@openparachute/hub 0.7.7-rc.9 → 0.7.7

package/src/__tests__/operator-token.test.ts

@@ -66,7 +66,7 @@ describe("mintOperatorToken", () => {
     }
   });
 
-  test("admin scope-set includes hub:admin + parachute:host:* + vault/scribe/agent admins (#213)", () => {
+  test("admin scope-set includes hub:admin + parachute:host:* + vault/scribe admin scopes (#213)", () => {
     // OPERATOR_TOKEN_SCOPES === OPERATOR_TOKEN_SCOPE_SETS.admin (back-compat
     // alias). The pre-#213 set was 5 scopes; #213 added the fine-grained
     // parachute:host:install/start/expose/auth/vault scopes to the admin
@@ -81,7 +81,6 @@ describe("mintOperatorToken", () => {
       "parachute:host:vault",
       "vault:admin",
       "scribe:admin",
-      "agent:send",
     ]);
   });
 });

package/src/__tests__/port-assign.test.ts

@@ -44,21 +44,18 @@ describe("assignPort (pure)", () => {
   });
 
   test("walks the unassigned reservation range when canonical is occupied", () => {
-    // 1940 is taken. 1944 is now `parachute-app`'s canonical slot (hub-parity
-    // P5, status "assigned") so the walker skips it; the first RESERVED
-    // (walkable) slot is 1945.
+    // 1940 is taken. Agent retirement released 1941 as the first walkable slot.
     const result = assignPort(1940, [1940]);
-    expect(result.port).toBe(1945);
+    expect(result.port).toBe(1941);
     expect(result.source).toBe("fallback-in-range");
     expect(result.warning).toMatch(/canonical port 1940 is in use/);
-    expect(result.warning).toMatch(/1945/);
+    expect(result.warning).toMatch(/1941/);
   });
 
   test("skips reservations that are also occupied", () => {
-    // Canonical 1940 is in use. 1944 is assigned (parachute-app, skipped
-    // regardless of `occupied`); 1945 is reserved-but-occupied; 1946 is
-    // assigned (parachute-surface, skipped); 1947 is reserved-and-free.
-    const result = assignPort(1940, [1940, 1944, 1945, 1946]);
+    // Canonical 1940 and released slot 1941 are occupied. Assigned slots are
+    // skipped; 1945 is reserved-but-occupied; 1947 is reserved-and-free.
+    const result = assignPort(1940, [1940, 1941, 1945]);
     expect(result.port).toBe(1947);
     expect(result.source).toBe("fallback-in-range");
   });
@@ -83,23 +80,19 @@ describe("assignPort (pure)", () => {
   });
 
   test("third-party (no canonical slot) jumps straight to the reservation range", () => {
-    // 1944 is assigned (parachute-app, hub-parity P5) so the walker skips it;
-    // the first RESERVED (walkable) slot is 1945.
+    // Agent retirement released 1941 as the first walkable slot.
     const result = assignPort(undefined, []);
-    expect(result.port).toBe(1945);
+    expect(result.port).toBe(1941);
     expect(result.source).toBe("fallback-in-range");
     expect(result.warning).toMatch(/no canonical slot/);
-    expect(result.warning).toMatch(/1945/);
+    expect(result.warning).toMatch(/1941/);
   });
 
   test("third-party with reservations occupied walks further in the range", () => {
-    // PORT_RESERVATIONS: 1944 assigned (parachute-app), 1945 reserved, 1946
-    // assigned (parachute-surface — both carry canonical slots so the
-    // fallback walker doesn't hand them to a third party), 1947 reserved.
-    // With 1944 + 1945 occupied, the walker skips the assigned 1946 slot and
-    // lands on the next reserved-and-free port — 1947.
-    const result = assignPort(undefined, [1944, 1945]);
-    expect(result.port).toBe(1947);
+    // With released 1941 occupied, the walker skips assigned 1942–1944 and
+    // lands on the next reserved-and-free port, 1945.
+    const result = assignPort(undefined, [1941]);
+    expect(result.port).toBe(1945);
     expect(result.source).toBe("fallback-in-range");
   });
 });
@@ -170,9 +163,8 @@ describe("assignServicePort (hub#206 — services.json is authoritative)", () =>
         canonical: 1940,
         occupied: [1940],
       });
-      // 1944 is parachute-app's assigned (non-walkable) slot as of
-      // hub-parity P5 — the first walkable reserved slot is 1945.
-      expect(result.port).toBe(1945);
+      // Agent retirement released 1941 as the first walkable slot.
+      expect(result.port).toBe(1941);
       expect(result.source).toBe("fallback-in-range");
       expect(result.warning).toMatch(/canonical port 1940 is in use/);
       // .env stays bit-for-bit identical.
@@ -189,9 +181,8 @@ describe("assignServicePort (hub#206 — services.json is authoritative)", () =>
       const result = assignServicePort({
         occupied: [],
       });
-      // 1944 is parachute-app's assigned (non-walkable) slot as of
-      // hub-parity P5 — the first walkable reserved slot is 1945.
-      expect(result.port).toBe(1945);
+      // Agent retirement released 1941 as the first walkable slot.
+      expect(result.port).toBe(1941);
       expect(result.source).toBe("fallback-in-range");
       expect(existsSync(envPath)).toBe(false);
     } finally {

package/src/__tests__/root-serve.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Tests for `src/root-serve.ts` — serving the Parachute app AT the origin root
+ * (`root_mode = serve-app`).
+ *
+ * Covers `serveAppAtRoot` (the static file-or-SPA-shell decision, Accept-gated,
+ * reserved-prefix-guarded, traversal-guarded) and `makeAppDistResolver` (success
+ * memoization + failure NON-caching for dynamic recovery).
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { makeAppDistResolver, serveAppAtRoot } from "../root-serve.ts";
+
+let dist: string;
+let root: string;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "phub-root-serve-"));
+  dist = join(root, "dist");
+  mkdirSync(join(dist, "assets"), { recursive: true });
+  writeFileSync(join(dist, "index.html"), "<!doctype html><title>App</title>");
+  writeFileSync(join(dist, "assets", "index-abc.js"), "console.log('app')");
+  writeFileSync(join(dist, "manifest.webmanifest"), '{"name":"Parachute"}');
+  writeFileSync(join(dist, "sw.js"), "self.addEventListener('install',()=>{})");
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+function get(pathname: string, accept?: string): Request {
+  return new Request(`http://localhost${pathname}`, {
+    method: "GET",
+    headers: accept ? { accept } : {},
+  });
+}
+
+describe("serveAppAtRoot", () => {
+  test("serves index.html at `/`", async () => {
+    const res = serveAppAtRoot(dist, get("/", "text/html"), "/");
+    expect(res).not.toBeNull();
+    expect(res?.headers.get("content-type")).toContain("text/html");
+    expect(await res?.text()).toContain("<title>App</title>");
+  });
+
+  test("serves an existing asset with an inferred content-type", async () => {
+    const res = serveAppAtRoot(dist, get("/assets/index-abc.js", "*/*"), "/assets/index-abc.js");
+    expect(res).not.toBeNull();
+    expect(res?.headers.get("content-type") ?? "").toMatch(/javascript/);
+    expect(await res?.text()).toContain("console.log");
+  });
+
+  test("serves the PWA manifest with the application/manifest+json override", () => {
+    const res = serveAppAtRoot(dist, get("/manifest.webmanifest", "*/*"), "/manifest.webmanifest");
+    expect(res).not.toBeNull();
+    expect(res?.headers.get("content-type")).toBe("application/manifest+json");
+  });
+
+  test("serves the service worker as a real file (not the SPA shell)", async () => {
+    const res = serveAppAtRoot(dist, get("/sw.js", "*/*"), "/sw.js");
+    expect(res).not.toBeNull();
+    expect(await res?.text()).toContain("addEventListener");
+  });
+
+  test("SPA fallback: an unclaimed HTML deep link gets index.html", async () => {
+    const res = serveAppAtRoot(dist, get("/some/app/route", "text/html"), "/some/app/route");
+    expect(res).not.toBeNull();
+    expect(await res?.text()).toContain("<title>App</title>");
+  });
+
+  test("non-HTML unclaimed request → null (branded 404 tail)", () => {
+    expect(serveAppAtRoot(dist, get("/nope.json", "application/json"), "/nope.json")).toBeNull();
+    // A missing asset fetched with Accept: */* is not an HTML navigation → null.
+    expect(serveAppAtRoot(dist, get("/assets/missing.js", "*/*"), "/assets/missing.js")).toBeNull();
+  });
+
+  test("non-GET → null (a non-GET unclaimed path keeps its default)", () => {
+    const post = new Request("http://localhost/", {
+      method: "POST",
+      headers: { accept: "text/html" },
+    });
+    expect(serveAppAtRoot(dist, post, "/")).toBeNull();
+  });
+
+  test("reserved hub/protocol prefixes keep the branded 404 even for HTML nav", () => {
+    for (const p of ["/api/bogus", "/oauth/typo", "/.well-known/nope"]) {
+      expect(serveAppAtRoot(dist, get(p, "text/html"), p)).toBeNull();
+    }
+  });
+
+  test("path traversal cannot escape dist", () => {
+    // A crafted encoded traversal joins outside dist → falls through (null).
+    const p = "/assets/..%2f..%2f..%2fetc%2fpasswd";
+    expect(serveAppAtRoot(dist, get(p, "*/*"), p)).toBeNull();
+  });
+
+  test("a resolved dist whose index.html vanished → null (no broken shell)", () => {
+    rmSync(join(dist, "index.html"));
+    expect(serveAppAtRoot(dist, get("/", "text/html"), "/")).toBeNull();
+  });
+
+  test("malformed percent-encoding → null (no URIError thrown → branded 404, not 500)", () => {
+    // decodeURIComponent throws URIError on a bad escape; the guard must swallow
+    // it and fall through so the dispatch never 500s on a garbage asset URL.
+    for (const p of ["/assets/%ZZ", "/foo%", "/%E0%A4%A", "/bar%2"]) {
+      expect(() => serveAppAtRoot(dist, get(p, "*/*"), p)).not.toThrow();
+      expect(serveAppAtRoot(dist, get(p, "*/*"), p)).toBeNull();
+    }
+    // Even an HTML navigation with bad encoding falls through (redirect-mode
+    // parity) rather than shelling.
+    expect(serveAppAtRoot(dist, get("/foo%", "text/html"), "/foo%")).toBeNull();
+  });
+});
+
+describe("makeAppDistResolver", () => {
+  test("returns the resolved dist and memoizes a success", () => {
+    let calls = 0;
+    const resolve = makeAppDistResolver(() => {
+      calls++;
+      return dist;
+    });
+    expect(resolve()).toBe(dist);
+    expect(resolve()).toBe(dist);
+    expect(calls).toBe(1); // success cached — only resolved once
+  });
+
+  test("does NOT cache a failure — recovers once the app is installed", () => {
+    let installed = false;
+    const resolve = makeAppDistResolver(() => {
+      if (!installed) throw new Error("not installed");
+      return dist;
+    });
+    expect(resolve()).toBeNull(); // not installed yet
+    expect(resolve()).toBeNull(); // still probing, still null
+    installed = true;
+    expect(resolve()).toBe(dist); // picked up without a restart
+  });
+});

package/src/__tests__/scope-explanations.test.ts

@@ -19,7 +19,6 @@ describe("SCOPE_EXPLANATIONS", () => {
       "vault:admin",
       "scribe:transcribe",
       "scribe:admin",
-      "agent:send",
       "hub:admin",
       "parachute:host:admin",
       // Account scopes (Parachute App campaign, Phase 2).
@@ -187,7 +186,6 @@ describe("isRequestableScope", () => {
   test("true for non-admin first-party scopes", () => {
     expect(isRequestableScope("vault:read")).toBe(true);
     expect(isRequestableScope("vault:admin")).toBe(true);
-    expect(isRequestableScope("agent:send")).toBe(true);
     expect(isRequestableScope("scribe:transcribe")).toBe(true);
   });
 

package/src/__tests__/serve-boot.test.ts

@@ -395,46 +395,39 @@ describe("bootSupervisedModules", () => {
   });
 });
 
-// agent (then channel)#41 — a transiently-wrong (drifted) services.json port for a
-// fixed-port first-party module self-perpetuates: the supervisor injects PORT /
-// probes / proxies from that row, so the wrong port strands the module forever.
-// The boot path snaps it back to canonical before spawn AND persists the fix so
-// the reverse-proxy (which reads services.json) routes correctly.
-describe("reconcilePortToCanonical (channel#41 — module now agent)", () => {
+// A transiently wrong services.json port for a fixed-port first-party module can
+// self-perpetuate through supervisor env, probes, and proxy routing. The boot path
+// snaps supported modules back to canonical and persists the fix.
+describe("reconcilePortToCanonical", () => {
   let h: Harness;
   beforeEach(() => {
     h = makeHarness();
   });
   afterEach(() => h.cleanup());
 
-  // The live-observed signature: the agent (then channel) row carried 19415 instead of its
-  // canonical 1941.
-  const DRIFTED_CHANNEL: ServiceEntry = {
-    name: "parachute-agent",
+  const DRIFTED_SCRIBE: ServiceEntry = {
+    name: "parachute-scribe",
     port: 19415,
-    paths: ["/agent"],
+    paths: ["/scribe"],
     health: "/health",
     version: "0.1.0",
   };
 
   test("snaps a drifted fixed-port row back to canonical + persists it", () => {
-    writeManifest({ services: [DRIFTED_CHANNEL] }, h.manifestPath);
+    writeManifest({ services: [DRIFTED_SCRIBE] }, h.manifestPath);
     const logs: string[] = [];
 
-    const reconciled = reconcilePortToCanonical(DRIFTED_CHANNEL, h.manifestPath, (l) =>
+    const reconciled = reconcilePortToCanonical(DRIFTED_SCRIBE, h.manifestPath, (l) =>
       logs.push(l),
     );
 
-    // Returned entry carries canonical (agent → 1941).
-    expect(reconciled.port).toBe(1941);
-    // And it's PERSISTED — the proxy reads services.json, so the row itself must
-    // now point at 1941 or `/agent/*` keeps routing to the dead 19415.
+    expect(reconciled.port).toBe(1943);
     const onDisk = readManifestLenient(h.manifestPath).services.find(
-      (s) => s.name === "parachute-agent",
+      (s) => s.name === "parachute-scribe",
     );
-    expect(onDisk?.port).toBe(1941);
+    expect(onDisk?.port).toBe(1943);
     expect(
-      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1941")),
+      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1943")),
     ).toBe(true);
   });
 
@@ -460,31 +453,30 @@ describe("reconcilePortToCanonical (channel#41 — module now agent)", () => {
   });
 
   test("does NOT steal the canonical port when another row already holds it", () => {
-    // Another row legitimately occupies 1941 — reconciling would trip the
-    // write-side duplicate-port guard and isn't the agent module's to take. Leave the
-    // drift; the supervisor's squatter detection surfaces it.
+    // Another row occupies Scribe's canonical 1943, so reconciliation must not
+    // steal it; leave the drift for squatter diagnostics.
     const squatter: ServiceEntry = {
       name: "parachute-vault",
-      port: 1941, // unusual, but it owns this slot right now
+      port: 1943,
       paths: ["/vault/default"],
       health: "/vault/default/health",
       version: "0.4.5",
     };
-    writeManifest({ services: [squatter, DRIFTED_CHANNEL] }, h.manifestPath);
+    writeManifest({ services: [squatter, DRIFTED_SCRIBE] }, h.manifestPath);
     const logs: string[] = [];
 
-    const out = reconcilePortToCanonical(DRIFTED_CHANNEL, h.manifestPath, (l) => logs.push(l));
+    const out = reconcilePortToCanonical(DRIFTED_SCRIBE, h.manifestPath, (l) => logs.push(l));
 
     expect(out.port).toBe(19415); // unchanged
     const onDisk = readManifestLenient(h.manifestPath).services.find(
-      (s) => s.name === "parachute-agent",
+      (s) => s.name === "parachute-scribe",
     );
     expect(onDisk?.port).toBe(19415); // not rewritten
     expect(logs.some((l) => l.includes("held by another row"))).toBe(true);
   });
 
-  test("boot path injects PORT=canonical + persists the fix for a drifted agent row", async () => {
-    writeManifest({ services: [DRIFTED_CHANNEL] }, h.manifestPath);
+  test("boot path injects and persists the supported module's canonical port", async () => {
+    writeManifest({ services: [DRIFTED_SCRIBE] }, h.manifestPath);
     const recorder = makeRecorder();
     const sup = new Supervisor({ spawnFn: recorder.spawn });
 
@@ -493,15 +485,12 @@ describe("reconcilePortToCanonical (channel#41 — module now agent)", () => {
       configDir: h.dir,
     });
 
-    // The supervisor child gets PORT=1941 (so it binds + the readiness probe
-    // checks the right port), not the drifted 19415.
-    expect(recorder.calls[0]?.short).toBe("agent");
-    expect(recorder.calls[0]?.env?.PORT).toBe("1941");
-    // services.json row is reconciled → proxy routes /agent/* to 1941.
+    expect(recorder.calls[0]?.short).toBe("scribe");
+    expect(recorder.calls[0]?.env?.PORT).toBe("1943");
     const onDisk = readManifestLenient(h.manifestPath).services.find(
-      (s) => s.name === "parachute-agent",
+      (s) => s.name === "parachute-scribe",
     );
-    expect(onDisk?.port).toBe(1941);
+    expect(onDisk?.port).toBe(1943);
   });
 
   test("boot path leaves a non-drifted vault row's port untouched", async () => {

package/src/__tests__/service-spec-discovery.test.ts

@@ -2,6 +2,8 @@ import { describe, expect, test } from "bun:test";
 import {
   FIRST_PARTY_FALLBACKS,
   KNOWN_MODULES,
+  PORT_RESERVATIONS,
+  RETIRED_MODULES,
   discoverableShorts,
   findServiceByShort,
   focusForShort,
@@ -25,20 +27,18 @@ describe("discoverableShorts", () => {
     expect(shorts.length).toBe(new Set(shorts).size);
   });
 
-  test("includes agent (the module the whitelist used to hide) + the core set", () => {
+  test("includes the supported module set and excludes retired Agent", () => {
     const shorts = discoverableShorts();
-    for (const s of ["vault", "scribe", "surface", "agent", "notes"]) {
+    for (const s of ["vault", "scribe", "surface", "app", "notes"]) {
       expect(shorts).toContain(s);
     }
+    expect(shorts).not.toContain("agent");
   });
 
   test("FIRST_PARTY_FALLBACKS shorts lead KNOWN_MODULES shorts (registry order)", () => {
     const shorts = discoverableShorts();
-    // notes (the remaining FALLBACK — agent moved to KNOWN_MODULES in
-    // boundary D3) appears before vault (KNOWN_MODULES) in the union.
+    // notes (a FALLBACK) appears before vault (KNOWN_MODULES) in the union.
     expect(shorts.indexOf("notes")).toBeLessThan(shorts.indexOf("vault"));
-    // agent rides in KNOWN_MODULES now but is still discoverable.
-    expect(shorts).toContain("agent");
   });
 });
 
@@ -106,9 +106,30 @@ describe("runner registry removal (2026-07-01)", () => {
   });
 });
 
+describe("Agent module retirement (2026-07-15)", () => {
+  test("is no longer known, discoverable, or resolvable", () => {
+    expect(isKnownModuleShort("agent")).toBe(false);
+    expect(discoverableShorts()).not.toContain("agent");
+    expect("agent" in KNOWN_MODULES).toBe(false);
+    expect(shortNameForManifest("parachute-agent")).toBeUndefined();
+    expect(shortNameForManifest("parachute-channel")).toBeUndefined();
+  });
+
+  test("retires every historical row name and releases port 1941", () => {
+    expect(RETIRED_MODULES.agent).toBeDefined();
+    expect(RETIRED_MODULES["parachute-agent"]).toBeDefined();
+    expect(RETIRED_MODULES["parachute-channel"]).toBeDefined();
+    expect(PORT_RESERVATIONS.find((entry) => entry.port === 1941)).toEqual({
+      port: 1941,
+      name: "unassigned",
+      status: "reserved",
+    });
+  });
+});
+
 describe("isKnownModuleShort", () => {
   test("true for every known module (the install/config gate)", () => {
-    for (const s of ["vault", "scribe", "surface", "agent", "notes"]) {
+    for (const s of ["vault", "scribe", "surface", "app", "notes"]) {
       expect(isKnownModuleShort(s)).toBe(true);
     }
   });
@@ -119,12 +140,6 @@ describe("isKnownModuleShort", () => {
   });
 });
 
-// Regression: services.json rows carry the MANIFEST name (`parachute-agent`),
-// not the bare short (`agent`). The connection/channels wiring used to do
-// `services.find((s) => s.name === "agent")`, which never matched the on-disk
-// row → agentOrigin null → a spurious "agent module is not installed" when
-// linking a vault-backed channel. findServiceByShort resolves through the
-// short↔manifest map so the lookup hits the real row.
 describe("findServiceByShort", () => {
   const services = [
     { name: "parachute-vault-default", port: 1940 },
@@ -132,29 +147,9 @@ describe("findServiceByShort", () => {
     { name: "parachute-scribe", port: 1943 },
   ];
 
-  test("matches a row by its manifest name via the short↔manifest map", () => {
-    const found = findServiceByShort(services, "agent");
-    expect(found?.name).toBe("parachute-agent");
-    expect(found?.port).toBe(1941);
-  });
-
-  test("the naive `name === short` comparison would have missed it (the bug)", () => {
-    // The exact pre-fix predicate: a bare short never matches a manifest-named row.
-    expect(services.find((s) => s.name === "agent")).toBeUndefined();
-    // The fix finds it.
-    expect(findServiceByShort(services, "agent")).toBeDefined();
-  });
-
-  test("resolves a legacy parachute-channel row to short `agent` (rename back-compat)", () => {
-    // Un-upgraded operators carry a `parachute-channel` row; the
-    // LEGACY_MANIFEST_ALIASES fallback keeps it routing to the agent module
-    // until the daemon re-registers under `parachute-agent`.
-    const legacy = [{ name: "parachute-channel", port: 1941 }];
-    expect(findServiceByShort(legacy, "agent")?.port).toBe(1941);
-  });
-
-  test("resolves scribe too, and returns undefined for an absent module", () => {
+  test("resolves supported modules and not retired Agent rows", () => {
     expect(findServiceByShort(services, "scribe")?.port).toBe(1943);
+    expect(findServiceByShort(services, "agent")).toBeUndefined();
     expect(findServiceByShort(services, "runner")).toBeUndefined();
   });
 });

package/src/__tests__/services-manifest.test.ts

@@ -404,9 +404,9 @@ describe("services-manifest", () => {
             slug: {
               displayName: "S",
               path: "/app/s",
-              // biome-ignore lint/suspicious/noExplicitAny: deliberately
-              // writing the pre-F legacy alias to pin the normalization
-              // boundary; the schema accepts it on read.
+              // Deliberately write the pre-F legacy alias to pin the
+              // normalization boundary; the schema accepts it on read.
+              // biome-ignore lint/suspicious/noExplicitAny: legacy fixture value
               status: "pending-oauth" as any,
             },
           },
@@ -872,20 +872,7 @@ describe("services-manifest", () => {
   });
 });
 
-describe("claw → agent migration", () => {
-  // Paraclaw was renamed to parachute-agent across the ecosystem (npm
-  // package, mount path, short name). The migration was a transitional
-  // read-time rewrite that aliased legacy `name: "claw"` rows to
-  // `name: "agent"` so operators on the old shape kept routing.
-  //
-  // History: parachute-agent (the Claude-in-containers module) was retired
-  // 2026-05-20 (hub#334 added `agent` to RETIRED_MODULES), which briefly made
-  // this a one-step retirement path (claw → agent → GC'd). The 2026-06-17
-  // channel→agent rename RE-ASSIGNED `agent`/`parachute-agent` to the renamed
-  // channel module, so those names left RETIRED_MODULES — `agent` is a live
-  // module again. The claw → agent rewrite still runs; the migrated row now
-  // PERSISTS (it routes to the live agent module). The tests below assert the
-  // rewrite + the persistence.
+describe("historical Agent row retirement", () => {
   const claw: ServiceEntry = {
     name: "claw",
     port: 1944,
@@ -893,70 +880,37 @@ describe("claw → agent migration", () => {
     health: "/claw/health",
     version: "0.1.0",
   };
-  const agent: ServiceEntry = {
-    name: "agent",
-    port: 1944,
-    paths: ["/agent"],
-    health: "/agent/health",
-    version: "0.1.0",
-  };
-
-  test("rewrites name + paths + health when both name=claw and paths[0]=/claw", () => {
-    const { path, cleanup } = makeTempPath();
-    try {
-      writeFileSync(path, `${JSON.stringify({ services: [claw] }, null, 2)}\n`);
-      const got = readManifest(path);
-      // Migration ran in this read (claw → agent on raw entries), then
-      // the row was rewritten to disk. Post the 2026-06-17 channel→agent
-      // rename, `agent` is once again a LIVE module (the renamed channel
-      // module), so it is NO LONGER GC'd by RETIRED_MODULES — the migrated
-      // row persists and routes to the live agent module's mount.
-      expect(got.services).toEqual([agent]);
-      const reread = JSON.parse(readFileSync(path, "utf8")) as {
-        services: ServiceEntry[];
-      };
-      expect(reread.services[0]?.name).toBe("agent");
-      expect(reread.services[0]?.paths).toEqual(["/agent"]);
-      expect(reread.services[0]?.health).toBe("/agent/health");
-    } finally {
-      cleanup();
-    }
-  });
 
-  test("the migrated agent row PERSISTS on the next read (agent is live again post-rename)", () => {
-    // Pre-rename this was a one-step retirement path (claw → agent → GC'd).
-    // After the channel→agent rename (2026-06-17) `agent`/`parachute-agent`
-    // are re-assigned to the live module, so the row is NOT dropped — a
-    // stale paraclaw row now ends up pointing at the live agent module
-    // (harmless / arguably correct, since paraclaw was the original "agent").
+  test("strict reads retire the structural claw row immediately and persist the cleanup", () => {
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(path, `${JSON.stringify({ services: [claw] }, null, 2)}\n`);
-      const first = readManifest(path);
-      expect(first.services).toEqual([agent]);
-      const second = readManifest(path);
-      expect(second.services).toEqual([agent]);
+      expect(readManifest(path).services).toEqual([]);
+      const persisted = JSON.parse(readFileSync(path, "utf8")) as { services: ServiceEntry[] };
+      expect(persisted.services).toEqual([]);
     } finally {
       cleanup();
     }
   });
 
-  test("an already-agent entry round-trips unchanged (agent live again post-rename)", () => {
-    // Pre-hub#334 this verified the migration was idempotent; hub#334 made it
-    // GC the agent row (agent was retired). After the channel→agent rename
-    // (2026-06-17) agent is live again, so the row round-trips unchanged —
-    // back to the original idempotent behavior.
+  test("lenient hot-path reads also hide structural claw and bare channel rows", () => {
     const { path, cleanup } = makeTempPath();
     try {
-      writeFileSync(path, `${JSON.stringify({ services: [agent] }, null, 2)}\n`);
-      const got = readManifest(path);
-      expect(got.services).toEqual([agent]);
+      const channel: ServiceEntry = {
+        name: "channel",
+        port: 1941,
+        paths: ["/channel"],
+        health: "/channel/health",
+        version: "0.1.0",
+      };
+      writeFileSync(path, `${JSON.stringify({ services: [claw, channel] }, null, 2)}\n`);
+      expect(readManifestLenient(path, { warn: () => {} }).services).toEqual([]);
     } finally {
       cleanup();
     }
   });
 
-  test("mixed manifest: vault and scribe are untouched, only claw migrates", () => {
+  test("mixed manifests retain supported rows while dropping historical Agent shapes", () => {
     const { path, cleanup } = makeTempPath();
     try {
       const scribe: ServiceEntry = {
@@ -967,38 +921,13 @@ describe("claw → agent migration", () => {
         version: "0.1.0",
       };
       writeFileSync(path, `${JSON.stringify({ services: [vault, claw, scribe] }, null, 2)}\n`);
-      const got = readManifest(path);
-      // First read: claw migrates to agent (retired GC didn't see `claw`
-      // on the way in). Vault + scribe round-trip unchanged.
-      expect(got.services).toHaveLength(3);
-      expect(got.services[0]).toEqual(vault);
-      expect(got.services[1]).toEqual(agent);
-      expect(got.services[2]).toEqual(scribe);
-    } finally {
-      cleanup();
-    }
-  });
-
-  test("preserves nested /claw paths when present (e.g. /claw/api)", () => {
-    const { path, cleanup } = makeTempPath();
-    try {
-      const clawNested: ServiceEntry = {
-        name: "claw",
-        port: 1944,
-        paths: ["/claw", "/claw/api"],
-        health: "/claw/api/health",
-        version: "0.1.0",
-      };
-      writeFileSync(path, `${JSON.stringify({ services: [clawNested] }, null, 2)}\n`);
-      const got = readManifest(path);
-      expect(got.services[0]?.paths).toEqual(["/agent", "/agent/api"]);
-      expect(got.services[0]?.health).toBe("/agent/api/health");
+      expect(readManifest(path).services).toEqual([vault, scribe]);
     } finally {
       cleanup();
     }
   });
 
-  test("leaves a row alone if name is claw but mount is something else (deliberate third-party reuse)", () => {
+  test("leaves a row alone if name is claw but mount is something else", () => {
     const { path, cleanup } = makeTempPath();
     try {
       const oddClaw: ServiceEntry = {
@@ -1010,6 +939,7 @@ describe("claw → agent migration", () => {
       };
       writeFileSync(path, `${JSON.stringify({ services: [oddClaw] }, null, 2)}\n`);
       expect(readManifest(path).services).toEqual([oddClaw]);
+      expect(readManifestLenient(path, { warn: () => {} }).services).toEqual([oddClaw]);
     } finally {
       cleanup();
     }