Termind/Memory/REFACTOR.md

Termind Refactoring Backlog

English-only durable history and redundancy backlog. For future work: confirm references with rg, record evidence/action/estimated net production reduction, implement one independent change, run risk-appropriate checks, and append status/verification. Retain completed items and native lifecycle boundaries. Structural changes must explicitly disclaim reduction. Test additions are counted separately. Historical results below describe their recorded runs, not current verification; pending work stays pending. “Pinned” means -onlyUsePackageVersionsFromResolvedFile. Formatting/localization/diff checks mean strict recursive Swift formatting, Scripts/check-zh-localization.sh and git diff --check; Xcode validates the app module graph.

Completed items, 2026-08-30 to 2026-09-04

Items 1–32 and 34 date to August 30; later dates are explicit. “Build” means the recorded app build, not a full test pass. Each item retains its original ID.

1. Legacy SwiftUI transcript: removed unreachable transcript/message/command/compaction/plan trees; retained live timestamps/risk components. Build and targeted Transcript tests passed.
2. List hosting: shared HostingListRow/HostingListContent; retained Transcript/conversation lifecycles. Build passed before the final parser-verified Connection Log migration.
3. SSH initializers: one private initializer, preserving temporary Hosts. Build passed.
4. Terminal appearance: SSH/Serial reuse TerminalViewState.applyAppearance. Build passed.
5. SFTP store overloads: removed four TransferLibraryModel forwarders for RemoteSessionHostStore. Build passed.
6. Jump Host builder: reused sshJumpConfigurations, preserving validation/errors. Build passed.
7. Connection interaction: shared trust/progress/prompt/reconnect policy in RemoteSessionConnectionController, keeping transport teardown local. Debug build and connection/SFTP tests passed.
8. Tool-free text collectors: shared streamed text/tool rejection for commands/titles/compaction. Focused tests passed.
9. Provider authorization: shared auth/ephemeral sessions; retained Vertex/empty-secret rules. Provider/ChatProbe passed.
10. SwiftData transactions: narrow ModelContext.commit, retaining two-stage history commits. Connection/SFTP History passed.
11. libssh2 continuations: shared identical SSH Exec/SFTP serial-worker bridges. Build passed.
12. Legacy Transcript helpers: removed dead streaming/edit-binding/activity helpers with item 1. Transcript checks passed.
13. Composer migration: callers use conversation.composer; removed four accessors, retaining attachment hooks. Build and Chat Composer tests passed.
14. Toolbar search: deleted unreachable menu/delegate/find-kind plumbing; query/keyboard behavior retained. Build passed.
15. Agent SSH prompts: AgentSSHAuthenticationRequest supplies both Journey/passphrase projections. Build passed.
16. Atomic SFTP writes: shared temp paths/cleanup/unlink/rename/progress, keeping source loops separate. Build/SFTP passed.
17. Transfer conflicts: shared Keep Both/directory/file policy, retaining distinct jobs. Debug build/SFTP passed.
18. Client leases: shared saved/borrowed acquisition and conditional disconnect; reservation state retained. Build/SFTP passed.
19. Legacy tool metadata: one compatibility table, retaining generic MCP fallback. Presentation tests passed.
20. Test-only presentation actions: removed unused automatic messages/verb duplication around actionKind. Presentation passed.
21. Tool input unpacking: narrow AgentToolDetailFormatting object/array helpers, local field presenters. Build passed.
22. Idle sweepers: one AgentIdleSweeper, caller-owned registries/emptiness. Focused tests passed.
23. Sidebar headers: reused SidebarSectionHeader for count/collapse instead of Assistant/Snippet copies. Build passed.
24. Host deletion: groups use repository/outbox saga; deleted direct snapshot deletion. Debug/repository/Snippet/forwarding passed.
25. Unused declarations: reference-confirmed Agent preflight/settings/metrics/reconnect/SSH-status wrappers/constants removed. Build passed.
26. Settings page: two callers use identical SettingsFormPage; deleted SettingsCollectionPage. Build/Settings passed.
27. Cursor lists: shared fixed-height Snippet Target/Host Chooser/Export Host adapter; specialized rows excluded. Build/list tests passed.
28. Agent authentication: shared typed Exec/SFTP authenticated-open retry loop. Build and all 21 Host Authentication tests passed.
29. Transcript risk/confirmation: shared native-row risk color/destructive confirmation. Build passed.
30. Glass shapes: one private shape-parameterized modifier, unchanged APIs/fallbacks. Build passed.
31. Vault envelopes: shared insert/update/upload indexing; callers retain versions/merge rules. Build/Vault Sync passed.
32. Remote preflight: shared directory ordering/descendant skip/target-kind lookup; prepared jobs remain distinct. Build/SFTP passed.
33. Vertex selection (09-04): ModelProvider.usesVertexEndpoint/effectiveCredentialRef, later adapted to API formats. Build/Provider checks passed.
34. Dead fields: removed unused onboarding/Agent/color/trial/runtime Linux metadata, retaining generated JSON provenance. Build passed.
35. Run presentation (09-01): derive state from reported run/outstanding queues. State/localization/diff checks passed.
36. Copy-only tests (09-02): removed 20 tests/literals; kept behavioral/persistence/language/protocol coverage. Target compiled; focused tests passed.
37. Provider HTTP (09-02): shared transport/HTTP/non-2xx validation; requests/parsing local. Build and 12 tests passed.
38. Finder drop wrapper (09-02): deleted unconstructed NativeFileURLDropTarget, retaining general target/test initializer. Build and five drop tests passed.
39. Context Chip recovery (09-02): shared payload boundaries/fallback filenames for live/restored attachments. Build/recovery passed.
40. Save/rollback reuse (09-02): savePendingChanges/commit cover Agent/Outbox/AI/conversation without shifting commits. All 46 focused tests passed.
41. Overlay chrome (09-02): three modifier chains use termindTransientOverlaySurface; content/transitions local. Debug passed.
42. SSH form chrome (09-02): shared connectionFormChrome, distinct form behavior. Formatting/Debug passed.
43. Snippet content (09-02): SnippetCardContent shared with drag ghost, separate interaction/chrome. Formatting/Debug passed.
44. SFTP reads (09-02): inline/two download paths use withRemoteReadHandle, keeping loops/destinations. Build/47 tests passed.
45. Chooser selection (09-02): shared ManagedChooserState.allChecked(in:)/toggleAll(in:) for three equal eligibility sets; restricted selection retained. Build/localization/diff passed.
46. AgentKit extraction (09-02): moved portable runtime behind host/interaction/prompt/presentation seams. Package build/tests/formatting and app build/full suite passed.
47. Workspace commands (09-02): removed AppKit-shadowed commands, retained standard shortcuts and moved split bindings off system keys with terminal routing coverage. Build/formatting/localization passed.
48. Provider addressing (09-04): one URL plus ModelAPIFormat replaces vendor/default-path branching; safe migration, AgentKit 0.4.0/0.5.0. Package checks, 994 app tests, localization/site build passed.

Later completed work, 2026-09-09 to 2026-09-14

Date	Change and retained boundary	Recorded verification / reduction
09-09	StoreKit replaces local HMAC/Keychain/CloudKit trial with transaction clock watermark.	−121 production lines; commerce passed except unrelated catalog expectation.
09-09	Delete unread Show Recents setting/UI/labels; retain Sidebar accessibility localization.	Builds, formatting, localization and relevant tests passed.
09-11	Remove five redundant tests and literal/enum/catalog snapshots; retain behavior.	−77 test lines; relevant checks passed, unchanged intermittent focus test passed rerun.
09-11	Delete ScreenshotDemoWindow; use production WindowGroup with demo restoration off.	Full pinned tests, native capture, formatting/localization passed.
09-11	Share SFTP permission Domain draft/Presentation grid.	Regression evidence was recorded in MOBILE_ROLLOUT.md.
09-11	Move CloudKit/settings transactions/journals/terminal/history to frameworks; retain desktop adapters.	Shared/mobile passed; full macOS retained known Agent timing failures.
09-11	Application owns Metrics/Journey state, Presentation panels/forms; native keyboard/logs stay local.	Shared/mobile and 127 focused macOS tests passed.
09-11	Share skill library/importer/role form in Application/Infrastructure/Presentation; native editors retained.	Isolated build and 81 mobile/shared tests passed.
09-12	Share Assistant runtime/tools/attachments/speech/conversation/list behavior.	Builds/navigation/Assistant/localization/formatting passed; unrelated mobile Metrics race passed rerun.
09-12	Remove app forwarding aliases; retain six responsibility-named adapters.	−86 files, 224 app aliases, 20 Persistence aliases; both builds/architecture/full TFI passed.
09-12	Align TFI layers, move connection construction to Infrastructure, centralize then-current idiom policy.	Both builds/architecture/full TFI passed; later width work supersedes idiom policy.
09-12	Share TerminalCommandDraftController/CommandGenerationCoordinator, timeout/cancellation/protocol constants.	Focused desktop/mobile passed.
09-12	Domain RemoteFile, Application RemoteFileSystem/MobileSFTPSessionModel.	Structural net increase; builds/architecture/SFTP passed.
09-12	Mobile adopts shared trust/progress controller and Workspace/Metrics temporary-key preparation.	Connection/Journey/Metrics/recovery passed.
09-12	Share TerminalFindController; platform binding closures retained.	Direct/platform tests passed.
09-12	Domain detects Linux distribution once, distinguishing unavailable/conclusive.	Domain/Host/mobile Workspace passed.
09-12	Share Journey header/status; native logs/failures/backgrounds/keyboard retained.	−98 production lines; builds/Journey passed.
09-12	Presentation owns Ghostty appearance conversion; desktop preference storage retained.	Both builds/themes passed; dependencies unchanged.
09-12	Share terminal-upload readiness/notices, distinct platform execution.	Direct policy tests/both builds passed.
09-12	Share hashed/endpoint Known Host titles, distinct cards.	Direct presentation/both builds passed.
09-12	Restrict ListViewKit: remove eight macOS adapters/eleven mounts, retain narrow UIKit transcript/history uses.	−611 macOS lines; builds/focused/format/localization/boundaries passed.
09-12	Share transcript tools/results/disclosure/timestamps/Markdown, retaining native renderers/viewport ownership.	Both builds/architecture record verify boundary.
09-12	Remove Periphery-confirmed 34 imports/three empty files/declarations; retain dynamic/protocol entry points.	−150 production lines; builds/focused/format/localization/diff passed.
09-12	Remove concrete native/list implementation-type assertions.	Behavioral rendering/identity/reuse/interaction/environment coverage retained.
09-13	Remove 81 compiler-confirmed unused localizations/three obsolete expectations/verified stale metadata.	Both builds and localization/language checks passed.
09-13	Use ChatSlashCommandRegistry with explicit platform ownership.	Both builds and registry/desktop/mobile tests passed.
09-13	Inject app-owned MobileFeatureRegistry; replace tab/sidebar/destination copies.	iOS build and 28 navigation tests passed.
09-13	Share tree/route/deletion/display/Snippet/model/SFTP-drag/service policy; retain native lifetimes.	Both builds/shared/mobile passed.
09-13	Annual introductory offers replace new standalone trials; legacy entitlement temporarily retained.	Offer/eligibility/duration/price/period/expiration derive from StoreKit; legacy removal follows below.
09-13	Remove 27 mobile/seven app source snapshots, host-state Keychain/status integration, duplicate permission/history tests; compatibility/defaults/limits move to FrameworkTests.	−1,303 lines; 1,079 macOS, 13 shared, 218 iOS tests plus formatting/localization/diff passed. Existing waveform bitmap failure remains outside cleanup.
09-14	Fresh scan removes standalone-trial ID/domain/clock/entitlements/product/UI/tests/copy; lifetimeProductID and annual trials remain.	Estimate −90 production lines; format/localization/site, 1,091 macOS, rerun Metrics and 187 shared iOS passed. iOS built; ten unrelated toolbar tests failed full/isolated runs.

Retained boundaries

Native transcript/conversation/dynamic/drag lists retain dedicated lifecycles. Share only portable SSH/SFTP/Serial/ platform policy; differing startup, credential saves, teardown, logs and interaction stay separate. Frozen SwiftData schemas are migration contracts; small lookalike repositories/views need no abstraction without reduction. RuntimeVersions stays platform-local to avoid invalid Ghostty dependencies. The 09-02 completion/recheck found no further qualifying independent duplication/dead code; every later candidate needs fresh references.

Planner reuse and test cleanup, 2026-09-16

Desktop download planner — completed

• Evidence: rg 'PreparedJob|PreparedBatch|pendingBatch|keepBothLocalURL' TFM TFI Frameworks TFMTests TFITests found desktop's sole mixed batch path was download-only, with empty remote-directory collections; mobile already used SFTPRemoteDownloadPlanner and uploads SFTPLocalUploadPlanner.
• Adopt shared traversal/local conflicts/scoped destination/enqueueing; retain desktop pending/errors/copy policy/ lifetimes. Destination ownership now creates directory-only trees. Estimate −180, actual −167 production lines (−59 including regression tests); architecture updated.
• All 75 SFTP/architecture tests passed, including three new tests/ten conflict/subtree/empty/cancellation cases; empty-directory regression fails with old production code. Full pinned macOS: 1,337/1,343. Four failures reproduce before change: SettingsSyncTests.providedDatabaseCopyMigratesWithoutReset (schema 15 vs 17), ModelCapabilityResolverTests.reportedFieldsWinOverCodexAutoReviewOverride, ScrubberWebClientTests.fetchPreflightNeverEscalatesPrivateHTTP, ChatComposerStateTests.aFailureNoticeIsNotAnAnswerWorthNaming. MetricsJourneyTests.offlineRestoredMetricsReconcileOnMainActor passed rerun; SSHImportTests.indexedIdentityPlanningHandlesTheImportFileLimit exceeded two seconds concurrently but passed isolated against both versions (final 0.100 s).
• Full pinned iPhone 17 Pro/iOS 26.5: 426/432, all 205 framework tests passed. Five Assistant/import failures remained on rerun (identifiers below); MobileEditorToolbarTests.iconButtonsKeepTheirNamesAndSaveLifecycle passed rerun. Formatting/localization/symbol/diff checks passed; no dependency/catalog/shared production changes.

Desktop copy planner and duplicate assertions — implemented, partial verification

• Evidence: rg 'PreparedRemoteCopy|pendingRemoteCopyBatch|SFTPRemoteCopyPlanner.enqueue|resolveRemoteDirectories' across app/framework/test Swift found desktop-only preparation/conflict/enqueue copies. Adopt the existing mobile planner and directory-mutation reporting, preserving pending/errors/completion refresh/interactive deletion. Estimate −220, actual −193 production lines; coverage retains validated recursive deletion/cancellation and adds three-policy file/directory/subtree conflicts, empty refresh and pending cancellation. Upload helpers remained R2.
• Reference scans of role-label, unknown-command, approval-copy, handshake-description and upload-notice tests removed pure literals/duplicates, keeping parameterized classification, endpoint/destructive policy, locales, diagnostics and gating/payload behavior. Estimate −50, actual −59 test lines; +75 copy regression lines gives −177 total Swift. Architecture/language/catalog/protocol/round-trip/behavioral string assertions remain.
• Focused pinned TFM: 200/200; full: 1,436/1,437, unchanged SpeechWaveformViewTests.waveformRespondsToLevelsAndReduceMotionMakesItStable bitmap assertion. Earlier records report it, but this pass ran no baseline/isolated rerun. TFI never built/tested: unavailable destination UUID; owner requested commit before retry after discovering a booted phone. Not a passing iOS result.
• Formatting/localization/removed-symbol/diff checks passed; Xcode resolved modules standalone SourceKit could not. Existing SwiftLint size/complexity findings stayed outside scope, without suppressions. Dependencies/catalogs unchanged. Evidence: /tmp/termind-refactor-copy-{focused,macos}-20260916.xcresult.

Low-value UI/source assertions — implemented, full verification recorded as in progress

rg '#filePath|sourceRoot|String\(contentsOf|source\.contains' FrameworkTests TFMTests TFITests found 35 architecture and eight UI/source snapshots. Removed implementation/copy/layout/enum/palette/fixed-canvas/disconnected sorting checks and orphan helpers: 52 declarations/1,230 lines versus estimate 1,000–1,200. Source checks fell 43→9 narrow ownership/dependency guards; native-list allowlist permits importer removal but rejects unapproved additions. Grouped Host tests now use fixture placement. Behavioral/language/protocol/opt-in screenshots remain; production, packages/catalogs unchanged and existing architecture edits preserved. Initial pinned macOS 18/18, iOS 5/5; format/localization/remaining-source/diff checks passed. Standalone SourceKit partly inconclusive; generic SwiftLint size/tuple/pixel-name/force-try findings untouched. Full runs were proceeding sequentially; no final pass recorded here. Evidence: /tmp/termind-test-cleanup-initial-{macos,ios}.xcresult.

SFTP status labels — verified with existing iOS failures

rg 'status\(for: transfer\)|transfer\.state\.label' TFM TFI found mobile direction mapping/two generic desktop labels. Presentation now supplies shared running/completed direction labels, generic other states: −8 production lines as estimated, unchanged translations/transports. Pinned macOS 1,183 app +213 shared passed; iOS 212/217 app +213 shared, with the same five Assistant/import failures/text as /tmp/termind-test-cleanup-full-ios.log. Formatting/localization/diff passed; English/zh-Hans/zh-Hant resource-backed label matrices reviewed, not live transfers. Evidence: /tmp/termind-sftp-status-{macos,ios}-20260916.xcresult, /tmp/termind-sftp-status-preview/.

Desktop forwarding adapter — implemented; verification blocker later resolved by the 09-17 repair

• rg 'PortForwardingEditorState|PortForwardingEditorPolicy' across sources/tests/Memory/project found a 43-line adapter serving three computed desktop getters/seven tests; mobile already used shared policy. Replace with PortForwardingEditorPolicy, preserving synchronous observed saved-rule/Host/controller reads, callbacks, intent OR activity, normalization, draft Host-ID lookup, edit locks and native runtime values. No new wrapper/API/ schema/secret/approval/dependency/localization change. Estimate −27–28; actual −27 production (−43/+16), +109 test lines, +82 total. Seven desktop behaviors retained; shared matrix adds 14 cases including hidden dynamic targets, local/remote normalization, activity/intent and missing targets. Independent reviews/audit found no issue.
• Focused pinned TFM 33/33 (14 feature, seven editor, nine architecture, three shared functions/14 cases), re-extracted without rerunning: /tmp/termind-forwarding-adapter-verify.xMtOCK/focused.xcresult. Full macOS 1,399/1,399 (1,183+216), no skips; iOS 428/433 (212/217+216), five failures/no skips, exact rerun 0/5. Simulator: iPhone 17 Pro/iOS 26.5, 38789AE8-B5AA-46CA-A15C-77CE760FC550.
• Repeated iOS identifiers: MobileAssistantTests.attachmentOnlyFirstSendPromotesTheConversation, firstNewConversationSendPromotesDraftAndStartsRun (expected user/assistant), existingConversationSendStillUsesTheDraftExecutionPath (expected user/user/assistant), completeRegistryIncludesRemoteAndBuiltInToolsOnlyForCapableModels (expected no terminal_suggest), and MobileVaultFeatureTests.importRequiresAnExplicitUsernameWhenTheConfigurationOmitsIt (model.canImport). No pre-refactor baseline was run; attribution was unverified, not established regression/pre-existing behavior. All planned stages completed after provider interruption; it was neither test failure nor user stop.
• Formatting/localization/diff/retired-symbol checks passed. No-index exit 1 was corrected as “files differ” in untracked-whitespace-adjudication.json, preserving raw evidence; supplementary scan passed. Patch, including untracked test, matched verifier/partial.patch byte-for-byte (SHA-256 f76b9950aa3bb49140865feec1153836f59ce903d25f3a32edcbf07ab320a691); dependency hashes matched HEAD/evidence. Audit altered documentation only, with no rebuild/source edit/commit; five paths remained at 8b01a631fefdbe14e1324d87c91d0860124d85d3.
• Manual status/toggle/lock/save/cancel/back checks were not run; no visual claim. Full results retain 166 macOS warnings (88 locale/74 constraint/four StoreKit listener), 29 iOS (27 locale/two view-update publishing), none in targeted rerun; focused logs retain row-height/Xcode warnings. Warnings were not baseline-attributed/investigated.
• Evidence: /tmp/termind-forwarding-adapter-recovery.eggzSE/remaining-checks.9wl35uwk/ contains full/rerun results, commands/logs/reports/test trees/comparisons/simulator/patch evidence; sibling audit-record/ has independent re-extractions/integrity/diff results. Implementation: /tmp/termind-forwarding-adapter-implement.aTsWRl/checks.{sh,log}.

Five repeated iOS failures, 2026-09-17 — repaired and verified

Clean pinned d582d711 reproduced all five (0/5) before this test-only repair, establishing this repair's baseline, not retroactively a pre-refactor baseline. Three send tests now assert user-only history, failed-run/prompt association, failure timeline and title exclusion: b2f05217 intentionally stopped synthesizing replies without a Chat model. Existing-chat testing awaits failed state rather than 20 yields. Registry testing follows df3bd04c: stable terminal_suggest definition, snapshot-gated execution, equal descriptors across surfaces and no tools for incapable models. Import testing follows ac165a9a's indexed identities: real SSHImportReader/temporary config/empty default username reject invalid commits; adding User deploy and rescanning imports a linked Host/Identity. Obsolete fake removed, without test-only production mutation API.

All five identifiers remain, none skipped/deleted/expected-failing; only two test files/record changed. Three independent actions passed all five (fixed-repeat, focused-2, focused-3); the first -test-iterations 3 actually ran Swift Testing once. Full pinned TFI 433/433, TFM 1,399/1,399, no failures/skips, resolve the preceding automated blocker. Formatting/localization/whitespace passed; Xcode, not inconclusive SourceKit, validates modules. Full runs retain 29 iOS/168 macOS uninvestigated/unattributed warnings, focused runs none. Evidence/scripts: /tmp/termind-ios-five-fixes.NfgsN4/ (baseline, focused actions, full-ios, full-macos results).

Skill packages and immutable helpers, 2026-09-17

• Single-document loader — implemented. load_skill duplicated definition/presenter/guidance/output exemptions. Replace executable LoadSkillTool with skill_read_file for bounded instructions/supporting resources; retain historical presenter/replay only. Estimate about −100 retired-loader lines; package management is additive, no overall reduction claim. AgentKit tests passed; app skill/migration/memory/mobile suites exercised.
• Starter runbooks — implemented. AgentSkillLibrary shipped three editable seeds, duplicated in library/sync persistence, with destructive Reset in both apps. Replace with two immutable runtime helpers; delete seeds/Reset/ old fixtures, preserving installed starters as ordinary user records. Native conflict repair and atomic install/ sync transaction remain. Estimate about −200 retired production lines, excluding installer/migration coverage. Signed/published AgentKit 0.13.0: 213 package tests passed. Memory labels remain 持久化记忆 / 持久化記憶. Final iOS 452/452, macOS app 1,183 passed, AppLanguage independently passed; refreshed shared 231/232 with existing waveform PNG failure. New skill/library/sync tests, bilingual native review, formatting/localization/diff passed.

Reuse and architecture scan, 2026-09-17

Discovery baseline 8509ddd5: inventory/normalized-block scan of 516 production Swift files/113,165 lines across frameworks/apps/bridge; inspected candidate bodies/callers/tests, not every file behavior. Import audit of 273 framework files found no prohibited edge. Stale source graph/unavailable structural navigation were not reachability proof. Website localized home already shares one page; AgentKit/third parties excluded. Scan changed docs only; source paths, English prose, diff/localization checks passed, no builds/tests/visual verification. At discovery all six were pending. Estimates are net production lines including helpers/callers, excluding tests; abandon extractions that cost more. Operator then authorized R1→R2→R3; R4–R6 were outside that pass, with later R5/R6 updates below.

R1. CloudKit record coding — implemented, affected checks passed

• Evidence: three Cloud coordinators' makeRecord|envelope|payloadData|systemFields|record|assetURL methods repeated record restoration, hashing, inline/assets, secure fields and cache paths; confirm with rg in Frameworks/TermindInfrastructure/Cloud. Estimated −70–110, low/medium wire risk.
• CloudSyncRecordCoding shares mechanics, raw/quarantine vs validated reads, lowercase SHA-256, lazy assets and namespaces. Coordinators retain envelope metadata/validation, legacy Guardian canonicalization, errors/public entry points/zone names/casing/cleanup/independent lifetimes; exact 700,000-byte threshold and frozen models remain. Actual −40 (1,741→1,701), eight new functions/12 cases covering threshold/storage transitions/hash/corruption/missing payload/asset errors/secure fields/namespace boundaries. No need for a generic metadata API or R5 due to size alone.
• Pinned macOS 61/61, iOS 13/13, new suites executed with unchanged source snapshots; Vault/Settings/legacy Guardian/ Metrics/architecture passed. Format/diff passed; Xcode resolved imports SourceKit could not. Evidence under /tmp/termind-refactor-three.7kUsqP/r1-focused-*. Initial full baseline before edits: macOS 1,502/1,505, iOS 502/503; approval/runtime cancellation, Metrics worker and mobile knowledge expansion failed. No unrelated fixes/package bump.

R2. Upload/copy conflicts — implemented with characterized upload hardening

• Evidence: remoteConflictPreflight|resolveRemoteDirectories|resolveRemoteConflict|deleteRecursively in SFTPLocalUploadPlanner, SFTPRemoteTransferPlanner and SFTPRemoteCopyOperation duplicated subtree/Keep Both/ delete policy. This is the 09-16 upload follow-up, not unfinished desktop planner adoption. Estimate −100–140; medium risk because Replace deletes directories. Before sharing, new fake-backend tests reproduced cancelled directory-only upload creating a directory and Replace accepting an outside child; macOS copy/SFTP 65/65, mobile upload 5/7 (only new cases failed).
• SFTPRemoteConflictResolver uses RemoteFileSystem, preserving strict-descendant upload preflight versus self-or-descendant copy. Upload deliberately gains copy's cancellation/recursive-name/path validation; not byte-equivalent old behavior. Keep manifests/local scoped traversal/jobs/enqueue/pending UI/interactive deletion/ directory accounting/errors separate. Copy-source error moved unchanged to its own file.
• Actual −139 (906→767, five files); seven shared functions/17 cases cover both modes/all policies/subtree mapping/ overwrite/counts/delete order/invalid paths/cancellation. FrameworkTests now links Remote Infrastructure on both platforms; production graph/pins unchanged. Required mobile coverage retains scoped symlink exclusion and empty directory uploads. Final focused macOS 81/81, iOS 23/23 include repaired cases/shared suite with unchanged snapshots. Formatting/plist/localization/diff passed; architecture records resolver/counting rules. Evidence: same root, r2-before-*, r2-focused-*; unrelated full failures remain tracked.

R3. Pro offer projection — implemented, affected checks passed

• Evidence: purchaseButtonTitle|selectedPlanDetail|trialBadge|annualBillingUnit|func formatted repeated in desktop/ mobile paywalls. Estimate −20–40, low risk. Value-only ProOfferPresentation consumes StoreKit-derived values/ eligibility/plan, never Infrastructure/controller. Apps retain cards/features/sheets/navigation/purchase/management.
• macOS injects AppLocalization, mobile Foundation/Apple bundle lookup; both keep effective locale, Gregorian full units/one component. Compute once per purchase section; History's abbreviated/two-unit formatter stays separate. Actual −32 (602→570); nine functions/20 cases cover plan/trial/missing data/period priority/separate locale lookup, plus six real-catalog English/zh-Hans/zh-Hant AppLanguage cases, with no catalog changes.
• Pinned macOS 41/41, iOS 11/11 with stable sources, including new suites/access/trial/architecture/language tests. Diff-reviewed native layout/actions; no interactive storefront/screenshots claimed. Evidence: same root r3-focused-*. Repository formatting/localization/diff/plist passed. R1–R3 total −211 production lines, excluding tests/docs and unrelated .TermindPresentationQA.xcodeproj deletion.

R1–R3 full verification — gate remained non-green

Final pinned macOS 1,527/1,530, iOS 528/529, no skips, unchanged action snapshots; all three new shared suites passed on both. Three failures repeat immutable baseline: AgentApprovalQueueTests.cancellingAParallelBatchStillAnswersEveryCall, ServerMetricsLifecycleTests.oneWorkerSurvivesWindowsAndStopsOnPauseSleepAndRemoval, MobileKnowledgeToolRenderingTests.knowledgeRowsStayCompactAtPhoneWidthAndExpandOnDemand. Initial AgentRuntimeTests.stoppingARunCancelsTheToolsItIsWaitingOn did not recur; no fix claimed.

Final macOS additionally failed SpeechWaveformViewTests.waveformRespondsToLevelsAndReduceMotionMakesItStable, absent in initial baseline despite earlier records. Unchanged HEAD source/test passed both tests in three independent minimal-package processes; current isolated Xcode macOS failed 1/2, iOS passed 2/2. Clean pinned 8509ddd5 export with separate DerivedData passed framework-only scheme 2/2 but reproduced 1/2 failure under original TFM scheme. Thus all four final failures have pre-change evidence; smaller harnesses alone were insufficient. Scheme sensitivity is established, root cause unrepaired. No unrelated tests/implementation/AgentKit/pins/QA deletion changed for green. Evidence: /tmp/termind-refactor-three.7kUsqP/ (final-*, waveform-{baseline,current}-*, waveform-head-tfm.*, passing waveform-head-xcode.*, source manifests).

R4. Architecture guards — pending, explicitly structural

ArchitectureBoundaryTests scans AgentKit ownership only in TFM, omits Remote Infrastructure/Presentation/bridge from SwiftData checks, incompletely forbids Application UI/native I/O and Presentation Infrastructure imports, and misses annotated/qualified imports. Confirm with rg 'applicationDoesNotImport|typesOwnedByTheAgentPackage|sharedFrameworksCannot|sharedPresentation|swiftDataModels|swiftFiles|text.split' TFMTests/ArchitectureBoundaryTests.swift. Centralize production roots/dependency rules/bounded import recognition; cover all owners, preserving fail-closed missing/empty roots/native-list allowlist. No production violation/reduction claimed; budget +20–60 test lines. Use fixtures, never production mutations, to reject annotated/qualified forbidden imports/out-of-owner declarations, allow valid imports/importer removal. Run boundary/both pinned suites; never restore UI/copy/layout/path/wiring snapshots.

R5. CloudKit lifecycle — discovery follow-up, implementing as of 2026-09-19

rg 'operationID|prepareAndSynchronize|synchronizeNow|isReadyToSend|stopEngineForAccountChange|handleZoneDeletion' in the three Cloud coordinators confirms duplicated operation/account/engine/fetch/send/pause/reset/error policy. Existing codecs/journals/merges alone do not characterize async lifecycle. After R1, compose one typed Infrastructure lifecycle instance per category with value journal projection/closures and injectable account/engine transport. Keep codecs/merge/quarantine/version acknowledgements/legacy records/Settings secrets in adapters; no universal untyped framework or model reshaping. Zones/journals/accounts/subscriptions/switches/engines/lifetimes remain independent; secret uploads require current-engine fetch and revoke on pause/account retirement. Estimate −200–350 additional production lines including driver/adapters, high risk; package/models unchanged.

Required deterministic coverage: pause/retry/stale callbacks, account switching/consent, zone/environment resets, failed fetch/readiness-before-send, secret authorization/revocation; migrate categories individually and retain tombstone/quarantine/versioned-ack tests. Fresh 09-19 scan reconfirmed evidence; implementation underway, unified verification follows all requested edits. Architecture ownership is recorded; no completion/result is claimed here.

R6. MCP ticket policy — discovery follow-up, implementing as of 2026-09-19

rg 'has.*Activity|count < 64|addingTimeInterval\(600\)|maximumBytes|func (endSession|revokeSession|sweep)|1_800|count - 256' in TFM/Application/MCPServer/MCP{Upload,Download}Coordinator.swift confirms repeated metadata/activity/expiry/capacity/ retention; download references MCPUploadRequest.maximumBytes. Share only desktop metadata/expiry/retention/limits, reusing four-slot MCPTransferBudget: ten-minute tickets, 64 unfinished/direction, 256 completions/direction/thirty minutes. Keep separate dictionaries/errors/live states/claims/generations/stream loops/revocation/cleanup/task ordering; no listener in mobile/frameworks/AgentKit or generic ticket superclass. Upload expiry may spawn cleanup; download can serve Range after success; cancelAndWait captures tasks differently. Estimate originally −30–70, revised on 09-19 to −10–40 including narrow protocol cost; medium/high lifecycle/security risk.

Retain MCPUploadTests, MCPDownloadTests and session-teardown tests; add clock-boundary/retention coverage and preserve Range-after-success, acknowledged offsets, late disconnects, Host/session revocation, slots held through cleanup, protocol strings and metadata-only audit. Fresh scan reconfirmed evidence; implementing. User requested finishing both remaining refactors before unified verification, superseding per-edit checks for this pass.

Scan disposition: R1 first, then R2/R3; R4 before expanding dependency/lifecycle ownership, separate R5/R6 design/ characterization. Retain frozen schemas, responsibility-named Vault facades, native lists/terminal teardown and local runtime-version adapters. File size or a small pixel-test duplicate alone never justifies merging native renderers.

Window and mobile changes, 2026-09-18

Width-based mobile layouts — implemented, later navigation design superseded below

rg 'mobileInterfaceIdiom|MobileInterfaceIdiom' TFI TFITests found device-based shells/sheets/cards and a duplicate test root. Removed environment/injection, tested real roots rebuilding native compact/regular shells; estimate −50 obsolete lines excluding transition behavior/tests. Coverage includes reconstruction/actual selection, Settings/draft reset, Metrics mapping/Back, Assistant drafts, window independence, deferred saves/errors and live SSH/SFTP. Phone focused 25 passed; final breadcrumb four Workspace tests passed on phone/tablet. English/zh-Hans/zh-Hant snapshots and actual rotation reviewed. Device Hub did not perform Stage Manager corner resizing; frame/trait real-root tests cover width/two-window behavior. Formatting/localization/diff passed, pins unchanged.

Full iPad: 537 passed/3 failed/0 skipped of 540; macOS: 1,527/1/13 of 1,541, all new tests passed. Clean c015d5f3 with original TFI scheme reproduced iPad tab-bar visibility/Host-card height/knowledge expansion; baseline cards pass on phone. Mac retained unchanged waveform failure. Earlier interrupted cleanup run was superseded by complete iPad. Evidence: /tmp/termind-width-{final-ipad,rebuild-macos,iphone,path-final,path-final-ipad,baseline-ipad,baseline-cards}.xcresult. Not a green full-suite claim; unrelated assertions/code were not changed.

Main-window registration/content style — completed

rg found RootView mounting MainWindowRegistration plus FullHeightWindowContent solely for two native properties; independent attachment could size before the full-size coordinate system. Move style/transparency before registration in the existing macOS bridge, removing representable/NSView (−30/+5). All 47 window/lifecycle/shortcut checks and formatting/localization/diff passed. Native checks: 904×572 copies exactly, fullscreen Command-N opens Connect, exit/ close/reopen preserves size; isolated quit/relaunch preserves 1004×652 and last-used 904×572 across differing windows. System restored one scene; distinct restored frames are test-covered. Same-bundle demo interference prompted clean relaunch repeats.

Full pinned immutable 94ad70f1 avoided concurrent Dock-menu test compilation errors: 1,593 passed/5 failed/8 skipped. Failures: StoreKitTrialTests.annualProductSuppliesPriceBillingPeriodTrialDurationAndEntitlement (JPY vs USD), parallel approval cancellation, Metrics worker lifecycle, MetricsJourneyTests.offlineRestoredMetricsReconcileOnMainActor, TerminalCommandDraftControllerTests.readsOneDraftAndRejectsConcurrentRequests. Only Agent/worker had earlier baseline evidence; no baseline claim/fix for the other three. Results: /tmp/termind-window-sizing-{focused-fixed,snapshot-full}.xcresult.

Metrics clock and short knowledge cards — repaired, full suite still non-green

Metrics tests advanced the manual clock before GPU work/next sleep registration; pre-fix failed 3/5 and a model probe needed another 0.05 s. Await both maintenance/sampling sleeps and preserve caller locations in polling; production Metrics unchanged. Compact SwiftUI details accepted tall proposals; trailing vertical fixedSize restores natural height within scaled cap (short phone fixture 99.33 vs 180 points). Tests classify truncation, checking natural short height and long expand/layout-retain/collapse, not tool names.

macOS lifecycle/knowledge 26 functions passed plus 20/20 lifecycle repeats; all three mobile knowledge tests passed English/zh-Hans/zh-Hant, phone/accessibility; native desktop widths 380/720 retained. Format/localization/diff passed. Full pinned macOS 1,600 passed/1 failed/8 skipped of 1,609, iOS 584/3/0 of 587; repaired tests passed. Remaining macOS parallel-approval failure was recorded earlier. Mobile MobileUploadBatchTests.sftpFolderUploadUsesTheCurrentDirectoryAndOneBatch, MobileEditorToolbarTests.cancelOnlyDismissesUnmodifiedDrafts(isDirty:), MobileAdaptiveLayoutTests.settingsDepthAndUnsavedFormsResetOnlyAcrossWidthClasses passed focused reruns, not proof of baseline/fix. Full mobile bundles finished before optional slow simctl diagnose was interrupted; finalized 587-test result is intact. Pins/APIs/persistence unchanged. Evidence: /tmp/termind-metrics-knowledge-fix-{macos-focused,repeat20,ios-focused,macos-full,ios-full,ios-unrelated-rerun,ios-upload-rerun}.xcresult.

Preserve mobile navigation during resizing — implemented

rg 'layoutTransition|compactMetrics|registrations\(on|scene\.layout' TFI TFITests found two roots, route resets, Metrics copies and reconstruction save gates. Replace with one native sidebar-adaptable TabView/five stable stacks; remove migration/registration/save gating, keep single Metrics shortcut target and save/cancel/error/native terminal ownership. Estimate −150–200, actual −210 production lines; Metrics/Vault search use waveform.path.ecg.

Focused iPad 21/21; phone 20/21 because a test forced unsupported regular class, changing search placement. Corrected native-class/compact-width fixture passed three times on each, retaining iPad width transitions. Coverage preserves pages/Settings/drafts/search/scroll/window independence/save/errors/session instances. English/zh-Hans/zh-Hant normal/ accessibility screenshots reviewed: five titles fit 320/375-point bottom bars; intermediate iPad top bar scrolls with all items selectable. Hosting-window/child resize tests do not mistake native title scaling for truncation. Manual rotation retained Models/icon; Device Hub did not perform corner resizing, covered through frame/trait tests.

Full before fixture corrections: iPad 583/586, phone 584/586, macOS 1,598 passed/1 failed/8 skipped of 1,607. New label/ scroll failures were corrected; other failures were reproduced iPad tab visibility/Host-card height and recorded Mac waveform. No unrelated assertions/production changed; not all-green. Format/localization/diff passed; pins/APIs/stores unchanged. Evidence: /tmp/termind-adaptive-tabs-{ipad,iphone,macos}-full.xcresult, /tmp/termind-adaptive-tabs-final-{ipad,iphone}.xcresult, /tmp/termind-adaptive-tabs-scroll-native-{iphone,ipad}.xcresult.

Window/quit confirmation removal — superseded

rg 'dismissalConfirmationDialog|Quit with unuploaded changes|sftpEdits.recheck' TFM found Workspace close and SFTP quit warnings/five unique strings. Proposed removal preserved native dismissal/pane-first Command-W/ownership/bounded cleanup, estimated −25–35 production lines/five entries. User instead requested both confirmations retained and only the edited indicator hidden; both dialogs/all strings restored.

Close-button edited indicator — implemented, verification pending

Restored SwiftUI WindowGroup sets NSWindow.isDocumentEdited for Workspace confirmation. Isolated Demo probe cleared it while retaining Close Window/Cancel. Attached registration now observes/clears decoration only, preserving dismissal delegate/condition/copy/SFTP quit checks. Visual correction, no code-reduction/API/persistence/package claim.

Free Workspace composition — implemented, full verification stopped by user

rg 'workspaceComposition|window.proAccess' TFM Frameworks found 15 gates, window commerce dependency and launch grant. Remove gates/sticky state, align app/site/StoreKit/docs. Estimate −35–45 production lines plus strings; actual −34/two entries. All 28 composition cases/seven non-Pro states, six remaining Pro gates and entitlement checks passed, plus format/localization/site build/diff. English/zh-Hans/zh-Hant desktop/mobile home/FAQ and legacy Chinese redirects reviewed. User stopped full macOS/iOS tests; before stopping, Mac AgentBackgroundCommand/AgentApprovalQueue/SpeechWaveform failed, without investigation/rerun. No green full-suite claim; App Store Connect metadata remains a release step.

Desktop authentication submission, 2026-09-19 — implemented, full verification pending

rg 'continueAuthentication|submittedPassword|let existing = store.identity|passwordUpdate' in desktop SSH/SFTP models confirmed duplicated fallback/submission/selected Identity updates/custom reuse/Host association. Share two methods on existing Application RemoteSessionHostStore; sessions retain username validation/passphrase continuation/prompts/ errors/ephemeral SFTP secrets/transient SSH Hosts/reconnect ordering. Preserve separate Identity-before-Host writes and secret usage; mobile/Metrics/forwarding keep different save rules. Estimate −40–80, actual −47 production lines; no new model/base/dependency/schema/secret store or localization change. Architecture updated, boundary rules unchanged; existing catalog edit stays outside scope.

Focused 83 functions/105 cases passed: shared policy/desktop entry points, credential usage/preparation/Identity, Journey/SFTP/window lifetimes/architecture. Initial fixture Host ambiguity was fixed with explicit Domain import. Formatting/localization/diff passed; full pinned macOS/iOS pending. Evidence: /tmp/termind-auth-refactor.uUFmoB/focused-macos-2.xcresult with logs/summary/line counts/dependency/catalog fingerprints.

Mobile toolbar policy, 2026-09-19 — implementing

rg 'tabBarPlacement|mobileToolbarLayout' TFI found feature-local Assistant/Metrics fallbacks despite shared stack environment; production already has no idiom/model layout branches. Remove both reads and consume one shared toolbar policy, retaining container geometry/active reserved regions/native identity/OS API checks. Estimate −2 production lines/two duplicate conditions. Native title/menu transitions and fold/session lifetime verification remain pending.

Batch Startup confirmation, 2026-09-19 — implemented, verification pending

rg 'showsWorkspaceChoice|workspaceConfirmLabel|workspaceHelp|openChecked' TFM TFMTests confirmed one chooser-only secondary action and layout parameter. Keep Connect/Return as the single confirmation, explicitly opening one new Workspace for one or more selected SSH/SFTP Hosts. Remove the redundant button/policy/help and three unused localized entries; retain shared BatchLayout for Host context menus. Estimate −45–60 chooser lines; actual −53 including stable accessibility identifiers for behavioral UI coverage. Focus/menu changes are tracked by the same regression run.

Port Forwarding refactor, 2026-09-19 — completed

rg plus Periphery on TFM/TFI confirmed the removable surface. Removed the unused forwarding-library route wrapper and configuration-only session overload, made the direction picker private, and replaced the stateful editor policy with static normalization/start validation that retains rule-ID, Host-ID, saved validity and runtime checks. Shared the otherwise identical Port Forwarding/Known Hosts deletion, pruning and error presentation through one typed managed-card modifier; feature state and transactions remain local. Actual change: −35 production and −73 test lines.

Controller bookkeeping consolidation was rejected: one record would have to encode active generation, stopped-but- serializing work and failed-but-presented Journey state, plus an identity token to safely retire completed tasks after rapid stop/start. The concrete shape adds lifecycle state without reducing code, so the existing dictionaries remain.

Focused 53 tests passed: Framework forwarding/editor/Known Host presentation, desktop forwarding/editor/Journey/ selection, and mobile forwarding/Vault lifecycle. TFM and TFI pinned builds passed. The ordinary TFM test build is currently blocked by unrelated concurrent ColorSystemTests and BroadcastInputTests API edits; the 29 desktop tests passed when only those two files were excluded. Formatting, localization and diff checks passed. Retained boundaries: forwarding/jump pumps, frozen schemas, forwarding authentication/Journey ownership and platform-native card renderers.