pi-oxidized 0.1.1

package/.outline/review-fix-grill/iterations/1.json

@@ -0,0 +1,767 @@
+{
+  "iteration": 1,
+  "changedFiles": [
+    ".agent-tasks/pi-rust-rewrite/Cargo.lock",
+    ".agent-tasks/pi-rust-rewrite/Cargo.toml",
+    ".agent-tasks/pi-rust-rewrite/src/lib.rs",
+    ".agent-tasks/pi-rust-rewrite/tests/pi_ai_contract.rs",
+    ".github/workflows/release-verification.yml",
+    ".gitignore",
+    "Cargo.lock",
+    "bun.lock",
+    "crates/pi-agent/Cargo.toml",
+    "crates/pi-agent/src/agent.rs",
+    "crates/pi-agent/src/bus.rs",
+    "crates/pi-agent/src/config.rs",
+    "crates/pi-agent/src/drain.rs",
+    "crates/pi-agent/src/error.rs",
+    "crates/pi-agent/src/event.rs",
+    "crates/pi-agent/src/lib.rs",
+    "crates/pi-agent/src/message.rs",
+    "crates/pi-agent/src/queue.rs",
+    "crates/pi-agent/src/run.rs",
+    "crates/pi-agent/src/schedule.rs",
+    "crates/pi-agent/src/state.rs",
+    "crates/pi-agent/src/tool.rs",
+    "crates/pi-ai/Cargo.toml",
+    "crates/pi-ai/data/builtin-models.json",
+    "crates/pi-ai/src/auth/config_value.rs",
+    "crates/pi-ai/src/auth/context.rs",
+    "crates/pi-ai/src/auth/credential_store.rs",
+    "crates/pi-ai/src/auth/env_keys.rs",
+    "crates/pi-ai/src/auth/error.rs",
+    "crates/pi-ai/src/auth/file_store.rs",
+    "crates/pi-ai/src/auth/http.rs",
+    "crates/pi-ai/src/auth/mod.rs",
+    "crates/pi-ai/src/auth/oauth/anthropic.rs",
+    "crates/pi-ai/src/auth/oauth/callback_server.rs",
+    "crates/pi-ai/src/auth/oauth/device_code.rs",
+    "crates/pi-ai/src/auth/oauth/github_copilot.rs",
+    "crates/pi-ai/src/auth/oauth/mod.rs",
+    "crates/pi-ai/src/auth/oauth/openai_codex.rs",
+    "crates/pi-ai/src/auth/oauth/page.rs",
+    "crates/pi-ai/src/auth/oauth/pkce.rs",
+    "crates/pi-ai/src/auth/oauth/radius.rs",
+    "crates/pi-ai/src/auth/oauth/xai.rs",
+    "crates/pi-ai/src/auth/resolve.rs",
+    "crates/pi-ai/src/auth/runtime_credentials.rs",
+    "crates/pi-ai/src/auth/types.rs",
+    "crates/pi-ai/src/catalog/merge.rs",
+    "crates/pi-ai/src/catalog/mod.rs",
+    "crates/pi-ai/src/lib.rs",
+    "crates/pi-ai/src/models_store.rs",
+    "crates/pi-ai/src/provider.rs",
+    "crates/pi-ai/src/providers/anthropic_messages.rs",
+    "crates/pi-ai/src/providers/azure_openai_responses.rs",
+    "crates/pi-ai/src/providers/bedrock_converse_stream.rs",
+    "crates/pi-ai/src/providers/google_generative_ai.rs",
+    "crates/pi-ai/src/providers/google_vertex.rs",
+    "crates/pi-ai/src/providers/mistral_conversations.rs",
+    "crates/pi-ai/src/providers/mod.rs",
+    "crates/pi-ai/src/providers/openai_codex_responses.rs",
+    "crates/pi-ai/src/providers/openai_completions.rs",
+    "crates/pi-ai/src/providers/openai_responses.rs",
+    "crates/pi-ai/src/providers/pi_messages.rs",
+    "crates/pi-ai/src/providers/registry.rs",
+    "crates/pi-ai/src/providers/shared.rs",
+    "crates/pi-ai/src/providers/shared/google.rs",
+    "crates/pi-ai/src/providers/shared/responses.rs",
+    "crates/pi-ai/src/providers/stream_state.rs",
+    "crates/pi-ai/src/providers/transport.rs",
+    "crates/pi-ai/src/types.rs",
+    "crates/pi-ai/tests/conformance_anthropic_mistral.rs",
+    "crates/pi-ai/tests/conformance_bedrock_pi_messages.rs",
+    "crates/pi-ai/tests/conformance_codex.rs",
+    "crates/pi-ai/tests/conformance_google.rs",
+    "crates/pi-ai/tests/conformance_openai.rs",
+    "crates/pi-ai/tests/fixtures/providers/anthropic-messages/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/azure-openai-responses/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/bedrock-converse-stream/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/google-generative-ai/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/google-vertex/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/mistral-conversations/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/openai-codex-responses/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/openai-completions/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/openai-responses/cases.jsonl",
+    "crates/pi-ai/tests/fixtures/providers/pi-messages/cases.jsonl",
+    "crates/pi-ai/tests/provider_registry_contract.rs",
+    "crates/pi-ai/tests/support/golden.rs",
+    "crates/pi-ai/tests/support/http.rs",
+    "crates/pi-ai/tests/support/mod.rs",
+    "crates/pi-ext/Cargo.toml",
+    "crates/pi-ext/src/adapters.rs",
+    "crates/pi-ext/src/client.rs",
+    "crates/pi-ext/src/host.rs",
+    "crates/pi-ext/src/lib.rs",
+    "crates/pi-ext/src/protocol.rs",
+    "crates/pi-ext/src/sanitize.rs",
+    "crates/pi-ext/src/test_support.rs",
+    "crates/pi-ext/tests/scaling.rs",
+    "crates/pi-tui/Cargo.toml",
+    "crates/pi-tui/src/bin/pi_tui_pty_fixture.rs",
+    "crates/pi-tui/src/component.rs",
+    "crates/pi-tui/src/components/editor/mod.rs",
+    "crates/pi-tui/src/components/editor/paste.rs",
+    "crates/pi-tui/src/components/editor/state.rs",
+    "crates/pi-tui/src/components/image.rs",
+    "crates/pi-tui/src/components/input.rs",
+    "crates/pi-tui/src/components/loader.rs",
+    "crates/pi-tui/src/components/markdown.rs",
+    "crates/pi-tui/src/components/mod.rs",
+    "crates/pi-tui/src/components/padded.rs",
+    "crates/pi-tui/src/components/select_list.rs",
+    "crates/pi-tui/src/components/settings_list.rs",
+    "crates/pi-tui/src/components/spacer.rs",
+    "crates/pi-tui/src/components/text.rs",
+    "crates/pi-tui/src/components/truncated_text.rs",
+    "crates/pi-tui/src/components/util.rs",
+    "crates/pi-tui/src/editor_support/autocomplete.rs",
+    "crates/pi-tui/src/editor_support/history.rs",
+    "crates/pi-tui/src/editor_support/kill_ring.rs",
+    "crates/pi-tui/src/editor_support/mod.rs",
+    "crates/pi-tui/src/editor_support/undo.rs",
+    "crates/pi-tui/src/editor_support/word_nav.rs",
+    "crates/pi-tui/src/editor_support/wrap.rs",
+    "crates/pi-tui/src/focus.rs",
+    "crates/pi-tui/src/frame.rs",
+    "crates/pi-tui/src/fuzzy.rs",
+    "crates/pi-tui/src/image.rs",
+    "crates/pi-tui/src/keybindings.rs",
+    "crates/pi-tui/src/keys.rs",
+    "crates/pi-tui/src/layout.rs",
+    "crates/pi-tui/src/lib.rs",
+    "crates/pi-tui/src/link.rs",
+    "crates/pi-tui/src/overlay.rs",
+    "crates/pi-tui/src/terminal/backend.rs",
+    "crates/pi-tui/src/terminal/caps.rs",
+    "crates/pi-tui/src/terminal/guard.rs",
+    "crates/pi-tui/src/terminal/input.rs",
+    "crates/pi-tui/src/terminal/mod.rs",
+    "crates/pi-tui/src/terminal/probe.rs",
+    "crates/pi-tui/src/terminal/sink.rs",
+    "crates/pi-tui/src/terminal/writer.rs",
+    "crates/pi-tui/src/text/ansi.rs",
+    "crates/pi-tui/src/text/mod.rs",
+    "crates/pi-tui/src/text/slice.rs",
+    "crates/pi-tui/src/text/tests.rs",
+    "crates/pi-tui/src/text/width.rs",
+    "crates/pi-tui/src/text/wrap.rs",
+    "crates/pi-tui/tests/pty_no_flicker.rs",
+    "crates/pi/Cargo.toml",
+    "crates/pi/assets/export-html/template.css",
+    "crates/pi/assets/export-html/template.html",
+    "crates/pi/assets/export-html/template.js",
+    "crates/pi/assets/export-html/vendor/dark.json",
+    "crates/pi/assets/export-html/vendor/highlight.min.js",
+    "crates/pi/assets/export-html/vendor/light.json",
+    "crates/pi/assets/export-html/vendor/marked.min.js",
+    "crates/pi/src/cli/args.rs",
+    "crates/pi/src/cli/bootstrap.rs",
+    "crates/pi/src/cli/entry.rs",
+    "crates/pi/src/cli/help.rs",
+    "crates/pi/src/cli/mod.rs",
+    "crates/pi/src/cli/package_manager_cli.rs",
+    "crates/pi/src/core/agent_session/bash.rs",
+    "crates/pi/src/core/agent_session/compaction.rs",
+    "crates/pi/src/core/agent_session/events.rs",
+    "crates/pi/src/core/agent_session/extension.rs",
+    "crates/pi/src/core/agent_session/extension_runner.rs",
+    "crates/pi/src/core/agent_session/mod.rs",
+    "crates/pi/src/core/agent_session/model.rs",
+    "crates/pi/src/core/agent_session/persistence.rs",
+    "crates/pi/src/core/agent_session/prompt.rs",
+    "crates/pi/src/core/agent_session/retry.rs",
+    "crates/pi/src/core/agent_session/stats.rs",
+    "crates/pi/src/core/agent_session/subscribe.rs",
+    "crates/pi/src/core/agent_session/tools.rs",
+    "crates/pi/src/core/agent_session/tree.rs",
+    "crates/pi/src/core/agent_session_runtime.rs",
+    "crates/pi/src/core/agent_session_services.rs",
+    "crates/pi/src/core/compaction/branch.rs",
+    "crates/pi/src/core/compaction/mod.rs",
+    "crates/pi/src/core/compaction/utils.rs",
+    "crates/pi/src/core/config.rs",
+    "crates/pi/src/core/config_value.rs",
+    "crates/pi/src/core/experimental.rs",
+    "crates/pi/src/core/export_html/ansi_to_html.rs",
+    "crates/pi/src/core/export_html/mod.rs",
+    "crates/pi/src/core/export_html/session_data.rs",
+    "crates/pi/src/core/extension_host.rs",
+    "crates/pi/src/core/extension_host/tests.rs",
+    "crates/pi/src/core/lockfile.rs",
+    "crates/pi/src/core/messages.rs",
+    "crates/pi/src/core/migrations.rs",
+    "crates/pi/src/core/mod.rs",
+    "crates/pi/src/core/model_resolver.rs",
+    "crates/pi/src/core/model_runtime.rs",
+    "crates/pi/src/core/output_guard.rs",
+    "crates/pi/src/core/package_manager.rs",
+    "crates/pi/src/core/package_manager/tests.rs",
+    "crates/pi/src/core/platform/clipboard.rs",
+    "crates/pi/src/core/platform/command.rs",
+    "crates/pi/src/core/platform/debug_dump.rs",
+    "crates/pi/src/core/platform/external_editor.rs",
+    "crates/pi/src/core/platform/first_run.rs",
+    "crates/pi/src/core/platform/image.rs",
+    "crates/pi/src/core/platform/mod.rs",
+    "crates/pi/src/core/platform/open_browser.rs",
+    "crates/pi/src/core/platform/release_packaging.rs",
+    "crates/pi/src/core/resources/diagnostics.rs",
+    "crates/pi/src/core/resources/discovery.rs",
+    "crates/pi/src/core/resources/frontmatter.rs",
+    "crates/pi/src/core/resources/mod.rs",
+    "crates/pi/src/core/resources/prompts.rs",
+    "crates/pi/src/core/resources/skills.rs",
+    "crates/pi/src/core/resources/slash.rs",
+    "crates/pi/src/core/resources/source_info.rs",
+    "crates/pi/src/core/resources/themes.rs",
+    "crates/pi/src/core/session_transfer.rs",
+    "crates/pi/src/core/sessions/context.rs",
+    "crates/pi/src/core/sessions/cwd.rs",
+    "crates/pi/src/core/sessions/entries.rs",
+    "crates/pi/src/core/sessions/list.rs",
+    "crates/pi/src/core/sessions/mod.rs",
+    "crates/pi/src/core/settings.rs",
+    "crates/pi/src/core/share.rs",
+    "crates/pi/src/core/system_prompt.rs",
+    "crates/pi/src/core/tools/bash.rs",
+    "crates/pi/src/core/tools/edit.rs",
+    "crates/pi/src/core/tools/edit_diff.rs",
+    "crates/pi/src/core/tools/find.rs",
+    "crates/pi/src/core/tools/grep.rs",
+    "crates/pi/src/core/tools/ls.rs",
+    "crates/pi/src/core/tools/mod.rs",
+    "crates/pi/src/core/tools/mutation_queue.rs",
+    "crates/pi/src/core/tools/output_accumulator.rs",
+    "crates/pi/src/core/tools/path_utils.rs",
+    "crates/pi/src/core/tools/read.rs",
+    "crates/pi/src/core/tools/truncate.rs",
+    "crates/pi/src/core/tools/write.rs",
+    "crates/pi/src/core/trust.rs",
+    "crates/pi/src/core/update/changelog.rs",
+    "crates/pi/src/core/update/deprecation.rs",
+    "crates/pi/src/core/update/mod.rs",
+    "crates/pi/src/core/update/self_update.rs",
+    "crates/pi/src/core/update/user_agent.rs",
+    "crates/pi/src/core/update/version_check.rs",
+    "crates/pi/src/core/update/windows_quarantine.rs",
+    "crates/pi/src/lib.rs",
+    "crates/pi/src/main.rs",
+    "crates/pi/src/modes/interactive/footer.rs",
+    "crates/pi/src/modes/interactive/header.rs",
+    "crates/pi/src/modes/interactive/input.rs",
+    "crates/pi/src/modes/interactive/messages.rs",
+    "crates/pi/src/modes/interactive/mod.rs",
+    "crates/pi/src/modes/interactive/progress.rs",
+    "crates/pi/src/modes/interactive/runtime.rs",
+    "crates/pi/src/modes/interactive/selectors.rs",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__bash_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__compact_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__custom_branch_skill_messages.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__empty_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__error_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__loading_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__queue_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__retry_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__streaming_state_widths.snap",
+    "crates/pi/src/modes/interactive/snapshots/pi__modes__interactive__tests__user_assistant_messages.snap",
+    "crates/pi/src/modes/interactive/startup.rs",
+    "crates/pi/src/modes/interactive/state.rs",
+    "crates/pi/src/modes/interactive/status.rs",
+    "crates/pi/src/modes/interactive/tests.rs",
+    "crates/pi/src/modes/interactive/theme.rs",
+    "crates/pi/src/modes/interactive/tool_renderer.rs",
+    "crates/pi/src/modes/interactive/view.rs",
+    "crates/pi/src/modes/mod.rs",
+    "crates/pi/src/modes/print/input.rs",
+    "crates/pi/src/modes/print/json.rs",
+    "crates/pi/src/modes/print/mod.rs",
+    "crates/pi/src/modes/print/text.rs",
+    "crates/pi/src/modes/rpc/extension_ui.rs",
+    "crates/pi/src/modes/rpc/jsonl.rs",
+    "crates/pi/src/modes/rpc/mod.rs",
+    "crates/pi/src/modes/rpc/mode_host.rs",
+    "crates/pi/src/modes/rpc/server.rs",
+    "crates/pi/src/modes/rpc/types.rs",
+    "crates/pi/src/modes/run.rs",
+    "deny.toml",
+    "package.json",
+    "packages/extension-host/bun.lock",
+    "packages/extension-host/bunfig.toml",
+    "packages/extension-host/fixtures/extensions/all-events.ts",
+    "packages/extension-host/fixtures/extensions/crash.ts",
+    "packages/extension-host/fixtures/extensions/hooks.ts",
+    "packages/extension-host/fixtures/extensions/hostile.ts",
+    "packages/extension-host/fixtures/extensions/idle.ts",
+    "packages/extension-host/fixtures/extensions/provider-stream.ts",
+    "packages/extension-host/fixtures/extensions/terminal-input-fast.ts",
+    "packages/extension-host/fixtures/extensions/terminal-input-slow.ts",
+    "packages/extension-host/fixtures/extensions/tool-progress.ts",
+    "packages/extension-host/fixtures/extensions/tool.ts",
+    "packages/extension-host/fixtures/extensions/widget-active.ts",
+    "packages/extension-host/fixtures/runtime-import.ts",
+    "packages/extension-host/package.json",
+    "packages/extension-host/src/host.ts",
+    "packages/extension-host/src/index.ts",
+    "packages/extension-host/src/main.ts",
+    "packages/extension-host/src/protocol.ts",
+    "packages/extension-host/src/refs.d.ts",
+    "packages/extension-host/src/sanitize.ts",
+    "packages/extension-host/src/version.ts",
+    "packages/extension-host/src/virtual-modules.ts",
+    "packages/extension-host/tests/acceptance.test.ts",
+    "packages/extension-host/tests/host.test.ts",
+    "packages/extension-host/tests/sanitize.test.ts",
+    "packages/extension-host/tests/scaling.test.ts",
+    "packages/extension-host/tsconfig.build.json",
+    "packages/extension-host/tsconfig.check.json",
+    "packages/extension-host/tsconfig.json",
+    "packages/pi-tui-protocol/dist/client.d.ts",
+    "packages/pi-tui-protocol/dist/client.d.ts.map",
+    "packages/pi-tui-protocol/dist/client.js",
+    "packages/pi-tui-protocol/dist/client.js.map",
+    "packages/pi-tui-protocol/dist/codec.d.ts",
+    "packages/pi-tui-protocol/dist/codec.d.ts.map",
+    "packages/pi-tui-protocol/dist/codec.js",
+    "packages/pi-tui-protocol/dist/codec.js.map",
+    "packages/pi-tui-protocol/dist/index.d.ts",
+    "packages/pi-tui-protocol/dist/index.d.ts.map",
+    "packages/pi-tui-protocol/dist/index.js",
+    "packages/pi-tui-protocol/dist/index.js.map",
+    "packages/pi-tui-protocol/dist/types.d.ts",
+    "packages/pi-tui-protocol/dist/types.d.ts.map",
+    "packages/pi-tui-protocol/dist/types.js",
+    "packages/pi-tui-protocol/dist/types.js.map",
+    "packages/pi-tui-protocol/package.json",
+    "packages/pi-tui-protocol/src/client.ts",
+    "packages/pi-tui-protocol/src/codec.ts",
+    "packages/pi-tui-protocol/src/index.ts",
+    "packages/pi-tui-protocol/src/types.ts",
+    "packages/pi-tui-protocol/tests/client.test.ts",
+    "packages/pi-tui-protocol/tests/codec.test.ts",
+    "packages/pi-tui-protocol/tests/fixtures/frames.jsonl",
+    "packages/pi-tui-protocol/tsconfig.build.json",
+    "packages/pi-tui-protocol/tsconfig.json",
+    "scripts/bench-extension-scaling.ts",
+    "scripts/build-extension-host.ts",
+    "scripts/generate-builtin-models.ts",
+    "scripts/generate-session-fixtures.ts",
+    "scripts/generate-tool-schemas.ts",
+    "scripts/package-release.ts",
+    "scripts/release/archive.ts",
+    "scripts/release/args.ts",
+    "scripts/release/host.ts",
+    "scripts/release/runner.ts",
+    "scripts/release/stage.ts",
+    "scripts/release/targets.ts",
+    "scripts/tests/archive.test.ts",
+    "scripts/tests/args.test.ts",
+    "scripts/tests/cli-dry-run.test.ts",
+    "scripts/tests/host.test.ts",
+    "scripts/tests/package-release.test.ts",
+    "scripts/tests/runner.test.ts",
+    "scripts/tests/stage.test.ts",
+    "scripts/tests/targets.test.ts",
+    "scripts/tsconfig.json",
+    "scripts/verification/e2e-smoke.ts",
+    "scripts/verification/extension.ts",
+    "scripts/verification/foundation.test.ts",
+    "scripts/verification/performance.ts",
+    "scripts/verification/pty.ts"
+  ],
+  "reviewers": [
+    "code-quality",
+    "security",
+    "performance",
+    "test-quality",
+    "architecture",
+    "database",
+    "api",
+    "frontend",
+    "backend",
+    "devops"
+  ],
+  "counts": {
+    "critical": 5,
+    "high": 52,
+    "medium": 56,
+    "low": 5
+  },
+  "openAtOrAboveFloor": 98,
+  "belowFloor": 5,
+  "findingsHash": "6510588ed6d8bffdb0cca44146ce403629e786857aa20b939c46656936cd3575",
+  "fixBatches": [
+    {
+      "name": "agent-core",
+      "files": [
+        "crates/pi-agent/src/agent.rs",
+        "crates/pi-agent/src/bus.rs",
+        "crates/pi-agent/src/lib.rs",
+        "crates/pi-agent/src/run.rs",
+        "crates/pi-agent/src/schedule.rs",
+        "crates/pi-agent/src/tool.rs"
+      ],
+      "itemIds": [
+        "performance:crates/pi-agent/src/bus.rs:145:AgentEventSink::subscribe creates unbounded mpsc channels; emit clones the full AgentEvent (MessageUpdate embeds large message + boxed event) into every live lossless sender under a mutex. A lagging session/RPC/interactive consumer never drops, so queue length and clone work grow without bound under streaming load.",
+        "performance:crates/pi-agent/src/run.rs:325:Every Text/Thinking/ToolCall delta builds AssistantMessageEvent with partial: self.snapshot() (full AssistantMessage clone). run.rs then clones partial twice more for context replace and AgentEvent::MessageUpdate, and also event.clone() so MessageUpdate carries two full message copies. Cost path: provider token \u2192 stream_state \u2192 drain/run \u2192 bus reduce/fan-out. Impact: O(T\u00b2) allocation and copy as the partial grows across T tokens, amplified by N subscribers.",
+        "test-quality:crates/pi-agent/src/run.rs:1642:Asserts only count(agent_end)==1, count(assistant MessageEnd)==1, and empty partial. Never asserts the final assistant stop_reason. Regression: A cancel-vs-provider-terminal race that mis-classifies the run as StopReason::Stop or Error (while still emitting exactly one end pair) passes. This is the core classification contract of commit a2a4371.",
+        "code-quality:crates/pi-agent/src/schedule.rs:403:collect_parallel_completions only awaits event_rx and never selects on the run CancellationToken. Tools that ignore cancel hang the batch and block agent_end/wait_for_idle. Separately, emit_source_ordered_results skips ParallelSlot::Pending: if a worker panics or the channel closes before Done, those tool_use calls emit no tool_result, so the next LLM turn sees unpaired tool calls.",
+        "test-quality:crates/pi-agent/src/schedule.rs:1276:IDs-only tautology: after cancelling in the c1 before-hook, the test asserts only that result ids are [c1,c2,c3]. It never asserts is_error or the result content, and never checks RecordingTool.executed. Regression: If execute_tool_calls ignored the cancel token and ran all three tools to success, ids would still be c1,c2,c3 and the test stays green \u2014 the exact regression commit a2a4371 (preserve cancellation result contracts) was meant to prevent.",
+        "test-quality:crates/pi-agent/src/agent.rs:1047:Discards the prompt Result (`let _ = agent.prompt(...)`). Also, no test covers the documented contract that abort() cancels only the token and does NOT clear steer/follow-up queues (agent.rs:364-370); only reset_clears_transcript_and_queues tests the clearing side. Regression: Cancelled run bubbling up as Err to callers/UI (double error reporting) passes; abort() accidentally clearing queues (confusion with reset) passes.",
+        "test-quality:crates/pi-agent/src/agent.rs:1056:abort_emits_single_aborted_terminal polls `while !is_streaming && waited < 200` but does assert afterwards (good); however cancel_plus_provider_terminal... (run.rs:1671-1679) breaks out of `for _ in 0..100` when delivered < 1 and proceeds to cancel anyway with no failure if the provider never delivered. Regression: If the provider never delivers (harness deadlock/regression), the cancel still fires, the loop likely ends via hanging provider semantics, and the count-based assertions can still pass \u2014 masking the hang the test was built to race against.",
+        "test-quality:crates/pi-agent/src/run.rs:1439:Name overclaims: only the Error branch (no cancel) is exercised. The Aborted branch of synthesize_stream_failure (run.rs:413-417, cancel.is_cancelled() -> StopReason::Aborted) has no test. Regression: A transport failure concurrent with user cancel being classified as Error instead of Aborted (wrong UI semantics for user-initiated abort) passes silently.",
+        "performance:crates/pi-agent/src/schedule.rs:328:execute_tool_calls_parallel spawns one tokio task per tool with no concurrency limit, cloning the full AgentContext (entire transcript) and AssistantMessage per spawn. Partial ToolUpdates clone the ToolCall (including args map) on every progress callback over an unbounded channel. Large multi-tool turns can explode task count, memory, and clone traffic."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-agent",
+          "result": "post-commit all-target check + 9 bus + 17 schedule + 20 run + 19 agent tests passed (artifact://7028)"
+        }
+      ],
+      "guard": "Cancellation/panic emits one ordered result per tool; bounded subscriptions and clone work",
+      "verifier": "cargo test -p pi-agent",
+      "commit": "257de7e"
+    },
+    {
+      "name": "ai-store-config",
+      "files": [
+        "Cargo.lock",
+        "crates/pi-ai/src/auth/config_value.rs",
+        "crates/pi-ai/src/auth/file_store.rs",
+        "crates/pi/src/core/migrations.rs"
+      ],
+      "itemIds": [
+        "database:crates/pi-ai/src/auth/file_store.rs:133:FileLockBackend::ensure_data_file checks path.exists() then, without holding the exclusive lock, atomically replaces the data file with \"{}\". migrate_auth_to_auth_json_in also writes auth.json without that lock (and any other process can finish a real write between the exists check and the empty seed). If a concurrent FileCredentialStore/FileModelsStore constructor seeds after a non-empty write lands, credentials or catalog bytes are permanently replaced by empty JSON. Trigger: two pi processes starting against the same agent dir while auth.json is being created/migrated.",
+        "code-quality:crates/pi-ai/src/auth/config_value.rs:281:execute_command_uncached spawns a thread, waits 10s on mpsc, then unwrap_or_default on timeout without joining or killing the child. Hung `!command` auth config entries leave detached threads and shell processes until process exit.",
+        "backend:crates/pi-ai/src/auth/file_store.rs:362:FileCredentialStore::modify/delete call replace_cache_mutex before with_lock_async performs atomic_write. If atomic_write fails after the callback returns Some(serialized), the in-memory cache already holds the new credential map while disk retains the previous file. Trigger: disk full/permission error on atomic rename/write after a successful refresh/delete callback. Impact: subsequent get/list in-process return credentials that are not durable; restart or other processes see the old store\u2014auth/cache inconsistency."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-ai auth::config_value && cargo test -p pi-ai auth::file_store",
+          "result": "post-commit all-target check + 5 config command + 10 file-store tests passed (artifact://7069); migration suite previously 11 passed"
+        }
+      ],
+      "guard": "Concurrent seed cannot clobber; cache changes only after durable write; command child reaped",
+      "verifier": "cargo test -p pi-ai auth::config_value && cargo test -p pi-ai auth::file_store",
+      "commit": "a5a1b27"
+    },
+    {
+      "name": "oauth",
+      "files": [
+        "crates/pi-ai/src/auth/error.rs",
+        "crates/pi-ai/src/auth/oauth/anthropic.rs",
+        "crates/pi-ai/src/auth/oauth/github_copilot.rs",
+        "crates/pi-ai/src/auth/oauth/openai_codex.rs",
+        "crates/pi-ai/src/auth/oauth/radius.rs",
+        "crates/pi-ai/src/auth/resolve.rs",
+        "crates/pi/src/core/model_runtime.rs"
+      ],
+      "itemIds": [
+        "security:crates/pi-ai/src/auth/oauth/github_copilot.rs:592:get_base_url_from_token trusts the proxy-ep claim inside the Copilot token with no host allowlist, private-IP block, or scheme validation beyond prepending https://. get_github_copilot_base_url then uses that base for /models and /models/{id}/policy requests with Authorization: Bearer <copilot token>, so a malicious or compromised token issuer can redirect credentialed client traffic (SSRF/exfil) to arbitrary hosts including link-local metadata endpoints.",
+        "security:crates/pi-ai/src/auth/oauth/openai_codex.rs:883:OpenAI Codex read_token_response, on HTTP 2xx responses missing required fields, formats AuthError with the full response.body. That JSON commonly includes access_token and refresh_token when expires_in is absent or mistyped. AuthError::Message is Displayed verbatim, so tokens can leak into TUI errors, logs, diagnostics, or support dumps during login/refresh parse failures.",
+        "api:crates/pi-ai/src/auth/oauth/openai_codex.rs:886:openai_codex read_token_response, after HTTP ok, on missing access_token/refresh_token/expires_in formats the entire response.body into AuthError. Partial success bodies containing bearer/refresh tokens can leak into user-facing errors and ModelsError via resolve.",
+        "backend:crates/pi-ai/src/auth/resolve.rs:208:resolve_stored_oauth always calls oauth.refresh(&current_oauth, None) inside CredentialStore::modify, ignoring any session/request cancellation token, and maps AuthError::Cancelled into ModelsErrorCode::Oauth text. Trigger: user aborts model resolution while a token refresh is in flight. Impact: refresh cannot be cancelled; cancel becomes a generic OAuth failure, blocking retry/abort distinction and leaving long HTTP refresh running under the file lock.",
+        "test-quality:crates/pi-ai/src/auth/oauth/anthropic.rs:257:Both providers deliberately pass the PARENT signal into exchange_authorization_code after cancelling only the child prompt token, but no test cancels mid-exchange after a code was obtained. Such a test is also the only thing that would catch accidentally passing the already-cancelled child token into the exchange (which would make every settled login fail with Cancelled). Regression: Hung token exchange after successful callback cannot be aborted by the user; or child/parent token mix-up making login always fail post-settle.",
+        "test-quality:crates/pi-ai/src/auth/oauth/openai_codex.rs:1779:Happy-path only. No pre-cancel or mid-poll cancel variant for the Codex device flow, unlike github_copilot.rs:1375 (cancel_during_device_poll_returns_cancelled) and the xai/radius pre-cancel tests. Regression: Cancel ignored while poll_device_auth hangs: user abort leaves the device poll running until the server times out (commit bdc705c's cancellation contract only verified on the browser path).",
+        "security:crates/pi-ai/src/auth/oauth/radius.rs:281:Radius login_with_device_code notifies AuthEvent::DeviceCode with verification_uri taken verbatim from the gateway device-authorization response (or verification_endpoint) with no https/host checks. xAI already rejects non-https verification URIs because the URI is intended for browser open. A malicious or MITM'd Radius gateway can supply a phishing or non-https URI for user navigation during device login.",
+        "api:crates/pi-ai/src/auth/resolve.rs:206:resolve_stored_oauth calls oauth_for_refresh.refresh(&current_oauth, None) under CredentialStore::modify. Token HTTP can run up to the 30s OAuth timeout and cannot be aborted by session/auth cancel, despite OAuthAuth::refresh accepting a signal and other OAuth paths honoring cancellation."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-ai auth::oauth && cargo test -p pi-ai auth::resolve",
+          "result": "post-commit pi-ai all-target check + 95 OAuth + 6 resolve tests passed (artifact://6969)"
+        }
+      ],
+      "guard": "No token leakage/unsafe destination; cancellation reaches device, exchange and refresh",
+      "verifier": "cargo test -p pi-ai auth::oauth && cargo test -p pi-ai auth::resolve",
+      "commit": "23fe5f6"
+    },
+    {
+      "name": "provider-responses",
+      "files": [
+        "crates/pi-ai/src/providers/openai_responses.rs",
+        "crates/pi-ai/src/providers/shared/responses.rs"
+      ],
+      "itemIds": [
+        "backend:crates/pi-ai/src/providers/shared/responses.rs:964:On response.completed/incomplete (and Codex-rewritten completed frames that keep status failed|cancelled), finalize_response maps status via map_stop_reason to StopReason::Error, but done_reason collapses Error into DoneReason::Stop and AssistantState::finish overwrites stop_reason to Stop and clears error_message. Upstream TypeScript maps failed/cancelled to error and throws before emitting done. Trigger: provider returns completed/incomplete with status failed or cancelled (Codex path explicitly preserves those statuses). Impact: stream terminates as successful Done; callers may commit failed/partial assistant content and skip retry/error handling.",
+        "performance:crates/pi-ai/src/providers/shared/responses.rs:574:ResponsesStreamProcessor::tool_delta appends each argument fragment then calls parse_streaming_json(partial_json) on the entire accumulated string. parse_partial_object copies the candidate and retries from_str after each pop, so cost per fragment is O(n)\u2013O(n\u00b2) in partial length; large tool args stream into multi-megabyte reparses. Same pattern exists in openai_completions and anthropic input_json_delta.",
+        "api:crates/pi-ai/src/providers/openai_responses.rs:84:OpenAiResponses always formats OpenAI API error: {failure.message} even when ErrorReason::Aborted. Completions preserves raw abort text. Cancelled streams surface as OpenAI API error: request cancelled, diverging cancel detection and OpenAI-family adapter contracts."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-ai providers::shared::responses",
+          "result": "post-commit 8 shared + 5 adapter + 2 conformance tests passed (artifact://6942)"
+        }
+      ],
+      "guard": "failed/cancelled emits Error and never Done; argument stream work is amortized",
+      "verifier": "cargo test -p pi-ai providers::shared::responses",
+      "commit": "2820ae9"
+    },
+    {
+      "name": "extension-ui",
+      "files": [
+        "crates/pi-ext/src/adapters.rs",
+        "crates/pi-ext/src/client.rs",
+        "crates/pi/src/core/extension_host.rs",
+        "crates/pi/src/core/extension_host/tests.rs",
+        "crates/pi/src/core/platform/external_editor.rs",
+        "crates/pi/src/modes/interactive/runtime.rs",
+        "crates/pi/src/modes/interactive/theme.rs",
+        "crates/pi/src/modes/rpc/server.rs",
+        "packages/extension-host/src/host.ts",
+        "packages/extension-host/tests/acceptance.test.ts"
+      ],
+      "itemIds": [
+        "architecture:crates/pi/src/core/extension_host.rs:1279:Violated invariant: every Method-typed host\u2192Rust control frame reaches a consumer dispatcher (no silent drop). Host dialog()/notify produce select/confirm/input/editor/notify; HostClient maps FrameKind::Req and unmatched events to HostEvent::Raw (client.rs:804-806,860-861); product pump drops Raw at extension_host.rs:1279-1281. Extension UI dialogs hang until timeout and notifies never surface.",
+        "code-quality:crates/pi-ext/src/client.rs:352:HostClient::request_raw and StreamHandle::finish on timeout only remove_pending and return Timeout. Docs claim cancel-on-timeout, but no tool.cancel/provider.cancel control frame is sent. Host-side tool/provider work continues after the Rust caller already failed, leaking in-flight host work and risking late responses on recycled ids.",
+        "backend:crates/pi-ext/src/client.rs:361:HostClient::request_raw timeout path only remove_pending and returns Timeout; StreamHandle::finish does the same. No tool.cancel/provider.cancel control frame is sent, so the TS host keeps running (tool.execute has no local timeout and only aborts on cancel events). Trigger: hook/tool/provider exceeds DEFAULT_CALL_TIMEOUT. Impact: orphaned host side effects continue; agent may retry and duplicate execution; in-flight host work is unbounded after Rust abandons correlation.",
+        "code-quality:crates/pi-ext/src/client.rs:574:StreamHandle::finish mirrors request_raw: on deadline it remove_pending and returns Timeout without invoking cancel(control_method). ExtensionAgentTool/ExtensionProvider only send cancel when the CancellationToken fires, not when finish times out after DEFAULT_CALL_TIMEOUT, so hung extension tools keep running after the agent already errored.",
+        "api:crates/pi-ext/src/client.rs:798:Host UI context sends select/confirm/input/editor as correlated kind=req frames (packages/extension-host/src/host.ts dialog helper). Rust HostClient maps FrameKind::Req to HostEvent::Raw, and HostExtensionRunner's event pump silently ignores Raw. Dialogs therefore hang until the 30s request timeout with no UI surface and no correlated res/error.",
+        "api:crates/pi-ext/src/client.rs:809:Host createUIContext.notify emits unsolicited event method=notify id=0. forward_event has no Notify branch, so the frame becomes HostEvent::Raw and is ignored by the extension_host pump. Wire types define Notify/NotifyRequest, but the consumer never delivers notifications to interactive or RPC UI.",
+        "architecture:crates/pi/src/core/extension_host.rs:60:Violated invariant: every produced open method has a host dispatcher. Product defines TOOL_RENDER_HTML_METHOD and render_extension_tool_html requests tool.renderHtml; packages/extension-host has no tool.renderHtml case. Requests fail as unknown-method and export HTML always yields None on a live host.",
+        "frontend:crates/pi/src/modes/interactive/runtime.rs:686:ViewState.widgets_above/below are composed, but InteractiveRuntime never subscribes to HostExtensionRunner::subscribe_slot / HostEvent::UiSlot nor projects disposeSlot. Extension host fixtures push multi-line widgets on session_start, yet the live TUI never shows or updates them\u2014widget lifecycle is severed at the interactive boundary.",
+        "frontend:crates/pi/src/modes/interactive/runtime.rs:1062:handle_ui_event routes keys only through InteractiveRoot then InputMapper and never sends Method::TerminalInput to the extension host. Protocol and host implement the 4ms deadline with consume/rewrite and fail-open, but interactive input never exercises them, so onTerminalInput cannot rewrite or consume keystrokes in TUI mode.",
+        "frontend:crates/pi/src/modes/interactive/runtime.rs:1168:ViewAction::ExternalEditor is grouped with None/Consumed and returns ActionOutcome::None. input.rs maps Ctrl+G and the header documents it, and core/platform/external_editor.rs implements a cancel-safe editor flow, but the interactive runtime never pauses the TUI or writes edited text back. Ctrl+G is a complete no-op for users.",
+        "frontend:crates/pi/src/modes/interactive/runtime.rs:1171:ToggleToolExpand and ToggleThinking only force ActionOutcome::Repaint. ToolState.expanded is always false on project_tool_start and never toggled; AssistantMessageView.hide_thinking is always constructed false. Users cannot expand tool output or hide thinking despite keybindings and tests that only assert the mapper emits these actions.",
+        "performance:crates/pi/src/modes/interactive/runtime.rs:1897:paint_frame always InteractiveRoot::build \u2192 compose \u2192 build_chat walks every message and Markdown::new(text) per text block. Markdown width/parse caches die with the component each frame (~16ms coalesce or every keystroke). Long sessions re-parse and re-wrap the full transcript on every streaming paint; cost scales with message count \u00d7 content size \u00d7 paint rate.",
+        "test-quality:crates/pi/src/modes/interactive/runtime.rs:4469:Wiring tautology: the test sets emergency=AtomicBool::new(true) BEFORE install_product_panic_emergency_hook, so the installed global hook can never fire; it then calls the returned restore closure directly and asserts its bytes. The install call inside run_interactive_mode (runtime.rs:3396-3403) is never exercised. Regression: Deleting the install_product_panic_emergency_hook(...) call from run_interactive_mode \u2014 i.e. shipping commit 4e845e3's product wiring removed \u2014 leaves this test green; only the fixture PTY test would (weakly, see TQ-04) notice.",
+        "api:packages/extension-host/src/host.ts:348:Rust export path request_raw(TOOL_RENDER_HTML_METHOD) expects a host handler, but packages/extension-host handleRequest has no tool.renderHtml case and respondErrors with unknown method. Callers then isolate to Ok(None), so extension HTML export is a permanent silent no-op outside mocked tests.",
+        "architecture:crates/pi-ext/src/adapters.rs:146:Violated invariant: adapter honors host schema RPCs that the host implements. ExtensionAgentTool prepare_arguments/validate_arguments (adapters.rs:146-160) pass-through clone raw args while host.ts implements tool.prepare/tool.validate. Schema authority lives in TypeScript but is never invoked; malformed args are deferred to execute only.",
+        "test-quality:crates/pi/src/core/extension_host.rs:1170:Production reuses self.inner.project_trusted when spawning the replacement host, but extension_host/tests.rs contains zero references to restart_and_rewire or reload+trust. Regression: A restart dropping trust to the start_with_cwd default of false mid-session (extensions suddenly see untrusted context after reload) is uncaught.",
+        "code-quality:crates/pi/src/core/extension_host.rs:1288:spawn_event_pump on HostEvent::ProtocolError sets disabled and publishes an error but falls through the loop instead of breaking (unlike Eof). Post-fatal host traffic can keep flowing into a runner already marked disabled, creating inconsistent lifecycle state.",
+        "test-quality:crates/pi/src/core/extension_host/tests.rs:858:Asserts only the true case (payload[\"projectTrusted\"] == true). No false-case test exists anywhere; connect/start_with_cwd silently default to false (extension_host.rs:1190). Regression: Serialization hardcoding projectTrusted:true (or a true/false swap) passes; an untrusted project's extensions would observe trusted context.",
+        "frontend:crates/pi/src/modes/interactive/theme.rs:268:ResolvedTheme::from_slots marks any Rgb equal to Rgb::none() (0,0,0) as empty reset. ThemeJson::resolve_owned uses from_slots, so explicit #000000 becomes ESC[39m instead of black. Built-in light() bypasses via fg_empty:0, but JSON-loaded/custom themes\u2014including reloading light.json\u2014lose intentional black slots.",
+        "frontend:crates/pi/src/modes/interactive/theme.rs:975:ColorValue::Indexed(i) resolves to Rgb(i,i,i) grayscale, then emitters push truecolor or downsampled 256-color. Reference themes emit CSI 38;5;{index}m / 48;5;{index}m for numeric palette indices, so integer theme colors (e.g. 196 red) paint wrong.",
+        "code-quality:packages/extension-host/src/host.ts:1064:handleToolValidate looks up the tool definition then voids it and responds with the original args. Invalid extension-tool arguments are not schema-checked on the host validate path, so prepare/execute receive unvalidated payloads despite a dedicated RPC.",
+        "test-quality:packages/extension-host/tests/acceptance.test.ts:514:Bare `await runner.emit({ type: event })` with zero assertions \u2014 no result check, no handler-invocation check, no cancel/order assertion. Regression: emit resolving with an error result, dropping handlers silently, or merging cancel state incorrectly all pass."
+      ],
+      "status": "pending",
+      "attempts": 0,
+      "verification": [],
+      "guard": "Typed host UI request roundtrip with correlation; no raw drop; UI/runtime behavior wired",
+      "verifier": "cargo test -p pi core::extension_host && cargo test -p pi-ext && bun test packages/extension-host"
+    },
+    {
+      "name": "release",
+      "files": [
+        "crates/pi-ext/src/host.rs",
+        "crates/pi/src/core/platform/release_packaging.rs",
+        "scripts/package-release.ts",
+        "scripts/release/runner.ts",
+        "scripts/tests/cli-dry-run.test.ts",
+        "scripts/tests/package-release.test.ts"
+      ],
+      "itemIds": [
+        "devops:scripts/package-release.ts:123:When buildHost falls back to runtime-bundle, package-release sets bunRuntimePath to join(stagingRoot, plan.bunRuntimeName) without downloading or copying an official Bun binary unless --dry-run. assembleRelease then fs.readFile(s) that path, so non-dry-run fallback fails with missing-file errors instead of producing a shippable archive; comments claim the caller supplies the runtime, but the orchestrator never does.",
+        "devops:crates/pi-ext/src/host.rs:117:scripts/release/host.ts documents that the Rust binary should resolve PI_EXTENSION_HOST, then sibling pi-extension-host, then sibling bun[.exe] pi-extension-host.js. pi-ext host::default_asset_path/resolve_with only ever return the single sibling pi-extension-host[.exe] program with empty args\u2014no bun+js fallback. Archives produced on the runtime-bundle path therefore cannot start the extension host without manual PI_EXTENSION_HOST wiring.",
+        "devops:crates/pi/src/core/platform/release_packaging.rs:131:crates/pi/src/core/platform/release_packaging.rs plans compiled host as pi-host and fallback script as host.js with archive base pi-{version}-{triple}. The release scripts and pi-ext resolver ship/look for pi-extension-host[.exe] and pi-extension-host.js under pi-{os}-{arch}[-base]. Any consumer of the Rust planner (docs, future runner, tests asserting these names) disagrees with the actual packaging contract and product host resolution.",
+        "devops:scripts/package-release.ts:243:package-release unpackArchive always spawns unzip for zip archives. The release-verification matrix includes x86_64-pc-windows-msvc on windows-latest, where unzip is not a guaranteed PATH tool for node:child_process spawn. Windows packaging smoke can fail after a successful build/archive with a host-tool ENOENT, blocking the release job.",
+        "test-quality:scripts/tests/package-release.test.ts:32:The only smokeUnpacked test injects a perfect RecordingRunner and asserts call argv order. No test covers: missing pi throw (package-release.ts:284-286), pi --version nonzero throw (312-318), hello handshake failure throw (347-351), the hello stdin payload content (the mock never requires stdin), the dry-run branch (292-309), the runtime-bundle host-absent skip (325-330), or Windows .exe path joins. Regression: Release smoke (commit 7866bc5) can regress to accept a broken archive \u2014 non-running pi, garbage-hello host, handshake that sends no JSONL \u2014 with all unit tests green; failure would first appear on real release CI.",
+        "test-quality:scripts/package-release.ts:344:Smoke handshake accepts the host if the first stdout line substring-matches '\"method\":\"hello\"', '\"kind\":\"res\"', '\"protocolVersion\":1' \u2014 no JSON parse and no compatibilityVersion check, weaker than build-time isHelloAck (release/host.ts). No test pins the predicate's behavior on garbage input. Regression: A host ack with wrong compatibilityVersion, or a non-JSON line containing the substrings, passes smoke; conversely tightening the predicate later has no test safety net.",
+        "code-quality:scripts/release/runner.ts:78:SpawnRunner.run awaits child close with no deadline. cargo/host/smoke children that hang hold the release pipeline indefinitely; RunOptions has no timeout field and package-release smoke paths inherit this.",
+        "test-quality:scripts/tests/cli-dry-run.test.ts:29:Asserts only exitCode 0, stdout containing '=== Release Complete ===', and an Archive path prefix. Never stats the produced archive or .sha256, and never lists archive members. Regression: Packaging writing an empty/wrong-named archive, or omitting pi / host / release.json from entries, still prints the success banner and passes."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "bun test scripts && cargo test -p pi-ext host && cargo test -p pi release_packaging",
+          "result": "post-commit 34 Bun tests + TS check + 9 pi-ext + 14 pi release tests passed (artifacts://7085, artifact://7120)"
+        }
+      ],
+      "guard": "Forced compiled-host fallback packages and launches Bun+JS; portable archive smoke",
+      "verifier": "bun test scripts && cargo test -p pi-ext host && cargo test -p pi release_packaging",
+      "commit": "66cc9c2"
+    },
+    {
+      "name": "editor",
+      "files": [
+        "crates/pi-tui/src/components/editor/mod.rs",
+        "crates/pi-tui/src/components/editor/paste.rs",
+        "crates/pi-tui/src/components/editor/state.rs"
+      ],
+      "itemIds": [
+        "frontend:crates/pi-tui/src/components/editor/mod.rs:888:handle_backspace calls renumber_after_delete while the deleted marker is still in the line, then deletes [col-glen, col) using pre-renumber offsets. When a higher id earlier on the line shrinks (e.g. #10\to#9), the target span moves left and the delete removes the wrong bytes, corrupting markers/text.",
+        "frontend:crates/pi-tui/src/components/editor/mod.rs:1220:move_word_forwards passes is_atomic_segment=is_paste_marker with segment:None, so default_word_segments splits markers into '[', 'paste', '#', digits. is_atomic never sees a full marker; word-right and delete-word-forward step inside markers and can slice them. move_word_backwards falls through to the same split when markers are present.",
+        "frontend:crates/pi-tui/src/components/editor/mod.rs:416:push_undo_snapshot only clones EditorState (lines+cursor). pastes and paste_counter live outside the undo stack. Undo after a large paste removes marker text but leaves pastes populated; undo after marker delete can restore marker text without the matching id. Submit/get_expanded_text then expands incorrectly or leaves ghost paste storage.",
+        "frontend:crates/pi-tui/src/components/editor/mod.rs:512:navigate_history uses set_text_internal without canceling/updating autocomplete; cursor line-start/end, word motion, and page_scroll move the cursor without update_autocomplete. Only move_cursor refreshes an open picker, so Tab/confirm can apply_completion with an obsolete prefix against new text after history or word motion.",
+        "frontend:crates/pi-tui/src/components/editor/mod.rs:913:handle_forward_delete removes an atomic paste-marker grapheme via next_grapheme_len but never updates pastes/paste_counter. Marker text disappears while stored content and later ids remain, so expand/submit can inject orphaned pastes if a matching id reappears and counters drift from visible markers."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-tui components::editor",
+          "result": "post-commit 28 editor tests + pi-tui lib check passed (artifact://6983)"
+        }
+      ],
+      "guard": "Paste marker/map/counter/undo remain atomic across delete, movement, history",
+      "verifier": "cargo test -p pi-tui components::editor",
+      "commit": "49e3b37"
+    },
+    {
+      "name": "terminal",
+      "files": [
+        "crates/pi-tui/src/focus.rs",
+        "crates/pi-tui/src/overlay.rs",
+        "crates/pi-tui/src/terminal/guard.rs",
+        "crates/pi-tui/src/terminal/writer.rs",
+        "crates/pi-tui/src/text/ansi.rs",
+        "crates/pi-tui/tests/pty_no_flicker.rs"
+      ],
+      "itemIds": [
+        "frontend:crates/pi-tui/src/terminal/writer.rs:521:stage3_write builds a balanced CSI ? 2026 h...l buffer then write_all/flush with no cleanup on partial write or mid-write I/O error. If the open marker is delivered without the close, the terminal stays in synchronized-output mode and subsequent UI can appear frozen/blank until an emergency close.",
+        "frontend:crates/pi-tui/src/focus.rs:331:dispatch_to_focused returns EventResult::Ignored when filter_key drops a Release. TS handleInput returns early so the event is fully consumed at the TUI layer. Hosts that fall through on Ignored can deliver key-release to global handlers (double-Esc, Ctrl+C) while a focused component was meant to own the key stream.",
+        "frontend:crates/pi-tui/src/overlay.rs:217:hide_id retargets FocusManager.overlay_pre_focus but not remaining OverlayEntry.pre_focus fields. Nested show editor\to A\to B then hide(A) while B is focused leaves B.pre_focus=A; hide(B) then set_focus(Some(A)) on a removed id so keyboard dispatch has no live component. TS retargetOverlayPreFocus rewrites entry.preFocus on the stack.",
+        "test-quality:crates/pi-tui/src/terminal/guard.rs:287:No test panics under the installed hook. CAS-once semantics, restore-closure invocation, and previous-hook chaining are untested at unit level; GuardScript tests (319-349) exercise only a mock whose emergency_restore (records sync_close) diverges from the real mode-only TerminalGuard::emergency_restore (146-160), which itself has no production call site. Regression: Hook not chaining the previous hook, restore firing twice, or the CAS flag not shared with the guard all pass unit tests.",
+        "frontend:crates/pi-tui/src/text/ansi.rs:54:extract_ansi_code only completes CSI on finals m/G/K/H/J. Private-mode sequences such as CSI ? 25 h/l (cursor hide/show) and other finals (A/B/C/D/f/l/h) are treated as visible text, so visible_width/wrap_text_with_ansi inflate columns (e.g. ESC[?25lhello width 10 vs 5) and mis-align wrap/truncate/overlays for streamed ANSI content.",
+        "test-quality:crates/pi-tui/tests/pty_no_flicker.rs:75:OR-weak predicate: saw_cursor_show || saw_emergency_restore. For exit=\"panic\" the normal Drop-path cursor show (?25h) alone satisfies the assertion, and saw_emergency_restore only requires ?2026l plus ANY of ?25h/0m/<u \u2014 a partial emergency sequence passes. Regression: Removing the fixture's panic-hook install (pi_tui_pty_fixture.rs:295-304) \u2014 panic exit restored only by Drop \u2014 keeps the panic branch green; an emergency sequence missing mode pops or reset also passes."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi-tui terminal && cargo test -p pi-tui --test pty_no_flicker",
+          "result": "post-commit: 8+15+11+6+3 unit tests and 5 PTY tests passed (artifact://6829)"
+        }
+      ],
+      "guard": "Partial sync errors close mode; panic emits exact restore; ANSI/focus/overlay contracts",
+      "verifier": "cargo test -p pi-tui terminal && cargo test -p pi-tui --test pty_no_flicker",
+      "commit": "a04a0a1"
+    },
+    {
+      "name": "product-session",
+      "files": [
+        "crates/pi/src/cli/bootstrap.rs",
+        "crates/pi/src/cli/entry.rs",
+        "crates/pi/src/cli/package_manager_cli.rs",
+        "crates/pi/src/core/agent_session/compaction.rs",
+        "crates/pi/src/core/agent_session/events.rs",
+        "crates/pi/src/core/agent_session/extension.rs",
+        "crates/pi/src/core/agent_session/mod.rs",
+        "crates/pi/src/core/agent_session/model.rs",
+        "crates/pi/src/core/agent_session/retry.rs",
+        "crates/pi/src/core/agent_session/subscribe.rs",
+        "crates/pi/src/core/agent_session/tools.rs",
+        "crates/pi/src/core/agent_session_runtime.rs",
+        "crates/pi/src/core/agent_session_services.rs",
+        "crates/pi/src/core/config_value.rs",
+        "crates/pi/src/core/trust.rs",
+        "crates/pi/src/modes/print.rs",
+        "crates/pi/src/modes/rpc/mode_host.rs",
+        "crates/pi/src/modes/text.rs"
+      ],
+      "itemIds": [
+        "security:crates/pi/src/core/agent_session_services.rs:571:Production session construction always creates SettingsManager with SettingsManagerCreateOptions::default() (project_trusted: true) in create_service_foundation, create_runtime_services, and RealReplacementFactory, then discovers project extensions/settings and starts HostExtensionRunner with that flag. resolve_project_trusted / ProjectTrustStore are only exercised in unit tests; CLI project_trust_override is never passed. Opening a repo with .pi/extensions or project packages therefore executes untrusted local code and merges attacker-controlled project settings (e.g. npmCommand) without prompt or --no-approve.",
+        "code-quality:crates/pi/src/cli/entry.rs:900:RealPackageHandler::refresh_models always Ok(()) and update_self always Ok(false) with comments that wiring is deferred. Bootstrap routes `pi update` / `pi update models` / `pi update --self` through these handlers, so production CLI reports success or already-latest without performing the documented work.",
+        "security:crates/pi/src/cli/package_manager_cli.rs:669:package_manager_cli parses project_trust_override and preflight errors with \"Use --approve\", but only calls handler.is_project_trusted() and never reads the override. RealPackageHandler::is_project_trusted always builds SettingsManager with project_trusted(false) and returns that flag, so --approve cannot unblock local package writes and --no-approve cannot force-deny. Main Args::project_trust_override is likewise unused by create_runtime_services.",
+        "architecture:crates/pi/src/core/agent_session/compaction.rs:446:Violated invariant: each lifecycle hook fires once per occurrence. compact/run_auto_compaction call emit_session_event(CompactionStart) which already runner.emit's to extensions, then run_compaction_core again dispatches session_before_compact via another CompactionStart when handlers exist (compaction.rs:446-450). Extensions can double-cancel or observe duplicate starts.",
+        "api:crates/pi/src/core/agent_session/retry.rs:242:Providers emit status-first errorMessage strings such as OpenAI API error: 429: {body} and HTTP 429: {body}. is_retryable_assistant_error matches 500/502/503 and rate limit text but not 429. Upstream RETRYABLE_PROVIDER_ERROR_PATTERN includes 429; empty or generic 429 bodies therefore skip auto-retry.",
+        "architecture:crates/pi/src/core/agent_session/subscribe.rs:230:Violated invariant: one policy authority for retryability/context-overflow. will_retry_after_agent_end uses private is_retryable_assistant (subscribe.rs:230-256) that omits patterns in retry.rs is_retryable_assistant_error (\"internal error\", \"temporarily unavailable\", \"service_unavailable\") and does not share is_context_overflow. Public agent_end.willRetry can disagree with whether prepare_retry continues.",
+        "architecture:crates/pi/src/core/agent_session/tools.rs:241:Violated invariant: single owner of the live tool list for execution and prepare_next_turn. set_active_tools_by_name (tools.rs:241-246) updates Agent.state.tools and inner.active_tool_names but never SessionHooks.set_tools; prepare_next_turn_hook (extension_runner.rs:435-447) overwrites context.tools from the construction-time hooks snapshot whenever non-empty. After refresh_tool_registry or extension tool registration, the next turn can reinstall the stale tool set and drop newly registered tools.",
+        "architecture:crates/pi/src/core/agent_session_runtime.rs:621:Violated invariant: advertised extension lifecycle events are either fully dispatched with cancel semantics or not reported as having handlers. emit_before_switch/emit_before_fork (agent_session_runtime.rs:621-642) only check has_handlers and always return cancelled:false; emit_model_select is a no-op despite ALL_EVENT_TYPES listing model_select/session_before_*. Extensions cannot cancel switch/fork and never receive model_select.",
+        "architecture:crates/pi/src/cli/entry.rs:382:Violated invariant: product-owned types stay typed at product boundaries; no type-erasure for same-crate dependencies. cli/entry.rs:382-384 erases ModelRuntime into Arc<dyn Any + Send + Sync>; session/modes repeatedly downcast. Failed downcasts silently yield None auth/model paths.",
+        "test-quality:crates/pi/src/core/agent_session/extension.rs:1131:Tautology: calls session.report_extension_error(\"host crashed\") then asserts only !session.session_id().await.is_empty() \u2014 always true for a fresh session. The test cannot fail unless report_extension_error panics. Regression: Listener not invoked, listener panic propagating, or error swallowed into the wrong channel all pass.",
+        "architecture:crates/pi/src/core/agent_session/mod.rs:991:Violated invariant: runtime toggles that have a settings key update cache and persistence consistently. set_auto_retry_enabled writes inner + SettingsManager; set_auto_compaction_enabled only mutates the inner flag (mod.rs:991-994). Session toggle and disk settings diverge; restart reverts compaction policy while retry stays consistent.",
+        "performance:crates/pi/src/core/agent_session/subscribe.rs:103:process_agent_event clones each AgentEvent into a public AgentSessionEvent and, when message_update handlers exist, HostExtensionRunner::emit does serde_json::to_value of the full event (full AgentMessage + AssistantMessageEvent with another partial snapshot) and awaits the host RPC on the pump path. Per-token IPC JSON of growing messages multiplies extension latency and CPU whenever any extension subscribes to message_update.",
+        "backend:crates/pi/src/core/agent_session/subscribe.rs:182:will_retry_after_agent_end uses a weaker is_retryable_assistant that omits patterns prepare_retry/is_retryable_assistant_error accepts (e.g. internal error, temporarily unavailable, service_unavailable). Trigger: transient provider error matching only the stronger classifier. Impact: AgentEnd.willRetry can be false while the session still auto-retries (or the inverse on edge patterns), so UI/RPC clients mis-report retry intent and may settle prematurely in observers that trust willRetry alone.",
+        "code-quality:crates/pi/src/core/agent_session/subscribe.rs:230:subscribe.rs::is_retryable_assistant omits retry.rs patterns (internal error, temporarily unavailable, service_unavailable). AgentEnd.willRetry can be false while handle_post_agent_run still prepare_retry (or the reverse for other future drift), so UIs and extensions misread retry intent.",
+        "test-quality:crates/pi/src/core/agent_session_services.rs:466:create_agent_session_services reads settings_manager.is_project_trusted() and forwards it to start_with_cwd_and_trust, but no test asserts the bit actually reaches the extensions.load request for either value. Regression: Settings trust flipped in the UI but the host still started with default false (or always-true) \u2014 the trust decision never reaching extensions \u2014 passes all current tests (commit 6425136's core contract).",
+        "architecture:crates/pi/src/core/config_value.rs:50:Violated invariant: single domain authority and no hidden process-global mutable state for config command expansion. pi-ai auth/config_value owns COMMAND_CACHE and is what ModelRuntime imports; product core/config_value.rs:50-54 is a near-clone with a second static COMMAND_CACHE, pub-mod'd but unused by production paths. Dead second authority invites divergence if rewired later.",
+        "code-quality:crates/pi/src/core/trust.rs:611:write_trust_file uses fs::write directly on trust.json after building JSON. A crash mid-write can leave a truncated trust file; readers then fail open/closed unpredictably. No temp-file + rename pattern is used despite the store being security-sensitive."
+      ],
+      "status": "pending",
+      "attempts": 0,
+      "verification": [],
+      "guard": "Untrusted production startup loads no project resources; lifecycle/retry/tool policies single-authority",
+      "verifier": "cargo test -p pi trust && cargo test -p pi agent_session"
+    },
+    {
+      "name": "persistence",
+      "files": [
+        "crates/pi/src/core/agent_session/bash.rs",
+        "crates/pi/src/core/agent_session/persistence.rs",
+        "crates/pi/src/core/agent_session/prompt.rs",
+        "crates/pi/src/core/sessions/list.rs",
+        "crates/pi/src/core/sessions/mod.rs"
+      ],
+      "itemIds": [
+        "code-quality:crates/pi/src/core/agent_session/bash.rs:242:flush_pending_bash_messages drains pending bash records then ignores every manager.append_message Result. run_agent_prompt also does `let _ = self.flush_pending_bash_messages().await` before settle, so mid-run bashExecution custom messages can be lost while the prompt still reports success.",
+        "database:crates/pi/src/core/agent_session/persistence.rs:82:AgentSession::on_message_end routes append/persist errors through tracing_warn_persist, which intentionally discards the SessionError (let _ = err) and never logs, emits, or retries. Disk-full, permission, or create_new collisions therefore leave the live transcript ahead of the on-disk JSONL with no operator signal, so later resume/export silently omit user/assistant turns. This is a pure data-loss observability hole on the only append path for message_end.",
+        "code-quality:crates/pi/src/core/agent_session/persistence.rs:244:tracing_warn_persist discards SessionError with only `let _ = err` and an explicit silent-path comment. Callers that route append/message_end failures through it never log or surface diagnostics, so live transcript and on-disk session tree can diverge without operator signal.",
+        "code-quality:crates/pi/src/core/sessions/list.rs:78:find_most_recent_session_inner maps any fs::metadata error to Err(()) and find_most_recent_session turns that into None. One unreadable candidate makes the scan report no sessions even when other valid jsonl headers exist, breaking resume/most-recent selection.",
+        "performance:crates/pi/src/core/sessions/list.rs:173:build_session_info fully parses every JSONL line and accumulates all user/assistant text into all_messages, then joins into all_messages_text on SessionInfo. Listing many large sessions keeps complete transcript text in memory for the picker; cost is O(total session bytes) in RAM and CPU per list.",
+        "backend:crates/pi/src/core/sessions/mod.rs:417:SessionManager::rewrite_file opens the live session path with truncate(true) and rewrites all lines in place without temp file + rename or fsync. Trigger: crash/power loss mid-rewrite (migration, branch rewrite, bulk rebuild). Impact: session JSONL can be truncated to empty/partial contents\u2014history loss for the active session file.",
+        "performance:crates/pi/src/core/sessions/mod.rs:1453:On every message_end the event pump awaits persist_message_end \u2192 SessionManager::append_message \u2192 append_line, which does blocking OpenOptions open + writeln on the calling Tokio worker while holding session_manager. Large serialized messages or slow disks stall the lossless agent-event pump (and thus streaming projection) on the critical path."
+      ],
+      "status": "pending",
+      "attempts": 0,
+      "verification": [],
+      "guard": "Disk failures propagate; no drained/lost messages; rewrites atomic; listing bounded",
+      "verifier": "cargo test -p pi sessions && cargo test -p pi agent_session::persistence"
+    },
+    {
+      "name": "tools-mutation",
+      "files": [
+        "crates/pi/src/core/tools/edit.rs",
+        "crates/pi/src/core/tools/mutation_queue.rs",
+        "crates/pi/src/core/tools/write.rs"
+      ],
+      "itemIds": [
+        "backend:crates/pi/src/core/tools/edit.rs:290:apply_edit_mutation performs tokio::fs::write of final_content, then throw_if_cancelled. If cancel arrives in that window, the tool returns Operation aborted while the mutation is already durable on disk. Trigger: user abort/timeout immediately after the write completes. Impact: agent history/tool result claim failure, but workspace already changed; retries or compensating edits can corrupt or double-apply.",
+        "code-quality:crates/pi/src/core/tools/mutation_queue.rs:99:QueueRegistration::Drop checks Arc::strong_count == 1 outside the registry lock, then locks and removes the map entry. Between the count check and map.remove, another waiter can upgrade the Weak, register on a fresh Semaphore for the same path, and both run mutations concurrently\u2014breaking the per-path FIFO invariant for write/edit.",
+        "backend:crates/pi/src/core/tools/mutation_queue.rs:103:QueueRegistration::drop checks Arc::strong_count(&gate)==1 outside REGISTRY, then locks and map.remove(key). Between the count check and remove, another waiter can register the same key, insert a Weak to a new Semaphore, and then get wiped by the late remove\u2014or the old gate can be reclaimed while a new registration is in flight\u2014splitting one path across two semaphores. Trigger: concurrent edit/write on the same path when the last waiter drops during a new register. Impact: lost FIFO serialization; concurrent writers can interleave partial content on the same file.",
+        "backend:crates/pi/src/core/tools/write.rs:168:WriteTool writes file bytes then throw_if_cancelled; cancel after successful create/overwrite surfaces as tool error. Trigger: abort right after fs::write. Impact: same false-failure/durable-side-effect split as edit\u2014session believes the write failed while disk was updated."
+      ],
+      "status": "pending",
+      "attempts": 0,
+      "verification": [],
+      "guard": "One semaphore per path and cancellation cannot report failure after durable commit",
+      "verifier": "cargo test -p pi core::tools"
+    },
+    {
+      "name": "rpc",
+      "files": [
+        "crates/pi/src/modes/rpc/mode_host.rs",
+        "crates/pi/src/modes/rpc/server.rs",
+        "crates/pi/src/modes/rpc/types.rs"
+      ],
+      "itemIds": [
+        "api:crates/pi/src/modes/rpc/mode_host.rs:403:RpcSessionHost::get_commands always returns Vec::new while the wire command and success data shape exist. Upstream rpc-mode.ts fills extension commands, prompt templates, and skills. RPC clients permanently observe an empty catalog despite a successful get_commands response.",
+        "backend:crates/pi/src/modes/rpc/server.rs:448:ExtensionBindings.shutdown_handler only stores shutdown_requested=true and never notifies ServerState.signal. Production run_rpc_mode only observes that flag on signal.notified() (AgentSettled/rebind) or after the next stdin command (process_input_line). Trigger: extension invokes shutdown while the RPC server is idle with no stdin traffic. Impact: process hangs until external input/signal instead of exiting; automation clients can deadlock waiting for clean shutdown.",
+        "api:crates/pi/src/modes/rpc/mode_host.rs:411:Server docs require awaiting backpressure after non-prompt responses and on agent subscribe paths. process_input_line only enqueues frames, and production register_backpressure_hook is a no-op. Under event load the write FIFO can grow without flow control, diverging from TS waitForRawStdoutBackpressure.",
+        "api:crates/pi/src/modes/rpc/server.rs:994:process_input_line deserializes JSON to Value first, then RpcCommand. On schema/field errors it always emits RpcResponse::err(None, parse, ...), discarding a present id. Unknown commands correctly echo id; field errors break client correlation for the same request envelope.",
+        "api:crates/pi/src/modes/rpc/server.rs:1028:stdin_reader maps any JsonlReadError/Err to LineMsg::Eof, so transient read failures become clean shutdown with no error frame and exit-0 style completion. Distinguish Ok(None) EOF from Err and surface a non-zero/error path.",
+        "api:crates/pi/src/modes/rpc/types.rs:2192:optional_string/optional_bool silently return None for wrong JSON types (e.g. id:123, excludeFromContext:true-as-string). Correlation ids and bash flags can change semantics without a parse error. Reject known optional fields with wrong types, still echoing id when recoverable."
+      ],
+      "status": "verified",
+      "attempts": 1,
+      "verification": [
+        {
+          "command": "cargo test -p pi modes::rpc",
+          "result": "post-commit 99 RPC tests passed (artifact://7001)"
+        }
+      ],
+      "guard": "RPC correlation/backpressure/shutdown/read/type/catalog contracts are observable",
+      "verifier": "cargo test -p pi modes::rpc",
+      "commit": "5771f14"
+    }
+  ],
+  "verification": [],
+  "reReview": null,
+  "resolve": {
+    "valid": 98,
+    "notAnIssue": 15,
+    "needsClarification": 0,
+    "outOfScope": 0,
+    "findingsHash": "06074273642453e991181a4005bacfddd0645b02a77d85d40b26a9a3d9624afb"
+  }
+}