@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/shared/tests/cloudpit-runtime-flip.test.ts

@@ -3,10 +3,17 @@
  *
  * GOAL-053 left the Cloudpit pipeline DARK: the resolver, the settings fallback, the dual asset
  * roots and the scope alias table existed, but every runtime default still pointed at the legacy
- * layout. This file drives the flip — default `~/.cloudpit`, settings read-legacy/write-new,
- * uploads to the new asset root, both observation URI spellings, the new MCP server name, the two
- * scope vocabularies and the two service-worker cache prefixes — against temp homes and fakes, so
- * it never reads or writes the developer's real `~`.
+ * layout. This file drives the flip — default `~/.cloudpit`, one-time settings migration, uploads
+ * to the new asset root, both observation URI spellings, the new MCP server name, the two scope
+ * vocabularies and the two service-worker cache prefixes — against temp homes and fakes, so it
+ * never reads or writes the developer's real `~`.
+ *
+ * v3.0 retired the runtime fallbacks: `defaultRoot: 'legacy'`, the failed-migration fallback to
+ * `~/.cloudcli`, the legacy settings read fallback and the `CLOUDCLI_*` environment spellings are
+ * all gone. This batch also retires the identity contracts: the cloudcli deep link and observation
+ * URI spelling, the two legacy MCP names, the `cloudcli:*` OAuth scope spelling and the
+ * `claude-ui-*` service-worker cache family. The arms below assert the one-time migrations still
+ * work and that the retired paths are ignored.
  *
  * Run directly:
  *   npx tsx --tsconfig server/tsconfig.json --test server/shared/tests/cloudpit-runtime-flip.test.ts
@@ -29,7 +36,6 @@ import {
   readMcpPrincipal,
 } from '@/modules/mcp-gateway/index.js';
 import {
-  LEGACY_MCP_SERVER_NAMES,
   MCP_SERVER_NAME,
   mcpServerNamesToRemove,
 } from '@/modules/browser-use/index.js';
@@ -47,7 +53,11 @@ import {
 import { createBrandEnvReader } from '@/shared/brand.js';
 import { resolveDataRoots } from '@/shared/data-root.js';
 import { getImageAssetsReadDirs, getImageAssetsWriteDir } from '@/shared/image-attachments.js';
-import { ACCESS_TOKEN_SCOPES, CLOUDPIT_ACCESS_TOKEN_SCOPES } from '@/shared/mcp-contract/index.js';
+import {
+  ACCEPTED_ACCESS_TOKEN_SCOPES,
+  ACCESS_TOKEN_SCOPES,
+  CLOUDPIT_ACCESS_TOKEN_SCOPES,
+} from '@/shared/mcp-contract/index.js';
 import { defaultServerSettingsPath } from '@/shared/settings-file.js';
 
 const APPLICATION_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
@@ -62,7 +72,7 @@ function temporaryHome(prefix: string): string {
   return mkdtempSync(path.join(os.tmpdir(), prefix));
 }
 
-test('AC2/AC11: the Cloudpit default root migrates a legacy layout, and the legacy mode stays', () => {
+test('AC2/AC11 (v3.0): the Cloudpit default root migrates a legacy layout; no legacy mode is selectable', () => {
   const homeDir = temporaryHome('cloudpit-runtime-root-');
   try {
     const legacyRoot = path.join(homeDir, '.cloudcli');
@@ -71,7 +81,6 @@ test('AC2/AC11: the Cloudpit default root migrates a legacy layout, and the lega
     writeFileSync(path.join(legacyRoot, 'cockpit-card-feedback.json'), '{"kept":true}\n');
 
     const plan = resolveDataRoots({
-      defaultRoot: 'cloudpit',
       env: {},
       homeDir,
       version: 'criterion',
@@ -99,11 +108,16 @@ test('AC2/AC11: the Cloudpit default root migrates a legacy layout, and the lega
     // The legacy root is only ever READ.
     assert.equal(readFileSync(path.join(legacyRoot, 'auth.db'), 'utf8'), 'legacy-database');
 
-    // AC11's negative control: the legacy mode is still selectable and is unchanged.
-    const legacyPlan = resolveDataRoots({ defaultRoot: 'legacy', env: {}, homeDir });
-    assert.equal(legacyPlan.activeRoot, legacyRoot);
-    assert.equal(legacyPlan.reason, 'default-legacy');
-    assert.equal(legacyPlan.migrated, false);
+    // AC11's negative control: the retired `defaultRoot: 'legacy'` option no longer moves the
+    // default back to the old root — it is not part of the resolver's public shape, so a caller
+    // that still passes it keeps the Cloudpit root.
+    const ignoredMode = resolveDataRoots({
+      defaultRoot: 'legacy',
+      env: {},
+      homeDir,
+    } as unknown as Parameters<typeof resolveDataRoots>[0]);
+    assert.equal(ignoredMode.activeRoot, path.join(homeDir, '.cloudpit'));
+    assert.equal(ignoredMode.reason, 'default-already-migrated');
   } finally {
     rmSync(homeDir, { recursive: true, force: true });
   }
@@ -114,8 +128,7 @@ test('AC2/AC11: the Cloudpit default root migrates a legacy layout, and the lega
     mkdirSync(failingLegacyRoot, { recursive: true });
     writeFileSync(path.join(failingLegacyRoot, 'auth.db'), 'legacy-database');
 
-    const fallback = resolveDataRoots({
-      defaultRoot: 'cloudpit',
+    const failure = resolveDataRoots({
       env: {},
       homeDir: failingHome,
       backupDatabase: () => {
@@ -123,9 +136,10 @@ test('AC2/AC11: the Cloudpit default root migrates a legacy layout, and the lega
       },
     });
 
-    assert.equal(fallback.activeRoot, failingLegacyRoot);
-    assert.equal(fallback.reason, 'fallback-after-failure');
-    assert.equal(fallback.migrated, false);
+    assert.equal(failure.activeRoot, path.join(failingHome, '.cloudpit'), 'no fallback to ~/.cloudcli');
+    assert.equal(failure.reason, 'migration-failed');
+    assert.equal(failure.migrated, false);
+    assert.match(failure.migrationError ?? '', /SQLITE_BUSY/);
     assert.equal(
       existsSync(path.join(failingHome, '.cloudpit')),
       false,
@@ -142,8 +156,8 @@ test('AC3: the bootstrap and the CLI derive the default database from the resolv
   const indexSource = readApplicationFile('server/index.ts');
 
   assert.ok(
-    loadEnvSource.includes("resolveDataRoots({ defaultRoot: 'cloudpit' })"),
-    'load-env.ts must resolve the Cloudpit default',
+    loadEnvSource.includes('resolveDataRoots()'),
+    'load-env.ts must resolve the one Cloudpit default',
   );
   assert.ok(
     loadEnvSource.includes('process.env.DATABASE_PATH = DATA_ROOTS.authDatabasePath'),
@@ -155,7 +169,7 @@ test('AC3: the bootstrap and the CLI derive the default database from the resolv
   );
 
   assert.ok(
-    cliModuleSource.includes("resolveDataRoots({ defaultRoot: 'cloudpit', homeDir: homeDirectory })"),
+    cliModuleSource.includes('resolveDataRoots({ homeDir: homeDirectory })'),
     'cli.module.ts must derive its default database path from the resolver',
   );
   assert.ok(
@@ -179,7 +193,7 @@ test('AC3: the bootstrap and the CLI derive the default database from the resolv
   );
 });
 
-test('AC4/AC11: settings read the legacy file but always write the Cloudpit path', () => {
+test('AC4/AC11 (v3.0): the legacy settings file is copied once, then only the Cloudpit file is read', () => {
   const homeDir = temporaryHome('cloudpit-runtime-settings-');
   try {
     const newDefault = path.join(homeDir, '.config', 'cloudpit', 'server.settings.json');
@@ -191,21 +205,40 @@ test('AC4/AC11: settings read the legacy file but always write the Cloudpit path
       legacyDefault,
       `${JSON.stringify({ cockpit: { sessionStart: { model: 'legacy-model', effort: 'high' } } }, null, 2)}\n`,
     );
+    assert.equal(existsSync(newDefault), false, 'the Cloudpit file does not exist before the first boot');
 
+    // The first boot copies the legacy file to the Cloudpit path and reads the new one.
     const settings = loadServerSettings({ homeDir, env: {} });
     assert.equal(settings.cockpit.sessionStart.model, 'legacy-model');
     assert.equal(settings.cockpit.sessionStart.effort, 'high');
-    assert.deepEqual(settings.problems, [], 'a legacy fallback is not a configuration problem');
+    assert.deepEqual(settings.problems, []);
+    assert.equal(existsSync(newDefault), true, 'the first boot must create the Cloudpit settings file');
+    assert.deepEqual(
+      readFileSync(newDefault),
+      readFileSync(legacyDefault),
+      'the one-time migration copies the legacy document verbatim',
+    );
 
     const boot = readCockpitSessionStartBoot();
     assert.ok(boot, 'the boot loader must record its reading');
-    assert.equal(boot.path, legacyDefault, 'the effective values come from the legacy file');
-    assert.equal(boot.writePath, newDefault, 'a save must land in the Cloudpit default');
+    assert.equal(boot.path, newDefault, 'the effective values come from the Cloudpit file');
+    assert.equal(boot.writePath, newDefault, 'a save lands in the same Cloudpit file');
 
     const target = resolveServerSettingsFileTarget({ homeDir, env: {} });
-    assert.equal(target.path, legacyDefault);
-    assert.equal(target.writePath, newDefault);
-    assert.equal(target.explicit, false);
+    assert.deepEqual(target, { path: newDefault, writePath: newDefault, explicit: false });
+
+    // Editing the legacy file afterwards has no effect: only the Cloudpit file is read.
+    writeFileSync(
+      legacyDefault,
+      `${JSON.stringify({ cockpit: { sessionStart: { model: 'edited-legacy', effort: 'low' } } })}\n`,
+    );
+    assert.equal(loadServerSettings({ homeDir, env: {} }).cockpit.sessionStart.model, 'legacy-model');
+
+    // A save made after the copy is never clobbered by a later resolution (idempotent migration).
+    const savedDocument = `${JSON.stringify({ cockpit: { sessionStart: { model: 'saved-cloudpit' } } }, null, 2)}\n`;
+    writeFileSync(newDefault, savedDocument);
+    resolveServerSettingsFileTarget({ homeDir, env: {} });
+    assert.equal(readFileSync(newDefault, 'utf8'), savedDocument, 'the second run must not overwrite the user file');
 
     // Explicit overrides are unchanged: the named file is both read and written.
     const explicitPath = path.join(homeDir, 'operator', 'custom.settings.json');
@@ -216,11 +249,6 @@ test('AC4/AC11: settings read the legacy file but always write the Cloudpit path
       env: { SERVER_SETTINGS_PATH: explicitPath },
     });
     assert.deepEqual(byEnvironment, { path: explicitPath, writePath: explicitPath, explicit: true });
-
-    // With both files present the Cloudpit default wins.
-    mkdirSync(path.dirname(newDefault), { recursive: true });
-    writeFileSync(newDefault, `${JSON.stringify({ cockpit: { sessionStart: { model: 'new-model' } } })}\n`);
-    assert.equal(loadServerSettings({ homeDir, env: {} }).cockpit.sessionStart.model, 'new-model');
   } finally {
     rmSync(homeDir, { recursive: true, force: true });
   }
@@ -258,7 +286,7 @@ test('AC5/AC11: uploads write the Cloudpit root, the legacy root stays readable'
   }
 });
 
-test('AC6: both protocols are declared/registered and both observation URI spellings parse', () => {
+test('AC6 (v3.0): cloudpit is the only deep link and the only observation URI spelling', () => {
   const packageJson = JSON.parse(readApplicationFile('package.json')) as {
     build: {
       protocols: Array<{ name: string; schemes: string[] }>;
@@ -266,7 +294,9 @@ test('AC6: both protocols are declared/registered and both observation URI spell
     };
   };
   const protocolSchemes = packageJson.build.protocols.flatMap((entry) => entry.schemes);
-  assert.ok(protocolSchemes.includes('cloudcli'), 'the CloudCLI scheme must stay declared');
+  // The cloudcli scheme stays DECLARED for the third-party `cloudcli://auth/callback`; it is
+  // no longer a deep link this build registers at runtime.
+  assert.ok(protocolSchemes.includes('cloudcli'), 'the auth-callback scheme must stay declared');
   assert.ok(protocolSchemes.includes('cloudpit'), 'the Cloudpit scheme must be declared');
   const macSchemes = packageJson.build.mac.extendInfo.CFBundleURLTypes.flatMap(
     (entry) => entry.CFBundleURLSchemes,
@@ -274,32 +304,34 @@ test('AC6: both protocols are declared/registered and both observation URI spell
   assert.ok(macSchemes.includes('cloudcli') && macSchemes.includes('cloudpit'));
 
   const electronSource = readApplicationFile('electron/main.js');
-  // Both schemes must live in the single registered-scheme list, and the loop must push every
-  // entry through setAsDefaultProtocolClient (packaged and dev branches alike).
-  assert.match(electronSource, /const DEEP_LINK_SCHEMES = \['cloudcli', 'cloudpit'\];/);
+  // 3.0 registers exactly one deep-link scheme; the callback protocol is parsed separately.
+  assert.match(electronSource, /const DEEP_LINK_SCHEMES = \['cloudpit'\];/);
+  assert.match(electronSource, /const CALLBACK_PROTOCOL = 'cloudcli';/);
   const registerSource = electronSource.slice(
     electronSource.indexOf('function registerProtocolHandler'),
   );
   assert.ok(registerSource.includes('for (const scheme of DEEP_LINK_SCHEMES)'));
-  assert.ok(
-    registerSource.includes('app.setAsDefaultProtocolClient(scheme'),
-    'both schemes must reach setAsDefaultProtocolClient',
-  );
+  assert.ok(registerSource.includes('app.setAsDefaultProtocolClient(scheme'));
 
-  const legacyParsed = parseObservationUri('cloudcli://session/x');
+  // 3.0 owns one observation spelling. The canonical one still parses; the retired 2.x read
+  // spelling is a null, not a normalization.
   const cloudpitParsed = parseObservationUri('cloudpit://session/x');
-  assert.ok(legacyParsed && cloudpitParsed);
-  assert.deepEqual(cloudpitParsed, legacyParsed);
-  assert.equal(cloudpitParsed.uri, 'cloudcli://session/x', 'the canonical spelling stays legacy');
-  assert.equal(cloudpitParsed.scheme, 'cloudcli');
-  assert.equal(formatSessionUri('x'), 'cloudcli://session/x');
-  assert.equal(formatArchitectureUri('project-1'), 'cloudcli://architecture/project-1');
-  assert.equal(parseObservationUri('cloudpit://architecture/project-1')?.uri, 'cloudcli://architecture/project-1');
+  assert.ok(cloudpitParsed);
+  assert.equal(cloudpitParsed.uri, 'cloudpit://session/x');
+  assert.equal(cloudpitParsed.scheme, 'cloudpit');
+  assert.equal(parseObservationUri('cloudcli://session/x'), null, 'the 2.x session spelling is retired');
+  assert.equal(
+    parseObservationUri('cloudcli://architecture/project-1'),
+    null,
+    'the 2.x architecture spelling is retired',
+  );
+  assert.equal(formatSessionUri('x'), 'cloudpit://session/x');
+  assert.equal(formatArchitectureUri('project-1'), 'cloudpit://architecture/project-1');
 
   // The two compilers carry separate copies of the grammar; the accepted-scheme line must be
   // textually identical so a later edit cannot widen one side only.
   const regexLineOf = (source: string): string => {
-    const line = source.split('\n').find((entry) => entry.includes('const CLOUDCLI_URI = new RegExp('));
+    const line = source.split('\n').find((entry) => entry.includes('const CLOUDPIT_URI = new RegExp('));
     assert.ok(line, 'the URI grammar line must exist');
     return line.trim();
   };
@@ -309,21 +341,41 @@ test('AC6: both protocols are declared/registered and both observation URI spell
   );
 
   const storeSource = readApplicationFile('server/modules/observation/observation-store.ts');
-  assert.ok(storeSource.includes('cloudpit://session/<id>'), 'the INVALID_URI message names both spellings');
+  assert.ok(storeSource.includes('cloudpit://session/<id>'), 'the INVALID_URI message names the grammar');
+  assert.equal(
+    storeSource.includes('cloudcli://session/<id>'),
+    false,
+    'the INVALID_URI message no longer offers the retired spelling',
+  );
 });
 
-test('AC7/AC11: MCP registers the Cloudpit name and still cleans both legacy names', () => {
+test('AC6b (v3.0): the R14 itemRef formatters keep the legacy spelling, outside the observation grammar', () => {
+  // R14 is an item-addressing contract persisted on messages/cards, NOT the observation URI
+  // grammar retired above. A blanket `cloudcli://` deletion must not reach these two files.
+  const briefFormatter = readApplicationFile('server/modules/cockpit/cockpit-brief-result.ts');
+  assert.ok(
+    briefFormatter.includes('`cloudcli://session/${input.sessionId}`'),
+    'the brief itemRef formatter must keep writing cloudcli://session/<id>',
+  );
+  const replyFormatter = readApplicationFile(
+    'src/modules/chat-transcript/utils/transcript/replyItems.ts',
+  );
+  assert.ok(
+    replyFormatter.includes('`cloudcli://session/${address.sessionId}/msg/${address.messageId}#item-${address.ordinal}`'),
+    'the reply-item formatter must keep writing cloudcli://session/<id>/msg/<messageId>#item-<n>',
+  );
+  // The retired observation grammar rejects the same prefix: the two contracts stay separate.
+  assert.equal(parseObservationUri('cloudcli://session/x'), null);
+});
+
+test('AC7 (v3.0): MCP registers and cleans exactly the Cloudpit name', () => {
   assert.equal(MCP_SERVER_NAME, 'cloudpit-browser');
-  assert.deepEqual([...LEGACY_MCP_SERVER_NAMES], ['cloudcli-browser', 'cloudcli-browser-use']);
-  assert.deepEqual(mcpServerNamesToRemove(), [
-    'cloudpit-browser',
-    'cloudcli-browser',
-    'cloudcli-browser-use',
-  ]);
-
-  // Negative control: a name outside the current + legacy set is never a cleanup target.
+  assert.deepEqual(mcpServerNamesToRemove(), ['cloudpit-browser']);
+
+  // Negative control: neither a third-party name nor a retired spelling is a cleanup target.
   assert.equal(mcpServerNamesToRemove().includes('experimental-browser'), false);
-  assert.equal(LEGACY_MCP_SERVER_NAMES.includes('experimental-browser'), false);
+  assert.equal(mcpServerNamesToRemove().includes('cloudcli-browser'), false);
+  assert.equal(mcpServerNamesToRemove().includes('cloudcli-browser-use'), false);
 
   const entrySource = readApplicationFile('server/modules/cli/browser-use-mcp.ts');
   assert.match(
@@ -363,30 +415,35 @@ function principalForScopes(scopes: string[]) {
   return readMcpPrincipal(response);
 }
 
-test('AC8/AC11: both scope vocabularies are issued and judged; unknown scopes stay refused', () => {
+test('AC8 (v3.0): the advertised and accepted vocabulary is the eight Cloudpit scopes only', () => {
   const metadata = buildAuthorizationServerMetadata({
     baseUrl: 'https://cloudpit.example.test',
     dcrMode: 'off',
   });
   assert.equal(CLOUDPIT_ACCESS_TOKEN_SCOPES.length, 8);
-  assert.equal(ACCESS_TOKEN_SCOPES.length, 8);
-  for (const scope of ACCESS_TOKEN_SCOPES) {
-    assert.ok(metadata.scopes_supported.includes(scope), `AS metadata must advertise ${scope}`);
-  }
-  for (const scope of CLOUDPIT_ACCESS_TOKEN_SCOPES) {
-    assert.ok(metadata.scopes_supported.includes(scope), `AS metadata must advertise ${scope}`);
+  assert.equal(ACCESS_TOKEN_SCOPES.length, 8, 'the canonical table keeps its eight names');
+  assert.deepEqual(
+    [...metadata.scopes_supported],
+    [...CLOUDPIT_ACCESS_TOKEN_SCOPES],
+    'AS metadata advertises the wire vocabulary, once',
+  );
+  assert.equal(metadata.scopes_supported.length, 8);
+  for (const scope of metadata.scopes_supported) {
+    assert.ok(scope.startsWith('cloudpit:'), `AS metadata must advertise a cloudpit scope (saw ${scope})`);
   }
-  assert.equal(metadata.scopes_supported.length, 16);
 
-  // Dedupe on the canonical name, store the spelling the caller asked for.
-  assert.deepEqual(normalizeAccessTokenScopes(['cloudcli:read', 'cloudpit:read']), {
-    ok: true,
-    scopes: ['cloudcli:read'],
-  });
-  assert.deepEqual(normalizeAccessTokenScopes(['cloudpit:read', 'cloudcli:read']), {
-    ok: true,
-    scopes: ['cloudpit:read'],
-  });
+  // ACCEPTED is the one wire spelling: the canonical names are internal, never a request.
+  assert.deepEqual([...ACCEPTED_ACCESS_TOKEN_SCOPES], [...CLOUDPIT_ACCESS_TOKEN_SCOPES]);
+  assert.equal(ACCEPTED_ACCESS_TOKEN_SCOPES.includes('cloudcli:read'), false);
+
+  // New spelling issues; the retired 2.x spelling is refused at the boundary.
+  assert.deepEqual(normalizeAccessTokenScopes(['cloudpit:read']), { ok: true, scopes: ['cloudpit:read'] });
+  assert.deepEqual(normalizeAccessTokenScopes(['cloudcli:read']), { ok: false });
+  assert.deepEqual(
+    normalizeAccessTokenScopes(['cloudcli:read', 'cloudcli:session:send']),
+    { ok: false },
+    'a request naming any retired spelling is refused',
+  );
   assert.deepEqual(normalizeAccessTokenScopes(['cloudpit:read', 'cloudpit:session:send']), {
     ok: true,
     scopes: ['cloudpit:read', 'cloudpit:session:send'],
@@ -394,25 +451,22 @@ test('AC8/AC11: both scope vocabularies are issued and judged; unknown scopes st
   assert.deepEqual(normalizeAccessTokenScopes(['cloudcli:admin']), { ok: false });
   assert.deepEqual(normalizeAccessTokenScopes(['cloudpit:unknown']), { ok: false });
 
-  // AC11's old-token arm: the legacy spelling is still accepted and still satisfies the legacy
-  // required scope. The principal is built from the minted scope list, so dropping the old
-  // spelling from the accepted table would refuse the mint here.
-  const legacyMinted = normalizeAccessTokenScopes(['cloudcli:read']);
-  assert.deepEqual(legacyMinted, { ok: true, scopes: ['cloudcli:read'] });
-  const legacyPrincipal = principalForScopes(legacyMinted.ok ? legacyMinted.scopes : []);
-  assert.ok(legacyPrincipal);
-  assert.ok(legacyPrincipal.scopes.includes('cloudcli:read'));
-
-  // A token minted with the Cloudpit spelling is judged by the same old literal.
+  // A token minted with the new spelling is judged by the canonical `requiredScopes` literals.
   const cloudpitMinted = normalizeAccessTokenScopes(['cloudpit:read', 'cloudpit:session:send']);
   assert.deepEqual(cloudpitMinted, { ok: true, scopes: ['cloudpit:read', 'cloudpit:session:send'] });
   const cloudpitPrincipal = principalForScopes(cloudpitMinted.ok ? cloudpitMinted.scopes : []);
   assert.ok(cloudpitPrincipal);
   assert.deepEqual(cloudpitPrincipal.scopes, ['cloudcli:read', 'cloudcli:session:send']);
   assert.ok(cloudpitPrincipal.scopes.includes('cloudcli:read'));
+
+  // The old-token arm: a token row minted before 3.0 still carries the canonical spelling and
+  // still authenticates and satisfies the required scope (no forced invalidation).
+  const legacyPrincipal = principalForScopes(['cloudcli:read']);
+  assert.ok(legacyPrincipal);
+  assert.ok(legacyPrincipal.scopes.includes('cloudcli:read'));
 });
 
-test('AC9: activation deletes both cache families and keeps unrelated caches', async () => {
+test('AC9 (v3.0): activation deletes only the cloudpit- family and keeps unrelated caches', async () => {
   const cacheNames = [
     'cloudpit-v1',
     'cloudpit-old',
@@ -457,64 +511,49 @@ test('AC9: activation deletes both cache families and keeps unrelated caches', a
   activate({ waitUntil: (promise) => { pending = promise; } });
   await pending;
 
-  assert.deepEqual([...deleted].sort(), ['claude-ui-legacy', 'claude-ui-v3', 'cloudpit-old']);
-  assert.equal(deleted.includes('cloudpit-v1'), false);
+  assert.deepEqual([...deleted].sort(), ['cloudpit-old'], 'only this worker\'s own prefix is purged');
+  assert.equal(deleted.includes('cloudpit-v1'), false, 'the current cache is never deleted');
+  assert.equal(deleted.includes('claude-ui-v3'), false, 'the retired 1.x family is no longer cleaned');
+  assert.equal(deleted.includes('claude-ui-legacy'), false);
   assert.equal(deleted.includes('voice-client-asr-model-v1'), false);
   assert.equal(deleted.includes('other'), false);
   assert.equal(claimed, true);
 });
 
-test('AC10/AC11: CLOUDPIT_* is the canonical environment spelling, CLOUDCLI_* stays compatible', () => {
-  // New name only: no warning, and the reading names the canonical key.
-  const newOnlyWarnings: string[] = [];
+test('AC10/AC11 (v3.0): CLOUDPIT_* is the only environment spelling read', () => {
+  // New name only: the reading names the canonical key.
   const newOnly = createBrandEnvReader({
     env: { CLOUDPIT_HOME: '/new/home' },
-    warn: (message) => newOnlyWarnings.push(message),
   }).read('HOME');
   assert.deepEqual(newOnly, { value: '/new/home', source: 'new', key: 'CLOUDPIT_HOME' });
-  assert.deepEqual(newOnlyWarnings, [], 'the canonical spelling must not warn');
 
-  // Both set: the Cloudpit spelling wins and the legacy one is not even read.
-  const bothWarnings: string[] = [];
+  // Both set: the Cloudpit spelling wins and the legacy one is not read.
   const both = createBrandEnvReader({
     env: { CLOUDPIT_HOME: '/new/home', CLOUDCLI_HOME: '/legacy/home' },
-    warn: (message) => bothWarnings.push(message),
   }).read('HOME');
   assert.deepEqual(both, { value: '/new/home', source: 'new', key: 'CLOUDPIT_HOME' });
-  assert.deepEqual(bothWarnings, [], 'a legacy value shadowed by the new spelling must not warn');
 
-  // Legacy name only: still honoured, marked as legacy, warned exactly once per key.
-  const legacyWarnings: string[] = [];
-  const legacyReader = createBrandEnvReader({
-    env: { CLOUDCLI_HOME: '/legacy/home' },
-    warn: (message) => legacyWarnings.push(message),
-  });
-  assert.deepEqual(legacyReader.read('HOME'), {
-    value: '/legacy/home',
-    source: 'legacy',
-    key: 'CLOUDCLI_HOME',
-  });
-  assert.equal(legacyWarnings.length, 1, 'using the legacy spelling warns once');
-  assert.match(legacyWarnings[0], /CLOUDCLI_HOME is deprecated; set CLOUDPIT_HOME instead\./);
-  legacyReader.read('HOME');
-  assert.equal(legacyWarnings.length, 1, 'a second read of the same key stays silent');
+  // Legacy name only: no fallback any more — the read is absent (the shipped default applies).
+  assert.deepEqual(
+    createBrandEnvReader({ env: { CLOUDCLI_HOME: '/legacy/home' } }).read('HOME'),
+    { value: undefined, source: 'absent', key: 'CLOUDPIT_HOME' },
+  );
 
   // Absent: the reading still names the canonical key the operator should set.
-  assert.deepEqual(createBrandEnvReader({ env: {}, warn: () => {} }).read('HOME'), {
+  assert.deepEqual(createBrandEnvReader({ env: {} }).read('HOME'), {
     value: undefined,
     source: 'absent',
     key: 'CLOUDPIT_HOME',
   });
 
-  // The production resolver wires the same precedence: the Cloudpit variable wins, the legacy
-  // one is the fallback. This is the arm the CLI/bootstrap actually consume.
+  // The production resolver reads the same one spelling: CLOUDPIT_HOME wins, and a
+  // CLOUDCLI_HOME-only environment selects the default `~/.cloudpit` root instead.
   const homeDir = temporaryHome('cloudpit-runtime-env-');
   try {
     const newRoot = path.join(homeDir, 'explicit-new');
     const legacyRoot = path.join(homeDir, 'explicit-legacy');
     assert.equal(
       resolveDataRoots({
-        defaultRoot: 'cloudpit',
         env: { CLOUDPIT_HOME: newRoot, CLOUDCLI_HOME: legacyRoot },
         homeDir,
       }).activeRoot,
@@ -522,9 +561,9 @@ test('AC10/AC11: CLOUDPIT_* is the canonical environment spelling, CLOUDCLI_* st
       'CLOUDPIT_HOME must win over CLOUDCLI_HOME',
     );
     assert.equal(
-      resolveDataRoots({ defaultRoot: 'cloudpit', env: { CLOUDCLI_HOME: legacyRoot }, homeDir }).activeRoot,
-      legacyRoot,
-      'CLOUDCLI_HOME must stay a compatible fallback',
+      resolveDataRoots({ env: { CLOUDCLI_HOME: legacyRoot }, homeDir }).activeRoot,
+      path.join(homeDir, '.cloudpit'),
+      'CLOUDCLI_HOME must no longer select a root',
     );
   } finally {
     rmSync(homeDir, { recursive: true, force: true });

package/server/shared/tests/frontend-import-cycle-budget.baseline.json

@@ -1,12 +1,12 @@
 {
-  "measuredAt": "2026-10-31",
+  "measuredAt": "2026-11-02",
   "scope": "every non-test .ts/.tsx under src/ (tests/ directories pruned, *.test.*/*.spec.* dropped), paths relative to src/",
-  "note": "Committed baseline for the frontend import-cycle ratchets (tasks/gap-routine-architecture-analysis-src-import-cycles-unpinned.md, tasks/gap-routine-architecture-analysis-src-module-scc-cockpit-hub.md). A RATCHET: cycleGroups and moduleSccGroups may only SHRINK. A group closed by a refactor is lowered explicitly here and in the matching in-file pin in the same commit; never raise or add a group to accommodate a red reading. `cycleGroups` is the DIRECTORY reading; `moduleSccGroups` is the MODULE reading (`modules/<name>` nodes collapsed from the same walk). `readings` records the tree the pin was measured on (same walk, resolver and Tarjan scanner as AC-394's server budget, with src/ as the scan root so @/ resolves to src/); the counts are provenance, not a gate, because a new acyclic import is ordinary feature work.",
+  "note": "Committed baseline for the frontend import-cycle ratchets (tasks/gap-routine-architecture-analysis-src-import-cycles-unpinned.md, tasks/gap-routine-architecture-analysis-src-module-scc-cockpit-hub.md). A RATCHET: cycleGroups and moduleSccGroups may only SHRINK. A group closed by a refactor is lowered explicitly here and in the matching in-file pin in the same commit; never raise or add a group to accommodate a red reading. `cycleGroups` is the DIRECTORY reading; `moduleSccGroups` is the MODULE reading (`modules/<name>` nodes collapsed from the same walk). `readings` records the tree the pin was measured on (same walk, resolver and Tarjan scanner as AC-394's server budget, with src/ as the scan root so @/ resolves to src/); the counts are provenance, not a gate, because a new acyclic import is ordinary feature work. RE-READ 2026-11-02 (task gap-routine-architecture-analysis-god-package-src-cockpit): the cockpit god-package split moved the card and workspace files into src/modules/cockpit/cards and src/modules/cockpit/workspace; because those files already imported each other and the root barrel, the one cockpit dependency web now spans four cockpit directories plus project-workspace. cycleGroups was re-measured and re-pinned member-for-member (not dropped); the module-level SCC is unchanged. The readings below were re-measured on the same tree.",
   "readings": {
-    "files": 688,
-    "staticFileEdges": 2144,
-    "dynamicFileEdges": 3,
-    "nodeCount": 108,
+    "files": 703,
+    "staticFileEdges": 2467,
+    "dynamicFileEdges": 0,
+    "nodeCount": 122,
     "unresolvedInternal": 100,
     "nonLiteralDynamic": 2
   },
@@ -24,7 +24,9 @@
     ],
     [
       "modules/cockpit",
+      "modules/cockpit/cards",
       "modules/cockpit/hooks",
+      "modules/cockpit/workspace",
       "modules/project-workspace"
     ],
     [

package/server/shared/tests/frontend-import-cycle-budget.test.ts

@@ -6,6 +6,12 @@
  * 2026-10-30): chat/tools ↔ chat/tools/ContentRenderers ↔ chat/transcript;
  * cockpit ↔ cockpit/hooks ↔ project-workspace; git-panel ↔ git-panel/changes ↔
  * git-panel/history; architecture ↔ architecture/hooks; settings/hooks ↔ settings/tabs.
+ * RE-READ 2026-11-02 (task gap-routine-architecture-analysis-god-package-src-cockpit): the
+ * cockpit god-package split moved its card and workspace files into `cockpit/cards` and
+ * `cockpit/workspace`. Those files already imported each other, so the same dependency web is
+ * now read across four cockpit directories plus project-workspace; the group was re-measured and
+ * re-pinned member-for-member rather than dropped. This is the mandated re-read for a structural
+ * split, not a widened dependency: the module-level SCC below is unchanged.
  * The backend already had AC-394's directory budget, but `src` had no cycle criterion and
  * `.oxlintrc.json` enables no `import/no-cycle`, so those five could widen unmeasured.
  *
@@ -58,7 +64,9 @@ const BASELINE_PATH = path.join(TEST_DIR, 'frontend-import-cycle-budget.baseline
  */
 const CYCLE_GROUPS: readonly string[][] = [
   ['modules/chat/tools', 'modules/chat/tools/ContentRenderers', 'modules/chat/transcript'],
-  ['modules/cockpit', 'modules/cockpit/hooks', 'modules/project-workspace'],
+  // Re-read after the cockpit god-package split (2026-11-02): the card, workspace and hooks
+  // directories share one dependency web with the root barrel and project-workspace.
+  ['modules/cockpit', 'modules/cockpit/cards', 'modules/cockpit/hooks', 'modules/cockpit/workspace', 'modules/project-workspace'],
   ['modules/git-panel', 'modules/git-panel/changes', 'modules/git-panel/history'],
   ['modules/architecture', 'modules/architecture/hooks'],
   ['modules/settings/hooks', 'modules/settings/tabs'],

package/server/shared/tests/quay-test-script.test.ts

@@ -483,8 +483,26 @@ test('AC2: a valid baseline dispatches known files longest-first, keeps the rest
     // (496 + 1 = 497 collected server test files). The goal branch's
     // gap-cloudpit-runtime-default-flip adds its criterion
     // server/shared/tests/cloudpit-runtime-flip.test.ts (497 + 1 = 498 collected server test
-    // files). This fixture names 3 known files, so 498 - 3 = 495.
-    assert.match(lines[0], /^test\.sh: server dispatch order=longest-first source=.* known=3 unknown=495$/);
+    // files), then codex-provider-config-surface added its criterion
+    // server/modules/settings/tests/codex-model-providers-settings.test.ts
+    // (498 + 1 = 499 collected server test files). Then
+    // gap-cloudpit-migrate-assets-rewrite added its criterion
+    // server/modules/cli/tests/asset-migration.service.test.ts
+    // (499 + 1 = 500 collected server test files). Then codex-model-entry-provider-binding
+    // added its criterion server/modules/providers/tests/codex-provider-model-binding.test.ts
+    // (500 + 1 = 501 collected server test files). Then codex-perrun-provider-injection
+    // added its criterion server/modules/providers/tests/codex-runtime-provider-injection.test.ts
+    // (501 + 1 = 502 collected server test files), then codex-session-provider-id-binding
+    // added its criterion server/modules/providers/tests/codex-session-provider-binding.test.ts
+    // (502 + 1 = 503 collected server test files), then codex-resident-provider-injection
+    // added its criterion server/modules/providers/tests/codex-resident-provider-injection.test.ts
+    // (503 + 1 = 504 collected server test files). Then codex-provider-import-user-profile added
+    // its criterion server/modules/settings/tests/codex-provider-import.test.ts
+    // (504 + 1 = 505 collected server test files), then codex-provider-advanced-capabilities
+    // added its criterion server/modules/settings/tests/codex-provider-advanced.test.ts
+    // (505 + 1 = 506 collected server test files). This fixture names 3 known files, so
+    // 506 - 3 = 503.
+    assert.match(lines[0], /^test\.sh: server dispatch order=longest-first source=.* known=3 unknown=503$/);
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
@@ -625,10 +643,26 @@ test('AC3: a broken baseline fails open to alphabetical order byte-for-byte, and
     // gap-effective-config-proc-request-layer added its criterion
     // server/modules/mcp-gateway/tests/knowledge-effective-config-launch-request.test.ts (496 + 1 = 497),
     // then the goal branch's gap-cloudpit-runtime-default-flip added
-    // server/shared/tests/cloudpit-runtime-flip.test.ts (497 + 1 = 498)
-    // — but this fixture names ONE known file, so 498 - 1 = 497 (AC2 reads 495 because its
-    // fixture names 3; the 498 is the number the tree collects with these criteria).
-    assert.match(vl[0], /^test\.sh: server dispatch order=longest-first source=.* known=1 unknown=497$/);
+    // server/shared/tests/cloudpit-runtime-flip.test.ts (497 + 1 = 498), then
+    // codex-provider-config-surface added
+    // server/modules/settings/tests/codex-model-providers-settings.test.ts (498 + 1 = 499), then
+    // gap-cloudpit-migrate-assets-rewrite added its criterion
+    // server/modules/cli/tests/asset-migration.service.test.ts (499 + 1 = 500), then
+    // codex-model-entry-provider-binding added
+    // server/modules/providers/tests/codex-provider-model-binding.test.ts (500 + 1 = 501), then
+    // codex-perrun-provider-injection added
+    // server/modules/providers/tests/codex-runtime-provider-injection.test.ts (501 + 1 = 502),
+    // then codex-session-provider-id-binding added
+    // server/modules/providers/tests/codex-session-provider-id-binding.test.ts (502 + 1 = 503),
+    // then codex-resident-provider-injection added
+    // server/modules/providers/tests/codex-resident-provider-injection.test.ts (503 + 1 = 504),
+    // then codex-provider-import-user-profile added
+    // server/modules/settings/tests/codex-provider-import.test.ts (504 + 1 = 505), then
+    // codex-provider-advanced-capabilities added
+    // server/modules/settings/tests/codex-provider-advanced.test.ts (505 + 1 = 506)
+    // — but this fixture names ONE known file, so 506 - 1 = 505 (AC2 reads 503 because its
+    // fixture names 3; the 506 is the number the tree collects with these criteria).
+    assert.match(vl[0], /^test\.sh: server dispatch order=longest-first source=.* known=1 unknown=505$/);
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }