@pome-sh/cli 0.20.0 → 0.21.0

package/node_modules/@pome-sh/twin-github/package.json

@@ -1,63 +0,0 @@
-{
-  "name": "@pome-sh/twin-github",
-  "version": "0.9.0",
-  "description": "Deterministic GitHub-shaped twin for agent testing — REST + MCP, SQLite-backed state.",
-  "private": false,
-  "type": "module",
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/src/index.d.ts",
-      "default": "./dist/src/index.js"
-    },
-    "./server": {
-      "types": "./dist/src/server.d.ts",
-      "default": "./dist/src/server.js"
-    },
-    "./*": {
-      "types": "./dist/src/*.d.ts",
-      "default": "./dist/src/*.js"
-    }
-  },
-  "bin": {
-    "twin-github": "./dist/src/server.js"
-  },
-  "files": [
-    "dist",
-    "FIDELITY.md",
-    "README.md",
-    "fidelity.inventory.json"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "@hono/node-server": "^2.1.0",
-    "@pome-sh/sdk": "0.11.1",
-    "@pome-sh/shared-types": "0.14.1",
-    "hono": "^4.13.0",
-    "zod": "^4.4.3"
-  },
-  "keywords": [
-    "github",
-    "twin",
-    "test-double",
-    "agent-testing",
-    "mcp",
-    "pome"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/pome-sh/digital-twins.git",
-    "directory": "packages/twin-github"
-  },
-  "homepage": "https://github.com/pome-sh/digital-twins/tree/main/packages/twin-github",
-  "bugs": {
-    "url": "https://github.com/pome-sh/digital-twins/issues"
-  },
-  "license": "Apache-2.0",
-  "engines": {
-    "node": ">=24"
-  }
-}

package/node_modules/@pome-sh/twin-gmail/CHANGELOG.md

@@ -1,126 +0,0 @@
-# @pome-sh/twin-gmail — CHANGELOG
-
-
-## 0.3.3 — 2026-08-04
-
-Dependency-only patch (#302): `hono` `^4.12.31` → `^4.13.0`, `zod` `^4.1.13` → `^4.4.3`, `@hono/node-server` `^2.0.10` → `^2.1.0`.
-No source file changed and `npm run test:contract` is green, so the surface is
-identical — this exists so the npm artifact stops differing from `main`, which is
-the staleness the publish skip-guard cannot see.
-
-## 0.3.2 — 2026-08-04
-
-- Re-pinned to `@pome-sh/sdk@0.11.0` for the F-1200 parent-vocabulary
-  change: a recorded row now carries `parent_event_id` rather than `parent_id`.
-  No change to this twin's own surface — `npm run test:contract` is green.
-
-## 0.3.1 — 2026-08-03
-
-Every state-reading check says where it looked (F-1197).
-
-- 6 declarations now fill `CheckOutcome.evidenceStatePaths` (new in
-  `@pome-sh/sdk` 0.10.1) with RFC 6901 pointers into this twin's exported tree.
-- `check-state.ts`'s resolvers return the pointer they walked. `Resolved<T>`'s
-  found arm gains `path`; its missing arm gains an optional `searched`, naming
-  the collection a failed lookup scanned.
-- `checks-contract.test.ts` gains the citation gate and an EMPTY
-  `HONEST_UNCITED_CHECKS` ledger.
-
-A failed lookup cites too, and that is the half worth knowing about. A message the export does not carry is the commonest refusal here, and it is the one a reader most wants to check.
-So the honest citation on that arm is not the row — there is none — but the list:
-*this is where I looked, see for yourself that it is not in it.*
-
-Requires `@pome-sh/sdk` 0.10.1: the declarations call `statePath` /
-`childStatePath`, which 0.10.0 does not export.
-
-No sentence, template, substrate or check id changed, so `checksDigest` is
-identical and no criterion re-binds.
-
-## 0.3.0 — 2026-07-30
-
-Gmail declares its assertable check vocabulary (F-1128, milestone A3).
-
-- New `./checks` subpath: `GMAIL_CHECKS`, seven declarations, plus the
-  `GmailCheckState` model they read (`check-state.ts`). pome-cloud deletes its
-  hand-maintained mirror of that shape in the same milestone — the twin's model
-  is now the only one.
-- Four declarations are new and bind the six criteria A3 found unbound across
-  tasks 22, 23 and 27: `gmail.message-has-label` (which clears three of them,
-  because two tasks say the same sentence), `gmail.label-exists`,
-  `gmail.draft-addressed-to` and `gmail.draft-count-at-least`.
-- Three are carried across from pome-cloud's hand-written regexes:
-  `gmail.mailbox-label-count`, `gmail.one-message-per-recipient` and
-  `gmail.no-unsupported-endpoint`. The last drops the twin word — it is now the
-  same sentence twin-github declares, resolved per-twin by the engine — so
-  `examples/gmail-retry-notify` is rewritten to the rendered templates in the
-  same commit.
-- `gmail.draft-addressed-to` declares its recipient as the check's `subject`.
-  pome-cloud has carried a prediction since F-1028 that this exact criterion
-  becomes an unguarded redaction hazard the day a gmail draft-recipient
-  predicate ships without one.
-- Two shapes drove the state model and are pinned by tests rather than left as
-  comments: an exported draft row carries no addressing at all (the recipient
-  lives on the backing message, reached through `messageId`), and message
-  bodies are digested away unconditionally — so no check on this twin can scan
-  message prose.
-- Ambiguity is closed in the reader rather than the grammar: a message id
-  present in more than one mailbox returns `message_ambiguous` instead of
-  grading whichever sorted first. Gmail mints ids per mailbox, and the corpus
-  sentences carry no mailbox.
-- New `test/fidelity-contract.test.ts` adds the state-shape parity arm gmail
-  never had. The existing parity harness's rings are all about the tool surface;
-  nothing had ever compared `exportGmailState()` against the shape a consumer
-  reads.
-- `vitest.config.ts` replaces the `test` script's hand-maintained file list.
-  `faults.test.ts` had already fallen off it — a suite that exists, passes, and
-  never ran.
-
-
-## 0.2.1 — 2026-07-30
-
-Dependency-only patch: repin `@pome-sh/sdk` to 0.10.0 (F-1126). No surface change.
-
-The repin is not cosmetic. npm only symlinks a workspace sibling when the
-declared pin matches its version; a stale pin makes npm install a nested
-PUBLISHED copy instead, so the package is built and tested against the registry
-rather than this tree. `scripts/check-workspace-pins-match-workspace.mjs` now
-gates it.
-
-## 0.2.0 — 2026-07-24
-
-### Added
-
-- Named `rate-limited` fault-injection seed primitive (F-917). Gmail seeds accept
-  an optional `faults` array (default `[]`, opt-in). `rate-limited` throttles a
-  target operation (default `messages.send`) by call count: the first
-  `succeedFirst` calls succeed, the next `throttleFor` return 429
-  `RESOURCE_EXHAUSTED` (retry hint in the body, no `Retry-After` header), then
-  calls recover; the counter is per twin instance and cleared by
-  `POST /admin/reset`. Default seed behavior is unchanged.
-
-## 0.1.2 — 2026-07-23
-
-Fix: declare `@hono/node-server` as a direct dependency. The twin's
-`server.js` boots via the SDK `serve()` helper, which imports
-`@hono/node-server` (an optional peer of `@pome-sh/sdk`). Without a direct
-dependency, a clean install (e.g. the hosted Vercel Sandbox snapshot build)
-failed to start the server with `ERR_MODULE_NOT_FOUND`. twin-github and
-twin-linear already declared it; gmail now matches. No twin surface change.
-
-## 0.1.1 — 2026-07-21
-
-Dependency-only patch: repin `@pome-sh/sdk` to 0.5.1 (F-818 batch). No twin
-surface change.
-
-## 0.1.0 — 2026-07-20
-
-First public release of the deterministic Gmail twin:
-
-- Broad frozen Gmail v1 REST and upload surface with loud named 501 gaps.
-- Captured ten-tool first-party Gmail MCP listing and structured results.
-- Deterministic SQLite mailbox state, MIME handling, search, history, labels,
-  drafts, settings, bounded state export, and recorder payload projection.
-- CLI, scenario, runtime-contract, package, and signed-image integration.
-
-Authentication is Pome-owned. `POME_GMAIL_TOKEN` aliases the session JWT and
-the package does not implement Google OAuth or add `provider_credentials.gmail`.

package/node_modules/@pome-sh/twin-gmail/HOSTED.md

@@ -1,45 +0,0 @@
-# Hosted Gmail handoff
-
-OSS package + CLI are release-ready independently of hosted support. Use this
-checklist to split **OSS-ready** work from **cloud-owned** gating. No cloud
-imports belong in this package.
-
-## OSS-ready (this repo)
-
-| Item | Status / note |
-| --- | --- |
-| Package `@pome-sh/twin-gmail` | Deterministic domain, REST, Gate-1 13-tool MCP |
-| Registry id | `gmail` (twin id / CLI `--twin gmail`) |
-| JWT claim | `gmail_email` — default local mailbox `pome-agent@pome-twin.test` |
-| Agent token env | `POME_AUTH_TOKEN` + alias `POME_GMAIL_TOKEN` (same JWT) |
-| Seed / admin | `/admin/seed`, `/admin/reset`, `/_pome/state`, `/_pome/events` |
-| Image tag family | `ghcr.io/pome-sh/twins:gmail-*` (publish after CI + secret-scan) |
-| Local tasks | Inbox triage, first-party MCP parity, multi-twin with GitHub |
-| Fidelity artifacts | `fidelity.inventory.json`, `FIDELITY.md`, fixtures under `fixtures/` |
-
-## Cloud-owned (Pome Cloud — not this repo)
-
-Complete before advertising hosted Gmail:
-
-1. **Registry** — Add `gmail` to the mounted/provisionable twin registry and
-   consume a `@pome-sh/shared-types` version that includes `gmailSeedStateSchema`.
-2. **JWT claims** — Mint the session JWT with
-   `gmail_email: "pome-agent@pome-twin.test"` by default, or the normalized
-   primary mailbox email from the accepted Gmail seed.
-3. **Credentials** — Do **not** add `provider_credentials.gmail`. Return the
-   normal `agent_token`; clients expose it as both `POME_AUTH_TOKEN` and
-   `POME_GMAIL_TOKEN`.
-4. **Digest routing** — Route the signed `ghcr.io/pome-sh/twins:gmail-*`
-   digest (cosign-verify + pin). Publish Gmail `api_url`, `mcp_url`, and
-   `openapi_url` under `per_twin.gmail`.
-5. **Pod seed / capture** — Forward the Gmail seed unchanged to the pod,
-   capture `/_pome/state` and `/_pome/events`, retain MIME/attachment
-   projection redaction.
-6. **Hosted verification** — Run official-client, thirteen-tool MCP parity,
-   and multi-twin tasks against the hosted route before enabling the
-   product flag.
-7. **Fidelity watch** — Register the signed digest on the fidelity
-   dashboard/watch list.
-
-Until that gate passes, documentation must describe Gmail as **local/OSS-ready**,
-not hosted-ready.

package/node_modules/@pome-sh/twin-gmail/LIMITS.md

@@ -1,51 +0,0 @@
-# Domain limits
-
-Pinned limits enforced by seed, MIME, search, REST list/batch, and MCP pageSize.
-
-| Limit | Value | Notes |
-| --- | --- | --- |
-| Raw MIME bytes (accept) | `36700160` | Checked before parse and after base64url decode |
-| Decoded MIME bytes | `36700160` | Canonical raw upper bound |
-| Header count / header bytes | `1000` / `262144` | Folded headers count after unfolding |
-| MIME parts / nesting depth | `500` / `20` | Multipart boundaries fail loudly |
-| Recipients (To+Cc+Bcc) | `500` per field in seeds | Send delivery is deduplicated by normalized address |
-| Attachment count / filename bytes / attachment bytes | `100` / `512` / bounded by raw | Recording projects to `{sha256,size}` |
-| `messages.send` / insert media `maxSize` (discovery) | `36700160` | From discovery; twin may lower |
-| `messages.insert` / `import` media `maxSize` (discovery) | `157286400` | From discovery; twin may lower |
-| Draft create/update media `maxSize` (discovery) | `36700160` | From discovery; twin may lower |
-| Search query bytes / tokens / nesting / branches | `4096` / `256` / `20` / `256` | Shared AST for domain + filters |
-| In-memory search mailbox messages | `10000` | Intentional bound: hydrate + JS predicate; **loud fail** above budget. Parameterized SQL compile of the AST is deferred |
-| Colored-star `has:*-star` | unsupported | Loud reject; use `is:starred` (system `STARRED` only) |
-| Labels per mailbox / per message | `5000` / `100` in seeds | |
-| Filters per mailbox | `1000` in seeds | `action.forward` → 501 (no forwarding delivery) |
-| Batch modify/delete ID count | `1000` | Enforced on `batchModify` / `batchDelete` |
-| List `maxResults` | default `100`, max `500` | REST messages/threads/drafts/history |
-| History page size | default `100`, max `500` | Same `maxResults` cap as other lists |
-| MCP `pageSize` | default `20`, max `50` | `search_threads` / `list_drafts` / `list_labels` |
-| State export message bodies | always digested | `/_pome/state` never includes plaintext text/html/headers/snippet (sha256 digests only); collections capped at `2000` rows; **history** keeps the newest 2000 when truncated (messages/attachments/labels keep oldest-first); body-omission flag set when mailbox exceeds `500` messages |
-| SQLite bind parameters | parameterized only | Query text is never interpolated |
-| Packaged boot | ≤ 3s | Contract gate (later) |
-
-## Page tokens
-
-Opaque page tokens are HMAC-signed and bound to mailbox email, route, normalized
-query/filter, and the mailbox history high-water mark. The signing key resolves as:
-
-1. `POME_GMAIL_PAGE_TOKEN_SECRET` when set
-2. else a key derived from `TWIN_AUTH_SECRET`
-3. else a per-process ephemeral secret
-
-There is no forgeable public default string. Cross-mailbox, cross-query, and stale
-snapshot tokens fail with `invalidArgument`.
-
-## Fault seeds
-
-Opt-in named fault-injection primitives (default none; a seed's `faults` array
-defaults to `[]`). The name is reusable teaching vocabulary — any task may seed
-it. See CONTRACT.md (Gmail pins).
-
-| Fault | Target (default) | Behavior |
-| --- | --- | --- |
-| `rate-limited` | `messages.send` | First `succeedFirst` (default 2) matching calls succeed; the next `throttleFor` (default 3) return **429 `RESOURCE_EXHAUSTED`** (retry hint in body; `retryAfterSeconds` default 1); then calls recover. Counter is per twin instance, cleared by `POST /admin/reset`. |
-
-See `performanceBudgets` in [`fidelity.inventory.json`](fidelity.inventory.json).

package/node_modules/@pome-sh/twin-gmail/README.md

@@ -1,150 +0,0 @@
-# `@pome-sh/twin-gmail`
-
-Deterministic Gmail-shaped twin for agent testing (Pome).
-
-**Status: OSS release candidate.** This package includes the deterministic
-SQLite mailbox model, strict seed/reset APIs, canonical MIME storage, identity,
-delivery, drafts, labels/history/search, bounded semantic state export,
-recording projection, the frozen Gmail REST/upload surface, and the captured
-thirteen-tool first-party MCP contract (Gate 1).
-
-## Auth identity (frozen)
-
-| Item | Value |
-| --- | --- |
-| Claim | `gmail_email` on the Pome session JWT |
-| Default local mailbox | `pome-agent@pome-twin.test` |
-| Agent token env | `POME_GMAIL_TOKEN` (alias of `POME_AUTH_TOKEN`) |
-| Bearer | Pome session JWT — **not** a Google OAuth access token |
-
-Pome owns authentication. This twin does **not** implement Google consent
-screens, OAuth codes, refresh tokens, JWKS, or scope issuance.
-
-Mailbox resolution accepts only `me` or the exact `gmail_email` value.
-Unknown/cross-mailbox access returns the captured Gmail not-found shape without
-revealing mailbox existence.
-
-## Gate 0 artifacts
-
-| Path | Role |
-| --- | --- |
-| [`fixtures/rest-surface.json`](fixtures/rest-surface.json) | Frozen launch REST method/parameter/media matrix from Gmail v1 discovery |
-| [`fixtures/mcp-tools-list.*.json`](fixtures/) | Official Gmail MCP `tools/list` raw + canonical (13-tool Gate-1 launch set) |
-| [`fidelity.inventory.json`](fidelity.inventory.json) | Heat × fidelity × evidence for every launch REST/MCP row |
-| [`FIDELITY.md`](FIDELITY.md) | Human-readable heat × fidelity tables (linted against inventory) |
-| [`REFERENCE-DIVERGENCES.md`](REFERENCE-DIVERGENCES.md) | Emulate rejected; never an oracle |
-| [`LIMITS.md`](LIMITS.md) | Limit placeholders (discovery maxima + TBD local caps) |
-
-See [`fixtures/README.md`](fixtures/README.md) for capture provenance and SHA-256.
-
-## Launch MCP tools (exactly 13)
-
-`create_draft`, `list_drafts`, `get_thread`, `get_message`, `search_threads`,
-`label_thread`, `unlabel_thread`, `apply_sensitive_thread_label`, `list_labels`,
-`label_message`, `unlabel_message`, `apply_sensitive_message_label`,
-`create_label`.
-
-Order and schemas are frozen from the live Developer Preview listing capture.
-Gate 1 promotes `get_message` and the two `apply_sensitive_*` tools that were
-previously named cold preview drift under the Gate 0 ten-tool freeze.
-
-## Named 501 gaps (not fake success)
-
-- `users.watch` / `users.stop` — no Pub/Sub; loud 501
-- Resumable upload initiation/chunks — loud 501
-- Filter `action.forward` — loud 501 (no forwarding delivery)
-- `processForCalendar=true`, `deleted=true` on insert/import — loud 501
-
-## Non-goals
-
-- External SMTP / network mail delivery (`messages.send` is a mailbox-state transition)
-- Pub/Sub push notifications
-- Google OAuth/OIDC
-- Calendar, Drive, Contacts, client UI, CSE, delegates, S/MIME, admin controls
-- HTTP batch API
-- Resumable upload
-- Expanding MCP beyond the frozen Gate-1 13-tool launch set without a new ruling
-
-## Limits
-
-See [`LIMITS.md`](LIMITS.md). Defaults/maxima from discovery are frozen in
-`rest-surface.json`. Page tokens are HMAC-bound to mailbox/query/snapshot; set
-`POME_GMAIL_PAGE_TOKEN_SECRET` or rely on `TWIN_AUTH_SECRET` (see LIMITS.md).
-
-## Stateful parity with other first-party twins
-
-Gmail follows the same SDK chassis as GitHub / Slack / Stripe:
-
-| Capability | Gmail | Notes vs peers |
-| --- | --- | --- |
-| `defineTwin` + SQLite domain | yes | Same `@pome-sh/sdk` boot path |
-| `/_pome/state` | yes | Bounded digests; history prefers newest 2000 when capped |
-| `/_pome/events` + durable recorder | yes | `recordingProjection` redacts MIME/bodies |
-| `/admin/reset` + `/admin/seed` | yes | Reports `state_delta` like GitHub (Stripe freezes admin unrecorded) |
-| MCP `reportDelta` / no-op `state_mutation=false` | yes | Aligned with REST `rest-routes-kit` |
-| Session identity claim | `gmail_email` | Peers use provider-shaped claims |
-
-Intentional differences: no Google OAuth (Pome JWT only); watch/stop 501; Stripe-style idempotency/failure-injection middleware is Stripe-only.
-
-## Runtime contract (for snapshot consumers)
-
-`pome-cloud` builds a Vercel Sandbox snapshot from this package's signed source
-artifact. The following constraints must hold for that build to succeed and for
-the resulting snapshot to boot. Changing any of these is a breaking change for
-hosted; land the producer change here first, then open the cloud consumer PR
-that pins and verifies the new signed digest.
-
-### Build
-
-- Package is `npm install`-able from `package.json` alone (no `workspace:*`
-  protocols, no package-manager-specific deps; no committed lockfile is required, the snapshot
-  build regenerates one on each rebuild)
-- `npm run build` exits 0 and emits `dist/src/server.js`
-- Built output is loadable under Node 24 — the snapshot runs `runtime: "node24"`.
-  SQLite is the built-in `node:sqlite` (via the sdk's `openTwinDatabase()`) —
-  no native modules, no compiler toolchain.
-
-### Runtime
-
-- Server entry: `node dist/src/server.js` (cwd = package root)
-- Listens on `:3336` by default (`GMAIL_TWIN_PORT`, then the native default)
-- **Hosted normalizes the port to `PORT=3333`.** The server honors the `PORT`
-  env var first (`PORT` → `GMAIL_TWIN_PORT` → `3336`); the pome-cloud
-  control-plane sets `PORT=3333` at spawn for every twin, so the native `3336`
-  default is only used for standalone local runs.
-- Honors `GMAIL_TWIN_HOST=0.0.0.0` env (default `127.0.0.1` is unreachable via
-  Vercel Sandbox port forwarding)
-- `GET /healthz` returns 200 within ~3s of process start (the snapshot build
-  sleeps 3s after `node dist/src/server.js` before probing)
-- Seed via `POME_SEED_JSON` (strict Gmail seed schema)
-- Bearer auth at `Authorization: Bearer <jwt>` — Pome session JWT, not a Google
-  OAuth access token
-
-### Cloud consumer coordination
-
-- Bumping any of the above = publish a signed twin digest and open the matching
-  `pome-cloud` consumer PR.
-
-## Development
-
-```bash
-npm test -w @pome-sh/twin-gmail
-npm run typecheck -w @pome-sh/twin-gmail
-```
-
-Fixture smoke tests assert launch tool count/order and that watch/stop are
-marked `named_gap_501`; domain tests cover seed/identity, MIME round-trip,
-draft replacement, message labels and computed thread labels, history, search,
-local delivery/Bcc privacy, state export, and recorder payload projection.
-
-## CLI
-
-```bash
-npx @pome-sh/cli twin start gmail
-# prints POME_GMAIL_REST_URL, POME_GMAIL_MCP_URL, POME_AUTH_TOKEN,
-# and the identical POME_GMAIL_TOKEN alias
-```
-
-Use `pome tasks gmail --copy` for the inbox-triage and captured first-party
-MCP parity tasks. Hosted rollout is gated separately; see
-[`HOSTED.md`](HOSTED.md).

package/node_modules/@pome-sh/twin-gmail/REFERENCE-DIVERGENCES.md

@@ -1,42 +0,0 @@
-# Reference divergences — Emulate is not an oracle
-
-Emulate (and similar Gmail fakes) may be useful as a **coverage checklist** for which
-surfaces agents poke. They are **never** a behavioral oracle for `@pome-sh/twin-gmail`.
-
-The oracles for this twin are:
-
-1. Frozen Gmail API v1 discovery → [`fixtures/rest-surface.json`](fixtures/rest-surface.json)
-2. Captured / documented official Gmail MCP listing → [`fixtures/mcp-tools-list.canonical.json`](fixtures/mcp-tools-list.canonical.json)
-3. Sanitized live Gmail REST captures (when reconciled later)
-4. This package’s invariants (draft ID replacement, mailbox-local IDs, no false watch success, etc.)
-
-## Explicitly rejected Emulate-known-bad behaviors
-
-| Rejected behavior | Twin rule |
-| --- | --- |
-| **In-place draft message IDs** — updating a draft keeps the same underlying Gmail message id | Draft **id** is stable; each update **replaces** the underlying Gmail message id. Send deletes the draft/draft message and creates a new `SENT` message id. |
-| **Permissive malformed JSON** — accepting broken bodies / wrong types with silent coercion | Reject malformed JSON and schema violations with the captured Gmail/MCP error envelope. No silent coercion. |
-| **Numeric offset page tokens** — `pageToken` as an integer offset | Page tokens are opaque, versioned, tamper-evident, bound to mailbox/route/query/sort/snapshot. Malformed/cross-query tokens fail loudly. |
-| **Shallow search** — substring-only or partial operator support presented as Gmail search | Implement the full operator grammar declared by the captured `search_threads` tool; message-first match then thread expansion. Unknown operators (and unknown `category:` values) fail loudly — they never silently fall back to full-text match. `category:primary` maps to `CATEGORY_PERSONAL`. Colored-star `has:*-star` operators are **loud-rejected** (twin has system `STARRED` only via `is:starred`). Search evaluation is intentionally in-memory with a hard mailbox-size budget (`LIMITS.md`); SQL compile of the AST is deferred. |
-| **Incomplete settings methods** — advertising filters/sendAs/forwarding while omitting declared launch methods or inventing extras | Launch settings surface is exactly the frozen set in `rest-surface.json` (`filters` list/get/create/delete, `forwardingAddresses` list/get, `sendAs` list/get). Everything else is unsupported/501. |
-| **Nondeterministic values** — random ids, wall-clock-only dates, unordered collections | Reset/seed produces deterministic ids, dates, and sorted exports. Tests pin order and values. |
-| **Successful inert `watch` / `stop`** — HTTP 200 registration that does nothing | `users.watch` and `users.stop` are **named gaps** returning the loud **501** unsupported envelope. No fake Pub/Sub success. No network I/O. |
-
-## Offline fidelity notes (no Google OAuth required)
-
-Checked against frozen discovery / public API docs (not live authenticated Gmail):
-
-| Surface | Official expectation | Twin behavior | Evidence |
-| --- | --- | --- | --- |
-| `threadId` on send/insert/import/draft | Optional; when present and owned, message joins that thread | Honors explicit owned `threadId` even without In-Reply-To/References | `storage.resolveThread`, domain/REST send paths |
-| Draft send identity | Send removes draft; sent message retains draft's thread | Solo drafts keep thread id across delete→send (empty thread preserved until send) | `domain.sendDraft` |
-| Bad search `q` | Client input error → `400 INVALID_ARGUMENT` | Search/MIME client failures throw `GmailError(400)`; REST `asInputError` + MCP `errorEnvelope` | `search.ts`, `mime.ts`, `errors.ts` |
-| `users.watch` / `users.stop` | Live Gmail uses Pub/Sub | Named gap **501** (never fake registration) | `rest-routes-resources`, `rest-surface.json` |
-
-Live authenticated Gmail calls were **not** run (no OAuth credentials). Offline checks used `fixtures/rest-surface.json`, packaged discovery raw fixture, `npm run fidelity:parity`, and `npm run preview:drift` when available.
-
-## Other non-oracles
-
-- Google OAuth/OIDC consent screens, refresh tokens, JWKS, and scope issuance are **out of scope**. Pome session auth + frozen `gmail_email` claim only.
-- External SMTP delivery, Pub/Sub push, forwarding delivery, Calendar, Drive, Contacts, CSE, HTTP batch, and resumable upload are **out of scope** (loud failure, never silent success).
-- Live Developer Preview MCP may expose tools beyond the launch 10; the twin does **not** expand the listing to chase preview drift without a new Gate 0 ruling.