusted workspace.
 	hookDispatcher, hookSkip := newHookDispatcherWithExtra(workspaceRoot, pluginActivation.hooks, trustRoot, executionRunner)
 	emitTrustNotice(stderr, hookSkip, pluginActivation.trustSkip, mcpSkip)
-	// From the engine the session's commands run through, so the notice
-	// describes the sandbox they actually get.
-	startupNotices := []string{sandboxEngine.DegradedNotice()}
 	return deps.runTUI(context.Background(), tui.Options{
 		Cwd:                  workspaceRoot,
 		Version:              version,
@@ -984,7 +974,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 		FavoriteModels:       resolved.Preferences.FavoriteModels,
 		RecentModels:         resolved.Preferences.RecentModels,
 		RecapsEnabled:        resolved.Preferences.RecapsEnabled(),
-		CompactionModel:      resolved.Preferences.CompactionModel,
 		Provider:             provider,
 		NewProvider:          deps.newProvider,
 		NewTurnSessionProvider: func(profile config.ProviderProfile, provider zeroruntime.Provider) zeroruntime.TurnSessionProvider {
@@ -1043,7 +1032,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 			Specialists:    specialistRuntime.specialists,
 			Skills:         pluginActivation.skillInfos(deps.skillsDir()),
 		},
-		AllowEscalation: allowEscalation,
 		// LoadSkills backs /skills and direct /<skill-name> invocation in the TUI.
 		// It resolves against the same merged set (default dir + plugin skill
 		// roots) as the skill tool and the system-prompt list, re-read per use so
@@ -1055,7 +1043,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 		PermissionMode:            permissionMode,
 		Notify:                    resolved.Notify,
 		KeyBindings:               resolved.KeyBindings,
-		StartupNotices:            startupNotices,
 		STT:                       resolved.STT,
 		BuildDictationTranscriber: newDictationTranscriberFactory(resolved, userConfigPath, sttServerManager),
 		ShutdownDictationServer:   sttServerManager.Shutdown,
@@ -1390,7 +1377,6 @@ Flags:
   -v, --version                  Print version
   -p, --prompt                   Run a one-shot prompt
       --add-dir <path>           Allow writes in an extra directory (repeatable)
-      --allow-escalation         Let the agent escalate to a stronger model mid-run via escalate_model
       --skip-permissions-unsafe  Launch the interactive shell in unsafe mode (enables the ! shell escape)
 `)
 	return err
@@ -1407,17 +1393,6 @@ func addDirFlagArgs(addDirs []string) []string {
 	return flags
 }
 
-// rootFlagArgs re-synthesises the root flags exec consumes, in the spelling
-// its own parser accepts, so a flag written before the subcommand reaches
-// the run exactly as one written after it would.
-func rootFlagArgs(addDirs []string, allowEscalation bool) []string {
-	flags := addDirFlagArgs(addDirs)
-	if allowEscalation {
-		flags = append(flags, "--allow-escalation")
-	}
-	return flags
-}
-
 // splitLeadingAddDirFlags strips leading --add-dir flags from the root
 // argument list (zero --add-dir <path> [--add-dir <path>] [subcommand …]).
 // Subcommands like exec parse their own --add-dir occurrences.
@@ -1458,83 +1433,6 @@ func splitLeadingAddDirFlags(args []string) ([]string, []string, error) {
 	return addDirs, args, nil
 }
 
-// rootFlags is what the leading root flags amount to once every one of them
-// has been stripped from the front of the argument list.
-type rootFlags struct {
-	addDirs         []string
-	theme           string
-	allowEscalation bool
-}
-
-// splitLeadingRootFlags strips --add-dir, --theme and --allow-escalation from
-// the front of args in whatever order they were written, stopping at the
-// first token none of them claims.
-//
-// EACH SPLITTER STOPS AT THE FIRST TOKEN IT DOES NOT OWN, so running them once
-// in a fixed sequence made the order the operator wrote them in load-bearing:
-// a flag handled late in the sequence stranded every flag written after it as
-// an unknown command, and `zero --allow-escalation --theme auto` exited with
-// an argument error instead of launching. Running the sequence until it makes
-// no progress accepts every ordering, including a flag repeated on both sides
-// of another.
-func splitLeadingRootFlags(args []string) (rootFlags, []string, error) {
-	var flags rootFlags
-	for {
-		before := len(args)
-		addDirs, rest, err := splitLeadingAddDirFlags(args)
-		if err != nil {
-			return rootFlags{}, nil, err
-		}
-		flags.addDirs = append(flags.addDirs, addDirs...)
-		theme, rest, err := splitLeadingThemeFlag(rest)
-		if err != nil {
-			return rootFlags{}, nil, err
-		}
-		if theme != "" {
-			// The last occurrence wins across passes, as it does within one.
-			flags.theme = theme
-		}
-		allowEscalation, rest, err := splitLeadingAllowEscalationFlag(rest)
-		if err != nil {
-			return rootFlags{}, nil, err
-		}
-		flags.allowEscalation = flags.allowEscalation || allowEscalation
-		args = rest
-		if len(args) == before {
-			return flags, args, nil
-		}
-	}
-}
-
-// splitLeadingAllowEscalationFlag strips a leading --allow-escalation from the
-// root argument list, opting the interactive session into mid-run model
-// escalation.
-//
-// OPT-IN, THE SAME WAY exec IS. Escalation moves a run onto a different model,
-// which changes what the run costs and which provider sees the conversation, so
-// it is a decision the operator makes rather than a default. The exec flag
-// already answers this conservatively and the interactive surface should not
-// answer it differently.
-//
-// Bare flag only: repeating it is harmless, and an =value form is rejected so a
-// mistyped --allow-escalation=false is a loud error instead of silently enabling
-// the thing it was trying to turn off.
-func splitLeadingAllowEscalationFlag(args []string) (bool, []string, error) {
-	allow := false
-	for len(args) > 0 {
-		switch {
-		case args[0] == "--allow-escalation":
-			allow = true
-			args = args[1:]
-		case strings.HasPrefix(args[0], "--allow-escalation="):
-			return false, nil, errors.New("--allow-escalation takes no value; pass it bare to enable mid-run model escalation, or omit it")
-		default:
-			return allow, args, nil
-		}
-	}
-	return allow, args, nil
-}
-
 // splitLeadingThemeFlag strips a leading --theme <auto|theme-name> (space or =form)
 // from the root argument list and validates it against the registered themes. The
 // last occurrence wins. A value outside the allowed set is a loud error rather than

internal/cli/app_test.go

@@ -377,73 +377,6 @@ func TestRunNoArgsFallsBackToUsableProviderWhenNoneMarkedActive(t *testing.T) {
 	}
 }
 
-// Maintainer regression (PR #1001): a stored explicit notify opt-out must
-// survive the provider-recovery startup path. With a stale activeProvider and
-// another usable saved provider, Resolve returns the partial config alongside
-// ErrNoActiveProvider and the recovery branch forwards it — dropping the
-// notify policy there would surface an empty Options.Notify, and the TUI's
-// unconfigured default (both) would resurrect alerts the user explicitly
-// turned off. The same recovery branch that clears the resolved config for
-// the setup wizard carries the stored notify block through.
-func TestRunNoArgsPreservesNotifyOptOutThroughProviderRecovery(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	cwd := t.TempDir()
-	setCLIUserConfigRoot(t)
-	userConfigPath := filepath.Join(t.TempDir(), "zero", "config.json")
-	var launchedOptions tui.Options
-	launched := false
-
-	usable := config.ProviderProfile{
-		Name:         "work",
-		ProviderKind: config.ProviderKindOpenAI,
-		BaseURL:      config.OpenAIBaseURL,
-		APIKey:       "sk-test",
-		Model:        "gpt-test",
-	}
-
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) {
-			return cwd, nil
-		},
-		resolveConfig: func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-			// Stale activeProvider + usable saved provider, and the user's
-			// config.json explicitly opts out of notifications. The fixed
-			// resolver carries the parsed notify block through the error path.
-			return config.ResolvedConfig{
-				Providers: []config.ProviderProfile{usable},
-				Notify:    config.NotifyConfig{Mode: "off", FocusMode: "always"},
-			}, fmt.Errorf("%w: active provider %q not found", config.ErrNoActiveProvider, "ghost")
-		},
-		newProvider: func(profile config.ProviderProfile) (zeroruntime.Provider, error) {
-			return &cliFakeProvider{}, nil
-		},
-		userConfigPath: func() (string, error) {
-			return userConfigPath, nil
-		},
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return noopMCPRuntime{}, nil
-		},
-		runTUI: func(ctx context.Context, options tui.Options) int {
-			launched = true
-			launchedOptions = options
-			return 0
-		},
-	})
-
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, want 0, stderr=%q", exitCode, stderr.String())
-	}
-	if !launched {
-		t.Fatal("TUI was not launched")
-	}
-	// The explicit opt-out reaches the TUI intact — NOT the both/unfocused
-	// unconfigured default.
-	if launchedOptions.Notify.Mode != "off" || launchedOptions.Notify.FocusMode != "always" {
-		t.Fatalf("Options.Notify = %+v, want the stored off/always opt-out preserved through recovery", launchedOptions.Notify)
-	}
-}
-
 func TestRunNoArgsFailsWhenResolveErrorIsNotProviderRelated(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer

internal/cli/auth.go

@@ -74,8 +74,6 @@ func runAuth(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		return runAuthStatus(args[1:], stdout, stderr, deps)
 	case "refresh":
 		return runAuthRefresh(args[1:], stdout, stderr, deps)
-	case "reset":
-		return runAuthReset(args[1:], stdout, stderr, deps)
 	case "openrouter":
 		return runAuthOpenRouter(args[1:], stdout, stderr, deps)
 	case "chatgpt":
@@ -263,7 +261,6 @@ type authArgs struct {
 	json       bool
 	device     bool
 	watch      bool
-	confirm    bool
 	scopes     []string
 	help       bool
 }
@@ -289,8 +286,6 @@ func parseAuthArgs(sub string, args []string) (authArgs, error) {
 			parsed.device = true
 		case arg == "--watch":
 			parsed.watch = true
-		case arg == "--confirm":
-			parsed.confirm = true
 		case arg == "--scope":
 			if i+1 >= len(args) {
 				return authArgs{}, fmt.Errorf("--scope requires a value")
@@ -326,7 +321,6 @@ func validateAuthFlags(sub string, a authArgs) error {
 		"logout":  {"json": true},
 		"status":  {"json": true},
 		"refresh": {"watch": true},
-		"reset":   {"json": true, "confirm": true},
 	}[sub]
 	bad := func(name string) error { return fmt.Errorf("zero auth %s does not accept %s", sub, name) }
 	if a.json && !allowed["json"] {
@@ -338,9 +332,6 @@ func validateAuthFlags(sub string, a authArgs) error {
 	if a.watch && !allowed["watch"] {
 		return bad("--watch")
 	}
-	if a.confirm && !allowed["confirm"] {
-		return bad("--confirm")
-	}
 	if len(a.scopes) > 0 && !allowed["scope"] {
 		return bad("--scope")
 	}
@@ -578,43 +569,6 @@ func runAuthRefreshWatch(manager *oauth.Manager, key, provider string, stdout io
 	return exitSuccess
 }
 
-func runAuthReset(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
-	parsed, err := parseAuthArgs("reset", args)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-	if parsed.help {
-		_ = writeAuthHelp(stdout)
-		return exitSuccess
-	}
-	if len(parsed.positional) > 0 {
-		return writeExecUsageError(stderr, fmt.Sprintf("zero auth reset takes no arguments (got %q)", parsed.positional[0]))
-	}
-	if !parsed.confirm {
-		return writeExecUsageError(stderr, "zero auth reset clears all stored OAuth logins and shared MCP tokens; rerun with --confirm to reset")
-	}
-	manager, err := newAuthManager(deps, stdout)
-	if err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	if err := manager.Reset(); err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	if parsed.json {
-		payload := struct {
-			Reset bool `json:"reset"`
-		}{Reset: true}
-		if err := writePrettyJSON(stdout, payload); err != nil {
-			return exitCrash
-		}
-		return exitSuccess
-	}
-	if _, err := fmt.Fprintln(stdout, "Reset OAuth token store."); err != nil {
-		return exitCrash
-	}
-	return exitSuccess
-}
-
 func filterAuthStatuses(statuses []oauth.Status, provider string) []oauth.Status {
 	want := oauth.ProviderKey(provider)
 	filtered := make([]oauth.Status, 0, 1)
@@ -635,7 +589,6 @@ Commands:
   logout <provider>                               Delete a provider's stored login
   status [provider]                               Show login presence/expiry (never the token)
   refresh <provider> [--watch]                    Force a token refresh (--watch keeps it fresh)
-  reset --confirm [--json]                        Clear all OAuth logins and shared MCP tokens (also repairs corrupted stores)
   openrouter                                      Log in to OpenRouter in the browser; mints an API key
   chatgpt                                         Log in to ChatGPT in the browser (Codex backend, ChatGPT Plus/Pro)
 
@@ -662,7 +615,7 @@ Flags:
       --device   Use the device-code flow (headless/SSH; no browser)
       --scope    Add an OAuth scope (repeatable)
       --watch    Keep the token fresh in the foreground (refresh only)
-      --json     Print result as JSON (status/logout/reset)
+      --json     Print result as JSON (status/logout)
   -h, --help     Show this help
 `)
 	return err

internal/cli/auth_test.go

@@ -129,8 +129,6 @@ func TestRunAuthRejectsWrongFlags(t *testing.T) {
 		{"auth", "logout", "demo", "--scope", "x"}, // scope is login-only
 		{"auth", "refresh", "demo", "--json"},      // json not for refresh
 		{"auth", "login", "demo", "--scope", ""},   // empty scope rejected
-		{"auth", "status", "--confirm"},            // confirm is reset-only
-		{"auth", "reset", "--confirm", "--watch"},  // confirmation does not allow unrelated flags
 	}
 	for _, args := range cases {
 		var stdout, stderr bytes.Buffer
@@ -198,102 +196,13 @@ func TestRunAuthHelp(t *testing.T) {
 	if code := runWithDeps([]string{"auth", "--help"}, &stdout, &stderr, appDeps{}); code != exitSuccess {
 		t.Fatalf("exit = %d", code)
 	}
-	for _, want := range []string{"zero auth", "login", "logout", "status", "refresh", "reset --confirm", "--device"} {
+	for _, want := range []string{"zero auth", "login", "logout", "status", "refresh", "--device"} {
 		if !strings.Contains(stdout.String(), want) {
 			t.Fatalf("help missing %q:\n%s", want, stdout.String())
 		}
 	}
 }
 
-func TestRunAuthResetRequiresConfirmation(t *testing.T) {
-	for _, args := range [][]string{{}, {"--json"}} {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			path := withAuthStore(t)
-			store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := store.Save(oauth.ProviderKey("demo"), oauth.Token{AccessToken: "synthetic-reset-test-token"}); err != nil {
-				t.Fatal(err)
-			}
-			before, err := os.ReadFile(path)
-			if err != nil {
-				t.Fatal(err)
-			}
-			var stdout, stderr bytes.Buffer
-			code := runAuthReset(args, &stdout, &stderr, appDeps{})
-			after, readErr := os.ReadFile(path)
-			if readErr != nil || !bytes.Equal(before, after) {
-				t.Fatalf("unconfirmed reset changed the store: %v", readErr)
-			}
-			if code == exitSuccess || !strings.Contains(stderr.String(), "--confirm") || stdout.Len() != 0 {
-				t.Fatalf("unconfirmed reset: exit=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
-			}
-		})
-	}
-}
-
-func TestRunAuthResetJSON(t *testing.T) {
-	path := withAuthStore(t)
-	store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatalf("NewStore: %v", err)
-	}
-	if err := store.Save(oauth.ProviderKey("demo"), oauth.Token{AccessToken: "synthetic-reset-test-token"}); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-	var stdout, stderr bytes.Buffer
-	if code := runWithDeps([]string{"auth", "reset", "--confirm", "--json"}, &stdout, &stderr, appDeps{}); code != exitSuccess {
-		t.Fatalf("exit = %d stderr=%s", code, stderr.String())
-	}
-	var payload struct {
-		Reset bool `json:"reset"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("decode JSON: %v (stdout=%q)", err, stdout.String())
-	}
-	if !payload.Reset {
-		t.Fatalf("payload = %+v, want reset=true", payload)
-	}
-	stdout.Reset()
-	stderr.Reset()
-	if code := runWithDeps([]string{"auth", "status"}, &stdout, &stderr, appDeps{}); code != exitSuccess {
-		t.Fatalf("status exit = %d stderr=%s", code, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "No OAuth provider logins are stored.") {
-		t.Fatalf("expected empty store after JSON reset, got: %q", stdout.String())
-	}
-}
-
-func TestRunAuthReset(t *testing.T) {
-	path := withAuthStore(t)
-	store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatalf("NewStore: %v", err)
-	}
-	if err := store.Save(oauth.ProviderKey("demo"), oauth.Token{AccessToken: "secret"}); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-
-	var stdout, stderr bytes.Buffer
-	if code := runWithDeps([]string{"auth", "reset", "--confirm"}, &stdout, &stderr, appDeps{}); code != exitSuccess {
-		t.Fatalf("exit = %d stderr=%s", code, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "Reset OAuth token store") {
-		t.Fatalf("stdout = %q", stdout.String())
-	}
-
-	// Verify store is now empty.
-	stdout.Reset()
-	stderr.Reset()
-	if code := runWithDeps([]string{"auth", "status"}, &stdout, &stderr, appDeps{}); code != exitSuccess {
-		t.Fatalf("status exit = %d", code)
-	}
-	if !strings.Contains(stdout.String(), "No OAuth provider logins are stored.") {
-		t.Fatalf("expected empty store after reset, got: %q", stdout.String())
-	}
-}
-
 // TestRunAuthLoginChatGPTRoutesToDedicatedFlow verifies `zero auth login
 // chatgpt` reaches the dedicated ChatGPT login (fixed-port loopback + mandatory
 // authorize params), not the generic manager path. The generic login accepts

internal/cli/command_center.go

@@ -26,30 +26,6 @@ type modelSummary = zerocommands.ModelSnapshot
 type providerCatalogSummary = zerocommands.ProviderCatalogSnapshot
 
 func runConfig(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
-	// The first non-flag argument is a subcommand. With no positional argument
-	// (or only flag arguments), the read-only summary path runs — this keeps
-	// `zero config` and `zero config --json` working unchanged.
-	command := "summary"
-	rest := args
-	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
-		command = strings.ToLower(strings.TrimSpace(args[0]))
-		rest = args[1:]
-	}
-	switch command {
-	case "summary":
-		return runConfigSummary(rest, stdout, stderr, deps)
-	case "notify":
-		return runConfigNotify(rest, stdout, stderr, deps)
-	case "help":
-		if err := writeConfigHelp(stdout); err != nil {
-			return exitCrash
-		}
-		return exitSuccess
-	}
-	return writeExecUsageError(stderr, fmt.Sprintf("unknown config command %q", command))
-}
-
-func runConfigSummary(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
 	options, help, err := parseCommandCenterArgs(args, false, false)
 	if err != nil {
 		return writeExecUsageError(stderr, err.Error())
@@ -431,11 +407,7 @@ func formatProviderCatalogLine(provider providerCatalogSummary) string {
 		provider.RuntimeSupported,
 	))
 	if provider.RuntimeSupported {
-		setup := "    setup: zero providers setup " + displayCLIValue(provider.ID, "unknown") + " --set-active"
-		if provider.ID == "atomic-chat-local" {
-			setup = "    setup: run zero setup to select a loaded model, or zero providers detect to get an add command"
-		}
-		lines = append(lines, setup)
+		lines = append(lines, "    setup: zero providers setup "+displayCLIValue(provider.ID, "unknown")+" --set-active")
 	} else {
 		lines = append(lines, "    unsupported: "+displayCLIValue(provider.RuntimeUnsupportedReason, "unknown"))
 	}
@@ -490,12 +462,8 @@ func formatProviderCatalogValue(value string, fallback string) string {
 func writeConfigHelp(w io.Writer) error {
 	_, err := fmt.Fprint(w, `Usage:
   zero config [flags]
-  zero config notify [flags]
 
-Inspects resolved Go configuration without printing secrets. The notify
-subcommand reads or updates the stored global notification preference,
-which controls both the completion and needs-input alerts —
-run "zero config notify --help" for details.
+Inspects resolved Go configuration without printing secrets.
 
 Flags:
       --json      Print JSON summary
@@ -534,7 +502,7 @@ func writeProvidersHelp(w io.Writer) error {
   zero providers models [name] [flags]
 
 Inspects resolved provider profiles and provider catalog descriptors without printing secrets.
-Detect probes for running local runtimes (Ollama, LM Studio, Atomic Chat) and prints adopt commands plus per-provider next steps.
+Detect probes for running local runtimes (Ollama, LM Studio) and prints adopt commands plus per-provider next steps.
 Models probes a provider's live model-listing endpoint (e.g. an OpenAI-compatible /v1/models) and lists the models it serves — including custom OpenAI-/Anthropic-compatible endpoints — so a self-hosted provider needs no per-model config.
 
 Flags:

internal/cli/command_center_test.go

@@ -967,10 +967,3 @@ func TestProvidersListMarksOAuthLoginProviders(t *testing.T) {
 		t.Fatalf("list should render the oauth login state, got:\n%s", rendered)
 	}
 }
-
-func TestAtomicCatalogSetupRequiresLoadedModel(t *testing.T) {
-	out := formatProviderCatalogLine(providerCatalogSummary{ID: "atomic-chat-local", RuntimeSupported: true})
-	if strings.Contains(out, "zero providers setup atomic-chat-local --set-active") || !strings.Contains(out, "zero setup") {
-		t.Fatalf("catalog advertises a failing setup command: %s", out)
-	}
-}

internal/cli/completions.go

@@ -20,7 +20,7 @@ type completionContext struct {
 }
 
 var completionRoot = completionNode{
-	flags: []string{"-h", "--help", "-v", "--version", "-p", "--prompt", "--add-dir", "--allow-escalation", "--theme", "--skip-permissions-unsafe"},
+	flags: []string{"-h", "--help", "-v", "--version", "-p", "--prompt", "--add-dir", "--theme", "--skip-permissions-unsafe"},
 	children: []completionNode{
 		{names: []string{"exec"}, flags: []string{
 			"-h", "--help", "-f", "--file", "--image", "--add-dir", "--mode", "-m", "--model",
@@ -40,11 +40,7 @@ var completionRoot = completionNode{
 		},
 		{names: []string{"daemon"}, children: leafNodes("start", "stop", "status", "run", "attach", "serve-remote", "link")},
 		{names: []string{"setup"}},
-		{names: []string{"config"}, flags: []string{"-h", "--help", "--json"}, children: []completionNode{
-			{names: []string{"notify"}, flags: []string{
-				"-h", "--help", "--mode", "--focus", "--reset", "--json",
-			}},
-		}},
+		{names: []string{"config"}},
 		{names: []string{"models"}, children: []completionNode{{names: []string{"list", "ls"}}}},
 		{names: []string{"providers"}, children: []completionNode{
 			{names: []string{"current"}}, {names: []string{"list"}}, {names: []string{"catalog"}},
@@ -82,8 +78,7 @@ var completionRoot = completionNode{
 			{names: []string{"tools"}, children: leafNodes("list")},
 			{names: []string{"oauth"}, children: leafNodes("login", "logout", "status")},
 		}},
-		{names: []string{"auth"}, children: append(leafNodes("openrouter", "chatgpt", "login", "logout", "status", "refresh"),
-			completionNode{names: []string{"reset"}, flags: []string{"--confirm", "--json", "--help"}})},
+		{names: []string{"auth"}, children: leafNodes("openrouter", "chatgpt", "login", "logout", "status", "refresh")},
 		{names: []string{"sandbox"}, children: []completionNode{
 			{names: []string{"policy"}}, {names: []string{"setup"}}, {names: []string{"check"}},
 			{names: []string{"grants"}, children: leafNodes("list", "allow", "deny", "revoke", "clear")},

internal/cli/completions_test.go

@@ -159,17 +159,10 @@ func TestCompletionTreeCoversAliasesNestingAndCommonFlags(t *testing.T) {
 	assertCandidates(t, byPath["worktree"], "prepare", "release")
 	assertCandidates(t, byPath["daemon"], "start", "stop", "status", "run", "attach")
 	assertCandidates(t, byPath["mcp oauth"], "login", "logout", "status")
-	assertCandidates(t, byPath["auth"], "openrouter", "chatgpt", "login", "logout", "status", "refresh", "reset")
-	assertCandidates(t, byPath["auth reset"], "--confirm", "--json", "--help")
 	assertCandidates(t, byPath["sandbox grants"], "list", "allow", "deny", "revoke", "clear")
 	assertCandidates(t, byPath["completions"], "bash", "zsh", "fish", "powershell", "elvish")
 	assertCandidates(t, byPath["plugins"], "list", "add", "info", "remove", "rm")
 	assertCandidates(t, byPath["plugin"], "list", "add", "info", "remove", "rm")
-	// `config` gained the notify subcommand; the completion tree must expose
-	// it (and its flags) so shell completion cannot go stale for new CLI
-	// surfaces (maintainer review, PR #1001).
-	assertCandidates(t, byPath["config"], "notify", "--json", "--help")
-	assertCandidates(t, byPath["config notify"], "--mode", "--focus", "--reset", "--json", "--help")
 }
 
 func assertCandidates(t *testing.T, got []string, wants ...string) {

internal/cli/config_notify.go

@@ -1,177 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/Gitlawb/zero/internal/config"
-)
-
-// runConfigNotify implements `zero config notify`: with no flags it prints the
-// stored mode/focusMode; --mode/--focus update them via the same
-// config.SetNotify writer the TUI /notify command uses, so all surfaces stay
-// in lockstep; --reset blanks both fields so the TUI's effective default
-// applies again (an unconfigured headless run stays silent).
-//
-// The command manages a user preference, so it talks ONLY to the user's own
-// config file (config.UserNotify / config.SetNotify) and never runs the full
-// config resolution: resolving providers would fail with ErrNoActiveProvider
-// for a brand-new user, locking them out of setting notifications before they
-// have even configured a provider (CodeRabbit review, PR #1001). The display
-// therefore reports the USER'S stored values — a project config that
-// overrides notify for one repo is not shown here, by the same logic the
-// maintainer applied to the write path.
-func runConfigNotify(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
-	options, help, err := parseConfigNotifyArgs(args)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-	if help {
-		if err := writeConfigNotifyHelp(stdout); err != nil {
-			return exitCrash
-		}
-		return exitSuccess
-	}
-
-	configPath, err := deps.userConfigPath()
-	if err != nil {
-		return writeAppError(stderr, err.Error(), exitCrash)
-	}
-
-	if options.mode != "" || options.focus != "" || options.reset {
-		// One serialized read-merge-write transaction: the lock covers
-		// reading the stored block, applying only the explicit fields, and
-		// replacing the file, so two concurrent partial updates (e.g.
-		// --mode off and --focus always from two terminals) cannot lose
-		// each other's change (maintainer review, PR #1001). Omitted
-		// fields preserve the values stored in the user's OWN file — blank
-		// stays blank; --reset is the only path that clears both fields.
-		_, err := config.UpdateNotify(configPath, func(current config.NotifyConfig) config.NotifyConfig {
-			if options.reset {
-				return config.NotifyConfig{}
-			}
-			if options.mode != "" {
-				current.Mode = options.mode
-			}
-			if options.focus != "" {
-				current.FocusMode = options.focus
-			}
-			return current
-		})
-		if err != nil {
-			return writeAppError(stderr, err.Error(), exitUsage)
-		}
-	}
-
-	// Report the stored values (blank renders as "(default)").
-	current, err := config.UserNotify(configPath)
-	if err != nil {
-		return writeAppError(stderr, err.Error(), exitUsage)
-	}
-	if options.json {
-		if err := writePrettyJSON(stdout, map[string]any{
-			"mode":      current.Mode,
-			"focusMode": current.FocusMode,
-		}); err != nil {
-			return exitCrash
-		}
-		return exitSuccess
-	}
-	lines := []string{
-		"Notify",
-		"mode:      " + displayCLIValue(current.Mode, "(default)"),
-		"focusMode: " + displayCLIValue(current.FocusMode, "(default)"),
-	}
-	if _, err := fmt.Fprintln(stdout, strings.Join(lines, "\n")); err != nil {
-		return exitCrash
-	}
-	return exitSuccess
-}
-
-type configNotifyOptions struct {
-	mode  string
-	focus string
-	reset bool
-	json  bool
-}
-
-func parseConfigNotifyArgs(args []string) (configNotifyOptions, bool, error) {
-	options := configNotifyOptions{}
-	for index := 0; index < len(args); index++ {
-		arg := args[index]
-		switch {
-		case arg == "-h" || arg == "--help" || arg == "help":
-			return options, true, nil
-		case arg == "--json":
-			options.json = true
-		case arg == "--reset":
-			options.reset = true
-		case arg == "--mode":
-			value, next, err := nextFlagValue(args, index, arg)
-			if err != nil {
-				return options, false, err
-			}
-			options.mode = value
-			index = next
-		case strings.HasPrefix(arg, "--mode="):
-			value, err := requiredInlineFlagValue(arg, "--mode")
-			if err != nil {
-				return options, false, err
-			}
-			options.mode = value
-		case arg == "--focus":
-			value, next, err := nextFlagValue(args, index, arg)
-			if err != nil {
-				return options, false, err
-			}
-			options.focus = value
-			index = next
-		case strings.HasPrefix(arg, "--focus="):
-			value, err := requiredInlineFlagValue(arg, "--focus")
-			if err != nil {
-				return options, false, err
-			}
-			options.focus = value
-		case strings.HasPrefix(arg, "-"):
-			return options, false, execUsageError{fmt.Sprintf("unknown flag %q", arg)}
-		default:
-			return options, false, execUsageError{fmt.Sprintf("unexpected argument %q", arg)}
-		}
-	}
-	return options, false, nil
-}
-
-func writeConfigNotifyHelp(w io.Writer) error {
-	_, err := fmt.Fprint(w, "Usage:\n"+
-		"  zero config notify [flags]\n"+
-		"\n"+
-		"Print or update the stored global notification preference.\n"+
-		"\n"+
-		"The preference controls BOTH notification kinds: the turn-completion\n"+
-		"(\"Zero: ready\") alert and the needs-input alert. mode off silences both;\n"+
-		"the focus mode (unfocused, always, focused) applies to both.\n"+
-		"\n"+
-		"When run with no flag, prints the stored mode and focusMode; a field you\n"+
-		"never set shows as (default) — the TUI alerts with bell + notification,\n"+
-		"firing only when the terminal is unfocused, while an unconfigured\n"+
-		"headless run stays silent. Omitted flags preserve the values stored in\n"+
-		"YOUR config file; --reset clears both so the TUI's effective default\n"+
-		"applies again. If --reset is combined with --mode/--focus, --reset wins\n"+
-		"and the explicit values are ignored.\n"+
-		"\n"+
-		"Examples:\n"+
-		"  zero config notify\n"+
-		"  zero config notify --json\n"+
-		"  zero config notify --mode both --focus unfocused\n"+
-		"  zero config notify --mode off\n"+
-		"  zero config notify --reset         # clear the stored preference\n"+
-		"\n"+
-		"Flags:\n"+
-		"      --mode <off|bell|notify|both>       Notification mechanism (both kinds)\n"+
-		"      --focus <unfocused|always|focused>  When the alert fires\n"+
-		"      --reset                             Clear the stored preference so the TUI effective default applies\n"+
-		"      --json                              Machine-readable output\n"+
-		"  -h, --help                              Show this help\n")
-	return err
-}

internal/cli/config_notify_test.go

@@ -1,481 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/config"
-)
-
-// `zero config notify` with no flag and a fresh config: nothing is configured,
-// the resolver leaves the fields blank (defaults deliberately live in the TUI,
-// not the resolver — maintainer review, PR #1001), and the command reports
-// "(default)" for both.
-func TestRunConfigNotifyPrintsUnconfiguredAsDefault(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	// A valid openai profile so the resolver does not error with
-	// ErrNoActiveProvider. The notify defaults are applied independently of
-	// the provider resolution path.
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}]
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "mode:      (default)") {
-		t.Errorf("stdout should show unconfigured mode as (default), got: %s", stdout.String())
-	}
-	if !strings.Contains(stdout.String(), "focusMode: (default)") {
-		t.Errorf("stdout should show unconfigured focus as (default), got: %s", stdout.String())
-	}
-}
-
-// `zero config notify --json` emits a machine-readable payload. A configured
-// pair round-trips; unconfigured fields are empty strings (never defaults
-// filled in), so scripts can distinguish "user chose" from "default".
-func TestRunConfigNotifyPrintsJSON(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}],
-		"notify": {"mode": "bell", "focusMode": "always"}
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--json"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	var payload map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-	}
-	if payload["mode"] != "bell" {
-		t.Errorf("mode = %v, want bell", payload["mode"])
-	}
-	if payload["focusMode"] != "always" {
-		t.Errorf("focusMode = %v, want always", payload["focusMode"])
-	}
-}
-
-// The unconfigured JSON shape: fields are empty strings, never defaults
-// filled in, so scripts can tell "user chose" from "default".
-func TestRunConfigNotifyPrintsJSONUnconfigured(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}]
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--json"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	var payload map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-	}
-	if payload["mode"] != "" {
-		t.Errorf("mode = %v, want empty (unconfigured)", payload["mode"])
-	}
-	if payload["focusMode"] != "" {
-		t.Errorf("focusMode = %v, want empty (unconfigured)", payload["focusMode"])
-	}
-}
-
-// `zero config notify --mode off` writes the new value to disk and prints
-// confirmation. The user can read it back by running the command again.
-func TestRunConfigNotifyWritesModeChange(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}],
-		"notify": {"mode": "both", "focusMode": "always"}
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--mode", "off"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "off" {
-		t.Errorf("Notify.Mode = %q, want off", cfg.Notify.Mode)
-	}
-	// A mode-only update must preserve the configured focusMode, not wipe it.
-	if cfg.Notify.FocusMode != "always" {
-		t.Errorf("Notify.FocusMode = %q, want preserved %q", cfg.Notify.FocusMode, "always")
-	}
-	if !strings.Contains(stdout.String(), "mode:      off") {
-		t.Errorf("stdout should confirm the change, got: %s", stdout.String())
-	}
-}
-
-// A focus-only update preserves the configured mode.
-func TestRunConfigNotifyFocusOnlyPreservesMode(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}],
-		"notify": {"mode": "bell", "focusMode": "unfocused"}
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--focus", "always"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "bell" {
-		t.Errorf("Notify.Mode = %q, want preserved %q", cfg.Notify.Mode, "bell")
-	}
-	if cfg.Notify.FocusMode != "always" {
-		t.Errorf("Notify.FocusMode = %q, want always", cfg.Notify.FocusMode)
-	}
-}
-
-// Maintainer regression (PR #1001): a partial update must seed from the USER'S
-// OWN file, never from the resolved view. A project .zero/config.json setting
-// mode=off resolves into the session, but `--focus always` inside that repo
-// must NOT copy the project's off into the user's global config.
-func TestRunConfigNotifyDoesNotCopyProjectNotifyIntoUserConfig(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "user.json")
-	projectPath := filepath.Join(t.TempDir(), "project.json")
-	if err := os.WriteFile(configPath, []byte(`{"activeProvider": "openai"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(projectPath, []byte(`{"notify": {"mode": "off"}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	// Resolve EXACTLY the way production does: user config + project config
-	// merged, so resolved.Notify.Mode is the project's "off".
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{
-			UserConfigPath:    configPath,
-			ProjectConfigPath: projectPath,
-			Env:               map[string]string{"OPENAI_API_KEY": "sk-test"},
-		})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--focus", "always"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	// The user's file must keep an unspecified mode unspecified — the
-	// project's "off" stays in the project file where it belongs.
-	if cfg.Notify.Mode != "" {
-		t.Errorf("user Notify.Mode = %q, want blank (project's off must not leak into the user file)", cfg.Notify.Mode)
-	}
-	if cfg.Notify.FocusMode != "always" {
-		t.Errorf("Notify.FocusMode = %q, want always", cfg.Notify.FocusMode)
-	}
-	// The project file is untouched.
-	project := readFileConfig(t, projectPath)
-	if project.Notify.Mode != "off" {
-		t.Errorf("project Notify.Mode = %q, want untouched off", project.Notify.Mode)
-	}
-}
-
-// Maintainer regression (PR #1001): with a clean config, `--mode off` must not
-// also pin focusMode as an explicit choice — blank means "use the built-in
-// default", and a partial update keeps it that way.
-func TestRunConfigNotifyDoesNotPinDefaultsAsExplicitChoices(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(configPath, []byte(`{"activeProvider": "openai"}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--mode", "off"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "off" {
-		t.Errorf("Notify.Mode = %q, want off", cfg.Notify.Mode)
-	}
-	if cfg.Notify.FocusMode != "" {
-		t.Errorf("Notify.FocusMode = %q, want blank (unspecified stays unspecified; the default must not be pinned)", cfg.Notify.FocusMode)
-	}
-}
-
-// `--mode` and `--focus` together update both fields in one call.
-func TestRunConfigNotifyWritesModeAndFocus(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}]
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--mode", "both", "--focus", "unfocused"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "both" || cfg.Notify.FocusMode != "unfocused" {
-		t.Errorf("Notify = %+v, want mode=both focusMode=unfocused", cfg.Notify)
-	}
-}
-
-// `--mode loud` is a usage error. The config must not be mutated.
-func TestRunConfigNotifyRejectsInvalidMode(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}],
-		"notify": {"mode": "off"}
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--mode", "loud"}, &stdout, &stderr, deps)
-	if exitCode == exitSuccess {
-		t.Fatalf("expected failure for invalid mode, got success; stdout=%s", stdout.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "off" {
-		t.Errorf("Notify.Mode = %q, want off (unchanged after failed write)", cfg.Notify.Mode)
-	}
-}
-
-// `--reset` blanks both fields so the TUI's effective default applies again
-// (an unconfigured headless run stays silent). Useful for "go back to the
-// recommended setup" after a custom value.
-func TestRunConfigNotifyResetClearsStoredValues(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	seed := `{
-		"activeProvider": "openai",
-		"providers": [{
-			"name": "openai",
-			"providerKind": "openai",
-			"baseUrl": "https://api.openai.com/v1",
-			"model": "gpt-4.1",
-			"apiKeyEnv": "OPENAI_API_KEY"
-		}],
-		"notify": {"mode": "off", "focusMode": "always"}
-	}`
-	if err := os.WriteFile(configPath, []byte(seed), 0o600); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{"OPENAI_API_KEY": "sk-test"}})
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify", "--reset"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "" || cfg.Notify.FocusMode != "" {
-		t.Errorf("Notify after reset = %+v, want empty (defaults apply)", cfg.Notify)
-	}
-}
-
-// CodeRabbit regression (PR #1001): the command manages a user preference and
-// must not require provider resolution. A brand-new user with NO provider
-// configured (the resolver would return ErrNoActiveProvider) can still read,
-// set, and reset their notification preference.
-func TestRunConfigNotifyWorksWithoutAnyProviderConfigured(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(configPath, []byte(`{}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// resolveConfig fails the way the real resolver does for a fresh user —
-	// the command must never call it, so a panic-free stub is enough to prove
-	// the point; use the failing resolver to catch any regression to the
-	// resolve-first shape.
-	deps := commandCenterDeps(t)
-	deps.userConfigPath = func() (string, error) { return configPath, nil }
-	deps.resolveConfig = func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-		return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{}})
-	}
-
-	// Read works and shows defaults.
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config", "notify"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("read: exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "mode:      (default)") {
-		t.Errorf("read should show (default), got: %s", stdout.String())
-	}
-
-	// Write works.
-	stdout.Reset()
-	exitCode = runWithDeps([]string{"config", "notify", "--mode", "bell", "--focus", "always"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("write: exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg := readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "bell" || cfg.Notify.FocusMode != "always" {
-		t.Fatalf("write: Notify = %+v, want bell/always", cfg.Notify)
-	}
-
-	// JSON read reflects the stored pair.
-	stdout.Reset()
-	exitCode = runWithDeps([]string{"config", "notify", "--json"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("json: exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	var payload map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("json output invalid: %v\n%s", err, stdout.String())
-	}
-	if payload["mode"] != "bell" || payload["focusMode"] != "always" {
-		t.Errorf("json = mode %v focus %v, want bell/always", payload["mode"], payload["focusMode"])
-	}
-
-	// Reset works.
-	stdout.Reset()
-	exitCode = runWithDeps([]string{"config", "notify", "--reset"}, &stdout, &stderr, deps)
-	if exitCode != exitSuccess {
-		t.Fatalf("reset: exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	cfg = readFileConfig(t, configPath)
-	if cfg.Notify.Mode != "" || cfg.Notify.FocusMode != "" {
-		t.Errorf("reset: Notify = %+v, want empty", cfg.Notify)
-	}
-}
-
-// `zero config` (no subcommand) still works after the dispatch change.
-func TestRunConfigSummaryStillWorks(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"config"}, &stdout, &stderr, commandCenterDeps(t))
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want %d: %s", exitCode, exitSuccess, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "Config") {
-		t.Errorf("stdout should show the config summary, got: %s", stdout.String())
-	}
-}

internal/cli/cron_claim_test.go

@@ -2,10 +2,6 @@ package cli
 
 import (
 	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -43,115 +39,3 @@ func TestFireJobClaimPreventsDoubleFire(t *testing.T) {
 		t.Fatalf("NextRunAt must advance past now, got %s", d.NextRunAt)
 	}
 }
-
-func TestFireJobOverlappingAdjacentSlots(t *testing.T) {
-	for _, olderFirst := range []bool{false, true} {
-		name := "newer completes first"
-		if olderFirst {
-			name = "older completes first"
-		}
-		t.Run(name, func(t *testing.T) {
-			root := t.TempDir()
-			stores := []*cron.Store{
-				cron.NewStore(cron.StoreOptions{RootDir: root}),
-				cron.NewStore(cron.StoreOptions{RootDir: root}),
-			}
-			now := time.Date(2026, 6, 9, 9, 0, 0, 0, time.UTC)
-			job, err := stores[0].Add(cron.Job{Expr: "* * * * *", Prompt: "fire me", NextRunAt: now, FireCount: 7})
-			if err != nil {
-				t.Fatal(err)
-			}
-			var release, done [2]chan struct{}
-			for i := range stores {
-				release[i], done[i] = make(chan struct{}), make(chan struct{})
-				// Always release blocked runners, including on assertion failures.
-				defer func() {
-					select {
-					case <-release[i]:
-					default:
-						close(release[i])
-					}
-					<-done[i]
-				}()
-				started := make(chan struct{})
-				go func() {
-					defer close(done[i])
-					fireJob(stores[i], func() time.Time { return now.Add(time.Duration(i) * time.Minute) }, job, io.Discard, io.Discard,
-						func(_ []string, _, _ io.Writer) int {
-							close(started)
-							<-release[i]
-							return i // Include a failed execution in the accounting.
-						})
-				}()
-				select {
-				case <-started:
-				case <-done[i]:
-					t.Fatal("runner did not claim its slot")
-				}
-			}
-			order := []int{1, 0}
-			if olderFirst {
-				order = []int{0, 1}
-			}
-			for n, i := range order {
-				close(release[i])
-				<-done[i]
-				current, err := stores[0].Get(job.ID)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if current.FireCount != 8+n || !current.NextRunAt.Equal(now.Add(2*time.Minute)) {
-					t.Fatalf("after completion %d: FireCount=%d NextRunAt=%s; want count %d and next %s", n+1, current.FireCount, current.NextRunAt, 8+n, now.Add(2*time.Minute))
-				}
-				claimed, err := claimFire(stores[1], now.Add(time.Minute), job.ID)
-				if err != nil || claimed {
-					t.Fatalf("already claimed slot became available: claimed=%v err=%v", claimed, err)
-				}
-			}
-			runs, err := stores[0].Runs(job.ID, 0)
-			if err != nil || len(runs) != 2 {
-				t.Fatalf("runs=%v err=%v", runs, err)
-			}
-			for n, i := range order {
-				if !runs[n].At.Equal(now.Add(time.Duration(i)*time.Minute)) || runs[n].ExitCode != i {
-					t.Fatalf("unexpected run record: %+v", runs[n])
-				}
-			}
-		})
-	}
-}
-
-func TestFireJobCompletionReadErrorDoesNotOverwriteState(t *testing.T) {
-	root := t.TempDir()
-	store := cron.NewStore(cron.StoreOptions{RootDir: root})
-	now := time.Date(2026, 6, 9, 9, 0, 0, 0, time.UTC)
-	job, err := store.Add(cron.Job{Expr: "* * * * *", Prompt: "fire me", NextRunAt: now})
-	if err != nil {
-		t.Fatal(err)
-	}
-	metadata := filepath.Join(root, job.ID, "metadata.json")
-	var stdout, stderr bytes.Buffer
-	fireJob(store, func() time.Time { return now }, job, &stdout, &stderr,
-		func(_ []string, _, _ io.Writer) int {
-			// A corrupt read must not cause completion to replace unknown newer state
-			// with the stale pre-execution job. This works without permission tricks.
-			if err := os.WriteFile(metadata, []byte("unreadable job"), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			return 0
-		})
-	data, err := os.ReadFile(metadata)
-	if err != nil || string(data) != "unreadable job" {
-		t.Fatalf("completion overwrote unreadable state: %q, err=%v", data, err)
-	}
-	if !strings.Contains(stderr.String(), "failed to persist job state") {
-		t.Fatalf("missing persistence warning: %s", stderr.String())
-	}
-	if want := "fired " + job.ID + " -> exit 0 (next: unknown)\n"; stdout.String() != want {
-		t.Fatalf("completion summary = %q; want %q", stdout.String(), want)
-	}
-	runs, err := store.Runs(job.ID, 0)
-	if err != nil || len(runs) != 1 || runs[0].ExitCode != 0 {
-		t.Fatalf("execution should still be recorded: runs=%v err=%v", runs, err)
-	}
-}

internal/cli/cron_run.go

@@ -129,15 +129,17 @@ func reconcileOverdue(store *cron.Store, now func() time.Time, ids []string, std
 	}
 }
 
-// fireJob claims one job, runs it via the exec runner, and records the outcome.
-// Separate scheduler processes can have adjacent slots executing concurrently.
+// fireJob runs one job via the exec runner, records the outcome, advances the
+// schedule, and persists. The foreground loop is single-goroutine, so the
+// previous fire has already returned before the next tick — no overlap.
 func fireJob(store *cron.Store, now func() time.Time, job cron.Job, stdout io.Writer, stderr io.Writer, exec execRunner) {
 	fired := now()
 	// Atomically claim this fire before running it so concurrent schedulers (or
 	// --once overlapping the forever loop) can't both execute the same due job: the
 	// winner advances NextRunAt under the per-job lock, and a loser sees the
-	// advanced time and skips. Only the claim writes schedule state; completion
-	// must not overwrite a later slot's claim with this run's stale job copy.
+	// advanced time and skips. The post-exec advance recomputes the same
+	// NextRunAt (sched.Next(fired) is deterministic), so the claim serializes the
+	// fire decision without changing any persisted schedule state (M9).
 	claimed, claimErr := claimFire(store, fired, job.ID)
 	if claimErr != nil {
 		if errors.Is(claimErr, cron.ErrJobNotFound) {
@@ -176,25 +178,44 @@ func fireJob(store *cron.Store, now func() time.Time, job cron.Job, stdout io.Wr
 		rec.Error = cronTruncate(detail, 500)
 	}
 
-	// Explain schedules that claimFire paused because they cannot advance.
+	job.FireCount++
+	// Advance the schedule. If the expression can no longer produce a future run
+	// (became invalid, or is an impossible spec whose Next is zero), pause the job
+	// so it cannot re-fire on every tick.
 	if sched, perr := cron.Parse(job.Expr); perr != nil {
+		job.Status = cron.StatusPaused
 		if rec.Error == "" {
 			rec.Error = "invalid schedule; job paused: " + perr.Error()
 		}
 	} else if nxt := sched.Next(fired.Truncate(time.Minute)); nxt.IsZero() {
+		job.Status = cron.StatusPaused
 		if rec.Error == "" {
 			rec.Error = "schedule no longer fires; job paused"
 		}
+	} else {
+		// Minute-aligned input keeps this advance identical to claimFire's and lets
+		// the DST fall-back collapse guard engage (AUDIT-M4).
+		job.NextRunAt = nxt
 	}
-	// Count this completion against current state under the cross-process lock.
-	// The claim already advanced or paused the schedule. Leave that state alone:
-	// another scheduler may have claimed a later slot or a user may have edited it.
+	// Re-read and persist the advanced state ATOMICALLY under the per-job lock. The
+	// job may have been paused or removed while it executed, and this in-memory copy
+	// is stale from tick start. Mutate closes the read-modify-write window a single
+	// scheduler alone could only narrow (Store.Mutate took a cross-process lock): a
+	// concurrent scheduler or an external pause/remove landing here can no longer be
+	// clobbered.
 	persisted, err := store.Mutate(job.ID, func(current cron.Job, readErr error) (cron.Job, error) {
 		if readErr != nil {
-			// Never replace unknown newer state with the pre-execution snapshot.
-			return current, readErr
+			// A transient read failure (IO/permission) is NOT removal — persist the
+			// computed next state anyway so the schedule advances and the job does not
+			// re-fire next tick.
+			fmt.Fprintf(stderr, "warning: could not re-read job %s before persist: %v\n", job.ID, readErr)
+			return job, nil
+		}
+		current.FireCount = job.FireCount
+		current.NextRunAt = job.NextRunAt
+		if current.Status != cron.StatusPaused {
+			current.Status = job.Status
 		}
-		current.FireCount++
 		return current, nil
 	})
 	if errors.Is(err, cron.ErrJobNotFound) {
@@ -208,21 +229,19 @@ func fireJob(store *cron.Store, now func() time.Time, job cron.Job, stdout io.Wr
 	if aerr := store.AppendRun(job.ID, rec); aerr != nil {
 		fmt.Fprintf(stderr, "warning: failed to record run for %s: %v\n", job.ID, aerr)
 	}
-	next := "unknown"
 	if err != nil {
 		fmt.Fprintf(stderr, "warning: failed to persist job state for %s: %v\n", job.ID, err)
-	} else {
-		next = formatCronTime(persisted.NextRunAt)
+		persisted = job
 	}
-	fmt.Fprintf(stdout, "fired %s -> exit %d (next: %s)\n", job.ID, code, next)
+	fmt.Fprintf(stdout, "fired %s -> exit %d (next: %s)\n", job.ID, code, formatCronTime(persisted.NextRunAt))
 }
 
 // claimFire atomically claims a due job's fire under the per-job lock and reports
 // whether THIS caller should run it. It returns false only when the job was paused
 // externally or another scheduler already advanced NextRunAt past `fired` (so a
 // valid recurring job never double-fires). A valid due job has its NextRunAt
-// advanced here to claim the slot; an invalid or exhausted schedule is paused
-// here and the caller still fires once (preserving single-scheduler behavior).
+// advanced here to claim the slot; an invalid or exhausted schedule is left for the
+// caller to fire-once and pause (preserving existing single-scheduler behavior).
 func claimFire(store *cron.Store, fired time.Time, id string) (bool, error) {
 	claimed := true
 	_, err := store.Mutate(id, func(current cron.Job, readErr error) (cron.Job, error) {
@@ -249,8 +268,8 @@ func claimFire(store *cron.Store, fired time.Time, id string) (bool, error) {
 		}
 		// Unparseable or unadvanceable schedule (an impossible spec whose Next is
 		// zero): pause the job inside this same locked claim so a concurrent scheduler
-		// sees a non-active job and does NOT also fire it. The winner still fires once.
-		// Without this, both callers leave
+		// sees a non-active job and does NOT also fire it. The winner still fires once
+		// and fireJob's post-exec keeps it paused. Without this, both callers leave
 		// NextRunAt unchanged, both see the job due, and both fire the same slot
 		// (AUDIT-M5).
 		current.Status = cron.StatusPaused

internal/cli/cron_run_test.go

@@ -53,7 +53,7 @@ func TestCronRunOnceFiresDueJobs(t *testing.T) {
 	if d.FireCount != 1 || !d.NextRunAt.After(now) {
 		t.Fatalf("due job not advanced: %+v", d)
 	}
-	runs, _ := store.Runs(due.ID, 0)
+	runs, _ := store.Runs(due.ID)
 	if len(runs) != 1 {
 		t.Fatalf("expected 1 run record, got %d", len(runs))
 	}
@@ -146,7 +146,7 @@ func TestCronRunPausesUnadvanceableJob(t *testing.T) {
 	if d.Status != cron.StatusPaused {
 		t.Fatalf("unadvanceable job must be paused, got status=%q", d.Status)
 	}
-	runs, _ := store.Runs(job.ID, 0)
+	runs, _ := store.Runs(job.ID)
 	if len(runs) != 1 || runs[0].Error == "" {
 		t.Fatalf("expected one run record with an error, got %+v", runs)
 	}

internal/cli/daemon.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"os/exec"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
@@ -146,7 +147,11 @@ func runDaemonStartDetached(paths daemon.Paths, stdout io.Writer, stderr io.Writ
 	if err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
 	}
-	logFile, logPath, err := daemon.OpenRuntimeLog(paths)
+	if err := os.MkdirAll(filepath.Dir(paths.Socket), 0o700); err != nil {
+		return writeAppError(stderr, err.Error(), exitCrash)
+	}
+	logPath := filepath.Join(filepath.Dir(paths.Socket), "daemon.log")
+	logFile, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)
 	if err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
 	}

internal/cli/deferred_wiring_test.go

@@ -18,20 +18,14 @@ import (
 // cliFakeDeferredTool is deferred-eligible (implements Deferred() bool), mirroring
 // an MCP registry tool, so it counts toward the deferral threshold.
 type cliFakeDeferredTool struct {
-	name            string
-	permission      tools.Permission
-	advertiseInAuto bool
+	name string
 }
 
 func (t cliFakeDeferredTool) Name() string             { return t.name }
 func (t cliFakeDeferredTool) Description() string      { return "fake deferred tool" }
 func (t cliFakeDeferredTool) Parameters() tools.Schema { return tools.Schema{Type: "object"} }
 func (t cliFakeDeferredTool) Safety() tools.Safety {
-	permission := t.permission
-	if permission == "" {
-		permission = tools.PermissionAllow
-	}
-	return tools.Safety{SideEffect: tools.SideEffectNetwork, Permission: permission, AdvertiseInAuto: t.advertiseInAuto}
+	return tools.Safety{SideEffect: tools.SideEffectNetwork, Permission: tools.PermissionAllow}
 }
 func (t cliFakeDeferredTool) Run(context.Context, map[string]any) tools.Result {
 	return tools.Result{Status: tools.StatusOK, Output: "ok"}

internal/cli/exec.go

@@ -49,14 +49,6 @@ const (
 	exitInterrupted = 130
 )
 
-// defaultExecMaxTurns is the headless tool-turn budget when no source sets one.
-// An interactive run can be continued past the shared interactive default by the
-// user; an exec run has nobody to unstick it, so evals and automation would
-// truncate mid-task at 80 turns. The ceiling is the already-justified bound —
-// still finite against a genuinely runaway loop, which the loop's empty-turn
-// guard also cuts independently of this budget.
-const defaultExecMaxTurns = config.MaxTurnsCeiling
-
 type execOutputFormat string
 type execInputFormat string
 
@@ -181,7 +173,7 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 	// Refresh the models.dev pricing/limits cache in the background when stale;
 	// the overlay is read at registry construction from the cache file, so this
 	// benefits the next run and never blocks or fails this one.
-	modelregistry.StartModelsDevRefresh()
+	go func() { _ = modelregistry.RefreshModelsDevCache(context.Background()) }()
 
 	// A mode seeds model/effort/max-turns/tool filters as a preset. Expand it up
 	// front — before tool-filter validation and the --list-tools branch — so a
@@ -328,7 +320,6 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		}
 		return writeExecProviderError(stdout, stderr, options.outputFormat, "provider_error", err.Error())
 	}
-	resolved.MaxTurns = execTurnBudget(resolved)
 	var displacedMaxTurns int
 	resolved.MaxTurns, displacedMaxTurns = applyProfileTurnBudget(execProfile, options.maxTurns, resolved.MaxTurns)
 	execScope, err := sandbox.NewScope(workspaceRoot, append(append([]string{}, resolved.Sandbox.AdditionalWriteRoots...), options.addDirs...))
@@ -347,17 +338,6 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 	} else if notice != "" {
 		_, _ = fmt.Fprintln(stderr, "[zero] "+notice)
 	}
-	// Before any tool runs, and before the MCP servers and plugins below start
-	// through the same sandbox, so a run that goes ahead with reduced isolation
-	// says so where its output starts, not only when someone runs `zero doctor`.
-	// A notice that cannot be written stops the run, as the image and effort
-	// notices further down do: going ahead would mean reduced isolation and no
-	// warning delivered.
-	if notice := sandboxEngine.DegradedNotice(); notice != "" {
-		if _, err := fmt.Fprintln(stderr, "[zero] "+notice); err != nil {
-			return exitCrash
-		}
-	}
 	executionRunner.SetPreparer(sandboxEngine)
 	if permissionMode != agent.PermissionModePlan {
 		mcpRuntime, mcpSkip, err = registerMCPToolsForWorkspace(context.Background(), workspaceRoot, registry, deps, execMCPAutonomy(options), trustRoot, executionRunner)
@@ -462,22 +442,57 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 	// the resolved model and is reassigned by the model switcher on a mid-run
 	// escalation so post-switch turns are attributed to the escalated model.
 	currentModel := resolved.Provider.Model
-	// Optimized OpenAI turn sessions (ZERO_OPENAI_TURN_SESSION, default off). nil
-	// when gated off or the profile is ineligible: agent.Run then wraps the
-	// provider in its default adapter. This is the run's STARTING session provider
-	// and is used whether or not escalation is enabled.
-	turnSessions, _ := providers.OptimizedTurnSessions(resolved.Provider, provider, providers.Options{})
-	// Both switchers come from one shared builder so exec and the interactive TUI
-	// cannot drift on the nil contracts the agent loop depends on. The session
-	// switcher is nil unless this run STARTED optimized, which is what keeps a
-	// default-adapter run on the default adapter.
 	var modelSwitcher func(context.Context, string) (agent.Provider, error)
-	var modelSessionSwitcher func(context.Context, string) (zeroruntime.TurnSessionProvider, error)
 	if options.allowEscalation {
-		modelSwitcher, modelSessionSwitcher = providers.EscalationSwitchers(
-			resolved.Provider, provider, deps.newProvider,
-			func(modelID string) { currentModel = modelID },
-		)
+		modelSwitcher = func(_ context.Context, modelID string) (agent.Provider, error) {
+			// deps.newProvider is wrapped (fillAppDeps) to apply the stored key, so
+			// the escalated provider is authenticated even though resolved.Provider
+			// is the pure profile — no per-site key handling here.
+			switchedProfile := resolved.Provider
+			switchedProfile.Model = modelID
+			switchedProvider, err := deps.newProvider(switchedProfile)
+			if err != nil {
+				return nil, err
+			}
+			// Mirror the agent loop's switch guard (it only reassigns the provider
+			// when newProvider != nil). Updating currentModel only on a non-nil
+			// provider keeps usage attribution consistent with whether the loop
+			// actually switched — a (nil, nil) return leaves both untouched.
+			if switchedProvider != nil {
+				currentModel = modelID
+			}
+			return switchedProvider, nil
+		}
+	}
+
+	// Optimized OpenAI turn sessions (ZERO_OPENAI_TURN_SESSION, default off).
+	// nil when gated off or the profile is ineligible: agent.Run then wraps the
+	// provider in its default adapter — the exact code path of today. The
+	// session switcher is installed only when the run START is optimized, so
+	// the legacy ModelSwitcher path above stays untouched otherwise.
+	turnSessions, _ := providers.OptimizedTurnSessions(resolved.Provider, provider, providers.Options{})
+	var modelSessionSwitcher func(context.Context, string) (zeroruntime.TurnSessionProvider, error)
+	if options.allowEscalation && turnSessions != nil {
+		modelSessionSwitcher = func(_ context.Context, modelID string) (zeroruntime.TurnSessionProvider, error) {
+			switchedProfile := resolved.Provider
+			switchedProfile.Model = modelID
+			switchedProvider, err := deps.newProvider(switchedProfile)
+			if err != nil {
+				return nil, err
+			}
+			if switchedProvider == nil {
+				// The loop treats a nil session source as "no swap" — mirror the
+				// legacy closure's (nil, nil) contract.
+				return nil, nil
+			}
+			currentModel = modelID
+			if optimized, ok := providers.OptimizedTurnSessions(switchedProfile, switchedProvider, providers.Options{}); ok {
+				return optimized, nil
+			}
+			// Ineligible switch target: default adapter, but with the switched
+			// model's resolved capability projection preserved.
+			return providers.DefaultTurnSessions(switchedProfile, switchedProvider, providers.Options{}), nil
+		}
 	}
 
 	runMetadata, err := resolveExecRunMetadata(resolved.Provider)
@@ -667,23 +682,16 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		ModelSwitcher:        modelSwitcher,
 		TurnSessionProvider:  turnSessions,
 		ModelSessionSwitcher: modelSessionSwitcher,
-		Summarizer:           summarizerFactory(resolved, deps.newProvider),
-		ContextWindowFor: func(modelID string) int {
-			return modelregistry.AgentContextWindow(modelContextWindow(modelRegistry, modelID))
-		},
-		SupportsVision: func(modelID string) bool {
-			return modelregistry.SupportsVision(modelRegistry, modelID)
-		},
-		ReasoningEffort: forwardEffort,
-		Trace:           traceRecorder,
-		Cwd:             workspaceRoot,
-		Images:          images,
-		Registry:        registry,
-		PermissionMode:  permissionMode,
-		Autonomy:        options.autonomy,
-		SelfCorrect:     selfCorrector,
-		FileDiagnostics: fileDiagnostics,
-		Profile:         execProfile.Policy(displacedMaxTurns, execProfileFilledEffort),
+		ReasoningEffort:      forwardEffort,
+		Trace:                traceRecorder,
+		Cwd:                  workspaceRoot,
+		Images:               images,
+		Registry:             registry,
+		PermissionMode:       permissionMode,
+		Autonomy:             options.autonomy,
+		SelfCorrect:          selfCorrector,
+		FileDiagnostics:      fileDiagnostics,
+		Profile:              execProfile.Policy(displacedMaxTurns, execProfileFilledEffort),
 		// Headless exec: don't accept a no-tool-call turn as "done" while work
 		// clearly remains (pending plan items / a mid-step continuation cue) —
 		// nudge to continue, and finalize as INCOMPLETE rather than false success
@@ -1245,20 +1253,6 @@ func specProfileEffortFilled(effortFilled bool, specReasoningEffort string) bool
 	return effortFilled && strings.TrimSpace(specReasoningEffort) == ""
 }
 
-// execTurnBudget applies the headless default to the resolved turn budget: an
-// interactive run can be continued past the shared default by the user, but an
-// exec run has nobody to unstick it, so an unconfigured budget starts at the
-// documented ceiling instead of truncating mid-task. Explicit sources
-// (--max-turns, mode presets, ZERO_MAX_TURNS, config files) resolve as
-// MaxTurnsSet and pass through; an exec-profile budget still wins via
-// applyProfileTurnBudget afterward.
-func execTurnBudget(resolved config.ResolvedConfig) int {
-	if resolved.MaxTurnsSet {
-		return resolved.MaxTurns
-	}
-	return defaultExecMaxTurns
-}
-
 // applyProfileTurnBudget decides the run's turn budget once config is resolved.
 // The profile displaces the RESOLVED value, not the flag: a pinned budget
 // always wins and the profile backs off entirely, while an env/config budget

internal/cli/exec_protocol_test.go

@@ -70,8 +70,8 @@ func TestRunExecListsFilteredToolsWithoutPromptOrProvider(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("expected exit code %d, got %d: %s", exitSuccess, exitCode, stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 	if providerBuilt {
 		t.Fatal("provider should not be constructed for --list-tools")
@@ -108,8 +108,8 @@ func TestRunExecListsToolsAsStreamJSONWhenRequested(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("expected exit code %d, got %d: %s", exitSuccess, exitCode, stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 	if providerBuilt {
 		t.Fatal("provider should not be constructed for --list-tools")
@@ -176,8 +176,8 @@ func TestRunExecListsMCPToolsWithoutProviderConstruction(t *testing.T) {
 	if !closed {
 		t.Fatal("MCP runtime was not closed after --list-tools")
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "mcp_docs_lookup") || !strings.Contains(stdout.String(), "Lookup documentation") {
 		t.Fatalf("expected MCP tool in list output, got %q", stdout.String())
@@ -323,8 +323,8 @@ func TestRunExecStreamJSONOutputsRunEndAndRecordsSession(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("expected exit code %d, got %d: %s", exitSuccess, exitCode, stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 
 	events := decodeJSONLines(t, stdout.String())
@@ -388,8 +388,8 @@ func TestRunExecStreamJSONEmitsAndRecordsPermissionEvents(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("expected exit code %d, got %d: %s", exitSuccess, exitCode, stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 
 	events := decodeJSONLines(t, stdout.String())
@@ -460,7 +460,7 @@ func TestRunExecStreamJSONEmitsAndRecordsPermissionEvents(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("approved exec exit = %d, stderr = %q", exitCode, stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
+	if stderr.String() != "" {
 		t.Fatalf("approved exec wrote stderr = %q", stderr.String())
 	}
 	approvedEvents := decodeJSONLines(t, stdout.String())

internal/cli/exec_spec.go

@@ -118,15 +118,12 @@ func runExecSpecDraft(run execSpecDraftRun) int {
 	hookDispatcher, hookSkip := newHookDispatcher(run.workspaceRoot, run.trustRoot, execution.NewRunner(run.sandboxEngine))
 	emitTrustNotice(run.stderr, hookSkip, run.mcpSkip)
 	result, err := agent.Run(runCtx, run.prompt, run.provider, agent.Options{
-		MaxTurns:      run.resolved.MaxTurns,
-		ContextWindow: resolveAgentContextWindow(runCtx, run.modelRegistry, run.resolved.Provider),
-		SessionID:     draftSession.SessionID,
-		SessionTitle:  run.sessionTitle,
-		ProviderName:  run.resolved.Provider.Name,
-		Model:         run.resolved.Provider.Model,
-		SupportsVision: func(modelID string) bool {
-			return modelregistry.SupportsVision(run.modelRegistry, modelID)
-		},
+		MaxTurns:        run.resolved.MaxTurns,
+		ContextWindow:   resolveAgentContextWindow(runCtx, run.modelRegistry, run.resolved.Provider),
+		SessionID:       draftSession.SessionID,
+		SessionTitle:    run.sessionTitle,
+		ProviderName:    run.resolved.Provider.Name,
+		Model:           run.resolved.Provider.Model,
 		ReasoningEffort: run.reasoningEffort,
 		Profile:         run.profilePolicy,
 		Cwd:             run.workspaceRoot,

internal/cli/exec_test.go

@@ -568,8 +568,8 @@ func TestRunExecAcceptsLegacyModelProfileFlags(t *testing.T) {
 	if !strings.Contains(stdout, "hello") {
 		t.Fatalf("expected prompt output, got %q", stdout)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 }
 
@@ -696,8 +696,8 @@ func TestRunExecAssemblesInlineAndFilePromptRelativeToCwd(t *testing.T) {
 	if !strings.Contains(stdout, "inline prompt\n\nfile prompt") {
 		t.Fatalf("expected inline and file prompt joined by blank line, got %q", stdout)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 }
 
@@ -715,8 +715,8 @@ func TestRunExecAcceptsFileOnlyPrompt(t *testing.T) {
 	if !strings.Contains(stdout, "file only prompt") {
 		t.Fatalf("expected file prompt output, got %q", stdout)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 }
 
@@ -798,8 +798,8 @@ func TestRunExecJSONOutputsNDJSONEvents(t *testing.T) {
 	if exitCode != 0 {
 		t.Fatalf("expected exit code 0, got %d: %s", exitCode, stderr)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 
 	events := decodeJSONLines(t, stdout)
@@ -833,8 +833,8 @@ func TestRunExecResolvesCanonicalModelAlias(t *testing.T) {
 	if exitCode != 0 {
 		t.Fatalf("expected exit code 0, got %d: %s", exitCode, stderr)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice for active model, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr for active model, got %q", stderr)
 	}
 	events := decodeJSONLines(t, stdout)
 	if got := events[0]["model"]; got != "gpt-4.1" {
@@ -926,8 +926,8 @@ func TestRunExecJSONUnsafeOutputsWarningEvent(t *testing.T) {
 	if exitCode != 0 {
 		t.Fatalf("expected exit code 0, got %d: %s", exitCode, stderr)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 
 	events := decodeJSONLines(t, stdout)
@@ -970,10 +970,10 @@ func TestRunExecUsesProjectConfigAndOpenAICompatibleProvider(t *testing.T) {
 			"name": "local",
 			"provider_kind": "openai-compatible",
 			"base_url": "` + server.URL + `",
-		"api_key": "sk-local",
-		"model": "local-model"
-	}]
-}`
+			"api_key": "sk-local",
+			"model": "local-model"
+		}]
+	}`
 	if err := os.WriteFile(filepath.Join(configDir, "config.json"), []byte(writeConfig), 0o600); err != nil {
 		t.Fatal(err)
 	}
@@ -988,8 +988,8 @@ func TestRunExecUsesProjectConfigAndOpenAICompatibleProvider(t *testing.T) {
 	if strings.TrimSpace(stdout.String()) != "provider ok" {
 		t.Fatalf("stdout = %q, want provider response", stdout.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr, got %q", stderr.String())
 	}
 	if gotAuth != "Bearer sk-local" {
 		t.Fatalf("Authorization = %q, want project config token", gotAuth)
@@ -1204,8 +1204,8 @@ func TestRunExecAutoHighEmitsUnsafeWarning(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("expected exit code %d, got %d: %s", exitSuccess, exitCode, stderr)
 	}
-	if stderr != hostSandboxNotice(t) {
-		t.Fatalf("expected no stderr beyond this host's sandbox notice, got %q", stderr)
+	if stderr != "" {
+		t.Fatalf("expected empty stderr, got %q", stderr)
 	}
 
 	events := decodeJSONLines(t, stdout)
@@ -1975,23 +1975,3 @@ func TestRunExecTopTierDeclineNoSwitch(t *testing.T) {
 		t.Fatalf("provider model = %q, want claude-opus-4.1", providerModels[0])
 	}
 }
-
-func TestExecTurnBudgetDefaultsToCeilingUnlessSet(t *testing.T) {
-	cases := []struct {
-		name     string
-		resolved config.ResolvedConfig
-		want     int
-	}{
-		// A headless run has no user to continue past the shared interactive
-		// default, so an unconfigured budget starts at the ceiling.
-		{"unconfigured default", config.ResolvedConfig{MaxTurns: 80, MaxTurnsSet: false}, config.MaxTurnsCeiling},
-		// A user who configured 80 on purpose (e.g. cost control in CI) keeps 80.
-		{"explicit default value", config.ResolvedConfig{MaxTurns: 80, MaxTurnsSet: true}, 80},
-		{"configured value passes through", config.ResolvedConfig{MaxTurns: 42, MaxTurnsSet: true}, 42},
-	}
-	for _, tc := range cases {
-		if got := execTurnBudget(tc.resolved); got != tc.want {
-			t.Fatalf("%s: execTurnBudget = %d, want %d", tc.name, got, tc.want)
-		}
-	}
-}

internal/cli/local_control_test.go

@@ -69,7 +69,7 @@ func TestRunExecListToolsHonorsDisabledLocalControlConfig(t *testing.T) {
 	if exitCode != exitSuccess {
 		t.Fatalf("exitCode = %d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
 	}
-	if stderr.String() != hostSandboxNotice(t) {
+	if stderr.Len() != 0 {
 		t.Fatalf("stderr = %q, want empty", stderr.String())
 	}
 	var payload struct {

internal/cli/mcp_config.go

@@ -29,8 +29,6 @@ type mcpWritableConfig struct {
 	serverRaw map[string]json.RawMessage
 }
 
-var lockMCPConfigFile = config.LockFile
-
 // projectMCPConfigExists reports whether the workspace's project ./.zero/config.json
 // declares any MCP servers, so the trust notice fires only when project MCP config was
 // actually skipped (mirroring projectHooksFileExists / projectPluginsDirExists). A
@@ -52,7 +50,7 @@ func projectMCPConfigExists(workspaceRoot string) bool {
 	return len(fc.MCP.Servers) > 0
 }
 
-func runMCPAdd(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) (exitCode int) {
+func runMCPAdd(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
 	options, help, err := parseMCPAddArgs(args)
 	if err != nil {
 		return writeExecUsageError(stderr, err.Error())
@@ -68,26 +66,6 @@ func runMCPAdd(args []string, stdout io.Writer, stderr io.Writer, deps appDeps)
 	if err != nil {
 		return writeAppError(stderr, "failed to resolve user config: "+err.Error(), exitCrash)
 	}
-	// This edits the same user config document the config package mutates, with
-	// the same read-modify-write + rename shape, so it takes the same
-	// cross-process lock. Without it, an MCP config edit racing a provider or
-	// preference write would silently drop whichever landed first (issue #832).
-	unlock, err := lockMCPConfigFile(configPath)
-	if err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released := false
-	defer func() {
-		if released {
-			return
-		}
-		// A failed release leaves the lock held for the rest of the process, so
-		// exiting success here would claim a state the next config write cannot
-		// reproduce. It must not mask a failure this command already reported.
-		if releaseErr := unlock(); releaseErr != nil && exitCode == exitSuccess {
-			exitCode = writeAppError(stderr, redaction.ErrorMessage(releaseErr, redaction.Options{}), exitCrash)
-		}
-	}()
 	cfg, err := readMCPWritableConfig(configPath)
 	if err != nil {
 		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
@@ -102,10 +80,6 @@ func runMCPAdd(args []string, stdout io.Writer, stderr io.Writer, deps appDeps)
 	if err := writeMCPWritableConfig(configPath, cfg); err != nil {
 		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
 	}
-	if err := unlock(); err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released = true
 
 	if options.json {
 		payload := struct {
@@ -135,7 +109,7 @@ func runMCPAdd(args []string, stdout io.Writer, stderr io.Writer, deps appDeps)
 	return exitSuccess
 }
 
-func runMCPRemove(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) (exitCode int) {
+func runMCPRemove(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
 	options, positional, help, err := parseMCPConfigPositionalCommand(args, "remove")
 	if err != nil {
 		return writeExecUsageError(stderr, err.Error())
@@ -158,26 +132,6 @@ func runMCPRemove(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 	if err != nil {
 		return writeAppError(stderr, "failed to resolve user config: "+err.Error(), exitCrash)
 	}
-	// This edits the same user config document the config package mutates, with
-	// the same read-modify-write + rename shape, so it takes the same
-	// cross-process lock. Without it, an MCP config edit racing a provider or
-	// preference write would silently drop whichever landed first (issue #832).
-	unlock, err := lockMCPConfigFile(configPath)
-	if err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released := false
-	defer func() {
-		if released {
-			return
-		}
-		// A failed release leaves the lock held for the rest of the process, so
-		// exiting success here would claim a state the next config write cannot
-		// reproduce. It must not mask a failure this command already reported.
-		if releaseErr := unlock(); releaseErr != nil && exitCode == exitSuccess {
-			exitCode = writeAppError(stderr, redaction.ErrorMessage(releaseErr, redaction.Options{}), exitCrash)
-		}
-	}()
 	cfg, err := readMCPWritableConfig(configPath)
 	if err != nil {
 		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
@@ -191,10 +145,6 @@ func runMCPRemove(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 			return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
 		}
 	}
-	if err := unlock(); err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released = true
 
 	if options.json {
 		payload := struct {
@@ -217,7 +167,7 @@ func runMCPRemove(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 	return exitSuccess
 }
 
-func runMCPToggle(args []string, stdout io.Writer, stderr io.Writer, deps appDeps, disabled bool) (exitCode int) {
+func runMCPToggle(args []string, stdout io.Writer, stderr io.Writer, deps appDeps, disabled bool) int {
 	commandName := "enable"
 	if disabled {
 		commandName = "disable"
@@ -244,26 +194,6 @@ func runMCPToggle(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 	if err != nil {
 		return writeAppError(stderr, "failed to resolve user config: "+err.Error(), exitCrash)
 	}
-	// This edits the same user config document the config package mutates, with
-	// the same read-modify-write + rename shape, so it takes the same
-	// cross-process lock. Without it, an MCP config edit racing a provider or
-	// preference write would silently drop whichever landed first (issue #832).
-	unlock, err := lockMCPConfigFile(configPath)
-	if err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released := false
-	defer func() {
-		if released {
-			return
-		}
-		// A failed release leaves the lock held for the rest of the process, so
-		// exiting success here would claim a state the next config write cannot
-		// reproduce. It must not mask a failure this command already reported.
-		if releaseErr := unlock(); releaseErr != nil && exitCode == exitSuccess {
-			exitCode = writeAppError(stderr, redaction.ErrorMessage(releaseErr, redaction.Options{}), exitCrash)
-		}
-	}()
 	cfg, err := readMCPWritableConfig(configPath)
 	if err != nil {
 		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
@@ -280,10 +210,6 @@ func runMCPToggle(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 			return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
 		}
 	}
-	if err := unlock(); err != nil {
-		return writeAppError(stderr, redaction.ErrorMessage(err, redaction.Options{}), exitCrash)
-	}
-	released = true
 
 	if options.json {
 		payload := struct {

internal/cli/mcp_config_lock_test.go

@@ -1,221 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/config"
-)
-
-type mcpConfigLockCase struct {
-	name     string
-	args     []string
-	disabled bool
-	server   bool
-}
-
-func mcpConfigLockCases() []mcpConfigLockCase {
-	return []mcpConfigLockCase{
-		{name: "add", args: []string{"mcp", "add", "docs", "--", "docs-mcp"}},
-		{name: "remove", args: []string{"mcp", "remove", "docs"}, server: true},
-		{name: "enable", args: []string{"mcp", "enable", "docs"}, server: true, disabled: true},
-		{name: "disable", args: []string{"mcp", "disable", "docs"}, server: true},
-	}
-}
-
-func seedMCPConfigLockCase(t *testing.T, path string, testCase mcpConfigLockCase) {
-	t.Helper()
-	servers := map[string]config.MCPServerConfig{}
-	if testCase.server {
-		servers["docs"] = config.MCPServerConfig{Type: "stdio", Command: "docs-mcp", Disabled: testCase.disabled}
-	}
-	writeMCPCommandConfig(t, path, config.FileConfig{
-		ActiveProvider: "seed",
-		Providers:      []config.ProviderProfile{{Name: "seed", Model: "seed-model"}},
-		MCP:            config.MCPConfig{Servers: servers},
-	})
-}
-
-func assertMCPConfigLockMutation(t *testing.T, path string, testCase mcpConfigLockCase) {
-	t.Helper()
-	cfg := readMCPCommandConfig(t, path)
-	server, exists := cfg.MCP.Servers["docs"]
-	switch testCase.name {
-	case "add":
-		if !exists {
-			t.Fatal("mcp add did not persist the server")
-		}
-	case "remove":
-		if exists {
-			t.Fatal("mcp remove left the server configured")
-		}
-	case "enable":
-		if !exists || server.Disabled {
-			t.Fatalf("mcp enable result = %+v, exists=%v", server, exists)
-		}
-	case "disable":
-		if !exists || !server.Disabled {
-			t.Fatalf("mcp disable result = %+v, exists=%v", server, exists)
-		}
-	}
-	if cfg.Preferences.Theme != "dracula" {
-		t.Errorf("theme update was lost: theme = %q, want dracula", cfg.Preferences.Theme)
-	}
-	if cfg.ActiveProvider != "seed" || len(cfg.Providers) != 1 || cfg.Providers[0].Name != "seed" {
-		t.Errorf("seeded provider was lost: active=%q providers=%#v", cfg.ActiveProvider, cfg.Providers)
-	}
-}
-
-// TestRunMCPConfigCommandsParticipateInConfigLock covers the half of issue #832
-// that lives outside internal/config. MCP config commands read the SAME user
-// config document, edit it, and republish it with the same temp-file+rename
-// shape as the config package's mutators. Locking only the config package would
-// leave these writers free to clobber a concurrent provider or preference
-// update, and be clobbered by one, with the file still valid JSON afterwards.
-//
-// Racing the two writers and hoping to observe a lost update is unreliable —
-// the interleaving that loses one is narrow, and the test passed consistently
-// against the unlocked code. So this asserts the property that actually matters
-// and is deterministic: while the config lock is held elsewhere, the MCP
-// writer's update CANNOT land. Once released it completes, and both updates
-// survive.
-func TestRunMCPConfigCommandsParticipateInConfigLock(t *testing.T) {
-	for _, testCase := range mcpConfigLockCases() {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath := filepath.Join(t.TempDir(), "zero", "config.json")
-			seedMCPConfigLockCase(t, configPath, testCase)
-			before, err := os.ReadFile(configPath)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			unlock, err := config.LockFile(configPath)
-			if err != nil {
-				t.Fatalf("acquire config lock: %v", err)
-			}
-			released := false
-			release := func() {
-				if !released {
-					released = true
-					if err := unlock(); err != nil {
-						t.Fatalf("release config lock: %v", err)
-					}
-				}
-			}
-			defer release()
-
-			original := lockMCPConfigFile
-			lockAttempted := make(chan struct{})
-			lockMCPConfigFile = func(path string) (func() error, error) {
-				close(lockAttempted)
-				return original(path)
-			}
-			t.Cleanup(func() { lockMCPConfigFile = original })
-
-			var stdout, stderr bytes.Buffer
-			done := make(chan int, 1)
-			go func() {
-				done <- runWithDeps(testCase.args, &stdout, &stderr, appDeps{
-					userConfigPath: func() (string, error) { return configPath, nil },
-				})
-			}()
-
-			select {
-			case <-lockAttempted:
-			case <-time.After(30 * time.Second):
-				t.Fatalf("mcp %s did not attempt config lock acquisition", testCase.name)
-			}
-
-			for range 20 {
-				after, err := os.ReadFile(configPath)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if !bytes.Equal(after, before) {
-					t.Fatalf("mcp %s changed config while its lock was held", testCase.name)
-				}
-				select {
-				case exitCode := <-done:
-					t.Fatalf("mcp %s completed (exit %d) while its lock was held", testCase.name, exitCode)
-				default:
-				}
-				time.Sleep(5 * time.Millisecond)
-			}
-
-			release()
-			select {
-			case exitCode := <-done:
-				if exitCode != exitSuccess {
-					t.Fatalf("mcp %s exitCode = %d stderr=%s", testCase.name, exitCode, stderr.String())
-				}
-			case <-time.After(30 * time.Second):
-				t.Fatalf("mcp %s did not finish after the config lock was released", testCase.name)
-			}
-
-			if _, err := config.SetTheme(configPath, "dracula"); err != nil {
-				t.Fatalf("SetTheme: %v", err)
-			}
-			assertMCPConfigLockMutation(t, configPath, testCase)
-		})
-	}
-}
-
-func TestRunMCPConfigCommandsReportLockAcquisitionFailure(t *testing.T) {
-	sentinel := errors.New("injected lock acquisition failure")
-	original := lockMCPConfigFile
-	lockMCPConfigFile = func(string) (func() error, error) { return nil, sentinel }
-	t.Cleanup(func() { lockMCPConfigFile = original })
-
-	for _, testCase := range mcpConfigLockCases() {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath := filepath.Join(t.TempDir(), "zero", "config.json")
-			seedMCPConfigLockCase(t, configPath, testCase)
-			before, err := os.ReadFile(configPath)
-			if err != nil {
-				t.Fatal(err)
-			}
-			var stdout, stderr bytes.Buffer
-			exitCode := runWithDeps(testCase.args, &stdout, &stderr, appDeps{
-				userConfigPath: func() (string, error) { return configPath, nil },
-			})
-			if exitCode != exitCrash || stdout.Len() != 0 || !strings.Contains(stderr.String(), sentinel.Error()) {
-				t.Fatalf("exit=%d stdout=%q stderr=%q, want lock error without success output", exitCode, stdout.String(), stderr.String())
-			}
-			after, err := os.ReadFile(configPath)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if !bytes.Equal(after, before) {
-				t.Fatal("command changed config after lock acquisition failed")
-			}
-		})
-	}
-}
-
-func TestRunMCPConfigCommandsReleaseBeforeSuccessOutput(t *testing.T) {
-	sentinel := errors.New("injected lock release failure")
-	original := lockMCPConfigFile
-	lockMCPConfigFile = func(string) (func() error, error) {
-		return func() error { return sentinel }, nil
-	}
-	t.Cleanup(func() { lockMCPConfigFile = original })
-
-	for _, testCase := range mcpConfigLockCases() {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath := filepath.Join(t.TempDir(), "zero", "config.json")
-			seedMCPConfigLockCase(t, configPath, testCase)
-			var stdout, stderr bytes.Buffer
-			exitCode := runWithDeps(testCase.args, &stdout, &stderr, appDeps{
-				userConfigPath: func() (string, error) { return configPath, nil },
-			})
-			if exitCode != exitCrash || stdout.Len() != 0 || !strings.Contains(stderr.String(), sentinel.Error()) {
-				t.Fatalf("exit=%d stdout=%q stderr=%q, want unlock error before success output", exitCode, stdout.String(), stderr.String())
-			}
-		})
-	}
-}

internal/cli/mcp_tools.go

@@ -31,14 +31,6 @@ type mcpToolListItem struct {
 // into the one-line trust notice (mirroring the hooks and plugins chokepoints);
 // otherwise a workspace whose only project config is MCP would be gated silently.
 func registerMCPToolsForWorkspace(ctx context.Context, workspaceRoot string, registry *tools.Registry, deps appDeps, autonomy mcp.PermissionAutonomy, trustRoot string, runners ...*execution.Runner) (mcpToolRuntime, trustSkip, error) {
-	options := mcp.RegisterOptions{}
-	if len(runners) > 0 {
-		options.Execution = runners[0]
-	}
-	return registerMCPToolsForWorkspaceWithOptions(ctx, workspaceRoot, registry, deps, autonomy, trustRoot, options)
-}
-
-func registerMCPToolsForWorkspaceWithOptions(ctx context.Context, workspaceRoot string, registry *tools.Registry, deps appDeps, autonomy mcp.PermissionAutonomy, trustRoot string, options mcp.RegisterOptions) (mcpToolRuntime, trustSkip, error) {
 	excludeProject, trustCheckErrored := resolveTrust(trustRoot)
 	skip := trustSkip{
 		excludedProjectConfig: excludeProject && projectMCPConfigExists(workspaceRoot),
@@ -55,10 +47,16 @@ func registerMCPToolsForWorkspaceWithOptions(ctx context.Context, workspaceRoot
 	if err != nil {
 		return nil, skip, err
 	}
-	options.PermissionStore = store
-	options.Autonomy = autonomy
-	options.WorkspaceRoot = workspaceRoot
-	runtime, err := deps.registerMCPTools(ctx, registry, cfg, options)
+	var runner *execution.Runner
+	if len(runners) > 0 {
+		runner = runners[0]
+	}
+	runtime, err := deps.registerMCPTools(ctx, registry, cfg, mcp.RegisterOptions{
+		PermissionStore: store,
+		Autonomy:        autonomy,
+		Execution:       runner,
+		WorkspaceRoot:   workspaceRoot,
+	})
 	return runtime, skip, err
 }
 

internal/cli/provider_adoption_test.go

@@ -1,117 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/provideronboarding"
-	"mvdan.cc/sh/v3/shell"
-)
-
-func TestLocalAdoptionSavesAndReloadsEligibleModel(t *testing.T) {
-	const wantModel = "-loaded chat model"
-	requests := make(chan string, 4)
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/v1/models":
-			w.Header().Set("Content-Type", "application/json")
-			_, _ = fmt.Fprintf(w, `{"data":[{"id":"text-embedding-local"},{"id":%q}]}`, wantModel)
-		case "/v1/chat/completions":
-			var body struct {
-				Model string `json:"model"`
-			}
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-				t.Errorf("decode completion request: %v", err)
-				w.WriteHeader(http.StatusBadRequest)
-				return
-			}
-			if r.Header.Get("Authorization") != "" {
-				t.Error("local adoption unexpectedly sent authorization")
-			}
-			select {
-			case requests <- body.Model:
-			default:
-				t.Error("unexpected extra completion requests")
-			}
-			w.Header().Set("Content-Type", "text/event-stream")
-			_, _ = fmt.Fprint(w, "data: {\"choices\":[{\"delta\":{\"content\":\"adoption ok\"},\"finish_reason\":\"stop\"}]}\n\ndata: [DONE]\n\n")
-		default:
-			w.WriteHeader(http.StatusNotFound)
-		}
-	}))
-	defer server.Close()
-	detected := provideronboarding.DetectLocalRuntimes(context.Background(), provideronboarding.LocalDetectOptions{
-		HTTPClient: server.Client(),
-		Candidates: []provideronboarding.LocalRuntime{{CatalogID: "atomic-chat-local", Name: "Atomic Chat Local", DefaultModel: "local-model", BaseURL: server.URL + "/v1"}},
-	})
-	if len(detected) != 1 {
-		t.Fatalf("expected one detected runtime: %+v", detected)
-	}
-	args, err := shell.Fields(detected[0].SetupAction().Command, func(string) string { return "" })
-	if err != nil || len(args) < 4 {
-		t.Fatalf("invalid adoption command: args=%q err=%v", args, err)
-	}
-	root := t.TempDir()
-	run := func(args ...string) string {
-		t.Helper()
-		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer cancel()
-		childArgs := append([]string{"-test.run=^TestLocalAdoptionCLIProcess$", "--"}, args...)
-		cmd := exec.CommandContext(ctx, os.Args[0], childArgs...)
-		cmd.Dir = root
-		cmd.Env = []string{
-			"ZERO_TEST_LOCAL_ADOPTION=1", "ZERO_CRED_STORAGE=encrypted-file",
-			"HOME=" + root, "USERPROFILE=" + root,
-			"XDG_CONFIG_HOME=" + filepath.Join(root, "config"),
-			"XDG_CACHE_HOME=" + filepath.Join(root, "cache"),
-			"XDG_STATE_HOME=" + filepath.Join(root, "state"),
-			"APPDATA=" + filepath.Join(root, "config"),
-			"LOCALAPPDATA=" + filepath.Join(root, "cache"),
-		}
-		for _, key := range []string{"PATH", "SystemRoot", "WINDIR", "TMPDIR", "TEMP", "TMP"} {
-			if value, ok := os.LookupEnv(key); ok {
-				cmd.Env = append(cmd.Env, key+"="+value)
-			}
-		}
-		output, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("CLI %q failed: %v\n%s", args, err, output)
-		}
-		return string(output)
-	}
-	// The mock uses a random port; only override the endpoint, retaining all
-	// generated arguments for the real add parser and persistence path.
-	run(append(args[1:], "--base-url", server.URL+"/v1")...)
-	if output := run("exec", "--cwd", root, "Reply with adoption ok"); !strings.Contains(output, "adoption ok") {
-		t.Fatalf("completion output = %q", output)
-	}
-	select {
-	case model := <-requests:
-		if model != wantModel {
-			t.Fatalf("fresh process sent model %q, want eligible model %q", model, wantModel)
-		}
-	default:
-		t.Fatal("fresh process did not send a completion request")
-	}
-}
-
-func TestLocalAdoptionCLIProcess(t *testing.T) {
-	if os.Getenv("ZERO_TEST_LOCAL_ADOPTION") != "1" {
-		return
-	}
-	for i, arg := range os.Args {
-		if arg == "--" {
-			os.Exit(Run(os.Args[i+1:], os.Stdout, os.Stderr))
-		}
-	}
-	t.Fatal("missing helper argument separator")
-}

internal/cli/provider_detect.go

@@ -40,7 +40,7 @@ type providerDetectReport struct {
 }
 
 // runProvidersDetect probes the machine for running local, OpenAI-compatible
-// model runtimes (Ollama, LM Studio, Atomic Chat) and prints a no-key adopt command for each
+// model runtimes (Ollama, LM Studio) and prints a no-key adopt command for each
 // one it finds, followed by the next-step actions for every already-configured
 // provider. It is the onboarding-advice surface — "what can I do right now?" —
 // and never errors on a machine with nothing running locally (it just reports an
@@ -146,8 +146,6 @@ func formatProviderDetectReport(report providerDetectReport) string {
 		}
 		if command := strings.TrimSpace(runtime.Action.Command); command != "" {
 			lines = append(lines, "    "+runtime.Action.Label+": "+command)
-		} else if detail := strings.TrimSpace(runtime.Action.Detail); detail != "" {
-			lines = append(lines, "    "+runtime.Action.Label+": "+detail)
 		}
 	}
 

internal/cli/provider_detect_test.go

@@ -105,13 +105,3 @@ func TestRunProvidersDetectJSONNoRuntimesActiveProvider(t *testing.T) {
 		t.Fatalf("expected only a Check action for an active keyed provider, got %#v", payload.Providers[0].Actions)
 	}
 }
-
-func TestProviderDetectShowsGuidanceWithoutCommand(t *testing.T) {
-	for _, models := range [][]string{nil, {"local-model"}, {"x&calc"}} {
-		runtime := provideronboarding.DetectedLocalRuntime{LocalRuntime: provideronboarding.LocalRuntime{CatalogID: "atomic-chat-local", Name: "Atomic Chat Local", DefaultModel: "local-model"}, Models: models}
-		out := formatProviderDetectReport(buildProviderDetectReport(config.ResolvedConfig{}, []provideronboarding.DetectedLocalRuntime{runtime}))
-		if strings.Contains(out, "providers add") || !strings.Contains(out, runtime.SetupAction().Detail) {
-			t.Fatalf("missing actionable guidance: %s", out)
-		}
-	}
-}

internal/cli/provider_setup.go

@@ -434,14 +434,6 @@ func providerProfileForAdd(options providerAddOptions) (config.ProviderProfile,
 			catalogHeaders = aimlapi.WithResolvedPartnerHeader(catalogHeaders)
 		}
 	}
-	// Discovery fallback can pass the nonempty catalog placeholder through
-	// either CLI setup path. Never persist it as an Atomic Chat model.
-	if descriptor.ID == "atomic-chat-local" {
-		model := strings.TrimSpace(options.model)
-		if model == "" || model == "local-model" {
-			return config.ProviderProfile{}, fmt.Errorf("provider %q serves a locally loaded model; pass --model <id> (run `zero providers detect` to see the served model)", descriptor.ID)
-		}
-	}
 	profile := config.ProviderProfile{
 		Name:            name,
 		ProviderKind:    providerKindForDescriptor(descriptor),

internal/cli/provider_setup_test.go

@@ -1,12 +1,9 @@
 package cli
 
 import (
-	"strings"
 	"testing"
 
 	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/provideronboarding"
-	"mvdan.cc/sh/v3/shell"
 )
 
 // Regression for issue #555's follow-up: `zero providers check` must not
@@ -69,58 +66,3 @@ func TestValidateProviderRuntimeReadyCustomEndpoint(t *testing.T) {
 		})
 	}
 }
-
-// atomic-chat-local without --model would persist the catalog placeholder
-// "local-model", which the Atomic Chat server never serves, so the first
-// completion fails. Adding it must require a real model instead.
-func TestProviderProfileForAddRequiresModelForAtomicChatLocal(t *testing.T) {
-	if _, err := providerProfileForAdd(providerAddOptions{catalogID: "atomic-chat-local"}); err == nil {
-		t.Fatalf("providerProfileForAdd(atomic-chat-local, no --model) = nil error, want a require-model error")
-	} else if !strings.Contains(err.Error(), "--model") {
-		t.Fatalf("error should tell the user to pass --model, got %v", err)
-	}
-
-	// The interactive wizards and the no-id detect fallback resolve the model to
-	// the catalog DefaultModel and pass it through as a non-empty value, so the
-	// placeholder itself must be rejected, not just an empty --model.
-	if _, err := providerProfileForAdd(providerAddOptions{catalogID: "atomic-chat-local", model: "local-model"}); err == nil {
-		t.Fatalf("providerProfileForAdd(atomic-chat-local, --model local-model) = nil error, want reject of the catalog placeholder")
-	}
-
-	profile, err := providerProfileForAdd(providerAddOptions{catalogID: "atomic-chat-local", model: "unsloth/gemma-4-E2B-it-GGUF"})
-	if err != nil {
-		t.Fatalf("providerProfileForAdd(atomic-chat-local, --model) returned error: %v", err)
-	}
-	if profile.Model != "unsloth/gemma-4-E2B-it-GGUF" {
-		t.Fatalf("profile.Model = %q, want the explicit model", profile.Model)
-	}
-	if profile.Model == "local-model" {
-		t.Fatalf("profile persisted the catalog placeholder")
-	}
-}
-
-func TestDetectedModelActionSurvivesAddParser(t *testing.T) {
-	for _, catalogID := range []string{"atomic-chat-local", "lmstudio", "ollama"} {
-		for _, modelID := range []string{"-loaded-model", "--set-active", "--model", "-loaded model", "ordinary/model", "model with spaces"} {
-			t.Run(catalogID+"/"+modelID, func(t *testing.T) {
-				detected := provideronboarding.DetectedLocalRuntime{
-					LocalRuntime: provideronboarding.LocalRuntime{CatalogID: catalogID, Name: "Local Runtime", DefaultModel: "local-model"},
-					Models:       []string{modelID},
-				}
-				command := detected.SetupAction().Command
-				args, err := shell.Fields(command, func(string) string { return "" })
-				if err != nil || len(args) < 4 {
-					t.Fatalf("invalid adoption command %q: %v", command, err)
-				}
-				options, help, err := parseProviderAddArgs(args[3:])
-				if err != nil || help {
-					t.Fatalf("generated adoption command rejected by add parser: %q: %v", command, err)
-				}
-				profile, err := providerProfileForAdd(options)
-				if err != nil || profile.Model != modelID || !options.setActive || profile.Name != "Local Runtime" {
-					t.Fatalf("adoption changed model or options: model=%q name=%q active=%v err=%v", profile.Model, profile.Name, options.setActive, err)
-				}
-			})
-		}
-	}
-}

internal/cli/root_flag_order_test.go

@@ -1,211 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tui"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// rootFlagOrderings is every ordering of the given flag groups, each group
-// kept intact so a flag stays next to its value.
-func rootFlagOrderings(groups [][]string) [][]string {
-	if len(groups) == 0 {
-		return [][]string{{}}
-	}
-	var orderings [][]string
-	for index, group := range groups {
-		rest := append(append([][]string{}, groups[:index]...), groups[index+1:]...)
-		for _, tail := range rootFlagOrderings(rest) {
-			orderings = append(orderings, append(append([]string{}, group...), tail...))
-		}
-	}
-	return orderings
-}
-
-// ROOT FLAGS COMPOSE IN ANY ORDER. Each leading-flag splitter stops at the first
-// token it does not own, so running them once in a fixed sequence made the
-// order the operator wrote them in load-bearing: `zero --allow-escalation
-// --theme auto` stranded `--theme auto` as an unknown command and exited with
-// an argument error instead of launching. Every ordering of the three root
-// flags, with --skip-permissions-unsafe absent or at any position, has to reach
-// the TUI with all three applied.
-func TestRootFlagsComposeInAnyOrder(t *testing.T) {
-	extra := t.TempDir()
-	resolvedExtra, err := filepath.EvalSymlinks(extra)
-	if err != nil {
-		t.Fatal(err)
-	}
-	groups := [][]string{{"--add-dir", extra}, {"--theme", "auto"}, {"--allow-escalation"}}
-	cases := rootFlagOrderings(groups)
-	cases = append(cases, rootFlagOrderings(append(groups, []string{"--skip-permissions-unsafe"}))...)
-	if len(cases) != 6+24 {
-		t.Fatalf("SETUP INVALID: %d orderings, want 30", len(cases))
-	}
-	for _, args := range cases {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			options := captureTUIOptions(t, args...)
-			wantMode := agent.PermissionModeAsk
-			for _, arg := range args {
-				if arg == "--skip-permissions-unsafe" {
-					wantMode = agent.PermissionModeUnsafe
-				}
-			}
-			if options.PermissionMode != wantMode {
-				t.Errorf("PermissionMode = %q, want %q", options.PermissionMode, wantMode)
-			}
-			if !options.AllowEscalation {
-				t.Error("escalation not enabled")
-			}
-			if options.Theme != "auto" {
-				t.Errorf("Theme = %q, want auto", options.Theme)
-			}
-			if options.AgentOptions.Sandbox == nil {
-				t.Fatal("no sandbox engine on the launched options")
-			}
-			roots := options.AgentOptions.Sandbox.Scope().Roots()
-			found := false
-			for _, root := range roots {
-				if root == resolvedExtra {
-					found = true
-				}
-			}
-			if !found {
-				t.Errorf("scope roots = %v, want the --add-dir root %q", roots, resolvedExtra)
-			}
-		})
-	}
-}
-
-// The last --theme wins even with another root flag between two of them, and a
-// --theme written before --skip-permissions-unsafe reaches the TUI: the unsafe
-// path used to launch with only the theme written after the flag, dropping one
-// written before it.
-func TestRootThemeLastOccurrenceWinsAcrossOtherFlags(t *testing.T) {
-	for _, testCase := range []struct {
-		args []string
-		want string
-	}{
-		{[]string{"--theme", "light", "--allow-escalation", "--theme", "auto"}, "auto"},
-		{[]string{"--theme", "auto", "--skip-permissions-unsafe"}, "auto"},
-		{[]string{"--theme", "light", "--skip-permissions-unsafe", "--theme", "auto"}, "auto"},
-	} {
-		t.Run(strings.Join(testCase.args, " "), func(t *testing.T) {
-			options := captureTUIOptions(t, testCase.args...)
-			if options.Theme != testCase.want {
-				t.Fatalf("Theme = %q, want %q", options.Theme, testCase.want)
-			}
-		})
-	}
-}
-
-// THE ROOT FLAG REACHES EXEC. A --allow-escalation written before the
-// subcommand is forwarded the way --add-dir is, so `zero --allow-escalation -p
-// "..."` runs with the opt-in the help text promises instead of silently
-// without it. The negative control is the same run without the flag, which
-// must not advertise escalate_model.
-func TestRootAllowEscalationForwardsIntoExec(t *testing.T) {
-	for _, testCase := range []struct {
-		name string
-		args []string
-	}{
-		{"exec subcommand", []string{"--allow-escalation", "exec", "say hi"}},
-		{"prompt flag", []string{"--allow-escalation", "-p", "say hi"}},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			if !execAdvertisesEscalateModel(t, testCase.args) {
-				t.Fatalf("%v ran without escalate_model advertised: the root flag was dropped before exec", testCase.args)
-			}
-			if execAdvertisesEscalateModel(t, testCase.args[1:]) {
-				t.Fatalf("%v advertised escalate_model without the flag", testCase.args[1:])
-			}
-		})
-	}
-}
-
-// Everywhere else the flag is rejected loudly rather than discarded, the way
-// --add-dir is: help and version run no agent and could only ignore it.
-func TestRootAllowEscalationIsRejectedWhereNothingConsumesIt(t *testing.T) {
-	for _, args := range [][]string{
-		{"--allow-escalation", "version"},
-		{"--allow-escalation", "help"},
-		{"--allow-escalation", "completions", "bash"},
-	} {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			launched := false
-			exitCode := runWithDeps(args, &stdout, &stderr, appDeps{
-				getwd:  func() (string, error) { return t.TempDir(), nil },
-				runTUI: func(context.Context, tui.Options) int { launched = true; return exitSuccess },
-			})
-			if exitCode == exitSuccess || launched {
-				t.Fatalf("exit = %d launched = %v: the flag was discarded instead of rejected", exitCode, launched)
-			}
-			if !strings.Contains(stderr.String(), "--allow-escalation is only supported for the interactive TUI and exec") {
-				t.Fatalf("stderr does not name the flag: %s", stderr.String())
-			}
-		})
-	}
-}
-
-// execAdvertisesEscalateModel dispatches args through the root command with a
-// provider that records the tools advertised on the first request, and reports
-// whether escalate_model was among them.
-func execAdvertisesEscalateModel(t *testing.T, args []string) bool {
-	t.Helper()
-	isolateCLIUserState(t)
-	provider := &toolListingProvider{}
-	var stdout, stderr bytes.Buffer
-	exitCode := runWithDeps(args, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) { return t.TempDir(), nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return execResolvedConfig(), nil
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			return provider, nil
-		},
-		newSandboxStore: func() (*sandbox.GrantStore, error) {
-			return sandbox.NewGrantStore(sandbox.StoreOptions{FilePath: filepath.Join(t.TempDir(), "sandbox-grants.json")})
-		},
-	})
-	if exitCode != exitSuccess {
-		t.Fatalf("%v: exit = %d, stderr = %s", args, exitCode, stderr.String())
-	}
-	if provider.requests == 0 {
-		t.Fatalf("SETUP INVALID: %v never reached the provider", args)
-	}
-	for _, name := range provider.toolNames {
-		if name == "escalate_model" {
-			return true
-		}
-	}
-	return false
-}
-
-// toolListingProvider answers every request with a one-line text reply and
-// keeps the tool names advertised on the first one.
-type toolListingProvider struct {
-	requests  int
-	toolNames []string
-}
-
-func (provider *toolListingProvider) StreamCompletion(_ context.Context, request zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	provider.requests++
-	if provider.requests == 1 {
-		for _, tool := range request.Tools {
-			provider.toolNames = append(provider.toolNames, tool.Name)
-		}
-	}
-	ch := make(chan zeroruntime.StreamEvent, 2)
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: "hi"}
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventDone}
-	close(ch)
-	return ch, nil
-}

internal/cli/sandbox_degraded_notice_test.go

@@ -1,237 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/mcp"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/tui"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// hostSandboxNotice is the degraded-sandbox line exec prints on THIS machine for
-// a run under the default sandbox policy, or "" where the sandbox is not
-// degraded. Exec tests that expect a quiet stderr compare against it rather than
-// against "": unless a test pins a backend, the run gets the host's own, and a
-// Linux runner without the sandbox helper is degraded where macOS and Windows
-// are not.
-func hostSandboxNotice(t *testing.T) string {
-	t.Helper()
-	engine := sandbox.NewEngine(sandbox.EngineOptions{
-		WorkspaceRoot: t.TempDir(),
-		Policy:        sandbox.DefaultPolicy(),
-		Backend:       sandbox.SelectBackend(sandbox.BackendOptions{}),
-	})
-	notice := engine.DegradedNotice()
-	if notice == "" {
-		return ""
-	}
-	return "[zero] " + notice + "\n"
-}
-
-// clearSandboxNestingMarkers keeps a test that pins the notice from inheriting
-// the nesting markers when the suite itself runs inside a Zero sandbox.
-func clearSandboxNestingMarkers(t *testing.T) {
-	t.Helper()
-	t.Setenv(sandbox.EnvSandboxed, "")
-	t.Setenv(sandbox.EnvSandboxBackend, "")
-}
-
-// unavailableTestSandbox is the backend a Linux box without the helper gets,
-// pinned so a test sees the degraded case on every platform.
-func unavailableTestSandbox(sandbox.BackendOptions) sandbox.Backend {
-	return sandbox.Backend{Name: sandbox.BackendUnavailable, Platform: "linux", Fallback: true, Message: "Linux sandbox helper is not available"}
-}
-
-const unavailableTestSandboxNotice = "[zero] Sandbox enforcement is degraded: Linux sandbox helper is not available. See `zero sandbox policy --effective`.\n"
-
-func runExecWithSandbox(t *testing.T, args []string, backend func(sandbox.BackendOptions) sandbox.Backend, sandboxConfig config.SandboxConfig) (int, string, string) {
-	t.Helper()
-	isolateCLIUserState(t)
-	var stdout, stderr bytes.Buffer
-	cwd := t.TempDir()
-	exitCode := runWithDeps(args, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) { return cwd, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{
-				ActiveProvider: "echo",
-				Provider: config.ProviderProfile{
-					Name:         "echo",
-					ProviderKind: config.ProviderKindOpenAICompatible,
-					BaseURL:      "http://127.0.0.1/v1",
-					Model:        "echo-model",
-				},
-				MaxTurns: 3,
-				Sandbox:  sandboxConfig,
-			}, nil
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			return echoExecProvider{}, nil
-		},
-		selectSandboxBackend: backend,
-	})
-	return exitCode, stdout.String(), stderr.String()
-}
-
-// A RUN THAT GOES AHEAD WITH REDUCED ISOLATION SAYS SO. Before this only `zero
-// doctor` and `zero sandbox policy` did, so `zero exec` ran every tool with the
-// native sandbox effectively off and printed nothing about it. #1041.
-func TestExecSaysOnStderrWhenTheSandboxIsDegraded(t *testing.T) {
-	clearSandboxNestingMarkers(t)
-	exitCode, _, stderr := runExecWithSandbox(t, []string{"exec", "hello"}, unavailableTestSandbox, config.SandboxConfig{})
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, stderr %q", exitCode, stderr)
-	}
-	if stderr != unavailableTestSandboxNotice {
-		t.Fatalf("stderr = %q, want exactly the degraded notice %q", stderr, unavailableTestSandboxNotice)
-	}
-}
-
-// The notice goes to stderr in the JSON modes as well, so stdout stays one JSON
-// object per line for whatever reads it.
-func TestExecKeepsTheDegradedNoticeOffStdoutInJSONMode(t *testing.T) {
-	clearSandboxNestingMarkers(t)
-	exitCode, stdout, stderr := runExecWithSandbox(t, []string{"exec", "--output-format", "json", "hello"}, unavailableTestSandbox, config.SandboxConfig{})
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, stderr %q", exitCode, stderr)
-	}
-	if stderr != unavailableTestSandboxNotice {
-		t.Fatalf("stderr = %q, want exactly the degraded notice", stderr)
-	}
-	for _, line := range strings.Split(strings.TrimSpace(stdout), "\n") {
-		var event map[string]any
-		if err := json.Unmarshal([]byte(line), &event); err != nil {
-			t.Fatalf("stdout carries a line that is not JSON: %q (%v)", line, err)
-		}
-	}
-}
-
-// A sandbox the user turned off is their choice, not a degradation.
-func TestExecSaysNothingWhenTheSandboxIsTurnedOff(t *testing.T) {
-	clearSandboxNestingMarkers(t)
-	off := false
-	exitCode, _, stderr := runExecWithSandbox(t, []string{"exec", "hello"}, unavailableTestSandbox, config.SandboxConfig{Enabled: &off})
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, stderr %q", exitCode, stderr)
-	}
-	if stderr != "" {
-		t.Fatalf("stderr = %q, want nothing for a disabled sandbox", stderr)
-	}
-}
-
-// countingExecProvider is echoExecProvider, counting the completions it streams.
-type countingExecProvider struct {
-	echoExecProvider
-	streamed *int
-}
-
-func (provider countingExecProvider) StreamCompletion(ctx context.Context, request zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	*provider.streamed++
-	return provider.echoExecProvider.StreamCompletion(ctx, request)
-}
-
-// A degraded notice that cannot be written stops the run before the model is
-// asked for anything, as the image and effort notices do, instead of going ahead
-// with reduced isolation and no warning delivered.
-func TestExecStopsWhenTheDegradedNoticeCannotBeWritten(t *testing.T) {
-	clearSandboxNestingMarkers(t)
-	isolateCLIUserState(t)
-	var stdout bytes.Buffer
-	cwd := t.TempDir()
-	streamed := 0
-	exitCode := runWithDeps([]string{"exec", "hello"}, &stdout, failingWriter{}, appDeps{
-		getwd: func() (string, error) { return cwd, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{
-				ActiveProvider: "echo",
-				Provider: config.ProviderProfile{
-					Name:         "echo",
-					ProviderKind: config.ProviderKindOpenAICompatible,
-					BaseURL:      "http://127.0.0.1/v1",
-					Model:        "echo-model",
-				},
-				MaxTurns: 3,
-			}, nil
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			return countingExecProvider{streamed: &streamed}, nil
-		},
-		selectSandboxBackend: unavailableTestSandbox,
-	})
-	if exitCode != exitCrash {
-		t.Fatalf("exit code = %d, want %d when the degraded notice cannot be written", exitCode, exitCrash)
-	}
-	if streamed != 0 {
-		t.Fatalf("the model was asked %d times: the run went ahead without its warning", streamed)
-	}
-}
-
-// launchTUIWithSandbox runs the root command the way a bare `zero` does, with
-// the sandbox backend pinned to the unavailable one, and returns the options the
-// TUI would have started with.
-func launchTUIWithSandbox(t *testing.T, sandboxConfig config.SandboxConfig) tui.Options {
-	t.Helper()
-	isolateCLIUserState(t)
-	var stdout, stderr bytes.Buffer
-	cwd := t.TempDir()
-	var launched tui.Options
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) { return cwd, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{MaxTurns: 12, Sandbox: sandboxConfig}, nil
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			t.Fatal("newProvider should not be called without a resolved provider")
-			return nil, nil
-		},
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return noopMCPRuntime{}, nil
-		},
-		selectSandboxBackend: unavailableTestSandbox,
-		runTUI: func(_ context.Context, options tui.Options) int {
-			launched = options
-			return 0
-		},
-	})
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, stderr %q", exitCode, stderr.String())
-	}
-	return launched
-}
-
-// The TUI shows the same notice when the session opens, taken from the engine
-// its commands run through.
-func TestTUILaunchCarriesTheDegradedNotice(t *testing.T) {
-	clearSandboxNestingMarkers(t)
-	for _, testCase := range []struct {
-		name    string
-		sandbox config.SandboxConfig
-		want    bool
-	}{
-		{name: "degraded", want: true},
-		{name: "turned off", sandbox: config.SandboxConfig{Enabled: func() *bool { off := false; return &off }()}},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			launched := launchTUIWithSandbox(t, testCase.sandbox)
-			var notices []string
-			for _, notice := range launched.StartupNotices {
-				if strings.TrimSpace(notice) != "" {
-					notices = append(notices, notice)
-				}
-			}
-			want := strings.TrimSuffix(strings.TrimPrefix(unavailableTestSandboxNotice, "[zero] "), "\n")
-			if testCase.want && (len(notices) != 1 || notices[0] != want) {
-				t.Fatalf("StartupNotices = %q, want exactly %q", notices, want)
-			}
-			if !testCase.want && len(notices) != 0 {
-				t.Fatalf("StartupNotices = %q, want none", notices)
-			}
-		})
-	}
-}

internal/cli/serve_test.go

@@ -168,18 +168,11 @@ func TestBuildServeScopeKeepsLexicalPaths(t *testing.T) {
 	}
 	linkWorkspace := filepath.Join(base, "link-workspace")
 	linkExtra := filepath.Join(base, "link-extra")
-	// SKIPPED, NOT FAILED, WHEN THE PLATFORM WILL NOT MAKE THE LINK. Creating a
-	// symlink on Windows needs SeCreateSymbolicLinkPrivilege, which an ordinary
-	// developer account does not hold, so this reported a failure with nothing
-	// wrong in the code: "A required privilege is not held by the client". CI
-	// runners are elevated, so it only ever showed up locally, where it cost a
-	// round of triage before being ruled environmental. The sibling tests that
-	// need a link already answer this way.
 	if err := os.Symlink(realWorkspace, linkWorkspace); err != nil {
-		t.Skipf("symlink unavailable: %v", err)
+		t.Fatal(err)
 	}
 	if err := os.Symlink(realExtra, linkExtra); err != nil {
-		t.Skipf("symlink unavailable: %v", err)
+		t.Fatal(err)
 	}
 
 	scope, err := buildServeScope(linkWorkspace, []string{linkExtra})

internal/cli/setup.go

@@ -42,7 +42,7 @@ func runSetup(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) i
 		return exitSuccess
 	}
 	if strings.TrimSpace(options.catalogID) == "" {
-		return runInteractiveTUIWithSetup(stderr, deps, "", nil, "", true, false)
+		return runInteractiveTUIWithSetup(stderr, deps, "", nil, "", true)
 	}
 
 	result, err := saveSetupProvider(deps, tui.SetupSelection{

internal/cli/setup_test.go

@@ -367,14 +367,3 @@ func TestVerifySetupProviderDistinguishesMissingFromRejectedKey(t *testing.T) {
 		t.Fatal("a keyless local provider should still be probed")
 	}
 }
-
-func TestSaveSetupProviderRejectsAtomicPlaceholderBeforeConfigAccess(t *testing.T) {
-	for _, model := range []string{"", "local-model", " local-model "} {
-		accessed := false
-		deps := appDeps{userConfigPath: func() (string, error) { accessed = true; return filepath.Join(t.TempDir(), "config.json"), nil }}
-		_, err := saveSetupProvider(deps, tui.SetupSelection{CatalogID: "atomic-chat-local", Model: model}, setupSaveOptions{})
-		if err == nil || !strings.Contains(err.Error(), "--model") || accessed {
-			t.Fatalf("invalid model %q reached config access: accessed=%v err=%v", model, accessed, err)
-		}
-	}
-}

internal/cli/summarizer.go

@@ -1,17 +0,0 @@
-package cli
-
-import (
-	"context"
-
-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/providers"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// summarizerFactory adapts the resolved profile and the authenticated provider
-// builder into agent.Options.Summarizer; the selection rules live in
-// providers.CompactionSummarizerFactory, shared with the TUI.
-func summarizerFactory(resolved config.ResolvedConfig, newProvider func(config.ProviderProfile) (zeroruntime.Provider, error)) func(context.Context, string) (agent.Provider, error) {
-	return providers.CompactionSummarizerFactory(resolved.Provider, resolved.Preferences.CompactionModel, newProvider)
-}

internal/cli/tui_escalation_test.go

@@ -1,126 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/tui"
-)
-
-// captureTUIOptions runs the root command with the TUI launch intercepted, and
-// returns the options the interactive session would have started with.
-func captureTUIOptions(t *testing.T, args ...string) tui.Options {
-	t.Helper()
-	isolateCLIUserState(t)
-	var captured tui.Options
-	var stdout, stderr bytes.Buffer
-	workspace := t.TempDir()
-	exitCode := runWithDeps(args, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) { return workspace, nil },
-		runTUI: func(_ context.Context, options tui.Options) int {
-			captured = options
-			return exitSuccess
-		},
-	})
-	if exitCode != exitSuccess {
-		t.Fatalf("exitCode = %d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-	return captured
-}
-
-func hasEscalateModel(options tui.Options) bool {
-	if options.AgentOptions.Registry == nil {
-		return false
-	}
-	_, registered := options.AgentOptions.Registry.Get("escalate_model")
-	return registered
-}
-
-// ESCALATION IS OFF UNLESS THE OPERATOR ASKS FOR IT.
-//
-// Escalation moves a run onto a different model, changing what it costs and which
-// provider sees the conversation, so the interactive surface answers this the same
-// conservative way `zero exec --allow-escalation` already does.
-func TestInteractiveTUIRegistersEscalateModelOnlyWithTheFlag(t *testing.T) {
-	if hasEscalateModel(captureTUIOptions(t)) {
-		t.Error("escalate_model was registered without --allow-escalation")
-	}
-	if !hasEscalateModel(captureTUIOptions(t, "--allow-escalation")) {
-		t.Error("--allow-escalation did not register escalate_model")
-	}
-}
-
-// THE TOOL AND THE SWITCHERS ARE ONE FEATURE, NOT TWO.
-//
-// This is the failure the whole change exists to avoid. The agent loop performs a
-// switch only when a switcher is wired, so registering escalate_model without
-// wiring one ships a tool the model can call and the loop will silently ignore:
-// the run reports an escalation that never happened. The reverse is merely dead
-// code. Both halves ride on the same flag and this asserts they cannot be
-// separated, whichever half a future change touches.
-func TestInteractiveTUIEscalationToolAndSwitchersAreWiredTogether(t *testing.T) {
-	for _, testCase := range []struct {
-		name string
-		args []string
-		want bool
-	}{
-		{name: "default", args: nil, want: false},
-		{name: "flagged", args: []string{"--allow-escalation"}, want: true},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			options := captureTUIOptions(t, testCase.args...)
-			if got := hasEscalateModel(options); got != testCase.want {
-				t.Fatalf("escalate_model registered = %v, want %v", got, testCase.want)
-			}
-			if options.AllowEscalation != testCase.want {
-				t.Errorf("AllowEscalation = %v, want %v: the tool is registered on one gate and the switchers on another, so they can drift apart",
-					options.AllowEscalation, testCase.want)
-			}
-		})
-	}
-}
-
-// The flag is accepted on either side of --skip-permissions-unsafe, like the
-// other root flags that may appear there.
-func TestInteractiveTUIAcceptsAllowEscalationAroundUnsafe(t *testing.T) {
-	for _, args := range [][]string{
-		{"--allow-escalation", "--skip-permissions-unsafe"},
-		{"--skip-permissions-unsafe", "--allow-escalation"},
-	} {
-		options := captureTUIOptions(t, args...)
-		if !options.AllowEscalation {
-			t.Errorf("%v did not enable escalation", args)
-		}
-		if !hasEscalateModel(options) {
-			t.Errorf("%v did not register escalate_model", args)
-		}
-	}
-}
-
-// An =value form is a loud error rather than a silent enable, so a mistyped
-// --allow-escalation=false cannot turn the feature ON.
-func TestAllowEscalationRejectsAValue(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"--allow-escalation=false"}, &stdout, &stderr, appDeps{
-		getwd:  func() (string, error) { return t.TempDir(), nil },
-		runTUI: func(context.Context, tui.Options) int { return exitSuccess },
-	})
-	if exitCode == exitSuccess {
-		t.Fatal("--allow-escalation=false was accepted; a mistyped disable must not silently enable escalation")
-	}
-	if !strings.Contains(stderr.String(), "--allow-escalation takes no value") {
-		t.Errorf("stderr does not explain the flag: %s", stderr.String())
-	}
-}
-
-func TestRootHelpDocumentsAllowEscalation(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	if exitCode := runWithDeps([]string{"--help"}, &stdout, &stderr, appDeps{}); exitCode != exitSuccess {
-		t.Fatalf("exitCode = %d stderr=%s", exitCode, stderr.String())
-	}
-	if !strings.Contains(stdout.String(), "--allow-escalation") {
-		t.Error("the root help does not mention --allow-escalation, so the flag is undiscoverable")
-	}
-}

internal/cli/user_state_isolation_test.go

@@ -1,143 +0,0 @@
-package cli
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/config"
-)
-
-// userStateEnvNames is every per-user base directory the root command can
-// resolve against, across platforms. One throwaway root behind all of them
-// lands the resolution inside it whichever branch it takes.
-var userStateEnvNames = []string{
-	"HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA",
-	"XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME",
-}
-
-// isolateCLIUserState points every user-scoped path the root command touches at
-// throwaway directories, and keeps credential work off the host keyring.
-//
-// A TEMPORARY WORKING DIRECTORY IS NOT ISOLATION. runWithDeps fills the
-// dependencies a test leaves out with the production ones, and the launch paths
-// read user config, open stores, refresh the models.dev cache and, for an
-// interactive run, migrate any inline plaintext API key into the credential
-// store before they ever reach an injected callback. Without this, running these
-// tests on a developer machine rewrites that developer's config.json and moves
-// their key into their keychain, makes a real network call, and reports results
-// that depend on whatever providers, MCP servers and plugins that machine has.
-func isolateCLIUserState(t *testing.T) {
-	t.Helper()
-	root := t.TempDir()
-	for _, name := range userStateEnvNames {
-		t.Setenv(name, root)
-	}
-	// The models.dev overlay cache, and the background refresh that writes it:
-	// a wiring test has no business making a network call or leaving a cache
-	// file behind.
-	t.Setenv("ZERO_MODELS_CACHE_PATH", filepath.Join(root, "modelsdev.json"))
-	t.Setenv("ZERO_DISABLE_MODELS_FETCH", "1")
-	// Credentials resolve keyring-first. This keeps a migrated key in a file
-	// under the fixture root rather than in the developer's OS keychain.
-	t.Setenv("ZERO_CRED_STORAGE", "encrypted-file")
-}
-
-// AND THE ISOLATION IS ITSELF PINNED, ONE HELPER AT A TIME. A seeded config
-// outside the helper fixture roots stands in for a developer's real one: the
-// launch helper must leave it exactly as it found it, inline API key included,
-// must not write a credential file beside it, and must have moved the per-user
-// paths off that root before running anything.
-//
-// EACH HELPER GETS ITS OWN SUBTEST because t.Setenv restores at the end of the
-// test, not when the helper returns: exercising both in one test would let the
-// first helper isolation cover for a second helper that had none.
-func TestCLILaunchHelpersLeaveUserStateAlone(t *testing.T) {
-	for _, testCase := range []struct {
-		name     string
-		exercise func(*testing.T)
-	}{
-		{"captureTUIOptions", func(t *testing.T) { _ = captureTUIOptions(t, "--allow-escalation") }},
-		{"execAdvertisesEscalateModel", func(t *testing.T) {
-			_ = execAdvertisesEscalateModel(t, []string{"--allow-escalation", "exec", "say hi"})
-		}},
-		{"runExecWithSandbox", func(t *testing.T) {
-			_, _, _ = runExecWithSandbox(t, []string{"exec", "hello"}, unavailableTestSandbox, config.SandboxConfig{})
-		}},
-		{"launchTUIWithSandbox", func(t *testing.T) { _ = launchTUIWithSandbox(t, config.SandboxConfig{}) }},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			seedRoot, configPath, seeded, before := seedEmulatedUserConfig(t)
-
-			testCase.exercise(t)
-
-			after, err := os.ReadFile(configPath)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if string(after) != string(seeded) {
-				t.Errorf("the seeded user config was rewritten:\n before: %s\n  after: %s", seeded, after)
-			}
-			entries, err := os.ReadDir(filepath.Dir(configPath))
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(entries) != len(before) {
-				names := []string{}
-				for _, entry := range entries {
-					names = append(names, entry.Name())
-				}
-				t.Errorf("the user config directory gained entries: %v", names)
-			}
-
-			// The checks above catch what this platform happens to write. This
-			// one catches the missing isolation itself, so a startup path that
-			// writes somewhere else, or only sometimes, is covered too.
-			resolved, err := config.DefaultUserConfigPath()
-			if err != nil {
-				t.Fatal(err)
-			}
-			if strings.HasPrefix(resolved, seedRoot) {
-				t.Errorf("user config still resolves inside the seeded root (%s): the helper installed no isolation", resolved)
-			}
-			if os.Getenv("ZERO_DISABLE_MODELS_FETCH") == "" {
-				t.Error("the helper left the background models.dev refresh enabled, so this test can make a network call and write a cache file")
-			}
-			if os.Getenv("ZERO_CRED_STORAGE") == "" {
-				t.Error("the helper left credential storage resolving keyring-first, so a migrated key can reach the host keychain")
-			}
-		})
-	}
-}
-
-// seedEmulatedUserConfig points the per-user base directories at a throwaway
-// root and writes a config carrying an inline plaintext API key there, which is
-// what the startup migration rewrites. It returns that root, the config path,
-// its bytes, and the directory listing to compare against.
-func seedEmulatedUserConfig(t *testing.T) (string, string, []byte, []os.DirEntry) {
-	t.Helper()
-	seedRoot := t.TempDir()
-	for _, name := range userStateEnvNames {
-		t.Setenv(name, seedRoot)
-	}
-	configPath, err := config.DefaultUserConfigPath()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasPrefix(configPath, seedRoot) {
-		t.Fatalf("SETUP INVALID: user config resolved to %q, outside the seeded root %q", configPath, seedRoot)
-	}
-	if err := os.MkdirAll(filepath.Dir(configPath), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	seeded := []byte(`{"providers":[{"name":"anthropic","providerKind":"anthropic","model":"claude-haiku-4.5","apiKey":"sk-seeded-plaintext-key"}]}`)
-	if err := os.WriteFile(configPath, seeded, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	before, err := os.ReadDir(filepath.Dir(configPath))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return seedRoot, configPath, seeded, before
-}

internal/config/concurrent_writer_test.go

@@ -1,396 +0,0 @@
-package config
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-func readTestConfig(t *testing.T, path string) FileConfig {
-	t.Helper()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-	cfg := FileConfig{}
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		t.Fatalf("invalid config JSON after concurrent writes: %v\n%s", err, data)
-	}
-	return cfg
-}
-
-func seedTestConfig(t *testing.T, path string) {
-	t.Helper()
-	if _, err := UpsertProvider(path, ProviderProfile{Name: "seed", Model: "seed-model"}, true); err != nil {
-		t.Fatalf("seed config: %v", err)
-	}
-}
-
-// TestConcurrentMutationsDoNotLoseUpdates is the issue #832 regression. Each
-// mutator loads the whole document, edits one field, and publishes a complete
-// replacement by rename. Without a lock spanning load-through-publish, two
-// writers that loaded the same revision both write a full document and the
-// second rename silently discards the first one's acknowledged update.
-//
-// Every mutation below touches an INDEPENDENT field, so a correct
-// implementation ends with all of them present. A lost update shows up as a
-// zero value in exactly one of the fields, with valid JSON either way — which
-// is what made the bug silent.
-func TestConcurrentMutationsDoNotLoseUpdates(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	mutations := []struct {
-		name  string
-		apply func() error
-		check func(FileConfig) error
-	}{
-		{
-			name:  "theme",
-			apply: func() error { _, err := SetTheme(path, "dracula"); return err },
-			check: func(cfg FileConfig) error {
-				if cfg.Preferences.Theme != "dracula" {
-					return fmt.Errorf("theme = %q, want dracula", cfg.Preferences.Theme)
-				}
-				return nil
-			},
-		},
-		{
-			name:  "pet",
-			apply: func() error { _, err := SetPet(path, "otter"); return err },
-			check: func(cfg FileConfig) error {
-				if cfg.Preferences.Pet != "otter" {
-					return fmt.Errorf("pet = %q, want otter", cfg.Preferences.Pet)
-				}
-				return nil
-			},
-		},
-		{
-			name:  "recaps",
-			apply: func() error { _, err := SetRecapsEnabled(path, true); return err },
-			check: func(cfg FileConfig) error {
-				if cfg.Preferences.Recaps == nil || !*cfg.Preferences.Recaps {
-					return fmt.Errorf("recaps = %v, want true", cfg.Preferences.Recaps)
-				}
-				return nil
-			},
-		},
-		{
-			name:  "favorites",
-			apply: func() error { _, err := SetFavoriteModels(path, []string{"fav-model"}); return err },
-			check: func(cfg FileConfig) error {
-				if len(cfg.Preferences.FavoriteModels) != 1 || cfg.Preferences.FavoriteModels[0] != "fav-model" {
-					return fmt.Errorf("favorites = %v, want [fav-model]", cfg.Preferences.FavoriteModels)
-				}
-				return nil
-			},
-		},
-		{
-			name: "provider",
-			apply: func() error {
-				_, err := UpsertProvider(path, ProviderProfile{Name: "added", Model: "added-model"}, false)
-				return err
-			},
-			check: func(cfg FileConfig) error {
-				for _, provider := range cfg.Providers {
-					if provider.Name == "added" {
-						return nil
-					}
-				}
-				return fmt.Errorf("provider %q missing from %d providers", "added", len(cfg.Providers))
-			},
-		},
-	}
-
-	// SetPet edits the raw bytes rather than round-tripping the struct, so it is
-	// included deliberately: it must take the same lock as the struct writers or
-	// it would clobber, and be clobbered by, everything else.
-	errs := make([]error, len(mutations))
-	start := make(chan struct{})
-	var wg sync.WaitGroup
-	for index, mutation := range mutations {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			<-start
-			errs[index] = mutation.apply()
-		}()
-	}
-	close(start)
-	wg.Wait()
-
-	for index, err := range errs {
-		if err != nil {
-			t.Fatalf("%s mutation failed: %v", mutations[index].name, err)
-		}
-	}
-	cfg := readTestConfig(t, path)
-	for _, mutation := range mutations {
-		if err := mutation.check(cfg); err != nil {
-			t.Errorf("%s update was lost: %v", mutation.name, err)
-		}
-	}
-	if cfg.ActiveProvider != "seed" {
-		t.Errorf("activeProvider = %q, want the seeded value preserved", cfg.ActiveProvider)
-	}
-}
-
-// TestConcurrentSameFieldMutationsSerialize proves the lock serializes writers
-// that contend on ONE field: every call must succeed and the file must end with
-// exactly one of the written values, never a merged or truncated document.
-func TestConcurrentSameFieldMutationsSerialize(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	const writers = 24
-	errs := make([]error, writers)
-	start := make(chan struct{})
-	var wg sync.WaitGroup
-	for index := range writers {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			<-start
-			_, errs[index] = SetTheme(path, fmt.Sprintf("theme-%02d", index))
-		}()
-	}
-	close(start)
-	wg.Wait()
-
-	for index, err := range errs {
-		if err != nil {
-			t.Fatalf("writer %d failed: %v", index, err)
-		}
-	}
-	cfg := readTestConfig(t, path)
-	if !strings.HasPrefix(cfg.Preferences.Theme, "theme-") {
-		t.Fatalf("theme = %q, want one of the written values", cfg.Preferences.Theme)
-	}
-}
-
-// TestConcurrentProviderUpsertsAllSurvive is the shape the issue describes most
-// directly: N distinct providers added at once. Each add is an independent
-// successful mutation, so all N must be present afterwards.
-func TestConcurrentProviderUpsertsAllSurvive(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	const providers = 16
-	errs := make([]error, providers)
-	start := make(chan struct{})
-	var wg sync.WaitGroup
-	for index := range providers {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			<-start
-			_, errs[index] = UpsertProvider(path, ProviderProfile{
-				Name:  fmt.Sprintf("provider-%02d", index),
-				Model: fmt.Sprintf("model-%02d", index),
-			}, false)
-		}()
-	}
-	close(start)
-	wg.Wait()
-
-	for index, err := range errs {
-		if err != nil {
-			t.Fatalf("upsert %d failed: %v", index, err)
-		}
-	}
-	cfg := readTestConfig(t, path)
-	present := map[string]string{}
-	for _, provider := range cfg.Providers {
-		present[provider.Name] = provider.Model
-	}
-	for index := range providers {
-		name := fmt.Sprintf("provider-%02d", index)
-		want := fmt.Sprintf("model-%02d", index)
-		if got, ok := present[name]; !ok {
-			t.Errorf("provider %s was lost (config holds %d providers)", name, len(cfg.Providers))
-		} else if got != want {
-			t.Errorf("provider %s model = %q, want %q", name, got, want)
-		}
-	}
-}
-
-// TestCrossProcessMutationExcludesAndPreserves is the coordinated two-process
-// test the issue asks for. Goroutines share this process's descriptors, so only
-// a second OS process shows the lock is held by the kernel rather than by
-// in-process state.
-//
-// The child announces itself and then mutates; the parent holds the lock across
-// that window and asserts the child's write CANNOT land, then does its own
-// mutation and releases. Both updates must survive. The exclusion window is
-// what makes this deterministic in the passing direction: with the lock held,
-// the child is blocked in its retry loop and the theme provably stays unset.
-func TestCrossProcessMutationExcludesAndPreserves(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	unlock, err := lockConfigFile(path)
-	if err != nil {
-		t.Fatalf("acquire lock: %v", err)
-	}
-	released := false
-	release := func() {
-		if !released {
-			released = true
-			unlock()
-		}
-	}
-	defer release()
-
-	child := exec.Command(os.Args[0], "-test.run=^TestConfigConcurrentHelperProcess$")
-	child.Env = append(os.Environ(),
-		"ZERO_CONFIG_CONCURRENT_HELPER=1",
-		"ZERO_CONFIG_CONCURRENT_PATH="+path,
-	)
-	stdout, err := child.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := child.Start(); err != nil {
-		t.Fatalf("start helper: %v", err)
-	}
-	defer func() {
-		if child.ProcessState == nil {
-			_ = child.Process.Kill()
-			_ = child.Wait()
-		}
-	}()
-
-	ready := make([]byte, len("ready\n"))
-	if _, err := io.ReadFull(stdout, ready); err != nil {
-		t.Fatalf("helper never signalled ready: %v", err)
-	}
-
-	// The child is now live and contending for a lock this process holds. Its
-	// write must not appear while we hold it.
-	for range 20 {
-		if theme := readTestConfig(t, path).Preferences.Theme; theme != "" {
-			t.Fatalf("child wrote %q while the lock was held elsewhere; mutations are not excluded", theme)
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-
-	if _, err := upsertProviderLocked(path, ProviderProfile{Name: "parent", Model: "parent-model"}, false); err != nil {
-		t.Fatalf("parent mutation: %v", err)
-	}
-	release()
-
-	if err := child.Wait(); err != nil {
-		t.Fatalf("helper process failed: %v", err)
-	}
-
-	cfg := readTestConfig(t, path)
-	if cfg.Preferences.Theme != "child-theme" {
-		t.Errorf("child update was lost: theme = %q, want child-theme", cfg.Preferences.Theme)
-	}
-	found := false
-	for _, provider := range cfg.Providers {
-		if provider.Name == "parent" {
-			found = true
-		}
-	}
-	if !found {
-		t.Errorf("parent update was lost: provider %q missing from %d providers", "parent", len(cfg.Providers))
-	}
-}
-
-// TestConfigConcurrentHelperProcess is the child half of the cross-process
-// test. It is skipped unless the parent selected it through the environment.
-func TestConfigConcurrentHelperProcess(t *testing.T) {
-	if os.Getenv("ZERO_CONFIG_CONCURRENT_HELPER") == "" {
-		t.Skip("helper process for TestCrossProcessMutationExcludesAndPreserves")
-	}
-	path := os.Getenv("ZERO_CONFIG_CONCURRENT_PATH")
-	if path == "" {
-		t.Fatal("ZERO_CONFIG_CONCURRENT_PATH is required")
-	}
-	// Announce BEFORE contending, so the parent's exclusion window starts with
-	// this process already running rather than still being forked.
-	fmt.Println("ready")
-	if _, err := SetTheme(path, "child-theme"); err != nil {
-		t.Fatalf("child mutation: %v", err)
-	}
-}
-
-// TestMutationReportsUnlockFailure pins the AGENTS.md rule that a mutator must
-// never report success when unlock failed. A failed release can leave the lock
-// held for the rest of the process, so returning (cfg, nil) after one would
-// claim a state the next mutation cannot reproduce.
-//
-// lockutil.Release is idempotent and reports nil once released, so a real
-// release failure cannot be provoked through the public API — hence the seam.
-// The mutation itself must still have been published: the release failure
-// annotates the result, it does not undo the write.
-func TestMutationReportsUnlockFailure(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	releaseErr := errors.New("release exploded")
-	original := lockConfigFileFn
-	t.Cleanup(func() { lockConfigFileFn = original })
-	lockConfigFileFn = func(p string) (func() error, error) {
-		unlock, err := original(p)
-		if err != nil {
-			return nil, err
-		}
-		return func() error {
-			_ = unlock()
-			return releaseErr
-		}, nil
-	}
-
-	cfg, err := SetTheme(path, "dracula")
-	if !errors.Is(err, releaseErr) {
-		t.Fatalf("SetTheme err = %v, want it to carry the release failure", err)
-	}
-	if cfg.Preferences.Theme != "dracula" {
-		t.Errorf("returned config lost the mutation: theme = %q", cfg.Preferences.Theme)
-	}
-	if got := readTestConfig(t, path).Preferences.Theme; got != "dracula" {
-		t.Errorf("mutation was not published despite only the release failing: theme = %q", got)
-	}
-}
-
-// TestMutationErrorSurvivesUnlockFailure proves the two errors are joined
-// rather than chosen between: a release failure must not mask the mutation
-// error that actually explains what went wrong.
-func TestMutationErrorSurvivesUnlockFailure(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	seedTestConfig(t, path)
-
-	releaseErr := errors.New("release exploded")
-	original := lockConfigFileFn
-	t.Cleanup(func() { lockConfigFileFn = original })
-	lockConfigFileFn = func(p string) (func() error, error) {
-		unlock, err := original(p)
-		if err != nil {
-			return nil, err
-		}
-		return func() error {
-			_ = unlock()
-			return releaseErr
-		}, nil
-	}
-
-	// An unknown provider is the mutation error; the release failure is joined
-	// onto it, and neither one disappears.
-	_, err := SetActiveProvider(path, "definitely-not-configured")
-	if !errors.Is(err, releaseErr) {
-		t.Fatalf("err = %v, want it to carry the release failure", err)
-	}
-	if !strings.Contains(err.Error(), "definitely-not-configured") {
-		t.Fatalf("err = %v, want it to still name the missing provider", err)
-	}
-}

internal/config/credentials.go

@@ -2,7 +2,6 @@ package config
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -81,21 +80,12 @@ func ForgetProviderKey(provider string) (bool, error) {
 // config at path, so credential checks no longer claim a stored key after one is
 // removed. No-op when path/provider is empty, the config is absent, or the marker
 // is already unset.
-func ClearProviderKeyStored(path, provider string) (cleared bool, err error) {
+func ClearProviderKeyStored(path, provider string) (bool, error) {
 	path = strings.TrimSpace(path)
 	provider = strings.TrimSpace(provider)
 	if path == "" || provider == "" {
 		return false, nil
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return false, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -126,22 +116,11 @@ func ClearProviderKeyStored(path, provider string) (cleared bool, err error) {
 // leaves the plaintext key in place and never strands a credential. Returns how
 // many keys were migrated; a no-op (0, nil) when path is empty/absent or nothing
 // needs migrating. Safe to run on every startup (idempotent).
-func MigratePlaintextProviderKeys(path string, store APIKeySetter) (count int, err error) {
+func MigratePlaintextProviderKeys(path string, store APIKeySetter) (int, error) {
 	path = strings.TrimSpace(path)
 	if path == "" || store == nil {
 		return 0, nil
 	}
-	// This runs on every startup, so it is the most likely writer to be racing
-	// an interactive mutation in another Zero process.
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return 0, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {

internal/config/credentials_test.go

@@ -257,21 +257,6 @@ func TestProviderProfileMissingCredentialEnv(t *testing.T) {
 			profile: ProviderProfile{Name: "local", CatalogID: "ollama"},
 			want:    false,
 		},
-		{
-			// A profile saved against the hosted atomic-chat preset keeps its
-			// remote base URL and key, so it must still be reported as missing a
-			// credential. The keyless local runtime is a separate catalog ID
-			// (atomic-chat-local) precisely so this identity is never repurposed.
-			name:    "hosted atomic-chat profile still requires its key",
-			profile: ProviderProfile{Name: "atomic-chat", CatalogID: "atomic-chat", BaseURL: "https://api.atomic.chat/v1"},
-			wantEnv: "ATOMIC_CHAT_API_KEY",
-			want:    true,
-		},
-		{
-			name:    "local atomic chat runtime needs no credential",
-			profile: ProviderProfile{Name: "atomic-local", CatalogID: "atomic-chat-local"},
-			want:    false,
-		},
 		{
 			name:    "credential resolved via inline key",
 			profile: ProviderProfile{Name: "openai", ProviderKind: ProviderKindOpenAI, APIKey: "sk-test"},

internal/config/export_test.go

@@ -3,7 +3,6 @@ package config
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -42,7 +41,7 @@ func ValidateFile(path string) (FileConfig, []Issue) {
 // SetProviderDescription sets a provider's description VERBATIM — including to
 // empty. The generic UpsertProvider merge treats empty fields as "leave
 // unchanged", so clearing a description needs this dedicated setter.
-func SetProviderDescription(path string, name string, description string) (result FileConfig, err error) {
+func SetProviderDescription(path string, name string, description string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
@@ -51,17 +50,6 @@ func SetProviderDescription(path string, name string, description string) (resul
 	if name == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
 	}
-	// Locks like the production mutators so this seam can stand in for one in a
-	// concurrency test rather than being the one unsynchronized writer.
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 
 	data, err := os.ReadFile(path)
 	if err != nil {

internal/config/json_object_edit.go

@@ -244,86 +244,6 @@ func petJSONObject(encodedPet []byte) []byte {
 	return append(result, '}')
 }
 
-// setNotifyJSONObject replaces only the notify member's value, keeping the
-// original bytes of every unrelated member so a notification save cannot
-// reorder, reformat, or drop the user's other settings — including values whose
-// EXPLICIT presence matters (tools.deferThreshold: 0, mcp servers'
-// disabled: false) and keys the typed FileConfig does not model at all. The
-// typed serializer cannot round-trip explicit zeros (omitempty drops them), so
-// notification writes go through this byte-preserving editor instead
-// (maintainer review, PR #1001). An empty notify block removes the member
-// entirely so a reset leaves no `"notify": {}` husk behind.
-//
-// A hand-edited file may contain DUPLICATE notify members. Go's decoder
-// MERGES the fields of duplicate object members into the same struct, so an
-// earlier duplicate's field survives a replacement that omits it — e.g.
-// {"notify":{"mode":"off"},"notify":{"focusMode":"focused"}} + a
-// replacement {"focusMode":"always"} would leave mode "off" effective.
-// The nonempty path therefore removes EVERY duplicate and inserts the
-// replacement fresh (full-replace semantics: nothing inherited), and the
-// reset path removes every member the same way. UpdateNotify's partial
-// merge is unaffected: it seeds omitted fields from the stored value BEFORE
-// calling this editor, so the value it passes is already complete.
-// Mirrors setPetPreferenceJSON's duplicate handling.
-func setNotifyJSONObject(data []byte, notify NotifyConfig) ([]byte, error) {
-	encoded, err := json.Marshal(notify)
-	if err != nil {
-		return nil, fmt.Errorf("encode notify preference: %w", err)
-	}
-
-	rootStart := skipJSONSpace(data, 0)
-	root, err := parseJSONObject(data, rootStart)
-	if err != nil {
-		return nil, err
-	}
-	notifyIndex := lastJSONMember(root.members, "notify")
-	// Count duplicates: the ordinary file has exactly one notify member, and
-	// for it a positional replace keeps the key where the user put it and
-	// preserves their formatting (byte-preserving contract). The
-	// remove-all-and-reinsert path below is ONLY for files that actually
-	// contain duplicates, where Go's field-merging decode would otherwise let
-	// an earlier block's fields leak into the replacement.
-	duplicates := 0
-	for _, member := range root.members {
-		if member.key == "notify" {
-			duplicates++
-		}
-	}
-	if string(encoded) == "{}" {
-		for notifyIndex >= 0 {
-			data = removeJSONMember(data, root, notifyIndex)
-			rootStart = skipJSONSpace(data, 0)
-			root, err = parseJSONObject(data, rootStart)
-			if err != nil {
-				return nil, err
-			}
-			notifyIndex = lastJSONMember(root.members, "notify")
-		}
-		return data, nil
-	}
-	if duplicates <= 1 {
-		if notifyIndex < 0 {
-			return insertJSONMember(data, root, "notify", encoded), nil
-		}
-		// Single member: replace its value in place — no key movement, no
-		// reformatting of the surrounding bytes.
-		return replaceJSONRange(data, root.members[notifyIndex].valueStart, root.members[notifyIndex].valueEnd, encoded), nil
-	}
-	// Multiple duplicates: Go merges their fields at decode time, so the
-	// replacement must not inherit anything — remove every duplicate and
-	// insert the complete value fresh.
-	for notifyIndex >= 0 {
-		data = removeJSONMember(data, root, notifyIndex)
-		rootStart = skipJSONSpace(data, 0)
-		root, err = parseJSONObject(data, rootStart)
-		if err != nil {
-			return nil, err
-		}
-		notifyIndex = lastJSONMember(root.members, "notify")
-	}
-	return insertJSONMember(data, root, "notify", encoded), nil
-}
-
 func replaceJSONRange(data []byte, start, end int, replacement []byte) []byte {
 	result := make([]byte, 0, len(data)-(end-start)+len(replacement))
 	result = append(result, data[:start]...)

internal/config/lock.go

@@ -1,94 +0,0 @@
-package config
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/lockutil"
-)
-
-// ErrLockUnavailable reports that the config lock was still held by another
-// process (or goroutine) when configLockTimeout expired. A caller that would
-// otherwise make a SECOND config write after a failed one branches on this: the
-// lock has not been released, so the second attempt can only spend another full
-// timeout to fail the same way, turning one keystroke into two stalls.
-var ErrLockUnavailable = errors.New("config lock unavailable")
-
-const (
-	configLockTimeout    = 10 * time.Second
-	configLockRetryDelay = 20 * time.Millisecond
-)
-
-// lockConfigFile serializes a config read-modify-write across processes.
-//
-// Every mutator in this package loads the whole document, edits independent
-// fields, and publishes a complete replacement by rename. The rename is atomic,
-// so a reader never sees partial JSON — but two processes that both loaded the
-// same revision each write a full document, and the second rename silently
-// discards the first one's acknowledged update (issue #832). Startup work makes
-// this easy to hit: MigratePlaintextProviderKeys rewrites the config on every
-// launch, so it collides with any concurrent mutation from another Zero.
-//
-// The lock must therefore span load, mutation, validation AND publication:
-// holding it only around the write would still let both processes read the same
-// stale revision first. Callers acquire before their first read, which is what
-// makes the re-read inside the lock authoritative.
-//
-// The lock file is a sibling of the config, never the config itself. The kernel
-// holds an advisory lock against an inode, and publishing the config by rename
-// installs a NEW inode — locking the config directly would leave each process
-// holding a different one. lockutil keeps the sibling's path stable for the
-// same reason, and never removes it.
-//
-// The returned release function reports its own failure rather than swallowing
-// it: a failed Release can leave the lock held for the rest of the process, so
-// a mutator that returned success after it would be reporting a state the next
-// mutation cannot reproduce. Callers join it into their result (AGENTS.md:
-// "never report success when cleanup or unlock failed").
-//
-// This also serializes goroutines within one process: each acquisition opens
-// its own file description, so a second in-process attempt contends exactly as
-// another process would. The lock is NOT reentrant, so an exported mutator that
-// needs another mutator's work calls the unexported *Locked form instead of
-// re-entering through the public function.
-// LockFile exposes lockConfigFile to packages that edit the SAME user config
-// document without going through this package's mutators — internal/cli's MCP
-// editor reads, edits and republishes it with the identical temp-file+rename
-// shape. A writer that skipped this lock would reintroduce the lost update for
-// every field, so the lock has to be one authority across packages rather than
-// a private detail of this one.
-func LockFile(path string) (func() error, error) {
-	return lockConfigFileFn(path)
-}
-
-// lockConfigFileFn is the seam the mutators call. Release failures cannot be
-// provoked through the public API — lockutil.Release is idempotent and reports
-// nil once released — so substituting this is the only way to assert that a
-// failed unlock actually reaches the caller instead of being swallowed.
-var lockConfigFileFn = lockConfigFile
-
-func lockConfigFile(path string) (func() error, error) {
-	lockPath := path + ".lock"
-	if dir := filepath.Dir(lockPath); dir != "." && dir != "" {
-		if err := os.MkdirAll(dir, 0o700); err != nil {
-			return nil, fmt.Errorf("create config directory %s: %w", dir, err)
-		}
-	}
-	deadline := time.Now().Add(configLockTimeout)
-	for {
-		lock, err := lockutil.TryAcquireFileLock(lockPath)
-		if err == nil {
-			return lock.Release, nil
-		}
-		if !errors.Is(err, lockutil.ErrLockHeld) {
-			return nil, fmt.Errorf("config: acquire config lock: %w", err)
-		}
-		if !time.Now().Before(deadline) {
-			return nil, fmt.Errorf("config: timed out acquiring config lock for %s: %w", path, ErrLockUnavailable)
-		}
-		time.Sleep(configLockRetryDelay)
-	}
-}

internal/config/resolver.go

@@ -157,26 +157,8 @@ func Resolve(options ResolveOptions) (ResolvedConfig, error) {
 		// On ErrNoActiveProvider, providers may still hold the successfully
 		// normalized (but active-less) profile list — keep it so a caller can fall
 		// back to an already-configured usable provider instead of treating this
-		// like a config with nothing set up at all. The non-provider fields parsed
-		// before the failure (notify, sandbox, tools, preferences, ...) are kept
-		// too: the TUI's provider-recovery path forwards this partial config, and
-		// dropping them would let the TUI's unconfigured notify default overwrite
-		// a stored explicit opt-out on startup (maintainer review, PR #1001).
-		partial := ResolvedConfig{
-			Providers:           providers,
-			MaxTurns:            cfg.MaxTurns,
-			MCP:                 cfg.MCP,
-			Sandbox:             cfg.Sandbox,
-			Notify:              cfg.Notify,
-			Tools:               cfg.Tools,
-			Swarm:               cfg.Swarm,
-			Preferences:         cfg.Preferences,
-			KeyBindings:         cfg.KeyBindings,
-			LocalControl:        cfg.LocalControl,
-			STT:                 cfg.STT,
-			CrossSessionInbound: cfg.CrossSessionInbound,
-		}
-		return partial, err
+		// like a config with nothing set up at all.
+		return ResolvedConfig{Providers: providers}, err
 	}
 
 	return ResolvedConfig{
@@ -184,7 +166,6 @@ func Resolve(options ResolveOptions) (ResolvedConfig, error) {
 		Providers:           providers,
 		Provider:            active,
 		MaxTurns:            cfg.MaxTurns,
-		MaxTurnsSet:         cfg.maxTurnsSet,
 		MCP:                 cfg.MCP,
 		Sandbox:             cfg.Sandbox,
 		Notify:              cfg.Notify,
@@ -253,7 +234,6 @@ func mergeConfig(dst *FileConfig, src FileConfig) {
 	}
 	if src.MaxTurns > 0 {
 		dst.MaxTurns = src.MaxTurns
-		dst.maxTurnsSet = true
 	}
 	for _, provider := range src.Providers {
 		mergeProvider(dst, provider)
@@ -314,7 +294,6 @@ func mergeProjectConfig(dst *FileConfig, src FileConfig) error {
 	}
 	if src.MaxTurns > 0 {
 		dst.MaxTurns = src.MaxTurns
-		dst.maxTurnsSet = true
 	}
 	for _, provider := range src.Providers {
 		candidate := providerMergeCandidate(*dst, provider)
@@ -627,7 +606,6 @@ func applyEnv(cfg *FileConfig, env map[string]string) {
 				n = MaxTurnsCeiling
 			}
 			cfg.MaxTurns = n
-			cfg.maxTurnsSet = true
 		}
 	}
 
@@ -748,7 +726,6 @@ func applyOverrides(cfg *FileConfig, overrides Overrides) {
 	}
 	if overrides.MaxTurns > 0 {
 		cfg.MaxTurns = overrides.MaxTurns
-		cfg.maxTurnsSet = true
 	}
 	if overrides.Sandbox.Enabled != nil {
 		cfg.Sandbox.Enabled = overrides.Sandbox.Enabled

internal/config/resolver_test.go

@@ -1151,13 +1151,8 @@ func TestResolveRejectsActiveProviderWithoutConfiguredProfiles(t *testing.T) {
 	if HasProviderProfile(resolved.Provider) {
 		t.Fatalf("Provider = %#v, want zero value", resolved.Provider)
 	}
-	// The error path now carries the parsed non-provider fields through
-	// (maintainer review, PR #1001): the TUI's provider-recovery startup
-	// forwards this partial config, and a zero MaxTurns there would silently
-	// discard the user's turn budget. Matches the no-providers SUCCESS path,
-	// which has always defaulted MaxTurns.
-	if resolved.MaxTurns != defaultMaxTurns {
-		t.Fatalf("MaxTurns = %d, want default %d carried through the partial resolve", resolved.MaxTurns, defaultMaxTurns)
+	if resolved.MaxTurns != 0 {
+		t.Fatalf("MaxTurns = %d, want zero on failed resolve", resolved.MaxTurns)
 	}
 }
 
@@ -1869,43 +1864,14 @@ func TestResolveNotifyInvalidFocusMode(t *testing.T) {
 	}
 }
 
-// An unconfigured notify block must resolve EMPTY. Defaults live in the TUI
-// (effectiveTUINotifyMode) and in `zero config notify`'s display, not in the
-// resolver: a filled-in default here leaks into headless `zero exec` (BEL +
-// OSC-9 bytes on stderr under -o json) and into the CLI/TUI preserve paths,
-// which must treat "user never chose" differently from "user chose both"
-// (maintainer review, PR #1001).
-func TestResolveNotifyUnconfiguredStaysEmpty(t *testing.T) {
-	// No config file at all.
-	resolved, err := Resolve(ResolveOptions{Env: map[string]string{}})
+func TestResolveNotifyDefaultEmpty(t *testing.T) {
+	path := writeConfig(t, `{}`)
+	resolved, err := Resolve(ResolveOptions{UserConfigPath: path, Env: map[string]string{}})
 	if err != nil {
 		t.Fatalf("Resolve: %v", err)
 	}
 	if resolved.Notify.Mode != "" || resolved.Notify.FocusMode != "" {
-		t.Fatalf("no config file: notify = %+v, want empty (resolver must not default)", resolved.Notify)
-	}
-
-	for name, body := range map[string]string{
-		"empty config": `{}`,
-		"empty block":  `{"notify":{}}`,
-		"mode only":    `{"notify":{"mode":"off"}}`,
-	} {
-		t.Run(name, func(t *testing.T) {
-			resolved, err := Resolve(ResolveOptions{UserConfigPath: writeConfig(t, body), Env: map[string]string{}})
-			if err != nil {
-				t.Fatalf("Resolve: %v", err)
-			}
-			if name == "mode only" {
-				if resolved.Notify.Mode != "off" {
-					t.Errorf("notify.mode = %q, want preserved off", resolved.Notify.Mode)
-				}
-			} else if resolved.Notify.Mode != "" {
-				t.Errorf("notify.mode = %q, want empty (resolver must not default)", resolved.Notify.Mode)
-			}
-			if resolved.Notify.FocusMode != "" {
-				t.Errorf("notify.focusMode = %q, want empty (resolver must not default)", resolved.Notify.FocusMode)
-			}
-		})
+		t.Fatalf("unset notify should be empty, got %+v", resolved.Notify)
 	}
 }
 
@@ -2286,64 +2252,3 @@ func TestResolveRejectsInvalidCrossSessionInbound(t *testing.T) {
 		t.Fatalf("error = %v", err)
 	}
 }
-
-func TestResolveReportsExplicitMaxTurns(t *testing.T) {
-	// A nil ResolveOptions.Env means "read the real process environment" (see
-	// envValue), so a case that leaves it nil inherits whatever the developer
-	// happens to export. ANTHROPIC_BASE_URL alone is enough: applyProviderEnv
-	// synthesizes a second, keyless "anthropic" profile from a base URL on its
-	// own, the single-provider shortcut in normalizeProviders stops applying,
-	// and Resolve fails with `active provider "" not found` before this test
-	// reaches its assertion. Every variable the resolver reads does it, so the
-	// cases below state an EMPTY environment rather than no environment, and
-	// these three are set to a hostile value so the test proves it.
-	t.Setenv("ANTHROPIC_BASE_URL", "https://proxy.example/v1")
-	t.Setenv("OPENAI_API_KEY", "from-the-developer-shell")
-	t.Setenv(MaxTurnsEnv, "7")
-
-	const providerJSON = `{
-		"activeProvider": "p",
-		"providers": [{"name": "p", "provider_kind": "openai-compatible", "base_url": "https://x.example/v1", "apiKey": "k", "model": "m"}]
-	}`
-	providerWithTurns := strings.Replace(providerJSON, `"activeProvider": "p"`, `"activeProvider": "p", "maxTurns": 40`, 1)
-
-	cases := []struct {
-		name string
-		opts ResolveOptions
-		set  bool
-	}{
-		{"built-in default only", ResolveOptions{
-			Env:       map[string]string{},
-			Overrides: Overrides{Provider: ProviderProfile{Name: "p", ProviderKind: "openai-compatible", BaseURL: "https://x.example/v1", APIKey: "k", Model: "m"}},
-		}, false},
-		{"user config", ResolveOptions{
-			Env:            map[string]string{},
-			UserConfigPath: writeConfig(t, providerWithTurns),
-		}, true},
-		{"project config", ResolveOptions{
-			Env:               map[string]string{},
-			UserConfigPath:    writeConfig(t, providerJSON),
-			ProjectConfigPath: writeConfig(t, `{"maxTurns": 40}`),
-		}, true},
-		{"env", ResolveOptions{
-			Env:       map[string]string{MaxTurnsEnv: "120"},
-			Overrides: Overrides{Provider: ProviderProfile{Name: "p", ProviderKind: "openai-compatible", BaseURL: "https://x.example/v1", APIKey: "k", Model: "m"}},
-		}, true},
-		{"cli override", ResolveOptions{
-			Env: map[string]string{},
-			Overrides: Overrides{
-				MaxTurns: 42,
-				Provider: ProviderProfile{Name: "p", ProviderKind: "openai-compatible", BaseURL: "https://x.example/v1", APIKey: "k", Model: "m"},
-			},
-		}, true},
-	}
-	for _, tc := range cases {
-		resolved, err := Resolve(tc.opts)
-		if err != nil {
-			t.Fatalf("%s: Resolve() error = %v", tc.name, err)
-		}
-		if resolved.MaxTurnsSet != tc.set {
-			t.Fatalf("%s: MaxTurnsSet = %v, want %v (MaxTurns=%d)", tc.name, resolved.MaxTurnsSet, tc.set, resolved.MaxTurns)
-		}
-	}
-}

internal/config/types.go

@@ -3,7 +3,6 @@ package config
 import (
 	"encoding/json"
 	"fmt"
-	"reflect"
 	"strings"
 )
 
@@ -120,12 +119,6 @@ type PreferencesConfig struct {
 	// the user turned idle recaps off. A *bool is its own tri-state, so no
 	// custom unmarshal is needed (unlike ToolsConfig.DeferThreshold's int).
 	Recaps *bool `json:"recaps,omitempty"`
-	// CompactionModel routes compaction summarization calls to this model
-	// instead of the session's main model (summaries at main-model prices are
-	// the most expensive recurring event in long runs). Empty = automatic: a
-	// curated cheap model on official endpoints, the main model elsewhere.
-	// "main" forces the main model. ZERO_COMPACTION_MODEL overrides.
-	CompactionModel string `json:"compactionModel,omitempty"`
 }
 
 // RecentModelEntry is one provider-qualified model selection recorded in
@@ -364,13 +357,6 @@ type FileConfig struct {
 	LocalControl        LocalControlConfig `json:"localControl,omitempty"`
 	STT                 STTConfig          `json:"stt,omitempty"`
 	CrossSessionInbound string             `json:"crossSessionInbound,omitempty"`
-	// maxTurnsSet records that some merge source supplied a positive maxTurns —
-	// i.e. the value is configured, not the built-in default. Unexported like
-	// Tools.deferThresholdSet: merge bookkeeping, not a config key.
-	maxTurnsSet bool
-	// Extra preserves top-level fields written by newer Zero versions or
-	// extensions so a read-modify-write through this version is non-destructive.
-	Extra map[string]json.RawMessage `json:"-"`
 }
 
 func (cfg FileConfig) MarshalJSON() ([]byte, error) {
@@ -408,32 +394,7 @@ func (cfg FileConfig) MarshalJSON() ([]byte, error) {
 	if !cfg.STT.Empty() {
 		raw.STT = &cfg.STT
 	}
-	known, err := json.Marshal(raw)
-	if err != nil || len(cfg.Extra) == 0 {
-		return known, err
-	}
-	var merged map[string]json.RawMessage
-	if err := json.Unmarshal(known, &merged); err != nil {
-		return nil, err
-	}
-	for key, value := range cfg.Extra {
-		if !fileConfigKnownJSONKey(key) {
-			merged[key] = value
-		}
-	}
-	return json.Marshal(merged)
-}
-
-func fileConfigKnownJSONKey(key string) bool {
-	if strings.EqualFold(key, "mcpServers") || strings.EqualFold(key, "mcp_servers") {
-		return true
-	}
-	for _, field := range knownJSONFields(reflect.TypeOf(FileConfig{})) {
-		if strings.EqualFold(key, field.canonical) {
-			return true
-		}
-	}
-	return false
+	return json.Marshal(raw)
 }
 
 type ResolveOptions struct {
@@ -465,15 +426,10 @@ type Overrides struct {
 }
 
 type ResolvedConfig struct {
-	ActiveProvider string
-	Providers      []ProviderProfile
-	Provider       ProviderProfile
-	MaxTurns       int
-	// MaxTurnsSet reports whether MaxTurns came from an explicit source (a
-	// config file, a provider command, ZERO_MAX_TURNS, or CLI overrides) rather
-	// than the built-in default — callers that need a different default can
-	// tell the two apart.
-	MaxTurnsSet         bool
+	ActiveProvider      string
+	Providers           []ProviderProfile
+	Provider            ProviderProfile
+	MaxTurns            int
 	MCP                 MCPConfig
 	Sandbox             SandboxConfig
 	Notify              NotifyConfig
@@ -554,18 +510,6 @@ func (cfg *FileConfig) UnmarshalJSON(data []byte) error {
 	if err := json.Unmarshal(data, &raw); err != nil {
 		return err
 	}
-	var extra map[string]json.RawMessage
-	if err := json.Unmarshal(data, &extra); err != nil {
-		return err
-	}
-	for key := range extra {
-		if fileConfigKnownJSONKey(key) {
-			delete(extra, key)
-		}
-	}
-	if len(extra) == 0 {
-		extra = nil
-	}
 	cfg.ActiveProvider = raw.ActiveProvider
 	cfg.Providers = raw.Providers
 	// A negative maxTurns is unambiguously invalid; without this it would be
@@ -587,7 +531,6 @@ func (cfg *FileConfig) UnmarshalJSON(data []byte) error {
 	cfg.LocalControl = raw.LocalControl
 	cfg.STT = raw.STT
 	cfg.CrossSessionInbound = raw.CrossSessionInbound
-	cfg.Extra = extra
 	if cfg.MCP.Servers == nil && (len(raw.MCPServers) > 0 || len(raw.MCPServersSnake) > 0) {
 		cfg.MCP.Servers = map[string]MCPServerConfig{}
 	}

internal/config/types_test.go

@@ -43,58 +43,3 @@ func TestToolsConfigPresentOnOverridesAndResolved(t *testing.T) {
 		t.Fatalf("ResolvedConfig.Tools.DeferThreshold = %d, want 4", resolved.Tools.DeferThreshold)
 	}
 }
-
-func TestFileConfigExtraCannotOverrideKnownFields(t *testing.T) {
-	cfg := FileConfig{
-		MaxTurns: 3,
-		Extra: map[string]json.RawMessage{
-			"maxTurns": json.RawMessage(`99`),
-			"MaxTurns": json.RawMessage(`100`),
-			"future":   json.RawMessage(`{"enabled":true}`),
-		},
-	}
-	data, err := json.Marshal(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var persisted map[string]json.RawMessage
-	if err := json.Unmarshal(data, &persisted); err != nil {
-		t.Fatal(err)
-	}
-	if got := string(persisted["maxTurns"]); got != "3" {
-		t.Fatalf("maxTurns = %s, want 3", got)
-	}
-	if _, exists := persisted["MaxTurns"]; exists {
-		t.Fatalf("case-variant extra overrode a known field: %s", data)
-	}
-	if got := string(persisted["future"]); got != `{"enabled":true}` {
-		t.Fatalf("future = %s, want preserved object", got)
-	}
-}
-
-func TestFileConfigUnicodeFoldedKnownFieldRoundTrip(t *testing.T) {
-	const data = `{"mcpſervers":{"docs":{"url":"https://example.com/mcp"}}}`
-
-	var cfg FileConfig
-	if err := json.Unmarshal([]byte(data), &cfg); err != nil {
-		t.Fatal(err)
-	}
-	if _, exists := cfg.MCP.Servers["docs"]; !exists {
-		t.Fatalf("MCP.Servers = %#v, want docs server", cfg.MCP.Servers)
-	}
-	if cfg.Extra != nil {
-		t.Fatalf("Extra = %#v, want Unicode-folded known field excluded", cfg.Extra)
-	}
-
-	encoded, err := json.Marshal(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var roundTripped FileConfig
-	if err := json.Unmarshal(encoded, &roundTripped); err != nil {
-		t.Fatal(err)
-	}
-	if _, exists := roundTripped.MCP.Servers["docs"]; !exists {
-		t.Fatalf("round-tripped MCP.Servers = %#v, want docs server", roundTripped.MCP.Servers)
-	}
-}

internal/config/unknownfields.go

@@ -131,7 +131,7 @@ type knownField struct {
 }
 
 func derefType(t reflect.Type) reflect.Type {
-	for t != nil && t.Kind() == reflect.Pointer {
+	for t != nil && t.Kind() == reflect.Ptr {
 		t = t.Elem()
 	}
 	return t

internal/config/writer.go

@@ -2,39 +2,20 @@ package config
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
 
-	"github.com/Gitlawb/zero/internal/notify"
 	"github.com/Gitlawb/zero/internal/providercatalog"
 )
 
-func UpsertProvider(path string, profile ProviderProfile, setActive bool) (result FileConfig, err error) {
+func UpsertProvider(path string, profile ProviderProfile, setActive bool) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
-	return upsertProviderLocked(path, profile, setActive)
-}
-
-// upsertProviderLocked is UpsertProvider's body for a caller that already holds
-// the config lock. EnsureCatalogProvider reads the document and then upserts
-// into it, and the lock is not reentrant, so it must reach the work this way
-// rather than through the exported function.
-func upsertProviderLocked(path string, profile ProviderProfile, setActive bool) (FileConfig, error) {
 	profile.Name = strings.TrimSpace(profile.Name)
 	if profile.Name == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
@@ -91,7 +72,7 @@ type EnsuredProvider struct {
 // Name or CatalogID already matches is left completely untouched (its name,
 // credentials, and model are the user's), and a created profile is NOT marked
 // active unless no provider was active at all.
-func EnsureCatalogProvider(path string, catalogID string) (result EnsuredProvider, err error) {
+func EnsureCatalogProvider(path string, catalogID string) (EnsuredProvider, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return EnsuredProvider{}, fmt.Errorf("config path is required")
@@ -100,18 +81,6 @@ func EnsureCatalogProvider(path string, catalogID string) (result EnsuredProvide
 	if err != nil {
 		return EnsuredProvider{}, err
 	}
-	// One lock spans the existence scan AND the upsert: releasing between them
-	// would let another process create the same catalog profile in the window,
-	// and the second writer would clobber the first.
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return EnsuredProvider{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
@@ -135,7 +104,7 @@ func EnsureCatalogProvider(path string, catalogID string) (result EnsuredProvide
 		BaseURL:      descriptor.DefaultBaseURL,
 		Model:        descriptor.DefaultModel,
 	}
-	written, err := upsertProviderLocked(path, profile, false)
+	written, err := UpsertProvider(path, profile, false)
 	if err != nil {
 		return EnsuredProvider{}, err
 	}
@@ -146,20 +115,11 @@ func EnsureCatalogProvider(path string, catalogID string) (result EnsuredProvide
 // credential store. It also clears inline/env key fields so the stored key is the
 // runtime credential; an old apiKeyEnv value must not keep overriding a freshly
 // captured key from `zero auth openrouter` or provider setup.
-func MarkProviderAPIKeyStored(path string, provider string) (err error) {
+func MarkProviderAPIKeyStored(path string, provider string) error {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	provider = strings.TrimSpace(provider)
 	if provider == "" {
 		return fmt.Errorf("provider name is required")
@@ -184,20 +144,11 @@ func MarkProviderAPIKeyStored(path string, provider string) (err error) {
 	return fmt.Errorf("provider %q not found", provider)
 }
 
-func SetActiveProvider(path string, name string) (result FileConfig, err error) {
+func SetActiveProvider(path string, name string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	name = strings.TrimSpace(name)
 	if name == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
@@ -226,51 +177,6 @@ func SetActiveProvider(path string, name string) (result FileConfig, err error)
 	return FileConfig{}, fmt.Errorf("provider %q not found", name)
 }
 
-// SetActiveProviderModel persists a provider selection as one lock-held
-// read-modify-write. The active provider and that provider's model are one UI
-// choice; publishing them separately can leave a partially applied selection
-// if another writer wins the lock between calls.
-func SetActiveProviderModel(path string, name string, model string) (result FileConfig, err error) {
-	path = strings.TrimSpace(path)
-	if path == "" {
-		return FileConfig{}, fmt.Errorf("config path is required")
-	}
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return FileConfig{}, fmt.Errorf("provider name is required")
-	}
-	model = strings.TrimSpace(model)
-	if model == "" {
-		return FileConfig{}, fmt.Errorf("model is required")
-	}
-
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	defer func() { err = errors.Join(err, unlock()) }()
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return FileConfig{}, fmt.Errorf("read config %s: %w", path, err)
-	}
-	cfg := FileConfig{}
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return FileConfig{}, fmt.Errorf("invalid config JSON %s: %w", path, err)
-	}
-	for index := range cfg.Providers {
-		if strings.EqualFold(strings.TrimSpace(cfg.Providers[index].Name), name) {
-			cfg.ActiveProvider = cfg.Providers[index].Name
-			cfg.Providers[index].Model = model
-			if err := writeConfigFile(path, cfg); err != nil {
-				return FileConfig{}, err
-			}
-			return cfg, nil
-		}
-	}
-	return FileConfig{}, fmt.Errorf("provider %q not found", name)
-}
-
 // ProviderPersisted reports whether a provider profile named name actually has
 // a row in the config file at path. A provider can appear in the resolved/
 // in-memory provider list without ever being written to config.json — e.g.
@@ -304,20 +210,11 @@ func ProviderPersisted(path string, name string) (bool, error) {
 // a profile that no longer exists. The caller owns cleaning up the credential
 // store entry — config stays pure of secret I/O on the read path, and remove
 // keeps that symmetry by only touching config.json.
-func RemoveProvider(path string, name string) (result FileConfig, err error) {
+func RemoveProvider(path string, name string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	name = strings.TrimSpace(name)
 	if name == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
@@ -364,20 +261,11 @@ func RemoveProvider(path string, name string) (result FileConfig, err error) {
 // resolves. OAuth tokens are deliberately not migrated: the runtime's login
 // candidates fall back to the profile's CatalogID, which every OAuth-capable
 // catalog profile carries, so a rename keeps the login reachable.
-func RenameProvider(path string, oldName string, newName string) (result FileConfig, err error) {
+func RenameProvider(path string, oldName string, newName string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	oldName = strings.TrimSpace(oldName)
 	newName = strings.TrimSpace(newName)
 	if oldName == "" || newName == "" {
@@ -459,20 +347,11 @@ type ProviderEdit struct {
 // and, unlike UpsertProvider's exact-name merge, the case-insensitive match
 // here makes a case-only rename (groq -> Groq) an in-place update instead of
 // an appended duplicate profile.
-func EditProvider(path string, edit ProviderEdit) (result FileConfig, err error) {
+func EditProvider(path string, edit ProviderEdit) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	oldName := strings.TrimSpace(edit.Name)
 	if oldName == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
@@ -582,20 +461,11 @@ func migrateStoredProviderKey(configPath string, oldName string, newName string)
 	return nil
 }
 
-func SetProviderModel(path string, name string, model string) (result FileConfig, err error) {
+func SetProviderModel(path string, name string, model string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	name = strings.TrimSpace(name)
 	if name == "" {
 		return FileConfig{}, fmt.Errorf("provider name is required")
@@ -628,20 +498,11 @@ func SetProviderModel(path string, name string, model string) (result FileConfig
 	return FileConfig{}, fmt.Errorf("provider %q not found", name)
 }
 
-func SetFavoriteModels(path string, models []string) (result FileConfig, err error) {
+func SetFavoriteModels(path string, models []string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
@@ -663,20 +524,11 @@ func SetFavoriteModels(path string, models []string) (result FileConfig, err err
 // mirroring SetFavoriteModels (read-modify-atomic-write). Unlike favorites,
 // order is preserved (newest first) rather than sorted, since it reflects
 // switch recency, not an alphabetical preference list.
-func SetRecentModels(path string, entries []RecentModelEntry) (result FileConfig, err error) {
+func SetRecentModels(path string, entries []RecentModelEntry) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
@@ -696,20 +548,11 @@ func SetRecentModels(path string, entries []RecentModelEntry) (result FileConfig
 
 // SetRecapsEnabled persists the idle recap preference, mirroring
 // SetFavoriteModels (read-modify-atomic-write).
-func SetRecapsEnabled(path string, enabled bool) (result FileConfig, err error) {
+func SetRecapsEnabled(path string, enabled bool) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
 		if err := json.Unmarshal(data, &cfg); err != nil {
@@ -728,20 +571,11 @@ func SetRecapsEnabled(path string, enabled bool) (result FileConfig, err error)
 
 // SetTheme persists the TUI theme preference, mirroring SetFavoriteModels
 // (read-modify-atomic-write). A blank theme clears the stored preference.
-func SetTheme(path string, theme string) (result FileConfig, err error) {
+func SetTheme(path string, theme string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
 		if err := json.Unmarshal(data, &cfg); err != nil {
@@ -757,162 +591,13 @@ func SetTheme(path string, theme string) (result FileConfig, err error) {
 	return cfg, nil
 }
 
-// UserNotify returns the notify block stored in the user's own config file at
-// path, trimmed. A missing file or missing/empty block returns the zero value:
-// callers that need to preserve "whatever the user already chose" on a partial
-// update must seed from THIS value, not from the resolved view — the resolver
-// merges project config and the TUI applies its own defaults, so seeding from
-// resolved copies choices the user never made into their global file (a
-// project's mode: off, or a pinned default) and across every other project.
-func UserNotify(path string) (NotifyConfig, error) {
-	path = strings.TrimSpace(path)
-	if path == "" {
-		return NotifyConfig{}, nil
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return NotifyConfig{}, nil
-		}
-		return NotifyConfig{}, fmt.Errorf("read config %s: %w", path, err)
-	}
-	var cfg FileConfig
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return NotifyConfig{}, fmt.Errorf("invalid config JSON %s: %w", path, err)
-	}
-	cfg.Notify.Mode = strings.TrimSpace(cfg.Notify.Mode)
-	cfg.Notify.FocusMode = strings.TrimSpace(cfg.Notify.FocusMode)
-	return cfg.Notify, nil
-}
-
-// validateNotify trims both fields and checks them against the accepted vocab
-// (mode in {off,bell,notify,both}; focusMode in {unfocused,always,focused}) so
-// a bad caller cannot write a value the resolver would later reject at
-// startup. An empty Mode or FocusMode is stored as-is — blank means "use the
-// built-in defaults" (the TUI's effectiveTUINotifyMode maps an empty mode to
-// both; the notify package treats an empty focusMode as unfocused), not "off".
-func validateNotify(value NotifyConfig) (NotifyConfig, error) {
-	value.Mode = strings.TrimSpace(value.Mode)
-	value.FocusMode = strings.TrimSpace(value.FocusMode)
-	if mode := value.Mode; mode != "" {
-		switch notify.Mode(mode) {
-		case notify.ModeOff, notify.ModeBell, notify.ModeNotify, notify.ModeBoth:
-		default:
-			return NotifyConfig{}, fmt.Errorf("invalid notify.mode %q: expected off, bell, notify, or both", mode)
-		}
-	}
-	if focus := value.FocusMode; focus != "" {
-		switch notify.FocusMode(focus) {
-		case notify.FocusUnfocused, notify.FocusAlways, notify.FocusFocused:
-		default:
-			return NotifyConfig{}, fmt.Errorf("invalid notify.focusMode %q: expected unfocused, always, or focused", focus)
-		}
-	}
-	return value, nil
-}
-
-// UpdateNotify runs one SERIALIZED read-modify-write transaction on the user's
-// notify block. merge receives the currently stored block and returns the
-// block to store; it must preserve any field the caller is not explicitly
-// changing. The lock covers reading the stored block, applying merge, and
-// replacing the file, so two concurrent partial updates (for example
-// `--mode off` and `--focus always` from two terminals) cannot interleave
-// their reads and writes and silently undo each other's explicit change
-// (maintainer review, PR #1001 reproduced a 50/50 lost-update without it).
-//
-// The write replaces ONLY the notify member's bytes (setNotifyJSONObject),
-// preserving every unrelated value and its explicit presence — including
-// explicit zeros/falses like tools.deferThreshold: 0 or an MCP server's
-// disabled: false, which the typed serializer's omitempty cannot round-trip —
-// through the existing temp-file-and-rename atomic publish. Locking only the
-// final write would leave the stale-field merge outside the transaction, so
-// the whole sequence runs under one lock — the SAME lockConfigFileFn authority
-// every other config mutator uses (provider/theme/credential/MCP writes), not
-// a private lock: two authorities over the same file would not contend
-// (maintainer review, PR #1001). The release error is joined into the
-// result like every other writer: a failed unlock would leave the advisory
-// lock held and later updates blocked while the caller is told success.
-func UpdateNotify(path string, merge func(current NotifyConfig) NotifyConfig) (result NotifyConfig, err error) {
-	path = strings.TrimSpace(path)
-	if path == "" {
-		return NotifyConfig{}, fmt.Errorf("config path is required")
-	}
-	if merge == nil {
-		return NotifyConfig{}, fmt.Errorf("merge function is required")
-	}
-	release, err := lockConfigFileFn(path)
-	if err != nil {
-		return NotifyConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed release would claim a state the
-	// next update cannot reproduce.
-	defer func() { err = errors.Join(err, release()) }()
-
-	current, err := UserNotify(path)
-	if err != nil {
-		return NotifyConfig{}, err
-	}
-	next, err := validateNotify(merge(current))
-	if err != nil {
-		return NotifyConfig{}, err
-	}
-
-	// Read the raw file and edit only the notify member. A missing file starts
-	// from an empty object so a first-time write does not need a pre-seeded
-	// config.
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			return NotifyConfig{}, fmt.Errorf("read config %s: %w", path, err)
-		}
-		data = []byte("{}")
-	}
-	updated, err := setNotifyJSONObject(data, next)
-	if err != nil {
-		return NotifyConfig{}, fmt.Errorf("invalid config JSON %s: %w", path, err)
-	}
-	if err := writeConfigData(path, updated); err != nil {
-		return NotifyConfig{}, err
-	}
-	return next, nil
-}
-
-// SetNotify replaces the stored notification preference with value. It is a
-// thin wrapper over the transactional UpdateNotify so existing callers keep
-// their replace semantics under the same lock and byte-preserving write.
-func SetNotify(path string, value NotifyConfig) (FileConfig, error) {
-	next, err := UpdateNotify(path, func(NotifyConfig) NotifyConfig { return value })
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Re-read the full config so callers that inspect unrelated fields (and
-	// existing tests) keep their FileConfig-shaped result.
-	cfg, err := loadConfigFile(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	cfg.Notify = next
-	return cfg, nil
-}
-
 // SetPet persists only the terminal-pet preference while preserving every
 // unrelated user setting through the config writer's atomic replace path.
-func SetPet(path string, pet string) (result FileConfig, err error) {
+func SetPet(path string, pet string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	data := []byte("{}")
 	if existing, err := os.ReadFile(path); err == nil {
@@ -925,7 +610,7 @@ func SetPet(path string, pet string) (result FileConfig, err error) {
 	}
 	pet = strings.TrimSpace(pet)
 	cfg.Preferences.Pet = pet
-	data, err = setPetPreferenceJSON(data, pet)
+	data, err := setPetPreferenceJSON(data, pet)
 	if err != nil {
 		return FileConfig{}, fmt.Errorf("invalid config JSON %s: %w", path, err)
 	}
@@ -939,20 +624,11 @@ func SetPet(path string, pet string) (result FileConfig, err error) {
 // SetTheme (read-modify-atomic-write). provider must be one of the known STT
 // provider kinds; a local provider stores the model as stt.localModelPath,
 // otherwise as stt.model. A blank model clears the stored value for that slot.
-func SetSTTModel(path string, provider STTProviderKind, model string) (result FileConfig, err error) {
+func SetSTTModel(path string, provider STTProviderKind, model string) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
 		if err := json.Unmarshal(data, &cfg); err != nil {
@@ -984,20 +660,11 @@ func SetSTTModel(path string, provider STTProviderKind, model string) (result Fi
 // (read-modify-atomic-write). streaming selects the pipeline matching the
 // downloaded model (a streaming transducer vs a batch model). Called after a
 // download completes.
-func SetSTTLocalEngine(path, binary, serverBinary, modelPath string, streaming bool) (result FileConfig, err error) {
+func SetSTTLocalEngine(path, binary, serverBinary, modelPath string, streaming bool) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
 		if err := json.Unmarshal(data, &cfg); err != nil {
@@ -1030,20 +697,11 @@ func SetSTTLocalEngine(path, binary, serverBinary, modelPath string, streaming b
 }
 
 // SetSTTProvider persists just the dictation batch provider, mirroring SetTheme.
-func SetSTTProvider(path string, provider STTProviderKind) (result FileConfig, err error) {
+func SetSTTProvider(path string, provider STTProviderKind) (FileConfig, error) {
 	path = strings.TrimSpace(path)
 	if path == "" {
 		return FileConfig{}, fmt.Errorf("config path is required")
 	}
-	unlock, err := lockConfigFileFn(path)
-	if err != nil {
-		return FileConfig{}, err
-	}
-	// Joined, not chosen between: a release failure annotates the result
-	// instead of masking the mutation error that actually explains what went
-	// wrong. Reporting success after a failed unlock would claim a state the
-	// next mutation cannot reproduce.
-	defer func() { err = errors.Join(err, unlock()) }()
 	cfg := FileConfig{}
 	if data, err := os.ReadFile(path); err == nil {
 		if err := json.Unmarshal(data, &cfg); err != nil {

internal/config/writer_test.go

@@ -3,7 +3,6 @@ package config
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io/fs"
 	"os"
 	"os/exec"
@@ -11,7 +10,6 @@ import (
 	"reflect"
 	"runtime"
 	"strings"
-	"sync"
 	"testing"
 )
 
@@ -153,32 +151,6 @@ func TestSetActiveProviderTightensExistingConfigFilePermissions(t *testing.T) {
 	}
 }
 
-func TestSetActiveProviderModelPersistsSelectionTogether(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	writeConfigFixture(t, path, FileConfig{
-		ActiveProvider: "openai",
-		Providers: []ProviderProfile{
-			{Name: "openai", ProviderKind: ProviderKindOpenAI, Model: "gpt-4.1"},
-			{Name: "Anthropic", ProviderKind: ProviderKindAnthropic, Model: "old-model"},
-		},
-	}, 0o600)
-
-	cfg, err := SetActiveProviderModel(path, " anthropic ", " claude-sonnet-4.5 ")
-	if err != nil {
-		t.Fatalf("SetActiveProviderModel() error = %v", err)
-	}
-	if cfg.ActiveProvider != "Anthropic" || cfg.Providers[1].Model != "claude-sonnet-4.5" {
-		t.Fatalf("returned selection = active %q model %q", cfg.ActiveProvider, cfg.Providers[1].Model)
-	}
-	persisted := readConfigFixture(t, path)
-	if persisted.ActiveProvider != "Anthropic" || persisted.Providers[1].Model != "claude-sonnet-4.5" {
-		t.Fatalf("persisted selection = active %q model %q", persisted.ActiveProvider, persisted.Providers[1].Model)
-	}
-	if persisted.Providers[0].Model != "gpt-4.1" {
-		t.Fatalf("unrelated provider changed: %#v", persisted.Providers[0])
-	}
-}
-
 func TestSetProviderModelUpdatesConfiguredProvider(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "zero.json")
 	writeConfigFixture(t, path, FileConfig{
@@ -397,300 +369,6 @@ func TestSetThemePersistsUserPreference(t *testing.T) {
 	}
 }
 
-func TestSetThemePreservesUnknownTopLevelFields(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	if err := os.WriteFile(path, []byte(`{
-  "preferences": {"theme": "default"},
-  "futureSetting": {"a": 1}
-}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if _, err := SetTheme(path, "dracula"); err != nil {
-		t.Fatalf("SetTheme() error = %v", err)
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var persisted map[string]json.RawMessage
-	if err := json.Unmarshal(data, &persisted); err != nil {
-		t.Fatal(err)
-	}
-	var futureSetting struct {
-		A int `json:"a"`
-	}
-	if err := json.Unmarshal(persisted["futureSetting"], &futureSetting); err != nil {
-		t.Fatalf("unknown field was not preserved: %v\nconfig: %s", err, data)
-	}
-	if futureSetting.A != 1 {
-		t.Fatalf("futureSetting = %s, want {\"a\":1}", persisted["futureSetting"])
-	}
-}
-
-func TestSetNotifyPersistsValidValues(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	writeConfigFixture(t, path, FileConfig{
-		ActiveProvider: "openai",
-		Providers: []ProviderProfile{
-			{Name: "openai", ProviderKind: ProviderKindOpenAI, Model: "gpt-4.1"},
-		},
-	}, 0o600)
-
-	cfg, err := SetNotify(path, NotifyConfig{Mode: "  both  ", FocusMode: "  unfocused  "})
-	if err != nil {
-		t.Fatalf("SetNotify() error = %v", err)
-	}
-	if cfg.Notify.Mode != "both" || cfg.Notify.FocusMode != "unfocused" {
-		t.Fatalf("Notify = %+v, want mode=both focusMode=unfocused (trimmed)", cfg.Notify)
-	}
-	persisted := readConfigFixture(t, path)
-	if persisted.Notify.Mode != "both" || persisted.Notify.FocusMode != "unfocused" {
-		t.Fatalf("persisted Notify = %+v, want mode=both focusMode=unfocused", persisted.Notify)
-	}
-	if persisted.ActiveProvider != "openai" || len(persisted.Providers) != 1 {
-		t.Fatalf("provider config was not preserved by SetNotify: %#v", persisted)
-	}
-}
-
-func TestSetNotifyRejectsInvalidMode(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	writeConfigFixture(t, path, FileConfig{ActiveProvider: "openai"}, 0o600)
-	if _, err := SetNotify(path, NotifyConfig{Mode: "loud", FocusMode: "unfocused"}); err == nil {
-		t.Fatal("expected error for invalid notify.mode")
-	}
-}
-
-func TestSetNotifyRejectsInvalidFocusMode(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	writeConfigFixture(t, path, FileConfig{ActiveProvider: "openai"}, 0o600)
-	if _, err := SetNotify(path, NotifyConfig{Mode: "off", FocusMode: "sideways"}); err == nil {
-		t.Fatal("expected error for invalid notify.focusMode")
-	}
-}
-
-func TestSetNotifyRejectsEmptyConfigPath(t *testing.T) {
-	if _, err := SetNotify("", NotifyConfig{Mode: "off"}); err == nil {
-		t.Fatal("expected error for empty config path")
-	}
-}
-
-func TestSetNotifyBlankValuesPreservedAsDefaults(t *testing.T) {
-	// An empty mode/focusMode stored on disk is a valid "use the built-in
-	// defaults" signal — SetNotify must not reject blanks, and they must round
-	// trip unchanged.
-	path := filepath.Join(t.TempDir(), "zero.json")
-	writeConfigFixture(t, path, FileConfig{ActiveProvider: "openai"}, 0o600)
-	if _, err := SetNotify(path, NotifyConfig{}); err != nil {
-		t.Fatalf("SetNotify({}) should accept blank values, got error: %v", err)
-	}
-	persisted := readConfigFixture(t, path)
-	if persisted.Notify.Mode != "" || persisted.Notify.FocusMode != "" {
-		t.Fatalf("blank notify values should round-trip, got %+v", persisted.Notify)
-	}
-}
-
-// Maintainer regression (PR #1001): a notification save must preserve unrelated
-// values whose EXPLICIT presence matters. The typed serializer's omitempty
-// cannot round-trip tools.deferThreshold: 0 (explicit "never defer" vs unset
-// "use default 3") or an MCP server's disabled: false (explicitly enabled), so
-// SetNotify/UpdateNotify edit only the notify member's bytes instead. The
-// assertions run against the RAW file, because reading through FileConfig
-// would hide exactly the presence loss being tested.
-func TestSetNotifyPreservesExplicitUnrelatedValues(t *testing.T) {
-	dir := t.TempDir()
-
-	for name, body := range map[string]string{
-		"explicit zero deferThreshold": `{
-	"tools": {"deferThreshold": 0},
-	"mcp": {"servers": {"firecrawl": {"command": "npx", "disabled": false}}}
-}`,
-		"unknown keys stay untouched": `{
-	"activeProvider": "openai",
-	"customTopLevel": {"nested": [1, 2, 3]},
-	"notify": {"mode": "both"}
-}`,
-	} {
-		t.Run(name, func(t *testing.T) {
-			path := filepath.Join(dir, name+".json")
-			if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
-				t.Fatal(err)
-			}
-
-			if _, err := SetNotify(path, NotifyConfig{Mode: "off", FocusMode: "always"}); err != nil {
-				t.Fatalf("SetNotify: %v", err)
-			}
-
-			raw, err := os.ReadFile(path)
-			if err != nil {
-				t.Fatal(err)
-			}
-			var obj map[string]json.RawMessage
-			if err := json.Unmarshal(raw, &obj); err != nil {
-				t.Fatalf("decode: %v", err)
-			}
-			if strings.Contains(name, "explicit zero") {
-				tools, ok := obj["tools"]
-				if !ok || !strings.Contains(string(tools), `"deferThreshold": 0`) {
-					t.Errorf("tools.deferThreshold: 0 lost through a notify write; tools = %s", string(tools))
-				}
-				mcp, ok := obj["mcp"]
-				if !ok || !strings.Contains(string(mcp), `"disabled": false`) {
-					t.Errorf("mcp disabled: false lost through a notify write; mcp = %s", string(mcp))
-				}
-			}
-			if strings.Contains(name, "unknown keys") {
-				if _, ok := obj["customTopLevel"]; !ok {
-					t.Error("unknown top-level key lost through a notify write")
-				}
-			}
-		})
-	}
-}
-
-// Maintainer regression (PR #1001, CodeRabbit follow-up): a hand-edited config
-// may contain DUPLICATE notify members (JSON decoders tolerate them and the
-// last occurrence wins). A reset must remove EVERY notify member — removing
-// only the last leaves the earlier block as the new effective preference, so
-// `zero config notify --reset` would report success while the old value still
-// applies.
-func TestSetNotifyResetRemovesEveryDuplicateNotifyMember(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	duplicated := `{"notify":{"mode":"off"},"activeProvider":"openai","notify":{"mode":"bell"}}`
-	if err := os.WriteFile(path, []byte(duplicated), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if _, err := SetNotify(path, NotifyConfig{}); err != nil {
-		t.Fatalf("SetNotify({}) reset: %v", err)
-	}
-
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var obj map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &obj); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if _, still := obj["notify"]; still {
-		t.Fatalf("reset left a notify member behind: %s", string(raw))
-	}
-	if obj["activeProvider"] == nil || string(obj["activeProvider"]) != `"openai"` {
-		t.Errorf("unrelated member lost through the reset: %s", string(raw))
-	}
-
-	// A reset on a file with NO notify member is a no-op, and a partial update
-	// against duplicates replaces the LAST member (the effective one under
-	// last-occurrence-wins decoding).
-	if err := os.WriteFile(path, []byte(duplicated), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := SetNotify(path, NotifyConfig{Mode: "off", FocusMode: "always"}); err != nil {
-		t.Fatalf("SetNotify replace: %v", err)
-	}
-	raw, err = os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	stored, err := UserNotify(path)
-	if err != nil {
-		t.Fatalf("UserNotify: %v", err)
-	}
-	if stored.Mode != "off" || stored.FocusMode != "always" {
-		t.Fatalf("after replace, effective notify = %+v, want off/always (last member replaced)", stored)
-	}
-	if !strings.Contains(string(raw), `"activeProvider"`) {
-		t.Errorf("unrelated member lost through the replace: %s", string(raw))
-	}
-}
-
-// Maintainer regression (PR #1001): concurrent partial updates must not lose
-// each other's explicit change. Two `zero config notify` calls (--mode off and
-// --focus always) racing from both/unfocused previously interleaved their
-// read-merge-write and one write silently undid the other (reproduced 50/50
-// without the lock). UpdateNotify serializes the whole transaction.
-func TestUpdateNotifyConcurrentPartialUpdatesLoseNoField(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	if err := os.WriteFile(path, []byte(`{"notify":{"mode":"both","focusMode":"unfocused"}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	var wg sync.WaitGroup
-	errs := make(chan error, 2)
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		if _, err := UpdateNotify(path, func(current NotifyConfig) NotifyConfig {
-			current.Mode = "off"
-			return current
-		}); err != nil {
-			errs <- fmt.Errorf("mode update: %w", err)
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		if _, err := UpdateNotify(path, func(current NotifyConfig) NotifyConfig {
-			current.FocusMode = "always"
-			return current
-		}); err != nil {
-			errs <- fmt.Errorf("focus update: %w", err)
-		}
-	}()
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		t.Fatalf("concurrent update failed: %v", err)
-	}
-
-	stored, err := UserNotify(path)
-	if err != nil {
-		t.Fatalf("read stored: %v", err)
-	}
-	// BOTH explicit changes must survive: mode from writer 1, focus from
-	// writer 2. The old race let the second writer's stale focus
-	// ("unfocused") or stale mode ("both") win.
-	if stored.Mode != "off" {
-		t.Errorf("mode = %q, want off (concurrent focus update must not clobber it)", stored.Mode)
-	}
-	if stored.FocusMode != "always" {
-		t.Errorf("focusMode = %q, want always (concurrent mode update must not clobber it)", stored.FocusMode)
-	}
-}
-
-// UserNotify reads the notify block from the user's own file. Partial updates
-// seed from this value so they preserve what the USER chose (blank included)
-// instead of copying a project config's setting or a pinned default into the
-// global file (maintainer review, PR #1001).
-func TestUserNotify(t *testing.T) {
-	dir := t.TempDir()
-
-	// Missing file: zero value, no error.
-	got, err := UserNotify(filepath.Join(dir, "missing.json"))
-	if err != nil {
-		t.Fatalf("missing file should not error: %v", err)
-	}
-	if got.Mode != "" || got.FocusMode != "" {
-		t.Fatalf("missing file = %+v, want zero value", got)
-	}
-
-	// Present block: trimmed values returned.
-	path := filepath.Join(dir, "zero.json")
-	writeConfigFixture(t, path, FileConfig{Notify: NotifyConfig{Mode: "  bell  ", FocusMode: " always "}}, 0o600)
-	got, err = UserNotify(path)
-	if err != nil {
-		t.Fatalf("UserNotify: %v", err)
-	}
-	if got.Mode != "bell" || got.FocusMode != "always" {
-		t.Fatalf("UserNotify = %+v, want bell/always (trimmed)", got)
-	}
-
-	// Blank path: zero value, no error.
-	if got, err = UserNotify(""); err != nil || got.Mode != "" || got.FocusMode != "" {
-		t.Fatalf("blank path = %+v err=%v, want zero value", got, err)
-	}
-}
-
 func TestRecapsPreferenceRoundTrips(t *testing.T) {
 	// Default (unset) is ON.
 	if !(PreferencesConfig{}).RecapsEnabled() {
@@ -1343,109 +1021,3 @@ func TestEditProviderRejectsCollisionAndUnknown(t *testing.T) {
 		t.Fatalf("config was rewritten by a rejected edit")
 	}
 }
-
-// Maintainer regression (PR #1001): notify writes must contend with EXISTING
-// config mutators, not only each other. UpdateNotify originally took a private
-// lock (acquireConfigLock); on Windows its LockFileEx range did not overlap
-// lockutil's, so `zero config notify --mode off` could race a theme (or
-// provider/credential/MCP) write and silently discard it — the later rename
-// wins and the other acknowledged change is gone. UpdateNotify now uses the
-// same lockConfigFileFn authority as every other mutator; this race holds it
-// against SetTheme and requires BOTH acknowledged edits to survive.
-func TestUpdateNotifyRacesExistingConfigMutatorWithoutLoss(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	if err := os.WriteFile(path, []byte(`{"notify":{"mode":"both","focusMode":"unfocused"}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	var wg sync.WaitGroup
-	errs := make(chan error, 2)
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		if _, err := UpdateNotify(path, func(NotifyConfig) NotifyConfig {
-			return NotifyConfig{Mode: "off", FocusMode: "always"}
-		}); err != nil {
-			errs <- fmt.Errorf("notify write: %w", err)
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		if _, err := SetTheme(path, "dracula"); err != nil {
-			errs <- fmt.Errorf("theme write: %w", err)
-		}
-	}()
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		t.Fatal(err)
-	}
-
-	cfg := readConfigFixture(t, path)
-	if cfg.Notify.Mode != "off" || cfg.Notify.FocusMode != "always" {
-		t.Errorf("notify lost the race: %+v, want off/always — the two writers did not contend on one lock", cfg.Notify)
-	}
-	if cfg.Preferences.Theme != "dracula" {
-		t.Errorf("theme lost the race: %q, want dracula — the two writers did not contend on one lock", cfg.Preferences.Theme)
-	}
-}
-
-// Maintainer regression (PR #1001, jatmn review): Go's decoder MERGES the
-// fields of duplicate JSON members into one struct, so a full replacement that
-// omits a field could inherit it from an earlier duplicate —
-// {"notify":{"mode":"off"},"notify":{"focusMode":"focused"}} +
-// SetNotify({FocusMode:"always"}) must yield blank/always, not off/always.
-// The editor removes every duplicate and inserts the replacement fresh.
-func TestSetNotifyReplacementInheritsNoFieldFromEarlierDuplicate(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	duplicated := `{"notify":{"mode":"off"},"notify":{"focusMode":"focused"},"activeProvider":"openai"}`
-	if err := os.WriteFile(path, []byte(duplicated), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if _, err := SetNotify(path, NotifyConfig{FocusMode: "always"}); err != nil {
-		t.Fatalf("SetNotify: %v", err)
-	}
-	stored, err := UserNotify(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if stored.Mode != "" || stored.FocusMode != "always" {
-		t.Fatalf("replacement inherited a field from an earlier duplicate: %+v, want blank/always", stored)
-	}
-
-	// Unrelated bytes still survive the rewrite.
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), `"activeProvider":"openai"`) {
-		t.Fatalf("unrelated member lost through the replace: %s", string(raw))
-	}
-}
-
-// Maintainer regression (PR #1001, Vasanthdev2004 review): the duplicate-key
-// fix must not reach the ORDINARY single-member file. Removing and re-inserting
-// the notify member there moved the key to the end of the object and collapsed
-// its formatting, so every /notify toggle reordered the user's config — JSON
-// member order carries no meaning, but a byte-preserving write should not
-// reformat anything it does not have to. A single notify member is replaced
-// in place: key position and surrounding formatting unchanged.
-func TestSetNotifySingleMemberReplacedInPlace(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "zero.json")
-	original := "{\n  \"activeProvider\": \"openai\",\n  \"notify\": {\"mode\": \"both\", \"focusMode\": \"unfocused\"},\n  \"preferences\": {\"theme\": \"dracula\"}\n}\n"
-	if err := os.WriteFile(path, []byte(original), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := SetNotify(path, NotifyConfig{Mode: "off", FocusMode: "always"}); err != nil {
-		t.Fatalf("SetNotify: %v", err)
-	}
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := "{\n  \"activeProvider\": \"openai\",\n  \"notify\": {\"mode\":\"off\",\"focusMode\":\"always\"},\n  \"preferences\": {\"theme\": \"dracula\"}\n}\n"
-	if string(raw) != want {
-		t.Fatalf("single-member replace moved or reformatted unrelated bytes:\n got: %q\nwant: %q", string(raw), want)
-	}
-}

internal/cron/append_run_test.go

@@ -1,61 +1,10 @@
 package cron
 
 import (
-	"bytes"
-	"encoding/json"
-	"errors"
 	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"syscall"
 	"testing"
-
-	"github.com/Gitlawb/zero/internal/fsutil"
 )
 
-func TestAppendRunRetainsNewestThousand(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Expr: "* * * * *", Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Seed an oversized legacy log, then cross the boundary again after compaction.
-	var history bytes.Buffer
-	for i := 0; i < 1207; i++ {
-		if err := json.NewEncoder(&history).Encode(RunRecord{ExitCode: i}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	if err := os.WriteFile(path, history.Bytes(), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	for _, next := range []int{1207, 1208} {
-		if err := store.AppendRun(job.ID, RunRecord{ExitCode: next}); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		lines := bytes.Split(bytes.TrimSpace(data), []byte("\n"))
-		if len(lines) != 1000 {
-			t.Fatalf("retained %d records, want 1000", len(lines))
-		}
-		for i, line := range lines {
-			var rec RunRecord
-			if err := json.Unmarshal(line, &rec); err != nil {
-				t.Fatal(err)
-			}
-			if rec.ExitCode != next-999+i {
-				t.Fatalf("record %d = %d, want %d", i, rec.ExitCode, next-999+i)
-			}
-		}
-	}
-}
-
 // AppendRun on a job removed mid-run must NOT resurrect its directory (which the
 // old unconditional MkdirAll did, leaving an orphaned runs.jsonl with no
 // metadata.json).
@@ -75,7 +24,7 @@ func TestAppendRunDoesNotResurrectRemovedJob(t *testing.T) {
 	if _, err := os.Stat(store.jobDir(job.ID)); !os.IsNotExist(err) {
 		t.Fatalf("AppendRun resurrected the removed job directory (stat err = %v)", err)
 	}
-	runs, err := store.Runs(job.ID, 0)
+	runs, err := store.Runs(job.ID)
 	if err != nil {
 		t.Fatalf("Runs: %v", err)
 	}
@@ -83,256 +32,3 @@ func TestAppendRunDoesNotResurrectRemovedJob(t *testing.T) {
 		t.Fatalf("expected no runs for a removed job, got %d", len(runs))
 	}
 }
-
-func TestRunsTail(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var history bytes.Buffer
-	// A forward scan would fail on this old oversized line. A recent-window
-	// reader must stop before reaching it, rather than merely cap its output.
-	history.WriteString(strings.Repeat("x", 1024*1024+1) + "\n")
-	for i := 0; i < 1103; i++ {
-		if err := json.NewEncoder(&history).Encode(RunRecord{ExitCode: i, SessionTitle: strings.Repeat("界", 1500)}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	history.WriteString("bad json\n\n{\"exitCode\":1103}") // no final newline
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	if err := os.WriteFile(path, history.Bytes(), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	for _, limit := range []int{1, 7, 999, 1000, 1001, 0, -1} {
-		runs, err := store.Runs(job.ID, limit)
-		want := limit
-		if want <= 0 || want > 1000 {
-			want = 1000
-		}
-		if err != nil || len(runs) != want {
-			t.Fatalf("limit %d: got %d records, err %v", limit, len(runs), err)
-		}
-		for i, run := range runs {
-			if run.ExitCode != 1104-want+i {
-				t.Fatalf("limit %d, record %d = %d", limit, i, run.ExitCode)
-			}
-			if run.ExitCode != 1103 && run.SessionTitle != strings.Repeat("界", 1500) {
-				t.Fatal("record spanning read blocks was corrupted")
-			}
-		}
-	}
-}
-
-func TestAppendRunFailurePreservesHistory(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	for _, data := range []string{"{\"exitCode\":7}\n", strings.Repeat("x", 1024*1024)} {
-		if err := os.WriteFile(path, []byte(data), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		rec := RunRecord{ExitCode: 8, Error: strings.Repeat("x", 1024*1024)}
-		if err := store.AppendRun(job.ID, rec); err == nil {
-			t.Fatal("expected oversized new record error")
-		}
-		got, err := os.ReadFile(path)
-		if err != nil || string(got) != data {
-			t.Fatalf("failed append changed history: %v", err)
-		}
-	}
-}
-
-func TestAppendRunWithOversizedHistory(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	// An oversized unterminated legacy record must not block future outcomes.
-	if err := os.WriteFile(path, []byte(strings.Repeat("x", maxRunBytes)), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := store.AppendRun(job.ID, RunRecord{ExitCode: 42}); err != nil {
-		t.Fatal(err)
-	}
-	runs, err := store.Runs(job.ID, 1)
-	if err != nil || len(runs) != 1 || runs[0].ExitCode != 42 {
-		t.Fatalf("new outcome lost: %+v, %v", runs, err)
-	}
-}
-
-func TestRunsSkipOversizedLines(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	for _, size := range []int{maxRunBytes - 1, maxRunBytes, maxRunBytes + 4096} {
-		// Valid JSON plus trailing whitespace catches accidental decoding of a
-		// prefix after dropping only the oversized suffix. The exact boundary
-		// also distinguishes an oversized line from the largest allowed line.
-		line := `{"exitCode":99}`
-		line += strings.Repeat(" ", size-len(line))
-		data := line + "\n{\"exitCode\":7}\n" + line + "\n{\"exitCode\":42}\n" + line
-		if err := os.WriteFile(path, []byte(data), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		runs, err := store.Runs(job.ID, 10)
-		want := []int{7, 42}
-		if size < maxRunBytes {
-			want = []int{99, 7, 99, 42, 99}
-		}
-		if err != nil || len(runs) != len(want) {
-			t.Fatalf("size %d: got %+v, err %v; want %v", size, runs, err, want)
-		}
-		for i, rec := range runs {
-			if rec.ExitCode != want[i] {
-				t.Fatalf("size %d: record %d = %d, want %d", size, i, rec.ExitCode, want[i])
-			}
-		}
-	}
-}
-
-// An outside reader holding runs.jsonl open makes the Windows replace fail;
-// the outcome must still be recorded rather than dropped.
-func TestAppendRunWhileHistoryHeldOpen(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	if err := os.WriteFile(path, []byte("{\"exitCode\":7}\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	held, err := os.Open(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer held.Close()
-	if err := store.AppendRun(job.ID, RunRecord{ExitCode: 42}); err != nil {
-		t.Fatalf("AppendRun with history held open: %v", err)
-	}
-	runs, err := store.Runs(job.ID, 10)
-	if err != nil || len(runs) != 2 || runs[0].ExitCode != 7 || runs[1].ExitCode != 42 {
-		t.Fatalf("outcome lost while history held open: %+v, %v", runs, err)
-	}
-}
-
-// Only a sharing or lock violation falls back to appending. Any other replace
-// failure, including a persistent access denial, and a committed replacement
-// whose backup cleanup failed must leave the log untouched, so history can
-// neither grow past retention nor record an outcome twice.
-func TestAppendRunFallbackOnlyForSharingViolation(t *testing.T) {
-	const seed = "{\"exitCode\":7}\n"
-	for _, tc := range []struct {
-		name   string
-		err    error
-		append bool
-	}{
-		{"sharing violation", syscall.Errno(32), runtime.GOOS == "windows"},
-		{"access denied", os.ErrPermission, false},
-		{"other", errors.New("boom"), false},
-		{"committed", &fsutil.CommittedReplacementCleanupError{Cause: syscall.Errno(32)}, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			store := newTestStore(t)
-			job, err := store.Add(Job{Prompt: "x"})
-			if err != nil {
-				t.Fatal(err)
-			}
-			path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-			if err := os.WriteFile(path, []byte(seed), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			store.replace = func(string, string) error { return tc.err }
-			err = store.AppendRun(job.ID, RunRecord{ExitCode: 42})
-			data, readErr := os.ReadFile(path)
-			if readErr != nil {
-				t.Fatal(readErr)
-			}
-			if tc.append {
-				if err != nil || !strings.HasPrefix(string(data), seed) || !strings.Contains(string(data), "\"exitCode\":42") {
-					t.Fatalf("sharing violation dropped the outcome: err %v, log %q", err, data)
-				}
-				return
-			}
-			if !errors.Is(err, tc.err) {
-				t.Fatalf("AppendRun error = %v, want %v", err, tc.err)
-			}
-			if string(data) != seed {
-				t.Fatalf("non-transient replace failure changed the log: %q", data)
-			}
-		})
-	}
-}
-
-// The fallback append must start a fresh line even when the log ends in an
-// unterminated record, so neither record is corrupted.
-func TestAppendRunLineAfterUnterminatedTail(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(store.jobDir(job.ID), "runs.jsonl")
-	if err := os.WriteFile(path, []byte("{\"exitCode\":7}"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := appendRunLine(path, []byte("{\"exitCode\":42}")); err != nil {
-		t.Fatal(err)
-	}
-	runs, err := store.Runs(job.ID, 10)
-	if err != nil || len(runs) != 2 || runs[0].ExitCode != 7 || runs[1].ExitCode != 42 {
-		t.Fatalf("fallback append corrupted history: %+v, %v", runs, err)
-	}
-}
-
-func TestRunHistoryConcurrentStores(t *testing.T) {
-	store := newTestStore(t)
-	job, err := store.Add(Job{Prompt: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var history bytes.Buffer
-	for i := 0; i < 1000; i++ {
-		if err := json.NewEncoder(&history).Encode(RunRecord{ExitCode: -1}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.WriteFile(filepath.Join(store.jobDir(job.ID), "runs.jsonl"), history.Bytes(), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	var wg sync.WaitGroup
-	for i := 0; i < 12; i++ {
-		wg.Go(func() {
-			other := NewStore(StoreOptions{RootDir: store.root})
-			if err := other.AppendRun(job.ID, RunRecord{ExitCode: i}); err != nil {
-				t.Error(err)
-				return
-			}
-			runs, err := other.Runs(job.ID, 1000)
-			if err != nil || len(runs) != 1000 {
-				t.Errorf("inconsistent history: %d records, err %v", len(runs), err)
-			}
-		})
-	}
-	wg.Wait()
-	runs, err := store.Runs(job.ID, 12)
-	if err != nil || len(runs) != 12 {
-		t.Fatalf("final tail: %d records, err %v", len(runs), err)
-	}
-	seen := make(map[int]bool)
-	for _, run := range runs {
-		if run.ExitCode < 0 || run.ExitCode >= 12 || seen[run.ExitCode] {
-			t.Fatalf("lost or duplicate concurrent append: %+v", runs)
-		}
-		seen[run.ExitCode] = true
-	}
-}

internal/cron/lock.go

@@ -5,23 +5,31 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync/atomic"
 	"time"
 
 	"github.com/Gitlawb/zero/internal/lockutil"
 )
 
 // Cross-process lock tuning. The lock is held only for a single metadata
-// read-modify-write (milliseconds), never across a job's exec, so the timeout
-// is generous relative to any real hold.
+// read-modify-write (milliseconds), never across a job's exec, so the timeout is
+// generous and the stale threshold sits far above any real hold.
 const (
 	cronLockTimeout    = 10 * time.Second
+	cronLockStaleAfter = 60 * time.Second
 	cronLockRetryDelay = 20 * time.Millisecond
 )
 
-// lockJob takes a cross-process advisory lock for one job on a stable sibling
-// "<id>.lock" file next to the job directory. It serializes the read-modify-write
-// of a job's metadata across concurrent schedulers and commands. The kernel
-// releases the lock when a holder exits; the file is never renamed or removed.
+var cronLockSeq atomic.Uint64
+
+// lockJob takes a cross-process exclusive lock for one job by O_EXCL-creating a
+// sibling "<id>.lock" file next to the job directory (so Remove's RemoveAll of
+// the job dir never deletes a live lock). It serializes the read-modify-write of
+// a job's metadata across concurrent schedulers and commands. The lock file is
+// removed on release; a stale lock from a crashed holder (older than
+// cronLockStaleAfter) is reclaimed. Wall-clock time.Now is used deliberately
+// (not the injectable Store.now) so lock timing never depends on a frozen test
+// clock and the stale check compares against real file mtimes.
 func (s *Store) lockJob(id string) (func(), error) {
 	if !validID(id) {
 		return nil, fmt.Errorf("invalid cron job id %q", id)
@@ -30,15 +38,64 @@ func (s *Store) lockJob(id string) (func(), error) {
 	if err := os.MkdirAll(filepath.Dir(lockPath), 0o700); err != nil {
 		return nil, err
 	}
+	token := fmt.Sprintf("%d-%d-%d", os.Getpid(), time.Now().UnixNano(), cronLockSeq.Add(1))
 	deadline := time.Now().Add(cronLockTimeout)
 	for {
-		lock, err := lockutil.TryAcquireFileLock(lockPath)
+		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 		if err == nil {
-			return func() { _ = lock.Release() }, nil
+			// A partial write would leave a lock file without our token, so the
+			// releaser could never delete it — stranding the lock. Fail closed.
+			if _, werr := f.WriteString(token); werr != nil {
+				_ = f.Close()
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("cron: write job lock: %w", werr)
+			}
+			if cerr := f.Close(); cerr != nil {
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("cron: close job lock: %w", cerr)
+			}
+			var released bool
+			return func() {
+				if released {
+					return
+				}
+				released = true
+				if data, rerr := os.ReadFile(lockPath); rerr == nil && string(data) == token {
+					_ = lockutil.RemoveLockFile(lockPath)
+				}
+			}, nil
 		}
-		if !errors.Is(err, lockutil.ErrLockHeld) {
+		// On Windows a concurrent holder's os.Remove leaves the lock file in a
+		// "delete pending" state, so an O_EXCL create races it with
+		// ERROR_ACCESS_DENIED (os.ErrPermission) rather than ErrExist. Treat that
+		// as contention and retry, exactly like ErrExist — otherwise the lock
+		// spuriously fails under concurrency on Windows.
+		if !errors.Is(err, os.ErrExist) && !errors.Is(err, os.ErrPermission) {
 			return nil, fmt.Errorf("cron: acquire job lock: %w", err)
 		}
+		// Reclaim a stale lock left by a crashed holder — atomically (H3). A blind
+		// Remove lets two racers both "reclaim" and recreate, so both hold the lock;
+		// reclaimStaleLock renames the file aside (only one rename of a given file
+		// wins) and restores it if it turns out fresh, so a live lock is never deleted
+		// out from under its holder.
+		if info, statErr := os.Stat(lockPath); statErr == nil && time.Since(info.ModTime()) > cronLockStaleAfter {
+			cleared, rerr := lockutil.ReclaimStaleLock(lockPath, token, func(reclaimedPath string) bool {
+				info, err := os.Stat(reclaimedPath)
+				return err == nil && time.Since(info.ModTime()) <= cronLockStaleAfter
+			})
+			if rerr != nil {
+				// Reclaim hit a hard failure: the rename aside failed outright, or a
+				// live holder's lock could not be put back (the lock path may be
+				// missing, so re-acquiring would break mutual exclusion). Fail closed
+				// instead of spinning to the deadline.
+				return nil, fmt.Errorf("cron: reclaim stale job lock: %w", rerr)
+			}
+			if cleared {
+				continue // cleared a genuinely stale lock; retry the O_EXCL create now
+			}
+			// Lost the reclaim race (or it was actually fresh) — fall through to the
+			// bounded wait instead of hot-spinning on a reclaim that never wins (L13).
+		}
 		if !time.Now().Before(deadline) {
 			return nil, fmt.Errorf("cron: timed out acquiring job lock for %q", id)
 		}

internal/cron/mutate_test.go

@@ -64,7 +64,7 @@ func TestMutateRemovedJobReturnsNotFound(t *testing.T) {
 	if !errors.Is(err, ErrJobNotFound) {
 		t.Fatalf("Mutate on removed job = %v, want ErrJobNotFound", err)
 	}
-	// The stable advisory-lock file does not resurrect the removed job dir.
+	// And the lock file left no litter / did not resurrect the job dir.
 	if _, gerr := store.Get(job.ID); !errors.Is(gerr, ErrJobNotFound) {
 		t.Fatalf("job should remain removed, Get = %v", gerr)
 	}

internal/cron/store.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"time"
 
@@ -17,10 +16,6 @@ import (
 const (
 	StatusActive = "active"
 	StatusPaused = "paused"
-
-	// MaxRunHistory is the number of recent outcomes retained per job.
-	MaxRunHistory = 1000
-	maxRunBytes   = 1024 * 1024
 )
 
 // ErrJobNotFound is returned (wrapped) by Get when a job's metadata file is
@@ -61,9 +56,6 @@ type StoreOptions struct {
 type Store struct {
 	root string
 	now  func() time.Time
-	// replace overrides the run-history replacement primitive in tests; nil
-	// uses the platform default.
-	replace func(src, dst string) error
 }
 
 func NewStore(opts StoreOptions) *Store {
@@ -236,7 +228,8 @@ func (s *Store) Update(job Job) error {
 // Remove). It re-reads the CURRENT on-disk job and passes it to mutate along with
 // any read error; mutate returns the job to persist. A removed job aborts with
 // ErrJobNotFound (no recreate). A transient read error (not removal) is surfaced
-// via readErr; the callback can return it to abort without overwriting state.
+// via readErr so the caller can still persist a best-effort state — the fire path
+// advances the schedule regardless, to avoid a re-fire.
 func (s *Store) Mutate(id string, mutate func(current Job, readErr error) (Job, error)) (Job, error) {
 	if !validID(id) {
 		return Job{}, fmt.Errorf("invalid cron job id %q", id)
@@ -316,8 +309,10 @@ func (s *Store) AppendRun(id string, rec RunRecord) error {
 		return err
 	}
 	defer unlock()
-	// Do not resurrect a job removed mid-run. The lock serializes this check
-	// and publication against Remove and other history writers/readers.
+	// Bail if the job was removed (e.g. mid-run) — otherwise the MkdirAll below
+	// would resurrect a deleted job's directory with an orphaned runs.jsonl and no
+	// metadata.json (which Runs would then still return). Under the per-job lock
+	// this stat-then-write is race-free against a concurrent Remove.
 	if _, err := os.Stat(filepath.Join(s.jobDir(id), "metadata.json")); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil
@@ -325,98 +320,30 @@ func (s *Store) AppendRun(id string, rec RunRecord) error {
 		return err
 	}
 	dir := s.jobDir(id)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(dir, "runs.jsonl"), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		return err
+	}
 	line, err := json.Marshal(rec)
 	if err != nil {
-		return err
-	}
-	if len(line) >= maxRunBytes {
-		return fmt.Errorf("cron run record exceeds %d bytes", maxRunBytes-1)
-	}
-	runs, err := s.readRuns(id, MaxRunHistory-1)
-	if err != nil {
-		return err
-	}
-	// Publish a complete snapshot even below the retention boundary so readers
-	// never see a partial append. Legacy oversized logs compact on their next run.
-	f, err := os.CreateTemp(dir, "runs-*.tmp")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	w := bufio.NewWriter(f)
-	for _, run := range runs {
-		if err := json.NewEncoder(w).Encode(run); err != nil {
-			_ = f.Close()
-			return err
-		}
-	}
-	if _, err := w.Write(append(line, '\n')); err != nil {
 		_ = f.Close()
 		return err
 	}
-	if err := w.Flush(); err != nil {
+	if _, err := f.Write(append(line, '\n')); err != nil {
 		_ = f.Close()
 		return err
 	}
 	// Surface a buffered-write failure that only materializes on Close.
-	if err := f.Close(); err != nil {
-		return err
-	}
-	path := filepath.Join(dir, "runs.jsonl")
-	// ReplaceWithRetry keeps a DACL applied to runs.jsonl itself; a rename would
-	// publish the temporary file's inherited directory DACL instead.
-	err = fsutil.ReplaceWithRetry(f.Name(), path, s.replace)
-	var committed *fsutil.CommittedReplacementCleanupError
-	if err == nil || errors.As(err, &committed) || !fsutil.IsSharingOrLockViolation(err) {
-		return err
-	}
-	// Windows refuses to replace a log another process holds open. Append the
-	// record instead so the outcome survives; compaction resumes on a later run.
-	// Other failures are returned so a log that can never be replaced cannot
-	// grow past the retention limit. The leading newline ends any unterminated
-	// tail, and readRuns skips the blank line it may leave. Zero's own readers
-	// hold the job lock.
-	if appendErr := appendRunLine(path, line); appendErr != nil {
-		return errors.Join(err, appendErr)
-	}
-	return nil
-}
-
-func appendRunLine(path string, line []byte) error {
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND, 0)
-	if err != nil {
-		return err
-	}
-	record := append(append([]byte{'\n'}, line...), '\n')
-	if _, err := f.Write(record); err != nil {
-		_ = f.Close()
-		return err
-	}
 	return f.Close()
 }
 
-// Runs returns the newest limit valid records in append order (oldest first).
-// Non-positive limits and limits above MaxRunHistory use MaxRunHistory. It reads
-// backwards from the tail, including for legacy logs not yet compacted.
-func (s *Store) Runs(id string, limit int) ([]RunRecord, error) {
+func (s *Store) Runs(id string) ([]RunRecord, error) {
 	if !validID(id) {
 		return nil, fmt.Errorf("invalid cron job id %q", id)
 	}
-	if limit <= 0 || limit > MaxRunHistory {
-		limit = MaxRunHistory
-	}
-	unlock, err := s.lockJob(id)
-	if err != nil {
-		return nil, err
-	}
-	defer unlock()
-	return s.readRuns(id, limit)
-}
-
-// readRuns requires the job lock. Memory is bounded by limit records plus one
-// line. Malformed and oversized legacy lines are skipped so they cannot prevent
-// recording new outcomes during compaction.
-func (s *Store) readRuns(id string, limit int) ([]RunRecord, error) {
 	f, err := os.Open(filepath.Join(s.jobDir(id), "runs.jsonl"))
 	if errors.Is(err, os.ErrNotExist) {
 		return nil, nil
@@ -425,48 +352,14 @@ func (s *Store) readRuns(id string, limit int) ([]RunRecord, error) {
 		return nil, err
 	}
 	defer f.Close()
-	info, err := f.Stat()
-	if err != nil {
-		return nil, err
-	}
 	var runs []RunRecord
-	var line []byte
-	oversized := false
-	decode := func() {
-		slices.Reverse(line)
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for scanner.Scan() {
 		var rec RunRecord
-		if json.Unmarshal(line, &rec) == nil {
+		if json.Unmarshal(scanner.Bytes(), &rec) == nil {
 			runs = append(runs, rec)
 		}
-		line = line[:0]
 	}
-	var block [4096]byte
-	for end := info.Size(); end > 0 && len(runs) < limit; {
-		start := max(int64(0), end-int64(len(block)))
-		n, err := f.ReadAt(block[:end-start], start)
-		if err != nil {
-			return nil, err
-		}
-		for i := n - 1; i >= 0 && len(runs) < limit; i-- {
-			if block[i] == '\n' {
-				if !oversized {
-					decode()
-				}
-				oversized = false
-			} else if !oversized {
-				if len(line) >= maxRunBytes-1 {
-					line = line[:0]
-					oversized = true
-					continue
-				}
-				line = append(line, block[i])
-			}
-		}
-		end = start
-	}
-	if len(runs) < limit && len(line) > 0 {
-		decode()
-	}
-	slices.Reverse(runs)
-	return runs, nil
+	return runs, scanner.Err()
 }