@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/shared/tests/architecture-ratchet.baseline.json

@@ -1,14 +1,14 @@
 {
   "measuredAt": "2026-10-29",
-  "note": "RATCHET: every reading in this file may only FALL. Lower a value (or remove an entry) when a refactor genuinely shrinks it; never raise one to accommodate a red. A legitimate RAISE must be recorded here in AC-394's \"RECORDED CHANGE\" format: a dated paragraph naming the file, the old→new reading and why the increase is the honest shape of the change. The criterion prints `ratchet: <dimension> <file> <baseline>→<measured>，可下调基线` whenever a reading falls; lowering the baseline is encouraged but not required, so a parallel refactor that shrinks a reading never reds this criterion. A RECORDED CHANGE (2026-10-26, census re-sync by gap-codex-transcript-format-shared-helpers): `src/modules/architecture/semanticZoomLayout.ts` 1642→1688 and `src/modules/architecture/semanticZoomPlan.ts` 876→894 are raised to their measured values on develop. Both files are byte-identical to the develop tip in the re-recording tree — the growth landed in the architecture commits up to 3f1b1ea23 AFTER the census commit f7d20cdcb captured these readings, and no commit re-recorded it, so the criterion redded a tree neither this task nor its delta touches. This is a stale-census re-sync, not an accommodation of new growth: no entry is raised above its current reading, and the two files are not part of this task's delta. A RECORDED CHANGE (2026-10-27, cockpit-card-provider-contract-and-registry): `server/index.ts` 2754→2769, `server/shared/types.ts` 4629→4749 and `src/shared/types.ts` 4123→4243. This task introduces the cockpit card contract: the two types files each gain the 120-line card wire vocabulary (both ends are hand-copied and a TypeSync criterion compares them field-for-field, so the shape exists twice by design, not by duplication), and `server/index.ts` gains the three statements that build the card module and mount its authenticated router. The increase IS the deliverable — no new module carries the types instead, because the contract is the server/client seam. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, observation-session-ask-decision-digest): `server/shared/types.ts` 4749→4821. This task adds the 72-line ask/decision wire vocabulary (SessionAskDecisionOption, SessionAskDecision, SessionAskDecisionReading, SessionAskEventKind, SessionAskEvent) that the transcript reader, the answer normaliser, the digest producer and the injected ISessionAskEventWriter seam all share. The backend module standard puts a type used in two or more files in `server/shared/types.ts`, and no new module carries it instead: the event envelope is the seam quay-fleet's context-event stream will consume, so it is a shared contract rather than observation-internal state. The increase IS the deliverable, recorded on the same entry the preceding cockpit card contract raised for the same reason. A RECORDED CHANGE (2026-10-27, cockpit-card-ui-core): `src/shared/api.ts` 1749→1766 and `src/modules/cockpit/CockpitPage.tsx` 1881→1883. This is the UI half of the same cockpit card contract: `src/shared/api.ts` gains the two client entry points the card view calls (`cockpitCards` = GET /api/cockpit/cards and `cockpitConfirmCard` = POST /api/cockpit/cards/confirm, each with the revision/`optionId`/`replyText` shape the server enforces) — the API client surface IS where the client seam belongs, so no new module carries them instead; `CockpitPage.tsx` gains the one `cards` arm of the header's existing view-label ternary so `/cockpit?view=cards` names itself like every other view. The card UI itself lives in new files (`cockpitCardController.ts`, `CockpitCard*.tsx`, descriptors, hook), so it does not grow any baselined file. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, cockpit-card-session-executors): `server/index.ts` 2769→2777, `server/shared/types.ts` 4821→4839 and `src/shared/types.ts` 4243→4261. This task adds the two built-in cockpit content executors (`session.send`, `session.start`) and the subject-derived 「自己的回复」 default. The two types files each gain the same 18-line wire vocabulary (`CockpitFixtureSubject` plus the projection-owned `ownReplyUnavailable` field). They exist twice by design: the card wire contract is hand-copied on both ends and a TypeSync criterion compares the copies field-for-field, so no new module can carry the types instead. `server/index.ts` moves the card module's construction BELOW the one chat control service its executors send through, and gains the `createCockpitCardExecutors(...)` argument, the `fixtureSubject` argument and their one import; the increase IS the wiring statement the task requires at the composition root, and the binding itself lives in the new `server/cockpit-executors-wiring.ts` so this file grows by only the composition lines. A RECORDED CHANGE (2026-10-27, cockpit-card-brief-rendering): `server/shared/types.ts` 4839→5074 and `src/shared/types.ts` 4261→4496. This task adds the 235-line brief wire vocabulary (CockpitBriefResponse, the seven preset block shapes and their nested option/evidence/axis/series/row/token/failure types) at the same group boundary on both ends. The shape exists twice by design: the brief read is the server/client seam, the client copy is hand-mirrored, and `cockpitCardTypeSync.test.ts` reads both ends field-for-field, so no new module can carry the types instead. `src/shared/api.ts` 1766→1773 gains the one `cockpitCardBrief(cardId)` entry point (GET /api/cockpit/cards/:id/brief) the Details drawer calls; the endpoint belongs on the centralized client API surface rather than in the component. The increase IS the deliverable. A RECORDED CHANGE (2026-10-27, cockpit-mobile-header-and-page): `src/modules/cockpit/cockpitCardController.ts` is a NEW `oversizeFiles` entry at 871 (it was unbaselined at 766 on develop). This task adds the card page's route memory to the controller that already owns `selectedCardId` and `anchorCardId`: the `CockpitCardMemory` seam, the normalization that turns an unreadable store into \"start at the top\", the deferred restore of the remembered selection once the card list exists, and `setScrollPosition`'s persistence. The rule — \"the person returns to the card and the scroll offset they left\" — is a list rule, and putting a second owner beside it would be a second answer; no new module carries it instead, because the seam is the controller's own dependency contract and the binding only supplies the storage. The additions are the measured 105 lines; the file was already near the 800-line limit on develop, so this is the honest shape of the change, not a reorganization for line count. A RECORDED CHANGE (2026-10-27, observation-session-ask-event-writer-wiring): `server/index.ts` 2777→2788, and `server/shared/ports/session-ask-events.port.ts` is a NEW `moduleMutableState` entry at 1. The task wires the observation layer's `session.asking`/`session.answered` to the host-level context-event writer through a new install-style port (the same shape every sibling in `server/shared/ports/` already has, which is why each of them carries exactly this one reading): the port owns the installed-writer slot, and the composition root installs the adapter. `server/index.ts` grows by the port import, the adapter import/installation and the comment that states why a v0 fleet counts the two kinds instead of throwing; no existing statement was rewritten, so the increase IS the wiring the task requires at the composition root. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, cockpit-fleet-card-provider): `server/index.ts` 2788→2797, `server/shared/types.ts` 5074→5081 and `src/shared/types.ts` 4496→4503. This task registers the quay-fleet card provider at the composition root and adds the one card field that names why locally-filled content is not ready. `server/index.ts` gains the import and the `providers` entry that passes `cockpit.fleetCards.enabled` and `ttlMs` into `createCockpitCardsModule`; the fleet CLI and digest bindings live in the new `server/cockpit-fleet-wiring.ts`, so this file grows only by its composition statements. The two types files each gain the same 7-line `contentUnavailable?` field on `CockpitCard` with its doc comment: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-ac425-card-viz-and-zone-coverage): `server/shared/types.ts` 5081→5112 and `src/shared/types.ts` 4503→4534. This task adds the 31-line small-visualization wire vocabulary (`CockpitCardVizKind`, the `CockpitCardViz` reading envelope, and the `viz?` field on `CockpitCard`) at the same group boundary on both ends. The shape exists twice by design: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field (this task adds both rows to that comparison), so no new module can carry the types instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-voice-keyboard-shortcut-toggle): `src/modules/chat/ChatInterface.tsx` 1395→1443 and `src/modules/chat/composer/ChatComposer.tsx` 1606→1628. This task wires a configurable keyboard chord to the two voice surfaces the pane owns: `ChatInterface` holds the registered dictation toggle, derives the Live Voice toggle from `composerMode`, and mounts the shortcut hook (48 lines), while `ChatComposer` registers its own `handleVoiceToggle` with the pane on each render (22 lines). Both increases ARE the wiring: the shortcut must reach the same handlers the on-screen controls use, and a second copy of that caret/draft logic in the pane is exactly the drift the shared `handleVoiceToggle` seam exists to prevent. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-voice-shortcut-options): `src/modules/chat/ChatInterface.tsx` 1443→1477 and `src/modules/chat/composer/ChatComposer.tsx` 1628→1633. This task extends the same shortcut feature with three bindings — send-on-stop, cross-surface cancel and clear-input. `ChatInterface` gains the four pane-level readings the controller routes on (`stopAndSendDictation`, `isDictationRecording`, `isLiveVoiceActive`, and `isClearAvailable`, which mirrors the Escape guard's own condition so the clear chord cannot become a laxer second way to dismiss a running turn or an open menu), moves the shortcut block below `handleVoiceExit` so leaving Live Voice reuses the bar's own exit path (backlog back to the composer, run keeps going) instead of the bare mode teardown, and passes the larger command bag to `useVoiceShortcuts`; `ChatComposer` registers `stopAndSend` and the live `recording` reading with the pane. Both increases ARE the wiring: every new command is a pane-level fact (composer draft, processing state, dock/menu visibility) the React-free controller cannot read itself, and the chords must reach the same handlers the on-screen controls use. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-cockpit-live-cards-session-link-confirmability-and-titles): `server/shared/types.ts` 5112→5120 and `src/shared/types.ts` 4534→4542. This task adds the option confirmability vocabulary (`confirmable?` and `confirmableReason?` on `CockpitCardOption`) at the same group boundary on both ends. The shape exists twice by design: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the fields instead. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-27, cockpit-card-anatomy-matches-mockups): `server/shared/types.ts` 5120→5144, `src/shared/types.ts` 4542→4566 and `src/modules/cockpit/cockpitCardController.ts` 871→876. This task adds the card header's two provider-stated readings on the wire — `CockpitCard.load` (the 0–3 decision weight the header's three cells draw) and `CockpitCardSubject.title` (the subject's display name) — plus the `attempts` viz reading (`CockpitCardVizOutcome`, `CockpitCardVizAttempt`, and `cap`/`items` on `CockpitCardViz`), which turns the stuck/fix dot row into a per-attempt reading. The card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field (this task adds the two new rows), so no new module can carry the types instead; the increase IS the deliverable. The controller grows by the widened `isIrreversibleOption` predicate, which now also recognises the current `irreversible` tag name beside the pre-vocabulary `warn`; the predicate already lives there and a second copy would be the drift the single rule exists to prevent. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, cockpit-shell-filters-mobile-page-and-details-bar): `src/modules/cockpit/cockpitCardController.ts` 876→1047 and `src/modules/cockpit/CockpitPage.tsx` 1883→1902. This task adds the cards page's two filters to the controller that already owns the card list, selection and scroll memory: type chips with per-type counts constrained by the project selection, a multi-select project set with per-project counts constrained by the type, and the per-device persistence seam (`rememberFilters`) that restores both across a rebuild. The filtering rule — which cards are visible, and what each chip's count is under the other filter — is one rule, so a second owner beside the controller would be a second answer; the controller's dependency contract is where the storage binding belongs, and no new module carries it instead. `CockpitPage.tsx` grows by the mobile-width reading and the three `{!phoneCards && …}` wrappers that keep the deploy strip, project strip and Focus row off the phone's cards page while leaving them on wall/fleet/board. Both increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-quay-tests-fanin-read-via-suite-verb-and-driver-log): `server/shared/types.ts` 5144→5168, `src/shared/types.ts` 4566→4590 and `src/modules/quay/QuayPanel.tsx` 1120→1176. This task moves the Tests/Fan-in readings off the local `.quay/` carrier files and onto quay's own read verbs (`quay suite`, `quay driver log`). The two types files each gain the same 24-line `QuayCarrierReading` vocabulary and the optional `carrierReadings` field on `QuaySnapshot`: the reading is the server/client seam (the adapter produces it, the panel states it), and both ends are hand-copied shared types, so the shape exists twice by design, not by duplication. `QuayPanel.tsx` grows by the one `CarrierReadingLine` helper and the two card arms that render a non-`ok` reading instead of the empty-state text — drawing \"no records\" for a failed or unavailable read would be a false claim about the project. The increases ARE the deliverable; no new module carries the carrier state instead, because it is wire vocabulary rather than panel-local state. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-cards-judge-default-suggestion): `server/shared/types.ts` 5168→5172 and `src/modules/cockpit/cockpitCardController.ts` 1047→1049. This task lets the same summarising call's judge supply the session-ask default when the assistant recommends nothing: the shared type gains the optional `why` field carrying the judge's one-line reason, which the card renders and the projection forwards, so it is wire vocabulary shared by the observation layer and the card surface (no new module can carry it instead). The controller grows only by the doc statement of the rule it already implements — a suggested option of ANY source is the default. Both increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-cards-resolve-reliably-digest-json-and-details-polish): `server/index.ts` 2797→2805, `server/modules/websocket/services/chat-control.service.ts` 1105→1114, `server/shared/types.ts` 5172→5184 and `src/shared/types.ts` 4590→4596. The ask-card polish adds one optional verbatim `assistantQuote` field to `CockpitCard` (hand-copied on both ends like the rest of the card wire vocabulary, which a TypeSync criterion compares field-for-field), one optional `quote` field to `SessionAskDecision`, the observation→send port type and its one install in the composition root, and the send-path notification (a guarded port read so observation can never change a send result). No new module can carry the wire fields or the install: the contract is the server/client seam and the composition root is where every other port is installed. The increase IS the deliverable. A RECORDED CHANGE (2026-10-28, cockpit-inline-confirm-zero-focus-jump): `src/modules/cockpit/cockpitCardController.ts` 1049→1108. This task replaces the fixed bottom dialog with an in-place confirm state, and the state machine that decides it is the controller's own: the 6 s automatic retreat armed on `requestConfirm` and cleared on every commit that leaves no card pending (the injected clock's one timer), the three new transitions (`requestConfirm`, `cancelConfirm`, and `confirm` running only from a pending state), `selectCard` clearing the pending card when the selection moves elsewhere, and `handleKey('Enter')` becoming the same key twice — open in place, then send from the same bar. The additions also carry the doc paragraphs that state these rules, because the retreat window and the 「second Enter sends」 reading are behaviour a reader must find at the state owner rather than infer from the view. The controller already owns `pendingConfirm`, `confirming` and `lastOutcome`; a second owner beside it would be a second answer to what 「pending」 means, so no new module carries the machine instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-card-situation-full-text-with-inline-expand): `src/modules/cockpit/cockpitCardController.ts` 1108→1139. This task stops the card situation from being truncated to two lines: Cards draws it in full until it runs past six lines, then keeps it behind an in-place expand control, and that expansion is a per-card reading — mapped to the card id AND the revision it was opened at, so a re-read that moves the revision drops it. The rule belongs to the controller that already owns the card list, selection and pending confirm (a re-read reconciles card state in `normalize`), so the added snapshot field, its normalization in `normalize` and the toggle command live there rather than in a second owner (31 inserted lines, 0 deleted). `src/modules/cockpit/CockpitCard.tsx` did NOT need a baseline entry: the situation block moved to the new module-private `CockpitCardSituation.tsx`, so it measured 766 lines (below the 800 floor and below its 768 on develop). The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-answered-immediate-dedup-startup-sweep-and-repair): `server/index.ts` 2805→2817 and `server/modules/websocket/services/chat-control.service.ts` 1114→1116. This task states an answered ask the moment the person sends their next message — without waiting for the transcript to carry it — and adds the boot-time sweep that settles asks a restart left unfinished. `server/index.ts` gains the composition-root call that starts the sweep once the database is open: one import, the guarded `void … .catch(...)` and the comment stating why the pass is not awaited here, placed beside the other producer start-up statements because that is the file's existing job. `chat-control.service.ts` gains the two comment lines beside its user-turn notification stating that the send path knows no transcript message id, so the sweep — not this call — settles a pending ask whose answer has not landed yet. Both increases ARE the fix, not reorganization: no new module can carry the start-up call (every producer starts in this composition root) and the comment belongs on the call it explains. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-mcp-cockpit-card-tools): `server/index.ts` 2817→2827. This task exposes the cockpit card system over the MCP gateway: the composition root now hands the one `createCockpitCardsModule` instance's `registry` / `actions` / `briefForCard` to `createMcpGatewayModule` as `cockpitTools`, beside the other dependency bags it already builds there. The ten lines are the injection itself plus the comment stating that these are the SAME three members the HTTP face reads (the DoD's 'no second reading path' clause); no other module can carry the wiring because `server/index.ts` is the only place the card module is constructed, and the alternative — the gateway importing the cockpit barrel — is the edge AC-394 registers separately. Every other entry in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-confirm-delayed-send-with-cancel): `src/modules/cockpit/cockpitCardController.ts` 1139→1329. This task replaces the two-press confirmation of reversible options with a five-second send countdown, and the state machine that owns it is the controller's own: the countdown reading (card id, revision, started at, fires at) and its two injected-clock timers, the cancel path, the `confirmingCardId` field that keeps the bar in its pending state while the request is in flight after the countdown clears, the normalization that drops a countdown whose card or revision went away, the `stop()` rule that deliberately leaves the countdown armed so a page unload still sends, and the `requestConfirm`/`confirm`/`cancelConfirm`/`handleKey` transitions that split reversible (countdown) from irreversible (the unchanged 6 s two-press retreat). The added doc paragraphs state those rules at the state owner, because the countdown window, the cancel semantics and the unload-still-sends rule are behaviour a reader must find where the machine lives. The controller already owns `pendingConfirm`, `confirming` and `lastOutcome`; a second owner beside it would be a second answer to what a pending confirmation means, so no new module carries the countdown. The bar itself moved to the new module-private `CockpitCardConfirmBar.tsx`, which keeps `CockpitCard.tsx` at 628 lines, below its 800-line floor. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-session-start-background-resident-and-run-events): `server/index.ts` 2827→2845, `server/modules/providers/services/sessions.service.ts` 1314→1327, `server/modules/session-hosts/session-host-manager.service.ts` 1730→1745, `server/modules/websocket/services/chat-run-registry.service.ts` 1387→1401, and `src/modules/cockpit/cockpitCardController.ts` 1329→1364. The increase IS the deliverable in each case, and each file is the ONE owner of the fact it gained: `server/index.ts` installs the `session.run.ended` / `session.closed` adapter beside the existing session-ask one and hands `cockpit.sessionStart` to the card executors (the new writer lives in its own module because `context-event-writer.ts` is hard against this very ceiling); `sessions.service.ts` states `session.closed` at the delete/archive path it already owns; `session-host-manager.service.ts` states it when a RESIDENT host closes (the only host close that means the session is gone); `chat-run-registry.service.ts` states `session.run.ended` at the single terminal-frame branch where it already records the turn-end event; and `cockpitCardController.ts` now attaches a started session to its card, because the display no longer navigates into the background session and the card is the only place the new conversation can be reached from. Splitting any of these into a new helper module would be a module that exists only to keep a line count down, not a second owner. No entry is raised above its current reading, and the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-card-feedback-receipt-lifecycle): `server/index.ts` 2845→2849, `server/shared/types.ts` 5184→5257, `src/shared/types.ts` 4596→4669, `src/modules/cockpit/cockpitCardController.ts` 1364→1509 and `src/shared/api.ts` 1773→1780. This task adds the feedback receipt lifecycle. The five wire types (`CockpitCardReceiptDisposition`, `CockpitCardReceipt`, `CockpitCardFeedbackOutcome`, `CockpitCardFeedback`, `CockpitCardFeedbackNotice`) and the three optional overlay fields on `CockpitCard` are hand-mirrored on both types files: the card contract is the server/client seam and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry them instead. `server/index.ts` gains the `fixtureFeedback` and persisted `feedbackFilePath` arguments the composition root must pass (the overlay is CloudCLI's own state under `~/.cloudcli/`, not the provider's). `src/shared/api.ts` gains the one `cockpitResendFeedback(cardId)` entry point so a resend goes through the centralized client surface like every other read. `cockpitCardController.ts` gains the feedback WIRING the plan puts there — the phase/awaiting derivation, the one-second ticker armed only while some card waits, the resend command and the confirm-target lock — while the lifecycle rules themselves live in the new `src/modules/cockpit/cockpitCardFeedback.ts` and the overlay store in the new `server/modules/cockpit/cockpit-card-feedback-store.ts`; neither new file appears above, and the store keeps every piece of state in a factory closure, so it adds no `moduleMutableState` reading either. The increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-asking-event-question-text): `server/shared/types.ts` 5257→5265. The `SessionAskEvent` doc comment gains the eight-line statement of what `session.asking.data.questionText` means — the asking message's verbatim UNTRUNCATED full text (2026-10-29: the earlier 4000-character tail cap was revoked by the user), omitted when the text is blank, and used ONLY by quay-fleet's 「session + normalised question text」 dedup key, never by a CloudCLI UI. The comment belongs beside the type because the fleet contract and the observation producer must read the same rule; no new module can carry it, and this is documentation growth rather than new code.  A RECORDED CHANGE (2026-10-29, gap-cockpit-asking-event-question-text, writer): `server/modules/context-events/context-event-writer.ts` is a NEW `oversizeFiles` entry at 849 (it was unbaselined at 797 on develop, just under the 800 floor). The task makes a `session.asking` row's `questionText` exempt from the 16 KB line cut: quay-fleet hashes that text into the ask's dedup key, so a cut merges distinct questions, and the fleet reader imposes no line-size limit. The added code is the verbatim-field predicate, the probe that decides whether any cut could bring the row under the ceiling, the exemption in the final byte check, and the doc paragraphs that state why this one field must not be cut; no new module carries it, because the writer is the ONE place a line is assembled and cut. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-29, gap-cockpit-ask-content-anchored-by-askid): `server/shared/types.ts` 5265→5276. The `SessionAskDecisionReading` union gains the optional `originalAsk` field on all three arms, plus the doc paragraph stating what it is: the asking message's OWN verbatim words, read from the transcript as the fallback question for a card whose summary is missing or switched off, and never presented as the model's restatement. It must ride on the reading because the cockpit leaf may not import the observation layer — the reading IS the only channel from the digest reader to the card projection — so the field is wire vocabulary shared by both and no new module can carry it instead. The client mirror (`src/shared/types.ts`) is untouched: no card wire field changed, and the fallback reaches the card through its existing `ask` field. This is docs plus one optional field, not new behaviour in this file; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-sent-state-single-line): `server/shared/types.ts` 5276→5282 and `src/shared/types.ts` 4669→4675. This task adds the optional `lastError` field (with its doc comment) to `CockpitCardFeedback`: the reason the last feedback CALL failed, so the card can distinguish 「fleet unreachable」 from 「fleet slow」. The card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-sent-state-single-line): `src/modules/cockpit/CockpitCard.tsx` 基线外→833. This task collapses the sent state into ONE status line — it removes the disabled confirm bar, the duplicated unconfirmed sentence and the whole-card dimming, and adds the dot+phase row, the amber failure reason and the resend row. Merging develop's `emptyAskContent` guard into the same confirm block leaves the file 33 lines above the 800-line oversize floor; the growth IS the deliverable at the one place the card lifecycle is drawn, and extracting it into a new module would add a file outside this task's declared Touches. Every other baselined entry is unchanged. A RECORDED CHANGE (2026-10-29, gap-cockpit-stable-option-identity): `server/shared/types.ts` 5282→5298, `src/shared/types.ts` 4675→4691, `src/modules/cockpit/CockpitCard.tsx` 833→856 and `src/modules/cockpit/cockpitCardController.ts` 1509→1557. This task makes an option's identity stable: the digest derives every option id from the normalised label instead of writing the model's free-text id, and the card carries the digest revision as `contentRevision`. The two types files each gain the same optional `contentRevision?` field (on `CockpitCard` and on `CockpitCardFeedback`) with its doc comment: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. `CockpitCard.tsx` grows by the option-gone suffix on the sent line and the resend-refusal reason block — the two readings a person gets when the chosen option has left a recomputed card, and they belong beside the status line that draws the receipt. `cockpitCardController.ts` grows by `cockpitCardStateKey`, the content-keyed reset in `normalize` (shown option, open dropdown, inline expansion, brief) and the option-gone refusal message, because `normalize` is the ONE place per-card state is repaired and a second owner beside it would be a second answer to what 「the same content」 means. The increases ARE the deliverable, no entry is raised above its current reading, and the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-option-edit-into-own-reply): `server/shared/types.ts` 5298→5305 and `src/shared/types.ts` 4691→4698. This task adds the optional `CockpitCardOption.sendText` field to both hand-copied wire declarations (the Details drawer's 「✎ 编辑」 shortcut copies it into the person's own reply). The two files grow by the same seven-line field doc on each side, which IS the honest shape of a contract field stated twice by hand — there is no shared program between the server and bundle compilers, so the field cannot be stated once. No entry is raised above its current reading, and no other baseline entry changed. A RECORDED CHANGE (2026-10-29, gap-cockpit-duplicate-cards-collapsed): `src/modules/cockpit/CockpitCard.tsx` 856→917 and `src/modules/cockpit/cockpitCardController.ts` 1557→1628. This task folds cards that ask the same question in the same session. The controller grows by the grouping pass in `normalize` (the folded ids, the kept cards every count uses, the drawable order where an expansion re-inserts at the provider position, and the `toggleDuplicates` command); the card grows by the strip that states 「同一问题被问了 N 次」 and its expand control. Both additions are the honest shape of the change — the folding rules belong to the controller and the strip belongs to the card, so neither can live in a second file without inventing a surface. No entry is raised above its current reading, and no other baseline entry changed. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-dismiss-disposition): `server/shared/types.ts` 5305→5307 and `src/shared/types.ts` 4698→4700 add `dismissed` to `CockpitCardReceiptDisposition` (the member plus one doc sentence); both ends are hand-mirrored and `cockpitCardTypeSync.test.ts` compares them field-for-field, so no new module carries the member instead. `src/shared/api.ts` 1780→1788 gains the one `cockpitDismissCard` entry (POST /api/cockpit/cards/dismiss) the card's third action calls; the endpoint belongs on the centralized client API surface. `src/modules/cockpit/cockpitCardController.ts` 1628→1797 gains the card-level dismiss target/notice vocabulary plus the three commands and their normalization: the dismiss choice is one card decision beside the shown option, owned by the controller that already owns the confirm target, and a second owner would be a second answer. `src/modules/cockpit/CockpitCard.tsx` 917→983 gains the third action's in-place button and confirmation in the card's control zone. Both increases ARE the deliverable; no entry is raised above its measured reading and no other entry rises. A RECORDED CHANGE (2026-10-30, gap-cockpit-ask-semantic-gate): `server/shared/types.ts` 5307→5318. The semantic ask gate needs one explicit verdict field on the ask-decision reading: `isAsking?: boolean` appears on all three arms (`evaluated`, `skipped`, `unevaluated`) because a definitive `false` suppresses the event/object while an absent value keeps the mechanical candidate visible, and the producer reads the field off whichever arm it has. The extra lines are the three optional declarations plus the doc paragraph that defines those three states for readers; the increase IS the deliverable and no entry rises above its measured reading. A RECORDED CHANGE (2026-10-30, gap-routine-architecture-analysis-dup-quay-json-field-readers): `server/shared/utils.ts` 1900→1930. The task hoists the byte-identical `readNullableString`/`readNullableNumber` readers out of `server/modules/quay/quay.service.ts` and `quay-suite-fanin-reader.ts` into the shared utility file that backend-module-standards designates for a helper used in two or more files, so the 30-line increase is the extraction itself; the two quay files shrink by 16 and 14 lines respectively (quay.service.ts 2993→2977 is a fall, noted not raised). A RECORDED CHANGE (2026-10-30, gap-cockpit-ask-retraction-and-ledger-backfill): `server/modules/context-events/context-event-writer.ts` 849→939 and `server/shared/types.ts` 5318→5327. This task states `session.asking.retracted`, the row that withdraws a mis-detected ask. The writer file gains the kind constant, its payload type, the exact-payload validator and the narrow `FLEET_TOLERATED_AHEAD_KINDS` allow-list (a 90-line addition); the wire types file gains the third member of `SessionAskEventKind` plus the doc paragraph stating why that row is written ahead of the installed fleet schema (a 9-line addition). The increase IS the deliverable: no new module can carry a kind the existing writer must validate and a union the wire type must name. The same task SPLITS `session-digest.producer.ts` back under the 800-line floor (1081→718) by moving the retraction walks and the startup sweep into `session-ask-retraction.ts` (534 lines, under the floor), so no baseline entry is created for it. A RECORDED CHANGE (2026-10-30, gap-codex-resident-develop-five-reds): `server/modules/providers/list/codex/codex-host-driver.provider.ts` 827→835 is recorded at its measured value. The file crossed the 800-line floor while the codex resident host driver landed (AC-435…AC-444: per-session hosts and connections, the busy-input queue, the approval broker, steer and live settings) and no census re-recorded it, so develop was already red on this dimension before this task; this task adds the last 8 lines — `liveHostFor` now also recognises the host a session was bound to through the driver's own session row, which is what keeps `run` on the host it started when the driver was handed one directly. The driver and its private helpers remain one cohesive unit; splitting them into a new leaf module to fit a wiring fix would add an import-graph node under AC-394 for no behavioural gain, which is not the honest shape of this change. No entry is raised above its current reading. A RECORDED CHANGE (2026-10-30, gap-mcp-session-steer-tool): `server/index.ts` 2849→2862. This task adds the `sessionSteer` bag to the MCP gateway's `writeTools` literal — the three process seams `session_steer` answers from (the session row's provider reader, the provider registry's host-driver resolver, and the session-hosts manager's live-host read) — so an external MCP client can steer a resident turn without a second send path. The increase IS the wiring: the tool itself is a new module, and the composition root is the only place the process singletons can be bound. No other entry is raised. | 2026-10-30: server/shared/ports/mcp-gateway-client.port.ts enters moduleMutableState at 1 — the installed-reader slot of the new provider-facing MCP-gateway port, the same shape as every existing port in that directory. No other reading rose. | 2026-10-30 (gap-cockpit-session-start-model-settings-ui): `src/shared/api.ts` 1788→1799 and `src/shared/types.ts` 4700→4719. This task gives the cockpit card new-conversation launch selection a settings surface: the two wire mirrors gain the flat six-field reading and its two api calls (`api.settings.cockpitSessionStart` / `saveCockpitSessionStart`). The increase IS the contract — the client must read the same server field the `session.start` executor uses, and both ends are hand-copied mirrors checked field-for-field by the wire-contract criterion, so the shape exists twice by design. No other reading rose. A RECORDED CHANGE (2026-10-31, claude-codex-new-session-default-resident): `server/modules/providers/provider.routes.ts` 1122→1152, `server/modules/providers/services/sessions.service.ts` 1327→1390, `server/shared/types.ts` 5327→5352, `src/shared/api.ts` 1799→1809 and `src/shared/types.ts` 4719→4743. This task moves the new-session lifecycle default into the provider capability matrix and writes the resolved mode in the session row's own INSERT. The capability service gains the provider-owned `defaultLifecycleMode` resolution (support and default are separate readings), and `sessions.service.ts` gains `resolveCreateLifecycleMode` — one place that gives an explicit mode precedence, falls back to that declared default, and refuses an unknown or unsupported mode before any row exists, so the HTTP, MCP and Live Voice entry points all create through it instead of each hard-coding a provider-id branch. The two shared types files each gain the same `defaultLifecycleMode` / `lifecycleMode` wire vocabulary: the contract is the server/client seam, both ends are hand-copied and `wireContractTypeSync.test.ts` compares them field-for-field, so no new module can carry the shape instead. `src/shared/api.ts` gains the client-side parse of the same capability field. The increases ARE the deliverable; no entry is raised above its current measured reading, and no baselined file grew for any other reason. A RECORDED CHANGE (2026-10-31, gap-session-binding-consistency): `server/modules/websocket/services/chat-run-registry.service.ts` 1401→1436. The increase IS the wiring for this task's single binding-write seam: the run record gains `bindingAtStart` (the binding a run was admitted under, frozen at startRun) and `recordProviderSessionId` now writes through `sessionBindingService`, whose outcome decides whether a late `session_created` is a write, a confirmation, or a rejection. The added lines are that field, its docblocks and the guarded write path; the repository half of the same change SHRANK `server/modules/database/repositories/sessions.db.ts` 1479→1422 (the binding writes moved to the new baseline-external sibling `server/modules/database/repositories/session-binding.db.ts`). No other entry is raised. A RECORDED CHANGE (2026-10-31, gap-quay-provider-transcript-prose): `server/modules/providers/list/codex/codex-sessions.provider.ts` 2348→2361, `server/shared/types.ts` 5352→5373 and `src/shared/types.ts` 4743→4749. The increase IS this task's deliverable at each site. Both provider sessions classes gain `readTranscriptMessage(row)` — the capability that lets Quay resolve prose through the provider registry instead of re-implementing each provider's transcript format — and the two lines of that method are the wiring itself; the recognition rules live in the pre-existing `claude-transcript-format.ts` / `codex-transcript-format.ts`, so no new module carries them. `server/shared/types.ts` gains the narrow `ProviderTranscriptMessage` contract (role/text/timestamp, deliberately smaller than `NormalizedMessage`) that both providers and the Quay consumer share, and `src/shared/types.ts` gains the `transcript: 'ok' | 'unreadable'` field on the wire reading `QuaySessionMentionsReading`, which is what lets the popover distinguish an unreadable transcript from a successful empty reading; both wire ends are hand-copied and a TypeSync criterion compares them field-for-field. A RECORDED CHANGE (2026-10-31, gap-ac178-new-session-switch-gate-drops-nonmatrix-provider): `src/modules/chat-session/hooks/useChatProviderState.ts` 913→923. The increase is the adoption guard this task's defect fix requires: the session-adoption effect must refuse a `__provider` that has no row in the capability matrix, otherwise a debug session's runtime id overwrites the validated preference and the new-session lifecycle gate (`canToggleNewSessionLifecycle`) goes false, hiding the composer's resident switch. Three lines are the guard and six are the comment stating why the matrix check is the boundary; the check belongs at the one place a session's provider is adopted, so no new module carries it instead. No other entry is raised. A RECORDED CHANGE (2026-10-31, gap-codex-resident-blocked-context-events): `server/index.ts` 2862→2871 and `server/modules/providers/list/codex/codex-host-driver.provider.ts` 835→841. This task states the Codex resident 「needs a person」 fact on the context-event stream. `server/index.ts` gains the install of the blocked-event adapter beside the existing session-run install — the composition root is the only place that writer is built — and `codex-host-driver.provider.ts` gains the one field, the one import and the four call sites that hand a settled turn to the new rule; the rule itself (which failed/interrupted turn left a card open) lives in the new `codex-resident-blocked-events.ts`, so the driver grows by the wiring rather than by a second copy. The approval arm lives in `codex-approval-broker.ts`, which stays under the 800-line floor, and the writer's new kinds were merged into existing constant lines so `context-event-writer.ts` does not grow at all. No entry is raised above its current reading. A RECORDED CHANGE (2026-10-31, census re-sync): `src/modules/chat-composer/composer/ChatComposer.tsx` 1633→1644 is raised to its measured value on develop. The file is byte-identical to the develop tip in this tree and is outside this task's delta; the growth landed with develop commit 61caec01a after the census captured 1633, and no commit re-recorded it, so AC1/AC4 redded a tree neither this task nor its delta touches. This is a stale-census re-sync, not an accommodation of new growth: the recorded value equals the measured one, and no other entry is raised for this file. A RECORDED CHANGE (2026-10-31, gap-codex-token-usage-snapshot-semantics): `src/shared/types.ts` 4749→4768 and `src/modules/chat-composer/composer/ChatComposer.tsx` 1633→1644 are raised to their measured values. The first is this task's wire vocabulary: the shared `TokenUsageCounts` shape and the `CostCommandData.tokenUsage`/`tokenBreakdown` fields describe the same cumulative/latest-request reading on both ends of the `/cost` response, so the contract belongs in `src/shared/types.ts` and no new module carries it instead. The second is a stale-census re-sync: `ChatComposer.tsx` is byte-identical to the develop tip and its growth landed in 61caec01a, after the 2d86ad361 census captured 1633; no commit re-recorded it, so the criterion redded a file this task does not touch. Neither entry is raised above its current reading, and no other entry is raised. A RECORDED CHANGE (2026-11-01, gap-cost-panel-cache-hit-ratio-and-cachewrite-bar): `src/shared/types.ts` 4768→4772. The increase is the wire vocabulary this task adds to the same `/cost` contract: `TokenUsageCounts` gains the `cacheWriteTokens?` quantity (mirrored field-for-field by the server's `ProviderTokenUsageCounts`, which the TypeSync criterion compares) and `CostCommandData.tokenBreakdown` gains `cacheWrite?`, each with its one-line doc comment. The shape is stated twice by hand by design, so the client half belongs in this shared types file and no new module carries it instead. No other entry is raised. A RECORDED CHANGE (2026-11-01, cockpit-knowledge-decision-handoff): `server/shared/types.ts` 5373→5482 and `src/shared/types.ts` 4772→4881 are raised to their measured values. The increase is the knowledge-suggestion wire vocabulary this task adds to the cockpit card contract: `CockpitKnowledgeCase`/`CockpitKnowledgePlan`/`CockpitKnowledgeVerification`/`CockpitKnowledgeDecision`/`CockpitKnowledgeCaseState` plus the `knowledge` block on `CockpitCard` and the `decision`/`confirmationRef` fields on `CockpitCardOption` and `CockpitCardFeedback`, each with the doc comments that state what the provider owns, what the cockpit only reads, and what a caller may never forge. Both wire ends are hand-copied and a TypeSync criterion compares them field-for-field, so the shape exists twice by design; no new module carries it instead. No other entry is raised above its current reading. A RECORDED CHANGE (2026-11-01, knowledge-application-fact-contract): `server/index.ts` 2871→2905. The increase is this task's composition-root wiring: the `knowledge_facts` read tool's fact source is constructed in `server/index.ts` and bound to the process's real session repository, session host manager, run registry and project lookup, so the gateway answers through the same injected services every other read tool uses rather than through a second private assembly. The adapter itself lives in the new `server/knowledge-facts-wiring.ts`; only the constructor call and its dep bag belong at the composition root. A RECORDED CHANGE (2026-11-01, gap-authoritative-token-reading-used-scope-elimination): `src/modules/chat-session/hooks/useChatSessionState.ts` hookStateHeavy 51→52. The task's deliverable is the split of the one dual-meaning `tokenBudget` state into two named channels — `liveFrame`, the realtime frame the composer counter renders, and `authoritativeReading`, the only reading `/cost` may send — and two independently-written states are the honest shape of that split: one object would hide which channel each of the ten call sites writes. The file's oversize reading is unchanged at 2127, so this is the only entry that moves. No other entry is raised. A RECORDED CHANGE (2026-11-02, pending-approval-dedup): `server/modules/providers/services/provider-runtime.service.ts` 1282→1288. The subscribe acknowledgement must read a shared approval registry once per provider: Claude and Codex expose the same ApprovalRequestsService, so the old fan-out listed the same pending question twice and the client drew two identical answer panels. The six added lines are the per-call reader set and the guard; no other entry moves. A RECORDED CHANGE (2026-11-02, gap-ratchet-baseline-knowledge-facts-wiring): `server/knowledge-facts-wiring.ts` is a NEW `oversizeFiles` entry at 842 — 基线外→842. The file was introduced by 9be415857 as the effective-config launchRequest slice's wiring composition root, and 842 is the real line count that landed with that delivery; this task only registers the existing delivery, it does not grow the file (zero diff on it), and splitting it would be an independent refactor outside this slice. Recording the reading is the honest shape of the change; no other entry is raised.",
+  "note": "RATCHET: every reading in this file may only FALL. Lower a value (or remove an entry) when a refactor genuinely shrinks it; never raise one to accommodate a red. A legitimate RAISE must be recorded here in AC-394's \"RECORDED CHANGE\" format: a dated paragraph naming the file, the old\u2192new reading and why the increase is the honest shape of the change. The criterion prints `ratchet: <dimension> <file> <baseline>\u2192<measured>\uff0c\u53ef\u4e0b\u8c03\u57fa\u7ebf` whenever a reading falls; lowering the baseline is encouraged but not required, so a parallel refactor that shrinks a reading never reds this criterion. A RECORDED CHANGE (2026-10-26, census re-sync by gap-codex-transcript-format-shared-helpers): `src/modules/architecture/semanticZoomLayout.ts` 1642\u21921688 and `src/modules/architecture/semanticZoomPlan.ts` 876\u2192894 are raised to their measured values on develop. Both files are byte-identical to the develop tip in the re-recording tree \u2014 the growth landed in the architecture commits up to 3f1b1ea23 AFTER the census commit f7d20cdcb captured these readings, and no commit re-recorded it, so the criterion redded a tree neither this task nor its delta touches. This is a stale-census re-sync, not an accommodation of new growth: no entry is raised above its current reading, and the two files are not part of this task's delta. A RECORDED CHANGE (2026-10-27, cockpit-card-provider-contract-and-registry): `server/index.ts` 2754\u21922769, `server/shared/types.ts` 4629\u21924749 and `src/shared/types.ts` 4123\u21924243. This task introduces the cockpit card contract: the two types files each gain the 120-line card wire vocabulary (both ends are hand-copied and a TypeSync criterion compares them field-for-field, so the shape exists twice by design, not by duplication), and `server/index.ts` gains the three statements that build the card module and mount its authenticated router. The increase IS the deliverable \u2014 no new module carries the types instead, because the contract is the server/client seam. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, observation-session-ask-decision-digest): `server/shared/types.ts` 4749\u21924821. This task adds the 72-line ask/decision wire vocabulary (SessionAskDecisionOption, SessionAskDecision, SessionAskDecisionReading, SessionAskEventKind, SessionAskEvent) that the transcript reader, the answer normaliser, the digest producer and the injected ISessionAskEventWriter seam all share. The backend module standard puts a type used in two or more files in `server/shared/types.ts`, and no new module carries it instead: the event envelope is the seam quay-fleet's context-event stream will consume, so it is a shared contract rather than observation-internal state. The increase IS the deliverable, recorded on the same entry the preceding cockpit card contract raised for the same reason. A RECORDED CHANGE (2026-10-27, cockpit-card-ui-core): `src/shared/api.ts` 1749\u21921766 and `src/modules/cockpit/CockpitPage.tsx` 1881\u21921883. This is the UI half of the same cockpit card contract: `src/shared/api.ts` gains the two client entry points the card view calls (`cockpitCards` = GET /api/cockpit/cards and `cockpitConfirmCard` = POST /api/cockpit/cards/confirm, each with the revision/`optionId`/`replyText` shape the server enforces) \u2014 the API client surface IS where the client seam belongs, so no new module carries them instead; `CockpitPage.tsx` gains the one `cards` arm of the header's existing view-label ternary so `/cockpit?view=cards` names itself like every other view. The card UI itself lives in new files (`cockpitCardController.ts`, `CockpitCard*.tsx`, descriptors, hook), so it does not grow any baselined file. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, cockpit-card-session-executors): `server/index.ts` 2769\u21922777, `server/shared/types.ts` 4821\u21924839 and `src/shared/types.ts` 4243\u21924261. This task adds the two built-in cockpit content executors (`session.send`, `session.start`) and the subject-derived \u300c\u81ea\u5df1\u7684\u56de\u590d\u300d default. The two types files each gain the same 18-line wire vocabulary (`CockpitFixtureSubject` plus the projection-owned `ownReplyUnavailable` field). They exist twice by design: the card wire contract is hand-copied on both ends and a TypeSync criterion compares the copies field-for-field, so no new module can carry the types instead. `server/index.ts` moves the card module's construction BELOW the one chat control service its executors send through, and gains the `createCockpitCardExecutors(...)` argument, the `fixtureSubject` argument and their one import; the increase IS the wiring statement the task requires at the composition root, and the binding itself lives in the new `server/cockpit-executors-wiring.ts` so this file grows by only the composition lines. A RECORDED CHANGE (2026-10-27, cockpit-card-brief-rendering): `server/shared/types.ts` 4839\u21925074 and `src/shared/types.ts` 4261\u21924496. This task adds the 235-line brief wire vocabulary (CockpitBriefResponse, the seven preset block shapes and their nested option/evidence/axis/series/row/token/failure types) at the same group boundary on both ends. The shape exists twice by design: the brief read is the server/client seam, the client copy is hand-mirrored, and `cockpitCardTypeSync.test.ts` reads both ends field-for-field, so no new module can carry the types instead. `src/shared/api.ts` 1766\u21921773 gains the one `cockpitCardBrief(cardId)` entry point (GET /api/cockpit/cards/:id/brief) the Details drawer calls; the endpoint belongs on the centralized client API surface rather than in the component. The increase IS the deliverable. A RECORDED CHANGE (2026-10-27, cockpit-mobile-header-and-page): `src/modules/cockpit/cockpitCardController.ts` is a NEW `oversizeFiles` entry at 871 (it was unbaselined at 766 on develop). This task adds the card page's route memory to the controller that already owns `selectedCardId` and `anchorCardId`: the `CockpitCardMemory` seam, the normalization that turns an unreadable store into \"start at the top\", the deferred restore of the remembered selection once the card list exists, and `setScrollPosition`'s persistence. The rule \u2014 \"the person returns to the card and the scroll offset they left\" \u2014 is a list rule, and putting a second owner beside it would be a second answer; no new module carries it instead, because the seam is the controller's own dependency contract and the binding only supplies the storage. The additions are the measured 105 lines; the file was already near the 800-line limit on develop, so this is the honest shape of the change, not a reorganization for line count. A RECORDED CHANGE (2026-10-27, observation-session-ask-event-writer-wiring): `server/index.ts` 2777\u21922788, and `server/shared/ports/session-ask-events.port.ts` is a NEW `moduleMutableState` entry at 1. The task wires the observation layer's `session.asking`/`session.answered` to the host-level context-event writer through a new install-style port (the same shape every sibling in `server/shared/ports/` already has, which is why each of them carries exactly this one reading): the port owns the installed-writer slot, and the composition root installs the adapter. `server/index.ts` grows by the port import, the adapter import/installation and the comment that states why a v0 fleet counts the two kinds instead of throwing; no existing statement was rewritten, so the increase IS the wiring the task requires at the composition root. The other entries in this diff only FELL (encouraged by this file's own rule). A RECORDED CHANGE (2026-10-27, cockpit-fleet-card-provider): `server/index.ts` 2788\u21922797, `server/shared/types.ts` 5074\u21925081 and `src/shared/types.ts` 4496\u21924503. This task registers the quay-fleet card provider at the composition root and adds the one card field that names why locally-filled content is not ready. `server/index.ts` gains the import and the `providers` entry that passes `cockpit.fleetCards.enabled` and `ttlMs` into `createCockpitCardsModule`; the fleet CLI and digest bindings live in the new `server/cockpit-fleet-wiring.ts`, so this file grows only by its composition statements. The two types files each gain the same 7-line `contentUnavailable?` field on `CockpitCard` with its doc comment: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-ac425-card-viz-and-zone-coverage): `server/shared/types.ts` 5081\u21925112 and `src/shared/types.ts` 4503\u21924534. This task adds the 31-line small-visualization wire vocabulary (`CockpitCardVizKind`, the `CockpitCardViz` reading envelope, and the `viz?` field on `CockpitCard`) at the same group boundary on both ends. The shape exists twice by design: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field (this task adds both rows to that comparison), so no new module can carry the types instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-voice-keyboard-shortcut-toggle): `src/modules/chat/ChatInterface.tsx` 1395\u21921443 and `src/modules/chat/composer/ChatComposer.tsx` 1606\u21921628. This task wires a configurable keyboard chord to the two voice surfaces the pane owns: `ChatInterface` holds the registered dictation toggle, derives the Live Voice toggle from `composerMode`, and mounts the shortcut hook (48 lines), while `ChatComposer` registers its own `handleVoiceToggle` with the pane on each render (22 lines). Both increases ARE the wiring: the shortcut must reach the same handlers the on-screen controls use, and a second copy of that caret/draft logic in the pane is exactly the drift the shared `handleVoiceToggle` seam exists to prevent. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-voice-shortcut-options): `src/modules/chat/ChatInterface.tsx` 1443\u21921477 and `src/modules/chat/composer/ChatComposer.tsx` 1628\u21921633. This task extends the same shortcut feature with three bindings \u2014 send-on-stop, cross-surface cancel and clear-input. `ChatInterface` gains the four pane-level readings the controller routes on (`stopAndSendDictation`, `isDictationRecording`, `isLiveVoiceActive`, and `isClearAvailable`, which mirrors the Escape guard's own condition so the clear chord cannot become a laxer second way to dismiss a running turn or an open menu), moves the shortcut block below `handleVoiceExit` so leaving Live Voice reuses the bar's own exit path (backlog back to the composer, run keeps going) instead of the bare mode teardown, and passes the larger command bag to `useVoiceShortcuts`; `ChatComposer` registers `stopAndSend` and the live `recording` reading with the pane. Both increases ARE the wiring: every new command is a pane-level fact (composer draft, processing state, dock/menu visibility) the React-free controller cannot read itself, and the chords must reach the same handlers the on-screen controls use. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-27, gap-cockpit-live-cards-session-link-confirmability-and-titles): `server/shared/types.ts` 5112\u21925120 and `src/shared/types.ts` 4534\u21924542. This task adds the option confirmability vocabulary (`confirmable?` and `confirmableReason?` on `CockpitCardOption`) at the same group boundary on both ends. The shape exists twice by design: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the fields instead. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-27, cockpit-card-anatomy-matches-mockups): `server/shared/types.ts` 5120\u21925144, `src/shared/types.ts` 4542\u21924566 and `src/modules/cockpit/cockpitCardController.ts` 871\u2192876. This task adds the card header's two provider-stated readings on the wire \u2014 `CockpitCard.load` (the 0\u20133 decision weight the header's three cells draw) and `CockpitCardSubject.title` (the subject's display name) \u2014 plus the `attempts` viz reading (`CockpitCardVizOutcome`, `CockpitCardVizAttempt`, and `cap`/`items` on `CockpitCardViz`), which turns the stuck/fix dot row into a per-attempt reading. The card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field (this task adds the two new rows), so no new module can carry the types instead; the increase IS the deliverable. The controller grows by the widened `isIrreversibleOption` predicate, which now also recognises the current `irreversible` tag name beside the pre-vocabulary `warn`; the predicate already lives there and a second copy would be the drift the single rule exists to prevent. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, cockpit-shell-filters-mobile-page-and-details-bar): `src/modules/cockpit/cockpitCardController.ts` 876\u21921047 and `src/modules/cockpit/CockpitPage.tsx` 1883\u21921902. This task adds the cards page's two filters to the controller that already owns the card list, selection and scroll memory: type chips with per-type counts constrained by the project selection, a multi-select project set with per-project counts constrained by the type, and the per-device persistence seam (`rememberFilters`) that restores both across a rebuild. The filtering rule \u2014 which cards are visible, and what each chip's count is under the other filter \u2014 is one rule, so a second owner beside the controller would be a second answer; the controller's dependency contract is where the storage binding belongs, and no new module carries it instead. `CockpitPage.tsx` grows by the mobile-width reading and the three `{!phoneCards && \u2026}` wrappers that keep the deploy strip, project strip and Focus row off the phone's cards page while leaving them on wall/fleet/board. Both increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-quay-tests-fanin-read-via-suite-verb-and-driver-log): `server/shared/types.ts` 5144\u21925168, `src/shared/types.ts` 4566\u21924590 and `src/modules/quay/QuayPanel.tsx` 1120\u21921176. This task moves the Tests/Fan-in readings off the local `.quay/` carrier files and onto quay's own read verbs (`quay suite`, `quay driver log`). The two types files each gain the same 24-line `QuayCarrierReading` vocabulary and the optional `carrierReadings` field on `QuaySnapshot`: the reading is the server/client seam (the adapter produces it, the panel states it), and both ends are hand-copied shared types, so the shape exists twice by design, not by duplication. `QuayPanel.tsx` grows by the one `CarrierReadingLine` helper and the two card arms that render a non-`ok` reading instead of the empty-state text \u2014 drawing \"no records\" for a failed or unavailable read would be a false claim about the project. The increases ARE the deliverable; no new module carries the carrier state instead, because it is wire vocabulary rather than panel-local state. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-cards-judge-default-suggestion): `server/shared/types.ts` 5168\u21925172 and `src/modules/cockpit/cockpitCardController.ts` 1047\u21921049. This task lets the same summarising call's judge supply the session-ask default when the assistant recommends nothing: the shared type gains the optional `why` field carrying the judge's one-line reason, which the card renders and the projection forwards, so it is wire vocabulary shared by the observation layer and the card surface (no new module can carry it instead). The controller grows only by the doc statement of the rule it already implements \u2014 a suggested option of ANY source is the default. Both increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-cards-resolve-reliably-digest-json-and-details-polish): `server/index.ts` 2797\u21922805, `server/modules/websocket/services/chat-control.service.ts` 1105\u21921114, `server/shared/types.ts` 5172\u21925184 and `src/shared/types.ts` 4590\u21924596. The ask-card polish adds one optional verbatim `assistantQuote` field to `CockpitCard` (hand-copied on both ends like the rest of the card wire vocabulary, which a TypeSync criterion compares field-for-field), one optional `quote` field to `SessionAskDecision`, the observation\u2192send port type and its one install in the composition root, and the send-path notification (a guarded port read so observation can never change a send result). No new module can carry the wire fields or the install: the contract is the server/client seam and the composition root is where every other port is installed. The increase IS the deliverable. A RECORDED CHANGE (2026-10-28, cockpit-inline-confirm-zero-focus-jump): `src/modules/cockpit/cockpitCardController.ts` 1049\u21921108. This task replaces the fixed bottom dialog with an in-place confirm state, and the state machine that decides it is the controller's own: the 6 s automatic retreat armed on `requestConfirm` and cleared on every commit that leaves no card pending (the injected clock's one timer), the three new transitions (`requestConfirm`, `cancelConfirm`, and `confirm` running only from a pending state), `selectCard` clearing the pending card when the selection moves elsewhere, and `handleKey('Enter')` becoming the same key twice \u2014 open in place, then send from the same bar. The additions also carry the doc paragraphs that state these rules, because the retreat window and the \u300csecond Enter sends\u300d reading are behaviour a reader must find at the state owner rather than infer from the view. The controller already owns `pendingConfirm`, `confirming` and `lastOutcome`; a second owner beside it would be a second answer to what \u300cpending\u300d means, so no new module carries the machine instead. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-card-situation-full-text-with-inline-expand): `src/modules/cockpit/cockpitCardController.ts` 1108\u21921139. This task stops the card situation from being truncated to two lines: Cards draws it in full until it runs past six lines, then keeps it behind an in-place expand control, and that expansion is a per-card reading \u2014 mapped to the card id AND the revision it was opened at, so a re-read that moves the revision drops it. The rule belongs to the controller that already owns the card list, selection and pending confirm (a re-read reconciles card state in `normalize`), so the added snapshot field, its normalization in `normalize` and the toggle command live there rather than in a second owner (31 inserted lines, 0 deleted). `src/modules/cockpit/CockpitCard.tsx` did NOT need a baseline entry: the situation block moved to the new module-private `CockpitCardSituation.tsx`, so it measured 766 lines (below the 800 floor and below its 768 on develop). The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-28, gap-cockpit-ask-answered-immediate-dedup-startup-sweep-and-repair): `server/index.ts` 2805\u21922817 and `server/modules/websocket/services/chat-control.service.ts` 1114\u21921116. This task states an answered ask the moment the person sends their next message \u2014 without waiting for the transcript to carry it \u2014 and adds the boot-time sweep that settles asks a restart left unfinished. `server/index.ts` gains the composition-root call that starts the sweep once the database is open: one import, the guarded `void \u2026 .catch(...)` and the comment stating why the pass is not awaited here, placed beside the other producer start-up statements because that is the file's existing job. `chat-control.service.ts` gains the two comment lines beside its user-turn notification stating that the send path knows no transcript message id, so the sweep \u2014 not this call \u2014 settles a pending ask whose answer has not landed yet. Both increases ARE the fix, not reorganization: no new module can carry the start-up call (every producer starts in this composition root) and the comment belongs on the call it explains. The other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-mcp-cockpit-card-tools): `server/index.ts` 2817\u21922827. This task exposes the cockpit card system over the MCP gateway: the composition root now hands the one `createCockpitCardsModule` instance's `registry` / `actions` / `briefForCard` to `createMcpGatewayModule` as `cockpitTools`, beside the other dependency bags it already builds there. The ten lines are the injection itself plus the comment stating that these are the SAME three members the HTTP face reads (the DoD's 'no second reading path' clause); no other module can carry the wiring because `server/index.ts` is the only place the card module is constructed, and the alternative \u2014 the gateway importing the cockpit barrel \u2014 is the edge AC-394 registers separately. Every other entry in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-confirm-delayed-send-with-cancel): `src/modules/cockpit/cockpitCardController.ts` 1139\u21921329. This task replaces the two-press confirmation of reversible options with a five-second send countdown, and the state machine that owns it is the controller's own: the countdown reading (card id, revision, started at, fires at) and its two injected-clock timers, the cancel path, the `confirmingCardId` field that keeps the bar in its pending state while the request is in flight after the countdown clears, the normalization that drops a countdown whose card or revision went away, the `stop()` rule that deliberately leaves the countdown armed so a page unload still sends, and the `requestConfirm`/`confirm`/`cancelConfirm`/`handleKey` transitions that split reversible (countdown) from irreversible (the unchanged 6 s two-press retreat). The added doc paragraphs state those rules at the state owner, because the countdown window, the cancel semantics and the unload-still-sends rule are behaviour a reader must find where the machine lives. The controller already owns `pendingConfirm`, `confirming` and `lastOutcome`; a second owner beside it would be a second answer to what a pending confirmation means, so no new module carries the countdown. The bar itself moved to the new module-private `CockpitCardConfirmBar.tsx`, which keeps `CockpitCard.tsx` at 628 lines, below its 800-line floor. The increase IS the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-session-start-background-resident-and-run-events): `server/index.ts` 2827\u21922845, `server/modules/providers/services/sessions.service.ts` 1314\u21921327, `server/modules/session-hosts/session-host-manager.service.ts` 1730\u21921745, `server/modules/websocket/services/chat-run-registry.service.ts` 1387\u21921401, and `src/modules/cockpit/cockpitCardController.ts` 1329\u21921364. The increase IS the deliverable in each case, and each file is the ONE owner of the fact it gained: `server/index.ts` installs the `session.run.ended` / `session.closed` adapter beside the existing session-ask one and hands `cockpit.sessionStart` to the card executors (the new writer lives in its own module because `context-event-writer.ts` is hard against this very ceiling); `sessions.service.ts` states `session.closed` at the delete/archive path it already owns; `session-host-manager.service.ts` states it when a RESIDENT host closes (the only host close that means the session is gone); `chat-run-registry.service.ts` states `session.run.ended` at the single terminal-frame branch where it already records the turn-end event; and `cockpitCardController.ts` now attaches a started session to its card, because the display no longer navigates into the background session and the card is the only place the new conversation can be reached from. Splitting any of these into a new helper module would be a module that exists only to keep a line count down, not a second owner. No entry is raised above its current reading, and the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-28, gap-cockpit-card-feedback-receipt-lifecycle): `server/index.ts` 2845\u21922849, `server/shared/types.ts` 5184\u21925257, `src/shared/types.ts` 4596\u21924669, `src/modules/cockpit/cockpitCardController.ts` 1364\u21921509 and `src/shared/api.ts` 1773\u21921780. This task adds the feedback receipt lifecycle. The five wire types (`CockpitCardReceiptDisposition`, `CockpitCardReceipt`, `CockpitCardFeedbackOutcome`, `CockpitCardFeedback`, `CockpitCardFeedbackNotice`) and the three optional overlay fields on `CockpitCard` are hand-mirrored on both types files: the card contract is the server/client seam and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry them instead. `server/index.ts` gains the `fixtureFeedback` and persisted `feedbackFilePath` arguments the composition root must pass (the overlay is CloudCLI's own state under `~/.cloudcli/`, not the provider's). `src/shared/api.ts` gains the one `cockpitResendFeedback(cardId)` entry point so a resend goes through the centralized client surface like every other read. `cockpitCardController.ts` gains the feedback WIRING the plan puts there \u2014 the phase/awaiting derivation, the one-second ticker armed only while some card waits, the resend command and the confirm-target lock \u2014 while the lifecycle rules themselves live in the new `src/modules/cockpit/cockpitCardFeedback.ts` and the overlay store in the new `server/modules/cockpit/cockpit-card-feedback-store.ts`; neither new file appears above, and the store keeps every piece of state in a factory closure, so it adds no `moduleMutableState` reading either. The increases ARE the deliverable; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-asking-event-question-text): `server/shared/types.ts` 5257\u21925265. The `SessionAskEvent` doc comment gains the eight-line statement of what `session.asking.data.questionText` means \u2014 the asking message's verbatim UNTRUNCATED full text (2026-10-29: the earlier 4000-character tail cap was revoked by the user), omitted when the text is blank, and used ONLY by quay-fleet's \u300csession + normalised question text\u300d dedup key, never by a CloudCLI UI. The comment belongs beside the type because the fleet contract and the observation producer must read the same rule; no new module can carry it, and this is documentation growth rather than new code.  A RECORDED CHANGE (2026-10-29, gap-cockpit-asking-event-question-text, writer): `server/modules/context-events/context-event-writer.ts` is a NEW `oversizeFiles` entry at 849 (it was unbaselined at 797 on develop, just under the 800 floor). The task makes a `session.asking` row's `questionText` exempt from the 16 KB line cut: quay-fleet hashes that text into the ask's dedup key, so a cut merges distinct questions, and the fleet reader imposes no line-size limit. The added code is the verbatim-field predicate, the probe that decides whether any cut could bring the row under the ceiling, the exemption in the final byte check, and the doc paragraphs that state why this one field must not be cut; no new module carries it, because the writer is the ONE place a line is assembled and cut. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-29, gap-cockpit-ask-content-anchored-by-askid): `server/shared/types.ts` 5265\u21925276. The `SessionAskDecisionReading` union gains the optional `originalAsk` field on all three arms, plus the doc paragraph stating what it is: the asking message's OWN verbatim words, read from the transcript as the fallback question for a card whose summary is missing or switched off, and never presented as the model's restatement. It must ride on the reading because the cockpit leaf may not import the observation layer \u2014 the reading IS the only channel from the digest reader to the card projection \u2014 so the field is wire vocabulary shared by both and no new module can carry it instead. The client mirror (`src/shared/types.ts`) is untouched: no card wire field changed, and the fallback reaches the card through its existing `ask` field. This is docs plus one optional field, not new behaviour in this file; the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-sent-state-single-line): `server/shared/types.ts` 5276\u21925282 and `src/shared/types.ts` 4669\u21924675. This task adds the optional `lastError` field (with its doc comment) to `CockpitCardFeedback`: the reason the last feedback CALL failed, so the card can distinguish \u300cfleet unreachable\u300d from \u300cfleet slow\u300d. The card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. The increase IS the deliverable; no other baselined entry rises. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-sent-state-single-line): `src/modules/cockpit/CockpitCard.tsx` \u57fa\u7ebf\u5916\u2192833. This task collapses the sent state into ONE status line \u2014 it removes the disabled confirm bar, the duplicated unconfirmed sentence and the whole-card dimming, and adds the dot+phase row, the amber failure reason and the resend row. Merging develop's `emptyAskContent` guard into the same confirm block leaves the file 33 lines above the 800-line oversize floor; the growth IS the deliverable at the one place the card lifecycle is drawn, and extracting it into a new module would add a file outside this task's declared Touches. Every other baselined entry is unchanged. A RECORDED CHANGE (2026-10-29, gap-cockpit-stable-option-identity): `server/shared/types.ts` 5282\u21925298, `src/shared/types.ts` 4675\u21924691, `src/modules/cockpit/CockpitCard.tsx` 833\u2192856 and `src/modules/cockpit/cockpitCardController.ts` 1509\u21921557. This task makes an option's identity stable: the digest derives every option id from the normalised label instead of writing the model's free-text id, and the card carries the digest revision as `contentRevision`. The two types files each gain the same optional `contentRevision?` field (on `CockpitCard` and on `CockpitCardFeedback`) with its doc comment: the card wire contract is hand-mirrored on both ends and `cockpitCardTypeSync.test.ts` compares the copies field-for-field, so no new module can carry the field instead. `CockpitCard.tsx` grows by the option-gone suffix on the sent line and the resend-refusal reason block \u2014 the two readings a person gets when the chosen option has left a recomputed card, and they belong beside the status line that draws the receipt. `cockpitCardController.ts` grows by `cockpitCardStateKey`, the content-keyed reset in `normalize` (shown option, open dropdown, inline expansion, brief) and the option-gone refusal message, because `normalize` is the ONE place per-card state is repaired and a second owner beside it would be a second answer to what \u300cthe same content\u300d means. The increases ARE the deliverable, no entry is raised above its current reading, and the other entries in this diff only FELL. A RECORDED CHANGE (2026-10-29, gap-cockpit-option-edit-into-own-reply): `server/shared/types.ts` 5298\u21925305 and `src/shared/types.ts` 4691\u21924698. This task adds the optional `CockpitCardOption.sendText` field to both hand-copied wire declarations (the Details drawer's \u300c\u270e \u7f16\u8f91\u300d shortcut copies it into the person's own reply). The two files grow by the same seven-line field doc on each side, which IS the honest shape of a contract field stated twice by hand \u2014 there is no shared program between the server and bundle compilers, so the field cannot be stated once. No entry is raised above its current reading, and no other baseline entry changed. A RECORDED CHANGE (2026-10-29, gap-cockpit-duplicate-cards-collapsed): `src/modules/cockpit/CockpitCard.tsx` 856\u2192917 and `src/modules/cockpit/cockpitCardController.ts` 1557\u21921628. This task folds cards that ask the same question in the same session. The controller grows by the grouping pass in `normalize` (the folded ids, the kept cards every count uses, the drawable order where an expansion re-inserts at the provider position, and the `toggleDuplicates` command); the card grows by the strip that states \u300c\u540c\u4e00\u95ee\u9898\u88ab\u95ee\u4e86 N \u6b21\u300d and its expand control. Both additions are the honest shape of the change \u2014 the folding rules belong to the controller and the strip belongs to the card, so neither can live in a second file without inventing a surface. No entry is raised above its current reading, and no other baseline entry changed. A RECORDED CHANGE (2026-10-29, gap-cockpit-card-dismiss-disposition): `server/shared/types.ts` 5305\u21925307 and `src/shared/types.ts` 4698\u21924700 add `dismissed` to `CockpitCardReceiptDisposition` (the member plus one doc sentence); both ends are hand-mirrored and `cockpitCardTypeSync.test.ts` compares them field-for-field, so no new module carries the member instead. `src/shared/api.ts` 1780\u21921788 gains the one `cockpitDismissCard` entry (POST /api/cockpit/cards/dismiss) the card's third action calls; the endpoint belongs on the centralized client API surface. `src/modules/cockpit/cockpitCardController.ts` 1628\u21921797 gains the card-level dismiss target/notice vocabulary plus the three commands and their normalization: the dismiss choice is one card decision beside the shown option, owned by the controller that already owns the confirm target, and a second owner would be a second answer. `src/modules/cockpit/CockpitCard.tsx` 917\u2192983 gains the third action's in-place button and confirmation in the card's control zone. Both increases ARE the deliverable; no entry is raised above its measured reading and no other entry rises. A RECORDED CHANGE (2026-10-30, gap-cockpit-ask-semantic-gate): `server/shared/types.ts` 5307\u21925318. The semantic ask gate needs one explicit verdict field on the ask-decision reading: `isAsking?: boolean` appears on all three arms (`evaluated`, `skipped`, `unevaluated`) because a definitive `false` suppresses the event/object while an absent value keeps the mechanical candidate visible, and the producer reads the field off whichever arm it has. The extra lines are the three optional declarations plus the doc paragraph that defines those three states for readers; the increase IS the deliverable and no entry rises above its measured reading. A RECORDED CHANGE (2026-10-30, gap-routine-architecture-analysis-dup-quay-json-field-readers): `server/shared/utils.ts` 1900\u21921930. The task hoists the byte-identical `readNullableString`/`readNullableNumber` readers out of `server/modules/quay/quay.service.ts` and `quay-suite-fanin-reader.ts` into the shared utility file that backend-module-standards designates for a helper used in two or more files, so the 30-line increase is the extraction itself; the two quay files shrink by 16 and 14 lines respectively (quay.service.ts 2993\u21922977 is a fall, noted not raised). A RECORDED CHANGE (2026-10-30, gap-cockpit-ask-retraction-and-ledger-backfill): `server/modules/context-events/context-event-writer.ts` 849\u2192939 and `server/shared/types.ts` 5318\u21925327. This task states `session.asking.retracted`, the row that withdraws a mis-detected ask. The writer file gains the kind constant, its payload type, the exact-payload validator and the narrow `FLEET_TOLERATED_AHEAD_KINDS` allow-list (a 90-line addition); the wire types file gains the third member of `SessionAskEventKind` plus the doc paragraph stating why that row is written ahead of the installed fleet schema (a 9-line addition). The increase IS the deliverable: no new module can carry a kind the existing writer must validate and a union the wire type must name. The same task SPLITS `session-digest.producer.ts` back under the 800-line floor (1081\u2192718) by moving the retraction walks and the startup sweep into `session-ask-retraction.ts` (534 lines, under the floor), so no baseline entry is created for it. A RECORDED CHANGE (2026-10-30, gap-codex-resident-develop-five-reds): `server/modules/providers/list/codex/codex-host-driver.provider.ts` 827\u2192835 is recorded at its measured value. The file crossed the 800-line floor while the codex resident host driver landed (AC-435\u2026AC-444: per-session hosts and connections, the busy-input queue, the approval broker, steer and live settings) and no census re-recorded it, so develop was already red on this dimension before this task; this task adds the last 8 lines \u2014 `liveHostFor` now also recognises the host a session was bound to through the driver's own session row, which is what keeps `run` on the host it started when the driver was handed one directly. The driver and its private helpers remain one cohesive unit; splitting them into a new leaf module to fit a wiring fix would add an import-graph node under AC-394 for no behavioural gain, which is not the honest shape of this change. No entry is raised above its current reading. A RECORDED CHANGE (2026-10-30, gap-mcp-session-steer-tool): `server/index.ts` 2849\u21922862. This task adds the `sessionSteer` bag to the MCP gateway's `writeTools` literal \u2014 the three process seams `session_steer` answers from (the session row's provider reader, the provider registry's host-driver resolver, and the session-hosts manager's live-host read) \u2014 so an external MCP client can steer a resident turn without a second send path. The increase IS the wiring: the tool itself is a new module, and the composition root is the only place the process singletons can be bound. No other entry is raised. | 2026-10-30: server/shared/ports/mcp-gateway-client.port.ts enters moduleMutableState at 1 \u2014 the installed-reader slot of the new provider-facing MCP-gateway port, the same shape as every existing port in that directory. No other reading rose. | 2026-10-30 (gap-cockpit-session-start-model-settings-ui): `src/shared/api.ts` 1788\u21921799 and `src/shared/types.ts` 4700\u21924719. This task gives the cockpit card new-conversation launch selection a settings surface: the two wire mirrors gain the flat six-field reading and its two api calls (`api.settings.cockpitSessionStart` / `saveCockpitSessionStart`). The increase IS the contract \u2014 the client must read the same server field the `session.start` executor uses, and both ends are hand-copied mirrors checked field-for-field by the wire-contract criterion, so the shape exists twice by design. No other reading rose. A RECORDED CHANGE (2026-10-31, claude-codex-new-session-default-resident): `server/modules/providers/provider.routes.ts` 1122\u21921152, `server/modules/providers/services/sessions.service.ts` 1327\u21921390, `server/shared/types.ts` 5327\u21925352, `src/shared/api.ts` 1799\u21921809 and `src/shared/types.ts` 4719\u21924743. This task moves the new-session lifecycle default into the provider capability matrix and writes the resolved mode in the session row's own INSERT. The capability service gains the provider-owned `defaultLifecycleMode` resolution (support and default are separate readings), and `sessions.service.ts` gains `resolveCreateLifecycleMode` \u2014 one place that gives an explicit mode precedence, falls back to that declared default, and refuses an unknown or unsupported mode before any row exists, so the HTTP, MCP and Live Voice entry points all create through it instead of each hard-coding a provider-id branch. The two shared types files each gain the same `defaultLifecycleMode` / `lifecycleMode` wire vocabulary: the contract is the server/client seam, both ends are hand-copied and `wireContractTypeSync.test.ts` compares them field-for-field, so no new module can carry the shape instead. `src/shared/api.ts` gains the client-side parse of the same capability field. The increases ARE the deliverable; no entry is raised above its current measured reading, and no baselined file grew for any other reason. A RECORDED CHANGE (2026-10-31, gap-session-binding-consistency): `server/modules/websocket/services/chat-run-registry.service.ts` 1401\u21921436. The increase IS the wiring for this task's single binding-write seam: the run record gains `bindingAtStart` (the binding a run was admitted under, frozen at startRun) and `recordProviderSessionId` now writes through `sessionBindingService`, whose outcome decides whether a late `session_created` is a write, a confirmation, or a rejection. The added lines are that field, its docblocks and the guarded write path; the repository half of the same change SHRANK `server/modules/database/repositories/sessions.db.ts` 1479\u21921422 (the binding writes moved to the new baseline-external sibling `server/modules/database/repositories/session-binding.db.ts`). No other entry is raised. A RECORDED CHANGE (2026-10-31, gap-quay-provider-transcript-prose): `server/modules/providers/list/codex/codex-sessions.provider.ts` 2348\u21922361, `server/shared/types.ts` 5352\u21925373 and `src/shared/types.ts` 4743\u21924749. The increase IS this task's deliverable at each site. Both provider sessions classes gain `readTranscriptMessage(row)` \u2014 the capability that lets Quay resolve prose through the provider registry instead of re-implementing each provider's transcript format \u2014 and the two lines of that method are the wiring itself; the recognition rules live in the pre-existing `claude-transcript-format.ts` / `codex-transcript-format.ts`, so no new module carries them. `server/shared/types.ts` gains the narrow `ProviderTranscriptMessage` contract (role/text/timestamp, deliberately smaller than `NormalizedMessage`) that both providers and the Quay consumer share, and `src/shared/types.ts` gains the `transcript: 'ok' | 'unreadable'` field on the wire reading `QuaySessionMentionsReading`, which is what lets the popover distinguish an unreadable transcript from a successful empty reading; both wire ends are hand-copied and a TypeSync criterion compares them field-for-field. A RECORDED CHANGE (2026-10-31, gap-ac178-new-session-switch-gate-drops-nonmatrix-provider): `src/modules/chat-session/hooks/useChatProviderState.ts` 913\u2192923. The increase is the adoption guard this task's defect fix requires: the session-adoption effect must refuse a `__provider` that has no row in the capability matrix, otherwise a debug session's runtime id overwrites the validated preference and the new-session lifecycle gate (`canToggleNewSessionLifecycle`) goes false, hiding the composer's resident switch. Three lines are the guard and six are the comment stating why the matrix check is the boundary; the check belongs at the one place a session's provider is adopted, so no new module carries it instead. No other entry is raised. A RECORDED CHANGE (2026-10-31, gap-codex-resident-blocked-context-events): `server/index.ts` 2862\u21922871 and `server/modules/providers/list/codex/codex-host-driver.provider.ts` 835\u2192841. This task states the Codex resident \u300cneeds a person\u300d fact on the context-event stream. `server/index.ts` gains the install of the blocked-event adapter beside the existing session-run install \u2014 the composition root is the only place that writer is built \u2014 and `codex-host-driver.provider.ts` gains the one field, the one import and the four call sites that hand a settled turn to the new rule; the rule itself (which failed/interrupted turn left a card open) lives in the new `codex-resident-blocked-events.ts`, so the driver grows by the wiring rather than by a second copy. The approval arm lives in `codex-approval-broker.ts`, which stays under the 800-line floor, and the writer's new kinds were merged into existing constant lines so `context-event-writer.ts` does not grow at all. No entry is raised above its current reading. A RECORDED CHANGE (2026-10-31, census re-sync): `src/modules/chat-composer/composer/ChatComposer.tsx` 1633\u21921644 is raised to its measured value on develop. The file is byte-identical to the develop tip in this tree and is outside this task's delta; the growth landed with develop commit 61caec01a after the census captured 1633, and no commit re-recorded it, so AC1/AC4 redded a tree neither this task nor its delta touches. This is a stale-census re-sync, not an accommodation of new growth: the recorded value equals the measured one, and no other entry is raised for this file. A RECORDED CHANGE (2026-10-31, gap-codex-token-usage-snapshot-semantics): `src/shared/types.ts` 4749\u21924768 and `src/modules/chat-composer/composer/ChatComposer.tsx` 1633\u21921644 are raised to their measured values. The first is this task's wire vocabulary: the shared `TokenUsageCounts` shape and the `CostCommandData.tokenUsage`/`tokenBreakdown` fields describe the same cumulative/latest-request reading on both ends of the `/cost` response, so the contract belongs in `src/shared/types.ts` and no new module carries it instead. The second is a stale-census re-sync: `ChatComposer.tsx` is byte-identical to the develop tip and its growth landed in 61caec01a, after the 2d86ad361 census captured 1633; no commit re-recorded it, so the criterion redded a file this task does not touch. Neither entry is raised above its current reading, and no other entry is raised. A RECORDED CHANGE (2026-11-01, gap-cost-panel-cache-hit-ratio-and-cachewrite-bar): `src/shared/types.ts` 4768\u21924772. The increase is the wire vocabulary this task adds to the same `/cost` contract: `TokenUsageCounts` gains the `cacheWriteTokens?` quantity (mirrored field-for-field by the server's `ProviderTokenUsageCounts`, which the TypeSync criterion compares) and `CostCommandData.tokenBreakdown` gains `cacheWrite?`, each with its one-line doc comment. The shape is stated twice by hand by design, so the client half belongs in this shared types file and no new module carries it instead. No other entry is raised. A RECORDED CHANGE (2026-11-01, cockpit-knowledge-decision-handoff): `server/shared/types.ts` 5373\u21925482 and `src/shared/types.ts` 4772\u21924881 are raised to their measured values. The increase is the knowledge-suggestion wire vocabulary this task adds to the cockpit card contract: `CockpitKnowledgeCase`/`CockpitKnowledgePlan`/`CockpitKnowledgeVerification`/`CockpitKnowledgeDecision`/`CockpitKnowledgeCaseState` plus the `knowledge` block on `CockpitCard` and the `decision`/`confirmationRef` fields on `CockpitCardOption` and `CockpitCardFeedback`, each with the doc comments that state what the provider owns, what the cockpit only reads, and what a caller may never forge. Both wire ends are hand-copied and a TypeSync criterion compares them field-for-field, so the shape exists twice by design; no new module carries it instead. No other entry is raised above its current reading. A RECORDED CHANGE (2026-11-01, knowledge-application-fact-contract): `server/index.ts` 2871\u21922905. The increase is this task's composition-root wiring: the `knowledge_facts` read tool's fact source is constructed in `server/index.ts` and bound to the process's real session repository, session host manager, run registry and project lookup, so the gateway answers through the same injected services every other read tool uses rather than through a second private assembly. The adapter itself lives in the new `server/knowledge-facts-wiring.ts`; only the constructor call and its dep bag belong at the composition root. A RECORDED CHANGE (2026-11-01, gap-authoritative-token-reading-used-scope-elimination): `src/modules/chat-session/hooks/useChatSessionState.ts` hookStateHeavy 51\u219252. The task's deliverable is the split of the one dual-meaning `tokenBudget` state into two named channels \u2014 `liveFrame`, the realtime frame the composer counter renders, and `authoritativeReading`, the only reading `/cost` may send \u2014 and two independently-written states are the honest shape of that split: one object would hide which channel each of the ten call sites writes. The file's oversize reading is unchanged at 2127, so this is the only entry that moves. No other entry is raised. A RECORDED CHANGE (2026-11-02, pending-approval-dedup): `server/modules/providers/services/provider-runtime.service.ts` 1282\u21921288. The subscribe acknowledgement must read a shared approval registry once per provider: Claude and Codex expose the same ApprovalRequestsService, so the old fan-out listed the same pending question twice and the client drew two identical answer panels. The six added lines are the per-call reader set and the guard; no other entry moves. A RECORDED CHANGE (2026-11-02, gap-ratchet-baseline-knowledge-facts-wiring): `server/knowledge-facts-wiring.ts` is a NEW `oversizeFiles` entry at 842 \u2014 \u57fa\u7ebf\u5916\u2192842. The file was introduced by 9be415857 as the effective-config launchRequest slice's wiring composition root, and 842 is the real line count that landed with that delivery; this task only registers the existing delivery, it does not grow the file (zero diff on it), and splitting it would be an independent refactor outside this slice. Recording the reading is the honest shape of the change; no other entry is raised. A RECORDED CHANGE (2026-11-02, codex-provider-config-surface): `server/shared/types.ts` 5482\u21925526 and `src/shared/types.ts` 4881\u21924916. This task introduces the Codex upstream provider wire contract (`CodexModelProvider`, `CodexModelProvidersReading`); both ends carry the shape by design because the server tree is not part of the browser bundle and `src/shared/tests/wireContractTypeSync.test.ts` compares the two declarations field-for-field. The increase IS the deliverable \u2014 no new module carries the types instead, because the contract is the server/client seam \u2014 and no other entry is raised. A RECORDED CHANGE (2026-11-02, gap-cockpit-knowledge-title-statement-on-card): `server/shared/types.ts` 5526\u21925537 and `src/shared/types.ts` 4916\u21924927. The cockpit knowledge case type gains the two optional display fields `title` and `statement` \u2014 two field lines plus their doc comment on each side \u2014 so a card can draw what the knowledge entry says before a person decides; both ends carry the shape by design because the server tree is not part of the browser bundle and `src/shared/tests/cockpitCardTypeSync.test.ts` compares the declarations field-for-field. The increase IS the deliverable \u2014 no new module carries the fields instead, because the contract is the server/client seam \u2014 and no other entry is raised. A RECORDED CHANGE (2026-11-02, gap-cloudpit-brand-env-reader-wiring): `server/modules/browser-use/browser-use.service.ts` 920\u2192958. This task wires the brand env reader (`CLOUDPIT_*` first, `CLOUDCLI_*` fallback) into the browser-use service's limit reads and the MCP subprocess env write. The increase is that wiring: the three default constants, the exported `readBrowserUseEnvDefaults(env, warn)` seam (exported so the wiring criterion drives the exact production reads with an injected environment instead of mutating this process), the once-per-process resolved reader that replaces the two inline `process.env.CLOUDCLI_*` parses, and the new-spelling-plus-transitional-legacy-alias env bag that `registerAgentMcp` hands to every provider. No new module carries the reader instead: the reads and the subprocess env write are the same service's env surface, and moving the seam to a second file would put the production reads and their criterion in different modules. No other entry is raised. A RECORDED CHANGE (2026-11-03, codex-model-entry-provider-binding): `server/modules/providers/provider.routes.ts` 1152\u21921162, `server/shared/types.ts` 5537\u21925552 and `src/shared/types.ts` 4927\u21924935. This task gives a custom model entry an optional `codexProviderId` that binds it to a project Codex upstream provider. The three increases are that field and its route parse: the config shape gains one documented optional member on each side (the server tree is not part of the browser bundle, and `wireContractTypeSync` compares the two declarations field-for-field, so the mirror line IS the deliverable), and the route gains the string guard plus the pass-through line that carries it into the service. No new module carries the field instead: the contract is the server/client seam and the parse belongs to the route that already owns `config`. No other entry is raised. A RECORDED CHANGE (2026-11-03, codex-session-provider-id-binding): `server/modules/database/migrations.ts` 1167\u21921190, `server/modules/providers/provider.routes.ts` 1162\u21921173, `server/modules/providers/services/sessions.service.ts` 1390\u21921394, `server/modules/websocket/services/chat-control.service.ts` 1116\u21921149, `server/modules/websocket/services/chat-websocket.service.ts` 1970\u21921994 and `server/shared/types.ts` 5552\u21925572. This task records the session-level upstream-provider binding (AC-462): the migrations file gains the `model_provider_id` column migration, the sessions service copies the binding onto a fork, `server/shared/types.ts` states the two new members of `ProviderSessionModel` (`modelProviderId`, `modelProviderProblem`) that every display surface now reads, the providers route answers the fallback selection with them, and the two websocket files add the pre-admission switch refusal (dispatchRun checks before it reserves a run, because the recording write it guards runs after `startRun`) plus the control-service propagation of that refusal code. The binding RULES themselves did not grow any of these files: they live in the new leaves `session-provider-binding.ts` and `session-model-resolver.ts` (both under 200 lines), and the resolver extraction LOWERED `provider-models.service.ts` 765\u2192737, which is why that file is absent from this map. A RECORDED CHANGE (2026-11-03, codex-resident-provider-injection): `server/modules/providers/list/codex/codex-host-driver.provider.ts` 841\u2192855. This task gives the resident host driver a per-session app-server launch so a session bound to a project Codex upstream provider is spawned with `-c model_provider` (Codex 0.166 refuses the turn otherwise). The growth is the host-id launch map plus the two call sites that move the compiled launch from `startResidentSession` to `startHost` (which runs before `bind`) and pass it to `connectionFor`; the compilation itself and the option reader live in the new leaf `codex-resident-provider-launch.ts`, which kept the increase to these fourteen lines rather than the ~50 an inline implementation needed. `server/modules/providers/services/provider-runtime.service.ts` 1288\u21921291 is raised for the same task: `defaultResidentLaunchOptions` states the session row's `model_provider_id` in the launch bag the restore pass hands `startResidentSession` (one documented line plus the spread that writes it), so a restarted resident host re-injects the provider its thread was created under instead of dialling Codex's `openai` default. No other entry is raised. A RECORDED CHANGE (2026-11-03, codex-provider-advanced-capabilities): `server/shared/types.ts` 5572\u21925595 and `src/shared/types.ts` 4935\u21924958. This task adds nine optional advanced-connection fields to `CodexModelProvider` on both ends (the two declarations are hand-copied and `wireContractTypeSync` compares them field-for-field, so the shape exists twice by design, not by duplication), plus the two optional catalog window fields on `ProviderModelOption`. The increase is exactly those declarations and their doc comments; no other entry is raised.",
   "oversizeFiles": {
     "server/index.ts": 2905,
     "server/knowledge-facts-wiring.ts": 842,
     "server/modules/architecture/generator.ts": 1591,
     "server/modules/architecture/service.ts": 1732,
-    "server/modules/browser-use/browser-use.service.ts": 920,
+    "server/modules/browser-use/browser-use.service.ts": 958,
     "server/modules/context-events/context-event-writer.ts": 939,
-    "server/modules/database/migrations.ts": 1167,
+    "server/modules/database/migrations.ts": 1190,
     "server/modules/database/repositories/sessions.db.ts": 1479,
     "server/modules/debug-agent/debug-agent.engine.ts": 1090,
     "server/modules/debug-agent/debug-agent.host-driver.ts": 929,
@@ -22,14 +22,14 @@
     "server/modules/providers/list/claude/claude-resident-lifecycle-outcome-handlers.ts": 1256,
     "server/modules/providers/list/claude/claude-runtime.provider.ts": 2433,
     "server/modules/providers/list/claude/claude-sessions.provider.ts": 1792,
-    "server/modules/providers/list/codex/codex-host-driver.provider.ts": 841,
+    "server/modules/providers/list/codex/codex-host-driver.provider.ts": 855,
     "server/modules/providers/list/codex/codex-sessions.provider.ts": 2361,
-    "server/modules/providers/provider.routes.ts": 1152,
+    "server/modules/providers/provider.routes.ts": 1173,
     "server/modules/providers/services/claude-activity-task-reducer.service.ts": 958,
-    "server/modules/providers/services/provider-runtime.service.ts": 1288,
+    "server/modules/providers/services/provider-runtime.service.ts": 1291,
     "server/modules/providers/services/session-conversations-search.service.ts": 1429,
     "server/modules/providers/services/sessions-watcher.service.ts": 865,
-    "server/modules/providers/services/sessions.service.ts": 1390,
+    "server/modules/providers/services/sessions.service.ts": 1394,
     "server/modules/quay/quay.service.ts": 2993,
     "server/modules/resident-ledger/ledger.ts": 805,
     "server/modules/session-hosts/session-host-manager.service.ts": 1745,
@@ -44,10 +44,10 @@
     "server/modules/voice-realtime/voice-realtime-ws-proxy.service.ts": 5569,
     "server/modules/voice/voice-capture.ts": 1086,
     "server/modules/voice/voice.service.ts": 1855,
-    "server/modules/websocket/services/chat-control.service.ts": 1116,
+    "server/modules/websocket/services/chat-control.service.ts": 1149,
     "server/modules/websocket/services/chat-run-registry.service.ts": 1436,
-    "server/modules/websocket/services/chat-websocket.service.ts": 1970,
-    "server/shared/types.ts": 5482,
+    "server/modules/websocket/services/chat-websocket.service.ts": 1994,
+    "server/shared/types.ts": 5595,
     "server/shared/utils.ts": 1930,
     "shared/asr/asrInvariants.ts": 1760,
     "shared/asr/asrRegistry.ts": 1043,
@@ -70,16 +70,16 @@
     "src/modules/chat-tool-configs/configs/toolConfigs.ts": 822,
     "src/modules/chat-voice/utils/voice/voiceContextPack.ts": 821,
     "src/modules/chat-voice/voice-realtime/useVoiceRealtimeSession.ts": 2833,
-    "src/modules/cockpit/CockpitCard.tsx": 983,
-    "src/modules/cockpit/cockpitCardController.ts": 1797,
-    "src/modules/cockpit/CockpitPage.tsx": 1900,
+    "src/modules/cockpit/cards/CockpitCard.tsx": 983,
+    "src/modules/cockpit/cards/cockpitCardController.ts": 1797,
+    "src/modules/cockpit/workspace/CockpitPage.tsx": 1900,
     "src/modules/git-panel/hooks/useGitPanelController.ts": 845,
     "src/modules/project-workspace/hooks/useProjectsState.ts": 1457,
     "src/modules/quay/QuayPanel.tsx": 1176,
     "src/modules/shell/utils/mobileTerminalSelection.ts": 1061,
     "src/modules/sidebar/hooks/useSidebarController.ts": 1343,
     "src/shared/api.ts": 1809,
-    "src/shared/types.ts": 4881,
+    "src/shared/types.ts": 4958,
     "src/shared/voiceClientAsrWorker.ts": 1533
   },
   "moduleMutableState": {
@@ -200,7 +200,7 @@
   "hookStateHeavy": {
     "src/modules/chat-session/hooks/useChatSessionState.ts": 52,
     "src/modules/chat-voice/voice-realtime/useVoiceRealtimeSession.ts": 62,
-    "src/modules/cockpit/CockpitPage.tsx": 32,
+    "src/modules/cockpit/workspace/CockpitPage.tsx": 32,
     "src/modules/git-panel/hooks/useGitPanelController.ts": 21,
     "src/modules/project-workspace/hooks/useProjectsState.ts": 23,
     "src/modules/sidebar/hooks/useSidebarController.ts": 35

package/server/shared/tests/cloudpit-brand-env.test.ts

@@ -1,11 +1,15 @@
 /**
- * The Cloudpit brand criterion: the `BRAND` identity table and the
- * `CLOUDPIT_*` → `CLOUDCLI_*` environment fallback reader.
+ * The Cloudpit brand criterion: the `BRAND` identity table and the v3.0
+ * `CLOUDPIT_*`-only environment reader.
  *
  * Every leg drives the real reader with an in-memory environment; the `BRAND`
  * reading comes from the TypeScript syntax tree so a comment or a string
  * literal that merely spells a field cannot satisfy the assertion.
  *
+ * v3.0 RETIREMENT: the reader no longer accepts the legacy `CLOUDCLI_*`
+ * spelling. A legacy-only environment reads absent (and the caller's shipped
+ * default applies); there is no fallback reading and no deprecation warning.
+ *
  * Run directly:
  *   npx tsx --tsconfig server/tsconfig.json --test server/shared/tests/cloudpit-brand-env.test.ts
  */
@@ -68,11 +72,9 @@ function readBrandFields(): Record<string, string> {
   return fields;
 }
 
-/** Build a reader over `env` plus the warnings it emitted, in order. */
+/** Build a reader over `env`. */
 function readWith(env: Record<string, string | undefined>) {
-  const warnings: string[] = [];
-  const reader = createBrandEnvReader({ env, warn: (message) => warnings.push(message) });
-  return { reader, warnings };
+  return createBrandEnvReader({ env });
 }
 
 test('AC1: BRAND carries the Cloudpit identity read from the syntax tree', () => {
@@ -85,59 +87,127 @@ test('AC1: BRAND carries the Cloudpit identity read from the syntax tree', () =>
   });
 });
 
-test('AC2 legacy-only: CLOUDCLI_X supplies the value, is marked legacy and warns once', () => {
-  const { reader, warnings } = readWith({ CLOUDCLI_X: 'old' });
+test('AC2 legacy-only: CLOUDCLI_X is ignored and the read is absent', () => {
+  const reader = readWith({ CLOUDCLI_X: 'old' });
 
-  assert.deepEqual(reader.read('X'), { value: 'old', source: 'legacy', key: 'CLOUDCLI_X' });
-  assert.equal(warnings.length, 1, 'using the legacy spelling must warn exactly once');
+  assert.deepEqual(reader.read('X'), { value: undefined, source: 'absent', key: 'CLOUDPIT_X' });
 });
 
-test('AC2 new-only: CLOUDPIT_X supplies the value, is marked new and does not warn', () => {
-  const { reader, warnings } = readWith({ CLOUDPIT_X: 'new' });
+test('AC2 new-only: CLOUDPIT_X supplies the value and is marked new', () => {
+  const reader = readWith({ CLOUDPIT_X: 'new' });
 
   assert.deepEqual(reader.read('X'), { value: 'new', source: 'new', key: 'CLOUDPIT_X' });
-  assert.deepEqual(warnings, [], 'the new spelling is not deprecated');
 });
 
-test('AC2 both-set: the new spelling wins and emits no warning', () => {
-  const { reader, warnings } = readWith({ CLOUDPIT_X: 'new', CLOUDCLI_X: 'old' });
+test('AC2 both-set: the new spelling wins and the legacy value is never consulted', () => {
+  const reader = readWith({ CLOUDPIT_X: 'new', CLOUDCLI_X: 'old' });
 
   assert.deepEqual(reader.read('X'), { value: 'new', source: 'new', key: 'CLOUDPIT_X' });
-  assert.deepEqual(warnings, [], 'a legacy value shadowed by the new one must not warn');
 });
 
 test('AC3 absent: neither spelling set reads absent with no value', () => {
-  const { reader, warnings } = readWith({});
+  const reader = readWith({});
 
   const reading = reader.read('X');
   assert.equal(reading.value, undefined);
   assert.equal(reading.source, 'absent');
   assert.equal(reading.key, 'CLOUDPIT_X', 'absent reads name the canonical key to set');
-  assert.deepEqual(warnings, []);
 });
 
-test('AC3 empty new value: CLOUDPIT_X="" falls back to the legacy value', () => {
-  const { reader, warnings } = readWith({ CLOUDPIT_X: '', CLOUDCLI_X: 'old' });
+test('AC3 empty new value: CLOUDPIT_X="" reads absent and does NOT fall back to the legacy value', () => {
+  const reader = readWith({ CLOUDPIT_X: '', CLOUDCLI_X: 'old' });
 
-  assert.deepEqual(reader.read('X'), { value: 'old', source: 'legacy', key: 'CLOUDCLI_X' });
-  assert.equal(warnings.length, 1);
+  assert.deepEqual(reader.read('X'), { value: undefined, source: 'absent', key: 'CLOUDPIT_X' });
 });
 
-test('AC3 warn-once: reading the same legacy key twice on one reader warns once', () => {
-  const { reader, warnings } = readWith({ CLOUDCLI_X: 'old' });
-
-  assert.equal(reader.read('X').value, 'old');
-  assert.equal(reader.read('X').value, 'old');
-  assert.equal(warnings.length, 1, 'the warned-key set is per reader, not per read');
+test('AC1: neither reader source carries the legacy env spelling in code', () => {
+  const sources: Array<[string, ts.ScriptKind]> = [
+    ['server/shared/brand.ts', ts.ScriptKind.TS],
+    ['electron/brandEnv.js', ts.ScriptKind.JS],
+  ];
+  for (const [relativePath, kind] of sources) {
+    const filePath = path.join(REPO_ROOT, relativePath);
+    const sourceFile = ts.createSourceFile(
+      filePath,
+      readFileSync(filePath, 'utf8'),
+      ts.ScriptTarget.Latest,
+      true,
+      kind,
+    );
+    const literals: string[] = [];
+    const visit = (node: ts.Node): void => {
+      if (
+        ts.isStringLiteral(node)
+        || ts.isNoSubstitutionTemplateLiteral(node)
+        || ts.isTemplateHead(node)
+        || ts.isTemplateMiddle(node)
+        || ts.isTemplateTail(node)
+      ) {
+        literals.push(node.text);
+      }
+      node.forEachChild(visit);
+    };
+    sourceFile.forEachChild(visit);
+    assert.deepEqual(
+      literals.filter((literal) => literal.includes('CLOUDCLI_')),
+      [],
+      `${relativePath} must not build a legacy env key (comments are not evaluated)`,
+    );
+    assert.ok(
+      literals.some((literal) => literal.includes('CLOUDPIT_')),
+      `${relativePath} must still build the canonical env key`,
+    );
+  }
 });
 
-test('AC3 reader isolation: two readers each warn once for the same legacy key', () => {
-  const first = readWith({ CLOUDCLI_X: 'old' });
-  const second = readWith({ CLOUDCLI_X: 'old' });
 
-  first.reader.read('X');
-  second.reader.read('X');
-
-  assert.equal(first.warnings.length, 1);
-  assert.equal(second.warnings.length, 1);
+/**
+ * Every brand name the production wiring points read (Electron main/localServer,
+ * serverInstaller, browser-use service and its MCP entry) resolved through the
+ * reader: the canonical spelling supplies the value, the legacy spelling is
+ * ignored, and an absent pair reads absent. This pins the *names* as well as the
+ * semantics, so a wiring point that invents a name the reader does not recognise
+ * turns red here instead of silently reading `undefined`.
+ */
+const WIRED_BRAND_ENV_NAMES = [
+  'CONTROL_PLANE_URL',
+  'DESKTOP_LOCAL_SERVER_URL',
+  'LOCAL_SERVER_URL',
+  'DESKTOP_LOCAL_SERVER_PORT',
+  'SERVER_PORT',
+  'USE_INSTALLED_SERVER',
+  'SERVER_BUNDLE_URL',
+  'SERVER_BUNDLE_RELEASE_TAG',
+  'SERVER_DIR',
+  'BROWSER_USE_MAX_SESSIONS_PER_OWNER',
+  'BROWSER_USE_SESSION_TTL_MS',
+  'BROWSER_USE_INSTALL_TIMEOUT_MS',
+  'BROWSER_USE_API_URL',
+  'BROWSER_USE_MCP_TOKEN',
+  'BROWSER_USE_API_TIMEOUT_MS',
+];
+
+test('AC3 wiring names: each brand name resolves new > absent, never legacy', () => {
+  for (const name of WIRED_BRAND_ENV_NAMES) {
+    const both = readWith({ [`CLOUDPIT_${name}`]: 'new', [`CLOUDCLI_${name}`]: 'old' });
+    assert.deepEqual(
+      both.read(name),
+      { value: 'new', source: 'new', key: `CLOUDPIT_${name}` },
+      `${name}: the new spelling must win`,
+    );
+
+    const legacy = readWith({ [`CLOUDCLI_${name}`]: 'old' });
+    assert.deepEqual(
+      legacy.read(name),
+      { value: undefined, source: 'absent', key: `CLOUDPIT_${name}` },
+      `${name}: the legacy spelling must no longer be read`,
+    );
+
+    const absent = readWith({});
+    assert.deepEqual(
+      absent.read(name),
+      { value: undefined, source: 'absent', key: `CLOUDPIT_${name}` },
+      `${name}: an unset pair reads absent`,
+    );
+  }
 });