diff --git a/.cargo/config.toml b/.cargo/config.toml
index ce4f8c60d..f6000e3d5 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -7,7 +7,7 @@ linker = "rust-lld"
 rustflags = ["-C", "target-feature=+crt-static"]
 
 [alias]
-workshop = "run -p build-workshop --"
+installer = "run -p build-installer --"
 xtask = "run -p build-xtask --"
 # Outlines the workspace with the vibelight checkout next to this repo. Cargo
 # builds it in release mode on first use and rebuilds it when its source
@@ -24,3 +24,8 @@ outline = "run --release --bin vibelight --manifest-path ../vibelight/Cargo.toml
 # identifies it.
 [env]
 CLIPPY_DISABLE_DOCS_LINKS = "1"
+# The runvil-workshop checkout `cargo installer` builds from and its tests
+# read: the one next to this repo, unless the variable is already set. The
+# path is relative to this file's parent's parent, and Cargo passes it on
+# as an absolute path.
+RUNVIL_WORKSHOP = { value = "../runvil-workshop", relative = true }
diff --git a/.cursor/rules/workshop-architecture.mdc b/.cursor/rules/workshop-architecture.mdc
deleted file mode 100644
index 21bb7ec9b..000000000
--- a/.cursor/rules/workshop-architecture.mdc
+++ /dev/null
@@ -1,21 +0,0 @@
----
-description: Workshop server crate architecture invariants - one-way dependency tiers, registry self-registration
-globs: crates/workshop*/**
-alwaysApply: false
----
-
-# Workshop Architecture Invariants
-
-## One-way dependency graph
-
-- Dependencies flow one way: server -> features -> services -> vocabulary. Never add a dependency from a lower tier to a higher one. If Cargo rejects a cycle, the design is wrong, not the graph.
-- Crates in the same tier never depend on each other, with one exception: `workshop-registry` depends on `workshop-protocol`, because the status push-channel slot holds `workshop-protocol`'s `StatusBarUpdate`. Otherwise same-tier crates meet through `workshop-protocol` wire types and `workshop-registry` proxy slots.
-- The desktop app (package `workshop`) sits outside the tiers and depends on `workshop-server-api`, never on `workshop-server`; the facade is its entire view of the server. `cargo test -p build-xtask` enforces this.
-- Every `workshop-*` crate's `lib.rs` opens with a `//!` doc carrying a `## Invariants` marker that lists what the crate may depend on and what it may not. Read it before adding an import.
-- `lib.rs` is a facade only: crate docs, crate-level attributes, `mod` declarations, and `pub use` re-exports. No logic.
-
-## Registry pattern
-
-- Subsystems self-register into `workshop-registry` proxy slots: routes, state handles, background tasks, push channels, and shutdown handles. The composition root (`crates/workshop/server/src/app/compose.rs`) calls each subsystem's `register` by name and requires its concrete handle, so a missing registration fails boot naming the type. Subsystems reach each other only through the registry.
-- Unregistered slots are graceful no-ops. Never add a hard dependency on an optional subsystem.
-- Registration handles are `#[must_use]`; registry traits are sealed so only workshop crates implement them.
diff --git a/.cursor/rules/workshop-spa.mdc b/.cursor/rules/workshop-spa.mdc
deleted file mode 100644
index c722f2170..000000000
--- a/.cursor/rules/workshop-spa.mdc
+++ /dev/null
@@ -1,22 +0,0 @@
----
-description: Workshop SPA conventions - feature directories, barrel exports, lazy loading, CSS colocation, token-only values
-globs: crates/workshop/ui/**,crates/workshop/look/**,crates/workshop/platform/**
-alwaysApply: false
----
-
-# Workshop SPA Conventions
-
-## Feature directories and lazy loading
-
-- The package at `crates/workshop/ui/` is a sibling of the `crates/workshop/server/` crate that builds and serves it. `src/` has three layers: `base/` (paths), `services/` (the app's services and their tokens; services own no views), and `parts/` (feature directories; every panel extends `WorkshopPart` from `@workshop/platform/workshop-part`). All three layers may import `@workshop/platform`, the family's UI mechanics (lifecycle, events, the registries, the context-key and text-control services, the `WorkshopPart` base class), which never imports the app.
-- Feature-based directories under `parts/` (`parts/agent/`, `parts/chatbox/`, `parts/chrome/`, `parts/editor/`, `parts/gateway/`, `parts/layout/`, `parts/menu/`, `parts/quickinput/`, `parts/run/`, `parts/status/`, `parts/stt/`, `parts/take/`, `parts/workspace/`, `parts/workspace-document/`). Shared code is defined with the entry bundle below; the panel dialog helper lives in `parts/shared/`, and the boot-loaded icons come from `@workshop/look/icons`; per-component tokens live in `tokens/component.css`. The workspace tree panel, its `tree` factory, and its Explorer and Primary Side Bar actions live in `parts/workspace/`; `parts/layout/` holds the layout machinery (zones, boot, persistence, and the keybinding dispatcher), and no `parts/layout` module imports `parts/workspace`.
-- A part that the panel registry loads lazily has an `index.ts` as its chunk entry (`crates/workshop/platform/panel-registry.ts`), and other parts need none. Lazy directories export `register()` installing panel factories.
-- The entry bundle is the eagerly loaded composition: `crates/workshop/ui/src/main.ts` and the `*.contribution.ts` modules it imports. Lazy panels never import a module inside it, directly or through another import. Everything else that eager and lazy code both import, such as `@workshop/platform`, `services/`, `base/`, and shared parts modules like `parts/layout/zones.ts`, is shared code. Lazy panels load via dynamic `import()` on first activation.
-- Registration, not central wiring: panel types, menu items, services, socket handlers, keyboard shortcuts, and lifecycle disposal self-register through the panel, menu/command, and service registries. The menu, command, keybinding, and service registries live in `@workshop/platform`.
-
-## CSS colocation and tokens
-
-- CSS lives beside its TypeScript, imported as a side-effect. Never a separate `styles/` tree. Every feature directory is self-contained: its `.ts` and `.css` sit together, plus an `index.ts` when the panel registry loads it lazily. A designer finds the styles for the agent chat at `parts/agent/agent-session.css`, not by grepping a flat directory.
-- No raw color, size, or spacing values in Workshop UI component CSS. The sizes and semantic tiers live in `@workshop/look`: primitives in `look/sizes.css`, intent aliases in `look/semantic.css`. Per-component overrides live in `ui/src/tokens/component.css`. Sizes and elevation are themed in `look/semantic.css`, and colors in `look/tokens.css`, which `look`'s own component sheets read directly.
-- CSS classes use the `.ws-` project prefix (`.ws-agent-toolbar`).
-- Directories and files are kebab-case (`agent-session-view.ts`, `agent-session.css`).
diff --git a/.gitattributes b/.gitattributes
index 2175e3a17..d9e86b829 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -6,19 +6,3 @@
 *.icns binary
 *.gguf binary
 *.bin binary
-# The UI sources are bundled by esbuild; CRLF conversion on Windows
-# checkouts would change bundle bytes between platforms.
-crates/gateway/config-ui/ui/** text eol=lf
-crates/workshop/ui/** text eol=lf
-crates/workshop/look/** text eol=lf
-crates/workshop/platform/** text eol=lf
-# Images are not text; the blanket rules above must not convert them.
-crates/gateway/config-ui/ui/**/*.png binary
-crates/workshop/ui/**/*.png binary
-crates/workshop/look/**/*.png binary
-# The event-log schema canary pins the version-1 file exactly as the log
-# writer emits it (LF); autocrlf must not rewrite it on Windows checkouts.
-crates/workshop/server/tests/it/observer/*.jsonl text eol=lf
-# The Gateway discovery contract's golden fixtures are compared byte for
-# byte against what the writer emits (LF); a checkout must not rewrite them.
-crates/workshop/gateway-discovery/fixtures/*.json text eol=lf
diff --git a/.githooks/pre-push b/.githooks/pre-push
index 3d194b94f..75507d3b9 100755
--- a/.githooks/pre-push
+++ b/.githooks/pre-push
@@ -3,10 +3,10 @@
 set -e
 
 echo "==> Running docs-claims wording scan..."
-node --test crates/workshop/ui/test/docs-claims.mjs
+node --test tools/docs-claims.mjs
 
 echo "==> Running Clippy on workspace..."
-CARGO_BUILD_WARNINGS=deny cargo clippy --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-targets --all-features
+CARGO_BUILD_WARNINGS=deny cargo clippy --workspace --all-targets --all-features
 
 if command -v cargo-deny >/dev/null 2>&1; then
     echo "==> Running cargo deny check..."
diff --git a/.github/actions/workshop-checkout/action.yml b/.github/actions/workshop-checkout/action.yml
new file mode 100644
index 000000000..84821dc9c
--- /dev/null
+++ b/.github/actions/workshop-checkout/action.yml
@@ -0,0 +1,63 @@
+name: Check out Workshop
+description: >-
+  Checks out cppalliance/runvil-workshop into runvil-workshop/, at the commit
+  the root Cargo.toml pins or at the ref given, and sets RUNVIL_WORKSHOP to
+  the checkout. Run it after the checkout of this repository.
+
+inputs:
+  ref:
+    description: >-
+      The runvil-workshop commit, branch or tag to check out. Empty takes the
+      commit [workspace.metadata.workshop] pins in the root Cargo.toml.
+    required: false
+    default: ""
+
+outputs:
+  sha:
+    description: The runvil-workshop commit that was checked out.
+    value: ${{ steps.report.outputs.sha }}
+
+runs:
+  using: composite
+  steps:
+    # awk, not a TOML parser, because the action runs on every runner image
+    # and the Python that Ubuntu 22.04 ships has no tomllib. The value must
+    # then be a full commit id, so a pin the scan misread, a branch name or
+    # a short id stops the job here.
+    - name: Read the Workshop pin
+      id: pin
+      shell: bash
+      env:
+        REF: ${{ inputs.ref }}
+      run: |
+        set -euo pipefail
+        if [ -n "$REF" ]; then
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+          echo "Workshop ref (given): $REF"
+          exit 0
+        fi
+        rev=$(awk '
+          /^\[workspace\.metadata\.workshop\]/ { table = 1; next }
+          /^\[/ { table = 0 }
+          table && /^rev[ \t]*=/ { gsub(/[ \t"\r]/, ""); sub(/^rev=/, ""); print }
+        ' Cargo.toml)
+        [[ "$rev" =~ ^[0-9a-f]{40}$ ]] ||
+          { echo "[workspace.metadata.workshop] in Cargo.toml must give rev as a 40-digit commit id, got '$rev'"; exit 1; }
+        echo "ref=$rev" >> "$GITHUB_OUTPUT"
+        echo "Workshop ref (pinned): $rev"
+
+    - uses: actions/checkout@v4
+      with:
+        repository: cppalliance/runvil-workshop
+        ref: ${{ steps.pin.outputs.ref }}
+        path: runvil-workshop
+
+    - name: Report the Workshop checkout
+      id: report
+      shell: bash
+      run: |
+        set -euo pipefail
+        sha=$(git -C runvil-workshop rev-parse HEAD)
+        echo "sha=$sha" >> "$GITHUB_OUTPUT"
+        echo "RUNVIL_WORKSHOP=$GITHUB_WORKSPACE/runvil-workshop" >> "$GITHUB_ENV"
+        echo "Workshop SHA: $sha"
diff --git a/.github/fixtures/workshop-package-smoke/gateway.state.toml b/.github/fixtures/workshop-package-smoke/gateway.state.toml
deleted file mode 100644
index b7c227214..000000000
--- a/.github/fixtures/workshop-package-smoke/gateway.state.toml
+++ /dev/null
@@ -1 +0,0 @@
-active_profile = "main"
diff --git a/.github/fixtures/workshop-package-smoke/gateway.toml b/.github/fixtures/workshop-package-smoke/gateway.toml
deleted file mode 100644
index 15c6eaa33..000000000
--- a/.github/fixtures/workshop-package-smoke/gateway.toml
+++ /dev/null
@@ -1,9 +0,0 @@
-config-version = 0
-
-[server]
-bind = "127.0.0.1:0"
-api_key = "release-smoke"
-
-[[profile]]
-name = "main"
-models = []
diff --git a/.github/installers/cell.ps1 b/.github/installers/cell.ps1
index 982717121..7dd864032 100644
--- a/.github/installers/cell.ps1
+++ b/.github/installers/cell.ps1
@@ -3,18 +3,20 @@
 # are present and that each present one runs, then runs the selection's
 # Windows-only check (update, relaunch, rerun, or rejections).
 #
-# Usage: cell.ps1 <setup> <selection> <version>
-#   <setup>      the NSIS -setup.exe
-#   <selection>  all, workshop, gateway, gateway-stt, or rejections
-#   <version>    the version Workshop must print; the Gateway must print the
-#                version gateway-pin/pin.json names
+# Usage: cell.ps1 <setup> <selection> <version> <gateway-version>
+#   <setup>            the NSIS -setup.exe
+#   <selection>        all, workshop, gateway, gateway-stt, or rejections
+#   <version>          the version Workshop must print
+#   <gateway-version>  the version the Gateway must print: the release the
+#                      Workshop checkout the setup was built from pins
 #
 # Environment:
 #   CELL_LOGS    write the logs here (default: a new temporary directory)
 param(
   [Parameter(Mandatory = $true, Position = 0)][string]$Setup,
   [Parameter(Mandatory = $true, Position = 1)][string]$Selection,
-  [Parameter(Mandatory = $true, Position = 2)][string]$Version
+  [Parameter(Mandatory = $true, Position = 2)][string]$Version,
+  [Parameter(Mandatory = $true, Position = 3)][string]$GatewayVersion
 )
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
@@ -36,10 +38,6 @@ if (-not $selections.ContainsKey($Selection)) {
   Fail "selection must be all, workshop, gateway, gateway-stt, or rejections; got '$Selection'"
 }
 $want = $selections[$Selection]
-# The setup carries the Gateway release the repository pins.
-$pin = Join-Path $PSScriptRoot '..\..\gateway-pin\pin.json'
-$gatewayVersion = (Get-Content -LiteralPath $pin -Raw | ConvertFrom-Json).version
-if (-not $gatewayVersion) { Fail "$pin names no Gateway version" }
 
 $root = Join-Path $env:LOCALAPPDATA 'Runvil'
 $profileDir = Join-Path $env:USERPROFILE '.runvil'
@@ -278,7 +276,7 @@ function Test-Selection($Want) {
   # 3. Every present executable prints the version.
   foreach ($check in @(
       @{ Wanted = $Want.Workshop; Exe = $workshopExe; Expected = "runvil-workshop $Version" },
-      @{ Wanted = $Want.Gateway; Exe = $gatewayExe; Expected = "runvil-gateway $gatewayVersion" })) {
+      @{ Wanted = $Want.Gateway; Exe = $gatewayExe; Expected = "runvil-gateway $GatewayVersion" })) {
     if (-not $check.Wanted) { continue }
     $output = (& $check.Exe --version | Out-String).Trim()
     if ($output -ne $check.Expected) { Fail "$($check.Exe) --version printed '$output', required '$($check.Expected)'" }
diff --git a/.github/installers/cell.sh b/.github/installers/cell.sh
index 2f0d8f1e2..4fae2cfae 100644
--- a/.github/installers/cell.sh
+++ b/.github/installers/cell.sh
@@ -3,11 +3,12 @@
 # selection with the Qt IFW installer, then checks that exactly the selected
 # components are present and that each present one runs.
 #
-# Usage: cell.sh <installer> <selection> <version>
-#   <installer>  the .dmg on macOS, the .run on Linux
-#   <selection>  all, workshop, or gateway
-#   <version>    the version Workshop must print; the Gateway must print the
-#                version gateway-pin/pin.json names
+# Usage: cell.sh <installer> <selection> <version> <gateway-version>
+#   <installer>        the .dmg on macOS, the .run on Linux
+#   <selection>        all, workshop, or gateway
+#   <version>          the version Workshop must print
+#   <gateway-version>  the version the Gateway must print: the release the
+#                      Workshop checkout the installer was built from pins
 #
 # Environment:
 #   CELL_ROOT    install here (IFW --root) instead of the default location,
@@ -22,10 +23,12 @@ fail() {
   exit 1
 }
 
-[ "$#" -eq 3 ] || fail "usage: cell.sh <installer> <all|workshop|gateway> <version>; got $# arguments"
+[ "$#" -eq 4 ] || fail "usage: cell.sh <installer> <all|workshop|gateway> <version> <gateway-version>; got $# arguments"
 installer=$1
 selection=$2
 version=$3
+gateway_version=$4
+[ -n "$gateway_version" ] || fail "the Gateway version is empty"
 [ -f "$installer" ] || fail "installer $installer does not exist"
 case "$installer" in
   /*) ;;
@@ -43,10 +46,6 @@ esac
 ids=""
 [ "$want_workshop" = 0 ] || ids="$ids com.runvil.workshop"
 [ "$want_gateway" = 0 ] || ids="$ids com.runvil.gateway"
-# The installers carry the Gateway release the repository pins.
-pin="$(cd "$(dirname "$0")/../.." && pwd)/gateway-pin/pin.json"
-gateway_version=$(python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["version"])' "$pin") ||
-  fail "cannot read the Gateway version from $pin"
 
 system=$(uname -s)
 profile="$HOME/.runvil"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index efa31fe39..c4320a69d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,50 +26,38 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
       - name: Clippy
         env:
           CARGO_BUILD_WARNINGS: deny
-        run: cargo clippy --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-targets --all-features
+        run: cargo clippy --workspace --all-targets --all-features
 
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
+      # One test of build-installer reads the pinned Workshop: it compares
+      # the names the installers lay the payload out under with the names
+      # Workshop looks for.
+      - name: Check out Workshop
+        uses: ./.github/actions/workshop-checkout
+
       - name: Install cargo-nextest
         uses: taiki-e/install-action@4dc1969decfa71b34f25aa7f3dd4656654d9ad1e # nextest
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
       - name: Test (concurrent via nextest)
-        run: cargo nextest run --locked --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-features
+        run: cargo nextest run --locked --workspace --all-features
 
-      # No build step may write into the repository (the UI bundles build
-      # into OUT_DIR now); catch a regression here rather than in a diff.
+      # No test may write into the repository; catch a regression here
+      # rather than in a diff.
       - name: Clean tree
         shell: bash
         run: |
           if [ -n "$(git status --porcelain)" ]; then
-            echo "the build dirtied the repository:"
+            echo "the tests dirtied the repository:"
             git status --porcelain
             exit 1
           fi
@@ -84,128 +72,12 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
       - name: Docs
-        run: cargo doc --workspace --no-deps --all-features --exclude workshop --exclude workshop-server --exclude workshop-server-api
-
-  check-workshop:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install cargo-nextest
-        uses: taiki-e/install-action@4dc1969decfa71b34f25aa7f3dd4656654d9ad1e # nextest
+        run: cargo doc --workspace --no-deps --all-features
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
-      - name: Stage a stub Gateway sidecar
-        run: node tools/fetch-gateway-sidecar.mjs --stub --target x86_64-pc-windows-msvc
-
-      # workshop-server-api is the desktop app's re-export view of workshop-server,
-      # so it runs in this partition with the crates it fronts and stays
-      # out of the workspace-wide jobs like them.
-      - name: Clippy (workshop)
-        env:
-          CARGO_BUILD_WARNINGS: deny
-        run: cargo clippy -p workshop -p workshop-server -p workshop-server-api --all-targets
-
-      # The Workshop crates' suites, including the workspace jail's Windows
-      # paths.
-      - name: Test (Windows)
-        shell: bash
-        run: >-
-          cargo nextest run --locked
-          -p workshop -p workshop-server -p workshop-server-api -p workshop-workspace
-          -E 'package(workshop) | package(workshop-server) | package(workshop-server-api)
-          | package(workshop-workspace)'
-
-      - name: Docs (workshop-server, private items)
-        env:
-          RUSTDOCFLAGS: -D warnings
-        run: cargo doc --locked --no-deps -p workshop-server --document-private-items
-
-      - name: Remove Gateway sidecar
-        if: always()
-        run: node tools/stage-gateway-sidecar.mjs remove --target x86_64-pc-windows-msvc
-
-      - name: Clean tree
-        shell: bash
-        run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "the build dirtied the repository:"
-            git status --porcelain
-            exit 1
-          fi
-
-  # First Linux build of the desktop app: compile-only, against the Tauri
-  # system packages a Linux developer installs. Catches the
-  # missing-system-package class of failure the Windows-only job cannot see.
-  check-workshop-linux:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      # A mirror that does not answer makes apt-get wait for a long time, so
-      # the step fails after 20 minutes. It normally takes under one.
-      - name: Install Tauri system packages
-        timeout-minutes: 20
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev libssl-dev librsvg2-dev
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
-      - name: Stage a stub Gateway sidecar
-        run: node tools/fetch-gateway-sidecar.mjs --stub --target x86_64-unknown-linux-gnu
-
-      - name: Build (workshop, Linux)
-        run: cargo build --locked -p workshop
-
-      - name: Remove Gateway sidecar
-        if: always()
-        run: node tools/stage-gateway-sidecar.mjs remove --target x86_64-unknown-linux-gnu
-
-      - name: Clean tree
-        shell: bash
-        run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "the build dirtied the repository:"
-            git status --porcelain
-            exit 1
-          fi
-
-  # The UI build is its own job: typecheck, bundle, and test. The cargo
-  # jobs drive the same bundle through the crates' build scripts, hence
-  # their npm ci.
-  ui:
+  # The wording scan reads the rulebooks with Node's own modules, so it
+  # needs no install.
+  wording:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -213,24 +85,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        working-directory: crates/workshop
-        run: npm ci
-
-      - name: Typecheck
-        working-directory: crates/workshop
-        run: npm run typecheck --workspaces --if-present
 
-      - name: Build
-        working-directory: crates/workshop
-        run: npm run build --workspace ui
-
-      - name: Test
-        working-directory: crates/workshop
-        run: npm test --workspaces --if-present
+      - name: Wording
+        run: node --test tools/docs-claims.mjs
 
   supply-chain:
     runs-on: ubuntu-latest
@@ -247,35 +104,13 @@ jobs:
       - name: cargo audit
         run: cargo audit
 
-      # The Workshop binary links exactly one rustls crypto backend,
-      # aws-lc-rs. This fails when `ring` re-enters its normal-edge closure
-      # (through a reqwest bump or a Tauri plugin default) and when
-      # `cargo tree` itself cannot run; only a successful, ring-free result
-      # passes. The Gateway has its own repository and its own checks.
-      - name: One rustls crypto backend in the Workshop
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! out="$(cargo tree --locked -p workshop -e normal -i ring --depth 0 2>&1)"; then
-            echo "cargo tree failed:"
-            printf '%s\n' "$out"
-            exit 1
-          fi
-          if printf '%s\n' "$out" | grep -v '^warning: nothing to print' | grep -q '^ring v'; then
-            echo "ring is linked into the workshop; aws-lc-rs is the only permitted rustls backend"
-            printf '%s\n' "$out"
-            exit 1
-          fi
-
   # The custom lints, the dylint library in cppalliance/dylints at the
   # rev the root Cargo.toml's [workspace.metadata.dylint] pins. `cargo
   # dylint` fetches it and builds it on the nightly in its
   # rust-toolchain.toml, which rustup installs with that file's components;
-  # the date is never repeated here. Its UI tests run in its own CI.
-  # `cargo dylint` checks every crate, the desktop app included, so this
-  # job installs what check-workshop-linux does. It runs on 24.04, not
-  # check-workshop-linux's 22.04: the prebuilt cargo-dylint and
-  # dylint-link binaries need glibc 2.38 or later, and 22.04 ships 2.35.
+  # the date is never repeated here. Its UI tests run in its own CI. The
+  # job runs on 24.04: the prebuilt cargo-dylint and dylint-link binaries
+  # need glibc 2.38 or later.
   dylint:
     runs-on: ubuntu-24.04
     steps:
@@ -290,33 +125,9 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      # A mirror that does not answer makes apt-get wait for a long time, so
-      # the step fails after 20 minutes. It normally takes under one.
-      - name: Install Tauri system packages
-        timeout-minutes: 20
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev libssl-dev librsvg2-dev
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
-
-      - name: Install UI dependencies
-        run: npm ci --prefix crates/workshop
-
-      - name: Stage a stub Gateway sidecar
-        run: node tools/fetch-gateway-sidecar.mjs --stub --target x86_64-unknown-linux-gnu
-
       - name: Dylint
         run: cargo dylint --all -- --locked --workspace --all-targets --all-features
 
-      - name: Remove Gateway sidecar
-        if: always()
-        run: node tools/stage-gateway-sidecar.mjs remove --target x86_64-unknown-linux-gnu
-
       - name: Clean tree
         shell: bash
         run: |
@@ -332,7 +143,7 @@ jobs:
   # or that job bypasses this gate.
   ci-green:
     runs-on: ubuntu-latest
-    needs: [fmt, clippy, test, docs, check-workshop, check-workshop-linux, ui, supply-chain, dylint]
+    needs: [fmt, clippy, test, docs, wording, supply-chain, dylint]
     if: always()
     steps:
       - name: Verify every job succeeded
diff --git a/.github/workflows/installers.yml b/.github/workflows/installers.yml
index 7dae76998..682277c83 100644
--- a/.github/workflows/installers.yml
+++ b/.github/workflows/installers.yml
@@ -6,13 +6,20 @@ run-name: Runvil installers (${{ github.event_name == 'push' && github.ref_name
 # each kind, and assembles and verifies latest.json and SHA256SUMS. A
 # vX.Y.Z tag then publishes the release; any failed cell means no release.
 #
+# Workshop is its own product in cppalliance/runvil-workshop. Every job
+# that builds takes it at the commit the root Cargo.toml pins in
+# [workspace.metadata.workshop], and cargo installer builds its bundle
+# there with cargo workshop bundle. The Gateway is the release that
+# checkout pins.
+#
 # Modes, which prepare reads from the event:
 # - release: a pushed vX.Y.Z tag naming the workspace version. Signs with
-#   the release key and publishes.
+#   the release key and publishes. It always builds the pinned Workshop.
 # - full: a dispatched run on any ref. Every cell runs; the installers stay
-#   as workflow artifacts for 7 days and nothing is published.
-# - pull-request: a pull request touching the installer paths below. Two
-#   cells per platform.
+#   as workflow artifacts for 7 days and nothing is published. The
+#   workshop-ref input builds another Workshop commit than the pinned one.
+# - pull-request: a pull request touching the installer paths below, the
+#   Workshop pin among them. Two cells per platform.
 # Every mode builds with --sign. Outside release the key is a run key that
 # prepare generates and nothing trusts, so the manifest job checks the same
 # signatures a release has.
@@ -22,30 +29,22 @@ on:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
+    inputs:
+      workshop-ref:
+        description: A runvil-workshop commit, branch or tag to build in place of the pinned commit
+        required: false
+        default: ""
   pull_request:
     paths:
       - .github/workflows/installers.yml
       - .github/installers/**
+      - .github/actions/**
+      - .cargo/config.toml
       - Cargo.toml
       - Cargo.lock
       - LICENSE
-      - crates/build-workshop/**
-      - crates/workshop/desktop/installer.nsi
-      - crates/workshop/desktop/build.rs
-      - crates/workshop/desktop/src/gateway/**
-      - crates/workshop/desktop/*.plist
-      - crates/workshop/desktop/tauri*.conf.json
-      - crates/workshop/desktop/icons/**
-      - crates/workshop/plugin-std/**
-      - crates/workshop/plugin-bashkit/**
-      - crates/workshop/package.json
-      - crates/workshop/package-lock.json
-      - crates/workshop/gateway-discovery/src/**
-      - gateway-pin/**
-      - tools/fetch-gateway-sidecar.mjs
-      - tools/gateway-archive.mjs
-      - tools/gateway-pin.mjs
-      - tools/stage-gateway-sidecar.mjs
+      - rust-toolchain.toml
+      - crates/build-installer/**
 
 permissions:
   contents: read
@@ -62,6 +61,8 @@ jobs:
       version: ${{ steps.identity.outputs.version }}
       mode: ${{ steps.identity.outputs.mode }}
       cells: ${{ steps.cells.outputs.cells }}
+      workshop-sha: ${{ steps.workshop.outputs.sha }}
+      gateway-version: ${{ steps.gateway.outputs.version }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -147,12 +148,41 @@ jobs:
           echo "cells=$cells" >> "$GITHUB_OUTPUT"
           echo "Cells: $(jq '.include | length' <<< "$cells")" | tee -a "$GITHUB_STEP_SUMMARY"
 
+      # Every later job checks out the commit this step resolves, so a
+      # branch given as workshop-ref cannot move between jobs. A tag builds
+      # the pinned commit whatever the input says.
+      - name: Check out Workshop
+        id: workshop
+        uses: ./.github/actions/workshop-checkout
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.workshop-ref || '' }}
+
+      # The installers hold the Gateway release the Workshop checkout pins,
+      # and the install cells require that version of an installed Gateway.
+      - name: Read the Gateway version
+        id: gateway
+        shell: bash
+        env:
+          WORKSHOP_SHA: ${{ steps.workshop.outputs.sha }}
+        run: |
+          set -euo pipefail
+          pin=runvil-workshop/gateway-pin/pin.json
+          version=$(python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["version"])' "$pin") ||
+            { echo "cannot read the Gateway version from $pin"; exit 1; }
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]] ||
+            { echo "$pin names the Gateway version '$version', which is not a version"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          {
+            echo "Workshop SHA: $WORKSHOP_SHA"
+            echo "Gateway version: $version"
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
       - uses: actions/setup-node@v4
         if: steps.identity.outputs.mode != 'release'
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
+          cache-dependency-path: runvil-workshop/crates/workshop/package-lock.json
 
       # Nothing trusts this key: released Workshops embed only the release
       # key, and tauri build only warns when the key does not match
@@ -164,9 +194,9 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          npm ci --prefix crates/workshop
+          npm ci --prefix runvil-workshop/crates/workshop
           mkdir -p "$RUNNER_TEMP/run-key"
-          node crates/workshop/node_modules/@tauri-apps/cli/tauri.js signer generate --ci -w "$RUNNER_TEMP/run-key/run.key"
+          node runvil-workshop/crates/workshop/node_modules/@tauri-apps/cli/tauri.js signer generate --ci -w "$RUNNER_TEMP/run-key/run.key"
           test -s "$RUNNER_TEMP/run-key/run.key"
           test -s "$RUNNER_TEMP/run-key/run.key.pub"
 
@@ -231,32 +261,45 @@ jobs:
           [ "$actual" = "$expected" ] || { echo "checkout $actual does not match execution SHA $expected"; exit 1; }
           echo "Execution SHA: $actual"
 
+      - name: Check out Workshop
+        uses: ./.github/actions/workshop-checkout
+        with:
+          ref: ${{ needs.prepare.outputs.workshop-sha }}
+
       - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
 
       - name: Add the Rust target
         run: rustup target add ${{ matrix.triple }}
 
+      # Workshop builds into its own target directory, which is by far the
+      # larger of the two.
       - name: Cache cargo
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: ${{ matrix.triple }}
+          workspaces: |
+            . -> target
+            runvil-workshop -> target
 
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: crates/workshop/package-lock.json
+          cache-dependency-path: runvil-workshop/crates/workshop/package-lock.json
 
-      # The workshop install brings the pinned Tauri CLI.
+      # Workshop's install brings the pinned Tauri CLI, which cargo workshop
+      # bundle runs.
       - name: Install UI dependencies
         shell: bash
-        run: npm ci --prefix crates/workshop
+        run: npm ci --prefix runvil-workshop/crates/workshop
 
-      # The Gateway is its own product: every installer carries the release
-      # gateway-pin/pin.json names, which the fetch verifies against the
-      # pin's sha256 and stages where cargo workshop installer reads it.
+      # The Gateway is its own product: every installer holds the release
+      # the Workshop checkout's gateway-pin/pin.json names, which its fetch
+      # script verifies against the pin's sha256 and stages where cargo
+      # workshop bundle and cargo installer read it.
       - name: Stage the pinned Gateway
         shell: bash
+        working-directory: runvil-workshop
         env:
           GH_TOKEN: ${{ github.token }}
         run: node tools/fetch-gateway-sidecar.mjs --target ${{ matrix.triple }}
@@ -315,8 +358,8 @@ jobs:
           [ "$count" = 1 ] || { echo "the Qt IFW archive must hold exactly one bin/binarycreator, found $count: $found"; exit 1; }
           echo "QTIFWDIR=$(dirname "$(dirname "$found")")" >> "$GITHUB_ENV"
 
-      # The Gateway version check inside cargo workshop installer runs the
-      # x86_64 Gateway.
+      # The Gateway version checks inside cargo workshop bundle and cargo
+      # installer run the x86_64 Gateway.
       - name: Install Rosetta
         if: matrix.platform == 'macos-intel'
         run: |
@@ -345,10 +388,11 @@ jobs:
             TAURI_SIGNING_PRIVATE_KEY_PASSWORD=
             export TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD
           fi
-          cargo workshop installer --target ${{ matrix.triple }} --sign
+          cargo installer --target ${{ matrix.triple }} --sign
 
-      # The Gateway reaches the setup only through tauri.windows.conf.json's
-      # externalBin; 7-Zip lists an NSIS setup's files.
+      # The Gateway reaches the setup only through Workshop's
+      # tauri.windows.conf.json, as an externalBin; 7-Zip lists an NSIS
+      # setup's files.
       - name: The setup carries the Gateway
         if: matrix.platform == 'windows'
         shell: bash
@@ -357,14 +401,20 @@ jobs:
           listing=$(7z l "$setup")
           grep -F runvil-gateway.exe <<< "$listing" || { echo "$listing"; echo "runvil-gateway.exe is not in $setup"; exit 1; }
 
-      - name: Clean tree
+      # Neither build may write into its checkout. This repository ignores
+      # the Workshop checkout, so each tree is asked for itself.
+      - name: Clean trees
         shell: bash
         run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "the installer build dirtied the repository:"
-            git status --porcelain
-            exit 1
-          fi
+          status=0
+          for tree in . runvil-workshop; do
+            if [ -n "$(git -C "$tree" status --porcelain)" ]; then
+              echo "the installer build dirtied the checkout at $tree:"
+              git -C "$tree" status --porcelain
+              status=1
+            fi
+          done
+          exit $status
 
       - name: Upload the installer and updater files
         uses: actions/upload-artifact@v4
@@ -436,7 +486,7 @@ jobs:
           shopt -s nullglob
           installers=(dist/*-setup.dmg dist/*-setup.run)
           [ "${#installers[@]}" -eq 1 ] || { echo "the artifact must hold one installer, found ${#installers[@]}"; ls dist; exit 1; }
-          bash .github/installers/cell.sh "${installers[0]}" "${{ matrix.selection }}" "${{ needs.prepare.outputs.version }}"
+          bash .github/installers/cell.sh "${installers[0]}" "${{ matrix.selection }}" "${{ needs.prepare.outputs.version }}" "${{ needs.prepare.outputs.gateway-version }}"
 
       - name: Install and check (Windows)
         if: runner.os == 'Windows'
@@ -446,7 +496,7 @@ jobs:
         run: |
           $setups = @(Get-ChildItem dist | Where-Object { $_.Name -like '*-setup.exe' })
           if ($setups.Count -ne 1) { throw "the artifact must hold one setup, found $($setups.Count)" }
-          & .github/installers/cell.ps1 $setups[0].FullName '${{ matrix.selection }}' '${{ needs.prepare.outputs.version }}'
+          & .github/installers/cell.ps1 $setups[0].FullName '${{ matrix.selection }}' '${{ needs.prepare.outputs.version }}' '${{ needs.prepare.outputs.gateway-version }}'
 
       # cancelled() covers the job timeout, so a hung cell keeps its logs.
       - name: Upload the cell's logs
@@ -474,6 +524,13 @@ jobs:
           [ "$actual" = "$expected" ] || { echo "checkout $actual does not match execution SHA $expected"; exit 1; }
           echo "Execution SHA: $actual"
 
+      # A release verifies against the updater key in Workshop's
+      # tauri.conf.json.
+      - name: Check out Workshop
+        uses: ./.github/actions/workshop-checkout
+        with:
+          ref: ${{ needs.prepare.outputs.workshop-sha }}
+
       - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
 
       - name: Cache cargo
@@ -495,8 +552,9 @@ jobs:
           name: run-signing-key
           path: ${{ runner.temp }}/run-key
 
-      # A release verifies against plugins.updater.pubkey in tauri.conf.json,
-      # the key every installed copy trusts; other modes against the run key.
+      # A release verifies against plugins.updater.pubkey in Workshop's
+      # tauri.conf.json, the key every installed copy trusts; other modes
+      # against the run key.
       - name: Assemble and verify latest.json and SHA256SUMS
         shell: bash
         env:
@@ -508,7 +566,7 @@ jobs:
           if [ "$MODE" != release ]; then
             key=(--public-key "$RUNNER_TEMP/run-key/run.key.pub")
           fi
-          cargo workshop manifest --assets "$RUNNER_TEMP/release" \
+          cargo installer manifest --assets "$RUNNER_TEMP/release" \
             --base-url "https://github.com/$GITHUB_REPOSITORY/releases/download/v$VERSION" "${key[@]}"
           cat "$RUNNER_TEMP/release/latest.json" "$RUNNER_TEMP/release/SHA256SUMS"
 
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 80ff28f83..8b29dc60f 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -2,8 +2,9 @@ name: Deploy docs site to Pages
 on:
   push:
     branches: [main, master]
-  # The chapters live in cppalliance/runvil-docs, whose pushes do not
-  # start this workflow, so a nightly run publishes them.
+  # The chapters live in cppalliance/runvil-docs and the documented crates
+  # in cppalliance/runvil-harness. A push to either does not start this
+  # workflow, so a nightly run publishes them.
   schedule:
     - cron: "17 7 * * *"
   workflow_dispatch:
@@ -28,6 +29,7 @@ jobs:
     env:
       MDBOOK_VERSION: 0.4.44
       RUNVIL_DOCS: ${{ github.workspace }}/runvil-docs
+      RUNVIL_HARNESS: ${{ github.workspace }}/runvil-harness
     steps:
       - uses: actions/checkout@v4
 
@@ -36,6 +38,14 @@ jobs:
           repository: cppalliance/runvil-docs
           path: runvil-docs
 
+      # Only the full site documents the crates; a books-only build reads
+      # no harness checkout.
+      - uses: actions/checkout@v4
+        if: github.event_name != 'pull_request'
+        with:
+          repository: cppalliance/runvil-harness
+          path: runvil-harness
+
       - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
 
       - name: Cache cargo
@@ -46,8 +56,9 @@ jobs:
           wget -q "https://github.com/rust-lang/mdBook/releases/download/v${MDBOOK_VERSION}/mdbook-v${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
           tar xzf "mdbook-v${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
 
-      # The ci.yml docs job already builds both facade rustdocs on every PR,
-      # so PR runs build only the books and the landing page.
+      # The documented crates are in cppalliance/runvil-harness, whose own CI
+      # builds their rustdoc on every PR, so PR runs here build only the
+      # books and the landing page.
       - name: Build books
         if: github.event_name == 'pull_request'
         run: MDBOOK="$PWD/mdbook" cargo xtask site --books-only
diff --git a/.gitignore b/.gitignore
index b5ffadc33..68f8dff7d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-/.model-cache/
 /target
 /vibe-review.md
 /conformance-audit.md
@@ -7,19 +6,6 @@
 *.env
 # Standing guard: the operator's real secrets file must never be tracked.
 /secrets.env
-# Voice test fixtures, downloaded out of band (see design/design-runvil-workshop.md).
-/crates/gateway/stt/backend-whisper/tests/fixtures/
-# UI build pipeline: npm install target and the esbuild output. The build
-# scripts write the bundle to OUT_DIR; `npm run build`/`--watch` still write
-# dist/ in place for the jsdom tests, and none of it is tracked.
-/crates/workshop/**/node_modules/
-/crates/gateway/config-ui/ui/node_modules/
-/crates/workshop/ui/dist/
-/crates/gateway/config-ui/ui/dist/
-# tauri-build's generated ACL schemas, regenerated on every workshop build.
-/crates/workshop/desktop/gen/
-# The Windows gateway sidecar staged for bundle.externalBin before
-# `tauri build` (crates/workshop/desktop/tauri.windows.conf.json); a build
-# artifact.
-/crates/workshop/desktop/binaries/
-/plan-dist-manifest.json
+# The runvil-workshop checkout CI places inside this one
+# (.github/actions/workshop-checkout); a local checkout sits beside it.
+/runvil-workshop/
diff --git a/AGENTS.md b/AGENTS.md
index c0c2ecc2c..3bf58439f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # Runvil
 
-Multi-crate Rust workspace for Workshop, a Host, and the tooling that builds its installers. The Engine and the Harness are in their own repository, `cppalliance/runvil-harness`, which the root `Cargo.toml` pins by commit. The Gateway is a separate product in its own repository, `cppalliance/runvil-gateway`.
+Multi-crate Rust workspace for the tooling that builds the Runvil installers and the documentation site. Workshop, a Host, is in its own repository, `cppalliance/runvil-workshop`, which the root `Cargo.toml` pins by commit in `[workspace.metadata.workshop]`; the installers are built from that commit. The Engine and the Harness are in `cppalliance/runvil-harness`, and the Gateway is a separate product in `cppalliance/runvil-gateway`.
 
 ## Definitions
 
@@ -19,7 +19,7 @@ Seven terms have exactly one meaning each, everywhere in this repository: code c
 - "Host", in any capitalization, means only the Host. Other senses use another word: "machine", "real files", "Engine globals", "Engine call", the part's own name ("the desktop app"), or a verb such as run, serve, embed, or hold.
 - "Engine", "Harness", and "Plugin" mean only the defined terms. Anything else gets a qualified lowercase name, such as the Gateway's speech engine or a Tauri plugin. This repository's own checks are "structural checks", "test support", or "fixtures".
 - Names defined elsewhere keep their own meaning (the HTTP `Host` header, Cargo's `harness = false`), crate names are written as they are, and quotations of people stay verbatim.
-- `crates/workshop/ui/test/docs-claims.mjs` enforces these rules in every `AGENTS.md`, every `## Invariants` crate doc, and every `.cursor/rules` file.
+- `tools/docs-claims.mjs` enforces these rules in every `AGENTS.md`, every `## Invariants` crate doc, and every `.cursor/rules` file.
 
 ## Principles
 
@@ -40,13 +40,13 @@ Seven terms have exactly one meaning each, everywhere in this repository: code c
 
 ## Verification
 
-- Tests: `cargo nextest run --locked --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-features`, and `cargo nextest run --locked -p workshop -p workshop-server -p workshop-server-api`.
-- Lint: `cargo clippy --workspace --exclude workshop --exclude workshop-server --exclude workshop-server-api --all-targets --all-features`, and `cargo clippy -p workshop -p workshop-server -p workshop-server-api --all-targets`, both with `CARGO_BUILD_WARNINGS=deny`. Clippy covers `cargo check`, so never run a standalone `cargo check --workspace`.
+- Tests: `cargo nextest run --locked --workspace --all-features`. One test of `build-installer` reads the Workshop checkout that `RUNVIL_WORKSHOP` names, which `.cargo/config.toml` sets to the checkout beside this repository unless the variable is already set.
+- Lint: `cargo clippy --workspace --all-targets --all-features`, with `CARGO_BUILD_WARNINGS=deny`. Clippy covers `cargo check`, so never run a standalone `cargo check --workspace`.
 - Format: `cargo fmt --all --check`.
-- Docs: `cargo doc --workspace --no-deps --all-features --exclude workshop --exclude workshop-server --exclude workshop-server-api`, with `RUSTDOCFLAGS="-D warnings"`. Clippy does not run rustdoc lints, so never skip this.
+- Docs: `cargo doc --workspace --no-deps --all-features`, with `RUSTDOCFLAGS="-D warnings"`. Clippy does not run rustdoc lints, so never skip this.
 - Custom lints: `cargo dylint --all -- --locked --workspace --all-targets --all-features`, with `cargo-dylint` and `dylint-link` installed. The lints and their UI tests live in `cppalliance/dylints`, at the `rev` the root `Cargo.toml`'s `[workspace.metadata.dylint]` pins; a new lint lands there first.
 - Structural checks: `cargo test -p build-xtask`.
-- Wording: `node --test crates/workshop/ui/test/docs-claims.mjs`, from any directory, no `npm ci` needed.
+- Wording: `node --test tools/docs-claims.mjs`, from any directory. It needs Node and no install.
 
 ## Structural Rules
 
@@ -56,8 +56,3 @@ Seven terms have exactly one meaning each, everywhere in this repository: code c
 - Production code uses the standard module layout: `foo.rs`, with `foo/bar.rs` for its children. No `#[path]`, and no inline `mod` blocks. A module never has exactly one child file (tests aside): merge it, or make it a peer module `foo_bar.rs` declared beside `foo.rs`.
 - Test code goes at the bottom of the file under test in a `#[cfg(test)] mod tests { }` block when practical (if in doubt, beside), and otherwise in `foo-tests.rs` beside it, wired with `#[path = "foo-tests.rs"] mod tests;`. A big test file may split by topic into siblings named after it, `<stem>-<topic>.rs` (so `foo-tests-topic.rs`). These are the only files wired with `#[path]`, so a hyphen in a file name means test code. Top-level `tests/` and `benches/` trees follow Cargo's conventions.
 - The crates in this repository keep their older layout until their own pass.
-
-## SPA and CSS Rules
-
-- Workshop UI component CSS uses the custom properties in `@workshop/look` and `ui/src/tokens/component.css`, never raw color, size, or spacing values.
-- Every persisted value goes through the `ui-storage` adapter to the server. Account state (preferences and ephemera such as editor toggles, zoom, recent files, and command history) goes to `ui-state.json` in the state directory (`workshop-user-state`, `/user/state`). Workspace-scoped state, anything that should travel with the `.rvwork` document, goes to the workspace file (`/workspace/file/state`). A new persisted value is a new allow-listed key in one of those two buckets, added on the server first.
diff --git a/Cargo.lock b/Cargo.lock
index 3082ac661..803c481d8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3,8614 +3,728 @@
 version = 4
 
 [[package]]
-name = "adler2"
-version = "2.0.1"
+name = "anyhow"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
-name = "aead"
-version = "0.5.2"
+name = "base64"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
-]
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
-name = "aegis"
-version = "0.9.16"
+name = "block-buffer"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542662923e93dc727bc364f885f6cf24adb4dc60d6fcce0e8d397d214179e14"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "cc",
- "softaes",
+ "generic-array",
 ]
 
 [[package]]
-name = "aes"
-version = "0.8.4"
+name = "block-buffer"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
+ "hybrid-array",
 ]
 
 [[package]]
-name = "aes-gcm"
-version = "0.10.3"
+name = "block2"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
 dependencies = [
- "aead",
- "aes",
- "cipher",
- "ctr",
- "ghash",
- "subtle",
+ "objc2",
 ]
 
 [[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+name = "build-installer"
+version = "0.3.0"
 dependencies = [
- "memchr",
+ "anyhow",
+ "base64",
+ "ctrlc",
+ "minisign",
+ "minisign-verify",
+ "serde_json",
+ "sha2 0.11.0",
+ "tempfile",
+ "toml",
 ]
 
 [[package]]
-name = "alloc-no-stdlib"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+name = "build-user-guide"
+version = "0.3.0"
+dependencies = [
+ "tempfile",
+]
 
 [[package]]
-name = "alloc-stdlib"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+name = "build-xtask"
+version = "0.0.0"
 dependencies = [
- "alloc-no-stdlib",
+ "proc-macro2",
+ "pulldown-cmark",
+ "syn 3.0.3",
+ "tempfile",
+ "toml",
 ]
 
 [[package]]
-name = "allocator-api2"
-version = "0.4.0"
+name = "bumpalo"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c880a97d28a3681c0267bd29cff89621202715b065127cd445fa0f0fe0aa2880"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
-name = "android_system_properties"
-version = "0.1.5"
+name = "cfg-if"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
-name = "anstyle"
-version = "1.0.14"
+name = "cfg_aliases"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
-name = "antithesis_sdk"
-version = "0.2.9"
+name = "cipher"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08410fcac93669a476c006cd6c4512ac1e2b30fd117231a5d55d8a2c76599b82"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "libc",
- "libloading 0.8.9",
- "linkme",
- "once_cell",
- "rand 0.8.8",
- "rustc_version_runtime",
- "serde",
- "serde_json",
+ "crypto-common 0.1.7",
+ "inout",
 ]
 
 [[package]]
-name = "anyhow"
-version = "1.0.104"
+name = "const-oid"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
-name = "ar_archive_writer"
-version = "0.5.5"
+name = "cpufeatures"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523e5e187fff36fcb8d1d19ccf0ca4ca43ec3d158316057f66dc6f72716bc5ec"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
- "object",
+ "libc",
 ]
 
 [[package]]
-name = "arc-swap"
-version = "1.9.2"
+name = "cpufeatures"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
- "rustversion",
+ "libc",
 ]
 
 [[package]]
-name = "aristo"
-version = "0.4.1"
+name = "crypto-common"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcdeefa800110050103e2459a2f8dbdbd560ad046e30f1f87e24ce19c2cb8bde"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "aristo-macros",
+ "generic-array",
+ "typenum",
 ]
 
 [[package]]
-name = "aristo-macros"
-version = "0.4.1"
+name = "crypto-common"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d64a66d21a80182b35b1741997a6d2456911f54b7eb1918aa4e2382fc205268d"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "hybrid-array",
 ]
 
 [[package]]
-name = "assoc"
-version = "0.1.3"
+name = "ct-codecs"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfdc70193dadb9d7287fa4b633f15f90c876915b31f6af17da307fc59c9859a8"
+checksum = "8fd9f3db6f2cfef61c10613071955154ffdc9e515daebff26de4b54e35038fdd"
 
 [[package]]
-name = "async-broadcast"
-version = "0.7.2"
+name = "ctrlc"
+version = "3.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
 dependencies = [
- "event-listener",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
+ "dispatch2",
+ "nix",
+ "windows-sys",
 ]
 
 [[package]]
-name = "async-channel"
-version = "2.5.0"
+name = "digest"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "concurrent-queue",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
 ]
 
 [[package]]
-name = "async-compression"
-version = "0.4.43"
+name = "digest"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3976abdc8fe7d1133d43d304afd42abdf5bc3e1319d263d223bde07b5efc4be8"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "compression-codecs",
- "compression-core",
- "pin-project-lite",
- "tokio",
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
 ]
 
 [[package]]
-name = "async-executor"
-version = "1.14.1"
+name = "dispatch2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f426a31126c735126297bc5ea7a521263c9faff4f63ca415267ee625651c4f37"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "async-task",
- "concurrent-queue",
- "fastrand",
- "futures-lite",
- "pin-project-lite",
- "slab",
+ "bitflags",
+ "block2",
+ "libc",
+ "objc2",
 ]
 
 [[package]]
-name = "async-io"
-version = "2.6.0"
+name = "equivalent"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
-dependencies = [
- "autocfg",
- "cfg-if",
- "concurrent-queue",
- "futures-io",
- "futures-lite",
- "parking",
- "polling",
- "rustix 1.1.4",
- "slab",
- "windows-sys 0.61.2",
-]
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
-name = "async-lock"
-version = "3.4.2"
+name = "errno"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
- "event-listener",
- "event-listener-strategy",
- "pin-project-lite",
+ "libc",
+ "windows-sys",
 ]
 
 [[package]]
-name = "async-process"
+name = "fastrand"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
-dependencies = [
- "async-channel",
- "async-io",
- "async-lock",
- "async-signal",
- "async-task",
- "blocking",
- "cfg-if",
- "event-listener",
- "futures-lite",
- "rustix 1.1.4",
-]
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
-name = "async-recursion"
-version = "1.1.1"
+name = "generic-array"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "typenum",
+ "version_check",
 ]
 
 [[package]]
-name = "async-signal"
-version = "0.2.14"
+name = "getrandom"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
- "async-io",
- "async-lock",
- "atomic-waker",
  "cfg-if",
- "futures-core",
- "futures-io",
- "rustix 1.1.4",
- "signal-hook-registry",
- "slab",
- "windows-sys 0.61.2",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "async-task"
-version = "4.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
-
-[[package]]
-name = "async-trait"
-version = "0.1.92"
+name = "hashbrown"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
-name = "atk"
-version = "0.18.2"
+name = "hmac"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "atk-sys",
- "glib",
- "libc",
+ "digest 0.10.7",
 ]
 
 [[package]]
-name = "atk-sys"
-version = "0.18.2"
+name = "hybrid-array"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
+ "typenum",
 ]
 
 [[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "aws-lc-rs"
-version = "1.18.1"
+name = "indexmap"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
- "aws-lc-sys",
- "zeroize",
+ "equivalent",
+ "hashbrown",
 ]
 
 [[package]]
-name = "aws-lc-sys"
-version = "0.45.0"
+name = "inout"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
- "pkg-config",
+ "generic-array",
 ]
 
 [[package]]
-name = "axum"
-version = "0.8.9"
+name = "itoa"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
-dependencies = [
- "axum-core",
- "base64 0.22.1",
- "bytes",
- "form_urlencoded",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "multer",
- "percent-encoding",
- "pin-project-lite",
- "serde_core",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sha1 0.10.7",
- "sync_wrapper",
- "tokio",
- "tokio-tungstenite",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
-name = "axum-core"
-version = "0.5.6"
+name = "js-sys"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
- "tracing",
+ "cfg-if",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "base64"
-version = "0.21.7"
+name = "libc"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
-name = "base64"
-version = "0.22.1"
+name = "linux-raw-sys"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
-name = "base64"
-version = "0.23.1"
+name = "memchr"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
-name = "bashkit"
-version = "0.21.0"
+name = "minisign"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75e2a19b3bae7c4efa43dd564e34f03acf9786b36814e2e7246f656379b9fd14"
+checksum = "aefd422a7a8b5efced01cd7cdf3771e62ebecbc90e3d27695002d3af6af94586"
 dependencies = [
- "anyhow",
- "async-trait",
- "base64 0.23.1",
- "bigdecimal",
- "bitflags 2.13.1",
- "blake2",
- "bstr",
- "bytes",
- "bzip2",
- "chrono",
- "clap",
- "fancy-regex",
- "flate2",
- "foldhash",
- "futures-util",
- "getrandom 0.4.3",
- "hifijson",
- "hmac 0.13.0",
- "indexmap 2.14.0",
- "jaq-core",
- "jaq-std",
- "md-5",
- "num-bigint",
- "num-traits",
- "os_display",
- "regex",
- "regex-automata",
- "ryu",
- "self_cell",
- "serde",
- "serde_json",
- "serde_norway",
- "sha1 0.11.0",
- "sha2 0.11.0",
- "stacker",
- "thiserror 2.0.19",
- "tokio",
- "unit-prefix",
- "url",
+ "ct-codecs",
+ "getrandom",
+ "rpassword",
+ "scrypt",
 ]
 
 [[package]]
-name = "bigdecimal"
-version = "0.4.10"
+name = "minisign-verify"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695"
-dependencies = [
- "autocfg",
- "libm",
- "num-bigint",
- "num-integer",
- "num-traits",
-]
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
 
 [[package]]
-name = "bindgen"
-version = "0.69.5"
+name = "nix"
+version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.1",
- "cexpr",
- "clang-sys",
- "itertools 0.10.5",
- "lazy_static",
- "lazycell",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex 1.3.0",
- "syn 2.0.119",
- "which 4.4.2",
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
 ]
 
 [[package]]
-name = "bit-set"
-version = "0.8.0"
+name = "objc2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
 dependencies = [
- "bit-vec",
+ "objc2-encode",
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "objc2-encode"
+version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
 
 [[package]]
-name = "bitflags"
-version = "1.3.2"
+name = "once_cell"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
-name = "bitflags"
-version = "2.13.1"
+name = "pbkdf2"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
- "serde_core",
+ "digest 0.10.7",
+ "hmac",
 ]
 
 [[package]]
-name = "bitvec"
-version = "1.1.1"
+name = "proc-macro2"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
- "funty",
- "radium",
- "tap",
- "wyz",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "blake2"
-version = "0.11.0"
+name = "pulldown-cmark"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
+checksum = "f86ba2052aebccc42cbbb3ed234b8b13ce76f75c3551a303cb2bcffcff12bb14"
 dependencies = [
- "digest 0.11.3",
+ "bitflags",
+ "memchr",
+ "unicase",
 ]
 
 [[package]]
-name = "block-buffer"
-version = "0.10.4"
+name = "quote"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
- "generic-array",
+ "proc-macro2",
 ]
 
 [[package]]
-name = "block-buffer"
-version = "0.12.1"
+name = "r-efi"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
-name = "block2"
-version = "0.6.2"
+name = "rpassword"
+version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
- "objc2",
+ "libc",
+ "rtoolbox",
+ "windows-sys",
 ]
 
 [[package]]
-name = "blocking"
-version = "1.7.0"
+name = "rtoolbox"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a70e4329df6cb94385eed412ec92375c3cdd8a6e502493d1229b6414e4036dfa"
+checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
 dependencies = [
- "async-channel",
- "async-task",
- "futures-io",
- "futures-lite",
- "piper",
+ "libc",
+ "windows-sys",
 ]
 
 [[package]]
-name = "branches"
-version = "0.4.6"
+name = "rustix"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7436b21fd6195415058eb41c9090e156b556bc7e0377bb57c5c026a421521525"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "rustc_version",
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
 ]
 
 [[package]]
-name = "brotli"
-version = "8.0.4"
+name = "rustversion"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor",
-]
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
-name = "brotli-decompressor"
-version = "5.0.3"
+name = "salsa20"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
 dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
+ "cipher",
 ]
 
 [[package]]
-name = "bs58"
-version = "0.5.1"
+name = "scrypt"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
 dependencies = [
- "tinyvec",
+ "pbkdf2",
+ "salsa20",
+ "sha2 0.10.9",
 ]
 
 [[package]]
-name = "bstr"
-version = "1.13.0"
+name = "serde"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f7dc094d718f2e1c1559ad110e27eeaae14a5465d3d56dd6dbd793079fbd530"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
- "memchr",
- "regex-automata",
  "serde_core",
 ]
 
 [[package]]
-name = "build-ui"
-version = "0.3.0"
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
- "anyhow",
- "serde_json",
- "tempfile",
+ "serde_derive",
 ]
 
 [[package]]
-name = "build-user-guide"
-version = "0.3.0"
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
- "tempfile",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
 ]
 
 [[package]]
-name = "build-workshop"
-version = "0.3.0"
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
- "anyhow",
- "base64 0.22.1",
- "ctrlc",
- "minisign",
- "minisign-verify",
- "serde_json",
- "sha2 0.11.0",
- "tempfile",
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
-name = "build-xtask"
-version = "0.0.0"
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
- "anyhow",
- "proc-macro2",
- "pulldown-cmark",
- "syn 3.0.3",
- "tempfile",
- "toml 1.1.4+spec-1.1.0",
+ "serde_core",
 ]
 
 [[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "bytemuck"
-version = "1.25.2"
+name = "sha2"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
- "bytemuck_derive",
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
 ]
 
 [[package]]
-name = "bytemuck_derive"
-version = "1.11.0"
+name = "sha2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
-name = "byteorder"
-version = "1.5.0"
+name = "subtle"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
-name = "bytes"
-version = "1.12.1"
+name = "syn"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
- "serde",
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "bzip2"
-version = "0.6.1"
+name = "syn"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
- "libbz2-rs-sys",
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "cairo-rs"
-version = "0.18.5"
+name = "tempfile"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
- "bitflags 2.13.1",
- "cairo-sys-rs",
- "glib",
- "libc",
+ "fastrand",
+ "getrandom",
  "once_cell",
- "thiserror 1.0.69",
+ "rustix",
+ "windows-sys",
 ]
 
 [[package]]
-name = "cairo-sys-rs"
-version = "0.18.2"
+name = "toml"
+version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
+checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
 dependencies = [
- "glib-sys",
- "libc",
- "system-deps",
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
 ]
 
 [[package]]
-name = "camino"
-version = "1.2.5"
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb1307f12aa967b5a58416e87b3653360e0fd614a016b6e970db08fecbb1b80d"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
-name = "cargo-platform"
-version = "0.1.9"
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e35af189006b9c0f00a064685c727031e3ed2d8020f7ba284d78cc2671bd36ea"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
- "serde",
+ "winnow",
 ]
 
 [[package]]
-name = "cargo_metadata"
-version = "0.19.2"
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
-dependencies = [
- "camino",
- "cargo-platform",
- "semver",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
-]
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
 [[package]]
-name = "cargo_toml"
-version = "0.22.3"
+name = "typenum"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77"
-dependencies = [
- "serde",
- "toml 0.9.12+spec-1.1.0",
-]
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
-name = "cc"
-version = "1.4.6"
+name = "unicase"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex 2.0.1",
-]
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
 [[package]]
-name = "cesu8"
-version = "1.1.0"
+name = "unicode-ident"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
-name = "cexpr"
-version = "0.6.0"
+name = "version_check"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
-]
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
-name = "cfb"
-version = "0.7.3"
+name = "wasm-bindgen"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38f2da7a0a2c4ccf0065be06397cc26a81f4e528be095826eee9d4adbb8c60f"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
- "byteorder",
- "fnv",
- "uuid",
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
 ]
 
 [[package]]
-name = "cfg-expr"
-version = "0.15.8"
+name = "wasm-bindgen-macro"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
- "smallvec",
- "target-lexicon",
+ "quote",
+ "wasm-bindgen-macro-support",
 ]
 
 [[package]]
-name = "cfg-if"
-version = "1.0.4"
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
 
 [[package]]
-name = "cfg_aliases"
-version = "0.2.2"
+name = "wasm-bindgen-shared"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
-name = "cfg_block"
-version = "0.1.1"
+name = "windows-link"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18758054972164c3264f7c8386f5fc6da6114cb46b619fd365d4e3b2dc3ae487"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
-name = "chacha20"
-version = "0.10.2"
+name = "windows-sys"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
+ "windows-link",
 ]
 
 [[package]]
-name = "chrono"
-version = "0.4.45"
+name = "winnow"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
-dependencies = [
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "serde",
- "wasm-bindgen",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common 0.1.7",
- "inout",
-]
-
-[[package]]
-name = "clang-sys"
-version = "1.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
-dependencies = [
- "glob",
- "libc",
- "libloading 0.8.9",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
-dependencies = [
- "anstyle",
- "clap_lex",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
-[[package]]
-name = "combine"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "compression-codecs"
-version = "0.4.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
-dependencies = [
- "brotli",
- "compression-core",
- "flate2",
- "memchr",
-]
-
-[[package]]
-name = "compression-core"
-version = "0.4.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
-
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "cookie"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
-dependencies = [
- "time",
- "version_check",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "core-graphics"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97"
-dependencies = [
- "bitflags 2.13.1",
- "core-foundation 0.10.1",
- "core-graphics-types",
- "foreign-types",
- "libc",
-]
-
-[[package]]
-name = "core-graphics-types"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
-dependencies = [
- "bitflags 2.13.1",
- "core-foundation 0.10.1",
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
-
-[[package]]
-name = "crc32c"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
-dependencies = [
- "rustc_version",
-]
-
-[[package]]
-name = "crc32fast"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "typenum",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "cssparser"
-version = "0.36.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2"
-dependencies = [
- "cssparser-macros",
- "dtoa-short",
- "itoa",
- "phf",
- "smallvec",
-]
-
-[[package]]
-name = "cssparser-macros"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
-dependencies = [
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "ct-codecs"
-version = "1.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd9f3db6f2cfef61c10613071955154ffdc9e515daebff26de4b54e35038fdd"
-
-[[package]]
-name = "ctor"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98"
-dependencies = [
- "ctor-proc-macro",
- "dtor",
-]
-
-[[package]]
-name = "ctor-proc-macro"
-version = "0.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
-
-[[package]]
-name = "ctr"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
-dependencies = [
- "cipher",
-]
-
-[[package]]
-name = "ctrlc"
-version = "3.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
-dependencies = [
- "dispatch2",
- "nix",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "ctutils"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "261af4dc7a06ea8a527a8717d8cbba3417530d6ea14e1edb3de6b67806be474f"
-dependencies = [
- "cmov",
-]
-
-[[package]]
-name = "darling"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
-dependencies = [
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
-dependencies = [
- "darling_core",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
-
-[[package]]
-name = "dbus"
-version = "0.9.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
-dependencies = [
- "libc",
- "libdbus-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "defmt"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
-dependencies = [
- "bitflags 1.3.2",
- "defmt-macros",
-]
-
-[[package]]
-name = "defmt-macros"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
-dependencies = [
- "defmt-parser",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "defmt-parser"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
-dependencies = [
- "thiserror 2.0.19",
-]
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "derive_more"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
-dependencies = [
- "derive_more-impl",
-]
-
-[[package]]
-name = "derive_more-impl"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
-dependencies = [
- "proc-macro2",
- "quote",
- "rustc_version",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
- "subtle",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.1",
- "const-oid",
- "crypto-common 0.2.2",
- "ctutils",
-]
-
-[[package]]
-name = "dirs"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "dispatch2"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "libc",
- "objc2",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "dlopen2"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e2c5bd4158e66d1e215c49b837e11d62f3267b30c92f1d171c4d3105e3dc4d4"
-dependencies = [
- "dlopen2_derive",
- "libc",
- "once_cell",
- "winapi",
-]
-
-[[package]]
-name = "dlopen2_derive"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fbbb781877580993a8707ec48672673ec7b81eeba04cfd2310bd28c08e47c8f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "dom_query"
-version = "0.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89"
-dependencies = [
- "bit-set",
- "cssparser",
- "foldhash",
- "html5ever 0.38.0",
- "precomputed-hash",
- "selectors 0.36.1",
- "tendril 0.5.1",
-]
-
-[[package]]
-name = "dpi"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "dtoa"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
-
-[[package]]
-name = "dtoa-short"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
-dependencies = [
- "dtoa",
-]
-
-[[package]]
-name = "dtor"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4"
-dependencies = [
- "dtor-proc-macro",
-]
-
-[[package]]
-name = "dtor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
-
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "dyn-clone"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
-
-[[package]]
-name = "ego-tree"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2972feb8dffe7bc8c5463b1dacda1b0dfbed3710e50f977d965429692d74cd8"
-
-[[package]]
-name = "either"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
-
-[[package]]
-name = "embed-resource"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbfdaacccebec3b28e4866b8973543c7647797db5ada1bdab552e48fe665fbbd"
-dependencies = [
- "cc",
- "memchr",
- "rustc_version",
- "toml 1.1.4+spec-1.1.0",
- "vswhom",
- "winreg",
-]
-
-[[package]]
-name = "embed_plist"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
-
-[[package]]
-name = "encoding_rs"
-version = "0.8.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "endi"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
-
-[[package]]
-name = "enumflags2"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
-dependencies = [
- "enumflags2_derive",
- "serde",
-]
-
-[[package]]
-name = "enumflags2_derive"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "env_filter"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
-dependencies = [
- "log",
- "regex",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
-dependencies = [
- "env_filter",
- "log",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "erased-serde"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
-dependencies = [
- "serde",
- "serde_core",
- "typeid",
-]
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "event-listener"
-version = "5.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
-dependencies = [
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
-dependencies = [
- "event-listener",
- "pin-project-lite",
-]
-
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fancy-regex"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a2e16b9a584b602f1e0e5e22c30ca0906786088c27500653e432d086def8b53"
-dependencies = [
- "bit-set",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "fastbloom"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7f34442dbe69c60fe8eaf58a8cafff81a1f278816d8ab4db255b3bef4ac3c4"
-dependencies = [
- "getrandom 0.3.4",
- "libm",
- "siphasher",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
-
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
-[[package]]
-name = "field-offset"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
-dependencies = [
- "memoffset",
- "rustc_version",
-]
-
-[[package]]
-name = "filetime"
-version = "0.2.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
-dependencies = [
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
-
-[[package]]
-name = "flate2"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "foreign-types"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
-dependencies = [
- "foreign-types-macros",
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-macros"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
-[[package]]
-name = "funty"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
-
-[[package]]
-name = "futf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
-dependencies = [
- "mac",
- "new_debug_unreachable",
-]
-
-[[package]]
-name = "futures"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
-dependencies = [
- "futures-core",
- "futures-sink",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
-
-[[package]]
-name = "futures-executor"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
-dependencies = [
- "futures-core",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-io"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
-
-[[package]]
-name = "futures-lite"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
-dependencies = [
- "fastrand",
- "futures-core",
- "futures-io",
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "futures-macro"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "futures-sink"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
-
-[[package]]
-name = "futures-task"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
-
-[[package]]
-name = "futures-util"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-macro",
- "futures-sink",
- "futures-task",
- "memchr",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "gdk"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
-dependencies = [
- "cairo-rs",
- "gdk-pixbuf",
- "gdk-sys",
- "gio",
- "glib",
- "libc",
- "pango",
-]
-
-[[package]]
-name = "gdk-pixbuf"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
-dependencies = [
- "gdk-pixbuf-sys",
- "gio",
- "glib",
- "libc",
- "once_cell",
-]
-
-[[package]]
-name = "gdk-pixbuf-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
-dependencies = [
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "gdk-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
-dependencies = [
- "cairo-sys-rs",
- "gdk-pixbuf-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "pango-sys",
- "pkg-config",
- "system-deps",
-]
-
-[[package]]
-name = "gdkwayland-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "140071d506d223f7572b9f09b5e155afbd77428cd5cc7af8f2694c41d98dfe69"
-dependencies = [
- "gdk-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "pkg-config",
- "system-deps",
-]
-
-[[package]]
-name = "gdkx11"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3caa00e14351bebbc8183b3c36690327eb77c49abc2268dd4bd36b856db3fbfe"
-dependencies = [
- "gdk",
- "gdkx11-sys",
- "gio",
- "glib",
- "libc",
- "x11",
-]
-
-[[package]]
-name = "gdkx11-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e7445fe01ac26f11601db260dd8608fe172514eb63b3b5e261ea6b0f4428d"
-dependencies = [
- "gdk-sys",
- "glib-sys",
- "libc",
- "system-deps",
- "x11",
-]
-
-[[package]]
-name = "genawaiter"
-version = "0.99.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c86bd0361bcbde39b13475e6e36cb24c329964aa2611be285289d1e4b751c1a0"
-dependencies = [
- "genawaiter-macro",
-]
-
-[[package]]
-name = "genawaiter-macro"
-version = "0.99.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b32dfe1fdfc0bbde1f22a5da25355514b5e450c33a6af6770884c8750aedfbc"
-
-[[package]]
-name = "generator"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "log",
- "rustversion",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "getopts"
-version = "0.2.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
-dependencies = [
- "unicode-width 0.2.2",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "wasi",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 5.3.0",
- "wasip2",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi 6.0.0",
- "rand_core 0.10.1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "ghash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
-dependencies = [
- "opaque-debug",
- "polyval",
-]
-
-[[package]]
-name = "gio"
-version = "0.18.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-util",
- "gio-sys",
- "glib",
- "libc",
- "once_cell",
- "pin-project-lite",
- "smallvec",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "gio-sys"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
- "winapi",
-]
-
-[[package]]
-name = "glib"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
-dependencies = [
- "bitflags 2.13.1",
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-task",
- "futures-util",
- "gio-sys",
- "glib-macros",
- "glib-sys",
- "gobject-sys",
- "libc",
- "memchr",
- "once_cell",
- "smallvec",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "glib-macros"
-version = "0.18.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
-dependencies = [
- "heck 0.4.1",
- "proc-macro-crate 2.0.2",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
-
-[[package]]
-name = "gobject-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
-dependencies = [
- "glib-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "gtk"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
-dependencies = [
- "atk",
- "cairo-rs",
- "field-offset",
- "futures-channel",
- "gdk",
- "gdk-pixbuf",
- "gio",
- "glib",
- "gtk-sys",
- "gtk3-macros",
- "libc",
- "pango",
- "pkg-config",
-]
-
-[[package]]
-name = "gtk-sys"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
-dependencies = [
- "atk-sys",
- "cairo-sys-rs",
- "gdk-pixbuf-sys",
- "gdk-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "pango-sys",
- "system-deps",
-]
-
-[[package]]
-name = "gtk3-macros"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
-dependencies = [
- "proc-macro-crate 1.3.1",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "harness-gateway-client"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "async-trait",
- "bytes",
- "plugin-web",
- "reqwest",
- "runvil",
- "serde",
- "serde_json",
- "tokio",
- "url",
-]
-
-[[package]]
-name = "harness-plugin-loader"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "libloading 0.8.9",
- "runvil-plugin",
- "runvil-plugin-sys",
- "serde_json",
-]
-
-[[package]]
-name = "harness-runner"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "futures-util",
- "rand 0.9.5",
- "runvil-engine",
- "runvil-plugin",
- "serde_json",
- "tracing",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "hifijson"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "242402749acf71e6f32f5857598b7002c4058a4e3c3b22b4c7d51cab9aea754e"
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest 0.10.7",
-]
-
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
-[[package]]
-name = "home"
-version = "0.5.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "htmd"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5a1c7113c831fec68cbd79cd8bf281a84e5b6943f51473dc266b0b88a6a017e"
-dependencies = [
- "html5ever 0.38.0",
- "markup5ever_rcdom",
- "phf",
-]
-
-[[package]]
-name = "html5ever"
-version = "0.36.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6452c4751a24e1b99c3260d505eaeee76a050573e61f30ac2c924ddc7236f01e"
-dependencies = [
- "log",
- "markup5ever 0.36.1",
-]
-
-[[package]]
-name = "html5ever"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2"
-dependencies = [
- "log",
- "markup5ever 0.38.0",
-]
-
-[[package]]
-name = "http"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "humantime"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "hyper"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "http",
- "http-body",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "tokio",
- "tokio-rustls",
- "tower-service",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "system-configuration",
- "tokio",
- "tower-service",
- "tracing",
- "windows-registry",
-]
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core 0.62.2",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "ico"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371"
-dependencies = [
- "byteorder",
- "png 0.17.16",
-]
-
-[[package]]
-name = "icu_collator"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08984ed58ac439ebf3e13d2cf26b0c46a60afcd21721c1d14087c0b240344dda"
-dependencies = [
- "icu_collator_data",
- "icu_collections",
- "icu_locale_core",
- "icu_locale_fallback",
- "icu_normalizer",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "utf16_iter",
- "utf8_iter",
- "zerovec",
-]
-
-[[package]]
-name = "icu_collator_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7d7e54efdddeb1208c08dd5d32b53a879ac00d2d3d051b2255fd26821d16368"
-
-[[package]]
-name = "icu_collections"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "785f595c61ef57169a467eeed7b4b6936a66f6cacbb116a96ee86da983251bf4"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_locale_data",
- "icu_locale_fallback",
- "icu_provider",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
-dependencies = [
- "displaydoc",
- "litemap",
- "serde",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d37d91460e362a5cf58907cd7ce871411775ee6294e49a5cc8e6cec16dfa75ea"
-
-[[package]]
-name = "icu_locale_fallback"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
-dependencies = [
- "icu_locale_core",
- "icu_locale_fallback_data",
- "icu_provider",
- "potential_utf",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_fallback_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
-
-[[package]]
-name = "icu_normalizer"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "utf16_iter",
- "utf8_iter",
- "write16",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
-
-[[package]]
-name = "icu_properties"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
-
-[[package]]
-name = "icu_provider"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "serde",
- "stable_deref_trait",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
- "serde",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.1",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "infer"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7"
-dependencies = [
- "cfb",
-]
-
-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "intrusive-collections"
-version = "0.9.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "189d0897e4cbe8c75efedf3502c18c887b05046e59d28404d4d8e46cbc4d1e86"
-dependencies = [
- "memoffset",
-]
-
-[[package]]
-name = "io-uring"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3bd0ecfbb87805f538bb7b32e5239ca0763890c623e349860ecba69469f2bb"
-dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-
-[[package]]
-name = "is-docker"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "is-wsl"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5"
-dependencies = [
- "is-docker",
- "once_cell",
-]
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itertools"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "jaq-core"
-version = "3.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723ad9253808e95daa2d10ad5b258ac4e65c07003e223e08d1d8734c2942d606"
-dependencies = [
- "dyn-clone",
- "once_cell",
- "typed-arena",
-]
-
-[[package]]
-name = "jaq-std"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56b378d4f7587d332111a92608348db6d6b9b8f7cb5ee1d2bd162ec715d7c5bf"
-dependencies = [
- "aho-corasick",
- "base64 0.22.1",
- "bstr",
- "jaq-core",
- "jiff",
- "libm",
- "log",
- "regex-bites",
- "urlencoding",
-]
-
-[[package]]
-name = "javascriptcore-rs"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
-dependencies = [
- "bitflags 1.3.2",
- "glib",
- "javascriptcore-rs-sys",
-]
-
-[[package]]
-name = "javascriptcore-rs-sys"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "jiff"
-version = "0.2.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
-dependencies = [
- "defmt",
- "jiff-core",
- "jiff-static",
- "jiff-tzdb-platform",
- "log",
- "portable-atomic",
- "portable-atomic-util",
- "serde_core",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "jiff-core"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
-dependencies = [
- "defmt",
-]
-
-[[package]]
-name = "jiff-static"
-version = "0.2.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
-dependencies = [
- "jiff-core",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "jiff-tzdb"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
-
-[[package]]
-name = "jiff-tzdb-platform"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
-dependencies = [
- "jiff-tzdb",
-]
-
-[[package]]
-name = "jni"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
-dependencies = [
- "cesu8",
- "cfg-if",
- "combine",
- "jni-sys 0.3.1",
- "log",
- "thiserror 1.0.69",
- "walkdir",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "jni"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
-dependencies = [
- "cfg-if",
- "combine",
- "jni-macros",
- "jni-sys 0.4.1",
- "log",
- "simd_cesu8",
- "thiserror 2.0.19",
- "walkdir",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "jni-macros"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "rustc_version",
- "simd_cesu8",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
-dependencies = [
- "jni-sys 0.4.1",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
-dependencies = [
- "jni-sys-macros",
-]
-
-[[package]]
-name = "jni-sys-macros"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
-dependencies = [
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc",
-]
-
-[[package]]
-name = "js-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
-dependencies = [
- "cfg-if",
- "futures-util",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "json-patch"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
-dependencies = [
- "jsonptr",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "jsonptr"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
-dependencies = [
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "keyboard-types"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
-dependencies = [
- "bitflags 2.13.1",
- "serde",
- "unicode-segmentation",
-]
-
-[[package]]
-name = "kuchikikiki"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14683223e533503d404478bfd32826a4cba1b4906034ff74135404372390e87b"
-dependencies = [
- "bitflags 2.13.1",
- "crc",
- "cssparser",
- "html5ever 0.36.1",
- "indexmap 2.14.0",
- "precomputed-hash",
- "selectors 0.33.0",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
-[[package]]
-name = "libappindicator"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03589b9607c868cc7ae54c0b2a22c8dc03dd41692d48f2d7df73615c6a95dc0a"
-dependencies = [
- "glib",
- "gtk",
- "gtk-sys",
- "libappindicator-sys",
- "log",
-]
-
-[[package]]
-name = "libappindicator-sys"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e9ec52138abedcc58dc17a7c6c0c00a2bdb4f3427c7f63fa97fd0d859155caf"
-dependencies = [
- "gtk-sys",
- "libloading 0.7.4",
- "once_cell",
-]
-
-[[package]]
-name = "libbz2-rs-sys"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f454fd6831a29c0e827ed075bca2a15be201bd57f4168f0fd1041124eab17e"
-
-[[package]]
-name = "libc"
-version = "0.2.189"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
-
-[[package]]
-name = "libdbus-sys"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
-dependencies = [
- "pkg-config",
-]
-
-[[package]]
-name = "libloading"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "libredox"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "linkme"
-version = "0.3.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3045e122bd98aef8ec3ad58ce84f0791f64e70163d1a02710af4aa11a4d54cc5"
-dependencies = [
- "linkme-impl",
-]
-
-[[package]]
-name = "linkme-impl"
-version = "0.3.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "litemap"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
-
-[[package]]
-name = "lock_api"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "loom"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
-dependencies = [
- "cfg-if",
- "generator",
- "scoped-tls",
- "tracing",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "lua-src"
-version = "550.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c110c2fa33f34e0de05448e1f3eb2e0631e7a69e2d8ae1586cffc9fc9f9949"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "luajit-src"
-version = "210.7.2+b925b3e"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "920cf654b23d217c550ceea57c32cd2a413ea27b6d47ed77b5ee0cf655adefa6"
-dependencies = [
- "cc",
- "which 8.0.6",
-]
-
-[[package]]
-name = "mac"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
-
-[[package]]
-name = "markup5ever"
-version = "0.36.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c3294c4d74d0742910f8c7b466f44dda9eb2d5742c1e430138df290a1e8451c"
-dependencies = [
- "log",
- "tendril 0.4.3",
- "web_atoms",
-]
-
-[[package]]
-name = "markup5ever"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862"
-dependencies = [
- "log",
- "tendril 0.5.1",
- "web_atoms",
-]
-
-[[package]]
-name = "markup5ever_rcdom"
-version = "0.38.0+unofficial"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "333171ccdf66e915257740d44e38ea5b1b19ce7b45d33cc35cb6f118fbd981ff"
-dependencies = [
- "html5ever 0.38.0",
- "markup5ever 0.38.0",
- "tendril 0.5.1",
- "xml5ever",
-]
-
-[[package]]
-name = "matchers"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
-dependencies = [
- "regex-automata",
-]
-
-[[package]]
-name = "matchit"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
-
-[[package]]
-name = "md-5"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
-dependencies = [
- "cfg-if",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "miette"
-version = "7.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7"
-dependencies = [
- "cfg-if",
- "miette-derive",
- "unicode-width 0.1.14",
-]
-
-[[package]]
-name = "miette-derive"
-version = "7.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "mime_guess"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
-dependencies = [
- "mime",
- "unicase",
-]
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "minisign"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aefd422a7a8b5efced01cd7cdf3771e62ebecbc90e3d27695002d3af6af94586"
-dependencies = [
- "ct-codecs",
- "getrandom 0.4.3",
- "rpassword",
- "scrypt",
-]
-
-[[package]]
-name = "minisign-verify"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
-[[package]]
-name = "mio"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "mlua"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad72ffa037cf5970c9860674f32f703fda25d86cf217475fe7a79c5f9961bcaa"
-dependencies = [
- "bstr",
- "either",
- "erased-serde",
- "libc",
- "mlua-sys",
- "num-traits",
- "parking_lot",
- "rustc-hash 2.1.3",
- "serde",
- "serde-value",
-]
-
-[[package]]
-name = "mlua-sys"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92136787b906d4e55cfe96cd6c62e010bb1a56889d0d6cf83eb016dbad07576b"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "lua-src",
- "luajit-src",
- "pkg-config",
-]
-
-[[package]]
-name = "muda"
-version = "0.19.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd04e60bc0b07438a6771710ee1698f98f6ebbc7f89b61264af1563b8aeb878"
-dependencies = [
- "crossbeam-channel",
- "dpi",
- "gtk",
- "keyboard-types",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "once_cell",
- "png 0.18.1",
- "serde",
- "thiserror 2.0.19",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "multer"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
-dependencies = [
- "bytes",
- "encoding_rs",
- "futures-util",
- "http",
- "httparse",
- "memchr",
- "mime",
- "spin",
- "version_check",
-]
-
-[[package]]
-name = "ndk"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
-dependencies = [
- "bitflags 2.13.1",
- "jni-sys 0.3.1",
- "log",
- "ndk-sys",
- "num_enum",
- "raw-window-handle",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "ndk-sys"
-version = "0.6.0+11769913"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
-dependencies = [
- "jni-sys 0.3.1",
-]
-
-[[package]]
-name = "new_debug_unreachable"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
-
-[[package]]
-name = "nix"
-version = "0.31.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
-dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "cfg_aliases",
- "libc",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "nu-ansi-term"
-version = "0.50.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "num-bigint"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num-integer"
-version = "0.1.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_enum"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
-dependencies = [
- "num_enum_derive",
- "rustversion",
-]
-
-[[package]]
-name = "num_enum_derive"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "objc2"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
-dependencies = [
- "objc2-encode",
- "objc2-exception-helper",
-]
-
-[[package]]
-name = "objc2-app-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "objc2",
- "objc2-core-foundation",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-cloud-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
-dependencies = [
- "bitflags 2.13.1",
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-data"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
-dependencies = [
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
-dependencies = [
- "bitflags 2.13.1",
- "dispatch2",
- "objc2",
-]
-
-[[package]]
-name = "objc2-core-graphics"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
-dependencies = [
- "bitflags 2.13.1",
- "dispatch2",
- "objc2",
- "objc2-core-foundation",
- "objc2-io-surface",
-]
-
-[[package]]
-name = "objc2-core-image"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
-dependencies = [
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-location"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
-dependencies = [
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-text"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
-dependencies = [
- "bitflags 2.13.1",
- "objc2",
- "objc2-core-foundation",
- "objc2-core-graphics",
-]
-
-[[package]]
-name = "objc2-encode"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
-
-[[package]]
-name = "objc2-exception-helper"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7a1c5fbb72d7735b076bb47b578523aedc40f3c439bea6dfd595c089d79d98a"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "objc2-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "libc",
- "objc2",
- "objc2-core-foundation",
-]
-
-[[package]]
-name = "objc2-io-surface"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
-dependencies = [
- "bitflags 2.13.1",
- "objc2",
- "objc2-core-foundation",
-]
-
-[[package]]
-name = "objc2-osa-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f112d1746737b0da274ef79a23aac283376f335f4095a083a267a082f21db0c0"
-dependencies = [
- "bitflags 2.13.1",
- "objc2",
- "objc2-app-kit",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-quartz-core"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
-dependencies = [
- "bitflags 2.13.1",
- "objc2",
- "objc2-core-foundation",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-ui-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "objc2",
- "objc2-cloud-kit",
- "objc2-core-data",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-core-image",
- "objc2-core-location",
- "objc2-core-text",
- "objc2-foundation",
- "objc2-quartz-core",
- "objc2-user-notifications",
-]
-
-[[package]]
-name = "objc2-user-notifications"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e"
-dependencies = [
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-web-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
-]
-
-[[package]]
-name = "object"
-version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
-[[package]]
-name = "open"
-version = "5.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ade3be4664bc1ef537ce133015f04c176b737815c2ba9fd60edf212d6e90dd55"
-dependencies = [
- "dunce",
- "is-wsl",
- "libc",
-]
-
-[[package]]
-name = "openssl-probe"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
-
-[[package]]
-name = "option-ext"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
-
-[[package]]
-name = "ordered-float"
-version = "2.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "ordered-stream"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
-dependencies = [
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "os_display"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad5fd71b79026fb918650dde6d125000a233764f1c2f1659a1c71118e33ea08f"
-dependencies = [
- "unicode-width 0.2.2",
-]
-
-[[package]]
-name = "osakit"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "732c71caeaa72c065bb69d7ea08717bd3f4863a4f451402fc9513e29dbd5261b"
-dependencies = [
- "objc2",
- "objc2-foundation",
- "objc2-osa-kit",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
-]
-
-[[package]]
-name = "owo-colors"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1b04fb49957986fdce4d6ee7a65027d55d4b6d2265e5848bbb507b58ccfdb6f"
-
-[[package]]
-name = "pack1"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3b7bb0ecf2e447b1f20ee94ee79ef6eed1e9d4b3c36ce1903b9dea3bf205523"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "pango"
-version = "0.18.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
-dependencies = [
- "gio",
- "glib",
- "libc",
- "once_cell",
- "pango-sys",
-]
-
-[[package]]
-name = "pango-sys"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
-dependencies = [
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "parking"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
-
-[[package]]
-name = "parking_lot"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "pastey"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
-
-[[package]]
-name = "pbkdf2"
-version = "0.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
-dependencies = [
- "digest 0.10.7",
- "hmac 0.12.1",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "phf"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
-dependencies = [
- "phf_macros",
- "phf_shared",
- "serde",
-]
-
-[[package]]
-name = "phf_codegen"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
-dependencies = [
- "phf_generator",
- "phf_shared",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
-dependencies = [
- "fastrand",
- "phf_shared",
-]
-
-[[package]]
-name = "phf_macros"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
-dependencies = [
- "phf_generator",
- "phf_shared",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "phf_shared"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
-dependencies = [
- "siphasher",
-]
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "piper"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
-dependencies = [
- "atomic-waker",
- "fastrand",
- "futures-io",
-]
-
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
-[[package]]
-name = "plist"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
-dependencies = [
- "base64 0.22.1",
- "indexmap 2.14.0",
- "quick-xml",
- "serde",
- "time",
-]
-
-[[package]]
-name = "plugin-bashkit"
-version = "0.1.0"
-source = "git+https://github.com/cppalliance/runvil-plugin-bashkit?rev=0864f1ff9cc1f4fad6c96f1e9f6d8a3ab85e9580#0864f1ff9cc1f4fad6c96f1e9f6d8a3ab85e9580"
-dependencies = [
- "bashkit",
- "runvil-plugin-sdk",
- "serde",
- "serde_json",
- "tokio",
-]
-
-[[package]]
-name = "plugin-mcp"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "reqwest",
- "rmcp",
- "runvil-plugin",
- "serde_json",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "plugin-std"
-version = "0.1.0"
-source = "git+https://github.com/cppalliance/runvil-plugin-std?rev=782ad23e5dfbe6fbfa5be7145fa73a9ca60ce8a8#782ad23e5dfbe6fbfa5be7145fa73a9ca60ce8a8"
-dependencies = [
- "regex",
- "runvil-plugin-sdk",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "plugin-web"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "async-trait",
- "encoding_rs",
- "htmd",
- "ipnet",
- "mime",
- "readabilityrs",
- "reqwest",
- "runvil-plugin",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
-]
-
-[[package]]
-name = "png"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
-dependencies = [
- "bitflags 2.13.1",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
-]
-
-[[package]]
-name = "polling"
-version = "3.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
-dependencies = [
- "cfg-if",
- "concurrent-queue",
- "hermit-abi",
- "pin-project-lite",
- "rustix 1.1.4",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "polyval"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
-[[package]]
-name = "portable-atomic"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
-
-[[package]]
-name = "portable-atomic-util"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
-dependencies = [
- "portable-atomic",
-]
-
-[[package]]
-name = "potential_utf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
-dependencies = [
- "serde_core",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
-[[package]]
-name = "precomputed-hash"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
-
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
-dependencies = [
- "once_cell",
- "toml_edit 0.19.15",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
-dependencies = [
- "toml_datetime 0.6.3",
- "toml_edit 0.20.2",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit 0.25.13+spec-1.1.0",
-]
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "prost"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
-dependencies = [
- "bytes",
- "prost-derive",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
-dependencies = [
- "anyhow",
- "itertools 0.14.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "psm"
-version = "0.1.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
-dependencies = [
- "ar_archive_writer",
- "cc",
-]
-
-[[package]]
-name = "pulldown-cmark"
-version = "0.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86ba2052aebccc42cbbb3ed234b8b13ce76f75c3551a303cb2bcffcff12bb14"
-dependencies = [
- "bitflags 2.13.1",
- "memchr",
- "unicase",
-]
-
-[[package]]
-name = "quick-xml"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash 2.1.3",
- "rustls",
- "socket2",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
-dependencies = [
- "aws-lc-rs",
- "bytes",
- "getrandom 0.4.3",
- "lru-slab",
- "rand 0.10.2",
- "rand_pcg 0.10.2",
- "ring",
- "rustc-hash 2.1.3",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.19",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "radium"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
-
-[[package]]
-name = "rand"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
-dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
-dependencies = [
- "chacha20",
- "getrandom 0.4.3",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
-dependencies = [
- "getrandom 0.3.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
-[[package]]
-name = "rand_pcg"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59cad018caf63deb318e5a4586d99a24424a364f40f1e5778c29aca23f4fc73e"
-dependencies = [
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_pcg"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
-dependencies = [
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rapidhash"
-version = "4.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5da7e78a036ce858e8d55b7e7dc8ba3a88b78350fd2155d3591bbd966b58589e"
-dependencies = [
- "rustversion",
-]
-
-[[package]]
-name = "raw-window-handle"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
-
-[[package]]
-name = "readabilityrs"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d90c6e1dad698d9f3c80a8d91bc0efc8c2397cb5ca4bbffb9c0fb88a9a66e6b8"
-dependencies = [
- "bitflags 2.13.1",
- "kuchikikiki",
- "once_cell",
- "regex",
- "scraper",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
- "url",
- "v_htmlescape",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
-dependencies = [
- "bitflags 2.13.1",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
-dependencies = [
- "getrandom 0.2.17",
- "libredox",
- "thiserror 2.0.19",
-]
-
-[[package]]
-name = "ref-cast"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "regex"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-bites"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6a15a2fa0bfda9361941c45550896ae87b15cc6c8c939ea350079670332e211"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
-
-[[package]]
-name = "reqwest"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "rustls-platform-verifier",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tokio-util",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
-]
-
-[[package]]
-name = "rfd"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
-dependencies = [
- "block2",
- "dispatch2",
- "glib-sys",
- "gobject-sys",
- "gtk-sys",
- "js-sys",
- "log",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "raw-window-handle",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rmcp"
-version = "3.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d24a7e92f4bcaa36b97fa93c4fa7ca8f3e669eced949345b3462dba333c7f909"
-dependencies = [
- "base64 0.23.1",
- "bytes",
- "chrono",
- "futures",
- "http",
- "indexmap 2.14.0",
- "libc",
- "pin-project-lite",
- "reqwest",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "sse-stream",
- "thiserror 2.0.19",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "roaring"
-version = "0.11.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18bd8a37d17a58532776dcdf6041ce64929adca78e8489d5cacbafe99229d3e1"
-dependencies = [
- "bytemuck",
- "byteorder",
-]
-
-[[package]]
-name = "rpassword"
-version = "7.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
-dependencies = [
- "libc",
- "rtoolbox",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rtoolbox"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "runvil"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "harness-plugin-loader",
- "harness-runner",
- "runvil-engine",
- "runvil-plugin",
-]
-
-[[package]]
-name = "runvil-engine"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "runvil-lua",
- "runvil-model-client",
- "runvil-prompt",
- "runvil-runtime",
- "runvil-types",
- "runvil-vfs",
-]
-
-[[package]]
-name = "runvil-lua"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "mlua",
- "runvil-markdown",
- "runvil-model-client",
- "runvil-types",
- "runvil-vfs",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "runvil-markdown"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "pulldown-cmark",
- "serde_json",
- "serde_yaml_ng",
-]
-
-[[package]]
-name = "runvil-model-client"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "runvil-types",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "runvil-plugin"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "runvil-types",
- "runvil-vfs",
- "serde_json",
-]
-
-[[package]]
-name = "runvil-plugin-sdk"
-version = "0.4.0"
-source = "git+https://github.com/cppalliance/runvil-plugin-api?rev=03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2#03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2"
-dependencies = [
- "runvil-plugin-sys",
-]
-
-[[package]]
-name = "runvil-plugin-sys"
-version = "0.4.0"
-source = "git+https://github.com/cppalliance/runvil-plugin-api?rev=03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2#03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2"
-
-[[package]]
-name = "runvil-prompt"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "pulldown-cmark",
- "runvil-lua",
- "runvil-types",
- "serde",
- "serde_yaml_ng",
-]
-
-[[package]]
-name = "runvil-runtime"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "mlua",
- "regex",
- "runvil-lua",
- "runvil-markdown",
- "runvil-model-client",
- "runvil-prompt",
- "runvil-types",
- "runvil-vfs",
- "serde",
- "serde_json",
- "tracing",
-]
-
-[[package]]
-name = "runvil-types"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-dependencies = [
- "serde",
- "serde_json",
- "sha2 0.11.0",
-]
-
-[[package]]
-name = "runvil-vfs"
-version = "0.3.0"
-source = "git+https://github.com/cppalliance/runvil-harness?rev=5bca6f9fd9b398d5f221a5893570b8085bc283da#5bca6f9fd9b398d5f221a5893570b8085bc283da"
-
-[[package]]
-name = "rust-embed"
-version = "8.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9e7760e252aaba7b09f4be00e36476cf585bdb68a53552ac954cdf504ab4bc9"
-dependencies = [
- "rust-embed-impl",
- "rust-embed-utils",
- "walkdir",
-]
-
-[[package]]
-name = "rust-embed-impl"
-version = "8.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bcfc4d6f53af43755f7a723e4b6b8794fcce052a178dd8c6c1dadc5f5343097"
-dependencies = [
- "mime_guess",
- "proc-macro2",
- "quote",
- "rust-embed-utils",
- "shellexpand",
- "syn 2.0.119",
- "walkdir",
-]
-
-[[package]]
-name = "rust-embed-utils"
-version = "8.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ffa149f6aa81b58a5b3011d01a857c4ed12c7a732d2c51947a4c7c692185f0"
-dependencies = [
- "sha2 0.11.0",
- "walkdir",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
-[[package]]
-name = "rustc_version_runtime"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dd18cd2bae1820af0b6ad5e54f4a51d0f3fcc53b05f845675074efcc7af071d"
-dependencies = [
- "rustc_version",
- "semver",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags 2.13.1",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
-dependencies = [
- "bitflags 2.13.1",
- "errno",
- "libc",
- "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
-dependencies = [
- "aws-lc-rs",
- "once_cell",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-native-certs"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
-dependencies = [
- "openssl-probe",
- "rustls-pki-types",
- "schannel",
- "security-framework",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-platform-verifier"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
-dependencies = [
- "core-foundation 0.10.1",
- "core-foundation-sys",
- "jni 0.22.4",
- "log",
- "once_cell",
- "rustls",
- "rustls-native-certs",
- "rustls-platform-verifier-android",
- "rustls-webpki",
- "security-framework",
- "security-framework-sys",
- "webpki-root-certs",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls-platform-verifier-android"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
-dependencies = [
- "aws-lc-rs",
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "ryu"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
-[[package]]
-name = "salsa20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
-dependencies = [
- "cipher",
-]
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "schannel"
-version = "0.1.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "schemars"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
-dependencies = [
- "dyn-clone",
- "indexmap 1.9.3",
- "schemars_derive",
- "serde",
- "serde_json",
- "url",
- "uuid",
-]
-
-[[package]]
-name = "schemars"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "schemars"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "schemars_derive"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde_derive_internals",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "scraper"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93cecd86d6259499c844440546d02f55f3e17bd286e529e48d1f9f67e92315cb"
-dependencies = [
- "cssparser",
- "ego-tree",
- "getopts",
- "html5ever 0.36.1",
- "precomputed-hash",
- "selectors 0.33.0",
- "tendril 0.4.3",
-]
-
-[[package]]
-name = "scrypt"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
-dependencies = [
- "pbkdf2",
- "salsa20",
- "sha2 0.10.9",
-]
-
-[[package]]
-name = "security-framework"
-version = "3.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
-dependencies = [
- "bitflags 2.13.1",
- "core-foundation 0.10.1",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
-[[package]]
-name = "security-framework-sys"
-version = "2.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "selectors"
-version = "0.33.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
-dependencies = [
- "bitflags 2.13.1",
- "cssparser",
- "derive_more",
- "log",
- "new_debug_unreachable",
- "phf",
- "phf_codegen",
- "precomputed-hash",
- "rustc-hash 2.1.3",
- "servo_arc",
- "smallvec",
-]
-
-[[package]]
-name = "selectors"
-version = "0.36.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c"
-dependencies = [
- "bitflags 2.13.1",
- "cssparser",
- "derive_more",
- "log",
- "new_debug_unreachable",
- "phf",
- "phf_codegen",
- "precomputed-hash",
- "rustc-hash 2.1.3",
- "servo_arc",
- "smallvec",
-]
-
-[[package]]
-name = "self_cell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
-
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-dependencies = [
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde-untagged"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9faf48a4a2d2693be24c6289dbe26552776eb7737074e6722891fadbe6c5058"
-dependencies = [
- "erased-serde",
- "serde",
- "serde_core",
- "typeid",
-]
-
-[[package]]
-name = "serde-value"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
-dependencies = [
- "ordered-float",
- "serde",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "serde_derive_internals"
-version = "0.29.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.151"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_norway"
-version = "0.9.42"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e408f29489b5fd500fab51ff1484fc859bb655f32c671f307dcd733b72e8168c"
-dependencies = [
- "indexmap 2.14.0",
- "itoa",
- "ryu",
- "serde",
- "unsafe-libyaml-norway",
-]
-
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_repr"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_with"
-version = "3.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
-dependencies = [
- "base64 0.22.1",
- "bs58",
- "chrono",
- "hex",
- "indexmap 1.9.3",
- "indexmap 2.14.0",
- "jiff",
- "schemars 0.9.0",
- "schemars 1.2.2",
- "serde_core",
- "serde_json",
- "serde_with_macros",
- "time",
-]
-
-[[package]]
-name = "serde_with_macros"
-version = "3.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
-dependencies = [
- "darling",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "serde_yaml_ng"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
-dependencies = [
- "indexmap 2.14.0",
- "itoa",
- "ryu",
- "serde",
- "unsafe-libyaml",
-]
-
-[[package]]
-name = "serialize-to-javascript"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f3666a07a197cdb77cdf306c32be9b7f598d7060d50cfd4d5aa04bfd92f6c5"
-dependencies = [
- "serde",
- "serde_json",
- "serialize-to-javascript-impl",
-]
-
-[[package]]
-name = "serialize-to-javascript-impl"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "772ee033c0916d670af7860b6e1ef7d658a4629a6d0b4c8c3e67f09b3765b75d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "servo_arc"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
-dependencies = [
- "stable_deref_trait",
-]
-
-[[package]]
-name = "sha1"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
-[[package]]
-name = "sha1"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "sha1_smol"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "sharded-slab"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "shellexpand"
-version = "3.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8"
-dependencies = [
- "dirs",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "shuttle"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab17edba38d63047f46780cf7360acf7467fec2c048928689a5c1dd1c2b4e31"
-dependencies = [
- "assoc",
- "bitvec",
- "cfg-if",
- "generator",
- "hex",
- "owo-colors",
- "rand 0.8.8",
- "rand_core 0.6.4",
- "rand_pcg 0.3.1",
- "scoped-tls",
- "smallvec",
- "tracing",
-]
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
-dependencies = [
- "errno",
- "libc",
-]
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
-
-[[package]]
-name = "simd_cesu8"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
-dependencies = [
- "rustc_version",
- "simdutf8",
-]
-
-[[package]]
-name = "simdutf8"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
-
-[[package]]
-name = "simsimd"
-version = "6.5.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4fb3bc3cdce07a7d7d4caa4c54f8aa967f6be41690482b54b24100a2253fa70"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "siphasher"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-
-[[package]]
-name = "socket2"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "softaes"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45e14297decde697ddf377c25752aead0927d5cfc89c2684d2af96901a4ceeea"
-
-[[package]]
-name = "softbuffer"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aac18da81ebbf05109ab275b157c22a653bb3c12cf884450179942f81bcbf6c3"
-dependencies = [
- "bytemuck",
- "js-sys",
- "ndk",
- "objc2",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation",
- "objc2-quartz-core",
- "raw-window-handle",
- "redox_syscall",
- "tracing",
- "wasm-bindgen",
- "web-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "soup3"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
-dependencies = [
- "futures-channel",
- "gio",
- "glib",
- "libc",
- "soup3-sys",
-]
-
-[[package]]
-name = "soup3-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
-dependencies = [
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "sse-stream"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c25ac7aff0abd1dbc474536e40416e1102c7dd9bfba0b9861c6d357f835dcfb4"
-dependencies = [
- "bytes",
- "futures-util",
- "http-body",
- "http-body-util",
- "pin-project-lite",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
-[[package]]
-name = "stacker"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "psm",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "string_cache"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
-dependencies = [
- "new_debug_unreachable",
- "parking_lot",
- "phf_shared",
- "precomputed-hash",
- "serde",
-]
-
-[[package]]
-name = "string_cache_codegen"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
-dependencies = [
- "phf_generator",
- "phf_shared",
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "strum"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
-dependencies = [
- "strum_macros",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "rustversion",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
-[[package]]
-name = "swift-rs"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e45c444e496845d3f2a351146bff59aae4975b2280238df1dfaa0c7d1846f38e"
-dependencies = [
- "base64 0.21.7",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "symlink"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.119"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "system-configuration"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
-dependencies = [
- "bitflags 2.13.1",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "system-deps"
-version = "6.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
-dependencies = [
- "cfg-expr",
- "heck 0.5.0",
- "pkg-config",
- "toml 0.8.2",
- "version-compare",
-]
-
-[[package]]
-name = "tao"
-version = "0.35.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1c93047acf68669466a34690ac58cca7010bd1b201e1ec86f1fd0a75d3dd4a9"
-dependencies = [
- "bitflags 2.13.1",
- "block2",
- "core-foundation 0.10.1",
- "core-graphics",
- "crossbeam-channel",
- "dbus",
- "dispatch2",
- "dlopen2",
- "dpi",
- "gdkwayland-sys",
- "gdkx11-sys",
- "gtk",
- "jni 0.21.1",
- "libc",
- "log",
- "ndk",
- "ndk-sys",
- "objc2",
- "objc2-app-kit",
- "objc2-foundation",
- "objc2-ui-kit",
- "once_cell",
- "parking_lot",
- "percent-encoding",
- "raw-window-handle",
- "tao-macros",
- "unicode-segmentation",
- "url",
- "windows",
- "windows-core 0.61.2",
- "windows-version",
- "x11-dl",
-]
-
-[[package]]
-name = "tao-macros"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tap"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
-
-[[package]]
-name = "tar"
-version = "0.4.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
-dependencies = [
- "filetime",
- "libc",
- "xattr",
-]
-
-[[package]]
-name = "target-lexicon"
-version = "0.12.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
-
-[[package]]
-name = "tauri"
-version = "2.11.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "667b20e2726d572dea2de7370da16e188eb06008faf9a92fab7cdc46791190b5"
-dependencies = [
- "anyhow",
- "bytes",
- "cookie",
- "dirs",
- "dunce",
- "embed_plist",
- "getrandom 0.3.4",
- "glob",
- "gtk",
- "heck 0.5.0",
- "http",
- "jni 0.21.1",
- "libc",
- "log",
- "mime",
- "muda",
- "objc2",
- "objc2-app-kit",
- "objc2-foundation",
- "objc2-ui-kit",
- "objc2-web-kit",
- "percent-encoding",
- "plist",
- "raw-window-handle",
- "reqwest",
- "serde",
- "serde_json",
- "serde_repr",
- "serialize-to-javascript",
- "swift-rs",
- "tauri-build",
- "tauri-macros",
- "tauri-runtime",
- "tauri-runtime-wry",
- "tauri-utils",
- "thiserror 2.0.19",
- "tokio",
- "tray-icon",
- "url",
- "webkit2gtk",
- "webview2-com",
- "window-vibrancy",
- "windows",
-]
-
-[[package]]
-name = "tauri-build"
-version = "2.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9ce40b16101cb6ea63d3e221567affd1c3a9205f95d7bc574941a10636b632"
-dependencies = [
- "anyhow",
- "cargo_toml",
- "dirs",
- "glob",
- "heck 0.5.0",
- "json-patch",
- "schemars 0.8.22",
- "semver",
- "serde",
- "serde_json",
- "tauri-utils",
- "tauri-winres",
- "walkdir",
-]
-
-[[package]]
-name = "tauri-codegen"
-version = "2.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08279169ff42f8fc45a1dbc9dcae888893ba95288142e5880c59b93a26d2cfc5"
-dependencies = [
- "base64 0.22.1",
- "brotli",
- "ico",
- "json-patch",
- "plist",
- "png 0.17.16",
- "proc-macro2",
- "quote",
- "semver",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "syn 2.0.119",
- "tauri-utils",
- "thiserror 2.0.19",
- "time",
- "url",
- "uuid",
- "walkdir",
-]
-
-[[package]]
-name = "tauri-macros"
-version = "2.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8b394794f399a421811d06966343e7933fcae92d59f5180b9388d1174497a45"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "tauri-codegen",
- "tauri-utils",
-]
-
-[[package]]
-name = "tauri-plugin"
-version = "2.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74be5dd4bed9afbd145e5716b5fa2ec28cbc29c34ffa61c258c9273d896c8020"
-dependencies = [
- "anyhow",
- "glob",
- "plist",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "tauri-utils",
- "walkdir",
-]
-
-[[package]]
-name = "tauri-plugin-dialog"
-version = "2.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61854a36651aa48381e5e209f69a01273b77f3f9f91f0c430b1b98d33bd47229"
-dependencies = [
- "log",
- "raw-window-handle",
- "rfd",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "tauri-plugin-fs",
- "thiserror 2.0.19",
- "url",
-]
-
-[[package]]
-name = "tauri-plugin-fs"
-version = "2.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de22eef34fd78c0da050e748710edd50bf127e651d02ea1b2bfada1523cc5c51"
-dependencies = [
- "anyhow",
- "dunce",
- "glob",
- "log",
- "objc2-foundation",
- "percent-encoding",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "serde_repr",
- "tauri",
- "tauri-plugin",
- "tauri-utils",
- "thiserror 2.0.19",
- "toml 1.1.4+spec-1.1.0",
- "url",
-]
-
-[[package]]
-name = "tauri-plugin-opener"
-version = "2.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60d60366174b745b4ef5824b8bbc1c457fd08f0ce101ff643c0a49181a9f4e91"
-dependencies = [
- "dunce",
- "glob",
- "objc2-app-kit",
- "objc2-foundation",
- "open",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "thiserror 2.0.19",
- "url",
- "windows",
- "zbus",
-]
-
-[[package]]
-name = "tauri-plugin-process"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d55511a7bf6cd70c8767b02c97bf8134fa434daf3926cfc1be0a0f94132d165a"
-dependencies = [
- "tauri",
- "tauri-plugin",
-]
-
-[[package]]
-name = "tauri-plugin-single-instance"
-version = "2.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cd0cb5c412a5071b69bab6a6df1583cbb89460d4a83b6a24769b08d15b6b1e1"
-dependencies = [
- "serde",
- "serde_json",
- "tauri",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "windows-sys 0.60.2",
- "zbus",
-]
-
-[[package]]
-name = "tauri-plugin-updater"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b28d8cabdeb0564f03ae261963de4bc3d98321cd3d213e76a81b7d344e5df606"
-dependencies = [
- "base64 0.22.1",
- "dirs",
- "flate2",
- "futures-util",
- "http",
- "infer",
- "log",
- "minisign-verify",
- "osakit",
- "percent-encoding",
- "reqwest",
- "semver",
- "serde",
- "serde_json",
- "tar",
- "tauri",
- "tauri-plugin",
- "tempfile",
- "thiserror 2.0.19",
- "time",
- "tokio",
- "url",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "tauri-runtime"
-version = "2.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0b4bc95aed361b0019067d189a1174a603d460d0f6c72606512d59fc9c12ec8"
-dependencies = [
- "cookie",
- "dpi",
- "gtk",
- "http",
- "jni 0.21.1",
- "objc2",
- "objc2-ui-kit",
- "objc2-web-kit",
- "raw-window-handle",
- "serde",
- "serde_json",
- "tauri-utils",
- "thiserror 2.0.19",
- "url",
- "webkit2gtk",
- "webview2-com",
- "windows",
-]
-
-[[package]]
-name = "tauri-runtime-wry"
-version = "2.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e6fac707727b7a2f48e4ded90976324267371073edbb415ffb73bb0458d203f"
-dependencies = [
- "gtk",
- "http",
- "jni 0.21.1",
- "log",
- "objc2",
- "objc2-app-kit",
- "once_cell",
- "percent-encoding",
- "raw-window-handle",
- "softbuffer",
- "tao",
- "tauri-runtime",
- "tauri-utils",
- "url",
- "webkit2gtk",
- "webview2-com",
- "windows",
- "wry",
-]
-
-[[package]]
-name = "tauri-utils"
-version = "2.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e176a18e67764923c4f1ce66f25ae4abe5f688384d5eb1a0fa6c77f3d90f887"
-dependencies = [
- "anyhow",
- "brotli",
- "cargo_metadata",
- "ctor",
- "dom_query",
- "dunce",
- "glob",
- "http",
- "infer",
- "json-patch",
- "log",
- "memchr",
- "phf",
- "plist",
- "proc-macro2",
- "quote",
- "regex",
- "schemars 0.8.22",
- "semver",
- "serde",
- "serde-untagged",
- "serde_json",
- "serde_with",
- "swift-rs",
- "thiserror 2.0.19",
- "toml 1.1.4+spec-1.1.0",
- "url",
- "urlpattern",
- "uuid",
- "walkdir",
-]
-
-[[package]]
-name = "tauri-winres"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc65d45c68858bfe420dd29e834b5d15dbecf8a07a8a16cf4d532c7b1f69d4b6"
-dependencies = [
- "dunce",
- "embed-resource",
- "toml 1.1.4+spec-1.1.0",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
-dependencies = [
- "fastrand",
- "getrandom 0.4.3",
- "once_cell",
- "rustix 1.1.4",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tendril"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
-dependencies = [
- "futf",
- "mac",
- "utf-8",
-]
-
-[[package]]
-name = "tendril"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
-dependencies = [
- "new_debug_unreachable",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
-dependencies = [
- "thiserror-impl 2.0.19",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "time"
-version = "0.3.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
-dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
-
-[[package]]
-name = "time-macros"
-version = "0.2.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
-dependencies = [
- "displaydoc",
- "serde_core",
- "zerovec",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tokio"
-version = "1.54.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
-dependencies = [
- "bytes",
- "libc",
- "mio",
- "pin-project-lite",
- "socket2",
- "tokio-macros",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
-name = "tokio-stream"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
-dependencies = [
- "futures-core",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "tokio-tungstenite"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
-dependencies = [
- "futures-util",
- "log",
- "tokio",
- "tungstenite",
-]
-
-[[package]]
-name = "tokio-util"
-version = "0.7.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "toml"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
-dependencies = [
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.3",
- "toml_edit 0.20.2",
-]
-
-[[package]]
-name = "toml"
-version = "0.9.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
-dependencies = [
- "indexmap 2.14.0",
- "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml"
-version = "1.1.4+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
-dependencies = [
- "indexmap 2.14.0",
- "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 1.1.1+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.19.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
-dependencies = [
- "indexmap 2.14.0",
- "toml_datetime 0.6.3",
- "winnow 0.5.40",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
-dependencies = [
- "indexmap 2.14.0",
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.3",
- "winnow 0.5.40",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.13+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
-dependencies = [
- "indexmap 2.14.0",
- "toml_datetime 1.1.1+spec-1.1.0",
- "toml_parser",
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
-dependencies = [
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "toml_writer"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
-
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
-dependencies = [
- "async-compression",
- "bitflags 2.13.1",
- "bytes",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "pin-project-lite",
- "tokio",
- "tokio-util",
- "tower",
- "tower-layer",
- "tower-service",
- "url",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "log",
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-appender"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
-dependencies = [
- "crossbeam-channel",
- "symlink",
- "thiserror 2.0.19",
- "time",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
-dependencies = [
- "matchers",
- "nu-ansi-term",
- "once_cell",
- "regex-automata",
- "sharded-slab",
- "smallvec",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
-]
-
-[[package]]
-name = "tray-icon"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "045979e3f037cd18ad1cb2a419dfda133c5c29c9f3453370079f2255d46c257e"
-dependencies = [
- "crossbeam-channel",
- "dirs",
- "libappindicator",
- "muda",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-foundation",
- "once_cell",
- "png 0.18.1",
- "serde",
- "thiserror 2.0.19",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
-[[package]]
-name = "tungstenite"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
-dependencies = [
- "bytes",
- "data-encoding",
- "http",
- "httparse",
- "log",
- "rand 0.9.5",
- "sha1 0.10.7",
- "thiserror 2.0.19",
-]
-
-[[package]]
-name = "turso"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9491d7a80312c5abe66a4409e4dce02065503a235453c94b9e4133877e39ffc"
-dependencies = [
- "thiserror 2.0.19",
- "tracing",
- "tracing-subscriber",
- "turso_core",
- "turso_sdk_kit",
- "turso_sync_sdk_kit",
-]
-
-[[package]]
-name = "turso_core"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a833cc3bf8d4e6c101c504fa470f8ab4270c2202ff2591b61b2e373b4f20d9b"
-dependencies = [
- "aegis",
- "aes",
- "aes-gcm",
- "allocator-api2",
- "antithesis_sdk",
- "arc-swap",
- "aristo",
- "bigdecimal",
- "bitflags 2.13.1",
- "branches",
- "bumpalo",
- "bytemuck",
- "cfg_aliases",
- "cfg_block",
- "chrono",
- "crc32c",
- "crossbeam-epoch",
- "crossbeam-utils",
- "either",
- "fallible-iterator",
- "fastbloom",
- "hex",
- "icu_collator",
- "icu_locale",
- "intrusive-collections",
- "io-uring",
- "libc",
- "libloading 0.8.9",
- "libm",
- "loom",
- "miette",
- "num-bigint",
- "num-traits",
- "pack1",
- "parking_lot",
- "pastey",
- "polling",
- "rand 0.9.5",
- "rapidhash",
- "regex",
- "regex-syntax",
- "roaring",
- "rustc-hash 2.1.3",
- "rustix 1.1.4",
- "ryu",
- "serde_json",
- "shuttle",
- "simsimd",
- "smallvec",
- "strum",
- "strum_macros",
- "tempfile",
- "thiserror 2.0.19",
- "tracing",
- "tracing-subscriber",
- "turso_ext",
- "turso_macros",
- "turso_parser",
- "twox-hash",
- "uncased",
- "uuid",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "turso_ext"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7452fe676450b6840e9eb80e512d14293265221154eba66aba3845dfc0d659f"
-dependencies = [
- "chrono",
- "getrandom 0.4.3",
- "turso_macros",
-]
-
-[[package]]
-name = "turso_macros"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2825eaa6b7b893693636947f988e252c1196393fa54d4b85637c70d616d92fa"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "turso_parser"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0e58d029f02e442df4be0b5036ce520b49c553505d9d52ef5a98fc4056e95b7"
-dependencies = [
- "bitflags 2.13.1",
- "memchr",
- "miette",
- "strum",
- "strum_macros",
- "thiserror 2.0.19",
- "turso_macros",
-]
-
-[[package]]
-name = "turso_sdk_kit"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18c1dc1c0304348c39b97bc6b27cdcb1d7292454ebd0de0f30b5ee3a4c61f9bb"
-dependencies = [
- "bindgen",
- "env_logger",
- "parking_lot",
- "tracing",
- "tracing-appender",
- "tracing-subscriber",
- "turso_core",
- "turso_ext",
- "turso_sdk_kit_macros",
-]
-
-[[package]]
-name = "turso_sdk_kit_macros"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4708b5fe678b8730c85964e3d378f75e18c23c4409971360b2209f4e53e4956"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "turso_sync_engine"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce8f03e430240d590d209ac874db52773b7382c627cd604a685affde77622b09"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "crc32c",
- "genawaiter",
- "http",
- "libc",
- "prost",
- "roaring",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tracing",
- "turso_core",
- "turso_parser",
- "uuid",
-]
-
-[[package]]
-name = "turso_sync_sdk_kit"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d48cb47d056c3ec567745761fa6f832358ca30ef9eb0435fdcfb77c558e70089"
-dependencies = [
- "bindgen",
- "env_logger",
- "genawaiter",
- "parking_lot",
- "tracing",
- "tracing-appender",
- "tracing-subscriber",
- "turso_core",
- "turso_sdk_kit",
- "turso_sdk_kit_macros",
- "turso_sync_engine",
-]
-
-[[package]]
-name = "twox-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8464ec13c3691491391d9fce00f6416c9a48e46972f72d7865688be2080192c9"
-dependencies = [
- "rand 0.10.2",
-]
-
-[[package]]
-name = "typed-arena"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
-
-[[package]]
-name = "typeid"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "uds_windows"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
-dependencies = [
- "memoffset",
- "tempfile",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "uncased"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "unic-char-property"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221"
-dependencies = [
- "unic-char-range",
-]
-
-[[package]]
-name = "unic-char-range"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc"
-
-[[package]]
-name = "unic-common"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
-
-[[package]]
-name = "unic-ucd-ident"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
-dependencies = [
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
-[[package]]
-name = "unic-ucd-version"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4"
-dependencies = [
- "unic-common",
-]
-
-[[package]]
-name = "unicase"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "unit-prefix"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
-
-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common 0.1.7",
- "subtle",
-]
-
-[[package]]
-name = "unsafe-libyaml"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
-
-[[package]]
-name = "unsafe-libyaml-norway"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
- "serde_derive",
-]
-
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
-[[package]]
-name = "urlpattern"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
-dependencies = [
- "regex",
- "serde",
- "unic-ucd-ident",
- "url",
-]
-
-[[package]]
-name = "utf-8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
-
-[[package]]
-name = "utf16_iter"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "uuid"
-version = "1.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
-dependencies = [
- "getrandom 0.4.3",
- "js-sys",
- "serde_core",
- "sha1_smol",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "v_htmlescape"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e8257fbc510f0a46eb602c10215901938b5c2a7d5e70fc11483b1d3c9b5b18c"
-
-[[package]]
-name = "valuable"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
-
-[[package]]
-name = "version-compare"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "vswhom"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
-dependencies = [
- "libc",
- "vswhom-sys",
-]
-
-[[package]]
-name = "vswhom-sys"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
-dependencies = [
- "wit-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
-dependencies = [
- "bumpalo",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "wasm-streams"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
-dependencies = [
- "futures-util",
- "js-sys",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web_atoms"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "075474b12bcb3d2e3d4546580e9de478eeeead668a1761e2a8860c836b7ef297"
-dependencies = [
- "phf",
- "phf_codegen",
- "string_cache",
- "string_cache_codegen",
-]
-
-[[package]]
-name = "webkit2gtk"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
-dependencies = [
- "bitflags 1.3.2",
- "cairo-rs",
- "gdk",
- "gdk-sys",
- "gio",
- "gio-sys",
- "glib",
- "glib-sys",
- "gobject-sys",
- "gtk",
- "gtk-sys",
- "javascriptcore-rs",
- "libc",
- "once_cell",
- "soup3",
- "webkit2gtk-sys",
-]
-
-[[package]]
-name = "webkit2gtk-sys"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
-dependencies = [
- "bitflags 1.3.2",
- "cairo-sys-rs",
- "gdk-sys",
- "gio-sys",
- "glib-sys",
- "gobject-sys",
- "gtk-sys",
- "javascriptcore-rs-sys",
- "libc",
- "pkg-config",
- "soup3-sys",
- "system-deps",
-]
-
-[[package]]
-name = "webpki-root-certs"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "webview2-com"
-version = "0.38.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a"
-dependencies = [
- "webview2-com-macros",
- "webview2-com-sys",
- "windows",
- "windows-core 0.61.2",
- "windows-implement",
- "windows-interface",
-]
-
-[[package]]
-name = "webview2-com-macros"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "webview2-com-sys"
-version = "0.38.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c"
-dependencies = [
- "thiserror 2.0.19",
- "windows",
- "windows-core 0.61.2",
-]
-
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.44",
-]
-
-[[package]]
-name = "which"
-version = "8.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bae2f2b2b816647a1cab1acc91f5bd20812d53cb344382635ec2181940c8034f"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "window-vibrancy"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9bec5a31f3f9362f2258fd0e9c9dd61a9ca432e7306cc78c444258f0dce9a9c"
-dependencies = [
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "raw-window-handle",
- "windows-sys 0.59.0",
- "windows-version",
-]
-
-[[package]]
-name = "windows"
-version = "0.61.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
-dependencies = [
- "windows-collections",
- "windows-core 0.61.2",
- "windows-future",
- "windows-link 0.1.3",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
-dependencies = [
- "windows-core 0.61.2",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link 0.1.3",
- "windows-result 0.3.4",
- "windows-strings 0.4.2",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
-]
-
-[[package]]
-name = "windows-future"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
-dependencies = [
- "windows-core 0.61.2",
- "windows-link 0.1.3",
- "windows-threading",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-numerics"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
-dependencies = [
- "windows-core 0.61.2",
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
-dependencies = [
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link 0.2.1",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
-[[package]]
-name = "windows-threading"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-version"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
-[[package]]
-name = "winnow"
-version = "0.5.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-
-[[package]]
-name = "winnow"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "winreg"
-version = "0.55.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
-dependencies = [
- "cfg-if",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "wit-bindgen"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
-
-[[package]]
-name = "workshop"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "reqwest",
- "serde",
- "serde_json",
- "tauri",
- "tauri-build",
- "tauri-plugin-dialog",
- "tauri-plugin-opener",
- "tauri-plugin-process",
- "tauri-plugin-single-instance",
- "tauri-plugin-updater",
- "tempfile",
- "url",
- "webkit2gtk",
- "webview2-com",
- "windows-core 0.61.2",
- "workshop-server-api",
-]
-
-[[package]]
-name = "workshop-agents"
-version = "0.0.0"
-dependencies = [
- "rand 0.9.5",
- "runvil",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "workshop-gateway"
-version = "0.0.0"
-dependencies = [
- "arc-swap",
- "axum",
- "futures-util",
- "reqwest",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tokio-tungstenite",
- "tracing",
- "url",
- "workshop-gateway-discovery",
- "workshop-protocol",
- "workshop-registry",
- "workshop-support",
-]
-
-[[package]]
-name = "workshop-gateway-discovery"
-version = "0.3.0"
-dependencies = [
- "libc",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "windows-sys 0.61.2",
- "workshop-gateway-discovery",
-]
-
-[[package]]
-name = "workshop-menu"
-version = "0.0.0"
-dependencies = [
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "workshop-protocol",
- "workshop-registry",
- "workshop-support",
-]
-
-[[package]]
-name = "workshop-plugin-bashkit"
-version = "0.3.0"
-dependencies = [
- "plugin-bashkit",
- "runvil-plugin-sdk",
-]
-
-[[package]]
-name = "workshop-plugin-std"
-version = "0.3.0"
-dependencies = [
- "plugin-std",
- "runvil-plugin-sdk",
-]
-
-[[package]]
-name = "workshop-protocol"
-version = "0.0.0"
-dependencies = [
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "workshop-registry"
-version = "0.0.0"
-dependencies = [
- "axum",
- "serde_json",
- "tokio",
- "workshop-protocol",
-]
-
-[[package]]
-name = "workshop-run-log"
-version = "0.0.0"
-dependencies = [
- "runvil",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "turso",
-]
-
-[[package]]
-name = "workshop-server"
-version = "0.3.0"
-dependencies = [
- "async-trait",
- "axum",
- "build-ui",
- "futures-util",
- "harness-gateway-client",
- "plugin-mcp",
- "plugin-web",
- "reqwest",
- "runvil",
- "rust-embed",
- "serde",
- "serde_json",
- "socket2",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tokio-tungstenite",
- "tower",
- "tracing",
- "url",
- "workshop-agents",
- "workshop-gateway",
- "workshop-menu",
- "workshop-plugin-bashkit",
- "workshop-plugin-std",
- "workshop-protocol",
- "workshop-registry",
- "workshop-run-log",
- "workshop-server",
- "workshop-status",
- "workshop-support",
- "workshop-user-state",
- "workshop-workspace",
-]
-
-[[package]]
-name = "workshop-server-api"
-version = "0.0.0"
-dependencies = [
- "workshop-server",
- "workshop-server-api",
-]
-
-[[package]]
-name = "workshop-status"
-version = "0.0.0"
-dependencies = [
- "tokio",
- "workshop-protocol",
- "workshop-registry",
- "workshop-support",
-]
-
-[[package]]
-name = "workshop-support"
-version = "0.0.0"
-dependencies = [
- "axum",
- "reqwest",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "toml 1.1.4+spec-1.1.0",
- "tower",
- "tracing",
-]
-
-[[package]]
-name = "workshop-user-state"
-version = "0.0.0"
-dependencies = [
- "axum",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tower",
- "tracing",
- "workshop-protocol",
- "workshop-registry",
- "workshop-support",
-]
-
-[[package]]
-name = "workshop-workspace"
-version = "0.0.0"
-dependencies = [
- "axum",
- "dunce",
- "humantime",
- "percent-encoding",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tower",
- "tracing",
- "turso",
- "workshop-protocol",
- "workshop-registry",
- "workshop-support",
- "workshop-workspace",
-]
-
-[[package]]
-name = "write16"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
-
-[[package]]
-name = "writeable"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
-
-[[package]]
-name = "wry"
-version = "0.55.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186f9871daa55fd9c016578b810d149de58367113db7fb72b462d2323ce19514"
-dependencies = [
- "base64 0.22.1",
- "block2",
- "cookie",
- "crossbeam-channel",
- "dirs",
- "dom_query",
- "dpi",
- "dunce",
- "gdkx11",
- "gtk",
- "http",
- "javascriptcore-rs",
- "jni 0.21.1",
- "libc",
- "ndk",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "objc2-ui-kit",
- "objc2-web-kit",
- "once_cell",
- "percent-encoding",
- "raw-window-handle",
- "sha2 0.10.9",
- "soup3",
- "tao-macros",
- "thiserror 2.0.19",
- "url",
- "webkit2gtk",
- "webkit2gtk-sys",
- "webview2-com",
- "windows",
- "windows-core 0.61.2",
- "windows-version",
- "x11-dl",
-]
-
-[[package]]
-name = "wyz"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
-dependencies = [
- "tap",
-]
-
-[[package]]
-name = "x11"
-version = "2.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
-dependencies = [
- "libc",
- "pkg-config",
-]
-
-[[package]]
-name = "x11-dl"
-version = "2.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
-dependencies = [
- "libc",
- "once_cell",
- "pkg-config",
-]
-
-[[package]]
-name = "xattr"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
-dependencies = [
- "libc",
- "rustix 1.1.4",
-]
-
-[[package]]
-name = "xml5ever"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dc9559429edf0cd3f327cc0afd9d6b36fa8cec6d93107b7fbe64f806b5f2d9"
-dependencies = [
- "log",
- "markup5ever 0.38.0",
-]
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
-[[package]]
-name = "zbus"
-version = "5.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db4be7c075cb421e4b7ee645541604239bd243ba7c357511f4ff3a74b555907"
-dependencies = [
- "async-broadcast",
- "async-executor",
- "async-io",
- "async-lock",
- "async-process",
- "async-recursion",
- "async-task",
- "async-trait",
- "blocking",
- "enumflags2",
- "event-listener",
- "futures-core",
- "futures-lite",
- "hex",
- "libc",
- "ordered-stream",
- "rustix 1.1.4",
- "serde",
- "serde_repr",
- "tracing",
- "uds_windows",
- "uuid",
- "windows-sys 0.61.2",
- "winnow 1.0.4",
- "zbus_macros",
- "zbus_names",
- "zvariant",
-]
-
-[[package]]
-name = "zbus_macros"
-version = "5.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2990635d09ade6df1868f72f8cac69a876a90981e8bd3c40b1be413f8dc88f40"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "zbus_names",
- "zvariant",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zbus_names"
-version = "4.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8bf88b4a3ff53e883001e0e0115b297a9d53c31b9c1edd2bfdd853e3428624e"
-dependencies = [
- "serde",
- "winnow 1.0.4",
- "zvariant",
-]
-
-[[package]]
-name = "zcheapstr"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
-
-[[package]]
-name = "zerotrie"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
-dependencies = [
- "serde",
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 
 [[package]]
 name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
-
-[[package]]
-name = "zvariant"
-version = "5.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1d34c27cc6cdd1f458427519dd6b8612f7b7e3f7b9a0b2355d041dda9869147"
-dependencies = [
- "endi",
- "enumflags2",
- "serde",
- "winnow 1.0.4",
- "zcheapstr",
- "zvariant_derive",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_derive"
-version = "5.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "864155e69b4352db0c7f374917bf45d1e0c8d17659c8b3dbf9795f3673f8c497"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_utils"
-version = "4.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bad0294361a320b694a328460dc73add56c306150f5cb6bfafc44446120008a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde",
- "syn 3.0.3",
- "winnow 1.0.4",
-]
diff --git a/Cargo.toml b/Cargo.toml
index c0b73e9fb..0999f1470 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,16 +1,6 @@
 [workspace]
 resolver = "3"
-members = ["crates/*", "crates/workshop/desktop", "crates/workshop/server", "crates/workshop/server-api", "crates/workshop/gateway", "crates/workshop/gateway-discovery", "crates/workshop/menu", "crates/workshop/protocol", "crates/workshop/registry", "crates/workshop/status", "crates/workshop/support", "crates/workshop/user-state", "crates/workshop/workspace", "crates/workshop/run-log", "crates/workshop/agents", "crates/workshop/plugin-std", "crates/workshop/plugin-bashkit"]
-# crates/workshop is a manifestless container holding Workshop's crates.
-# Cargo prunes excluded subtrees from member globs, so a "crates/workshop/*"
-# glob beside the exclude below would match nothing; the container crates
-# are enumerated explicitly instead.
-exclude = ["crates/workshop"]
-# Plain `cargo build`/`cargo test` build every crate but the desktop app,
-# the server it embeds, and the server's facade: the rest compile on a
-# fresh macOS or Linux clone with no Node install and no Tauri system
-# packages. The desktop app is an explicit choice: `cargo build -p workshop`.
-default-members = ["crates/build-ui", "crates/build-user-guide", "crates/build-workshop", "crates/build-xtask", "crates/workshop/gateway", "crates/workshop/gateway-discovery", "crates/workshop/menu", "crates/workshop/protocol", "crates/workshop/registry", "crates/workshop/status", "crates/workshop/support", "crates/workshop/user-state", "crates/workshop/workspace", "crates/workshop/run-log", "crates/workshop/agents", "crates/workshop/plugin-std", "crates/workshop/plugin-bashkit"]
+members = ["crates/*"]
 
 [workspace.package]
 version = "0.3.0"
@@ -19,143 +9,30 @@ license = "BSL-1.0"
 repository = "https://github.com/cppalliance/runvil"
 
 [workspace.dependencies]
+anyhow = "1"
 base64 = "0.22"
-# The Engine and the Harness, from their own repository, pinned by commit:
-# the `runvil` facade, which is the one crate a Host depends on, the
-# standard Gateway client, and the two Rust Plugins that Workshop links
-# in. All four name one commit, because two commits would be two copies
-# of every type the crates share. `version` beside `git` keeps cargo-deny's
-# wildcard check quiet.
-runvil = { version = "0.3.0", git = "https://github.com/cppalliance/runvil-harness", rev = "5bca6f9fd9b398d5f221a5893570b8085bc283da" }
-harness-gateway-client = { version = "0.3.0", git = "https://github.com/cppalliance/runvil-harness", rev = "5bca6f9fd9b398d5f221a5893570b8085bc283da" }
-plugin-web = { version = "0.3.0", git = "https://github.com/cppalliance/runvil-harness", rev = "5bca6f9fd9b398d5f221a5893570b8085bc283da" }
-plugin-mcp = { version = "0.3.0", git = "https://github.com/cppalliance/runvil-harness", rev = "5bca6f9fd9b398d5f221a5893570b8085bc283da" }
-# The safe layer over the C Plugin contract, version 0.4, from its own
-# repository, pinned by commit. Only the library Plugin crates under
-# `crates/workshop/` name it, for `export_plugin!`. The commit is the one
-# runvil-harness pins the contract's `runvil-plugin-sys` at: that crate
-# sets `links`, so Cargo refuses two commits of the contract in one build.
-runvil-plugin-sdk = { version = "0.4.0", git = "https://github.com/cppalliance/runvil-plugin-api", rev = "03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2" }
-# The std Plugin, from its own repository, pinned by commit, which must be
-# built against the contract commit above. default-features off drops its
-# own export of `runvil_plugin`, which `workshop-plugin-std` makes instead.
-# The key is `std-plugin` because that crate's own library is named
-# `plugin_std`, the name of the file Workshop ships.
-std-plugin = { package = "plugin-std", version = "0.1.0", git = "https://github.com/cppalliance/runvil-plugin-std", rev = "782ad23e5dfbe6fbfa5be7145fa73a9ca60ce8a8", default-features = false }
-# The bashkit Plugin, from its own repository, pinned by commit and built
-# against the same contract commit. default-features off drops its own
-# export of `runvil_plugin`, which `workshop-plugin-bashkit` makes
-# instead. The key is `bashkit-plugin` for the reason std's is
-# `std-plugin`: the crate's own library has the name of the file Workshop
-# ships, `plugin_bashkit`.
-bashkit-plugin = { package = "plugin-bashkit", version = "0.1.0", git = "https://github.com/cppalliance/runvil-plugin-bashkit", rev = "0864f1ff9cc1f4fad6c96f1e9f6d8a3ab85e9580", default-features = false }
-workshop-gateway-discovery = { path = "crates/workshop/gateway-discovery" }
-workshop-server = { path = "crates/workshop/server" }
-workshop-server-api = { path = "crates/workshop/server-api" }
-workshop-gateway = { path = "crates/workshop/gateway" }
-workshop-menu = { path = "crates/workshop/menu" }
-workshop-protocol = { path = "crates/workshop/protocol" }
-workshop-status = { path = "crates/workshop/status" }
-workshop-support = { path = "crates/workshop/support" }
-workshop-registry = { path = "crates/workshop/registry" }
-workshop-workspace = { path = "crates/workshop/workspace" }
-workshop-run-log = { path = "crates/workshop/run-log" }
-workshop-agents = { path = "crates/workshop/agents" }
-workshop-user-state = { path = "crates/workshop/user-state" }
-workshop-plugin-std = { path = "crates/workshop/plugin-std" }
-workshop-plugin-bashkit = { path = "crates/workshop/plugin-bashkit" }
+# Cross-platform Ctrl-C handling for the installer build.
+ctrlc = "3.5"
+# `cargo installer manifest` checks each updater signature as the Tauri
+# updater does: 0.2.5 is the release Workshop's `tauri-plugin-updater`
+# verifies with.
+minisign-verify = "0.2.5"
+# Signs the manifest tests' fixtures with a key generated per run. A
+# dev-dependency only: the release key never leaves CI.
+minisign = "0.9"
+# `span-locations` makes a span parsed outside a proc macro report its line,
+# which the structural checks print with every violation.
+proc-macro2 = { version = "1", features = ["span-locations"] }
 # default-features off: build-xtask's doctest scan reads only the core
 # event stream, never the `html` renderer or the `getopts` binary.
 pulldown-cmark = { version = "0.12", default-features = false }
-serde = { version = "1", features = ["derive"] }
-# `float_roundtrip` makes `from_str` reproduce the exact `f64` that
-# `to_string` printed, so a payload the run log stores reads back bit-for-bit.
-serde_json = { version = "1", features = ["float_roundtrip"] }
-# 0.13 rather than 0.12 so the tree links exactly one rustls crypto backend:
-# aws-lc-rs, the one Tauri already selects. 0.13 has no `ring`
-# option, so a bump cannot re-enable it; CI checks that `ring` stays out of
-# each Rust binary's normal closure. Root certificates come from the OS trust
-# store through the platform verifier (the `rustls` feature's default), not
-# from a bundled Mozilla list. `query` became opt-in in 0.13.
-# `system-proxy` makes reqwest honor Windows registry and macOS proxies.
-reqwest = { version = "0.13", default-features = false, features = ["json", "query", "rustls", "stream", "system-proxy"] }
-rand = "0.9"
-url = "2"
-# Percent-decoding for path parameters; already in the tree as url's own core.
-percent-encoding = "2"
-dunce = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "net", "time", "sync"] }
-thiserror = "2"
-anyhow = "1"
-axum = { version = "0.8", features = ["multipart", "ws"] }
-# 0.29 rather than the newer 0.30 so the resolver unifies with the copy axum's
-# `ws` feature already pulls in, instead of compiling two.
-tokio-tungstenite = "0.29"
-async-trait = "0.1"
-futures-util = "0.3"
-# 1.x rather than 0.8 so the resolver unifies with the copy tauri-utils
-# already pulls in, instead of compiling two toml lines (and the 0.8 line's
-# exclusive toml_edit 0.19 and winnow 0.5 tail).
-toml = "1"
+serde_json = "1"
+sha2 = "0.11"
 # Parses each crate's sources for build-xtask's structural checks; `full`
-# is the feature that parses items. 3 is the newest major the lockfile
-# already carries.
+# is the feature that parses items.
 syn = { version = "3", features = ["full"] }
-# `span-locations` makes a span parsed outside a proc macro report its line,
-# which the structural checks print with every violation.
-proc-macro2 = { version = "1", features = ["span-locations"] }
-tracing = "0.1"
-tower = { version = "0.5", features = ["util"] }
-arc-swap = "1"
-# Serves the UIs: reads $OUT_DIR/ui-dist from disk in debug builds, embeds it
-# into the binary in release builds. interpolate-folder-path resolves the
-# $OUT_DIR prefix in the `folder` attribute.
-rust-embed = { version = "8", features = ["interpolate-folder-path"] }
-humantime = "2"
 tempfile = "3"
-# Exact pin: turso is pre-1.0 and backs user-visible workspace files, so
-# upgrades are deliberate, reviewed changes rather than resolver drift.
-# default-features off: the `mimalloc` default installs a
-# `#[global_allocator]` from inside the library (process-global state and a
-# C build in a serve path), and `fts` is unused; the workspace schema is
-# three plain tables.
-turso = { version = "=0.7.2", default-features = false }
-sha2 = "0.11"
-# `cargo workshop manifest` checks each updater signature as the Tauri
-# updater does; 0.2.5 is the copy tauri-plugin-updater already pulls in.
-minisign-verify = "0.2.5"
-# Signs the manifest tests' fixtures with a key generated per run. A
-# dev-dependency only: the release key never leaves CI.
-minisign = "0.9"
-socket2 = { version = "0.6", features = ["all"] }
-# Cross-platform Ctrl-C handling for the Workshop build orchestrator.
-ctrlc = "3.5"
-# Thin process-image shims for the Workshop gateway discovery reader's stale
-# detection; both are already in the tree transitively.
-libc = "0.2"
-windows-sys = { version = "0.61", default-features = false }
-# Tauri v2 desktop framework for workshop. tauri is pinned to the
-# minor because `with_webview` exposes webview2-com/webkit2gtk types that may
-# shift in a Tauri minor release (the upstream guidance for `with_webview`).
-tauri = "~2.11"
-tauri-build = "2.6.3"
-tauri-plugin-dialog = "2.7.3"
-tauri-plugin-opener = "2.5.5"
-tauri-plugin-process = "2.3.1"
-# default-features off drops the Tauri plugin's `rustls-tls` default, which is
-# the one dependency in the tree that pins rustls to the `ring` backend (and
-# installs it as the process-global CryptoProvider). The plugin's `rustls-tls`
-# default would put `ring` into the Workshop binary. The plugin's reqwest
-# calls still get TLS: cargo unifies reqwest's features per binary and the
-# workspace pin above enables `rustls` (aws-lc-rs), so the Workshop links one
-# crypto backend. `system-proxy` is the plugin's other default, kept as it
-# was. The `zip` default stays off: it only unpacks the older v1Compatible
-# update bundles (the Windows `.zip` and the Linux `.AppImage.tar.gz`), and
-# the desktop app's `"createUpdaterArtifacts": true` ships the signed
-# installers themselves (the NSIS `-setup.exe` and the raw `.AppImage`). The
-# macOS `.app.tar.gz` path uses `tar` and `flate2` with no feature.
-tauri-plugin-updater = { version = "2.11.0", default-features = false, features = ["system-proxy"] }
-tauri-plugin-single-instance = "2.4.4"
+toml = "1"
 
 # The dylint libraries `cargo dylint --all` runs. The lints live in their
 # own repository, shared across the runvil project, because they build on
@@ -164,6 +41,17 @@ tauri-plugin-single-instance = "2.4.4"
 [workspace.metadata.dylint]
 libraries = [{ git = "https://github.com/cppalliance/dylints", rev = "982b297ede90d37cdf8f3bf9995d1d706dcc51d4" }]
 
+# The Workshop commit the installers are built from. Workshop is its own
+# product in its own repository, and `cargo installer` builds the checkout
+# `RUNVIL_WORKSHOP` names, which `installers.yml` takes at this commit.
+# Moving to a newer Workshop is a change of `rev`, together with the
+# workspace version above and `rust-toolchain.toml` when Workshop changed
+# either: `cargo installer` refuses a checkout whose version or toolchain
+# differs from this workspace's.
+[workspace.metadata.workshop]
+git = "https://github.com/cppalliance/runvil-workshop"
+rev = "e32d4caaaa60ad03d47fb807daa5d0d4b2c80ec4"
+
 [workspace.lints.rust]
 unsafe_code = "deny"
 missing_docs = "warn"
@@ -200,8 +88,3 @@ doc_markdown = "allow"
 # `assert_eq!(x, [] as [T; 0])`, which has to spell out the element type and
 # needs `T: PartialEq + Debug`, so it cannot be applied to most call sites.
 assert_is_empty = "allow"
-
-# The profile that 'dist' will build with
-[profile.dist]
-inherits = "release"
-lto = "thin"
diff --git a/README.md b/README.md
index aac1d1d75..2b79872bc 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ The [latest release](https://github.com/cppalliance/runvil/releases/latest) hold
 
 The installer offers Workshop, the desktop app, and the Gateway, the local gateway described below, with its tray icon and Settings page. On Windows it also offers Speech to Text, which needs the Gateway. The Gateway downloads its speech runtime and two speech models, about 0.6 GB, the first time it starts with speech configured, so dictation works offline after that. Workshop installed without the Gateway attaches to a gateway already running for you, or else uses the one `~/.runvil/workshop.toml` names. By default, Windows installs into `%LOCALAPPDATA%\Runvil`, macOS into `/Applications/Runvil`, and Linux into `~/Runvil`.
 
-Workshop checks for updates when it starts and offers each new version, which it installs when you accept. The Gateway is its own product with its own releases, at [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway); each installer carries the Gateway release this repository pins in `gateway-pin/pin.json`.
+Workshop checks for updates when it starts and offers each new version, which it installs when you accept. The Gateway is its own product with its own releases, at [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway); each installer holds the Gateway release that Workshop pins.
 
 The installers are not code-signed yet. On Windows, SmartScreen may stop the setup: choose More info, then Run anyway. On macOS, the first open is refused: open System Settings, then Privacy & Security, choose Open Anyway, and open the installer again. Until the apps are signed, the gateway's Launch at Login does not work on macOS.
 
@@ -33,6 +33,8 @@ Workshop is the desktop app. You open your folders in it, edit files, and work w
 
 Workshop connects to a Gateway that's already running or starts the installed one, and the Gateway stays in the system tray after you close the window, so your loaded models stay loaded.
 
+Workshop is developed in its own repository, [cppalliance/runvil-workshop](https://github.com/cppalliance/runvil-workshop). This repository builds the installers from the Workshop commit that its root `Cargo.toml` pins.
+
 ## What a prompt looks like
 
 This is [`prompts/greet.md`](https://github.com/cppalliance/runvil-harness/blob/master/prompts/greet.md), one of the sample prompts in the Engine's repository:
@@ -66,7 +68,7 @@ The prompt declares no models, so `models.infer(prose)` runs on the Host's defau
 
 ## How it fits together
 
-The Engine and the Harness are Rust libraries. The Engine parses a prompt and steps through it, and whenever the run needs a model reply, a Pack's render of the tools a section offers, a Pack tool's result, a timer, or a file outside a prelude's install, it asks for one and waits. The Harness answers each of those requests and records the run. A Host is any application that runs prompts through the Harness. Workshop is one, and your own program becomes one when it embeds the Harness. The Engine and the Harness are developed in their own repository, [cppalliance/runvil-harness](https://github.com/cppalliance/runvil-harness), which this repository pins by commit.
+The Engine and the Harness are Rust libraries. The Engine parses a prompt and steps through it, and whenever the run needs a model reply, a Pack's render of the tools a section offers, a Pack tool's result, a timer, or a file outside a prelude's install, it asks for one and waits. The Harness answers each of those requests and records the run. A Host is any application that runs prompts through the Harness. Workshop is one, and your own program becomes one when it embeds the Harness. The Engine and the Harness are developed in their own repository, [cppalliance/runvil-harness](https://github.com/cppalliance/runvil-harness).
 
 The Gateway is the one process that holds model credentials, so no other process ever sees a vendor key. It serves an OpenAI-compatible API and routes each request to a cloud provider or to a model running on your own machine. It also provides web search, speech-to-text, text-to-speech, and a settings page in your browser, and you can run it on its own, on a desktop or a server. It is developed and released separately, in [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway).
 
diff --git a/crates/README.md b/crates/README.md
index a684a3247..c5ab74349 100644
--- a/crates/README.md
+++ b/crates/README.md
@@ -1,3 +1,3 @@
 # Crates
 
-This directory holds the workspace's crates. The crates at this level are the build tooling. Workshop keeps its crates in a container directory of its own, `workshop/`, and only the build tooling may depend into it.
+This directory holds the workspace's crates, which are all build tooling. `build-installer` builds the installers from a Workshop checkout, `build-user-guide` stages the books of the documentation site, and `build-xtask` holds the structural checks and builds the site.
diff --git a/crates/build-installer/AGENTS.md b/crates/build-installer/AGENTS.md
new file mode 100644
index 000000000..129fe1402
--- /dev/null
+++ b/crates/build-installer/AGENTS.md
@@ -0,0 +1,8 @@
+# build-installer
+
+- Nothing here builds Workshop or the Gateway. Both come from the Workshop checkout `RUNVIL_WORKSHOP` names. `cargo workshop bundle`, run there, builds Workshop's Tauri bundle (`bundle_command` in `src/main/workshop.rs`). The Gateway is the release that checkout's `gateway-pin/pin.json` names, from `--gateway-binary`, `RUNVIL_GATEWAY_SIDECAR`, or the file the checkout's `tools/fetch-gateway-sidecar.mjs` stages (`src/main/gateway.rs`). A Windows installer is the NSIS setup from that bundle, which already holds the Gateway, so only a macOS or Linux build reads the Gateway and the pin. The build leaves both checkouts clean: it writes only to Cargo's target directories.
+- The installer mode checks the Workshop checkout before any command runs (`check` in `src/main/workshop.rs`). The `[workspace.package]` version in its `Cargo.toml` must equal this workspace's, because the release file names and the release tag check in `.github/workflows/installers.yml` use this workspace's version while Tauri names its files with Workshop's. The `[toolchain]` channel in its `rust-toolchain.toml` must equal this repository's, because the Cargo that runs the installer builds Workshop. A change of `rev` in the root `Cargo.toml`'s `[workspace.metadata.workshop]` to a Workshop commit that changed either value changes the workspace version or `rust-toolchain.toml` with it.
+- Each release file name has one definition: `installer_name` and `workshop_updater_name` in `src/main/installer/collect.rs`. The installer build, the IFW stage, and the `manifest` mode call them; never spell a release name inline. The payload's bundle and AppImage names are the constants beside them, which must equal those `crates/workshop/gateway-discovery/src/peer.rs` in the Workshop checkout searches; a test in `src/main/tests/collect.rs` compares the two. It is the one test that reads the real checkout, the one `RUNVIL_WORKSHOP` names when the test runs; every other test builds its own Workshop tree in a temporary directory. The bare Gateway executable's name is `GATEWAY` in `collect.rs`.
+- The Qt IFW pin is enforced in two places that change together: `IFW_VERSION` in `src/main/installer/ifw.rs`, and each `ifw-archive` with its `ifw-sha256` in `.github/workflows/installers.yml`'s build matrix. `USAGE` in `src/main/args.rs`, the workflow step's name, and this crate's README name the version or the archive paths too; update them in the same change.
+- Files under `ifw/` are templates. The build fills `{{NAME}}` placeholders and fails on any left over; IFW's own `@Variable@` placeholders are left for IFW to expand at install time.
+- `installscript.qs` runs only inside IFW and has no test support. A change to either script, or to what an install puts where, updates the install cells in `.github/installers/cell.sh` and `cell.ps1`, which are its tests.
diff --git a/crates/build-workshop/Cargo.toml b/crates/build-installer/Cargo.toml
similarity index 82%
rename from crates/build-workshop/Cargo.toml
rename to crates/build-installer/Cargo.toml
index a296cb2ef..8742f7e08 100644
--- a/crates/build-workshop/Cargo.toml
+++ b/crates/build-installer/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "build-workshop"
+name = "build-installer"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -7,7 +7,7 @@ repository.workspace = true
 publish = false
 
 [[bin]]
-name = "build-workshop"
+name = "build-installer"
 path = "src/main.rs"
 
 [dependencies]
@@ -21,6 +21,9 @@ ctrlc.workspace = true
 minisign-verify.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
+# Reads the version and the toolchain channel the Workshop checkout check
+# compares.
+toml.workspace = true
 
 [dev-dependencies]
 # Signs the `manifest` mode's test fixtures with a key generated per run.
diff --git a/crates/build-installer/README.md b/crates/build-installer/README.md
new file mode 100644
index 000000000..2fa786b2a
--- /dev/null
+++ b/crates/build-installer/README.md
@@ -0,0 +1,79 @@
+# build-installer
+
+This crate is `cargo installer`, the one build path for Runvil's installers. Each installer installs Workshop, the desktop app, and the Gateway. CI's `installers.yml` runs the same commands described here, so a local build makes what a release ships.
+
+Workshop is its own product, in [cppalliance/runvil-workshop](https://github.com/cppalliance/runvil-workshop), so nothing here builds it. `cargo installer` runs that repository's own tool, `cargo workshop bundle`, in a checkout of it, and builds the installer from the Tauri bundle the tool leaves. The Gateway is its own product too, in [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway), and nothing here builds it either.
+
+## Modes
+
+- `cargo installer [--target <triple>] [--sign] [--gateway-binary <path>]` builds one platform's installer in release.
+- `cargo installer manifest --assets <dir> --base-url <url> [--public-key <file>]` checks that a directory holds exactly one release's files for every platform, verifies each updater signature, and writes `latest.json` and `SHA256SUMS` beside them. The key it verifies against is the updater public key in the Workshop checkout's `crates/workshop/desktop/tauri.conf.json`, unless `--public-key` names another.
+
+`cargo installer --help` prints the full usage.
+
+## The Workshop checkout
+
+The installer is built from a runvil-workshop checkout, and the `manifest` mode reads the updater public key from it. The `RUNVIL_WORKSHOP` environment variable names the checkout. When the variable is unset, `.cargo/config.toml` sets it to the checkout next to this repository, `../runvil-workshop`. `installers.yml` takes Workshop at the commit the root `Cargo.toml` pins in `[workspace.metadata.workshop]`, so a local build of a release starts from that commit.
+
+Do two things in that checkout before the first build. Install the UI's packages, which bring the pinned Tauri CLI, and stage the Gateway release that the checkout's `gateway-pin/pin.json` names, once per target:
+
+```text
+npm ci --prefix crates/workshop
+node tools/fetch-gateway-sidecar.mjs --target <triple>
+```
+
+That repository's `crates/build-workshop/README.md` lists what else its bundle build needs, such as Node 22 and Tauri's build packages on Linux. `cargo installer` passes its environment on to the bundle build, so a variable that README asks for, such as `APPIMAGE_EXTRACT_AND_RUN=1`, is set for `cargo installer`.
+
+`--gateway-binary <path>`, or the `RUNVIL_GATEWAY_SIDECAR` environment variable, names another Gateway in place of the staged one, and `cargo installer` passes it on to the bundle build. The Plugins' libraries arrive inside Workshop's bundle.
+
+### The version and the toolchain
+
+`cargo installer` checks the checkout before it runs any command, and refuses one that differs from this workspace in either of two values:
+
+- The `[workspace.package]` version in the checkout's `Cargo.toml` must equal this workspace's. The release file names and the release tag check use this workspace's version, while Tauri names its files with Workshop's.
+- The `[toolchain]` channel in the checkout's `rust-toolchain.toml` must equal the one in this repository's `rust-toolchain.toml`. The Cargo that runs the installer also builds Workshop, so Workshop is built on this workspace's toolchain.
+
+To build from a newer Workshop, change `rev` in `[workspace.metadata.workshop]`. When Workshop changed its version or its toolchain channel, change the workspace version in the root `Cargo.toml` or the channel in `rust-toolchain.toml` in the same change.
+
+## Building an installer
+
+The output lands in `target/installer/<triple>/`:
+
+- `publish/`: the installer, and under `--sign` the updater files and their `.sig` signatures. Windows gets `Runvil_<version>_x64-setup.exe`, macOS `Runvil_<version>_<aarch64|x86_64>-setup.dmg`, and Linux `Runvil_<version>_<amd64|aarch64>-setup.run`.
+- `payload/` (macOS and Linux): the installed items, `Runvil.app` and `Runvil Gateway.app`, or `Runvil.AppImage` and `runvil-gateway`.
+- `ifw/` (macOS and Linux): the Qt IFW definition filled in from `ifw/` in this crate, with the payload copied into its packages.
+
+Workshop's bundle itself is built in the checkout's own `target/`, and the build moves its files from there into the output, so the two target directories must be on one filesystem. When `CARGO_TARGET_DIR` is set, the bundle and the installer output both go to that directory.
+
+Windows needs nothing more: the installer is the NSIS setup from Workshop's bundle, with the Gateway inside. macOS and Linux install the Gateway beside Workshop, so their installers are built here with the Qt Installer Framework, from Workshop's bundle and the Gateway. That build runs the Gateway's `--version` and refuses one that is not the pinned version.
+
+Building the Intel macOS installer on Apple silicon needs Rosetta, since the build runs the x86_64 Gateway to check its version.
+
+### Qt Installer Framework
+
+macOS and Linux installers need Qt IFW 4.11.0 exactly; the build checks `installerbase --version` and refuses any other version. Download the archive for your machine from `https://download.qt.io/online/qtsdkrepository/`:
+
+- macOS (one universal build for both architectures): `mac_x64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603311245ifw-mac-universal.7z`
+- Linux x64: `linux_x64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603231357ifw-linux-x64.7z`
+- Linux ARM64: `linux_arm64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603231357ifw-linux-arm64.7z`, which runs only on glibc 2.38 or newer
+
+Check its SHA-256 against the `ifw-sha256` pinned beside the same path in `.github/workflows/installers.yml`. Extract it into a directory you own, with `bsdtar -xf` on macOS or `7z x` on Linux, and point `QTIFWDIR` at the extracted directory that holds `bin/`. Without `QTIFWDIR`, the build uses the first `binarycreator` on `PATH` and the `installerbase` beside it.
+
+On Linux the IFW tools load these libraries even without a display, and `p7zip-full` extracts the archive, as `installers.yml` installs them on Ubuntu:
+
+```text
+p7zip-full
+libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0
+libxcb-render-util0 libxcb-shape0 libxcb-shm0 libxcb-sync1 libxcb-xfixes0
+libxcb-xkb1 libxcb-util1 libfontconfig1 libfreetype6 libdbus-1-3
+```
+
+### Signing
+
+`cargo installer` passes `--sign` on to the bundle build. Without it, the bundle build makes no updater files, and `publish/` holds only the installer. With it, Tauri signs Workshop's updater files with the minisign key in `TAURI_SIGNING_PRIVATE_KEY` and `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`, and `cargo installer` publishes them with their signatures. For a local try, make a throwaway key with the Tauri CLI in the Workshop checkout:
+
+```text
+node crates/workshop/node_modules/@tauri-apps/cli/tauri.js signer generate --ci -w <dir>/run.key
+```
+
+Installed copies trust only the release key, so files signed with any other key never install as an update.
diff --git a/crates/build-workshop/ifw/config/config.xml b/crates/build-installer/ifw/config/config.xml
similarity index 100%
rename from crates/build-workshop/ifw/config/config.xml
rename to crates/build-installer/ifw/config/config.xml
diff --git a/crates/build-workshop/ifw/config/installer-logo.png b/crates/build-installer/ifw/config/installer-logo.png
similarity index 100%
rename from crates/build-workshop/ifw/config/installer-logo.png
rename to crates/build-installer/ifw/config/installer-logo.png
diff --git a/crates/build-workshop/ifw/config/installer-logo@2x.png b/crates/build-installer/ifw/config/installer-logo@2x.png
similarity index 100%
rename from crates/build-workshop/ifw/config/installer-logo@2x.png
rename to crates/build-installer/ifw/config/installer-logo@2x.png
diff --git a/crates/build-workshop/ifw/config/installer-watermark.png b/crates/build-installer/ifw/config/installer-watermark.png
similarity index 100%
rename from crates/build-workshop/ifw/config/installer-watermark.png
rename to crates/build-installer/ifw/config/installer-watermark.png
diff --git a/crates/build-workshop/ifw/config/installer-watermark@2x.png b/crates/build-installer/ifw/config/installer-watermark@2x.png
similarity index 100%
rename from crates/build-workshop/ifw/config/installer-watermark@2x.png
rename to crates/build-installer/ifw/config/installer-watermark@2x.png
diff --git a/crates/build-workshop/ifw/packages/com.runvil.gateway/meta/installscript.qs b/crates/build-installer/ifw/packages/com.runvil.gateway/meta/installscript.qs
similarity index 100%
rename from crates/build-workshop/ifw/packages/com.runvil.gateway/meta/installscript.qs
rename to crates/build-installer/ifw/packages/com.runvil.gateway/meta/installscript.qs
diff --git a/crates/build-workshop/ifw/packages/com.runvil.gateway/meta/package.xml b/crates/build-installer/ifw/packages/com.runvil.gateway/meta/package.xml
similarity index 100%
rename from crates/build-workshop/ifw/packages/com.runvil.gateway/meta/package.xml
rename to crates/build-installer/ifw/packages/com.runvil.gateway/meta/package.xml
diff --git a/crates/build-workshop/ifw/packages/com.runvil.workshop/meta/installscript.qs b/crates/build-installer/ifw/packages/com.runvil.workshop/meta/installscript.qs
similarity index 100%
rename from crates/build-workshop/ifw/packages/com.runvil.workshop/meta/installscript.qs
rename to crates/build-installer/ifw/packages/com.runvil.workshop/meta/installscript.qs
diff --git a/crates/build-workshop/ifw/packages/com.runvil.workshop/meta/package.xml b/crates/build-installer/ifw/packages/com.runvil.workshop/meta/package.xml
similarity index 100%
rename from crates/build-workshop/ifw/packages/com.runvil.workshop/meta/package.xml
rename to crates/build-installer/ifw/packages/com.runvil.workshop/meta/package.xml
diff --git a/crates/build-workshop/packaging/gateway-Info.plist b/crates/build-installer/packaging/gateway-Info.plist
similarity index 89%
rename from crates/build-workshop/packaging/gateway-Info.plist
rename to crates/build-installer/packaging/gateway-Info.plist
index 9a2e7984c..016bb80be 100644
--- a/crates/build-workshop/packaging/gateway-Info.plist
+++ b/crates/build-installer/packaging/gateway-Info.plist
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
-    Runvil Gateway.app, the macOS Gateway payload. `cargo workshop
-    installer` assembles the bundle around the pinned Gateway release and
+    Runvil Gateway.app, the macOS Gateway payload. `cargo installer`
+    assembles the bundle around the pinned Gateway release and
     fills both version keys with that release's version. LSUIElement keeps the tray-only gateway out of the
     Dock, and CFBundleExecutable makes the gateway the bundle's principal
     executable, which Launch at Login registers.
diff --git a/crates/build-workshop/src/main.rs b/crates/build-installer/src/main.rs
similarity index 57%
rename from crates/build-workshop/src/main.rs
rename to crates/build-installer/src/main.rs
index 04e615214..65e81aba6 100644
--- a/crates/build-workshop/src/main.rs
+++ b/crates/build-installer/src/main.rs
@@ -1,17 +1,16 @@
-//! Builds Workshop or each platform's installer around the pinned Gateway
-//! release. For Windows targets the Gateway is Tauri's sidecar inside
-//! Workshop's bundle; macOS and Linux payloads carry it beside Workshop, and
-//! Qt IFW packages them into one installer. The Gateway is its own product
-//! in `cppalliance/runvil-gateway`, so nothing here compiles it. Every
-//! build and every installer carries the libraries of the std Plugin and
-//! the bashkit Plugin in Workshop's Plugin directory: `plugins` beside
-//! Workshop in a build and on Windows, and inside Workshop's bundle on
-//! macOS and Linux (`plugin`). The
+//! Builds each platform's installer around Workshop's Tauri bundle and the
+//! pinned Gateway release. Workshop is its own product in
+//! `cppalliance/runvil-workshop`, so nothing here builds it: the bundle
+//! comes from `cargo workshop bundle`, run in the checkout
+//! `RUNVIL_WORKSHOP` names. For Windows targets that bundle is the
+//! installer, Tauri's NSIS setup with the Gateway inside. macOS and Linux
+//! payloads hold the Gateway beside Workshop, and Qt IFW packages them into
+//! one installer. The Gateway is its own product in
+//! `cppalliance/runvil-gateway`, so nothing here compiles it. The
 //! `manifest` mode verifies every platform's published files as one release
 //! and writes its `latest.json` and `SHA256SUMS`.
 
 use std::ffi::OsString;
-use std::fmt;
 use std::io;
 use std::path::PathBuf;
 use std::process::{Child, ExitCode};
@@ -21,46 +20,23 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 #[path = "main/args.rs"]
 mod args;
+#[path = "main/gateway.rs"]
+mod gateway;
 #[path = "main/installer.rs"]
 mod installer;
 #[path = "main/manifest.rs"]
 mod manifest;
 #[path = "main/pipeline.rs"]
 mod pipeline;
-#[path = "main/plugin.rs"]
-mod plugin;
 #[path = "main/runner.rs"]
 mod runner;
-#[path = "main/sidecar.rs"]
-mod sidecar;
+#[path = "main/workshop.rs"]
+mod workshop;
 
-use args::{Request, parse_arguments};
+use args::{InstallerRequest, ManifestRequest, Request, parse_arguments};
 use installer::build_installer;
-use pipeline::build_workshop;
 use runner::install_cancel_handler;
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum Profile {
-    Debug,
-    Release,
-}
-
-impl Profile {
-    fn directory(self) -> &'static str {
-        match self {
-            Self::Debug => "debug",
-            Self::Release => "release",
-        }
-    }
-}
-
-#[derive(Debug, Eq, PartialEq)]
-struct BuildRequest {
-    profile: Profile,
-    target: Option<String>,
-    gateway_binary: Option<PathBuf>,
-}
-
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum OutputMode {
     Capture,
@@ -109,14 +85,20 @@ struct CancelState {
 
 #[derive(Debug)]
 struct BuildEnvironment {
+    /// This repository, which holds the IFW definition, the Gateway bundle
+    /// template, and `LICENSE`.
     workspace_root: PathBuf,
+    /// The runvil-workshop checkout `RUNVIL_WORKSHOP` names. Its
+    /// `cargo workshop bundle` builds Workshop's bundle, and it holds the
+    /// icons, the Gateway pin, and the staged Gateway.
+    workshop_root: PathBuf,
+    /// The installer output goes to `installer/<triple>/` in this
+    /// directory.
     target_root: PathBuf,
     /// Whether `CARGO_TARGET_DIR` chose `target_root`; otherwise Cargo's
     /// own configuration does, and children are left to it.
     target_root_from_env: bool,
     cargo: PathBuf,
-    node: PathBuf,
-    tauri_cli: PathBuf,
     signing_key: Option<OsString>,
     /// The Gateway binary `RUNVIL_GATEWAY_SIDECAR` names, when set.
     gateway_sidecar: Option<PathBuf>,
@@ -128,35 +110,32 @@ struct BuildEnvironment {
     release_date: String,
 }
 
-/// The environment variable naming the workspace root in place of the
-/// checkout this crate was compiled in. `tests/cancellation.rs` sets it so
-/// the subprocess stages its Gateway in a temporary tree: a test that
-/// staged in the checkout's sidecar slot and was killed left its fake
-/// Gateway there, and every later build shipped it.
-const WORKSPACE_ROOT_VARIABLE: &str = "BUILD_WORKSHOP_ROOT";
-
 impl BuildEnvironment {
     fn discover() -> Result<Self, anyhow::Error> {
-        let workspace_root = match std::env::var_os(WORKSPACE_ROOT_VARIABLE) {
-            Some(value) if value.is_empty() => {
+        let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+        let workspace_root = manifest_dir
+            .parent()
+            .and_then(|crates| crates.parent())
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "cannot derive the workspace root from {}",
+                    manifest_dir.display()
+                )
+            })?
+            .to_path_buf();
+        let workshop_root = match std::env::var_os(workshop::WORKSHOP_VARIABLE) {
+            Some(value) if !value.is_empty() => std::path::absolute(&value).map_err(|error| {
+                anyhow::anyhow!(
+                    "cannot resolve the Workshop checkout {}: {error}",
+                    PathBuf::from(&value).display()
+                )
+            })?,
+            _ => {
                 return Err(anyhow::anyhow!(
-                    "{WORKSPACE_ROOT_VARIABLE} must not be empty"
+                    "{} is unset or empty; set it to the root of a runvil-workshop checkout",
+                    workshop::WORKSHOP_VARIABLE
                 ));
             }
-            Some(value) => PathBuf::from(value),
-            None => {
-                let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-                manifest_dir
-                    .parent()
-                    .and_then(|crates| crates.parent())
-                    .ok_or_else(|| {
-                        anyhow::anyhow!(
-                            "cannot derive the workspace root from {}",
-                            manifest_dir.display()
-                        )
-                    })?
-                    .to_path_buf()
-            }
         };
         let configured_target = std::env::var_os("CARGO_TARGET_DIR");
         let target_root_from_env = configured_target.is_some();
@@ -184,20 +163,13 @@ impl BuildEnvironment {
             .ok_or_else(|| {
                 anyhow::anyhow!("Cargo did not provide the executable used for this command")
             })?;
-        let tauri_cli = workspace_root
-            .join("crates")
-            .join("workshop")
-            .join("node_modules")
-            .join("@tauri-apps")
-            .join("cli")
-            .join("tauri.js");
         let signing_key =
             std::env::var_os("TAURI_SIGNING_PRIVATE_KEY").filter(|key| !key.is_empty());
-        let gateway_sidecar = match std::env::var_os(sidecar::GATEWAY_SIDECAR_VARIABLE) {
+        let gateway_sidecar = match std::env::var_os(gateway::GATEWAY_SIDECAR_VARIABLE) {
             Some(value) if value.is_empty() => {
                 return Err(anyhow::anyhow!(
                     "{} must not be empty",
-                    sidecar::GATEWAY_SIDECAR_VARIABLE
+                    gateway::GATEWAY_SIDECAR_VARIABLE
                 ));
             }
             Some(value) => Some(PathBuf::from(value)),
@@ -208,11 +180,10 @@ impl BuildEnvironment {
             .map_err(|error| anyhow::anyhow!("the system clock is before 1970: {error}"))?;
         Ok(Self {
             workspace_root,
+            workshop_root,
             target_root,
             target_root_from_env,
             cargo,
-            node: PathBuf::from("node"),
-            tauri_cli,
             signing_key,
             gateway_sidecar,
             qtifw_dir: std::env::var_os("QTIFWDIR"),
@@ -221,10 +192,21 @@ impl BuildEnvironment {
         })
     }
 
+    /// The target directory `cargo workshop bundle` writes to. That Cargo
+    /// runs in the Workshop checkout, so without `CARGO_TARGET_DIR` it
+    /// writes to the checkout's own `target`.
+    fn workshop_target_root(&self) -> PathBuf {
+        if self.target_root_from_env {
+            self.target_root.clone()
+        } else {
+            self.workshop_root.join("target")
+        }
+    }
+
     /// Cargo resolves a relative `CARGO_TARGET_DIR` against its own working
-    /// directory, which differs between children (the Tauri CLI runs from
-    /// `crates/workshop/desktop`), so every child that runs Cargo gets the
-    /// absolute root this process reads its outputs from.
+    /// directory, and the bundle step runs Cargo from the Workshop
+    /// checkout, so a child that runs Cargo gets the absolute root this
+    /// process reads its outputs from.
     fn cargo_envs(&self) -> Vec<(OsString, OsString)> {
         if !self.target_root_from_env {
             return Vec::new();
@@ -236,46 +218,6 @@ impl BuildEnvironment {
     }
 }
 
-#[derive(Debug, Eq, PartialEq)]
-struct BuildError {
-    primary: String,
-    cleanup: Option<String>,
-}
-
-#[derive(Debug, Eq, PartialEq)]
-struct StepError {
-    message: String,
-    canceled: bool,
-}
-
-impl StepError {
-    fn failed(message: String) -> Self {
-        Self {
-            message,
-            canceled: false,
-        }
-    }
-}
-
-impl From<StepError> for BuildError {
-    fn from(error: StepError) -> Self {
-        Self {
-            primary: error.message,
-            cleanup: None,
-        }
-    }
-}
-
-impl fmt::Display for BuildError {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(&self.primary)?;
-        if let Some(cleanup) = &self.cleanup {
-            write!(formatter, "\ncleanup also failed: {cleanup}")?;
-        }
-        Ok(())
-    }
-}
-
 fn main() -> ExitCode {
     let args: Vec<String> = std::env::args().skip(1).collect();
     if args
@@ -295,43 +237,33 @@ fn main() -> ExitCode {
     let environment = match BuildEnvironment::discover() {
         Ok(environment) => environment,
         Err(error) => {
-            eprintln!("build-workshop failed: {error}");
+            eprintln!("build-installer failed: {error}");
             return ExitCode::FAILURE;
         }
     };
     let result = match &request {
-        Request::Build(request) => {
-            with_process_runner(|runner| build_workshop(request, &environment, runner))
-        }
-        Request::Installer(request) => {
-            with_process_runner(|runner| build_installer(request, &environment, runner))
-        }
+        Request::Installer(request) => run_installer(request, &environment),
         Request::Manifest(request) => run_manifest(request, &environment),
     };
     match result {
         Ok(()) => ExitCode::SUCCESS,
         Err(error) => {
-            eprintln!("build-workshop failed: {error}");
+            eprintln!("build-installer failed: {error}");
             ExitCode::FAILURE
         }
     }
 }
 
-fn with_process_runner(
-    build: impl FnOnce(&mut ProcessRunner) -> Result<(), BuildError>,
-) -> Result<(), String> {
+fn run_installer(request: &InstallerRequest, environment: &BuildEnvironment) -> Result<(), String> {
     let cancel = install_cancel_handler().map_err(|error| error.to_string())?;
-    build(&mut ProcessRunner::new(cancel)).map_err(|error| error.to_string())
+    build_installer(request, environment, &mut ProcessRunner::new(cancel))
 }
 
-fn run_manifest(
-    request: &args::ManifestRequest,
-    environment: &BuildEnvironment,
-) -> Result<(), String> {
+fn run_manifest(request: &ManifestRequest, environment: &BuildEnvironment) -> Result<(), String> {
     let now = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map_err(|error| format!("the system clock is before 1970: {error}"))?;
-    manifest::write(request, &environment.workspace_root, now.as_secs())?;
+    manifest::write(request, &environment.workshop_root, now.as_secs())?;
     println!(
         "wrote {} and {} in {}",
         manifest::MANIFEST,
diff --git a/crates/build-workshop/src/main/args.rs b/crates/build-installer/src/main/args.rs
similarity index 71%
rename from crates/build-workshop/src/main/args.rs
rename to crates/build-installer/src/main/args.rs
index 5c94ad236..69b832c1a 100644
--- a/crates/build-workshop/src/main/args.rs
+++ b/crates/build-installer/src/main/args.rs
@@ -1,29 +1,31 @@
-//! Command-line parsing for the build, installer, and manifest modes.
+//! Command-line parsing for the installer and manifest modes.
 
 use std::path::PathBuf;
 
-use super::{BuildRequest, Profile};
-
 pub(super) const USAGE: &str = "\
-Build Workshop, build a platform installer that carries the Gateway, or
-write a release's latest.json and SHA256SUMS. Workshop bundles the Gateway
-as a sidecar only for Windows targets; macOS and Linux install it beside
-Workshop. On macOS and Linux, `installer` needs Qt IFW 4.11.0, found through
-QTIFWDIR (the directory holding bin/) or else binarycreator on PATH.
+Build one platform's Runvil installer, or write a release's latest.json and
+SHA256SUMS. The installer is built from the runvil-workshop checkout the
+RUNVIL_WORKSHOP environment variable names: `cargo workshop bundle` runs
+there and builds Workshop's Tauri bundle in release. For Windows targets
+that bundle is the installer, the NSIS setup with the Gateway inside. macOS
+and Linux installers install the Gateway beside Workshop and need Qt IFW
+4.11.0, found through QTIFWDIR (the directory holding bin/) or else
+binarycreator on PATH.
+
+The checkout's workspace version and toolchain channel must equal this
+workspace's.
 
 The Gateway is a separate product, so this never builds it. It comes from
 --gateway-binary, then the RUNVIL_GATEWAY_SIDECAR environment variable, then
-the file `node tools/fetch-gateway-sidecar.mjs --target <triple>` stages
-under crates/workshop/desktop/binaries/: the release gateway-pin/pin.json
-names. A staged Gateway is left in place, so the next build reuses it.
+the file `node tools/fetch-gateway-sidecar.mjs --target <triple>` stages in
+the Workshop checkout under crates/workshop/desktop/binaries/: the release
+that checkout's gateway-pin/pin.json names.
 
 USAGE:
-    cargo workshop [--release] [--target <triple>] [--gateway-binary <path>]
-    cargo workshop installer [--target <triple>] [--sign] [--gateway-binary <path>]
-    cargo workshop manifest --assets <dir> --base-url <url> [--public-key <file>]
+    cargo installer [--target <triple>] [--sign] [--gateway-binary <path>]
+    cargo installer manifest --assets <dir> --base-url <url> [--public-key <file>]
 
 OPTIONS:
-    --release           Build Workshop with Cargo's release profile
     --target <triple>   Build for this target triple instead of the host
     --gateway-binary <path>
                         The Gateway executable to ship instead of the staged one
@@ -34,13 +36,13 @@ OPTIONS:
                         SHA256SUMS are written into it
     --base-url <url>    The URL the release's files are downloaded from
     --public-key <file> The updater public key to verify against, instead
-                        of plugins.updater.pubkey in tauri.conf.json
+                        of plugins.updater.pubkey in the Workshop checkout's
+                        tauri.conf.json
     -h, --help          Print this help
 ";
 
 #[derive(Debug, Eq, PartialEq)]
 pub(super) enum Request {
-    Build(BuildRequest),
     Installer(InstallerRequest),
     Manifest(ManifestRequest),
 }
@@ -61,7 +63,6 @@ pub(super) struct ManifestRequest {
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum Flag {
-    Release,
     Target,
     Sign,
     GatewayBinary,
@@ -71,8 +72,7 @@ enum Flag {
 }
 
 impl Flag {
-    const ALL: [Self; 7] = [
-        Self::Release,
+    const ALL: [Self; 6] = [
         Self::Target,
         Self::Sign,
         Self::GatewayBinary,
@@ -83,7 +83,6 @@ impl Flag {
 
     fn name(self) -> &'static str {
         match self {
-            Self::Release => "--release",
             Self::Target => "--target",
             Self::Sign => "--sign",
             Self::GatewayBinary => "--gateway-binary",
@@ -96,7 +95,6 @@ impl Flag {
 
 #[derive(Debug, Default)]
 struct Options {
-    release: bool,
     target: Option<String>,
     sign: bool,
     gateway_binary: Option<String>,
@@ -119,7 +117,6 @@ impl Options {
                 return Err(usage_error(&format!("duplicate argument `{argument}`")));
             }
             match flag {
-                Flag::Release => options.release = true,
                 Flag::Sign => options.sign = true,
                 Flag::Target => {
                     let value = value_after(args, index, "a target triple")?;
@@ -155,7 +152,6 @@ impl Options {
 
     fn seen(&self, flag: Flag) -> bool {
         match flag {
-            Flag::Release => self.release,
             Flag::Target => self.target.is_some(),
             Flag::Sign => self.sign,
             Flag::GatewayBinary => self.gateway_binary.is_some(),
@@ -167,36 +163,22 @@ impl Options {
 }
 
 pub(super) fn parse_arguments(args: &[String]) -> Result<Request, anyhow::Error> {
-    match args.first().map(String::as_str) {
-        Some("installer") => {
-            if args[1..].iter().any(|argument| argument == "--release") {
-                return Err(usage_error(
-                    "`installer` always builds the release profile; drop `--release`",
-                ));
-            }
-            let options =
-                Options::parse(&args[1..], &[Flag::Target, Flag::Sign, Flag::GatewayBinary])?;
-            Ok(Request::Installer(InstallerRequest {
-                target: options.target,
-                sign: options.sign,
-                gateway_binary: options.gateway_binary.map(PathBuf::from),
-            }))
-        }
-        Some("manifest") => parse_manifest(&args[1..]),
-        _ => {
-            let options =
-                Options::parse(args, &[Flag::Release, Flag::Target, Flag::GatewayBinary])?;
-            Ok(Request::Build(BuildRequest {
-                profile: if options.release {
-                    Profile::Release
-                } else {
-                    Profile::Debug
-                },
-                target: options.target,
-                gateway_binary: options.gateway_binary.map(PathBuf::from),
-            }))
-        }
+    if let Some((mode, rest)) = args.split_first()
+        && mode == "manifest"
+    {
+        return parse_manifest(rest);
+    }
+    if args.iter().any(|argument| argument == "--release") {
+        return Err(usage_error(
+            "`cargo installer` always builds the release profile; drop `--release`",
+        ));
     }
+    let options = Options::parse(args, &[Flag::Target, Flag::Sign, Flag::GatewayBinary])?;
+    Ok(Request::Installer(InstallerRequest {
+        target: options.target,
+        sign: options.sign,
+        gateway_binary: options.gateway_binary.map(PathBuf::from),
+    }))
 }
 
 fn parse_manifest(args: &[String]) -> Result<Request, anyhow::Error> {
diff --git a/crates/build-installer/src/main/gateway.rs b/crates/build-installer/src/main/gateway.rs
new file mode 100644
index 000000000..e7ebb4d55
--- /dev/null
+++ b/crates/build-installer/src/main/gateway.rs
@@ -0,0 +1,93 @@
+//! The Gateway an installer ships. A Windows installer is Workshop's NSIS
+//! setup, which already holds the Gateway, so only a macOS or Linux
+//! payload takes one from here, to install beside Workshop. A Gateway
+//! named for the build is passed on to the bundle step on every platform.
+//!
+//! The Gateway is its own product in `cppalliance/runvil-gateway`, so
+//! nothing here compiles it. It comes from `--gateway-binary`, then the
+//! `RUNVIL_GATEWAY_SIDECAR` environment variable, then the file the
+//! Workshop checkout's `tools/fetch-gateway-sidecar.mjs` stages there: the
+//! release that checkout's `gateway-pin/pin.json` names.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use super::workshop;
+
+/// The environment variable naming a Gateway binary, so a CI job can point
+/// a build at one without passing a flag. `cargo workshop bundle` reads it
+/// too.
+pub(super) const GATEWAY_SIDECAR_VARIABLE: &str = "RUNVIL_GATEWAY_SIDECAR";
+
+/// The Gateway `given` names, when a flag or the variable named one, as an
+/// absolute path to a file.
+pub(super) fn named(given: Option<&Path>) -> Result<Option<PathBuf>, String> {
+    let Some(path) = given else {
+        return Ok(None);
+    };
+    // One absolute path serves every later use: the bundle step runs from
+    // the Workshop checkout and the version check from this repository,
+    // and a bare name would otherwise resolve through PATH.
+    let path = std::path::absolute(path)
+        .map_err(|error| format!("cannot resolve the Gateway {}: {error}", path.display()))?;
+    if !path.is_file() {
+        return Err(format!(
+            "--gateway-binary or {GATEWAY_SIDECAR_VARIABLE} names the Gateway {}, which is \
+             not a file",
+            path.display()
+        ));
+    }
+    Ok(Some(path))
+}
+
+/// The executable a macOS or Linux payload for `target` holds: `named`,
+/// else the one staged in the Workshop checkout. With neither, the error
+/// names the fetch script.
+pub(super) fn payload_binary(
+    named: Option<&Path>,
+    workshop_root: &Path,
+    target: &str,
+) -> Result<PathBuf, String> {
+    if let Some(path) = named {
+        return Ok(path.to_path_buf());
+    }
+    let staged = staged_path(workshop_root, target);
+    if !staged.is_file() {
+        return Err(format!(
+            "no Gateway for {target}: nothing is staged at {} and neither --gateway-binary nor \
+             {GATEWAY_SIDECAR_VARIABLE} names one; the Gateway is a separate product, so run \
+             `node tools/fetch-gateway-sidecar.mjs --target {target}` in the Workshop checkout \
+             {} to stage the release its gateway-pin/pin.json names",
+            staged.display(),
+            workshop_root.display()
+        ));
+    }
+    Ok(staged)
+}
+
+/// The Gateway version the Workshop checkout's `gateway-pin/pin.json`
+/// names, the one every installer ships.
+pub(super) fn pinned_version(workshop_root: &Path) -> Result<String, String> {
+    let pin = workshop_root.join("gateway-pin").join("pin.json");
+    let text = fs::read_to_string(&pin)
+        .map_err(|error| format!("cannot read the Gateway pin {}: {error}", pin.display()))?;
+    let value: serde_json::Value = serde_json::from_str(&text)
+        .map_err(|error| format!("the Gateway pin {} is not JSON: {error}", pin.display()))?;
+    match value.get("version").and_then(serde_json::Value::as_str) {
+        Some(version) if !version.is_empty() && version != "PLACEHOLDER" => Ok(version.to_owned()),
+        _ => Err(format!(
+            "the Gateway pin {} names no version; run `node tools/bump-gateway.mjs <tag>` in \
+             the Workshop checkout to fill it from a published Gateway release",
+            pin.display()
+        )),
+    }
+}
+
+/// Where the fetch script stages the Gateway for a macOS or Linux
+/// `target`: Tauri's sidecar name, the target triple appended to the file
+/// stem.
+pub(super) fn staged_path(workshop_root: &Path, target: &str) -> PathBuf {
+    workshop::desktop(workshop_root)
+        .join("binaries")
+        .join(format!("runvil-gateway-{target}"))
+}
diff --git a/crates/build-installer/src/main/installer.rs b/crates/build-installer/src/main/installer.rs
new file mode 100644
index 000000000..632390fda
--- /dev/null
+++ b/crates/build-installer/src/main/installer.rs
@@ -0,0 +1,305 @@
+//! `cargo installer`: gets Workshop's Tauri bundle for one target from
+//! `cargo workshop bundle`, run in the Workshop checkout, and collects each
+//! platform's installer payload and, under `--sign`, Workshop's updater
+//! files into `target/installer/<triple>/`. Windows ends with Tauri's NSIS
+//! setup, which holds the Gateway. macOS and Linux end with a Qt IFW
+//! installer built from the payload, whose Gateway is the release the
+//! checkout's `gateway-pin/pin.json` names, staged there by
+//! `tools/fetch-gateway-sidecar.mjs` or named by `--gateway-binary`.
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+use super::args::InstallerRequest;
+use super::pipeline::{resolve_target, run_checked};
+use super::{BuildEnvironment, CommandRunner, CommandSpec, OutputMode, gateway, workshop};
+
+// This file is loaded through a path attribute, so its children need one
+// too to resolve under `installer/`.
+#[path = "installer/bundle.rs"]
+pub(super) mod bundle;
+#[path = "installer/collect.rs"]
+pub(super) mod collect;
+#[path = "installer/ifw.rs"]
+pub(super) mod ifw;
+
+pub(super) const VERSION: &str = env!("CARGO_PKG_VERSION");
+/// The bundle step's name in diagnostics.
+const BUNDLE_STEP: &str = "Workshop bundle";
+
+/// The Gateway release a macOS or Linux installer installs: its
+/// executable and the version the Workshop checkout's
+/// `gateway-pin/pin.json` names.
+#[derive(Debug, Eq, PartialEq)]
+pub(super) struct Gateway {
+    pub(super) binary: PathBuf,
+    pub(super) version: String,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum System {
+    Windows,
+    MacOs,
+    Linux,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum Arch {
+    X86_64,
+    Aarch64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) struct Platform {
+    pub(super) system: System,
+    pub(super) arch: Arch,
+}
+
+impl Platform {
+    pub(super) fn from_triple(target: &str) -> Result<Self, String> {
+        let parts: Vec<&str> = target.split('-').collect();
+        let arch = match parts.first() {
+            Some(&"x86_64") => Some(Arch::X86_64),
+            Some(&"aarch64") => Some(Arch::Aarch64),
+            _ => None,
+        };
+        let system = match parts.get(1..) {
+            Some(["pc", "windows", "msvc"]) => Some(System::Windows),
+            Some(["apple", "darwin"]) => Some(System::MacOs),
+            Some(["unknown", "linux", "gnu"]) => Some(System::Linux),
+            _ => None,
+        };
+        match (system, arch) {
+            (Some(system), Some(arch)) => Ok(Self { system, arch }),
+            _ => Err(format!(
+                "installer target `{target}` is not supported; supported: x86_64 or aarch64 \
+                 with pc-windows-msvc, apple-darwin, or unknown-linux-gnu"
+            )),
+        }
+    }
+
+    /// The name of Tauri's bundle directory for the platform, under
+    /// `release/bundle/` in Workshop's target directory.
+    fn bundle_directory(self) -> &'static str {
+        match self.system {
+            System::Windows => "nsis",
+            System::MacOs => "macos",
+            System::Linux => "appimage",
+        }
+    }
+}
+
+pub(super) fn build_installer(
+    request: &InstallerRequest,
+    environment: &BuildEnvironment,
+    runner: &mut impl CommandRunner,
+) -> Result<(), String> {
+    check_signing_key(request, environment)?;
+    workshop::check(environment)?;
+    let target = resolve_target(request.target.as_deref(), environment, runner)?;
+    let platform = Platform::from_triple(&target)?;
+    let named_gateway = gateway::named(
+        request
+            .gateway_binary
+            .as_deref()
+            .or(environment.gateway_sidecar.as_deref()),
+    )?;
+    // The Windows setup already holds the Gateway. A macOS or Linux
+    // installer installs it beside Workshop, packaged by Qt IFW.
+    let packaging = match platform.system {
+        System::Windows => None,
+        System::MacOs | System::Linux => {
+            let gateway = Gateway {
+                binary: gateway::payload_binary(
+                    named_gateway.as_deref(),
+                    &environment.workshop_root,
+                    &target,
+                )?,
+                version: gateway::pinned_version(&environment.workshop_root)?,
+            };
+            Some((gateway, check_ifw(environment, runner)?))
+        }
+    };
+    bundle_workshop(
+        runner,
+        environment,
+        &target,
+        request.sign,
+        named_gateway.as_deref(),
+    )?;
+    if let Some((gateway, _)) = &packaging {
+        check_gateway_version(runner, environment, gateway)?;
+    }
+    let release = environment
+        .workshop_target_root()
+        .join(&target)
+        .join("release");
+    let output = environment.target_root.join("installer").join(&target);
+    collect::collect(&release, platform, request.sign, &output)?;
+    let installer = match &packaging {
+        Some((gateway, ifw)) => {
+            build_ifw_installer(ifw, environment, platform, gateway, &output, runner)?
+        }
+        None => output
+            .join("publish")
+            .join(collect::installer_name(platform)),
+    };
+    println!("installer: {}", installer.display());
+    Ok(())
+}
+
+fn check_signing_key(
+    request: &InstallerRequest,
+    environment: &BuildEnvironment,
+) -> Result<(), String> {
+    if request.sign && environment.signing_key.is_none() {
+        return Err(
+            "`--sign` needs TAURI_SIGNING_PRIVATE_KEY set to the release minisign key; it is \
+             unset or empty"
+                .to_owned(),
+        );
+    }
+    Ok(())
+}
+
+fn check_ifw(
+    environment: &BuildEnvironment,
+    runner: &mut impl CommandRunner,
+) -> Result<ifw::Ifw, String> {
+    let cwd = std::env::current_dir()
+        .map_err(|error| format!("cannot read the current directory: {error}"))?;
+    let ifw = ifw::locate(
+        environment.qtifw_dir.as_deref(),
+        environment.path.as_deref(),
+        &cwd,
+    )?;
+    let printed = run_checked(
+        runner,
+        &ifw::version_command(&ifw, &environment.workspace_root),
+        &format!(
+            "Qt IFW version check (`{} --version`)",
+            ifw.installerbase.display()
+        ),
+    )?;
+    ifw::check_version(&ifw, &printed)?;
+    Ok(ifw)
+}
+
+/// Runs `cargo workshop bundle` in the Workshop checkout, which builds
+/// Workshop and leaves Tauri's bundle in Workshop's target directory.
+fn bundle_workshop(
+    runner: &mut impl CommandRunner,
+    environment: &BuildEnvironment,
+    target: &str,
+    sign: bool,
+    named_gateway: Option<&Path>,
+) -> Result<(), String> {
+    run_checked(
+        runner,
+        &workshop::bundle_command(environment, target, sign, named_gateway),
+        BUNDLE_STEP,
+    )?;
+    // The bundle is the last command of a Windows build, so no later
+    // command would refuse to start after a cancel that arrived as this
+    // one completed.
+    if runner.cancel_observed() {
+        return Err(format!("{BUNDLE_STEP} canceled after child completion"));
+    }
+    Ok(())
+}
+
+/// Runs the Gateway's `--version` and requires the version the pin names,
+/// so an installer never ships a Gateway other than the pinned release.
+fn check_gateway_version(
+    runner: &mut impl CommandRunner,
+    environment: &BuildEnvironment,
+    gateway: &Gateway,
+) -> Result<(), String> {
+    let printed = run_checked(
+        runner,
+        &CommandSpec {
+            program: gateway.binary.clone(),
+            args: vec![OsString::from("--version")],
+            current_dir: environment.workspace_root.clone(),
+            envs: Vec::new(),
+            output_mode: OutputMode::Capture,
+        },
+        "Gateway version check",
+    )?;
+    let expected = format!("runvil-gateway {}", gateway.version);
+    if printed.trim() == expected {
+        Ok(())
+    } else {
+        Err(format!(
+            "Gateway version check failed: {} printed `{}`, expected `{expected}`, the \
+             version the Workshop checkout's gateway-pin/pin.json names",
+            gateway.binary.display(),
+            printed.trim()
+        ))
+    }
+}
+
+/// Places `gateway` in `output`'s payload, stages the IFW definition
+/// around the payload, and builds the installer into `output/publish/`,
+/// returning its path.
+fn build_ifw_installer(
+    ifw: &ifw::Ifw,
+    environment: &BuildEnvironment,
+    platform: Platform,
+    gateway: &Gateway,
+    output: &Path,
+    runner: &mut impl CommandRunner,
+) -> Result<PathBuf, String> {
+    let payload = output.join("payload");
+    let stage = output.join("ifw");
+    let publish = output.join("publish");
+    collect::place_gateway(
+        &bundle::BundleSources::from_environment(environment),
+        gateway,
+        platform,
+        &payload,
+    )?;
+    ifw::stage(
+        &ifw::Sources::from_environment(environment),
+        &payload,
+        platform,
+        &environment.release_date,
+        &gateway.version,
+        &stage,
+    )?;
+    let built = ifw::binarycreator_output(platform, &stage, &publish);
+    run_checked(
+        runner,
+        &ifw::binarycreator_command(ifw, &stage, &built),
+        "Qt IFW binarycreator",
+    )?;
+    require_output("Qt IFW binarycreator", &built)?;
+    if platform.system != System::MacOs {
+        return Ok(built);
+    }
+    run_checked(
+        runner,
+        &ifw::adhoc_sign_command(&built),
+        "Installer app ad hoc signing (codesign)",
+    )?;
+    let dmg = ifw::dmg_path(platform, &publish);
+    let app_folder = stage.join("dmg");
+    run_checked(
+        runner,
+        &ifw::hdiutil_command(&app_folder, &dmg),
+        "DMG wrap (hdiutil)",
+    )?;
+    require_output("DMG wrap (hdiutil)", &dmg)?;
+    Ok(dmg)
+}
+
+fn require_output(step: &str, path: &Path) -> Result<(), String> {
+    if path.exists() {
+        Ok(())
+    } else {
+        Err(format!(
+            "{step} succeeded but wrote nothing at {}",
+            path.display()
+        ))
+    }
+}
diff --git a/crates/build-workshop/src/main/installer/bundle.rs b/crates/build-installer/src/main/installer/bundle.rs
similarity index 84%
rename from crates/build-workshop/src/main/installer/bundle.rs
rename to crates/build-installer/src/main/installer/bundle.rs
index 6735a3610..d8dc51ed0 100644
--- a/crates/build-workshop/src/main/installer/bundle.rs
+++ b/crates/build-installer/src/main/installer/bundle.rs
@@ -6,11 +6,13 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 use super::collect::{GATEWAY, copy_executable, create_directory};
+use crate::{BuildEnvironment, workshop};
 
 /// Stands for the Gateway's version in the template's two version keys.
 const VERSION_PLACEHOLDER: &str = "@VERSION@";
 
-/// The checked-in files the bundle is assembled from.
+/// The checked-in files the bundle is assembled from: the template in
+/// this repository, and Workshop's icon in the Workshop checkout.
 #[derive(Debug)]
 pub(crate) struct BundleSources {
     pub(crate) info_plist: PathBuf,
@@ -18,16 +20,15 @@ pub(crate) struct BundleSources {
 }
 
 impl BundleSources {
-    pub(crate) fn in_workspace(workspace_root: &Path) -> Self {
-        let crates = workspace_root.join("crates");
+    pub(crate) fn from_environment(environment: &BuildEnvironment) -> Self {
         Self {
-            info_plist: crates
-                .join("build-workshop")
+            info_plist: environment
+                .workspace_root
+                .join("crates")
+                .join("build-installer")
                 .join("packaging")
                 .join("gateway-Info.plist"),
-            icon: crates
-                .join("workshop")
-                .join("desktop")
+            icon: workshop::desktop(&environment.workshop_root)
                 .join("icons")
                 .join("icon.icns"),
         }
diff --git a/crates/build-workshop/src/main/installer/collect.rs b/crates/build-installer/src/main/installer/collect.rs
similarity index 83%
rename from crates/build-workshop/src/main/installer/collect.rs
rename to crates/build-installer/src/main/installer/collect.rs
index c79a4f60c..05fb7e76d 100644
--- a/crates/build-workshop/src/main/installer/collect.rs
+++ b/crates/build-installer/src/main/installer/collect.rs
@@ -1,5 +1,6 @@
-//! Moves Tauri's bundle output and places the Gateway (on macOS as its own
-//! bundle) into the installer output directory under stable names.
+//! Moves Tauri's bundle output out of Workshop's target directory and
+//! places the Gateway (on macOS as its own bundle) into the installer
+//! output directory under stable names.
 //!
 //! `publish/` holds what a release uploads; `payload/` (macOS and Linux)
 //! holds what the installer packages install, under their installed names.
@@ -15,9 +16,9 @@ use super::{Arch, Gateway, Platform, System, VERSION};
 const PRODUCT: &str = "Runvil";
 pub(crate) const GATEWAY: &str = "runvil-gateway";
 
-// The installed names Workshop's Gateway lookup searches
-// (`crates/workshop/gateway-discovery/src/peer.rs`); a test reads that file
-// and requires the same three.
+// The installed names Workshop's Gateway lookup searches, in the Workshop
+// checkout's `crates/workshop/gateway-discovery/src/peer.rs`; a test reads
+// that file and requires the same three.
 /// The macOS Workshop bundle's directory name.
 pub(crate) const WORKSHOP_BUNDLE_NAME: &str = "Runvil.app";
 /// The macOS Gateway bundle's directory name.
@@ -25,12 +26,12 @@ pub(crate) const GATEWAY_BUNDLE_NAME: &str = "Runvil Gateway.app";
 /// The Linux Workshop AppImage's file name.
 pub(crate) const WORKSHOP_APPIMAGE_NAME: &str = "Runvil.AppImage";
 
-/// `workspace_root` holds the sources of the macOS Gateway bundle, and
-/// `gateway` is the Gateway release the payload carries.
+/// Clears `output` and moves the bundle Tauri left under `release`, the
+/// release directory in Workshop's target directory, into it: the Windows
+/// setup and the updater files into `publish/`, and Workshop's macOS
+/// bundle or AppImage into `payload/`.
 pub(crate) fn collect(
-    workspace_root: &Path,
     release: &Path,
-    gateway: &Gateway,
     platform: Platform,
     sign: bool,
     output: &Path,
@@ -64,13 +65,6 @@ pub(crate) fn collect(
             move_path(
                 &bundle.join(format!("{PRODUCT}.app")),
                 &payload.join(WORKSHOP_BUNDLE_NAME),
-            )?;
-            let payload_gateway = payload.join(GATEWAY_BUNDLE_NAME);
-            bundle::assemble(
-                &BundleSources::in_workspace(workspace_root),
-                &gateway.binary,
-                &gateway.version,
-                &payload_gateway,
             )
         }
         System::Linux => {
@@ -82,16 +76,34 @@ pub(crate) fn collect(
                 move_path(&signature_path(&appimage), &signature_path(&published))?;
                 copy_file(&appimage, &published)?;
             }
-            move_path(&appimage, &payload.join(WORKSHOP_APPIMAGE_NAME))?;
-            let payload_gateway = payload.join(GATEWAY);
-            copy_executable(&gateway.binary, &payload_gateway)
+            move_path(&appimage, &payload.join(WORKSHOP_APPIMAGE_NAME))
         }
     }
 }
 
+/// Places `gateway`, the Gateway release a macOS or Linux installer
+/// installs, in `payload` beside Workshop: on macOS as its own bundle,
+/// assembled from `sources`, and on Linux as the bare executable.
+pub(crate) fn place_gateway(
+    sources: &BundleSources,
+    gateway: &Gateway,
+    platform: Platform,
+    payload: &Path,
+) -> Result<(), String> {
+    match platform.system {
+        System::MacOs => bundle::assemble(
+            sources,
+            &gateway.binary,
+            &gateway.version,
+            &payload.join(GATEWAY_BUNDLE_NAME),
+        ),
+        System::Linux | System::Windows => copy_executable(&gateway.binary, &payload.join(GATEWAY)),
+    }
+}
+
 /// The platform's installer as published: Tauri's NSIS setup on Windows,
 /// the Qt IFW installer elsewhere, which a DMG wraps on macOS. The
-/// collection, the IFW stage, and `cargo workshop manifest` all read the
+/// collection, the IFW stage, and `cargo installer manifest` all read the
 /// release's names from this function and the two below.
 pub(crate) fn installer_name(platform: Platform) -> String {
     let arch = platform.arch;
diff --git a/crates/build-workshop/src/main/installer/ifw.rs b/crates/build-installer/src/main/installer/ifw.rs
similarity index 95%
rename from crates/build-workshop/src/main/installer/ifw.rs
rename to crates/build-installer/src/main/installer/ifw.rs
index ea134be85..01b48861f 100644
--- a/crates/build-workshop/src/main/installer/ifw.rs
+++ b/crates/build-installer/src/main/installer/ifw.rs
@@ -1,6 +1,6 @@
 //! The Qt Installer Framework stage of the macOS and Linux installers:
 //! locates IFW, checks its version, stages the definition in
-//! `crates/build-workshop/ifw/` around the collected payload, and builds
+//! `crates/build-installer/ifw/` around the collected payload, and builds
 //! the installer with `binarycreator`, which on macOS `hdiutil` then wraps
 //! in a DMG.
 //!
@@ -17,7 +17,7 @@ use super::collect::{
     installer_name,
 };
 use super::{Platform, System, VERSION};
-use crate::{CommandSpec, OutputMode};
+use crate::{BuildEnvironment, CommandSpec, OutputMode, workshop};
 
 /// The one IFW release local and CI builds use; any other is refused.
 pub(crate) const IFW_VERSION: &str = "4.11.0";
@@ -172,7 +172,9 @@ pub(crate) fn ifw_version(version: &str) -> &str {
     core.trim_end_matches('.')
 }
 
-/// The checked-in files the stage is built from.
+/// The checked-in files the stage is built from: the definition and the
+/// license in this repository, and Workshop's icons in the Workshop
+/// checkout.
 #[derive(Debug)]
 pub(crate) struct Sources {
     pub(crate) definition: PathBuf,
@@ -181,12 +183,15 @@ pub(crate) struct Sources {
 }
 
 impl Sources {
-    pub(crate) fn in_workspace(workspace_root: &Path) -> Self {
-        let crates = workspace_root.join("crates");
+    pub(crate) fn from_environment(environment: &BuildEnvironment) -> Self {
+        let workspace_root = &environment.workspace_root;
         Self {
-            definition: crates.join("build-workshop").join("ifw"),
+            definition: workspace_root
+                .join("crates")
+                .join("build-installer")
+                .join("ifw"),
             license: workspace_root.join("LICENSE"),
-            icons: crates.join("workshop").join("desktop").join("icons"),
+            icons: workshop::desktop(&environment.workshop_root).join("icons"),
         }
     }
 }
diff --git a/crates/build-workshop/src/main/manifest.rs b/crates/build-installer/src/main/manifest.rs
similarity index 96%
rename from crates/build-workshop/src/main/manifest.rs
rename to crates/build-installer/src/main/manifest.rs
index 0d7dad107..aebff7d77 100644
--- a/crates/build-workshop/src/main/manifest.rs
+++ b/crates/build-installer/src/main/manifest.rs
@@ -1,4 +1,4 @@
-//! `cargo workshop manifest`: checks that a directory holds exactly one
+//! `cargo installer manifest`: checks that a directory holds exactly one
 //! release's files for every platform, verifies each updater file's
 //! signature against the updater public key, and writes the release's
 //! `latest.json` and `SHA256SUMS` into it.
@@ -16,6 +16,7 @@ use super::args::ManifestRequest;
 use super::installer::collect::{arch_name, installer_name, workshop_updater_name};
 use super::installer::ifw::utc_date;
 use super::installer::{Arch, Platform, System, VERSION};
+use super::workshop;
 
 pub(crate) const MANIFEST: &str = "latest.json";
 pub(crate) const CHECKSUMS: &str = "SHA256SUMS";
@@ -99,16 +100,17 @@ fn release_files(updaters: &[Updater]) -> BTreeSet<String> {
 /// Verifies `request.assets` as this version's release and writes
 /// `latest.json` and `SHA256SUMS` into it, dated `now` (seconds since the
 /// Unix epoch). The public key is `request.public_key`'s contents, or else
-/// `plugins.updater.pubkey` in `workspace_root`'s Workshop `tauri.conf.json`.
+/// `plugins.updater.pubkey` in Workshop's `tauri.conf.json`, in the
+/// checkout at `workshop_root`.
 pub(crate) fn write(
     request: &ManifestRequest,
-    workspace_root: &Path,
+    workshop_root: &Path,
     now: u64,
 ) -> Result<(), String> {
     let base_url = base_url(&request.base_url)?;
     let updaters = updaters();
     check_file_set(&request.assets, &release_files(&updaters))?;
-    let (public_key, against) = public_key(request, workspace_root)?;
+    let (public_key, against) = public_key(request, workshop_root)?;
     let mut platforms = serde_json::Map::new();
     let mut failures = Vec::new();
     for updater in &updaters {
@@ -245,7 +247,7 @@ fn check_file_set(assets: &Path, expected: &BTreeSet<String>) -> Result<(), Stri
 /// the release key in `tauri.conf.json` is the one installed copies trust.
 fn public_key(
     request: &ManifestRequest,
-    workspace_root: &Path,
+    workshop_root: &Path,
 ) -> Result<(minisign_verify::PublicKey, String), String> {
     let (encoded, source, against) = if let Some(path) = &request.public_key {
         let contents = fs::read_to_string(path)
@@ -254,11 +256,7 @@ fn public_key(
         let against = format!("the key in {source}");
         (contents, source, against)
     } else {
-        let config = workspace_root
-            .join("crates")
-            .join("workshop")
-            .join("desktop")
-            .join("tauri.conf.json");
+        let config = workshop::desktop(workshop_root).join("tauri.conf.json");
         let text = fs::read_to_string(&config)
             .map_err(|error| format!("cannot read {}: {error}", config.display()))?;
         let value: serde_json::Value = serde_json::from_str(&text)
diff --git a/crates/build-installer/src/main/pipeline.rs b/crates/build-installer/src/main/pipeline.rs
new file mode 100644
index 000000000..aa45647d7
--- /dev/null
+++ b/crates/build-installer/src/main/pipeline.rs
@@ -0,0 +1,65 @@
+//! The checked command run every installer step goes through, and the
+//! discovery of the target a build without `--target` is for.
+
+use std::ffi::OsString;
+use std::io;
+
+use super::args::valid_target_triple;
+use super::{BuildEnvironment, CommandRunner, CommandSpec, OutputMode};
+
+pub(super) fn resolve_target(
+    target: Option<&str>,
+    environment: &BuildEnvironment,
+    runner: &mut impl CommandRunner,
+) -> Result<String, String> {
+    match target {
+        Some(target) => Ok(target.to_owned()),
+        None => discover_host_target(environment, runner),
+    }
+}
+
+fn discover_host_target(
+    environment: &BuildEnvironment,
+    runner: &mut impl CommandRunner,
+) -> Result<String, String> {
+    let output = run_checked(
+        runner,
+        &CommandSpec {
+            program: environment.cargo.clone(),
+            args: vec![OsString::from("-vV")],
+            current_dir: environment.workspace_root.clone(),
+            envs: Vec::new(),
+            output_mode: OutputMode::Capture,
+        },
+        "Cargo host discovery",
+    )?;
+    output
+        .lines()
+        .find_map(|line| line.strip_prefix("host: "))
+        .filter(|target| valid_target_triple(target))
+        .map(str::to_owned)
+        .ok_or_else(|| "Cargo host triple was absent or malformed in `cargo -vV` output".to_owned())
+}
+
+pub(super) fn run_checked(
+    runner: &mut impl CommandRunner,
+    command: &CommandSpec,
+    label: &str,
+) -> Result<String, String> {
+    let result = runner.run(command).map_err(|error| {
+        if error.kind() == io::ErrorKind::Interrupted {
+            format!("{label} canceled: {error}")
+        } else {
+            format!("{label} could not start: {error}")
+        }
+    })?;
+    if result.success {
+        return Ok(result.stdout);
+    }
+    let detail = if result.stderr.trim().is_empty() {
+        String::new()
+    } else {
+        format!(": {}", result.stderr.trim())
+    };
+    Err(format!("{label} failed{detail}"))
+}
diff --git a/crates/build-workshop/src/main/runner.rs b/crates/build-installer/src/main/runner.rs
similarity index 100%
rename from crates/build-workshop/src/main/runner.rs
rename to crates/build-installer/src/main/runner.rs
diff --git a/crates/build-installer/src/main/tests.rs b/crates/build-installer/src/main/tests.rs
new file mode 100644
index 000000000..99acd4616
--- /dev/null
+++ b/crates/build-installer/src/main/tests.rs
@@ -0,0 +1,272 @@
+//! The fake runner and the test environment the installer's tests share.
+
+use std::collections::VecDeque;
+use std::fmt;
+use std::path::Path;
+
+use tempfile::TempDir;
+
+use super::*;
+
+#[path = "tests/args.rs"]
+mod args_tests;
+#[path = "tests/bundle.rs"]
+mod bundle_tests;
+#[path = "tests/collect.rs"]
+mod collect_tests;
+#[path = "tests/failures.rs"]
+mod failures;
+#[path = "tests/gateway.rs"]
+mod gateway_tests;
+#[path = "tests/ifw.rs"]
+mod ifw_tests;
+#[path = "tests/installer.rs"]
+mod installer_tests;
+#[path = "tests/stage.rs"]
+mod stage_tests;
+#[path = "tests/workshop.rs"]
+mod workshop_tests;
+
+enum FakeResponse {
+    Completed(CommandResult),
+    CompletedAndCanceled,
+    CanceledBeforeStart,
+    CanceledAfterStart,
+    SpawnFailed(io::ErrorKind, &'static str),
+    /// Runs the effect, standing in for what the real child does to the
+    /// filesystem, then answers with the inner response.
+    Act(Box<dyn FnOnce()>, Box<FakeResponse>),
+}
+
+impl fmt::Debug for FakeResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Completed(result) => write!(formatter, "Completed({result:?})"),
+            Self::CompletedAndCanceled => formatter.write_str("CompletedAndCanceled"),
+            Self::CanceledBeforeStart => formatter.write_str("CanceledBeforeStart"),
+            Self::CanceledAfterStart => formatter.write_str("CanceledAfterStart"),
+            Self::SpawnFailed(kind, message) => {
+                write!(formatter, "SpawnFailed({kind:?}, {message})")
+            }
+            Self::Act(_, response) => write!(formatter, "Act({response:?})"),
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct FakeRunner {
+    responses: VecDeque<FakeResponse>,
+    commands: Vec<CommandSpec>,
+    cancel_observed: bool,
+}
+
+impl FakeRunner {
+    fn with_responses(responses: Vec<FakeResponse>) -> Self {
+        Self {
+            responses: responses.into(),
+            commands: Vec::new(),
+            cancel_observed: false,
+        }
+    }
+
+    fn answer(&mut self, response: FakeResponse) -> io::Result<CommandResult> {
+        match response {
+            FakeResponse::Completed(result) => Ok(result),
+            FakeResponse::CompletedAndCanceled => {
+                self.cancel_observed = true;
+                Ok(CommandResult {
+                    success: true,
+                    stdout: String::new(),
+                    stderr: String::new(),
+                })
+            }
+            FakeResponse::CanceledBeforeStart | FakeResponse::CanceledAfterStart => {
+                self.cancel_observed = true;
+                Err(io::Error::new(io::ErrorKind::Interrupted, "canceled"))
+            }
+            FakeResponse::SpawnFailed(kind, message) => Err(io::Error::new(kind, message)),
+            FakeResponse::Act(effect, response) => {
+                effect();
+                self.answer(*response)
+            }
+        }
+    }
+}
+
+impl CommandRunner for FakeRunner {
+    fn run(&mut self, command: &CommandSpec) -> io::Result<CommandResult> {
+        self.commands.push(command.clone());
+        if self.cancel_observed {
+            return Err(io::Error::new(
+                io::ErrorKind::Interrupted,
+                "canceled before child start",
+            ));
+        }
+        let response = self.responses.pop_front().expect("unexpected command");
+        self.answer(response)
+    }
+
+    fn cancel_observed(&self) -> bool {
+        self.cancel_observed
+    }
+}
+
+fn success(stdout: &str) -> FakeResponse {
+    FakeResponse::Completed(CommandResult {
+        success: true,
+        stdout: stdout.to_owned(),
+        stderr: String::new(),
+    })
+}
+
+fn failure(stderr: &str) -> FakeResponse {
+    FakeResponse::Completed(CommandResult {
+        success: false,
+        stdout: String::new(),
+        stderr: stderr.to_owned(),
+    })
+}
+
+fn act(effect: impl FnOnce() + 'static, response: FakeResponse) -> FakeResponse {
+    FakeResponse::Act(Box::new(effect), Box::new(response))
+}
+
+fn repository_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(Path::parent)
+        .expect("repository root")
+        .to_path_buf()
+}
+
+fn write_file(path: &Path, contents: &[u8]) {
+    std::fs::create_dir_all(path.parent().expect("parent")).expect("parent directory");
+    std::fs::write(path, contents).expect("write file");
+}
+
+/// The Gateway version the test Workshop checkout's pin names, apart from
+/// Workshop's own so a test can tell the two apart.
+const GATEWAY_VERSION: &str = "0.9.3";
+
+/// The Cargo manifest of a Workshop checkout at `version`.
+fn workshop_manifest(version: &str) -> String {
+    format!("[workspace.package]\nversion = \"{version}\"\n")
+}
+
+/// A build environment whose Workshop checkout and target directory are
+/// in a temporary directory. The workspace root is this repository, whose
+/// IFW definition, Gateway bundle template, `LICENSE`, and toolchain file
+/// the build reads and never writes.
+struct TestEnvironment {
+    temp: TempDir,
+    environment: BuildEnvironment,
+}
+
+impl TestEnvironment {
+    /// Stages a Gateway for `target` in the Workshop checkout, where its
+    /// `tools/fetch-gateway-sidecar.mjs` leaves one.
+    fn stage_gateway(&self, target: &str) -> PathBuf {
+        let staged = gateway::staged_path(&self.environment.workshop_root, target);
+        write_file(&staged, b"gateway");
+        staged
+    }
+
+    /// A Gateway binary outside the Workshop checkout, as
+    /// `--gateway-binary` or `RUNVIL_GATEWAY_SIDECAR` names one.
+    fn given_gateway(&self) -> PathBuf {
+        let path = self.temp.path().join("given").join("runvil-gateway");
+        write_file(&path, b"given gateway");
+        path
+    }
+
+    /// Writes the Workshop checkout's `gateway-pin/pin.json` naming
+    /// `version`.
+    fn pin(&self, version: &str) {
+        let pin = self
+            .environment
+            .workshop_root
+            .join("gateway-pin")
+            .join("pin.json");
+        write_file(
+            &pin,
+            serde_json::json!({ "version": version })
+                .to_string()
+                .as_bytes(),
+        );
+    }
+}
+
+/// The environment of a build whose Workshop checkout agrees with this
+/// workspace: its version, this repository's toolchain file, the Gateway
+/// pin, and placeholders for the two icons the installer reads.
+fn environment() -> TestEnvironment {
+    let temp = tempfile::tempdir().expect("temporary root");
+    let workspace_root = repository_root();
+    let workshop_root = temp.path().join("runvil-workshop");
+    let target_root = temp.path().join("cargo-target");
+    write_file(
+        &workshop_root.join("Cargo.toml"),
+        workshop_manifest(installer::VERSION).as_bytes(),
+    );
+    write_file(
+        &workshop_root.join("rust-toolchain.toml"),
+        &std::fs::read(workspace_root.join("rust-toolchain.toml")).expect("toolchain file"),
+    );
+    for icon in ["icon.icns", "icon.png"] {
+        write_file(
+            &workshop::desktop(&workshop_root).join("icons").join(icon),
+            format!("placeholder {icon}").as_bytes(),
+        );
+    }
+    let qtifw_dir = Some(ifw_tests::fake_ifw(temp.path()).into_os_string());
+    let test_environment = TestEnvironment {
+        temp,
+        environment: BuildEnvironment {
+            workspace_root,
+            workshop_root,
+            target_root,
+            target_root_from_env: true,
+            cargo: PathBuf::from("selected-cargo"),
+            signing_key: None,
+            gateway_sidecar: None,
+            qtifw_dir,
+            path: None,
+            release_date: "2026-10-11".to_owned(),
+        },
+    };
+    test_environment.pin(GATEWAY_VERSION);
+    test_environment
+}
+
+fn strings(values: &[&str]) -> Vec<OsString> {
+    values.iter().map(OsString::from).collect()
+}
+
+fn command(
+    environment: &BuildEnvironment,
+    program: &str,
+    args: &[&str],
+    output_mode: OutputMode,
+) -> CommandSpec {
+    CommandSpec {
+        program: PathBuf::from(program),
+        args: strings(args),
+        current_dir: environment.workspace_root.clone(),
+        envs: Vec::new(),
+        output_mode,
+    }
+}
+
+/// The environment a child that runs Cargo gets: the test target root
+/// stands in for an absolute `CARGO_TARGET_DIR`.
+fn target_root_env(environment: &BuildEnvironment) -> Vec<(OsString, OsString)> {
+    vec![(
+        OsString::from("CARGO_TARGET_DIR"),
+        environment.target_root.clone().into_os_string(),
+    )]
+}
+
+/// Sets the key the release secrets set.
+fn set_signing_key(environment: &mut BuildEnvironment) {
+    environment.signing_key = Some(OsString::from("dW50cnVzdGVkIGNvbW1lbnQ6"));
+}
diff --git a/crates/build-workshop/src/main/tests/args.rs b/crates/build-installer/src/main/tests/args.rs
similarity index 57%
rename from crates/build-workshop/src/main/tests/args.rs
rename to crates/build-installer/src/main/tests/args.rs
index e8569f9fa..c0f2b97f2 100644
--- a/crates/build-workshop/src/main/tests/args.rs
+++ b/crates/build-installer/src/main/tests/args.rs
@@ -1,5 +1,5 @@
-//! Unit tests for the build and installer modes' arguments. The `manifest`
-//! mode's are in `manifest-args.rs`.
+//! Unit tests for the installer mode's arguments. The `manifest` mode's are
+//! in `manifest-args.rs`.
 
 use super::*;
 
@@ -7,37 +7,10 @@ pub(super) fn arguments(values: &[&str]) -> Vec<String> {
     values.iter().map(|value| (*value).to_owned()).collect()
 }
 
-#[test]
-fn parses_only_the_documented_profile_and_target_options() {
-    assert_eq!(
-        parse_arguments(&[]).expect("debug request"),
-        Request::Build(BuildRequest {
-            profile: Profile::Debug,
-            target: None,
-            gateway_binary: None,
-        })
-    );
-    assert_eq!(
-        parse_arguments(&arguments(&[
-            "--target",
-            "aarch64-apple-darwin",
-            "--release",
-            "--gateway-binary",
-            "gateway/runvil-gateway",
-        ]))
-        .expect("release target request"),
-        Request::Build(BuildRequest {
-            profile: Profile::Release,
-            target: Some("aarch64-apple-darwin".to_owned()),
-            gateway_binary: Some(PathBuf::from("gateway/runvil-gateway")),
-        })
-    );
-}
-
 #[test]
 fn parses_the_installer_mode_with_its_gateway_binary() {
     assert_eq!(
-        parse_arguments(&arguments(&["installer"])).expect("installer"),
+        parse_arguments(&[]).expect("installer"),
         Request::Installer(InstallerRequest {
             target: None,
             sign: false,
@@ -46,7 +19,6 @@ fn parses_the_installer_mode_with_its_gateway_binary() {
     );
     assert_eq!(
         parse_arguments(&arguments(&[
-            "installer",
             "--gateway-binary",
             "gateway/runvil-gateway.exe",
             "--sign",
@@ -62,16 +34,35 @@ fn parses_the_installer_mode_with_its_gateway_binary() {
     );
 }
 
+/// The installer is the default mode, so the word that once chose it is
+/// an argument like any other.
+#[test]
+fn the_installer_word_is_an_unsupported_argument() {
+    for args in [
+        arguments(&["installer"]),
+        arguments(&["installer", "--target", "x86_64-pc-windows-msvc"]),
+    ] {
+        let error = parse_arguments(&args)
+            .expect_err("the installer word")
+            .to_string();
+        assert!(
+            error.starts_with("unsupported argument `installer`"),
+            "{args:?}: {error}"
+        );
+        assert!(error.contains(args::USAGE), "{error}");
+    }
+}
+
 #[test]
 fn rejects_product_features_and_other_unsupported_arguments() {
     for args in [
         arguments(&["--features", "local"]),
         arguments(&["--profile", "dist"]),
         arguments(&["gateway"]),
-        arguments(&["--sign"]),
-        arguments(&["installer", "--source", "gateway"]),
-        // The sidecar mode is gone; the slot is the fetch script's.
+        arguments(&["--source", "gateway"]),
+        arguments(&["bundle", "--target", "x86_64-pc-windows-msvc"]),
         arguments(&["sidecar", "stage", "--target", "x86_64-pc-windows-msvc"]),
+        arguments(&["--assets", "dist"]),
         arguments(&[
             "manifest",
             "--assets",
@@ -93,7 +84,7 @@ fn rejects_product_features_and_other_unsupported_arguments() {
 #[test]
 fn rejects_duplicate_incomplete_or_malformed_options() {
     for args in [
-        arguments(&["--release", "--release"]),
+        arguments(&["--sign", "--sign"]),
         arguments(&["--target"]),
         arguments(&[
             "--target",
@@ -102,11 +93,10 @@ fn rejects_duplicate_incomplete_or_malformed_options() {
             "x86_64-unknown-linux-gnu",
         ]),
         arguments(&["--target", "../outside"]),
+        arguments(&["--target", "--sign"]),
         arguments(&["--gateway-binary"]),
         arguments(&["--gateway-binary", "a", "--gateway-binary", "b"]),
-        arguments(&["installer", "--sign", "--sign"]),
-        arguments(&["installer", "--target", "--sign"]),
-        arguments(&["installer", "--gateway-binary", "--sign"]),
+        arguments(&["--gateway-binary", "--sign"]),
     ] {
         assert!(parse_arguments(&args).is_err(), "{args:?}");
     }
@@ -114,12 +104,19 @@ fn rejects_duplicate_incomplete_or_malformed_options() {
 
 #[test]
 fn installer_release_says_the_installer_always_builds_release() {
-    let error = parse_arguments(&arguments(&["installer", "--target", "x", "--release"]))
-        .expect_err("installer --release")
-        .to_string();
-
-    assert!(
-        error.starts_with("`installer` always builds the release profile; drop `--release`"),
-        "{error}"
-    );
+    for args in [
+        arguments(&["--release"]),
+        arguments(&["--target", "x86_64-pc-windows-msvc", "--release"]),
+    ] {
+        let error = parse_arguments(&args)
+            .expect_err("installer --release")
+            .to_string();
+        assert!(
+            error.starts_with(
+                "`cargo installer` always builds the release profile; drop `--release`"
+            ),
+            "{args:?}: {error}"
+        );
+        assert!(error.contains(args::USAGE), "{error}");
+    }
 }
diff --git a/crates/build-workshop/src/main/tests/bundle.rs b/crates/build-installer/src/main/tests/bundle.rs
similarity index 60%
rename from crates/build-workshop/src/main/tests/bundle.rs
rename to crates/build-installer/src/main/tests/bundle.rs
index 7de00e527..3d79f4071 100644
--- a/crates/build-workshop/src/main/tests/bundle.rs
+++ b/crates/build-installer/src/main/tests/bundle.rs
@@ -1,75 +1,23 @@
-//! Unit tests for the per-platform Tauri configs, the macOS Gateway
-//! bundle, and the macOS installer sequences.
-
-use serde_json::Value;
+//! Unit tests for the macOS Gateway bundle and the macOS installer
+//! sequences.
 
 use super::ifw_tests::{ifw_built, ifw_commands, ifw_found, installer_path};
 use super::installer_tests::{
-    bundle, bundled, bundled_plugins, collect_signature, expected_commands, node_found, output,
-    request, version_printed,
+    bundle, bundled, collect_signature, expected_commands, output, request, version_printed,
 };
 use super::*;
-use crate::installer::Platform;
 use crate::installer::bundle::{self, BundleSources};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
-fn tauri_config(name: &str) -> Value {
-    let path = repository_root()
-        .join("crates")
-        .join("workshop")
-        .join("desktop")
-        .join(name);
-    let text = std::fs::read_to_string(&path).expect("Tauri config");
-    serde_json::from_str(&text).expect("Tauri config JSON")
-}
-
-#[test]
-fn each_platform_config_builds_the_installer_bundle_and_only_windows_carries_the_gateway() {
-    let base = tauri_config("tauri.conf.json");
-    assert_eq!(base["bundle"].get("targets"), None);
-    assert_eq!(base["bundle"].get("externalBin"), None);
-    for (file, target) in [
-        ("tauri.windows.conf.json", "x86_64-pc-windows-msvc"),
-        ("tauri.macos.conf.json", "aarch64-apple-darwin"),
-        ("tauri.linux.conf.json", "x86_64-unknown-linux-gnu"),
-    ] {
-        let config = tauri_config(file);
-        let platform = Platform::from_triple(target).expect("platform");
-        assert_eq!(
-            config["bundle"]["targets"],
-            serde_json::json!([platform.bundle()]),
-            "{file}"
-        );
-        let external = config["bundle"].get("externalBin");
-        if sidecar::bundles_sidecar(target) {
-            assert_eq!(
-                external,
-                Some(&serde_json::json!(["binaries/runvil-gateway"])),
-                "{file}"
-            );
-        } else {
-            assert_eq!(external, None, "{file}");
-        }
-    }
-}
-
-#[test]
-fn the_appimage_bundles_the_gstreamer_plugins_beside_the_core_webkit_brings() {
-    let linux = tauri_config("tauri.linux.conf.json");
-    assert_eq!(
-        linux["bundle"]["linux"]["appimage"]["bundleMediaFramework"],
-        Value::Bool(true)
-    );
-}
-
 #[test]
 fn the_gateway_bundle_holds_the_versioned_plist_the_executable_and_the_icon() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let gateway = temp.path().join("runvil-gateway");
+    let test_environment = environment();
+    let temp = test_environment.temp.path();
+    let gateway = temp.join("runvil-gateway");
     write_file(&gateway, b"gateway");
-    let app = temp.path().join("Runvil Gateway.app");
-    let sources = BundleSources::in_workspace(&repository_root());
+    let app = temp.join("Runvil Gateway.app");
+    let sources = BundleSources::from_environment(&test_environment.environment);
     // The guard in `assemble` only checks that the placeholder appears, so
     // anywhere but the two version keys would defeat it.
     let template = std::fs::read_to_string(&sources.info_plist).expect("template");
@@ -88,8 +36,13 @@ fn the_gateway_bundle_holds_the_versioned_plist_the_executable_and_the_icon() {
             "Contents/Resources/icon.icns",
         ]
     );
-    let plist =
-        std::fs::read_to_string(app.join("Contents").join("Info.plist")).expect("Info.plist");
+    let contents = app.join("Contents");
+    assert_eq!(
+        std::fs::read(contents.join("Resources").join("icon.icns")).expect("icon"),
+        std::fs::read(&sources.icon).expect("Workshop's icon"),
+        "the icon is the Workshop checkout's"
+    );
+    let plist = std::fs::read_to_string(contents.join("Info.plist")).expect("Info.plist");
     assert!(
         plist.contains(&format!(
             "<key>CFBundleShortVersionString</key>\n    <string>{GATEWAY_VERSION}</string>"
@@ -110,7 +63,7 @@ fn the_gateway_bundle_holds_the_versioned_plist_the_executable_and_the_icon() {
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt as _;
-        let executable = app.join("Contents").join("MacOS").join("runvil-gateway");
+        let executable = contents.join("MacOS").join("runvil-gateway");
         let mode = std::fs::metadata(executable)
             .expect("executable")
             .permissions()
@@ -121,11 +74,12 @@ fn the_gateway_bundle_holds_the_versioned_plist_the_executable_and_the_icon() {
 
 #[test]
 fn a_template_without_the_placeholder_or_a_missing_icon_fails_naming_the_file() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let gateway = temp.path().join("runvil-gateway");
+    let test_environment = environment();
+    let temp = test_environment.temp.path();
+    let gateway = temp.join("runvil-gateway");
     write_file(&gateway, b"gateway");
-    let real = BundleSources::in_workspace(&repository_root());
-    let fixed = temp.path().join("Info.plist");
+    let real = BundleSources::from_environment(&test_environment.environment);
+    let fixed = temp.join("Info.plist");
     write_file(&fixed, b"<plist><string>1.0.0</string></plist>");
 
     let error = bundle::assemble(
@@ -135,13 +89,13 @@ fn a_template_without_the_placeholder_or_a_missing_icon_fails_naming_the_file()
         },
         &gateway,
         GATEWAY_VERSION,
-        &temp.path().join("a.app"),
+        &temp.join("a.app"),
     )
     .expect_err("no placeholder");
     assert!(error.contains(&fixed.display().to_string()), "{error}");
     assert!(error.contains("@VERSION@"), "{error}");
 
-    let missing = temp.path().join("icon.icns");
+    let missing = temp.join("icon.icns");
     let error = bundle::assemble(
         &BundleSources {
             info_plist: real.info_plist,
@@ -149,7 +103,7 @@ fn a_template_without_the_placeholder_or_a_missing_icon_fails_naming_the_file()
         },
         &gateway,
         GATEWAY_VERSION,
-        &temp.path().join("b.app"),
+        &temp.join("b.app"),
     )
     .expect_err("no icon");
     assert!(error.contains(&missing.display().to_string()), "{error}");
@@ -190,34 +144,32 @@ fn macos_signed_collects_the_payload_and_publishes_workshop_s_updater() {
     let output_root = output(environment, target);
     let mut responses = vec![
         ifw_found(),
-        node_found(),
-        version_printed(),
         bundled(
-            staged.clone(),
-            [
-                vec![
-                    macos
-                        .join("Runvil.app")
-                        .join("Contents")
-                        .join("MacOS")
-                        .join("runvil-workshop"),
-                    collect_signature(&updater),
-                    updater,
-                ],
-                bundled_plugins(environment, target),
-            ]
-            .concat(),
+            vec![
+                macos
+                    .join("Runvil.app")
+                    .join("Contents")
+                    .join("MacOS")
+                    .join("runvil-workshop"),
+                collect_signature(&updater),
+                updater,
+            ],
             success(""),
         ),
+        version_printed(),
     ];
     responses.extend(ifw_built(environment, target));
     let mut runner = FakeRunner::with_responses(responses);
 
     build_installer(&request(target, true), environment, &mut runner).expect("installer");
 
-    let mut expected = expected_commands(environment, target, "app", true);
+    let mut expected = expected_commands(environment, target, true, None);
     expected.extend(ifw_commands(environment, target));
     assert_eq!(runner.commands, expected);
+    assert_eq!(
+        runner.commands[1].args,
+        strings(&["workshop", "bundle", "--target", target, "--sign"])
+    );
     assert!(installer_path(environment, target).is_file());
     let payload = output_root.join("payload");
     assert!(
@@ -253,39 +205,41 @@ fn macos_unsigned_publishes_only_the_dmg_around_the_pinned_gateway() {
     let test_environment = environment();
     let environment = &test_environment.environment;
     let target = "x86_64-apple-darwin";
-    let staged = test_environment.stage_gateway(target);
-    let app = bundle(environment, target, "macos").join("Runvil.app");
+    test_environment.stage_gateway(target);
+    let contents = Path::new("Runvil.app").join("Contents");
+    let executable = contents.join("MacOS").join("runvil-workshop");
+    // Workshop's bundle arrives with the Plugins' libraries inside it.
+    let library = contents
+        .join("Resources")
+        .join("plugins")
+        .join("libplugin_std.dylib");
+    let macos = bundle(environment, target, "macos");
     let mut responses = vec![
         ifw_found(),
-        node_found(),
-        version_printed(),
         bundled(
-            staged,
-            [
-                vec![app.join("Contents").join("MacOS").join("runvil-workshop")],
-                bundled_plugins(environment, target),
-            ]
-            .concat(),
+            vec![macos.join(&executable), macos.join(&library)],
             success(""),
         ),
+        version_printed(),
     ];
     responses.extend(ifw_built(environment, target));
     let mut runner = FakeRunner::with_responses(responses);
 
     build_installer(&request(target, false), environment, &mut runner).expect("installer");
 
-    let mut expected = expected_commands(environment, target, "app", false);
+    let mut expected = expected_commands(environment, target, false, None);
     expected.extend(ifw_commands(environment, target));
     assert_eq!(runner.commands, expected);
-    let payload = output(environment, target).join("payload");
-    assert!(
-        payload
-            .join("Runvil.app")
-            .join("Contents")
-            .join("MacOS")
-            .join("runvil-workshop")
-            .is_file()
+    assert_eq!(
+        runner.commands[1].args,
+        strings(&["workshop", "bundle", "--target", target])
     );
+    let payload = output(environment, target).join("payload");
+    // The payload holds Workshop's bundle whole, and the bundle has left
+    // Tauri's directory.
+    assert!(payload.join(&executable).is_file());
+    assert!(payload.join(&library).is_file());
+    assert!(!macos.join("Runvil.app").exists());
     // The Gateway bundle states the pin's version, not Workshop's.
     let plist = payload_plist(&payload);
     assert!(
@@ -297,21 +251,6 @@ fn macos_unsigned_publishes_only_the_dmg_around_the_pinned_gateway() {
         "{plist}"
     );
     assert!(!payload.join("runvil-gateway").exists());
-    // The Plugins' libraries sit inside Workshop's bundle, where the
-    // updater replaces them with Workshop, and nowhere beside it.
-    for library in ["libplugin_std.dylib", "libplugin_bashkit.dylib"] {
-        assert!(
-            payload
-                .join("Runvil.app")
-                .join("Contents")
-                .join("Resources")
-                .join("plugins")
-                .join(library)
-                .is_file(),
-            "{library}"
-        );
-    }
-    assert!(!payload.join("plugins").exists());
     let installer = installer_path(environment, target);
     assert_eq!(
         installer.file_name().expect("name"),
diff --git a/crates/build-workshop/src/main/tests/collect.rs b/crates/build-installer/src/main/tests/collect.rs
similarity index 71%
rename from crates/build-workshop/src/main/tests/collect.rs
rename to crates/build-installer/src/main/tests/collect.rs
index c5bd32e0c..7f4d2c3b7 100644
--- a/crates/build-workshop/src/main/tests/collect.rs
+++ b/crates/build-installer/src/main/tests/collect.rs
@@ -2,19 +2,16 @@
 //! installed names Workshop's Gateway lookup shares.
 
 use super::*;
+use crate::installer::bundle::BundleSources;
 use crate::installer::collect;
 use crate::installer::{Arch, Gateway, Platform, System};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
-/// A Gateway at `binary` with the test pin's version; a Windows collection
-/// never reads it.
-fn pinned(binary: PathBuf) -> Gateway {
-    Gateway {
-        binary,
-        version: GATEWAY_VERSION.to_owned(),
-    }
-}
+const WINDOWS: Platform = Platform {
+    system: System::Windows,
+    arch: Arch::X86_64,
+};
 
 #[test]
 fn maps_each_supported_triple_to_its_platform() {
@@ -52,35 +49,17 @@ fn a_missing_or_duplicated_bundle_file_names_the_glob_and_directory() {
     let release = temp.path().join("release");
     let nsis = release.join("bundle").join("nsis");
     std::fs::create_dir_all(&nsis).expect("bundle directory");
-    let windows = Platform {
-        system: System::Windows,
-        arch: Arch::X86_64,
-    };
 
-    let error = collect::collect(
-        temp.path(),
-        &release,
-        &pinned(release.join("runvil-gateway.exe")),
-        windows,
-        false,
-        &temp.path().join("out"),
-    )
-    .expect_err("missing setup");
+    let error = collect::collect(&release, WINDOWS, false, &temp.path().join("out"))
+        .expect_err("missing setup");
     assert!(error.contains("`*-setup.exe`"), "{error}");
     assert!(error.contains(&nsis.display().to_string()), "{error}");
     assert!(error.contains("found 0"), "{error}");
 
     write_file(&nsis.join("a-setup.exe"), b"a");
     write_file(&nsis.join("b-setup.exe"), b"b");
-    let error = collect::collect(
-        temp.path(),
-        &release,
-        &pinned(release.join("runvil-gateway.exe")),
-        windows,
-        false,
-        &temp.path().join("out"),
-    )
-    .expect_err("duplicate setup");
+    let error = collect::collect(&release, WINDOWS, false, &temp.path().join("out"))
+        .expect_err("duplicate setup");
     assert!(error.contains("found 2"), "{error}");
 }
 
@@ -94,18 +73,8 @@ fn a_missing_signature_under_sign_names_the_file() {
         .join(format!("Runvil_{VERSION}_x64-setup.exe"));
     write_file(&setup, b"setup");
 
-    let error = collect::collect(
-        temp.path(),
-        &release,
-        &pinned(release.join("runvil-gateway.exe")),
-        Platform {
-            system: System::Windows,
-            arch: Arch::X86_64,
-        },
-        true,
-        &temp.path().join("out"),
-    )
-    .expect_err("missing signature");
+    let error = collect::collect(&release, WINDOWS, true, &temp.path().join("out"))
+        .expect_err("missing signature");
 
     assert!(
         error.contains(&collect::signature_path(&setup).display().to_string()),
@@ -131,24 +100,13 @@ fn collection_replaces_an_earlier_output() {
         b"setup",
     );
 
-    collect::collect(
-        temp.path(),
-        &release,
-        &pinned(release.join("runvil-gateway.exe")),
-        Platform {
-            system: System::Windows,
-            arch: Arch::X86_64,
-        },
-        false,
-        &output,
-    )
-    .expect("collect");
+    collect::collect(&release, WINDOWS, false, &output).expect("collect");
 
     assert!(!output.join("publish").join("stale.exe").exists());
 }
 
-/// A Tauri macOS bundle output and a release Gateway; with `sign`, also
-/// Workshop's updater archive and its signature.
+/// A Tauri macOS bundle output; with `sign`, also Workshop's updater
+/// archive and its signature.
 fn macos_release(release: &Path, sign: bool) {
     let bundle = release.join("bundle").join("macos");
     write_file(
@@ -163,29 +121,38 @@ fn macos_release(release: &Path, sign: bool) {
         write_file(&bundle.join("Runvil.app.tar.gz"), b"app archive");
         write_file(&bundle.join("Runvil.app.tar.gz.sig"), b"app signature");
     }
-    write_file(&release.join("runvil-gateway"), b"gateway");
 }
 
-#[test]
-fn macos_payload_holds_the_two_bundles_with_the_gateway_s_version() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let release = temp.path().join("release");
-    let output = temp.path().join("out");
-    macos_release(&release, true);
+/// Collects `release` for a macOS `arch` into `output` and places a
+/// Gateway with the test pin's version in the payload, as the installer
+/// build does.
+fn collect_macos(test_environment: &TestEnvironment, release: &Path, arch: Arch, sign: bool) {
     let platform = Platform {
         system: System::MacOs,
-        arch: Arch::Aarch64,
+        arch,
     };
-
-    collect::collect(
-        &repository_root(),
-        &release,
-        &pinned(release.join("runvil-gateway")),
+    let output = test_environment.temp.path().join("out");
+    collect::collect(release, platform, sign, &output).expect("collect");
+    collect::place_gateway(
+        &BundleSources::from_environment(&test_environment.environment),
+        &Gateway {
+            binary: test_environment.given_gateway(),
+            version: GATEWAY_VERSION.to_owned(),
+        },
         platform,
-        true,
-        &output,
+        &output.join("payload"),
     )
-    .expect("collect");
+    .expect("place the Gateway");
+}
+
+#[test]
+fn macos_payload_holds_the_two_bundles_with_the_gateway_s_version() {
+    let test_environment = environment();
+    let release = test_environment.temp.path().join("release");
+    let output = test_environment.temp.path().join("out");
+    macos_release(&release, true);
+
+    collect_macos(&test_environment, &release, Arch::Aarch64, true);
 
     let payload = output.join("payload");
     let mut names: Vec<_> = std::fs::read_dir(&payload)
@@ -197,7 +164,7 @@ fn macos_payload_holds_the_two_bundles_with_the_gateway_s_version() {
     let contents = payload.join("Runvil Gateway.app").join("Contents");
     assert_eq!(
         std::fs::read(contents.join("MacOS").join("runvil-gateway")).expect("executable"),
-        b"gateway"
+        b"given gateway"
     );
     let plist = std::fs::read_to_string(contents.join("Info.plist")).expect("Info.plist");
     assert!(
@@ -224,24 +191,12 @@ fn macos_payload_holds_the_two_bundles_with_the_gateway_s_version() {
 
 #[test]
 fn macos_unsigned_payload_publishes_nothing() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let release = temp.path().join("release");
-    let output = temp.path().join("out");
+    let test_environment = environment();
+    let release = test_environment.temp.path().join("release");
+    let output = test_environment.temp.path().join("out");
     macos_release(&release, false);
-    let platform = Platform {
-        system: System::MacOs,
-        arch: Arch::X86_64,
-    };
 
-    collect::collect(
-        &repository_root(),
-        &release,
-        &pinned(release.join("runvil-gateway")),
-        platform,
-        false,
-        &output,
-    )
-    .expect("collect");
+    collect_macos(&test_environment, &release, Arch::X86_64, false);
 
     let payload = output.join("payload");
     assert!(payload.join("Runvil Gateway.app").is_dir());
@@ -264,25 +219,32 @@ fn declared(text: &str, name: &str) -> String {
     value[..value.find('"').expect("close quote")].to_owned()
 }
 
+/// The one test that reads the real Workshop checkout, the one
+/// `RUNVIL_WORKSHOP` names when the test runs. Cargo's configuration in
+/// this repository sets the variable to the checkout next to the
+/// repository unless it is already set.
 #[test]
 fn the_installed_names_match_workshop_s_gateway_lookup() {
-    let peer = repository_root()
+    let variable = workshop::WORKSHOP_VARIABLE;
+    let checkout = std::env::var_os(variable).unwrap_or_else(|| {
+        panic!("{variable} is unset; set it to the root of a runvil-workshop checkout")
+    });
+    let peer = PathBuf::from(checkout)
         .join("crates")
         .join("workshop")
         .join("gateway-discovery")
         .join("src")
         .join("peer.rs");
-    let text = std::fs::read_to_string(&peer).expect("peer.rs");
+    let text = std::fs::read_to_string(&peer).unwrap_or_else(|error| {
+        panic!(
+            "cannot read {}: {error}; set {variable} to the root of a runvil-workshop checkout",
+            peer.display()
+        )
+    });
     for (name, ours) in [
         ("WORKSHOP_BUNDLE_NAME", collect::WORKSHOP_BUNDLE_NAME),
         ("GATEWAY_BUNDLE_NAME", collect::GATEWAY_BUNDLE_NAME),
         ("WORKSHOP_APPIMAGE_NAME", collect::WORKSHOP_APPIMAGE_NAME),
-        ("PLUGIN_DIR_NAME", crate::plugin::PLUGIN_DIR_NAME),
-        ("MACOS_PLUGIN_PARENT", crate::plugin::MACOS_PLUGIN_PARENT),
-        (
-            "APPIMAGE_PLUGIN_PARENT",
-            crate::plugin::APPIMAGE_PLUGIN_PARENT,
-        ),
     ] {
         assert_eq!(declared(&text, name), ours, "{name} in {}", peer.display());
     }
diff --git a/crates/build-installer/src/main/tests/failures.rs b/crates/build-installer/src/main/tests/failures.rs
new file mode 100644
index 000000000..4addee1dd
--- /dev/null
+++ b/crates/build-installer/src/main/tests/failures.rs
@@ -0,0 +1,225 @@
+//! Unit tests for the installer's failure and cancellation paths.
+
+use super::ifw_tests::ifw_found;
+use super::installer_tests::{bundle_command, bundled, output, request};
+use super::*;
+
+#[test]
+fn a_missing_named_gateway_fails_before_any_command() {
+    for target in ["aarch64-pc-windows-msvc", "x86_64-unknown-linux-gnu"] {
+        let test_environment = environment();
+        let environment = &test_environment.environment;
+        test_environment.stage_gateway(target);
+        let missing = test_environment.temp.path().join("runvil-gateway");
+        let mut installer_request = request(target, false);
+        installer_request.gateway_binary = Some(missing.clone());
+        let mut runner = FakeRunner::default();
+
+        let error = build_installer(&installer_request, environment, &mut runner)
+            .expect_err("a missing Gateway");
+
+        assert!(error.contains("which is not a file"), "{target}: {error}");
+        assert!(
+            error.contains(&missing.display().to_string()),
+            "{target}: {error}"
+        );
+        assert!(runner.commands.is_empty(), "{target}");
+    }
+}
+
+#[test]
+fn a_cancel_raced_with_the_bundle_s_completion_fails_and_collects_nothing() {
+    for target in ["x86_64-pc-windows-msvc", "x86_64-unknown-linux-gnu"] {
+        let test_environment = environment();
+        let environment = &test_environment.environment;
+        test_environment.stage_gateway(target);
+        let ifw = (!target.ends_with("windows-msvc")).then(ifw_found);
+        let mut runner = FakeRunner::with_responses(
+            ifw.into_iter()
+                .chain([bundled(Vec::new(), FakeResponse::CompletedAndCanceled)])
+                .collect(),
+        );
+
+        let error = build_installer(&request(target, false), environment, &mut runner)
+            .expect_err("bundle completion race");
+
+        assert_eq!(
+            error, "Workshop bundle canceled after child completion",
+            "{target}"
+        );
+        assert_eq!(
+            runner.commands.last(),
+            Some(&bundle_command(environment, target, false, None)),
+            "{target}: no command follows the bundle"
+        );
+        assert!(!output(environment, target).exists(), "{target}");
+    }
+}
+
+#[test]
+fn malformed_host_output_fails_before_building() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let mut runner = FakeRunner::with_responses(vec![success("cargo 1.89.0\n")]);
+
+    let error = build_installer(
+        &InstallerRequest {
+            target: None,
+            sign: false,
+            gateway_binary: None,
+        },
+        environment,
+        &mut runner,
+    )
+    .expect_err("missing host");
+
+    assert!(error.contains("Cargo host triple"), "{error}");
+    assert_eq!(runner.commands.len(), 1);
+}
+
+#[test]
+fn a_gateway_other_than_the_pinned_release_fails_naming_the_pin() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "x86_64-unknown-linux-gnu";
+    let staged = test_environment.stage_gateway(target);
+    let mut runner = FakeRunner::with_responses(vec![
+        ifw_found(),
+        bundled(Vec::new(), success("")),
+        success("runvil-gateway 0.0.1\n"),
+    ]);
+
+    let error = build_installer(&request(target, false), environment, &mut runner)
+        .expect_err("version mismatch");
+
+    assert!(error.contains("printed `runvil-gateway 0.0.1`"), "{error}");
+    assert!(
+        error.contains(&format!("expected `runvil-gateway {GATEWAY_VERSION}`")),
+        "{error}"
+    );
+    assert!(
+        error.contains("the Workshop checkout's gateway-pin/pin.json"),
+        "{error}"
+    );
+    assert_eq!(runner.commands.len(), 3);
+    assert!(!output(environment, target).exists());
+    assert!(staged.is_file(), "a staged Gateway must outlive the build");
+}
+
+#[test]
+fn a_failed_version_check_collects_nothing() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "aarch64-apple-darwin";
+    test_environment.stage_gateway(target);
+    let mut runner = FakeRunner::with_responses(vec![
+        ifw_found(),
+        bundled(Vec::new(), success("")),
+        failure("bad CPU type in executable"),
+    ]);
+
+    let error = build_installer(&request(target, false), environment, &mut runner)
+        .expect_err("version check failure");
+
+    assert_eq!(
+        error,
+        "Gateway version check failed: bad CPU type in executable"
+    );
+    assert_eq!(runner.commands.len(), 3);
+    assert!(!output(environment, target).exists());
+}
+
+#[test]
+fn cancellation_at_the_version_check_collects_nothing_and_keeps_the_staged_gateway() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "x86_64-unknown-linux-gnu";
+    let staged = test_environment.stage_gateway(target);
+    let mut runner = FakeRunner::with_responses(vec![
+        ifw_found(),
+        bundled(Vec::new(), success("")),
+        FakeResponse::CanceledBeforeStart,
+    ]);
+
+    let error = build_installer(&request(target, false), environment, &mut runner)
+        .expect_err("version check cancellation");
+
+    assert!(error.contains("Gateway version check canceled"), "{error}");
+    assert_eq!(runner.commands.len(), 3);
+    assert!(!output(environment, target).exists());
+    assert!(staged.is_file());
+}
+
+#[test]
+fn a_failed_unstartable_or_canceled_bundle_collects_nothing() {
+    let cases = || {
+        [
+            (
+                failure("bundle broke"),
+                "Workshop bundle failed: bundle broke",
+            ),
+            (
+                FakeResponse::SpawnFailed(io::ErrorKind::NotFound, "cargo not found"),
+                "Workshop bundle could not start: cargo not found",
+            ),
+            (
+                FakeResponse::CanceledAfterStart,
+                "Workshop bundle canceled: canceled",
+            ),
+        ]
+    };
+    for (target, given) in [
+        ("x86_64-pc-windows-msvc", true),
+        ("x86_64-pc-windows-msvc", false),
+        ("x86_64-unknown-linux-gnu", true),
+        ("x86_64-unknown-linux-gnu", false),
+    ] {
+        for (response, expected) in cases() {
+            let test_environment = environment();
+            let environment = &test_environment.environment;
+            let staged = test_environment.stage_gateway(target);
+            let mut installer_request = request(target, false);
+            let named = given.then(|| test_environment.given_gateway());
+            installer_request.gateway_binary.clone_from(&named);
+            let ifw = (!target.ends_with("windows-msvc")).then(ifw_found);
+            let mut runner = FakeRunner::with_responses(
+                ifw.into_iter()
+                    .chain([bundled(Vec::new(), response)])
+                    .collect(),
+            );
+
+            let error = build_installer(&installer_request, environment, &mut runner)
+                .expect_err("bundle failure");
+
+            assert_eq!(error, expected, "{target}");
+            assert_eq!(
+                runner.commands.last(),
+                Some(&bundle_command(
+                    environment,
+                    target,
+                    false,
+                    named.as_deref()
+                )),
+                "{target}: the bundle is the last command, told the named Gateway"
+            );
+            assert!(!output(environment, target).exists(), "{target}");
+            assert!(staged.is_file(), "{target}: the staged Gateway is left");
+        }
+    }
+}
+
+#[test]
+fn an_unsupported_target_fails_before_building() {
+    let test_environment = environment();
+    let mut runner = FakeRunner::default();
+
+    let error = build_installer(
+        &request("x86_64-unknown-freebsd", false),
+        &test_environment.environment,
+        &mut runner,
+    )
+    .expect_err("unsupported target");
+
+    assert!(error.contains("x86_64-unknown-freebsd"), "{error}");
+    assert!(runner.commands.is_empty());
+}
diff --git a/crates/build-installer/src/main/tests/gateway.rs b/crates/build-installer/src/main/tests/gateway.rs
new file mode 100644
index 000000000..269f3f721
--- /dev/null
+++ b/crates/build-installer/src/main/tests/gateway.rs
@@ -0,0 +1,276 @@
+//! Unit tests for where the installer finds the Gateway: the named binary,
+//! the one staged in the Workshop checkout, and the pin.
+
+use super::ifw_tests::ifw_found;
+use super::installer_tests::{VERSION, bundle, bundle_command, bundled, output, request};
+use super::*;
+
+#[test]
+fn a_missing_gateway_names_the_fetch_script_and_runs_no_command() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "x86_64-unknown-linux-gnu";
+    let mut runner = FakeRunner::default();
+
+    let error = build_installer(&request(target, false), environment, &mut runner)
+        .expect_err("no Gateway for the installer");
+
+    assert!(
+        error.contains(&format!(
+            "run `node tools/fetch-gateway-sidecar.mjs --target {target}` in the Workshop \
+             checkout {}",
+            environment.workshop_root.display()
+        )),
+        "{error}"
+    );
+    assert!(
+        error.contains(
+            &gateway::staged_path(&environment.workshop_root, target)
+                .display()
+                .to_string()
+        ),
+        "{error}"
+    );
+    assert!(runner.commands.is_empty());
+}
+
+#[test]
+fn the_flag_wins_over_the_variable_which_wins_over_the_staged_gateway() {
+    let target = "x86_64-unknown-linux-gnu";
+    for (flag, variable, expected) in [
+        (true, true, "flag"),
+        (false, true, "variable"),
+        (false, false, "staged"),
+    ] {
+        let mut test_environment = environment();
+        let staged = test_environment.stage_gateway(target);
+        let named = |name: &str| {
+            test_environment
+                .temp
+                .path()
+                .join(name)
+                .join("runvil-gateway")
+        };
+        write_file(&named("flag"), b"flag");
+        write_file(&named("variable"), b"variable");
+        if variable {
+            test_environment.environment.gateway_sidecar = Some(named("variable"));
+        }
+        let environment = &test_environment.environment;
+        let mut installer_request = request(target, false);
+        if flag {
+            installer_request.gateway_binary = Some(named("flag"));
+        }
+        // A mismatched version stops the run after the version check.
+        let mut runner = FakeRunner::with_responses(vec![
+            ifw_found(),
+            bundled(Vec::new(), success("")),
+            success("runvil-gateway 0.0.1\n"),
+        ]);
+
+        build_installer(&installer_request, environment, &mut runner)
+            .expect_err("version mismatch");
+
+        // The bundle is told a named Gateway and left to the staged one,
+        // and the payload's Gateway is the same file.
+        let passed = (expected != "staged").then(|| named(expected));
+        assert_eq!(
+            runner.commands[1],
+            bundle_command(environment, target, false, passed.as_deref()),
+            "{expected}"
+        );
+        assert_eq!(
+            runner.commands[2].program,
+            passed.unwrap_or(staged),
+            "{expected}"
+        );
+        assert_eq!(runner.commands[2].args, strings(&["--version"]));
+    }
+}
+
+#[test]
+fn a_named_gateway_is_passed_to_a_windows_bundle_as_gateway_binary() {
+    for from_variable in [false, true] {
+        let mut test_environment = environment();
+        let target = "x86_64-pc-windows-msvc";
+        let given = test_environment.given_gateway();
+        let mut installer_request = request(target, false);
+        if from_variable {
+            test_environment.environment.gateway_sidecar = Some(given.clone());
+        } else {
+            installer_request.gateway_binary = Some(given.clone());
+        }
+        let environment = &test_environment.environment;
+        let setup =
+            bundle(environment, target, "nsis").join(format!("Runvil_{VERSION}_x64-setup.exe"));
+        let mut runner = FakeRunner::with_responses(vec![bundled(vec![setup], success(""))]);
+
+        build_installer(&installer_request, environment, &mut runner).expect("installer");
+
+        // The setup holds the Gateway, so the installer itself never runs
+        // or copies the named file.
+        assert_eq!(
+            runner.commands,
+            vec![CommandSpec {
+                program: PathBuf::from("selected-cargo"),
+                args: [
+                    strings(&["workshop", "bundle", "--target", target, "--gateway-binary"]),
+                    vec![given.clone().into_os_string()],
+                ]
+                .concat(),
+                current_dir: environment.workshop_root.clone(),
+                envs: target_root_env(environment),
+                output_mode: OutputMode::Inherit,
+            }],
+            "from the variable: {from_variable}"
+        );
+        assert!(!output(environment, target).join("payload").exists());
+    }
+}
+
+/// The bundle runs from the Workshop checkout, so a relative name must
+/// reach it resolved against this process's working directory.
+#[test]
+fn a_relative_gateway_name_reaches_the_bundle_as_an_absolute_path() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "x86_64-pc-windows-msvc";
+    // Cargo runs a test from its package's root, which holds this file. A
+    // Windows build only passes the name on.
+    let relative = Path::new("Cargo.toml");
+    let mut installer_request = request(target, false);
+    installer_request.gateway_binary = Some(relative.to_path_buf());
+    let mut runner = FakeRunner::with_responses(vec![failure("stop after the bundle")]);
+
+    build_installer(&installer_request, environment, &mut runner).expect_err("bundle failure");
+
+    let absolute = std::env::current_dir()
+        .expect("current directory")
+        .join(relative);
+    assert!(absolute.is_absolute());
+    assert_eq!(
+        runner.commands,
+        vec![bundle_command(environment, target, false, Some(&absolute))]
+    );
+}
+
+#[test]
+fn a_named_gateway_must_be_a_file_and_a_relative_name_resolves_once() {
+    let test_environment = environment();
+    let given = test_environment.given_gateway();
+    let missing = test_environment.temp.path().join("missing-gateway");
+
+    let error = gateway::named(Some(&missing)).expect_err("a missing Gateway");
+    assert!(error.contains("which is not a file"), "{error}");
+    assert!(error.contains(&missing.display().to_string()), "{error}");
+    // A relative name is resolved once, against the current directory, and
+    // never through PATH.
+    let error = gateway::named(Some(Path::new("no-such-runvil-gateway"))).expect_err("a bare name");
+    let resolved = std::env::current_dir()
+        .expect("current directory")
+        .join("no-such-runvil-gateway");
+    assert!(error.contains(&resolved.display().to_string()), "{error}");
+
+    assert_eq!(gateway::named(Some(&given)), Ok(Some(given)));
+    assert_eq!(gateway::named(None), Ok(None));
+}
+
+#[test]
+fn the_staged_gateway_is_named_with_tauri_s_target_suffix() {
+    let root = Path::new("runvil-workshop");
+    let binaries = root
+        .join("crates")
+        .join("workshop")
+        .join("desktop")
+        .join("binaries");
+    for (target, staged) in [
+        (
+            "x86_64-unknown-linux-gnu",
+            "runvil-gateway-x86_64-unknown-linux-gnu",
+        ),
+        (
+            "aarch64-unknown-linux-gnu",
+            "runvil-gateway-aarch64-unknown-linux-gnu",
+        ),
+        (
+            "aarch64-apple-darwin",
+            "runvil-gateway-aarch64-apple-darwin",
+        ),
+        ("x86_64-apple-darwin", "runvil-gateway-x86_64-apple-darwin"),
+    ] {
+        assert_eq!(
+            gateway::staged_path(root, target),
+            binaries.join(staged),
+            "{target}"
+        );
+    }
+}
+
+#[test]
+fn a_named_gateway_wins_over_the_staged_one_in_the_payload() {
+    let test_environment = environment();
+    let root = &test_environment.environment.workshop_root;
+    let target = "aarch64-apple-darwin";
+    let given = test_environment.given_gateway();
+
+    let error = gateway::payload_binary(None, root, target).expect_err("nothing staged");
+    assert!(
+        error.contains(&format!(
+            "node tools/fetch-gateway-sidecar.mjs --target {target}"
+        )),
+        "{error}"
+    );
+    assert_eq!(
+        gateway::payload_binary(Some(&given), root, target),
+        Ok(given.clone())
+    );
+
+    let staged = test_environment.stage_gateway(target);
+    assert_eq!(gateway::payload_binary(None, root, target), Ok(staged));
+    assert_eq!(
+        gateway::payload_binary(Some(&given), root, target),
+        Ok(given)
+    );
+}
+
+#[test]
+fn the_pinned_version_is_the_pin_s_version_and_a_placeholder_or_missing_pin_fails() {
+    let test_environment = environment();
+    let root = &test_environment.environment.workshop_root;
+    assert_eq!(
+        gateway::pinned_version(root),
+        Ok(GATEWAY_VERSION.to_owned())
+    );
+
+    let pin = root.join("gateway-pin").join("pin.json");
+    for (contents, expected) in [
+        (r#"{"version": "PLACEHOLDER"}"#, "names no version"),
+        (r#"{"version": ""}"#, "names no version"),
+        (r#"{"tag": "gateway-v1.0.0"}"#, "names no version"),
+        ("not json", "is not JSON"),
+    ] {
+        write_file(&pin, contents.as_bytes());
+        let error = gateway::pinned_version(root).expect_err(contents);
+        assert!(error.contains(expected), "{contents}: {error}");
+        assert!(error.contains(&pin.display().to_string()), "{error}");
+    }
+    std::fs::remove_file(&pin).expect("remove the pin");
+    let error = gateway::pinned_version(root).expect_err("missing pin");
+    assert!(error.contains("cannot read the Gateway pin"), "{error}");
+}
+
+#[test]
+fn an_unpinned_gateway_refuses_the_installer_before_any_command() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "aarch64-apple-darwin";
+    test_environment.stage_gateway(target);
+    test_environment.pin("PLACEHOLDER");
+    let mut runner = FakeRunner::default();
+
+    let error = build_installer(&request(target, false), environment, &mut runner)
+        .expect_err("an unpinned Gateway");
+
+    assert!(error.contains("names no version"), "{error}");
+    assert!(runner.commands.is_empty());
+}
diff --git a/crates/build-workshop/src/main/tests/ifw.rs b/crates/build-installer/src/main/tests/ifw.rs
similarity index 88%
rename from crates/build-workshop/src/main/tests/ifw.rs
rename to crates/build-installer/src/main/tests/ifw.rs
index 4c0d22ca7..155257049 100644
--- a/crates/build-workshop/src/main/tests/ifw.rs
+++ b/crates/build-installer/src/main/tests/ifw.rs
@@ -1,12 +1,10 @@
 //! Unit tests for locating Qt IFW, its version check, and the installer
 //! commands, with the helpers the installer sequences share.
 
-use super::installer_tests::{
-    bundle, bundled, bundled_plugins, node_found, output, request, version_printed,
-};
+use super::installer_tests::{bundle, bundled, output, request, version_printed};
 use super::*;
 use crate::installer::Platform;
-use crate::installer::ifw::{self, IFW_VERSION, Ifw, Sources};
+use crate::installer::ifw::{self, IFW_VERSION, Ifw};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
@@ -20,33 +18,6 @@ pub(super) fn fake_ifw(root: &Path) -> PathBuf {
     ifw
 }
 
-/// Copies the checked-in sources the IFW stage reads into a temporary
-/// workspace.
-pub(super) fn copy_sources(repository: &Path, workspace: &Path) {
-    let from = Sources::in_workspace(repository);
-    let to = Sources::in_workspace(workspace);
-    copy_tree(&from.definition, &to.definition);
-    write_file(&to.license, &std::fs::read(&from.license).expect("LICENSE"));
-    for icon in ["icon.icns", "icon.png"] {
-        write_file(
-            &to.icons.join(icon),
-            &std::fs::read(from.icons.join(icon)).expect("icon"),
-        );
-    }
-}
-
-fn copy_tree(from: &Path, to: &Path) {
-    for entry in std::fs::read_dir(from).expect("read directory") {
-        let path = entry.expect("entry").path();
-        let destination = to.join(path.file_name().expect("name"));
-        if path.is_dir() {
-            copy_tree(&path, &destination);
-        } else {
-            write_file(&destination, &std::fs::read(&path).expect("read"));
-        }
-    }
-}
-
 pub(super) fn ifw_found() -> FakeResponse {
     success(&format!(
         "IFW Version: {IFW_VERSION}, built with Qt 6.9.3.\nBuild date: Mar 27 2026\n"
@@ -287,9 +258,7 @@ fn a_failed_or_unstartable_installerbase_fails_naming_it_before_any_build() {
 
         let installerbase = located(environment).installerbase;
         assert!(
-            error
-                .primary
-                .contains(&format!("`{} --version`", installerbase.display())),
+            error.contains(&format!("`{} --version`", installerbase.display())),
             "{error}"
         );
         assert_eq!(runner.commands, vec![ifw_version_command(environment)]);
@@ -312,7 +281,7 @@ fn a_missing_ifw_runs_no_build_on_macos_or_linux() {
         let mut runner = FakeRunner::default();
         let error =
             build_installer(&request(target, false), environment, &mut runner).expect_err("no IFW");
-        assert!(error.primary.contains("QTIFWDIR is unset"), "{error}");
+        assert!(error.contains("QTIFWDIR is unset"), "{error}");
         assert!(runner.commands.is_empty(), "{target}");
     }
 
@@ -342,6 +311,7 @@ fn a_missing_ifw_runs_no_build_on_macos_or_linux() {
 /// The responses up to the IFW stage of an unsigned macOS or Linux build.
 fn bundled_responses(test_environment: &TestEnvironment, target: &str) -> Vec<FakeResponse> {
     let environment = &test_environment.environment;
+    test_environment.stage_gateway(target);
     let file = if is_macos(target) {
         bundle(environment, target, "macos")
             .join("Runvil.app")
@@ -353,13 +323,8 @@ fn bundled_responses(test_environment: &TestEnvironment, target: &str) -> Vec<Fa
     };
     vec![
         ifw_found(),
-        node_found(),
+        bundled(vec![file], success("")),
         version_printed(),
-        bundled(
-            test_environment.stage_gateway(target),
-            [vec![file], bundled_plugins(environment, target)].concat(),
-            success(""),
-        ),
     ]
 }
 
@@ -405,7 +370,7 @@ fn a_failing_or_silent_installer_step_fails_naming_the_step_or_the_path() {
         let error = build_installer(&request(target, false), environment, &mut runner)
             .expect_err("IFW step failure");
 
-        assert!(error.primary.contains(expected), "{target}: {error}");
+        assert!(error.contains(expected), "{target}: {error}");
         if wrote_nothing {
             let path = if step == 0 {
                 built_path(environment, target)
@@ -413,7 +378,7 @@ fn a_failing_or_silent_installer_step_fails_naming_the_step_or_the_path() {
                 installer_path(environment, target)
             };
             let message = format!("{expected} {silent} {}", path.display());
-            assert_eq!(error.primary, message, "{target}");
+            assert_eq!(error, message, "{target}");
         }
         assert!(!installer_path(environment, target).exists(), "{target}");
     }
diff --git a/crates/build-installer/src/main/tests/installer.rs b/crates/build-installer/src/main/tests/installer.rs
new file mode 100644
index 000000000..6410b3e79
--- /dev/null
+++ b/crates/build-installer/src/main/tests/installer.rs
@@ -0,0 +1,354 @@
+//! Unit tests for the installer command sequence on Windows and Linux,
+//! with the helpers every sequence test shares. The macOS sequences are
+//! in `bundle.rs`.
+
+use super::ifw_tests::{ifw_built, ifw_commands, ifw_found, ifw_version_command, installer_path};
+use super::*;
+
+pub(super) const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Tauri's bundle directory `directory` for `target`, in the target
+/// directory `cargo workshop bundle` writes to.
+pub(super) fn bundle(environment: &BuildEnvironment, target: &str, directory: &str) -> PathBuf {
+    environment
+        .workshop_target_root()
+        .join(target)
+        .join("release")
+        .join("bundle")
+        .join(directory)
+}
+
+pub(super) fn output(environment: &BuildEnvironment, target: &str) -> PathBuf {
+    environment.target_root.join("installer").join(target)
+}
+
+pub(super) fn version_printed() -> FakeResponse {
+    success(&format!("runvil-gateway {GATEWAY_VERSION}\n"))
+}
+
+/// A `cargo workshop bundle` run that writes `files`, as Tauri leaves its
+/// bundle.
+pub(super) fn bundled(files: Vec<PathBuf>, response: FakeResponse) -> FakeResponse {
+    act(
+        move || {
+            for file in files {
+                write_file(&file, b"bundle");
+            }
+        },
+        response,
+    )
+}
+
+/// The bundle step: Cargo's `workshop bundle`, run in the Workshop
+/// checkout with the absolute target root. `gateway` is the Gateway a
+/// flag or the variable named.
+pub(super) fn bundle_command(
+    environment: &BuildEnvironment,
+    target: &str,
+    sign: bool,
+    gateway: Option<&Path>,
+) -> CommandSpec {
+    let mut args = strings(&["workshop", "bundle", "--target", target]);
+    if sign {
+        args.push(OsString::from("--sign"));
+    }
+    if let Some(gateway) = gateway {
+        args.push(OsString::from("--gateway-binary"));
+        args.push(gateway.as_os_str().to_owned());
+    }
+    CommandSpec {
+        program: PathBuf::from("selected-cargo"),
+        args,
+        current_dir: environment.workshop_root.clone(),
+        envs: target_root_env(environment),
+        output_mode: OutputMode::Inherit,
+    }
+}
+
+/// The commands of a build for `target` up to the collection. `named` is
+/// the Gateway a flag or the variable named; without one, a macOS or
+/// Linux payload takes the staged Gateway.
+pub(super) fn expected_commands(
+    environment: &BuildEnvironment,
+    target: &str,
+    sign: bool,
+    named: Option<&Path>,
+) -> Vec<CommandSpec> {
+    let bundle = bundle_command(environment, target, sign, named);
+    if target.ends_with("windows-msvc") {
+        return vec![bundle];
+    }
+    // macOS and Linux check Qt IFW once the target is known, and the
+    // payload's Gateway once the bundle is built.
+    let gateway = named.map_or_else(
+        || gateway::staged_path(&environment.workshop_root, target),
+        Path::to_path_buf,
+    );
+    vec![
+        ifw_version_command(environment),
+        bundle,
+        CommandSpec {
+            program: gateway,
+            args: strings(&["--version"]),
+            current_dir: environment.workspace_root.clone(),
+            envs: Vec::new(),
+            output_mode: OutputMode::Capture,
+        },
+    ]
+}
+
+pub(super) fn request(target: &str, sign: bool) -> InstallerRequest {
+    InstallerRequest {
+        target: Some(target.to_owned()),
+        sign,
+        gateway_binary: None,
+    }
+}
+
+pub(super) fn collect_signature(path: &Path) -> PathBuf {
+    crate::installer::collect::signature_path(path)
+}
+
+#[test]
+fn windows_unsigned_publishes_only_the_setup_and_needs_no_gateway_or_ifw() {
+    let mut test_environment = environment();
+    // The setup already holds the Gateway, so a Windows installer reads
+    // neither Qt IFW, nor a staged Gateway, nor the pin.
+    test_environment.environment.qtifw_dir = None;
+    let environment = &test_environment.environment;
+    std::fs::remove_dir_all(environment.workshop_root.join("gateway-pin")).expect("remove pin");
+    let target = "x86_64-pc-windows-msvc";
+    let setup = bundle(environment, target, "nsis").join(format!("Runvil_{VERSION}_x64-setup.exe"));
+    let mut runner = FakeRunner::with_responses(vec![bundled(vec![setup], success(""))]);
+
+    build_installer(&request(target, false), environment, &mut runner).expect("installer");
+
+    assert_eq!(
+        runner.commands,
+        vec![CommandSpec {
+            program: PathBuf::from("selected-cargo"),
+            args: strings(&["workshop", "bundle", "--target", target]),
+            current_dir: environment.workshop_root.clone(),
+            envs: target_root_env(environment),
+            output_mode: OutputMode::Inherit,
+        }]
+    );
+    let publish = output(environment, target).join("publish");
+    assert!(
+        publish
+            .join(format!("Runvil_{VERSION}_x64-setup.exe"))
+            .is_file()
+    );
+    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 1);
+    assert!(!output(environment, target).join("payload").exists());
+}
+
+#[test]
+fn windows_signed_publishes_the_setup_and_its_signature() {
+    let mut test_environment = environment();
+    set_signing_key(&mut test_environment.environment);
+    let environment = &test_environment.environment;
+    let target = "x86_64-pc-windows-msvc";
+    let setup = bundle(environment, target, "nsis").join(format!("Runvil_{VERSION}_x64-setup.exe"));
+    let mut runner = FakeRunner::with_responses(vec![bundled(
+        vec![collect_signature(&setup), setup],
+        success(""),
+    )]);
+
+    build_installer(&request(target, true), environment, &mut runner).expect("installer");
+
+    assert_eq!(
+        runner.commands,
+        vec![CommandSpec {
+            program: PathBuf::from("selected-cargo"),
+            args: strings(&["workshop", "bundle", "--target", target, "--sign"]),
+            current_dir: environment.workshop_root.clone(),
+            envs: target_root_env(environment),
+            output_mode: OutputMode::Inherit,
+        }]
+    );
+    let publish = output(environment, target).join("publish");
+    let setup = publish.join(format!("Runvil_{VERSION}_x64-setup.exe"));
+    assert!(setup.is_file());
+    assert!(collect_signature(&setup).is_file());
+    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 2);
+}
+
+#[test]
+fn linux_unsigned_from_the_host_publishes_only_the_installer() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let target = "x86_64-unknown-linux-gnu";
+    let staged = test_environment.stage_gateway(target);
+    let appimage = bundle(environment, target, "appimage");
+    let mut responses = vec![
+        success(&format!("cargo 1.89.0\nhost: {target}\n")),
+        ifw_found(),
+        bundled(
+            vec![
+                appimage.join(format!("Runvil_{VERSION}_amd64.AppImage")),
+                appimage.join("Runvil.AppDir").join("AppRun"),
+            ],
+            success(""),
+        ),
+        version_printed(),
+    ];
+    responses.extend(ifw_built(environment, target));
+    let mut runner = FakeRunner::with_responses(responses);
+
+    build_installer(
+        &InstallerRequest {
+            target: None,
+            sign: false,
+            gateway_binary: None,
+        },
+        environment,
+        &mut runner,
+    )
+    .expect("installer");
+
+    let mut expected = vec![command(
+        environment,
+        "selected-cargo",
+        &["-vV"],
+        OutputMode::Capture,
+    )];
+    expected.extend(expected_commands(environment, target, false, None));
+    expected.extend(ifw_commands(environment, target));
+    assert_eq!(runner.commands, expected);
+    let output_root = output(environment, target);
+    assert!(
+        output_root
+            .join("payload")
+            .join("Runvil.AppImage")
+            .is_file()
+    );
+    assert_eq!(
+        std::fs::read(output_root.join("payload").join("runvil-gateway")).expect("payload"),
+        b"gateway"
+    );
+    let installer = installer_path(environment, target);
+    assert_eq!(
+        installer.file_name().expect("name"),
+        format!("Runvil_{VERSION}_amd64-setup.run").as_str()
+    );
+    assert!(installer.is_file());
+    assert_eq!(
+        std::fs::read_dir(output_root.join("publish"))
+            .expect("publish")
+            .count(),
+        1
+    );
+    assert!(staged.is_file(), "a staged Gateway must outlive the build");
+    // The Gateway package states the pin's version, not Workshop's.
+    let package = output_root
+        .join("ifw")
+        .join("packages")
+        .join("com.runvil.gateway")
+        .join("meta")
+        .join("package.xml");
+    let package = std::fs::read_to_string(package).expect("Gateway package");
+    assert!(
+        package.contains(&format!("<Version>{GATEWAY_VERSION}</Version>")),
+        "{package}"
+    );
+}
+
+#[test]
+fn linux_signed_publishes_the_appimage_and_its_signature_beside_the_installer() {
+    let mut test_environment = environment();
+    set_signing_key(&mut test_environment.environment);
+    let environment = &test_environment.environment;
+    let target = "aarch64-unknown-linux-gnu";
+    test_environment.stage_gateway(target);
+    let appimage =
+        bundle(environment, target, "appimage").join(format!("Runvil_{VERSION}_aarch64.AppImage"));
+    let mut responses = vec![
+        ifw_found(),
+        bundled(vec![collect_signature(&appimage), appimage], success("")),
+        version_printed(),
+    ];
+    responses.extend(ifw_built(environment, target));
+    let mut runner = FakeRunner::with_responses(responses);
+
+    build_installer(&request(target, true), environment, &mut runner).expect("installer");
+
+    let mut expected = expected_commands(environment, target, true, None);
+    expected.extend(ifw_commands(environment, target));
+    assert_eq!(runner.commands, expected);
+    assert_eq!(
+        runner.commands[1].args,
+        strings(&["workshop", "bundle", "--target", target, "--sign"])
+    );
+    assert!(installer_path(environment, target).is_file());
+    let publish = output(environment, target).join("publish");
+    let published = publish.join(format!("Runvil_{VERSION}_aarch64.AppImage"));
+    assert!(published.is_file());
+    assert!(collect_signature(&published).is_file());
+    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 3);
+    assert!(
+        output(environment, target)
+            .join("payload")
+            .join("Runvil.AppImage")
+            .is_file()
+    );
+}
+
+/// Without `CARGO_TARGET_DIR`, the Cargo that builds Workshop runs in the
+/// Workshop checkout and writes to that checkout's `target`, while the
+/// installer output stays in this workspace's.
+#[test]
+fn a_target_root_from_cargo_configuration_is_left_to_cargo() {
+    let mut test_environment = environment();
+    test_environment.environment.target_root_from_env = false;
+    let environment = &test_environment.environment;
+    let target = "x86_64-pc-windows-msvc";
+    let setup = environment
+        .workshop_root
+        .join("target")
+        .join(target)
+        .join("release")
+        .join("bundle")
+        .join("nsis")
+        .join(format!("Runvil_{VERSION}_x64-setup.exe"));
+    let mut runner = FakeRunner::with_responses(vec![bundled(vec![setup], success(""))]);
+
+    build_installer(&request(target, false), environment, &mut runner).expect("installer");
+
+    assert_eq!(runner.commands.len(), 1);
+    assert!(
+        runner
+            .commands
+            .iter()
+            .all(|command| command.envs.is_empty())
+    );
+    assert!(
+        environment
+            .target_root
+            .join("installer")
+            .join(target)
+            .join("publish")
+            .join(format!("Runvil_{VERSION}_x64-setup.exe"))
+            .is_file()
+    );
+}
+
+#[test]
+fn signing_without_the_key_fails_first_and_runs_no_command() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    // The key is checked before the Workshop checkout, which is missing
+    // here.
+    std::fs::remove_dir_all(&environment.workshop_root).expect("remove the checkout");
+    let mut runner = FakeRunner::default();
+
+    let error = build_installer(
+        &request("x86_64-unknown-linux-gnu", true),
+        environment,
+        &mut runner,
+    )
+    .expect_err("no signing key");
+
+    assert!(error.contains("TAURI_SIGNING_PRIVATE_KEY set"), "{error}");
+    assert!(runner.commands.is_empty());
+}
diff --git a/crates/build-workshop/src/main/tests/manifest-args.rs b/crates/build-installer/src/main/tests/manifest-args.rs
similarity index 95%
rename from crates/build-workshop/src/main/tests/manifest-args.rs
rename to crates/build-installer/src/main/tests/manifest-args.rs
index e60fbe5d5..8cadd2c9b 100644
--- a/crates/build-workshop/src/main/tests/manifest-args.rs
+++ b/crates/build-installer/src/main/tests/manifest-args.rs
@@ -1,5 +1,4 @@
-//! The `manifest` mode's arguments, here rather than in `tests.rs`, which
-//! holds the other modes' cases at the file ceiling.
+//! The `manifest` mode's arguments. The installer mode's are in `args.rs`.
 
 use std::path::PathBuf;
 
diff --git a/crates/build-workshop/src/main/tests/manifest.rs b/crates/build-installer/src/main/tests/manifest.rs
similarity index 93%
rename from crates/build-workshop/src/main/tests/manifest.rs
rename to crates/build-installer/src/main/tests/manifest.rs
index a02cda0e1..6f2199ad7 100644
--- a/crates/build-workshop/src/main/tests/manifest.rs
+++ b/crates/build-installer/src/main/tests/manifest.rs
@@ -34,12 +34,12 @@ fn release_comment(file: &str) -> String {
     format!("timestamp:1\tfile:{file}\tversion:{VERSION}")
 }
 
-/// A complete release signed with `pair`, beside a workspace whose
+/// A complete release signed with `pair`, beside a Workshop checkout whose
 /// `tauri.conf.json` trusts `pair`.
 struct Release {
     _temp: TempDir,
     assets: PathBuf,
-    workspace: PathBuf,
+    workshop: PathBuf,
     pair: minisign::KeyPair,
 }
 
@@ -47,13 +47,13 @@ impl Release {
     fn new() -> Release {
         let temp = tempfile::tempdir().expect("temp dir");
         let assets = temp.path().join("assets");
-        let workspace = temp.path().join("workspace");
+        let workshop = temp.path().join("runvil-workshop");
         fs::create_dir_all(&assets).expect("assets dir");
         let pair = key_pair();
         let release = Release {
             _temp: temp,
             assets,
-            workspace,
+            workshop,
             pair,
         };
         release.trust(&public(&release.pair));
@@ -76,9 +76,9 @@ impl Release {
         release
     }
 
-    /// Writes `key` as the workspace's `plugins.updater.pubkey`.
+    /// Writes `key` as the Workshop checkout's `plugins.updater.pubkey`.
     fn trust(&self, key: &str) {
-        let desktop = self.workspace.join("crates/workshop/desktop");
+        let desktop = self.workshop.join("crates/workshop/desktop");
         fs::create_dir_all(&desktop).expect("desktop dir");
         let config = serde_json::json!({ "plugins": { "updater": { "pubkey": key } } });
         fs::write(desktop.join("tauri.conf.json"), config.to_string()).expect("config");
@@ -101,7 +101,7 @@ impl Release {
     }
 
     fn write(&self) -> Result<(), String> {
-        write(&self.request(), &self.workspace, 1_709_210_096)
+        write(&self.request(), &self.workshop, 1_709_210_096)
     }
 
     fn manifest(&self) -> serde_json::Value {
@@ -185,7 +185,7 @@ fn a_release_name_that_is_not_a_regular_file_fails_naming_it() {
     #[cfg(unix)]
     {
         let run = installer_name(RELEASE_PLATFORMS[3]);
-        let target = release.workspace.join(&run);
+        let target = release.workshop.join(&run);
         fs::rename(release.assets.join(&run), &target).expect("move");
         std::os::unix::fs::symlink(&target, release.assets.join(&run)).expect("symlink");
         let error = release.write().expect_err("a symlink");
@@ -197,10 +197,10 @@ fn a_release_name_that_is_not_a_regular_file_fails_naming_it() {
 fn a_missing_release_directory_fails_naming_it() {
     let release = Release::new();
     let request = ManifestRequest {
-        assets: release.workspace.join("absent"),
+        assets: release.workshop.join("absent"),
         ..release.request()
     };
-    let error = write(&request, &release.workspace, 0).expect_err("no directory");
+    let error = write(&request, &release.workshop, 0).expect_err("no directory");
     assert!(
         error.contains("cannot read the release directory"),
         "{error}"
@@ -324,30 +324,30 @@ fn a_trusted_comment_with_another_version_fails_naming_its_platform_key() {
 #[test]
 fn the_public_key_option_replaces_the_tauri_config_key() {
     let release = Release::new();
-    let key_file = release.workspace.join("run.key.pub");
+    let key_file = release.workshop.join("run.key.pub");
     fs::write(&key_file, public(&release.pair)).expect("key file");
     release.trust(&public(&key_pair()));
     let request = ManifestRequest {
         public_key: Some(key_file.clone()),
         ..release.request()
     };
-    write(&request, &release.workspace, 0).expect("the key file's key verifies");
+    write(&request, &release.workshop, 0).expect("the key file's key verifies");
 
-    let other = release.workspace.join("other.key.pub");
+    let other = release.workshop.join("other.key.pub");
     fs::write(&other, public(&key_pair())).expect("other key file");
     let request = ManifestRequest {
         public_key: Some(other.clone()),
         ..release.request()
     };
-    let error = write(&request, &release.workspace, 0).expect_err("the file's key is used");
+    let error = write(&request, &release.workshop, 0).expect_err("the file's key is used");
     assert!(error.contains(&other.display().to_string()), "{error}");
     assert!(!error.contains("every installed copy"), "{error}");
 
     let request = ManifestRequest {
-        public_key: Some(release.workspace.join("absent.key.pub")),
+        public_key: Some(release.workshop.join("absent.key.pub")),
         ..release.request()
     };
-    let error = write(&request, &release.workspace, 0).expect_err("no key file");
+    let error = write(&request, &release.workshop, 0).expect_err("no key file");
     assert!(error.contains("cannot read the public key"), "{error}");
 }
 
@@ -355,7 +355,7 @@ fn the_public_key_option_replaces_the_tauri_config_key() {
 fn a_tauri_config_without_a_key_fails_naming_the_field() {
     let release = Release::new();
     let config = release
-        .workspace
+        .workshop
         .join("crates/workshop/desktop/tauri.conf.json");
     fs::write(&config, r#"{"plugins":{}}"#).expect("config");
     let error = release.write().expect_err("no key in the config");
diff --git a/crates/build-workshop/src/main/tests/stage.rs b/crates/build-installer/src/main/tests/stage.rs
similarity index 83%
rename from crates/build-workshop/src/main/tests/stage.rs
rename to crates/build-installer/src/main/tests/stage.rs
index fb3625c35..b81757f0f 100644
--- a/crates/build-workshop/src/main/tests/stage.rs
+++ b/crates/build-installer/src/main/tests/stage.rs
@@ -101,13 +101,15 @@ fn the_staged_definition_is_filled_for_each_platform_with_the_payload_in_place()
         ("aarch64-unknown-linux-gnu", "@HomeDir@/Runvil"),
     ] {
         let macos = target.ends_with("apple-darwin");
-        let temp = tempfile::tempdir().expect("temporary root");
-        let payload = payload(temp.path(), macos);
-        let stage = temp.path().join("ifw");
+        let test_environment = environment();
+        let temp = test_environment.temp.path();
+        let sources = Sources::from_environment(&test_environment.environment);
+        let payload = payload(temp, macos);
+        let stage = temp.join("ifw");
         let platform = Platform::from_triple(target).expect("platform");
 
         ifw::stage(
-            &Sources::in_workspace(&repository_root()),
+            &sources,
             &payload,
             platform,
             RELEASE_DATE,
@@ -118,7 +120,7 @@ fn the_staged_definition_is_filled_for_each_platform_with_the_payload_in_place()
 
         assert_eq!(staged_files(&stage), expected_files(macos), "{target}");
         check_templates(&stage, target, target_dir);
-        check_data(&stage.join("packages"), macos);
+        check_data(&stage, &sources, macos);
     }
 }
 
@@ -174,15 +176,19 @@ fn check_templates(stage: &Path, target: &str, target_dir: &str) {
     }
 }
 
-/// The payload copies are byte-identical and executable, and Linux packages
-/// carry their own icon.
-fn check_data(packages: &Path, macos: bool) {
-    let icon = std::fs::read(
-        Sources::in_workspace(&repository_root())
-            .icons
-            .join("icon.png"),
-    )
-    .expect("icon");
+/// The installer's own icons and the payload copies are byte-identical to
+/// their sources, the copies are executable, and each Linux package holds
+/// its own icon.
+fn check_data(stage: &Path, sources: &Sources, macos: bool) {
+    for name in ["icon.icns", "icon.png"] {
+        assert_eq!(
+            std::fs::read(stage.join("config").join(name)).expect("staged icon"),
+            std::fs::read(sources.icons.join(name)).expect("Workshop's icon"),
+            "{name}"
+        );
+    }
+    let packages = stage.join("packages");
+    let icon = std::fs::read(sources.icons.join("icon.png")).expect("icon");
     let items = if macos {
         [
             "Runvil.app/Contents/MacOS/runvil-workshop",
@@ -216,12 +222,30 @@ fn assert_executable(path: &Path) {
 #[cfg(not(unix))]
 fn assert_executable(_path: &Path) {}
 
+fn copy_tree(from: &Path, to: &Path) {
+    for entry in std::fs::read_dir(from).expect("read directory") {
+        let path = entry.expect("entry").path();
+        let destination = to.join(path.file_name().expect("name"));
+        if path.is_dir() {
+            copy_tree(&path, &destination);
+        } else {
+            write_file(&destination, &std::fs::read(&path).expect("read"));
+        }
+    }
+}
+
 #[test]
 fn an_unknown_placeholder_fails_naming_the_file_and_the_placeholder() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let workspace = temp.path().join("repo");
-    super::ifw_tests::copy_sources(&repository_root(), &workspace);
-    let sources = Sources::in_workspace(&workspace);
+    let test_environment = environment();
+    let temp = test_environment.temp.path();
+    let checked_in = Sources::from_environment(&test_environment.environment);
+    // The test edits a template, so it stages a copy of the definition.
+    let definition = temp.join("definition");
+    copy_tree(&checked_in.definition, &definition);
+    let sources = Sources {
+        definition,
+        ..checked_in
+    };
     let package = sources
         .definition
         .join("packages")
@@ -229,7 +253,7 @@ fn an_unknown_placeholder_fails_naming_the_file_and_the_placeholder() {
         .join("meta")
         .join("package.xml");
     write_file(&package, b"<Package><Name>{{NOT_A_VALUE}}</Name></Package>");
-    let payload = payload(temp.path(), false);
+    let payload = payload(temp, false);
     let platform = Platform::from_triple("x86_64-unknown-linux-gnu").expect("platform");
 
     let error = ifw::stage(
@@ -238,7 +262,7 @@ fn an_unknown_placeholder_fails_naming_the_file_and_the_placeholder() {
         platform,
         RELEASE_DATE,
         GATEWAY_VERSION,
-        &temp.path().join("ifw"),
+        &temp.join("ifw"),
     )
     .expect_err("unknown placeholder");
 
@@ -249,8 +273,9 @@ fn an_unknown_placeholder_fails_naming_the_file_and_the_placeholder() {
 #[cfg(unix)]
 #[test]
 fn a_symlink_in_the_payload_is_refused_naming_its_path() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let payload = payload(temp.path(), true);
+    let test_environment = environment();
+    let temp = test_environment.temp.path();
+    let payload = payload(temp, true);
     let link = payload
         .join("Runvil.app")
         .join("Contents")
@@ -259,12 +284,12 @@ fn a_symlink_in_the_payload_is_refused_naming_its_path() {
     let platform = Platform::from_triple("aarch64-apple-darwin").expect("platform");
 
     let error = ifw::stage(
-        &Sources::in_workspace(&repository_root()),
+        &Sources::from_environment(&test_environment.environment),
         &payload,
         platform,
         RELEASE_DATE,
         GATEWAY_VERSION,
-        &temp.path().join("ifw"),
+        &temp.join("ifw"),
     )
     .expect_err("symlink");
 
@@ -289,9 +314,12 @@ fn element<'a>(xml: &'a str, name: &str) -> &'a str {
     &xml[start..end]
 }
 
+/// The icons are the two the test Workshop checkout holds, which are the
+/// two the stage copies from a real one.
 #[test]
 fn the_definition_names_only_files_it_holds_with_exact_double_size_images() {
-    let sources = Sources::in_workspace(&repository_root());
+    let test_environment = environment();
+    let sources = Sources::from_environment(&test_environment.environment);
     let config_dir = sources.definition.join("config");
     let config = read(&config_dir.join("config.xml"));
     for name in ["Logo", "Watermark"] {
@@ -351,7 +379,8 @@ fn the_definition_names_only_files_it_holds_with_exact_double_size_images() {
 fn a_hidden_page_list_comes_with_a_default_wizard_size() {
     // IFW's 800-wide default applies only beside a visible page list; without
     // one the wizard opens at its minimum size and clips its pages.
-    let sources = Sources::in_workspace(&repository_root());
+    let test_environment = environment();
+    let sources = Sources::from_environment(&test_environment.environment);
     let config = read(&sources.definition.join("config/config.xml"));
     assert_eq!(element(&config, "WizardShowPageList"), "false");
     for name in ["WizardDefaultWidth", "WizardDefaultHeight"] {
diff --git a/crates/build-installer/src/main/tests/workshop.rs b/crates/build-installer/src/main/tests/workshop.rs
new file mode 100644
index 000000000..3104730ee
--- /dev/null
+++ b/crates/build-installer/src/main/tests/workshop.rs
@@ -0,0 +1,131 @@
+//! Unit tests for the Workshop checkout check, which runs before any
+//! command.
+
+use super::installer_tests::VERSION;
+use super::*;
+
+const TOOLCHAIN_FILE: &str = "rust-toolchain.toml";
+
+/// The toolchain file of a checkout on `channel`.
+fn toolchain_file(channel: &str) -> String {
+    format!("[toolchain]\nchannel = \"{channel}\"\n")
+}
+
+/// The error of a build that names no target, after requiring that it ran
+/// nothing: past the check, such a build first runs `cargo -vV`.
+fn refusal(environment: &BuildEnvironment) -> String {
+    let mut runner = FakeRunner::default();
+    let error = build_installer(
+        &InstallerRequest {
+            target: None,
+            sign: false,
+            gateway_binary: None,
+        },
+        environment,
+        &mut runner,
+    )
+    .expect_err("a refused Workshop checkout");
+    assert!(runner.commands.is_empty(), "{error}");
+    error
+}
+
+#[test]
+fn a_workshop_checkout_that_is_not_a_directory_fails_naming_it_and_the_variable() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let root = &environment.workshop_root;
+    let expected = format!(
+        "the Workshop checkout {} is not a directory; set RUNVIL_WORKSHOP to the root of a \
+         runvil-workshop checkout",
+        root.display()
+    );
+
+    std::fs::remove_dir_all(root).expect("remove the checkout");
+    assert_eq!(refusal(environment), expected, "a missing directory");
+
+    write_file(root, b"not a checkout");
+    assert_eq!(refusal(environment), expected, "a file");
+}
+
+#[test]
+fn a_workshop_version_that_differs_fails_naming_both_manifests() {
+    let test_environment = environment();
+    let environment = &test_environment.environment;
+    let manifest = environment.workshop_root.join("Cargo.toml");
+    write_file(&manifest, workshop_manifest("9.9.9").as_bytes());
+
+    assert_eq!(
+        refusal(environment),
+        format!(
+            "the Workshop checkout is not at this workspace's version: {} has \
+             workspace.package.version `9.9.9`, required `{VERSION}`, the version in {}; the \
+             release file names use this workspace's version and Tauri names its files with \
+             Workshop's",
+            manifest.display(),
+            environment.workspace_root.join("Cargo.toml").display()
+        )
+    );
+}
+
+#[test]
+fn a_workshop_toolchain_channel_that_differs_fails_naming_both_toolchain_files() {
+    let mut test_environment = environment();
+    // The check reads nothing else of this repository, so a workspace root
+    // of the test's own lets it name both channels.
+    let workspace_root = test_environment.temp.path().join("runvil");
+    let ours = workspace_root.join(TOOLCHAIN_FILE);
+    write_file(&ours, toolchain_file("1.99").as_bytes());
+    test_environment.environment.workspace_root = workspace_root;
+    let environment = &test_environment.environment;
+    let theirs = environment.workshop_root.join(TOOLCHAIN_FILE);
+    write_file(&theirs, toolchain_file("1.90").as_bytes());
+
+    assert_eq!(
+        refusal(environment),
+        format!(
+            "the Workshop checkout is not on this workspace's toolchain: {} has \
+             toolchain.channel `1.90`, required `1.99`, the channel in {}; the Cargo that runs \
+             the installer builds Workshop",
+            theirs.display(),
+            ours.display()
+        )
+    );
+}
+
+#[test]
+fn a_checkout_file_that_is_missing_malformed_or_lacks_the_value_fails_naming_it() {
+    for (file, key) in [
+        ("Cargo.toml", "workspace.package.version"),
+        (TOOLCHAIN_FILE, "toolchain.channel"),
+    ] {
+        let section = key.rsplit_once('.').expect("a dotted key").0;
+        for (contents, expected) in [
+            (None, "cannot read ".to_owned()),
+            (Some("= not TOML".to_owned()), " is not TOML: ".to_owned()),
+            (
+                Some(format!("[{section}]\n")),
+                format!(" has no string at {key}"),
+            ),
+            (
+                Some(format!("[{section}]\n{} = 3\n", &key[section.len() + 1..])),
+                format!(" has no string at {key}"),
+            ),
+        ] {
+            let test_environment = environment();
+            let environment = &test_environment.environment;
+            let path = environment.workshop_root.join(file);
+            match &contents {
+                Some(contents) => write_file(&path, contents.as_bytes()),
+                None => std::fs::remove_file(&path).expect("remove the file"),
+            }
+
+            let error = refusal(environment);
+
+            assert!(error.contains(&expected), "{file} {contents:?}: {error}");
+            assert!(
+                error.contains(&path.display().to_string()),
+                "{file} {contents:?}: {error}"
+            );
+        }
+    }
+}
diff --git a/crates/build-installer/src/main/workshop.rs b/crates/build-installer/src/main/workshop.rs
new file mode 100644
index 000000000..3739ae88a
--- /dev/null
+++ b/crates/build-installer/src/main/workshop.rs
@@ -0,0 +1,116 @@
+//! The runvil-workshop checkout an installer is built from: the check that
+//! it agrees with this workspace, the command that builds Workshop's
+//! bundle there, and where its desktop crate is.
+//!
+//! Workshop is its own product in `cppalliance/runvil-workshop`, so
+//! nothing here builds it. The checkout's own tool builds the Tauri bundle
+//! each installer is made from, as `cargo workshop bundle`.
+
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use super::installer::VERSION;
+use super::{BuildEnvironment, CommandSpec, OutputMode};
+
+/// The environment variable naming the root of the checkout. This
+/// repository's Cargo configuration sets it to the checkout next to the
+/// repository unless it is already set.
+pub(super) const WORKSHOP_VARIABLE: &str = "RUNVIL_WORKSHOP";
+
+const TOOLCHAIN_FILE: &str = "rust-toolchain.toml";
+const VERSION_KEY: &str = "workspace.package.version";
+const CHANNEL_KEY: &str = "toolchain.channel";
+
+/// Requires the checkout to be a directory at this workspace's version
+/// and toolchain channel. The release file names and the release tag
+/// check use this workspace's version while Tauri names its files with
+/// Workshop's, and the Cargo that runs the installer builds Workshop, on
+/// this workspace's toolchain.
+pub(super) fn check(environment: &BuildEnvironment) -> Result<(), String> {
+    let workshop_root = &environment.workshop_root;
+    let workspace_root = &environment.workspace_root;
+    if !workshop_root.is_dir() {
+        return Err(format!(
+            "the Workshop checkout {} is not a directory; set {WORKSHOP_VARIABLE} to the root \
+             of a runvil-workshop checkout",
+            workshop_root.display()
+        ));
+    }
+    let manifest = workshop_root.join("Cargo.toml");
+    let version = toml_string(&manifest, VERSION_KEY)?;
+    if version != VERSION {
+        return Err(format!(
+            "the Workshop checkout is not at this workspace's version: {} has {VERSION_KEY} \
+             `{version}`, required `{VERSION}`, the version in {}; the release file names use \
+             this workspace's version and Tauri names its files with Workshop's",
+            manifest.display(),
+            workspace_root.join("Cargo.toml").display()
+        ));
+    }
+    let ours = workspace_root.join(TOOLCHAIN_FILE);
+    let theirs = workshop_root.join(TOOLCHAIN_FILE);
+    let required = toml_string(&ours, CHANNEL_KEY)?;
+    let channel = toml_string(&theirs, CHANNEL_KEY)?;
+    if channel != required {
+        return Err(format!(
+            "the Workshop checkout is not on this workspace's toolchain: {} has {CHANNEL_KEY} \
+             `{channel}`, required `{required}`, the channel in {}; the Cargo that runs the \
+             installer builds Workshop",
+            theirs.display(),
+            ours.display()
+        ));
+    }
+    Ok(())
+}
+
+/// The string at the dotted `key` in the TOML file at `path`.
+fn toml_string(path: &Path, key: &str) -> Result<String, String> {
+    let text = fs::read_to_string(path)
+        .map_err(|error| format!("cannot read {}: {error}", path.display()))?;
+    let document: toml::Value = toml::from_str(&text)
+        .map_err(|error| format!("{} is not TOML: {error}", path.display()))?;
+    key.split('.')
+        .try_fold(&document, |value, part| value.get(part))
+        .and_then(toml::Value::as_str)
+        .map(str::to_owned)
+        .ok_or_else(|| format!("{} has no string at {key}", path.display()))
+}
+
+/// `cargo workshop bundle` for `target`, run in the checkout, where Cargo
+/// finds the `workshop` alias. `gateway` is the Gateway a flag or the
+/// variable named, as an absolute path: the child's working directory is
+/// not this process's, so a relative name would point elsewhere.
+pub(super) fn bundle_command(
+    environment: &BuildEnvironment,
+    target: &str,
+    sign: bool,
+    gateway: Option<&Path>,
+) -> CommandSpec {
+    let mut args = ["workshop", "bundle", "--target", target]
+        .map(OsString::from)
+        .to_vec();
+    if sign {
+        args.push(OsString::from("--sign"));
+    }
+    if let Some(gateway) = gateway {
+        args.push(OsString::from("--gateway-binary"));
+        args.push(gateway.as_os_str().to_owned());
+    }
+    CommandSpec {
+        program: environment.cargo.clone(),
+        args,
+        current_dir: environment.workshop_root.clone(),
+        envs: environment.cargo_envs(),
+        output_mode: OutputMode::Inherit,
+    }
+}
+
+/// Workshop's desktop crate in the checkout, which holds the icons,
+/// `tauri.conf.json`, and the staged Gateway.
+pub(super) fn desktop(workshop_root: &Path) -> PathBuf {
+    workshop_root
+        .join("crates")
+        .join("workshop")
+        .join("desktop")
+}
diff --git a/crates/build-workshop/tests/cancellation.rs b/crates/build-installer/tests/cancellation.rs
similarity index 71%
rename from crates/build-workshop/tests/cancellation.rs
rename to crates/build-installer/tests/cancellation.rs
index 825eaa061..190308914 100644
--- a/crates/build-workshop/tests/cancellation.rs
+++ b/crates/build-installer/tests/cancellation.rs
@@ -1,4 +1,4 @@
-//! Subprocess coverage for Workshop build cancellation and staging cleanup.
+//! Subprocess coverage for a cancel during the Workshop bundle step.
 
 use std::fs::{self, File};
 use std::path::{Path, PathBuf};
@@ -10,66 +10,76 @@ use tempfile::TempDir;
 
 const WAIT_BOUND: Duration = Duration::from_secs(15);
 
-// Only Windows targets stage a given Gateway as the sidecar. The fake Cargo
-// builds nothing, so the Windows target serves on every host.
+// A Windows installer needs no Gateway and no Qt IFW, so the bundle is its
+// first command. The fake Cargo builds nothing, so the Windows target
+// serves on every machine.
 const TARGET: &str = "x86_64-pc-windows-msvc";
-const GATEWAY_NAME: &str = "runvil-gateway.exe";
-const SIDECAR_NAME: &str = "runvil-gateway-x86_64-pc-windows-msvc.exe";
 
 #[test]
-fn cancel_signal_after_staging_kills_child_cleans_and_fails() {
+fn cancel_signal_during_the_bundle_kills_the_child_fails_and_leaves_no_output() {
     let temp = tempfile::tempdir().expect("temporary test root");
-    // The orchestrator stages in the workspace root it is given, never in
-    // the checkout: a killed run of this test must not leave its fake
-    // Gateway in the slot every real build ships from.
-    let workspace_root = temp.path().join("workspace");
-    fs::create_dir(&workspace_root).expect("temporary workspace root");
-    let staged = workspace_root
-        .join("crates")
-        .join("workshop")
-        .join("desktop")
-        .join("binaries")
-        .join(SIDECAR_NAME);
+    let workshop_root = write_workshop_checkout(&temp);
+    let target_root = temp.path().join("target");
     let fake_cargo = write_fake_cargo(&temp);
-    let gateway = temp.path().join(GATEWAY_NAME);
-    fs::write(&gateway, "gateway").expect("given Gateway");
-    let blocked_marker = temp.path().join("workshop-blocked");
+    let blocked_marker = temp.path().join("bundle-blocked");
     let stdout_path = temp.path().join("orchestrator.stdout");
     let stderr_path = temp.path().join("orchestrator.stderr");
     let stdout = File::create(&stdout_path).expect("stdout file");
     let stderr = File::create(&stderr_path).expect("stderr file");
 
-    let mut command = Command::new(env!("CARGO_BIN_EXE_build-workshop"));
+    let mut command = Command::new(env!("CARGO_BIN_EXE_build-installer"));
     command
         .arg("--target")
         .arg(TARGET)
-        .arg("--gateway-binary")
-        .arg(&gateway)
         .env("CARGO", fake_cargo)
-        .env("BUILD_WORKSHOP_ROOT", &workspace_root)
+        .env("RUNVIL_WORKSHOP", &workshop_root)
+        .env("CARGO_TARGET_DIR", &target_root)
+        .env_remove("RUNVIL_GATEWAY_SIDECAR")
         .current_dir(temp.path())
-        .env("BUILD_WORKSHOP_BLOCKED_MARKER", &blocked_marker)
+        .env("BUILD_INSTALLER_BLOCKED_MARKER", &blocked_marker)
         .stdout(Stdio::from(stdout))
         .stderr(Stdio::from(stderr));
     configure_signal_process_group(&mut command);
     let mut orchestrator = command.spawn().expect("start build orchestrator");
 
     wait_for_path(&blocked_marker, &mut orchestrator, &stderr_path);
-    assert!(staged.exists(), "Gateway sidecar was not staged");
     send_cancel_signal(orchestrator.id(), &temp);
 
     let status = wait_for_exit(&mut orchestrator, &stderr_path);
     assert!(!status.success(), "canceled orchestrator succeeded");
-    assert!(
-        !staged.exists(),
-        "canceled orchestrator left staging at {}",
-        staged.display()
-    );
     let stderr = fs::read_to_string(stderr_path).expect("orchestrator stderr");
     assert!(
-        stderr.contains("Workshop build canceled"),
+        stderr.contains("build-installer failed: Workshop bundle canceled"),
         "missing cancellation diagnostic: {stderr}"
     );
+    let output = target_root.join("installer");
+    assert!(
+        !output.exists(),
+        "canceled orchestrator left installer output at {}",
+        output.display()
+    );
+}
+
+/// Writes the two files the orchestrator's Workshop checkout check reads:
+/// a manifest at this workspace's version, and this repository's toolchain
+/// file.
+fn write_workshop_checkout(temp: &TempDir) -> PathBuf {
+    let workshop_root = temp.path().join("runvil-workshop");
+    let manifest = format!(
+        "[workspace.package]\nversion = \"{}\"\n",
+        env!("CARGO_PKG_VERSION")
+    );
+    let toolchain = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("..")
+        .join("rust-toolchain.toml");
+    let written = fs::create_dir(&workshop_root)
+        .and_then(|()| fs::write(workshop_root.join("Cargo.toml"), manifest))
+        .and_then(|()| fs::copy(toolchain, workshop_root.join("rust-toolchain.toml")));
+    if let Err(error) = written {
+        panic!("could not write the Workshop checkout: {error}");
+    }
+    workshop_root
 }
 
 fn wait_for_path(path: &Path, child: &mut Child, stderr_path: &Path) {
@@ -90,7 +100,7 @@ fn wait_for_path(path: &Path, child: &mut Child, stderr_path: &Path) {
     }
     terminate_after_timeout(child);
     let stderr = fs::read_to_string(stderr_path).unwrap_or_default();
-    panic!("orchestrator did not reach blocked Workshop child\n{stderr}");
+    panic!("orchestrator did not reach the blocked bundle child\n{stderr}");
 }
 
 fn wait_for_exit(child: &mut Child, stderr_path: &Path) -> ExitStatus {
@@ -123,8 +133,8 @@ fn write_fake_cargo(temp: &TempDir) -> PathBuf {
     if let Err(error) = fs::write(
         &path,
         r#"#!/bin/sh
-if [ "$1" = "build" ] && [ "$3" = "workshop" ]; then
-  printf blocked > "$BUILD_WORKSHOP_BLOCKED_MARKER"
+if [ "$1" = "workshop" ] && [ "$2" = "bundle" ]; then
+  printf blocked > "$BUILD_INSTALLER_BLOCKED_MARKER"
   while :; do sleep 1; done
 fi
 exit 91
@@ -144,10 +154,10 @@ fn write_fake_cargo(temp: &TempDir) -> PathBuf {
     if let Err(error) = fs::write(
         &path,
         r#"@echo off
-if "%1"=="build" if "%3"=="workshop" goto workshop
+if "%1"=="workshop" if "%2"=="bundle" goto bundle
 exit /b 91
-:workshop
-> "%BUILD_WORKSHOP_BLOCKED_MARKER%" echo blocked
+:bundle
+> "%BUILD_INSTALLER_BLOCKED_MARKER%" echo blocked
 :blocked
 ping -n 2 127.0.0.1 >nul
 goto blocked
diff --git a/crates/build-installer/tests/environment.rs b/crates/build-installer/tests/environment.rs
new file mode 100644
index 000000000..c8b7cfc17
--- /dev/null
+++ b/crates/build-installer/tests/environment.rs
@@ -0,0 +1,56 @@
+//! Subprocess coverage for the Workshop checkout the orchestrator takes
+//! from `RUNVIL_WORKSHOP`. Each run stops before any command.
+
+use std::process::Command;
+
+// A Windows installer needs no Gateway and no Qt IFW, so nothing else in
+// the environment decides how far a run gets.
+const TARGET: &str = "x86_64-pc-windows-msvc";
+
+#[test]
+fn an_unset_or_empty_runvil_workshop_fails_naming_the_variable() {
+    for value in [None, Some("")] {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_build-installer"));
+        command.args(["--target", TARGET]);
+        match value {
+            Some(value) => command.env("RUNVIL_WORKSHOP", value),
+            None => command.env_remove("RUNVIL_WORKSHOP"),
+        };
+
+        let output = command.output().expect("run the orchestrator");
+
+        assert!(!output.status.success(), "{value:?}");
+        assert_eq!(
+            String::from_utf8_lossy(&output.stderr).trim_end(),
+            "build-installer failed: RUNVIL_WORKSHOP is unset or empty; set it to the root of \
+             a runvil-workshop checkout",
+            "{value:?}"
+        );
+    }
+}
+
+#[test]
+fn a_relative_runvil_workshop_resolves_against_the_working_directory() {
+    let temp = tempfile::tempdir().expect("temporary test root");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_build-installer"))
+        .args(["--target", TARGET])
+        .env("RUNVIL_WORKSHOP", "no-such-checkout")
+        .current_dir(temp.path())
+        .output()
+        .expect("run the orchestrator");
+
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    // The working directory may be reported through another name than the
+    // one the test gave it, so only the join is compared.
+    let joined = format!(
+        "{}no-such-checkout is not a directory; set RUNVIL_WORKSHOP",
+        std::path::MAIN_SEPARATOR
+    );
+    assert!(
+        stderr.starts_with("build-installer failed: the Workshop checkout "),
+        "{stderr}"
+    );
+    assert!(stderr.contains(&joined), "{stderr}");
+}
diff --git a/crates/build-ui/Cargo.toml b/crates/build-ui/Cargo.toml
deleted file mode 100644
index 34afe7e83..000000000
--- a/crates/build-ui/Cargo.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[package]
-name = "build-ui"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-[dependencies]
-anyhow.workspace = true
-serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/build-ui/src/lib-tests.rs b/crates/build-ui/src/lib-tests.rs
deleted file mode 100644
index a08ae63e3..000000000
--- a/crates/build-ui/src/lib-tests.rs
+++ /dev/null
@@ -1,273 +0,0 @@
-//! The esbuild lookup, the nearest lockfile, the npm workspace members,
-//! and the watch list, over scratch package trees.
-
-use std::fs;
-use std::path::{Path, PathBuf};
-
-use super::{
-    UiBuild, esbuild_command, find_esbuild, nearest_lockfile, watched_paths, workspace_members,
-};
-
-const ESBUILD_SHIM: &str = if cfg!(windows) {
-    "esbuild.cmd"
-} else {
-    "esbuild"
-};
-
-const CONFIG: UiBuild = UiBuild {
-    static_files: &["index.html"],
-    define_app_version: false,
-    splitting: false,
-};
-
-fn install_esbuild(dir: &Path) -> PathBuf {
-    let shim = dir.join("node_modules").join(".bin").join(ESBUILD_SHIM);
-    write(&shim, "");
-    shim
-}
-
-fn write(path: &Path, contents: &str) {
-    fs::create_dir_all(path.parent().unwrap()).unwrap();
-    fs::write(path, contents).unwrap();
-}
-
-#[test]
-fn a_ui_local_install_wins_over_an_ancestor_install() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    write(&temp.path().join("package-lock.json"), "{}");
-    install_esbuild(temp.path());
-    let local = install_esbuild(&ui);
-    assert_eq!(find_esbuild(&ui), Some(local));
-}
-
-#[test]
-fn an_ancestor_install_is_found() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    fs::create_dir_all(&ui).unwrap();
-    write(&temp.path().join("package-lock.json"), "{}");
-    let hoisted = install_esbuild(temp.path());
-    assert_eq!(find_esbuild(&ui), Some(hoisted));
-}
-
-#[test]
-fn no_install_in_the_tree_finds_nothing_in_it() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    fs::create_dir_all(ui.join("node_modules").join(".bin")).unwrap();
-    assert!(find_esbuild(&ui).is_none());
-}
-
-#[test]
-fn an_install_above_the_install_root_is_not_used() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path().join("root");
-    let ui = root.join("ui");
-    fs::create_dir_all(&ui).unwrap();
-    write(&root.join("package-lock.json"), "{}");
-    install_esbuild(temp.path());
-    assert_eq!(find_esbuild(&ui), None);
-}
-
-#[test]
-fn the_shim_gets_its_argument_intact_when_both_paths_have_a_space() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("game projects").join("ui");
-    fs::create_dir_all(&ui).unwrap();
-    let shim = install_esbuild(&ui);
-    if cfg!(windows) {
-        write(&shim, "@echo off\r\necho %~1\r\n");
-    } else {
-        write(&shim, "#!/bin/sh\nprintf '%s\\n' \"$1\"\n");
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            fs::set_permissions(&shim, fs::Permissions::from_mode(0o755)).unwrap();
-        }
-    }
-    let outfile = format!("--outfile={}", ui.join("dist").join("app.js").display());
-    let output = esbuild_command(&ui)
-        .unwrap()
-        .arg(&outfile)
-        .output()
-        .unwrap();
-    assert!(
-        output.status.success(),
-        "the shim failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    assert_eq!(String::from_utf8_lossy(&output.stdout).trim(), outfile);
-}
-
-#[test]
-fn the_nearest_lockfile_is_the_workspace_root_one() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    write(&ui.join("package.json"), "{}");
-    let root_lockfile = temp.path().join("package-lock.json");
-    write(&root_lockfile, "{}");
-    assert_eq!(nearest_lockfile(&ui), Some(root_lockfile));
-}
-
-#[test]
-fn a_ui_local_lockfile_is_nearer_than_the_root_one() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    write(&temp.path().join("package-lock.json"), "{}");
-    let local_lockfile = ui.join("package-lock.json");
-    write(&local_lockfile, "{}");
-    assert_eq!(nearest_lockfile(&ui), Some(local_lockfile));
-}
-
-#[test]
-fn the_other_listed_members_are_returned() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "private": true, "workspaces": ["ui", "look"] }"#,
-    );
-    write(&root.join("package-lock.json"), "{}");
-    write(&root.join("ui").join("package.json"), r#"{ "name": "ui" }"#);
-    fs::create_dir_all(root.join("look")).unwrap();
-    let workspace = workspace_members(&root.join("ui")).unwrap().unwrap();
-    assert_eq!(workspace.root, root);
-    assert_eq!(workspace.members, vec![root.join("look")]);
-}
-
-#[test]
-fn a_package_json_without_workspaces_is_not_the_root() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "workspaces": ["inner/ui", "look"] }"#,
-    );
-    write(&root.join("package-lock.json"), "{}");
-    write(
-        &root.join("inner").join("package.json"),
-        r#"{ "name": "inner" }"#,
-    );
-    let ui = root.join("inner").join("ui");
-    write(&ui.join("package.json"), r#"{ "name": "ui" }"#);
-    let workspace = workspace_members(&ui).unwrap().unwrap();
-    assert_eq!(workspace.root, root);
-    assert_eq!(workspace.members, vec![root.join("look")]);
-}
-
-#[test]
-fn a_workspace_root_above_the_install_root_is_not_adopted() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "workspaces": ["ui", "look"] }"#,
-    );
-    fs::create_dir_all(root.join("look")).unwrap();
-    let ui = root.join("ui");
-    write(&ui.join("package.json"), r#"{ "name": "ui" }"#);
-    write(&ui.join("package-lock.json"), "{}");
-    let workspace = workspace_members(&ui).unwrap();
-    assert!(workspace.is_none(), "adopted {workspace:?}");
-}
-
-#[test]
-fn a_malformed_package_json_is_an_error_naming_it() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    let broken = root.join("package.json");
-    write(&broken, r#"{ "workspaces": ["ui", "look"] "#);
-    write(&root.join("package-lock.json"), "{}");
-    let ui = root.join("ui");
-    write(&ui.join("package.json"), r#"{ "name": "ui" }"#);
-    let error = workspace_members(&ui).unwrap_err().to_string();
-    assert!(
-        error.contains(&broken.display().to_string()),
-        "the error does not name {}: {error}",
-        broken.display()
-    );
-    assert!(watched_paths(&ui, &CONFIG).is_err());
-}
-
-#[test]
-fn a_malformed_package_json_above_the_install_root_is_not_read() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "workspaces": ["ui", "look"] "#,
-    );
-    let ui = root.join("ui");
-    write(&ui.join("package.json"), r#"{ "name": "ui" }"#);
-    write(&ui.join("package-lock.json"), "{}");
-    let workspace = workspace_members(&ui).unwrap();
-    assert!(workspace.is_none(), "adopted {workspace:?}");
-    assert!(watched_paths(&ui, &CONFIG).is_ok());
-}
-
-#[test]
-fn the_ui_dir_is_left_out_when_reached_through_a_parent_hop() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "workspaces": ["ui", "look"] }"#,
-    );
-    write(&root.join("package-lock.json"), "{}");
-    for member in ["ui", "look", "server"] {
-        fs::create_dir_all(root.join(member)).unwrap();
-    }
-    let workspace = workspace_members(&root.join("server").join("..").join("ui"))
-        .unwrap()
-        .unwrap();
-    assert_eq!(workspace.root, root);
-    assert_eq!(workspace.members, vec![root.join("look")]);
-}
-
-#[test]
-fn watch_covers_the_workspace_root_and_the_other_members() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let root = temp.path();
-    write(
-        &root.join("package.json"),
-        r#"{ "workspaces": ["ui", "look"] }"#,
-    );
-    write(&root.join("package-lock.json"), "{}");
-    write(&root.join("look").join("tokens.css"), "");
-    let ui = root.join("ui");
-    write(&ui.join("package.json"), r#"{ "name": "ui" }"#);
-    write(&ui.join("index.html"), "");
-    write(&ui.join("src").join("main.ts"), "");
-    let paths = watched_paths(&ui, &CONFIG).unwrap();
-    for expected in [
-        root.join("package.json"),
-        root.join("package-lock.json"),
-        root.join("look"),
-        ui.join("src"),
-        ui.join("index.html"),
-        ui.join("package.json"),
-    ] {
-        assert!(
-            paths.contains(&expected),
-            "{} is not watched",
-            expected.display()
-        );
-    }
-    assert!(
-        !paths.contains(&ui),
-        "the UI directory is watched recursively"
-    );
-}
-
-#[test]
-fn watch_lists_only_paths_that_exist() {
-    let temp = tempfile::TempDir::new().unwrap();
-    let ui = temp.path().join("ui");
-    write(&ui.join("src").join("main.ts"), "");
-    let paths = watched_paths(&ui, &CONFIG).unwrap();
-    assert!(paths.contains(&ui.join("src")));
-    for path in &paths {
-        assert!(path.exists(), "{} is watched but missing", path.display());
-    }
-}
diff --git a/crates/build-ui/src/lib.rs b/crates/build-ui/src/lib.rs
deleted file mode 100644
index 5b115261a..000000000
--- a/crates/build-ui/src/lib.rs
+++ /dev/null
@@ -1,400 +0,0 @@
-//! Shared build-script helper that bundles a UI package's TypeScript
-//! sources with esbuild into the Cargo build output directory.
-//!
-//! The workshop server drives its entire UI build through this crate: it
-//! keeps its package at `crates/workshop/ui/` and calls [`build_sibling`].
-//! The bundle and copies of the static files land in `$OUT_DIR/ui-dist/`,
-//! which git never tracks, so no build step can dirty the repository.
-//! Cargo's
-//! change detection decides when the bundle is rebuilt. Splitting builds
-//! content-hash every bundle file and emit a `manifest.json` plus a
-//! stamped `index.html`; non-splitting builds keep the unversioned
-//! `app.js`. Building requires Node.js 22 and one `npm ci` per install
-//! root - the UI package itself, or the npm workspace root it is a member
-//! of; there is no fallback.
-
-use std::path::{Component, Path, PathBuf};
-use std::process::Command;
-
-/// Static files copied next to the workshop UI bundle, relative to `ui/`.
-pub const WORKSHOP_STATIC_FILES: &[&str] = &[
-    "index.html",
-    "style.css",
-    "pcm-worklet.js",
-    "icons/runvil-icon.png",
-    "icons/runvil-icon@2x.png",
-];
-
-/// One crate's UI build configuration.
-#[derive(Clone, Copy, Debug)]
-pub struct UiBuild {
-    /// Files to copy next to the bundle, relative to the ui folder.
-    pub static_files: &'static [&'static str],
-    /// Bakes the crate version into the bundle as the `__APP_VERSION__`
-    /// define.
-    pub define_app_version: bool,
-    /// Code-split the bundle: dynamic imports become lazily loaded chunks
-    /// under `chunks/`, and every bundle file is content-hashed - the
-    /// entry lands at `bundle/app-<hash>.js` (plus its extracted
-    /// `bundle/app-<hash>.css`), the chunks at `chunks/<name>-<hash>`.
-    /// The build then writes `manifest.json` (the logical-to-hashed name
-    /// map the workshop server's asset routes resolve through) and stamps
-    /// the dist copy of `index.html` with the hashed URLs. The workshop
-    /// UI splits because its panel registry lazy-loads feature
-    /// directories; a non-splitting build keeps the unversioned `app.js`.
-    pub splitting: bool,
-}
-
-/// The one entry point: `relative` is joined onto
-/// `CARGO_MANIFEST_DIR` to locate the UI package, so it serves a package
-/// nested in the crate and a package outside it (the workshop server
-/// passes `"../ui"` for its sibling at `crates/workshop/ui/`). Output
-/// lands in `$OUT_DIR/ui-dist/` either way.
-///
-/// # Errors
-/// Returns an error when not run through Cargo, when the resolved
-/// package directory does not exist, when a `package.json` at or above
-/// it up to its install root exists but cannot be read or parsed, when
-/// no esbuild install is found there or esbuild fails, or when a static
-/// file cannot be copied.
-pub fn build_sibling(relative: &str, config: UiBuild) -> anyhow::Result<()> {
-    let manifest_dir = PathBuf::from(
-        std::env::var_os("CARGO_MANIFEST_DIR")
-            .ok_or_else(|| anyhow::anyhow!("CARGO_MANIFEST_DIR is not set; run through cargo"))?,
-    );
-    let out_dir = PathBuf::from(
-        std::env::var_os("OUT_DIR")
-            .ok_or_else(|| anyhow::anyhow!("OUT_DIR is not set; run through cargo"))?,
-    );
-    let ui_dir = manifest_dir.join(relative);
-    anyhow::ensure!(
-        ui_dir.is_dir(),
-        "the UI package {relative} resolved to {}, which is not a directory",
-        ui_dir.display()
-    );
-    let dist_dir = out_dir.join("ui-dist");
-
-    watch(&ui_dir, &config)?;
-    build_in(&ui_dir, &dist_dir, config)
-}
-
-/// Path-explicit variant of [`build_sibling`]: bundles `ui_dir/src/main.ts`
-/// into
-/// `dist_dir` without reading Cargo's environment. Tests use it to run
-/// the Rust implementer against a scratch output directory (setting
-/// process environment would require `unsafe`), and to compare the
-/// result against the Node build script's `--out` output.
-///
-/// # Errors
-/// Returns an error when no esbuild install is found at or above
-/// `ui_dir` up to its install root or esbuild fails, or when a static
-/// file cannot be copied.
-pub fn build_in(ui_dir: &Path, dist_dir: &Path, config: UiBuild) -> anyhow::Result<()> {
-    // The output tree is rebuilt from scratch so removed assets never
-    // linger into what debug builds serve and release builds embed.
-    if dist_dir.exists() {
-        std::fs::remove_dir_all(dist_dir)
-            .map_err(|error| anyhow::anyhow!("clear {}: {error}", dist_dir.display()))?;
-    }
-    bundle(ui_dir, dist_dir, &config)?;
-    copy_static(ui_dir, dist_dir, config.static_files)?;
-    if config.splitting {
-        finalize_hashing(dist_dir)?;
-    }
-    Ok(())
-}
-
-/// Tells Cargo what to watch: the sources, the static files, and the
-/// build inputs whose contents change the bundle. Cargo watches a
-/// directory recursively, so one line covers every file under `ui/src`.
-fn watch(ui_dir: &Path, config: &UiBuild) -> anyhow::Result<()> {
-    for path in watched_paths(ui_dir, config)? {
-        println!("cargo::rerun-if-changed={}", path.display());
-    }
-    Ok(())
-}
-
-/// The paths [`watch`] declares, keeping only those that exist: Cargo
-/// reruns a build script on every build while a watched path is missing.
-fn watched_paths(ui_dir: &Path, config: &UiBuild) -> anyhow::Result<Vec<PathBuf>> {
-    let mut paths = vec![ui_dir.join("src")];
-    paths.extend(config.static_files.iter().map(|file| ui_dir.join(file)));
-    // esbuild reads tsconfig.json from its working directory, and the
-    // lockfile pins the dependency code that lands in the bundle; both can
-    // change the output without touching ui/src.
-    paths.extend(["build.mjs", "package.json", "tsconfig.json"].map(|file| ui_dir.join(file)));
-    paths.extend(nearest_lockfile(ui_dir));
-    // In an npm workspace the root manifest and the sibling members the UI
-    // imports through workspace links change the bundle too. The UI's own
-    // directory stays out: its inputs are listed above, and the jsdom
-    // tests write its dist/.
-    if let Some(workspace) = workspace_members(ui_dir)? {
-        paths.push(workspace.root.join("package.json"));
-        paths.extend(workspace.members);
-    }
-    // Both UIs bundle the shared-ui package (a `file:` dependency at
-    // crates/shared-ui); its sources change the bundle without touching
-    // ui/src. The UIs sit at different depths under crates/, so search
-    // upward for the crates/ directory instead of counting parents.
-    paths.extend(
-        ui_dir
-            .ancestors()
-            .find(|ancestor| ancestor.file_name().is_some_and(|name| name == "crates"))
-            .map(|crates| crates.join("shared-ui")),
-    );
-    paths.retain(|path| path.exists());
-    Ok(paths)
-}
-
-/// An npm workspace root and its member directories other than the UI's.
-#[derive(Debug)]
-struct Workspace {
-    root: PathBuf,
-    members: Vec<PathBuf>,
-}
-
-/// Finds the nearest `package.json` at or above `ui_dir`, up to and
-/// including its [`install_root`], whose `workspaces` field is an array,
-/// returning its directory and every listed member except `ui_dir`.
-/// Entries are taken literally; npm's glob patterns are not expanded. A
-/// manifest that exists but cannot be read or parsed is an error rather
-/// than a skip: skipping a broken workspace root would drop it and its
-/// members from the watch list.
-fn workspace_members(ui_dir: &Path) -> anyhow::Result<Option<Workspace>> {
-    let install_root = install_root(ui_dir);
-    let ui_dir = normalize(ui_dir);
-    for dir in ui_dir
-        .ancestors()
-        .take_while(|dir| dir.starts_with(&install_root))
-    {
-        let manifest_path = dir.join("package.json");
-        let text = match std::fs::read_to_string(&manifest_path) {
-            Ok(text) => text,
-            Err(error) if error.kind() == std::io::ErrorKind::NotFound => continue,
-            Err(error) => anyhow::bail!(
-                "read {} to find the npm workspace root: {error}",
-                manifest_path.display()
-            ),
-        };
-        let manifest: serde_json::Value = serde_json::from_str(&text).map_err(|error| {
-            anyhow::anyhow!(
-                "parse {} to find the npm workspace root: {error}",
-                manifest_path.display()
-            )
-        })?;
-        let Some(entries) = manifest
-            .get("workspaces")
-            .and_then(serde_json::Value::as_array)
-        else {
-            continue;
-        };
-        let members = entries
-            .iter()
-            .filter_map(serde_json::Value::as_str)
-            .map(|entry| normalize(&dir.join(entry)))
-            .filter(|member| *member != ui_dir)
-            .collect();
-        return Ok(Some(Workspace {
-            root: dir.to_path_buf(),
-            members,
-        }));
-    }
-    Ok(None)
-}
-
-/// The nearest `package-lock.json` at or above `ui_dir`: the UI's own for
-/// a standalone package, the root's for an npm workspace member.
-fn nearest_lockfile(ui_dir: &Path) -> Option<PathBuf> {
-    normalize(ui_dir)
-        .ancestors()
-        .map(|dir| dir.join("package-lock.json"))
-        .find(|lockfile| lockfile.is_file())
-}
-
-/// The directory the upward searches stop at: the one holding the
-/// nearest `package-lock.json`, where `npm ci` installs, or `ui_dir`
-/// itself when there is no lockfile.
-fn install_root(ui_dir: &Path) -> PathBuf {
-    nearest_lockfile(ui_dir)
-        .and_then(|lockfile| lockfile.parent().map(Path::to_path_buf))
-        .unwrap_or_else(|| normalize(ui_dir))
-}
-
-/// Finds the npm esbuild shim (`node_modules/.bin/esbuild`, or
-/// `esbuild.cmd` on Windows) in `ui_dir` or the nearest ancestor that has
-/// one, searching up to and including the install root and never above
-/// it: the directory holding the nearest `package-lock.json`, or `ui_dir`
-/// itself when there is none. A standalone UI finds only its own install,
-/// and an npm workspace member finds the install hoisted to its root.
-#[must_use]
-pub fn find_esbuild(ui_dir: &Path) -> Option<PathBuf> {
-    let shim = if cfg!(windows) {
-        "esbuild.cmd"
-    } else {
-        "esbuild"
-    };
-    let install_root = install_root(ui_dir);
-    normalize(ui_dir)
-        .ancestors()
-        .take_while(|dir| dir.starts_with(&install_root))
-        .map(|dir| dir.join("node_modules").join(".bin").join(shim))
-        .find(|path| path.is_file())
-}
-
-/// Folds `.` and `..` lexically so the ancestor searches walk the real
-/// parent chain: the workshop server passes `crates/workshop/server/../ui`,
-/// whose lexical ancestors include `server`.
-fn normalize(path: &Path) -> PathBuf {
-    let mut normal = PathBuf::new();
-    for component in path.components() {
-        match component {
-            Component::CurDir => {}
-            Component::ParentDir if normal.file_name().is_some() => {
-                normal.pop();
-            }
-            other => normal.push(other),
-        }
-    }
-    normal
-}
-
-/// Runs the esbuild bundle step from the npm install [`find_esbuild`]
-/// locates. There is no `npx` fallback: `npx` can download a different
-/// esbuild version and produce different output.
-fn bundle(ui_dir: &Path, dist_dir: &Path, config: &UiBuild) -> anyhow::Result<()> {
-    let mut command = esbuild_command(ui_dir)?;
-    command.current_dir(ui_dir).args([
-        "src/main.ts",
-        "--bundle",
-        "--format=esm",
-        "--target=es2022",
-    ]);
-    if config.splitting {
-        // Every bundle file is content-hashed: the entry lands under
-        // bundle/ (index.html is stamped with the hashed URLs by
-        // finalize_hashing, and the server's asset routes resolve the
-        // logical names through manifest.json); chunks are content-hashed
-        // under chunks/, served by the workshop server's chunk route.
-        command.arg("--splitting");
-        command.arg(format!("--outdir={}", dist_dir.display()));
-        command.arg("--entry-names=bundle/app-[hash]");
-        command.arg("--chunk-names=chunks/[name]-[hash]");
-    } else {
-        command.arg(format!("--outfile={}", dist_dir.join("app.js").display()));
-    }
-    if std::env::var("PROFILE").as_deref() == Ok("release") {
-        command.arg("--minify");
-    }
-    if config.define_app_version {
-        let version = std::env::var("CARGO_PKG_VERSION").map_err(|error| {
-            anyhow::anyhow!("CARGO_PKG_VERSION is not set: {error}; run through cargo")
-        })?;
-        // Single quotes: esbuild evaluates the define value as a JS string
-        // literal, and unlike double quotes they pass through `cmd /c` on
-        // Windows untouched.
-        command.arg(format!("--define:__APP_VERSION__='{version}'"));
-    }
-    let output = command.output().map_err(|error| {
-        anyhow::anyhow!(
-            "esbuild could not be started: {error}; install Node.js 22 so it is on PATH"
-        )
-    })?;
-    if output.status.success() {
-        return Ok(());
-    }
-    Err(anyhow::anyhow!(
-        "the UI bundle failed (status {}):\n{}\n{}",
-        output.status,
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr),
-    ))
-}
-
-/// Builds the command that invokes the esbuild install [`find_esbuild`]
-/// locates, failing with the setup instructions when there is none: `npm
-/// ci` belongs where the nearest lockfile is. On Windows the npm shim is a
-/// `.cmd` file; `Command` runs it through `cmd.exe` and quotes the whole
-/// line for it. A hand-built `cmd /c` line breaks once both the shim path
-/// and an argument need quotes, because `cmd` strips the first and last
-/// quote, as when the checkout path has a space.
-fn esbuild_command(ui_dir: &Path) -> anyhow::Result<Command> {
-    let Some(esbuild) = find_esbuild(ui_dir) else {
-        return Err(anyhow::anyhow!(
-            "no node_modules/.bin/esbuild at or above {}; run `npm ci` in {} first",
-            ui_dir.display(),
-            install_root(ui_dir).display()
-        ));
-    };
-    Ok(Command::new(esbuild))
-}
-
-/// Copies the static UI files next to the bundle, keeping the relative
-/// paths.
-fn copy_static(ui_dir: &Path, dist_dir: &Path, static_files: &[&str]) -> anyhow::Result<()> {
-    std::fs::create_dir_all(dist_dir)
-        .map_err(|error| anyhow::anyhow!("create {}: {error}", dist_dir.display()))?;
-    for file in static_files {
-        let target = dist_dir.join(file);
-        if let Some(parent) = target.parent() {
-            std::fs::create_dir_all(parent)
-                .map_err(|error| anyhow::anyhow!("create the parent for {file}: {error}"))?;
-        }
-        std::fs::copy(ui_dir.join(file), &target)
-            .map_err(|error| anyhow::anyhow!("copy ui/{file} into the bundle output: {error}"))?;
-    }
-    Ok(())
-}
-
-/// Finishes a content-hashed build: writes `manifest.json` mapping the
-/// logical names (`app.js`, `app.css`) to the hashed files under
-/// `bundle/`, and stamps the copied `index.html` with the hashed URLs so
-/// the page loads the immutable assets directly. The workshop server's
-/// asset routes resolve the logical names through the manifest and mark
-/// the hashed files `Cache-Control: immutable`. Mirrored in the workshop
-/// UI's `build.mjs` stamp step.
-fn finalize_hashing(dist_dir: &Path) -> anyhow::Result<()> {
-    let script = hashed_entry(dist_dir, ".js")?;
-    let styles = hashed_entry(dist_dir, ".css")?;
-    let manifest = format!("{{\n  \"app.js\": \"{script}\",\n  \"app.css\": \"{styles}\"\n}}\n");
-    std::fs::write(dist_dir.join("manifest.json"), manifest)
-        .map_err(|error| anyhow::anyhow!("write the asset manifest: {error}"))?;
-    let index_path = dist_dir.join("index.html");
-    let html = std::fs::read_to_string(&index_path)
-        .map_err(|error| anyhow::anyhow!("read the copied index.html: {error}"))?;
-    let stamped = html
-        .replace("href=\"/app.css\"", &format!("href=\"/{styles}\""))
-        .replace("src=\"/app.js\"", &format!("src=\"/{script}\""));
-    if stamped == html {
-        return Err(anyhow::anyhow!(
-            "index.html did not reference /app.js and /app.css; the stamp found nothing"
-        ));
-    }
-    std::fs::write(&index_path, stamped)
-        .map_err(|error| anyhow::anyhow!("write the stamped index.html: {error}"))?;
-    Ok(())
-}
-
-/// Finds the single hashed entry output of one kind under `bundle/`,
-/// returning its dist-relative path. The output tree is rebuilt from
-/// scratch on every build, so exactly one match must exist.
-fn hashed_entry(dist_dir: &Path, extension: &str) -> anyhow::Result<String> {
-    let bundle_dir = dist_dir.join("bundle");
-    let mut matches: Vec<String> = std::fs::read_dir(&bundle_dir)
-        .map_err(|error| anyhow::anyhow!("list {}: {error}", bundle_dir.display()))?
-        .filter_map(std::result::Result::ok)
-        .filter_map(|entry| entry.file_name().into_string().ok())
-        .filter(|name| name.starts_with("app-") && name.ends_with(extension))
-        .collect();
-    matches.sort_unstable();
-    match matches.as_slice() {
-        [name] => Ok(format!("bundle/{name}")),
-        _ => Err(anyhow::anyhow!(
-            "expected exactly one bundle/app-*{extension} output, found {}",
-            matches.len()
-        )),
-    }
-}
-
-#[cfg(test)]
-#[path = "lib-tests.rs"]
-mod tests;
diff --git a/crates/build-ui/tests/it/main.rs b/crates/build-ui/tests/it/main.rs
deleted file mode 100644
index 925a595c7..000000000
--- a/crates/build-ui/tests/it/main.rs
+++ /dev/null
@@ -1,159 +0,0 @@
-//! Integration tests for the `build-ui` helper.
-
-use std::collections::BTreeSet;
-
-use anyhow::Context as _;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-/// Differential behavior test over real build outputs: the Rust
-/// implementer (`build_ui::build_in`, what `cargo build` runs through
-/// the crate build scripts) and the Node implementer
-/// (`ui/build.mjs --out`, the fast-iteration path) must emit the same
-/// layout - the same hash-normalized file set, the same manifest, and
-/// the same stamped index page. Skips with a message when Node.js or
-/// the Workshop npm workspace install is absent.
-#[test]
-fn both_implementers_emit_the_same_layout() -> anyhow::Result<()> {
-    let workspace_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-        .join("..")
-        .join("workshop");
-    let ui_dir = workspace_dir.join("ui");
-    if !node_available() {
-        eprintln!("skipping: node is not on PATH; install Node.js 22 to run this test");
-        return Ok(());
-    }
-    if build_ui::find_esbuild(&ui_dir).is_none() {
-        eprintln!(
-            "skipping: no esbuild install at or above {}; run `npm ci` in {} first",
-            ui_dir.display(),
-            workspace_dir.display()
-        );
-        return Ok(());
-    }
-
-    let rust_dist = tempfile::TempDir::new().context("create the Rust build's temp dir")?;
-    let node_dist = tempfile::TempDir::new().context("create the Node build's temp dir")?;
-
-    build_ui::build_in(
-        &ui_dir,
-        rust_dist.path(),
-        build_ui::UiBuild {
-            static_files: build_ui::WORKSHOP_STATIC_FILES,
-            define_app_version: true,
-            splitting: true,
-        },
-    )?;
-
-    let output = Command::new("node")
-        .arg("build.mjs")
-        .arg("--out")
-        .arg(node_dist.path())
-        .current_dir(&ui_dir)
-        .output()
-        .with_context(|| format!("run node build.mjs in {}", ui_dir.display()))?;
-    anyhow::ensure!(
-        output.status.success(),
-        "node build.mjs --out failed (status {}):\n{}",
-        output.status,
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    let rust_files = file_set(rust_dist.path())?;
-    let node_files = file_set(node_dist.path())?;
-    anyhow::ensure!(
-        rust_files == node_files,
-        "the emitted file sets differ:\nonly in the Rust build: {:?}\nonly in the Node build: {:?}",
-        rust_files.difference(&node_files).collect::<Vec<_>>(),
-        node_files.difference(&rust_files).collect::<Vec<_>>(),
-    );
-
-    // The manifest maps the logical names to the hashed files; the
-    // stamped index page references them. Both are byte-identical once
-    // the content hashes are normalized.
-    let manifest = normalized_file(rust_dist.path(), "manifest.json")?;
-    anyhow::ensure!(
-        manifest.contains("\"app.js\"") && manifest.contains("\"app.css\""),
-        "manifest.json must map the app.js and app.css logical names, got:\n{manifest}"
-    );
-    for name in ["manifest.json", "index.html"] {
-        let rust_text = normalized_file(rust_dist.path(), name)?;
-        let node_text = normalized_file(node_dist.path(), name)?;
-        anyhow::ensure!(
-            rust_text == node_text,
-            "{name} differs between the implementers:\nRust:\n{rust_text}\nNode:\n{node_text}"
-        );
-    }
-    Ok(())
-}
-
-/// True when `node` runs on PATH.
-fn node_available() -> bool {
-    Command::new("node")
-        .arg("--version")
-        .output()
-        .is_ok_and(|output| output.status.success())
-}
-
-/// The set of files under `root`, relative with `/` separators and with
-/// esbuild content hashes normalized so the two implementers' different
-/// bytes (minification, defines) do not break the comparison.
-fn file_set(root: &Path) -> anyhow::Result<BTreeSet<String>> {
-    let mut files = BTreeSet::new();
-    let mut stack = vec![root.to_path_buf()];
-    while let Some(dir) = stack.pop() {
-        let entries =
-            std::fs::read_dir(&dir).with_context(|| format!("read dir {}", dir.display()))?;
-        for entry in entries {
-            let path = entry
-                .with_context(|| format!("read an entry of {}", dir.display()))?
-                .path();
-            if path.is_dir() {
-                stack.push(path);
-            } else {
-                let relative = path
-                    .strip_prefix(root)?
-                    .to_string_lossy()
-                    .replace('\\', "/");
-                files.insert(normalize_hashes(&relative));
-            }
-        }
-    }
-    Ok(files)
-}
-
-/// Reads one file under `root` with its content hashes normalized.
-fn normalized_file(root: &Path, name: &str) -> anyhow::Result<String> {
-    let path = root.join(name);
-    let text =
-        std::fs::read_to_string(&path).with_context(|| format!("read {}", path.display()))?;
-    Ok(normalize_hashes(&text))
-}
-
-/// Replaces esbuild content hashes (`-XXXXXXXX` in base32, A-Z and 2-7)
-/// with a fixed token.
-fn normalize_hashes(text: &str) -> String {
-    let mut out = String::with_capacity(text.len());
-    let mut rest = text;
-    while let Some(c) = rest.chars().next() {
-        if c == '-' {
-            let candidate = &rest[1..];
-            let hash: String = candidate.chars().take(8).collect();
-            let bounded = candidate
-                .chars()
-                .nth(8)
-                .is_none_or(|next| !next.is_ascii_alphanumeric());
-            if hash.len() == 8
-                && hash.chars().all(|h| matches!(h, 'A'..='Z' | '2'..='7'))
-                && bounded
-            {
-                out.push_str("-HASH");
-                rest = &candidate[8..];
-                continue;
-            }
-        }
-        out.push(c);
-        rest = &rest[c.len_utf8()..];
-    }
-    out
-}
diff --git a/crates/build-workshop/AGENTS.md b/crates/build-workshop/AGENTS.md
deleted file mode 100644
index ee5b44bff..000000000
--- a/crates/build-workshop/AGENTS.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# build-workshop
-
-- Each release file name has one definition: `installer_name` and `workshop_updater_name` in `src/main/installer/collect.rs`. The installer build, the IFW stage, and the `manifest` mode call them; never spell a release name inline. The payload's bundle and AppImage names are the constants beside them, which must equal those `crates/workshop/gateway-discovery/src/peer.rs` searches; a test compares the two. The bare gateway executable's name is `GATEWAY` in `collect.rs`.
-- Nothing here compiles the gateway: it is the release `gateway-pin/pin.json` names, from `--gateway-binary`, `RUNVIL_GATEWAY_SIDECAR`, or the file `tools/fetch-gateway-sidecar.mjs` stages (`gateway_source` in `src/main/sidecar.rs`). A staged gateway is never removed; only a named one staged for a Windows build is.
-- The Qt IFW pin is enforced in two places that change together: `IFW_VERSION` in `src/main/installer/ifw.rs`, and each `ifw-archive` with its `ifw-sha256` in `.github/workflows/installers.yml`'s build matrix. `USAGE` in `src/main/args.rs`, the workflow step's name, and this crate's README name the version or the archive paths too; update them in the same change.
-- Files under `ifw/` are templates. The build fills `{{NAME}}` placeholders and fails on any left over; IFW's own `@Variable@` placeholders are left for IFW to expand at install time.
-- `installscript.qs` runs only inside IFW and has no test support. A change to either script, or to what an install puts where, updates the install cells in `.github/installers/cell.sh` and `cell.ps1`, which are its tests.
-- Workshop carries the gateway as a sidecar only for Windows targets (`bundles_sidecar` in `src/main/sidecar.rs`). Only `crates/workshop/desktop/tauri.windows.conf.json` declares `externalBin`, and the config agreement test in `src/main/tests/bundle.rs` holds the two in step.
diff --git a/crates/build-workshop/README.md b/crates/build-workshop/README.md
deleted file mode 100644
index 1adf4dc35..000000000
--- a/crates/build-workshop/README.md
+++ /dev/null
@@ -1,83 +0,0 @@
-# build-workshop
-
-This crate is `cargo workshop`, the one build path for Runvil's desktop products. CI's `installers.yml` runs the same commands described here, so a local build makes what a release ships.
-
-## Modes
-
-- `cargo workshop [--release] [--target <triple>] [--gateway-binary <path>]` builds Workshop with Cargo. For a Windows target the gateway is Workshop's sidecar; elsewhere the build copies it beside Workshop in the target directory, where a development Workshop finds it. Every build also copies the libraries of the Plugins Workshop ships into `plugins` beside Workshop, where a development Workshop loads them.
-- `cargo workshop installer [--target <triple>] [--sign] [--gateway-binary <path>]` builds one platform's installer in release.
-- `cargo workshop manifest --assets <dir> --base-url <url> [--public-key <file>]` checks that a directory holds exactly one release's files for every platform, verifies each updater signature, and writes `latest.json` and `SHA256SUMS` beside them.
-
-`cargo workshop --help` prints the full usage.
-
-## The gateway
-
-The gateway is its own product, in [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway), so nothing here builds it. Every build ships the release `gateway-pin/pin.json` names. Stage it once per target:
-
-```text
-node tools/fetch-gateway-sidecar.mjs --target <triple>
-```
-
-The script downloads the release asset, checks its SHA-256 against the pin, and stages the executable in `crates/workshop/desktop/binaries/`, where every later build reuses it. `--gateway-binary <path>`, or the `RUNVIL_GATEWAY_SIDECAR` environment variable, names another gateway instead; for a Windows target, remove the staged one first, because a named gateway never replaces it. The installer build runs the gateway's `--version` and refuses one that is not the pinned version.
-
-## The Plugins Workshop ships
-
-Two Plugins ship with Workshop, each a dynamic library whose code is in a repository of its own, pinned by commit in the root `Cargo.toml`:
-
-- The std Plugin, from [cppalliance/runvil-plugin-std](https://github.com/cppalliance/runvil-plugin-std), holds the file tools. Its library is `plugin_std.dll`, `libplugin_std.so`, or `libplugin_std.dylib`.
-- The bashkit Plugin, from [cppalliance/runvil-plugin-bashkit](https://github.com/cppalliance/runvil-plugin-bashkit), holds the shell. Its library is `plugin_bashkit.dll`, `libplugin_bashkit.so`, or `libplugin_bashkit.dylib`.
-
-Nothing here builds them by name: the Workshop server depends on `workshop-plugin-std` and `workshop-plugin-bashkit`, so Cargo writes each library to `deps` in the profile's directory whenever it builds Workshop. Each mode takes the libraries from there. A build copies them into `plugins` beside Workshop in the target directory. A macOS or Linux installer has Tauri copy them into Workshop's bundle, at `Runvil.app/Contents/Resources/plugins` or at `usr/lib/runvil/plugins` in the AppImage, so the updater, which replaces only that bundle, replaces the libraries with it. The installer build fails when the bundle Tauri built does not hold each library. A Workshop run with plain `cargo run -p workshop` has no Plugin directory, so its agents have no file tools and no shell; run `cargo workshop` once to place the libraries. Plain Cargo builds do not refresh the placed copies, so run `cargo workshop` again after a pin or the contract version changes.
-
-`LIBRARIES` in `src/main/plugin.rs` names the two. A third Plugin adds its name there, in `crates/workshop/desktop/installer.nsi`, and in the two scripts in `.github/installers`.
-
-## Building an installer
-
-Every platform needs Node 22, the staged gateway above, and the UI install, which brings the pinned Tauri CLI:
-
-```text
-npm ci --prefix crates/workshop
-```
-
-The output lands in `target/installer/<triple>/`:
-
-- `publish/`: the installer, and under `--sign` the updater files and their `.sig` signatures. Windows gets `Runvil_<version>_x64-setup.exe`, macOS `Runvil_<version>_<aarch64|x86_64>-setup.dmg`, and Linux `Runvil_<version>_<amd64|aarch64>-setup.run`.
-- `payload/` (macOS and Linux): the installed items, `Runvil.app` and `Runvil Gateway.app`, or `Runvil.AppImage` and `runvil-gateway`. The Plugins' libraries are inside Workshop's item.
-- `ifw/` (macOS and Linux): the Qt IFW definition filled in from `ifw/` in this crate, with the payload copied into its packages. The Plugin directory goes in Workshop's package.
-
-Windows needs nothing more: Tauri builds the NSIS setup from `crates/workshop/desktop/installer.nsi`, with the gateway inside. That template takes the Plugins' libraries from `deps` beside the built executable and installs them as `plugins\plugin_std.dll` and `plugins\plugin_bashkit.dll`.
-
-Linux also needs Tauri's build packages and the libraries the Qt IFW tools load even without a display, as `installers.yml` installs them on Ubuntu:
-
-```text
-gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-pulseaudio
-gstreamer1.0-alsa patchelf
-libwebkit2gtk-4.1-dev libssl-dev librsvg2-dev xdg-utils p7zip-full
-libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0
-libxcb-render-util0 libxcb-shape0 libxcb-shm0 libxcb-sync1 libxcb-xfixes0
-libxcb-xkb1 libxcb-util1 libfontconfig1 libfreetype6 libdbus-1-3
-```
-
-Building the Intel macOS installer on Apple silicon needs Rosetta, since the build runs the x86_64 gateway to check its version.
-
-Where FUSE is unavailable, such as in a container, set `APPIMAGE_EXTRACT_AND_RUN=1` so Tauri's AppImage tools run without it.
-
-### Qt Installer Framework
-
-macOS and Linux installers need Qt IFW 4.11.0 exactly; the build checks `installerbase --version` and refuses any other version. Download the archive for your machine from `https://download.qt.io/online/qtsdkrepository/`:
-
-- macOS (one universal build for both architectures): `mac_x64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603311245ifw-mac-universal.7z`
-- Linux x64: `linux_x64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603231357ifw-linux-x64.7z`
-- Linux ARM64: `linux_arm64/ifw/tools_ifw_411/qt.tools.ifw.411/4.11.0-0-202603231357ifw-linux-arm64.7z`, which runs only on glibc 2.38 or newer
-
-Check its SHA-256 against the `ifw-sha256` pinned beside the same path in `.github/workflows/installers.yml`. Extract it into a directory you own, with `bsdtar -xf` on macOS or `7z x` on Linux, and point `QTIFWDIR` at the extracted directory that holds `bin/`. Without `QTIFWDIR`, the build uses the first `binarycreator` on `PATH` and the `installerbase` beside it.
-
-### Signing
-
-Without `--sign`, the build applies `crates/workshop/desktop/tauri.unsigned.conf.json` and makes no updater files. With it, `tauri build` signs Workshop's updater files with the minisign key in `TAURI_SIGNING_PRIVATE_KEY` and `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`. For a local try, make a throwaway key:
-
-```text
-node crates/workshop/node_modules/@tauri-apps/cli/tauri.js signer generate --ci -w <dir>/run.key
-```
-
-Installed copies trust only the release key, so files signed with any other key never install as an update.
diff --git a/crates/build-workshop/src/main/installer.rs b/crates/build-workshop/src/main/installer.rs
deleted file mode 100644
index 8541f9265..000000000
--- a/crates/build-workshop/src/main/installer.rs
+++ /dev/null
@@ -1,386 +0,0 @@
-//! `cargo workshop installer`: builds Workshop for one target in release,
-//! bundles it with the pinned Tauri CLI, and collects each platform's
-//! installer payload and, under `--sign`, Workshop's updater files into
-//! `target/installer/<triple>/`. The payload's Gateway is the release
-//! `gateway-pin/pin.json` names, staged by `tools/fetch-gateway-sidecar.mjs`
-//! or named by `--gateway-binary`. Windows ends with Tauri's NSIS setup;
-//! macOS and Linux end with a Qt IFW installer built from the payload.
-
-use std::ffi::OsString;
-use std::fs;
-use std::io;
-use std::path::{Path, PathBuf};
-
-use super::args::InstallerRequest;
-use super::pipeline::{resolve_target, run_checked, with_staged_sidecar};
-use super::sidecar::{self, GatewaySource};
-use super::{
-    BuildEnvironment, BuildError, CommandRunner, CommandSpec, OutputMode, StepError, plugin,
-};
-
-// This file is loaded through a path attribute, so its children need one
-// too to resolve under `installer/`.
-#[path = "installer/bundle.rs"]
-pub(super) mod bundle;
-#[path = "installer/collect.rs"]
-pub(super) mod collect;
-#[path = "installer/ifw.rs"]
-pub(super) mod ifw;
-
-pub(super) const VERSION: &str = env!("CARGO_PKG_VERSION");
-/// Applied to unsigned builds: it turns off `createUpdaterArtifacts`, which
-/// would otherwise demand the release key.
-const UNSIGNED_CONFIG: &str = "tauri.unsigned.conf.json";
-/// The Tauri CLI first runs after the Gateway version check, so a missing
-/// `node` is found up front instead.
-const NODE_CHECK: &str = "`node --version` (the Tauri CLI runs on `node` from PATH)";
-
-/// The Gateway release an installer carries: its executable and the
-/// version `gateway-pin/pin.json` names.
-#[derive(Debug, Eq, PartialEq)]
-pub(super) struct Gateway {
-    pub(super) binary: PathBuf,
-    pub(super) version: String,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(super) enum System {
-    Windows,
-    MacOs,
-    Linux,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(super) enum Arch {
-    X86_64,
-    Aarch64,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(super) struct Platform {
-    pub(super) system: System,
-    pub(super) arch: Arch,
-}
-
-impl Platform {
-    pub(super) fn from_triple(target: &str) -> Result<Self, String> {
-        let parts: Vec<&str> = target.split('-').collect();
-        let arch = match parts.first() {
-            Some(&"x86_64") => Some(Arch::X86_64),
-            Some(&"aarch64") => Some(Arch::Aarch64),
-            _ => None,
-        };
-        let system = match parts.get(1..) {
-            Some(["pc", "windows", "msvc"]) => Some(System::Windows),
-            Some(["apple", "darwin"]) => Some(System::MacOs),
-            Some(["unknown", "linux", "gnu"]) => Some(System::Linux),
-            _ => None,
-        };
-        match (system, arch) {
-            (Some(system), Some(arch)) => Ok(Self { system, arch }),
-            _ => Err(format!(
-                "installer target `{target}` is not supported; supported: x86_64 or aarch64 \
-                 with pc-windows-msvc, apple-darwin, or unknown-linux-gnu"
-            )),
-        }
-    }
-
-    /// The Tauri bundle format, which is also its output directory's name
-    /// except for `app`.
-    pub(super) fn bundle(self) -> &'static str {
-        match self.system {
-            System::Windows => "nsis",
-            System::MacOs => "app",
-            System::Linux => "appimage",
-        }
-    }
-
-    fn bundle_directory(self) -> &'static str {
-        match self.system {
-            System::MacOs => "macos",
-            System::Windows | System::Linux => self.bundle(),
-        }
-    }
-}
-
-pub(super) fn build_installer(
-    request: &InstallerRequest,
-    environment: &BuildEnvironment,
-    runner: &mut impl CommandRunner,
-) -> Result<(), BuildError> {
-    preflight(request, environment)?;
-    let target = resolve_target(request.target.as_deref(), environment, runner)?;
-    let platform = Platform::from_triple(&target).map_err(failure)?;
-    let given = request
-        .gateway_binary
-        .as_deref()
-        .or(environment.gateway_sidecar.as_deref());
-    let source =
-        sidecar::gateway_source(given, &environment.workspace_root, &target).map_err(failure)?;
-    if source == (GatewaySource::Staged { stub: true }) {
-        return Err(failure(format!(
-            "the Gateway staged for {target} at {} is a compile-only stub, which an installer \
-             cannot ship; run `node tools/fetch-gateway-sidecar.mjs --target {target}` to stage \
-             the release gateway-pin/pin.json names, or pass --gateway-binary",
-            sidecar::sidecar_path(&environment.workspace_root, &target).display()
-        )));
-    }
-    let gateway = Gateway {
-        binary: source.binary(&environment.workspace_root, &target),
-        version: sidecar::pinned_version(&environment.workspace_root).map_err(failure)?,
-    };
-    let ifw = match platform.system {
-        System::Windows => None,
-        System::MacOs | System::Linux => Some(check_ifw(environment, runner)?),
-    };
-    run_checked(runner, &node_check_command(environment), NODE_CHECK)?;
-    let release = environment.target_root.join(&target).join("release");
-    let bundle_directory = release.join("bundle").join(platform.bundle_directory());
-    // A bundle left by an earlier build, possibly at another version, would
-    // make the collection ambiguous.
-    remove_directory(&bundle_directory)?;
-    check_gateway_version(runner, environment, &gateway)?;
-    // The Windows setup takes the Plugins' libraries from the build
-    // itself. On macOS and Linux Tauri copies them into Workshop's bundle,
-    // so the updater replaces them with Workshop.
-    let libraries = plugin::built_libraries(&release, &target);
-    let plugin_config = plugin::bundle_config(platform.system, &libraries).map_err(failure)?;
-    with_staged_sidecar(
-        environment,
-        &target,
-        runner,
-        "Workshop bundle",
-        &source,
-        |runner| {
-            let mut bundle = tauri_build_command(
-                environment,
-                &target,
-                platform,
-                request.sign,
-                plugin_config.as_deref(),
-            );
-            bundle.envs.extend(source.child_envs());
-            run_checked(runner, &bundle, "Workshop bundle").map(|_| ())
-        },
-    )?;
-    plugin::check_bundled(
-        platform.system,
-        &bundle_directory,
-        &plugin::library_names(&target),
-    )
-    .map_err(failure)?;
-    let output = environment.target_root.join("installer").join(&target);
-    collect::collect(
-        &environment.workspace_root,
-        &release,
-        &gateway,
-        platform,
-        request.sign,
-        &output,
-    )
-    .map_err(failure)?;
-    let installer = match &ifw {
-        Some(ifw) => build_ifw_installer(ifw, environment, platform, &gateway, &output, runner)?,
-        None => output
-            .join("publish")
-            .join(collect::installer_name(platform)),
-    };
-    println!("installer: {}", installer.display());
-    Ok(())
-}
-
-fn check_ifw(
-    environment: &BuildEnvironment,
-    runner: &mut impl CommandRunner,
-) -> Result<ifw::Ifw, BuildError> {
-    let cwd = std::env::current_dir()
-        .map_err(|error| failure(format!("cannot read the current directory: {error}")))?;
-    let ifw = ifw::locate(
-        environment.qtifw_dir.as_deref(),
-        environment.path.as_deref(),
-        &cwd,
-    )
-    .map_err(failure)?;
-    let printed = run_checked(
-        runner,
-        &ifw::version_command(&ifw, &environment.workspace_root),
-        &format!(
-            "Qt IFW version check (`{} --version`)",
-            ifw.installerbase.display()
-        ),
-    )?;
-    ifw::check_version(&ifw, &printed).map_err(failure)?;
-    Ok(ifw)
-}
-
-/// Stages the IFW definition around `output`'s payload and builds the
-/// installer into `output/publish/`, returning its path.
-fn build_ifw_installer(
-    ifw: &ifw::Ifw,
-    environment: &BuildEnvironment,
-    platform: Platform,
-    gateway: &Gateway,
-    output: &Path,
-    runner: &mut impl CommandRunner,
-) -> Result<PathBuf, BuildError> {
-    let stage = output.join("ifw");
-    let publish = output.join("publish");
-    ifw::stage(
-        &ifw::Sources::in_workspace(&environment.workspace_root),
-        &output.join("payload"),
-        platform,
-        &environment.release_date,
-        &gateway.version,
-        &stage,
-    )
-    .map_err(failure)?;
-    let built = ifw::binarycreator_output(platform, &stage, &publish);
-    run_checked(
-        runner,
-        &ifw::binarycreator_command(ifw, &stage, &built),
-        "Qt IFW binarycreator",
-    )?;
-    require_output("Qt IFW binarycreator", &built)?;
-    if platform.system != System::MacOs {
-        return Ok(built);
-    }
-    run_checked(
-        runner,
-        &ifw::adhoc_sign_command(&built),
-        "Installer app ad hoc signing (codesign)",
-    )?;
-    let dmg = ifw::dmg_path(platform, &publish);
-    let app_folder = stage.join("dmg");
-    run_checked(
-        runner,
-        &ifw::hdiutil_command(&app_folder, &dmg),
-        "DMG wrap (hdiutil)",
-    )?;
-    require_output("DMG wrap (hdiutil)", &dmg)?;
-    Ok(dmg)
-}
-
-fn require_output(step: &str, path: &Path) -> Result<(), BuildError> {
-    if path.exists() {
-        Ok(())
-    } else {
-        Err(failure(format!(
-            "{step} succeeded but wrote nothing at {}",
-            path.display()
-        )))
-    }
-}
-
-fn preflight(request: &InstallerRequest, environment: &BuildEnvironment) -> Result<(), BuildError> {
-    if !environment.tauri_cli.is_file() {
-        return Err(failure(format!(
-            "the Tauri CLI is missing at {}; run `npm ci --prefix crates/workshop` first",
-            environment.tauri_cli.display()
-        )));
-    }
-    if request.sign && environment.signing_key.is_none() {
-        return Err(failure(
-            "`--sign` needs TAURI_SIGNING_PRIVATE_KEY set to the release minisign key; it is \
-             unset or empty"
-                .to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-/// Runs the Gateway's `--version` and requires the version the pin names,
-/// so an installer never ships a Gateway other than the pinned release.
-fn check_gateway_version(
-    runner: &mut impl CommandRunner,
-    environment: &BuildEnvironment,
-    gateway: &Gateway,
-) -> Result<(), StepError> {
-    let printed = run_checked(
-        runner,
-        &CommandSpec {
-            program: gateway.binary.clone(),
-            args: vec![OsString::from("--version")],
-            current_dir: environment.workspace_root.clone(),
-            envs: Vec::new(),
-            output_mode: OutputMode::Capture,
-        },
-        "Gateway version check",
-    )?;
-    let expected = format!("runvil-gateway {}", gateway.version);
-    if printed.trim() == expected {
-        Ok(())
-    } else {
-        Err(StepError::failed(format!(
-            "Gateway version check failed: {} printed `{}`, expected `{expected}`, the \
-             version gateway-pin/pin.json names",
-            gateway.binary.display(),
-            printed.trim()
-        )))
-    }
-}
-
-/// The Tauri build of Workshop's bundle for `target`. `plugin_config` is
-/// the configuration that copies the Plugins' libraries into the bundle,
-/// when the platform has one.
-fn tauri_build_command(
-    environment: &BuildEnvironment,
-    target: &str,
-    platform: Platform,
-    sign: bool,
-    plugin_config: Option<&str>,
-) -> CommandSpec {
-    let mut args = vec![environment.tauri_cli.clone().into_os_string()];
-    args.extend(
-        [
-            "build",
-            "--ci",
-            "--target",
-            target,
-            "--bundles",
-            platform.bundle(),
-        ]
-        .map(OsString::from),
-    );
-    if !sign {
-        args.extend(["--config", UNSIGNED_CONFIG].map(OsString::from));
-    }
-    if let Some(config) = plugin_config {
-        args.extend(["--config", config].map(OsString::from));
-    }
-    CommandSpec {
-        program: environment.node.clone(),
-        args,
-        current_dir: environment
-            .workspace_root
-            .join("crates")
-            .join("workshop")
-            .join("desktop"),
-        envs: environment.cargo_envs(),
-        output_mode: OutputMode::Inherit,
-    }
-}
-
-fn node_check_command(environment: &BuildEnvironment) -> CommandSpec {
-    CommandSpec {
-        program: environment.node.clone(),
-        args: vec![OsString::from("--version")],
-        current_dir: environment.workspace_root.clone(),
-        envs: Vec::new(),
-        output_mode: OutputMode::Capture,
-    }
-}
-
-fn remove_directory(path: &Path) -> Result<(), BuildError> {
-    match fs::remove_dir_all(path) {
-        Ok(()) => Ok(()),
-        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()),
-        Err(error) => Err(failure(format!("cannot clear {}: {error}", path.display()))),
-    }
-}
-
-fn failure(message: String) -> BuildError {
-    BuildError {
-        primary: message,
-        cleanup: None,
-    }
-}
diff --git a/crates/build-workshop/src/main/pipeline.rs b/crates/build-workshop/src/main/pipeline.rs
deleted file mode 100644
index 0e11c54c4..000000000
--- a/crates/build-workshop/src/main/pipeline.rs
+++ /dev/null
@@ -1,284 +0,0 @@
-//! The build pipeline: host discovery, product builds, sidecar staging, and cleanup.
-
-use std::ffi::OsString;
-use std::fs;
-use std::io;
-use std::path::Path;
-
-use super::args::valid_target_triple;
-use super::installer::collect::copy_executable;
-use super::sidecar::{self, GatewaySource};
-use super::{
-    BuildEnvironment, BuildError, BuildRequest, CommandRunner, CommandSpec, OutputMode, Profile,
-    StepError, plugin,
-};
-
-pub(super) fn build_workshop(
-    request: &BuildRequest,
-    environment: &BuildEnvironment,
-    runner: &mut impl CommandRunner,
-) -> Result<(), BuildError> {
-    let target = resolve_target(request.target.as_deref(), environment, runner)?;
-    let given = request
-        .gateway_binary
-        .as_deref()
-        .or(environment.gateway_sidecar.as_deref());
-    let source = sidecar::gateway_source(given, &environment.workspace_root, &target)
-        .map_err(StepError::failed)?;
-    if source == (GatewaySource::Staged { stub: true }) {
-        eprintln!(
-            "warning: the Gateway staged at {} is a compile-only stub and cannot run; run \
-             `node tools/fetch-gateway-sidecar.mjs --target {target}` for the pinned release, \
-             or pass --gateway-binary",
-            sidecar::sidecar_path(&environment.workspace_root, &target).display()
-        );
-    }
-    with_staged_sidecar(
-        environment,
-        &target,
-        runner,
-        "Workshop build",
-        &source,
-        |runner| {
-            let mut build = cargo_build_command(environment, request, "workshop");
-            build.envs.extend(source.child_envs());
-            run_checked(runner, &build, "Workshop build")?;
-            let mut profile = environment.target_root.clone();
-            if request.target.is_some() {
-                profile.push(&target);
-            }
-            profile.push(request.profile.directory());
-            // Workshop loads its Plugins from `plugins` beside its own
-            // executable in a development tree.
-            plugin::place(&plugin::built_libraries(&profile, &target), &profile).map_err(
-                |reason| {
-                    StepError::failed(format!(
-                        "cannot place Workshop's Plugins beside it: {reason}"
-                    ))
-                },
-            )?;
-            if sidecar::bundles_sidecar(&target) {
-                return Ok(());
-            }
-            // Workshop finds the Gateway beside its own executable in a
-            // development tree, as tauri-build arranges on Windows.
-            let beside = profile.join(sidecar::gateway_binary_name(&target));
-            let gateway = source.binary(&environment.workspace_root, &target);
-            // Copying a file onto itself would truncate it.
-            if fs::canonicalize(&gateway).ok() == fs::canonicalize(&beside).ok() && beside.exists()
-            {
-                return Ok(());
-            }
-            // A Gateway from an earlier run may still be running from
-            // `beside`, and writing into a running program's file fails on
-            // Linux. A rename replaces the name and leaves that file alone.
-            let fresh = beside.with_extension("new");
-            // One left by a build that stopped mid-copy may be read-only.
-            let _ = fs::remove_file(&fresh);
-            copy_executable(&gateway, &fresh)
-                .and_then(|()| {
-                    fs::rename(&fresh, &beside).map_err(|error| {
-                        format!(
-                            "cannot move {} to {}: {error}",
-                            fresh.display(),
-                            beside.display()
-                        )
-                    })
-                })
-                .map_err(|reason| {
-                    StepError::failed(format!(
-                        "cannot place the Gateway beside Workshop: {reason}"
-                    ))
-                })
-        },
-    )
-}
-
-pub(super) fn resolve_target(
-    target: Option<&str>,
-    environment: &BuildEnvironment,
-    runner: &mut impl CommandRunner,
-) -> Result<String, BuildError> {
-    match target {
-        Some(target) => Ok(target.to_owned()),
-        None => discover_host_target(environment, runner).map_err(BuildError::from),
-    }
-}
-
-/// Runs `build_workshop` (named `workshop_label` in diagnostics). For a
-/// target whose Workshop bundle carries the Gateway and a `source` that
-/// names a binary, it stages that binary as the Tauri sidecar first and
-/// removes it whatever happened, unless a cancel arrived before
-/// anything was staged. A Gateway already staged is used in place and left
-/// there.
-pub(super) fn with_staged_sidecar<R: CommandRunner>(
-    environment: &BuildEnvironment,
-    target: &str,
-    runner: &mut R,
-    workshop_label: &str,
-    source: &GatewaySource,
-    build_workshop: impl FnOnce(&mut R) -> Result<(), StepError>,
-) -> Result<(), BuildError> {
-    let given = match source {
-        GatewaySource::Given(path) if sidecar::bundles_sidecar(target) => path,
-        _ => {
-            build_workshop(runner)?;
-            if runner.cancel_observed() {
-                return Err(canceled_after_completion(workshop_label).into());
-            }
-            return Ok(());
-        }
-    };
-    // Staging over a downloaded Gateway, then removing it, would lose the
-    // download and leave its marker behind.
-    let slot = sidecar::sidecar_path(&environment.workspace_root, target);
-    if slot.exists() {
-        return Err(StepError::failed(format!(
-            "--gateway-binary or {} names a Gateway for {target}, but one is already staged \
-             at {}; remove that file and its .pinned marker, or drop the named Gateway to use \
-             the staged one",
-            sidecar::GATEWAY_SIDECAR_VARIABLE,
-            slot.display()
-        ))
-        .into());
-    }
-    let mut staged = false;
-    let primary = build_around_sidecar(
-        environment,
-        target,
-        runner,
-        &mut staged,
-        given,
-        build_workshop,
-    );
-    let mut primary = match primary {
-        Err(error) if error.canceled && !staged => return Err(error.into()),
-        result => result,
-    };
-    if primary.is_ok() && runner.cancel_observed() {
-        primary = Err(canceled_after_completion(workshop_label));
-    }
-    let cleanup = sidecar::remove(&environment.workspace_root, target)
-        .map(|_| ())
-        .map_err(|error| StepError::failed(format!("Gateway sidecar cleanup failed: {error}")));
-    if primary.is_ok() && cleanup.is_ok() && runner.cancel_observed() {
-        primary = Err(canceled_after_completion(workshop_label));
-    }
-
-    match (primary, cleanup) {
-        (Ok(()), Ok(())) => Ok(()),
-        (Err(error), Ok(())) | (Ok(()), Err(error)) => Err(error.into()),
-        (Err(primary), Err(cleanup)) => Err(BuildError {
-            primary: primary.message,
-            cleanup: Some(cleanup.message),
-        }),
-    }
-}
-
-fn build_around_sidecar<R: CommandRunner>(
-    environment: &BuildEnvironment,
-    target: &str,
-    runner: &mut R,
-    staged: &mut bool,
-    source: &Path,
-    build_workshop: impl FnOnce(&mut R) -> Result<(), StepError>,
-) -> Result<(), StepError> {
-    if runner.cancel_observed() {
-        return Err(StepError {
-            message: "Gateway sidecar staging canceled".to_owned(),
-            canceled: true,
-        });
-    }
-    // A copy that fails partway may leave a file behind, so cleanup counts
-    // from the attempt.
-    *staged = true;
-    sidecar::stage(&environment.workspace_root, target, source)
-        .map_err(|error| StepError::failed(format!("Gateway sidecar staging failed: {error}")))?;
-    build_workshop(runner)
-}
-
-fn canceled_after_completion(workshop_label: &str) -> StepError {
-    StepError {
-        message: format!("{workshop_label} canceled after child completion"),
-        canceled: true,
-    }
-}
-
-fn discover_host_target(
-    environment: &BuildEnvironment,
-    runner: &mut impl CommandRunner,
-) -> Result<String, StepError> {
-    let output = run_checked(
-        runner,
-        &CommandSpec {
-            program: environment.cargo.clone(),
-            args: vec![OsString::from("-vV")],
-            current_dir: environment.workspace_root.clone(),
-            envs: Vec::new(),
-            output_mode: OutputMode::Capture,
-        },
-        "Cargo host discovery",
-    )?;
-    output
-        .lines()
-        .find_map(|line| line.strip_prefix("host: "))
-        .filter(|target| valid_target_triple(target))
-        .map(str::to_owned)
-        .ok_or_else(|| {
-            StepError::failed(
-                "Cargo host triple was absent or malformed in `cargo -vV` output".to_owned(),
-            )
-        })
-}
-
-fn cargo_build_command(
-    environment: &BuildEnvironment,
-    request: &BuildRequest,
-    package: &str,
-) -> CommandSpec {
-    let mut args = vec![
-        OsString::from("build"),
-        OsString::from("-p"),
-        OsString::from(package),
-    ];
-    if request.profile == Profile::Release {
-        args.push(OsString::from("--release"));
-    }
-    if let Some(target) = &request.target {
-        args.push(OsString::from("--target"));
-        args.push(OsString::from(target));
-    }
-    CommandSpec {
-        program: environment.cargo.clone(),
-        args,
-        current_dir: environment.workspace_root.clone(),
-        envs: environment.cargo_envs(),
-        output_mode: OutputMode::Inherit,
-    }
-}
-
-pub(super) fn run_checked(
-    runner: &mut impl CommandRunner,
-    command: &CommandSpec,
-    label: &str,
-) -> Result<String, StepError> {
-    let result = runner.run(command).map_err(|error| {
-        if error.kind() == io::ErrorKind::Interrupted {
-            StepError {
-                message: format!("{label} canceled: {error}"),
-                canceled: true,
-            }
-        } else {
-            StepError::failed(format!("{label} could not start: {error}"))
-        }
-    })?;
-    if result.success {
-        return Ok(result.stdout);
-    }
-    let detail = if result.stderr.trim().is_empty() {
-        String::new()
-    } else {
-        format!(": {}", result.stderr.trim())
-    };
-    Err(StepError::failed(format!("{label} failed{detail}")))
-}
diff --git a/crates/build-workshop/src/main/plugin.rs b/crates/build-workshop/src/main/plugin.rs
deleted file mode 100644
index 7116ca0bc..000000000
--- a/crates/build-workshop/src/main/plugin.rs
+++ /dev/null
@@ -1,187 +0,0 @@
-//! The libraries of the Plugins Workshop ships, the std Plugin's and the
-//! bashkit Plugin's, which Workshop loads from the Plugin directory of
-//! its installation.
-//!
-//! Nothing here builds a library. The Workshop server depends on
-//! `workshop-plugin-std` and `workshop-plugin-bashkit`, so Cargo writes
-//! each library to `deps` in the profile's directory whenever it builds
-//! Workshop, and each mode takes them from there. A build copies them
-//! into `plugins` beside Workshop in the target directory. A macOS or
-//! Linux installer has Tauri copy them into Workshop's bundle, so the
-//! updater, which replaces only that bundle, replaces the libraries with
-//! it. The Windows setup takes them from `deps` itself, in
-//! `crates/workshop/desktop/installer.nsi`.
-
-use std::fs;
-use std::path::{Path, PathBuf};
-
-use crate::installer::System;
-
-// The names Workshop's Plugin directory lookup searches
-// (`crates/workshop/gateway-discovery/src/peer.rs`); a test reads that file
-// and requires the same three.
-/// The Plugin directory's name.
-pub(crate) const PLUGIN_DIR_NAME: &str = "plugins";
-/// The directory that holds the Plugin directory inside the macOS
-/// Workshop bundle, from the bundle's `Contents`.
-pub(crate) const MACOS_PLUGIN_PARENT: &str = "Resources";
-/// The directory that holds the Plugin directory inside the Linux
-/// AppImage, from the root of the AppDir.
-pub(crate) const APPIMAGE_PLUGIN_PARENT: &str = "usr/lib/runvil";
-
-/// The library of each Plugin Workshop ships, as its `workshop-plugin-*`
-/// crate names it: the std Plugin's, which holds the file tools, and the
-/// bashkit Plugin's, which holds the shell. `installer.nsi` and the two
-/// scripts in `.github/installers` name the same two.
-pub(crate) const LIBRARIES: [&str; 2] = ["plugin_std", "plugin_bashkit"];
-
-/// The file name Cargo gives each shipped library for `target`, in the
-/// order of [`LIBRARIES`].
-pub(crate) fn library_names(target: &str) -> Vec<String> {
-    let has = |part: &str| target.split('-').any(|word| word == part);
-    LIBRARIES
-        .iter()
-        .map(|library| {
-            if has("windows") {
-                format!("{library}.dll")
-            } else if has("apple") {
-                format!("lib{library}.dylib")
-            } else {
-                format!("lib{library}.so")
-            }
-        })
-        .collect()
-}
-
-/// Where Cargo writes each shipped library when it builds Workshop for
-/// `target` into `profile_dir`.
-pub(crate) fn built_libraries(profile_dir: &Path, target: &str) -> Vec<PathBuf> {
-    library_names(target)
-        .into_iter()
-        .map(|name| profile_dir.join("deps").join(name))
-        .collect()
-}
-
-/// Where Workshop's bundle for `system` keeps the library named `name`,
-/// both with `/` between their segments: the tree Tauri leaves under the
-/// bundle's own directory, and the library's path inside that tree. The
-/// tree is `Contents` in the macOS bundle and the AppDir on Linux. `None`
-/// for Windows, which has no bundle.
-fn bundled(system: System, name: &str) -> Option<(&'static str, String)> {
-    let (tree, parent) = match system {
-        System::Windows => return None,
-        System::MacOs => ("Runvil.app/Contents", MACOS_PLUGIN_PARENT),
-        System::Linux => ("Runvil.AppDir", APPIMAGE_PLUGIN_PARENT),
-    };
-    Some((tree, format!("{parent}/{PLUGIN_DIR_NAME}/{name}")))
-}
-
-/// The Tauri configuration, as JSON text for `--config`, that copies each
-/// of `libraries` into Workshop's bundle for `system`. `Ok(None)` for
-/// Windows, whose setup installs the libraries itself.
-///
-/// The bundler copies these files after Cargo has built Workshop, so the
-/// libraries exist by then. Tauri's `bundle.resources` would not do: the
-/// desktop crate's build script checks that each resource exists, and it
-/// runs before Cargo has built the libraries.
-pub(crate) fn bundle_config(
-    system: System,
-    libraries: &[PathBuf],
-) -> Result<Option<String>, String> {
-    let mut files = serde_json::Map::new();
-    for library in libraries {
-        let name = library
-            .file_name()
-            .and_then(|name| name.to_str())
-            .ok_or_else(|| format!("{} names no file", library.display()))?;
-        let Some((_, inside)) = bundled(system, name) else {
-            return Ok(None);
-        };
-        let source = library
-            .to_str()
-            .ok_or_else(|| format!("{} is not UTF-8", library.display()))?;
-        // Tauri takes a macOS path from `Contents`, and an AppImage path
-        // from the root of the AppDir, written as an absolute path.
-        let inside = if system == System::MacOs {
-            inside
-        } else {
-            format!("/{inside}")
-        };
-        files.insert(inside, source.into());
-    }
-    let files = if system == System::MacOs {
-        serde_json::json!({ "macOS": { "files": files } })
-    } else {
-        serde_json::json!({ "linux": { "appimage": { "files": files } } })
-    };
-    Ok(Some(serde_json::json!({ "bundle": files }).to_string()))
-}
-
-/// Checks that the bundle Tauri built for `system` holds each library of
-/// `names`. `bundle` is the bundle's own directory under `release/bundle`.
-///
-/// # Errors
-/// Returns the first path that is missing. A Tauri CLI that ignored the
-/// configuration of [`bundle_config`] would otherwise ship a Workshop
-/// with no file tools or no shell.
-pub(crate) fn check_bundled(system: System, bundle: &Path, names: &[String]) -> Result<(), String> {
-    for name in names {
-        let Some((tree, inside)) = bundled(system, name) else {
-            return Ok(());
-        };
-        let library = tree
-            .split('/')
-            .chain(inside.split('/'))
-            .fold(bundle.to_path_buf(), |path, segment| path.join(segment));
-        if !library.is_file() {
-            return Err(format!(
-                "the Workshop bundle lacks a Plugin's library: {} is missing after the Tauri build",
-                library.display()
-            ));
-        }
-    }
-    Ok(())
-}
-
-/// Copies each of `libraries` into the Plugin directory in `beside`,
-/// which it makes when it is missing. A library that is missing places
-/// none of them.
-pub(crate) fn place(libraries: &[PathBuf], beside: &Path) -> Result<(), String> {
-    if let Some(missing) = libraries.iter().find(|library| !library.is_file()) {
-        return Err(format!(
-            "{} is missing; a Workshop build writes it, because the server depends on the \
-             `workshop-plugin-*` crate that exports it",
-            missing.display()
-        ));
-    }
-    let directory = beside.join(PLUGIN_DIR_NAME);
-    fs::create_dir_all(&directory)
-        .map_err(|error| format!("cannot create {}: {error}", directory.display()))?;
-    for library in libraries {
-        let name = library
-            .file_name()
-            .ok_or_else(|| format!("{} names no file", library.display()))?;
-        let placed = directory.join(name);
-        // A Workshop from an earlier run may still have the library
-        // loaded, and writing into a loaded library's file crashes that
-        // process on Linux. A rename replaces the name and leaves that
-        // file alone.
-        let fresh = placed.with_extension("new");
-        let _ = fs::remove_file(&fresh);
-        fs::copy(library, &fresh).map_err(|error| {
-            format!(
-                "cannot copy {} to {}: {error}",
-                library.display(),
-                fresh.display()
-            )
-        })?;
-        fs::rename(&fresh, &placed).map_err(|error| {
-            format!(
-                "cannot move {} to {}: {error}",
-                fresh.display(),
-                placed.display()
-            )
-        })?;
-    }
-    Ok(())
-}
diff --git a/crates/build-workshop/src/main/sidecar.rs b/crates/build-workshop/src/main/sidecar.rs
deleted file mode 100644
index 6d4bc260c..000000000
--- a/crates/build-workshop/src/main/sidecar.rs
+++ /dev/null
@@ -1,209 +0,0 @@
-//! The Gateway a build ships, and the sidecar slot Tauri's `externalBin`
-//! bundles it from for Windows targets (`tauri.windows.conf.json`). macOS
-//! and Linux ship the Gateway beside Workshop instead of inside it.
-//!
-//! The Gateway is its own product in `cppalliance/runvil-gateway`, so
-//! nothing here compiles it. It comes from `--gateway-binary`, then the
-//! `RUNVIL_GATEWAY_SIDECAR` environment variable, then the slot, where
-//! `tools/fetch-gateway-sidecar.mjs` stages the release
-//! `gateway-pin/pin.json` names for any target.
-
-use std::ffi::OsString;
-use std::fs;
-use std::io;
-use std::path::{Path, PathBuf};
-
-/// The environment variable naming a Gateway binary, so a CI job can point
-/// a build at one without passing a flag. The desktop build script reads it
-/// too.
-pub(super) const GATEWAY_SIDECAR_VARIABLE: &str = "RUNVIL_GATEWAY_SIDECAR";
-
-/// Where this run's Gateway comes from.
-#[derive(Debug, Eq, PartialEq)]
-pub(super) enum GatewaySource {
-    /// A binary `--gateway-binary` or `RUNVIL_GATEWAY_SIDECAR` named. A
-    /// Windows build stages it in the slot and removes it afterward.
-    Given(PathBuf),
-    /// The binary already in the slot, used in place and left there, so a
-    /// downloaded Gateway serves every later build. `stub` is true when
-    /// `tools/fetch-gateway-sidecar.mjs --stub` staged a compile-only file.
-    Staged { stub: bool },
-}
-
-impl GatewaySource {
-    /// The Gateway executable this source names for `target`.
-    pub(super) fn binary(&self, workspace_root: &Path, target: &str) -> PathBuf {
-        match self {
-            Self::Given(path) => path.clone(),
-            Self::Staged { .. } => sidecar_path(workspace_root, target),
-        }
-    }
-
-    /// The environment a Workshop build gets for this source. The desktop
-    /// build script copies the file `RUNVIL_GATEWAY_SIDECAR` names into the
-    /// sidecar slot, and a child inherits that variable, so a given Gateway
-    /// is named there too: otherwise an inherited value would replace the
-    /// `--gateway-binary` file this run checked and staged.
-    pub(super) fn child_envs(&self) -> Vec<(OsString, OsString)> {
-        match self {
-            Self::Given(path) => vec![(
-                OsString::from(GATEWAY_SIDECAR_VARIABLE),
-                path.clone().into_os_string(),
-            )],
-            Self::Staged { .. } => Vec::new(),
-        }
-    }
-}
-
-/// Chooses the Gateway for `target`: `given` when a flag or the variable
-/// named one, else the staged slot. With neither, the error names the fetch
-/// script.
-pub(super) fn gateway_source(
-    given: Option<&Path>,
-    workspace_root: &Path,
-    target: &str,
-) -> Result<GatewaySource, String> {
-    if let Some(path) = given {
-        // One absolute path serves every later use: the version check, the
-        // copies, and the desktop build script each run from a different
-        // directory, and a bare name would otherwise resolve through PATH.
-        let path = std::path::absolute(path)
-            .map_err(|error| format!("cannot resolve the Gateway {}: {error}", path.display()))?;
-        if !path.is_file() {
-            return Err(format!(
-                "--gateway-binary or {GATEWAY_SIDECAR_VARIABLE} names the Gateway {}, which is \
-                 not a file",
-                path.display()
-            ));
-        }
-        return Ok(GatewaySource::Given(path));
-    }
-    let staged = sidecar_path(workspace_root, target);
-    if !staged.is_file() {
-        return Err(format!(
-            "no Gateway for {target}: nothing is staged at {} and neither --gateway-binary nor \
-             {GATEWAY_SIDECAR_VARIABLE} names one; the Gateway is a separate product, so run \
-             `node tools/fetch-gateway-sidecar.mjs --target {target}` to stage the release \
-             gateway-pin/pin.json names",
-            staged.display()
-        ));
-    }
-    Ok(GatewaySource::Staged {
-        stub: marker_says_stub(&staged),
-    })
-}
-
-/// Whether the fetch script's marker beside `staged` records a stub. A
-/// missing or unreadable marker means some other step staged the file, and
-/// it counts as a real Gateway.
-fn marker_says_stub(staged: &Path) -> bool {
-    let mut marker = staged.as_os_str().to_owned();
-    marker.push(".pinned");
-    let Ok(text) = fs::read_to_string(PathBuf::from(marker)) else {
-        return false;
-    };
-    // The marker is the fetch script's JSON; a substring check is enough.
-    text.contains("\"kind\": \"stub\"") || text.contains("\"kind\":\"stub\"")
-}
-
-/// The Gateway version `gateway-pin/pin.json` names, the one every
-/// installer ships.
-pub(super) fn pinned_version(workspace_root: &Path) -> Result<String, String> {
-    let pin = workspace_root.join("gateway-pin").join("pin.json");
-    let text = fs::read_to_string(&pin)
-        .map_err(|error| format!("cannot read the Gateway pin {}: {error}", pin.display()))?;
-    let value: serde_json::Value = serde_json::from_str(&text)
-        .map_err(|error| format!("the Gateway pin {} is not JSON: {error}", pin.display()))?;
-    match value.get("version").and_then(serde_json::Value::as_str) {
-        Some(version) if !version.is_empty() && version != "PLACEHOLDER" => Ok(version.to_owned()),
-        _ => Err(format!(
-            "the Gateway pin {} names no version; run `node tools/bump-gateway.mjs <tag>` to \
-             fill it from a published Gateway release",
-            pin.display()
-        )),
-    }
-}
-
-pub(super) fn gateway_binary_name(target: &str) -> &'static str {
-    if is_windows(target) {
-        "runvil-gateway.exe"
-    } else {
-        "runvil-gateway"
-    }
-}
-
-/// Whether Workshop's bundle for `target` carries the Gateway sidecar.
-pub(super) fn bundles_sidecar(target: &str) -> bool {
-    is_windows(target)
-}
-
-/// Tauri resolves `externalBin` entries with the target triple appended to
-/// the file stem.
-pub(super) fn sidecar_path(workspace_root: &Path, target: &str) -> PathBuf {
-    let extension = if is_windows(target) { ".exe" } else { "" };
-    workspace_root
-        .join("crates")
-        .join("workshop")
-        .join("desktop")
-        .join("binaries")
-        .join(format!("runvil-gateway-{target}{extension}"))
-}
-
-pub(super) fn stage(workspace_root: &Path, target: &str, source: &Path) -> Result<PathBuf, String> {
-    let metadata = match fs::metadata(source) {
-        Ok(metadata) => metadata,
-        Err(error) if error.kind() == io::ErrorKind::NotFound => {
-            return Err(format!(
-                "Gateway source binary does not exist: {}",
-                source.display()
-            ));
-        }
-        Err(error) => {
-            return Err(format!(
-                "Gateway source binary {} cannot be read: {error}",
-                source.display()
-            ));
-        }
-    };
-    if !metadata.is_file() {
-        return Err(format!(
-            "Gateway source binary is not a file: {}",
-            source.display()
-        ));
-    }
-    let expected = gateway_binary_name(target);
-    if source.file_name().and_then(|name| name.to_str()) != Some(expected) {
-        return Err(format!(
-            "Gateway source binary must be named {expected} for {target}, got {}",
-            source.display()
-        ));
-    }
-    let destination = sidecar_path(workspace_root, target);
-    if let Some(parent) = destination.parent() {
-        fs::create_dir_all(parent)
-            .map_err(|error| format!("cannot create {}: {error}", parent.display()))?;
-    }
-    fs::copy(source, &destination).map_err(|error| {
-        format!(
-            "cannot copy {} to {}: {error}",
-            source.display(),
-            destination.display()
-        )
-    })?;
-    Ok(destination)
-}
-
-/// Removing a sidecar that was never staged succeeds, so cleanup can run
-/// after any failure.
-pub(super) fn remove(workspace_root: &Path, target: &str) -> Result<PathBuf, String> {
-    let path = sidecar_path(workspace_root, target);
-    match fs::remove_file(&path) {
-        Ok(()) => Ok(path),
-        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(path),
-        Err(error) => Err(format!("cannot remove {}: {error}", path.display())),
-    }
-}
-
-fn is_windows(target: &str) -> bool {
-    target.split('-').any(|part| part == "windows")
-}
diff --git a/crates/build-workshop/src/main/tests.rs b/crates/build-workshop/src/main/tests.rs
deleted file mode 100644
index a4d3572e8..000000000
--- a/crates/build-workshop/src/main/tests.rs
+++ /dev/null
@@ -1,470 +0,0 @@
-//! Unit tests for the build command sequence, with the fake runner and
-//! test workspace every mode's tests share.
-
-use std::collections::VecDeque;
-use std::path::Path;
-
-use tempfile::TempDir;
-
-use super::*;
-use args::InstallerRequest;
-
-#[path = "tests/args.rs"]
-mod args_tests;
-#[path = "tests/bundle.rs"]
-mod bundle_tests;
-#[path = "tests/collect.rs"]
-mod collect_tests;
-#[path = "tests/failures.rs"]
-mod failures;
-#[path = "tests/gateway.rs"]
-mod gateway_tests;
-#[path = "tests/ifw.rs"]
-mod ifw_tests;
-#[path = "tests/installer.rs"]
-mod installer_tests;
-#[path = "tests/plugin.rs"]
-mod plugin_tests;
-#[path = "tests/sidecar.rs"]
-mod sidecar_tests;
-#[path = "tests/stage.rs"]
-mod stage_tests;
-
-enum FakeResponse {
-    Completed(CommandResult),
-    CompletedAndCanceled,
-    CanceledBeforeStart,
-    CanceledAfterStart,
-    SpawnFailed(io::ErrorKind, &'static str),
-    /// Runs the effect, standing in for what the real child does to the
-    /// filesystem, then answers with the inner response.
-    Act(Box<dyn FnOnce()>, Box<FakeResponse>),
-}
-
-impl fmt::Debug for FakeResponse {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Completed(result) => write!(formatter, "Completed({result:?})"),
-            Self::CompletedAndCanceled => formatter.write_str("CompletedAndCanceled"),
-            Self::CanceledBeforeStart => formatter.write_str("CanceledBeforeStart"),
-            Self::CanceledAfterStart => formatter.write_str("CanceledAfterStart"),
-            Self::SpawnFailed(kind, message) => {
-                write!(formatter, "SpawnFailed({kind:?}, {message})")
-            }
-            Self::Act(_, response) => write!(formatter, "Act({response:?})"),
-        }
-    }
-}
-
-#[derive(Debug, Default)]
-struct FakeRunner {
-    responses: VecDeque<FakeResponse>,
-    commands: Vec<CommandSpec>,
-    cancel_observed: bool,
-}
-
-impl FakeRunner {
-    fn with_responses(responses: Vec<FakeResponse>) -> Self {
-        Self {
-            responses: responses.into(),
-            commands: Vec::new(),
-            cancel_observed: false,
-        }
-    }
-
-    fn answer(&mut self, response: FakeResponse) -> io::Result<CommandResult> {
-        match response {
-            FakeResponse::Completed(result) => Ok(result),
-            FakeResponse::CompletedAndCanceled => {
-                self.cancel_observed = true;
-                Ok(CommandResult {
-                    success: true,
-                    stdout: String::new(),
-                    stderr: String::new(),
-                })
-            }
-            FakeResponse::CanceledBeforeStart | FakeResponse::CanceledAfterStart => {
-                self.cancel_observed = true;
-                Err(io::Error::new(io::ErrorKind::Interrupted, "canceled"))
-            }
-            FakeResponse::SpawnFailed(kind, message) => Err(io::Error::new(kind, message)),
-            FakeResponse::Act(effect, response) => {
-                effect();
-                self.answer(*response)
-            }
-        }
-    }
-}
-
-impl CommandRunner for FakeRunner {
-    fn run(&mut self, command: &CommandSpec) -> io::Result<CommandResult> {
-        self.commands.push(command.clone());
-        if self.cancel_observed {
-            return Err(io::Error::new(
-                io::ErrorKind::Interrupted,
-                "canceled before child start",
-            ));
-        }
-        let response = self.responses.pop_front().expect("unexpected command");
-        self.answer(response)
-    }
-
-    fn cancel_observed(&self) -> bool {
-        self.cancel_observed
-    }
-}
-
-fn success(stdout: &str) -> FakeResponse {
-    FakeResponse::Completed(CommandResult {
-        success: true,
-        stdout: stdout.to_owned(),
-        stderr: String::new(),
-    })
-}
-
-fn failure(stderr: &str) -> FakeResponse {
-    FakeResponse::Completed(CommandResult {
-        success: false,
-        stdout: String::new(),
-        stderr: stderr.to_owned(),
-    })
-}
-
-fn act(effect: impl FnOnce() + 'static, response: FakeResponse) -> FakeResponse {
-    FakeResponse::Act(Box::new(effect), Box::new(response))
-}
-
-/// A Workshop build that asserts the sidecar is staged while it runs.
-fn workshop_built_with_sidecar(sidecar: PathBuf, response: FakeResponse) -> FakeResponse {
-    act(
-        move || assert!(sidecar.is_file(), "sidecar not staged during the build"),
-        response,
-    )
-}
-
-/// A Workshop build that asserts no sidecar is staged while it runs.
-fn workshop_built_without_sidecar(sidecar: PathBuf, response: FakeResponse) -> FakeResponse {
-    act(
-        move || assert!(!sidecar.exists(), "sidecar staged for a target without one"),
-        response,
-    )
-}
-
-/// A Workshop build that creates its profile directory, as Cargo does, so
-/// a macOS or Linux build can copy the Gateway beside Workshop.
-fn workshop_built_into(profile: PathBuf, response: FakeResponse) -> FakeResponse {
-    act(
-        move || write_file(&profile.join("runvil-workshop"), b"workshop"),
-        response,
-    )
-}
-
-fn repository_root() -> PathBuf {
-    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .and_then(Path::parent)
-        .expect("repository root")
-        .to_path_buf()
-}
-
-/// What the shipped library `library`, one of [`plugin::LIBRARIES`],
-/// holds in a test, as Cargo built it in `profile` for the named
-/// `target`, or for the host when no target is named. Each library's and
-/// each build's differs, so a test shows which one was placed.
-fn plugin_bytes(library: &str, target: Option<&str>, profile: &str) -> Vec<u8> {
-    format!(
-        "{library} for {} in {profile}",
-        target.unwrap_or("the host")
-    )
-    .into_bytes()
-}
-
-fn write_file(path: &Path, contents: &[u8]) {
-    std::fs::create_dir_all(path.parent().expect("parent")).expect("parent directory");
-    std::fs::write(path, contents).expect("write file");
-}
-
-struct TestEnvironment {
-    temp: TempDir,
-    environment: BuildEnvironment,
-}
-
-impl TestEnvironment {
-    fn sidecar(&self, target: &str) -> PathBuf {
-        sidecar::sidecar_path(&self.environment.workspace_root, target)
-    }
-
-    /// Stages a release Gateway in `target`'s slot with the fetch script's
-    /// marker, as `tools/fetch-gateway-sidecar.mjs` leaves it.
-    fn stage_gateway(&self, target: &str) -> PathBuf {
-        self.stage_gateway_kind(target, "release")
-    }
-
-    /// Stages `tools/fetch-gateway-sidecar.mjs --stub`'s compile-only file.
-    fn stage_stub(&self, target: &str) -> PathBuf {
-        self.stage_gateway_kind(target, "stub")
-    }
-
-    /// Writes each shipped Plugin's library where Cargo leaves it
-    /// whenever it builds Workshop for `target`, in either profile, with
-    /// the target named or left to the host. Each of the four builds'
-    /// libraries holds its own [`plugin_bytes`]. No fake build writes a
-    /// file of its own, and every test that builds Workshop names its
-    /// Gateway first, so the Gateway helpers call this.
-    fn leave_plugins(&self, target: &str) {
-        let root = &self.environment.target_root;
-        for (base, named) in [(root.clone(), None), (root.join(target), Some(target))] {
-            for profile in ["debug", "release"] {
-                let built = plugin::built_libraries(&base.join(profile), target);
-                for (library, path) in plugin::LIBRARIES.iter().zip(built) {
-                    write_file(&path, &plugin_bytes(library, named, profile));
-                }
-            }
-        }
-    }
-
-    /// Removes the library `library`, one of [`plugin::LIBRARIES`], that
-    /// [`leave_plugins`](Self::leave_plugins) wrote, as a build that
-    /// never compiled it leaves things.
-    fn lose_plugin(&self, target: &str, library: &str) {
-        let root = &self.environment.target_root;
-        for base in [root.clone(), root.join(target)] {
-            for profile in ["debug", "release"] {
-                let built = plugin::built_libraries(&base.join(profile), target);
-                for (name, path) in plugin::LIBRARIES.iter().zip(built) {
-                    if *name == library {
-                        let _ = std::fs::remove_file(path);
-                    }
-                }
-            }
-        }
-    }
-
-    fn stage_gateway_kind(&self, target: &str, kind: &str) -> PathBuf {
-        self.leave_plugins(target);
-        let slot = self.sidecar(target);
-        write_file(&slot, b"gateway");
-        let mut marker = slot.clone().into_os_string();
-        marker.push(".pinned");
-        write_file(
-            Path::new(&marker),
-            format!("{{\n  \"kind\": \"{kind}\"\n}}\n").as_bytes(),
-        );
-        slot
-    }
-
-    /// A Gateway binary outside the slot, as `--gateway-binary` or
-    /// `RUNVIL_GATEWAY_SIDECAR` names one.
-    fn given_gateway(&self, target: &str) -> PathBuf {
-        self.leave_plugins(target);
-        let path = self
-            .temp
-            .path()
-            .join("given")
-            .join(sidecar::gateway_binary_name(target));
-        write_file(&path, b"given gateway");
-        path
-    }
-
-    /// Writes `gateway-pin/pin.json` naming `version`.
-    fn pin(&self, version: &str) {
-        let pin = self
-            .environment
-            .workspace_root
-            .join("gateway-pin")
-            .join("pin.json");
-        write_file(
-            &pin,
-            serde_json::json!({ "version": version })
-                .to_string()
-                .as_bytes(),
-        );
-    }
-}
-
-/// The Gateway version the test workspace's pin names, apart from
-/// Workshop's own so a test can tell the two apart.
-const GATEWAY_VERSION: &str = "0.9.3";
-
-fn environment() -> TestEnvironment {
-    let temp = tempfile::tempdir().expect("temporary workspace");
-    let workspace_root = temp.path().join("repo");
-    let target_root = temp.path().join("cargo-target");
-    let tauri_cli = temp.path().join("tauri-cli").join("tauri.js");
-    std::fs::create_dir_all(&workspace_root).expect("workspace root");
-    write_file(&tauri_cli, b"");
-    let sources = installer::bundle::BundleSources::in_workspace(&repository_root());
-    let copies = installer::bundle::BundleSources::in_workspace(&workspace_root);
-    for (source, copy) in [
-        (sources.info_plist, copies.info_plist),
-        (sources.icon, copies.icon),
-    ] {
-        write_file(&copy, &std::fs::read(source).expect("bundle source"));
-    }
-    ifw_tests::copy_sources(&repository_root(), &workspace_root);
-    let qtifw_dir = Some(ifw_tests::fake_ifw(temp.path()).into_os_string());
-    let test_environment = TestEnvironment {
-        temp,
-        environment: BuildEnvironment {
-            workspace_root,
-            target_root,
-            target_root_from_env: true,
-            cargo: PathBuf::from("selected-cargo"),
-            node: PathBuf::from("selected-node"),
-            tauri_cli,
-            signing_key: None,
-            gateway_sidecar: None,
-            qtifw_dir,
-            path: None,
-            release_date: "2026-10-11".to_owned(),
-        },
-    };
-    test_environment.pin(GATEWAY_VERSION);
-    test_environment
-}
-
-fn strings(values: &[&str]) -> Vec<OsString> {
-    values.iter().map(OsString::from).collect()
-}
-
-fn command(
-    environment: &BuildEnvironment,
-    program: &str,
-    args: &[&str],
-    output_mode: OutputMode,
-) -> CommandSpec {
-    CommandSpec {
-        program: PathBuf::from(program),
-        args: strings(args),
-        current_dir: environment.workspace_root.clone(),
-        envs: Vec::new(),
-        output_mode,
-    }
-}
-
-/// The environment a child that runs Cargo gets: the test target root
-/// stands in for an absolute `CARGO_TARGET_DIR`.
-fn target_root_env(environment: &BuildEnvironment) -> Vec<(OsString, OsString)> {
-    vec![(
-        OsString::from("CARGO_TARGET_DIR"),
-        environment.target_root.clone().into_os_string(),
-    )]
-}
-
-/// A Cargo build, which runs with the absolute target root.
-fn cargo_build(environment: &BuildEnvironment, args: &[&str]) -> CommandSpec {
-    CommandSpec {
-        envs: target_root_env(environment),
-        ..command(environment, "selected-cargo", args, OutputMode::Inherit)
-    }
-}
-
-/// Sets the key the release secrets set.
-fn set_signing_key(environment: &mut BuildEnvironment) {
-    environment.signing_key = Some(OsString::from("dW50cnVzdGVkIGNvbW1lbnQ6"));
-}
-
-#[test]
-fn default_build_derives_host_and_uses_the_staged_gateway_in_place() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![
-        success("cargo 1.89.0\nhost: x86_64-pc-windows-msvc\n"),
-        workshop_built_with_sidecar(staged.clone(), success("")),
-    ]);
-
-    build_workshop(
-        &BuildRequest {
-            profile: Profile::Debug,
-            target: None,
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    assert_eq!(
-        runner.commands,
-        vec![
-            command(environment, "selected-cargo", &["-vV"], OutputMode::Capture),
-            cargo_build(environment, &["build", "-p", "workshop"]),
-        ]
-    );
-    assert!(staged.is_file(), "a staged Gateway must outlive the build");
-    // Windows carries the Gateway inside Workshop, never beside it.
-    assert!(
-        !environment
-            .target_root
-            .join("debug")
-            .join("runvil-gateway.exe")
-            .exists()
-    );
-}
-
-#[test]
-fn explicit_linux_release_target_copies_the_gateway_beside_workshop() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "aarch64-unknown-linux-gnu";
-    let staged = test_environment.stage_gateway(triple);
-    let profile = environment.target_root.join(triple).join("release");
-    let mut runner =
-        FakeRunner::with_responses(vec![workshop_built_into(profile.clone(), success(""))]);
-
-    build_workshop(
-        &BuildRequest {
-            profile: Profile::Release,
-            target: Some(triple.to_owned()),
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    assert_eq!(
-        runner.commands,
-        vec![cargo_build(
-            environment,
-            &["build", "-p", "workshop", "--release", "--target", triple]
-        )]
-    );
-    assert_eq!(
-        std::fs::read(profile.join("runvil-gateway")).expect("Gateway beside Workshop"),
-        b"gateway"
-    );
-    assert!(staged.is_file(), "a staged Gateway must outlive the build");
-}
-
-#[test]
-fn a_target_root_from_cargo_configuration_is_left_to_cargo() {
-    let mut test_environment = environment();
-    test_environment.environment.target_root_from_env = false;
-    let environment = &test_environment.environment;
-    let triple = "aarch64-unknown-linux-gnu";
-    test_environment.stage_gateway(triple);
-    let profile = environment.target_root.join(triple).join("release");
-    let mut runner = FakeRunner::with_responses(vec![workshop_built_into(profile, success(""))]);
-
-    build_workshop(
-        &BuildRequest {
-            profile: Profile::Release,
-            target: Some(triple.to_owned()),
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    assert_eq!(runner.commands.len(), 1);
-    assert!(
-        runner
-            .commands
-            .iter()
-            .all(|command| command.envs.is_empty())
-    );
-}
diff --git a/crates/build-workshop/src/main/tests/failures.rs b/crates/build-workshop/src/main/tests/failures.rs
deleted file mode 100644
index c48e5f885..000000000
--- a/crates/build-workshop/src/main/tests/failures.rs
+++ /dev/null
@@ -1,378 +0,0 @@
-//! Unit tests for failure, cancellation, and sidecar cleanup paths of both
-//! modes. A given Gateway exercises the Windows staging and cleanup.
-
-use super::ifw_tests::ifw_found;
-use super::installer_tests::{bundled, node_found, output, request, version_printed};
-use super::*;
-
-/// A debug build for `target` with a Gateway given from outside the slot,
-/// which Windows targets stage for the build and remove after.
-fn given_request(target: &str, gateway: PathBuf) -> BuildRequest {
-    BuildRequest {
-        profile: Profile::Debug,
-        target: Some(target.to_owned()),
-        gateway_binary: Some(gateway),
-    }
-}
-
-/// Stands in for a file the cleanup cannot remove: a directory with content
-/// at the sidecar's path.
-fn block_sidecar_removal(sidecar: PathBuf) -> impl FnOnce() {
-    move || {
-        std::fs::remove_file(&sidecar).expect("remove the staged sidecar");
-        write_file(&sidecar.join("held"), b"held");
-    }
-}
-
-#[test]
-fn workshop_failure_is_primary_when_cleanup_also_fails() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![act(
-        block_sidecar_removal(test_environment.sidecar(triple)),
-        failure("workshop broke"),
-    )]);
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("Workshop and cleanup failure");
-
-    assert!(error.primary.contains("Workshop build failed"), "{error}");
-    assert!(error.primary.contains("workshop broke"), "{error}");
-    let cleanup = error.cleanup.expect("separate cleanup failure");
-    assert!(
-        cleanup.contains("Gateway sidecar cleanup failed"),
-        "{cleanup}"
-    );
-    assert!(cleanup.contains("cannot remove"), "{cleanup}");
-}
-
-#[test]
-fn a_missing_given_gateway_fails_before_any_build_and_stages_nothing() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "aarch64-pc-windows-msvc";
-    let missing = environment.target_root.join("runvil-gateway.exe");
-    let mut runner = FakeRunner::default();
-
-    let error = build_workshop(
-        &given_request(triple, missing.clone()),
-        environment,
-        &mut runner,
-    )
-    .expect_err("a missing Gateway");
-
-    assert!(error.primary.contains("which is not a file"), "{error}");
-    assert!(
-        error.primary.contains(&missing.display().to_string()),
-        "{error}"
-    );
-    assert!(runner.commands.is_empty());
-    assert!(!test_environment.sidecar(triple).exists());
-}
-
-#[test]
-fn cancellation_before_staging_stages_nothing() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(triple);
-    let mut runner = FakeRunner {
-        cancel_observed: true,
-        ..FakeRunner::default()
-    };
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("pre-staging cancellation");
-
-    assert!(
-        error.primary.contains("Gateway sidecar staging canceled"),
-        "{error}"
-    );
-    assert_eq!(error.cleanup, None);
-    assert!(runner.commands.is_empty());
-    assert!(!test_environment.sidecar(triple).exists());
-}
-
-#[test]
-fn cancellation_raced_with_completion_removes_the_sidecar() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![workshop_built_with_sidecar(
-        test_environment.sidecar(triple),
-        FakeResponse::CompletedAndCanceled,
-    )]);
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("Workshop completion race");
-
-    assert!(
-        error
-            .primary
-            .contains("Workshop build canceled after child completion"),
-        "{error}"
-    );
-    assert!(!test_environment.sidecar(triple).exists());
-}
-
-#[test]
-fn cancellation_raced_with_completion_fails_a_build_without_a_sidecar() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-unknown-linux-gnu";
-    let given = test_environment.given_gateway(triple);
-    let profile = environment.target_root.join(triple).join("debug");
-    let mut runner = FakeRunner::with_responses(vec![workshop_built_without_sidecar(
-        test_environment.sidecar(triple),
-        workshop_built_into(profile, FakeResponse::CompletedAndCanceled),
-    )]);
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("Workshop completion race");
-
-    assert!(
-        error
-            .primary
-            .contains("Workshop build canceled after child completion"),
-        "{error}"
-    );
-    assert_eq!(error.cleanup, None);
-}
-
-#[test]
-fn cancellation_preserves_cleanup_failure_diagnostics() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![act(
-        block_sidecar_removal(test_environment.sidecar(triple)),
-        FakeResponse::CanceledAfterStart,
-    )]);
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("Workshop cancellation and cleanup failure");
-
-    assert!(error.primary.contains("Workshop build canceled"), "{error}");
-    let cleanup = error.cleanup.expect("cleanup diagnostic");
-    assert!(
-        cleanup.contains("Gateway sidecar cleanup failed"),
-        "{cleanup}"
-    );
-}
-
-#[test]
-fn cleanup_failure_after_success_fails_the_command_clearly() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![act(
-        block_sidecar_removal(test_environment.sidecar(triple)),
-        success(""),
-    )]);
-
-    let error = build_workshop(&given_request(triple, given), environment, &mut runner)
-        .expect_err("cleanup failure");
-
-    assert!(
-        error.primary.contains("Gateway sidecar cleanup failed"),
-        "{error}"
-    );
-    assert_eq!(error.cleanup, None);
-}
-
-#[test]
-fn malformed_host_output_fails_before_building() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let mut runner = FakeRunner::with_responses(vec![success("cargo 1.89.0\n")]);
-
-    let error = build_workshop(
-        &BuildRequest {
-            profile: Profile::Debug,
-            target: None,
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect_err("missing host");
-
-    assert!(error.primary.contains("Cargo host triple"), "{error}");
-    assert_eq!(runner.commands.len(), 1);
-}
-
-#[test]
-fn a_gateway_other_than_the_pinned_release_fails_naming_the_pin() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(target);
-    let mut runner =
-        FakeRunner::with_responses(vec![node_found(), success("runvil-gateway 0.0.1\n")]);
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("version mismatch");
-
-    assert!(
-        error.primary.contains("printed `runvil-gateway 0.0.1`"),
-        "{error}"
-    );
-    assert!(
-        error
-            .primary
-            .contains(&format!("expected `runvil-gateway {GATEWAY_VERSION}`")),
-        "{error}"
-    );
-    assert!(error.primary.contains("gateway-pin/pin.json"), "{error}");
-    assert_eq!(runner.commands.len(), 2);
-    assert!(staged.is_file(), "a staged Gateway must outlive the build");
-}
-
-#[test]
-fn a_failed_version_check_stops_before_the_bundle() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "aarch64-pc-windows-msvc";
-    test_environment.stage_gateway(target);
-    let mut runner =
-        FakeRunner::with_responses(vec![node_found(), failure("bad CPU type in executable")]);
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("version check failure");
-
-    assert!(
-        error
-            .primary
-            .contains("Gateway version check failed: bad CPU type in executable"),
-        "{error}"
-    );
-    assert_eq!(runner.commands.len(), 2);
-}
-
-#[test]
-fn cancellation_before_the_version_check_runs_no_bundle_and_keeps_the_staged_gateway() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(target);
-    let mut runner =
-        FakeRunner::with_responses(vec![node_found(), FakeResponse::CanceledBeforeStart]);
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("version check cancellation");
-
-    assert!(
-        error.primary.contains("Gateway version check canceled"),
-        "{error}"
-    );
-    assert_eq!(runner.commands.len(), 2);
-    assert!(staged.is_file());
-}
-
-#[test]
-fn a_failed_unstartable_or_canceled_bundle_collects_nothing_and_removes_only_a_given_gateway() {
-    let cases = || {
-        [
-            (
-                failure("bundle broke"),
-                "Workshop bundle failed: bundle broke",
-            ),
-            (
-                FakeResponse::SpawnFailed(io::ErrorKind::NotFound, "node not found"),
-                "Workshop bundle could not start: node not found",
-            ),
-            (FakeResponse::CanceledAfterStart, "Workshop bundle canceled"),
-        ]
-    };
-    for (target, given) in [
-        ("x86_64-pc-windows-msvc", true),
-        ("x86_64-pc-windows-msvc", false),
-        ("x86_64-unknown-linux-gnu", false),
-    ] {
-        for (response, expected) in cases() {
-            let test_environment = environment();
-            let environment = &test_environment.environment;
-            let mut installer_request = request(target, false);
-            let named = given.then(|| test_environment.given_gateway(target));
-            if given {
-                installer_request.gateway_binary.clone_from(&named);
-            } else {
-                test_environment.stage_gateway(target);
-            }
-            let ifw = (!sidecar::bundles_sidecar(target)).then(ifw_found);
-            let mut runner = FakeRunner::with_responses(
-                ifw.into_iter()
-                    .chain([
-                        node_found(),
-                        version_printed(),
-                        bundled(test_environment.sidecar(target), Vec::new(), response),
-                    ])
-                    .collect(),
-            );
-
-            let error = build_installer(&installer_request, environment, &mut runner)
-                .expect_err("bundle failure");
-
-            assert!(error.primary.contains(expected), "{target}: {error}");
-            // The bundle's build script copies what this variable names
-            // into the slot, so the bundle is told the checked Gateway.
-            let bundle = runner.commands.last().expect("the bundle command");
-            let told = bundle
-                .envs
-                .iter()
-                .find(|(key, _)| key == "RUNVIL_GATEWAY_SIDECAR")
-                .map(|(_, value)| PathBuf::from(value));
-            assert_eq!(told, named, "{target}");
-            assert_eq!(
-                test_environment.sidecar(target).exists(),
-                !given,
-                "{target}: only a given Gateway is removed"
-            );
-            assert!(!output(environment, target).exists(), "{target}");
-        }
-    }
-}
-
-#[test]
-fn an_unsupported_target_fails_before_building() {
-    let test_environment = environment();
-    let mut runner = FakeRunner::default();
-
-    let error = build_installer(
-        &request("x86_64-unknown-freebsd", false),
-        &test_environment.environment,
-        &mut runner,
-    )
-    .expect_err("unsupported target");
-
-    assert!(error.primary.contains("x86_64-unknown-freebsd"), "{error}");
-    assert!(runner.commands.is_empty());
-}
-
-#[test]
-fn a_missing_node_fails_before_the_gateway_version_check() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-unknown-linux-gnu";
-    test_environment.stage_gateway(target);
-    let mut runner = FakeRunner::with_responses(vec![
-        ifw_found(),
-        FakeResponse::SpawnFailed(io::ErrorKind::NotFound, "program not found"),
-    ]);
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("missing node");
-
-    assert!(
-        error
-            .primary
-            .contains("the Tauri CLI runs on `node` from PATH) could not start"),
-        "{error}"
-    );
-    assert_eq!(runner.commands.len(), 2);
-}
diff --git a/crates/build-workshop/src/main/tests/gateway.rs b/crates/build-workshop/src/main/tests/gateway.rs
deleted file mode 100644
index 60f5a0332..000000000
--- a/crates/build-workshop/src/main/tests/gateway.rs
+++ /dev/null
@@ -1,243 +0,0 @@
-//! Unit tests for where both modes find the Gateway: the given binary, the
-//! staged slot and its stub marker, the pin, and the copy beside Workshop.
-
-use super::installer_tests::{node_found, request};
-use super::*;
-
-fn build_request(target: Option<&str>, gateway_binary: Option<PathBuf>) -> BuildRequest {
-    BuildRequest {
-        profile: Profile::Debug,
-        target: target.map(str::to_owned),
-        gateway_binary,
-    }
-}
-
-#[test]
-fn a_missing_gateway_names_the_fetch_script_and_runs_no_command() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-unknown-linux-gnu";
-    let fetch = format!("node tools/fetch-gateway-sidecar.mjs --target {target}");
-
-    let mut runner = FakeRunner::default();
-    let error = build_workshop(&build_request(Some(target), None), environment, &mut runner)
-        .expect_err("no Gateway for the build");
-    assert!(error.primary.contains(&fetch), "{error}");
-    assert!(runner.commands.is_empty());
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("no Gateway for the installer");
-    assert!(error.primary.contains(&fetch), "{error}");
-    assert!(runner.commands.is_empty());
-}
-
-#[test]
-fn a_staged_stub_refuses_the_installer_but_builds_workshop() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-unknown-linux-gnu";
-    let stub = test_environment.stage_stub(target);
-
-    let mut runner = FakeRunner::default();
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("a stub installer");
-    assert!(error.primary.contains("compile-only stub"), "{error}");
-    assert!(
-        error.primary.contains(&format!(
-            "node tools/fetch-gateway-sidecar.mjs --target {target}"
-        )),
-        "{error}"
-    );
-    assert!(runner.commands.is_empty());
-
-    let profile = environment.target_root.join(target).join("debug");
-    let mut runner =
-        FakeRunner::with_responses(vec![workshop_built_into(profile.clone(), success(""))]);
-    build_workshop(&build_request(Some(target), None), environment, &mut runner)
-        .expect("a stub builds Workshop");
-    assert_eq!(runner.commands.len(), 1);
-    assert!(profile.join("runvil-gateway").is_file());
-    assert!(stub.is_file(), "a staged stub must outlive the build");
-}
-
-#[test]
-fn the_flag_wins_over_the_variable_which_wins_over_the_slot() {
-    let target = "x86_64-pc-windows-msvc";
-    for (flag, variable, expected) in [
-        (true, true, "flag"),
-        (false, true, "variable"),
-        (false, false, "slot"),
-    ] {
-        let mut test_environment = environment();
-        let slot = test_environment.stage_gateway(target);
-        let named = |name: &str| {
-            test_environment
-                .temp
-                .path()
-                .join(name)
-                .join("runvil-gateway.exe")
-        };
-        write_file(&named("flag"), b"flag");
-        write_file(&named("variable"), b"variable");
-        if variable {
-            test_environment.environment.gateway_sidecar = Some(named("variable"));
-        }
-        let environment = &test_environment.environment;
-        let mut installer_request = request(target, false);
-        if flag {
-            installer_request.gateway_binary = Some(named("flag"));
-        }
-        // A mismatched version stops the run after the version check.
-        let mut runner =
-            FakeRunner::with_responses(vec![node_found(), success("runvil-gateway 0.0.1\n")]);
-
-        build_installer(&installer_request, environment, &mut runner)
-            .expect_err("version mismatch");
-
-        let program = if expected == "slot" {
-            slot
-        } else {
-            named(expected)
-        };
-        assert_eq!(runner.commands[1].program, program, "{expected}");
-        assert_eq!(runner.commands[1].args, strings(&["--version"]));
-    }
-}
-
-#[test]
-fn a_given_gateway_is_staged_for_a_windows_build_and_removed_after() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let given = test_environment.given_gateway(target);
-    let slot = test_environment.sidecar(target);
-    let staged = slot.clone();
-    let mut runner = FakeRunner::with_responses(vec![act(
-        move || {
-            assert_eq!(
-                std::fs::read(&staged).expect("staged during the build"),
-                b"given gateway"
-            );
-        },
-        success(""),
-    )]);
-
-    build_workshop(
-        &build_request(Some(target), Some(given.clone())),
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    assert_eq!(runner.commands.len(), 1);
-    // The desktop build script copies what this variable names into the
-    // slot, and the child would otherwise inherit the caller's value.
-    assert!(
-        runner.commands[0].envs.contains(&(
-            OsString::from("RUNVIL_GATEWAY_SIDECAR"),
-            given.clone().into_os_string()
-        )),
-        "{:?}",
-        runner.commands[0].envs
-    );
-    assert!(!slot.exists(), "a given Gateway's staging was left");
-    assert!(given.is_file(), "staging moved the given Gateway");
-}
-
-#[test]
-fn a_given_gateway_never_replaces_one_already_staged_for_windows() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let slot = test_environment.stage_gateway(target);
-    let before = std::fs::read(&slot).expect("the staged Gateway");
-    let given = test_environment.given_gateway(target);
-    let mut runner = FakeRunner::default();
-
-    let error = build_workshop(
-        &build_request(Some(target), Some(given)),
-        environment,
-        &mut runner,
-    )
-    .expect_err("a Gateway is already staged");
-
-    assert!(error.primary.contains("already staged"), "{error}");
-    assert!(runner.commands.is_empty());
-    assert_eq!(std::fs::read(&slot).expect("kept"), before);
-}
-
-#[test]
-fn a_host_build_copies_a_given_gateway_into_the_profile_directory() {
-    let mut test_environment = environment();
-    let target = "aarch64-unknown-linux-gnu";
-    let given = test_environment.given_gateway(target);
-    test_environment.environment.gateway_sidecar = Some(given);
-    let environment = &test_environment.environment;
-    // Without `--target`, Cargo writes to the target root's profile
-    // directory, with no triple.
-    let profile = environment.target_root.join("debug");
-    let mut runner = FakeRunner::with_responses(vec![
-        success(&format!("cargo 1.89.0\nhost: {target}\n")),
-        workshop_built_without_sidecar(
-            test_environment.sidecar(target),
-            workshop_built_into(profile.clone(), success("")),
-        ),
-    ]);
-
-    build_workshop(&build_request(None, None), environment, &mut runner).expect("Workshop build");
-
-    assert_eq!(
-        std::fs::read(profile.join("runvil-gateway")).expect("Gateway beside Workshop"),
-        b"given gateway"
-    );
-    assert!(!test_environment.sidecar(target).exists());
-}
-
-/// A Gateway from an earlier run may still be running from the profile
-/// directory, so the copy must replace the name and leave that file alone.
-#[cfg(unix)]
-#[test]
-fn a_host_build_replaces_the_gateway_beside_workshop_without_writing_into_it() {
-    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
-
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "aarch64-unknown-linux-gnu";
-    let given = test_environment.given_gateway(target);
-    std::fs::set_permissions(&given, std::fs::Permissions::from_mode(0o644)).expect("mode");
-    let profile = environment.target_root.join(target).join("debug");
-    let beside = profile.join("runvil-gateway");
-    write_file(&beside, b"an earlier gateway");
-    let earlier = std::fs::metadata(&beside).expect("earlier").ino();
-    let mut runner =
-        FakeRunner::with_responses(vec![workshop_built_into(profile.clone(), success(""))]);
-
-    build_workshop(
-        &build_request(Some(target), Some(given)),
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    assert_eq!(std::fs::read(&beside).expect("replaced"), b"given gateway");
-    let metadata = std::fs::metadata(&beside).expect("replaced");
-    assert_eq!(metadata.permissions().mode() & 0o777, 0o755);
-    assert_ne!(metadata.ino(), earlier, "the earlier file was written into");
-    assert!(!profile.join("runvil-gateway.new").exists());
-}
-
-#[test]
-fn an_unpinned_gateway_refuses_the_installer_before_any_command() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "aarch64-apple-darwin";
-    test_environment.stage_gateway(target);
-    test_environment.pin("PLACEHOLDER");
-    let mut runner = FakeRunner::default();
-
-    let error = build_installer(&request(target, false), environment, &mut runner)
-        .expect_err("an unpinned Gateway");
-
-    assert!(error.primary.contains("names no version"), "{error}");
-    assert!(runner.commands.is_empty());
-}
diff --git a/crates/build-workshop/src/main/tests/installer.rs b/crates/build-workshop/src/main/tests/installer.rs
deleted file mode 100644
index 59199a625..000000000
--- a/crates/build-workshop/src/main/tests/installer.rs
+++ /dev/null
@@ -1,402 +0,0 @@
-//! Unit tests for the installer command sequence, its preflight, and its
-//! failure paths.
-
-use super::ifw_tests::{ifw_built, ifw_commands, ifw_found, ifw_version_command, installer_path};
-use super::*;
-
-pub(super) const VERSION: &str = env!("CARGO_PKG_VERSION");
-
-fn release(environment: &BuildEnvironment, target: &str) -> PathBuf {
-    environment.target_root.join(target).join("release")
-}
-
-/// The staged Gateway, which the version check runs.
-pub(super) fn gateway(environment: &BuildEnvironment, target: &str) -> PathBuf {
-    sidecar::sidecar_path(&environment.workspace_root, target)
-}
-
-pub(super) fn bundle(environment: &BuildEnvironment, target: &str, directory: &str) -> PathBuf {
-    release(environment, target).join("bundle").join(directory)
-}
-
-pub(super) fn output(environment: &BuildEnvironment, target: &str) -> PathBuf {
-    environment.target_root.join("installer").join(target)
-}
-
-pub(super) fn node_found() -> FakeResponse {
-    success("v22.0.0\n")
-}
-
-pub(super) fn version_printed() -> FakeResponse {
-    success(&format!("runvil-gateway {GATEWAY_VERSION}\n"))
-}
-
-/// A Tauri build that writes `files`, with a Gateway in the slot: one the
-/// fetch script staged for any target, or a given one staged for Windows.
-pub(super) fn bundled(
-    sidecar: PathBuf,
-    files: Vec<PathBuf>,
-    response: FakeResponse,
-) -> FakeResponse {
-    act(
-        move || {
-            assert!(
-                sidecar.is_file(),
-                "no Gateway in the slot during the bundle"
-            );
-            for file in files {
-                write_file(&file, b"bundle");
-            }
-        },
-        response,
-    )
-}
-
-/// The library of each Plugin Workshop ships, inside the Workshop bundle
-/// a Tauri build leaves for a macOS or Linux `target`, where the build's
-/// configuration has Tauri copy them.
-pub(super) fn bundled_plugins(environment: &BuildEnvironment, target: &str) -> Vec<PathBuf> {
-    let (plugins, names) = if target.contains("apple") {
-        (
-            bundle(environment, target, "macos")
-                .join("Runvil.app")
-                .join("Contents")
-                .join("Resources")
-                .join("plugins"),
-            ["libplugin_std.dylib", "libplugin_bashkit.dylib"],
-        )
-    } else {
-        (
-            bundle(environment, target, "appimage")
-                .join("Runvil.AppDir")
-                .join("usr")
-                .join("lib")
-                .join("runvil")
-                .join("plugins"),
-            ["libplugin_std.so", "libplugin_bashkit.so"],
-        )
-    };
-    names.iter().map(|name| plugins.join(name)).collect()
-}
-
-/// The `--config` text that has Tauri copy the libraries of `target`'s
-/// release build into Workshop's bundle, or `None` for Windows.
-fn plugin_config(environment: &BuildEnvironment, target: &str) -> Option<String> {
-    let deps = release(environment, target).join("deps");
-    let config = if target.contains("apple") {
-        serde_json::json!({
-            "bundle": { "macOS": { "files": {
-                "Resources/plugins/libplugin_std.dylib": deps.join("libplugin_std.dylib"),
-                "Resources/plugins/libplugin_bashkit.dylib":
-                    deps.join("libplugin_bashkit.dylib"),
-            } } }
-        })
-    } else if target.contains("linux") {
-        serde_json::json!({
-            "bundle": { "linux": { "appimage": { "files": {
-                "/usr/lib/runvil/plugins/libplugin_std.so": deps.join("libplugin_std.so"),
-                "/usr/lib/runvil/plugins/libplugin_bashkit.so":
-                    deps.join("libplugin_bashkit.so"),
-            } } } }
-        })
-    } else {
-        return None;
-    };
-    Some(config.to_string())
-}
-
-pub(super) fn expected_commands(
-    environment: &BuildEnvironment,
-    target: &str,
-    bundle: &str,
-    sign: bool,
-) -> Vec<CommandSpec> {
-    let plugin_config = plugin_config(environment, target);
-    let mut tauri = vec![
-        environment.tauri_cli.to_str().expect("UTF-8 CLI"),
-        "build",
-        "--ci",
-        "--target",
-        target,
-        "--bundles",
-        bundle,
-    ];
-    if !sign {
-        tauri.extend(["--config", "tauri.unsigned.conf.json"]);
-    }
-    // The library of the installer's own release build goes into the
-    // bundle, so the updater replaces it with Workshop.
-    if let Some(config) = &plugin_config {
-        tauri.extend(["--config", config.as_str()]);
-    }
-    // macOS and Linux check Qt IFW once the target is known.
-    let ifw = (!target.ends_with("windows-msvc")).then(|| ifw_version_command(environment));
-    ifw.into_iter()
-        .chain([
-            command(
-                environment,
-                "selected-node",
-                &["--version"],
-                OutputMode::Capture,
-            ),
-            CommandSpec {
-                program: gateway(environment, target),
-                args: strings(&["--version"]),
-                current_dir: environment.workspace_root.clone(),
-                envs: Vec::new(),
-                output_mode: OutputMode::Capture,
-            },
-            CommandSpec {
-                current_dir: environment
-                    .workspace_root
-                    .join("crates")
-                    .join("workshop")
-                    .join("desktop"),
-                envs: target_root_env(environment),
-                ..command(environment, "selected-node", &tauri, OutputMode::Inherit)
-            },
-        ])
-        .collect()
-}
-
-pub(super) fn request(target: &str, sign: bool) -> InstallerRequest {
-    InstallerRequest {
-        target: Some(target.to_owned()),
-        sign,
-        gateway_binary: None,
-    }
-}
-
-#[test]
-fn windows_unsigned_builds_the_setup_on_the_unsigned_config() {
-    let mut test_environment = environment();
-    // Windows never looks for Qt IFW.
-    test_environment.environment.qtifw_dir = None;
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(target);
-    let setup = bundle(environment, target, "nsis").join(format!("Runvil_{VERSION}_x64-setup.exe"));
-    // A setup left by an earlier build at another version must not make
-    // the collection ambiguous.
-    write_file(
-        &bundle(environment, target, "nsis").join("Runvil_0.0.1_x64-setup.exe"),
-        b"stale",
-    );
-    let mut runner = FakeRunner::with_responses(vec![
-        node_found(),
-        version_printed(),
-        bundled(staged.clone(), vec![setup], success("")),
-    ]);
-
-    build_installer(&request(target, false), environment, &mut runner).expect("installer");
-
-    assert_eq!(
-        runner.commands,
-        expected_commands(environment, target, "nsis", false)
-    );
-    let publish = output(environment, target).join("publish");
-    assert!(
-        publish
-            .join(format!("Runvil_{VERSION}_x64-setup.exe"))
-            .is_file()
-    );
-    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 1);
-    assert!(!output(environment, target).join("payload").exists());
-    assert!(staged.is_file(), "a staged Gateway must outlive the build");
-}
-
-#[test]
-fn windows_signed_publishes_the_setup_and_its_signature() {
-    let mut test_environment = environment();
-    set_signing_key(&mut test_environment.environment);
-    let environment = &test_environment.environment;
-    let target = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(target);
-    let setup = bundle(environment, target, "nsis").join(format!("Runvil_{VERSION}_x64-setup.exe"));
-    let mut runner = FakeRunner::with_responses(vec![
-        node_found(),
-        version_printed(),
-        bundled(staged, vec![collect_signature(&setup), setup], success("")),
-    ]);
-
-    build_installer(&request(target, true), environment, &mut runner).expect("installer");
-
-    assert_eq!(
-        runner.commands,
-        expected_commands(environment, target, "nsis", true)
-    );
-    let publish = output(environment, target).join("publish");
-    let setup = publish.join(format!("Runvil_{VERSION}_x64-setup.exe"));
-    assert!(setup.is_file());
-    assert!(collect_signature(&setup).is_file());
-    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 2);
-}
-
-#[test]
-fn linux_unsigned_from_the_host_publishes_only_the_installer() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let target = "x86_64-unknown-linux-gnu";
-    let staged = test_environment.stage_gateway(target);
-    let appimage = bundle(environment, target, "appimage");
-    let mut responses = vec![
-        success(&format!("cargo 1.89.0\nhost: {target}\n")),
-        ifw_found(),
-        node_found(),
-        version_printed(),
-        bundled(
-            staged.clone(),
-            [
-                vec![
-                    appimage.join(format!("Runvil_{VERSION}_amd64.AppImage")),
-                    appimage.join("Runvil.AppDir").join("AppRun"),
-                ],
-                bundled_plugins(environment, target),
-            ]
-            .concat(),
-            success(""),
-        ),
-    ];
-    responses.extend(ifw_built(environment, target));
-    let mut runner = FakeRunner::with_responses(responses);
-
-    build_installer(
-        &InstallerRequest {
-            target: None,
-            sign: false,
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("installer");
-
-    let mut expected = vec![command(
-        environment,
-        "selected-cargo",
-        &["-vV"],
-        OutputMode::Capture,
-    )];
-    expected.extend(expected_commands(environment, target, "appimage", false));
-    expected.extend(ifw_commands(environment, target));
-    assert_eq!(runner.commands, expected);
-    let output_root = output(environment, target);
-    assert!(
-        output_root
-            .join("payload")
-            .join("Runvil.AppImage")
-            .is_file()
-    );
-    assert_eq!(
-        std::fs::read(output_root.join("payload").join("runvil-gateway")).expect("payload"),
-        b"gateway"
-    );
-    // The Plugins' libraries ride inside the AppImage, so nothing beside
-    // it carries a Plugin directory.
-    assert!(!output_root.join("payload").join("plugins").exists());
-    assert!(
-        !output_root
-            .join("ifw")
-            .join("packages")
-            .join("com.runvil.workshop")
-            .join("data")
-            .join("plugins")
-            .exists()
-    );
-    let installer = installer_path(environment, target);
-    assert_eq!(
-        installer.file_name().expect("name"),
-        format!("Runvil_{VERSION}_amd64-setup.run").as_str()
-    );
-    assert!(installer.is_file());
-    assert_eq!(
-        std::fs::read_dir(output_root.join("publish"))
-            .expect("publish")
-            .count(),
-        1
-    );
-    assert!(staged.is_file(), "a staged Gateway must outlive the build");
-    // The Gateway package carries the pin's version, not Workshop's.
-    let package = output_root
-        .join("ifw")
-        .join("packages")
-        .join("com.runvil.gateway")
-        .join("meta")
-        .join("package.xml");
-    let package = std::fs::read_to_string(package).expect("Gateway package");
-    assert!(
-        package.contains(&format!("<Version>{GATEWAY_VERSION}</Version>")),
-        "{package}"
-    );
-}
-
-#[test]
-fn linux_signed_publishes_the_appimage_and_its_signature_beside_the_installer() {
-    let mut test_environment = environment();
-    set_signing_key(&mut test_environment.environment);
-    let environment = &test_environment.environment;
-    let target = "aarch64-unknown-linux-gnu";
-    let staged = test_environment.stage_gateway(target);
-    let appimage =
-        bundle(environment, target, "appimage").join(format!("Runvil_{VERSION}_aarch64.AppImage"));
-    let mut responses = vec![
-        ifw_found(),
-        node_found(),
-        version_printed(),
-        bundled(
-            staged,
-            [
-                vec![collect_signature(&appimage), appimage],
-                bundled_plugins(environment, target),
-            ]
-            .concat(),
-            success(""),
-        ),
-    ];
-    responses.extend(ifw_built(environment, target));
-    let mut runner = FakeRunner::with_responses(responses);
-
-    build_installer(&request(target, true), environment, &mut runner).expect("installer");
-
-    let mut expected = expected_commands(environment, target, "appimage", true);
-    expected.extend(ifw_commands(environment, target));
-    assert_eq!(runner.commands, expected);
-    assert!(installer_path(environment, target).is_file());
-    let publish = output(environment, target).join("publish");
-    let published = publish.join(format!("Runvil_{VERSION}_aarch64.AppImage"));
-    assert!(published.is_file());
-    assert!(collect_signature(&published).is_file());
-    assert_eq!(std::fs::read_dir(&publish).expect("publish").count(), 3);
-    assert!(
-        output(environment, target)
-            .join("payload")
-            .join("Runvil.AppImage")
-            .is_file()
-    );
-}
-
-#[test]
-fn preflight_failures_run_no_command() {
-    let mut test_environment = environment();
-    let target = "x86_64-unknown-linux-gnu";
-    test_environment.stage_gateway(target);
-    let mut runner = FakeRunner::default();
-    let mut refusal = |environment: &BuildEnvironment, case: &str| {
-        build_installer(&request(target, true), environment, &mut runner)
-            .expect_err(case)
-            .primary
-    };
-
-    let error = refusal(&test_environment.environment, "no signing key");
-    assert!(error.contains("TAURI_SIGNING_PRIVATE_KEY set"), "{error}");
-
-    set_signing_key(&mut test_environment.environment);
-    std::fs::remove_file(&test_environment.environment.tauri_cli).expect("remove CLI");
-    let error = refusal(&test_environment.environment, "no CLI");
-    assert!(error.contains("npm ci --prefix crates/workshop"), "{error}");
-    assert!(runner.commands.is_empty());
-}
-
-pub(super) fn collect_signature(path: &Path) -> PathBuf {
-    crate::installer::collect::signature_path(path)
-}
diff --git a/crates/build-workshop/src/main/tests/plugin.rs b/crates/build-workshop/src/main/tests/plugin.rs
deleted file mode 100644
index c7056ed35..000000000
--- a/crates/build-workshop/src/main/tests/plugin.rs
+++ /dev/null
@@ -1,288 +0,0 @@
-//! Unit tests for the libraries of the Plugins Workshop ships: the name
-//! Cargo gives each for each target, where a build places them, what a
-//! build that left one out says, and how an installer gets them into
-//! Workshop's bundle.
-
-use super::ifw_tests::ifw_found;
-use super::installer_tests::{bundled, bundled_plugins, node_found, request, version_printed};
-use super::*;
-use crate::installer::System;
-
-#[test]
-fn each_library_is_named_as_cargo_names_it_for_each_target() {
-    for (target, names) in [
-        (
-            "x86_64-pc-windows-msvc",
-            ["plugin_std.dll", "plugin_bashkit.dll"],
-        ),
-        (
-            "aarch64-pc-windows-msvc",
-            ["plugin_std.dll", "plugin_bashkit.dll"],
-        ),
-        (
-            "x86_64-apple-darwin",
-            ["libplugin_std.dylib", "libplugin_bashkit.dylib"],
-        ),
-        (
-            "aarch64-apple-darwin",
-            ["libplugin_std.dylib", "libplugin_bashkit.dylib"],
-        ),
-        (
-            "x86_64-unknown-linux-gnu",
-            ["libplugin_std.so", "libplugin_bashkit.so"],
-        ),
-        (
-            "aarch64-unknown-linux-gnu",
-            ["libplugin_std.so", "libplugin_bashkit.so"],
-        ),
-    ] {
-        assert_eq!(plugin::library_names(target), names, "{target}");
-        assert_eq!(
-            plugin::built_libraries(Path::new("profile"), target),
-            names.map(|name| Path::new("profile").join("deps").join(name)),
-            "{target}"
-        );
-    }
-}
-
-#[test]
-fn a_host_build_places_each_library_in_the_plugin_directory_beside_workshop() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "x86_64-pc-windows-msvc";
-    let staged = test_environment.stage_gateway(triple);
-    let mut runner = FakeRunner::with_responses(vec![
-        success("cargo 1.89.0\nhost: x86_64-pc-windows-msvc\n"),
-        workshop_built_with_sidecar(staged, success("")),
-    ]);
-
-    build_workshop(
-        &BuildRequest {
-            profile: Profile::Debug,
-            target: None,
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    let plugins = environment.target_root.join("debug").join("plugins");
-    for library in ["plugin_std", "plugin_bashkit"] {
-        assert_eq!(
-            std::fs::read(plugins.join(format!("{library}.dll"))).expect("the placed library"),
-            plugin_bytes(library, None, "debug"),
-            "the library of the host's debug build, and of no other"
-        );
-    }
-    assert_eq!(
-        std::fs::read_dir(&plugins).expect("plugins").count(),
-        2,
-        "the copies leave no other file behind"
-    );
-}
-
-#[test]
-fn a_build_for_a_named_target_places_each_library_under_that_target_and_replaces_an_old_one() {
-    let test_environment = environment();
-    let environment = &test_environment.environment;
-    let triple = "aarch64-unknown-linux-gnu";
-    test_environment.stage_gateway(triple);
-    let profile = environment.target_root.join(triple).join("release");
-    let plugins = profile.join("plugins");
-    write_file(
-        &plugins.join("libplugin_std.so"),
-        b"a library from an earlier build",
-    );
-    let mut runner =
-        FakeRunner::with_responses(vec![workshop_built_into(profile.clone(), success(""))]);
-
-    build_workshop(
-        &BuildRequest {
-            profile: Profile::Release,
-            target: Some(triple.to_owned()),
-            gateway_binary: None,
-        },
-        environment,
-        &mut runner,
-    )
-    .expect("Workshop build");
-
-    for library in ["plugin_std", "plugin_bashkit"] {
-        assert_eq!(
-            std::fs::read(plugins.join(format!("lib{library}.so"))).expect("the placed library"),
-            plugin_bytes(library, Some(triple), "release"),
-            "the library of the named target's release build, and of no other"
-        );
-    }
-    assert!(
-        !environment
-            .target_root
-            .join("release")
-            .join("plugins")
-            .exists(),
-        "nothing is placed under the host's profile"
-    );
-}
-
-#[test]
-fn a_build_that_left_a_library_out_fails_naming_the_file_and_places_nothing() {
-    for (lost, file) in [
-        ("plugin_std", "libplugin_std.so"),
-        ("plugin_bashkit", "libplugin_bashkit.so"),
-    ] {
-        let test_environment = environment();
-        let environment = &test_environment.environment;
-        let triple = "x86_64-unknown-linux-gnu";
-        test_environment.stage_gateway(triple);
-        test_environment.lose_plugin(triple, lost);
-        let profile = environment.target_root.join(triple).join("debug");
-        let mut runner =
-            FakeRunner::with_responses(vec![workshop_built_into(profile.clone(), success(""))]);
-
-        let error = build_workshop(
-            &BuildRequest {
-                profile: Profile::Debug,
-                target: Some(triple.to_owned()),
-                gateway_binary: None,
-            },
-            environment,
-            &mut runner,
-        )
-        .expect_err("a library is missing");
-
-        assert_eq!(
-            error.to_string(),
-            format!(
-                "cannot place Workshop's Plugins beside it: {} is missing; a Workshop build \
-                 writes it, because the server depends on the `workshop-plugin-*` crate that \
-                 exports it",
-                profile.join("deps").join(file).display()
-            ),
-            "{lost}"
-        );
-        assert!(
-            !profile.join("plugins").exists(),
-            "{lost}: the library that was built is not placed alone"
-        );
-        assert!(
-            !profile.join("runvil-gateway").exists(),
-            "{lost}: the Gateway is placed only after the Plugins"
-        );
-    }
-}
-
-#[test]
-fn the_bundle_configuration_copies_each_library_into_each_platform_s_bundle() {
-    let deps = Path::new("release").join("deps");
-    let dylibs = [
-        deps.join("libplugin_std.dylib"),
-        deps.join("libplugin_bashkit.dylib"),
-    ];
-    assert_eq!(
-        plugin::bundle_config(System::MacOs, &dylibs),
-        Ok(Some(
-            serde_json::json!({
-                "bundle": { "macOS": { "files": {
-                    "Resources/plugins/libplugin_std.dylib": dylibs[0],
-                    "Resources/plugins/libplugin_bashkit.dylib": dylibs[1],
-                } } }
-            })
-            .to_string()
-        )),
-        "a macOS path runs from the bundle's Contents"
-    );
-    let sos = [
-        deps.join("libplugin_std.so"),
-        deps.join("libplugin_bashkit.so"),
-    ];
-    assert_eq!(
-        plugin::bundle_config(System::Linux, &sos),
-        Ok(Some(
-            serde_json::json!({
-                "bundle": { "linux": { "appimage": { "files": {
-                    "/usr/lib/runvil/plugins/libplugin_std.so": sos[0],
-                    "/usr/lib/runvil/plugins/libplugin_bashkit.so": sos[1],
-                } } } }
-            })
-            .to_string()
-        )),
-        "an AppImage path runs from the root of the AppDir"
-    );
-    let dlls = [deps.join("plugin_std.dll"), deps.join("plugin_bashkit.dll")];
-    assert_eq!(
-        plugin::bundle_config(System::Windows, &dlls),
-        Ok(None),
-        "the Windows setup installs the libraries itself"
-    );
-}
-
-#[test]
-fn a_bundle_tauri_left_without_a_library_fails_the_installer_and_collects_nothing() {
-    for (target, directory, tree) in [
-        ("aarch64-apple-darwin", "macos", "Runvil.app"),
-        ("x86_64-unknown-linux-gnu", "appimage", "Runvil.AppDir"),
-    ] {
-        // The bundle is whole except for the library `lacks` names: both
-        // of them, and then the second alone.
-        for (kept, lacks) in [(0, "libplugin_std."), (1, "libplugin_bashkit.")] {
-            let test_environment = environment();
-            let environment = &test_environment.environment;
-            let staged = test_environment.stage_gateway(target);
-            let bundle = environment
-                .target_root
-                .join(target)
-                .join("release")
-                .join("bundle")
-                .join(directory);
-            let built = if directory == "macos" {
-                bundle
-                    .join(tree)
-                    .join("Contents")
-                    .join("MacOS")
-                    .join("runvil-workshop")
-            } else {
-                bundle.join("Runvil_0.0.0_amd64.AppImage")
-            };
-            let mut files = vec![built];
-            files.extend(bundled_plugins(environment, target).into_iter().take(kept));
-            let mut runner = FakeRunner::with_responses(vec![
-                ifw_found(),
-                node_found(),
-                version_printed(),
-                bundled(staged, files, success("")),
-            ]);
-
-            let error = build_installer(&request(target, false), environment, &mut runner)
-                .expect_err("the bundle lacks a library");
-
-            assert!(
-                error
-                    .primary
-                    .starts_with("the Workshop bundle lacks a Plugin's library: "),
-                "{target}: {error}"
-            );
-            assert!(
-                error.primary.contains(tree) && error.primary.contains(lacks),
-                "{target}: the error names the missing file: {error}"
-            );
-            assert!(
-                !environment.target_root.join("installer").exists(),
-                "{target}: nothing is collected"
-            );
-        }
-    }
-}
-
-#[test]
-fn a_windows_bundle_is_not_checked_for_a_library_inside_it() {
-    let bundle = Path::new("release").join("bundle").join("nsis");
-    assert_eq!(
-        plugin::check_bundled(
-            System::Windows,
-            &bundle,
-            &plugin::library_names("x86_64-pc-windows-msvc")
-        ),
-        Ok(())
-    );
-}
diff --git a/crates/build-workshop/src/main/tests/sidecar.rs b/crates/build-workshop/src/main/tests/sidecar.rs
deleted file mode 100644
index 7f5b886de..000000000
--- a/crates/build-workshop/src/main/tests/sidecar.rs
+++ /dev/null
@@ -1,247 +0,0 @@
-//! Unit tests for the sidecar's name, staging, and removal, the Gateway's
-//! source, and the pinned version.
-
-use super::*;
-use sidecar::GatewaySource;
-
-#[test]
-fn names_the_sidecar_with_tauri_s_target_suffix() {
-    let root = Path::new("repo");
-    let binaries = root
-        .join("crates")
-        .join("workshop")
-        .join("desktop")
-        .join("binaries");
-    for (target, binary, staged) in [
-        (
-            "x86_64-pc-windows-msvc",
-            "runvil-gateway.exe",
-            "runvil-gateway-x86_64-pc-windows-msvc.exe",
-        ),
-        (
-            "x86_64-pc-windows-gnu",
-            "runvil-gateway.exe",
-            "runvil-gateway-x86_64-pc-windows-gnu.exe",
-        ),
-        (
-            "x86_64-unknown-linux-gnu",
-            "runvil-gateway",
-            "runvil-gateway-x86_64-unknown-linux-gnu",
-        ),
-        (
-            "aarch64-unknown-linux-gnu",
-            "runvil-gateway",
-            "runvil-gateway-aarch64-unknown-linux-gnu",
-        ),
-        (
-            "aarch64-apple-darwin",
-            "runvil-gateway",
-            "runvil-gateway-aarch64-apple-darwin",
-        ),
-        (
-            "x86_64-apple-darwin",
-            "runvil-gateway",
-            "runvil-gateway-x86_64-apple-darwin",
-        ),
-    ] {
-        assert_eq!(sidecar::gateway_binary_name(target), binary, "{target}");
-        assert_eq!(
-            sidecar::sidecar_path(root, target),
-            binaries.join(staged),
-            "{target}"
-        );
-    }
-}
-
-/// A link to a Gateway stages as a regular file, the same as naming a copy.
-#[cfg(unix)]
-#[test]
-fn stages_the_file_a_symlink_names() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let root = temp.path().join("repo");
-    let built = temp.path().join("build").join("gateway-build");
-    write_file(&built, b"gateway bytes");
-    let link = temp.path().join("named").join("runvil-gateway.exe");
-    std::fs::create_dir_all(link.parent().expect("parent")).expect("directory");
-    std::os::unix::fs::symlink(&built, &link).expect("symlink");
-    let target = "x86_64-pc-windows-msvc";
-
-    let staged = sidecar::stage(&root, target, &link).expect("stage");
-
-    let metadata = std::fs::symlink_metadata(&staged).expect("staged");
-    assert!(metadata.is_file(), "the slot holds a link");
-    assert_eq!(std::fs::read(&staged).expect("staged"), b"gateway bytes");
-}
-
-#[test]
-fn stages_a_copy_and_removes_it() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let root = temp.path().join("repo");
-    let source = temp.path().join("build").join("runvil-gateway");
-    write_file(&source, b"gateway bytes");
-    let target = "x86_64-unknown-linux-gnu";
-
-    let staged = sidecar::stage(&root, target, &source).expect("stage");
-
-    assert_eq!(staged, sidecar::sidecar_path(&root, target));
-    assert_eq!(std::fs::read(&staged).expect("staged"), b"gateway bytes");
-    assert!(source.is_file(), "staging moved the source");
-    assert_eq!(sidecar::remove(&root, target).expect("remove"), staged);
-    assert!(!staged.exists());
-}
-
-#[cfg(unix)]
-#[test]
-fn staging_keeps_the_execute_bit() {
-    use std::os::unix::fs::PermissionsExt as _;
-
-    let temp = tempfile::tempdir().expect("temporary root");
-    let source = temp.path().join("runvil-gateway");
-    write_file(&source, b"gateway");
-    std::fs::set_permissions(&source, std::fs::Permissions::from_mode(0o755))
-        .expect("make executable");
-
-    let staged =
-        sidecar::stage(&temp.path().join("repo"), "aarch64-apple-darwin", &source).expect("stage");
-
-    let mode = std::fs::metadata(staged)
-        .expect("staged")
-        .permissions()
-        .mode();
-    assert_eq!(mode & 0o111, 0o111, "{mode:o}");
-}
-
-#[test]
-fn removing_an_absent_sidecar_succeeds() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let target = "x86_64-pc-windows-msvc";
-
-    let removed = sidecar::remove(temp.path(), target).expect("remove");
-
-    assert_eq!(removed, sidecar::sidecar_path(temp.path(), target));
-}
-
-#[test]
-fn refuses_a_missing_source_a_directory_and_a_wrong_name() {
-    let temp = tempfile::tempdir().expect("temporary root");
-    let root = temp.path().join("repo");
-    let target = "x86_64-pc-windows-msvc";
-    let missing = temp.path().join("runvil-gateway.exe");
-    let directory = temp.path().join("dir").join("runvil-gateway.exe");
-    std::fs::create_dir_all(&directory).expect("directory");
-    let misnamed = temp.path().join("runvil-gateway");
-    write_file(&misnamed, b"gateway");
-
-    for (source, expected) in [
-        (&missing, "does not exist"),
-        (&directory, "is not a file"),
-        (
-            &misnamed,
-            "must be named runvil-gateway.exe for x86_64-pc-windows-msvc",
-        ),
-    ] {
-        let error = sidecar::stage(&root, target, source).expect_err("refused source");
-        assert!(error.contains(expected), "{error}");
-        assert!(error.contains(&source.display().to_string()), "{error}");
-    }
-    assert!(!sidecar::sidecar_path(&root, target).exists());
-}
-
-#[test]
-fn only_windows_targets_bundle_the_sidecar() {
-    assert!(sidecar::bundles_sidecar("x86_64-pc-windows-msvc"));
-    assert!(sidecar::bundles_sidecar("aarch64-pc-windows-msvc"));
-    for target in [
-        "x86_64-unknown-linux-gnu",
-        "aarch64-unknown-linux-gnu",
-        "aarch64-apple-darwin",
-        "x86_64-apple-darwin",
-    ] {
-        assert!(!sidecar::bundles_sidecar(target), "{target}");
-    }
-}
-
-#[test]
-fn a_given_gateway_wins_over_the_slot_and_the_marker_says_whether_it_is_a_stub() {
-    let test_environment = environment();
-    let root = &test_environment.environment.workspace_root;
-    let target = "aarch64-apple-darwin";
-    let given = test_environment.given_gateway(target);
-    let missing = test_environment.temp.path().join("missing-gateway");
-    let error =
-        sidecar::gateway_source(Some(&missing), root, target).expect_err("a missing Gateway");
-    assert!(error.contains("which is not a file"), "{error}");
-    // A relative name is resolved once, against the current directory, and
-    // never through PATH.
-    let error = sidecar::gateway_source(Some(Path::new("no-such-runvil-gateway")), root, target)
-        .expect_err("a bare name");
-    let resolved = std::env::current_dir()
-        .expect("current directory")
-        .join("no-such-runvil-gateway");
-    assert!(error.contains(&resolved.display().to_string()), "{error}");
-
-    assert_eq!(
-        sidecar::gateway_source(Some(&given), root, target),
-        Ok(GatewaySource::Given(given.clone()))
-    );
-    let error = sidecar::gateway_source(None, root, target).expect_err("nothing staged");
-    assert!(
-        error.contains(&format!(
-            "node tools/fetch-gateway-sidecar.mjs --target {target}"
-        )),
-        "{error}"
-    );
-
-    let slot = test_environment.stage_gateway(target);
-    assert_eq!(
-        sidecar::gateway_source(None, root, target),
-        Ok(GatewaySource::Staged { stub: false })
-    );
-    assert_eq!(
-        GatewaySource::Staged { stub: false }.binary(root, target),
-        slot
-    );
-    assert_eq!(
-        sidecar::gateway_source(Some(&given), root, target),
-        Ok(GatewaySource::Given(given))
-    );
-    test_environment.stage_stub(target);
-    assert_eq!(
-        sidecar::gateway_source(None, root, target),
-        Ok(GatewaySource::Staged { stub: true })
-    );
-    // A file some other step staged, with no marker, is a real Gateway.
-    let mut marker = slot.into_os_string();
-    marker.push(".pinned");
-    std::fs::remove_file(marker).expect("remove the marker");
-    assert_eq!(
-        sidecar::gateway_source(None, root, target),
-        Ok(GatewaySource::Staged { stub: false })
-    );
-}
-
-#[test]
-fn the_pinned_version_is_the_pin_s_version_and_a_placeholder_or_missing_pin_fails() {
-    let test_environment = environment();
-    let root = &test_environment.environment.workspace_root;
-    assert_eq!(
-        sidecar::pinned_version(root),
-        Ok(GATEWAY_VERSION.to_owned())
-    );
-
-    let pin = root.join("gateway-pin").join("pin.json");
-    for (contents, expected) in [
-        (r#"{"version": "PLACEHOLDER"}"#, "names no version"),
-        (r#"{"version": ""}"#, "names no version"),
-        (r#"{"tag": "gateway-v1.0.0"}"#, "names no version"),
-        ("not json", "is not JSON"),
-    ] {
-        write_file(&pin, contents.as_bytes());
-        let error = sidecar::pinned_version(root).expect_err(contents);
-        assert!(error.contains(expected), "{contents}: {error}");
-        assert!(error.contains(&pin.display().to_string()), "{error}");
-    }
-    std::fs::remove_file(&pin).expect("remove the pin");
-    let error = sidecar::pinned_version(root).expect_err("missing pin");
-    assert!(error.contains("cannot read the Gateway pin"), "{error}");
-}
diff --git a/crates/build-xtask/Cargo.toml b/crates/build-xtask/Cargo.toml
index 3664f2a0d..4236056f0 100644
--- a/crates/build-xtask/Cargo.toml
+++ b/crates/build-xtask/Cargo.toml
@@ -7,7 +7,6 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
-anyhow.workspace = true
 proc-macro2.workspace = true
 pulldown-cmark.workspace = true
 syn.workspace = true
diff --git a/crates/build-xtask/src/debug_spelling-tests.rs b/crates/build-xtask/src/debug_spelling-tests.rs
index 9ca742df6..b0048dbb0 100644
--- a/crates/build-xtask/src/debug_spelling-tests.rs
+++ b/crates/build-xtask/src/debug_spelling-tests.rs
@@ -136,11 +136,11 @@ use std::fmt::{{self, {BARE}List, Write}};
 fn a_crate_whose_manifest_does_not_parse_is_still_scanned() {
     let root = tempfile::TempDir::new().expect("tempdir");
     let lib = format!("impl {DEBUG_PATH} for Seam {{}}\n");
-    write_crate(root.path(), "workshop/status", &[("lib.rs", lib.as_str())]);
+    write_crate(root.path(), "suite/status", &[("lib.rs", lib.as_str())]);
     std::fs::write(
         root.path()
             .join("crates")
-            .join("workshop")
+            .join("suite")
             .join("status")
             .join("Cargo.toml"),
         "not [valid toml",
@@ -149,7 +149,7 @@ fn a_crate_whose_manifest_does_not_parse_is_still_scanned() {
     let violations = debug_spelling_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
-        violations[0].starts_with(&format!("crates/workshop/status/src/lib.rs:1: {RULE}: ")),
+        violations[0].starts_with(&format!("crates/suite/status/src/lib.rs:1: {RULE}: ")),
         "a crate whose manifest was never read cannot be shown clean: {violations:?}"
     );
 }
diff --git a/crates/build-xtask/src/harness_pin-tests.rs b/crates/build-xtask/src/harness_pin-tests.rs
deleted file mode 100644
index 9360d17f9..000000000
--- a/crates/build-xtask/src/harness_pin-tests.rs
+++ /dev/null
@@ -1,238 +0,0 @@
-//! The runvil-harness pin over this workspace, plus fixtures that each
-//! rule fails for the entry that breaks it, every spelling of the
-//! repository's URL matches, and a git dependency on another repository
-//! is left alone.
-
-use super::*;
-use crate::product::test_support::{workspace_root, write_crate};
-
-/// The `git` field of a dependency on the repository, spelled out here so
-/// the fixtures do not follow the constant they test.
-const GIT: &str = "git = \"https://github.com/cppalliance/runvil-harness\"";
-
-/// The commit the fixtures pin.
-const REV: &str = "732429962c5873458213bb0072a0828a40ee4fb6";
-
-/// A second commit, which sorts before [`REV`].
-const OTHER_REV: &str = "03a9fa37d2fe690d42ee0aa5c7a8289173e8e0f2";
-
-/// A fake workspace root whose `Cargo.toml` is `manifest`, with an empty
-/// `crates/` directory.
-fn workspace(manifest: &str) -> tempfile::TempDir {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(root.path().join("Cargo.toml"), manifest).expect("the root manifest writes");
-    std::fs::create_dir_all(root.path().join("crates")).expect("the crates directory creates");
-    root
-}
-
-#[test]
-fn the_workspace_takes_only_the_public_crates_from_runvil_harness() {
-    let violations = harness_pin_violations(&workspace_root());
-    assert!(
-        violations.is_empty(),
-        "runvil-harness pin violations:\n{}",
-        violations.join("\n")
-    );
-}
-
-#[test]
-fn the_four_public_crates_at_one_rev_pass() {
-    let root = workspace(&format!(
-        "[workspace.dependencies]\n\
-         base64 = \"0.22\"\n\
-         workshop-protocol = {{ path = \"crates/workshop/protocol\" }}\n\
-         runvil = {{ version = \"0.3.0\", {GIT}, rev = \"{REV}\" }}\n\
-         harness-gateway-client = {{ {GIT}, rev = \"{REV}\" }}\n\
-         plugin-web = {{ {GIT}, rev = \"{REV}\" }}\n\
-         plugin-mcp = {{ {GIT}, rev = \"{REV}\" }}\n"
-    ));
-    write_crate(
-        root.path(),
-        "workshop/server",
-        "workshop-server",
-        "[dependencies]\nrunvil.workspace = true\nplugin-web = { workspace = true }\n\
-         [dev-dependencies]\nworkshop-protocol.workspace = true\n",
-    );
-    let violations = harness_pin_violations(root.path());
-    assert!(violations.is_empty(), "{violations:?}");
-}
-
-#[test]
-fn a_fifth_crate_from_the_repository_is_reported() {
-    let root = workspace(&format!(
-        "[workspace.dependencies]\n\
-         runvil = {{ {GIT}, rev = \"{REV}\" }}\n\
-         harness-runner = {{ {GIT}, rev = \"{REV}\" }}\n"
-    ));
-    let violations = harness_pin_violations(root.path());
-    assert_eq!(
-        violations,
-        [
-            "[workspace.dependencies] harness-runner: harness-runner comes from runvil-harness; \
-             crates here may take only runvil, harness-gateway-client, plugin-web, and \
-             plugin-mcp from it"
-        ]
-    );
-}
-
-#[test]
-fn a_renamed_entry_is_reported_by_its_package_name() {
-    let root = workspace(&format!(
-        "[workspace.dependencies]\n\
-         engine = {{ package = \"runvil-engine\", {GIT}, rev = \"{REV}\" }}\n\
-         facade = {{ package = \"runvil\", {GIT}, rev = \"{REV}\" }}\n"
-    ));
-    let violations = harness_pin_violations(root.path());
-    assert_eq!(violations.len(), 1, "{violations:?}");
-    assert!(
-        violations[0].starts_with(
-            "[workspace.dependencies] engine: runvil-engine comes from runvil-harness;"
-        ),
-        "the key locates the entry and the package names the crate: {violations:?}"
-    );
-}
-
-#[test]
-fn an_entry_with_a_branch_and_no_rev_is_reported() {
-    for pin in ["branch = \"main\"", "tag = \"v0.3.0\""] {
-        let root = workspace(&format!(
-            "[workspace.dependencies]\n\
-             runvil = {{ {GIT}, {pin} }}\n\
-             plugin-web = {{ {GIT}, rev = \"{REV}\" }}\n"
-        ));
-        let violations = harness_pin_violations(root.path());
-        assert_eq!(
-            violations,
-            [
-                "[workspace.dependencies] runvil: comes from runvil-harness with no rev; \
-                 required one pinned commit"
-            ],
-            "{pin}"
-        );
-    }
-}
-
-#[test]
-fn two_different_revs_are_reported_once() {
-    let root = workspace(&format!(
-        "[workspace.dependencies]\n\
-         runvil = {{ {GIT}, rev = \"{REV}\" }}\n\
-         harness-gateway-client = {{ {GIT}, rev = \"{REV}\" }}\n\
-         plugin-web = {{ {GIT}, rev = \"{OTHER_REV}\" }}\n\
-         plugin-mcp = {{ {GIT}, rev = \"{OTHER_REV}\" }}\n"
-    ));
-    let violations = harness_pin_violations(root.path());
-    assert_eq!(
-        violations,
-        [format!(
-            "[workspace.dependencies]: the entries from runvil-harness name 2 commits \
-             ({OTHER_REV}, {REV}); required one, because two commits are two copies of every \
-             type the crates share"
-        )]
-    );
-}
-
-#[test]
-fn a_member_naming_the_repository_directly_is_reported() {
-    let root = workspace(&format!(
-        "[workspace.dependencies]\nrunvil = {{ {GIT}, rev = \"{REV}\" }}\n"
-    ));
-    write_crate(
-        root.path(),
-        "workshop/server",
-        "workshop-server",
-        &format!(
-            "[dependencies]\nrunvil = {{ {GIT}, rev = \"{REV}\" }}\n\
-             [dev-dependencies]\nplugin-web.workspace = true\n"
-        ),
-    );
-    write_crate(
-        root.path(),
-        "workshop/desktop",
-        "workshop",
-        &format!(
-            "[target.'cfg(windows)'.dependencies]\nplugin-mcp = {{ {GIT}, rev = \"{REV}\" }}\n"
-        ),
-    );
-    let mut violations = harness_pin_violations(root.path());
-    violations.sort();
-    assert_eq!(
-        violations,
-        [
-            "workshop-server: runvil names runvil-harness directly; required \
-             runvil.workspace = true",
-            "workshop: plugin-mcp names runvil-harness directly; required \
-             plugin-mcp.workspace = true",
-        ]
-    );
-}
-
-#[test]
-fn the_git_suffix_and_a_trailing_slash_still_match() {
-    for url in [
-        "https://github.com/cppalliance/runvil-harness.git",
-        "https://github.com/cppalliance/runvil-harness/",
-        "https://github.com/cppalliance/runvil-harness.git/",
-        "https://GitHub.com/CppAlliance/Runvil-Harness",
-    ] {
-        let root = workspace(&format!(
-            "[workspace.dependencies]\n\
-             harness-runner = {{ git = \"{url}\", rev = \"{REV}\" }}\n"
-        ));
-        write_crate(
-            root.path(),
-            "workshop/server",
-            "workshop-server",
-            &format!("[dependencies]\nrunvil = {{ git = \"{url}\", rev = \"{REV}\" }}\n"),
-        );
-        let violations = harness_pin_violations(root.path());
-        assert_eq!(violations.len(), 2, "{url}: {violations:?}");
-        assert!(
-            violations[0].starts_with("[workspace.dependencies] harness-runner: harness-runner")
-                && violations[1].starts_with("workshop-server: runvil names runvil-harness"),
-            "{url} names the repository in the root manifest and in a member: {violations:?}"
-        );
-    }
-}
-
-#[test]
-fn a_git_dependency_on_another_repository_is_ignored() {
-    let other = "git = \"https://github.com/cppalliance/runvil-plugin-api\"";
-    let near = "git = \"https://github.com/cppalliance/runvil-harness-tools\"";
-    let root = workspace(&format!(
-        "[workspace.dependencies]\n\
-         runvil = {{ {GIT}, rev = \"{REV}\" }}\n\
-         runvil-plugin-sdk = {{ {other}, branch = \"main\" }}\n\
-         harness-runner = {{ {near}, rev = \"{OTHER_REV}\" }}\n"
-    ));
-    write_crate(
-        root.path(),
-        "workshop/plugin-std",
-        "workshop-plugin-std",
-        &format!("[dependencies]\nrunvil-plugin-sdk = {{ {other}, rev = \"{OTHER_REV}\" }}\n"),
-    );
-    let violations = harness_pin_violations(root.path());
-    assert!(
-        violations.is_empty(),
-        "another repository's crates, pins, and commits are not this check's: {violations:?}"
-    );
-}
-
-#[test]
-fn an_unreadable_or_unparseable_root_manifest_is_reported() {
-    let missing = tempfile::TempDir::new().expect("tempdir");
-    let broken = workspace("not [valid toml");
-    for (root, problem) in [
-        (&missing, ": unreadable manifest: "),
-        (&broken, ": unparseable manifest: "),
-    ] {
-        let manifest = root.path().join("Cargo.toml");
-        let violations = harness_pin_violations(root.path());
-        assert_eq!(violations.len(), 1, "{violations:?}");
-        assert!(
-            violations[0].starts_with(&manifest.display().to_string())
-                && violations[0].contains(problem),
-            "a table that was never read cannot be shown pinned: {violations:?}"
-        );
-    }
-}
diff --git a/crates/build-xtask/src/harness_pin.rs b/crates/build-xtask/src/harness_pin.rs
deleted file mode 100644
index 2af243bbf..000000000
--- a/crates/build-xtask/src/harness_pin.rs
+++ /dev/null
@@ -1,160 +0,0 @@
-//! The pin on the crates this workspace takes from runvil-harness, the
-//! repository that holds the Engine and the Harness. Those crates arrive
-//! as git dependencies, which the product matrix cannot see, so this check
-//! reads the manifests instead: crates here reach the Engine and the
-//! Harness only through the public crates in [`HARNESS_PUBLIC`], all at
-//! one commit. Runs as part of `cargo test -p build-xtask` and
-//! `cargo xtask tidy`.
-//!
-//! The rules:
-//!
-//! 1. An entry of the root `[workspace.dependencies]` that comes from the
-//!    repository names one of the four public crates, by its `package`
-//!    field when it has one and by its key otherwise.
-//! 2. Each such entry pins a `rev`; a `branch` or a `tag` does not count.
-//! 3. The entries name one `rev` between them, because two commits are two
-//!    copies of every type the crates share.
-//! 4. No workspace member names the repository in its own manifest, in any
-//!    dependency table, the target-specific ones included: a member takes
-//!    these crates with `<dep>.workspace = true`.
-
-use std::collections::BTreeSet;
-use std::fs;
-use std::path::Path;
-
-/// The repository that holds the Engine and the Harness.
-const HARNESS_REPOSITORY: &str = "https://github.com/cppalliance/runvil-harness";
-
-/// The four crates of that repository a crate here may depend on: the
-/// Harness facade, which is the one crate a Host depends on, the standard
-/// Gateway client, and the two Rust Plugins Workshop links in.
-const HARNESS_PUBLIC: [&str; 4] = [
-    "runvil",
-    "harness-gateway-client",
-    "plugin-web",
-    "plugin-mcp",
-];
-
-/// Runs the four rules over the root manifest's `[workspace.dependencies]`
-/// and every workspace member's manifest. A root manifest that cannot be
-/// read or parsed is reported, not skipped: a table that was never read
-/// cannot be shown pinned.
-#[must_use]
-pub(crate) fn harness_pin_violations(root: &Path) -> Vec<String> {
-    let mut violations = workspace_violations(&root.join("Cargo.toml"));
-    violations.extend(member_violations(root));
-    violations
-}
-
-/// The breaches of rules 1 to 3 in the `[workspace.dependencies]` of the
-/// root manifest at `path`, or the one reason the manifest could not be
-/// read.
-fn workspace_violations(path: &Path) -> Vec<String> {
-    let text = match fs::read_to_string(path) {
-        Ok(text) => text,
-        Err(error) => {
-            return vec![format!("{}: unreadable manifest: {error}", path.display())];
-        }
-    };
-    let manifest: toml::Value = match toml::from_str(&text) {
-        Ok(manifest) => manifest,
-        Err(error) => {
-            return vec![format!("{}: unparseable manifest: {error}", path.display())];
-        }
-    };
-    let Some(entries) = manifest
-        .get("workspace")
-        .and_then(|workspace| workspace.get("dependencies"))
-        .and_then(toml::Value::as_table)
-    else {
-        return Vec::new();
-    };
-    let mut violations = Vec::new();
-    let mut revs = BTreeSet::new();
-    for (key, entry) in entries {
-        if !from_harness(entry) {
-            continue;
-        }
-        let package = entry
-            .get("package")
-            .and_then(toml::Value::as_str)
-            .unwrap_or(key);
-        if !HARNESS_PUBLIC.contains(&package) {
-            violations.push(format!(
-                "[workspace.dependencies] {key}: {package} comes from runvil-harness; crates \
-                 here may take only {} from it",
-                public_crates()
-            ));
-        }
-        match entry.get("rev").and_then(toml::Value::as_str) {
-            Some(rev) => {
-                revs.insert(rev);
-            }
-            None => violations.push(format!(
-                "[workspace.dependencies] {key}: comes from runvil-harness with no rev; \
-                 required one pinned commit"
-            )),
-        }
-    }
-    if revs.len() > 1 {
-        violations.push(format!(
-            "[workspace.dependencies]: the entries from runvil-harness name {} commits ({}); \
-             required one, because two commits are two copies of every type the crates share",
-            revs.len(),
-            revs.into_iter().collect::<Vec<_>>().join(", ")
-        ));
-    }
-    violations
-}
-
-/// The breaches of rule 4: each dependency, in any dependency table of any
-/// workspace member's manifest, that names the repository itself.
-///
-/// The walk's read failures belong to `tidy::marker_violations`, the one
-/// owner, as they do for the product-boundary check.
-fn member_violations(root: &Path) -> Vec<String> {
-    let walk = crate::product::workspace_crates(root);
-    let mut violations = Vec::new();
-    for krate in &walk.crates {
-        let tables =
-            crate::manifest::dependency_tables(&krate.manifest, &crate::product::DEP_KINDS);
-        for (_, table) in tables {
-            for (dep, entry) in table {
-                if from_harness(entry) {
-                    violations.push(format!(
-                        "{}: {dep} names runvil-harness directly; required \
-                         {dep}.workspace = true",
-                        krate.package
-                    ));
-                }
-            }
-        }
-    }
-    violations
-}
-
-/// Whether a dependency entry's `git` names [`HARNESS_REPOSITORY`]. The
-/// URLs are compared without a trailing `/` or `.git` and without regard
-/// to ASCII case, since each of those spellings reaches the same
-/// repository.
-fn from_harness(entry: &toml::Value) -> bool {
-    entry
-        .get("git")
-        .and_then(toml::Value::as_str)
-        .is_some_and(|git| {
-            let url = git.to_ascii_lowercase();
-            let url = url.strip_suffix('/').unwrap_or(&url);
-            let url = url.strip_suffix(".git").unwrap_or(url);
-            url.eq_ignore_ascii_case(HARNESS_REPOSITORY)
-        })
-}
-
-/// [`HARNESS_PUBLIC`] as a violation lists it: `a, b, c, and d`.
-fn public_crates() -> String {
-    let [rest @ .., last] = HARNESS_PUBLIC;
-    format!("{}, and {last}", rest.join(", "))
-}
-
-#[cfg(test)]
-#[path = "harness_pin-tests.rs"]
-mod tests;
diff --git a/crates/build-xtask/src/main.rs b/crates/build-xtask/src/main.rs
index 4d57fabc5..65ea2b4de 100644
--- a/crates/build-xtask/src/main.rs
+++ b/crates/build-xtask/src/main.rs
@@ -1,15 +1,13 @@
-//! `build-xtask` - workspace automation for the Runvil repository.
+//! `build-xtask` - workspace automation for the Runvil repository: the
+//! structural checks and the documentation site.
 //!
 //! ## Invariants
 //!
-//! - Tier: tooling. The tidy-style
-//!   architecture checks run as tests (`cargo test -p build-xtask`);
+//! - The structural checks run as tests (`cargo test -p build-xtask`);
 //!   `cargo xtask tidy` prints the same report on demand.
 
 mod debug_spelling;
-mod harness_pin;
 mod manifest;
-mod new_crate;
 mod no_doctests;
 mod product;
 mod site;
@@ -27,22 +25,10 @@ fn main() -> ExitCode {
         return ExitCode::FAILURE;
     };
     match args.get(1).map(String::as_str) {
-        Some("new-crate") => match args.get(2) {
-            Some(name) => match new_crate::scaffold(root, name) {
-                Ok(dir) => {
-                    println!("scaffolded {}", dir.display());
-                    ExitCode::SUCCESS
-                }
-                Err(error) => {
-                    eprintln!("error: {error:#}");
-                    ExitCode::FAILURE
-                }
-            },
-            None => usage(),
-        },
         Some("site") => site::run(
             root,
             std::env::var_os(site::DOCS_VAR).as_deref(),
+            std::env::var_os(site::HARNESS_VAR).as_deref(),
             &args[2..],
         ),
         Some("tidy") => {
@@ -62,9 +48,6 @@ fn main() -> ExitCode {
 }
 
 fn usage() -> ExitCode {
-    eprintln!(
-        "usage: cargo xtask new-crate <workshop-name> | cargo xtask tidy | \
-         cargo xtask site [--books-only]"
-    );
+    eprintln!("usage: cargo xtask tidy | cargo xtask site [--books-only]");
     ExitCode::from(2)
 }
diff --git a/crates/build-xtask/src/manifest.rs b/crates/build-xtask/src/manifest.rs
index 18d6a7531..36addac13 100644
--- a/crates/build-xtask/src/manifest.rs
+++ b/crates/build-xtask/src/manifest.rs
@@ -1,9 +1,9 @@
 //! Shared walk over a parsed `Cargo.toml`: the dependency tables of the
 //! requested kinds, both at the top level and under `[target.<cfg>]`.
 //!
-//! Every structural check that reads declared dependencies (the product
-//! matrix, the workshop tiers, the runvil-harness pin) goes through this
-//! one walk and differs only in the kinds it asks for.
+//! Every structural check that reads declared dependencies goes through
+//! this one walk and names the kinds it asks for, as the product matrix
+//! does.
 
 /// Every dependency table of the given kinds, labeled the way its section
 /// header reads: the plain `<kind>` tables and their `[target.<cfg>.<kind>]`
diff --git a/crates/build-xtask/src/new_crate.rs b/crates/build-xtask/src/new_crate.rs
deleted file mode 100644
index e6cc39437..000000000
--- a/crates/build-xtask/src/new_crate.rs
+++ /dev/null
@@ -1,166 +0,0 @@
-//! `cargo xtask new-crate` scaffolder for `workshop-*` crates.
-
-use std::fs;
-use std::path::{Path, PathBuf};
-
-use anyhow::Context as _;
-
-/// Scaffold `crates/<name>/` with a manifest, a facade `lib.rs` holding
-/// the invariant docs, and the crate's integration-test binary.
-///
-/// # Errors
-///
-/// Returns an error when `name` is not a kebab-case `workshop-*` name, when
-/// the crate directory already exists, or when any file cannot be written.
-pub(crate) fn scaffold(root: &Path, name: &str) -> anyhow::Result<PathBuf> {
-    let short = validate_name(name)?;
-    let dir = root.join("crates").join("workshop").join(short);
-    anyhow::ensure!(
-        !dir.exists(),
-        "crate directory already exists: {}",
-        dir.display()
-    );
-    let create = |path: PathBuf| {
-        fs::create_dir_all(&path).with_context(|| format!("create {}", path.display()))
-    };
-    let write = |path: PathBuf, contents: &str| {
-        fs::write(&path, contents).with_context(|| format!("write {}", path.display()))
-    };
-    create(dir.join("src"))?;
-    create(dir.join("tests").join("it"))?;
-    write(dir.join("Cargo.toml"), &manifest(name))?;
-    write(dir.join("src").join("lib.rs"), &lib_rs(name))?;
-    write(
-        dir.join("tests").join("it").join("main.rs"),
-        &test_main_rs(name),
-    )?;
-    Ok(dir)
-}
-
-/// Kebab-case `workshop-<name>`: the server decomposition's crate namespace.
-/// Returns the validated `<name>` suffix.
-fn validate_name(name: &str) -> anyhow::Result<&str> {
-    let suffix = name.strip_prefix("workshop-").unwrap_or("");
-    anyhow::ensure!(
-        !suffix.is_empty()
-            && !suffix.starts_with('-')
-            && !suffix.ends_with('-')
-            && !suffix.contains("--")
-            && suffix
-                .bytes()
-                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-'),
-        "invalid crate name `{name}`: expected kebab-case `workshop-<name>`"
-    );
-    Ok(suffix)
-}
-
-fn manifest(name: &str) -> String {
-    format!(
-        "[package]\n\
-         name = \"{name}\"\n\
-         version = \"0.0.0\"\n\
-         publish = false\n\
-         edition.workspace = true\n\
-         license.workspace = true\n\
-         repository.workspace = true\n\
-         \n\
-         [dependencies]\n\
-         \n\
-         [lints]\n\
-         workspace = true\n"
-    )
-}
-
-fn lib_rs(name: &str) -> String {
-    format!(
-        "//! {name} - TODO: one-line purpose.\n\
-         //!\n\
-         //! ## Invariants\n\
-         //!\n\
-         //! - Tier: TODO (vocabulary | services | features | server); may depend\n\
-         //!   on: TODO. `cargo test -p build-xtask` enforces the product and\n\
-         //!   container boundaries.\n"
-    )
-}
-
-fn test_main_rs(name: &str) -> String {
-    format!("//! Integration tests for `{name}`.\n")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::fs;
-
-    fn scaffold_scratch() -> (tempfile::TempDir, PathBuf, PathBuf) {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().join("repo");
-        fs::create_dir_all(root.join("crates")).expect("crates dir");
-        let dir = scaffold(&root, "workshop-scratch").expect("scaffold");
-        (temp, root, dir)
-    }
-
-    #[test]
-    fn scaffold_creates_manifest_lib_and_test_binary() {
-        let (_temp, _root, dir) = scaffold_scratch();
-        let manifest = fs::read_to_string(dir.join("Cargo.toml")).expect("manifest");
-        assert!(manifest.contains("name = \"workshop-scratch\""));
-        assert!(manifest.contains("version = \"0.0.0\""));
-        assert!(manifest.contains("publish = false"));
-        assert!(manifest.contains("[lints]\nworkspace = true"));
-        let lib = fs::read_to_string(dir.join("src").join("lib.rs")).expect("lib.rs");
-        assert!(lib.contains("//! ## Invariants"));
-        assert!(dir.join("tests").join("it").join("main.rs").is_file());
-    }
-
-    #[test]
-    fn scaffold_writes_no_build_script() {
-        let (_temp, _root, dir) = scaffold_scratch();
-        assert!(!dir.join("build.rs").exists());
-        let text = fs::read_to_string(dir.join("Cargo.toml")).expect("manifest");
-        let manifest: toml::Value = toml::from_str(&text).expect("valid toml");
-        assert!(manifest.get("build-dependencies").is_none(), "{text}");
-    }
-
-    #[test]
-    fn scaffolded_manifest_parses_and_inherits_workspace_metadata() {
-        let (_temp, _root, dir) = scaffold_scratch();
-        let text = fs::read_to_string(dir.join("Cargo.toml")).expect("manifest");
-        let manifest: toml::Value = toml::from_str(&text).expect("valid toml");
-        let workspace_bool = |key: &str| {
-            manifest
-                .get("package")
-                .and_then(|p| p.get(key))
-                .and_then(|v| v.get("workspace"))
-                .and_then(toml::Value::as_bool)
-        };
-        assert_eq!(workspace_bool("edition"), Some(true));
-        assert_eq!(workspace_bool("license"), Some(true));
-        assert_eq!(workspace_bool("repository"), Some(true));
-        let lints = manifest
-            .get("lints")
-            .and_then(|l| l.get("workspace"))
-            .and_then(toml::Value::as_bool);
-        assert_eq!(lints, Some(true));
-    }
-
-    #[test]
-    fn scaffold_refuses_to_overwrite_an_existing_crate() {
-        let (_temp, root, _dir) = scaffold_scratch();
-        assert!(scaffold(&root, "workshop-scratch").is_err());
-    }
-
-    #[test]
-    fn scaffold_rejects_names_outside_the_workshop_namespace() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        for name in [
-            "scratch",
-            "Workshop-Scratch",
-            "workshop-",
-            "workshop-Bad",
-            "workshop--double",
-        ] {
-            assert!(scaffold(temp.path(), name).is_err(), "accepted {name}");
-        }
-    }
-}
diff --git a/crates/build-xtask/src/product.rs b/crates/build-xtask/src/product.rs
index b1782d2f7..8f6608c61 100644
--- a/crates/build-xtask/src/product.rs
+++ b/crates/build-xtask/src/product.rs
@@ -2,44 +2,39 @@
 //! workspace holds.
 //!
 //! Every workspace crate is classified by package name into a family:
-//! Workshop crates (`workshop` and `workshop-*`), build crates
-//! (`build-*`), and unaffiliated crates, which are all the rest. Its
-//! dependencies of every kind (normal, dev, build, and target-specific)
-//! are checked against the matrix:
+//! build crates (`build-*`) and unaffiliated crates, which are all the
+//! rest. Its dependencies of every kind (normal, dev, build, and
+//! target-specific) are checked against the matrix, which holds one rule:
 //!
-//! - Desktop-app boundary: the `workshop` desktop app may depend on no
-//!   workshop crate except `workshop-server-api`, and `workshop-server-api`
-//!   on none except `workshop-server`. A crate's dependency on itself is
-//!   not an edge.
-//! - Container privacy: a manifestless directory under `crates/`, as
-//!   `crates/workshop/` is, is private to its family; only the crates
-//!   inside a container and the `build-*` crates, which are meta tooling,
-//!   may depend on the crates it holds. Containers may nest.
+//! - Container privacy: a manifestless directory under `crates/` is a
+//!   container, private to the crates inside it; only they and the
+//!   `build-*` crates, which are meta tooling, may depend on the crates it
+//!   holds. Containers may nest. The workspace holds no container today,
+//!   so the rule binds the first one added.
 //!
 //! Crates from other repositories are outside the matrix: it classifies
-//! and binds only workspace members. The crates that come from
-//! runvil-harness are checked by `harness_pin` instead.
+//! and binds only workspace members.
+//!
+//! The crate walk, `workspace_crates`, is here too: the one enumeration of
+//! the workspace's crates that every structural check shares.
 
 use std::fs;
 use std::path::{Path, PathBuf};
 
 /// The dependency tables cargo recognizes, directly and under `[target]`.
-pub(crate) const DEP_KINDS: [&str; 3] = ["dependencies", "dev-dependencies", "build-dependencies"];
+const DEP_KINDS: [&str; 3] = ["dependencies", "dev-dependencies", "build-dependencies"];
 
-/// The product family a package name belongs to.
+/// The family a package name belongs to.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum Family {
-    Workshop,
     Build,
-    /// Named after no product family; has no matrix rules of its own.
+    /// Named after no family; has no matrix rules of its own.
     Unaffiliated,
 }
 
-/// Classifies a package name into its product family.
+/// Classifies a package name into its family.
 fn family(package: &str) -> Family {
-    if package == "workshop" || package.starts_with("workshop-") {
-        Family::Workshop
-    } else if package.starts_with("build-") {
+    if package.starts_with("build-") {
         Family::Build
     } else {
         Family::Unaffiliated
@@ -47,24 +42,22 @@ fn family(package: &str) -> Family {
 }
 
 /// A workspace crate: its package name, its manifest directory relative to
-/// the workspace root, its parsed manifest, and its dependency package
-/// names.
+/// the workspace root, and its dependency package names.
 pub(crate) struct CrateInfo {
-    pub(crate) package: String,
+    package: String,
     pub(crate) dir: PathBuf,
-    pub(crate) manifest: toml::Value,
     deps: Vec<String>,
 }
 
-/// Every crate under `crates/`, as the one enumeration the architecture
+/// Every crate under `crates/`, as the one enumeration the structural
 /// checks share.
 pub(crate) struct CrateWalk {
     /// The crates whose manifests named a package.
     pub(crate) crates: Vec<CrateInfo>,
     /// Crate directories, relative to the workspace root, whose manifest
     /// could not be read, parsed, or named. A crate that cannot be read
-    /// cannot be shown exempt, so the checks that bind by package name
-    /// bind these too.
+    /// cannot be shown to pass, so the checks that bind every crate bind
+    /// these too.
     pub(crate) unread: Vec<PathBuf>,
     /// Every read failure, in walk order.
     pub(crate) violations: Vec<String>,
@@ -72,8 +65,8 @@ pub(crate) struct CrateWalk {
 
 /// Checks every workspace manifest against the product-boundary matrix.
 ///
-/// The walk's read failures belong to `tidy::marker_violations`, the one
-/// owner: both checks share the walk, so reporting them here too would
+/// The walk's read failures belong to `tidy::crate_walk_violations`, the
+/// one owner: both checks share the walk, so reporting them here too would
 /// name every unreadable manifest twice in `tidy::all_violations`.
 #[must_use]
 pub(crate) fn product_boundary_violations(root: &Path) -> Vec<String> {
@@ -81,8 +74,8 @@ pub(crate) fn product_boundary_violations(root: &Path) -> Vec<String> {
     let mut violations = Vec::new();
     for package in &crates {
         for dep_name in &package.deps {
-            // Only workspace members are bound by the matrix; a crates.io
-            // package that happens to start with a product prefix is not.
+            // Only workspace members are bound by the matrix; a package
+            // from crates.io or another repository is outside it.
             let Some(dep) = crates.iter().find(|krate| &krate.package == dep_name) else {
                 continue;
             };
@@ -97,61 +90,35 @@ pub(crate) fn product_boundary_violations(root: &Path) -> Vec<String> {
     violations
 }
 
-/// The Tauri desktop app crate, bound by the desktop-app boundary rule.
-const DESKTOP: &str = "workshop";
-/// The server's re-export facade: the one workshop crate the desktop app
-/// may name.
-const SERVER_API: &str = "workshop-server-api";
-/// The server crate: the one workshop crate the facade may name.
-const SERVER: &str = "workshop-server";
-
 /// The reason a dependency from `package` to `dep` breaches the matrix,
 /// or `None` when the edge is legal.
 fn boundary_breach(package: &CrateInfo, dep: &CrateInfo) -> Option<String> {
-    if let Some(face) = desktop_boundary_face(&package.package)
-        && family(&dep.package) == Family::Workshop
-        && dep.package != face
-        && dep.package != package.package
-    {
-        return Some(format!(
-            "on the desktop-app boundary, {} may depend on workshop crates only through {face}",
-            package.package
-        ));
-    }
     if let Some(container) = container_of(&dep.dir) {
         // Inside is physical containment: a crate anywhere under
-        // crates/<container>/ may name the container's crates, so nested
-        // subsystems see their parent family's crates while the family
-        // cannot name the subsystem's private crates back.
+        // crates/<container>/ may name the container's crates, so the
+        // crates of a nested container may name the crates of the
+        // container around it, while those may not name the nested
+        // container's crates back.
         let inside = package
             .dir
             .starts_with(Path::new("crates").join(&container));
-        // The build-* crates are meta tooling, not a product family: they
-        // may depend into any container.
+        // The build-* crates are meta tooling: they may depend into any
+        // container.
         let meta = family(&package.package) == Family::Build;
         if !inside && !meta {
             return Some(format!(
-                "crates/{container} is private to its family; no outside crate may depend into it"
+                "crates/{container} is private to the crates inside it; no outside crate may \
+                 depend into it"
             ));
         }
     }
     None
 }
 
-/// The one workshop crate a crate on the desktop-app boundary may name, or
-/// `None` for a crate the boundary does not bind.
-fn desktop_boundary_face(package: &str) -> Option<&'static str> {
-    match package {
-        DESKTOP => Some(SERVER_API),
-        SERVER_API => Some(SERVER),
-        _ => None,
-    }
-}
-
 /// The root-relative path of the deepest manifestless `crates/<container>/`
 /// directory holding the crate whose root-relative manifest directory is
-/// `dir` (`crates/workshop/server` is in `workshop`), or
-/// `None` for a crate directly under `crates/`.
+/// `dir` (`crates/suite/server` is in `suite`), or `None` for a crate
+/// directly under `crates/`.
 fn container_of(dir: &Path) -> Option<String> {
     let mut components = dir.components();
     if components.next()?.as_os_str() != "crates" {
@@ -166,12 +133,12 @@ fn container_of(dir: &Path) -> Option<String> {
     }
 }
 
-/// Every workspace crate's package name, manifest directory, parsed
-/// manifest, and dependency package names, plus the directories and
-/// violations for manifests that could not be read or parsed. A directory
-/// under `crates/` containing a `Cargo.toml` is a crate and is not
-/// descended into; any other directory is a container and the walk
-/// descends, so containers may nest.
+/// Every workspace crate's package name, manifest directory, and
+/// dependency package names, plus the directories and violations for
+/// manifests that could not be read or parsed. A directory under `crates/`
+/// containing a `Cargo.toml` is a crate and is not descended into; any
+/// other directory is a container and the walk descends, so containers
+/// may nest.
 pub(crate) fn workspace_crates(root: &Path) -> CrateWalk {
     let mut walk = CrateWalk {
         crates: Vec::new(),
@@ -258,12 +225,10 @@ fn read_crate(root: &Path, dir: &Path, walk: &mut CrateWalk) {
         ));
         return;
     };
-    let (package, deps) = (package.to_owned(), manifest_dependencies(&manifest));
     walk.crates.push(CrateInfo {
-        package,
+        package: package.to_owned(),
         dir: relative,
-        manifest,
-        deps,
+        deps: manifest_dependencies(&manifest),
     });
 }
 
diff --git a/crates/build-xtask/src/product/container_tests.rs b/crates/build-xtask/src/product/container_tests.rs
index ca6948333..e225c66db 100644
--- a/crates/build-xtask/src/product/container_tests.rs
+++ b/crates/build-xtask/src/product/container_tests.rs
@@ -1,44 +1,44 @@
-//! Container-privacy fixtures: the manifestless `crates/<family>/`
-//! containers are private to their families; from outside, only the
-//! `build-*` crates may depend into one.
+//! Container-privacy fixtures: a manifestless directory under `crates/` is
+//! private to the crates inside it; from outside, only the `build-*`
+//! crates may depend into one.
 
 use super::product_boundary_violations;
 use super::test_support::write_crate;
 
 #[test]
-fn an_outside_crate_depending_into_the_workshop_container_is_reported() {
+fn an_outside_crate_depending_into_a_container_is_reported() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
         "outside-tool",
         "outside-tool",
-        "[dependencies]\nworkshop-protocol = { path = \"../workshop/protocol\" }\n",
+        "[dependencies]\nsuite-protocol = { path = \"../suite/protocol\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
-        violations[0].contains("outside-tool depends on workshop-protocol")
-            && violations[0].contains("crates/workshop is private to its family")
+        violations[0].contains("outside-tool depends on suite-protocol")
+            && violations[0].contains("crates/suite is private to the crates inside it")
             && violations[0].contains("no outside crate"),
-        "the violation includes the workshop container privacy message: {violations:?}"
+        "the violation includes the container privacy message: {violations:?}"
     );
 }
 
 #[test]
-fn workshop_container_siblings_may_depend_on_each_other() {
+fn container_siblings_may_depend_on_each_other() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
-        "workshop/server",
-        "workshop-server",
-        "[dependencies]\nworkshop-protocol = { path = \"../protocol\" }\n",
+        "suite/server",
+        "suite-server",
+        "[dependencies]\nsuite-protocol = { path = \"../protocol\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert!(
         violations.is_empty(),
-        "workshop container siblings may depend on each other: {violations:?}"
+        "container siblings may depend on each other: {violations:?}"
     );
 }
 
@@ -47,11 +47,11 @@ fn a_build_crate_depending_into_a_container_passes() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
-        "build-workshop",
-        "build-workshop",
-        "[dependencies]\nworkshop-protocol = { path = \"../workshop/protocol\" }\n",
+        "build-tool",
+        "build-tool",
+        "[dependencies]\nsuite-protocol = { path = \"../suite/protocol\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert!(
         violations.is_empty(),
@@ -60,24 +60,19 @@ fn a_build_crate_depending_into_a_container_passes() {
 }
 
 #[test]
-fn a_crate_outside_the_workshop_container_cannot_reach_a_nested_one() {
+fn a_crate_outside_a_container_cannot_reach_a_nested_one() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
         "outside-tool",
         "outside-tool",
-        "[dependencies]\nworkshop-protocol = { path = \"../workshop/nested/protocol\" }\n",
-    );
-    write_crate(
-        root.path(),
-        "workshop/nested/protocol",
-        "workshop-protocol",
-        "",
+        "[dependencies]\nsuite-protocol = { path = \"../suite/nested/protocol\" }\n",
     );
+    write_crate(root.path(), "suite/nested/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
-        violations[0].contains("crates/workshop/nested is private to its family")
+        violations[0].contains("crates/suite/nested is private to the crates inside it")
             && violations[0].contains("no outside crate"),
         "the violation names the nested container and refuses every outside crate: {violations:?}"
     );
diff --git a/crates/build-xtask/src/product/test_support.rs b/crates/build-xtask/src/product/test_support.rs
index 6007d6bc2..70046d9b9 100644
--- a/crates/build-xtask/src/product/test_support.rs
+++ b/crates/build-xtask/src/product/test_support.rs
@@ -13,7 +13,7 @@ pub(crate) fn workspace_root() -> PathBuf {
 
 /// Writes a minimal crate manifest into a fake workspace; `dir_name` may
 /// contain a slash to nest the crate under a container
-/// (`workshop/protocol`).
+/// (`suite/protocol`).
 pub(crate) fn write_crate(root: &Path, dir_name: &str, package: &str, deps: &str) {
     let dir = root.join("crates").join(dir_name);
     std::fs::create_dir_all(&dir).expect("the crate directory creates");
diff --git a/crates/build-xtask/src/product/tests.rs b/crates/build-xtask/src/product/tests.rs
index f074a2710..4cb469f25 100644
--- a/crates/build-xtask/src/product/tests.rs
+++ b/crates/build-xtask/src/product/tests.rs
@@ -1,5 +1,5 @@
-//! Product-boundary fixtures: the desktop-app boundary, the dependency
-//! tables and renames the check reads, and the classification itself.
+//! Product-boundary fixtures: the dependency tables and renames the check
+//! reads, the walk's read failures, and the classification itself.
 //! Container-privacy fixtures sit in `container_tests.rs`.
 
 use super::test_support::{workspace_root, write_crate};
@@ -15,134 +15,24 @@ fn workspace_respects_the_product_boundary() {
     );
 }
 
-#[test]
-fn workshop_depends_on_workshop_server_api_only() {
-    let walk = workspace_crates(&workspace_root());
-    assert!(walk.violations.is_empty(), "{:?}", walk.violations);
-    let desktop = walk
-        .crates
-        .iter()
-        .find(|krate| krate.package == "workshop")
-        .expect("the workshop desktop app crate is a workspace member");
-    assert!(
-        desktop.deps.iter().any(|dep| dep == "workshop-server-api"),
-        "the desktop app reaches the server through the api crate: {:?}",
-        desktop.deps
-    );
-    assert!(
-        !desktop.deps.iter().any(|dep| dep == "workshop-server"),
-        "the desktop app never depends on workshop-server directly: {:?}",
-        desktop.deps
-    );
-}
-
-#[test]
-fn the_desktop_app_re_adding_workshop_server_is_reported() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(
-        root.path(),
-        "workshop",
-        "workshop",
-        "[dependencies]\nworkshop-server-api = { path = \"../workshop-server-api\" }\n\
-         [dev-dependencies]\nworkshop-server = { path = \"../workshop-server\" }\n",
-    );
-    write_crate(
-        root.path(),
-        "workshop-server-api",
-        "workshop-server-api",
-        "",
-    );
-    write_crate(root.path(), "workshop-server", "workshop-server", "");
-    let violations = product_boundary_violations(root.path());
-    assert_eq!(violations.len(), 1, "{violations:?}");
-    assert!(
-        violations[0].starts_with("workshop depends on workshop-server:")
-            && violations[0].contains("workshop-server-api"),
-        "the violation names the desktop app, the forbidden dep, and the facade: {violations:?}"
-    );
-}
-
-#[test]
-fn the_desktop_boundarys_allowed_edges_pass() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let api = "workshop-server-api = { path = \"../workshop-server-api\" }\n";
-    write_crate(
-        root.path(),
-        "workshop",
-        "workshop",
-        &format!("[dependencies]\n{api}[dev-dependencies]\n{api}"),
-    );
-    write_crate(
-        root.path(),
-        "workshop-server-api",
-        "workshop-server-api",
-        "[dependencies]\nworkshop-server = { path = \"../workshop-server\" }\n\
-         [dev-dependencies]\nworkshop-server-api = { path = \".\", features = [\"test-fixtures\"] }\n",
-    );
-    write_crate(root.path(), "workshop-server", "workshop-server", "");
-    let violations = product_boundary_violations(root.path());
-    assert!(
-        violations.is_empty(),
-        "the desktop app names the facade, and the facade names the server and itself: {violations:?}"
-    );
-}
-
-#[test]
-fn a_desktop_dependency_on_a_workshop_crate_other_than_the_facade_is_reported() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(
-        root.path(),
-        "workshop",
-        "workshop",
-        "[dependencies]\nworkshop-status = { path = \"../workshop-status\" }\n",
-    );
-    write_crate(root.path(), "workshop-status", "workshop-status", "");
-    let violations = product_boundary_violations(root.path());
-    assert_eq!(violations.len(), 1, "{violations:?}");
-    assert!(
-        violations[0].starts_with("workshop depends on workshop-status:")
-            && violations[0].ends_with("only through workshop-server-api"),
-        "the violation names the desktop app, the forbidden dep, and the facade: {violations:?}"
-    );
-}
-
-#[test]
-fn a_facade_dependency_on_a_workshop_crate_other_than_the_server_is_reported() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(
-        root.path(),
-        "workshop-server-api",
-        "workshop-server-api",
-        "[dev-dependencies]\nworkshop-status = { path = \"../workshop-status\" }\n",
-    );
-    write_crate(root.path(), "workshop-status", "workshop-status", "");
-    let violations = product_boundary_violations(root.path());
-    assert_eq!(violations.len(), 1, "{violations:?}");
-    assert!(
-        violations[0].starts_with("workshop-server-api depends on workshop-status:")
-            && violations[0].ends_with("only through workshop-server"),
-        "the violation names the facade, the forbidden dep, and the server: {violations:?}"
-    );
-}
-
 #[test]
 fn a_crate_named_like_the_former_gateway_family_is_an_outside_crate() {
     // The Gateway moved to its own repository, so no crate here is
     // classified into a gateway family. A package that would have been one
-    // is an ordinary outside crate and is kept out of the workshop
-    // container like any other.
+    // is an ordinary outside crate and is kept out of a container like any
+    // other.
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
         "gateway-routing",
         "gateway-routing",
-        "[dependencies]\nworkshop-protocol = { path = \"../workshop/protocol\" }\n",
+        "[dependencies]\nsuite-protocol = { path = \"../suite/protocol\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
-        violations[0].starts_with("gateway-routing depends on workshop-protocol:")
+        violations[0].starts_with("gateway-routing depends on suite-protocol:")
             && violations[0].contains("no outside crate may depend into it"),
         "container privacy binds it as it binds any other outside crate: {violations:?}"
     );
@@ -155,11 +45,11 @@ fn dev_build_and_target_dependencies_are_checked() {
         root.path(),
         "outside-tool",
         "outside-tool",
-        "[dev-dependencies]\nworkshop-protocol = { path = \"../workshop/protocol\" }\n\
-         [target.'cfg(windows)'.dependencies]\nworkshop-status = { path = \"../workshop/status\" }\n",
+        "[dev-dependencies]\nsuite-protocol = { path = \"../suite/protocol\" }\n\
+         [target.'cfg(windows)'.dependencies]\nsuite-status = { path = \"../suite/status\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
-    write_crate(root.path(), "workshop/status", "workshop-status", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
+    write_crate(root.path(), "suite/status", "suite-status", "");
     let violations = product_boundary_violations(root.path());
     assert_eq!(
         violations.len(),
@@ -175,14 +65,14 @@ fn package_renames_are_resolved_before_classification() {
         root.path(),
         "outside-tool",
         "outside-tool",
-        "[dependencies]\nwire = { package = \"workshop-protocol\", path = \"../workshop/protocol\" }\n",
+        "[dependencies]\nwire = { package = \"suite-protocol\", path = \"../suite/protocol\" }\n",
     );
-    write_crate(root.path(), "workshop/protocol", "workshop-protocol", "");
+    write_crate(root.path(), "suite/protocol", "suite-protocol", "");
     let violations = product_boundary_violations(root.path());
     assert_eq!(
         violations.len(),
         1,
-        "the renamed dependency on workshop-protocol is reported: {violations:?}"
+        "the renamed dependency on suite-protocol is reported: {violations:?}"
     );
 }
 
@@ -200,14 +90,12 @@ fn an_unparseable_manifest_is_reported() {
     );
     assert!(
         product_boundary_violations(root.path()).is_empty(),
-        "the read failure belongs to the marker check, not this one"
+        "the read failure belongs to the crate walk check, not this one"
     );
 }
 
 #[test]
 fn family_classification_follows_the_naming_rules() {
-    assert_eq!(family("workshop"), Family::Workshop);
-    assert_eq!(family("workshop-server"), Family::Workshop);
     assert_eq!(family("build-xtask"), Family::Build);
     assert_eq!(family("serde"), Family::Unaffiliated);
     assert_eq!(family("runvil"), Family::Unaffiliated);
diff --git a/crates/build-xtask/src/site-tests.rs b/crates/build-xtask/src/site-tests.rs
index 1974a8115..290fff1ff 100644
--- a/crates/build-xtask/src/site-tests.rs
+++ b/crates/build-xtask/src/site-tests.rs
@@ -433,7 +433,7 @@ fn every_guide_book_config_gives_its_landing_title_and_description() {
 fn the_site_without_runvil_docs_fails_naming_it_before_building() {
     for unset in [None, Some(OsStr::new(""))] {
         let root = tempfile::tempdir().expect("tempdir");
-        let error = site(root.path(), unset, &[]).expect_err("RUNVIL_DOCS is unset");
+        let error = site(root.path(), unset, None, &[]).expect_err("RUNVIL_DOCS is unset");
         assert!(error.contains("RUNVIL_DOCS"), "{unset:?}: {error}");
         assert!(!root.path().join("target").exists(), "{unset:?}");
     }
@@ -443,12 +443,72 @@ fn the_site_without_runvil_docs_fails_naming_it_before_building() {
 fn the_site_with_a_missing_docs_root_fails_naming_runvil_docs_and_the_path() {
     let root = tempfile::tempdir().expect("tempdir");
     let missing = root.path().join("no-such-docs");
-    let error = site(root.path(), Some(missing.as_os_str()), &[]).expect_err("missing docs root");
+    let error =
+        site(root.path(), Some(missing.as_os_str()), None, &[]).expect_err("missing docs root");
     assert!(error.contains("RUNVIL_DOCS"), "{error}");
     assert!(error.contains(&missing.display().to_string()), "{error}");
     assert!(!root.path().join("target").exists());
 }
 
+#[test]
+fn the_site_without_runvil_harness_fails_naming_it_before_building() {
+    for unset in [None, Some(OsStr::new(""))] {
+        let root = tempfile::tempdir().expect("tempdir");
+        let docs = tempfile::tempdir().expect("tempdir");
+        let error = site(root.path(), Some(docs.path().as_os_str()), unset, &[])
+            .expect_err("RUNVIL_HARNESS is unset");
+        assert!(error.contains("RUNVIL_HARNESS"), "{unset:?}: {error}");
+        assert!(error.contains("runvil-harness"), "{unset:?}: {error}");
+        assert!(!root.path().join("target").exists(), "{unset:?}");
+    }
+}
+
+#[test]
+fn the_site_with_a_missing_harness_root_fails_naming_runvil_harness_and_the_path() {
+    let root = tempfile::tempdir().expect("tempdir");
+    let docs = tempfile::tempdir().expect("tempdir");
+    let missing = root.path().join("no-such-harness");
+    let error = site(
+        root.path(),
+        Some(docs.path().as_os_str()),
+        Some(missing.as_os_str()),
+        &[],
+    )
+    .expect_err("missing harness root");
+    assert!(error.contains("RUNVIL_HARNESS"), "{error}");
+    assert!(error.contains(&missing.display().to_string()), "{error}");
+    assert!(!root.path().join("target").exists());
+}
+
+#[test]
+fn a_books_only_build_reads_no_harness_checkout() {
+    let docs = tempfile::tempdir().expect("tempdir");
+    let missing = docs.path().join("no-such-harness");
+    for harness in [None, Some(missing.as_os_str())] {
+        let (_, harness_root) = checkouts(
+            Some(docs.path().as_os_str()),
+            harness,
+            Options { books_only: true },
+        )
+        .expect("a books-only build needs only the docs checkout");
+        assert_eq!(harness_root, None, "{harness:?}");
+    }
+}
+
+#[test]
+fn a_full_build_reads_the_docs_and_the_harness_checkouts() {
+    let docs = tempfile::tempdir().expect("tempdir");
+    let harness = tempfile::tempdir().expect("tempdir");
+    let (docs_root, harness_root) = checkouts(
+        Some(docs.path().as_os_str()),
+        Some(harness.path().as_os_str()),
+        Options { books_only: false },
+    )
+    .expect("both checkouts are directories");
+    assert_eq!(docs_root, docs.path());
+    assert_eq!(harness_root.as_deref(), Some(harness.path()));
+}
+
 #[test]
 fn the_stage_outputs_files_land_in_the_site_root_without_the_book_trees() {
     let staged = site_with(&["gateway/src/01-start.md", "gateway/book.toml"]);
diff --git a/crates/build-xtask/src/site.rs b/crates/build-xtask/src/site.rs
index 76b0b2211..b432ab369 100644
--- a/crates/build-xtask/src/site.rs
+++ b/crates/build-xtask/src/site.rs
@@ -2,7 +2,10 @@
 //! `target/site/`, in this order:
 //!
 //! 1. Checks that `RUNVIL_DOCS` names a directory, the root of the
-//!    `runvil-docs` checkout that holds the book chapters.
+//!    `runvil-docs` checkout that holds the book chapters, and, unless
+//!    `--books-only` is set, that `RUNVIL_HARNESS` names one, the root of
+//!    the `runvil-harness` checkout whose crates the rustdoc sites
+//!    document.
 //! 2. Clears `target/site/` and `target/site-books/`.
 //! 3. Stages one mdBook tree per book, and beside them each book's
 //!    single-file export, into `target/site-books/` by running
@@ -13,10 +16,11 @@
 //!    folder, into `target/site/<book>/`. The folders are read from the
 //!    stage output; no book is named here.
 //! 5. Unless `--books-only` is set, builds every rustdoc site in
-//!    `RUSTDOC_SITES` through the separate `target/site-doc` folder, so the
-//!    developer's `target/doc` is untouched. Each page carries the
-//!    `guide/chrome/banner.html` bar, and each site folder gets an
-//!    `index.html` redirect to its crate.
+//!    `RUSTDOC_SITES` by running `cargo doc` in the `runvil-harness`
+//!    checkout, through the separate `target/site-doc` folder of this
+//!    workspace, so the `target/doc` of neither checkout is touched. Each
+//!    page carries the `guide/chrome/banner.html` bar, and each site
+//!    folder gets an `index.html` redirect to its crate.
 //! 6. Copies `guide/landing/` and the staged exports into `target/site/`,
 //!    then writes the landing page `target/site/index.html`: one table row
 //!    per rustdoc site and per staged book (see `site-landing.rs`).
@@ -28,7 +32,7 @@
 //!    skipped.
 //!
 //! Every path passed to a child process is absolute, built from the
-//! workspace root or made absolute from `RUNVIL_DOCS`.
+//! workspace root or made absolute from `RUNVIL_DOCS` or `RUNVIL_HARNESS`.
 
 use std::borrow::Cow;
 use std::ffi::{OsStr, OsString};
@@ -46,11 +50,15 @@ const USAGE: &str = "usage: cargo xtask site [--books-only]";
 /// checkout.
 pub(crate) const DOCS_VAR: &str = "RUNVIL_DOCS";
 
+/// The environment variable naming the root of the `runvil-harness`
+/// checkout.
+pub(crate) const HARNESS_VAR: &str = "RUNVIL_HARNESS";
+
 /// The rustdoc sites: the folder under `target/site/`, the crate it
 /// documents, with default features, the facade as dependents read it, and
 /// the few broad words its landing row shows under Covers. The crates come
-/// from runvil-harness, so each site documents the commit the root
-/// `Cargo.toml` pins.
+/// from runvil-harness, so each site documents the commit of the checkout
+/// `RUNVIL_HARNESS` names.
 const RUSTDOC_SITES: [(&str, &str, &str); 5] = [
     (
         "runvil-engine",
@@ -82,9 +90,15 @@ struct Options {
 }
 
 /// Runs `cargo xtask site` with the arguments after `site`, reading the
-/// chapters from `docs`, the value of `RUNVIL_DOCS`.
-pub(crate) fn run(root: &Path, docs: Option<&OsStr>, args: &[String]) -> ExitCode {
-    match site(root, docs, args) {
+/// chapters from `docs`, the value of `RUNVIL_DOCS`, and documenting the
+/// crates in `harness`, the value of `RUNVIL_HARNESS`.
+pub(crate) fn run(
+    root: &Path,
+    docs: Option<&OsStr>,
+    harness: Option<&OsStr>,
+    args: &[String],
+) -> ExitCode {
+    match site(root, docs, harness, args) {
         Ok(site) => {
             println!("site: built {}", site.display());
             ExitCode::SUCCESS
@@ -98,33 +112,56 @@ pub(crate) fn run(root: &Path, docs: Option<&OsStr>, args: &[String]) -> ExitCod
 
 /// Builds the site for the workspace at `root` as [`run`] does, returning
 /// its folder. Nothing is cleared or built until the arguments parse and
-/// `docs` names a directory.
-fn site(root: &Path, docs: Option<&OsStr>, args: &[String]) -> Result<PathBuf, String> {
+/// each checkout the build reads is a directory.
+fn site(
+    root: &Path,
+    docs: Option<&OsStr>,
+    harness: Option<&OsStr>,
+    args: &[String],
+) -> Result<PathBuf, String> {
     let options = parse_args(args)?;
-    let docs = docs_root(docs)?;
-    build(root, &docs, options)
+    let (docs, harness) = checkouts(docs, harness, options)?;
+    build(root, &docs, harness.as_deref())
+}
+
+/// The checkouts a build with `options` reads, each absolute: the docs
+/// root, from `docs`, and the harness root, from `harness`. A books-only
+/// build documents no crate, so it reads no harness checkout and returns
+/// `None` for it.
+fn checkouts(
+    docs: Option<&OsStr>,
+    harness: Option<&OsStr>,
+    options: Options,
+) -> Result<(PathBuf, Option<PathBuf>), String> {
+    let docs = checkout_root(DOCS_VAR, "runvil-docs", docs)?;
+    let harness = if options.books_only {
+        None
+    } else {
+        Some(checkout_root(HARNESS_VAR, "runvil-harness", harness)?)
+    };
+    Ok((docs, harness))
 }
 
-/// The absolute form of `docs`, the value of `RUNVIL_DOCS`, or an
+/// The absolute form of `value`, the value of the variable `var`, or an
 /// error naming the variable when it is unset, empty, or names no
-/// directory.
-fn docs_root(docs: Option<&OsStr>) -> Result<PathBuf, String> {
-    const HELP: &str = "set it to the root of a runvil-docs checkout";
-    let Some(docs) = docs.filter(|docs| !docs.is_empty()) else {
-        return Err(format!("site: {DOCS_VAR} is not set; {HELP}"));
+/// directory. `repository` is the repository whose checkout `var` names.
+fn checkout_root(var: &str, repository: &str, value: Option<&OsStr>) -> Result<PathBuf, String> {
+    let help = format!("set it to the root of a {repository} checkout");
+    let Some(value) = value.filter(|value| !value.is_empty()) else {
+        return Err(format!("site: {var} is not set; {help}"));
     };
-    let docs = std::path::absolute(docs).map_err(|error| {
+    let root = std::path::absolute(value).map_err(|error| {
         format!(
-            "site: {DOCS_VAR} names {}, which has no absolute form ({error}); {HELP}",
-            Path::new(docs).display()
+            "site: {var} names {}, which has no absolute form ({error}); {help}",
+            Path::new(value).display()
         )
     })?;
-    if docs.is_dir() {
-        Ok(docs)
+    if root.is_dir() {
+        Ok(root)
     } else {
         Err(format!(
-            "site: {DOCS_VAR} names {}, which is not a directory; {HELP}",
-            docs.display()
+            "site: {var} names {}, which is not a directory; {help}",
+            root.display()
         ))
     }
 }
@@ -138,8 +175,10 @@ fn parse_args(args: &[String]) -> Result<Options, String> {
 }
 
 /// Builds the site for the workspace at `root` from the chapters in the
-/// absolute docs root `docs`, returning its folder.
-fn build(root: &Path, docs: &Path, options: Options) -> Result<PathBuf, String> {
+/// absolute docs root `docs`, returning its folder. `harness` is the
+/// absolute root of the harness checkout, or `None` for a books-only
+/// build.
+fn build(root: &Path, docs: &Path, harness: Option<&Path>) -> Result<PathBuf, String> {
     let target = root.join("target");
     let site = target.join("site");
     let staged = target.join("site-books");
@@ -167,8 +206,8 @@ fn build(root: &Path, docs: &Path, options: Options) -> Result<PathBuf, String>
         )?;
     }
 
-    if !options.books_only {
-        build_rustdoc(root, &cargo, &site)?;
+    if let Some(harness) = harness {
+        build_rustdoc(root, harness, &cargo, &site)?;
     }
 
     copy_dir(&root.join("guide").join("landing"), &site)?;
@@ -176,12 +215,13 @@ fn build(root: &Path, docs: &Path, options: Options) -> Result<PathBuf, String>
     let landing = site.join("index.html");
     fs::write(&landing, landing::page(&staged, &books)?)
         .map_err(|error| format!("site: cannot write {}: {error}", landing.display()))?;
-    check_links(&site, options.books_only)?;
+    check_links(&site, harness.is_none())?;
     Ok(site)
 }
 
-/// Builds every rustdoc site into `site/<dir>/`.
-fn build_rustdoc(root: &Path, cargo: &OsStr, site: &Path) -> Result<(), String> {
+/// Builds every rustdoc site into `site/<dir>/`, documenting the crates of
+/// the checkout at `harness` into this workspace's `target/site-doc`.
+fn build_rustdoc(root: &Path, harness: &Path, cargo: &OsStr, site: &Path) -> Result<(), String> {
     let target_dir = root.join("target").join("site-doc");
     let flags = encoded_rustdoc_flags(&root.join("guide").join("chrome").join("banner.html"));
     for (dir, krate, _) in RUSTDOC_SITES {
@@ -189,13 +229,13 @@ fn build_rustdoc(root: &Path, cargo: &OsStr, site: &Path) -> Result<(), String>
         // search index, so each crate starts from an empty folder.
         run_child(
             Command::new(cargo)
-                .current_dir(root)
+                .current_dir(harness)
                 .args(["clean", "--doc", "--target-dir"])
                 .arg(&target_dir),
         )?;
         run_child(
             Command::new(cargo)
-                .current_dir(root)
+                .current_dir(harness)
                 .args(["doc", "-p", krate, "--no-deps", "--target-dir"])
                 .arg(&target_dir)
                 .env("CARGO_ENCODED_RUSTDOCFLAGS", &flags),
diff --git a/crates/build-xtask/src/tidy-tests.rs b/crates/build-xtask/src/tidy-tests.rs
index 2105fd947..687e62471 100644
--- a/crates/build-xtask/src/tidy-tests.rs
+++ b/crates/build-xtask/src/tidy-tests.rs
@@ -8,16 +8,6 @@ fn workspace_root() -> PathBuf {
         .to_path_buf()
 }
 
-#[test]
-fn workshop_tier_dependencies_flow_one_way() {
-    let violations = tier_dependency_violations(&workspace_root());
-    assert!(
-        violations.is_empty(),
-        "tier violations:\n{}",
-        violations.join("\n")
-    );
-}
-
 #[test]
 fn every_workspace_crate_inherits_workspace_lints() {
     let violations = lint_inheritance_violations(&workspace_root());
@@ -29,77 +19,26 @@ fn every_workspace_crate_inherits_workspace_lints() {
 }
 
 #[test]
-fn family_crates_have_the_invariants_marker() {
-    let violations = marker_violations(&workspace_root());
+fn the_crate_walk_reads_every_workspace_manifest() {
+    let violations = crate_walk_violations(&workspace_root());
     assert!(
         violations.is_empty(),
-        "marker violations:\n{}",
+        "crate walk violations:\n{}",
         violations.join("\n")
     );
 }
 
 #[test]
-fn a_tiered_crate_whose_manifest_is_missing_is_reported_not_skipped() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    std::fs::create_dir_all(root.path().join("crates")).expect("the crates directory creates");
-    let violations = tier_dependency_violations(root.path());
-    let tiered = packages(&[VOCABULARY, PLUGINS, SERVICES, FEATURES, SERVER]);
-    assert_eq!(
-        violations.len(),
-        tiered.len(),
-        "every tiered crate's missing manifest is reported: {violations:?}"
-    );
-    for name in tiered {
-        assert!(
-            violations.iter().any(|v| v.contains(name)),
-            "{name} is named in the violations: {violations:?}"
-        );
-    }
-}
-
-/// Writes a crate under `crates/<dir>/` named `name`, with the given
-/// `lib.rs` docs.
-fn write_crate(root: &Path, dir: &str, name: &str, lib_docs: &str) {
-    let src = root.join("crates").join(dir).join("src");
-    std::fs::create_dir_all(&src).expect("the crate source directory creates");
-    std::fs::write(
-        src.parent().expect("src has a parent").join("Cargo.toml"),
-        format!("[package]\nname = \"{name}\"\n[lints]\nworkspace = true\n"),
-    )
-    .expect("the manifest writes");
-    std::fs::write(src.join("lib.rs"), lib_docs).expect("lib.rs writes");
-}
-
-const MARKED: &str = "//! Status bar.\n//!\n//! ## Invariants\n//!\n//! - none\n";
-const UNMARKED: &str = "//! Status bar, with no invariants block.\n";
-
-#[test]
-fn a_workshop_crate_without_the_marker_is_a_violation() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(root.path(), "workshop/status", "workshop-status", UNMARKED);
-    let violations = marker_violations(root.path());
-    assert_eq!(violations.len(), 1, "{violations:?}");
-    assert!(
-        violations[0].contains("workshop-status") && violations[0].contains(INVARIANT_MARKER),
-        "the crate and the missing marker are named: {violations:?}"
-    );
-}
-
-#[test]
-fn a_workshop_crate_whose_manifest_has_no_package_name_is_reported_not_skipped() {
+fn a_crate_whose_manifest_has_no_package_name_is_reported_not_skipped() {
     let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(root.path(), "workshop/status", "workshop-status", UNMARKED);
-    let manifest = root
-        .path()
-        .join("crates")
-        .join("workshop")
-        .join("status")
-        .join("Cargo.toml");
-    std::fs::write(&manifest, "[lints]\nworkspace = true\n").expect("the manifest rewrites");
-    let violations = marker_violations(root.path());
+    let dir = root.path().join("crates").join("nameless");
+    std::fs::create_dir_all(&dir).expect("the crate directory creates");
+    std::fs::write(dir.join("Cargo.toml"), "[lints]\nworkspace = true\n")
+        .expect("the manifest writes");
+    let violations = crate_walk_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
-        violations[0].contains("status") && violations[0].contains("no package name"),
+        violations[0].contains("nameless") && violations[0].contains("no package name"),
         "the directory and the failure mode are named: {violations:?}"
     );
 }
@@ -110,11 +49,11 @@ fn a_manifest_read_failure_is_reported_once_across_the_checks() {
     let dir = root.path().join("crates").join("broken");
     std::fs::create_dir_all(&dir).expect("the crate directory creates");
     std::fs::write(dir.join("Cargo.toml"), "not [valid toml").expect("the manifest writes");
-    let violations = marker_violations(root.path());
+    let violations = crate_walk_violations(root.path());
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
         violations[0].contains("unparseable manifest"),
-        "the marker check owns the walk's read failures: {violations:?}"
+        "the crate walk check owns the walk's read failures: {violations:?}"
     );
     assert!(
         crate::product::product_boundary_violations(root.path()).is_empty(),
@@ -122,21 +61,16 @@ fn a_manifest_read_failure_is_reported_once_across_the_checks() {
     );
 }
 
-#[test]
-fn the_workshop_desktop_app_without_the_marker_passes() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(root.path(), "workshop/desktop", "workshop", UNMARKED);
-    assert!(
-        marker_violations(root.path()).is_empty(),
-        "the desktop app is exempt from the marker"
-    );
-}
-
-#[test]
-fn an_unmarked_crate_outside_the_workshop_family_is_left_alone() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(root.path(), "build-ui", "build-ui", UNMARKED);
-    assert!(marker_violations(root.path()).is_empty());
+/// Writes a crate under `crates/<dir>/` named `name` that inherits the
+/// workspace lints.
+fn write_crate(root: &Path, dir: &str, name: &str) {
+    let dir = root.join("crates").join(dir);
+    std::fs::create_dir_all(&dir).expect("the crate directory creates");
+    std::fs::write(
+        dir.join("Cargo.toml"),
+        format!("[package]\nname = \"{name}\"\n[lints]\nworkspace = true\n"),
+    )
+    .expect("the manifest writes");
 }
 
 /// Writes a workspace root manifest that sets `unreachable_pub`, the one
@@ -150,20 +84,20 @@ fn write_root_manifest(root: &Path) {
 }
 
 #[test]
-fn crates_that_inherit_the_workspace_lints_pass_with_or_without_the_marker() {
+fn crates_that_inherit_the_workspace_lints_pass() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_root_manifest(root.path());
-    write_crate(root.path(), "build-ui", "build-ui", UNMARKED);
-    write_crate(root.path(), "workshop/status", "workshop-status", MARKED);
+    write_crate(root.path(), "build-ui", "build-ui");
+    write_crate(root.path(), "suite/status", "suite-status");
     let violations = lint_inheritance_violations(root.path());
     assert!(violations.is_empty(), "{violations:?}");
 }
 
 #[test]
-fn an_unmarked_crate_with_its_own_lint_table_is_reported() {
+fn a_crate_with_its_own_lint_table_is_reported() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_root_manifest(root.path());
-    write_crate(root.path(), "build-ui", "build-ui", UNMARKED);
+    write_crate(root.path(), "build-ui", "build-ui");
     std::fs::write(
         root.path()
             .join("crates")
@@ -176,7 +110,7 @@ fn an_unmarked_crate_with_its_own_lint_table_is_reported() {
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
         violations[0].contains("build-ui") && violations[0].contains("[lints] workspace = true"),
-        "every crate, not only a marked one, must inherit: {violations:?}"
+        "a crate that sets its own lints does not inherit the workspace's: {violations:?}"
     );
 }
 
@@ -197,7 +131,7 @@ fn a_lint_inheritance_scan_that_finds_no_crate_fails() {
 fn a_crate_whose_manifest_does_not_parse_is_held_to_lint_inheritance_not_skipped() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_root_manifest(root.path());
-    write_crate(root.path(), "build-ui", "build-ui", UNMARKED);
+    write_crate(root.path(), "build-ui", "build-ui");
     let dir = root.path().join("crates").join("broken");
     std::fs::create_dir_all(&dir).expect("the crate directory creates");
     std::fs::write(dir.join("Cargo.toml"), "not [valid toml").expect("the manifest writes");
@@ -239,36 +173,3 @@ fn an_undecodable_path_component_keeps_its_place_in_the_relative_path() {
          collide with an allowlist entry: {relative}"
     );
 }
-
-#[test]
-fn tier_table_grants_each_tier_only_lower_tiers() {
-    assert_eq!(allowed_dependencies("workshop-protocol"), Some(Vec::new()));
-    assert_eq!(
-        allowed_dependencies("workshop-registry"),
-        Some(vec!["workshop-protocol"])
-    );
-    assert_eq!(
-        allowed_dependencies("workshop-gateway"),
-        Some(packages(&[VOCABULARY]))
-    );
-    assert_eq!(
-        allowed_dependencies("workshop-workspace"),
-        Some(packages(&[VOCABULARY, SERVICES]))
-    );
-    assert_eq!(
-        allowed_dependencies("workshop-agents"),
-        Some(packages(&[VOCABULARY, SERVICES]))
-    );
-    assert_eq!(
-        allowed_dependencies("workshop-server"),
-        Some(packages(&[VOCABULARY, SERVICES, FEATURES, PLUGINS]))
-    );
-    for plugin in ["workshop-plugin-std", "workshop-plugin-bashkit"] {
-        assert_eq!(
-            allowed_dependencies(plugin),
-            Some(Vec::new()),
-            "a library Plugin names no workshop crate"
-        );
-    }
-    assert_eq!(allowed_dependencies("gateway"), None);
-}
diff --git a/crates/build-xtask/src/tidy.rs b/crates/build-xtask/src/tidy.rs
index 4dad73643..87a9120e2 100644
--- a/crates/build-xtask/src/tidy.rs
+++ b/crates/build-xtask/src/tidy.rs
@@ -1,174 +1,45 @@
-//! Tidy-style architecture checks for the workshop server decomposition,
-//! the product boundary (run from `product`), the pin on the crates that
-//! come from runvil-harness (run from `harness_pin`), the doctest ban over
-//! every workspace crate (run from `no_doctests`), the `Debug` trait's one
-//! spelling over every workspace crate (run from `debug_spelling`), the
-//! unsafe allowlist (run from `unsafe_allowlist`), and the type-size
-//! limits over every workspace crate (run from `type_size`).
+//! Tidy-style structural checks over every workspace crate: the shared
+//! crate walk's read failures and lint inheritance, which are checked
+//! here, and the unsafe allowlist (run from `unsafe_allowlist`), the
+//! product boundary (run from `product`), the doctest ban (run from
+//! `no_doctests`), the `Debug` trait's one spelling (run from
+//! `debug_spelling`), and the type-size limits (run from `type_size`).
 //!
 //! Each check returns a list of human-readable violations. The `#[test]`
 //! wrappers assert the lists are empty, so `cargo test -p build-xtask`
-//! enforces the architecture; `cargo xtask tidy` prints the same report
-//! on demand. The lint inheritance check binds every workspace crate. The
-//! shared walk's read failures are reported by `marker_violations`, their
-//! one owner.
+//! enforces the checks; `cargo xtask tidy` prints the same report on
+//! demand. The shared walk's read failures are reported by
+//! `crate_walk_violations`, their one owner.
+//!
+//! The helpers the checks share for finding and naming source files,
+//! `rust_files` and `slash_path`, are here too.
 
 use std::fs;
 use std::path::{Path, PathBuf};
 
-/// A tiered workshop crate: its package name and its directory under the
-/// `crates/workshop/` container.
-type Tiered = (&'static str, &'static str);
-
-/// Tier 0: vocabulary crates. No internal `workshop-*` dependencies.
-const VOCABULARY: &[Tiered] = &[
-    ("workshop-gateway-discovery", "gateway-discovery"),
-    ("workshop-protocol", "protocol"),
-    ("workshop-registry", "registry"),
-    ("workshop-support", "support"),
-];
-/// Tier 0: library Plugins, each the dynamic library of a Plugin whose
-/// code lives in another repository. No internal `workshop-*`
-/// dependencies, and only the server may name one.
-const PLUGINS: &[Tiered] = &[
-    ("workshop-plugin-std", "plugin-std"),
-    ("workshop-plugin-bashkit", "plugin-bashkit"),
-];
-/// Tier 1: domain services. Depend on vocabulary crates only.
-const SERVICES: &[Tiered] = &[
-    ("workshop-gateway", "gateway"),
-    ("workshop-menu", "menu"),
-    ("workshop-status", "status"),
-];
-/// Tier 2: features. Depend on vocabulary and service crates.
-const FEATURES: &[Tiered] = &[
-    ("workshop-agents", "agents"),
-    ("workshop-run-log", "run-log"),
-    ("workshop-user-state", "user-state"),
-    ("workshop-workspace", "workspace"),
-];
-/// Tier 3: the server. May depend on every lower tier, the library
-/// Plugins included.
-const SERVER: &[Tiered] = &[("workshop-server", "server")];
-
-/// Marker in a crate's `lib.rs` (or `main.rs`) crate docs. Mandatory for
-/// every `workshop-*` crate (see [`family_requires_marker`]); optional on
-/// any other crate. The `new-crate` scaffolder emits it.
-const INVARIANT_MARKER: &str = "//! ## Invariants";
-
 /// Runs every check and returns all violations.
 #[must_use]
 pub(crate) fn all_violations(root: &Path) -> Vec<String> {
-    let mut violations = tier_dependency_violations(root);
-    violations.extend(marker_violations(root));
+    let mut violations = crate_walk_violations(root);
     violations.extend(lint_inheritance_violations(root));
     violations.extend(crate::unsafe_allowlist::unsafe_allowlist_violations(root));
     violations.extend(crate::product::product_boundary_violations(root));
-    violations.extend(crate::harness_pin::harness_pin_violations(root));
     violations.extend(crate::no_doctests::no_doctests_violations(root));
     violations.extend(crate::debug_spelling::debug_spelling_violations(root));
     violations.extend(crate::type_size::type_size_violations(root));
     violations
 }
 
-/// The internal `workshop-*` crates a tiered crate may depend on, or `None`
-/// when `name` is not part of the decomposition's crate map.
-fn allowed_dependencies(name: &str) -> Option<Vec<&'static str>> {
-    let in_tier = |tier: &[Tiered]| tier.iter().any(|&(package, _)| package == name);
-    let allowed = if name == "workshop-registry" {
-        // The proxy slots speak the wire types: the status push-channel
-        // slot holds `workshop-protocol`'s `StatusBarUpdate`.
-        vec!["workshop-protocol"]
-    } else if in_tier(VOCABULARY) || in_tier(PLUGINS) {
-        Vec::new()
-    } else if in_tier(SERVICES) {
-        packages(&[VOCABULARY])
-    } else if in_tier(FEATURES) {
-        packages(&[VOCABULARY, SERVICES])
-    } else if in_tier(SERVER) {
-        packages(&[VOCABULARY, SERVICES, FEATURES, PLUGINS])
-    } else {
-        return None;
-    };
-    Some(allowed)
-}
-
-/// The package names of the crates in `tiers`, in table order.
-fn packages(tiers: &[&[Tiered]]) -> Vec<&'static str> {
-    tiers
-        .iter()
-        .flat_map(|tier| tier.iter().map(|&(package, _)| package))
-        .collect()
-}
-
-/// Checks that tiered `workshop-*` crates depend only on lower tiers.
+/// The shared crate walk's read failures.
 ///
-/// A missing manifest is a violation, not a crate to skip.
+/// A manifest the walk could not read, parse, or find a package name in is
+/// reported as itself, not skipped: the product-boundary check binds a
+/// crate by its package name, so a crate with no readable name cannot be
+/// shown to pass it. This check is the one owner of the walk's read
+/// failures; every other check shares the walk and leaves them here.
 #[must_use]
-fn tier_dependency_violations(root: &Path) -> Vec<String> {
-    let mut violations = Vec::new();
-    for (name, dir) in [VOCABULARY, PLUGINS, SERVICES, FEATURES, SERVER].concat() {
-        let Some(allowed) = allowed_dependencies(name) else {
-            continue;
-        };
-        let manifest_path = root
-            .join("crates")
-            .join("workshop")
-            .join(dir)
-            .join("Cargo.toml");
-        let Ok(text) = fs::read_to_string(&manifest_path) else {
-            violations.push(format!(
-                "{name}: tiered crate has no manifest at {}",
-                manifest_path.display()
-            ));
-            continue;
-        };
-        let manifest: toml::Value = match toml::from_str(&text) {
-            Ok(manifest) => manifest,
-            Err(error) => {
-                violations.push(format!(
-                    "{}: unparseable manifest: {error}",
-                    manifest_path.display()
-                ));
-                continue;
-            }
-        };
-        for dep in workshop_dependencies(&manifest) {
-            if dep == name {
-                continue; // self dev-dependency for test fixtures
-            }
-            if !allowed.contains(&dep.as_str()) {
-                violations.push(format!(
-                    "{name} depends on {dep}, which its tier forbids (allowed: {})",
-                    allowed.join(", ")
-                ));
-            }
-        }
-    }
-    violations
-}
-
-/// Collects the `workshop-*` dependency names of every kind (normal, dev,
-/// build, and target-specific) declared in a manifest.
-fn workshop_dependencies(manifest: &toml::Value) -> Vec<String> {
-    let mut names = Vec::new();
-    let kinds = ["dependencies", "dev-dependencies", "build-dependencies"];
-    for (_, table) in crate::manifest::dependency_tables(manifest, &kinds) {
-        collect_workshop_deps(table, &mut names);
-    }
-    names
-}
-
-fn collect_workshop_deps(table: &toml::map::Map<String, toml::Value>, names: &mut Vec<String>) {
-    for (key, value) in table {
-        let package = value
-            .get("package")
-            .and_then(toml::Value::as_str)
-            .unwrap_or(key);
-        if package.starts_with("workshop-") && !names.contains(&package.to_owned()) {
-            names.push(package.to_owned());
-        }
-    }
+fn crate_walk_violations(root: &Path) -> Vec<String> {
+    crate::product::workspace_crates(root).violations
 }
 
 /// Checks that every workspace crate, unread ones included, inherits
@@ -234,43 +105,6 @@ fn lint_inheritance_violations(root: &Path) -> Vec<String> {
     violations
 }
 
-/// Check that every `workshop-*` crate has the marker.
-///
-/// A manifest the walk could not read, parse, or find a package name in is
-/// reported as itself, not skipped: a crate with no readable name cannot be
-/// shown exempt from the marker. This check is the one owner of the shared
-/// walk's read failures; the product-boundary check shares the walk and
-/// leaves them here.
-#[must_use]
-fn marker_violations(root: &Path) -> Vec<String> {
-    let walk = crate::product::workspace_crates(root);
-    let mut violations = walk.violations;
-    for krate in &walk.crates {
-        if family_requires_marker(&krate.package) && !has_marker(&root.join(&krate.dir)) {
-            violations.push(format!(
-                "{}: src/lib.rs lacks the `{INVARIANT_MARKER}` marker required of every \
-                 workshop-* crate",
-                krate.package
-            ));
-        }
-    }
-    violations
-}
-
-/// Whether a package name places the crate in the family that must have
-/// the marker: `workshop-*`. The Tauri desktop app (the `workshop`
-/// package) falls outside the prefix, so it is exempt.
-fn family_requires_marker(name: &str) -> bool {
-    name.starts_with("workshop-")
-}
-
-/// Whether a crate's `lib.rs` or `main.rs` crate docs have the marker.
-fn has_marker(dir: &Path) -> bool {
-    ["src/lib.rs", "src/main.rs"].iter().any(|candidate| {
-        fs::read_to_string(dir.join(candidate)).is_ok_and(|text| text.contains(INVARIANT_MARKER))
-    })
-}
-
 /// A file's path relative to the workspace root with `/` separators, so
 /// the allowlist and the violations read the same on every platform.
 ///
diff --git a/crates/build-xtask/src/type_size.rs b/crates/build-xtask/src/type_size.rs
index 6b2c2322b..29700b5ae 100644
--- a/crates/build-xtask/src/type_size.rs
+++ b/crates/build-xtask/src/type_size.rs
@@ -32,25 +32,7 @@ const MAX_FIELDS: usize = 12;
 
 /// The types over a limit today. A new entry is a plan decision with a
 /// reason, never a way to make a change pass.
-const ALLOWED: &[Allowed] = &[
-    Allowed {
-        krate: "crates/workshop/gateway-discovery",
-        name: "ProcBsdInfo",
-        limit: Limit::Fields,
-        recorded: 22,
-        reason: "A `#[repr(C)]` mirror of the stable prefix of Darwin's `proc_bsdinfo`, \
-                 whose fields the OS fixes.",
-    },
-    Allowed {
-        krate: "crates/workshop/workspace",
-        name: "Workspace",
-        limit: Limit::Methods,
-        recorded: 39,
-        reason: "The workspace every route shares: the grant set and confinement plus the \
-                 backing file's open, save-as, duplicate, and persistence, on one cloneable \
-                 state so a new grant reaches every handler at once.",
-    },
-];
+const ALLOWED: &[Allowed] = &[];
 
 /// The limit an [`Allowed`] entry lifts.
 #[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
diff --git a/crates/build-xtask/src/unsafe_allowlist-tests.rs b/crates/build-xtask/src/unsafe_allowlist-tests.rs
index d91c959a2..e7e80e7dd 100644
--- a/crates/build-xtask/src/unsafe_allowlist-tests.rs
+++ b/crates/build-xtask/src/unsafe_allowlist-tests.rs
@@ -7,6 +7,10 @@ use std::path::Path;
 use super::*;
 use crate::product::test_support::workspace_root;
 
+/// The crates that own an unsafe boundary in the fixtures, which pass
+/// this list so that none follows the workspace's own.
+const FIXTURE_OWNED: [&str; 2] = ["crates/suite/ffi", "crates/suite/sys"];
+
 /// Writes a crate at `crates/<dir>/` holding each `(path, text)` under its
 /// `src/`.
 fn write_crate(root: &Path, dir: &str, files: &[(&str, &str)]) {
@@ -41,7 +45,7 @@ fn the_workspace_relaxes_unsafe_code_only_in_its_owned_crates() {
 #[test]
 fn the_owned_crates_may_relax_unsafe_code_and_text_that_spells_it_passes() {
     let root = tempfile::TempDir::new().expect("tempdir");
-    for dir in ["workshop/desktop", "workshop/gateway-discovery"] {
+    for dir in ["suite/ffi", "suite/sys"] {
         write_crate(root.path(), dir, &[("lib.rs", RELAXES)]);
     }
     write_crate(
@@ -57,16 +61,29 @@ fn the_owned_crates_may_relax_unsafe_code_and_text_that_spells_it_passes() {
              #[allow(dead_code)]\nfn unused() {}\n",
         )],
     );
-    let violations = unsafe_allowlist_violations(root.path());
+    let violations = violations_against(root.path(), &FIXTURE_OWNED);
     assert!(violations.is_empty(), "{violations:?}");
 }
 
+#[test]
+fn with_no_owned_crate_a_relaxation_in_any_crate_is_reported() {
+    let root = tempfile::TempDir::new().expect("tempdir");
+    write_crate(root.path(), "suite/ffi", &[("lib.rs", RELAXES)]);
+    let violations = violations_against(root.path(), &[]);
+    assert_eq!(violations.len(), 2, "{violations:?}");
+    assert!(
+        violations.iter().all(|violation| violation
+            .ends_with("in any crate, because none owns an unsafe boundary, found one")),
+        "with no owner to name, each violation says none exists: {violations:?}"
+    );
+}
+
 #[test]
 fn each_way_of_relaxing_unsafe_code_outside_the_owned_crates_is_reported_at_its_line() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
-        "workshop/status",
+        "suite/status",
         &[(
             "lib.rs",
             "//! Local inference.\n\
@@ -80,12 +97,15 @@ fn each_way_of_relaxing_unsafe_code_outside_the_owned_crates_is_reported_at_its_
              fn body() {\n    #[allow(unsafe_code)]\n    let _x = 1;\n}\n",
         )],
     );
-    let violations = unsafe_allowlist_violations(root.path());
+    let violations = violations_against(root.path(), &FIXTURE_OWNED);
     assert_eq!(violations.len(), 5, "{violations:?}");
     for (violation, line) in violations.iter().zip(["2", "3", "5", "7", "10"]) {
         assert!(
-            violation.contains(&format!("lib.rs:{line}: ")) && violation.contains("unsafe_code"),
-            "each relaxation is named at its line: {violations:?}"
+            violation.contains(&format!("lib.rs:{line}: "))
+                && violation.contains("unsafe_code")
+                && violation.ends_with("outside crates/suite/ffi, crates/suite/sys, found one"),
+            "each relaxation is named at its line, with the crates that may relax it: \
+             {violations:?}"
         );
     }
 }
@@ -93,12 +113,8 @@ fn each_way_of_relaxing_unsafe_code_outside_the_owned_crates_is_reported_at_its_
 #[test]
 fn a_source_file_that_does_not_parse_is_reported() {
     let root = tempfile::TempDir::new().expect("tempdir");
-    write_crate(
-        root.path(),
-        "workshop/status",
-        &[("lib.rs", "fn broken( {\n")],
-    );
-    let violations = unsafe_allowlist_violations(root.path());
+    write_crate(root.path(), "suite/status", &[("lib.rs", "fn broken( {\n")]);
+    let violations = violations_against(root.path(), &FIXTURE_OWNED);
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
         violations[0].contains("lib.rs") && violations[0].contains("unparseable"),
@@ -111,19 +127,19 @@ fn a_crate_whose_manifest_does_not_parse_is_still_scanned() {
     let root = tempfile::TempDir::new().expect("tempdir");
     write_crate(
         root.path(),
-        "workshop/status",
+        "suite/status",
         &[("lib.rs", "#[allow(unsafe_code)]\nmod sys {}\n")],
     );
     std::fs::write(
         root.path()
             .join("crates")
-            .join("workshop")
+            .join("suite")
             .join("status")
             .join("Cargo.toml"),
         "not [valid toml",
     )
     .expect("the manifest rewrites");
-    let violations = unsafe_allowlist_violations(root.path());
+    let violations = violations_against(root.path(), &FIXTURE_OWNED);
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
         violations[0].contains("lib.rs:1: ") && violations[0].contains("relaxes `unsafe_code`"),
@@ -135,7 +151,7 @@ fn a_crate_whose_manifest_does_not_parse_is_still_scanned() {
 fn an_unsafe_allowlist_scan_that_finds_no_source_fails() {
     let root = tempfile::TempDir::new().expect("tempdir");
     std::fs::create_dir_all(root.path().join("crates")).expect("the crates directory creates");
-    let violations = unsafe_allowlist_violations(root.path());
+    let violations = violations_against(root.path(), &FIXTURE_OWNED);
     assert_eq!(violations.len(), 1, "{violations:?}");
     assert!(
         violations[0].contains("scanned nothing"),
diff --git a/crates/build-xtask/src/unsafe_allowlist.rs b/crates/build-xtask/src/unsafe_allowlist.rs
index 196cca1f6..5a7a929a0 100644
--- a/crates/build-xtask/src/unsafe_allowlist.rs
+++ b/crates/build-xtask/src/unsafe_allowlist.rs
@@ -18,10 +18,7 @@ use syn::{Meta, Token};
 
 /// The crate directories, relative to the workspace root, that own an
 /// unsafe boundary and may relax `unsafe_code` in the module that holds it.
-const OWNED: [&str; 2] = [
-    "crates/workshop/desktop",
-    "crates/workshop/gateway-discovery",
-];
+const OWNED: &[&str] = &[];
 
 /// Runs the allowlist over every `.rs` file in every workspace crate
 /// outside [`OWNED`], the crates whose manifest the shared walk could not
@@ -30,13 +27,19 @@ const OWNED: [&str; 2] = [
 /// never scanned cannot be shown clean.
 #[must_use]
 pub(crate) fn unsafe_allowlist_violations(root: &Path) -> Vec<String> {
+    violations_against(root, OWNED)
+}
+
+/// [`unsafe_allowlist_violations`] against any list of owned crates, so a
+/// fixture can pass its own.
+fn violations_against(root: &Path, owned: &[&str]) -> Vec<String> {
     let walk = crate::product::workspace_crates(root);
     let mut files: Vec<PathBuf> = walk
         .crates
         .iter()
         .map(|krate| &krate.dir)
         .chain(&walk.unread)
-        .filter(|dir| !is_owned(dir))
+        .filter(|dir| !is_owned(dir, owned))
         .flat_map(|dir| crate::tidy::rust_files(&root.join(dir)))
         .collect();
     if files.is_empty() {
@@ -50,7 +53,7 @@ pub(crate) fn unsafe_allowlist_violations(root: &Path) -> Vec<String> {
     let mut violations = Vec::new();
     for file in &files {
         match fs::read_to_string(file) {
-            Ok(text) => violations.extend(source_violations(file, &text)),
+            Ok(text) => violations.extend(source_violations(file, &text, owned)),
             Err(error) => {
                 violations.push(format!("{}: unreadable source: {error}", file.display()));
             }
@@ -59,22 +62,24 @@ pub(crate) fn unsafe_allowlist_violations(root: &Path) -> Vec<String> {
     violations
 }
 
-/// Whether `dir`, relative to the workspace root, is one of [`OWNED`].
-fn is_owned(dir: &Path) -> bool {
+/// Whether `dir`, relative to the workspace root, is one of `owned`.
+fn is_owned(dir: &Path, owned: &[&str]) -> bool {
     let parts: Vec<_> = dir
         .components()
         .map(std::path::Component::as_os_str)
         .collect();
-    OWNED.iter().any(|owned| {
-        owned
+    owned.iter().any(|entry| {
+        entry
             .split('/')
             .map(std::ffi::OsStr::new)
             .eq(parts.iter().copied())
     })
 }
 
-/// The relaxations of `unsafe_code` in one source file, labeled with `file`.
-fn source_violations(file: &Path, text: &str) -> Vec<String> {
+/// The relaxations of `unsafe_code` in one source file, labeled with
+/// `file`. Each names where a relaxation is refused: outside `owned`, or
+/// in every crate when `owned` is empty.
+fn source_violations(file: &Path, text: &str, owned: &[&str]) -> Vec<String> {
     let tokens: TokenStream = match text.parse() {
         Ok(tokens) => tokens,
         Err(error) => {
@@ -87,14 +92,18 @@ fn source_violations(file: &Path, text: &str) -> Vec<String> {
     };
     let mut lines = Vec::new();
     collect_relaxations(tokens, &|lint| lint.is_ident("unsafe_code"), &mut lines);
+    let refused = if owned.is_empty() {
+        "in any crate, because none owns an unsafe boundary".to_owned()
+    } else {
+        format!("outside {}", owned.join(", "))
+    };
     lines
         .into_iter()
         .map(|line| {
             format!(
                 "{}:{line}: relaxes `unsafe_code` outside the owned unsafe boundaries: required \
-                 no `expect` or `allow` of `unsafe_code` outside {}, found one",
-                file.display(),
-                OWNED.join(", ")
+                 no `expect` or `allow` of `unsafe_code` {refused}, found one",
+                file.display()
             )
         })
         .collect()
diff --git a/crates/workshop/AGENTS.md b/crates/workshop/AGENTS.md
deleted file mode 100644
index 931952ee6..000000000
--- a/crates/workshop/AGENTS.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Workshop crates
-
-## npm workspace
-
-- There is one install, at `crates/workshop` (`npm ci --prefix crates/workshop`), and one lockfile, `crates/workshop/package-lock.json`.
-- Every member adds its `eol=lf` line to `.gitattributes`.
diff --git a/crates/workshop/agents/Cargo.toml b/crates/workshop/agents/Cargo.toml
deleted file mode 100644
index eb3ae9331..000000000
--- a/crates/workshop/agents/Cargo.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-[package]
-name = "workshop-agents"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-# The one crate a Host depends on: the per-run Harness a conversation
-# drives, its control, the recorder tee's trait, the events a
-# conversation observes, and the round ids its deltas and transcript
-# stamp.
-runvil.workspace = true
-# Conversation ids are 128 bits from the OS CSPRNG: unguessable by
-# anything that has not seen the acknowledging frame.
-rand.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-# `sync` for the conversation's broadcasts and state watch; `time` for the
-# timer every run sleeps on; `rt` for the blocking pool a conversation
-# parses its agent on.
-tokio = { workspace = true, features = ["rt", "sync", "time"] }
-tracing.workspace = true
-
-[dev-dependencies]
-# The discovery suite seeds an agents directory on disk.
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/agents/agents/chat.md b/crates/workshop/agents/agents/chat.md
deleted file mode 100644
index a3168cd1d..000000000
--- a/crates/workshop/agents/agents/chat.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-name: chat
-description: The built-in Workshop chat agent on the unified runtime.
-runvil: 0
-uses: [user, std, bash, web]
-models:
-  default:
-    min_context: 32768
----
-
-# Chat
-
-The built-in chat agent: a pass-through between the operator and the selected model, whose one system message says where the Runvil prompting language documentation is mounted. The conversation is the section's `messages` list, retained across turns; the model is the dropdown's selection bound at run launch, so a selection change takes effect on the next run. When the conversation outgrows the model's context window, older turns are summarized so the conversation continues.
-
-## Conversation
-
-```lua
-tools.offer("std")
-tools.offer("bash")
-tools.offer("web")
-tools.offer(tools.packs.extras())
-local function compact(reason)
-  local first = 1
-  while messages[first] and messages[first].role == "system" do
-    first = first + 1
-  end
-  local cut, turns = first, 0
-  for i = #messages, first, -1 do
-    if messages[i].role == "user" then
-      turns = turns + 1
-      if turns == 2 then cut = i break end
-    end
-  end
-  if cut == first then return compactors.fail(reason) end
-  local lines, room = {}, 48000
-  for i = cut - 1, first, -1 do
-    local text = json.encode(messages[i].content)
-    if #text > 1500 then text = text:sub(1, utf8.offset(text, 0, 1501) - 1) end
-    local line = messages[i].role .. ": " .. text
-    if #line > room then break end
-    room = room - #line
-    table.insert(lines, 1, line)
-  end
-  local summary = models.infer("Summarize this conversation:\n" .. table.concat(lines, "\n"))
-  messages:replace(first, cut - 1, {
-    role = "user",
-    content = "Summary of the earlier conversation: " .. summary,
-    meta = { summary = true },
-  })
-end
---messages:system("Runvil prompting language documentation can be found in /_runvil/language-guide")
-while true do
-    messages:user(tasks.receive())
-    pcall(function() return models.loop(compact) end)
-end
-```
diff --git a/crates/workshop/agents/src/conversation-run.rs b/crates/workshop/agents/src/conversation-run.rs
deleted file mode 100644
index 77340103f..000000000
--- a/crates/workshop/agents/src/conversation-run.rs
+++ /dev/null
@@ -1,124 +0,0 @@
-//! What a conversation hands its run's setup, and how it runs the agent
-//! and takes the run's report: the recorder tee, the live pieces of the
-//! run's own rounds, and the drive that parses the agent, runs it, and
-//! ends the conversation with its run.
-
-use std::sync::Arc;
-
-use runvil::harness::{RunRecorder, display_chain};
-use runvil::ids::RoundId;
-use runvil::{Error, Harness, Host, Prompt, RunReport, RunSetup};
-
-use super::{Conversation, lock};
-use crate::protocol::{Delta, DeltaKind};
-use crate::state::{FailureKind, SessionState};
-use crate::tee::ConversationRecorder;
-
-/// The report of a run a close or an uncaught stop cut short.
-const CANCELED: &str = "the agent run was canceled";
-
-impl Conversation {
-    /// The recorder the run writes through: every call goes on to
-    /// `inner`, and each event `inner` accepted reaches this
-    /// conversation.
-    #[must_use]
-    pub fn recorder(&self, inner: Arc<dyn RunRecorder>) -> Arc<dyn RunRecorder> {
-        Arc::new(ConversationRecorder::new(self.clone(), inner))
-    }
-
-    /// Parses the agent `name` on `host` on the blocking pool, then runs
-    /// it with `setup`. A parse failure is reported as a run failure with
-    /// its located message; no run is recorded.
-    ///
-    /// The run's Harness control is held while the run goes on, so the
-    /// operator's messages, a stop, and a close reach the run. The
-    /// conversation ends with its run, or with the parse failure.
-    pub async fn run(&self, host: Arc<Host>, name: &str, setup: RunSetup) {
-        let prompt = match parse(&host, name).await {
-            Ok(prompt) => prompt,
-            Err(message) => {
-                tracing::warn!(
-                    conversation = %self.core.id,
-                    agent = %self.core.agent,
-                    %message,
-                    "agent failed to parse"
-                );
-                self.report(FailureKind::RunFailed, message);
-                self.end();
-                return;
-            }
-        };
-        let harness = Harness::new(host, prompt, setup);
-        {
-            let mut control = lock(&self.core.control);
-            let held = control.insert(harness.control());
-            if self.state() != SessionState::Alive {
-                held.cancel();
-            }
-        }
-        let result = harness.run().await;
-        self.take_report(result);
-        self.end();
-    }
-
-    /// Notes the report's run, logs how many of the operator's messages
-    /// it never read, and reports a run that failed or was cut short; a
-    /// completed run reports nothing.
-    fn take_report(&self, result: Result<RunReport, Error>) {
-        let message = match result {
-            Ok(report) => {
-                self.note_run(report.run_id);
-                tracing::info!(
-                    conversation = %self.core.id,
-                    agent = %self.core.agent,
-                    unread = report.unread.len(),
-                    "the agent run ended; this many of the operator's messages went unread"
-                );
-                match report.result {
-                    Ok(_) => return,
-                    Err(error) if error.is_canceled() => {
-                        self.report(FailureKind::Canceled, CANCELED.to_owned());
-                        return;
-                    }
-                    Err(error) => error.located_message(),
-                }
-            }
-            Err(error) => display_chain(&error),
-        };
-        tracing::warn!(
-            conversation = %self.core.id,
-            agent = %self.core.agent,
-            %message,
-            "agent run failed"
-        );
-        self.report(FailureKind::RunFailed, message);
-    }
-
-    /// Broadcasts one live piece of the run's round `round` as a
-    /// [`Delta`] of `kind`, stamped with the round's id, the id the
-    /// round's reply event carries. No client listening is not a failure:
-    /// the completed reply travels in the round's answer.
-    pub fn publish_delta(&self, round: RoundId, kind: DeltaKind, content: String) {
-        if let Some(channels) = self.channels() {
-            // No receiver means no client is attached; deltas are
-            // ephemeral and the completed-reply event is the repair.
-            let _ = channels.deltas.send(Delta {
-                kind,
-                content,
-                reply: round.get(),
-            });
-        }
-    }
-}
-
-/// The agent `name` parsed on `host` on the blocking pool, since finding
-/// it reads the agents folder, or the message of why it did not parse: the
-/// parse failure's located message, or the blocking task's failure.
-async fn parse(host: &Arc<Host>, name: &str) -> Result<Prompt, String> {
-    let host = Arc::clone(host);
-    let name = name.to_owned();
-    match tokio::task::spawn_blocking(move || host.parse(&name)).await {
-        Ok(parsed) => parsed.map_err(|error| error.located_message()),
-        Err(join) => Err(format!("the agent could not be parsed: {join}")),
-    }
-}
diff --git a/crates/workshop/agents/src/conversation.rs b/crates/workshop/agents/src/conversation.rs
deleted file mode 100644
index e6c0332d9..000000000
--- a/crates/workshop/agents/src/conversation.rs
+++ /dev/null
@@ -1,288 +0,0 @@
-//! One conversation: the handle a socket holds, and the state that
-//! outlives any socket connection.
-//!
-//! A conversation owns one agent's one run. Its transcript is every event
-//! the run has reported, numbered from zero and held in memory. A live
-//! subscriber receives each event as the conversation observes it, and a
-//! reconnecting client reads [`Conversation::transcript`] past its last
-//! seen index. Deltas go out on their own broadcast, stamped with their
-//! round's id, and never enter the transcript. The operator's messages go
-//! to the run's main chain through its Harness control. Its channels
-//! close when the run ends.
-
-#[path = "conversation-run.rs"]
-mod run;
-
-use std::fmt;
-use std::sync::{Arc, Mutex, MutexGuard, PoisonError, Weak};
-
-use runvil::RunControl;
-use runvil::event::Event;
-use runvil::harness::RunId;
-use tokio::sync::{broadcast, watch};
-
-use crate::protocol::{ConversationId, Delta, SessionEvent};
-use crate::state::{FailureKind, SessionFailure, SessionState};
-use crate::table::{self, Table};
-use crate::transcript::Transcript;
-
-/// Capacity of a conversation's event broadcast. The broadcast is the
-/// wakeup; a receiver that lags repairs by reading the transcript past
-/// its cursor.
-const EVENT_CAPACITY: usize = 256;
-
-/// Capacity of a conversation's delta broadcast. Deltas are ephemeral: a
-/// receiver that lags loses chunks, and the completed-reply event is the
-/// repair path.
-const DELTA_CAPACITY: usize = 256;
-
-/// Capacity of a conversation's failure broadcast. Failures are rare
-/// one-off reports, and a receiver that lags misses only what the durable
-/// transcript already shows as a turn without a reply.
-const ERROR_CAPACITY: usize = 8;
-
-/// A running agent conversation: the handle a socket launches, sends the
-/// operator's messages through, stops, closes, and subscribes through.
-/// Cheap to clone; every clone names the same conversation.
-#[derive(Clone)]
-pub struct Conversation {
-    core: Arc<Core>,
-}
-
-impl fmt::Debug for Conversation {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Conversation")
-            .field("id", &self.core.id)
-            .field("agent", &self.core.agent)
-            .field("state", &self.state())
-            .finish_non_exhaustive()
-    }
-}
-
-/// The state behind every handle of one conversation.
-struct Core {
-    /// The Workshop-minted id, the run's name.
-    id: ConversationId,
-    /// The agent the conversation runs, as the agent menu lists it.
-    agent: String,
-    /// Every event the run has reported, stamped as the live stream
-    /// stamps it.
-    transcript: Transcript,
-    /// The live senders, until the conversation ends and drops them.
-    channels: Mutex<Option<Channels>>,
-    /// Where the run stands.
-    state: watch::Sender<SessionState>,
-    /// The run the recorder began for this conversation.
-    run: Mutex<Option<RunId>>,
-    /// The control over the run, once the run is handed its Harness: what
-    /// the operator's messages, a stop, and a close go through.
-    control: Mutex<Option<RunControl>>,
-    /// The table the conversation leaves when it ends.
-    table: Weak<Table>,
-}
-
-/// A conversation's live senders.
-#[derive(Clone)]
-struct Channels {
-    events: broadcast::Sender<SessionEvent>,
-    deltas: broadcast::Sender<Delta>,
-    errors: broadcast::Sender<SessionFailure>,
-}
-
-/// A receiver whose sender is already gone, for a subscription made
-/// after the conversation ended.
-fn closed<T: Clone>() -> broadcast::Receiver<T> {
-    broadcast::channel(1).1
-}
-
-impl Conversation {
-    /// A conversation with nothing reported yet, which leaves `table`
-    /// when it ends.
-    pub(crate) fn new(id: ConversationId, agent: String, table: Weak<Table>) -> Self {
-        let channels = Channels {
-            events: broadcast::channel(EVENT_CAPACITY).0,
-            deltas: broadcast::channel(DELTA_CAPACITY).0,
-            errors: broadcast::channel(ERROR_CAPACITY).0,
-        };
-        Self {
-            core: Arc::new(Core {
-                id,
-                agent,
-                transcript: Transcript::new(),
-                channels: Mutex::new(Some(channels)),
-                state: watch::Sender::new(SessionState::Alive),
-                run: Mutex::new(None),
-                control: Mutex::new(None),
-                table,
-            }),
-        }
-    }
-
-    /// The conversation's id.
-    #[must_use]
-    pub fn id(&self) -> &ConversationId {
-        &self.core.id
-    }
-
-    /// The agent the conversation runs.
-    #[must_use]
-    pub fn agent(&self) -> &str {
-        &self.core.agent
-    }
-
-    /// Where the run stands: [`SessionState::Alive`] until a close,
-    /// [`SessionState::Closing`] while a close drains the run, and
-    /// [`SessionState::Closed`] once the run has ended.
-    #[must_use]
-    pub fn state(&self) -> SessionState {
-        *self.core.state.borrow()
-    }
-
-    /// The run the recorder began for this conversation, once it has.
-    #[must_use]
-    pub fn run_id(&self) -> Option<RunId> {
-        *lock(&self.core.run)
-    }
-
-    /// Subscribes to the conversation's events from this call on.
-    /// Subscribe first, then read [`Conversation::transcript`] past the
-    /// last seen index, and skip live events below the cursor: nothing is
-    /// lost between the two.
-    #[must_use]
-    pub fn subscribe_events(&self) -> broadcast::Receiver<SessionEvent> {
-        self.channels()
-            .map_or_else(closed, |channels| channels.events.subscribe())
-    }
-
-    /// Subscribes to the conversation's live deltas from this call on.
-    #[must_use]
-    pub fn subscribe_deltas(&self) -> broadcast::Receiver<Delta> {
-        self.channels()
-            .map_or_else(closed, |channels| channels.deltas.subscribe())
-    }
-
-    /// Subscribes to the conversation's failure reports from this call
-    /// on. Ephemeral like the deltas.
-    #[must_use]
-    pub fn subscribe_errors(&self) -> broadcast::Receiver<SessionFailure> {
-        self.channels()
-            .map_or_else(closed, |channels| channels.errors.subscribe())
-    }
-
-    /// The transcript from index `from` on, read from memory. Each entry
-    /// carries the index and reply stamp the live
-    /// [`Conversation::subscribe_events`] stream gave the same event.
-    #[must_use]
-    pub fn transcript(&self, from: u64) -> Vec<SessionEvent> {
-        self.core.transcript.since(from)
-    }
-
-    /// Sends the operator's `text` to the run and returns true, or returns
-    /// false, dropping the text, before the run is handed its Harness and
-    /// once the run has ended.
-    ///
-    /// The text goes to the run's main-chain inbox: it answers the agent
-    /// waiting on its inbox, or steers the turn the agent is working on.
-    /// True means the run accepted it, not that the agent read it.
-    #[must_use]
-    pub fn send_input(&self, text: String) -> bool {
-        lock(&self.core.control)
-            .as_ref()
-            .is_some_and(|control| control.send(text))
-    }
-
-    /// Stops the round in flight: the run drops every effect in flight
-    /// and goes on. A message already sent stays queued for the agent's
-    /// next read of its inbox. Nothing happens before the run is handed
-    /// its Harness.
-    pub fn stop_round(&self) {
-        if let Some(control) = lock(&self.core.control).as_ref() {
-            control.stop_round();
-        }
-    }
-
-    /// Cancels the run for good: the state is `Closing` at once, every
-    /// effect in flight is answered `Dropped`, and the state is `Closed`
-    /// once the run has ended. A close before the run is handed its
-    /// Harness ends that run before it begins. Idempotent.
-    pub fn close(&self) {
-        let control = lock(&self.core.control);
-        self.core
-            .state
-            .send_modify(|state| *state = state.canceled());
-        if let Some(control) = control.as_ref() {
-            control.cancel();
-        }
-    }
-
-    /// Resolves once a close has been requested.
-    pub async fn closing(&self) {
-        let mut state = self.core.state.subscribe();
-        // The sender lives in the core this handle holds, so the watch
-        // never closes while this waits.
-        let _ = state.wait_for(|state| *state != SessionState::Alive).await;
-    }
-
-    /// The live senders, or `None` once the conversation has ended.
-    fn channels(&self) -> Option<Channels> {
-        lock(&self.core.channels).clone()
-    }
-
-    /// Notes the run the recorder began.
-    pub(crate) fn note_run(&self, run: RunId) {
-        *lock(&self.core.run) = Some(run);
-    }
-
-    /// Reports one operator-facing failure of `kind` with its display
-    /// `message`. No receiver means no client is attached; reports are
-    /// ephemeral by design.
-    fn report(&self, kind: FailureKind, message: String) {
-        if let Some(channels) = self.channels() {
-            let _ = channels.errors.send(SessionFailure { kind, message });
-        }
-    }
-
-    /// Applies one recorded event: a failed model round or tool dispatch
-    /// is reported first, then the event is appended to the transcript
-    /// under the next index and that same entry is broadcast.
-    pub(crate) fn observe(&self, event: &Event) {
-        // The program survives a failed round or tool dispatch (the
-        // built-in chat pcalls `models.loop` and returns to waiting), so
-        // the run never fails and only the conversation can tell the
-        // client.
-        match event {
-            Event::ModelTurnFailed { section, .. } => self.report(
-                FailureKind::ModelTurnFailed,
-                format!("Model turn failed in agent `{section}`"),
-            ),
-            Event::ToolCallFailed { section, .. } => self.report(
-                FailureKind::ToolCallFailed,
-                format!("Tool call failed in agent `{section}`"),
-            ),
-            _ => {}
-        }
-        let entry = self.core.transcript.push(event);
-        if let Some(channels) = self.channels() {
-            // No receiver means no client is attached; the transcript
-            // already holds the entry, so a late client reads it there.
-            let _ = channels.events.send(entry);
-        }
-    }
-
-    /// Ends the conversation once its run has: the state is `Closed`, the
-    /// channels close, and the conversation leaves its table.
-    fn end(&self) {
-        self.core.state.send_modify(|state| *state = state.done());
-        lock(&self.core.channels).take();
-        if let Some(table) = self.core.table.upgrade() {
-            table::lock(&table).remove(&self.core.id);
-        }
-    }
-}
-
-/// Locks one of the core's slots. Every write is one store, so a poisoned
-/// lock still holds a usable value.
-fn lock<T>(slot: &Mutex<T>) -> MutexGuard<'_, T> {
-    slot.lock().unwrap_or_else(PoisonError::into_inner)
-}
diff --git a/crates/workshop/agents/src/discovery-tests.rs b/crates/workshop/agents/src/discovery-tests.rs
deleted file mode 100644
index 7d0a58848..000000000
--- a/crates/workshop/agents/src/discovery-tests.rs
+++ /dev/null
@@ -1,114 +0,0 @@
-//! Tests for agent discovery in the agents directory, the built-in chat
-//! fallback, and the launch's refusal of names discovery does not list.
-
-use super::*;
-
-#[test]
-fn discovery_lists_sorted_markdown_stems_and_tolerates_a_missing_dir() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(dir.path().join("zeta.md"), "# zeta").expect("seed zeta");
-    std::fs::write(dir.path().join("alpha.md"), "# alpha").expect("seed alpha");
-    std::fs::write(dir.path().join("notes.txt"), "not an agent").expect("seed noise");
-    std::fs::create_dir(dir.path().join("nested.md")).expect("seed a decoy directory");
-    assert_eq!(
-        discover_agents(dir.path()),
-        vec!["alpha".to_owned(), "chat".to_owned(), "zeta".to_owned()],
-        "discovery lists .md file stems plus the built-in chat, sorted, \
-         and skips everything else"
-    );
-    assert_eq!(
-        discover_agents(&dir.path().join("missing")),
-        vec!["chat".to_owned()],
-        "a missing agents directory still offers the built-in chat rather than failing"
-    );
-}
-
-#[test]
-fn the_built_in_chat_is_always_listed_and_a_dir_file_shadows_its_source() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    assert_eq!(
-        discover_agents(dir.path()),
-        vec!["chat".to_owned()],
-        "an empty agents directory still offers the built-in chat"
-    );
-    assert_eq!(
-        agent_source(dir.path(), "chat").expect("the built-in serves"),
-        (BUILTIN_CHAT_FILE.to_owned(), BUILTIN_CHAT_SOURCE.to_owned()),
-        "with no directory file, the embedded source is what launches, named by its own file"
-    );
-
-    std::fs::write(dir.path().join("chat.md"), "# shadowed").expect("seed the shadow");
-    assert_eq!(
-        discover_agents(dir.path()),
-        vec!["chat".to_owned()],
-        "a directory chat.md lists once, never beside the built-in"
-    );
-    assert_eq!(
-        agent_source(dir.path(), "chat").expect("the shadow reads"),
-        (
-            dir.path().join("chat.md").display().to_string(),
-            "# shadowed".to_owned()
-        ),
-        "a directory chat.md shadows the embedded source and names its own path"
-    );
-
-    assert_eq!(
-        agent_source(dir.path(), "ghost")
-            .expect_err("only the built-in name falls back to embedded source")
-            .kind(),
-        io::ErrorKind::NotFound,
-        "a non-built-in name surfaces its filesystem error"
-    );
-}
-
-#[test]
-fn an_unreadable_chat_md_surfaces_its_error_rather_than_the_built_in() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // A directory named chat.md cannot be read as a file on any
-    // platform, and its failure is never NotFound - the one kind
-    // that falls back to the embedded source.
-    std::fs::create_dir(dir.path().join("chat.md")).expect("seed the unreadable shadow");
-    agent_source(dir.path(), "chat").expect_err(
-        "an existing chat.md that cannot be read surfaces its error; \
-         silently serving the built-in would mask the operator's own file",
-    );
-}
-
-#[test]
-fn a_launch_loads_only_a_name_the_agent_menu_lists() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(dir.path().join("echo.md"), "# echo").expect("seed echo");
-    std::fs::write(dir.path().join("hidden.txt"), "# hidden").expect("seed a non-agent");
-    assert_eq!(
-        load_agent(dir.path(), "echo").expect("a listed agent loads"),
-        (
-            dir.path().join("echo.md").display().to_string(),
-            "# echo".to_owned()
-        )
-    );
-    for refused in ["ghost", "hidden", "../echo", "echo.md"] {
-        let error = load_agent(dir.path(), refused)
-            .expect_err("a name the menu does not list never reaches the filesystem");
-        assert!(
-            matches!(&error, LaunchError::UnknownAgent { name } if name == refused),
-            "{refused:?} is refused by name: {error:?}"
-        );
-        assert_eq!(
-            error.to_string(),
-            format!("unknown agent {refused:?}: not in the agents directory"),
-            "the refusal keeps its text"
-        );
-    }
-}
-
-#[test]
-fn an_unreadable_listed_agent_is_refused_with_its_cause() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::create_dir(dir.path().join("chat.md")).expect("seed the unreadable shadow");
-    let error = load_agent(dir.path(), "chat").expect_err("an unreadable source refuses");
-    assert_eq!(error.to_string(), "agent session state unavailable");
-    assert!(
-        std::error::Error::source(&error).is_some(),
-        "the filesystem's diagnosis stays reachable as the cause"
-    );
-}
diff --git a/crates/workshop/agents/src/discovery.rs b/crates/workshop/agents/src/discovery.rs
deleted file mode 100644
index 35cb658b5..000000000
--- a/crates/workshop/agents/src/discovery.rs
+++ /dev/null
@@ -1,104 +0,0 @@
-//! Agent discovery: the `.md` agent prompts in Workshop's agents folder,
-//! the built-in `chat` agent embedded at compile time, the shadowing rule
-//! between them, and the launch's read of one agent's source.
-
-use std::io;
-use std::path::Path;
-
-/// The committed built-in chat agent, embedded at compile time, so a
-/// fresh install has a working chat with no agents folder at all.
-pub const BUILTIN_CHAT_SOURCE: &str = include_str!("../agents/chat.md");
-
-/// The file the built-in chat agent's source comes from, as its run names
-/// it: the file in this crate that [`BUILTIN_CHAT_SOURCE`] embeds.
-const BUILTIN_CHAT_FILE: &str = "agents/chat.md";
-
-/// The built-in default agent's name: discovery always offers it, and a
-/// folder file named `chat.md` shadows the embedded source.
-const BUILTIN_CHAT_NAME: &str = "chat";
-
-/// A refused launch.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum LaunchError {
-    /// The requested name is not one the agent menu lists.
-    #[error("unknown agent {name:?}: not in the agents directory")]
-    UnknownAgent {
-        /// The name that was requested.
-        name: String,
-    },
-    /// The agent's program source could not be read.
-    #[error("agent session state unavailable")]
-    Unreadable {
-        /// The underlying filesystem failure.
-        #[source]
-        source: io::Error,
-    },
-}
-
-/// Lists the launchable agent names: the `.md` file stems under `dir`
-/// plus the built-in `chat`, sorted. A missing or unreadable folder
-/// offers only the built-in, and a folder `chat.md` lists once: it
-/// shadows the embedded source instead of duplicating the name.
-#[must_use]
-pub fn discover_agents(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = std::fs::read_dir(dir)
-        .into_iter()
-        .flatten()
-        .filter_map(Result::ok)
-        .map(|entry| entry.path())
-        .filter(|path| {
-            path.is_file() && path.extension().is_some_and(|extension| extension == "md")
-        })
-        .filter_map(|path| {
-            path.file_stem()
-                .and_then(|stem| stem.to_str())
-                .map(str::to_owned)
-        })
-        .collect();
-    if !names.iter().any(|name| name == BUILTIN_CHAT_NAME) {
-        names.push(BUILTIN_CHAT_NAME.to_owned());
-    }
-    names.sort();
-    names
-}
-
-/// Reads the agent `name` as the pair of the file its source came from and
-/// the source, accepting only a name the agent menu lists:
-/// [`discover_agents`] over `dir` is the trust boundary, so a client-sent
-/// name reaches the filesystem only as the bare stem of a real `.md` file
-/// in `dir`, or as the built-in `chat`.
-///
-/// # Errors
-/// Returns [`LaunchError::UnknownAgent`] for a name discovery does not
-/// list, paths included, and [`LaunchError::Unreadable`] when a listed
-/// agent's source cannot be read.
-pub fn load_agent(dir: &Path, name: &str) -> Result<(String, String), LaunchError> {
-    if !discover_agents(dir).iter().any(|known| known == name) {
-        return Err(LaunchError::UnknownAgent {
-            name: name.to_owned(),
-        });
-    }
-    agent_source(dir, name).map_err(|source| LaunchError::Unreadable { source })
-}
-
-/// Reads the agent's file and program source: the folder file's path and
-/// text when it exists - a folder `chat.md` shadows the built-in - else
-/// the embedded built-in for the `chat` name alone. A missing file for any
-/// other name is a real filesystem race, surfaced as the error it is; so is
-/// an existing `chat.md` that cannot be read, because silently serving the
-/// built-in would mask the operator's own file.
-fn agent_source(dir: &Path, name: &str) -> io::Result<(String, String)> {
-    let path = dir.join(format!("{name}.md"));
-    match std::fs::read_to_string(&path) {
-        Ok(source) => Ok((path.display().to_string(), source)),
-        Err(error) if name == BUILTIN_CHAT_NAME && error.kind() == io::ErrorKind::NotFound => {
-            Ok((BUILTIN_CHAT_FILE.to_owned(), BUILTIN_CHAT_SOURCE.to_owned()))
-        }
-        Err(error) => Err(error),
-    }
-}
-
-#[cfg(test)]
-#[path = "discovery-tests.rs"]
-mod tests;
diff --git a/crates/workshop/agents/src/lib.rs b/crates/workshop/agents/src/lib.rs
deleted file mode 100644
index 07d95723b..000000000
--- a/crates/workshop/agents/src/lib.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-//! workshop-agents - Workshop's agent conversations: the conversation
-//! table keyed by a Workshop-minted id, each conversation's transcript,
-//! state, and failure reports, the operator's messages to its run,
-//! discovery over the agents folder with the built-in `chat` agent, the
-//! Host's timer, and the recorder tee every run of a conversation writes
-//! through.
-//!
-//! A conversation is one launched agent and its one run. The server
-//! builds that run's `RunSetup` around the recorder tee the
-//! [`Conversation`] hands it, streams the run's own rounds into it
-//! through [`Conversation::publish_delta`], and hands it to
-//! [`Conversation::run`], which parses the agent on the server's Host and
-//! drives the run. An agent that fails to parse is reported as a failed
-//! run and records none. [`Conversation::send_input`] sends the
-//! operator's message to the run's main chain. A stop drops the round in
-//! flight and keeps the run going; a close cancels the run, and the
-//! conversation ends when the run does.
-//!
-//! ## Invariants
-//!
-//! - Tier: feature; may depend on: the vocabulary crates
-//!   (`workshop-protocol`, `workshop-registry`, `workshop-support`), the
-//!   service crates (`workshop-gateway`, `workshop-menu`,
-//!   `workshop-status`), `runvil`, the one crate a Host depends on for
-//!   the Harness and the Engine, and third-party crates; today it names
-//!   none of the Workshop crates. Never on `workshop-server`, another
-//!   feature crate, an Engine crate, or a private Harness or Gateway
-//!   crate.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - A conversation's transcript is held in memory. The recorder tee adds
-//!   each event to it only after the inner recorder accepts the event, so
-//!   the record, the live broadcast, and the transcript agree event for
-//!   event, and each event takes its `reply` from its own round.
-//! - A conversation's channels close when it ends, so whatever holds only
-//!   its receivers ends with it.
-
-mod conversation;
-mod discovery;
-mod protocol;
-mod state;
-mod table;
-mod tee;
-mod timer;
-mod transcript;
-
-pub use conversation::Conversation;
-pub use discovery::{BUILTIN_CHAT_SOURCE, LaunchError, discover_agents, load_agent};
-pub use protocol::{ConversationId, Delta, DeltaKind, SessionEvent};
-pub use state::{FailureKind, SessionFailure, SessionState};
-pub use table::Conversations;
-pub use timer::TokioTimer;
diff --git a/crates/workshop/agents/src/protocol.rs b/crates/workshop/agents/src/protocol.rs
deleted file mode 100644
index 8d63c40e0..000000000
--- a/crates/workshop/agents/src/protocol.rs
+++ /dev/null
@@ -1,97 +0,0 @@
-//! The conversation vocabulary the agent socket renders: ids, durable
-//! transcript entries, and ephemeral deltas. Nothing here names the
-//! socket's wire shape.
-
-use std::fmt;
-
-use serde::{Deserialize, Serialize};
-
-/// A conversation's unguessable id, minted by Workshop at launch. It is
-/// also the name of the conversation's run. Conversations outlive socket
-/// connections, so a client keeps the id to reattach after a disconnect.
-#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(transparent)]
-pub struct ConversationId(String);
-
-impl ConversationId {
-    /// Wraps an already-minted id.
-    #[must_use]
-    pub fn new(id: impl Into<String>) -> Self {
-        Self(id.into())
-    }
-
-    /// A fresh unguessable id: 128 bits from the OS-seeded cryptographic
-    /// RNG, hex-encoded - wide enough that ids never collide across
-    /// restarts, so a client's retained id never names a stranger's
-    /// conversation.
-    #[must_use]
-    pub fn fresh() -> Self {
-        use rand::Rng as _;
-        let mut rng = rand::rng();
-        Self(format!(
-            "{:016x}{:016x}",
-            rng.random::<u64>(),
-            rng.random::<u64>()
-        ))
-    }
-
-    /// The id as text.
-    #[must_use]
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl fmt::Display for ConversationId {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(&self.0)
-    }
-}
-
-/// One durable entry of a conversation's transcript.
-///
-/// `index` is the entry's position in the transcript: every event the
-/// conversation's run has reported, in log order, numbered from zero. A
-/// client resumes past its last seen index on reconnect. `reply` is
-/// present on a model round's content events and holds that round's id,
-/// the id its [`Delta`]s carry.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct SessionEvent {
-    /// The entry's transcript index.
-    pub index: u64,
-    /// The round id this event settles, present on the model-round
-    /// content kinds and omitted elsewhere.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub reply: Option<u64>,
-    /// The logged Engine event, in its persisted shape.
-    pub event: serde_json::Value,
-}
-
-/// Which streaming side channel one delta belongs to.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-#[non_exhaustive]
-pub enum DeltaKind {
-    /// Answer content, superseded by the round's reply event.
-    Text,
-    /// Reasoning content, superseded by the round's thinking event.
-    Reasoning,
-}
-
-/// One live streaming chunk of a model round.
-///
-/// Every delta is stamped with its round's id as `reply`, the id the
-/// durable [`SessionEvent`] that supersedes it carries, so a client
-/// coalesces chunks by that id and replaces them when the event arrives.
-/// Deltas are ephemeral: they may drop under lag, and the completed-reply
-/// event is the repair path.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[non_exhaustive]
-pub struct Delta {
-    /// Which side channel the chunk belongs to.
-    pub kind: DeltaKind,
-    /// The chunk's text.
-    pub content: String,
-    /// The id of the round whose durable event will supersede this delta.
-    pub reply: u64,
-}
diff --git a/crates/workshop/agents/src/state.rs b/crates/workshop/agents/src/state.rs
deleted file mode 100644
index 4985b7d9a..000000000
--- a/crates/workshop/agents/src/state.rs
+++ /dev/null
@@ -1,94 +0,0 @@
-//! Where a conversation stands, and the failure reports it makes.
-
-/// Where a conversation's run stands between its launch and its end.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum SessionState {
-    /// The run is stepping and its effects are being performed.
-    Alive,
-    /// A close was requested: the run's cancel flag is set, and its
-    /// outstanding effects are being answered `Dropped`.
-    Closing,
-    /// The run ended; nothing is outstanding.
-    Closed,
-}
-
-impl SessionState {
-    /// The state after a close cancels the session. A closed conversation
-    /// stays closed: it has nothing left to cancel.
-    #[must_use]
-    pub fn canceled(self) -> Self {
-        match self {
-            Self::Alive | Self::Closing => Self::Closing,
-            Self::Closed => Self::Closed,
-        }
-    }
-
-    /// The state after the run ends, whatever preceded it.
-    #[must_use]
-    pub fn done(self) -> Self {
-        match self {
-            Self::Alive | Self::Closing | Self::Closed => Self::Closed,
-        }
-    }
-}
-
-/// What kind of failure a conversation is reporting: the machine-readable
-/// fact a client classifies on. The first two are turn failures the
-/// program survived (the built-in chat pcalls `models.loop` and returns
-/// to waiting); the last two end the run. Deliberately not
-/// `#[non_exhaustive]`: a client that labels each kind matches on it
-/// exhaustively, so a new kind fails that client's build until it is
-/// labelled instead of silently falling into a wildcard.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FailureKind {
-    /// A model round failed; the program survived and is waiting again.
-    ModelTurnFailed,
-    /// A tool dispatch failed; the program survived and is waiting again.
-    ToolCallFailed,
-    /// The run itself ended in error.
-    RunFailed,
-    /// The run ended canceled: a close, or a stop the program did not
-    /// catch, cut it short before it finished on its own.
-    Canceled,
-}
-
-/// One operator-facing failure report: the kind is the fact code acts
-/// on, the message is display text for the operator and the model. Code
-/// never derives meaning from the message.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct SessionFailure {
-    /// Which failure this is.
-    pub kind: FailureKind,
-    /// The sentence a client shows for it.
-    pub message: String,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_run_goes_alive_closing_closed_and_never_back() {
-        let cases: [(SessionState, SessionState, SessionState); 3] = [
-            (
-                SessionState::Alive,
-                SessionState::Closing,
-                SessionState::Closed,
-            ),
-            (
-                SessionState::Closing,
-                SessionState::Closing,
-                SessionState::Closed,
-            ),
-            (
-                SessionState::Closed,
-                SessionState::Closed,
-                SessionState::Closed,
-            ),
-        ];
-        for (start, after_cancel, after_done) in cases {
-            assert_eq!(start.canceled(), after_cancel, "{start:?} canceled");
-            assert_eq!(start.done(), after_done, "{start:?} done");
-        }
-    }
-}
diff --git a/crates/workshop/agents/src/table.rs b/crates/workshop/agents/src/table.rs
deleted file mode 100644
index 4c3f639d0..000000000
--- a/crates/workshop/agents/src/table.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-//! The conversation table: every running conversation by its id, which
-//! is how a socket that reconnects finds its conversation again.
-
-use std::collections::HashMap;
-use std::fmt;
-use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
-
-use crate::conversation::Conversation;
-use crate::protocol::ConversationId;
-
-/// The running conversations by id, shared with each conversation so an
-/// ended one removes itself.
-pub(crate) type Table = Mutex<HashMap<ConversationId, Conversation>>;
-
-/// Locks `table`. Every mutation is one insert or remove, so a poisoned
-/// lock still holds a usable map.
-pub(crate) fn lock(table: &Table) -> MutexGuard<'_, HashMap<ConversationId, Conversation>> {
-    table.lock().unwrap_or_else(PoisonError::into_inner)
-}
-
-/// Workshop's running conversations, keyed by the id each launch mints.
-/// Cheap to clone; every clone is the same table.
-#[derive(Clone, Default)]
-pub struct Conversations {
-    table: Arc<Table>,
-}
-
-impl fmt::Debug for Conversations {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Conversations")
-            .field("running", &lock(&self.table).len())
-            .finish()
-    }
-}
-
-impl Conversations {
-    /// An empty table.
-    #[must_use]
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Opens a conversation running the agent `agent` under a fresh id,
-    /// and holds it until its run ends or [`close`](Self::close) ends it.
-    /// Its run has not started: hand [`Conversation::run`] the run's
-    /// Harness.
-    #[must_use]
-    pub fn open(&self, agent: impl Into<String>) -> Conversation {
-        let conversation = Conversation::new(
-            ConversationId::fresh(),
-            agent.into(),
-            Arc::downgrade(&self.table),
-        );
-        lock(&self.table).insert(conversation.id().clone(), conversation.clone());
-        conversation
-    }
-
-    /// The running conversation with this id, when one exists.
-    #[must_use]
-    pub fn get(&self, id: &ConversationId) -> Option<Conversation> {
-        lock(&self.table).get(id).cloned()
-    }
-
-    /// Ends the conversation with this id: it leaves the table at once,
-    /// and its run is canceled. Returns whether a conversation was
-    /// ended. A handle still held sees the state reach `Closed` once the
-    /// run's outstanding effects are answered `Dropped`.
-    #[must_use]
-    pub fn close(&self, id: &ConversationId) -> bool {
-        let Some(conversation) = lock(&self.table).remove(id) else {
-            return false;
-        };
-        conversation.close();
-        true
-    }
-}
diff --git a/crates/workshop/agents/src/tee-tests.rs b/crates/workshop/agents/src/tee-tests.rs
deleted file mode 100644
index 284a60aed..000000000
--- a/crates/workshop/agents/src/tee-tests.rs
+++ /dev/null
@@ -1,197 +0,0 @@
-//! Tests for the recorder tee: an event reaches the conversation only
-//! after the inner recorder accepts it, a refusal is the inner recorder's
-//! own, and the recorded failure events become failure reports.
-
-use std::sync::{Arc, Mutex};
-
-use runvil::event::Event;
-use runvil::harness::{
-    MemoryRecorder, Record, RecordKind, RunId, RunMeta, RunRecorder, make_recorder_error,
-};
-use runvil::ids::Provenance;
-use runvil::{BoxFuture, Error, RunSeed, Timestamp};
-
-use crate::state::FailureKind;
-use crate::table::Conversations;
-
-use super::*;
-
-fn meta() -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([7; 32]),
-        flags: 0,
-        started_at: Timestamp::UNIX_EPOCH,
-    }
-}
-
-fn provenance() -> Provenance {
-    Provenance::new("0".parse().unwrap(), 0)
-}
-
-fn section_started() -> Event {
-    Event::SectionStarted {
-        section: "Conversation".to_owned(),
-        provenance: provenance(),
-    }
-}
-
-fn record(kind: RecordKind, event: &Event) -> Record {
-    Record {
-        task_id: "0".to_owned(),
-        task_seq: 0,
-        kind,
-        effect_id: None,
-        payload: serde_json::to_value(event).unwrap(),
-    }
-}
-
-/// An inner recorder that notes, at each append, how many entries the
-/// conversation's transcript already held, and refuses appends on demand.
-struct Watching {
-    inner: MemoryRecorder,
-    conversation: Conversation,
-    held_at_append: Mutex<Vec<usize>>,
-    refuse: bool,
-}
-
-impl RunRecorder for Watching {
-    fn begin_run(&self, meta: RunMeta) -> BoxFuture<'_, Result<RunId, Error>> {
-        self.inner.begin_run(meta)
-    }
-
-    fn append(&self, run: RunId, record: Record) -> BoxFuture<'_, Result<(), Error>> {
-        self.held_at_append
-            .lock()
-            .unwrap()
-            .push(self.conversation.transcript(0).len());
-        if self.refuse {
-            return Box::pin(async { Err(make_recorder_error("the log is full")) });
-        }
-        self.inner.append(run, record)
-    }
-
-    fn end_run(
-        &self,
-        run: RunId,
-        result: Result<String, Error>,
-    ) -> BoxFuture<'_, Result<(), Error>> {
-        self.inner.end_run(run, result)
-    }
-}
-
-fn watched(refuse: bool) -> (Conversation, Arc<Watching>, Arc<dyn RunRecorder>) {
-    let conversation = Conversations::new().open("echo");
-    let inner = Arc::new(Watching {
-        inner: MemoryRecorder::new(),
-        conversation: conversation.clone(),
-        held_at_append: Mutex::new(Vec::new()),
-        refuse,
-    });
-    let tee = conversation.recorder(inner.clone());
-    (conversation, inner, tee)
-}
-
-#[tokio::test]
-async fn the_tee_adds_an_event_to_the_transcript_after_the_inner_recorder_accepts_it() {
-    let (conversation, inner, tee) = watched(false);
-    let mut live = conversation.subscribe_events();
-    let run = tee.begin_run(meta()).await.unwrap();
-    tee.append(run, record(RecordKind::Event, &section_started()))
-        .await
-        .unwrap();
-    assert_eq!(
-        *inner.held_at_append.lock().unwrap(),
-        [0],
-        "the transcript was empty while the inner recorder took the event"
-    );
-    let entries = conversation.transcript(0);
-    assert_eq!(entries.len(), 1, "the accepted event is in the transcript");
-    assert_eq!(
-        live.try_recv().unwrap(),
-        entries[0],
-        "the live broadcast carries the entry the transcript holds"
-    );
-    assert_eq!(
-        inner.inner.records(run).len(),
-        1,
-        "the inner recorder holds the record"
-    );
-}
-
-#[tokio::test]
-async fn the_tee_returns_the_inner_recorders_refusal_and_keeps_the_event_out() {
-    let (conversation, _inner, tee) = watched(true);
-    let mut live = conversation.subscribe_events();
-    let run = tee.begin_run(meta()).await.unwrap();
-    let refusal = tee
-        .append(run, record(RecordKind::Event, &section_started()))
-        .await
-        .expect_err("the inner recorder's refusal is the tee's");
-    assert_eq!(
-        runvil::harness::display_chain(&refusal),
-        "the run recorder failed: the log is full",
-        "the refusal is the inner recorder's own"
-    );
-    assert!(
-        conversation.transcript(0).is_empty(),
-        "a refused event never reaches the transcript"
-    );
-    assert!(live.try_recv().is_err(), "nor the live broadcast");
-}
-
-#[tokio::test]
-async fn effects_and_answers_reach_the_inner_recorder_and_not_the_transcript() {
-    let (conversation, inner, tee) = watched(false);
-    let run = tee.begin_run(meta()).await.unwrap();
-    for kind in [RecordKind::Effect, RecordKind::Answer] {
-        tee.append(run, record(kind, &section_started()))
-            .await
-            .unwrap();
-    }
-    assert_eq!(inner.inner.records(run).len(), 2);
-    assert!(conversation.transcript(0).is_empty());
-}
-
-#[tokio::test]
-async fn begin_run_hands_the_meta_on_unchanged_and_notes_the_run() {
-    let (conversation, inner, tee) = watched(false);
-    assert_eq!(conversation.run_id(), None, "no run has begun");
-    let run = tee.begin_run(meta()).await.unwrap();
-    assert_eq!(
-        inner.inner.meta(run),
-        Some(meta()),
-        "the inner recorder receives the Harness's metadata as it was"
-    );
-    assert_eq!(conversation.run_id(), Some(run));
-}
-
-#[tokio::test]
-async fn recorded_turn_failures_report_their_kind_and_section() {
-    let (conversation, _inner, tee) = watched(false);
-    let mut errors = conversation.subscribe_errors();
-    let run = tee.begin_run(meta()).await.unwrap();
-    let model = Event::ModelTurnFailed {
-        section: "Conversation".to_owned(),
-        provenance: provenance(),
-    };
-    let tool = Event::ToolCallFailed {
-        section: "Lookup".to_owned(),
-        provenance: provenance(),
-    };
-    for event in [&model, &tool] {
-        tee.append(run, record(RecordKind::Event, event))
-            .await
-            .unwrap();
-    }
-    let first = errors.try_recv().unwrap();
-    assert_eq!(first.kind, FailureKind::ModelTurnFailed);
-    assert_eq!(first.message, "Model turn failed in agent `Conversation`");
-    let second = errors.try_recv().unwrap();
-    assert_eq!(second.kind, FailureKind::ToolCallFailed);
-    assert_eq!(second.message, "Tool call failed in agent `Lookup`");
-    assert_eq!(
-        conversation.transcript(0).len(),
-        2,
-        "a failure event is still a transcript entry"
-    );
-}
diff --git a/crates/workshop/agents/src/tee.rs b/crates/workshop/agents/src/tee.rs
deleted file mode 100644
index d7551203c..000000000
--- a/crates/workshop/agents/src/tee.rs
+++ /dev/null
@@ -1,75 +0,0 @@
-//! The recorder a conversation's run writes through: every call goes on
-//! to the inner recorder, and what the inner recorder accepted also
-//! reaches the conversation.
-//!
-//! The tee notes the run the inner recorder begins and hands each event
-//! record the inner recorder accepted to the conversation, so the record,
-//! the live broadcast, and the transcript agree event for event. A refused write
-//! is returned as the inner recorder's own, and its event reaches no one.
-
-use std::sync::Arc;
-
-use runvil::event::Event;
-use runvil::harness::{Record, RecordKind, RunId, RunMeta, RunRecorder};
-use runvil::{BoxFuture, Error};
-
-use crate::conversation::Conversation;
-
-/// A [`RunRecorder`] over an inner recorder that feeds one conversation.
-pub(crate) struct ConversationRecorder {
-    conversation: Conversation,
-    inner: Arc<dyn RunRecorder>,
-}
-
-impl ConversationRecorder {
-    /// The tee over `inner` feeding `conversation`.
-    pub(crate) fn new(conversation: Conversation, inner: Arc<dyn RunRecorder>) -> Self {
-        Self {
-            conversation,
-            inner,
-        }
-    }
-}
-
-impl RunRecorder for ConversationRecorder {
-    fn begin_run(&self, meta: RunMeta) -> BoxFuture<'_, Result<RunId, Error>> {
-        Box::pin(async move {
-            let run = self.inner.begin_run(meta).await?;
-            self.conversation.note_run(run);
-            Ok(run)
-        })
-    }
-
-    fn append(&self, run: RunId, record: Record) -> BoxFuture<'_, Result<(), Error>> {
-        Box::pin(async move {
-            let event = (record.kind == RecordKind::Event).then(|| record.payload.clone());
-            self.inner.append(run, record).await?;
-            if let Some(payload) = event {
-                // The run serialized this event for the record a moment
-                // ago, so it reads back; a payload that does not is
-                // logged and left out of the transcript.
-                match serde_json::from_value::<Event>(payload) {
-                    Ok(event) => self.conversation.observe(&event),
-                    Err(error) => tracing::error!(
-                        conversation = %self.conversation.id(),
-                        %error,
-                        "a recorded event did not read back; the transcript skips it"
-                    ),
-                }
-            }
-            Ok(())
-        })
-    }
-
-    fn end_run(
-        &self,
-        run: RunId,
-        result: Result<String, Error>,
-    ) -> BoxFuture<'_, Result<(), Error>> {
-        self.inner.end_run(run, result)
-    }
-}
-
-#[cfg(test)]
-#[path = "tee-tests.rs"]
-mod tests;
diff --git a/crates/workshop/agents/src/timer.rs b/crates/workshop/agents/src/timer.rs
deleted file mode 100644
index 54db74286..000000000
--- a/crates/workshop/agents/src/timer.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! The Host's timer: the clock every conversation's run sleeps on.
-
-use std::time::Duration;
-
-use runvil::BoxFuture;
-use runvil::harness::Timer;
-
-/// Sleeps on tokio's timer wheel.
-///
-/// The wheel multiplexes every pending sleep, so a `Timer` effect is one
-/// `tokio::time::sleep`, and the Harness's drop of the effect tears the
-/// sleep down.
-#[derive(Clone, Copy, Debug, Default)]
-pub struct TokioTimer;
-
-impl Timer for TokioTimer {
-    fn sleep(&self, duration: Duration) -> BoxFuture<'static, ()> {
-        Box::pin(tokio::time::sleep(duration))
-    }
-}
diff --git a/crates/workshop/agents/src/transcript-tests.rs b/crates/workshop/agents/src/transcript-tests.rs
deleted file mode 100644
index 9d358ab7f..000000000
--- a/crates/workshop/agents/src/transcript-tests.rs
+++ /dev/null
@@ -1,125 +0,0 @@
-//! Tests for the transcript: every event is numbered from zero, and a
-//! round's content events take their `reply` from that round.
-
-use runvil::event::{Event, ReplyOrigin};
-use runvil::ids::{Provenance, RoundId};
-
-use super::*;
-
-/// The coordinates every event carries; only the kind and payload matter
-/// to the numbering and the stamp.
-fn at() -> (String, Provenance) {
-    (
-        "Conversation".to_owned(),
-        Provenance::new("0".parse().unwrap(), 0),
-    )
-}
-
-fn answered(content: &str) -> Event {
-    let (section, provenance) = at();
-    Event::InboxMessage {
-        section,
-        provenance,
-        text: content.to_owned(),
-    }
-}
-
-fn thinking(round: u64) -> Event {
-    let (section, provenance) = at();
-    Event::Thinking {
-        section,
-        provenance,
-        turn: 0,
-        round: RoundId::new(round),
-        model: "some-model".to_owned(),
-        text: "weighing options".to_owned(),
-    }
-}
-
-fn reply(round: u64, origin: ReplyOrigin) -> Event {
-    let (section, provenance) = at();
-    Event::AssistantReply {
-        section,
-        provenance,
-        turn: 0,
-        round: RoundId::new(round),
-        text: "42".to_owned(),
-        finish_reason: Some("stop".to_owned()),
-        model: "some-model".to_owned(),
-        metrics: None,
-        origin,
-    }
-}
-
-fn tool_calls(round: u64) -> Event {
-    let (section, provenance) = at();
-    Event::AssistantToolCalls {
-        section,
-        provenance,
-        turn: 0,
-        round: RoundId::new(round),
-        model: "some-model".to_owned(),
-        calls: Vec::new(),
-    }
-}
-
-#[test]
-fn every_event_is_numbered_from_zero_in_the_order_it_lands() {
-    let transcript = Transcript::new();
-    let stamped: Vec<u64> = [answered("one"), thinking(0), reply(0, ReplyOrigin::Chat)]
-        .iter()
-        .map(|event| transcript.push(event).index)
-        .collect();
-    assert_eq!(stamped, [0, 1, 2], "the live entries number from zero");
-    let read: Vec<u64> = transcript
-        .since(0)
-        .iter()
-        .map(|entry| entry.index)
-        .collect();
-    assert_eq!(read, [0, 1, 2], "the transcript holds the same numbers");
-    assert_eq!(
-        transcript.since(1).first().map(|entry| entry.index),
-        Some(1),
-        "a read from an index starts there"
-    );
-    assert!(
-        transcript.since(9).is_empty(),
-        "a read past the end is empty"
-    );
-}
-
-#[test]
-fn a_rounds_content_events_take_their_reply_from_the_round() {
-    let transcript = Transcript::new();
-    // A nested infer round numbered 4 lands between a section's rounds 3
-    // and 5: each event names its own round, whatever landed before it.
-    let cases = [
-        (thinking(3), Some(3)),
-        (reply(3, ReplyOrigin::Chat), Some(3)),
-        (reply(4, ReplyOrigin::Infer), Some(4)),
-        (tool_calls(5), Some(5)),
-        (answered("next"), None),
-        (reply(5, ReplyOrigin::Chat), Some(5)),
-    ];
-    for (event, expected) in cases {
-        let entry = transcript.push(&event);
-        assert_eq!(entry.reply, expected, "{event:?}");
-        assert_eq!(
-            transcript.since(entry.index)[0].reply,
-            expected,
-            "the transcript keeps the stamp the live entry carried"
-        );
-    }
-}
-
-#[test]
-fn an_entry_carries_the_event_in_its_persisted_shape() {
-    let transcript = Transcript::new();
-    let event = answered("ping");
-    let entry = transcript.push(&event);
-    assert_eq!(
-        entry.event,
-        serde_json::to_value(&event).expect("an event serializes"),
-        "the entry's payload is the event the recorder took"
-    );
-}
diff --git a/crates/workshop/agents/src/transcript.rs b/crates/workshop/agents/src/transcript.rs
deleted file mode 100644
index b91120a2f..000000000
--- a/crates/workshop/agents/src/transcript.rs
+++ /dev/null
@@ -1,75 +0,0 @@
-//! A conversation's transcript: every event its run has reported, in the
-//! order the conversation observed them, numbered from zero.
-//!
-//! The transcript lives in memory. The conversation appends each event
-//! here before it broadcasts it, stamped with the index and reply id the
-//! live subscriber receives, so a reconnecting client that reads the
-//! transcript past its last seen index sees the same values the live
-//! stream carried. A round's content events take their reply id from the
-//! round itself, the id the round's deltas carry.
-
-use std::sync::{Mutex, MutexGuard, PoisonError};
-
-use runvil::event::Event;
-
-use crate::protocol::SessionEvent;
-
-/// The events a conversation has observed, stamped.
-pub(crate) struct Transcript {
-    events: Mutex<Vec<SessionEvent>>,
-}
-
-impl Transcript {
-    /// An empty transcript.
-    pub(crate) fn new() -> Self {
-        Self {
-            events: Mutex::new(Vec::new()),
-        }
-    }
-
-    /// Stamps `event` with the next index and its round, appends it, and
-    /// returns the stamped entry for the live broadcast.
-    pub(crate) fn push(&self, event: &Event) -> SessionEvent {
-        let mut events = self.lock();
-        // The run serialized this same event for its recorder a moment
-        // ago, so this cannot fail; `Null` keeps the index sequence whole
-        // if it ever did.
-        let stamped = SessionEvent {
-            index: events.len() as u64,
-            reply: reply_of(event),
-            event: serde_json::to_value(event).unwrap_or(serde_json::Value::Null),
-        };
-        events.push(stamped.clone());
-        stamped
-    }
-
-    /// The entries with an index of at least `from`, in order.
-    pub(crate) fn since(&self, from: u64) -> Vec<SessionEvent> {
-        let start = usize::try_from(from).unwrap_or(usize::MAX);
-        self.lock()
-            .get(start..)
-            .map(<[_]>::to_vec)
-            .unwrap_or_default()
-    }
-
-    fn lock(&self) -> MutexGuard<'_, Vec<SessionEvent>> {
-        // `push` leaves the vector whole between its pushes, so a poisoned
-        // lock still holds a usable value.
-        self.events.lock().unwrap_or_else(PoisonError::into_inner)
-    }
-}
-
-/// The reply id of a model round's content event: the round that
-/// produced it. Every other event settles no deltas.
-fn reply_of(event: &Event) -> Option<u64> {
-    match event {
-        Event::Thinking { round, .. }
-        | Event::AssistantReply { round, .. }
-        | Event::AssistantToolCalls { round, .. } => Some(round.get()),
-        _ => None,
-    }
-}
-
-#[cfg(test)]
-#[path = "transcript-tests.rs"]
-mod tests;
diff --git a/crates/workshop/agents/tests/it/conversation.rs b/crates/workshop/agents/tests/it/conversation.rs
deleted file mode 100644
index 527e7eb51..000000000
--- a/crates/workshop/agents/tests/it/conversation.rs
+++ /dev/null
@@ -1,296 +0,0 @@
-//! A conversation over its one run: the run's report becomes the
-//! conversation's failure report, an agent that fails to parse is a
-//! run-failed report with no run recorded, a message sent before the run
-//! is handed its Harness reaches no run, a stop leaves the agent waiting
-//! on its inbox, a close cancels the run, and the conversation ends with
-//! its run.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking with the invariant
-// named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-use std::sync::Arc;
-use std::time::Duration;
-
-use runvil::harness::{MemoryRecorder, RunId};
-use tokio::sync::broadcast;
-use workshop_agents::{
-    Conversation, Conversations, FailureKind, SessionEvent, SessionFailure, SessionState,
-};
-
-use crate::support::{AGENT, prompt, run_for};
-
-const DEADLINE: Duration = Duration::from_secs(10);
-
-/// A section that returns the operator's next message.
-const RECEIVES: &str = "return (tasks.receive())";
-
-/// Runs the conversation's one run over `source` on its own task.
-fn start(
-    conversation: &Conversation,
-    recorder: &Arc<MemoryRecorder>,
-    source: String,
-) -> tokio::task::JoinHandle<()> {
-    let (host, setup) = run_for(conversation, Arc::clone(recorder), source);
-    let conversation = conversation.clone();
-    tokio::spawn(async move { conversation.run(host, AGENT, setup).await })
-}
-
-/// Waits until the run's main chain parks on its empty inbox, as the
-/// conversation's live events report it.
-async fn waits_on_its_inbox(events: &mut broadcast::Receiver<SessionEvent>) {
-    tokio::time::timeout(DEADLINE, async {
-        loop {
-            let entry = events.recv().await.expect("the event channel is open");
-            if entry.event["kind"] == "inbox_waiting" {
-                return;
-            }
-        }
-    })
-    .await
-    .expect("the agent waits on its inbox in time");
-}
-
-async fn ended(run: tokio::task::JoinHandle<()>) {
-    tokio::time::timeout(DEADLINE, run)
-        .await
-        .expect("the run ends in time")
-        .expect("the run's task joins");
-}
-
-/// Every failure report still queued.
-fn reports(errors: &mut broadcast::Receiver<SessionFailure>) -> Vec<SessionFailure> {
-    std::iter::from_fn(|| errors.try_recv().ok()).collect()
-}
-
-#[tokio::test]
-async fn a_failed_report_becomes_a_run_failed_report_and_ends_the_conversation() {
-    let table = Conversations::new();
-    let conversation = table.open("boom");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-    let mut events = conversation.subscribe_events();
-
-    ended(start(&conversation, &recorder, prompt("error('kaboom')"))).await;
-
-    let reports = reports(&mut errors);
-    assert_eq!(reports.len(), 1, "one report: {reports:?}");
-    assert_eq!(reports[0].kind, FailureKind::RunFailed);
-    assert!(
-        reports[0].message.contains("kaboom"),
-        "the run's own failure is the message: {reports:?}"
-    );
-    assert_eq!(conversation.state(), SessionState::Closed);
-    let run = conversation.run_id().expect("the recorder began the run");
-    let Some(Err(error)) = recorder.result(run) else {
-        panic!("the run is recorded as failed");
-    };
-    assert!(!error.is_canceled(), "a failure is not a cancel: {error:?}");
-    assert_eq!(
-        reports[0].message,
-        error.located_message(),
-        "the report is the recorded failure's located message"
-    );
-    assert!(
-        table.get(conversation.id()).is_none(),
-        "an ended conversation leaves the table"
-    );
-    while let Ok(_entry) = events.try_recv() {}
-    assert!(
-        matches!(
-            events.try_recv(),
-            Err(broadcast::error::TryRecvError::Closed)
-        ),
-        "an ended conversation's channels close"
-    );
-}
-
-#[tokio::test]
-async fn an_agent_that_fails_to_parse_reports_a_run_failure_and_records_no_run() {
-    let table = Conversations::new();
-    let conversation = table.open("unclosed");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-    let unclosed = "---\nname: unclosed\ndescription: d\nrunvil: 0\n\n# Title\n".to_owned();
-    let (host, _setup) = run_for(&conversation, Arc::clone(&recorder), unclosed.clone());
-    let parse_failure = host
-        .parse(AGENT)
-        .expect_err("a frontmatter that is never closed does not parse");
-
-    ended(start(&conversation, &recorder, unclosed)).await;
-
-    let reports = reports(&mut errors);
-    assert_eq!(
-        reports,
-        [SessionFailure {
-            kind: FailureKind::RunFailed,
-            message: parse_failure.located_message(),
-        }],
-        "the parse failure's located message is the one run-failed report"
-    );
-    assert_eq!(conversation.run_id(), None, "no run began");
-    assert_eq!(
-        recorder.meta(RunId::from_raw(1)),
-        None,
-        "the recorder holds no run"
-    );
-    assert_eq!(conversation.state(), SessionState::Closed);
-    assert!(
-        table.get(conversation.id()).is_none(),
-        "the conversation ends with its parse failure"
-    );
-}
-
-#[tokio::test]
-async fn a_completed_report_reports_nothing_and_ends_the_conversation() {
-    let table = Conversations::new();
-    let conversation = table.open("done");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-
-    ended(start(&conversation, &recorder, prompt("return 'done'"))).await;
-
-    assert!(
-        reports(&mut errors).is_empty(),
-        "a completed run reports nothing"
-    );
-    assert_eq!(conversation.state(), SessionState::Closed);
-    let run = conversation.run_id().expect("the recorder began the run");
-    assert_eq!(recorder.result(run), Some(Ok("done".to_owned())));
-    assert!(table.get(conversation.id()).is_none());
-}
-
-#[tokio::test]
-async fn a_close_while_the_agent_waits_on_its_inbox_cancels_the_run_and_reports_the_cancel() {
-    let table = Conversations::new();
-    let conversation = table.open("receive");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-    let mut events = conversation.subscribe_events();
-    let run = start(&conversation, &recorder, prompt(RECEIVES));
-    waits_on_its_inbox(&mut events).await;
-
-    assert!(
-        table.close(conversation.id()),
-        "the open conversation closes"
-    );
-    assert_eq!(
-        conversation.state(),
-        SessionState::Closing,
-        "a close is Closing until the run ends"
-    );
-    ended(run).await;
-
-    let reports = reports(&mut errors);
-    assert_eq!(
-        reports.iter().map(|report| report.kind).collect::<Vec<_>>(),
-        [FailureKind::Canceled],
-        "a canceled report is the cancel's one report"
-    );
-    assert_eq!(conversation.state(), SessionState::Closed);
-    assert!(
-        !conversation.send_input("after the close".to_owned()),
-        "an ended run refuses the message"
-    );
-    let run = conversation.run_id().expect("the recorder began the run");
-    assert!(matches!(
-        recorder.result(run),
-        Some(Err(error)) if error.is_canceled()
-    ));
-    assert!(!table.close(conversation.id()), "a second close is a no-op");
-}
-
-#[tokio::test]
-async fn a_close_before_the_run_starts_ends_its_recorded_run_canceled() {
-    let table = Conversations::new();
-    let conversation = table.open("early");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-
-    conversation.close();
-    ended(start(&conversation, &recorder, prompt("return 'never'"))).await;
-
-    let run = conversation.run_id().expect("the recorder began the run");
-    assert!(matches!(
-        recorder.result(run),
-        Some(Err(error)) if error.is_canceled()
-    ));
-    assert!(
-        recorder.records(run).is_empty(),
-        "the run ended before it started"
-    );
-    assert_eq!(
-        reports(&mut errors)
-            .iter()
-            .map(|report| report.kind)
-            .collect::<Vec<_>>(),
-        [FailureKind::Canceled]
-    );
-    assert_eq!(conversation.state(), SessionState::Closed);
-}
-
-#[tokio::test]
-async fn a_stop_while_the_agent_waits_on_its_inbox_leaves_the_wait_and_a_message_answers_it() {
-    let table = Conversations::new();
-    let conversation = table.open("receive");
-    let recorder = Arc::new(MemoryRecorder::new());
-    let mut errors = conversation.subscribe_errors();
-    let mut events = conversation.subscribe_events();
-    let run = start(&conversation, &recorder, prompt(RECEIVES));
-    waits_on_its_inbox(&mut events).await;
-
-    conversation.stop_round();
-    // The stop is taken by the run's loop; the agent's wait on its inbox
-    // has nothing in flight for it to drop, so a message still answers it.
-    tokio::task::yield_now().await;
-    assert!(
-        conversation.send_input("still here".to_owned()),
-        "the live run accepts the message"
-    );
-    ended(run).await;
-
-    assert!(reports(&mut errors).is_empty(), "a stop is never an error");
-    let run = conversation.run_id().expect("the recorder began the run");
-    assert_eq!(
-        recorder.result(run),
-        Some(Ok("still here".to_owned())),
-        "the run went on past the stop to the operator's message"
-    );
-}
-
-#[tokio::test]
-async fn a_message_sent_before_the_run_is_handed_its_harness_returns_false_and_reaches_no_run() {
-    let table = Conversations::new();
-    let conversation = table.open("early");
-    let recorder = Arc::new(MemoryRecorder::new());
-    assert!(
-        !conversation.send_input("too early".to_owned()),
-        "a conversation whose run has no Harness yet refuses the message"
-    );
-    let mut events = conversation.subscribe_events();
-    let run = start(&conversation, &recorder, prompt(RECEIVES));
-    waits_on_its_inbox(&mut events).await;
-    assert!(
-        conversation.send_input("in time".to_owned()),
-        "the run, handed its Harness, accepts the message"
-    );
-    ended(run).await;
-
-    let run = conversation.run_id().expect("the recorder began the run");
-    assert_eq!(
-        recorder.result(run),
-        Some(Ok("in time".to_owned())),
-        "the run read the message sent once it had its Harness"
-    );
-    assert!(
-        !recorder
-            .records(run)
-            .iter()
-            .any(|record| record.payload.to_string().contains("too early")),
-        "the refused message reached no record"
-    );
-}
diff --git a/crates/workshop/agents/tests/it/main.rs b/crates/workshop/agents/tests/it/main.rs
deleted file mode 100644
index 718833c85..000000000
--- a/crates/workshop/agents/tests/it/main.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-//! Integration tests for `workshop-agents`: a conversation driven through
-//! a real per-run Harness reports its failures, records its run, and ends.
-
-mod conversation;
-mod support;
diff --git a/crates/workshop/agents/tests/it/support.rs b/crates/workshop/agents/tests/it/support.rs
deleted file mode 100644
index 0a476271f..000000000
--- a/crates/workshop/agents/tests/it/support.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-//! Shared fixtures: an offline broker, and a Host and a per-run setup
-//! built around the recorder tee a conversation hands it.
-
-use std::sync::Arc;
-
-use runvil::effect::Round;
-use runvil::harness::{InferenceBroker, MemoryRecorder, Packs};
-use runvil::model::{
-    Completion, CompletionOptions, Message, ModelBinding, ModelCatalog, ToolSchema,
-    make_completion_error, phrase,
-};
-use runvil::plugin::PackRegistry;
-use runvil::{BoxFuture, Error, ErrorCode, Host, RunSetup};
-use workshop_agents::{Conversation, TokioTimer};
-
-/// The name the fixture Host finds its one agent by.
-pub(crate) const AGENT: &str = "fixture";
-
-/// Lists no model and refuses every round as `Unavailable`.
-struct Offline;
-
-impl InferenceBroker for Offline {
-    fn models(&self) -> BoxFuture<'static, Result<ModelCatalog, Error>> {
-        Box::pin(async { Ok(ModelCatalog::empty()) })
-    }
-
-    fn chat(
-        &self,
-        _binding: ModelBinding,
-        _messages: Vec<Message>,
-        _tools: Vec<ToolSchema>,
-        _options: CompletionOptions,
-        _round: Round,
-    ) -> BoxFuture<'static, Result<Box<Completion>, Error>> {
-        let code = ErrorCode::Unavailable;
-        Box::pin(async move { Err(make_completion_error(code, phrase(code))) })
-    }
-}
-
-/// A prompt whose one section runs `lua`, declaring the user Pack, as a
-/// conversation's agent does.
-pub(crate) fn prompt(lua: &str) -> String {
-    format!(
-        "---\nname: fixture\ndescription: a conversation fixture\nrunvil: 0\n\
-         uses:\n  - user\n---\n\n\
-         # Fixture\n\n## Conversation\n\n```lua\n{lua}\n```\n"
-    )
-}
-
-/// A Host that finds `source` as [`AGENT`], beside the setup of a run with
-/// a user, recording into `recorder` through the conversation's tee.
-pub(crate) fn run_for(
-    conversation: &Conversation,
-    recorder: Arc<MemoryRecorder>,
-    source: String,
-) -> (Arc<Host>, RunSetup) {
-    let host = Arc::new(Host {
-        packs: Packs::new(PackRegistry::new()),
-        prompts: Arc::new(move |name: &str| {
-            if name == AGENT {
-                return Ok(source.clone());
-            }
-            let code = ErrorCode::NotFound;
-            Err(Error::new(
-                code,
-                format!("no agent named {name}"),
-                code.prose(),
-            ))
-        }),
-        timer: Arc::new(TokioTimer),
-    });
-    let setup = RunSetup {
-        has_user: true,
-        ..RunSetup::new(conversation.recorder(recorder), Arc::new(Offline))
-    };
-    (host, setup)
-}
diff --git a/crates/workshop/desktop/AGENTS.md b/crates/workshop/desktop/AGENTS.md
deleted file mode 100644
index 587539728..000000000
--- a/crates/workshop/desktop/AGENTS.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# workshop
-
-- Unsafe is confined to the Windows bridge (`src/bridge.rs`): dense working COM with documented failure modes and the crate's only unsafe code; its module-level `#[expect(unsafe_code)]` is deliberate. No other module contains unsafe code.
-- The desktop app does not read Gateway configuration, own the Gateway discovery file, or kill the Gateway as part of ordinary teardown.
-- Workshop carries the Gateway inside its bundle only on Windows: only `tauri.windows.conf.json` declares `externalBin`, and `build.rs` fills the sidecar slot only for Windows targets. On macOS and Linux the Gateway is its own install beside Workshop, found through `workshop-gateway-discovery`'s installed-peer lookup (`installed_gateway`).
-- The desktop app never replaces the Gateway's files. The Gateway it ships is the release `gateway-pin/pin.json` names, from `cppalliance/runvil-gateway`.
-- In `installer.nsi`, the Speech to Text section has no payload: `-Finalize` records the choice as the `InstallSTT` value the Gateway reads when it writes its first config, and never under `/UPDATE`. `/COMPONENTS=` and the exit code 2 (a refused component list) exist for CI; `.github/installers/cell.ps1` asserts them, so a change to either updates it.
-- `tauri.unsigned.conf.json` is for local builds without `--sign` only; every CI build signs.
-- Workshop never links the Plugins it ships, the std Plugin and the bashkit Plugin. It loads each as a dynamic library from the Plugin directory (`installed_plugin_dir`): `plugins` beside Workshop on Windows and in a development build, and inside the macOS bundle and the AppImage, so the updater replaces the libraries with Workshop. A change to a library's name or place, or a third Plugin, updates every file that names them: `crates/workshop/gateway-discovery/src/peer.rs`, which finds the directory; `installer.nsi`, which installs the libraries with the Workshop component and removes them with it; `crates/build-workshop/src/main/plugin.rs`, which places them for a development build and has Tauri copy them into the macOS and Linux bundles; `.github/installers/cell.ps1` and `cell.sh`, which assert them and run `runvil-workshop --plugins`; and the server's tests, in `crates/workshop/server/tests/common/mod.rs` and `crates/workshop/server/src/agents/tests.rs`.
diff --git a/crates/workshop/desktop/Cargo.toml b/crates/workshop/desktop/Cargo.toml
deleted file mode 100644
index beba53e74..000000000
--- a/crates/workshop/desktop/Cargo.toml
+++ /dev/null
@@ -1,65 +0,0 @@
-[package]
-name = "workshop"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-description = "Runvil Workshop desktop app: runs the workshop server in-process and opens the workshop window"
-
-[[bin]]
-name = "runvil-workshop"
-path = "src/main.rs"
-
-[dependencies]
-anyhow.workspace = true
-# The in-process workshop server, seen only through its re-export facade:
-# the desktop app spawns it on an OS-assigned loopback port and points the
-# window at it. Never depend on `workshop-server` directly: the facade is
-# the desktop app's sole view of the server.
-workshop-server-api.workspace = true
-# Window geometry lives in the workspace file (src/window_state.rs): the
-# desktop app reads and writes it over the server's loopback HTTP API with the
-# workspace's reqwest feature set (json, rustls), the same set the
-# gateway builds with, so cargo deny and the static-CRT Windows build see
-# nothing new.
-reqwest.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-# The health wait comes from the shared gateway-discovery-file seam, which
-# workshop-server-api re-exports from workshop-gateway.
-tauri.workspace = true
-tauri-plugin-dialog.workspace = true
-tauri-plugin-opener.workspace = true
-tauri-plugin-process.workspace = true
-tauri-plugin-single-instance.workspace = true
-tauri-plugin-updater.workspace = true
-url.workspace = true
-
-# Explorer path drops and the microphone permission grant (src/bridge.rs):
-# raw WebView2 COM. The versions mirror tauri-runtime-wry's, keeping one
-# build of each crate in the tree.
-[target.'cfg(target_os = "windows")'.dependencies.webview2-com]
-version = "0.38"
-
-[target.'cfg(target_os = "windows")'.dependencies.windows-core]
-version = "0.61"
-
-# Linux microphone permission: WebKitGTK ships with enable-media-stream off
-# and a deny-all permission handler; src/linux_media.rs opts the session in.
-[target.'cfg(target_os = "linux")'.dependencies.webkit2gtk]
-version = "2.0.2"
-
-[build-dependencies]
-tauri-build.workspace = true
-
-[features]
-default = []
-
-[dev-dependencies]
-tempfile.workspace = true
-workshop-server-api = { workspace = true, features = ["test-fixtures"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/desktop/Entitlements.plist b/crates/workshop/desktop/Entitlements.plist
deleted file mode 100644
index 27dcbd8fb..000000000
--- a/crates/workshop/desktop/Entitlements.plist
+++ /dev/null
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <!-- Permit microphone capture for local dictation -->
-    <key>com.apple.security.device.audio-input</key>
-    <true/>
-</dict>
-</plist>
diff --git a/crates/workshop/desktop/Info.plist b/crates/workshop/desktop/Info.plist
deleted file mode 100644
index 0b6ecdf02..000000000
--- a/crates/workshop/desktop/Info.plist
+++ /dev/null
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <!-- Without this string macOS kills the process on mic access. -->
-    <key>NSMicrophoneUsageDescription</key>
-    <string>Runvil uses the microphone you select for local voice dictation.</string>
-</dict>
-</plist>
diff --git a/crates/workshop/desktop/README.md b/crates/workshop/desktop/README.md
deleted file mode 100644
index 02e78cf12..000000000
--- a/crates/workshop/desktop/README.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# Workshop desktop app
-
-This crate is the Workshop desktop app, `runvil-workshop`: a Tauri window around Workshop's server and page. It attaches to a gateway already running for the user, launches the installed one when none is, or uses the remote gateway that `~/.runvil/workshop.toml` names.
-
-## How it ships
-
-The Runvil installer offers Workshop and the gateway as separate components, and on Windows also Speech to Text. The gateway is the release `gateway-pin/pin.json` names, from [cppalliance/runvil-gateway](https://github.com/cppalliance/runvil-gateway).
-
-- Windows: one NSIS setup, built from `installer.nsi`, installs into `%LOCALAPPDATA%\Runvil`. The gateway, `runvil-gateway.exe`, travels inside Workshop's bundle and sits beside `runvil-workshop.exe`.
-- macOS: a Qt IFW installer in a DMG places `Runvil.app` and `Runvil Gateway.app` side by side, in `/Applications/Runvil` by default.
-- Linux: a Qt IFW `.run` installer places `Runvil.AppImage` and `runvil-gateway` side by side, in `~/Runvil` by default.
-
-On every platform Workshop finds the gateway beside its own install through `workshop-gateway-discovery`'s installed-peer lookup.
-
-## Plugins
-
-Workshop loads every library Plugin in its Plugin directory when it starts. The directory is named `plugins` and ships with Workshop itself, so whatever replaces Workshop replaces its Plugins too:
-
-- Windows: beside `runvil-workshop.exe`.
-- macOS: inside the bundle, at `Runvil.app/Contents/Resources/plugins`.
-- Linux: inside the AppImage, at `usr/lib/runvil/plugins`.
-
-`[agents] plugins` in `workshop.toml` names another directory instead.
-
-Each installer puts two libraries there, each from a repository of its own, pinned by commit in the root `Cargo.toml`:
-
-- The std Plugin, which holds the file tools: `plugin_std.dll`, `libplugin_std.dylib`, or `libplugin_std.so`, from [cppalliance/runvil-plugin-std](https://github.com/cppalliance/runvil-plugin-std).
-- The bashkit Plugin, which holds the shell: `plugin_bashkit.dll`, `libplugin_bashkit.dylib`, or `libplugin_bashkit.so`, from [cppalliance/runvil-plugin-bashkit](https://github.com/cppalliance/runvil-plugin-bashkit).
-
-A Workshop with no Plugin directory, or one whose std library does not load, refuses an agent that requires `std` and says that `runvil/std` is not installed. It does the same for `bash` and the bashkit library.
-
-`runvil-workshop --plugins` prints each Plugin the installation loads, as its name and its version, and exits. A library that does not load goes to stderr with the reason. Workshop keeps no log, so this is the way to see why an agent has no file tools or no shell.
-
-## Updates
-
-Workshop checks for an update a few seconds after it starts and from Help, About, through the Tauri updater and the `latest.json` on the `workshop-latest` release, whose files are signed. On macOS and Linux it replaces its own `.app` or AppImage; on Windows it runs the new setup, which updates every installed component, the gateway included.
-
-An update replaces the Plugin directory with Workshop on every platform, because the directory sits inside what the updater replaces: the `.app`, the AppImage, or the files the Windows setup installs. A Plugin loads only in a Workshop that speaks its exact contract version, so the two must change together.
-
-## Building
-
-`cargo workshop` builds this app for development around the pinned gateway, and `cargo workshop installer` builds a platform's installer; `crates/build-workshop/README.md` covers both.
diff --git a/crates/workshop/desktop/app-icon.png b/crates/workshop/desktop/app-icon.png
deleted file mode 100644
index f567ea603..000000000
Binary files a/crates/workshop/desktop/app-icon.png and /dev/null differ
diff --git a/crates/workshop/desktop/build.rs b/crates/workshop/desktop/build.rs
deleted file mode 100644
index d22002714..000000000
--- a/crates/workshop/desktop/build.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-//! Build script for the workshop desktop app: puts the Gateway sidecar in
-//! the slot tauri-build copies from, then runs tauri-build so
-//! `tauri::generate_context!` sees the config-derived environment it
-//! requires.
-//!
-//! On Windows, `tauri.windows.conf.json` declares the Gateway as an
-//! `externalBin`, so on every workshop build tauri-build copies
-//! `binaries/runvil-gateway-<target-triple>.exe` to
-//! `target/<profile>/runvil-gateway.exe`. The sidecar step decides what that
-//! slot holds before tauri-build reads it, and leaves an empty slot for
-//! tauri-build to report.
-//!
-//! Two sources fill the slot, in order:
-//!
-//! 1. `RUNVIL_GATEWAY_SIDECAR`, an explicit file some other step staged.
-//!    `cargo workshop` sets it to the Gateway `--gateway-binary` or the
-//!    variable named. The named file is copied in as is.
-//! 2. Whatever `tools/fetch-gateway-sidecar.mjs` left in place: a stub for
-//!    compile-only jobs or the pinned release binary. Nothing here touches
-//!    it, so a downloaded Gateway survives every rebuild.
-//!
-//! macOS and Linux bundle no Gateway: their installers place it beside
-//! Workshop, so those targets skip the step.
-
-use std::env;
-use std::error::Error;
-use std::fs;
-use std::path::{Path, PathBuf};
-
-/// The variable naming a sidecar to install, shared with `build-workshop`.
-const GATEWAY_SIDECAR_VARIABLE: &str = "RUNVIL_GATEWAY_SIDECAR";
-
-fn main() -> Result<(), Box<dyn Error>> {
-    install_gateway_sidecar()?;
-    tauri_build::try_build(tauri_build::Attributes::new().app_manifest(
-        tauri_build::AppManifest::new().commands(&["desktop_update_supported", "quit"]),
-    ))?;
-    Ok(())
-}
-
-/// Puts the sidecar where `bundle.externalBin` resolves it: an explicit
-/// `RUNVIL_GATEWAY_SIDECAR` file when one is named, else what is already
-/// staged, with a warning when the staged file is the stub.
-fn install_gateway_sidecar() -> Result<(), Box<dyn Error>> {
-    if env::var("CARGO_CFG_TARGET_OS")? != "windows" {
-        return Ok(());
-    }
-    let target = env::var("TARGET")?;
-    let exe_suffix = ".exe";
-    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR")?);
-    let sidecar = manifest_dir
-        .join("binaries")
-        .join(format!("runvil-gateway-{target}{exe_suffix}"));
-
-    println!("cargo:rerun-if-env-changed={GATEWAY_SIDECAR_VARIABLE}");
-    // The marker is written only by `tools/fetch-gateway-sidecar.mjs`, never
-    // here, so watching it cannot loop. Watching it means re-staging a
-    // release over a stub re-runs this script and the warning below clears.
-    println!("cargo:rerun-if-changed={}", pin_marker(&sidecar).display());
-    if let Some(named) = env::var_os(GATEWAY_SIDECAR_VARIABLE) {
-        let named = PathBuf::from(named);
-        if named.as_os_str().is_empty() {
-            return Err(format!("{GATEWAY_SIDECAR_VARIABLE} names no file").into());
-        }
-        if !named.is_file() {
-            return Err(format!(
-                "{GATEWAY_SIDECAR_VARIABLE} names {}, which is not a file",
-                named.display()
-            )
-            .into());
-        }
-        copy_forward(&named, &sidecar)?;
-        return Ok(());
-    }
-
-    if sidecar_is_stub(&sidecar) {
-        // CI stages a stub for compile-only jobs, so a build that copies
-        // one is expected there. A person building locally gets the same
-        // warning, which is the last chance to notice before an app that
-        // cannot start exists on disk.
-        println!(
-            "cargo:warning={} is a compile-only stub Gateway and cannot run; \
-             run `node tools/fetch-gateway-sidecar.mjs --target {}` and rebuild for a \
-             Gateway that starts",
-            sidecar.display(),
-            target
-        );
-    }
-    Ok(())
-}
-
-/// Copies `source` over `sidecar`, creating the directory and reporting
-/// the copy so a surprising sidecar is visible in the build log.
-fn copy_forward(source: &Path, sidecar: &Path) -> Result<(), String> {
-    // `cargo workshop` stages the file it names here before this script
-    // runs. Copying it again would fail on Windows when the file is
-    // read-only, since the first copy carries that attribute to the slot:
-    // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-copyfilew
-    if fs::read(sidecar).is_ok_and(|staged| fs::read(source).is_ok_and(|named| named == staged)) {
-        return Ok(());
-    }
-    if let Some(parent) = sidecar.parent() {
-        fs::create_dir_all(parent).map_err(|e| format!("create {}: {e}", parent.display()))?;
-    }
-    fs::copy(source, sidecar).map_err(|e| {
-        format!(
-            "copy the gateway sidecar {} to {}: {e}",
-            source.display(),
-            sidecar.display()
-        )
-    })?;
-    println!(
-        "cargo:warning=installed gateway sidecar {} from {}",
-        sidecar.display(),
-        source.display()
-    );
-    Ok(())
-}
-
-/// The marker beside the sidecar: `<sidecar>.pinned`.
-fn pin_marker(sidecar: &Path) -> PathBuf {
-    let mut marker = sidecar.as_os_str().to_owned();
-    marker.push(".pinned");
-    PathBuf::from(marker)
-}
-
-/// Whether the marker says the staged sidecar is the compile-only stub
-/// rather than the pinned release. The marker is the fetch script's JSON,
-/// so a substring check keeps this script free of a JSON dependency. A
-/// missing or malformed marker reads as unknown, and unknown is not a stub:
-/// the app's own boot check still refuses to run one.
-fn sidecar_is_stub(sidecar: &Path) -> bool {
-    let Ok(text) = fs::read_to_string(pin_marker(sidecar)) else {
-        return false;
-    };
-    text.contains("\"kind\": \"stub\"") || text.contains("\"kind\":\"stub\"")
-}
diff --git a/crates/workshop/desktop/icons/128x128.png b/crates/workshop/desktop/icons/128x128.png
deleted file mode 100644
index d7b7c171d..000000000
Binary files a/crates/workshop/desktop/icons/128x128.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/128x128@2x.png b/crates/workshop/desktop/icons/128x128@2x.png
deleted file mode 100644
index b96caedb1..000000000
Binary files a/crates/workshop/desktop/icons/128x128@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/32x32.png b/crates/workshop/desktop/icons/32x32.png
deleted file mode 100644
index 9a3d7a932..000000000
Binary files a/crates/workshop/desktop/icons/32x32.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/64x64.png b/crates/workshop/desktop/icons/64x64.png
deleted file mode 100644
index 39330d8be..000000000
Binary files a/crates/workshop/desktop/icons/64x64.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/AGENTS.md b/crates/workshop/desktop/icons/AGENTS.md
deleted file mode 100644
index 19fc70c20..000000000
--- a/crates/workshop/desktop/icons/AGENTS.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Workshop icons
-
-- Keep the Gateway app, Gateway configuration UI, and Workshop UI icon copies synchronized with the corresponding master icons in this directory.
-- `installer-header.png`, `installer-header.bmp`, `installer-sidebar.png`, and `installer-sidebar.bmp` are hand-crafted installer assets. Do not regenerate, resize, overwrite, or modify them as part of ordinary icon generation.
-- The Qt IFW installer's `installer-logo.png`, `installer-logo@2x.png`, `installer-watermark.png`, and `installer-watermark@2x.png` in `crates/build-workshop/ifw/config/` are scaled copies of the two PNG masters. When a master changes, regenerate them from this directory:
-  - `sips -z 65 171 installer-header.png --out ../../../build-workshop/ifw/config/installer-logo.png`
-  - `sips -z 130 342 installer-header.png --out ../../../build-workshop/ifw/config/installer-logo@2x.png`
-  - `sips -z 310 162 installer-sidebar.png --out ../../../build-workshop/ifw/config/installer-watermark.png`
-  - `sips -z 620 324 installer-sidebar.png --out ../../../build-workshop/ifw/config/installer-watermark@2x.png`
diff --git a/crates/workshop/desktop/icons/Square107x107Logo.png b/crates/workshop/desktop/icons/Square107x107Logo.png
deleted file mode 100644
index b886857fa..000000000
Binary files a/crates/workshop/desktop/icons/Square107x107Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square142x142Logo.png b/crates/workshop/desktop/icons/Square142x142Logo.png
deleted file mode 100644
index 016ba8cba..000000000
Binary files a/crates/workshop/desktop/icons/Square142x142Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square150x150Logo.png b/crates/workshop/desktop/icons/Square150x150Logo.png
deleted file mode 100644
index 4f60ef442..000000000
Binary files a/crates/workshop/desktop/icons/Square150x150Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square284x284Logo.png b/crates/workshop/desktop/icons/Square284x284Logo.png
deleted file mode 100644
index 0e6542e13..000000000
Binary files a/crates/workshop/desktop/icons/Square284x284Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square30x30Logo.png b/crates/workshop/desktop/icons/Square30x30Logo.png
deleted file mode 100644
index 40cfc64ae..000000000
Binary files a/crates/workshop/desktop/icons/Square30x30Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square310x310Logo.png b/crates/workshop/desktop/icons/Square310x310Logo.png
deleted file mode 100644
index 30e1dbf9e..000000000
Binary files a/crates/workshop/desktop/icons/Square310x310Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square44x44Logo.png b/crates/workshop/desktop/icons/Square44x44Logo.png
deleted file mode 100644
index 23778164b..000000000
Binary files a/crates/workshop/desktop/icons/Square44x44Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square71x71Logo.png b/crates/workshop/desktop/icons/Square71x71Logo.png
deleted file mode 100644
index c8644b8f4..000000000
Binary files a/crates/workshop/desktop/icons/Square71x71Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/Square89x89Logo.png b/crates/workshop/desktop/icons/Square89x89Logo.png
deleted file mode 100644
index 94ac26fef..000000000
Binary files a/crates/workshop/desktop/icons/Square89x89Logo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/StoreLogo.png b/crates/workshop/desktop/icons/StoreLogo.png
deleted file mode 100644
index 794d1b0c7..000000000
Binary files a/crates/workshop/desktop/icons/StoreLogo.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-anydpi-v26/ic_launcher.xml b/crates/workshop/desktop/icons/android/mipmap-anydpi-v26/ic_launcher.xml
deleted file mode 100644
index 2ffbf24b6..000000000
--- a/crates/workshop/desktop/icons/android/mipmap-anydpi-v26/ic_launcher.xml
+++ /dev/null
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-  <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
-  <background android:drawable="@color/ic_launcher_background"/>
-</adaptive-icon>
\ No newline at end of file
diff --git a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher.png b/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher.png
deleted file mode 100644
index cf0895827..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_foreground.png b/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_foreground.png
deleted file mode 100644
index 31e946de0..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_round.png b/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_round.png
deleted file mode 100644
index 168dd27d7..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-hdpi/ic_launcher_round.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher.png b/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher.png
deleted file mode 100644
index 4df697eee..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_foreground.png b/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_foreground.png
deleted file mode 100644
index 9c0528b4e..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_round.png b/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_round.png
deleted file mode 100644
index 47760f4aa..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-mdpi/ic_launcher_round.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher.png b/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher.png
deleted file mode 100644
index 7650b4b05..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_foreground.png b/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_foreground.png
deleted file mode 100644
index b6daad292..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_round.png b/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_round.png
deleted file mode 100644
index 7118123c4..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher.png b/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher.png
deleted file mode 100644
index ff9e48887..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png b/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png
deleted file mode 100644
index 54c4e03dd..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_round.png b/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_round.png
deleted file mode 100644
index 70c4cb7ea..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher.png b/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher.png
deleted file mode 100644
index ac8e5a484..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png b/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png
deleted file mode 100644
index bccf7e37e..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_round.png b/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_round.png
deleted file mode 100644
index 650c7d2f6..000000000
Binary files a/crates/workshop/desktop/icons/android/mipmap-xxxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/android/values/ic_launcher_background.xml b/crates/workshop/desktop/icons/android/values/ic_launcher_background.xml
deleted file mode 100644
index ea9c223a6..000000000
--- a/crates/workshop/desktop/icons/android/values/ic_launcher_background.xml
+++ /dev/null
@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-  <color name="ic_launcher_background">#fff</color>
-</resources>
\ No newline at end of file
diff --git a/crates/workshop/desktop/icons/icon.icns b/crates/workshop/desktop/icons/icon.icns
deleted file mode 100644
index 15443b593..000000000
Binary files a/crates/workshop/desktop/icons/icon.icns and /dev/null differ
diff --git a/crates/workshop/desktop/icons/icon.ico b/crates/workshop/desktop/icons/icon.ico
deleted file mode 100644
index 875eb11cd..000000000
Binary files a/crates/workshop/desktop/icons/icon.ico and /dev/null differ
diff --git a/crates/workshop/desktop/icons/icon.png b/crates/workshop/desktop/icons/icon.png
deleted file mode 100644
index cae1d06d9..000000000
Binary files a/crates/workshop/desktop/icons/icon.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/installer-header.bmp b/crates/workshop/desktop/icons/installer-header.bmp
deleted file mode 100644
index 9d435943c..000000000
Binary files a/crates/workshop/desktop/icons/installer-header.bmp and /dev/null differ
diff --git a/crates/workshop/desktop/icons/installer-header.png b/crates/workshop/desktop/icons/installer-header.png
deleted file mode 100644
index 07b2aba7d..000000000
Binary files a/crates/workshop/desktop/icons/installer-header.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/installer-sidebar.bmp b/crates/workshop/desktop/icons/installer-sidebar.bmp
deleted file mode 100644
index a61c4e944..000000000
Binary files a/crates/workshop/desktop/icons/installer-sidebar.bmp and /dev/null differ
diff --git a/crates/workshop/desktop/icons/installer-sidebar.png b/crates/workshop/desktop/icons/installer-sidebar.png
deleted file mode 100644
index b15c5aa06..000000000
Binary files a/crates/workshop/desktop/icons/installer-sidebar.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-20x20@1x.png b/crates/workshop/desktop/icons/ios/AppIcon-20x20@1x.png
deleted file mode 100644
index 3cbc310ba..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-20x20@1x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x-1.png b/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x-1.png
deleted file mode 100644
index f616f43b2..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x-1.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x.png
deleted file mode 100644
index f616f43b2..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-20x20@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-20x20@3x.png b/crates/workshop/desktop/icons/ios/AppIcon-20x20@3x.png
deleted file mode 100644
index 48de4b8d6..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-20x20@3x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-29x29@1x.png b/crates/workshop/desktop/icons/ios/AppIcon-29x29@1x.png
deleted file mode 100644
index d7930b7a3..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-29x29@1x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x-1.png b/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x-1.png
deleted file mode 100644
index 4f232b58e..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x-1.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x.png
deleted file mode 100644
index 4f232b58e..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-29x29@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-29x29@3x.png b/crates/workshop/desktop/icons/ios/AppIcon-29x29@3x.png
deleted file mode 100644
index e8cd5da78..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-29x29@3x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-40x40@1x.png b/crates/workshop/desktop/icons/ios/AppIcon-40x40@1x.png
deleted file mode 100644
index f616f43b2..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-40x40@1x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x-1.png b/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x-1.png
deleted file mode 100644
index 88ff82662..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x-1.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x.png
deleted file mode 100644
index 88ff82662..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-40x40@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-40x40@3x.png b/crates/workshop/desktop/icons/ios/AppIcon-40x40@3x.png
deleted file mode 100644
index 9c63d81c4..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-40x40@3x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-512@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-512@2x.png
deleted file mode 100644
index 41c45ea40..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-512@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-60x60@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-60x60@2x.png
deleted file mode 100644
index 9c63d81c4..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-60x60@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-60x60@3x.png b/crates/workshop/desktop/icons/ios/AppIcon-60x60@3x.png
deleted file mode 100644
index 49897cff7..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-60x60@3x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-76x76@1x.png b/crates/workshop/desktop/icons/ios/AppIcon-76x76@1x.png
deleted file mode 100644
index 3843b0eca..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-76x76@1x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-76x76@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-76x76@2x.png
deleted file mode 100644
index 53e09c3c1..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-76x76@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/icons/ios/AppIcon-83.5x83.5@2x.png b/crates/workshop/desktop/icons/ios/AppIcon-83.5x83.5@2x.png
deleted file mode 100644
index d47cb0b49..000000000
Binary files a/crates/workshop/desktop/icons/ios/AppIcon-83.5x83.5@2x.png and /dev/null differ
diff --git a/crates/workshop/desktop/installer.nsi b/crates/workshop/desktop/installer.nsi
deleted file mode 100644
index 26e684fec..000000000
--- a/crates/workshop/desktop/installer.nsi
+++ /dev/null
@@ -1,1309 +0,0 @@
-Unicode true
-ManifestDPIAware true
-; Add in `dpiAwareness` `PerMonitorV2` to manifest for Windows 10 1607+ (note this should not affect lower versions since they should be able to ignore this and pick up `dpiAware` `true` set by `ManifestDPIAware true`)
-; Currently undocumented on NSIS's website but is in the Docs folder of source tree, see
-; https://github.com/kichik/nsis/blob/5fc0b87b819a9eec006df4967d08e522ddd651c9/Docs/src/attributes.but#L286-L300
-; https://github.com/tauri-apps/tauri/pull/10106
-ManifestDPIAwareness PerMonitorV2
-
-!if "{{compression}}" == "none"
- SetCompress off
-!else
- ; Set the compression algorithm. We default to LZMA.
- SetCompressor /SOLID "{{compression}}"
-!endif
-
-; Keep above !include to stay ahead of any NSIS plugin command
-; see https://github.com/tauri-apps/tauri/pull/15422#discussion_r3289239624
-{{#if signed_plugins_path}}
-!addplugindir "{{signed_plugins_path}}"
-{{/if}}
-
-; Runvil dark theme - defines must precede MUI2.nsh
-!define MUI_BGCOLOR "0F0F0F"
-!define MUI_TEXTCOLOR "E0E0E0"
-!define MUI_INSTFILESPAGE_COLORS "E0E0E0 0F0F0F"
-
-!include MUI2.nsh
-!include FileFunc.nsh
-!include x64.nsh
-!include WordFunc.nsh
-!include Sections.nsh
-!include "utils.nsh"
-!include "FileAssociation.nsh"
-!include "Win\COM.nsh"
-!include "Win\Propkey.nsh"
-!include "Win\RestartManager.nsh"
-!include "StrFunc.nsh"
-${StrCase}
-${StrLoc}
-
-{{#if installer_hooks}}
-!include "{{installer_hooks}}"
-{{/if}}
-
-!define WEBVIEW2APPGUID "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
-
-!define MANUFACTURER "{{manufacturer}}"
-!define PRODUCTNAME "{{product_name}}"
-!define VERSION "{{version}}"
-!define VERSIONWITHBUILD "{{version_with_build}}"
-!define HOMEPAGE "{{homepage}}"
-!define INSTALLMODE "{{install_mode}}"
-!define LICENSE "{{license}}"
-!define INSTALLERICON "{{installer_icon}}"
-!define SIDEBARIMAGE "{{sidebar_image}}"
-!define HEADERIMAGE "{{header_image}}"
-!define UNINSTALLERICON "{{uninstaller_icon}}"
-!define UNINSTALLERHEADERIMAGE "{{uninstaller_header_image}}"
-!define MAINBINARYNAME "{{main_binary_name}}"
-!define MAINBINARYSRCPATH "{{main_binary_path}}"
-; The libraries of the std Plugin and the bashkit Plugin. Cargo writes
-; each to `deps` beside the main executable whenever it builds Workshop,
-; so its path is the main executable's with the file name replaced.
-!searchreplace STDPLUGINSRCPATH "${MAINBINARYSRCPATH}" "${MAINBINARYNAME}.exe" "deps\plugin_std.dll"
-!searchreplace BASHKITPLUGINSRCPATH "${MAINBINARYSRCPATH}" "${MAINBINARYNAME}.exe" "deps\plugin_bashkit.dll"
-; A main executable under another name would leave the path unchanged, and
-; the setup would install the executable as each Plugin.
-!if "${STDPLUGINSRCPATH}" == "${MAINBINARYSRCPATH}"
-  !error "cannot find the Plugins' libraries: ${MAINBINARYSRCPATH} does not end in ${MAINBINARYNAME}.exe"
-!endif
-!define BUNDLEID "{{bundle_id}}"
-!define COPYRIGHT "{{copyright}}"
-!define OUTFILE "{{out_file}}"
-!define ARCH "{{arch}}"
-!define ADDITIONALPLUGINSPATH "{{additional_plugins_path}}"
-!define ALLOWDOWNGRADES "{{allow_downgrades}}"
-!define DISPLAYLANGUAGESELECTOR "{{display_language_selector}}"
-!define INSTALLWEBVIEW2MODE "{{install_webview2_mode}}"
-!define WEBVIEW2INSTALLERARGS "{{webview2_installer_args}}"
-!define WEBVIEW2BOOTSTRAPPERPATH "{{webview2_bootstrapper_path}}"
-!define WEBVIEW2INSTALLERPATH "{{webview2_installer_path}}"
-!define MINIMUMWEBVIEW2VERSION "{{minimum_webview2_version}}"
-!define UNINSTKEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${PRODUCTNAME}"
-!define MANUKEY "Software\${MANUFACTURER}"
-!define MANUPRODUCTKEY "${MANUKEY}\${PRODUCTNAME}"
-!define UNINSTALLERSIGNCOMMAND "{{uninstaller_sign_cmd}}"
-!define ESTIMATEDSIZE "{{estimated_size}}"
-!define STARTMENUFOLDER "{{start_menu_folder}}"
-
-Var PassiveMode
-Var UpdateMode
-Var NoShortcutMode
-Var WixMode
-Var OldMainBinaryName
-; Set when a running runvil-gateway.exe was stopped in the Gateway
-; section, so the -Relaunch section can relaunch it after the update.
-Var GatewayWasRunning
-
-; Persists one component's checkbox state as a DWORD (1 = installed,
-; 0 = declined) under the product key, so every later install starts from
-; it (see RestoreComponentSelections).
-!macro PersistComponent SECTION_ID VALUE_NAME
- SectionGetFlags ${SECTION_ID} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 = ${SF_SELECTED}
- WriteRegDWORD HKCU "${MANUPRODUCTKEY}\Components" "${VALUE_NAME}" 1
- ${Else}
- WriteRegDWORD HKCU "${MANUPRODUCTKEY}\Components" "${VALUE_NAME}" 0
- ${EndIf}
-!macroend
-
-; Update mode installs over the top without uninstalling, so a component
-; declined at the original install would linger on disk; delete its
-; payload explicitly.
-!macro DeleteComponentPayloadIfDeclined SECTION_ID FILE_PATH
- ${If} $UpdateMode = 1
- SectionGetFlags ${SECTION_ID} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 <> ${SF_SELECTED}
- Delete "${FILE_PATH}"
- ${EndIf}
- ${EndIf}
-!macroend
-
-Name "${PRODUCTNAME}"
-BrandingText "${COPYRIGHT}"
-OutFile "${OUTFILE}"
-
-; We don't actually use this value as default install path,
-; it's just for nsis to append the product name folder in the directory selector
-; https://nsis.sourceforge.io/Reference/InstallDir
-!define PLACEHOLDER_INSTALL_DIR "placeholder\${PRODUCTNAME}"
-InstallDir "${PLACEHOLDER_INSTALL_DIR}"
-
-VIProductVersion "${VERSIONWITHBUILD}"
-VIAddVersionKey "ProductName" "${PRODUCTNAME}"
-VIAddVersionKey "FileDescription" "${PRODUCTNAME}"
-VIAddVersionKey "LegalCopyright" "${COPYRIGHT}"
-VIAddVersionKey "FileVersion" "${VERSION}"
-VIAddVersionKey "ProductVersion" "${VERSION}"
-
-# additional NSIS plugins
-!addplugindir "${ADDITIONALPLUGINSPATH}"
-
-; Uninstaller signing command
-!if "${UNINSTALLERSIGNCOMMAND}" != ""
- !uninstfinalize '${UNINSTALLERSIGNCOMMAND}'
-!endif
-
-; Handle install mode, `perUser`, `perMachine` or `both`
-!if "${INSTALLMODE}" == "perMachine"
- RequestExecutionLevel admin
-!endif
-
-!if "${INSTALLMODE}" == "currentUser"
- RequestExecutionLevel user
-!endif
-
-!if "${INSTALLMODE}" == "both"
- !define MULTIUSER_MUI
- !define MULTIUSER_INSTALLMODE_INSTDIR "${PRODUCTNAME}"
- !define MULTIUSER_INSTALLMODE_COMMANDLINE
- !if "${ARCH}" == "x64"
- !define MULTIUSER_USE_PROGRAMFILES64
- !else if "${ARCH}" == "arm64"
- !define MULTIUSER_USE_PROGRAMFILES64
- !endif
- !define MULTIUSER_INSTALLMODE_DEFAULT_REGISTRY_KEY "${UNINSTKEY}"
- !define MULTIUSER_INSTALLMODE_DEFAULT_REGISTRY_VALUENAME "CurrentUser"
- !define MULTIUSER_INSTALLMODEPAGE_SHOWUSERNAME
- !define MULTIUSER_INSTALLMODE_FUNCTION RestorePreviousInstallLocation
- !define MULTIUSER_EXECUTIONLEVEL Highest
- !include MultiUser.nsh
-!endif
-
-; Installer icon
-!if "${INSTALLERICON}" != ""
- !define MUI_ICON "${INSTALLERICON}"
-!endif
-
-; Installer sidebar image
-!if "${SIDEBARIMAGE}" != ""
- !define MUI_WELCOMEFINISHPAGE_BITMAP "${SIDEBARIMAGE}"
-!endif
-
-; Enable header images for installer and uninstaller pages when either image is configured.
-!if "${HEADERIMAGE}" != ""
- !define MUI_HEADERIMAGE
-!else if "${UNINSTALLERHEADERIMAGE}" != ""
- !define MUI_HEADERIMAGE
-!endif
-
-; Installer header image
-!if "${HEADERIMAGE}" != ""
- !define MUI_HEADERIMAGE_BITMAP "${HEADERIMAGE}"
-!endif
-
-; Uninstaller header image
-!if "${UNINSTALLERHEADERIMAGE}" != ""
- !define MUI_HEADERIMAGE_UNBITMAP "${UNINSTALLERHEADERIMAGE}"
-!endif
-
-; Uninstaller icon
-!if "${UNINSTALLERICON}" != ""
- !define MUI_UNICON "${UNINSTALLERICON}"
-!endif
-
-; Define registry key to store installer language
-!define MUI_LANGDLL_REGISTRY_ROOT "HKCU"
-!define MUI_LANGDLL_REGISTRY_KEY "${MANUPRODUCTKEY}"
-!define MUI_LANGDLL_REGISTRY_VALUENAME "Installer Language"
-
-; Installer pages, must be ordered as they appear
-; 1. Welcome Page
-!define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
-!insertmacro MUI_PAGE_WELCOME
-
-; 2. License Page (if defined)
-!if "${LICENSE}" != ""
- !define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
- !insertmacro MUI_PAGE_LICENSE "${LICENSE}"
-!endif
-
-; 3. Install mode (if it is set to `both`)
-!if "${INSTALLMODE}" == "both"
- !define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
- !insertmacro MULTIUSER_PAGE_INSTALLMODE
-!endif
-
-; 4. Custom page to ask user if he wants to reinstall/uninstall
-; only if a previous installation was detected
-Var ReinstallPageCheck
-Page custom PageReinstall PageLeaveReinstall
-Function PageReinstall
- ; Uninstall previous WiX installation if exists.
- ;
- ; A WiX installer stores the installation info in registry
- ; using a UUID and so we have to loop through all keys under
- ; `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall`
- ; and check if `DisplayName` and `Publisher` keys match ${PRODUCTNAME} and ${MANUFACTURER}
- ;
- ; This has a potential issue that there maybe another installation that matches
- ; our ${PRODUCTNAME} and ${MANUFACTURER} but wasn't installed by our WiX installer,
- ; however, this should be fine since the user will have to confirm the uninstallation
- ; and they can chose to abort it if doesn't make sense.
- StrCpy $0 0
- wix_loop:
- EnumRegKey $1 HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" $0
- StrCmp $1 "" wix_loop_done ; Exit loop if there is no more keys to loop on
- IntOp $0 $0 + 1
- ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1" "DisplayName"
- ReadRegStr $R1 HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1" "Publisher"
- StrCmp "$R0$R1" "${PRODUCTNAME}${MANUFACTURER}" 0 wix_loop
- ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1" "UninstallString"
- ${StrCase} $R1 $R0 "L"
- ${StrLoc} $R0 $R1 "msiexec" ">"
- StrCmp $R0 0 0 wix_loop_done
- StrCpy $WixMode 1
- StrCpy $R6 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1"
- Goto compare_version
- wix_loop_done:
-
- ; Check if there is an existing installation, if not, abort the reinstall page
- ReadRegStr $R0 SHCTX "${UNINSTKEY}" ""
- ReadRegStr $R1 SHCTX "${UNINSTKEY}" "UninstallString"
- ${IfThen} "$R0$R1" == "" ${|} Abort ${|}
-
- ; Compare this installar version with the existing installation
- ; and modify the messages presented to the user accordingly
- compare_version:
- StrCpy $R4 "$(older)"
- ${If} $WixMode = 1
- ReadRegStr $R0 HKLM "$R6" "DisplayVersion"
- ${Else}
- ReadRegStr $R0 SHCTX "${UNINSTKEY}" "DisplayVersion"
- ${EndIf}
- ${IfThen} $R0 == "" ${|} StrCpy $R4 "$(unknown)" ${|}
-
- nsis_tauri_utils::SemverCompare "${VERSION}" $R0
- Pop $R0
- ; Reinstalling the same version
- ${If} $R0 = 0
- StrCpy $R1 "$(alreadyInstalledLong)"
- StrCpy $R2 "$(addOrReinstall)"
- StrCpy $R3 "$(uninstallApp)"
- !insertmacro MUI_HEADER_TEXT "$(alreadyInstalled)" "$(chooseMaintenanceOption)"
- ; Upgrading
- ${ElseIf} $R0 = 1
- StrCpy $R1 "$(olderOrUnknownVersionInstalled)"
- StrCpy $R2 "$(uninstallBeforeInstalling)"
- StrCpy $R3 "$(dontUninstall)"
- !insertmacro MUI_HEADER_TEXT "$(alreadyInstalled)" "$(choowHowToInstall)"
- ; Downgrading
- ${ElseIf} $R0 = -1
- StrCpy $R1 "$(newerVersionInstalled)"
- StrCpy $R2 "$(uninstallBeforeInstalling)"
- !if "${ALLOWDOWNGRADES}" == "true"
- StrCpy $R3 "$(dontUninstall)"
- !else
- StrCpy $R3 "$(dontUninstallDowngrade)"
- !endif
- !insertmacro MUI_HEADER_TEXT "$(alreadyInstalled)" "$(choowHowToInstall)"
- ${Else}
- Abort
- ${EndIf}
-
- ; Skip showing the page if passive
- ;
- ; Note that we don't call this earlier at the beginning
- ; of this function because we need to populate some variables
- ; related to current installed version if detected and whether
- ; we are downgrading or not.
- ${If} $PassiveMode = 1
- Call PageLeaveReinstall
- ${Else}
- nsDialogs::Create 1018
- Pop $R4
- ${IfThen} $(^RTL) = 1 ${|} nsDialogs::SetRTL $(^RTL) ${|}
-
- ${NSD_CreateLabel} 0 0 100% 24u $R1
- Pop $R1
-
- ${NSD_CreateRadioButton} 30u 50u -30u 8u $R2
- Pop $R2
- ${NSD_OnClick} $R2 PageReinstallUpdateSelection
-
- ${NSD_CreateRadioButton} 30u 70u -30u 8u $R3
- Pop $R3
- ; Disable this radio button if downgrading and downgrades are disabled
- !if "${ALLOWDOWNGRADES}" == "false"
- ${IfThen} $R0 = -1 ${|} EnableWindow $R3 0 ${|}
- !endif
- ${NSD_OnClick} $R3 PageReinstallUpdateSelection
-
- ; Check the first radio button if this the first time
- ; we enter this page or if the second button wasn't
- ; selected the last time we were on this page
- ${If} $ReinstallPageCheck <> 2
- SendMessage $R2 ${BM_SETCHECK} ${BST_CHECKED} 0
- ${Else}
- SendMessage $R3 ${BM_SETCHECK} ${BST_CHECKED} 0
- ${EndIf}
-
- ${NSD_SetFocus} $R2
- nsDialogs::Show
- ${EndIf}
-FunctionEnd
-Function PageReinstallUpdateSelection
- ${NSD_GetState} $R2 $R1
- ${If} $R1 == ${BST_CHECKED}
- StrCpy $ReinstallPageCheck 1
- ${Else}
- StrCpy $ReinstallPageCheck 2
- ${EndIf}
-FunctionEnd
-Function PageLeaveReinstall
- ${NSD_GetState} $R2 $R1
-
- ; If migrating from Wix, always uninstall
- ${If} $WixMode = 1
- Goto reinst_uninstall
- ${EndIf}
-
- ; In update mode, always proceeds without uninstalling
- ${If} $UpdateMode = 1
- Goto reinst_done
- ${EndIf}
-
- ; $R0 holds whether same(0)/upgrading(1)/downgrading(-1) version
- ; $R1 holds the radio buttons state:
- ; 1 => first choice was selected
- ; 0 => second choice was selected
- ${If} $R0 = 0 ; Same version, proceed
- ${If} $R1 = 1 ; User chose to add/reinstall
- Goto reinst_done
- ${Else} ; User chose to uninstall
- Goto reinst_uninstall
- ${EndIf}
- ${ElseIf} $R0 = 1 ; Upgrading
- ${If} $R1 = 1 ; User chose to uninstall
- Goto reinst_uninstall
- ${Else}
- Goto reinst_done ; User chose NOT to uninstall
- ${EndIf}
- ${ElseIf} $R0 = -1 ; Downgrading
- ${If} $R1 = 1 ; User chose to uninstall
- Goto reinst_uninstall
- ${Else}
- Goto reinst_done ; User chose NOT to uninstall
- ${EndIf}
- ${EndIf}
-
- reinst_uninstall:
- HideWindow
- ClearErrors
-
- ${If} $WixMode = 1
- ReadRegStr $R1 HKLM "$R6" "UninstallString"
- ExecWait '$R1' $0
- ${Else}
- ReadRegStr $4 SHCTX "${MANUPRODUCTKEY}" ""
- ReadRegStr $R1 SHCTX "${UNINSTKEY}" "UninstallString"
- ${IfThen} $UpdateMode = 1 ${|} StrCpy $R1 "$R1 /UPDATE" ${|} ; append /UPDATE
- ${IfThen} $PassiveMode = 1 ${|} StrCpy $R1 "$R1 /P" ${|} ; append /P
- StrCpy $R1 "$R1 _?=$4" ; append uninstall directory
- ExecWait '$R1' $0
- ${EndIf}
-
- BringToFront
-
- ${IfThen} ${Errors} ${|} StrCpy $0 2 ${|} ; ExecWait failed, set fake exit code
-
- ${If} $0 <> 0
- ${OrIf} ${FileExists} "$INSTDIR\${MAINBINARYNAME}.exe"
- ; User canceled wix uninstaller? return to select un/reinstall page
- ${If} $WixMode = 1
- ${AndIf} $0 = 1602
- Abort
- ${EndIf}
-
- ; User canceled NSIS uninstaller? return to select un/reinstall page
- ${If} $0 = 1
- Abort
- ${EndIf}
-
- ; Other errors? show generic error message and return to select un/reinstall page
- MessageBox MB_ICONEXCLAMATION "$(unableToUninstall)"
- Abort
- ${EndIf}
- reinst_done:
-FunctionEnd
-
-; 4b. Components page: Gateway, Workshop, and STT are checkable, checked
-; as the previous install left them, or all checked on a first install;
-; STT requires Gateway (.onSelChange). Skipped in passive and update
-; modes, which install the selection .onInit applied.
-!define MUI_COMPONENTSPAGE_NODESC
-!define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassiveOrUpdate
-!insertmacro MUI_PAGE_COMPONENTS
-
-; 5. Choose install directory page
-!define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
-!insertmacro MUI_PAGE_DIRECTORY
-
-; 6. Start menu shortcut page
-Var AppStartMenuFolder
-!if "${STARTMENUFOLDER}" != ""
- !define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
- !define MUI_STARTMENUPAGE_DEFAULTFOLDER "${STARTMENUFOLDER}"
-!else
- !define MUI_PAGE_CUSTOMFUNCTION_PRE Skip
-!endif
-!insertmacro MUI_PAGE_STARTMENU Application $AppStartMenuFolder
-
-; 7. Installation page
-!insertmacro MUI_PAGE_INSTFILES
-
-; 8. Finish page
-;
-; Don't auto jump to finish page after installation page,
-; because the installation page has useful info that can be used debug any issues with the installer.
-!define MUI_FINISHPAGE_NOAUTOCLOSE
-; Use show readme button in the finish page as a button create a desktop shortcut
-!define MUI_FINISHPAGE_SHOWREADME
-!define MUI_FINISHPAGE_SHOWREADME_TEXT "$(createDesktop)"
-!define MUI_FINISHPAGE_SHOWREADME_FUNCTION CreateOrUpdateDesktopShortcut
-; Show run app after installation.
-!define MUI_FINISHPAGE_RUN
-!define MUI_FINISHPAGE_RUN_FUNCTION RunMainBinary
-!define MUI_PAGE_CUSTOMFUNCTION_PRE SkipIfPassive
-!define MUI_PAGE_CUSTOMFUNCTION_SHOW FinishPageShow
-!insertmacro MUI_PAGE_FINISH
-
-!define /ifndef WM_SETTEXT 0x000C
-
-Function FinishPageShow
- ; Windows visual styles override SetCtlColors for checkbox text. Disable
- ; the theme on these controls before restoring the dark palette.
- ; https://sourceforge.net/p/nsis/bugs/443/
- System::Call 'UXTHEME::SetWindowTheme(p$mui.FinishPage.Run,w" ",w" ")'
- SetCtlColors $mui.FinishPage.Run "${MUI_TEXTCOLOR}" "${MUI_BGCOLOR}"
- System::Call 'UXTHEME::SetWindowTheme(p$mui.FinishPage.ShowReadme,w" ",w" ")'
- SetCtlColors $mui.FinishPage.ShowReadme "${MUI_TEXTCOLOR}" "${MUI_BGCOLOR}"
- ; The Run checkbox follows the components: the Workshop desktop app when
- ; installed; on a Gateway-only install it becomes the first-run browser
- ; handoff to the gateway's Settings page; hidden when neither landed.
- ${If} ${FileExists} "$INSTDIR\${MAINBINARYNAME}.exe"
- ; Default label and target: run the desktop app.
- ${ElseIf} ${FileExists} "$INSTDIR\runvil-gateway.exe"
- SendMessage $mui.FinishPage.Run ${WM_SETTEXT} 0 "STR:Open Runvil Gateway settings in your browser"
- ${Else}
- ShowWindow $mui.FinishPage.Run ${SW_HIDE}
- ${EndIf}
-FunctionEnd
-
-Function RunMainBinary
- ; The finish-page Run checkbox follows the components: the Workshop desktop app
- ; when installed; on a Gateway-only install it launches the gateway with
- ; --browser, so the first boot opens the Settings page in the
- ; default browser.
- ${If} ${FileExists} "$INSTDIR\${MAINBINARYNAME}.exe"
- nsis_tauri_utils::RunAsUser "$INSTDIR\${MAINBINARYNAME}.exe" ""
- ${ElseIf} ${FileExists} "$INSTDIR\runvil-gateway.exe"
- nsis_tauri_utils::RunAsUser "$INSTDIR\runvil-gateway.exe" "--browser"
- ${EndIf}
-FunctionEnd
-
-; Uninstaller Pages
-; 1. Confirm uninstall page
-Var DeleteAppDataCheckbox
-Var DeleteAppDataCheckboxState
-!define /ifndef WS_EX_LAYOUTRTL 0x00400000
-!define MUI_PAGE_CUSTOMFUNCTION_SHOW un.ConfirmShow
-Function un.ConfirmShow ; Add add a `Delete app data` check box
- ; $1 inner dialog HWND
- ; $2 window DPI
- ; $3 style
- ; $4 x
- ; $5 y
- ; $6 width
- ; $7 height
- FindWindow $1 "#32770" "" $HWNDPARENT ; Find inner dialog
- System::Call "user32::GetDpiForWindow(p r1) i .r2"
- ${If} $(^RTL) = 1
- StrCpy $3 "${__NSD_CheckBox_EXSTYLE} | ${WS_EX_LAYOUTRTL}"
- IntOp $4 50 * $2
- ${Else}
- StrCpy $3 "${__NSD_CheckBox_EXSTYLE}"
- IntOp $4 0 * $2
- ${EndIf}
- IntOp $5 100 * $2
- IntOp $6 400 * $2
- IntOp $7 25 * $2
- IntOp $4 $4 / 96
- IntOp $5 $5 / 96
- IntOp $6 $6 / 96
- IntOp $7 $7 / 96
- System::Call 'user32::CreateWindowEx(i r3, w "${__NSD_CheckBox_CLASS}", w "$(deleteAppDataAndState)", i ${__NSD_CheckBox_STYLE}, i r4, i r5, i r6, i r7, p r1, i0, i0, i0) i .s'
- Pop $DeleteAppDataCheckbox
- SendMessage $HWNDPARENT ${WM_GETFONT} 0 0 $1
- SendMessage $DeleteAppDataCheckbox ${WM_SETFONT} $1 1
-FunctionEnd
-!define MUI_PAGE_CUSTOMFUNCTION_LEAVE un.ConfirmLeave
-Function un.ConfirmLeave
- SendMessage $DeleteAppDataCheckbox ${BM_GETCHECK} 0 0 $DeleteAppDataCheckboxState
-FunctionEnd
-!define MUI_PAGE_CUSTOMFUNCTION_PRE un.SkipIfPassive
-!insertmacro MUI_UNPAGE_CONFIRM
-
-; 2. Uninstalling Page
-!insertmacro MUI_UNPAGE_INSTFILES
-
-;Languages
-{{#each languages}}
-!insertmacro MUI_LANGUAGE "{{this}}"
-{{/each}}
-!insertmacro MUI_RESERVEFILE_LANGDLL
-{{#each language_files}}
- !include "{{this}}"
-{{/each}}
-; The "Delete app data" check box also removes the state directory, so its
-; text names what that wipes. It has its own string because redefining the
-; Tauri CLI's deleteAppData makes makensis warn that it is set twice.
-LangString deleteAppDataAndState ${LANG_ENGLISH} "Delete app data, including models, API keys, and settings"
-
-Function .onInit
- ${GetOptions} $CMDLINE "/P" $PassiveMode
- ${IfNot} ${Errors}
- StrCpy $PassiveMode 1
- ${EndIf}
-
- ${GetOptions} $CMDLINE "/NS" $NoShortcutMode
- ${IfNot} ${Errors}
- StrCpy $NoShortcutMode 1
- ${EndIf}
-
- ${GetOptions} $CMDLINE "/UPDATE" $UpdateMode
- ${IfNot} ${Errors}
- StrCpy $UpdateMode 1
- ${EndIf}
-
- ; Start from the persisted component selection, so no install resurrects
- ; a component the user declined before: passive and update installs skip
- ; the components page and install it as is, and the page starts from it.
- ; A /COMPONENTS= list then replaces it.
- Call RestoreComponentSelections
- Call SelectComponentsFromCommandLine
- Call EnforceSttNeedsGateway
-
- !if "${DISPLAYLANGUAGESELECTOR}" == "true"
- !insertmacro MUI_LANGDLL_DISPLAY
- !endif
-
- !insertmacro SetContext
-
- ${If} $INSTDIR == "${PLACEHOLDER_INSTALL_DIR}"
- ; Set default install location
- !if "${INSTALLMODE}" == "perMachine"
- ${If} ${RunningX64}
- !if "${ARCH}" == "x64"
- StrCpy $INSTDIR "$PROGRAMFILES64\${PRODUCTNAME}"
- !else if "${ARCH}" == "arm64"
- StrCpy $INSTDIR "$PROGRAMFILES64\${PRODUCTNAME}"
- !else
- StrCpy $INSTDIR "$PROGRAMFILES\${PRODUCTNAME}"
- !endif
- ${Else}
- StrCpy $INSTDIR "$PROGRAMFILES\${PRODUCTNAME}"
- ${EndIf}
- !else if "${INSTALLMODE}" == "currentUser"
- StrCpy $INSTDIR "$LOCALAPPDATA\${PRODUCTNAME}"
- !endif
-
- Call RestorePreviousInstallLocation
- ${EndIf}
-
- !if "${INSTALLMODE}" == "both"
- !insertmacro MULTIUSER_INIT
- !endif
-FunctionEnd
-
-Section "-EarlyChecks"
- ; Abort silent installer if downgrades is disabled
- !if "${ALLOWDOWNGRADES}" == "false"
- ${If} ${Silent}
- ; If downgrading
- ${If} $R0 = -1
- System::Call 'kernel32::AttachConsole(i -1)i.r0'
- ${If} $0 <> 0
- System::Call 'kernel32::GetStdHandle(i -11)i.r0'
- System::call 'kernel32::SetConsoleTextAttribute(i r0, i 0x0004)' ; set red color
- FileWrite $0 "$(silentDowngrades)"
- ${EndIf}
- Abort
- ${EndIf}
- ${EndIf}
- !endif
-
-SectionEnd
-
-Section "-WebView2"
- ; Check if Webview2 is already installed and skip this section
- ${If} ${RunningX64}
- ReadRegStr $4 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\${WEBVIEW2APPGUID}" "pv"
- ${Else}
- ReadRegStr $4 HKLM "SOFTWARE\Microsoft\EdgeUpdate\Clients\${WEBVIEW2APPGUID}" "pv"
- ${EndIf}
- ${If} $4 == ""
- ReadRegStr $4 HKCU "SOFTWARE\Microsoft\EdgeUpdate\Clients\${WEBVIEW2APPGUID}" "pv"
- ${EndIf}
-
- ${If} $4 == ""
- ; Webview2 installation
- ;
- ; Skip if updating
- ${If} $UpdateMode <> 1
- !if "${INSTALLWEBVIEW2MODE}" == "downloadBootstrapper"
- Delete "$TEMP\MicrosoftEdgeWebview2Setup.exe"
- DetailPrint "$(webview2Downloading)"
- NSISdl::download "https://go.microsoft.com/fwlink/p/?LinkId=2124703" "$TEMP\MicrosoftEdgeWebview2Setup.exe"
- Pop $0
- ${If} $0 == "success"
- DetailPrint "$(webview2DownloadSuccess)"
- ${Else}
- DetailPrint "$(webview2DownloadError)"
- Abort "$(webview2AbortError)"
- ${EndIf}
- StrCpy $6 "$TEMP\MicrosoftEdgeWebview2Setup.exe"
- Goto install_webview2
- !endif
-
- !if "${INSTALLWEBVIEW2MODE}" == "embedBootstrapper"
- Delete "$TEMP\MicrosoftEdgeWebview2Setup.exe"
- File "/oname=$TEMP\MicrosoftEdgeWebview2Setup.exe" "${WEBVIEW2BOOTSTRAPPERPATH}"
- DetailPrint "$(installingWebview2)"
- StrCpy $6 "$TEMP\MicrosoftEdgeWebview2Setup.exe"
- Goto install_webview2
- !endif
-
- !if "${INSTALLWEBVIEW2MODE}" == "offlineInstaller"
- Delete "$TEMP\MicrosoftEdgeWebView2RuntimeInstaller.exe"
- File "/oname=$TEMP\MicrosoftEdgeWebView2RuntimeInstaller.exe" "${WEBVIEW2INSTALLERPATH}"
- DetailPrint "$(installingWebview2)"
- StrCpy $6 "$TEMP\MicrosoftEdgeWebView2RuntimeInstaller.exe"
- Goto install_webview2
- !endif
-
- Goto webview2_done
-
- install_webview2:
- DetailPrint "$(installingWebview2)"
- ; $6 holds the path to the webview2 installer
- ExecWait "$6 ${WEBVIEW2INSTALLERARGS} /install" $1
- ${If} $1 = 0
- DetailPrint "$(webview2InstallSuccess)"
- ${Else}
- DetailPrint "$(webview2InstallError)"
- Abort "$(webview2AbortError)"
- ${EndIf}
- webview2_done:
- ${EndIf}
- ${Else}
- !if "${MINIMUMWEBVIEW2VERSION}" != ""
- ${VersionCompare} "${MINIMUMWEBVIEW2VERSION}" "$4" $R0
- ${If} $R0 = 1
- update_webview:
- DetailPrint "$(installingWebview2)"
- ${If} ${RunningX64}
- ReadRegStr $R1 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate" "path"
- ${Else}
- ReadRegStr $R1 HKLM "SOFTWARE\Microsoft\EdgeUpdate" "path"
- ${EndIf}
- ${If} $R1 == ""
- ReadRegStr $R1 HKCU "SOFTWARE\Microsoft\EdgeUpdate" "path"
- ${EndIf}
- ${If} $R1 != ""
- ; Chromium updater docs: https://source.chromium.org/chromium/chromium/src/+/main:docs/updater/user_manual.md
- ; Modified from "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView\ModifyPath"
- ExecWait `"$R1" /install appguid=${WEBVIEW2APPGUID}&needsadmin=true` $1
- ${If} $1 = 0
- DetailPrint "$(webview2InstallSuccess)"
- ${Else}
- MessageBox MB_ICONEXCLAMATION|MB_ABORTRETRYIGNORE "$(webview2InstallError)" IDIGNORE ignore IDRETRY update_webview
- Quit
- ignore:
- ${EndIf}
- ${EndIf}
- ${EndIf}
- !endif
- ${EndIf}
-SectionEnd
-
-Section "-Prepare"
- !ifmacrodef NSIS_HOOK_PREINSTALL
- !insertmacro NSIS_HOOK_PREINSTALL
- !endif
-SectionEnd
-
-Section "Runvil Workshop" SecWorkshop
- SetOutPath $INSTDIR
-
- !insertmacro CheckIfAppIsRunning "$INSTDIR\${MAINBINARYNAME}.exe" "${PRODUCTNAME}"
-
- ; Copy main executable
- File "${MAINBINARYSRCPATH}"
-
- ; Copy the libraries of the std Plugin and the bashkit Plugin into the
- ; Plugin directory, `plugins` beside the main executable, where Workshop
- ; loads library Plugins from
- CreateDirectory "$INSTDIR\plugins"
- File "/oname=plugins\plugin_std.dll" "${STDPLUGINSRCPATH}"
- File "/oname=plugins\plugin_bashkit.dll" "${BASHKITPLUGINSRCPATH}"
-
- ; Copy resources
- {{#each resources_dirs}}
- CreateDirectory "$INSTDIR\\{{this}}"
- {{/each}}
- {{#each resources}}
- File /a "/oname={{this.[1]}}" "{{no-escape @key}}"
- {{/each}}
-
- ; Create file associations
- {{#each file_associations as |association| ~}}
- {{#each association.ext as |ext| ~}}
- !insertmacro APP_ASSOCIATE "{{ext}}" "{{or association.name ext}}" "{{association-description association.description ext}}" "$INSTDIR\${MAINBINARYNAME}.exe,0" "Open with ${PRODUCTNAME}" "$INSTDIR\${MAINBINARYNAME}.exe $\"%1$\""
- {{/each}}
- {{/each}}
-
- ; Register deep links
- {{#each deep_link_protocols as |protocol| ~}}
- WriteRegStr SHCTX "Software\Classes\\{{protocol}}" "URL Protocol" ""
- WriteRegStr SHCTX "Software\Classes\\{{protocol}}" "" "URL:${BUNDLEID} protocol"
- WriteRegStr SHCTX "Software\Classes\\{{protocol}}\DefaultIcon" "" "$\"$INSTDIR\${MAINBINARYNAME}.exe$\",0"
- WriteRegStr SHCTX "Software\Classes\\{{protocol}}\shell\open\command" "" "$\"$INSTDIR\${MAINBINARYNAME}.exe$\" $\"%1$\""
- {{/each}}
-
- ; Remove old main binary if it doesn't match new main binary name
- ReadRegStr $OldMainBinaryName SHCTX "${UNINSTKEY}" "MainBinaryName"
- ${If} $OldMainBinaryName != ""
- ${AndIf} $OldMainBinaryName != "${MAINBINARYNAME}.exe"
- Delete "$INSTDIR\$OldMainBinaryName"
- ${EndIf}
-
- ; Save current MAINBINARYNAME for future updates
- WriteRegStr SHCTX "${UNINSTKEY}" "MainBinaryName" "${MAINBINARYNAME}.exe"
-
- ; Create start menu shortcut
- !insertmacro MUI_STARTMENU_WRITE_BEGIN Application
- Call CreateOrUpdateStartMenuShortcut
- !insertmacro MUI_STARTMENU_WRITE_END
-
- ; Create desktop shortcut for silent and passive installers
- ; because finish page will be skipped
- ${If} $PassiveMode = 1
- ${OrIf} ${Silent}
- Call CreateOrUpdateDesktopShortcut
- ${EndIf}
-SectionEnd
-
-Section "Runvil Gateway" SecGateway
- SetOutPath $INSTDIR
-
- ; The updater's passive install only auto-kills the main binary (the
- ; CheckIfAppIsRunning in the Workshop section), so a running gateway
- ; would file-lock its own overwrite and fail the update. Detect it by
- ; process name through nsis_tauri_utils - parsing
- ; %USERPROFILE%\.runvil\run\gateway.json for the pid in NSIS buys
- ; nothing when the image name is unique - stop it through the same
- ; CheckIfAppIsRunning, and relaunch it in the -Relaunch section. Living
- ; inside the Gateway section, the stop runs only when the component is
- ; selected: a declined section leaves the payload untouched, and a
- ; daemon the install does not overwrite is not the installer's to kill.
- !if "${INSTALLMODE}" == "currentUser"
- nsis_tauri_utils::FindProcessCurrentUser "runvil-gateway.exe"
- !else
- nsis_tauri_utils::FindProcess "runvil-gateway.exe"
- !endif
- Pop $R0
- ${If} $R0 = 0
- StrCpy $GatewayWasRunning 1
- !insertmacro CheckIfAppIsRunning "$INSTDIR\runvil-gateway.exe" "${PRODUCTNAME}"
- ${EndIf}
-
- ; Copy external binaries (runvil-gateway.exe via bundle.externalBin,
- ; the only entry today - split per-component if that changes)
- {{#each binaries}}
- File /a "/oname={{this}}" "{{no-escape @key}}"
- {{/each}}
-SectionEnd
-
-Section "Speech to Text (downloads about 0.6 GB, 1.1 GB with an NVIDIA GPU)" SecSTT
- ; No files: STT is a config gate. The Finalize section records the
- ; selection, and the Gateway downloads the speech runtime and models the
- ; first time it starts with them in its config.
-SectionEnd
-
-Section "-Finalize"
- ; Create uninstaller
- WriteUninstaller "$INSTDIR\uninstall.exe"
-
- ; Save $INSTDIR in registry for future installations
- WriteRegStr SHCTX "${MANUPRODUCTKEY}" "" $INSTDIR
-
- !if "${INSTALLMODE}" == "both"
- ; Save install mode to be selected by default for the next installation such as updating
- ; or when uninstalling
- WriteRegStr SHCTX "${UNINSTKEY}" $MultiUser.InstallMode 1
- !endif
-
- ; Registry information for add/remove programs
- WriteRegStr SHCTX "${UNINSTKEY}" "DisplayName" "${PRODUCTNAME}"
- ; The display icon follows the Workshop exe when it is installed, the
- ; gateway exe on a Gateway-only install.
- SectionGetFlags ${SecWorkshop} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 = ${SF_SELECTED}
- WriteRegStr SHCTX "${UNINSTKEY}" "DisplayIcon" "$\"$INSTDIR\${MAINBINARYNAME}.exe$\""
- ${Else}
- WriteRegStr SHCTX "${UNINSTKEY}" "DisplayIcon" "$\"$INSTDIR\runvil-gateway.exe$\""
- ${EndIf}
- WriteRegStr SHCTX "${UNINSTKEY}" "DisplayVersion" "${VERSION}"
- WriteRegStr SHCTX "${UNINSTKEY}" "Publisher" "${MANUFACTURER}"
- WriteRegStr SHCTX "${UNINSTKEY}" "InstallLocation" "$\"$INSTDIR$\""
- WriteRegStr SHCTX "${UNINSTKEY}" "UninstallString" "$\"$INSTDIR\uninstall.exe$\""
- WriteRegDWORD SHCTX "${UNINSTKEY}" "NoModify" "1"
- WriteRegDWORD SHCTX "${UNINSTKEY}" "NoRepair" "1"
-
- ${GetSize} "$INSTDIR" "/M=uninstall.exe /S=0K /G=0" $0 $1 $2
- IntOp $0 $0 + ${ESTIMATEDSIZE}
- IntFmt $0 "0x%08X" $0
- WriteRegDWORD SHCTX "${UNINSTKEY}" "EstimatedSize" "$0"
-
- !if "${HOMEPAGE}" != ""
- WriteRegStr SHCTX "${UNINSTKEY}" "URLInfoAbout" "${HOMEPAGE}"
- WriteRegStr SHCTX "${UNINSTKEY}" "URLUpdateInfo" "${HOMEPAGE}"
- WriteRegStr SHCTX "${UNINSTKEY}" "HelpLink" "${HOMEPAGE}"
- !endif
-
- ; Persist the component selection so every later install starts from it
- ; (see RestoreComponentSelections).
- !insertmacro PersistComponent ${SecGateway} Gateway
- !insertmacro PersistComponent ${SecWorkshop} Workshop
- !insertmacro PersistComponent ${SecSTT} STT
-
- ; The STT checkbox writes the Gateway's first-run config gate, which the
- ; pinned Gateway release reads when it writes its default config:
- ; checked deletes the value (absent = STT on), unchecked writes 0. Update
- ; mode never touches it, since the first run already consumed the
- ; original choice.
- ${If} $UpdateMode <> 1
- SectionGetFlags ${SecSTT} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 = ${SF_SELECTED}
- DeleteRegValue HKCU "${MANUPRODUCTKEY}" "InstallSTT"
- ${Else}
- WriteRegDWORD HKCU "${MANUPRODUCTKEY}" "InstallSTT" 0
- ${EndIf}
- ${EndIf}
-
- ; Update mode installs over the top without uninstalling; delete the
- ; payloads of declined components or they would linger.
- !insertmacro DeleteComponentPayloadIfDeclined ${SecGateway} $INSTDIR\runvil-gateway.exe
- !insertmacro DeleteComponentPayloadIfDeclined ${SecWorkshop} $INSTDIR\${MAINBINARYNAME}.exe
- !insertmacro DeleteComponentPayloadIfDeclined ${SecWorkshop} $INSTDIR\plugins\plugin_std.dll
- !insertmacro DeleteComponentPayloadIfDeclined ${SecWorkshop} $INSTDIR\plugins\plugin_bashkit.dll
- ; Without /r, RMDir removes the Plugin directory only when it is empty,
- ; which it is only after the lines above deleted the two libraries in it.
- RMDir "$INSTDIR\plugins"
- ClearErrors
-
-SectionEnd
-
-Section "-Relaunch"
- ; Relaunch the gateway when the install stopped one and the component
- ; stays installed. `--login` keeps the relaunch headless: no browser, no
- ; window.
- ${If} $GatewayWasRunning = 1
- SectionGetFlags ${SecGateway} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 = ${SF_SELECTED}
- nsis_tauri_utils::RunAsUser "$INSTDIR\runvil-gateway.exe" "--login"
- ${EndIf}
- ${EndIf}
-
- !ifmacrodef NSIS_HOOK_POSTINSTALL
- !insertmacro NSIS_HOOK_POSTINSTALL
- !endif
-
- ; Auto close this page for passive mode
- ${If} $PassiveMode = 1
- SetAutoClose true
- ${EndIf}
-SectionEnd
-
-Function .onInstSuccess
- ; Check for `/R` flag only in silent and passive installers because
- ; GUI installer has a toggle for the user to (re)start the app
- ${If} $PassiveMode = 1
- ${OrIf} ${Silent}
- ${GetOptions} $CMDLINE "/R" $R0
- ${IfNot} ${Errors}
- ${GetOptions} $CMDLINE "/ARGS" $R0
- nsis_tauri_utils::RunAsUser "$INSTDIR\${MAINBINARYNAME}.exe" "$R0"
- ${EndIf}
- ${EndIf}
-FunctionEnd
-
-Function un.onInit
- !insertmacro SetContext
-
- !if "${INSTALLMODE}" == "both"
- !insertmacro MULTIUSER_UNINIT
- !endif
-
- !insertmacro MUI_UNGETLANGUAGE
-
- ${GetOptions} $CMDLINE "/P" $PassiveMode
- ${IfNot} ${Errors}
- StrCpy $PassiveMode 1
- ${EndIf}
-
- ${GetOptions} $CMDLINE "/UPDATE" $UpdateMode
- ${IfNot} ${Errors}
- StrCpy $UpdateMode 1
- ${EndIf}
-FunctionEnd
-
-Section "un.Gateway"
- !ifmacrodef NSIS_HOOK_PREUNINSTALL
- !insertmacro NSIS_HOOK_PREUNINSTALL
- !endif
-
- !insertmacro CheckIfAppIsRunning "$INSTDIR\runvil-gateway.exe" "${PRODUCTNAME}"
-
- ; Delete external binaries (runvil-gateway.exe)
- {{#each binaries}}
- Delete "$INSTDIR\\{{this}}"
- {{/each}}
-SectionEnd
-
-Section "un.Workshop"
- !insertmacro CheckIfAppIsRunning "$INSTDIR\${MAINBINARYNAME}.exe" "${PRODUCTNAME}"
-
- ; Delete the main executable
- Delete "$INSTDIR\${MAINBINARYNAME}.exe"
-
- ; Delete the Plugins' libraries, and the Plugin directory unless a
- ; library the installer did not put there is left in it
- Delete "$INSTDIR\plugins\plugin_std.dll"
- Delete "$INSTDIR\plugins\plugin_bashkit.dll"
- RMDir "$INSTDIR\plugins"
-
- ; Delete resources
- {{#each resources}}
- Delete "$INSTDIR\\{{this.[1]}}"
- {{/each}}
-
- ; Delete app associations
- {{#each file_associations as |association| ~}}
- {{#each association.ext as |ext| ~}}
- !insertmacro APP_UNASSOCIATE "{{ext}}" "{{or association.name ext}}"
- {{/each}}
- {{/each}}
-
- ; Delete deep links
- {{#each deep_link_protocols as |protocol| ~}}
- ReadRegStr $R7 SHCTX "Software\Classes\\{{protocol}}\shell\open\command" ""
- ${If} $R7 == "$\"$INSTDIR\${MAINBINARYNAME}.exe$\" $\"%1$\""
- DeleteRegKey SHCTX "Software\Classes\\{{protocol}}"
- ${EndIf}
- {{/each}}
-SectionEnd
-
-Section Uninstall
- ; Delete uninstaller
- Delete "$INSTDIR\uninstall.exe"
-
- {{#each resources_ancestors}}
- RMDir /REBOOTOK "$INSTDIR\\{{this}}"
- {{/each}}
- RMDir "$INSTDIR"
-
- ; Remove shortcuts if not updating
- ${If} $UpdateMode <> 1
- !insertmacro DeleteAppUserModelId
-
- ; Remove start menu shortcut
- !insertmacro MUI_STARTMENU_GETFOLDER Application $AppStartMenuFolder
- !insertmacro IsShortcutTarget "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- Pop $0
- ${If} $0 = 1
- !insertmacro UnpinShortcut "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk"
- Delete "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk"
- RMDir "$SMPROGRAMS\$AppStartMenuFolder"
- ${EndIf}
- !insertmacro IsShortcutTarget "$SMPROGRAMS\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- Pop $0
- ${If} $0 = 1
- !insertmacro UnpinShortcut "$SMPROGRAMS\${PRODUCTNAME}.lnk"
- Delete "$SMPROGRAMS\${PRODUCTNAME}.lnk"
- ${EndIf}
-
- ; Remove desktop shortcuts
- !insertmacro IsShortcutTarget "$DESKTOP\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- Pop $0
- ${If} $0 = 1
- !insertmacro UnpinShortcut "$DESKTOP\${PRODUCTNAME}.lnk"
- Delete "$DESKTOP\${PRODUCTNAME}.lnk"
- ${EndIf}
- ${EndIf}
-
- ; Remove registry information for add/remove programs
- !if "${INSTALLMODE}" == "both"
- DeleteRegKey SHCTX "${UNINSTKEY}"
- !else if "${INSTALLMODE}" == "perMachine"
- DeleteRegKey HKLM "${UNINSTKEY}"
- !else
- DeleteRegKey HKCU "${UNINSTKEY}"
- !endif
-
- ; Removes the Autostart entry for ${PRODUCTNAME} from the HKCU Run key if it exists.
- ; This ensures the program does not launch automatically after uninstallation if it exists.
- ; If it doesn't exist, it does nothing.
- ; We do this when not updating (to preserve the registry value on updates)
- ${If} $UpdateMode <> 1
- DeleteRegValue HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "${PRODUCTNAME}"
- ; The gateway's Launch at Login entry (the tray writes this value name).
- DeleteRegValue HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "RunvilGateway"
- ${EndIf}
-
- ; Remove the STT first-run gate when not updating (updates preserve
- ; it).
- ${If} $UpdateMode <> 1
- DeleteRegValue HKCU "${MANUPRODUCTKEY}" "InstallSTT"
- ${EndIf}
-
- ; Delete app data if the checkbox is selected
- ; and if not updating
- ${If} $DeleteAppDataCheckboxState = 1
- ${AndIf} $UpdateMode <> 1
- ; Clear the install location $INSTDIR from registry
- DeleteRegKey SHCTX "${MANUPRODUCTKEY}"
- DeleteRegKey /ifempty SHCTX "${MANUKEY}"
-
- ; Clear the install language from registry
- DeleteRegValue HKCU "${MANUPRODUCTKEY}" "Installer Language"
- ; The persisted component selection lives as long as the config it
- ; shaped: a reinstall over a kept speechless config would otherwise offer
- ; Speech to Text checked, which that config ignores. SHCTX above already removed it on a
- ; currentUser install; this covers a perMachine one, which keeps it in
- ; HKCU.
- DeleteRegKey HKCU "${MANUPRODUCTKEY}\Components"
- DeleteRegKey /ifempty HKCU "${MANUPRODUCTKEY}"
- DeleteRegKey /ifempty HKCU "${MANUKEY}"
-
- SetShellVarContext current
- RmDir /r "$APPDATA\${BUNDLEID}"
- RmDir /r "$LOCALAPPDATA\${BUNDLEID}"
- ; The gateway and the Workshop keep their configuration, logs, sessions,
- ; and downloaded models in the state directory, %USERPROFILE%\.runvil.
- RmDir /r "$PROFILE\.runvil"
- ${EndIf}
-
- !ifmacrodef NSIS_HOOK_POSTUNINSTALL
- !insertmacro NSIS_HOOK_POSTUNINSTALL
- !endif
-
- ; Auto close if passive mode or updating
- ${If} $PassiveMode = 1
- ${OrIf} $UpdateMode = 1
- SetAutoClose true
- ${EndIf}
-SectionEnd
-
-Function RestorePreviousInstallLocation
- ReadRegStr $4 SHCTX "${MANUPRODUCTKEY}" ""
- StrCmp $4 "" +2 0
- StrCpy $INSTDIR $4
-FunctionEnd
-
-Function Skip
- Abort
-FunctionEnd
-
-Function SkipIfPassive
- ${IfThen} $PassiveMode = 1 ${|} Abort ${|}
-FunctionEnd
-
-Function SkipIfPassiveOrUpdate
- ${If} $PassiveMode = 1
- ${OrIf} $UpdateMode = 1
- Abort
- ${EndIf}
-FunctionEnd
-
-; Forces the persisted component selection onto the sections, the
-; selection passive and update installs install and the components page
-; starts from. Values absent from the registry (a first install, one
-; after an uninstall that deleted app data or ran an earlier release's
-; uninstaller, or one predating persistence) keep the default:
-; everything selected.
-Function RestoreComponentSelections
- ClearErrors
- ReadRegDWORD $0 HKCU "${MANUPRODUCTKEY}\Components" "Gateway"
- ${IfNot} ${Errors}
- ${If} $0 = 1
- SectionSetFlags ${SecGateway} ${SF_SELECTED}
- ${Else}
- SectionSetFlags ${SecGateway} 0
- ${EndIf}
- ${EndIf}
-
- ClearErrors
- ReadRegDWORD $0 HKCU "${MANUPRODUCTKEY}\Components" "Workshop"
- ${IfNot} ${Errors}
- ${If} $0 = 1
- SectionSetFlags ${SecWorkshop} ${SF_SELECTED}
- ${Else}
- SectionSetFlags ${SecWorkshop} 0
- ${EndIf}
- ${EndIf}
-
- ClearErrors
- ReadRegDWORD $0 HKCU "${MANUPRODUCTKEY}\Components" "STT"
- ${IfNot} ${Errors}
- ${If} $0 = 1
- SectionSetFlags ${SecSTT} ${SF_SELECTED}
- ${Else}
- SectionSetFlags ${SecSTT} 0
- ${EndIf}
- ${EndIf}
-FunctionEnd
-
-; STT is a setting of the Gateway's config, so it requires Gateway: with
-; Gateway unchecked, STT is cleared.
-Function EnforceSttNeedsGateway
- SectionGetFlags ${SecGateway} $0
- IntOp $0 $0 & ${SF_SELECTED}
- ${If} $0 <> ${SF_SELECTED}
- !insertmacro UnselectSection ${SecSTT}
- ${EndIf}
-FunctionEnd
-
-Function .onSelChange
- Call EnforceSttNeedsGateway
-FunctionEnd
-
-; Selects exactly the sections a /COMPONENTS= list names, for silent
-; installs in CI: /COMPONENTS=gateway,stt. Names are workshop, gateway,
-; and stt, comma separated, in any case. An empty list, any other name,
-; or stt without gateway quits with exit code 2 rather than install a
-; selection nobody asked for.
-!macro SelectComponentIfListed LIST NAME SECTION_ID
- ${StrLoc} $1 "${LIST}" ",${NAME}," ">"
- ${If} $1 == ""
- SectionSetFlags ${SECTION_ID} 0
- ${Else}
- SectionSetFlags ${SECTION_ID} ${SF_SELECTED}
- ${EndIf}
-!macroend
-
-; Passive mode never prompts, so it reports through the exit code alone.
-!macro RejectComponentsList MESSAGE
- ${If} $PassiveMode <> 1
- MessageBox MB_OK|MB_ICONSTOP "${MESSAGE}" /SD IDOK
- ${EndIf}
- SetErrorLevel 2
- Quit
-!macroend
-
-Function SelectComponentsFromCommandLine
- ClearErrors
- ${GetOptions} $CMDLINE "/COMPONENTS=" $0
- ${If} ${Errors}
- Return
- ${EndIf}
- ${StrCase} $0 ",$0," "L"
- ; Strip every known name from a copy until nothing changes; a valid
- ; list leaves only its outer comma. Repeating covers a repeated name,
- ; whose adjacent matches share a comma.
- StrCpy $1 $0
- ${Do}
- StrCpy $2 $1
- ${WordReplace} $1 ",workshop," "," "+" $1
- ${WordReplace} $1 ",gateway," "," "+" $1
- ${WordReplace} $1 ",stt," "," "+" $1
- ${LoopUntil} $1 == $2
- ${If} $1 != ","
- !insertmacro RejectComponentsList "/COMPONENTS= lists unknown or empty names (left after removing the known ones: $1); the names are workshop, gateway, and stt, comma separated, without spaces."
- ${EndIf}
- ${StrLoc} $1 $0 ",stt," ">"
- ${StrLoc} $2 $0 ",gateway," ">"
- ${If} $1 != ""
- ${AndIf} $2 == ""
- !insertmacro RejectComponentsList "/COMPONENTS= lists stt without gateway; speech to text is a Gateway setting, so list gateway too."
- ${EndIf}
- !insertmacro SelectComponentIfListed $0 workshop ${SecWorkshop}
- !insertmacro SelectComponentIfListed $0 gateway ${SecGateway}
- !insertmacro SelectComponentIfListed $0 stt ${SecSTT}
-FunctionEnd
-
-Function un.SkipIfPassive
- ${IfThen} $PassiveMode = 1 ${|} Abort ${|}
-FunctionEnd
-
-Function CreateOrUpdateStartMenuShortcut
- ; We used to use product name as MAINBINARYNAME
- ; migrate old shortcuts to target the new MAINBINARYNAME
- StrCpy $R0 0
-
- !insertmacro IsShortcutTarget "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk" "$INSTDIR\$OldMainBinaryName"
- Pop $0
- ${If} $0 = 1
- !insertmacro SetShortcutTarget "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- StrCpy $R0 1
- ${EndIf}
-
- !insertmacro IsShortcutTarget "$SMPROGRAMS\${PRODUCTNAME}.lnk" "$INSTDIR\$OldMainBinaryName"
- Pop $0
- ${If} $0 = 1
- !insertmacro SetShortcutTarget "$SMPROGRAMS\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- StrCpy $R0 1
- ${EndIf}
-
- ${If} $R0 = 1
- Return
- ${EndIf}
-
- ; Skip creating shortcut if in update mode or no shortcut mode
- ; but always create if migrating from wix
- ${If} $WixMode = 0
- ${If} $UpdateMode = 1
- ${OrIf} $NoShortcutMode = 1
- Return
- ${EndIf}
- ${EndIf}
-
- !if "${STARTMENUFOLDER}" != ""
- CreateDirectory "$SMPROGRAMS\$AppStartMenuFolder"
- CreateShortcut "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- !insertmacro SetLnkAppUserModelId "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk"
- !else
- CreateShortcut "$SMPROGRAMS\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- !insertmacro SetLnkAppUserModelId "$SMPROGRAMS\${PRODUCTNAME}.lnk"
- !endif
-FunctionEnd
-
-Function CreateOrUpdateDesktopShortcut
- ; We used to use product name as MAINBINARYNAME
- ; migrate old shortcuts to target the new MAINBINARYNAME
- !insertmacro IsShortcutTarget "$DESKTOP\${PRODUCTNAME}.lnk" "$INSTDIR\$OldMainBinaryName"
- Pop $0
- ${If} $0 = 1
- !insertmacro SetShortcutTarget "$DESKTOP\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- Return
- ${EndIf}
-
- ; Skip creating shortcut if in update mode or no shortcut mode
- ; but always create if migrating from wix
- ${If} $WixMode = 0
- ${If} $UpdateMode = 1
- ${OrIf} $NoShortcutMode = 1
- Return
- ${EndIf}
- ${EndIf}
-
- CreateShortcut "$DESKTOP\${PRODUCTNAME}.lnk" "$INSTDIR\${MAINBINARYNAME}.exe"
- !insertmacro SetLnkAppUserModelId "$DESKTOP\${PRODUCTNAME}.lnk"
-FunctionEnd
diff --git a/crates/workshop/desktop/permissions/autogenerated/desktop_update_supported.toml b/crates/workshop/desktop/permissions/autogenerated/desktop_update_supported.toml
deleted file mode 100644
index 6cc836fa8..000000000
--- a/crates/workshop/desktop/permissions/autogenerated/desktop_update_supported.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-desktop-update-supported"
-description = "Enables the desktop_update_supported command without any pre-configured scope."
-commands.allow = ["desktop_update_supported"]
-
-[[permission]]
-identifier = "deny-desktop-update-supported"
-description = "Denies the desktop_update_supported command without any pre-configured scope."
-commands.deny = ["desktop_update_supported"]
diff --git a/crates/workshop/desktop/permissions/autogenerated/quit.toml b/crates/workshop/desktop/permissions/autogenerated/quit.toml
deleted file mode 100644
index 4a5d670b2..000000000
--- a/crates/workshop/desktop/permissions/autogenerated/quit.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-quit"
-description = "Enables the quit command without any pre-configured scope."
-commands.allow = ["quit"]
-
-[[permission]]
-identifier = "deny-quit"
-description = "Denies the quit command without any pre-configured scope."
-commands.deny = ["quit"]
diff --git a/crates/workshop/desktop/src/bridge.rs b/crates/workshop/desktop/src/bridge.rs
deleted file mode 100644
index 438e946a6..000000000
--- a/crates/workshop/desktop/src/bridge.rs
+++ /dev/null
@@ -1,434 +0,0 @@
-//! The Windows WebView2 bridge: Explorer path drops and the microphone
-//! permission grant, over raw COM.
-//!
-//! The page cannot read real OS paths from an HTML5 drop (Chromium hides
-//! them), and the app must not touch the OLE drop target either: Tauri's
-//! drag-drop handler registers its own target on the WebView2 child
-//! windows before Chromium can, which kills every HTML5 drag-and-drop
-//! interaction inside the page (Dockview panel drags included), and once
-//! Chromium does register, its target sits in the msedgewebview2 browser
-//! process, so it cannot be wrapped from this process at all - a window
-//! property holding another process's interface pointer is not callable
-//! here.
-//!
-//! WebView2 has a supported channel for this: on a drop the page
-//! calls `chrome.webview.postMessageWithAdditionalObjects` with the DOM
-//! `File` objects, and the desktop app receives each one as an
-//! [`ICoreWebView2File`] whose `Path` is the real OS path. [`attach`]
-//! subscribes to those messages and feeds the paths into the
-//! `runvil:file-drop` dispatch ([`crate::drops`]) the page already
-//! listens for.
-//!
-//! The same subscription pass installs the `PermissionRequested` handler
-//! that grants the microphone (and nothing else), replacing wry's
-//! `with_permission_handler` from the tao/wry runtime.
-
-use std::path::PathBuf;
-use std::sync::mpsc;
-
-use anyhow::Context as _;
-use webview2_com::Microsoft::Web::WebView2::Win32::{
-    COREWEBVIEW2_PERMISSION_KIND, COREWEBVIEW2_PERMISSION_KIND_MICROPHONE,
-    COREWEBVIEW2_PERMISSION_STATE_ALLOW, ICoreWebView2, ICoreWebView2File,
-    ICoreWebView2PermissionRequestedEventArgs, ICoreWebView2Settings3,
-    ICoreWebView2WebMessageReceivedEventArgs, ICoreWebView2WebMessageReceivedEventArgs2,
-};
-use webview2_com::{PermissionRequestedEventHandler, WebMessageReceivedEventHandler, take_pwstr};
-use windows_core::{Interface as _, PWSTR};
-
-use crate::drops::dispatch_file_drop;
-
-/// The web message the page sends with a drop's `File` objects attached.
-/// Every other message on the shared channel is ignored.
-const DROP_MESSAGE: &str = "workspace-drop";
-
-/// Subscribes the window's webview to drop messages and permission
-/// requests. The message handler reads the dropped paths off the event
-/// and queues the `runvil:file-drop` dispatch ([`crate::drops`]) for
-/// the next event-loop turn - never inside the callback, where the OLE
-/// drop may still be on the stack; the permission handler grants the
-/// microphone and leaves every other kind to WebView2's default handling.
-///
-/// # Errors
-/// Returns an error when the webview dispatch or a COM subscription fails;
-/// the caller logs it and Explorer drops plus the mic grant degrade,
-/// nothing else.
-pub(crate) fn attach(window: &tauri::WebviewWindow) -> anyhow::Result<()> {
-    let window_for_handler = window.clone();
-    let (tx, rx) = mpsc::channel();
-    window
-        .with_webview(move |webview| {
-            let _ = tx.send(attach_handlers(&webview, window_for_handler));
-        })
-        .context("dispatch the bridge attach to the webview thread")?;
-    rx.recv()
-        .context("the webview bridge attach did not answer")?
-        .context("attach the WebView2 bridge")
-}
-
-/// The COM subscriptions, run on the thread that owns the webview.
-fn attach_handlers(
-    webview: &tauri::webview::PlatformWebview,
-    window: tauri::WebviewWindow,
-) -> windows_core::Result<()> {
-    let controller = webview.controller();
-    // SAFETY: `controller` is the live controller of this window's webview,
-    // called on the webview's own thread (with_webview guarantees it), and
-    // the generated out-param write is valid by construction.
-    let core = unsafe { controller.CoreWebView2()? };
-    disable_browser_accelerator_keys(&core)?;
-    attach_drop_bridge(&core, window)?;
-    attach_permission_grant(&core)?;
-    Ok(())
-}
-
-/// WebView2's built-in keyboard shortcuts (Ctrl+=, Ctrl+-, F5, Ctrl+U,
-/// etc.) race the app's JS keydown handler. Disabling them here makes
-/// the JS handler in shortcuts.ts the sole zoom path.
-fn disable_browser_accelerator_keys(core: &ICoreWebView2) -> windows_core::Result<()> {
-    // SAFETY: `core` is the live interface supplied by the webview controller,
-    // and this call runs on that webview's thread.
-    let settings = unsafe { core.Settings()? };
-    let settings3: ICoreWebView2Settings3 = settings.cast()?;
-    // SAFETY: `settings3` was queried from the live settings interface and is
-    // called on the owning webview thread.
-    unsafe { settings3.SetAreBrowserAcceleratorKeysEnabled(false) }
-}
-
-/// The drop half: forward the real OS paths of a `workspace-drop`
-/// message's attached `File` objects into the page's grant flow. The
-/// dispatch is queued onto the next event-loop turn, never run inside
-/// the callback: on a real Explorer drop the message can arrive with
-/// the OLE drop still on the UI thread's stack, and eval'ing into the
-/// page from inside the callback is the reentrancy that hangs the app
-/// (WebView2Feedback #2498/#3559).
-fn attach_drop_bridge(
-    core: &ICoreWebView2,
-    window: tauri::WebviewWindow,
-) -> windows_core::Result<()> {
-    let handler = WebMessageReceivedEventHandler::create(Box::new(move |_, args| {
-        let Some(args) = args else {
-            return Ok(());
-        };
-        let window = window.clone();
-        handle_web_message(&args, move |paths| {
-            let queued = window.run_on_main_thread({
-                let window = window.clone();
-                move || dispatch_file_drop(&window, &paths)
-            });
-            if let Err(error) = queued {
-                eprintln!("could not queue the file-drop dispatch: {error}");
-            }
-        });
-        Ok(())
-    }));
-    let mut token = 0_i64;
-    // SAFETY: `core` is live on its owning thread, `handler` outlives the
-    // subscription (the webview holds it), and `token` is a valid out-pointer
-    // to a stack local.
-    unsafe { core.add_WebMessageReceived(&handler, &raw mut token) }
-}
-
-/// Handles one web message: when it is the drop message with file
-/// attachments, hands their real OS paths to `defer`. The event args die
-/// with the callback, so the paths are read here; everything after -
-/// above all the eval that dispatches the drop into the page - runs
-/// outside the callback, which `defer` must arrange.
-fn handle_web_message(
-    args: &ICoreWebView2WebMessageReceivedEventArgs,
-    defer: impl FnOnce(Vec<PathBuf>),
-) {
-    if message_string(args).as_deref() == Some(DROP_MESSAGE) {
-        let paths = dropped_paths(args);
-        if !paths.is_empty() {
-            defer(paths);
-        }
-    }
-}
-
-/// The permission half: grant the microphone automatically. Every other
-/// permission kind returns without a `SetState` call, keeping WebView2's
-/// default handling.
-fn attach_permission_grant(core: &ICoreWebView2) -> windows_core::Result<()> {
-    let handler = PermissionRequestedEventHandler::create(Box::new(move |_, args| {
-        let Some(args) = args else {
-            return Ok(());
-        };
-        grant_microphone(&args)
-    }));
-    let mut token = 0_i64;
-    // SAFETY: same preconditions as the drop subscription above.
-    unsafe { core.add_PermissionRequested(&handler, &raw mut token) }
-}
-
-/// Answers one permission request: allow for the microphone, default
-/// handling for everything else.
-fn grant_microphone(args: &ICoreWebView2PermissionRequestedEventArgs) -> windows_core::Result<()> {
-    let mut kind = COREWEBVIEW2_PERMISSION_KIND::default();
-    // SAFETY: `args` is the live event argument WebView2 handed the handler,
-    // and `kind` is a valid out-pointer to a stack local.
-    unsafe { args.PermissionKind(&raw mut kind) }?;
-    if kind == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE {
-        // SAFETY: `args` is live as above.
-        unsafe { args.SetState(COREWEBVIEW2_PERMISSION_STATE_ALLOW) }?;
-    }
-    Ok(())
-}
-
-/// The message's string payload, or `None` when the message is not a
-/// string (a JSON object posted by some other page code, say).
-fn message_string(args: &ICoreWebView2WebMessageReceivedEventArgs) -> Option<String> {
-    let mut message = PWSTR::null();
-    // SAFETY: `args` is the live event argument, and `message` is a valid
-    // out-pointer; on success the returned PWSTR is owned and freed by
-    // take_pwstr.
-    unsafe { args.TryGetWebMessageAsString(&raw mut message) }.ok()?;
-    Some(take_pwstr(message))
-}
-
-/// The real OS paths of the message's attached `File` objects. Anything
-/// else in the message (a message with no attachments, or attachments of
-/// some other type) contributes nothing.
-fn dropped_paths(args: &ICoreWebView2WebMessageReceivedEventArgs) -> Vec<PathBuf> {
-    // AdditionalObjects arrived with WebView2 runtime 1.0.1518.46 (2022);
-    // an older runtime fails the cast and drops degrade gracefully.
-    let Ok(args) = args.cast::<ICoreWebView2WebMessageReceivedEventArgs2>() else {
-        return Vec::new();
-    };
-    // SAFETY: `args` is live on the webview's thread; the returned
-    // collection pointer is owned by the event and read only here.
-    let Ok(objects) = (unsafe { args.AdditionalObjects() }) else {
-        return Vec::new();
-    };
-    let mut count = 0_u32;
-    // SAFETY: `objects` is the live collection returned above; `count` is a
-    // valid out-pointer to a stack local.
-    if unsafe { objects.Count(&raw mut count) }.is_err() {
-        return Vec::new();
-    }
-    let mut paths = Vec::with_capacity(count as usize);
-    for index in 0..count {
-        // SAFETY: `objects` is live; `index` is below the count it reported.
-        let Ok(object) = (unsafe { objects.GetValueAtIndex(index) }) else {
-            continue;
-        };
-        let Ok(file) = object.cast::<ICoreWebView2File>() else {
-            continue;
-        };
-        let mut path = PWSTR::null();
-        // SAFETY: `file` is a live attachment; `path` is a valid
-        // out-pointer, and on success the returned PWSTR is owned and freed
-        // by take_pwstr.
-        if unsafe { file.Path(&raw mut path) }.is_ok() {
-            paths.push(PathBuf::from(take_pwstr(path)));
-        }
-    }
-    paths
-}
-
-// The clippy expects cover code the #[implement] macro expands in tests.
-#[cfg(test)]
-#[expect(
-    clippy::inline_always,
-    clippy::ref_as_ptr,
-    reason = "the #[implement] macro expansion in tests triggers these lints"
-)]
-mod tests {
-    use std::path::PathBuf;
-
-    use webview2_com::Microsoft::Web::WebView2::Win32::{
-        ICoreWebView2File, ICoreWebView2File_Impl, ICoreWebView2ObjectCollectionView,
-        ICoreWebView2ObjectCollectionView_Impl, ICoreWebView2WebMessageReceivedEventArgs,
-        ICoreWebView2WebMessageReceivedEventArgs_Impl, ICoreWebView2WebMessageReceivedEventArgs2,
-        ICoreWebView2WebMessageReceivedEventArgs2_Impl,
-    };
-    use webview2_com::pwstr_from_str;
-    use windows_core::{IUnknown, Interface as _, PWSTR, implement};
-
-    use super::{DROP_MESSAGE, dropped_paths, handle_web_message, message_string};
-
-    /// A fake dropped file holding one path.
-    #[implement(ICoreWebView2File)]
-    struct FakeFile {
-        path: &'static str,
-    }
-
-    impl ICoreWebView2File_Impl for FakeFile_Impl {
-        fn Path(&self, value: *mut PWSTR) -> windows_core::Result<()> {
-            // SAFETY: `value` is the out-pointer the COM caller provided,
-            // valid for one write.
-            unsafe { *value = pwstr_from_str(self.path) };
-            Ok(())
-        }
-    }
-
-    /// A fake attachment collection.
-    #[implement(ICoreWebView2ObjectCollectionView)]
-    struct FakeObjects {
-        objects: Vec<IUnknown>,
-    }
-
-    impl ICoreWebView2ObjectCollectionView_Impl for FakeObjects_Impl {
-        fn Count(&self, value: *mut u32) -> windows_core::Result<()> {
-            #[expect(
-                clippy::cast_possible_truncation,
-                reason = "the test fake holds a handful of objects, far below u32::MAX"
-            )]
-            // SAFETY: `value` is the caller's out-pointer, valid for one write.
-            unsafe {
-                *value = self.objects.len() as u32;
-            }
-            Ok(())
-        }
-
-        fn GetValueAtIndex(&self, index: u32) -> windows_core::Result<IUnknown> {
-            Ok(self.objects[index as usize].clone())
-        }
-    }
-
-    /// A fake web-message event: a string message (or not) plus optional
-    /// attachments, mirroring what postMessageWithAdditionalObjects sends.
-    #[implement(
-        ICoreWebView2WebMessageReceivedEventArgs,
-        ICoreWebView2WebMessageReceivedEventArgs2
-    )]
-    struct FakeArgs {
-        message: Option<&'static str>,
-        objects: Vec<IUnknown>,
-    }
-
-    impl ICoreWebView2WebMessageReceivedEventArgs_Impl for FakeArgs_Impl {
-        fn Source(&self, value: *mut PWSTR) -> windows_core::Result<()> {
-            // SAFETY: `value` is the caller's out-pointer, valid for one write.
-            unsafe { *value = pwstr_from_str("http://127.0.0.1/") };
-            Ok(())
-        }
-
-        fn WebMessageAsJson(&self, value: *mut PWSTR) -> windows_core::Result<()> {
-            // SAFETY: `value` is the caller's out-pointer, valid for one write.
-            unsafe { *value = pwstr_from_str("{}") };
-            Ok(())
-        }
-
-        fn TryGetWebMessageAsString(&self, value: *mut PWSTR) -> windows_core::Result<()> {
-            match self.message {
-                Some(message) => {
-                    // SAFETY: `value` is the caller's out-pointer, valid for
-                    // one write.
-                    unsafe { *value = pwstr_from_str(message) };
-                    Ok(())
-                }
-                None => Err(windows_core::Error::from_hresult(windows_core::HRESULT(
-                    0x8000_000B_u32.cast_signed(), // E_BOUNDS, what WebView2 answers
-                ))),
-            }
-        }
-    }
-
-    impl ICoreWebView2WebMessageReceivedEventArgs2_Impl for FakeArgs_Impl {
-        fn AdditionalObjects(&self) -> windows_core::Result<ICoreWebView2ObjectCollectionView> {
-            Ok(FakeObjects {
-                objects: self.objects.clone(),
-            }
-            .into())
-        }
-    }
-
-    fn args_with(
-        message: Option<&'static str>,
-        objects: Vec<IUnknown>,
-    ) -> ICoreWebView2WebMessageReceivedEventArgs {
-        FakeArgs { message, objects }.into()
-    }
-
-    /// A fake file attachment, as the plain IUnknown the collection holds.
-    fn file_object(path: &'static str) -> IUnknown {
-        let file = ICoreWebView2File::from(FakeFile { path });
-        match file.cast() {
-            Ok(unknown) => unknown,
-            Err(error) => panic!("a file must cast to IUnknown: {error}"),
-        }
-    }
-
-    #[test]
-    fn the_drop_message_string_is_read_back() {
-        let args = args_with(Some(DROP_MESSAGE), Vec::new());
-        assert_eq!(message_string(&args).as_deref(), Some(DROP_MESSAGE));
-    }
-
-    #[test]
-    fn a_non_string_message_reads_as_none() {
-        let args = args_with(None, Vec::new());
-        assert_eq!(message_string(&args), None);
-    }
-
-    #[test]
-    fn file_attachments_become_their_os_paths() {
-        let files = vec![
-            file_object(r"C:\Users\Vinnie\Documents\project"),
-            file_object(r"D:\src\notes.md"),
-        ];
-        let args = args_with(Some(DROP_MESSAGE), files);
-        assert_eq!(
-            dropped_paths(&args),
-            vec![
-                PathBuf::from(r"C:\Users\Vinnie\Documents\project"),
-                PathBuf::from(r"D:\src\notes.md"),
-            ]
-        );
-    }
-
-    #[test]
-    fn non_file_attachments_are_skipped() {
-        // The collection object itself is included as a non-file IUnknown.
-        let not_a_file: IUnknown = ICoreWebView2ObjectCollectionView::from(FakeObjects {
-            objects: Vec::new(),
-        })
-        .cast()
-        .unwrap_or_else(|error| panic!("a collection must cast to IUnknown: {error}"));
-        let objects = vec![not_a_file, file_object(r"C:\only\this\one.txt")];
-        let args = args_with(Some(DROP_MESSAGE), objects);
-        assert_eq!(
-            dropped_paths(&args),
-            vec![PathBuf::from(r"C:\only\this\one.txt")]
-        );
-    }
-
-    #[test]
-    fn a_message_with_no_attachments_yields_no_paths() {
-        let args = args_with(Some(DROP_MESSAGE), Vec::new());
-        assert!(dropped_paths(&args).is_empty());
-    }
-
-    #[test]
-    fn a_drop_message_defers_its_paths() {
-        let args = args_with(
-            Some(DROP_MESSAGE),
-            vec![file_object(r"C:\Users\Vinnie\Documents\project")],
-        );
-        let (tx, rx) = std::sync::mpsc::channel();
-        handle_web_message(&args, move |paths| {
-            tx.send(paths).expect("the test channel is open");
-        });
-        assert_eq!(
-            rx.recv().expect("the drop's paths were deferred"),
-            vec![PathBuf::from(r"C:\Users\Vinnie\Documents\project")]
-        );
-    }
-
-    #[test]
-    fn a_non_drop_message_defers_nothing() {
-        let args = args_with(Some("other-message"), vec![file_object(r"D:\src\notes.md")]);
-        let called = std::cell::Cell::new(false);
-        handle_web_message(&args, |_| called.set(true));
-        assert!(!called.get());
-    }
-
-    #[test]
-    fn a_drop_message_with_no_files_defers_nothing() {
-        let args = args_with(Some(DROP_MESSAGE), Vec::new());
-        let called = std::cell::Cell::new(false);
-        handle_web_message(&args, |_| called.set(true));
-        assert!(!called.get());
-    }
-}
diff --git a/crates/workshop/desktop/src/config.rs b/crates/workshop/desktop/src/config.rs
deleted file mode 100644
index c4e9493d8..000000000
--- a/crates/workshop/desktop/src/config.rs
+++ /dev/null
@@ -1,278 +0,0 @@
-//! The desktop app's workshop-server configuration: `workshop.toml` discovery,
-//! the forced ephemeral loopback bind, and the installation's Plugin
-//! directory.
-//!
-//! The desktop app runs the workshop server in-process, so the listener
-//! settings are the desktop app's own: the bind is always `127.0.0.1:0` (an
-//! OS-assigned port - a fixed port is a conflict class the
-//! single-instance handoff cannot close). A discovered `workshop.toml` still
-//! owns the `[gateway]` connection settings and the state and
-//! agent prompt paths; the gateway endpoint itself resolves inside the
-//! server, gateway discovery file first, explicit config second. A config
-//! that names no Plugin directory gets the installation's own, `plugins`
-//! where the installer lays it out: beside Workshop on Windows, and
-//! inside Workshop's bundle on macOS and Linux.
-
-use std::path::{Path, PathBuf};
-
-use anyhow::Context as _;
-use workshop_server_api::Config;
-
-/// Canonical file name searched for at each candidate location.
-const CONFIG_FILE_NAME: &str = "workshop.toml";
-
-/// The desktop app's listener bind: loopback on an OS-assigned port, reported
-/// back through the server handle once bound.
-const DESKTOP_BIND: &str = "127.0.0.1:0";
-
-/// Loads the desktop app's workshop-server configuration.
-///
-/// A `workshop.toml` found in the search order - beside the executable,
-/// then the current directory, then the user profile's `.runvil`
-/// directory - supplies the `[gateway]` connection and the path
-/// settings; the listener settings are forced to the desktop app's own. With
-/// no file, the default config anchors its state in the profile's
-/// `.runvil` directory and leaves the gateway to endpoint
-/// resolution, which attaches through the gateway discovery
-/// file or fails plainly.
-///
-/// Either way, a config that names no Plugin directory gets the
-/// installation's own.
-///
-/// # Errors
-/// Returns an error when a discovered file cannot be loaded or the
-/// executable or current directory cannot be determined.
-pub(crate) fn load() -> anyhow::Result<Config> {
-    let exe = std::env::current_exe().context("locate the executable")?;
-    let exe_dir = exe
-        .parent()
-        .context("the executable has no parent directory")?;
-    let cwd = std::env::current_dir().context("locate the current directory")?;
-    let appimage = workshop_server_api::discovery::running_appimage(
-        &exe,
-        std::env::var_os("APPIMAGE").as_deref(),
-        std::env::var_os("APPDIR").as_deref(),
-    );
-    let plugins = workshop_server_api::discovery::installed_plugin_dir(&exe, appimage.as_deref());
-    let mut config = load_in(exe_dir, &cwd, std::env::home_dir().as_deref())?;
-    name_plugin_dir(&mut config, plugins);
-    Ok(config)
-}
-
-/// The testable core of [`load`], with the three base directories
-/// injected. A missing home directory degrades to skipping the profile
-/// candidate and anchoring the no-file default at the current directory,
-/// matching `Config::parse`'s anchor degradation.
-fn load_in(exe_dir: &Path, cwd: &Path, home: Option<&Path>) -> anyhow::Result<Config> {
-    let candidates = candidates_from(exe_dir, cwd, home);
-    match first_existing(&candidates) {
-        Some(path) => {
-            let mut config =
-                Config::load(&path).with_context(|| format!("load {}", path.display()))?;
-            shape_for_desktop(&mut config);
-            Ok(config)
-        }
-        None => Ok(default_config(home)),
-    }
-}
-
-/// Gives `config` the installation's Plugin directory, `installed`, unless
-/// it names one of its own.
-fn name_plugin_dir(config: &mut Config, installed: Option<PathBuf>) {
-    if config.agents.plugins.is_none() {
-        config.agents.plugins = installed;
-    }
-}
-
-/// Builds the candidate list in search order from the three base
-/// directories.
-fn candidates_from(exe_dir: &Path, cwd: &Path, home: Option<&Path>) -> Vec<PathBuf> {
-    let mut candidates = vec![exe_dir.join(CONFIG_FILE_NAME), cwd.join(CONFIG_FILE_NAME)];
-    if let Some(home) = home {
-        candidates.push(profile_dir(home).join(CONFIG_FILE_NAME));
-    }
-    candidates
-}
-
-/// Returns the first candidate path that exists, if any.
-fn first_existing(candidates: &[PathBuf]) -> Option<PathBuf> {
-    candidates.iter().find(|path| path.is_file()).cloned()
-}
-
-/// The profile directory: `<home>/.runvil`.
-fn profile_dir(home: &Path) -> PathBuf {
-    home.join(".runvil")
-}
-
-/// Forces the listener settings the desktop app owns onto a loaded config: the
-/// ephemeral loopback bind.
-fn shape_for_desktop(config: &mut Config) {
-    config.server.bind = DESKTOP_BIND.to_string();
-}
-
-/// The no-file configuration: no explicit gateway (endpoint resolution
-/// attaches through the gateway discovery file or fails plainly), with the
-/// state and agent prompt paths anchored at the profile directory.
-fn default_config(home: Option<&Path>) -> Config {
-    let mut config = Config {
-        gateway: workshop_server_api::GatewayConfig {
-            base_url: String::new(),
-            api_key: String::new(),
-        },
-        server: workshop_server_api::ServerConfig {
-            bind: DESKTOP_BIND.to_string(),
-            state_dir: PathBuf::new(),
-        },
-        agents: workshop_server_api::AgentsConfig::default(),
-    };
-    let anchor = home.map_or_else(|| PathBuf::from("."), profile_dir);
-    config.anchor_path_defaults(&anchor);
-    config
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Three empty candidate roots under one tempdir.
-    fn roots() -> (tempfile::TempDir, PathBuf, PathBuf, PathBuf) {
-        let temp = tempfile::TempDir::new().expect("tempdir");
-        let exe = temp.path().join("exe");
-        let cwd = temp.path().join("cwd");
-        let home = temp.path().join("home");
-        std::fs::create_dir_all(&exe).expect("exe dir");
-        std::fs::create_dir_all(&cwd).expect("cwd dir");
-        std::fs::create_dir_all(profile_dir(&home)).expect("profile dir");
-        (temp, exe, cwd, home)
-    }
-
-    fn write(path: &Path, gateway_url: &str) {
-        std::fs::write(
-            path,
-            format!("[gateway]\nbase_url = \"{gateway_url}\"\napi_key = \"k\"\n"),
-        )
-        .expect("write fixture");
-    }
-
-    #[test]
-    fn candidates_are_ordered_exe_then_cwd_then_profile() {
-        let candidates = candidates_from(
-            Path::new("exe-dir"),
-            Path::new("cwd-dir"),
-            Some(Path::new("home-dir")),
-        );
-        assert_eq!(
-            candidates,
-            vec![
-                PathBuf::from("exe-dir/workshop.toml"),
-                PathBuf::from("cwd-dir/workshop.toml"),
-                PathBuf::from("home-dir/.runvil/workshop.toml"),
-            ]
-        );
-    }
-
-    #[test]
-    fn a_missing_home_skips_the_profile_candidate() {
-        let candidates = candidates_from(Path::new("exe-dir"), Path::new("cwd-dir"), None);
-        assert_eq!(candidates.len(), 2, "no profile candidate without a home");
-    }
-
-    #[test]
-    fn the_first_existing_candidate_wins() {
-        let (_temp, exe, cwd, home) = roots();
-        let in_cwd = cwd.join(CONFIG_FILE_NAME);
-        let in_home = profile_dir(&home).join(CONFIG_FILE_NAME);
-        write(&in_cwd, "http://cwd:1");
-        write(&in_home, "http://home:1");
-        let config = load_in(&exe, &cwd, Some(&home)).expect("loads");
-        assert_eq!(
-            config.gateway.base_url, "http://cwd:1",
-            "cwd beats the profile"
-        );
-
-        let in_exe = exe.join(CONFIG_FILE_NAME);
-        write(&in_exe, "http://exe:1");
-        let config = load_in(&exe, &cwd, Some(&home)).expect("loads");
-        assert_eq!(
-            config.gateway.base_url, "http://exe:1",
-            "beside the executable beats everything"
-        );
-    }
-
-    #[test]
-    fn a_discovered_file_keeps_its_gateway_and_paths_but_not_the_listener() {
-        let (_temp, exe, cwd, home) = roots();
-        let path = profile_dir(&home).join(CONFIG_FILE_NAME);
-        std::fs::write(
-            &path,
-            "[gateway]\nbase_url = \"http://gateway.lan:9999\"\napi_key = \"k\"\n\n\
-             [server]\nbind = \"127.0.0.1:7910\"\n",
-        )
-        .expect("write fixture");
-        let config = load_in(&exe, &cwd, Some(&home)).expect("the discovered file loads");
-        assert_eq!(config.gateway.base_url, "http://gateway.lan:9999");
-        assert_eq!(
-            config.server.bind, DESKTOP_BIND,
-            "the desktop app owns the listener: an OS-assigned loopback port"
-        );
-        assert_eq!(
-            config.server.state_dir,
-            profile_dir(&home),
-            "state anchors beside the discovered file"
-        );
-    }
-
-    #[test]
-    fn no_file_defaults_to_discovery_with_profile_anchored_state() {
-        let (_temp, exe, cwd, home) = roots();
-        let config = load_in(&exe, &cwd, Some(&home)).expect("the default config");
-        assert_eq!(
-            config.gateway.base_url, "",
-            "an empty base_url is the not-explicit signal resolution reads"
-        );
-        assert_eq!(config.server.bind, DESKTOP_BIND);
-        assert_eq!(config.server.state_dir, profile_dir(&home));
-        assert_eq!(config.agents.path, profile_dir(&home).join("agents"));
-    }
-
-    #[test]
-    fn a_config_that_names_no_plugin_directory_gets_the_installations() {
-        let (_temp, exe, cwd, home) = roots();
-        let installed = exe.join("plugins");
-        let mut config = load_in(&exe, &cwd, Some(&home)).expect("the default config");
-        assert_eq!(config.agents.plugins, None);
-        name_plugin_dir(&mut config, Some(installed.clone()));
-        assert_eq!(config.agents.plugins, Some(installed.clone()));
-
-        std::fs::write(
-            exe.join(CONFIG_FILE_NAME),
-            "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n\n[agents]\nplugins = \"mine\"\n",
-        )
-        .expect("write fixture");
-        let mut config = load_in(&exe, &cwd, Some(&home)).expect("the discovered file loads");
-        name_plugin_dir(&mut config, Some(installed));
-        assert_eq!(
-            config.agents.plugins,
-            Some(PathBuf::from("mine")),
-            "a Plugin directory the file names is kept"
-        );
-    }
-
-    #[test]
-    fn no_file_and_no_home_anchors_at_the_working_directory() {
-        let (_temp, exe, cwd, _home) = roots();
-        let config = load_in(&exe, &cwd, None).expect("the default config");
-        assert_eq!(config.server.state_dir, Path::new("."));
-    }
-
-    #[test]
-    fn a_malformed_discovered_file_is_an_error() {
-        let (_temp, exe, cwd, home) = roots();
-        std::fs::write(exe.join(CONFIG_FILE_NAME), "[gateway\n").expect("write fixture");
-        let error = load_in(&exe, &cwd, Some(&home)).expect_err("malformed TOML must fail");
-        assert!(
-            error.to_string().contains(CONFIG_FILE_NAME),
-            "the error names the file: {error}"
-        );
-    }
-}
diff --git a/crates/workshop/desktop/src/drops.rs b/crates/workshop/desktop/src/drops.rs
deleted file mode 100644
index 753f318a9..000000000
--- a/crates/workshop/desktop/src/drops.rs
+++ /dev/null
@@ -1,84 +0,0 @@
-//! The `runvil:file-drop` dispatch shared by both drop paths: the
-//! Windows WebView2 web-message bridge ([`crate::bridge`]) and Tauri's own
-//! drag-drop window event everywhere else.
-//!
-//! The page grants each path through the workspace HTTP API; the app never
-//! reads file bytes merely because a file was dragged onto the window.
-
-use std::path::{Path, PathBuf};
-
-/// Renders a dropped OS path for the browser event: the path's own text
-/// with any Windows verbatim (`\\?\`) prefix stripped, so the page hands
-/// the workspace API the same spelling Explorer shows. The verbatim UNC
-/// form (`\\?\UNC\server\share`) collapses to the plain UNC spelling
-/// (`\\server\share`). Separators stay native - the workspace server runs
-/// on this same machine and canonicalizes whatever it receives.
-#[must_use]
-fn normalize_dropped_path(path: &Path) -> String {
-    let text = path.to_string_lossy().into_owned();
-    if let Some(unc) = text.strip_prefix(r"\\?\UNC\") {
-        return format!(r"\\{unc}");
-    }
-    match text.strip_prefix(r"\\?\") {
-        Some(stripped) => stripped.to_owned(),
-        None => text,
-    }
-}
-
-/// Dispatches the `runvil:file-drop` event with the normalized
-/// dropped paths. The page listens for the event and grants each path
-/// through the workspace HTTP API.
-pub(crate) fn dispatch_file_drop(window: &tauri::WebviewWindow, paths: &[PathBuf]) {
-    let normalized: Vec<String> = paths
-        .iter()
-        .map(|path| normalize_dropped_path(path))
-        .collect();
-    let detail = match serde_json::to_string(&normalized) {
-        Ok(detail) => detail,
-        Err(error) => {
-            eprintln!("could not encode the dropped paths: {error}");
-            return;
-        }
-    };
-    let script = format!(
-        "window.dispatchEvent(new CustomEvent(\"runvil:file-drop\", {{detail: {{paths: {detail}}}}}));"
-    );
-    if let Err(error) = window.eval(&script) {
-        eprintln!("could not dispatch the file-drop event: {error}");
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::path::Path;
-
-    use super::normalize_dropped_path;
-
-    #[test]
-    fn dropped_paths_keep_backslashes_spaces_and_unicode() {
-        for path in [
-            r"C:\Users\Vinnie\Documents\project",
-            r"C:\Users\Vinnie\My Documents\file name.txt",
-            "C:\\Users\\Vinnie\\caf\u{e9} \u{4e2d}\u{6587}.txt",
-            r"D:\src\runvil\crates",
-        ] {
-            assert_eq!(normalize_dropped_path(Path::new(path)), path, "{path}");
-        }
-    }
-
-    #[test]
-    fn dropped_paths_shed_the_verbatim_prefix() {
-        assert_eq!(
-            normalize_dropped_path(Path::new(r"\\?\C:\Users\Vinnie\file.txt")),
-            r"C:\Users\Vinnie\file.txt"
-        );
-        assert_eq!(
-            normalize_dropped_path(Path::new("\\\\?\\D:\\src\\caf\u{e9}.txt")),
-            "D:\\src\\caf\u{e9}.txt"
-        );
-        assert_eq!(
-            normalize_dropped_path(Path::new(r"\\?\UNC\server\share\file.txt")),
-            r"\\server\share\file.txt"
-        );
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway.rs b/crates/workshop/desktop/src/gateway.rs
deleted file mode 100644
index 26fb360d4..000000000
--- a/crates/workshop/desktop/src/gateway.rs
+++ /dev/null
@@ -1,29 +0,0 @@
-//! Attach-or-launch lifecycle for the desktop app's Gateway sidecar.
-//!
-//! The sidecar is the local `runvil-gateway` process found through
-//! its gateway discovery file or launched detached beside the desktop app.
-//! An explicit `workshop.toml` `[gateway]` endpoint is not a sidecar and
-//! gets no supervision.
-//!
-//! Boot planning and detached spawn (`boot`), validated identity
-//! (`identity`), and launch-and-wait plus continuous supervision
-//! (`supervisor`) are private sibling modules whose imports run both
-//! ways. `boot` and `supervisor` import each other: boot launches through
-//! the supervisor's cancellable launch-and-wait and authenticates the
-//! child as its `RecoveryCandidate`, and the supervisor relaunches
-//! through boot's sibling lookup and detached spawn. `identity` and
-//! `supervisor` import each other too: `GatewayAttachment` wraps that
-//! candidate, and recovery compares processes with
-//! `same_gateway_identity`. `boot` also returns `identity`'s
-//! `GatewayAttachment`, and `identity` never imports `boot`.
-
-mod boot;
-mod identity;
-mod supervisor;
-
-pub(crate) use boot::ensure_gateway;
-pub(crate) use identity::GatewayAttachment;
-pub(crate) use supervisor::{GatewaySupervisor, SupervisorShutdown, supervise};
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/desktop/src/gateway/boot.rs b/crates/workshop/desktop/src/gateway/boot.rs
deleted file mode 100644
index bd1e89e62..000000000
--- a/crates/workshop/desktop/src/gateway/boot.rs
+++ /dev/null
@@ -1,256 +0,0 @@
-//! Boot planning and detached Gateway spawn.
-
-use std::path::{Path, PathBuf};
-use std::process::ExitStatus;
-use std::sync::{Arc, OnceLock};
-
-use anyhow::Context as _;
-use workshop_server_api::Config;
-use workshop_server_api::discovery::{
-    CancellationToken, GatewayDiscoveryFile, Resolution, SidecarError, ValidatedConnection,
-};
-
-use super::identity::GatewayAttachment;
-use super::supervisor::{RecoveryCandidate, RecoveryOwnership, launch_and_attach_cancellable};
-
-/// The Gateway executable's file name, which test fixtures plant.
-#[cfg(all(test, windows))]
-pub(super) const GATEWAY_EXE_NAME: &str = "runvil-gateway.exe";
-/// The Gateway executable's file name, which test fixtures plant.
-#[cfg(all(test, not(windows)))]
-pub(super) const GATEWAY_EXE_NAME: &str = "runvil-gateway";
-
-#[cfg(windows)]
-const CREATE_BREAKAWAY_FROM_JOB: u32 = 0x0100_0000;
-#[cfg(windows)]
-const CREATE_NEW_PROCESS_GROUP: u32 = 0x0000_0200;
-#[cfg(windows)]
-const DETACHED_PROCESS: u32 = 0x0000_0008;
-#[cfg(windows)]
-const WINDOWS_DETACHED_CREATION_FLAGS: u32 = CREATE_NEW_PROCESS_GROUP | DETACHED_PROCESS;
-#[cfg(windows)]
-const WINDOWS_BREAKAWAY_CREATION_FLAGS: u32 =
-    CREATE_BREAKAWAY_FROM_JOB | WINDOWS_DETACHED_CREATION_FLAGS;
-
-/// What the boot decision concluded.
-#[derive(Debug, PartialEq, Eq)]
-pub(super) enum GatewayPlan {
-    /// A live gateway discovery file exists.
-    Attach(GatewayDiscoveryFile),
-    /// No live file exists and an installed Gateway can be launched.
-    Launch(PathBuf),
-    /// Explicit configuration is the only available endpoint.
-    ConfigOnly,
-    /// No attachment path exists.
-    Fail,
-}
-
-/// The result of a launch election, retaining the spawned pid only for the
-/// branch that actually created a child.
-#[derive(Debug)]
-pub(super) enum RecoveryLaunch {
-    /// A race winner had already published a live Gateway.
-    Attached(GatewayDiscoveryFile),
-    /// This process spawned a child and observed a gateway discovery file.
-    Launched {
-        child_pid: u32,
-        file: GatewayDiscoveryFile,
-    },
-}
-
-/// Connects the Gateway for boot.
-///
-/// # Errors
-/// Returns an error when no attachment path exists or launch fails.
-pub(crate) fn ensure_gateway(config: &Config) -> anyhow::Result<GatewayAttachment> {
-    let installed = installed_gateway()?;
-    let explicit = !config.gateway.base_url.is_empty();
-    let Some(run_dir) = workshop_server_api::discovery::default_run_dir() else {
-        return if explicit {
-            Ok(GatewayAttachment::Config)
-        } else {
-            Err(no_gateway_error())
-        };
-    };
-    match plan_gateway(
-        &run_dir,
-        installed,
-        explicit,
-        workshop_server_api::discovery::resolve,
-    ) {
-        GatewayPlan::Attach(file) => validated_attachment(file),
-        GatewayPlan::ConfigOnly => Ok(GatewayAttachment::Config),
-        GatewayPlan::Fail => Err(no_gateway_error()),
-        GatewayPlan::Launch(exe) => {
-            if sibling_is_placeholder(&exe) {
-                return Err(placeholder_gateway_error(&exe));
-            }
-            launch_and_attach_cancellable(&run_dir, &exe, &CancellationToken::new())
-                .and_then(validated_recovery_attachment)
-                .context("launch the sidecar gateway")
-        }
-    }
-}
-
-/// Retains the selected process proof instead of reducing it to file fields.
-fn validated_attachment(file: GatewayDiscoveryFile) -> anyhow::Result<GatewayAttachment> {
-    ValidatedConnection::validate(file)
-        .map(GatewayAttachment::Sidecar)
-        .context("validate the selected gateway process identity")
-}
-
-fn validated_recovery_attachment(recovery: RecoveryLaunch) -> anyhow::Result<GatewayAttachment> {
-    match recovery {
-        RecoveryLaunch::Attached(file) => validated_attachment(file),
-        RecoveryLaunch::Launched { child_pid, file } => {
-            let validated = ValidatedConnection::validate(file)
-                .context("validate the launched gateway process identity")?;
-            Ok(
-                match RecoveryCandidate::authenticate(child_pid, validated) {
-                    RecoveryOwnership::Owned(candidate) => GatewayAttachment::Launched(candidate),
-                    RecoveryOwnership::Unowned(unowned) => GatewayAttachment::Sidecar(unowned),
-                },
-            )
-        }
-    }
-}
-
-/// Chooses attach, launch, configured fallback, or failure.
-pub(super) fn plan_gateway(
-    run_dir: &Path,
-    installed: Option<PathBuf>,
-    explicit_config: bool,
-    resolve: fn(&Path) -> Result<Resolution, SidecarError>,
-) -> GatewayPlan {
-    match resolve(run_dir) {
-        Ok(Resolution::Attach(file)) => return GatewayPlan::Attach(file),
-        Ok(_) => {}
-        Err(error) => {
-            eprintln!("could not resolve the gateway discovery file: {error}");
-        }
-    }
-    match installed {
-        Some(exe) => GatewayPlan::Launch(exe),
-        None if explicit_config => GatewayPlan::ConfigOnly,
-        None => GatewayPlan::Fail,
-    }
-}
-
-/// Locates the installed Gateway for the running Workshop: beside it on
-/// Windows and in development, as the sibling `Runvil Gateway.app` on
-/// macOS, and beside `Runvil.AppImage` on Linux, where Workshop runs from
-/// the AppImage's mount.
-///
-/// # Errors
-/// Returns an error when the executable path cannot be read.
-pub(super) fn installed_gateway() -> anyhow::Result<Option<PathBuf>> {
-    let exe = std::env::current_exe().context("locate the executable")?;
-    let appimage = workshop_server_api::discovery::running_appimage(
-        &exe,
-        std::env::var_os("APPIMAGE").as_deref(),
-        std::env::var_os("APPDIR").as_deref(),
-    );
-    Ok(workshop_server_api::discovery::installed_gateway(
-        &exe,
-        appimage.as_deref(),
-    ))
-}
-
-/// The text `tools/fetch-gateway-sidecar.mjs --stub` writes, and the only
-/// content a file may hold and still be called a Gateway. Checked before a
-/// launch because Windows answers a text file with "This version of %1 is
-/// not compatible with the version of Windows you're running" and no clue
-/// which file was at fault.
-const STUB_PREFIX: &str = "This is a placeholder staged by";
-
-/// Whether the installed Gateway is a compile-only stub rather than an
-/// executable. A real Gateway starts with `MZ` on Windows and something
-/// other than this text everywhere else, so a byte-prefix compare is the
-/// whole test.
-pub(super) fn sibling_is_placeholder(exe: &Path) -> bool {
-    use std::io::Read as _;
-    let Ok(mut file) = std::fs::File::open(exe) else {
-        return false;
-    };
-    let mut prefix = vec![0_u8; STUB_PREFIX.len()];
-    let Ok(read) = file.read(&mut prefix) else {
-        return false;
-    };
-    prefix.truncate(read);
-    prefix == STUB_PREFIX.as_bytes()
-}
-
-/// The failure for a stub sidecar, naming the file and the one command that
-/// replaces it with a runnable Gateway.
-pub(super) fn placeholder_gateway_error(exe: &Path) -> anyhow::Error {
-    anyhow::anyhow!(
-        "the gateway beside this program is a compile-only stub, not an executable: {}; \
-         run `node tools/fetch-gateway-sidecar.mjs` from the repository root to stage the \
-         pinned Gateway release, then rebuild",
-        exe.display()
-    )
-}
-
-/// Builds the loud boot failure naming both supported remedies.
-pub(super) fn no_gateway_error() -> anyhow::Error {
-    anyhow::anyhow!(
-        "no gateway configured or running; install the Gateway component, which \
-         puts runvil-gateway where Workshop looks for it (in a development tree, \
-         build with `cargo workshop`, which places it beside Workshop), or set \
-         gateway.base_url and gateway.api_key in workshop.toml to attach to \
-         a gateway over the network"
-    )
-}
-
-#[cfg(windows)]
-pub(super) fn spawn_detached_windows_with<T, Spawn>(mut spawn: Spawn) -> std::io::Result<T>
-where
-    Spawn: FnMut(u32) -> std::io::Result<T>,
-{
-    match spawn(WINDOWS_BREAKAWAY_CREATION_FLAGS) {
-        Err(error) if error.kind() == std::io::ErrorKind::PermissionDenied => {
-            // Hosted runners can forbid breakaway from their job object.
-            // https://github.com/actions/runner/issues/595
-            spawn(WINDOWS_DETACHED_CREATION_FLAGS)
-        }
-        result => result,
-    }
-}
-
-fn detached_command(exe: &Path) -> std::process::Command {
-    let mut command = std::process::Command::new(exe);
-    command
-        .stdin(std::process::Stdio::null())
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null());
-    command
-}
-
-/// Spawns the Gateway detached from the desktop app's lifetime. The reaper
-/// thread records the child's exit status in `exit`, so a launch wait can
-/// stop as soon as the child dies instead of running out its budget.
-pub(super) fn spawn_detached(exe: &Path, exit: Arc<OnceLock<ExitStatus>>) -> std::io::Result<u32> {
-    #[cfg(windows)]
-    let mut child = spawn_detached_windows_with(|flags| {
-        use std::os::windows::process::CommandExt as _;
-        detached_command(exe).creation_flags(flags).spawn()
-    })?;
-    #[cfg(unix)]
-    let mut child = {
-        use std::os::unix::process::CommandExt as _;
-        let mut command = detached_command(exe);
-        command.process_group(0);
-        command.spawn()?
-    };
-    #[cfg(not(any(windows, unix)))]
-    let mut child = detached_command(exe).spawn()?;
-    let child_pid = child.id();
-    if let Err(error) = std::thread::Builder::new().spawn(move || {
-        if let Ok(status) = child.wait() {
-            let _ = exit.set(status);
-        }
-    }) {
-        eprintln!("could not spawn the gateway reaper thread; the child goes unreaped: {error}");
-    }
-    Ok(child_pid)
-}
diff --git a/crates/workshop/desktop/src/gateway/identity.rs b/crates/workshop/desktop/src/gateway/identity.rs
deleted file mode 100644
index 57e889ac1..000000000
--- a/crates/workshop/desktop/src/gateway/identity.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! Local Gateway attachment and validated process identity.
-
-use workshop_server_api::discovery::ValidatedConnection;
-
-use super::supervisor::RecoveryCandidate;
-
-/// How boot connected the Gateway.
-#[derive(Debug)]
-pub(crate) enum GatewayAttachment {
-    /// A local sidecar Gateway the desktop app attached to.
-    Sidecar(ValidatedConnection),
-    /// A child launched by this boot that has not yet entered server state.
-    Launched(RecoveryCandidate),
-    /// An explicit-config Gateway that the desktop app does not own.
-    Config,
-}
-
-impl GatewayAttachment {
-    /// Returns the validated sidecar identity, when the Gateway is local.
-    pub(crate) fn sidecar_identity(&self) -> Option<&ValidatedConnection> {
-        match self {
-            Self::Sidecar(identity) => Some(identity),
-            Self::Launched(candidate) => Some(candidate.validated()),
-            Self::Config => None,
-        }
-    }
-
-    /// Reconciles the desktop app's candidate with the identity the server actually
-    /// published, disarming launched-child cleanup only for an exact match.
-    pub(crate) fn reconcile_publication(self, published: Option<ValidatedConnection>) -> Self {
-        match (self, published) {
-            (Self::Launched(mut candidate), Some(published))
-                if candidate.validated().same_boot(&published) =>
-            {
-                candidate.mark_published();
-                Self::Launched(candidate)
-            }
-            (_, Some(published)) => Self::Sidecar(published),
-            (_, None) => Self::Config,
-        }
-    }
-}
-
-/// Whether two capabilities prove the same Gateway process boot.
-pub(super) fn same_gateway_identity(
-    left: &ValidatedConnection,
-    right: &ValidatedConnection,
-) -> bool {
-    left.same_boot(right)
-}
diff --git a/crates/workshop/desktop/src/gateway/supervisor.rs b/crates/workshop/desktop/src/gateway/supervisor.rs
deleted file mode 100644
index 3264b162c..000000000
--- a/crates/workshop/desktop/src/gateway/supervisor.rs
+++ /dev/null
@@ -1,232 +0,0 @@
-//! Continuous local Gateway supervision and recovery.
-
-use std::time::Duration;
-
-use anyhow::Context as _;
-use workshop_server_api::discovery::{
-    CancellationToken, Resolution, SidecarError, ValidatedConnection,
-};
-
-use super::boot;
-use super::identity::GatewayAttachment;
-
-mod launch;
-mod lifecycle;
-mod recovery;
-mod signals;
-
-#[cfg(test)]
-pub(super) use launch::{
-    RECOVERY_POLL_INTERVAL, SystemClock, WaitClock, launch_and_attach_cancellable_with,
-    run_effect_if_active, wait_for_launched_file_cancellable_with,
-};
-#[cfg(test)]
-pub(super) use lifecycle::SUPERVISOR_SHUTDOWN_BUDGET;
-pub(crate) use lifecycle::{GatewaySupervisor, SupervisorShutdown};
-use recovery::RecoveryIdentity;
-pub(in crate::gateway) use recovery::{RecoveryCandidate, RecoveryOwnership};
-
-pub(super) use launch::launch_and_attach_cancellable;
-
-/// Healthy-sidecar supervision cadence.
-const SUPERVISION_INTERVAL: Duration = Duration::from_secs(5);
-
-/// First delay after a failed re-resolution or relaunch.
-const SUPERVISION_BASE_DELAY: Duration = Duration::from_millis(250);
-
-/// Ceiling on repeated sidecar recovery attempts.
-pub(super) const SUPERVISION_MAX_DELAY: Duration = Duration::from_secs(30);
-
-/// One sidecar liveness observation.
-pub(super) enum SupervisionProbe<Identity> {
-    /// Another process already published a live replacement.
-    Replacement(Identity),
-    /// No live local Gateway is currently discoverable.
-    Missing,
-}
-
-/// A validated identity retained across supervision classifications.
-pub(super) trait SupervisedGatewayIdentity {
-    /// Whether both values prove the same process boot.
-    fn same_boot(&self, other: &Self) -> bool;
-
-    /// Disarms cleanup after this identity becomes authoritative.
-    fn publication_succeeded(&mut self) {}
-
-    /// Shuts down an unpublished owned child through the explicit,
-    /// error-reporting path. Identities that own no child do nothing.
-    fn shutdown_unpublished(self)
-    where
-        Self: Sized,
-    {
-    }
-}
-
-/// Starts runtime supervision only for a gateway discovery file sidecar.
-///
-/// # Errors
-/// Returns an error when the supervisor cannot locate its runtime paths or
-/// spawn its owned thread.
-pub(crate) fn supervise(
-    attachment: &GatewayAttachment,
-    updater: workshop_server_api::GatewayUpdater,
-) -> anyhow::Result<Option<GatewaySupervisor>> {
-    let Some(initial) = attachment.sidecar_identity().cloned() else {
-        return Ok(None);
-    };
-    let run_dir = workshop_server_api::discovery::default_run_dir()
-        .context("locate the sidecar run directory")?;
-    let sibling = boot::installed_gateway()?;
-    let supervisor_publication = updater.clone();
-    GatewaySupervisor::spawn_with_publication(supervisor_publication, move |cancellation| {
-        run_supervision(
-            RecoveryIdentity::Stable(initial),
-            |_, cancellation| match workshop_server_api::discovery::resolve_cancellable(
-                &run_dir,
-                cancellation,
-            ) {
-                Ok(Resolution::Attach(file)) => {
-                    match ValidatedConnection::validate_cancellable(file, cancellation) {
-                        Ok(identity) => {
-                            SupervisionProbe::Replacement(RecoveryIdentity::Stable(identity))
-                        }
-                        Err(error) => {
-                            eprintln!("could not retain the replacement gateway identity: {error}");
-                            SupervisionProbe::Missing
-                        }
-                    }
-                }
-                Ok(_) | Err(SidecarError::Canceled) => SupervisionProbe::Missing,
-                Err(error) => {
-                    eprintln!("could not re-resolve the local gateway: {error}");
-                    SupervisionProbe::Missing
-                }
-            },
-            |cancellation| {
-                let exe = sibling.as_deref().context(
-                    "the local gateway disappeared and no gateway executable is installed",
-                )?;
-                let recovery = launch_and_attach_cancellable(&run_dir, exe, cancellation)?;
-                validate_recovery(recovery, cancellation)
-            },
-            |identity, cancellation| {
-                if cancellation.is_canceled() {
-                    anyhow::bail!("gateway publication was canceled");
-                }
-                if updater.publication_closed() {
-                    anyhow::bail!("gateway publication is closed");
-                }
-                if updater
-                    .replace_sidecar_cancellable(identity.validated(), cancellation)
-                    .context("publish the replacement gateway endpoint")?
-                {
-                    Ok(())
-                } else {
-                    anyhow::bail!("gateway publication was canceled")
-                }
-            },
-            |delay, cancellation| cancellation.wait_timeout(delay),
-            &cancellation,
-        );
-    })
-    .map(Some)
-}
-
-/// Validates a recovery result and authenticates child ownership by exact pid.
-pub(super) fn validate_recovery(
-    recovery: boot::RecoveryLaunch,
-    cancellation: &CancellationToken,
-) -> anyhow::Result<RecoveryIdentity> {
-    let (child_pid, file) = match recovery {
-        boot::RecoveryLaunch::Attached(file) => (None, file),
-        boot::RecoveryLaunch::Launched { child_pid, file } => (Some(child_pid), file),
-    };
-    let validated = ValidatedConnection::validate_cancellable(file, cancellation)
-        .context("retain the recovered gateway identity")?;
-    Ok(match child_pid {
-        Some(child_pid) => match RecoveryCandidate::authenticate(child_pid, validated) {
-            RecoveryOwnership::Owned(candidate) => RecoveryIdentity::Candidate(candidate),
-            RecoveryOwnership::Unowned(unowned) => RecoveryIdentity::Stable(unowned),
-        },
-        None => RecoveryIdentity::Stable(validated),
-    })
-}
-
-/// Runs the supervision state machine with I/O injected for tests.
-pub(super) fn run_supervision<Identity, Probe, Recover, Publish, Wait, Error>(
-    mut current: Identity,
-    mut probe: Probe,
-    mut recover: Recover,
-    mut publish: Publish,
-    mut wait: Wait,
-    cancellation: &CancellationToken,
-) where
-    Identity: SupervisedGatewayIdentity,
-    Probe: FnMut(&Identity, &CancellationToken) -> SupervisionProbe<Identity>,
-    Recover: FnMut(&CancellationToken) -> Result<Identity, Error>,
-    Publish: FnMut(&Identity, &CancellationToken) -> Result<(), Error>,
-    Wait: FnMut(Duration, &CancellationToken) -> bool,
-    Error: std::fmt::Display,
-{
-    let mut retry_delay = SUPERVISION_BASE_DELAY;
-    loop {
-        if cancellation.is_canceled() {
-            return;
-        }
-        let observation = probe(&current, cancellation);
-        if cancellation.is_canceled() {
-            return;
-        }
-        match observation {
-            SupervisionProbe::Replacement(identity) if identity.same_boot(&current) => {
-                retry_delay = SUPERVISION_BASE_DELAY;
-                if wait(SUPERVISION_INTERVAL, cancellation) {
-                    return;
-                }
-                continue;
-            }
-            SupervisionProbe::Replacement(mut identity) => match publish(&identity, cancellation) {
-                Ok(()) => {
-                    identity.publication_succeeded();
-                    if cancellation.is_canceled() {
-                        return;
-                    }
-                    current = identity;
-                    retry_delay = SUPERVISION_BASE_DELAY;
-                    continue;
-                }
-                Err(error) => {
-                    eprintln!("could not publish a replacement local gateway: {error}");
-                }
-            },
-            SupervisionProbe::Missing => match recover(cancellation) {
-                Ok(_) if cancellation.is_canceled() => return,
-                Ok(mut identity) => match publish(&identity, cancellation) {
-                    Ok(()) => {
-                        identity.publication_succeeded();
-                        if cancellation.is_canceled() {
-                            return;
-                        }
-                        current = identity;
-                        retry_delay = SUPERVISION_BASE_DELAY;
-                        continue;
-                    }
-                    Err(error) => {
-                        eprintln!("could not publish a replacement local gateway: {error}");
-                        // A recovered child this process launched stays
-                        // unpublished, so it is shut down through the
-                        // explicit, error-reporting path.
-                        identity.shutdown_unpublished();
-                    }
-                },
-                Err(error) => {
-                    eprintln!("could not recover the local gateway: {error}");
-                }
-            },
-        }
-        if cancellation.is_canceled() || wait(retry_delay, cancellation) {
-            return;
-        }
-        retry_delay = retry_delay.saturating_mul(2).min(SUPERVISION_MAX_DELAY);
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway/supervisor/launch.rs b/crates/workshop/desktop/src/gateway/supervisor/launch.rs
deleted file mode 100644
index ffe36562a..000000000
--- a/crates/workshop/desktop/src/gateway/supervisor/launch.rs
+++ /dev/null
@@ -1,237 +0,0 @@
-//! Cancellable launch and readiness wait, shared by boot and recovery.
-
-use std::path::Path;
-use std::process::ExitStatus;
-use std::sync::{Arc, OnceLock};
-use std::time::{Duration, Instant};
-
-use anyhow::Context as _;
-use workshop_server_api::discovery::{
-    CancellationToken, GatewayDiscoveryFile, LaunchDecision, Resolution, SidecarError,
-};
-
-use super::boot;
-
-/// Budget for the launch-race and readiness phases.
-const RECOVERY_TIMEOUT: Duration = Duration::from_secs(30);
-
-/// Delay between readiness polls.
-pub(in crate::gateway) const RECOVERY_POLL_INTERVAL: Duration = Duration::from_millis(25);
-
-/// Longest single health probe, so a discovery file rewritten while a
-/// probe is failing is read again well before the readiness budget ends.
-const HEALTH_PROBE_WINDOW: Duration = Duration::from_millis(250);
-
-/// The readiness wait's only source of time.
-pub(in crate::gateway) trait WaitClock {
-    /// The current instant.
-    fn now(&self) -> Instant;
-
-    /// Pauses for `delay`, returning `true` when `cancellation` fires first.
-    fn pause(&self, delay: Duration, cancellation: &CancellationToken) -> bool;
-}
-
-/// The monotonic clock and the token's own timed wait.
-pub(in crate::gateway) struct SystemClock;
-
-impl WaitClock for SystemClock {
-    fn now(&self) -> Instant {
-        Instant::now()
-    }
-
-    fn pause(&self, delay: Duration, cancellation: &CancellationToken) -> bool {
-        cancellation.wait_timeout(delay)
-    }
-}
-
-/// Settles and performs a cancellable launch. Boot passes a token that is
-/// never canceled.
-pub(in crate::gateway) fn launch_and_attach_cancellable(
-    run_dir: &Path,
-    exe: &Path,
-    cancellation: &CancellationToken,
-) -> anyhow::Result<boot::RecoveryLaunch> {
-    let exit = Arc::new(OnceLock::new());
-    launch_and_attach_cancellable_with(
-        run_dir,
-        exe,
-        cancellation,
-        workshop_server_api::discovery::launch_or_attach_cancellable,
-        |exe, _| boot::spawn_detached(exe, Arc::clone(&exit)),
-        |run_dir, timeout, cancellation| {
-            wait_for_launched_file_cancellable(run_dir, timeout, cancellation, || {
-                exit.get().copied()
-            })
-        },
-    )
-}
-
-/// Launch with each blocking phase injected.
-pub(in crate::gateway) fn launch_and_attach_cancellable_with<Settle, Spawn, Wait>(
-    run_dir: &Path,
-    exe: &Path,
-    cancellation: &CancellationToken,
-    settle: Settle,
-    spawn: Spawn,
-    wait: Wait,
-) -> anyhow::Result<boot::RecoveryLaunch>
-where
-    Settle: FnOnce(&Path, Duration, &CancellationToken) -> Result<LaunchDecision, SidecarError>,
-    Spawn: FnOnce(&Path, &CancellationToken) -> std::io::Result<u32>,
-    Wait: FnOnce(&Path, Duration, &CancellationToken) -> anyhow::Result<GatewayDiscoveryFile>,
-{
-    match settle(run_dir, RECOVERY_TIMEOUT, cancellation)
-        .context("settle the gateway launch race")?
-    {
-        LaunchDecision::Attach(file) => {
-            if cancellation.is_canceled() {
-                anyhow::bail!("gateway attachment was canceled");
-            }
-            Ok(boot::RecoveryLaunch::Attached(file))
-        }
-        LaunchDecision::Launch(lock) => {
-            let child_pid = run_effect_if_active(cancellation, "gateway launch", |cancellation| {
-                if cancellation.is_canceled() {
-                    anyhow::bail!("gateway launch was canceled");
-                }
-                spawn(exe, cancellation).with_context(|| format!("spawn {}", exe.display()))
-            })?;
-            let file = wait(run_dir, RECOVERY_TIMEOUT, cancellation)?;
-            drop(lock);
-            Ok(boot::RecoveryLaunch::Launched { child_pid, file })
-        }
-        decision => anyhow::bail!("an unknown launch decision: {decision:?}"),
-    }
-}
-
-/// Linearizes one externally visible recovery effect with cancellation.
-pub(in crate::gateway) fn run_effect_if_active<T>(
-    cancellation: &CancellationToken,
-    phase: &'static str,
-    operation: impl FnOnce(&CancellationToken) -> anyhow::Result<T>,
-) -> anyhow::Result<T> {
-    match cancellation.run_if_active(|| operation(cancellation)) {
-        Some(result) => result,
-        None => anyhow::bail!("{phase} was canceled"),
-    }
-}
-
-/// Waits for a launched Gateway with production probes.
-fn wait_for_launched_file_cancellable(
-    run_dir: &Path,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-    exited: impl FnMut() -> Option<ExitStatus>,
-) -> anyhow::Result<GatewayDiscoveryFile> {
-    wait_for_launched_file_cancellable_with(
-        run_dir,
-        timeout,
-        cancellation,
-        &SystemClock,
-        workshop_server_api::discovery::wait_for_health_cancellable,
-        workshop_server_api::discovery::resolve_cancellable,
-        exited,
-    )
-}
-
-/// Readiness wait with time, health, validation, and the launched child's
-/// exit status injected. A failed probe does not end the wait; the budget
-/// does, reporting the last probe error. A child that has exited ends the
-/// wait at once when no discovery file exists, naming the gateway log.
-pub(in crate::gateway) fn wait_for_launched_file_cancellable_with<Clock, Health, Resolve, Exited>(
-    run_dir: &Path,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-    clock: &Clock,
-    mut health: Health,
-    mut resolve: Resolve,
-    mut exited: Exited,
-) -> anyhow::Result<GatewayDiscoveryFile>
-where
-    Clock: WaitClock,
-    Health: FnMut(
-        &str,
-        Duration,
-        &CancellationToken,
-    ) -> Result<(), workshop_server_api::discovery::HealthError>,
-    Resolve: FnMut(&Path, &CancellationToken) -> Result<Resolution, SidecarError>,
-    Exited: FnMut() -> Option<ExitStatus>,
-{
-    let deadline = clock.now() + timeout;
-    let mut last_probe_error = None;
-    loop {
-        if cancellation.is_canceled() {
-            anyhow::bail!("the launched gateway wait was canceled");
-        }
-        // Sampled before the read: a launched gateway that hands off to a
-        // running owner exits only after the owner publishes, so the read
-        // below sees the owner's file.
-        let exit = exited();
-        if let Ok(Some(file)) = GatewayDiscoveryFile::read(run_dir) {
-            let remaining = deadline.saturating_duration_since(clock.now());
-            let url = format!("http://127.0.0.1:{}", file.port);
-            match health(&url, remaining.min(HEALTH_PROBE_WINDOW), cancellation) {
-                Ok(()) => {
-                    if cancellation.is_canceled() {
-                        anyhow::bail!("the launched gateway wait was canceled");
-                    }
-                    match resolve(run_dir, cancellation) {
-                        Ok(Resolution::Attach(validated)) => {
-                            if cancellation.is_canceled() {
-                                anyhow::bail!("the launched gateway wait was canceled");
-                            }
-                            return Ok(validated);
-                        }
-                        Err(SidecarError::Canceled) => {
-                            anyhow::bail!("the launched gateway wait was canceled");
-                        }
-                        Ok(Resolution::Stale(reason)) => {
-                            last_probe_error =
-                                Some(anyhow::Error::new(reason).context(
-                                    "the launched gateway discovery file failed validation",
-                                ));
-                        }
-                        Err(error) => {
-                            last_probe_error = Some(
-                                anyhow::Error::new(error)
-                                    .context("resolve the launched gateway discovery file"),
-                            );
-                        }
-                        Ok(_) => {}
-                    }
-                }
-                Err(workshop_server_api::discovery::HealthError::Canceled) => {
-                    anyhow::bail!("the launched gateway wait was canceled");
-                }
-                Err(error) => {
-                    last_probe_error = Some(
-                        anyhow::Error::new(error)
-                            .context("the launched gateway did not answer its health probe"),
-                    );
-                }
-            }
-        } else if let Some(status) = exit {
-            let state_dir = run_dir.parent().unwrap_or(run_dir);
-            anyhow::bail!(
-                "the launched gateway exited ({status}) without writing a gateway discovery \
-                 file; see the gateway log at {}",
-                workshop_server_api::discovery::gateway_log_path(state_dir).display()
-            );
-        }
-        if cancellation.is_canceled() {
-            anyhow::bail!("the launched gateway wait was canceled");
-        }
-        if clock.now() >= deadline {
-            let failure = format!(
-                "the launched gateway wrote no validated gateway discovery file within {timeout:?}"
-            );
-            return Err(match last_probe_error {
-                Some(error) => error.context(failure),
-                None => anyhow::anyhow!(failure),
-            });
-        }
-        if clock.pause(RECOVERY_POLL_INTERVAL, cancellation) {
-            anyhow::bail!("the launched gateway wait was canceled");
-        }
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway/supervisor/lifecycle.rs b/crates/workshop/desktop/src/gateway/supervisor/lifecycle.rs
deleted file mode 100644
index 6eb41e47f..000000000
--- a/crates/workshop/desktop/src/gateway/supervisor/lifecycle.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//! Supervisor thread lifecycle and bounded shutdown.
-
-use std::time::{Duration, Instant};
-
-use anyhow::Context as _;
-use workshop_server_api::discovery::CancellationToken;
-
-use super::signals::{Completion, StopSignal};
-
-/// Maximum designed supervisor shutdown latency.
-pub(in crate::gateway) const SUPERVISOR_SHUTDOWN_BUDGET: Duration = Duration::from_secs(3);
-
-/// The running local-sidecar supervisor.
-#[derive(Debug)]
-pub(crate) struct GatewaySupervisor {
-    stop: StopSignal,
-    completion: Completion,
-    stop_bridge_completion: Completion,
-    thread: Option<std::thread::JoinHandle<()>>,
-    stop_bridge: Option<std::thread::JoinHandle<()>>,
-    publication: Option<workshop_server_api::GatewayUpdater>,
-    shutdown_budget: Duration,
-}
-
-/// How bounded supervisor shutdown ended.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum SupervisorShutdown {
-    /// The worker completed and joined normally.
-    Joined,
-    /// The worker completed but panicked.
-    Panicked,
-    /// The deadline elapsed, so the worker handle was detached.
-    Detached,
-}
-
-impl GatewaySupervisor {
-    /// Spawns one owned supervisor thread.
-    #[cfg(test)]
-    pub(in crate::gateway) fn spawn(
-        supervise: impl FnOnce(CancellationToken) + Send + 'static,
-    ) -> anyhow::Result<Self> {
-        Self::spawn_inner(None, SUPERVISOR_SHUTDOWN_BUDGET, supervise)
-    }
-
-    pub(in crate::gateway) fn spawn_with_publication(
-        publication: workshop_server_api::GatewayUpdater,
-        supervise: impl FnOnce(CancellationToken) + Send + 'static,
-    ) -> anyhow::Result<Self> {
-        Self::spawn_inner(Some(publication), SUPERVISOR_SHUTDOWN_BUDGET, supervise)
-    }
-
-    #[cfg(test)]
-    pub(in crate::gateway) fn spawn_with_budget(
-        shutdown_budget: Duration,
-        supervise: impl FnOnce(CancellationToken) + Send + 'static,
-    ) -> anyhow::Result<Self> {
-        Self::spawn_inner(None, shutdown_budget, supervise)
-    }
-
-    fn spawn_inner(
-        publication: Option<workshop_server_api::GatewayUpdater>,
-        shutdown_budget: Duration,
-        supervise: impl FnOnce(CancellationToken) + Send + 'static,
-    ) -> anyhow::Result<Self> {
-        let cancellation = CancellationToken::new();
-        let stop = StopSignal::default();
-        let worker_stop = stop.clone();
-        let completion = Completion::default();
-        let worker_completion = completion.clone();
-        let stop_bridge_completion = Completion::default();
-        let bridge_completion = stop_bridge_completion.clone();
-        let bridge_cancellation = cancellation.clone();
-        let stop_bridge = std::thread::Builder::new()
-            .name("gateway-supervisor-stop".to_owned())
-            .spawn(move || {
-                let _completion = bridge_completion.guard();
-                worker_stop.wait();
-                bridge_cancellation.cancel();
-            })
-            .context("spawn the gateway supervisor stop bridge")?;
-        let thread = match std::thread::Builder::new()
-            .name("gateway-supervisor".to_owned())
-            .spawn(move || {
-                let _completion = worker_completion.guard();
-                supervise(cancellation);
-            }) {
-            Ok(thread) => thread,
-            Err(source) => {
-                stop.signal();
-                let error = anyhow::Error::new(source).context("spawn the gateway supervisor");
-                return match stop_bridge.join() {
-                    Ok(()) => Err(error),
-                    Err(_) => Err(error.context(
-                        "the gateway supervisor stop bridge panicked during spawn rollback",
-                    )),
-                };
-            }
-        };
-        Ok(Self {
-            stop,
-            completion,
-            stop_bridge_completion,
-            thread: Some(thread),
-            stop_bridge: Some(stop_bridge),
-            publication,
-            shutdown_budget,
-        })
-    }
-
-    /// Revokes publication, requests stop, and waits at most one deadline.
-    ///
-    /// This is the blocking, outcome-reporting path; `Drop` only signals
-    /// and detaches.
-    pub(crate) fn shutdown(mut self) -> SupervisorShutdown {
-        self.stop_and_join()
-    }
-
-    fn stop_and_join(&mut self) -> SupervisorShutdown {
-        let deadline = Instant::now() + self.shutdown_budget;
-        if let Some(publication) = self.publication.as_ref() {
-            publication.close_publication();
-        }
-        self.stop.signal();
-        let thread = self.thread.take();
-        let stop_bridge = self.stop_bridge.take();
-        let (Some(thread), Some(stop_bridge)) = (thread, stop_bridge) else {
-            return SupervisorShutdown::Joined;
-        };
-        if !self.completion.wait_until(deadline)
-            || !self.stop_bridge_completion.wait_until(deadline)
-        {
-            drop(thread);
-            drop(stop_bridge);
-            return SupervisorShutdown::Detached;
-        }
-        match (thread.join(), stop_bridge.join()) {
-            (Ok(()), Ok(())) => SupervisorShutdown::Joined,
-            (Err(_), _) | (_, Err(_)) => SupervisorShutdown::Panicked,
-        }
-    }
-
-    #[cfg(test)]
-    pub(in crate::gateway) fn completion_waker_for_test(&self) -> impl Fn() + Send + 'static {
-        let completion = self.completion.clone();
-        move || completion.wake()
-    }
-}
-
-impl Drop for GatewaySupervisor {
-    fn drop(&mut self) {
-        // `shutdown()` is the bounded, outcome-reporting path. Drop can
-        // neither wait nor report, so it revokes publication, signals the
-        // stop, and detaches both threads; the worker captures only owned
-        // state, so a detached thread finishes on its own.
-        if let Some(publication) = self.publication.as_ref() {
-            publication.close_publication();
-        }
-        self.stop.signal();
-        drop(self.thread.take());
-        drop(self.stop_bridge.take());
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway/supervisor/recovery.rs b/crates/workshop/desktop/src/gateway/supervisor/recovery.rs
deleted file mode 100644
index 609b81a21..000000000
--- a/crates/workshop/desktop/src/gateway/supervisor/recovery.rs
+++ /dev/null
@@ -1,136 +0,0 @@
-//! Recovery-candidate ownership and identity classification.
-
-use std::time::{Duration, Instant};
-
-use workshop_server_api::discovery::{ShutdownError, ValidatedConnection};
-
-use super::super::identity::same_gateway_identity;
-use super::SupervisedGatewayIdentity;
-
-/// Separate bound for authenticated cleanup of an unpublished owned child.
-const LATE_CHILD_SHUTDOWN_BUDGET: Duration = Duration::from_secs(1);
-
-/// A validated recovery process whose pid proves it is the child we spawned.
-#[derive(Debug)]
-pub(crate) struct RecoveryCandidate {
-    child_pid: u32,
-    validated: ValidatedConnection,
-    published: bool,
-}
-
-pub(in crate::gateway) enum RecoveryOwnership {
-    Owned(RecoveryCandidate),
-    Unowned(ValidatedConnection),
-}
-
-impl RecoveryCandidate {
-    /// Claims cleanup authority only when validation names the spawned pid.
-    pub(in crate::gateway) fn authenticate(
-        child_pid: u32,
-        validated: ValidatedConnection,
-    ) -> RecoveryOwnership {
-        if validated.pid() != child_pid {
-            return RecoveryOwnership::Unowned(validated);
-        }
-        RecoveryOwnership::Owned(Self {
-            child_pid,
-            validated,
-            published: false,
-        })
-    }
-
-    pub(in crate::gateway) fn validated(&self) -> &ValidatedConnection {
-        &self.validated
-    }
-
-    pub(in crate::gateway) fn mark_published(&mut self) {
-        self.published = true;
-    }
-
-    /// Shuts down the unpublished recovered child within the late-child
-    /// budget.
-    ///
-    /// This is the blocking, error-reporting path; `Drop` only signals on
-    /// a detached thread. The drop signal is disarmed either way: the
-    /// caller receives the outcome, so a failed delivery is reported here
-    /// rather than retried silently.
-    pub(in crate::gateway) fn shutdown(mut self) -> Result<(), ShutdownError> {
-        if self.published {
-            return Ok(());
-        }
-        debug_assert_eq!(self.child_pid, self.validated.pid());
-        self.published = true;
-        let deadline = Instant::now() + LATE_CHILD_SHUTDOWN_BUDGET;
-        workshop_server_api::discovery::request_shutdown_before(&self.validated, deadline)
-    }
-}
-
-impl Drop for RecoveryCandidate {
-    fn drop(&mut self) {
-        if self.published {
-            return;
-        }
-        debug_assert_eq!(self.child_pid, self.validated.pid());
-        // Drop can neither block nor report: the bounded authenticated
-        // request runs on a detached thread, so a missed explicit
-        // `shutdown()` still signals the unpublished gateway process.
-        let validated = self.validated.clone();
-        let signalled = std::thread::Builder::new()
-            .name("gateway-late-child-shutdown".to_owned())
-            .spawn(move || {
-                let deadline = Instant::now() + LATE_CHILD_SHUTDOWN_BUDGET;
-                if let Err(error) =
-                    workshop_server_api::discovery::request_shutdown_before(&validated, deadline)
-                {
-                    // The detached signal has no error return channel, so
-                    // diagnostics are the only place this cleanup failure
-                    // can surface.
-                    eprintln!("could not shut down an unpublished recovered gateway: {error}");
-                }
-            });
-        if let Err(error) = signalled {
-            eprintln!("could not signal an unpublished recovered gateway: {error}");
-        }
-    }
-}
-
-impl SupervisedGatewayIdentity for ValidatedConnection {
-    fn same_boot(&self, other: &Self) -> bool {
-        same_gateway_identity(self, other)
-    }
-}
-
-#[derive(Debug)]
-pub(in crate::gateway) enum RecoveryIdentity {
-    Stable(ValidatedConnection),
-    Candidate(RecoveryCandidate),
-}
-
-impl RecoveryIdentity {
-    pub(super) fn validated(&self) -> &ValidatedConnection {
-        match self {
-            Self::Stable(validated) => validated,
-            Self::Candidate(candidate) => candidate.validated(),
-        }
-    }
-}
-
-impl SupervisedGatewayIdentity for RecoveryIdentity {
-    fn same_boot(&self, other: &Self) -> bool {
-        self.validated().same_boot(other.validated())
-    }
-
-    fn publication_succeeded(&mut self) {
-        if let Self::Candidate(candidate) = self {
-            candidate.mark_published();
-        }
-    }
-
-    fn shutdown_unpublished(self) {
-        if let Self::Candidate(candidate) = self
-            && let Err(error) = candidate.shutdown()
-        {
-            eprintln!("could not shut down an unpublished recovered gateway: {error}");
-        }
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway/supervisor/signals.rs b/crates/workshop/desktop/src/gateway/supervisor/signals.rs
deleted file mode 100644
index 374242065..000000000
--- a/crates/workshop/desktop/src/gateway/supervisor/signals.rs
+++ /dev/null
@@ -1,112 +0,0 @@
-//! Stop and completion signals for bounded supervisor shutdown.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Condvar, Mutex, PoisonError};
-use std::time::Instant;
-
-/// A stop request that never waits for in-progress supervisor work.
-#[derive(Clone, Debug, Default)]
-pub(super) struct StopSignal {
-    state: Arc<StopState>,
-}
-
-#[derive(Debug, Default)]
-struct StopState {
-    requested: AtomicBool,
-    waiter: Mutex<()>,
-    wake: Condvar,
-}
-
-impl StopSignal {
-    pub(super) fn signal(&self) {
-        let waiter = self
-            .state
-            .waiter
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        self.state.requested.store(true, Ordering::SeqCst);
-        self.state.wake.notify_all();
-        drop(waiter);
-    }
-
-    pub(super) fn wait(&self) {
-        if self.state.requested.load(Ordering::SeqCst) {
-            return;
-        }
-        let waiter = self
-            .state
-            .waiter
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        drop(
-            self.state
-                .wake
-                .wait_while(waiter, |()| !self.state.requested.load(Ordering::SeqCst))
-                .unwrap_or_else(PoisonError::into_inner),
-        );
-    }
-}
-
-#[derive(Clone, Debug, Default)]
-pub(super) struct Completion {
-    state: Arc<CompletionState>,
-}
-
-#[derive(Debug, Default)]
-struct CompletionState {
-    finished: Mutex<bool>,
-    wake: Condvar,
-}
-
-impl Completion {
-    pub(super) fn guard(&self) -> CompletionGuard {
-        CompletionGuard(self.clone())
-    }
-
-    pub(super) fn wait_until(&self, deadline: Instant) -> bool {
-        let mut finished = self
-            .state
-            .finished
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        loop {
-            if *finished {
-                return true;
-            }
-            let Some(remaining) = deadline.checked_duration_since(Instant::now()) else {
-                return false;
-            };
-            if remaining.is_zero() {
-                return false;
-            }
-            let (next, timeout) = self
-                .state
-                .wake
-                .wait_timeout(finished, remaining)
-                .unwrap_or_else(PoisonError::into_inner);
-            finished = next;
-            if timeout.timed_out() && !*finished {
-                return false;
-            }
-        }
-    }
-
-    #[cfg(test)]
-    pub(super) fn wake(&self) {
-        self.state.wake.notify_all();
-    }
-}
-
-pub(super) struct CompletionGuard(Completion);
-
-impl Drop for CompletionGuard {
-    fn drop(&mut self) {
-        *self
-            .0
-            .state
-            .finished
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner) = true;
-        self.0.state.wake.notify_all();
-    }
-}
diff --git a/crates/workshop/desktop/src/gateway/tests.rs b/crates/workshop/desktop/src/gateway/tests.rs
deleted file mode 100644
index a861bdc0f..000000000
--- a/crates/workshop/desktop/src/gateway/tests.rs
+++ /dev/null
@@ -1,216 +0,0 @@
-//! Shared fixtures for the split Gateway lifecycle tests.
-
-use std::io::{Read, Write as _};
-use std::net::{TcpListener, TcpStream};
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-
-use workshop_server_api::discovery::{
-    GatewayDiscoveryFile, Resolution, SidecarError, ValidatedConnection,
-};
-
-use super::boot as gateway_boot;
-use super::supervisor::{
-    GatewaySupervisor, RecoveryCandidate, RecoveryOwnership, SupervisedGatewayIdentity,
-    SupervisorShutdown,
-};
-
-mod boot;
-mod cancellation;
-mod identity;
-mod recovery;
-mod shutdown;
-
-/// A supervised identity whose boot token the test chooses.
-#[derive(Clone, Debug, PartialEq, Eq)]
-struct TestIdentity {
-    file: GatewayDiscoveryFile,
-    process_boot: u64,
-}
-
-impl SupervisedGatewayIdentity for TestIdentity {
-    fn same_boot(&self, other: &Self) -> bool {
-        self.process_boot == other.process_boot
-            && self.file.pid == other.file.pid
-            && self.file.epoch == other.file.epoch
-            && self.file.started_at == other.file.started_at
-    }
-}
-
-fn test_identity(file: GatewayDiscoveryFile) -> TestIdentity {
-    TestIdentity {
-        process_boot: u64::from(file.pid),
-        file,
-    }
-}
-
-/// Claims ownership of a validated child through its own pid.
-fn owned_candidate(identity: ValidatedConnection) -> RecoveryCandidate {
-    match RecoveryCandidate::authenticate(identity.pid(), identity) {
-        RecoveryOwnership::Owned(candidate) => candidate,
-        RecoveryOwnership::Unowned(_) => panic!("the validated child pid authenticates ownership"),
-    }
-}
-
-fn assert_bounded_supervisor_shutdown(supervisor: GatewaySupervisor, finished: &AtomicBool) {
-    assert_eq!(
-        supervisor.shutdown(),
-        SupervisorShutdown::Joined,
-        "Workshop exit joins the canceled supervisor within its budget"
-    );
-    assert!(
-        finished.load(Ordering::SeqCst),
-        "shutdown returns only after the supervisor thread exits"
-    );
-}
-
-/// Resolves against the test process's own image.
-fn probe_own_image(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    let image = std::env::current_exe()
-        .expect("current exe")
-        .file_name()
-        .expect("the exe has a file name")
-        .to_string_lossy()
-        .into_owned();
-    workshop_server_api::discovery::resolve_for_test(run_dir, &image)
-}
-
-/// Plants an unreadable discovery-file path before resolving.
-fn probe_read_failure(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    std::fs::create_dir(workshop_server_api::discovery::gateway_discovery_file_path(
-        run_dir,
-    ))
-    .expect("plant the unreadable file");
-    probe_own_image(run_dir)
-}
-
-/// A gateway discovery file pointing at the test process itself.
-fn live_file(port: u16, api_key: &str) -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port,
-        api_key: api_key.to_owned(),
-        pid: std::process::id(),
-        epoch: 1_757_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-09-03T12:00:00Z".to_owned(),
-    }
-}
-
-/// Returns a pid whose short-lived child has been reaped.
-fn dead_pid() -> u32 {
-    let mut child = std::process::Command::new(std::env::current_exe().expect("current exe"))
-        .arg("--list")
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .expect("spawn a short-lived child");
-    let pid = child.id();
-    child.wait().expect("the child exits");
-    pid
-}
-
-/// Starts a lightweight same-process health and bearer fixture.
-fn fixture_gateway(expected_key: impl Into<String>) -> u16 {
-    let expected_key = Arc::new(expected_key.into());
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            let expected_key = Arc::clone(&expected_key);
-            std::thread::spawn(move || {
-                loop {
-                    let mut buffer = [0_u8; 1024];
-                    let Ok(read) = stream.read(&mut buffer) else {
-                        break;
-                    };
-                    if read == 0 {
-                        break;
-                    }
-                    let request = String::from_utf8_lossy(&buffer[..read]);
-                    let accepted = request.starts_with("GET /health ")
-                        || accepts_bearer(&request, &expected_key);
-                    let response = if accepted {
-                        &b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"[..]
-                    } else {
-                        &b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"[..]
-                    };
-                    if stream.write_all(response).is_err() {
-                        break;
-                    }
-                }
-            });
-        }
-    });
-    port
-}
-
-fn accepts_bearer(request: &str, expected_key: &str) -> bool {
-    request.lines().any(|line| {
-        let Some((name, value)) = line.split_once(':') else {
-            return false;
-        };
-        let Some((scheme, credential)) = value.trim_start().split_once(' ') else {
-            return false;
-        };
-        name.eq_ignore_ascii_case("authorization")
-            && scheme.eq_ignore_ascii_case("bearer")
-            && credential == expected_key
-    })
-}
-
-/// Starts the shared named-process Gateway fixture in this test binary.
-fn validated_gateway(expected_key: &str) -> workshop_server_api::fixtures::ValidatedGateway {
-    workshop_server_api::fixtures::ValidatedGateway::spawn_in(
-        expected_key,
-        "gateway::tests::validated_gateway_fixture_process",
-    )
-}
-
-#[test]
-#[ignore = "runs only as a named child process"]
-fn validated_gateway_fixture_process() {
-    workshop_server_api::fixtures::run_validated_gateway_fixture_process();
-}
-
-/// Sends one plain GET to the Workshop fixture.
-fn get(url: &str, path: &str) -> String {
-    let url = url::Url::parse(url).expect("the Workshop URL parses");
-    let host = url.host_str().expect("the Workshop URL has a host");
-    let port = url.port().expect("the Workshop URL has a port");
-    let mut stream = TcpStream::connect((host, port)).expect("connect to Workshop");
-    write!(
-        stream,
-        "GET {path} HTTP/1.1\r\nHost: {host}:{port}\r\nConnection: close\r\n\r\n"
-    )
-    .expect("send Workshop request");
-    let mut response = String::new();
-    stream
-        .read_to_string(&mut response)
-        .expect("read Workshop response");
-    response
-}
-
-/// An executable directory, with or without the Gateway beside Workshop.
-fn exe_dir(with_gateway: bool) -> (tempfile::TempDir, PathBuf) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    if with_gateway {
-        let exe = dir.path().join(gateway_boot::GATEWAY_EXE_NAME);
-        std::fs::write(&exe, b"").expect("plant the sibling exe");
-        // The installed-Gateway lookup skips a file it cannot run.
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt as _;
-            std::fs::set_permissions(&exe, std::fs::Permissions::from_mode(0o755))
-                .expect("mark the sibling exe executable");
-        }
-    }
-    let path = dir.path().to_owned();
-    (dir, path)
-}
-
-/// The Gateway the installed-Gateway lookup finds for a Workshop running
-/// from `exe_dir`.
-fn installed_in(exe_dir: &Path) -> Option<PathBuf> {
-    workshop_server_api::discovery::installed_gateway(&exe_dir.join("runvil-workshop"), None)
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/boot-launch-wait.rs b/crates/workshop/desktop/src/gateway/tests/boot-launch-wait.rs
deleted file mode 100644
index 4a2b4ab92..000000000
--- a/crates/workshop/desktop/src/gateway/tests/boot-launch-wait.rs
+++ /dev/null
@@ -1,331 +0,0 @@
-//! Launch-wait coverage against a fake wait clock.
-
-use std::cell::Cell;
-use std::path::Path;
-use std::process::ExitStatus;
-use std::time::{Duration, Instant};
-
-use workshop_server_api::discovery::{
-    CancellationToken, GatewayDiscoveryFile, HealthError, ProbeError,
-};
-
-use super::super::{fixture_gateway, live_file, probe_own_image};
-use crate::gateway::supervisor::{
-    RECOVERY_POLL_INTERVAL, SystemClock, WaitClock, wait_for_launched_file_cancellable_with,
-};
-
-/// A discovery-file port the fake-clock tests never probe.
-const UNPROBED_PORT: u16 = 9;
-
-/// A wait clock that advances only when the wait pauses, by exactly the
-/// requested delay, and never reports cancellation.
-struct FakeClock<'hook> {
-    now: Cell<Instant>,
-    pauses: Cell<usize>,
-    on_pause: Option<Box<dyn Fn(usize) + 'hook>>,
-}
-
-impl<'hook> FakeClock<'hook> {
-    fn new() -> Self {
-        Self {
-            now: Cell::new(Instant::now()),
-            pauses: Cell::new(0),
-            on_pause: None,
-        }
-    }
-
-    /// Runs `hook` with the one-based pause number after each pause.
-    fn on_pause(hook: impl Fn(usize) + 'hook) -> Self {
-        Self {
-            on_pause: Some(Box::new(hook)),
-            ..Self::new()
-        }
-    }
-
-    fn pauses(&self) -> usize {
-        self.pauses.get()
-    }
-}
-
-impl WaitClock for FakeClock<'_> {
-    fn now(&self) -> Instant {
-        self.now.get()
-    }
-
-    fn pause(&self, delay: Duration, _cancellation: &CancellationToken) -> bool {
-        let pause = self.pauses.get() + 1;
-        self.pauses.set(pause);
-        self.now.set(self.now.get() + delay);
-        if let Some(hook) = &self.on_pause {
-            hook(pause);
-        }
-        false
-    }
-}
-
-/// A health failure built without any network probe.
-fn probe_timeout(url: &str, status_line: String) -> HealthError {
-    HealthError::Timeout {
-        url: url.to_owned(),
-        timeout: Duration::from_millis(250),
-        source: ProbeError::UnexpectedStatus { status_line },
-    }
-}
-
-/// Runs the launch wait against the test binary's own process image, for a
-/// launched child that never exits.
-fn launch_wait_with<Clock, Health>(
-    run_dir: &Path,
-    budget: Duration,
-    clock: &Clock,
-    health: Health,
-) -> anyhow::Result<GatewayDiscoveryFile>
-where
-    Clock: WaitClock,
-    Health: FnMut(&str, Duration, &CancellationToken) -> Result<(), HealthError>,
-{
-    launch_wait_exiting(run_dir, budget, clock, health, || None)
-}
-
-/// Runs the launch wait against the test binary's own process image, with
-/// the launched child's exit status read from `exited`.
-fn launch_wait_exiting<Clock, Health, Exited>(
-    run_dir: &Path,
-    budget: Duration,
-    clock: &Clock,
-    health: Health,
-    exited: Exited,
-) -> anyhow::Result<GatewayDiscoveryFile>
-where
-    Clock: WaitClock,
-    Health: FnMut(&str, Duration, &CancellationToken) -> Result<(), HealthError>,
-    Exited: FnMut() -> Option<ExitStatus>,
-{
-    wait_for_launched_file_cancellable_with(
-        run_dir,
-        budget,
-        &CancellationToken::new(),
-        clock,
-        health,
-        |run_dir, _| probe_own_image(run_dir),
-        exited,
-    )
-}
-
-/// The exit status of a child that exited with `code`.
-#[cfg(windows)]
-fn exit_status(code: u32) -> ExitStatus {
-    std::os::windows::process::ExitStatusExt::from_raw(code)
-}
-
-/// The exit status of a child that exited with `code`.
-#[cfg(unix)]
-fn exit_status(code: i32) -> ExitStatus {
-    std::os::unix::process::ExitStatusExt::from_raw(code << 8)
-}
-
-fn launch_wait(run_dir: &Path, budget: Duration) -> anyhow::Result<GatewayDiscoveryFile> {
-    launch_wait_with(
-        run_dir,
-        budget,
-        &SystemClock,
-        workshop_server_api::discovery::wait_for_health_cancellable,
-    )
-}
-
-#[test]
-fn the_launch_wait_returns_once_the_file_appears_and_answers() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let file = live_file(fixture_gateway("key"), "key");
-    let clock = FakeClock::on_pause(|pause| {
-        if pause == 1 {
-            file.write_to(run.path())
-                .expect("the launched gateway writes");
-        }
-    });
-
-    let waited = launch_wait_with(
-        run.path(),
-        Duration::from_secs(5),
-        &clock,
-        workshop_server_api::discovery::wait_for_health_cancellable,
-    )
-    .expect("the validated file lands and answers");
-
-    assert_eq!(waited, file);
-    assert_eq!(
-        clock.pauses(),
-        1,
-        "the file lands during the first pause and the next poll attaches"
-    );
-}
-
-#[test]
-fn the_launch_wait_times_out_when_no_file_appears() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let error = launch_wait(run.path(), Duration::from_millis(150))
-        .expect_err("a gateway that never writes must not hang boot");
-    assert!(
-        error
-            .to_string()
-            .contains("no validated gateway discovery file"),
-        "the error names the missing file: {error}"
-    );
-}
-
-#[test]
-fn the_launch_wait_rejects_a_key_the_live_process_does_not_accept() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    live_file(fixture_gateway("accepted-key"), "rejected-key")
-        .write_to(run.path())
-        .expect("write");
-
-    let error = launch_wait(run.path(), Duration::from_millis(150))
-        .expect_err("an unaccepted discovery-file key must not publish");
-    let message = format!("{error:#}");
-    assert!(
-        message.contains("no validated gateway discovery file"),
-        "the error names the validation failure: {message}"
-    );
-    assert!(
-        message.contains("bearer was rejected") && !message.contains("rejected-key"),
-        "the error reports the rejection without exposing the key: {message}"
-    );
-}
-
-#[test]
-fn the_launch_wait_completes_when_a_dead_port_file_is_replaced_by_a_live_one() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let live = live_file(fixture_gateway("key"), "key");
-    assert_ne!(
-        live.port, UNPROBED_PORT,
-        "the stale file names another port"
-    );
-    live_file(UNPROBED_PORT, "key")
-        .write_to(run.path())
-        .expect("write the stale file");
-    let clock = FakeClock::new();
-    let mut probes = 0;
-
-    let waited = launch_wait_with(
-        run.path(),
-        Duration::from_secs(5),
-        &clock,
-        |url, budget, cancellation| {
-            probes += 1;
-            if probes == 1 {
-                assert_eq!(url, format!("http://127.0.0.1:{UNPROBED_PORT}"));
-                live.write_to(run.path())
-                    .expect("the gateway rewrites its discovery file");
-                return Err(probe_timeout(url, "HTTP/1.1 503 Unavailable".to_owned()));
-            }
-            assert_eq!(url, format!("http://127.0.0.1:{}", live.port));
-            workshop_server_api::discovery::wait_for_health_cancellable(url, budget, cancellation)
-        },
-    )
-    .expect("the wait polls past the stale file and attaches to the live gateway");
-
-    assert_eq!(waited, live);
-    assert_eq!(
-        probes, 2,
-        "one failed probe of the stale file, then one of the live gateway"
-    );
-}
-
-#[test]
-fn the_launch_wait_fails_at_its_budget_with_the_last_probe_error() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    live_file(UNPROBED_PORT, "key")
-        .write_to(run.path())
-        .expect("write the stale file");
-    let budget = Duration::from_millis(600);
-    let polls = usize::try_from(
-        budget
-            .as_nanos()
-            .div_ceil(RECOVERY_POLL_INTERVAL.as_nanos()),
-    )
-    .expect("the poll count fits in usize");
-    let clock = FakeClock::new();
-    let mut probes = 0;
-
-    let error = launch_wait_with(run.path(), budget, &clock, |url, _, _| {
-        probes += 1;
-        Err(probe_timeout(url, format!("HTTP/1.1 503 probe {probes}")))
-    })
-    .expect_err("a file that never names a live gateway must not hang boot");
-
-    assert_eq!(
-        probes,
-        polls + 1,
-        "one probe at the start and one after each poll interval up to the budget"
-    );
-    assert_eq!(
-        clock.pauses(),
-        polls,
-        "the wait pauses only before the budget"
-    );
-    let message = format!("{error:#}");
-    assert!(
-        message.contains("no validated gateway discovery file"),
-        "the error names the budget failure: {message}"
-    );
-    assert!(
-        message.contains(&format!(
-            "unexpected health response: HTTP/1.1 503 probe {probes}"
-        )),
-        "the error reports the last probe: {message}"
-    );
-}
-
-#[test]
-fn the_launch_wait_fails_at_the_first_poll_after_the_gateway_exits_without_a_file() {
-    let state = tempfile::TempDir::new().expect("tempdir");
-    let run_dir = state.path().join("run");
-    std::fs::create_dir(&run_dir).expect("create the run directory");
-    let clock = FakeClock::new();
-
-    let error = launch_wait_exiting(
-        &run_dir,
-        Duration::from_secs(30),
-        &clock,
-        |_, _, _| panic!("no discovery file means no health probe"),
-        || (clock.pauses() >= 2).then(|| exit_status(1)),
-    )
-    .expect_err("a gateway that exits without a file must not hold boot for the budget");
-
-    assert_eq!(
-        clock.pauses(),
-        2,
-        "the poll after the exit fails, long before the budget"
-    );
-    let message = error.to_string();
-    assert!(
-        message.contains(&format!("exited ({})", exit_status(1))),
-        "the error names the exit status: {message}"
-    );
-    let log = workshop_server_api::discovery::gateway_log_path(state.path());
-    assert!(
-        message.contains(&log.display().to_string()),
-        "the error names the gateway log: {message}"
-    );
-}
-
-#[test]
-fn the_launch_wait_attaches_to_the_owner_a_launched_gateway_handed_off_to() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let owner = live_file(fixture_gateway("key"), "key");
-    owner
-        .write_to(run.path())
-        .expect("the owner publishes before the handed-off launch exits");
-
-    let waited = launch_wait_exiting(
-        run.path(),
-        Duration::from_secs(5),
-        &FakeClock::new(),
-        workshop_server_api::discovery::wait_for_health_cancellable,
-        || Some(exit_status(0)),
-    )
-    .expect("an exited launch still attaches to the owner's file");
-
-    assert_eq!(waited, owner);
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/boot.rs b/crates/workshop/desktop/src/gateway/tests/boot.rs
deleted file mode 100644
index d06246f36..000000000
--- a/crates/workshop/desktop/src/gateway/tests/boot.rs
+++ /dev/null
@@ -1,377 +0,0 @@
-//! Boot planning and one-shot launch coverage.
-
-use std::path::PathBuf;
-use std::sync::{Arc, OnceLock};
-use std::time::{Duration, Instant};
-
-use workshop_server_api::discovery::GatewayDiscoveryFile;
-
-use super::{
-    dead_pid, exe_dir, fixture_gateway, installed_in, live_file, owned_candidate, probe_own_image,
-    probe_read_failure,
-};
-#[cfg(windows)]
-use crate::gateway::boot::spawn_detached_windows_with;
-use crate::gateway::boot::{
-    GATEWAY_EXE_NAME, GatewayPlan, no_gateway_error, placeholder_gateway_error, plan_gateway,
-    sibling_is_placeholder, spawn_detached,
-};
-use crate::gateway::identity::GatewayAttachment;
-use crate::gateway::supervisor::RECOVERY_POLL_INTERVAL;
-
-#[path = "boot-launch-wait.rs"]
-mod launch_wait;
-
-const FIXTURE_PHASE_TIMEOUT: Duration = Duration::from_secs(10);
-
-#[cfg(windows)]
-#[test]
-fn windows_detached_spawn_first_attempt_uses_all_required_flags() {
-    let mut attempts = Vec::new();
-
-    let child_pid = spawn_detached_windows_with(|flags| {
-        attempts.push(flags);
-        Ok(41)
-    })
-    .expect("the first spawn succeeds");
-
-    assert_eq!(child_pid, 41);
-    assert_eq!(attempts, [0x0100_0208]);
-}
-
-#[cfg(windows)]
-#[test]
-fn windows_detached_spawn_retries_access_denied_without_breakaway() {
-    let mut attempts = Vec::new();
-
-    let child_pid = spawn_detached_windows_with(|flags| {
-        attempts.push(flags);
-        if attempts.len() == 1 {
-            Err(std::io::Error::from_raw_os_error(5))
-        } else {
-            Ok(42)
-        }
-    })
-    .expect("access denied retries without breakaway");
-
-    assert_eq!(child_pid, 42);
-    assert_eq!(attempts, [0x0100_0208, 0x0000_0208]);
-}
-
-#[cfg(windows)]
-#[test]
-fn windows_detached_spawn_does_not_retry_after_success() {
-    let mut attempts = 0;
-
-    spawn_detached_windows_with(|_| {
-        attempts += 1;
-        Ok(43)
-    })
-    .expect("the first spawn succeeds");
-
-    assert_eq!(attempts, 1);
-}
-
-#[cfg(windows)]
-#[test]
-fn windows_detached_spawn_does_not_retry_other_errors() {
-    let mut attempts = 0;
-
-    let error = spawn_detached_windows_with::<u32, _>(|_| {
-        attempts += 1;
-        Err(std::io::Error::from_raw_os_error(123))
-    })
-    .expect_err("non-permission errors propagate");
-
-    assert_eq!(error.raw_os_error(), Some(123));
-    assert_eq!(attempts, 1);
-}
-
-/// A program that exits by itself once it reads end of input from a null
-/// stdin.
-fn self_exiting_program() -> PathBuf {
-    if cfg!(windows) {
-        std::env::var_os("ComSpec").map_or_else(|| PathBuf::from("cmd.exe"), PathBuf::from)
-    } else {
-        PathBuf::from("/bin/sh")
-    }
-}
-
-#[test]
-fn the_reaper_records_the_exit_status_of_a_detached_child() {
-    let exit = Arc::new(OnceLock::new());
-    spawn_detached(&self_exiting_program(), Arc::clone(&exit))
-        .expect("spawn a child that exits by itself");
-
-    let deadline = Instant::now() + FIXTURE_PHASE_TIMEOUT;
-    while exit.get().is_none() {
-        assert!(
-            Instant::now() < deadline,
-            "the reaper records the child's exit within {FIXTURE_PHASE_TIMEOUT:?}"
-        );
-        std::thread::sleep(RECOVERY_POLL_INTERVAL);
-    }
-}
-
-fn workshop_server(
-    port: u16,
-    api_key: &str,
-) -> (tempfile::TempDir, workshop_server_api::ServerHandle) {
-    let state_dir = tempfile::TempDir::new().expect("create Workshop state directory");
-    let server = workshop_server_api::fixtures::spawn(workshop_server_api::Config {
-        gateway: workshop_server_api::GatewayConfig {
-            base_url: format!("http://127.0.0.1:{port}"),
-            api_key: api_key.to_owned(),
-        },
-        server: workshop_server_api::ServerConfig {
-            bind: "127.0.0.1:0".to_owned(),
-            state_dir: state_dir.path().to_owned(),
-        },
-        agents: workshop_server_api::AgentsConfig::default(),
-    })
-    .expect("spawn Workshop fixture");
-    (state_dir, server)
-}
-
-#[test]
-fn a_live_file_attaches_without_looking_for_a_sibling_exe() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let file = live_file(fixture_gateway("key"), "key");
-    file.write_to(run.path()).expect("write");
-    let (_exe, exe_dir) = exe_dir(false);
-
-    match plan_gateway(run.path(), installed_in(&exe_dir), false, probe_own_image) {
-        GatewayPlan::Attach(attached) => assert_eq!(attached, file),
-        other => panic!("a live gateway must be attached, not {other:?}"),
-    }
-}
-
-#[test]
-fn no_file_and_a_sibling_exe_launches() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let (_exe, exe_dir) = exe_dir(true);
-
-    match plan_gateway(run.path(), installed_in(&exe_dir), false, probe_own_image) {
-        GatewayPlan::Launch(exe) => assert_eq!(exe, exe_dir.join(GATEWAY_EXE_NAME)),
-        other => panic!("a full install with no running gateway must launch, not {other:?}"),
-    }
-}
-
-#[test]
-fn no_file_and_no_sibling_exe_falls_through_to_explicit_config() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let (_exe, exe_dir) = exe_dir(false);
-
-    assert_eq!(
-        plan_gateway(run.path(), installed_in(&exe_dir), true, probe_own_image),
-        GatewayPlan::ConfigOnly,
-        "a Workshop-only install attaches to the configured LAN gateway"
-    );
-}
-
-#[test]
-fn no_file_no_sibling_exe_and_no_config_fails() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let (_exe, exe_dir) = exe_dir(false);
-
-    assert_eq!(
-        plan_gateway(run.path(), installed_in(&exe_dir), false, probe_own_image),
-        GatewayPlan::Fail,
-        "nothing to connect to must fail loud, not serve a broken window"
-    );
-}
-
-#[test]
-fn a_stale_file_is_cleaned_and_the_sibling_exe_launches() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..live_file(1, "k")
-    }
-    .write_to(run.path())
-    .expect("write");
-    let (_exe, exe_dir) = exe_dir(true);
-
-    let plan = plan_gateway(run.path(), installed_in(&exe_dir), false, probe_own_image);
-    assert!(
-        matches!(plan, GatewayPlan::Launch(_)),
-        "a stale file must not block the relaunch: {plan:?}"
-    );
-    assert!(
-        !workshop_server_api::discovery::gateway_discovery_file_path(run.path()).exists(),
-        "the stale file was cleaned"
-    );
-}
-
-#[test]
-fn a_stale_file_with_no_sibling_exe_falls_through_to_explicit_config() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..live_file(1, "k")
-    }
-    .write_to(run.path())
-    .expect("write");
-    let (_exe, exe_dir) = exe_dir(false);
-
-    assert_eq!(
-        plan_gateway(run.path(), installed_in(&exe_dir), true, probe_own_image),
-        GatewayPlan::ConfigOnly,
-        "a stale file must not wedge the LAN fallback"
-    );
-    assert!(
-        !workshop_server_api::discovery::gateway_discovery_file_path(run.path()).exists(),
-        "the stale file was cleaned"
-    );
-}
-
-#[test]
-fn a_resolve_error_still_launches_the_sibling_exe() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let (_exe, exe_dir) = exe_dir(true);
-
-    let plan = plan_gateway(
-        run.path(),
-        installed_in(&exe_dir),
-        false,
-        probe_read_failure,
-    );
-    assert!(
-        matches!(plan, GatewayPlan::Launch(_)),
-        "a discovery error must not read as no-gateway: {plan:?}"
-    );
-}
-
-#[test]
-fn the_installed_lookup_finds_only_the_gateway_exe_beside_the_desktop_app() {
-    let (_dir, with) = exe_dir(true);
-    assert_eq!(
-        installed_in(&with),
-        Some(with.join(GATEWAY_EXE_NAME)),
-        "the installed sibling is found"
-    );
-    let (_dir, without) = exe_dir(false);
-    assert_eq!(
-        installed_in(&without),
-        None,
-        "a Workshop-only install has no Gateway"
-    );
-}
-
-#[test]
-fn the_no_gateway_error_names_both_remedies() {
-    let message = no_gateway_error().to_string();
-    assert!(
-        message.contains("runvil-gateway"),
-        "the error names the Gateway component remedy: {message}"
-    );
-    assert!(
-        message.contains("workshop.toml"),
-        "the error names the explicit-config remedy: {message}"
-    );
-}
-
-/// The stub `tools/fetch-gateway-sidecar.mjs --stub` writes, which CI stages
-/// so compile-only jobs need no Gateway release.
-const STUB_TEXT: &str = "This is a placeholder staged by tools/fetch-gateway-sidecar.mjs --stub.\n\
-     It stands in for the Gateway sidecar so compile-only jobs need no release.\n";
-
-fn sibling_with(content: &[u8]) -> (tempfile::TempDir, PathBuf) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let exe = dir.path().join(GATEWAY_EXE_NAME);
-    std::fs::write(&exe, content).expect("write the sibling");
-    (dir, exe)
-}
-
-#[test]
-fn a_stub_sibling_is_recognized_before_a_launch_attempt() {
-    let (_dir, exe) = sibling_with(STUB_TEXT.as_bytes());
-    assert!(
-        sibling_is_placeholder(&exe),
-        "the compile-only stub must be caught before spawning it"
-    );
-}
-
-#[test]
-fn a_real_executable_sibling_is_not_a_placeholder() {
-    let (_dir, exe) = sibling_with(b"MZ\x90\x00\x03\x00\x00\x00");
-    assert!(
-        !sibling_is_placeholder(&exe),
-        "an executable is left to the spawn to judge"
-    );
-}
-
-#[test]
-fn an_empty_sibling_is_not_treated_as_a_placeholder() {
-    let (_dir, exe) = sibling_with(b"");
-    assert!(
-        !sibling_is_placeholder(&exe),
-        "an unreadable prefix must not read as a stub"
-    );
-}
-
-#[test]
-fn a_missing_sibling_is_not_treated_as_a_placeholder() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    assert!(
-        !sibling_is_placeholder(&dir.path().join(GATEWAY_EXE_NAME)),
-        "a file that is not there cannot be a stub"
-    );
-}
-
-#[test]
-fn the_placeholder_error_names_the_file_and_the_fetch_command() {
-    let exe = PathBuf::from("/install/runvil-gateway");
-    let message = placeholder_gateway_error(&exe).to_string();
-    assert!(
-        message.contains("runvil-gateway"),
-        "the error names the file that is not runnable: {message}"
-    );
-    assert!(
-        message.contains("node tools/fetch-gateway-sidecar.mjs"),
-        "the error names the one command that stages a real Gateway: {message}"
-    );
-}
-
-#[test]
-fn matching_boot_publication_survives_closure_and_server_teardown() {
-    let mut launched = super::validated_gateway("launched-key");
-    let identity = launched.validate("launched-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let attachment = GatewayAttachment::Launched(owned_candidate(identity.clone()));
-    let (_state_dir, server) = workshop_server(launched.port(), "launched-key");
-
-    let attachment = attachment.reconcile_publication(Some(identity));
-    server.gateway_updater().close_publication();
-    drop(attachment);
-    let outcome = server.shutdown().expect("server teardown continues");
-
-    assert_eq!(outcome, workshop_server_api::Termination::Graceful);
-    assert!(
-        !launched.received_shutdown(Duration::from_millis(100)),
-        "closure cannot clean up the exact child already published at boot"
-    );
-}
-
-#[test]
-fn closed_boot_publication_cleans_unpublished_owner_then_continues_teardown() {
-    let mut launched = super::validated_gateway("launched-key");
-    let published = super::validated_gateway("published-key");
-    let launched_identity =
-        launched.validate("launched-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let published_identity =
-        published.validate("published-key", 1_778_000_002, "2026-09-08T18:00:02Z");
-    let attachment = GatewayAttachment::Launched(owned_candidate(launched_identity));
-    let (_state_dir, server) = workshop_server(published.port(), "published-key");
-
-    server.gateway_updater().close_publication();
-    let attachment = attachment.reconcile_publication(Some(published_identity));
-    drop(attachment);
-    assert!(
-        launched.received_shutdown(FIXTURE_PHASE_TIMEOUT),
-        "a closed boot cleans only its unpublished authenticated child"
-    );
-    assert_eq!(
-        server.shutdown().expect("server teardown continues"),
-        workshop_server_api::Termination::Graceful
-    );
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/cancellation.rs b/crates/workshop/desktop/src/gateway/tests/cancellation.rs
deleted file mode 100644
index 247ad6985..000000000
--- a/crates/workshop/desktop/src/gateway/tests/cancellation.rs
+++ /dev/null
@@ -1,259 +0,0 @@
-//! Exit cancellation of a supervisor blocked inside each recovery phase.
-
-use std::path::Path;
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-use std::sync::{Arc, mpsc};
-use std::time::Duration;
-
-use workshop_server_api::discovery::Resolution;
-
-use super::{TestIdentity, assert_bounded_supervisor_shutdown, live_file, test_identity};
-use crate::gateway::supervisor::{
-    GatewaySupervisor, SupervisionProbe, SystemClock, launch_and_attach_cancellable_with,
-    run_effect_if_active, run_supervision, wait_for_launched_file_cancellable_with,
-};
-
-#[test]
-fn exit_joins_a_supervisor_blocked_in_resolve_before_recovery() {
-    let (entered, blocked) = mpsc::channel();
-    let recoveries = Arc::new(AtomicUsize::new(0));
-    let worker_recoveries = Arc::clone(&recoveries);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        run_supervision(
-            test_identity(live_file(54_375, "stable-key")),
-            |_, cancellation| {
-                entered.send(()).expect("announce blocked resolve");
-                let _ = cancellation.wait_timeout(Duration::from_secs(30));
-                SupervisionProbe::Missing
-            },
-            |_| -> anyhow::Result<TestIdentity> {
-                worker_recoveries.fetch_add(1, Ordering::SeqCst);
-                anyhow::bail!("recovery must not start after cancellation")
-            },
-            |_, _| Ok::<(), anyhow::Error>(()),
-            |delay, cancellation| cancellation.wait_timeout(delay),
-            &cancellation,
-        );
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the resolve phase blocks deterministically");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        recoveries.load(Ordering::SeqCst),
-        0,
-        "cancellation prevents every later recovery launch"
-    );
-}
-
-#[test]
-fn exit_joins_a_supervisor_blocked_in_validation_before_publication() {
-    let (entered, blocked) = mpsc::channel();
-    let publications = Arc::new(AtomicUsize::new(0));
-    let worker_publications = Arc::clone(&publications);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        run_supervision(
-            test_identity(live_file(54_375, "stable-key")),
-            |current, cancellation| {
-                entered.send(()).expect("announce blocked validation");
-                let _ = cancellation.wait_timeout(Duration::from_secs(30));
-                SupervisionProbe::Replacement(current.clone())
-            },
-            |_| -> anyhow::Result<TestIdentity> {
-                panic!("canceled validation cannot start recovery")
-            },
-            |_, _| {
-                worker_publications.fetch_add(1, Ordering::SeqCst);
-                Ok::<(), anyhow::Error>(())
-            },
-            |delay, cancellation| cancellation.wait_timeout(delay),
-            &cancellation,
-        );
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the validation phase blocks deterministically");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        publications.load(Ordering::SeqCst),
-        0,
-        "canceled validation cannot publish into the snapshot"
-    );
-}
-
-#[test]
-fn exit_joins_a_supervisor_blocked_in_health_wait_before_resolve() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    live_file(54_375, "stable-key")
-        .write_to(run.path())
-        .expect("write candidate");
-    let run_dir = run.path().to_owned();
-    let (entered, blocked) = mpsc::channel();
-    let resolves = Arc::new(AtomicUsize::new(0));
-    let worker_resolves = Arc::clone(&resolves);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        let result = wait_for_launched_file_cancellable_with(
-            &run_dir,
-            Duration::from_secs(30),
-            &cancellation,
-            &SystemClock,
-            |_, _, cancellation| {
-                entered.send(()).expect("announce blocked health wait");
-                let _ = cancellation.wait_timeout(Duration::from_secs(30));
-                Err(workshop_server_api::discovery::HealthError::Canceled)
-            },
-            |_, _| {
-                worker_resolves.fetch_add(1, Ordering::SeqCst);
-                Ok(Resolution::Absent)
-            },
-            || None,
-        );
-        assert!(result.is_err(), "the canceled health wait is rejected");
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the health-wait phase blocks deterministically");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        resolves.load(Ordering::SeqCst),
-        0,
-        "canceled health waiting cannot start a later resolve"
-    );
-}
-
-#[test]
-fn exit_joins_a_supervisor_blocked_in_launch_race_before_spawn() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let decision =
-        workshop_server_api::discovery::launch_or_attach(run.path(), Duration::from_secs(1))
-            .expect("acquire a launch decision");
-    let run_dir = run.path().to_owned();
-    let (entered, blocked) = mpsc::channel();
-    let launches = Arc::new(AtomicUsize::new(0));
-    let worker_launches = Arc::clone(&launches);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        let mut decision = Some(decision);
-        let result = launch_and_attach_cancellable_with(
-            &run_dir,
-            Path::new("unused-gateway"),
-            &cancellation,
-            |_, _, cancellation| {
-                entered.send(()).expect("announce blocked launch race");
-                let _ = cancellation.wait_timeout(Duration::from_secs(30));
-                Ok(decision.take().expect("one launch decision"))
-            },
-            |_, _| {
-                worker_launches.fetch_add(1, Ordering::SeqCst);
-                Ok(42)
-            },
-            |_, _, _| anyhow::bail!("the canceled launch cannot wait for health"),
-        );
-        assert!(result.is_err(), "the canceled launch race is rejected");
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the launch race blocks deterministically");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        launches.load(Ordering::SeqCst),
-        0,
-        "canceled launch racing cannot create a process"
-    );
-}
-
-#[test]
-fn exit_joins_a_supervisor_blocked_inside_launch_without_process_creation() {
-    let run = tempfile::TempDir::new().expect("tempdir");
-    let decision =
-        workshop_server_api::discovery::launch_or_attach(run.path(), Duration::from_secs(1))
-            .expect("acquire a launch decision");
-    let run_dir = run.path().to_owned();
-    let (entered, blocked) = mpsc::channel();
-    let launches = Arc::new(AtomicUsize::new(0));
-    let worker_launches = Arc::clone(&launches);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        let mut decision = Some(decision);
-        let result = launch_and_attach_cancellable_with(
-            &run_dir,
-            Path::new("unused-gateway"),
-            &cancellation,
-            |_, _, _| Ok(decision.take().expect("one launch decision")),
-            |_, cancellation| {
-                entered.send(()).expect("announce blocked launch");
-                if cancellation.wait_timeout(Duration::from_secs(30)) {
-                    return Err(std::io::Error::from(std::io::ErrorKind::Interrupted));
-                }
-                worker_launches.fetch_add(1, Ordering::SeqCst);
-                Ok(42)
-            },
-            |_, _, _| anyhow::bail!("the canceled launch cannot wait for health"),
-        );
-        assert!(result.is_err(), "the canceled launch is rejected");
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the process launch blocks deterministically inside its effect gate");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        launches.load(Ordering::SeqCst),
-        0,
-        "the canceled launch has no post-cancel effect"
-    );
-}
-
-#[test]
-fn exit_joins_a_supervisor_blocked_inside_publication_without_replacement() {
-    let (entered, blocked) = mpsc::channel();
-    let publications = Arc::new(AtomicUsize::new(0));
-    let worker_publications = Arc::clone(&publications);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        let result = run_effect_if_active(&cancellation, "gateway publication", |cancellation| {
-            entered.send(()).expect("announce blocked publication");
-            if cancellation.wait_timeout(Duration::from_secs(30)) {
-                anyhow::bail!("gateway publication was canceled");
-            }
-            worker_publications.fetch_add(1, Ordering::SeqCst);
-            Ok(())
-        });
-        assert!(result.is_err(), "the canceled publication is rejected");
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("snapshot publication blocks deterministically inside its effect gate");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        publications.load(Ordering::SeqCst),
-        0,
-        "cancellation prevents authoritative snapshot replacement"
-    );
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/identity.rs b/crates/workshop/desktop/src/gateway/tests/identity.rs
deleted file mode 100644
index 1e6837823..000000000
--- a/crates/workshop/desktop/src/gateway/tests/identity.rs
+++ /dev/null
@@ -1,76 +0,0 @@
-//! Attachment and process-boot identity coverage.
-
-use super::{owned_candidate, validated_gateway};
-use crate::gateway::identity::{GatewayAttachment, same_gateway_identity};
-
-#[test]
-fn an_explicit_config_attachment_holds_no_local_sidecar_identity() {
-    let gateway = validated_gateway("k");
-    let identity = gateway.validate("k", 1_757_000_000, "2026-09-03T12:00:00Z");
-    let sidecar = GatewayAttachment::Sidecar(identity.clone());
-    assert!(
-        sidecar
-            .sidecar_identity()
-            .is_some_and(|attached| attached.same_boot(&identity)),
-        "a sidecar attachment retains its validated process identity"
-    );
-    let config = GatewayAttachment::Config;
-    assert_eq!(
-        config.sidecar_identity(),
-        None,
-        "a LAN Gateway from explicit config reports None for the sidecar identity"
-    );
-}
-
-#[test]
-fn validated_process_boot_identity_distinguishes_live_gateway_children() {
-    let first = validated_gateway("stable-key");
-    let second = validated_gateway("stable-key");
-    let original = first.validate("stable-key", 1_757_000_000, "2026-09-03T12:00:00Z");
-    let replacement = second.validate("stable-key", 1_757_000_000, "2026-09-03T12:00:00Z");
-
-    assert!(same_gateway_identity(&original, &original.clone()));
-    assert!(
-        !same_gateway_identity(&original, &replacement),
-        "equal file-supplied boot metadata cannot alias another validated process"
-    );
-}
-
-#[test]
-fn server_publication_disarms_launched_cleanup_only_for_the_same_process_boot() {
-    let mut launched = validated_gateway("launched-key");
-    let identity = launched.validate("launched-key", 1_757_000_000, "2026-09-03T12:00:00Z");
-    let attachment = GatewayAttachment::Launched(owned_candidate(identity.clone()));
-
-    let attachment = attachment.reconcile_publication(Some(identity));
-    drop(attachment);
-
-    assert!(
-        !launched.received_shutdown(std::time::Duration::from_millis(100)),
-        "the child the server actually published remains authoritative"
-    );
-}
-
-#[test]
-fn server_publication_replaces_a_mismatched_candidate_and_cleans_it_up() {
-    let mut launched = validated_gateway("launched-key");
-    let published = validated_gateway("published-key");
-    let launched_identity =
-        launched.validate("launched-key", 1_757_000_000, "2026-09-03T12:00:00Z");
-    let published_identity =
-        published.validate("published-key", 1_757_000_001, "2026-09-03T12:00:01Z");
-    let attachment = GatewayAttachment::Launched(owned_candidate(launched_identity));
-
-    let attachment = attachment.reconcile_publication(Some(published_identity.clone()));
-
-    assert!(
-        attachment
-            .sidecar_identity()
-            .is_some_and(|identity| identity.same_boot(&published_identity)),
-        "supervision follows the identity the server actually published"
-    );
-    assert!(
-        launched.received_shutdown(std::time::Duration::from_secs(1)),
-        "the unpublished owned child receives authenticated cleanup"
-    );
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/recovery.rs b/crates/workshop/desktop/src/gateway/tests/recovery.rs
deleted file mode 100644
index d8ed47ae0..000000000
--- a/crates/workshop/desktop/src/gateway/tests/recovery.rs
+++ /dev/null
@@ -1,444 +0,0 @@
-//! Continuous supervision, recovery, and joined-shutdown coverage.
-
-use std::cell::{Cell, RefCell};
-use std::io::{Read as _, Write as _};
-use std::net::TcpListener;
-use std::path::Path;
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-use std::sync::{Arc, mpsc};
-use std::time::{Duration, Instant};
-
-use anyhow::Context as _;
-use workshop_server_api::discovery::{
-    CancellationToken, GatewayDiscoveryFile, ValidatedConnection,
-};
-
-use super::{
-    TestIdentity, assert_bounded_supervisor_shutdown, get, live_file, test_identity,
-    validated_gateway,
-};
-use crate::gateway::boot::RecoveryLaunch;
-use crate::gateway::supervisor::{
-    GatewaySupervisor, RecoveryCandidate, RecoveryOwnership, SUPERVISION_MAX_DELAY,
-    SupervisionProbe, launch_and_attach_cancellable_with, run_supervision, validate_recovery,
-};
-
-/// How long a test listens to prove the named fixture received no shutdown.
-/// The fixture reports only accepted shutdowns over its control socket, and
-/// the request a regression would add comes from a detached drop thread, so
-/// no later event is ordered after it; absence needs a wall-clock window.
-const NO_SHUTDOWN_TIMEOUT: Duration = Duration::from_millis(100);
-
-#[test]
-fn supervision_lives_past_sixty_seconds_then_propagates_a_configured_key_edit_atomically() {
-    let gateway = validated_gateway("new-key");
-    let original = gateway.gateway_discovery_file("old-key", 1_757_000_000, "2026-09-03T12:00:00Z");
-    let replacement =
-        gateway.gateway_discovery_file("new-key", 1_757_000_001, "2026-09-03T12:00:01Z");
-    let state_dir = tempfile::TempDir::new().expect("create Workshop state directory");
-    let server = workshop_server_api::fixtures::spawn(workshop_server_api::Config {
-        gateway: workshop_server_api::GatewayConfig {
-            base_url: format!("http://127.0.0.1:{}", original.port),
-            api_key: original.api_key.clone(),
-        },
-        server: workshop_server_api::ServerConfig {
-            bind: "127.0.0.1:0".to_owned(),
-            state_dir: state_dir.path().to_owned(),
-        },
-        agents: workshop_server_api::AgentsConfig::default(),
-    })
-    .expect("spawn Workshop against the original same-port key");
-    let updater = server.gateway_updater();
-    let publish_replacement = |file: &GatewayDiscoveryFile| -> anyhow::Result<()> {
-        let validated = ValidatedConnection::validate(file.clone())
-            .context("validate the named local Gateway")?;
-        updater
-            .replace_sidecar(&validated)
-            .context("publish through the production updater")
-    };
-    let elapsed = Cell::new(Duration::ZERO);
-    let recoveries = Cell::new(0_u8);
-    let published = RefCell::new(Vec::new());
-    let cancellation = CancellationToken::new();
-
-    run_supervision(
-        test_identity(original.clone()),
-        |current, _| {
-            if !published.borrow().is_empty() || elapsed.get() <= Duration::from_secs(65) {
-                SupervisionProbe::Replacement(current.clone())
-            } else {
-                SupervisionProbe::Missing
-            }
-        },
-        |_| {
-            recoveries.set(recoveries.get() + 1);
-            if recoveries.get() < 3 {
-                anyhow::bail!("injected launch failure");
-            }
-            Ok(test_identity(replacement.clone()))
-        },
-        |identity, _| {
-            publish_replacement(&identity.file)?;
-            published.borrow_mut().push(identity.file.clone());
-            Ok::<(), anyhow::Error>(())
-        },
-        |delay, _| {
-            assert!(
-                delay <= SUPERVISION_MAX_DELAY,
-                "every supervision wait is capped: {delay:?}"
-            );
-            elapsed.set(elapsed.get() + delay);
-            !published.borrow().is_empty()
-        },
-        &cancellation,
-    );
-
-    assert!(
-        elapsed.get() > Duration::from_secs(60),
-        "the supervisor remains live beyond one minute"
-    );
-    assert_eq!(recoveries.get(), 3, "failed launches retry under backoff");
-    assert_eq!(
-        published.borrow().as_slice(),
-        [replacement],
-        "one successful relaunch publishes its exact discovery-file pair"
-    );
-    assert_eq!(
-        published.borrow()[0].port,
-        original.port,
-        "an OS-assigned port may be reused"
-    );
-    assert_ne!(
-        published.borrow()[0].api_key,
-        original.api_key,
-        "a configured key edit propagates with the replacement identity"
-    );
-    let response = get(server.url(), "/gateway/api/admin/status");
-    assert!(
-        response.starts_with("HTTP/1.1 200"),
-        "the real publisher replaces the bearer on the reused port: {response}"
-    );
-    server.shutdown().expect("stop the Workshop fixture");
-}
-
-#[test]
-fn reused_pid_and_file_metadata_still_publish_a_new_validated_process_boot() {
-    let file = live_file(54_375, "stable-key");
-    let original = TestIdentity {
-        file: file.clone(),
-        process_boot: 41,
-    };
-    let replacement = TestIdentity {
-        file: file.clone(),
-        process_boot: 42,
-    };
-    let published = RefCell::new(Vec::new());
-    let cancellation = CancellationToken::new();
-
-    run_supervision(
-        original.clone(),
-        |current, _| {
-            if published.borrow().is_empty() {
-                SupervisionProbe::Replacement(replacement.clone())
-            } else {
-                SupervisionProbe::Replacement(current.clone())
-            }
-        },
-        |_| -> anyhow::Result<TestIdentity> {
-            panic!("a validated replacement does not need a relaunch")
-        },
-        |identity, _| {
-            published.borrow_mut().push(identity.clone());
-            Ok(())
-        },
-        |_, _| !published.borrow().is_empty(),
-        &cancellation,
-    );
-
-    assert_eq!(
-        published.borrow().as_slice(),
-        [replacement],
-        "the stable OS boot token prevents identical file fields from hiding pid reuse"
-    );
-    assert_eq!(published.borrow()[0].file, original.file);
-}
-
-#[test]
-fn an_exact_spawned_pid_authenticates_late_child_cleanup() {
-    let mut gateway = validated_gateway("owned-key");
-    let validated = gateway.validate("owned-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let RecoveryOwnership::Owned(candidate) =
-        RecoveryCandidate::authenticate(validated.pid(), validated)
-    else {
-        panic!("the validated file names the spawned child");
-    };
-
-    drop(candidate);
-
-    assert!(
-        gateway.received_shutdown(Duration::from_secs(1)),
-        "an unpublished owned child receives authenticated shutdown"
-    );
-}
-
-#[test]
-fn explicit_candidate_shutdown_delivers_and_disarms_the_drop_signal() {
-    let mut gateway = validated_gateway("owned-key");
-    let validated = gateway.validate("owned-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let RecoveryOwnership::Owned(candidate) =
-        RecoveryCandidate::authenticate(validated.pid(), validated)
-    else {
-        panic!("the validated file names the spawned child");
-    };
-
-    candidate
-        .shutdown()
-        .expect("the fixture accepts the authenticated shutdown");
-
-    assert!(
-        gateway.received_shutdown(Duration::from_secs(1)),
-        "the explicit path signals the unpublished child"
-    );
-    assert!(
-        !gateway.received_shutdown(NO_SHUTDOWN_TIMEOUT),
-        "the disarmed drop sends no second signal"
-    );
-}
-
-#[test]
-fn explicit_candidate_shutdown_reports_a_delivery_failure() {
-    let validated = {
-        let gateway = validated_gateway("owned-key");
-        gateway.validate("owned-key", 1_778_000_001, "2026-09-08T18:00:01Z")
-    };
-    let RecoveryOwnership::Owned(candidate) =
-        RecoveryCandidate::authenticate(validated.pid(), validated)
-    else {
-        panic!("the validated file names the spawned child");
-    };
-
-    let error = candidate
-        .shutdown()
-        .expect_err("a dead child cannot accept the shutdown");
-    assert!(
-        matches!(
-            error,
-            workshop_server_api::discovery::ShutdownError::Io { .. }
-        ),
-        "the explicit path reports the delivery failure: {error}"
-    );
-}
-
-#[test]
-fn dropping_a_candidate_signals_without_waiting_for_an_unresponsive_child() {
-    // The fixture child lends its validatable pid; the hanging listener
-    // answers the validation probe, then parks the shutdown connection.
-    let gateway = validated_gateway("hanging-key");
-    let reference = gateway.validate("hanging-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let hang = Arc::new(AtomicBool::new(false));
-    let (_hang_tx, hang_rx) = std::sync::mpsc::channel::<()>();
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind the hanging fixture");
-    let port = listener.local_addr().expect("the fixture address").port();
-    std::thread::spawn({
-        let hang = Arc::clone(&hang);
-        move || {
-            while let Ok((mut stream, _)) = listener.accept() {
-                let mut buffer = [0_u8; 1024];
-                if hang.load(Ordering::SeqCst) {
-                    let _ = stream.read(&mut buffer);
-                    // Park the shutdown connection until the test drops the
-                    // gate, so the child stays unresponsive for as long as
-                    // the test needs, without a fixed wall-clock delay.
-                    let _ = hang_rx.recv();
-                    continue;
-                }
-                while let Ok(read) = stream.read(&mut buffer) {
-                    if read == 0 {
-                        break;
-                    }
-                    if stream
-                        .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
-                        .is_err()
-                    {
-                        break;
-                    }
-                }
-            }
-        }
-    });
-    let file = GatewayDiscoveryFile {
-        port,
-        api_key: "hanging-key".to_owned(),
-        pid: reference.pid(),
-        epoch: 1_778_000_001,
-        version: "test".to_owned(),
-        started_at: "2026-09-08T18:00:01Z".to_owned(),
-    };
-    let validated = ValidatedConnection::validate(file).expect("the hanging endpoint validates");
-    hang.store(true, Ordering::SeqCst);
-    let RecoveryOwnership::Owned(candidate) =
-        RecoveryCandidate::authenticate(validated.pid(), validated)
-    else {
-        panic!("the validated file names the spawned child");
-    };
-
-    let started = Instant::now();
-    drop(candidate);
-    // The unresponsive child is a real socket, and a blocking drop would
-    // still return at the production late-child deadline, so only elapsed
-    // time separates it from a detached signal.
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "drop signals on a detached thread instead of waiting out the late-child budget"
-    );
-}
-
-#[test]
-fn a_mismatched_spawned_pid_never_claims_or_cleans_the_validated_process() {
-    let mut gateway = validated_gateway("unowned-key");
-    let validated = gateway.validate("unowned-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let run = tempfile::TempDir::new().expect("create run directory");
-    gateway
-        .gateway_discovery_file("unowned-key", 1_778_000_001, "2026-09-08T18:00:01Z")
-        .write_to(run.path())
-        .expect("retain the uncertain connection record");
-
-    let RecoveryOwnership::Unowned(unowned) =
-        RecoveryCandidate::authenticate(validated.pid() + 1, validated)
-    else {
-        panic!("a different validated pid cannot prove ownership");
-    };
-    drop(unowned);
-
-    assert!(
-        !gateway.received_shutdown(NO_SHUTDOWN_TIMEOUT),
-        "an uncertain process never receives destructive cleanup"
-    );
-    assert!(
-        workshop_server_api::discovery::gateway_discovery_file_path(run.path()).exists(),
-        "uncertain cleanup retains the connection record"
-    );
-}
-
-#[test]
-fn successful_publication_disarms_late_child_cleanup() {
-    let mut gateway = validated_gateway("published-key");
-    let validated = gateway.validate("published-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let RecoveryOwnership::Owned(mut candidate) =
-        RecoveryCandidate::authenticate(validated.pid(), validated)
-    else {
-        panic!("the validated file names the spawned child");
-    };
-
-    candidate.mark_published();
-    drop(candidate);
-
-    assert!(
-        !gateway.received_shutdown(NO_SHUTDOWN_TIMEOUT),
-        "an authoritative published child remains running"
-    );
-}
-
-#[test]
-fn launched_recovery_retains_the_spawned_pid_and_releases_launch_lock() {
-    let run = tempfile::TempDir::new().expect("create run directory");
-    let decision =
-        workshop_server_api::discovery::launch_or_attach(run.path(), Duration::from_secs(1))
-            .expect("acquire launch election");
-    let file = live_file(54_375, "candidate-key");
-    let cancellation = CancellationToken::new();
-
-    let recovery = launch_and_attach_cancellable_with(
-        run.path(),
-        Path::new("unused-gateway"),
-        &cancellation,
-        |_, _, _| Ok(decision),
-        |_, _| Ok(4242),
-        |_, _, _| Ok(file.clone()),
-    )
-    .expect("complete injected launch");
-
-    match recovery {
-        RecoveryLaunch::Launched {
-            child_pid,
-            file: observed,
-        } => {
-            assert_eq!(child_pid, 4242);
-            assert_eq!(observed, file);
-        }
-        RecoveryLaunch::Attached(_) => panic!("the elected launcher retains child ownership"),
-    }
-    assert!(
-        matches!(
-            workshop_server_api::discovery::launch_or_attach(run.path(), Duration::from_secs(1))
-                .expect("reacquire launch election"),
-            workshop_server_api::discovery::LaunchDecision::Launch(_)
-        ),
-        "returning the candidate releases LaunchLock"
-    );
-}
-
-#[test]
-fn failed_validation_never_claims_or_removes_a_spawned_process_record() {
-    let run = tempfile::TempDir::new().expect("create run directory");
-    let file = GatewayDiscoveryFile {
-        pid: super::dead_pid(),
-        ..live_file(54_375, "unvalidated-key")
-    };
-    file.write_to(run.path()).expect("write uncertain record");
-    let cancellation = CancellationToken::new();
-
-    let result = validate_recovery(
-        RecoveryLaunch::Launched {
-            child_pid: file.pid,
-            file,
-        },
-        &cancellation,
-    );
-
-    assert!(
-        result.is_err(),
-        "failed validation creates no owned candidate"
-    );
-    assert!(
-        workshop_server_api::discovery::gateway_discovery_file_path(run.path()).exists(),
-        "failed validation retains an uncertain process record"
-    );
-}
-
-#[test]
-fn exit_wakes_the_supervision_wait_without_a_later_probe() {
-    let (entered, blocked) = mpsc::channel();
-    let probes = Arc::new(AtomicUsize::new(0));
-    let worker_probes = Arc::clone(&probes);
-    let finished = Arc::new(AtomicBool::new(false));
-    let worker_finished = Arc::clone(&finished);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        run_supervision(
-            test_identity(live_file(54_375, "stable-key")),
-            |current, _| {
-                worker_probes.fetch_add(1, Ordering::SeqCst);
-                SupervisionProbe::Replacement(current.clone())
-            },
-            |_| -> anyhow::Result<TestIdentity> { panic!("a healthy Gateway does not recover") },
-            |_, _| Ok::<(), anyhow::Error>(()),
-            |delay, cancellation| {
-                entered.send(()).expect("announce supervision wait");
-                cancellation.wait_timeout(delay)
-            },
-            &cancellation,
-        );
-        worker_finished.store(true, Ordering::SeqCst);
-    })
-    .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the supervision wait blocks deterministically");
-
-    assert_bounded_supervisor_shutdown(supervisor, &finished);
-    assert_eq!(
-        probes.load(Ordering::SeqCst),
-        1,
-        "cancellation prevents every later liveness probe"
-    );
-}
diff --git a/crates/workshop/desktop/src/gateway/tests/shutdown.rs b/crates/workshop/desktop/src/gateway/tests/shutdown.rs
deleted file mode 100644
index bef87469e..000000000
--- a/crates/workshop/desktop/src/gateway/tests/shutdown.rs
+++ /dev/null
@@ -1,225 +0,0 @@
-//! Bounded Gateway supervisor and late-publication shutdown coverage.
-
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-use std::sync::{Arc, mpsc};
-use std::time::Duration;
-
-use super::validated_gateway;
-use crate::gateway::supervisor::{
-    GatewaySupervisor, SUPERVISOR_SHUTDOWN_BUDGET, SupervisedGatewayIdentity, SupervisionProbe,
-    SupervisorShutdown, run_supervision,
-};
-
-/// How long a test waits for a teardown that must finish while its worker
-/// is still parked. Shorter than [`SUPERVISOR_SHUTDOWN_BUDGET`], so a
-/// shutdown that ignores its injected budget and waits out the production
-/// one fails instead of passing late.
-const TEARDOWN_DEADLINE: Duration = Duration::from_secs(2);
-const _: () = assert!(TEARDOWN_DEADLINE.as_millis() < SUPERVISOR_SHUTDOWN_BUDGET.as_millis());
-
-/// A shutdown budget longer than [`TEARDOWN_DEADLINE`], so a teardown that
-/// waits it out fails instead of passing late.
-const UNREACHED_BUDGET: Duration = Duration::from_secs(3600);
-
-/// A supervised identity reduced to its process boot.
-#[derive(Clone)]
-struct Boot(u64);
-
-impl SupervisedGatewayIdentity for Boot {
-    fn same_boot(&self, other: &Self) -> bool {
-        self.0 == other.0
-    }
-}
-
-/// Runs `teardown` on its own thread while the caller keeps the worker
-/// parked. A teardown that waits for the worker cannot finish, so it
-/// reports a timeout instead of hanging the test.
-fn teardown_while_parked<T: Send + 'static>(
-    teardown: impl FnOnce() -> T + Send + 'static,
-) -> Result<T, mpsc::RecvTimeoutError> {
-    let (finished, outcome) = mpsc::channel();
-    std::thread::spawn(move || {
-        let _ = finished.send(teardown());
-    });
-    outcome.recv_timeout(TEARDOWN_DEADLINE)
-}
-
-#[test]
-fn supervisor_shutdown_reports_a_worker_panic_without_unwinding_teardown() {
-    let supervisor = GatewaySupervisor::spawn(|_| panic!("injected supervisor panic"))
-        .expect("spawn test supervisor");
-
-    assert_eq!(supervisor.shutdown(), SupervisorShutdown::Panicked);
-}
-
-#[test]
-fn supervisor_shutdown_detaches_an_uncooperative_worker_at_one_deadline() {
-    let (release, blocked) = mpsc::channel();
-    let supervisor = GatewaySupervisor::spawn_with_budget(Duration::from_millis(50), move |_| {
-        let _ = blocked.recv();
-    })
-    .expect("spawn test supervisor");
-
-    assert_eq!(
-        teardown_while_parked(move || supervisor.shutdown()),
-        Ok(SupervisorShutdown::Detached),
-        "an uncooperative worker cannot outlive the shutdown budget"
-    );
-    release.send(()).expect("release the detached test worker");
-}
-
-#[test]
-fn stop_signaling_never_waits_for_an_in_progress_effect_gate() {
-    let (entered, blocked) = mpsc::channel();
-    let (release, await_release) = mpsc::channel();
-    let supervisor =
-        GatewaySupervisor::spawn_with_budget(Duration::from_millis(50), move |cancellation| {
-            let _ = cancellation.run_if_active(|| {
-                entered.send(()).expect("announce admitted effect");
-                let _ = await_release.recv();
-            });
-        })
-        .expect("spawn test supervisor");
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the worker enters the effect gate");
-
-    assert_eq!(
-        teardown_while_parked(move || supervisor.shutdown()),
-        Ok(SupervisorShutdown::Detached),
-        "the stop signal cannot join an admitted effect before the bounded completion wait"
-    );
-    release.send(()).expect("release the detached test worker");
-}
-
-#[test]
-fn a_spurious_completion_wake_cannot_trigger_a_blocking_join() {
-    let (release, blocked) = mpsc::channel();
-    let supervisor = GatewaySupervisor::spawn_with_budget(Duration::from_millis(50), move |_| {
-        let _ = blocked.recv();
-    })
-    .expect("spawn test supervisor");
-    let wake = supervisor.completion_waker_for_test();
-    let waking = Arc::new(AtomicBool::new(true));
-    let waker = std::thread::spawn({
-        let waking = Arc::clone(&waking);
-        move || {
-            while waking.load(Ordering::SeqCst) {
-                wake();
-                std::thread::yield_now();
-            }
-        }
-    });
-
-    let outcome = teardown_while_parked(move || supervisor.shutdown());
-    waking.store(false, Ordering::SeqCst);
-    waker.join().expect("the waker thread stops");
-
-    assert_eq!(
-        outcome,
-        Ok(SupervisorShutdown::Detached),
-        "a wake without completion must keep waiting only to the original deadline"
-    );
-    release.send(()).expect("release the detached test worker");
-}
-
-#[test]
-fn dropping_a_supervisor_signals_and_detaches_without_waiting() {
-    let (release, blocked) = mpsc::channel();
-    let supervisor = GatewaySupervisor::spawn_with_budget(UNREACHED_BUDGET, move |_| {
-        let _ = blocked.recv();
-    })
-    .expect("spawn test supervisor");
-
-    assert_eq!(
-        teardown_while_parked(move || drop(supervisor)),
-        Ok(()),
-        "Drop signals and detaches instead of waiting out the shutdown budget"
-    );
-    release.send(()).expect("release the detached test worker");
-}
-
-#[test]
-fn a_shut_down_supervisor_launches_nothing_when_its_gateway_later_disappears() {
-    let (entered, healthy) = mpsc::channel();
-    let gone = Arc::new(AtomicBool::new(false));
-    let worker_gone = Arc::clone(&gone);
-    let launches = Arc::new(AtomicUsize::new(0));
-    let worker_launches = Arc::clone(&launches);
-    let supervisor = GatewaySupervisor::spawn(move |cancellation| {
-        run_supervision(
-            Boot(1),
-            |current, _| {
-                if worker_gone.load(Ordering::SeqCst) {
-                    SupervisionProbe::Missing
-                } else {
-                    SupervisionProbe::Replacement(current.clone())
-                }
-            },
-            |_| -> anyhow::Result<Boot> {
-                worker_launches.fetch_add(1, Ordering::SeqCst);
-                Ok(Boot(2))
-            },
-            |_, _| Ok::<(), anyhow::Error>(()),
-            |delay, cancellation| {
-                let _ = entered.send(());
-                cancellation.wait_timeout(delay)
-            },
-            &cancellation,
-        );
-    })
-    .expect("spawn test supervisor");
-    healthy
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the supervisor observes the healthy gateway");
-    gone.store(true, Ordering::SeqCst);
-
-    assert_eq!(supervisor.shutdown(), SupervisorShutdown::Joined);
-    assert_eq!(
-        launches.load(Ordering::SeqCst),
-        0,
-        "quit stops the gateway only after its supervisor, so nothing relaunches it"
-    );
-}
-
-#[test]
-fn shutdown_revokes_publication_before_waking_a_late_worker() {
-    let state_dir = tempfile::TempDir::new().expect("create Workshop state directory");
-    let server = workshop_server_api::fixtures::spawn(workshop_server_api::Config {
-        gateway: workshop_server_api::GatewayConfig {
-            base_url: "http://127.0.0.1:54375".to_owned(),
-            api_key: "old-key".to_owned(),
-        },
-        server: workshop_server_api::ServerConfig {
-            bind: "127.0.0.1:0".to_owned(),
-            state_dir: state_dir.path().to_owned(),
-        },
-        agents: workshop_server_api::AgentsConfig::default(),
-    })
-    .expect("spawn Workshop");
-    let updater = server.gateway_updater();
-    let worker_updater = updater.clone();
-    let replacement_gateway = validated_gateway("replacement-key");
-    let replacement =
-        replacement_gateway.validate("replacement-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let rejected = Arc::new(AtomicBool::new(false));
-    let worker_rejected = Arc::clone(&rejected);
-    let supervisor = GatewaySupervisor::spawn_with_publication(updater, move |cancellation| {
-        let _ = cancellation.wait_timeout(Duration::from_secs(30));
-        worker_rejected.store(
-            matches!(
-                worker_updater.replace_sidecar(&replacement),
-                Err(workshop_server_api::GatewayPublicationError::PublicationClosed)
-            ),
-            Ordering::SeqCst,
-        );
-    })
-    .expect("spawn late publisher");
-
-    assert_eq!(supervisor.shutdown(), SupervisorShutdown::Joined);
-    assert!(
-        rejected.load(Ordering::SeqCst),
-        "the worker wakes only after permanent publication closure"
-    );
-    server.shutdown().expect("stop Workshop");
-}
diff --git a/crates/workshop/desktop/src/linux_media.rs b/crates/workshop/desktop/src/linux_media.rs
deleted file mode 100644
index 1cb72ba16..000000000
--- a/crates/workshop/desktop/src/linux_media.rs
+++ /dev/null
@@ -1,42 +0,0 @@
-//! Linux microphone permission for the workshop window.
-//!
-//! WebKitGTK ships two defaults that together break voice dictation:
-//! `enable-media-stream` is off, and the stock `permission-request` handler
-//! denies every request it never saw a listener override, including
-//! microphone/camera grabs. Neither is fixable from outside the embedding
-//! application, so the session opts in here and auto-allows only user-media
-//! requests - every other permission kind (notifications, geolocation, ...)
-//! keeps the default deny.
-
-use anyhow::Context as _;
-use webkit2gtk::{
-    PermissionRequestExt as _, SettingsExt as _, UserMediaPermissionRequest, WebViewExt as _,
-    glib::Cast as _,
-};
-
-/// Enables media capture on the window's webview and connects the
-/// permission handler for the webview's lifetime.
-///
-/// # Errors
-/// Returns an error when the closure cannot be dispatched to the webview's
-/// thread; the caller logs it and the mic stays unavailable, nothing else
-/// breaks.
-pub(crate) fn grant_media_permissions(window: &tauri::WebviewWindow) -> anyhow::Result<()> {
-    window
-        .with_webview(|webview| {
-            let webview = webview.inner();
-            if let Some(settings) = webview.settings() {
-                settings.set_enable_media_stream(true);
-            }
-            webview.connect_permission_request(|_webview, request| match request
-                .downcast_ref::<UserMediaPermissionRequest>(
-            ) {
-                Some(request) => {
-                    request.allow();
-                    true
-                }
-                None => false,
-            });
-        })
-        .context("dispatch the media permission setup to the webview thread")
-}
diff --git a/crates/workshop/desktop/src/main.rs b/crates/workshop/desktop/src/main.rs
deleted file mode 100644
index 802b354e3..000000000
--- a/crates/workshop/desktop/src/main.rs
+++ /dev/null
@@ -1,502 +0,0 @@
-//! The `runvil-workshop` binary: the Runvil Workshop desktop app.
-//!
-//! Runs the workshop server in-process on a loopback listener with an
-//! OS-assigned port and opens a Tauri window pointed at the in-process
-//! listener's URL. Boot first connects the gateway: attach to a running
-//! gateway through its gateway discovery file, or launch the sibling
-//! `runvil-gateway` detached when none is running - a Workshop-only
-//! install falls back to the explicit `workshop.toml` `[gateway]` config,
-//! and with neither boot fails loud naming both remedies. The in-process
-//! server then resolves the same endpoint itself. Closing the window
-//! stops the in-process server only: the gateway is a separate process
-//! and keeps running; the window menu's quit item is the one gesture
-//! that also stops a local gateway.
-//!
-//! ## Invariants
-//!
-//! - The webview loads only the in-process server's exact origin; every
-//!   other http(s) target opens in the system browser.
-//! - The `main` window's Tauri capability is granted to that exact bound
-//!   origin, built at setup, and never to a wildcard port.
-
-// Release builds are a GUI app: no console window when launched from the
-// installer. Debug builds keep the console so the eprintln diagnostics show.
-// The tradeoff: in release those diagnostics have nowhere to print, so a
-// boot failure also shows its error chain in a dialog (`boot_and_open`).
-#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
-
-// The only unsafe module in the crate: the WebView2 COM surface that
-// reads real OS paths out of dropped File objects and grants the
-// microphone has no safe wrapper.
-#[cfg(target_os = "windows")]
-#[expect(unsafe_code, reason = "raw WebView2 COM has no safe wrapper")]
-mod bridge;
-mod config;
-mod drops;
-mod gateway;
-#[cfg(target_os = "linux")]
-mod linux_media;
-mod menu;
-mod navigation;
-mod quit;
-mod window_state;
-
-use std::ffi::OsStr;
-use std::process::ExitCode;
-use std::sync::{Mutex, PoisonError};
-use std::time::Duration;
-
-use anyhow::Context as _;
-use tauri::ipc::CapabilityBuilder;
-use tauri::{Manager as _, WebviewUrl, WebviewWindowBuilder};
-use tauri_plugin_dialog::{DialogExt as _, MessageDialogKind};
-use tauri_plugin_opener::OpenerExt as _;
-use workshop_server_api::ServerHandle;
-
-/// How long the app waits for the in-process server's health endpoint
-/// before giving up.
-const HEALTH_TIMEOUT: Duration = Duration::from_secs(15);
-
-/// The managed slot holding the server until the `RunEvent::Exit` handler
-/// shuts it down. `shutdown` consumes the handle, so the slot hands it over
-/// exactly once.
-type ServerSlot = Mutex<Option<ServerHandle>>;
-
-/// The managed local-sidecar supervisor, absent for an explicit LAN Gateway.
-type GatewaySupervisorSlot = Mutex<Option<gateway::GatewaySupervisor>>;
-
-/// The permission set the workshop page holds. The grant itself is built
-/// in setup with the exact bound port: the OS assigns the port at boot, so
-/// no capability file can name the origin.
-const WINDOW_PERMISSIONS: &[&str] = &[
-    "core:default",
-    "core:window:default",
-    "core:window:allow-minimize",
-    "core:window:allow-close",
-    "core:window:allow-start-dragging",
-    "core:window:allow-toggle-maximize",
-    "core:webview:allow-set-webview-zoom",
-    "core:event:default",
-    "dialog:allow-open",
-    "dialog:allow-save",
-    "updater:default",
-    "process:allow-restart",
-    "allow-desktop-update-supported",
-    "allow-quit",
-];
-
-fn main() -> ExitCode {
-    if std::env::args_os().any(|arg| arg == "--version") {
-        return print_version();
-    }
-    if std::env::args_os().any(|arg| arg == "--plugins") {
-        return print_plugins();
-    }
-    match run() {
-        Ok(()) => ExitCode::SUCCESS,
-        Err(error) => {
-            eprintln!("{error:?}");
-            ExitCode::FAILURE
-        }
-    }
-}
-
-/// `runvil-workshop --version`: print the version and exit, without
-/// booting the server or opening a window. The release workflows smoke-test
-/// the installed package with it. The release build is GUI-subsystem on
-/// Windows, but a piped or inherited stdout still receives the line.
-fn print_version() -> ExitCode {
-    println!("runvil-workshop {}", env!("CARGO_PKG_VERSION"));
-    ExitCode::SUCCESS
-}
-
-/// `runvil-workshop --plugins`: print each library Plugin this
-/// installation loads, as its name and its version, and exit, without
-/// booting the server or opening a window. A library that does not load
-/// goes to stderr with the reason. Workshop keeps no log, so this is how
-/// a person sees why an agent has no file tools or no shell, and the
-/// release workflows check the installed Plugins with it.
-fn print_plugins() -> ExitCode {
-    let directory = match config::load() {
-        Ok(config) => config.agents.plugins,
-        Err(error) => {
-            eprintln!("{error:?}");
-            return ExitCode::FAILURE;
-        }
-    };
-    let Some(directory) = directory else {
-        eprintln!("this installation names no Plugin directory");
-        return ExitCode::FAILURE;
-    };
-    match workshop_server_api::list_plugin_dir(&directory) {
-        Ok(listing) => {
-            for line in &listing.loaded {
-                println!("{line}");
-            }
-            for line in &listing.failed {
-                eprintln!("{line}");
-            }
-            ExitCode::SUCCESS
-        }
-        Err(error) => {
-            eprintln!(
-                "cannot read the Plugin directory {}: {error}",
-                directory.display()
-            );
-            ExitCode::FAILURE
-        }
-    }
-}
-
-fn update_supported(os: &str, appimage: Option<&OsStr>) -> bool {
-    os != "linux" || appimage.is_some_and(|value| !value.is_empty())
-}
-
-#[tauri::command]
-fn desktop_update_supported() -> bool {
-    update_supported(
-        std::env::consts::OS,
-        std::env::var_os("APPIMAGE").as_deref(),
-    )
-}
-
-fn run() -> anyhow::Result<()> {
-    let builder = tauri::Builder::default()
-        // Registered first so a second launch exits inside `build`, before
-        // its own setup could spawn a second in-process server and race
-        // the first instance's gateway attach.
-        .plugin(tauri_plugin_single_instance::init(|app, _args, _cwd| {
-            if let Some(window) = app.get_webview_window("main") {
-                let _ = window.unminimize();
-                let _ = window.set_focus();
-            }
-        }))
-        .plugin(tauri_plugin_dialog::init())
-        .plugin(tauri_plugin_opener::init())
-        .plugin(tauri_plugin_process::init())
-        .plugin(tauri_plugin_updater::Builder::new().build())
-        .invoke_handler(tauri::generate_handler![
-            desktop_update_supported,
-            quit::quit
-        ])
-        .on_menu_event(menu::handle_event)
-        .setup(boot_and_open);
-    // Off Windows, OS file drops arrive as Tauri's own drag-drop event and
-    // are dispatched into the same runvil:file-drop grant flow. On
-    // Windows the drag-drop handler is disabled (see open_window) and drops
-    // arrive over the WebView2 web-message bridge instead.
-    #[cfg(not(target_os = "windows"))]
-    let builder = builder.on_window_event(|window, event| {
-        if let tauri::WindowEvent::DragDrop(tauri::DragDropEvent::Drop { paths, .. }) = event
-            && let Some(webview) = window.get_webview_window(window.label())
-        {
-            drops::dispatch_file_drop(&webview, paths);
-        }
-    });
-    let app = builder
-        .build(tauri::generate_context!())
-        .context("build the desktop application")?;
-    app.run(|handle, event| {
-        if let tauri::RunEvent::Exit = event {
-            let supervisor = handle.try_state::<GatewaySupervisorSlot>().and_then(|slot| {
-                slot.lock()
-                    .unwrap_or_else(PoisonError::into_inner)
-                    .take()
-            });
-            let supervisor_outcome = supervisor.map(gateway::GatewaySupervisor::shutdown);
-            let server = handle
-                .try_state::<ServerSlot>()
-                .map(|slot| slot.lock().unwrap_or_else(PoisonError::into_inner).take());
-            continue_teardown(supervisor_outcome, || {
-                if let Some(Some(server)) = server {
-                    match server.shutdown() {
-                        Ok(workshop_server_api::Termination::Graceful) => {}
-                        Ok(termination) => {
-                            eprintln!("the workshop server was forced down past its drain window: {termination:?}");
-                        }
-                        Err(error) => {
-                            eprintln!("could not shut the workshop server down cleanly: {error:?}");
-                        }
-                    }
-                }
-            });
-        }
-    });
-    Ok(())
-}
-
-/// Reports a supervisor shutdown that did not join cleanly. `None` means
-/// there was no supervisor, or quit already stopped it.
-fn report_supervisor_shutdown(supervisor: Option<gateway::SupervisorShutdown>) {
-    match supervisor {
-        Some(gateway::SupervisorShutdown::Joined) | None => {}
-        Some(gateway::SupervisorShutdown::Panicked) => {
-            eprintln!("the gateway supervisor panicked during shutdown");
-        }
-        Some(gateway::SupervisorShutdown::Detached) => {
-            eprintln!("the gateway supervisor exceeded its shutdown budget and was detached");
-        }
-    }
-}
-
-fn continue_teardown(
-    supervisor: Option<gateway::SupervisorShutdown>,
-    shutdown_server: impl FnOnce(),
-) {
-    report_supervisor_shutdown(supervisor);
-    shutdown_server();
-}
-
-/// The setup hook: connects the gateway (attach or launch), boots the
-/// in-process server, installs the window's exact-port capability and the
-/// menu, and opens the window on the server's URL. A boot failure prints
-/// its full error chain, shows it in an error dialog, and exits the process
-/// directly once the dialog closes: a release build on Windows has no
-/// console, and returning `Err` would surface as Tauri's "Failed to setup
-/// app" panic, losing the chain and the failure exit code. The hook returns
-/// while the dialog is up, because some platforms run dialogs on the event
-/// loop.
-fn boot_and_open(app: &mut tauri::App) -> Result<(), Box<dyn std::error::Error>> {
-    match boot() {
-        Ok((server, url, attachment, supervisor)) => {
-            // The capability must exist before the window does: the
-            // authority resolves a window's grants at creation.
-            app.add_capability(window_capability(&url))?;
-            app.manage(GatewaySupervisorSlot::new(supervisor));
-            app.manage(ServerSlot::new(Some(server)));
-            menu::install(app, attachment.sidecar_identity().is_some())?;
-            open_window(app, &url)
-        }
-        Err(error) => {
-            eprintln!("{error:?}");
-            #[expect(
-                clippy::exit,
-                reason = "an Err from the setup hook becomes Tauri's \"Failed to setup app\" panic, \
-                          which loses the error chain and the failure exit code"
-            )]
-            app.dialog()
-                .message(format!("{error:?}"))
-                .title("Runvil could not start")
-                .kind(MessageDialogKind::Error)
-                .show(|_| std::process::exit(1));
-            Ok(())
-        }
-    }
-}
-
-/// Connects the gateway (attach to a live gateway discovery file, or
-/// launch the sibling `runvil-gateway` detached), then spawns the
-/// in-process workshop server - which resolves the same endpoint itself,
-/// gateway discovery file first, explicit `workshop.toml` config
-/// second - and waits out its
-/// health probe. A failure after the spawn shuts the server down before
-/// propagating.
-fn boot() -> anyhow::Result<(
-    ServerHandle,
-    url::Url,
-    gateway::GatewayAttachment,
-    Option<gateway::GatewaySupervisor>,
-)> {
-    let config = config::load().context("load the workshop configuration")?;
-    let attachment = gateway::ensure_gateway(&config).context("connect to the gateway")?;
-    let server =
-        workshop_server_api::spawn(config).context("start the in-process workshop server")?;
-    let attachment = attachment.reconcile_publication(server.initial_gateway_identity().cloned());
-    match workshop_server_api::discovery::wait_for_health(server.url(), HEALTH_TIMEOUT)
-        .context("wait for the in-process workshop server")
-    {
-        Ok(()) => {
-            let url = url::Url::parse(server.url()).context("parse the workshop URL")?;
-            let supervisor = match gateway::supervise(&attachment, server.gateway_updater()) {
-                Ok(supervisor) => supervisor,
-                Err(error) => {
-                    if let Err(shutdown_error) = server.shutdown() {
-                        eprintln!("{shutdown_error:?}");
-                    }
-                    return Err(error.context("supervise the local gateway"));
-                }
-            };
-            Ok((server, url, attachment, supervisor))
-        }
-        Err(error) => {
-            if let Err(shutdown_error) = server.shutdown() {
-                eprintln!("{shutdown_error:?}");
-            }
-            Err(error)
-        }
-    }
-}
-
-/// The `main` window's capability: the permission set granted to the
-/// exact loopback origin the in-process server bound. Building it in
-/// setup is what lets the bind stay an OS-assigned port - a capability
-/// file could name only a wildcard port, which would hand the window's
-/// Tauri API surface to any other loopback server on the machine.
-fn window_capability(url: &url::Url) -> CapabilityBuilder {
-    let builder = CapabilityBuilder::new("workshop-main")
-        .local(false)
-        .remote(url.origin().ascii_serialization())
-        .window("main");
-    WINDOW_PERMISSIONS
-        .iter()
-        .fold(builder, |builder, permission| {
-            builder.permission(*permission)
-        })
-}
-
-/// Creates the workshop window on `url`: hidden while built so the
-/// window-state restore never flashes, undecorated on Windows where the
-/// custom HTML title bar replaces the native frame, overlay-titled on
-/// macOS where the native traffic lights float over the custom bar's left
-/// edge (the bar hides its Windows-style control cluster there), decorated
-/// on Linux, restored to the open workspace file's saved
-/// geometry, then shown. The saver that writes geometry back into the
-/// file is installed before the show, so the first layout pass is saved.
-fn open_window(app: &mut tauri::App, url: &url::Url) -> Result<(), Box<dyn std::error::Error>> {
-    let server_origin = url.origin();
-    let opener = app.handle().clone();
-    let builder = WebviewWindowBuilder::new(app, "main", WebviewUrl::External(url.clone()))
-        .title("Runvil")
-        .inner_size(1024.0, 768.0)
-        .visible(false)
-        .on_navigation(move |target| {
-            match navigation::classify_navigation(&server_origin, target.as_str()) {
-                navigation::Navigation::Allow => true,
-                navigation::Navigation::OpenExternally => {
-                    if let Err(error) = opener.opener().open_url(target.as_str(), None::<&str>) {
-                        eprintln!("could not open {target} in the system browser: {error}");
-                    }
-                    false
-                }
-            }
-        });
-    // Tauri's drag-drop handler suppresses HTML5 drag events on Windows
-    // (https://github.com/tauri-apps/tauri/issues/15138), so Windows keeps
-    // the handler off and takes Explorer drops over the WebView2
-    // web-message bridge instead (bridge.rs).
-    #[cfg(target_os = "windows")]
-    let builder = builder.disable_drag_drop_handler();
-    // macOS gets VS Code's overlay treatment: the native traffic lights
-    // float over the webview's top-left with no native title bar, and the
-    // custom HTML bar hides its Windows-style control cluster
-    // (window-chrome.ts) and insets its left region clear of the lights.
-    #[cfg(target_os = "macos")]
-    let builder = builder
-        .title_bar_style(tauri::TitleBarStyle::Overlay)
-        .hidden_title(true);
-    let window = builder.build()?;
-    // An attach failure only degrades Explorer drops and the mic grant,
-    // never the app.
-    #[cfg(target_os = "windows")]
-    if let Err(error) = bridge::attach(&window) {
-        eprintln!(
-            "could not attach the WebView2 bridge; Explorer drops and the microphone grant are unavailable: {error}"
-        );
-    }
-    #[cfg(target_os = "linux")]
-    if let Err(error) = linux_media::grant_media_permissions(&window) {
-        eprintln!(
-            "could not enable WebKitGTK media capture; the microphone is unavailable: {error}"
-        );
-    }
-    // Decorations come off after construction, not at build time: the
-    // Groupy-compatible title bar pattern proven by other Tauri apps.
-    #[cfg(target_os = "windows")]
-    window.set_decorations(false)?;
-    // Geometry comes from the workspace file through the server. The
-    // server is healthy by now (boot waited on it), so the fetch is a
-    // loopback round trip; a failure leaves the default geometry and is
-    // reported, never fatal.
-    match window_state::ServerClient::new(url) {
-        Ok(client) => {
-            let restored = window_state::restore(&window, &client);
-            window_state::spawn_saver(&window, client, restored);
-        }
-        Err(error) => {
-            eprintln!("window geometry will not be restored or saved: {error:#}");
-        }
-    }
-    window.show()?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use tauri::ipc::RuntimeCapability as _;
-    use tauri::utils::acl::capability::CapabilityFile;
-
-    #[test]
-    fn crate_is_named_workshop() {
-        assert_eq!(env!("CARGO_PKG_NAME"), "workshop");
-    }
-
-    #[test]
-    fn linux_updates_require_an_appimage_runtime() {
-        assert!(!update_supported("linux", None));
-        assert!(!update_supported("linux", Some(OsStr::new(""))));
-        assert!(update_supported(
-            "linux",
-            Some(OsStr::new("/tmp/Runvil.AppImage"))
-        ));
-        assert!(update_supported("windows", None));
-        assert!(update_supported("macos", None));
-    }
-
-    #[test]
-    fn the_window_capability_names_the_exact_bound_origin() {
-        let url = url::Url::parse("http://127.0.0.1:49152/").expect("the URL parses");
-        let CapabilityFile::Capability(capability) = window_capability(&url).build() else {
-            panic!("the builder produces a single capability");
-        };
-        assert!(
-            !capability.local,
-            "the window loads no local content; the grant is remote-only"
-        );
-        let remote = capability.remote.expect("the remote origins are set");
-        assert_eq!(
-            remote.urls,
-            vec!["http://127.0.0.1:49152".to_string()],
-            "the grant names the exact bound origin - a wildcard port would hand \
-             the Tauri API surface to any loopback server"
-        );
-        assert_eq!(capability.windows, vec!["main".to_string()]);
-        let permissions = format!("{:?}", capability.permissions);
-        for permission in WINDOW_PERMISSIONS {
-            assert!(
-                permissions.contains(permission),
-                "the capability includes {permission}"
-            );
-        }
-    }
-
-    #[test]
-    fn the_window_grants_both_native_pickers() {
-        // Open Workspace from File... uses the open picker; Save Workspace
-        // As... and Duplicate Workspace... use the save picker. A missing
-        // grant fails silently in the webview as a canceled dialog.
-        for permission in ["dialog:allow-open", "dialog:allow-save"] {
-            assert!(
-                WINDOW_PERMISSIONS.contains(&permission),
-                "the page needs {permission} for its File menu pickers"
-            );
-        }
-    }
-
-    #[test]
-    fn every_supervisor_outcome_continues_server_teardown() {
-        for outcome in [
-            gateway::SupervisorShutdown::Joined,
-            gateway::SupervisorShutdown::Panicked,
-            gateway::SupervisorShutdown::Detached,
-        ] {
-            let continued = std::cell::Cell::new(false);
-            continue_teardown(Some(outcome), || continued.set(true));
-            assert!(
-                continued.get(),
-                "{outcome:?} cannot prevent application teardown"
-            );
-        }
-    }
-}
diff --git a/crates/workshop/desktop/src/menu-tests.rs b/crates/workshop/desktop/src/menu-tests.rs
deleted file mode 100644
index 29d007795..000000000
--- a/crates/workshop/desktop/src/menu-tests.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-//! The quit item's accelerator: `CmdOrCtrl+Q` on macOS, where Cmd+Q is the
-//! platform's quit gesture, and none on Windows and Linux, where Ctrl+Q
-//! opens View in the SPA.
-
-use super::quit_accelerator;
-
-#[test]
-fn the_quit_item_keeps_cmd_or_ctrl_q_on_macos() {
-    assert_eq!(quit_accelerator(true), Some("CmdOrCtrl+Q"));
-}
-
-#[test]
-fn the_quit_item_has_no_accelerator_on_windows_and_linux() {
-    assert_eq!(quit_accelerator(false), None);
-}
diff --git a/crates/workshop/desktop/src/menu.rs b/crates/workshop/desktop/src/menu.rs
deleted file mode 100644
index 0a05b8101..000000000
--- a/crates/workshop/desktop/src/menu.rs
+++ /dev/null
@@ -1,105 +0,0 @@
-//! The window menu: the quit-everything affordance.
-//!
-//! The desktop app's only menu item quits the app through the shared
-//! shutdown-then-exit path in `quit.rs`, which the SPA's File > Exit row
-//! (the `quit` command) also runs: when boot attached to or launched a
-//! local sidecar gateway, the item first posts the gateway's `/shutdown`
-//! through the server's current validated Gateway snapshot, so one
-//! gesture stops the window, the in-process server, and the Gateway.
-//! Attached to a LAN Gateway through explicit config, the snapshot grants
-//! no shutdown authority, so the item stops the desktop app only and says so.
-
-use tauri::menu::{MenuBuilder, MenuItemBuilder, SubmenuBuilder};
-use tauri::{AppHandle, Wry};
-
-/// The quit item's menu id, matched by the event handler.
-const QUIT_MENU_ID: &str = "quit-runvil";
-
-/// The quit item's accelerator. macOS keeps `CmdOrCtrl+Q`, the platform's
-/// quit gesture. Windows and Linux have none: Ctrl+Q opens View in the SPA
-/// (the Open View... row), so quitting there goes through the SPA's File >
-/// Exit row and the `quit` command.
-fn quit_accelerator(macos: bool) -> Option<&'static str> {
-    macos.then_some("CmdOrCtrl+Q")
-}
-
-/// Builds and installs the app menu. A local sidecar makes the quit item
-/// stop both products; a configured LAN Gateway makes it stop only the desktop app.
-///
-/// # Errors
-/// Returns an error when the menu cannot be built or installed.
-pub(crate) fn install(app: &tauri::App, has_sidecar: bool) -> tauri::Result<()> {
-    let label = if has_sidecar {
-        "Quit Runvil and Gateway"
-    } else {
-        "Quit Runvil"
-    };
-    let mut quit = MenuItemBuilder::with_id(QUIT_MENU_ID, label);
-    if let Some(accelerator) = quit_accelerator(cfg!(target_os = "macos")) {
-        quit = quit.accelerator(accelerator);
-    }
-    let quit = quit.build(app)?;
-    // Setting a menu replaces the stock one wholesale, so macOS
-    // re-declares the default layout (app, File, Edit, View, Window) with
-    // the stock Quit swapped for the quit-everything item. Windows and
-    // Linux get the single File submenu; the Windows window is
-    // undecorated, so the menu bar is hidden there, and with no
-    // accelerator (Ctrl+Q opens View there) the SPA's File > Exit row is
-    // the gesture.
-    #[cfg(target_os = "macos")]
-    let menu = {
-        let app_menu = SubmenuBuilder::new(app, "Runvil")
-            .about(None)
-            .separator()
-            .services()
-            .separator()
-            .hide()
-            .hide_others()
-            .show_all()
-            .separator()
-            .item(&quit)
-            .build()?;
-        let file = SubmenuBuilder::new(app, "File").close_window().build()?;
-        let edit = SubmenuBuilder::new(app, "Edit")
-            .undo()
-            .redo()
-            .separator()
-            .cut()
-            .copy()
-            .paste()
-            .select_all()
-            .build()?;
-        let view = SubmenuBuilder::new(app, "View").fullscreen().build()?;
-        let window = SubmenuBuilder::new(app, "Window")
-            .minimize()
-            .maximize()
-            .separator()
-            .close_window()
-            .build()?;
-        MenuBuilder::new(app)
-            .items(&[&app_menu, &file, &edit, &view, &window])
-            .build()?
-    };
-    #[cfg(not(target_os = "macos"))]
-    let menu = {
-        let file = SubmenuBuilder::new(app, "File").item(&quit).build()?;
-        MenuBuilder::new(app).item(&file).build()?
-    };
-    let _previous = app.set_menu(menu)?;
-    Ok(())
-}
-
-/// Handles the quit item by running the shared stop-then-shutdown-then-exit
-/// path (`quit::quit_everything`), the same path the SPA's File > Exit row
-/// invokes through the `quit` command.
-pub(crate) fn handle_event(app: &AppHandle<Wry>, event: tauri::menu::MenuEvent) {
-    let tauri::menu::MenuEvent { id } = event;
-    if id != QUIT_MENU_ID {
-        return;
-    }
-    crate::quit::quit_everything(app);
-}
-
-#[cfg(test)]
-#[path = "menu-tests.rs"]
-mod tests;
diff --git a/crates/workshop/desktop/src/navigation.rs b/crates/workshop/desktop/src/navigation.rs
deleted file mode 100644
index 72359eae0..000000000
--- a/crates/workshop/desktop/src/navigation.rs
+++ /dev/null
@@ -1,125 +0,0 @@
-//! The navigation policy: the webview may load only the server's own
-//! origin; every other http(s) target opens in the system browser.
-//!
-//! A clicked link never navigates the app away from itself, and no other
-//! loopback server - same machine, different port, or a different
-//! loopback spelling - gets the desktop app's Tauri API surface, folder
-//! picker, or file-drop bridge. Other schemes (`about:blank`, `data:`)
-//! and unparseable values are left to the webview.
-
-/// What the app does with a URL the webview wants to navigate to.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Navigation {
-    /// The webview loads the URL itself.
-    Allow,
-    /// The URL opens in the system browser; the webview stays put.
-    OpenExternally,
-}
-
-/// Classifies a navigation target against the server's origin: a
-/// same-origin http(s) URL (the in-process server) loads in the webview,
-/// while any other absolute http(s) URL opens in the system browser.
-#[must_use]
-pub(crate) fn classify_navigation(server: &url::Origin, target: &str) -> Navigation {
-    let Ok(url) = url::Url::parse(target) else {
-        return Navigation::Allow;
-    };
-    if !matches!(url.scheme(), "http" | "https") {
-        return Navigation::Allow;
-    }
-    if url.origin() == *server {
-        Navigation::Allow
-    } else {
-        Navigation::OpenExternally
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{Navigation, classify_navigation};
-
-    /// The origin of the in-process server the test window was opened on.
-    fn server_origin(url: &str) -> url::Origin {
-        match url::Url::parse(url) {
-            Ok(parsed) => parsed.origin(),
-            Err(error) => panic!("the test server URL must parse: {error}"),
-        }
-    }
-
-    #[test]
-    fn same_origin_urls_load_in_the_webview() {
-        let server = server_origin("http://127.0.0.1:7910/");
-        for url in [
-            "http://127.0.0.1:7910/",
-            "http://127.0.0.1:7910/ws",
-            "http://127.0.0.1:7910/settings?tab=keys#top",
-        ] {
-            assert_eq!(
-                classify_navigation(&server, url),
-                Navigation::Allow,
-                "{url}"
-            );
-        }
-    }
-
-    #[test]
-    fn a_default_port_normalizes_into_the_origin() {
-        let server = server_origin("https://127.0.0.1/");
-        assert_eq!(
-            classify_navigation(&server, "https://127.0.0.1:443/"),
-            Navigation::Allow
-        );
-    }
-
-    #[test]
-    fn other_loopback_origins_open_in_the_system_browser() {
-        let server = server_origin("http://127.0.0.1:7910/");
-        for url in [
-            // Another loopback server is not the workshop, whatever the
-            // port, scheme, or loopback spelling.
-            "http://127.0.0.1:4000/",
-            "https://127.0.0.1:7910/",
-            "http://localhost:7910/",
-            "http://[::1]:7910/",
-        ] {
-            assert_eq!(
-                classify_navigation(&server, url),
-                Navigation::OpenExternally,
-                "{url}"
-            );
-        }
-    }
-
-    #[test]
-    fn external_urls_open_in_the_system_browser() {
-        let server = server_origin("http://127.0.0.1:7910/");
-        for url in [
-            "https://example.com/",
-            "http://192.168.1.10/",
-            "https://localhost.evil.example/",
-        ] {
-            assert_eq!(
-                classify_navigation(&server, url),
-                Navigation::OpenExternally,
-                "{url}"
-            );
-        }
-    }
-
-    #[test]
-    fn non_http_and_unparseable_targets_are_left_to_the_webview() {
-        let server = server_origin("http://127.0.0.1:7910/");
-        for url in [
-            "about:blank",
-            "data:text/html,<p>hi</p>",
-            "not a url",
-            "/relative/path",
-        ] {
-            assert_eq!(
-                classify_navigation(&server, url),
-                Navigation::Allow,
-                "{url}"
-            );
-        }
-    }
-}
diff --git a/crates/workshop/desktop/src/quit-tests.rs b/crates/workshop/desktop/src/quit-tests.rs
deleted file mode 100644
index bb72b7057..000000000
--- a/crates/workshop/desktop/src/quit-tests.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-//! The quit ordering, and the shutdown-request half of quit against a
-//! stubbed gateway: the sidecar snapshot receives the authenticated
-//! `/shutdown`, a configured gateway is left running (no shutdown
-//! authority), and a missing server is a no-op.
-
-use std::cell::RefCell;
-use std::time::Duration;
-
-use super::{request_gateway_shutdown, stop_supervisor_then_request_shutdown};
-
-/// How long a test waits for the stubbed gateway to report the shutdown.
-const SHUTDOWN_OBSERVE_TIMEOUT: Duration = Duration::from_secs(10);
-/// How long a test waits to prove no shutdown was sent. The stub is a
-/// separate process that reports only accepted shutdowns over a real
-/// socket, after answering them, so no event marks the absence of one and
-/// the proof needs a wall-clock window.
-const NO_SHUTDOWN_TIMEOUT: Duration = Duration::from_millis(250);
-
-#[test]
-#[ignore = "runs only as a named child process"]
-fn validated_gateway_fixture_process() {
-    workshop_server_api::fixtures::run_validated_gateway_fixture_process();
-}
-
-/// Starts the shared named-process Gateway stub in this test binary.
-fn stubbed_gateway(expected_key: &str) -> workshop_server_api::fixtures::ValidatedGateway {
-    workshop_server_api::fixtures::ValidatedGateway::spawn_in(
-        expected_key,
-        "quit::tests::validated_gateway_fixture_process",
-    )
-}
-
-/// Spawns a Workshop fixture server configured against the gateway at
-/// `port` - an explicit configuration, which alone grants no shutdown
-/// authority.
-fn workshop_server(
-    port: u16,
-    api_key: &str,
-) -> (tempfile::TempDir, workshop_server_api::ServerHandle) {
-    let state_dir = tempfile::TempDir::new().expect("create Workshop state directory");
-    let server = workshop_server_api::fixtures::spawn(workshop_server_api::Config {
-        gateway: workshop_server_api::GatewayConfig {
-            base_url: format!("http://127.0.0.1:{port}"),
-            api_key: api_key.to_owned(),
-        },
-        server: workshop_server_api::ServerConfig {
-            bind: "127.0.0.1:0".to_owned(),
-            state_dir: state_dir.path().to_owned(),
-        },
-        agents: workshop_server_api::AgentsConfig::default(),
-    })
-    .expect("spawn Workshop fixture");
-    (state_dir, server)
-}
-
-#[test]
-fn quit_stops_the_supervisor_before_requesting_the_gateway_shutdown() {
-    let calls = RefCell::new(Vec::new());
-
-    stop_supervisor_then_request_shutdown(
-        || calls.borrow_mut().push("stop the supervisor"),
-        || calls.borrow_mut().push("request the gateway shutdown"),
-    );
-
-    assert_eq!(
-        calls.into_inner(),
-        ["stop the supervisor", "request the gateway shutdown"],
-        "a supervisor still running when the gateway stops would relaunch it"
-    );
-}
-
-#[test]
-fn quit_requests_shutdown_from_the_current_sidecar_snapshot() {
-    let mut gateway = stubbed_gateway("quit-key");
-    let (_state_dir, server) = workshop_server(gateway.port(), "quit-key");
-    let updater = server.gateway_updater();
-    let sidecar = gateway.validate("quit-key", 1_778_000_001, "2026-09-15T18:00:01Z");
-    updater
-        .replace_sidecar(&sidecar)
-        .expect("the sidecar identity publishes");
-
-    request_gateway_shutdown(Some(updater));
-
-    assert!(
-        gateway.received_shutdown(SHUTDOWN_OBSERVE_TIMEOUT),
-        "quit posts the authenticated shutdown to the current sidecar"
-    );
-    server.shutdown().expect("stop the Workshop fixture");
-}
-
-#[test]
-fn quit_leaves_a_configured_gateway_running() {
-    let mut gateway = stubbed_gateway("lan-key");
-    let (_state_dir, server) = workshop_server(gateway.port(), "lan-key");
-
-    request_gateway_shutdown(Some(server.gateway_updater()));
-
-    assert!(
-        !gateway.received_shutdown(NO_SHUTDOWN_TIMEOUT),
-        "an explicitly configured gateway grants no shutdown authority"
-    );
-    server.shutdown().expect("stop the Workshop fixture");
-}
-
-#[test]
-fn quit_without_a_server_requests_nothing() {
-    request_gateway_shutdown(None);
-}
diff --git a/crates/workshop/desktop/src/quit.rs b/crates/workshop/desktop/src/quit.rs
deleted file mode 100644
index 14bd3d2e1..000000000
--- a/crates/workshop/desktop/src/quit.rs
+++ /dev/null
@@ -1,91 +0,0 @@
-//! The quit-everything gesture, shared by the native menu's quit item and
-//! the SPA's File > Exit row (the `quit` command): one
-//! stop-then-shutdown-then-exit path so the two cannot diverge. The path
-//! first stops the local-sidecar supervisor, so nothing relaunches the
-//! gateway this gesture is about to stop. When boot attached to or
-//! launched a local sidecar gateway, the path then posts the gateway's
-//! `/shutdown` through the server's current validated Gateway snapshot, so
-//! one gesture stops the window, the in-process server, and the Gateway.
-//! Attached to a LAN Gateway through explicit config, there is no
-//! supervisor and the snapshot grants no shutdown authority, so the gesture
-//! stops the desktop app only.
-
-use std::sync::PoisonError;
-
-use tauri::{AppHandle, Manager as _, Wry};
-use workshop_server_api::GatewayUpdater;
-
-use crate::gateway::GatewaySupervisor;
-use crate::{GatewaySupervisorSlot, ServerSlot};
-
-/// The quit ordering: stop the supervisor, then request the gateway's
-/// shutdown. The reverse order races: a supervisor still running when the
-/// gateway stops sees it missing and launches a replacement.
-fn stop_supervisor_then_request_shutdown(
-    stop_supervisor: impl FnOnce(),
-    request_shutdown: impl FnOnce(),
-) {
-    stop_supervisor();
-    request_shutdown();
-}
-
-/// The supervisor-stop half: takes the local-sidecar supervisor out of its
-/// slot and shuts it down, reporting a worker that panicked or outlived its
-/// budget. The `RunEvent::Exit` handler then finds the slot empty.
-fn stop_supervisor(app: &AppHandle<Wry>) {
-    let supervisor = app
-        .try_state::<GatewaySupervisorSlot>()
-        .and_then(|slot| slot.lock().unwrap_or_else(PoisonError::into_inner).take());
-    crate::report_supervisor_shutdown(supervisor.map(GatewaySupervisor::shutdown));
-}
-
-/// The shutdown-request half: asks the server's current validated local
-/// Gateway snapshot to post `/shutdown`. A configured LAN Gateway grants
-/// no shutdown authority, so its snapshot sends nothing. A refused or
-/// undeliverable request is reported and quit proceeds anyway - quit
-/// always works, even when the Gateway is wedged.
-fn request_gateway_shutdown(gateway: Option<GatewayUpdater>) {
-    if let Some(gateway) = gateway
-        && let Err(error) = gateway.request_shutdown()
-    {
-        eprintln!(
-            "the gateway did not accept the shutdown request; quitting the desktop app anyway: {error}"
-        );
-    }
-}
-
-/// The shared stop-then-shutdown-then-exit path: stop the supervisor,
-/// request the local Gateway's shutdown, then exit the desktop app (the
-/// `RunEvent::Exit` handler stops the in-process server).
-pub(crate) fn quit_everything(app: &AppHandle<Wry>) {
-    stop_supervisor_then_request_shutdown(
-        || stop_supervisor(app),
-        || {
-            let gateway = app.try_state::<ServerSlot>().and_then(|slot| {
-                slot.lock()
-                    .unwrap_or_else(PoisonError::into_inner)
-                    .as_ref()
-                    .map(workshop_server_api::ServerHandle::gateway_updater)
-            });
-            request_gateway_shutdown(gateway);
-        },
-    );
-    app.exit(0);
-}
-
-/// The `quit` command behind the SPA's File > Exit row. It runs the same
-/// stop-then-shutdown-then-exit path as the native menu's quit item so the
-/// two gestures cannot diverge; a plain `process.exit` from the webview
-/// would strand the sidecar gateway.
-#[tauri::command]
-#[expect(
-    clippy::needless_pass_by_value,
-    reason = "a Tauri command handler receives the app handle by value"
-)]
-pub(crate) fn quit(app: AppHandle<Wry>) {
-    quit_everything(&app);
-}
-
-#[cfg(test)]
-#[path = "quit-tests.rs"]
-mod tests;
diff --git a/crates/workshop/desktop/src/window_state-tests.rs b/crates/workshop/desktop/src/window_state-tests.rs
deleted file mode 100644
index 8c52ab095..000000000
--- a/crates/workshop/desktop/src/window_state-tests.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//! Window geometry without a window: the physical-to-logical mapping the
-//! saver applies under a scale factor, the maximized merge that keeps the
-//! normal rectangle, the empty-size guard on a saved geometry, the debounce
-//! that turns a drag's burst of events into one save, and the wire shape
-//! the server's workspace-file routes speak.
-
-use std::sync::mpsc;
-use std::time::Duration;
-
-use tauri::{PhysicalPosition, PhysicalSize};
-
-use super::{CurrentResponse, Debouncer, SavedResponse, WindowState, geometry, merge, usable};
-
-/// How long a test waits for the debouncer to deliver a coalesced save.
-const DELIVERY_TIMEOUT: Duration = Duration::from_secs(5);
-/// The debounce a test runs with: long enough that a burst pushed in a
-/// tight loop lands inside one window, short enough to keep the test fast.
-const TEST_DEBOUNCE: Duration = Duration::from_millis(150);
-
-fn state(width: u32, height: u32, x: i32, y: i32, maximized: bool) -> WindowState {
-    WindowState {
-        width,
-        height,
-        x,
-        y,
-        maximized,
-    }
-}
-
-#[test]
-fn physical_geometry_maps_to_logical_under_the_scale_factor() {
-    // A 200% display: the OS reports twice the logical pixels in every
-    // axis, and the file keeps logical pixels so a 100% display restores
-    // the same apparent size.
-    let mapped = geometry(
-        PhysicalSize::new(2560, 1600),
-        PhysicalPosition::new(200, -100),
-        2.0,
-        false,
-    );
-    assert_eq!(mapped, state(1280, 800, 100, -50, false));
-
-    // At 100% the mapping is the identity.
-    let identity = geometry(
-        PhysicalSize::new(1024, 768),
-        PhysicalPosition::new(40, 60),
-        1.0,
-        false,
-    );
-    assert_eq!(identity, state(1024, 768, 40, 60, false));
-
-    // The maximized flag passes through untouched.
-    let maximized = geometry(
-        PhysicalSize::new(3840, 2100),
-        PhysicalPosition::new(-8, -8),
-        1.5,
-        true,
-    );
-    assert!(maximized.maximized);
-    assert_eq!((maximized.width, maximized.height), (2560, 1400));
-}
-
-#[test]
-fn a_maximized_snapshot_keeps_the_last_normal_rectangle() {
-    let normal = state(1280, 800, 100, 50, false);
-    let maximized_rect = state(2560, 1400, -8, -8, true);
-
-    // Maximizing reports the screen rectangle; the file keeps the normal
-    // one so un-maximizing after a restart lands where the user left it.
-    assert_eq!(
-        merge(Some(normal), maximized_rect),
-        state(1280, 800, 100, 50, true)
-    );
-    // Un-maximizing takes the fresh rectangle again.
-    let moved = state(1000, 700, 300, 200, false);
-    assert_eq!(merge(Some(state(1280, 800, 100, 50, true)), moved), moved);
-    // With nothing remembered, the maximized rectangle is all there is.
-    assert_eq!(merge(None, maximized_rect), maximized_rect);
-}
-
-#[test]
-fn a_saved_geometry_with_an_empty_side_is_not_applied() {
-    assert!(
-        !usable(state(0, 800, 100, 50, false)),
-        "a zero width is empty"
-    );
-    assert!(
-        !usable(state(1280, 0, 100, 50, false)),
-        "a zero height is empty"
-    );
-    assert!(
-        !usable(state(0, 0, 0, 0, true)),
-        "a zero size is empty even when maximized"
-    );
-    assert!(
-        usable(state(1, 1, -32_000, -32_000, false)),
-        "any nonzero size is usable; the position is checked against the monitors separately"
-    );
-}
-
-#[test]
-fn a_burst_of_geometry_events_coalesces_into_one_save() {
-    let (sink, saved) = mpsc::channel();
-    let debouncer = Debouncer::spawn(TEST_DEBOUNCE, move |value: WindowState| {
-        sink.send(value).expect("the test holds the receiver");
-    });
-
-    // A drag: many events inside the debounce window.
-    for x in 0..50 {
-        debouncer.push(state(1280, 800, x, 0, false));
-    }
-
-    let first = saved
-        .recv_timeout(DELIVERY_TIMEOUT)
-        .expect("the burst produces one save");
-    assert_eq!(first, state(1280, 800, 49, 0, false), "the last value wins");
-    assert!(
-        saved.recv_timeout(TEST_DEBOUNCE * 3).is_err(),
-        "no intermediate value reaches the sink"
-    );
-
-    // A second, separate gesture saves again.
-    debouncer.push(state(1000, 700, 5, 5, true));
-    let second = saved
-        .recv_timeout(DELIVERY_TIMEOUT)
-        .expect("a later gesture produces its own save");
-    assert_eq!(second, state(1000, 700, 5, 5, true));
-}
-
-#[test]
-fn the_wire_shape_matches_the_server_fixture() {
-    // Copied from the server's `WindowState` (the kv 'window' value and
-    // the `PUT /workspace/file/window-state` body) and the
-    // `GET /workspace/file/current` answer.
-    let request = serde_json::to_value(state(1280, 800, 100, -50, false))
-        .expect("a five-field struct of plain values serializes");
-    assert_eq!(
-        request,
-        serde_json::json!({
-            "width": 1280,
-            "height": 800,
-            "x": 100,
-            "y": -50,
-            "maximized": false
-        })
-    );
-
-    let current: CurrentResponse = serde_json::from_str(
-        r#"{"path":"C:\\ws\\Name.rvwork","name":"Name","grants":[{"path":"C:\\src","exists":true}],"window_state":{"width":1280,"height":800,"x":100,"y":-50,"maximized":true}}"#,
-    )
-    .expect("the current-file answer parses");
-    assert_eq!(current.window_state, Some(state(1280, 800, 100, -50, true)));
-
-    let ephemeral: CurrentResponse =
-        serde_json::from_str(r#"{"path":null,"name":"Untitled","grants":[],"window_state":null}"#)
-            .expect("the ephemeral answer parses");
-    assert_eq!(ephemeral.window_state, None);
-
-    let saved: SavedResponse =
-        serde_json::from_str(r#"{"saved":false}"#).expect("the window-state answer parses");
-    assert!(!saved.saved);
-}
diff --git a/crates/workshop/desktop/src/window_state.rs b/crates/workshop/desktop/src/window_state.rs
deleted file mode 100644
index 7c60dca9f..000000000
--- a/crates/workshop/desktop/src/window_state.rs
+++ /dev/null
@@ -1,448 +0,0 @@
-//! Window geometry through the workspace file. The desktop app restores the
-//! saved size, position, and maximized flag from
-//! `GET /workspace/file/current` before the window shows, writes them
-//! back through `PUT /workspace/file/window-state` - debounced while the
-//! user drags, once more on close - and reapplies them when the SPA opens,
-//! saves as, or duplicates a workspace file (its
-//! `runvil:workspace-opened` event). The workspace file, not a
-//! Tauri-plugin-owned location, owns the geometry: an ephemeral workspace
-//! has nowhere to keep it and the server answers `saved: false`.
-//!
-//! Every failure here logs and continues: a window that opens at the
-//! default size is a nuisance, a window that never opens is a boot
-//! failure, and nothing in this module is allowed to cause the second.
-
-use std::fmt;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::mpsc::{self, RecvTimeoutError};
-use std::sync::{Arc, Mutex, PoisonError};
-use std::time::Duration;
-
-use anyhow::Context as _;
-use serde::{Deserialize, Serialize};
-use tauri::{
-    Listener as _, LogicalPosition, LogicalSize, Manager as _, PhysicalPosition, PhysicalSize,
-    WebviewWindow, WindowEvent,
-};
-
-/// How long a burst of resize and move events must go quiet before the
-/// geometry is written. A drag fires dozens of events a second; one save
-/// per gesture is plenty.
-const SAVE_DEBOUNCE: Duration = Duration::from_millis(500);
-/// The budget for the final save on close. Past it the window closes
-/// with whatever the last debounced save wrote.
-const CLOSE_SAVE_TIMEOUT: Duration = Duration::from_secs(2);
-/// The budget for a fetch or a debounced save against the in-process
-/// server: loopback, so generous.
-const REQUEST_TIMEOUT: Duration = Duration::from_secs(5);
-/// The Tauri event the SPA emits after switching the workspace file, so
-/// the desktop app can apply the file's geometry to the live window.
-const WORKSPACE_OPENED_EVENT: &str = "runvil:workspace-opened";
-/// How far inside the saved top-left corner the monitor probe looks: a
-/// window whose first title-bar pixels are on a monitor can be grabbed.
-const VISIBILITY_INSET: i32 = 16;
-
-/// The window geometry as the workspace file keeps it: the server's
-/// `WindowState` mirrored field for field, in logical pixels.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub(crate) struct WindowState {
-    /// Logical width.
-    width: u32,
-    /// Logical height.
-    height: u32,
-    /// Logical x position of the window's outer top-left corner.
-    x: i32,
-    /// Logical y position of the window's outer top-left corner.
-    y: i32,
-    /// Whether the window is maximized; the rectangle is the normal one
-    /// to return to.
-    maximized: bool,
-}
-
-/// The part of the `GET /workspace/file/current` answer the desktop app reads.
-/// The path, name, and grants belong to the SPA and are ignored here.
-#[derive(Debug, Deserialize)]
-struct CurrentResponse {
-    /// The saved geometry; `null` while ephemeral or never saved.
-    window_state: Option<WindowState>,
-}
-
-/// The `PUT /workspace/file/window-state` answer.
-#[derive(Debug, Deserialize)]
-struct SavedResponse {
-    /// Whether the geometry was written; `false` for an ephemeral
-    /// workspace.
-    saved: bool,
-}
-
-/// The desktop app's minimal client for the in-process server's workspace-file
-/// routes. The server admits it as a native client: no `Origin`, a
-/// loopback `Host`, and `application/json` on the body it sends.
-#[derive(Debug, Clone)]
-pub(crate) struct ServerClient {
-    /// The server's bound URL, the same one the window loads.
-    base_url: url::Url,
-    /// The HTTP client, bounded by [`REQUEST_TIMEOUT`] per request.
-    http: reqwest::Client,
-}
-
-impl ServerClient {
-    /// Builds a client against the server at `base_url`.
-    pub(crate) fn new(base_url: &url::Url) -> anyhow::Result<Self> {
-        let http = reqwest::Client::builder()
-            .timeout(REQUEST_TIMEOUT)
-            .build()
-            .context("build the window-state HTTP client")?;
-        Ok(Self {
-            base_url: base_url.clone(),
-            http,
-        })
-    }
-
-    fn endpoint(&self, path: &str) -> anyhow::Result<url::Url> {
-        self.base_url
-            .join(path)
-            .with_context(|| format!("resolve {path} against {}", self.base_url))
-    }
-
-    /// Fetches the open workspace's saved geometry: `None` while the
-    /// workspace is ephemeral or has never saved one.
-    async fn current(&self) -> anyhow::Result<Option<WindowState>> {
-        let url = self.endpoint("workspace/file/current")?;
-        let response = self
-            .http
-            .get(url)
-            .send()
-            .await
-            .context("request the current workspace file")?
-            .error_for_status()
-            .context("the current-workspace request was refused")?;
-        let body: CurrentResponse = response
-            .json()
-            .await
-            .context("parse the current workspace file")?;
-        Ok(body.window_state)
-    }
-
-    /// Saves `state` into the open workspace file within `timeout`.
-    /// Returns whether the server wrote it (`false` for an ephemeral
-    /// workspace).
-    async fn put_window_state(
-        &self,
-        state: WindowState,
-        timeout: Duration,
-    ) -> anyhow::Result<bool> {
-        let url = self.endpoint("workspace/file/window-state")?;
-        let response = self
-            .http
-            .put(url)
-            .timeout(timeout)
-            .json(&state)
-            .send()
-            .await
-            .context("send the window state")?
-            .error_for_status()
-            .context("the window-state save was refused")?;
-        let body: SavedResponse = response
-            .json()
-            .await
-            .context("parse the window-state answer")?;
-        Ok(body.saved)
-    }
-}
-
-/// The window's geometry in logical pixels, as the file keeps it. The OS
-/// reports physical pixels; dividing by the scale factor keeps a window
-/// the same apparent size when the file moves between displays.
-fn geometry(
-    inner: PhysicalSize<u32>,
-    outer: PhysicalPosition<i32>,
-    scale_factor: f64,
-    maximized: bool,
-) -> WindowState {
-    let size: LogicalSize<u32> = inner.to_logical(scale_factor);
-    let position: LogicalPosition<i32> = outer.to_logical(scale_factor);
-    WindowState {
-        width: size.width,
-        height: size.height,
-        x: position.x,
-        y: position.y,
-        maximized,
-    }
-}
-
-/// Merges a fresh snapshot with the last known geometry. A maximized
-/// window reports the screen rectangle, so only its flag is taken and the
-/// normal rectangle stays what it was; anything else is taken whole.
-fn merge(previous: Option<WindowState>, current: WindowState) -> WindowState {
-    match previous {
-        Some(previous) if current.maximized => WindowState {
-            maximized: true,
-            ..previous
-        },
-        _ => current,
-    }
-}
-
-/// Trailing-edge debounce on one worker thread: values arriving within
-/// `delay` of each other replace one another, and the sink sees only the
-/// last of a burst once it goes quiet. One thread, not one per event,
-/// because a drag produces hundreds.
-struct Debouncer<T> {
-    /// The event side; the worker owns the receiver.
-    events: mpsc::Sender<T>,
-}
-
-impl<T> fmt::Debug for Debouncer<T> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("Debouncer").finish_non_exhaustive()
-    }
-}
-
-impl<T: Send + 'static> Debouncer<T> {
-    /// Starts the worker. If the thread cannot be spawned the debouncer
-    /// still exists and silently drops every value: geometry saves are
-    /// best effort.
-    pub(crate) fn spawn(delay: Duration, mut sink: impl FnMut(T) + Send + 'static) -> Self {
-        let (events, receiver) = mpsc::channel::<T>();
-        let spawned = std::thread::Builder::new()
-            .name("window-state-saver".to_owned())
-            .spawn(move || {
-                while let Ok(mut latest) = receiver.recv() {
-                    loop {
-                        match receiver.recv_timeout(delay) {
-                            Ok(value) => latest = value,
-                            Err(RecvTimeoutError::Timeout) => break,
-                            Err(RecvTimeoutError::Disconnected) => {
-                                sink(latest);
-                                return;
-                            }
-                        }
-                    }
-                    sink(latest);
-                }
-            });
-        if let Err(error) = spawned {
-            eprintln!(
-                "could not start the window-state saver; geometry will not be saved: {error}"
-            );
-        }
-        Self { events }
-    }
-
-    /// Offers a value; the sink sees it only if nothing newer arrives
-    /// within the delay.
-    fn push(&self, value: T) {
-        // A dead worker means saves are off; there is nothing to report
-        // per event.
-        let _ = self.events.send(value);
-    }
-}
-
-/// The geometry last applied or saved, shared by the saver's paths so a
-/// maximized snapshot can keep the normal rectangle.
-type LastGeometry = Arc<Mutex<Option<WindowState>>>;
-
-/// Restores the open workspace's saved geometry onto `window` - meant to
-/// run after the server is healthy and before `show()`, so the restore
-/// never flashes. Returns what was applied, for the saver to remember.
-/// A missing or unusable geometry leaves the window at its defaults.
-pub(crate) fn restore(window: &WebviewWindow, client: &ServerClient) -> Option<WindowState> {
-    let state = match tauri::async_runtime::block_on(client.current()) {
-        Ok(Some(state)) => state,
-        Ok(None) => return None,
-        Err(error) => {
-            eprintln!(
-                "could not read the saved window state; using the default geometry: {error:#}"
-            );
-            return None;
-        }
-    };
-    apply(window, state)
-}
-
-/// Installs the save paths on `window`: a debounced save behind
-/// [`SAVE_DEBOUNCE`] on resize and move, one best-effort save bounded by
-/// [`CLOSE_SAVE_TIMEOUT`] when the window is asked to close, and a
-/// listener that reapplies the geometry when the SPA switches workspace
-/// files. `restored` is what [`restore`] applied, if anything.
-pub(crate) fn spawn_saver(
-    window: &WebviewWindow,
-    client: ServerClient,
-    restored: Option<WindowState>,
-) {
-    let last: LastGeometry = Arc::new(Mutex::new(restored));
-    let saver = {
-        let client = client.clone();
-        Debouncer::spawn(SAVE_DEBOUNCE, move |state: WindowState| {
-            save(&client, state, REQUEST_TIMEOUT);
-        })
-    };
-    let closing = AtomicBool::new(false);
-    let events_window = window.clone();
-    let events_last = Arc::clone(&last);
-    let events_client = client.clone();
-    window.on_window_event(move |event| match event {
-        WindowEvent::Resized(_) | WindowEvent::Moved(_) => {
-            if let Some(state) = remember(&events_window, &events_last) {
-                saver.push(state);
-            }
-        }
-        WindowEvent::CloseRequested { .. } => {
-            if closing.swap(true, Ordering::SeqCst) {
-                return;
-            }
-            if let Some(state) = remember(&events_window, &events_last) {
-                save(&events_client, state, CLOSE_SAVE_TIMEOUT);
-            }
-        }
-        _ => {}
-    });
-
-    let switched_window = window.clone();
-    window
-        .app_handle()
-        .listen_any(WORKSPACE_OPENED_EVENT, move |_event| {
-            let window = switched_window.clone();
-            let client = client.clone();
-            let last = Arc::clone(&last);
-            tauri::async_runtime::spawn(async move {
-                match client.current().await {
-                    Ok(Some(state)) if usable(state) => {
-                        // Seed `last` before the setters run, not after:
-                        // `apply` returns as soon as the setters are
-                        // dispatched, while the `Resized` and `Moved`
-                        // events they raise reach `remember` on the
-                        // event-loop thread. A maximized snapshot merged
-                        // there must keep this file's rectangle, not the
-                        // previous workspace's. Then remember what was
-                        // applied, since the position may have been
-                        // skipped as off-monitor.
-                        *last.lock().unwrap_or_else(PoisonError::into_inner) = Some(state);
-                        if let Some(applied) = apply(&window, state) {
-                            *last.lock().unwrap_or_else(PoisonError::into_inner) = Some(applied);
-                        }
-                    }
-                    Ok(Some(_) | None) => {}
-                    Err(error) => {
-                        eprintln!(
-                            "could not read the opened workspace's window state; keeping the current geometry: {error:#}"
-                        );
-                    }
-                }
-            });
-        });
-}
-
-/// Snapshots the window, merges it with the last known geometry, and
-/// remembers the result. `None` while minimized (the OS reports a
-/// nonsense position) or when the window cannot be read.
-fn remember(window: &WebviewWindow, last: &LastGeometry) -> Option<WindowState> {
-    let current = snapshot(window)?;
-    let mut last = last.lock().unwrap_or_else(PoisonError::into_inner);
-    let merged = merge(*last, current);
-    *last = Some(merged);
-    Some(merged)
-}
-
-/// Reads the window's geometry in logical pixels. Runs on the event-loop
-/// thread inside a window event, where the getters answer directly.
-fn snapshot(window: &WebviewWindow) -> Option<WindowState> {
-    let read = || -> tauri::Result<Option<WindowState>> {
-        if window.is_minimized()? {
-            return Ok(None);
-        }
-        Ok(Some(geometry(
-            window.inner_size()?,
-            window.outer_position()?,
-            window.scale_factor()?,
-            window.is_maximized()?,
-        )))
-    };
-    match read() {
-        Ok(state) => state,
-        Err(error) => {
-            eprintln!("could not read the window geometry; skipping this save: {error}");
-            None
-        }
-    }
-}
-
-/// Writes `state` to the server within `timeout`, reporting a refusal
-/// and shrugging off an ephemeral workspace's `saved: false`.
-fn save(client: &ServerClient, state: WindowState, timeout: Duration) {
-    if let Err(error) = tauri::async_runtime::block_on(client.put_window_state(state, timeout)) {
-        eprintln!("could not save the window state: {error:#}");
-    }
-}
-
-/// Whether a saved geometry can be applied at all. An empty size is the
-/// one shape the server cannot reject for us; it is reported here and the
-/// window keeps its defaults.
-fn usable(state: WindowState) -> bool {
-    if state.width == 0 || state.height == 0 {
-        eprintln!(
-            "saved window size {}x{} is empty; using the default geometry",
-            state.width, state.height
-        );
-        return false;
-    }
-    true
-}
-
-/// Applies `state` to `window`: size, then position when the saved
-/// corner is on a monitor that still exists, then the maximized flag.
-/// Returns the geometry as applied - the window's actual position when
-/// the saved one was skipped as off-monitor, so a later maximized
-/// snapshot does not re-save a corner the window never occupied - or
-/// `None` when the state is unusable.
-fn apply(window: &WebviewWindow, state: WindowState) -> Option<WindowState> {
-    if !usable(state) {
-        return None;
-    }
-    let outcome = || -> tauri::Result<WindowState> {
-        let mut applied = state;
-        window.set_size(LogicalSize::new(state.width, state.height))?;
-        if corner_is_visible(window, state)? {
-            window.set_position(LogicalPosition::new(state.x, state.y))?;
-        } else {
-            eprintln!(
-                "saved window position ({}, {}) is off every monitor; keeping the default position",
-                state.x, state.y
-            );
-            let kept: LogicalPosition<i32> =
-                window.outer_position()?.to_logical(window.scale_factor()?);
-            applied.x = kept.x;
-            applied.y = kept.y;
-        }
-        if state.maximized {
-            window.maximize()?;
-        }
-        Ok(applied)
-    };
-    match outcome() {
-        Ok(applied) => Some(applied),
-        Err(error) => {
-            eprintln!("could not apply the saved window state: {error}");
-            None
-        }
-    }
-}
-
-/// Whether the saved top-left corner, inset a little so the title bar's
-/// first pixels count, lands on a connected monitor. A monitor that was
-/// unplugged since the save would otherwise swallow the window.
-fn corner_is_visible(window: &WebviewWindow, state: WindowState) -> tauri::Result<bool> {
-    let probe: PhysicalPosition<i32> = LogicalPosition::new(
-        state.x.saturating_add(VISIBILITY_INSET),
-        state.y.saturating_add(VISIBILITY_INSET),
-    )
-    .to_physical(window.scale_factor()?);
-    Ok(window
-        .monitor_from_point(f64::from(probe.x), f64::from(probe.y))?
-        .is_some())
-}
-
-#[cfg(test)]
-#[path = "window_state-tests.rs"]
-mod tests;
diff --git a/crates/workshop/desktop/tauri.conf.json b/crates/workshop/desktop/tauri.conf.json
deleted file mode 100644
index 476da2ff5..000000000
--- a/crates/workshop/desktop/tauri.conf.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  "$schema": "https://schema.tauri.app/config/2",
-  "productName": "Runvil",
-  "mainBinaryName": "runvil-workshop",
-  "identifier": "com.runvil.workshop",
-  "app": {
-    "withGlobalTauri": true,
-    "windows": []
-  },
-  "bundle": {
-    "active": true,
-    "createUpdaterArtifacts": true,
-    "icon": [
-      "icons/32x32.png",
-      "icons/128x128.png",
-      "icons/128x128@2x.png",
-      "icons/icon.icns",
-      "icons/icon.ico"
-    ],
-    "windows": {
-      "webviewInstallMode": {
-        "type": "embedBootstrapper",
-        "silent": true
-      },
-      "nsis": {
-        "template": "installer.nsi",
-        "headerImage": "icons/installer-header.bmp",
-        "sidebarImage": "icons/installer-sidebar.bmp",
-        "installerIcon": "icons/icon.ico",
-        "uninstallerIcon": "icons/icon.ico"
-      }
-    }
-  },
-  "plugins": {
-    "updater": {
-      "endpoints": [
-        "https://github.com/cppalliance/runvil/releases/download/workshop-latest/latest.json"
-      ],
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEU3QUNCQ0M4Mzk4M0YwMEEKUldRSzhJTTV5THlzNXpnRXFQellRelNSNm1rTWJiNkNLL0FoL3Y4UFdLeGxRajJJTG96RGFNNEwK",
-      "windows": {
-        "installMode": "passive"
-      }
-    }
-  }
-}
diff --git a/crates/workshop/desktop/tauri.linux.conf.json b/crates/workshop/desktop/tauri.linux.conf.json
deleted file mode 100644
index efc4fe095..000000000
--- a/crates/workshop/desktop/tauri.linux.conf.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "bundle": {
-    "targets": ["appimage"],
-    "linux": {
-      "appimage": {
-        "bundleMediaFramework": true
-      }
-    }
-  }
-}
diff --git a/crates/workshop/desktop/tauri.macos.conf.json b/crates/workshop/desktop/tauri.macos.conf.json
deleted file mode 100644
index 631d1529c..000000000
--- a/crates/workshop/desktop/tauri.macos.conf.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "bundle": {
-    "targets": ["app"],
-    "macOS": {
-      "entitlements": "./Entitlements.plist",
-      "infoPlist": "./Info.plist"
-    }
-  }
-}
diff --git a/crates/workshop/desktop/tauri.unsigned.conf.json b/crates/workshop/desktop/tauri.unsigned.conf.json
deleted file mode 100644
index 55a99462c..000000000
--- a/crates/workshop/desktop/tauri.unsigned.conf.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "bundle": {
-    "createUpdaterArtifacts": false
-  }
-}
diff --git a/crates/workshop/desktop/tauri.windows.conf.json b/crates/workshop/desktop/tauri.windows.conf.json
deleted file mode 100644
index a4ee420d8..000000000
--- a/crates/workshop/desktop/tauri.windows.conf.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "bundle": {
-    "externalBin": ["binaries/runvil-gateway"],
-    "targets": ["nsis"]
-  }
-}
diff --git a/crates/workshop/gateway-discovery/CONTRACT.md b/crates/workshop/gateway-discovery/CONTRACT.md
deleted file mode 100644
index f53d5e864..000000000
--- a/crates/workshop/gateway-discovery/CONTRACT.md
+++ /dev/null
@@ -1,198 +0,0 @@
-# The Gateway discovery contract
-
-The Gateway and Workshop meet through a file plus three HTTP calls. Nothing else is shared. This document is the whole of that meeting point: the file format, the two lock files, the stale rule, the shutdown route, the three calls, and the fixtures that pin them.
-
-Both sides are written against this text. Workshop's reader is [`workshop-gateway-discovery`](src/lib.rs), and the Gateway's writer lives in the `runvil-gateway` repository, which spells the same protocol from the other side. When the two disagree, this document is right and one of them has a bug.
-
-- Names in the file: `gateway.json`, `gateway.json.lock`, `gateway.instance.lock`, `gateway.log`
-- Endpoints: `GET /health`, `GET /v1/models`, `POST /shutdown`
-- Address: `127.0.0.1:{port}`, never `localhost`
-- Contract fixtures: [`fixtures/`](fixtures/)
-
-## The discovery file
-
-The Gateway writes `gateway.json` into the run directory once it has bound its loopback port. A reader that finds a live file attaches to that Gateway instead of starting a second one. This is the Jupyter `connection file` pattern.
-
-### The six fields
-
-```json
-{
-  "port": 8081,
-  "api_key": "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b",
-  "pid": 4242,
-  "epoch": 1757000000,
-  "version": "0.2.0",
-  "started_at": "2026-09-03T12:00:00Z"
-}
-```
-
-- `port` (integer, `u16`): the port the Gateway bound. A reader connects to `127.0.0.1:{port}`. Must not be `0`.
-- `api_key` (string): the bearer key every authenticated request carries. Must not be empty and must not contain a carriage return or a line feed, because it is written into an `Authorization` header line.
-- `pid` (integer, `u32`): the Gateway process id, used by stale detection. Must not be `0`.
-- `epoch` (integer, `u64`): the boot instant in unix seconds. `0` means "not recorded", and a file with `0` carries no boot identity, so it reads as stale.
-- `version` (string): the Gateway crate version, for diagnostics only.
-- `started_at` (string): the same boot instant as an RFC 3339 timestamp, for diagnostics and for boot identity comparison. A whitespace-only value means "not recorded".
-
-### Unknown fields
-
-A reader must tolerate fields it does not know. serde's derived `Deserialize` ignores them, which is what both sides rely on, so a newer Gateway can add a field without breaking an older Workshop.
-
-### Validation
-
-A file is valid when `port` is nonzero, `api_key` is nonempty and holds no line break, and `pid` is nonzero. A file that fails validation is not "absent": it is stale with reason `Invalid`, and the reader deletes it.
-
-A file carries a **boot identity** when `epoch` is nonzero and `started_at` is not blank. A file with valid fields but no boot identity is stale with reason `BootIdentityInvalid`.
-
-### JSON Schema
-
-The schema below is the machine-readable form of the field table. It is written by hand and kept beside the fixtures rather than generated, because the contract is the input to both sides, not an output of either.
-
-```json
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://runvil.example/schemas/gateway.json",
-  "title": "Gateway discovery file",
-  "type": "object",
-  "required": ["port", "api_key", "pid", "epoch", "version", "started_at"],
-  "additionalProperties": true,
-  "properties": {
-    "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
-    "api_key": { "type": "string", "minLength": 1, "pattern": "^[^\\r\\n]*$" },
-    "pid": { "type": "integer", "minimum": 1, "maximum": 4294967295 },
-    "epoch": { "type": "integer", "minimum": 0 },
-    "version": { "type": "string" },
-    "started_at": { "type": "string" }
-  }
-}
-```
-
-`additionalProperties` is `true` on purpose: unknown fields are tolerated. The `api_key` pattern is the "no line break" rule. `epoch` allows `0` even though a zero epoch makes the file stale, because the field is present-and-informational while the boot identity rule decides staleness.
-
-## The run directory and the two locks
-
-### Where things live
-
-- The run directory is `<home>/.runvil/run`, where `<home>` is the user profile directory the OS reports.
-- The state directory is `<home>/.runvil`, the run directory's parent.
-- `gateway.json`, `gateway.json.lock`, and `gateway.instance.lock` all sit in the run directory, beside each other.
-- `gateway.log` sits in `<home>/.runvil/logs/gateway.log`, beside the run directory rather than in it, because the Gateway starts logging before it loads its configuration, so a Gateway that exits on its configuration still records why.
-
-### The atomic owner-only write
-
-The Gateway must never leave a truncated `gateway.json`. A reader racing a writer must see either the whole previous file or the whole new one. So every write goes:
-
-1. to a uniquely named sibling temp file, `gateway.json.<pid>-<counter>.rv-tmp`, so two concurrent writers never fill the same temp;
-2. created with mode `0600` on Unix, so the bearer key never exists in a looser file and the rename carries that mode to the target;
-3. synced to disk;
-4. renamed over `gateway.json`, which is atomic within a directory.
-
-A failed write removes the temp and leaves the target's previous contents. On Windows there are no mode bits, and the file relies on the user profile's ACL, which already restricts it to the owner.
-
-Clean shutdown removes the file with `remove_if_mine`: it removes `gateway.json` only when the file's `pid` is the remover's own, so a shutting-down Gateway cannot delete a replacement's file. A missing file is not an error. An unreadable or foreign file is left for the next reader's stale cleanup.
-
-### `gateway.json.lock` - the launch election
-
-The problem it solves: two readers find no live Gateway at the same moment and both launch one. The Jupyter phantom-server bug class. The lock settles the race so exactly one launches.
-
-- It is an OS advisory lock on an ordinary file in the run directory. Whoever holds it is the launcher.
-- The holder **re-validates** `gateway.json` after taking the lock before deciding to launch, because a previous winner may have written the file and released the lock in between.
-- While another process holds it, a loser polls every 25 ms. As soon as the winner's file goes live the loser attaches to it.
-- A loser never deletes anything. Cleanup of a stale file is the lock holder's privilege, because only the holder knows no launch is in flight.
-- A loser that waits out its budget without an attachable Gateway reports a launch timeout.
-- Dropping the file handle releases the lock; there is no pid file and no explicit unlock.
-
-### `gateway.instance.lock` - process-lifetime ownership
-
-A different question from the launch election: is a Gateway process already alive on this machine?
-
-- Every Gateway process acquires this lock before it performs any startup side effect, and holds it until the process exits.
-- It is separate from `gateway.json.lock` because a Workshop parent may hold the launch election while the spawned Gateway acquires this lease. One lock cannot answer both questions.
-- Acquisition is non-blocking. "Another process owns it" is a normal answer, not an error.
-- The OS releases it when the owning process dies, so a killed Gateway frees it with no cleanup path.
-
-## The stale rule
-
-A reader attaches only to a file that proves a live, authorized Gateway **right now**. Everything else is stale: the file is deleted and the reader relaunches or falls back to explicit configuration.
-
-The rule, in order. Each step's failure is the reason recorded.
-
-1. **Read.** No file: nothing to attach to and nothing to clean. The file exists but cannot be read: an I/O error, not staleness. The file is not valid JSON, or fails field validation: stale, `Invalid`. The file is deleted.
-2. **One process boot, first observation.** Look up the pid's image and start marker. No such process: stale, `ProcessDead`. The image's file name is not `runvil-gateway` (`runvil-gateway.exe` on Windows, case-insensitively): stale, `ImageMismatch`. This is the reused-pid case.
-3. **Boot identity.** The file must carry one; see above. Missing: stale, `BootIdentityInvalid`.
-4. **One connection, two proofs.** Open one TCP connection to `127.0.0.1:{port}` and, on that same connection, send `GET /health` and then the bearer proof on `GET /v1/models`. Same connection matters: authority cannot come from a listener that replaced the endpoint after the health answer. Failures:
-   - health did not answer `200`: stale, `HealthFailed`;
-   - the socket was lost after health succeeded: stale, `HealthFailed`, and the reader does not reconnect, because a new connection could reach a different endpoint;
-   - the bearer answer was not 2xx: stale, `KeyRejected`.
-5. **One process boot, second observation.** Re-read the pid's image and start marker and require them identical to step 2's. The pid died or was reused: stale, `ProcessChanged`.
-
-The two observations bracket the network proof on purpose. That closes the health-to-bearer replacement gap and rejects pid reuse during the interval. The result is a point-in-time proof; it makes no claim that the process is still live after validation returns.
-
-A reader that must not delete (a launch-race loser) runs the same rule but treats the answer as a yes/no and leaves the file alone.
-
-### The stale reasons
-
-Every reader-visible reason, with what it means for an operator.
-
-- `Invalid` - the file was not valid JSON or failed field validation. Something wrote it badly, or it was truncated by a writer that is not following the atomic write.
-- `ProcessDead` - the recorded pid names no process. The Gateway exited without withdrawing its file, typically a crash.
-- `ImageMismatch` - the pid is alive but runs a different program, so the pid was reused. The recorded Gateway is gone.
-- `BootIdentityInvalid` - the file carries no boot identity, so the reader cannot tell one boot from another on the same pid and port.
-- `ProcessChanged` - the process identity changed while validation ran. The recorded Gateway died mid-proof.
-- `HealthFailed` - the process is the right image but does not answer `GET /health` with `200`. It is wedged or still starting.
-- `KeyRejected` - the process is the right image and is healthy, but refused the file's bearer key. The file is from a different boot than the listener.
-
-`HealthFailed` and `KeyRejected` are different operator problems: a wedged Gateway versus a stale key. Keep them distinct.
-
-## `POST /shutdown` and the log
-
-### The shutdown route
-
-A reader holding a validated connection asks the Gateway to exit by posting its bearer key to `POST /shutdown`.
-
-- The request is `POST /shutdown HTTP/1.0` with `Host: 127.0.0.1:{port}` and `Authorization: Bearer {api_key}`.
-- A 2xx answer means the Gateway accepted and is draining. The caller returns without waiting for the process to die; the launch election's instance lock is what actually reports the process going away.
-- Any other answer is a rejection, reported with its status line.
-- A delivery failure is an I/O error, including connect refused and read timeout.
-- The request carries an absolute deadline where the caller has one, so cleanup of a child that never answers cannot outlive its budget.
-
-The bearer is never in an error message or in `Debug` output. A rejected shutdown whose status line echoes the bearer must not surface the key.
-
-### The log path
-
-`<home>/.runvil/logs/gateway.log`. A reader that sees a launched Gateway exit without writing a file names this path in the error, because that log is the only place the Gateway's own reason appears.
-
-## The three HTTP calls
-
-All three are raw HTTP over `std::net::TcpStream`: no HTTP client crate, no TLS, no chunked encoding, no keep-alive beyond the one validation connection.
-
-### `GET /health`
-
-- Request: `GET /health HTTP/1.0`, `Host: 127.0.0.1:{port}`, blank line.
-- Success: the status code is `200`. The body is drained and ignored.
-- Used two ways: as a readiness poll while a launched Gateway comes up, and as the first half of the validation proof.
-- The readiness poll retries every 25 ms up to its budget, with a per-attempt connect and read timeout so one hung attempt cannot eat the whole budget. A failed attempt does not end the poll; the budget does, reporting the last attempt's error.
-
-### `GET /v1/models`
-
-- Request: `GET /v1/models HTTP/1.0`, `Host: 127.0.0.1:{port}`, `Authorization: Bearer {api_key}`, blank line.
-- Success: a 2xx status. The body is drained and ignored.
-- This is the authority proof: a 2xx says the bearer in the file is the bearer the listener accepts. It is sent on the same connection as the health request, in that order.
-
-### `POST /shutdown`
-
-Described above.
-
-### The `Host` header rule
-
-Every one of the three sends `Host: 127.0.0.1:{port}`, the address the caller actually connected to. The Gateway's loopback `Host` allowlist refuses anything else, so sending `localhost` (or a bare host with no port) fails the allowlist and reads as a rejection that has nothing to do with the key. Never send `localhost`.
-
-## Golden fixtures
-
-The `fixtures/` directory holds committed `gateway.json` bytes. They are the drift alarm: a change to the writer's serialization that a reader would misread shows up here.
-
-- [`fixtures/gateway.json`](fixtures/gateway.json) - a canonical file, the shape the Gateway writes.
-- [`fixtures/gateway-unknown-field.json`](fixtures/gateway-unknown-field.json) - the same file with one field a reader does not know, which must still parse.
-- [`fixtures/gateway-no-boot-identity.json`](fixtures/gateway-no-boot-identity.json) - a valid-fields file with a zero epoch and blank start time, which parses but carries no boot identity.
-- [`fixtures/gateway-invalid-port.json`](fixtures/gateway-invalid-port.json) - a zero port, which parses and fails validation.
-
-The tests that read these fixtures live beside the reader. The Gateway's own writer is pinned by the same fixtures from its side.
diff --git a/crates/workshop/gateway-discovery/Cargo.toml b/crates/workshop/gateway-discovery/Cargo.toml
deleted file mode 100644
index b17c9d4e3..000000000
--- a/crates/workshop/gateway-discovery/Cargo.toml
+++ /dev/null
@@ -1,42 +0,0 @@
-[package]
-name = "workshop-gateway-discovery"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-description = "The Gateway discovery contract as Workshop reads it: gateway.json, the launch election, stale detection, and authenticated shutdown"
-
-[dependencies]
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-
-# Process-image lookup for stale detection (src/sys/macos.rs): proc_pidpath.
-[target.'cfg(target_os = "macos")'.dependencies]
-libc.workspace = true
-
-# Process-image lookup for stale detection (src/sys/windows.rs):
-# OpenProcess + QueryFullProcessImageNameW.
-[target.'cfg(target_os = "windows")'.dependencies]
-windows-sys = { workspace = true, features = [
-    "Win32_Foundation",
-    "Win32_System_Threading",
-] }
-
-[features]
-# The writer half, which Workshop ships only in test builds: a test double
-# writes a contract-shaped `gateway.json` and holds a process lease. No
-# production Workshop code writes the file; the Gateway owns that.
-test-fixtures = []
-
-[dev-dependencies]
-tempfile.workspace = true
-# The crate's own `test-fixtures` feature, so `cargo test -p
-# workshop-gateway-discovery` compiles the writer half its unit tests drive
-# without `--all-features`.
-workshop-gateway-discovery = { path = ".", features = ["test-fixtures"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/gateway-discovery/fixtures/gateway-invalid-port.json b/crates/workshop/gateway-discovery/fixtures/gateway-invalid-port.json
deleted file mode 100644
index ca9da3b23..000000000
--- a/crates/workshop/gateway-discovery/fixtures/gateway-invalid-port.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "port": 0,
-  "api_key": "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b",
-  "pid": 4242,
-  "epoch": 1757000000,
-  "version": "0.2.0",
-  "started_at": "2026-09-03T12:00:00Z"
-}
diff --git a/crates/workshop/gateway-discovery/fixtures/gateway-no-boot-identity.json b/crates/workshop/gateway-discovery/fixtures/gateway-no-boot-identity.json
deleted file mode 100644
index 4ad8c3fbf..000000000
--- a/crates/workshop/gateway-discovery/fixtures/gateway-no-boot-identity.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "port": 8081,
-  "api_key": "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b",
-  "pid": 4242,
-  "epoch": 0,
-  "version": "0.2.0",
-  "started_at": ""
-}
diff --git a/crates/workshop/gateway-discovery/fixtures/gateway-unknown-field.json b/crates/workshop/gateway-discovery/fixtures/gateway-unknown-field.json
deleted file mode 100644
index 0ada599d4..000000000
--- a/crates/workshop/gateway-discovery/fixtures/gateway-unknown-field.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "port": 8081,
-  "api_key": "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b",
-  "pid": 4242,
-  "epoch": 1757000000,
-  "version": "0.2.0",
-  "started_at": "2026-09-03T12:00:00Z",
-  "future_field": {
-    "nested": [1, 2, 3]
-  }
-}
diff --git a/crates/workshop/gateway-discovery/fixtures/gateway.json b/crates/workshop/gateway-discovery/fixtures/gateway.json
deleted file mode 100644
index bce7df716..000000000
--- a/crates/workshop/gateway-discovery/fixtures/gateway.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "port": 8081,
-  "api_key": "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b",
-  "pid": 4242,
-  "epoch": 1757000000,
-  "version": "0.2.0",
-  "started_at": "2026-09-03T12:00:00Z"
-}
diff --git a/crates/workshop/gateway-discovery/src/atomic.rs b/crates/workshop/gateway-discovery/src/atomic.rs
deleted file mode 100644
index 0b18716ca..000000000
--- a/crates/workshop/gateway-discovery/src/atomic.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-//! Crash-safe, owner-only file writes for the gateway discovery file: each write
-//! lands in a uniquely named sibling temp file, is synced to disk, and is
-//! renamed over the target, so a crash at any moment leaves either the old
-//! contents or the new, never a truncation. Writes are owner-only because
-//! the gateway discovery file holds the bearer key.
-//!
-//! This module exists only under the `test-fixtures` feature. Production
-//! Workshop never writes the file; the Gateway owns that half of the
-//! contract, and this is Workshop's test double copying its rule.
-
-use std::fs::{self, OpenOptions};
-use std::io::{self, Write as _};
-use std::path::{Path, PathBuf};
-use std::sync::atomic::{AtomicU64, Ordering};
-
-/// The suffix on every atomic-write temp file.
-const TEMP_SUFFIX: &str = ".rv-tmp";
-
-/// Process-wide counter making each temp name unique, so two concurrent
-/// writes to the same target never interleave inside one temp file: each
-/// writer fills its own temp completely and the last rename wins whole.
-static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
-
-/// The unique sibling temp path for one write to `path`, or `None` when
-/// `path` has no file name to derive it from.
-fn temp_path(path: &Path) -> Option<PathBuf> {
-    let mut name = path.file_name()?.to_os_string();
-    let counter = TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
-    name.push(format!(".{}-{counter}{TEMP_SUFFIX}", std::process::id()));
-    Some(path.with_file_name(name))
-}
-
-/// Writes `bytes` to `path` atomically with owner-only permissions: the
-/// bytes land in a unique sibling temp file created with mode `0600` on
-/// Unix (the rename preserves it, so the target never exists with looser
-/// permissions), are synced to disk, and the temp is renamed over `path`.
-/// On failure the temp file is removed and the target keeps its previous
-/// contents.
-///
-/// On Windows there are no mode bits; the file sits under the user
-/// profile, whose ACL already restricts it to the owner. Best-effort by
-/// design.
-pub(crate) fn write_atomic_owner_only(path: &Path, bytes: &[u8]) -> io::Result<()> {
-    let Some(temp) = temp_path(path) else {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "write target has no file name",
-        ));
-    };
-    let result = write_temp_then_rename(&temp, path, bytes);
-    if result.is_err() {
-        // Best-effort: when the create itself failed there is nothing to
-        // remove.
-        let _ = fs::remove_file(&temp);
-    }
-    result
-}
-
-/// The Unix write: the temp file is born owner-only.
-#[cfg(unix)]
-fn write_temp_then_rename(temp: &Path, path: &Path, bytes: &[u8]) -> io::Result<()> {
-    use std::os::unix::fs::OpenOptionsExt as _;
-    let mut file = OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .mode(0o600)
-        .open(temp)?;
-    file.write_all(bytes)?;
-    file.sync_data()?;
-    fs::rename(temp, path)
-}
-
-/// The Windows write: no mode bits exist; the user profile's ACL is the
-/// permission boundary.
-#[cfg(not(unix))]
-fn write_temp_then_rename(temp: &Path, path: &Path, bytes: &[u8]) -> io::Result<()> {
-    let mut file = OpenOptions::new().write(true).create_new(true).open(temp)?;
-    file.write_all(bytes)?;
-    file.sync_data()?;
-    fs::rename(temp, path)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The sorted file names in `dir`.
-    fn dir_names(dir: &Path) -> Vec<String> {
-        let mut names: Vec<String> = fs::read_dir(dir)
-            .expect("the test directory is listable")
-            .map(|entry| {
-                entry
-                    .expect("the test entry is readable")
-                    .file_name()
-                    .to_string_lossy()
-                    .into_owned()
-            })
-            .collect();
-        names.sort();
-        names
-    }
-
-    #[test]
-    fn a_write_lands_whole_and_leaves_no_temp_behind() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let target = dir.path().join("gateway.json");
-        write_atomic_owner_only(&target, b"one").expect("the first write succeeds");
-        assert_eq!(fs::read(&target).expect("readable"), b"one");
-        write_atomic_owner_only(&target, b"two").expect("the overwrite succeeds");
-        assert_eq!(fs::read(&target).expect("readable"), b"two");
-        assert_eq!(dir_names(dir.path()), ["gateway.json"]);
-    }
-
-    #[test]
-    fn a_failed_rename_removes_the_temp_and_reports_the_error() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        // A directory in the target's place fails the rename after the
-        // temp is fully written, exercising the cleanup path.
-        let target = dir.path().join("gateway.json");
-        fs::create_dir(&target).expect("directory in the target's place");
-        write_atomic_owner_only(&target, b"payload")
-            .expect_err("renaming over a directory must fail");
-        assert_eq!(dir_names(dir.path()), ["gateway.json"]);
-        assert!(target.is_dir(), "the failed write touched nothing");
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn the_written_file_is_owner_only() {
-        use std::os::unix::fs::PermissionsExt as _;
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let target = dir.path().join("gateway.json");
-        write_atomic_owner_only(&target, b"payload").expect("the write succeeds");
-        let mode = target.metadata().expect("metadata").permissions().mode();
-        assert_eq!(mode & 0o777, 0o600, "the bearer key file is owner-only");
-    }
-}
diff --git a/crates/workshop/gateway-discovery/src/cancellation.rs b/crates/workshop/gateway-discovery/src/cancellation.rs
deleted file mode 100644
index 17268c387..000000000
--- a/crates/workshop/gateway-discovery/src/cancellation.rs
+++ /dev/null
@@ -1,149 +0,0 @@
-//! Cooperative cancellation for synchronous sidecar work.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Condvar, Mutex, PoisonError};
-use std::time::Duration;
-
-/// A clonable cancellation signal for finite sidecar operations.
-///
-/// Cancellation wakes retry waits immediately. [`run_if_active`](Self::run_if_active)
-/// also provides a linearization point for effects such as process launch and
-/// authoritative publication: cancellation first wakes a cancellable effect
-/// already in progress, then waits for it, and no effect starts after
-/// cancellation returns.
-#[derive(Clone, Debug, Default)]
-pub struct CancellationToken {
-    state: Arc<CancellationState>,
-}
-
-#[derive(Debug, Default)]
-struct CancellationState {
-    canceled: AtomicBool,
-    effect: Mutex<()>,
-    waiter: Mutex<()>,
-    wake: Condvar,
-}
-
-impl CancellationToken {
-    /// Creates an active cancellation token.
-    #[must_use]
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Cancels the token and wakes every retry wait.
-    pub fn cancel(&self) {
-        let waiter = self
-            .state
-            .waiter
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        self.state.canceled.store(true, Ordering::SeqCst);
-        self.state.wake.notify_all();
-        drop(waiter);
-
-        // Wait for an operation that already crossed the effect gate. The
-        // cancellation flag and wake happen first, so a cancellable operation
-        // inside the gate can finish instead of deadlocking with `cancel`.
-        drop(
-            self.state
-                .effect
-                .lock()
-                .unwrap_or_else(PoisonError::into_inner),
-        );
-    }
-
-    /// Whether cancellation has been requested.
-    #[must_use]
-    pub fn is_canceled(&self) -> bool {
-        self.state.canceled.load(Ordering::SeqCst)
-    }
-
-    /// Waits for cancellation or until `timeout` elapses.
-    ///
-    /// Returns `true` when the token is canceled.
-    #[must_use]
-    pub fn wait_timeout(&self, timeout: Duration) -> bool {
-        if self.is_canceled() {
-            return true;
-        }
-        let waiter = self
-            .state
-            .waiter
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        if self.is_canceled() {
-            return true;
-        }
-        let (_waiter, _) = self
-            .state
-            .wake
-            .wait_timeout_while(waiter, timeout, |()| !self.is_canceled())
-            .unwrap_or_else(PoisonError::into_inner);
-        self.is_canceled()
-    }
-
-    /// Runs `operation` only while the token remains active.
-    ///
-    /// Cancellation and effect admission are mutually exclusive. Cancellation
-    /// is signalled before waiting for an admitted operation, so that operation
-    /// may call [`wait_timeout`](Self::wait_timeout) and stop within its bound.
-    /// The gate is not reentrant: `operation` must not call `cancel` or
-    /// `run_if_active` on this token.
-    pub fn run_if_active<T>(&self, operation: impl FnOnce() -> T) -> Option<T> {
-        let effect = self
-            .state
-            .effect
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        if self.is_canceled() {
-            return None;
-        }
-        let result = operation();
-        drop(effect);
-        Some(result)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use std::sync::mpsc;
-    use std::time::Instant;
-
-    #[test]
-    fn cancellation_wakes_an_operation_inside_the_effect_gate() {
-        let cancellation = CancellationToken::new();
-        let worker_cancellation = cancellation.clone();
-        let effects = Arc::new(AtomicUsize::new(0));
-        let worker_effects = Arc::clone(&effects);
-        let (entered, blocked) = mpsc::channel();
-        let worker = std::thread::spawn(move || {
-            worker_cancellation.run_if_active(|| {
-                entered.send(()).expect("announce the gated operation");
-                if !worker_cancellation.wait_timeout(Duration::from_secs(1)) {
-                    worker_effects.fetch_add(1, Ordering::SeqCst);
-                }
-            });
-        });
-        blocked
-            .recv_timeout(Duration::from_secs(1))
-            .expect("the operation enters the effect gate");
-
-        let started = Instant::now();
-        cancellation.cancel();
-        worker.join().expect("the canceled operation joins");
-
-        assert!(
-            started.elapsed() < Duration::from_millis(250),
-            "cancellation wakes an operation already inside the effect gate"
-        );
-        assert_eq!(
-            effects.load(Ordering::SeqCst),
-            0,
-            "the canceled operation performs no later effect"
-        );
-    }
-}
diff --git a/crates/workshop/gateway-discovery/src/error.rs b/crates/workshop/gateway-discovery/src/error.rs
deleted file mode 100644
index 3ee19670f..000000000
--- a/crates/workshop/gateway-discovery/src/error.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-//! The gateway-discovery-file and launch-lock error type.
-//!
-//! [`SidecarError`] is what the file and lock operations return; the health
-//! probe has its own [`crate::HealthError`].
-
-use std::path::PathBuf;
-use std::time::Duration;
-
-/// A failure of a gateway-discovery-file or launch-lock operation.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum SidecarError {
-    /// The caller canceled the sidecar operation.
-    #[error("the sidecar operation was canceled")]
-    Canceled,
-
-    /// The run directory could not be created.
-    #[error("create the run directory {path}")]
-    CreateDir {
-        /// The directory that could not be created.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The gateway discovery file existed but could not be read.
-    #[error("read {path}")]
-    Read {
-        /// The file that could not be read.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The gateway discovery file was not valid JSON.
-    #[error("parse {path}")]
-    Parse {
-        /// The file that could not be parsed.
-        path: PathBuf,
-        /// The underlying JSON error.
-        #[source]
-        source: serde_json::Error,
-    },
-
-    /// The gateway discovery file failed validation.
-    #[error("invalid gateway discovery file {path}: {reason}")]
-    Invalid {
-        /// The file that failed validation.
-        path: PathBuf,
-        /// The broken invariant.
-        reason: String,
-    },
-
-    /// The gateway discovery file could not be serialized for writing.
-    #[cfg(feature = "test-fixtures")]
-    #[error("serialize the gateway discovery file")]
-    Serialize {
-        /// The underlying JSON error.
-        #[source]
-        source: serde_json::Error,
-    },
-
-    /// The atomic write of the gateway discovery file failed.
-    #[cfg(feature = "test-fixtures")]
-    #[error("write {path}")]
-    Write {
-        /// The file that could not be written.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The gateway discovery file could not be removed.
-    #[error("remove {path}")]
-    Remove {
-        /// The file that could not be removed.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The launch lock could not be opened or taken.
-    #[error("lock {path}")]
-    Lock {
-        /// The lock file that failed.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The launch race produced no attachable gateway within the budget.
-    #[error("no launch winner became attachable within {timeout:?}")]
-    LaunchTimeout {
-        /// The budget that elapsed.
-        timeout: Duration,
-    },
-}
diff --git a/crates/workshop/gateway-discovery/src/file-tests.rs b/crates/workshop/gateway-discovery/src/file-tests.rs
deleted file mode 100644
index e58efa520..000000000
--- a/crates/workshop/gateway-discovery/src/file-tests.rs
+++ /dev/null
@@ -1,238 +0,0 @@
-//! The `gateway.json` reader and its golden fixtures: the six fields, the
-//! tolerated unknown field, the boot identity, and validation.
-
-use super::*;
-
-/// A canonical valid file, matching `fixtures/gateway.json`.
-fn valid_file() -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port: 8081,
-        api_key: "0e1f8f0d8f8c4e0f9a1c2b3d4e5f6a7b".to_owned(),
-        pid: 4242,
-        epoch: 1_757_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-09-03T12:00:00Z".to_owned(),
-    }
-}
-
-/// One committed contract fixture's bytes.
-fn fixture(name: &str) -> String {
-    let path = Path::new(env!("CARGO_MANIFEST_DIR"))
-        .join("fixtures")
-        .join(name);
-    std::fs::read_to_string(&path)
-        .unwrap_or_else(|error| panic!("read the contract fixture {}: {error}", path.display()))
-}
-
-/// Writes one fixture into a fresh run directory and parses it back.
-fn parse_fixture(name: &str) -> Result<Option<GatewayDiscoveryFile>, SidecarError> {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(
-        crate::paths::gateway_discovery_file_path(dir.path()),
-        fixture(name),
-    )
-    .expect("write the fixture");
-    GatewayDiscoveryFile::read(dir.path())
-}
-
-#[test]
-fn the_golden_fixture_parses_to_the_canonical_file() {
-    let parsed = parse_fixture("gateway.json").expect("the golden fixture is valid");
-    assert_eq!(parsed, Some(valid_file()));
-}
-
-#[test]
-#[cfg(feature = "test-fixtures")]
-fn the_writer_reproduces_the_golden_fixture_byte_for_byte() {
-    // The committed bytes are the drift alarm for the serialization: a
-    // change to the field order, the pretty-printing, or a field name
-    // shows up here rather than in a Gateway that no longer attaches. The
-    // writer emits no trailing newline and the committed file carries one
-    // because a text file should end in a newline, so the comparison is
-    // against the fixture without it.
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    valid_file().write_to(dir.path()).expect("write");
-    let written =
-        fs::read_to_string(crate::paths::gateway_discovery_file_path(dir.path())).expect("read");
-    let golden = fixture("gateway.json");
-    assert_eq!(
-        written,
-        golden.trim_end_matches('\n'),
-        "the writer's bytes are the committed contract bytes"
-    );
-}
-
-#[test]
-fn an_unknown_field_is_tolerated() {
-    let parsed = parse_fixture("gateway-unknown-field.json")
-        .expect("a newer Gateway's extra field must not break this reader");
-    assert_eq!(
-        parsed,
-        Some(valid_file()),
-        "the known fields read unchanged"
-    );
-}
-
-#[test]
-fn a_file_without_a_boot_identity_parses_but_carries_none() {
-    let parsed = parse_fixture("gateway-no-boot-identity.json")
-        .expect("valid fields parse")
-        .expect("the file exists");
-    assert!(
-        !parsed.has_boot_identity(),
-        "a zero epoch and a blank start time is no boot identity"
-    );
-}
-
-#[test]
-fn a_zero_port_is_a_validation_error() {
-    let error =
-        parse_fixture("gateway-invalid-port.json").expect_err("a zero port names no endpoint");
-    let SidecarError::Invalid { reason, .. } = &error else {
-        panic!("a zero port is a validation error, got {error}");
-    };
-    assert_eq!(reason, "port must not be 0");
-}
-
-#[test]
-fn the_field_names_and_types_are_the_contract() {
-    // Pins the wire names and types independently of the fixture file, so
-    // a rename or a type change fails here even if nobody updates the
-    // fixture. The future OpenAPI spec describes the same two fields for
-    // the admin status route; this is the discovery file's six.
-    let value = serde_json::to_value(valid_file()).expect("the file is representable");
-    let object = value.as_object().expect("the file is a JSON object");
-    let mut names: Vec<&str> = object.keys().map(String::as_str).collect();
-    names.sort_unstable();
-    assert_eq!(
-        names,
-        ["api_key", "epoch", "pid", "port", "started_at", "version"],
-        "the contract names exactly these six fields"
-    );
-    assert!(object["port"].is_u64(), "port is an integer");
-    assert!(object["api_key"].is_string(), "api_key is a string");
-    assert!(object["pid"].is_u64(), "pid is an integer");
-    assert!(object["epoch"].is_u64(), "epoch is an integer");
-    assert!(object["version"].is_string(), "version is a string");
-    assert!(object["started_at"].is_string(), "started_at is a string");
-}
-
-#[test]
-fn validation_rejects_the_three_attach_fields() {
-    let mut file = valid_file();
-    assert_eq!(file.validation_error(), None);
-    file.port = 0;
-    assert_eq!(file.validation_error(), Some("port must not be 0"));
-    file = valid_file();
-    file.api_key.clear();
-    assert_eq!(file.validation_error(), Some("api_key must not be empty"));
-    file = valid_file();
-    file.api_key = "key\r\ninjected: value".to_owned();
-    assert_eq!(
-        file.validation_error(),
-        Some("api_key must not contain line breaks")
-    );
-    file = valid_file();
-    file.pid = 0;
-    assert_eq!(file.validation_error(), Some("pid must not be 0"));
-}
-
-#[test]
-fn debug_redacts_bearer_and_untrusted_metadata() {
-    let secret = "capability-secret";
-    let mut file = valid_file();
-    file.api_key = secret.to_owned();
-    file.version = format!("version-{secret}\r\n");
-    file.started_at = format!("started-{secret}\t");
-
-    let debug = format!("{file:?}");
-    assert!(!debug.contains(secret), "debug output redacts the bearer");
-    assert!(
-        !debug.contains(['\r', '\n', '\t']),
-        "untrusted metadata cannot inject debug output"
-    );
-    assert!(
-        debug.contains(&file.port.to_string()),
-        "the endpoint remains visible"
-    );
-}
-
-#[test]
-fn read_returns_none_when_no_file_exists() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    assert_eq!(GatewayDiscoveryFile::read(dir.path()).expect("read"), None);
-}
-
-#[test]
-fn read_rejects_corrupt_json() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(
-        crate::paths::gateway_discovery_file_path(dir.path()),
-        b"not json",
-    )
-    .expect("write fixture");
-    let error = GatewayDiscoveryFile::read(dir.path()).expect_err("corrupt JSON must fail");
-    assert!(
-        matches!(error, SidecarError::Parse { .. }),
-        "a corrupt file is a parse error: {error}"
-    );
-}
-
-#[test]
-fn read_rejects_an_unreadable_path() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::create_dir(crate::paths::gateway_discovery_file_path(dir.path()))
-        .expect("a directory in the file's place");
-    let error = GatewayDiscoveryFile::read(dir.path()).expect_err("a directory is not a file");
-    assert!(
-        matches!(error, SidecarError::Read { .. }),
-        "an unreadable path is a read error, not staleness: {error}"
-    );
-}
-
-#[test]
-#[cfg(feature = "test-fixtures")]
-fn write_refuses_an_invalid_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let mut file = valid_file();
-    file.api_key.clear();
-    let error = file
-        .write_to(dir.path())
-        .expect_err("an invalid file must not be written");
-    assert!(matches!(error, SidecarError::Invalid { .. }));
-    assert!(
-        !crate::paths::gateway_discovery_file_path(dir.path()).exists(),
-        "nothing was written"
-    );
-}
-
-#[test]
-#[cfg(feature = "test-fixtures")]
-fn write_creates_a_missing_run_directory() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let run_dir = dir.path().join("nested").join("run");
-    valid_file().write_to(&run_dir).expect("write");
-    assert!(crate::paths::gateway_discovery_file_path(&run_dir).exists());
-}
-
-#[test]
-#[cfg(feature = "test-fixtures")]
-fn remove_if_mine_removes_only_the_owning_pid() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = valid_file();
-    file.write_to(dir.path()).expect("write");
-    let path = crate::paths::gateway_discovery_file_path(dir.path());
-
-    remove_if_mine(dir.path(), 9999).expect("a foreign pid is tolerated");
-    assert!(path.exists(), "a foreign pid's removal spares the file");
-
-    remove_if_mine(dir.path(), file.pid).expect("the owning pid removes");
-    assert!(!path.exists(), "the owning pid's removal deletes the file");
-}
-
-#[test]
-#[cfg(feature = "test-fixtures")]
-fn remove_if_mine_tolerates_a_missing_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    remove_if_mine(dir.path(), 4242).expect("a missing file is not an error");
-}
diff --git a/crates/workshop/gateway-discovery/src/file.rs b/crates/workshop/gateway-discovery/src/file.rs
deleted file mode 100644
index 309a8baf9..000000000
--- a/crates/workshop/gateway-discovery/src/file.rs
+++ /dev/null
@@ -1,183 +0,0 @@
-//! The `gateway.json` type: what the Gateway writes after a successful bind
-//! and what a reader validates before attaching.
-
-use std::fmt;
-use std::fs;
-use std::io;
-use std::path::Path;
-
-use serde::{Deserialize, Serialize};
-
-use crate::error::SidecarError;
-use crate::paths::gateway_discovery_file_path;
-
-/// The on-disk gateway discovery file naming a running gateway's loopback
-/// port and bearer key.
-///
-/// Readers must tolerate unknown fields: a newer gateway may write fields
-/// an older reader does not know, and serde ignores them. This is the six
-/// fields the contract names; see `CONTRACT.md`.
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct GatewayDiscoveryFile {
-    /// The gateway's bound port; readers connect to `127.0.0.1:{port}`.
-    pub port: u16,
-    /// The bearer key the gateway expects.
-    pub api_key: String,
-    /// The gateway process id.
-    pub pid: u32,
-    /// The gateway's boot instant in unix seconds.
-    pub epoch: u64,
-    /// The gateway crate version.
-    pub version: String,
-    /// RFC 3339 rendering of the boot instant.
-    pub started_at: String,
-}
-
-impl fmt::Debug for GatewayDiscoveryFile {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("GatewayDiscoveryFile")
-            .field("port", &self.port)
-            .field("api_key", &"[REDACTED]")
-            .field("pid", &self.pid)
-            .field("epoch", &self.epoch)
-            .field("version", &"[REDACTED]")
-            .field("started_at", &"[REDACTED]")
-            .finish()
-    }
-}
-
-impl GatewayDiscoveryFile {
-    /// Whether the connection names one particular Gateway boot.
-    pub(crate) fn has_boot_identity(&self) -> bool {
-        self.epoch != 0 && !self.started_at.trim().is_empty()
-    }
-
-    /// The reason the file fails validation, or `None` when it is valid.
-    ///
-    /// Validation covers the fields attach depends on: a real port, a
-    /// real key, a real pid. The remaining fields are informational.
-    #[must_use]
-    pub fn validation_error(&self) -> Option<&'static str> {
-        if self.port == 0 {
-            return Some("port must not be 0");
-        }
-        if self.api_key.is_empty() {
-            return Some("api_key must not be empty");
-        }
-        if self.api_key.contains(['\r', '\n']) {
-            return Some("api_key must not contain line breaks");
-        }
-        if self.pid == 0 {
-            return Some("pid must not be 0");
-        }
-        None
-    }
-
-    /// Reads and validates the gateway discovery file in `run_dir`,
-    /// returning `None` when no file exists.
-    ///
-    /// # Errors
-    /// Returns [`SidecarError::Read`] when the file exists but cannot be
-    /// read, [`SidecarError::Parse`] when it is not valid JSON, and
-    /// [`SidecarError::Invalid`] when it fails validation.
-    pub fn read(run_dir: &Path) -> Result<Option<GatewayDiscoveryFile>, SidecarError> {
-        let path = gateway_discovery_file_path(run_dir);
-        let raw = match fs::read_to_string(&path) {
-            Ok(raw) => raw,
-            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
-            Err(error) => {
-                return Err(SidecarError::Read {
-                    path,
-                    source: error,
-                });
-            }
-        };
-        let file: GatewayDiscoveryFile =
-            serde_json::from_str(&raw).map_err(|source| SidecarError::Parse {
-                path: path.clone(),
-                source,
-            })?;
-        if let Some(reason) = file.validation_error() {
-            return Err(SidecarError::Invalid {
-                path,
-                reason: reason.to_owned(),
-            });
-        }
-        Ok(Some(file))
-    }
-}
-
-/// The writer half of the contract, compiled only for Workshop's test
-/// doubles. The Gateway owns the production writer.
-#[cfg(feature = "test-fixtures")]
-impl GatewayDiscoveryFile {
-    /// Writes the gateway discovery file into `run_dir`, creating the
-    /// directory when missing. The write is atomic (temp sibling, sync,
-    /// rename) and the file lands owner-only; see `CONTRACT.md` for the
-    /// permission contract.
-    ///
-    /// # Errors
-    /// Returns [`SidecarError::Invalid`] when the file fails validation,
-    /// [`SidecarError::CreateDir`] when the run directory cannot be
-    /// created, [`SidecarError::Serialize`] when the file cannot be
-    /// serialized, and [`SidecarError::Write`] when the atomic write
-    /// fails.
-    pub fn write_to(&self, run_dir: &Path) -> Result<(), SidecarError> {
-        let path = gateway_discovery_file_path(run_dir);
-        if let Some(reason) = self.validation_error() {
-            return Err(SidecarError::Invalid {
-                path,
-                reason: reason.to_owned(),
-            });
-        }
-        fs::create_dir_all(run_dir).map_err(|source| SidecarError::CreateDir {
-            path: run_dir.to_owned(),
-            source,
-        })?;
-        let bytes =
-            serde_json::to_vec_pretty(self).map_err(|source| SidecarError::Serialize { source })?;
-        crate::atomic::write_atomic_owner_only(&path, &bytes)
-            .map_err(|source| SidecarError::Write { path, source })
-    }
-}
-
-/// Removes the gateway discovery file in `run_dir` when it still belongs to
-/// process `pid`, so a shutting-down writer withdraws itself from discovery
-/// but can never delete a replacement's file. A missing file is not an
-/// error; an unreadable or foreign file is left alone for the next
-/// [`crate::resolve`] to clean.
-///
-/// A test-double seam: the Gateway's own writer removes its file when it
-/// exits, and Workshop's doubles need the same withdrawal.
-///
-/// # Errors
-/// Returns [`SidecarError::Remove`] when the file is this process's own
-/// but cannot be removed.
-#[cfg(feature = "test-fixtures")]
-pub fn remove_if_mine(run_dir: &Path, pid: u32) -> Result<(), SidecarError> {
-    let path = gateway_discovery_file_path(run_dir);
-    match fs::read_to_string(&path) {
-        Ok(raw) => {
-            let owned = serde_json::from_str::<GatewayDiscoveryFile>(&raw)
-                .is_ok_and(|file| file.pid == pid);
-            if !owned {
-                return Ok(());
-            }
-        }
-        // A missing or unreadable file is left alone.
-        Err(_) => return Ok(()),
-    }
-    match fs::remove_file(&path) {
-        Ok(()) => Ok(()),
-        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()),
-        Err(error) => Err(SidecarError::Remove {
-            path,
-            source: error,
-        }),
-    }
-}
-
-#[cfg(test)]
-#[path = "file-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway-discovery/src/health.rs b/crates/workshop/gateway-discovery/src/health.rs
deleted file mode 100644
index 0b34aaed1..000000000
--- a/crates/workshop/gateway-discovery/src/health.rs
+++ /dev/null
@@ -1,335 +0,0 @@
-//! Readiness and key probes: raw loopback HTTP/1.x over
-//! `std::net::TcpStream`, enough to read a status line, with no HTTP
-//! client dependency.
-//!
-//! The `Host` header is the bound loopback address, matching the gateway's
-//! loopback `Host` allowlist.
-
-use std::io::{Read, Write as _};
-use std::net::{SocketAddr, TcpStream};
-use std::time::{Duration, Instant};
-
-use crate::CancellationToken;
-
-mod connection;
-
-#[cfg(test)]
-use connection::probe_connection;
-pub(crate) use connection::{probe_connection_cancellable, probe_connection_until};
-
-/// Delay between probes while the server comes up.
-const RETRY_INTERVAL: Duration = Duration::from_millis(25);
-
-/// Per-attempt connect and read timeout, so one hung attempt cannot eat
-/// the whole budget.
-const ATTEMPT_TIMEOUT: Duration = Duration::from_secs(2);
-
-/// Per-attempt I/O budget while a supervisor may be canceled.
-const CANCELLABLE_ATTEMPT_TIMEOUT: Duration = Duration::from_millis(100);
-/// Maximum accepted response head for the two-request validation proof.
-const RESPONSE_HEAD_LIMIT: usize = 16 * 1024;
-/// Maximum body drained between the health and bearer responses.
-const RESPONSE_BODY_LIMIT: usize = 64 * 1024;
-
-/// A failure of [`wait_for_health`].
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum HealthError {
-    /// The caller canceled the health wait.
-    #[error("the health wait was canceled")]
-    Canceled,
-
-    /// The URL is not an `http://` URL.
-    #[error("health probe needs an http:// URL, got {url}")]
-    NotHttp {
-        /// The offending URL.
-        url: String,
-    },
-
-    /// No 200 answer arrived within the budget.
-    #[error("the server did not answer {url}/health within {timeout:?}")]
-    Timeout {
-        /// The probed base URL.
-        url: String,
-        /// The budget that elapsed.
-        timeout: Duration,
-        /// The last attempt's failure.
-        #[source]
-        source: ProbeError,
-    },
-}
-
-/// One probe attempt failed.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum ProbeError {
-    /// The connect, write, or read failed.
-    #[error("{operation}")]
-    Io {
-        /// The failed operation.
-        operation: &'static str,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The status line was not a 200.
-    #[error("unexpected health response: {status_line}")]
-    UnexpectedStatus {
-        /// The response's first line.
-        status_line: String,
-    },
-}
-
-/// The outcome of one bearer-key probe.
-#[cfg(test)]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum KeyProbe {
-    /// A 2xx answer: the key is accepted.
-    Accepted,
-    /// A non-2xx answer: the key is rejected (or the route is gone).
-    Rejected,
-    /// The server could not be queried at all.
-    Unreachable,
-}
-
-/// The combined readiness and authority proof for one connection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ConnectionProbe {
-    /// Health answered and the bearer was accepted.
-    Accepted,
-    /// The caller canceled validation.
-    Canceled,
-    /// Health failed, including a bearer probe that became unreachable.
-    HealthFailed,
-    /// Health answered but the bearer was rejected.
-    KeyRejected,
-}
-
-/// Connects within the one absolute attempt deadline.
-fn connect_until(address: &SocketAddr, deadline: Instant) -> Result<TcpStream, ProbeError> {
-    let timeout = remaining(deadline)?;
-    TcpStream::connect_timeout(address, timeout).map_err(|source| ProbeError::Io {
-        operation: "connect",
-        source,
-    })
-}
-
-/// Applies the remaining absolute attempt budget to reads and writes.
-fn configure_stream(stream: &TcpStream, deadline: Instant) -> Result<(), ProbeError> {
-    let timeout = remaining(deadline)?;
-    stream
-        .set_read_timeout(Some(timeout))
-        .map_err(|source| ProbeError::Io {
-            operation: "configure the read timeout",
-            source,
-        })?;
-    stream
-        .set_write_timeout(Some(timeout))
-        .map_err(|source| ProbeError::Io {
-            operation: "configure the write timeout",
-            source,
-        })
-}
-
-fn remaining(deadline: Instant) -> Result<Duration, ProbeError> {
-    deadline
-        .checked_duration_since(Instant::now())
-        .filter(|remaining| !remaining.is_zero())
-        .ok_or_else(|| ProbeError::Io {
-            operation: "validation deadline elapsed",
-            source: std::io::Error::from(std::io::ErrorKind::TimedOut),
-        })
-}
-
-/// Polls `GET {base_url}/health` until it answers 200 or `timeout`
-/// elapses.
-///
-/// # Errors
-/// Returns [`HealthError::NotHttp`] when `base_url` is not an
-/// `http://host:port` URL, and [`HealthError::Timeout`] when the endpoint
-/// does not answer 200 within `timeout`.
-pub fn wait_for_health(base_url: &str, timeout: Duration) -> Result<(), HealthError> {
-    wait_for_health_cancellable_with(
-        base_url,
-        timeout,
-        &CancellationToken::new(),
-        ATTEMPT_TIMEOUT,
-        probe_health_until,
-    )
-}
-
-/// Polls `GET {base_url}/health` until it answers 200, the timeout elapses,
-/// or the caller cancels the wait.
-///
-/// # Errors
-/// Returns [`HealthError::Canceled`] when `cancellation` is signalled, plus
-/// the URL and timeout failures documented by [`wait_for_health`].
-pub fn wait_for_health_cancellable(
-    base_url: &str,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-) -> Result<(), HealthError> {
-    wait_for_health_cancellable_with(
-        base_url,
-        timeout,
-        cancellation,
-        CANCELLABLE_ATTEMPT_TIMEOUT,
-        probe_health_until,
-    )
-}
-
-fn wait_for_health_cancellable_with(
-    base_url: &str,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-    attempt_timeout: Duration,
-    mut probe: impl FnMut(&str, Instant) -> Result<(), ProbeError>,
-) -> Result<(), HealthError> {
-    wait_for_health_cancellable_with_start(
-        base_url,
-        timeout,
-        cancellation,
-        attempt_timeout,
-        || {},
-        |address, deadline| probe(address, deadline),
-    )
-}
-
-fn wait_for_health_cancellable_with_start(
-    base_url: &str,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-    attempt_timeout: Duration,
-    mut before_probe: impl FnMut(),
-    mut probe: impl FnMut(&str, Instant) -> Result<(), ProbeError>,
-) -> Result<(), HealthError> {
-    let address = base_url
-        .strip_prefix("http://")
-        .ok_or_else(|| HealthError::NotHttp {
-            url: base_url.to_owned(),
-        })?;
-    let deadline = Instant::now() + timeout;
-    loop {
-        let attempt_deadline = (Instant::now() + attempt_timeout).min(deadline);
-        before_probe();
-        let Some(attempt) = cancellation.run_if_active(|| probe(address, attempt_deadline)) else {
-            return Err(HealthError::Canceled);
-        };
-        match attempt {
-            Ok(()) => return Ok(()),
-            Err(error) => {
-                if cancellation.is_canceled() {
-                    return Err(HealthError::Canceled);
-                }
-                if Instant::now() >= deadline {
-                    return Err(HealthError::Timeout {
-                        url: base_url.to_owned(),
-                        timeout,
-                        source: error,
-                    });
-                }
-                if cancellation.wait_timeout(RETRY_INTERVAL) {
-                    return Err(HealthError::Canceled);
-                }
-            }
-        }
-    }
-}
-
-fn probe_health_until(address: &str, deadline: Instant) -> Result<(), ProbeError> {
-    let head = request_head_until(address, "GET", "/health", None, deadline)?;
-    let status_ok = head
-        .split_whitespace()
-        .nth(1)
-        .is_some_and(|code| code == "200");
-    if status_ok {
-        return Ok(());
-    }
-    Err(ProbeError::UnexpectedStatus {
-        status_line: head.lines().next().unwrap_or("<empty>").to_owned(),
-    })
-}
-
-/// Issues one `GET {path}` presenting `api_key` as the bearer token and
-/// classifies the answer.
-#[cfg(test)]
-fn probe_bearer(address: &str, path: &str, api_key: &str) -> KeyProbe {
-    match request_head(address, "GET", path, Some(api_key)) {
-        Ok(head) => {
-            let accepted = head
-                .split_whitespace()
-                .nth(1)
-                .and_then(|code| code.parse::<u16>().ok())
-                .is_some_and(|code| (200..300).contains(&code));
-            if accepted {
-                KeyProbe::Accepted
-            } else {
-                KeyProbe::Rejected
-            }
-        }
-        Err(_) => KeyProbe::Unreachable,
-    }
-}
-
-/// One HTTP/1.0 request returning the response head. The `Host` header
-/// is set to the bound address, never `localhost`: the gateway's loopback
-/// `Host` allowlist refuses anything else.
-pub(crate) fn request_head(
-    address: &str,
-    method: &str,
-    path: &str,
-    bearer: Option<&str>,
-) -> Result<String, ProbeError> {
-    request_head_with_timeout(address, method, path, bearer, ATTEMPT_TIMEOUT)
-}
-
-fn request_head_with_timeout(
-    address: &str,
-    method: &str,
-    path: &str,
-    bearer: Option<&str>,
-    timeout: Duration,
-) -> Result<String, ProbeError> {
-    request_head_until(address, method, path, bearer, Instant::now() + timeout)
-}
-
-pub(crate) fn request_head_until(
-    address: &str,
-    method: &str,
-    path: &str,
-    bearer: Option<&str>,
-    deadline: Instant,
-) -> Result<String, ProbeError> {
-    let socket = address
-        .parse::<SocketAddr>()
-        .map_err(|source| ProbeError::Io {
-            operation: "parse the loopback address",
-            source: std::io::Error::new(std::io::ErrorKind::InvalidInput, source),
-        })?;
-    let mut stream = connect_until(&socket, deadline)?;
-    let mut request = format!("{method} {path} HTTP/1.0\r\nHost: {address}\r\n");
-    if let Some(key) = bearer {
-        request.push_str("Authorization: Bearer ");
-        request.push_str(key);
-        request.push_str("\r\n");
-    }
-    request.push_str("\r\n");
-    configure_stream(&stream, deadline)?;
-    stream
-        .write_all(request.as_bytes())
-        .map_err(|source| ProbeError::Io {
-            operation: "write the request",
-            source,
-        })?;
-    let mut buffer = [0u8; 256];
-    configure_stream(&stream, deadline)?;
-    let read = stream.read(&mut buffer).map_err(|source| ProbeError::Io {
-        operation: "read the status line",
-        source,
-    })?;
-    Ok(String::from_utf8_lossy(&buffer[..read]).into_owned())
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/gateway-discovery/src/health/connection.rs b/crates/workshop/gateway-discovery/src/health/connection.rs
deleted file mode 100644
index 51439221d..000000000
--- a/crates/workshop/gateway-discovery/src/health/connection.rs
+++ /dev/null
@@ -1,282 +0,0 @@
-//! The one-connection health and bearer proof.
-
-use std::io::{Read, Write as _};
-use std::net::{SocketAddr, TcpStream};
-use std::time::{Duration, Instant};
-
-use super::{
-    ATTEMPT_TIMEOUT, CANCELLABLE_ATTEMPT_TIMEOUT, ConnectionProbe, ProbeError, RESPONSE_BODY_LIMIT,
-    RESPONSE_HEAD_LIMIT, RETRY_INTERVAL, configure_stream, connect_until,
-};
-use crate::CancellationToken;
-
-/// Proves that one address is healthy and accepts the presented bearer.
-/// Both requests use one TCP connection, so authority cannot come from a
-/// listener that replaced the endpoint after the health response.
-#[cfg(test)]
-pub(super) fn probe_connection(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    health_budget: Duration,
-) -> ConnectionProbe {
-    probe_connection_until(address, bearer_path, bearer, Instant::now() + health_budget)
-}
-
-/// Proves one connection within the caller's absolute deadline.
-pub(crate) fn probe_connection_until(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    deadline: Instant,
-) -> ConnectionProbe {
-    probe_connection_with(
-        address,
-        bearer_path,
-        bearer,
-        deadline,
-        &CancellationToken::new(),
-        ATTEMPT_TIMEOUT,
-    )
-}
-
-/// Proves one connection while observing supervisor cancellation.
-pub(crate) fn probe_connection_cancellable(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    health_budget: Duration,
-    cancellation: &CancellationToken,
-) -> ConnectionProbe {
-    probe_connection_with(
-        address,
-        bearer_path,
-        bearer,
-        Instant::now() + health_budget,
-        cancellation,
-        CANCELLABLE_ATTEMPT_TIMEOUT,
-    )
-}
-
-fn probe_connection_with(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    deadline: Instant,
-    cancellation: &CancellationToken,
-    attempt_timeout: Duration,
-) -> ConnectionProbe {
-    probe_connection_with_probe(
-        address,
-        bearer_path,
-        bearer,
-        deadline,
-        cancellation,
-        attempt_timeout,
-        probe_connection_once,
-    )
-}
-
-pub(super) fn probe_connection_with_probe(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    deadline: Instant,
-    cancellation: &CancellationToken,
-    attempt_timeout: Duration,
-    mut probe: impl FnMut(&str, &str, &str, Instant) -> ConnectionAttempt,
-) -> ConnectionProbe {
-    loop {
-        let attempt_deadline = (Instant::now() + attempt_timeout).min(deadline);
-        let Some(attempt) =
-            cancellation.run_if_active(|| probe(address, bearer_path, bearer, attempt_deadline))
-        else {
-            return ConnectionProbe::Canceled;
-        };
-        match attempt {
-            ConnectionAttempt::Accepted => return ConnectionProbe::Accepted,
-            ConnectionAttempt::KeyRejected => return ConnectionProbe::KeyRejected,
-            ConnectionAttempt::ProofIncomplete => return ConnectionProbe::HealthFailed,
-            ConnectionAttempt::HealthFailed if Instant::now() >= deadline => {
-                return ConnectionProbe::HealthFailed;
-            }
-            ConnectionAttempt::HealthFailed if cancellation.wait_timeout(RETRY_INTERVAL) => {
-                return ConnectionProbe::Canceled;
-            }
-            ConnectionAttempt::HealthFailed => {}
-        }
-    }
-}
-
-/// One coherent proof attempt over one TCP connection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(super) enum ConnectionAttempt {
-    Accepted,
-    HealthFailed,
-    KeyRejected,
-    ProofIncomplete,
-}
-
-/// Checks health and bearer acceptance over one socket. Once health has
-/// succeeded, any socket loss fails the proof instead of reconnecting to a
-/// potentially different endpoint.
-pub(super) fn probe_connection_once(
-    address: &str,
-    bearer_path: &str,
-    bearer: &str,
-    deadline: Instant,
-) -> ConnectionAttempt {
-    let Ok(socket) = address.parse::<SocketAddr>() else {
-        return ConnectionAttempt::HealthFailed;
-    };
-    let Ok(mut stream) = connect_until(&socket, deadline) else {
-        return ConnectionAttempt::HealthFailed;
-    };
-    if write_request(&mut stream, address, "/health", None, false, deadline).is_err() {
-        return ConnectionAttempt::HealthFailed;
-    }
-    let Ok(health_head) = read_framed_response_head(&mut stream, deadline) else {
-        return ConnectionAttempt::HealthFailed;
-    };
-    if response_status(&health_head) != Some(200) {
-        return ConnectionAttempt::HealthFailed;
-    }
-    if write_request(
-        &mut stream,
-        address,
-        bearer_path,
-        Some(bearer),
-        true,
-        deadline,
-    )
-    .is_err()
-    {
-        return ConnectionAttempt::ProofIncomplete;
-    }
-    let Ok(bearer_head) = read_framed_response_head(&mut stream, deadline) else {
-        return ConnectionAttempt::ProofIncomplete;
-    };
-    if response_status(&bearer_head).is_some_and(|code| (200..300).contains(&code)) {
-        ConnectionAttempt::Accepted
-    } else {
-        ConnectionAttempt::KeyRejected
-    }
-}
-
-/// Writes one GET request, retaining or closing the connection as directed.
-fn write_request(
-    stream: &mut TcpStream,
-    address: &str,
-    path: &str,
-    bearer: Option<&str>,
-    close: bool,
-    deadline: Instant,
-) -> Result<(), ProbeError> {
-    let connection = if close { "close" } else { "keep-alive" };
-    let mut request =
-        format!("GET {path} HTTP/1.1\r\nHost: {address}\r\nConnection: {connection}\r\n");
-    if let Some(key) = bearer {
-        request.push_str("Authorization: Bearer ");
-        request.push_str(key);
-        request.push_str("\r\n");
-    }
-    request.push_str("\r\n");
-    configure_stream(stream, deadline)?;
-    stream
-        .write_all(request.as_bytes())
-        .map_err(|source| ProbeError::Io {
-            operation: "write the validation request",
-            source,
-        })
-}
-
-/// Reads one response head and drains its fixed-length body so the next
-/// response starts at a framing boundary on the same socket.
-fn read_framed_response_head(
-    stream: &mut TcpStream,
-    deadline: Instant,
-) -> Result<String, ProbeError> {
-    let mut response = Vec::with_capacity(512);
-    let header_end = loop {
-        if let Some(end) = response.windows(4).position(|bytes| bytes == b"\r\n\r\n") {
-            break end + 4;
-        }
-        if response.len() >= RESPONSE_HEAD_LIMIT {
-            return Err(ProbeError::UnexpectedStatus {
-                status_line: "<response head too large>".to_owned(),
-            });
-        }
-        let mut buffer = [0_u8; 512];
-        let available = RESPONSE_HEAD_LIMIT - response.len();
-        let chunk = available.min(buffer.len());
-        configure_stream(stream, deadline)?;
-        let read = stream
-            .read(&mut buffer[..chunk])
-            .map_err(|source| ProbeError::Io {
-                operation: "read the validation response",
-                source,
-            })?;
-        if read == 0 {
-            return Err(ProbeError::Io {
-                operation: "read the validation response",
-                source: std::io::Error::from(std::io::ErrorKind::UnexpectedEof),
-            });
-        }
-        response.extend_from_slice(&buffer[..read]);
-    };
-    let head = String::from_utf8_lossy(&response[..header_end]).into_owned();
-    let content_length =
-        response_content_length(&head).ok_or_else(|| ProbeError::UnexpectedStatus {
-            status_line: "<missing or invalid content-length>".to_owned(),
-        })?;
-    if content_length > RESPONSE_BODY_LIMIT {
-        return Err(ProbeError::UnexpectedStatus {
-            status_line: "<response body too large>".to_owned(),
-        });
-    }
-    let body_already_read = response.len() - header_end;
-    if body_already_read > content_length {
-        return Err(ProbeError::UnexpectedStatus {
-            status_line: "<response body exceeds content-length>".to_owned(),
-        });
-    }
-    if body_already_read < content_length {
-        let mut remaining = content_length - body_already_read;
-        let mut buffer = [0_u8; 512];
-        while remaining > 0 {
-            let chunk_len = remaining.min(buffer.len());
-            configure_stream(stream, deadline)?;
-            let read = stream
-                .read(&mut buffer[..chunk_len])
-                .map_err(|source| ProbeError::Io {
-                    operation: "read the validation response body",
-                    source,
-                })?;
-            if read == 0 {
-                return Err(ProbeError::Io {
-                    operation: "read the validation response body",
-                    source: std::io::Error::from(std::io::ErrorKind::UnexpectedEof),
-                });
-            }
-            remaining -= read;
-        }
-    }
-    Ok(head)
-}
-
-/// Parses a decimal Content-Length from a response head.
-fn response_content_length(head: &str) -> Option<usize> {
-    head.lines().find_map(|line| {
-        let (name, value) = line.split_once(':')?;
-        name.eq_ignore_ascii_case("content-length")
-            .then(|| value.trim().parse().ok())
-            .flatten()
-    })
-}
-
-/// Parses the three-digit response status.
-fn response_status(head: &str) -> Option<u16> {
-    head.split_whitespace()
-        .nth(1)
-        .and_then(|code| code.parse::<u16>().ok())
-}
diff --git a/crates/workshop/gateway-discovery/src/health/tests-connection.rs b/crates/workshop/gateway-discovery/src/health/tests-connection.rs
deleted file mode 100644
index 711c394c1..000000000
--- a/crates/workshop/gateway-discovery/src/health/tests-connection.rs
+++ /dev/null
@@ -1,301 +0,0 @@
-//! Unit tests for the one-connection health and bearer proof.
-
-use super::*;
-
-use super::super::connection::{
-    ConnectionAttempt, probe_connection_once, probe_connection_with_probe,
-};
-
-#[test]
-fn connection_proof_cannot_mix_health_and_bearer_across_endpoints() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind replacement fixture");
-    let address = listener
-        .local_addr()
-        .expect("replacement fixture address")
-        .to_string();
-    let (accepted, received) = mpsc::channel();
-    std::thread::spawn(move || {
-        let (mut health, _) = listener.accept().expect("accept health probe");
-        let mut buffer = [0_u8; 1024];
-        let read = health.read(&mut buffer).expect("read health probe");
-        assert!(
-            String::from_utf8_lossy(&buffer[..read]).starts_with("GET /health "),
-            "the first endpoint receives health"
-        );
-        health
-            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
-            .expect("answer health");
-        drop(health);
-
-        listener
-            .set_nonblocking(true)
-            .expect("make replacement observation bounded");
-        let deadline = Instant::now() + Duration::from_millis(500);
-        let mut connection_count = 1;
-        while Instant::now() < deadline {
-            match listener.accept() {
-                Ok((mut bearer, _)) => {
-                    connection_count += 1;
-                    let read = bearer.read(&mut buffer).expect("read bearer probe");
-                    assert!(
-                        String::from_utf8_lossy(&buffer[..read])
-                            .contains("Authorization: Bearer accepted\r\n"),
-                        "the replacement endpoint accepts the bearer"
-                    );
-                    bearer
-                        .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
-                        .expect("answer bearer");
-                    break;
-                }
-                Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
-                    std::thread::sleep(Duration::from_millis(5));
-                }
-                Err(error) => panic!("observe replacement connection: {error}"),
-            }
-        }
-        accepted
-            .send(connection_count)
-            .expect("report accepted connections");
-    });
-
-    assert_eq!(
-        probe_connection(
-            &address,
-            "/v1/models",
-            "accepted",
-            Duration::from_millis(250)
-        ),
-        ConnectionProbe::HealthFailed,
-        "one capability cannot combine health from one socket with authority from another"
-    );
-    assert_eq!(
-        received
-            .recv_timeout(Duration::from_secs(2))
-            .expect("fixture reports its connection count"),
-        1,
-        "validation never reconnects after health succeeds"
-    );
-}
-
-#[test]
-fn a_real_connect_attempt_obeys_one_absolute_deadline() {
-    let started = Instant::now();
-    let result = probe_connection_once(
-        "192.0.2.1:9",
-        "/v1/models",
-        "key",
-        Instant::now() + Duration::from_millis(100),
-    );
-
-    assert_eq!(result, ConnectionAttempt::HealthFailed);
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "connect_timeout bounds a stalled or unreachable route"
-    );
-}
-
-#[test]
-fn slow_drip_response_head_cannot_refresh_the_attempt_budget() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind slow-head fixture");
-    let address = listener
-        .local_addr()
-        .expect("slow-head address")
-        .to_string();
-    std::thread::spawn(move || {
-        let (mut stream, _) = listener.accept().expect("accept slow-head probe");
-        let mut request = [0_u8; 1024];
-        let _ = stream.read(&mut request);
-        for byte in b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}" {
-            if stream.write_all(&[*byte]).is_err() {
-                return;
-            }
-            std::thread::sleep(Duration::from_millis(20));
-        }
-    });
-
-    let started = Instant::now();
-    let result = probe_connection_once(
-        &address,
-        "/v1/models",
-        "key",
-        Instant::now() + CANCELLABLE_ATTEMPT_TIMEOUT,
-    );
-
-    assert_eq!(result, ConnectionAttempt::HealthFailed);
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "one absolute deadline bounds a slow-drip response head"
-    );
-}
-
-#[test]
-fn slow_drip_response_body_cannot_refresh_the_attempt_budget() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind slow-body fixture");
-    let address = listener
-        .local_addr()
-        .expect("slow-body address")
-        .to_string();
-    std::thread::spawn(move || {
-        let (mut stream, _) = listener.accept().expect("accept slow-body probe");
-        let mut request = [0_u8; 1024];
-        let _ = stream.read(&mut request);
-        if stream
-            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 16\r\n\r\n")
-            .is_err()
-        {
-            return;
-        }
-        for byte in b"0123456789abcdef" {
-            if stream.write_all(&[*byte]).is_err() {
-                return;
-            }
-            std::thread::sleep(Duration::from_millis(20));
-        }
-    });
-
-    let started = Instant::now();
-    let result = probe_connection_once(
-        &address,
-        "/v1/models",
-        "key",
-        Instant::now() + CANCELLABLE_ATTEMPT_TIMEOUT,
-    );
-
-    assert_eq!(result, ConnectionAttempt::HealthFailed);
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "one absolute deadline bounds a slow-drip response body"
-    );
-}
-
-#[test]
-fn an_unbounded_declared_body_is_rejected_without_draining() {
-    let response = format!(
-        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\n\r\n",
-        RESPONSE_BODY_LIMIT + 1
-    );
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind oversized-body fixture");
-    let address = listener
-        .local_addr()
-        .expect("oversized-body address")
-        .to_string();
-    std::thread::spawn(move || {
-        let (mut stream, _) = listener.accept().expect("accept oversized-body probe");
-        let mut request = [0_u8; 1024];
-        let _ = stream.read(&mut request);
-        let _ = stream.write_all(response.as_bytes());
-        std::thread::sleep(Duration::from_secs(1));
-    });
-
-    let started = Instant::now();
-    let result = probe_connection_once(
-        &address,
-        "/v1/models",
-        "key",
-        Instant::now() + CANCELLABLE_ATTEMPT_TIMEOUT,
-    );
-
-    assert_eq!(result, ConnectionAttempt::HealthFailed);
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "an oversized declared body is rejected before its bytes arrive"
-    );
-}
-
-#[test]
-fn cancellation_joins_a_real_slow_drip_probe_without_retrying() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind canceled-drip fixture");
-    let address = listener
-        .local_addr()
-        .expect("canceled-drip address")
-        .to_string();
-    let connections = Arc::new(AtomicUsize::new(0));
-    let server_connections = Arc::clone(&connections);
-    let (entered, blocked) = mpsc::channel();
-    std::thread::spawn(move || {
-        let (mut stream, _) = listener.accept().expect("accept canceled-drip probe");
-        server_connections.fetch_add(1, Ordering::SeqCst);
-        let mut request = [0_u8; 1024];
-        let _ = stream.read(&mut request);
-        entered.send(()).expect("announce real slow-drip probe");
-        for byte in b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}" {
-            if stream.write_all(&[*byte]).is_err() {
-                return;
-            }
-            std::thread::sleep(Duration::from_millis(20));
-        }
-    });
-    let cancellation = CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let worker = std::thread::spawn(move || {
-        probe_connection_cancellable(
-            &address,
-            "/v1/models",
-            "key",
-            Duration::from_secs(30),
-            &worker_cancellation,
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the real probe begins its slow response");
-
-    let started = Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the real probe worker joins");
-
-    assert_eq!(result, ConnectionProbe::Canceled);
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "the attempt deadline bounds joined cancellation during real I/O"
-    );
-    assert_eq!(
-        connections.load(Ordering::SeqCst),
-        1,
-        "cancellation starts no later network probe"
-    );
-}
-
-#[test]
-fn cancellation_at_validation_probe_start_prevents_the_probe() {
-    let cancellation = CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let probe_cancellation = worker_cancellation.clone();
-    let probes = Arc::new(AtomicUsize::new(0));
-    let worker_probes = Arc::clone(&probes);
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        probe_connection_with_probe(
-            "127.0.0.1:1",
-            "/v1/models",
-            "key",
-            Instant::now() + Duration::from_secs(30),
-            &worker_cancellation,
-            CANCELLABLE_ATTEMPT_TIMEOUT,
-            |_, _, _, _| {
-                entered
-                    .send(())
-                    .expect("announce validation probe boundary");
-                if probe_cancellation.wait_timeout(Duration::from_secs(30)) {
-                    ConnectionAttempt::HealthFailed
-                } else {
-                    worker_probes.fetch_add(1, Ordering::SeqCst);
-                    ConnectionAttempt::Accepted
-                }
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("validation pauses immediately before probe admission");
-
-    cancellation.cancel();
-    let result = worker.join().expect("validation worker joins");
-
-    assert_eq!(result, ConnectionProbe::Canceled);
-    assert_eq!(
-        probes.load(Ordering::SeqCst),
-        0,
-        "no validation probe starts after cancellation returns"
-    );
-}
diff --git a/crates/workshop/gateway-discovery/src/health/tests.rs b/crates/workshop/gateway-discovery/src/health/tests.rs
deleted file mode 100644
index 3928c23e6..000000000
--- a/crates/workshop/gateway-discovery/src/health/tests.rs
+++ /dev/null
@@ -1,220 +0,0 @@
-//! Unit tests for the health wait and the bearer probe.
-
-use super::*;
-
-use std::net::TcpListener;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::{Arc, mpsc};
-
-#[path = "tests-connection.rs"]
-mod connection;
-
-/// Answers every connection with a canned response until the test
-/// stops it.
-fn spawn_stub_server(response: &'static [u8]) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind stub server");
-    let address = listener.local_addr().expect("stub server address");
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            let _ = stream.write_all(response);
-        }
-    });
-    format!("http://{address}")
-}
-
-#[test]
-fn a_200_answer_satisfies_the_probe() {
-    let base_url = spawn_stub_server(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}");
-    wait_for_health(&base_url, Duration::from_secs(5)).expect("the stub answers 200");
-}
-
-#[test]
-fn a_non_200_answer_is_retried_until_timeout() {
-    let base_url =
-        spawn_stub_server(b"HTTP/1.1 503 Service Unavailable\r\nContent-Length: 0\r\n\r\n");
-    let error = wait_for_health(&base_url, Duration::from_millis(150))
-        .expect_err("a 503 never satisfies the probe");
-    assert!(
-        matches!(error, HealthError::Timeout { .. }),
-        "a 503 past the budget is a timeout"
-    );
-    let message = error.to_string();
-    assert!(
-        message.contains("did not answer"),
-        "the error names the timeout: {message}"
-    );
-}
-
-#[test]
-fn a_dead_port_times_out() {
-    // Port 1 is never listening, so every connect fails fast.
-    let error = wait_for_health("http://127.0.0.1:1", Duration::from_millis(150))
-        .expect_err("a dead port never satisfies the probe");
-    assert!(
-        matches!(error, HealthError::Timeout { .. }),
-        "a dead port past the budget is a timeout"
-    );
-    let message = error.to_string();
-    assert!(
-        message.contains("did not answer"),
-        "the error names the timeout: {message}"
-    );
-}
-
-#[test]
-fn a_non_http_url_is_rejected() {
-    let error = wait_for_health("ftp://127.0.0.1:7910", Duration::from_millis(10))
-        .expect_err("a non-http URL must fail");
-    assert!(
-        matches!(error, HealthError::NotHttp { .. }),
-        "a non-http URL is rejected before any probe"
-    );
-    assert!(
-        error.to_string().contains("http://"),
-        "the error names the scheme requirement: {error}"
-    );
-}
-
-#[test]
-fn the_probe_sends_the_bound_address_as_host() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind recording server");
-    let address = listener.local_addr().expect("recording server address");
-    let (requests, received) = mpsc::channel();
-    std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            let mut buffer = [0u8; 1024];
-            if let Ok(read) = stream.read(&mut buffer) {
-                let _ = requests.send(String::from_utf8_lossy(&buffer[..read]).into_owned());
-            }
-            let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}");
-        }
-    });
-    wait_for_health(&format!("http://{address}"), Duration::from_secs(5))
-        .expect("the stub answers 200");
-    let request = received
-        .recv_timeout(Duration::from_secs(5))
-        .expect("the probe's request arrived");
-    assert!(
-        request.contains(&format!("Host: {address}\r\n")),
-        "the Host header is the bound address, not localhost: {request:?}"
-    );
-}
-
-#[test]
-fn a_bearer_probe_accepts_a_2xx_and_rejects_a_401() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind key fixture");
-    let address = listener
-        .local_addr()
-        .expect("key fixture address")
-        .to_string();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            let mut buffer = [0u8; 1024];
-            let Ok(read) = stream.read(&mut buffer) else {
-                continue;
-            };
-            let request = String::from_utf8_lossy(&buffer[..read]);
-            let response = if request.contains("Authorization: Bearer right\r\n") {
-                &b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"[..]
-            } else {
-                &b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"[..]
-            };
-            let _ = stream.write_all(response);
-        }
-    });
-    assert_eq!(
-        probe_bearer(&address, "/v1/models", "right"),
-        KeyProbe::Accepted
-    );
-    assert_eq!(
-        probe_bearer(&address, "/v1/models", "wrong"),
-        KeyProbe::Rejected
-    );
-    assert_eq!(
-        probe_bearer("127.0.0.1:1", "/v1/models", "right"),
-        KeyProbe::Unreachable
-    );
-}
-
-#[test]
-fn cancellation_at_health_probe_start_prevents_the_probe() {
-    let cancellation = CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let probes = Arc::new(AtomicUsize::new(0));
-    let worker_probes = Arc::clone(&probes);
-    let (entered, blocked) = mpsc::channel();
-    let (release, released) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        wait_for_health_cancellable_with_start(
-            "http://127.0.0.1:1",
-            Duration::from_secs(30),
-            &worker_cancellation,
-            CANCELLABLE_ATTEMPT_TIMEOUT,
-            || {
-                entered.send(()).expect("announce health probe boundary");
-                released.recv().expect("release health probe boundary");
-            },
-            |_, _| {
-                worker_probes.fetch_add(1, Ordering::SeqCst);
-                Ok(())
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("health wait pauses immediately before probe admission");
-
-    cancellation.cancel();
-    release.send(()).expect("release health probe boundary");
-    let result = worker.join().expect("health worker joins");
-
-    assert!(matches!(result, Err(HealthError::Canceled)));
-    assert_eq!(
-        probes.load(Ordering::SeqCst),
-        0,
-        "no health probe starts after cancellation returns"
-    );
-}
-
-#[test]
-fn cancellation_joins_a_blocked_health_wait_without_another_probe() {
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let probes = Arc::new(AtomicUsize::new(0));
-    let worker_probes = Arc::clone(&probes);
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        wait_for_health_cancellable_with(
-            "http://127.0.0.1:1",
-            Duration::from_secs(30),
-            &worker_cancellation,
-            CANCELLABLE_ATTEMPT_TIMEOUT,
-            |_, _| {
-                worker_probes.fetch_add(1, Ordering::SeqCst);
-                entered.send(()).expect("announce blocked health probe");
-                let _ = worker_cancellation.wait_timeout(Duration::from_secs(30));
-                Err(ProbeError::UnexpectedStatus {
-                    status_line: "blocked".to_owned(),
-                })
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the health phase blocks deterministically");
-
-    let started = Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the health worker joins");
-
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "cancellation bounds the blocked health wait"
-    );
-    assert!(matches!(result, Err(HealthError::Canceled)));
-    assert_eq!(
-        probes.load(Ordering::SeqCst),
-        1,
-        "no probe starts after cancellation"
-    );
-}
diff --git a/crates/workshop/gateway-discovery/src/lib.rs b/crates/workshop/gateway-discovery/src/lib.rs
deleted file mode 100644
index 762ba3b97..000000000
--- a/crates/workshop/gateway-discovery/src/lib.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-//! The Gateway discovery contract, as Workshop reads it.
-//!
-//! Workshop attaches to an already-running Gateway instead of starting a
-//! second one. It does that by reading the `gateway.json` file the Gateway
-//! writes into the run directory (`<home>/.runvil/run`) after a successful
-//! bind: the file holds the loopback port, the bearer key, the pid, the boot
-//! epoch, the version, and the start time. This crate is the reader half of
-//! that protocol - read, validate, resolve, settle a launch race, wait for
-//! health, and ask the Gateway to exit - and it is synchronous and
-//! runtime-agnostic: no tokio, axum, or reqwest.
-//!
-//! The contract itself is written down in `CONTRACT.md` at the crate root,
-//! which is the authority for both halves. The Gateway's writer lives in the
-//! Gateway family; this crate never names it.
-//!
-//! The flow:
-//!
-//! 1. A reader ([`resolve`]) attaches only when the file is live: the pid
-//!    is alive, one OS process boot with a `runvil-gateway` image brackets a
-//!    same-socket health and bearer proof, and the file includes a boot
-//!    identity. Anything else is stale and the file is deleted.
-//!    [`ValidatedConnection`] holds that point-in-time proof without
-//!    exposing a forgeable constructor.
-//! 2. Launch races take [`launch_or_attach`]: the `gateway.json.lock`
-//!    advisory lock elects one parent launcher; losers attach to the winner.
-//! 3. A reader holding a [`ValidatedConnection`] asks the Gateway to exit
-//!    with [`request_shutdown`], which posts its bearer key to
-//!    `POST /shutdown`.
-//!
-//! Before any Gateway runs, Workshop finds the installed one it launches
-//! with [`installed_gateway`], which knows each installer's layout.
-//! [`installed_plugin_dir`] names Workshop's Plugin directory, which
-//! ships inside Workshop's own bundle where the platform has one.
-//!
-//! URLs normalize to a literal `127.0.0.1`, never `localhost`, and probes
-//! send the bound address as the `Host` header, matching the Gateway's
-//! loopback `Host` allowlist.
-//!
-//! # Writing the file
-//!
-//! Production Workshop never writes `gateway.json`: the Gateway owns that
-//! half, and a second writer would let Workshop forge a live endpoint.
-//! Workshop's test doubles do need to write one, so the write and remove
-//! functions and the process-lifetime lease are compiled only under the
-//! `test-fixtures` feature.
-//!
-//! ## Invariants
-//!
-//! - Tier: vocabulary; may depend on no other `workshop-*` crate. It needs
-//!   no async runtime, so Workshop can hold the contract without adopting
-//!   one here. `cargo test -p build-xtask` enforces the product and
-//!   container boundaries.
-//! - The discovery file, the two lock file names, the stale rule, and the
-//!   three HTTP calls are exactly what `CONTRACT.md` says. A behavior change
-//!   here is a contract change, and `CONTRACT.md` changes with it.
-//! - A bearer key is never written to logs or `Debug` output. Every error
-//!   path that could echo a rejected request's status line redacts it.
-//! - Reading the file tolerates fields this crate does not know, so a newer
-//!   Gateway never breaks an older Workshop.
-//! - No writer ships in a production build: the file is the Gateway's to
-//!   write.
-
-#[cfg(feature = "test-fixtures")]
-mod atomic;
-mod cancellation;
-mod error;
-mod file;
-mod health;
-mod lock;
-mod paths;
-mod peer;
-mod shutdown;
-mod stale;
-mod sys;
-mod validated;
-
-pub use crate::cancellation::CancellationToken;
-pub use crate::error::SidecarError;
-pub use crate::file::GatewayDiscoveryFile;
-#[cfg(feature = "test-fixtures")]
-pub use crate::file::remove_if_mine;
-pub use crate::health::{HealthError, ProbeError, wait_for_health, wait_for_health_cancellable};
-#[cfg(feature = "test-fixtures")]
-pub use crate::lock::GatewayInstanceLease;
-pub use crate::lock::{LaunchDecision, LaunchLock, launch_or_attach, launch_or_attach_cancellable};
-pub use crate::paths::{
-    GATEWAY_DISCOVERY_FILE_NAME, GATEWAY_LOG_FILE_NAME, INSTANCE_LOCK_FILE_NAME, LOCK_FILE_NAME,
-    default_run_dir, gateway_discovery_file_path, gateway_log_path, instance_lock_file_path,
-    lock_file_path, run_dir,
-};
-pub use crate::peer::{
-    APPIMAGE_PLUGIN_PARENT, GATEWAY_BUNDLE_NAME, MACOS_PLUGIN_PARENT, PLUGIN_DIR_NAME,
-    WORKSHOP_APPIMAGE_NAME, WORKSHOP_BUNDLE_NAME, installed_gateway, installed_plugin_dir,
-    running_appimage,
-};
-pub use crate::shutdown::{ShutdownError, request_shutdown, request_shutdown_before};
-#[cfg(any(test, feature = "test-fixtures"))]
-#[doc(hidden)]
-pub use crate::stale::resolve_for_test;
-pub use crate::stale::{Resolution, StaleReason, is_running, resolve, resolve_cancellable};
-pub use crate::validated::{ValidatedConnection, ValidationError};
diff --git a/crates/workshop/gateway-discovery/src/lock-tests.rs b/crates/workshop/gateway-discovery/src/lock-tests.rs
deleted file mode 100644
index 94f88e4b1..000000000
--- a/crates/workshop/gateway-discovery/src/lock-tests.rs
+++ /dev/null
@@ -1,230 +0,0 @@
-//! Unit tests for the launch-race lock and the Gateway instance lease.
-
-use super::*;
-
-use std::io::{Read, Write as _};
-use std::net::TcpListener;
-use std::sync::mpsc;
-
-/// The test process's own image name, so the pid and image checks
-/// pass and the loser reaches the probe path.
-fn own_image_name() -> String {
-    std::env::current_exe()
-        .expect("current exe")
-        .file_name()
-        .expect("the exe has a file name")
-        .to_string_lossy()
-        .into_owned()
-}
-
-/// A fixture gateway answering health and the presented key with 200.
-fn fixture_gateway() -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            for _ in 0..2 {
-                let mut buffer = [0u8; 1024];
-                if stream.read(&mut buffer).is_err() {
-                    break;
-                }
-                if stream
-                    .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
-                    .is_err()
-                {
-                    break;
-                }
-            }
-        }
-    });
-    port
-}
-
-/// A live gateway discovery file on the fixture gateway, owned by the test
-/// process.
-fn live_file(port: u16) -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port,
-        api_key: "key".to_owned(),
-        pid: std::process::id(),
-        epoch: 1_757_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-09-03T12:00:00Z".to_owned(),
-    }
-}
-
-#[test]
-fn an_empty_run_dir_elects_a_launcher() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let decision = launch_or_attach_named(dir.path(), "irrelevant", Duration::from_secs(1))
-        .expect("the race settles");
-    assert!(
-        matches!(decision, LaunchDecision::Launch(_)),
-        "no file means this caller launches"
-    );
-    assert!(
-        lock_file_path(dir.path()).exists(),
-        "the lock file was created"
-    );
-}
-
-#[test]
-fn process_ownership_is_separate_from_parent_launch_election() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let lease = GatewayInstanceLease::try_acquire(dir.path())
-        .expect("attempt the process lease")
-        .expect("the first process acquires its lease");
-    let decision = launch_or_attach_named(dir.path(), "irrelevant", Duration::from_millis(100))
-        .expect("the independent parent launch election settles");
-    assert!(
-        matches!(decision, LaunchDecision::Launch(_)),
-        "holding the process lease never contends with LaunchLock"
-    );
-    assert!(
-        GatewayInstanceLease::try_acquire(dir.path())
-            .expect("contend for process ownership")
-            .is_none(),
-        "a second process lease cannot coexist"
-    );
-    drop(lease);
-    assert!(
-        GatewayInstanceLease::try_acquire(dir.path())
-            .expect("reacquire released process ownership")
-            .is_some(),
-        "dropping the handle releases ownership"
-    );
-}
-
-#[test]
-fn a_live_file_attaches_without_contesting_the_lock() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = live_file(fixture_gateway());
-    file.write_to(dir.path()).expect("write");
-
-    let decision = launch_or_attach_named(dir.path(), &own_image_name(), Duration::from_secs(5))
-        .expect("the race settles");
-    match decision {
-        LaunchDecision::Attach(attached) => assert_eq!(attached, file),
-        LaunchDecision::Launch(_) => panic!("a live gateway must be attached, not relaunched"),
-    }
-}
-
-#[test]
-fn the_race_loser_attaches_to_the_winners_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let image = own_image_name();
-    // The winner holds the lock with no file written yet.
-    let LaunchDecision::Launch(winner) =
-        launch_or_attach_named(dir.path(), &image, Duration::from_secs(5))
-            .expect("the first caller wins the lock")
-    else {
-        panic!("an empty run dir elects a launcher");
-    };
-
-    // The loser waits; the winner's file appears mid-wait.
-    let loser_dir = dir.path().to_owned();
-    let loser = std::thread::spawn(move || {
-        launch_or_attach_named(&loser_dir, &image, Duration::from_secs(10))
-            .expect("the loser's race settles")
-    });
-    std::thread::sleep(Duration::from_millis(100));
-    let file = live_file(fixture_gateway());
-    file.write_to(dir.path()).expect("the winner writes");
-
-    match loser.join().expect("the loser thread ran") {
-        LaunchDecision::Attach(attached) => assert_eq!(attached, file),
-        LaunchDecision::Launch(_) => {
-            panic!("the loser must attach to the winner, not launch a second gateway")
-        }
-    }
-    drop(winner);
-}
-
-#[test]
-fn a_loser_becomes_the_launcher_when_the_winner_dies_silent() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let image = own_image_name();
-    {
-        let LaunchDecision::Launch(winner) =
-            launch_or_attach_named(dir.path(), &image, Duration::from_secs(5))
-                .expect("the first caller wins the lock")
-        else {
-            panic!("an empty run dir elects a launcher");
-        };
-        // The winner dies (or gives up) without writing a file.
-        drop(winner);
-    }
-
-    let decision = launch_or_attach_named(dir.path(), &image, Duration::from_secs(5))
-        .expect("the race settles");
-    assert!(
-        matches!(decision, LaunchDecision::Launch(_)),
-        "a dead winner's lock passes to the next launcher"
-    );
-}
-
-#[test]
-fn a_loser_times_out_when_the_winner_stays_silent() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let image = own_image_name();
-    let LaunchDecision::Launch(_winner) =
-        launch_or_attach_named(dir.path(), &image, Duration::from_secs(5))
-            .expect("the first caller wins the lock")
-    else {
-        panic!("an empty run dir elects a launcher");
-    };
-
-    let error = launch_or_attach_named(dir.path(), &image, Duration::from_millis(150))
-        .expect_err("a silent winner starves the loser");
-    assert!(
-        matches!(error, SidecarError::LaunchTimeout { .. }),
-        "the loser reports the timeout: {error}"
-    );
-}
-
-#[test]
-fn cancellation_joins_a_blocked_launch_race_without_launching() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let image = own_image_name();
-    let LaunchDecision::Launch(winner) =
-        launch_or_attach_named(dir.path(), &image, Duration::from_secs(5))
-            .expect("the first caller wins the lock")
-    else {
-        panic!("an empty run dir elects a launcher");
-    };
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let run_dir = dir.path().to_owned();
-    let worker_image = image.clone();
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        launch_or_attach_named_cancellable_with(
-            &run_dir,
-            &worker_image,
-            Duration::from_secs(30),
-            &worker_cancellation,
-            |delay| {
-                entered.send(()).expect("announce blocked launch race");
-                worker_cancellation.wait_timeout(delay)
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the launch-race phase blocks deterministically");
-
-    let started = Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the launch-race worker joins");
-
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "cancellation bounds the blocked launch race"
-    );
-    assert!(matches!(result, Err(SidecarError::Canceled)));
-    assert!(
-        !crate::paths::gateway_discovery_file_path(dir.path()).exists(),
-        "the canceled loser never publishes or launches"
-    );
-    drop(winner);
-}
diff --git a/crates/workshop/gateway-discovery/src/lock.rs b/crates/workshop/gateway-discovery/src/lock.rs
deleted file mode 100644
index 0b82e0c30..000000000
--- a/crates/workshop/gateway-discovery/src/lock.rs
+++ /dev/null
@@ -1,275 +0,0 @@
-//! The launch-race lock: `gateway.json.lock` beside the gateway discovery file,
-//! electing one launcher when two readers find no live gateway at the
-//! same moment. The loser attaches to the winner.
-//!
-//! The protocol: the lock holder re-validates the gateway discovery file before
-//! deciding, because a previous winner may have written it and released
-//! the lock; a loser never deletes anything, it waits for the winner's
-//! file to go live and attaches. Cleanup is the lock holder's privilege.
-//! The OS-file-lock pattern mirrors the Gateway's own artifact lock: an
-//! `OpenOptions` create plus a `std::fs::File` advisory lock, released by
-//! dropping the handle.
-
-use std::fs::{File, OpenOptions, TryLockError};
-use std::path::Path;
-use std::time::{Duration, Instant};
-
-use crate::error::SidecarError;
-use crate::paths::lock_file_path;
-use crate::stale::{self, GATEWAY_IMAGE_NAME, Resolution};
-use crate::{CancellationToken, GatewayDiscoveryFile};
-
-/// Delay between lock retries while a winner finishes its launch.
-const RETRY_INTERVAL: Duration = Duration::from_millis(25);
-
-/// The held launch lock. The holder launches the gateway; dropping the
-/// guard releases the lock.
-#[derive(Debug)]
-pub struct LaunchLock {
-    // The handle owns the OS lock; dropping it releases.
-    _file: File,
-}
-
-/// The Gateway process-lifetime ownership lease, which only a test double
-/// needs: production Workshop never claims to be a Gateway.
-///
-/// This lock is distinct from [`LaunchLock`]: a Workshop parent may hold the
-/// launch election while the spawned Gateway acquires this lease. The file
-/// handle owns the operating-system lock, so dropping it or terminating its
-/// process releases ownership without pid files or explicit cleanup.
-#[cfg(feature = "test-fixtures")]
-#[derive(Debug)]
-pub struct GatewayInstanceLease {
-    // The handle owns the OS lock; dropping it releases.
-    _file: File,
-}
-
-#[cfg(feature = "test-fixtures")]
-impl GatewayInstanceLease {
-    /// Attempts to acquire process-lifetime Gateway ownership without
-    /// blocking. `Ok(None)` means another process owns the lease.
-    ///
-    /// # Errors
-    /// Returns [`SidecarError::CreateDir`] when the run directory cannot be
-    /// created, or [`SidecarError::Lock`] when the lease file cannot be opened
-    /// or an unexpected operating-system lock error occurs.
-    pub fn try_acquire(run_dir: &Path) -> Result<Option<Self>, SidecarError> {
-        std::fs::create_dir_all(run_dir).map_err(|source| SidecarError::CreateDir {
-            path: run_dir.to_owned(),
-            source,
-        })?;
-        let lock_path = crate::paths::instance_lock_file_path(run_dir);
-        let file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .truncate(false)
-            .open(&lock_path)
-            .map_err(|source| SidecarError::Lock {
-                path: lock_path.clone(),
-                source,
-            })?;
-        match file.try_lock() {
-            Ok(()) => Ok(Some(Self { _file: file })),
-            Err(TryLockError::WouldBlock) => Ok(None),
-            Err(TryLockError::Error(source)) => Err(SidecarError::Lock {
-                path: lock_path,
-                source,
-            }),
-        }
-    }
-}
-
-/// What [`launch_or_attach`] decided.
-#[derive(Debug)]
-#[non_exhaustive]
-pub enum LaunchDecision {
-    /// This caller holds the launch lock and no live gateway exists:
-    /// launch one. The lock stays held until the returned guard drops, so
-    /// a concurrent racer attaches to the launched gateway instead of
-    /// launching its own.
-    Launch(LaunchLock),
-    /// A live gateway already exists: attach to it.
-    Attach(GatewayDiscoveryFile),
-}
-
-/// Settles a launch race in `run_dir`: returns [`LaunchDecision::Launch`]
-/// with the held lock when no live gateway exists, or
-/// [`LaunchDecision::Attach`] when one does - either already running, or
-/// launched by the race winner while this caller waited. A loser waits up
-/// to `timeout` for the winner's gateway to become attachable, and takes
-/// the lock itself when the winner dies without writing one.
-///
-/// # Errors
-/// Returns [`SidecarError::CreateDir`] when the run directory cannot be
-/// created, [`SidecarError::Lock`] when the lock file cannot be opened or
-/// an unexpected lock error occurs, [`SidecarError::LaunchTimeout`] when
-/// no winner became attachable within `timeout`, and the [`crate::resolve`]
-/// errors when the lock holder's own re-validation fails.
-pub fn launch_or_attach(run_dir: &Path, timeout: Duration) -> Result<LaunchDecision, SidecarError> {
-    launch_or_attach_named(run_dir, GATEWAY_IMAGE_NAME, timeout)
-}
-
-/// Settles a launch race while observing caller cancellation.
-///
-/// # Errors
-/// Returns [`SidecarError::Canceled`] when cancellation wins, plus the
-/// file, lock, and timeout failures documented by [`launch_or_attach`].
-pub fn launch_or_attach_cancellable(
-    run_dir: &Path,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-) -> Result<LaunchDecision, SidecarError> {
-    launch_or_attach_named_cancellable(run_dir, GATEWAY_IMAGE_NAME, timeout, cancellation)
-}
-
-/// [`launch_or_attach`] against a caller-named process image, so tests
-/// can run the full liveness gauntlet from a test binary, which is never
-/// named `runvil-gateway`.
-fn launch_or_attach_named(
-    run_dir: &Path,
-    image_name: &str,
-    timeout: Duration,
-) -> Result<LaunchDecision, SidecarError> {
-    std::fs::create_dir_all(run_dir).map_err(|source| SidecarError::CreateDir {
-        path: run_dir.to_owned(),
-        source,
-    })?;
-    let lock_path = lock_file_path(run_dir);
-    let lock = OpenOptions::new()
-        .read(true)
-        .write(true)
-        .create(true)
-        .truncate(false)
-        .open(&lock_path)
-        .map_err(|source| SidecarError::Lock {
-            path: lock_path.clone(),
-            source,
-        })?;
-    let deadline = Instant::now() + timeout;
-    loop {
-        match lock.try_lock() {
-            Ok(()) => {
-                // The lock is held; a previous winner may have written a
-                // live file before releasing, so re-validate before
-                // launching. As the holder, cleanup is ours.
-                return Ok(match stale::resolve_named(run_dir, image_name)? {
-                    Resolution::Attach(file) => LaunchDecision::Attach(file),
-                    Resolution::Absent | Resolution::Stale(_) => {
-                        LaunchDecision::Launch(LaunchLock { _file: lock })
-                    }
-                });
-            }
-            Err(TryLockError::WouldBlock) => {
-                // Another process holds the lock and is mid-launch. Attach
-                // as soon as its file goes live; never delete here.
-                if let Ok(Some(file)) = GatewayDiscoveryFile::read(run_dir)
-                    && stale::is_live(&file, image_name)
-                {
-                    return Ok(LaunchDecision::Attach(file));
-                }
-                if Instant::now() >= deadline {
-                    return Err(SidecarError::LaunchTimeout { timeout });
-                }
-                std::thread::sleep(RETRY_INTERVAL);
-            }
-            Err(TryLockError::Error(source)) => {
-                return Err(SidecarError::Lock {
-                    path: lock_path.clone(),
-                    source,
-                });
-            }
-        }
-    }
-}
-
-fn launch_or_attach_named_cancellable(
-    run_dir: &Path,
-    image_name: &str,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-) -> Result<LaunchDecision, SidecarError> {
-    launch_or_attach_named_cancellable_with(run_dir, image_name, timeout, cancellation, |delay| {
-        cancellation.wait_timeout(delay)
-    })
-}
-
-fn launch_or_attach_named_cancellable_with(
-    run_dir: &Path,
-    image_name: &str,
-    timeout: Duration,
-    cancellation: &CancellationToken,
-    mut wait: impl FnMut(Duration) -> bool,
-) -> Result<LaunchDecision, SidecarError> {
-    if cancellation.is_canceled() {
-        return Err(SidecarError::Canceled);
-    }
-    std::fs::create_dir_all(run_dir).map_err(|source| SidecarError::CreateDir {
-        path: run_dir.to_owned(),
-        source,
-    })?;
-    if cancellation.is_canceled() {
-        return Err(SidecarError::Canceled);
-    }
-    let lock_path = lock_file_path(run_dir);
-    let lock = OpenOptions::new()
-        .read(true)
-        .write(true)
-        .create(true)
-        .truncate(false)
-        .open(&lock_path)
-        .map_err(|source| SidecarError::Lock {
-            path: lock_path.clone(),
-            source,
-        })?;
-    let deadline = Instant::now() + timeout;
-    loop {
-        if cancellation.is_canceled() {
-            return Err(SidecarError::Canceled);
-        }
-        match lock.try_lock() {
-            Ok(()) => {
-                let resolution =
-                    stale::resolve_named_cancellable(run_dir, image_name, cancellation)?;
-                if cancellation.is_canceled() {
-                    return Err(SidecarError::Canceled);
-                }
-                return Ok(match resolution {
-                    Resolution::Attach(file) => LaunchDecision::Attach(file),
-                    Resolution::Absent | Resolution::Stale(_) => {
-                        LaunchDecision::Launch(LaunchLock { _file: lock })
-                    }
-                });
-            }
-            Err(TryLockError::WouldBlock) => {
-                if cancellation.is_canceled() {
-                    return Err(SidecarError::Canceled);
-                }
-                if let Ok(Some(file)) = GatewayDiscoveryFile::read(run_dir)
-                    && stale::is_live_cancellable(&file, image_name, cancellation)?
-                {
-                    if cancellation.is_canceled() {
-                        return Err(SidecarError::Canceled);
-                    }
-                    return Ok(LaunchDecision::Attach(file));
-                }
-                if Instant::now() >= deadline {
-                    return Err(SidecarError::LaunchTimeout { timeout });
-                }
-                if wait(RETRY_INTERVAL) {
-                    return Err(SidecarError::Canceled);
-                }
-            }
-            Err(TryLockError::Error(source)) => {
-                return Err(SidecarError::Lock {
-                    path: lock_path.clone(),
-                    source,
-                });
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "lock-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway-discovery/src/paths.rs b/crates/workshop/gateway-discovery/src/paths.rs
deleted file mode 100644
index f5bee0bf2..000000000
--- a/crates/workshop/gateway-discovery/src/paths.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-//! Run-directory, gateway-discovery-file, and gateway-log paths: the one
-//! place that knows the `<home>/.runvil/run` and
-//! `<home>/.runvil/logs` layout.
-
-use std::path::{Path, PathBuf};
-
-/// The gateway discovery file's name inside the run directory.
-pub const GATEWAY_DISCOVERY_FILE_NAME: &str = "gateway.json";
-
-/// The gateway log's name inside the state directory's `logs` directory.
-pub const GATEWAY_LOG_FILE_NAME: &str = "gateway.log";
-
-/// The launch lock's name, beside the gateway discovery file.
-pub const LOCK_FILE_NAME: &str = "gateway.json.lock";
-
-/// The process-lifetime Gateway instance lock's name.
-pub const INSTANCE_LOCK_FILE_NAME: &str = "gateway.instance.lock";
-
-/// The run directory under the state dir: `<home>/.runvil/run`.
-#[must_use]
-pub fn run_dir(home: &Path) -> PathBuf {
-    home.join(".runvil").join("run")
-}
-
-/// This process's default run directory: the user profile's
-/// `.runvil/run`.
-///
-/// Returns `None` when the user profile directory cannot be located.
-#[must_use]
-pub fn default_run_dir() -> Option<PathBuf> {
-    std::env::home_dir().map(|home| run_dir(&home))
-}
-
-/// The gateway discovery file inside `run_dir`.
-#[must_use]
-pub fn gateway_discovery_file_path(run_dir: &Path) -> PathBuf {
-    run_dir.join(GATEWAY_DISCOVERY_FILE_NAME)
-}
-
-/// The launch lock inside `run_dir`.
-#[must_use]
-pub fn lock_file_path(run_dir: &Path) -> PathBuf {
-    run_dir.join(LOCK_FILE_NAME)
-}
-
-/// The process-lifetime Gateway instance lock inside `run_dir`. Named here
-/// for the contract's sake and used by the test-double lease.
-#[must_use]
-pub fn instance_lock_file_path(run_dir: &Path) -> PathBuf {
-    run_dir.join(INSTANCE_LOCK_FILE_NAME)
-}
-
-/// The gateway log under `state_dir`, the directory that holds the run
-/// directory: `<home>/.runvil/logs/gateway.log`. The gateway starts
-/// logging there before it loads its configuration, so a gateway that exits
-/// on its configuration still records why.
-#[must_use]
-pub fn gateway_log_path(state_dir: &Path) -> PathBuf {
-    state_dir.join("logs").join(GATEWAY_LOG_FILE_NAME)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_run_dir_sits_under_the_profile_runvil_dir() {
-        assert_eq!(
-            run_dir(Path::new("home")),
-            Path::new("home").join(".runvil").join("run")
-        );
-    }
-
-    #[test]
-    fn the_gateway_discovery_file_and_locks_sit_beside_each_other() {
-        let dir = Path::new("run");
-        assert_eq!(
-            gateway_discovery_file_path(dir),
-            Path::new("run").join("gateway.json")
-        );
-        assert_eq!(
-            lock_file_path(dir),
-            Path::new("run").join("gateway.json.lock")
-        );
-        assert_eq!(
-            instance_lock_file_path(dir),
-            Path::new("run").join("gateway.instance.lock")
-        );
-    }
-
-    #[test]
-    fn the_gateway_log_sits_in_a_logs_directory_beside_the_run_directory() {
-        let run = run_dir(Path::new("home"));
-        let state_dir = run.parent().expect("the run directory has a parent");
-        assert_eq!(
-            gateway_log_path(state_dir),
-            Path::new("home")
-                .join(".runvil")
-                .join("logs")
-                .join("gateway.log")
-        );
-    }
-}
diff --git a/crates/workshop/gateway-discovery/src/peer-tests.rs b/crates/workshop/gateway-discovery/src/peer-tests.rs
deleted file mode 100644
index adc63843a..000000000
--- a/crates/workshop/gateway-discovery/src/peer-tests.rs
+++ /dev/null
@@ -1,345 +0,0 @@
-use std::ffi::OsStr;
-use std::path::{Path, PathBuf};
-
-use super::{
-    GATEWAY_BUNDLE_NAME, Layout, PLUGIN_DIR_NAME, WORKSHOP_APPIMAGE_NAME, WORKSHOP_BUNDLE_NAME,
-    app_bundle, bundle_exe, first_file, gateway_candidates, installed_gateway,
-    installed_plugin_dir, plugin_dir, running_appimage,
-};
-
-/// Plants an empty executable file at `root/relative`, creating its
-/// directories.
-fn plant(root: &Path, relative: &Path) -> PathBuf {
-    let path = root.join(relative);
-    std::fs::create_dir_all(path.parent().expect("a planted file has a parent"))
-        .expect("create fixture directories");
-    std::fs::write(&path, b"").expect("plant fixture file");
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755))
-            .expect("mark fixture executable");
-    }
-    path
-}
-
-fn gateway_for(layout: Layout, workshop_exe: &Path, appimage: Option<&Path>) -> Option<PathBuf> {
-    first_file(gateway_candidates(layout, workshop_exe, appimage))
-}
-
-#[test]
-fn windows_peers_sit_beside_each_other() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let workshop = plant(root.path(), Path::new("runvil-workshop.exe"));
-    let gateway = plant(root.path(), Path::new("runvil-gateway.exe"));
-
-    assert_eq!(gateway_for(Layout::Windows, &workshop, None), Some(gateway));
-}
-
-#[test]
-fn a_development_tree_finds_the_gateway_beside_workshop() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let debug = Path::new("target").join("debug");
-    let workshop = plant(root.path(), &debug.join("runvil-workshop"));
-    let gateway = plant(root.path(), &debug.join("runvil-gateway"));
-
-    for layout in [Layout::MacOs, Layout::Linux] {
-        assert_eq!(
-            gateway_for(layout, &workshop, None),
-            Some(gateway.clone()),
-            "{layout:?}"
-        );
-    }
-}
-
-#[test]
-fn macos_peers_are_sibling_bundles() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let workshop = plant(
-        root.path(),
-        &bundle_exe(Path::new(""), WORKSHOP_BUNDLE_NAME, "runvil-workshop"),
-    );
-    let gateway = plant(
-        root.path(),
-        &bundle_exe(Path::new(""), GATEWAY_BUNDLE_NAME, "runvil-gateway"),
-    );
-
-    assert_eq!(gateway_for(Layout::MacOs, &workshop, None), Some(gateway));
-}
-
-#[test]
-fn macos_bundle_lookup_needs_the_bundle_structure() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    plant(
-        root.path(),
-        &bundle_exe(Path::new(""), GATEWAY_BUNDLE_NAME, "runvil-gateway"),
-    );
-    let loose = root
-        .path()
-        .join("Contents")
-        .join("MacOS")
-        .join("runvil-workshop");
-
-    assert_eq!(
-        gateway_for(Layout::MacOs, &loose, None),
-        None,
-        "an executable outside a .app bundle has no bundle siblings"
-    );
-}
-
-#[test]
-fn linux_workshop_finds_the_gateway_beside_its_appimage() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let install = root.path().join("Runvil");
-    let appimage = plant(&install, Path::new(WORKSHOP_APPIMAGE_NAME));
-    let gateway = plant(&install, Path::new("runvil-gateway"));
-    let mount = root
-        .path()
-        .join("mount")
-        .join("usr")
-        .join("bin")
-        .join("runvil-workshop");
-
-    assert_eq!(
-        gateway_for(Layout::Linux, &mount, Some(appimage.as_path())),
-        Some(gateway)
-    );
-}
-
-#[test]
-fn linux_workshop_prefers_the_gateway_beside_its_appimage_to_one_in_its_mount() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let install = root.path().join("Runvil");
-    let appimage = plant(&install, Path::new(WORKSHOP_APPIMAGE_NAME));
-    let installed = plant(&install, Path::new("runvil-gateway"));
-    let bin = root.path().join("mount").join("usr").join("bin");
-    let workshop = plant(&bin, Path::new("runvil-workshop"));
-    plant(&bin, Path::new("runvil-gateway"));
-
-    assert_eq!(
-        gateway_for(Layout::Linux, &workshop, Some(appimage.as_path())),
-        Some(installed)
-    );
-}
-
-#[test]
-fn an_appimage_counts_only_when_workshop_runs_from_its_mount() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let mount = root.path().join(".mount_PromptXYZ");
-    let workshop = mount.join("usr").join("bin").join("runvil-workshop");
-    let appimage = root.path().join("Runvil").join(WORKSHOP_APPIMAGE_NAME);
-    let other_mount = root.path().join(".mount_CodeXYZ");
-    let other_appimage = root.path().join("Apps").join("Code.AppImage");
-    let found = |appimage: &OsStr, appdir: &OsStr| {
-        running_appimage(&workshop, Some(appimage), Some(appdir))
-    };
-
-    assert_eq!(
-        found(appimage.as_os_str(), mount.as_os_str()),
-        Some(appimage.clone())
-    );
-    assert_eq!(
-        found(other_appimage.as_os_str(), other_mount.as_os_str()),
-        None,
-        "an $APPIMAGE inherited from another AppImage is ignored"
-    );
-    assert_eq!(
-        found(OsStr::new(WORKSHOP_APPIMAGE_NAME), mount.as_os_str()),
-        None,
-        "a relative $APPIMAGE is ignored"
-    );
-    assert_eq!(
-        found(OsStr::new(""), mount.as_os_str()),
-        None,
-        "empty $APPIMAGE"
-    );
-    assert_eq!(
-        found(appimage.as_os_str(), OsStr::new("")),
-        None,
-        "empty $APPDIR"
-    );
-    assert_eq!(
-        running_appimage(&workshop, Some(appimage.as_os_str()), None),
-        None
-    );
-    assert_eq!(
-        running_appimage(&workshop, None, Some(mount.as_os_str())),
-        None
-    );
-}
-
-#[cfg(unix)]
-#[test]
-fn an_appimage_counts_when_appdir_reaches_the_mount_through_a_symlink() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let mount = root.path().join(".mount_PromptXYZ");
-    std::fs::create_dir_all(&mount).expect("create the mount");
-    let link = root.path().join("tmp-link");
-    std::os::unix::fs::symlink(&mount, &link).expect("link to the mount");
-    let workshop = std::fs::canonicalize(&mount)
-        .expect("resolve the mount")
-        .join("usr")
-        .join("bin")
-        .join("runvil-workshop");
-    let appimage = root.path().join("Runvil").join(WORKSHOP_APPIMAGE_NAME);
-
-    assert_eq!(
-        running_appimage(
-            &workshop,
-            Some(appimage.as_os_str()),
-            Some(link.as_os_str())
-        ),
-        Some(appimage)
-    );
-}
-
-#[cfg(unix)]
-#[test]
-fn a_peer_without_an_execute_bit_is_not_found() {
-    use std::os::unix::fs::PermissionsExt as _;
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let workshop = plant(root.path(), Path::new("runvil-workshop"));
-    let gateway = plant(root.path(), Path::new("runvil-gateway"));
-    assert_eq!(
-        gateway_for(Layout::Linux, &workshop, None),
-        Some(gateway.clone())
-    );
-    std::fs::set_permissions(&gateway, std::fs::Permissions::from_mode(0o644))
-        .expect("clear the execute bits");
-
-    assert_eq!(gateway_for(Layout::Linux, &workshop, None), None);
-}
-
-#[test]
-fn the_bundle_walks_up_from_contents_macos_to_the_app() {
-    let exe = Path::new("/Applications/Runvil.app/Contents/MacOS/runvil-gateway");
-    assert_eq!(app_bundle(exe), Some(Path::new("/Applications/Runvil.app")));
-}
-
-#[test]
-fn the_bundle_probe_rejects_unbundled_and_partial_paths() {
-    assert_eq!(app_bundle(Path::new("/usr/local/bin/runvil-gateway")), None);
-    assert_eq!(
-        app_bundle(Path::new("/Applications/Runvil.app/Contents/MacOS")),
-        None,
-        "the exe itself must sit below MacOS"
-    );
-    assert_eq!(
-        app_bundle(Path::new("/opt/x/Contents/MacOS/runvil-gateway")),
-        None,
-        "the parent two levels up must be a .app"
-    );
-    assert_eq!(app_bundle(Path::new("runvil-gateway")), None);
-}
-
-#[test]
-fn a_missing_peer_is_none_in_every_layout() {
-    for layout in [Layout::Windows, Layout::MacOs, Layout::Linux] {
-        let root = tempfile::TempDir::new().expect("tempdir");
-        let exe = if matches!(layout, Layout::Windows) {
-            "runvil-workshop.exe"
-        } else {
-            "runvil-workshop"
-        };
-        let workshop = plant(root.path(), Path::new(exe));
-        plant(
-            &root.path().join("elsewhere"),
-            Path::new(layout.gateway_exe()),
-        );
-
-        assert_eq!(gateway_for(layout, &workshop, None), None, "{layout:?}");
-    }
-}
-
-#[test]
-fn a_missing_install_directory_is_none() {
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let absent = root.path().join("absent").join("runvil-gateway");
-    assert_eq!(installed_gateway(&absent, None), None);
-}
-
-#[test]
-fn the_plugin_directory_sits_beside_an_unbundled_workshop_in_every_layout() {
-    let install = Path::new("install");
-    for layout in [Layout::Windows, Layout::MacOs, Layout::Linux] {
-        assert_eq!(
-            plugin_dir(layout, &install.join("runvil-workshop"), None),
-            Some(install.join(PLUGIN_DIR_NAME)),
-            "{layout:?}"
-        );
-    }
-}
-
-#[test]
-fn the_macos_plugin_directory_sits_inside_the_workshop_bundle() {
-    let install = Path::new("Applications").join("Runvil");
-    let workshop = bundle_exe(&install, WORKSHOP_BUNDLE_NAME, "runvil-workshop");
-    assert_eq!(
-        plugin_dir(Layout::MacOs, &workshop, None),
-        Some(
-            install
-                .join(WORKSHOP_BUNDLE_NAME)
-                .join("Contents")
-                .join("Resources")
-                .join(PLUGIN_DIR_NAME)
-        ),
-        "the updater replaces the bundle, so the Plugins go with it"
-    );
-    assert_eq!(
-        plugin_dir(Layout::Windows, &workshop, None),
-        Some(
-            install
-                .join(WORKSHOP_BUNDLE_NAME)
-                .join("Contents")
-                .join("MacOS")
-                .join(PLUGIN_DIR_NAME)
-        ),
-        "only the macOS layout reads the bundle structure"
-    );
-}
-
-#[test]
-fn the_linux_plugin_directory_sits_inside_the_appimage_s_mount() {
-    let install = Path::new("opt").join("Runvil");
-    let appimage = install.join(WORKSHOP_APPIMAGE_NAME);
-    let workshop = Path::new("mount")
-        .join("usr")
-        .join("bin")
-        .join("runvil-workshop");
-    assert_eq!(
-        plugin_dir(Layout::Linux, &workshop, Some(appimage.as_path())),
-        Some(
-            Path::new("mount")
-                .join("usr")
-                .join("lib")
-                .join("runvil")
-                .join(PLUGIN_DIR_NAME)
-        ),
-        "the updater replaces the AppImage, so the Plugins go with it"
-    );
-    assert_eq!(
-        plugin_dir(Layout::Linux, &workshop, None),
-        Some(
-            Path::new("mount")
-                .join("usr")
-                .join("bin")
-                .join(PLUGIN_DIR_NAME)
-        ),
-        "outside an AppImage the directory sits beside the executable"
-    );
-    assert_eq!(
-        plugin_dir(Layout::Windows, &workshop, Some(appimage.as_path())),
-        Some(
-            Path::new("mount")
-                .join("usr")
-                .join("bin")
-                .join(PLUGIN_DIR_NAME)
-        ),
-        "only the Linux layout reads the AppImage"
-    );
-}
-
-#[test]
-fn an_executable_without_a_directory_has_no_plugin_directory() {
-    assert_eq!(installed_plugin_dir(Path::new(""), None), None);
-}
diff --git a/crates/workshop/gateway-discovery/src/peer.rs b/crates/workshop/gateway-discovery/src/peer.rs
deleted file mode 100644
index bfe4ef195..000000000
--- a/crates/workshop/gateway-discovery/src/peer.rs
+++ /dev/null
@@ -1,214 +0,0 @@
-//! Installed-peer lookup: where Workshop finds the Gateway it launches and
-//! the Plugin directory it loads.
-//!
-//! The installers lay the two programs out three ways:
-//!
-//! - Beside each other in one directory (Windows, development builds).
-//! - On macOS, as sibling bundles in one directory: `Runvil.app` and
-//!   `Runvil Gateway.app`, each running from `Contents/MacOS/`.
-//! - On Linux, as `Runvil.AppImage` beside `runvil-gateway`.
-//!   Workshop runs from the AppImage's mount, so it finds the gateway
-//!   through `$APPIMAGE`, the path of the AppImage file, when `$APPDIR`
-//!   confirms Workshop runs from that AppImage, and looks there
-//!   before its own directory: a gateway inside the mount loses its files
-//!   when Workshop exits and the mount goes away.
-//!
-//! The Plugin directory, `plugins`, ships with Workshop itself, so that
-//! whatever replaces Workshop replaces its Plugins too. On Windows and in
-//! a development build it sits beside Workshop's executable. On macOS it
-//! sits inside `Runvil.app`, and on Linux inside the AppImage, because
-//! the updater replaces only that bundle or that file.
-
-use std::ffi::OsStr;
-use std::path::{Path, PathBuf};
-
-// `build-workshop` lays the payload out under these names and its tests
-// read them from this file, so a rename here fails there.
-
-/// The macOS Workshop bundle's directory name.
-pub const WORKSHOP_BUNDLE_NAME: &str = "Runvil.app";
-
-/// The macOS gateway bundle's directory name.
-pub const GATEWAY_BUNDLE_NAME: &str = "Runvil Gateway.app";
-
-/// The Linux Workshop AppImage's file name.
-pub const WORKSHOP_APPIMAGE_NAME: &str = "Runvil.AppImage";
-
-/// The Plugin directory's name: the directory of dynamic libraries
-/// Workshop loads as Plugins.
-pub const PLUGIN_DIR_NAME: &str = "plugins";
-
-/// The directory that holds the Plugin directory inside the macOS
-/// Workshop bundle, from the bundle's `Contents`.
-pub const MACOS_PLUGIN_PARENT: &str = "Resources";
-
-/// The directory that holds the Plugin directory inside the Linux
-/// AppImage, from the root of its mount.
-pub const APPIMAGE_PLUGIN_PARENT: &str = "usr/lib/runvil";
-
-/// The installer layout a lookup searches.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-#[cfg_attr(
-    not(test),
-    expect(
-        dead_code,
-        reason = "a build constructs only its own target's layout; tests construct all three"
-    )
-)]
-pub(crate) enum Layout {
-    Windows,
-    MacOs,
-    Linux,
-}
-
-impl Layout {
-    #[cfg(target_os = "windows")]
-    pub(crate) const CURRENT: Self = Self::Windows;
-    #[cfg(target_os = "macos")]
-    pub(crate) const CURRENT: Self = Self::MacOs;
-    #[cfg(not(any(target_os = "windows", target_os = "macos")))]
-    pub(crate) const CURRENT: Self = Self::Linux;
-
-    pub(crate) const fn gateway_exe(self) -> &'static str {
-        match self {
-            Self::Windows => "runvil-gateway.exe",
-            Self::MacOs | Self::Linux => "runvil-gateway",
-        }
-    }
-}
-
-/// The AppImage Workshop runs from, given its `$APPIMAGE` and `$APPDIR`.
-///
-/// The AppImage runtime sets both: `$APPIMAGE` names the file and `$APPDIR`
-/// the mount Workshop's executable runs from. A value counts only when both
-/// are absolute and `workshop_exe` sits under `$APPDIR`, so a relative
-/// value never resolves against the working directory and a value inherited
-/// from another AppImage's environment is ignored. `$APPDIR` is compared
-/// both as given and with symlinks resolved: the runtime builds it from the
-/// temporary directory unresolved, while the executable path arrives
-/// resolved.
-#[must_use]
-pub fn running_appimage(
-    workshop_exe: &Path,
-    appimage: Option<&OsStr>,
-    appdir: Option<&OsStr>,
-) -> Option<PathBuf> {
-    let appimage = Path::new(appimage?);
-    let appdir = Path::new(appdir?);
-    let under = |dir: &Path| workshop_exe.starts_with(dir);
-    let inside = appimage.is_absolute()
-        && appdir.is_absolute()
-        && (under(appdir) || std::fs::canonicalize(appdir).is_ok_and(|dir| under(&dir)));
-    inside.then(|| appimage.to_path_buf())
-}
-
-/// Locates the installed gateway executable for the Workshop running from
-/// `workshop_exe`, inside `appimage` when [`running_appimage`] found one.
-/// Checks, in order: on Linux `runvil-gateway` beside the AppImage, then
-/// beside `workshop_exe`, then the sibling gateway bundle on macOS.
-#[must_use]
-pub fn installed_gateway(workshop_exe: &Path, appimage: Option<&Path>) -> Option<PathBuf> {
-    first_file(gateway_candidates(Layout::CURRENT, workshop_exe, appimage))
-}
-
-fn first_file(candidates: Vec<PathBuf>) -> Option<PathBuf> {
-    candidates.into_iter().find(|candidate| runnable(candidate))
-}
-
-/// Whether `path` is a regular file this process can run. On Unix that
-/// needs an execute bit: a downloaded AppImage starts without one, and
-/// launching it would fail.
-fn runnable(path: &Path) -> bool {
-    let Ok(metadata) = std::fs::metadata(path) else {
-        return false;
-    };
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        metadata.is_file() && metadata.permissions().mode() & 0o111 != 0
-    }
-    #[cfg(not(unix))]
-    {
-        metadata.is_file()
-    }
-}
-
-fn gateway_candidates(
-    layout: Layout,
-    workshop_exe: &Path,
-    appimage: Option<&Path>,
-) -> Vec<PathBuf> {
-    let mut candidates = Vec::new();
-    if matches!(layout, Layout::Linux)
-        && let Some(dir) = appimage.and_then(Path::parent)
-    {
-        candidates.push(dir.join(layout.gateway_exe()));
-    }
-    if let Some(dir) = workshop_exe.parent() {
-        candidates.push(dir.join(layout.gateway_exe()));
-    }
-    if matches!(layout, Layout::MacOs)
-        && let Some(dir) = bundle_dir(workshop_exe)
-    {
-        candidates.push(bundle_exe(dir, GATEWAY_BUNDLE_NAME, layout.gateway_exe()));
-    }
-    candidates
-}
-
-/// Names the Plugin directory of the installation the Workshop at
-/// `workshop_exe` runs from, inside `appimage` when [`running_appimage`]
-/// found one: `plugins` inside the AppImage's mount on Linux, inside
-/// `Runvil.app` on macOS, and otherwise beside `workshop_exe`, as on
-/// Windows and in a development tree. It matches the path shape only and
-/// never touches the disk, so the directory it names may not exist.
-/// `None` when `workshop_exe` has no parent directory.
-#[must_use]
-pub fn installed_plugin_dir(workshop_exe: &Path, appimage: Option<&Path>) -> Option<PathBuf> {
-    plugin_dir(Layout::CURRENT, workshop_exe, appimage)
-}
-
-fn plugin_dir(layout: Layout, workshop_exe: &Path, appimage: Option<&Path>) -> Option<PathBuf> {
-    let beside = workshop_exe.parent()?;
-    let inside = match layout {
-        Layout::Windows => None,
-        Layout::MacOs => {
-            app_bundle(workshop_exe).map(|app| app.join("Contents").join(MACOS_PLUGIN_PARENT))
-        }
-        // Workshop runs from `usr/bin` in the AppImage's mount.
-        Layout::Linux => appimage
-            .and_then(|_| beside.parent()?.parent())
-            .map(|mount| mount.join(APPIMAGE_PLUGIN_PARENT)),
-    };
-    Some(
-        inside
-            .unwrap_or_else(|| beside.to_path_buf())
-            .join(PLUGIN_DIR_NAME),
-    )
-}
-
-/// The `.app` bundle `exe` runs from, when `exe` sits at
-/// `<name>.app/Contents/MacOS/<exe>`, or `None` for an unbundled executable
-/// such as a development build. Matches the path shape only and never
-/// touches the disk.
-fn app_bundle(exe: &Path) -> Option<&Path> {
-    let macos = exe.parent()?;
-    let contents = macos.parent()?;
-    let bundle = contents.parent()?;
-    let is_bundle = macos.file_name()? == "MacOS"
-        && contents.file_name()? == "Contents"
-        && bundle.extension()? == "app";
-    is_bundle.then_some(bundle)
-}
-
-/// The directory holding the `.app` bundle `exe` runs from.
-fn bundle_dir(exe: &Path) -> Option<&Path> {
-    app_bundle(exe)?.parent()
-}
-
-fn bundle_exe(dir: &Path, bundle: &str, exe: &str) -> PathBuf {
-    dir.join(bundle).join("Contents").join("MacOS").join(exe)
-}
-
-#[cfg(test)]
-#[path = "peer-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway-discovery/src/shutdown.rs b/crates/workshop/gateway-discovery/src/shutdown.rs
deleted file mode 100644
index 877192e3e..000000000
--- a/crates/workshop/gateway-discovery/src/shutdown.rs
+++ /dev/null
@@ -1,225 +0,0 @@
-//! The `POST /shutdown` request: how a reader asks the gateway to exit.
-//!
-//! The workshop shell's quit-everything menu item is the caller: it posts
-//! the current validated connection's bearer key to the gateway's shutdown
-//! route, which answers `202 Accepted` and drains. Raw HTTP/1.0 over
-//! `TcpStream` like the health probe, matching the crate's dependency diet -
-//! no HTTP client.
-
-use crate::health::{self, ProbeError};
-use crate::{GatewayDiscoveryFile, ValidatedConnection};
-use std::time::Instant;
-
-/// The shutdown route's path on the gateway.
-const SHUTDOWN_PATH: &str = "/shutdown";
-
-/// A failure of [`request_shutdown`].
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum ShutdownError {
-    /// The request could not be delivered or the answer read.
-    #[error("{operation}")]
-    Io {
-        /// The failed operation.
-        operation: &'static str,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The gateway answered with a non-2xx status: the key was rejected
-    /// or the route is gone.
-    #[error("unexpected shutdown response: {status_line}")]
-    Rejected {
-        /// The response's first line.
-        status_line: String,
-    },
-}
-
-impl From<ProbeError> for ShutdownError {
-    fn from(error: ProbeError) -> Self {
-        match error {
-            ProbeError::Io { operation, source } => Self::Io { operation, source },
-            ProbeError::UnexpectedStatus { status_line } => Self::Rejected { status_line },
-        }
-    }
-}
-
-/// Posts `POST /shutdown` to the validated local Gateway, presenting its
-/// bearer key. A 2xx answer means the Gateway accepted and is draining;
-/// the caller exits without waiting for the process to die.
-///
-/// # Errors
-/// Returns [`ShutdownError::Io`] when the gateway cannot be connected or
-/// its answer cannot be read, and [`ShutdownError::Rejected`] when the
-/// answer's status is not 2xx.
-pub fn request_shutdown(connection: &ValidatedConnection) -> Result<(), ShutdownError> {
-    request_shutdown_file(connection.gateway_discovery_file())
-}
-
-/// Posts authenticated shutdown without allowing network I/O to outlive the
-/// caller's absolute deadline.
-///
-/// # Errors
-/// Returns the same delivery and rejection errors as [`request_shutdown`].
-pub fn request_shutdown_before(
-    connection: &ValidatedConnection,
-    deadline: Instant,
-) -> Result<(), ShutdownError> {
-    request_shutdown_file_before(connection.gateway_discovery_file(), deadline)
-}
-
-fn request_shutdown_file(file: &GatewayDiscoveryFile) -> Result<(), ShutdownError> {
-    let address = format!("127.0.0.1:{}", file.port);
-    let head = health::request_head(&address, "POST", SHUTDOWN_PATH, Some(&file.api_key))?;
-    accepted(&head)
-}
-
-fn request_shutdown_file_before(
-    file: &GatewayDiscoveryFile,
-    deadline: Instant,
-) -> Result<(), ShutdownError> {
-    let address = format!("127.0.0.1:{}", file.port);
-    let head = health::request_head_until(
-        &address,
-        "POST",
-        SHUTDOWN_PATH,
-        Some(&file.api_key),
-        deadline,
-    )?;
-    accepted(&head)
-}
-
-fn accepted(head: &str) -> Result<(), ShutdownError> {
-    let status = head
-        .split_whitespace()
-        .nth(1)
-        .and_then(|code| code.parse::<u16>().ok());
-    if status.is_some_and(|code| (200..300).contains(&code)) {
-        return Ok(());
-    }
-    Err(ShutdownError::Rejected {
-        status_line: status.map_or_else(|| "<malformed>".to_owned(), |code| code.to_string()),
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use std::io::{Read, Write as _};
-    use std::net::TcpListener;
-    use std::sync::mpsc;
-    use std::time::Duration;
-
-    /// A gateway discovery file naming the fixture gateway's port.
-    fn file(port: u16) -> GatewayDiscoveryFile {
-        GatewayDiscoveryFile {
-            port,
-            api_key: "key".to_owned(),
-            pid: 4242,
-            epoch: 1_757_000_000,
-            version: "0.2.0".to_owned(),
-            started_at: "2026-09-03T12:00:00Z".to_owned(),
-        }
-    }
-
-    /// A fixture gateway recording each request and answering with the
-    /// canned response.
-    fn fixture_gateway(response: &'static [u8]) -> (u16, mpsc::Receiver<String>) {
-        let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-        let port = listener.local_addr().expect("fixture address").port();
-        let (requests, received) = mpsc::channel();
-        std::thread::spawn(move || {
-            while let Ok((mut stream, _)) = listener.accept() {
-                let mut buffer = [0u8; 1024];
-                if let Ok(read) = stream.read(&mut buffer) {
-                    let _ = requests.send(String::from_utf8_lossy(&buffer[..read]).into_owned());
-                }
-                let _ = stream.write_all(response);
-            }
-        });
-        (port, received)
-    }
-
-    #[test]
-    fn an_accepted_shutdown_posts_the_route_with_the_files_key() {
-        let (port, received) =
-            fixture_gateway(b"HTTP/1.1 202 Accepted\r\nContent-Length: 0\r\n\r\n");
-        request_shutdown_file(&file(port)).expect("the gateway accepted");
-        let request = received
-            .recv_timeout(Duration::from_secs(5))
-            .expect("the request arrived");
-        assert!(
-            request.starts_with("POST /shutdown HTTP/1.0\r\n"),
-            "the request is a POST to the shutdown route: {request:?}"
-        );
-        assert!(
-            request.contains("Authorization: Bearer key\r\n"),
-            "the file's key is the bearer token: {request:?}"
-        );
-        assert!(
-            request.contains(&format!("Host: 127.0.0.1:{port}\r\n")),
-            "the Host header is the bound address, not localhost: {request:?}"
-        );
-    }
-
-    #[test]
-    fn a_refused_shutdown_is_rejected() {
-        let (port, _received) =
-            fixture_gateway(b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n");
-        let error = request_shutdown_file(&file(port)).expect_err("a 401 is a refusal");
-        assert!(
-            matches!(error, ShutdownError::Rejected { .. }),
-            "a non-2xx answer is a rejection: {error}"
-        );
-    }
-
-    #[test]
-    fn a_reflected_bearer_is_absent_from_shutdown_errors() {
-        let secret = "capability-secret";
-        let response = format!("HTTP/1.1 401 rejected-{secret}\r\nContent-Length: 0\r\n\r\n");
-        let response: &'static [u8] = Box::leak(response.into_bytes().into_boxed_slice());
-        let (port, _received) = fixture_gateway(response);
-        let mut connection = file(port);
-        connection.api_key = secret.to_owned();
-
-        let error = request_shutdown_file(&connection).expect_err("a 401 is a refusal");
-        assert!(
-            !format!("{error:?} {error}").contains(secret),
-            "bearer values never enter error diagnostics"
-        );
-    }
-
-    #[test]
-    fn a_dead_gateway_is_an_io_error() {
-        // Port 1 is never listening, so the connect fails fast.
-        let error = request_shutdown_file(&file(1)).expect_err("a dead port cannot answer");
-        assert!(
-            matches!(error, ShutdownError::Io { .. }),
-            "an undelivered request is an I/O error: {error}"
-        );
-    }
-
-    #[test]
-    fn an_absolute_deadline_bounds_an_unresponsive_shutdown_target() {
-        let listener = TcpListener::bind("127.0.0.1:0").expect("bind slow shutdown fixture");
-        let port = listener.local_addr().expect("fixture address").port();
-        std::thread::spawn(move || {
-            let (mut stream, _) = listener.accept().expect("accept shutdown");
-            let mut request = [0_u8; 1024];
-            let _ = stream.read(&mut request);
-            std::thread::sleep(Duration::from_secs(1));
-        });
-        let started = std::time::Instant::now();
-
-        let error = request_shutdown_file_before(&file(port), started + Duration::from_millis(100))
-            .expect_err("an unresponsive child exceeds the cleanup deadline");
-
-        assert!(matches!(error, ShutdownError::Io { .. }));
-        assert!(
-            started.elapsed() < Duration::from_millis(500),
-            "late-child shutdown uses one absolute network deadline"
-        );
-    }
-}
diff --git a/crates/workshop/gateway-discovery/src/stale-tests.rs b/crates/workshop/gateway-discovery/src/stale-tests.rs
deleted file mode 100644
index 18888d894..000000000
--- a/crates/workshop/gateway-discovery/src/stale-tests.rs
+++ /dev/null
@@ -1,389 +0,0 @@
-//! Unit tests for stale detection and stale-file cleanup.
-
-use super::*;
-
-use std::io::{Read, Write as _};
-use std::net::TcpListener;
-use std::sync::mpsc;
-
-use crate::paths::gateway_discovery_file_path;
-
-/// The test process's own image name, so the pid and image checks
-/// pass and the test reaches the probe under test.
-fn own_image_name() -> String {
-    std::env::current_exe()
-        .expect("current exe")
-        .file_name()
-        .expect("the exe has a file name")
-        .to_string_lossy()
-        .into_owned()
-}
-
-/// A gateway discovery file pointing at the test process itself.
-fn live_file(port: u16, api_key: &str) -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port,
-        api_key: api_key.to_owned(),
-        pid: std::process::id(),
-        epoch: 1_757_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-09-03T12:00:00Z".to_owned(),
-    }
-}
-
-/// A pid guaranteed dead: a short-lived child, reaped and dropped so
-/// no handle keeps the process object alive.
-fn dead_pid() -> u32 {
-    let mut child = std::process::Command::new(std::env::current_exe().expect("current exe"))
-        .arg("--list")
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .expect("spawn a short-lived child");
-    let pid = child.id();
-    child.wait().expect("the child exits");
-    drop(child);
-    pid
-}
-
-/// A fixture gateway: answers `GET /health` with 200 and the key
-/// probe with 200 only when the bearer matches `expected_key`.
-fn fixture_gateway(expected_key: &'static str) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            for _ in 0..2 {
-                let mut buffer = [0u8; 1024];
-                let Ok(read) = stream.read(&mut buffer) else {
-                    break;
-                };
-                let request = String::from_utf8_lossy(&buffer[..read]);
-                let accepted = request.starts_with("GET /health ")
-                    || request.contains(&format!("Authorization: Bearer {expected_key}\r\n"));
-                let response = if accepted {
-                    &b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"[..]
-                } else {
-                    &b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"[..]
-                };
-                if stream.write_all(response).is_err() {
-                    break;
-                }
-            }
-        }
-    });
-    port
-}
-
-#[test]
-fn a_dead_pid_is_stale_and_cleaned() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = live_file(1, "key");
-    let file = GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..file
-    };
-    file.write_to(dir.path()).expect("write");
-
-    let resolution = resolve(dir.path()).expect("resolve");
-    assert_eq!(resolution, Resolution::Stale(StaleReason::ProcessDead));
-    assert!(
-        !gateway_discovery_file_path(dir.path()).exists(),
-        "the stale file was deleted"
-    );
-}
-
-#[test]
-fn an_alive_pid_with_a_foreign_image_is_stale() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // The test binary is never named runvil-gateway, so the real
-    // image name must reject the test process's own pid.
-    live_file(1, "key").write_to(dir.path()).expect("write");
-
-    let resolution = resolve(dir.path()).expect("resolve");
-    assert_eq!(resolution, Resolution::Stale(StaleReason::ImageMismatch));
-    assert!(
-        !gateway_discovery_file_path(dir.path()).exists(),
-        "the stale file was deleted"
-    );
-}
-
-#[test]
-fn a_silent_health_endpoint_is_stale() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // Port 1 never listens, so every probe is refused until the
-    // liveness budget elapses.
-    live_file(1, "key").write_to(dir.path()).expect("write");
-
-    let resolution = resolve_named(dir.path(), &own_image_name()).expect("resolve");
-    assert_eq!(resolution, Resolution::Stale(StaleReason::HealthFailed));
-    assert!(
-        !gateway_discovery_file_path(dir.path()).exists(),
-        "the stale file was deleted"
-    );
-}
-
-#[test]
-fn a_transiently_silent_health_endpoint_is_not_stale() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // The first probe connection is hung up without a response; only
-    // a retried probe learns the gateway is live.
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        let mut first = true;
-        while let Ok((mut stream, _)) = listener.accept() {
-            if std::mem::take(&mut first) {
-                drop(stream);
-                continue;
-            }
-            for _ in 0..2 {
-                let mut buffer = [0u8; 1024];
-                if stream.read(&mut buffer).is_err() {
-                    break;
-                }
-                if stream
-                    .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
-                    .is_err()
-                {
-                    break;
-                }
-            }
-        }
-    });
-    let file = live_file(port, "key");
-    file.write_to(dir.path()).expect("write");
-
-    let resolution = resolve_named(dir.path(), &own_image_name()).expect("resolve");
-    assert_eq!(
-        resolution,
-        Resolution::Attach(file),
-        "one dropped probe must not reject a live gateway"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "a live file is left in place"
-    );
-}
-
-#[test]
-fn a_rejected_key_is_stale_and_cleaned() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let port = fixture_gateway("right");
-    live_file(port, "wrong")
-        .write_to(dir.path())
-        .expect("write");
-
-    let resolution = resolve_named(dir.path(), &own_image_name()).expect("resolve");
-    assert_eq!(resolution, Resolution::Stale(StaleReason::KeyRejected));
-    assert!(
-        !gateway_discovery_file_path(dir.path()).exists(),
-        "the stale file was deleted"
-    );
-}
-
-#[test]
-fn a_fully_live_file_attaches() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let port = fixture_gateway("right");
-    let file = live_file(port, "right");
-    file.write_to(dir.path()).expect("write");
-
-    let resolution = resolve_named(dir.path(), &own_image_name()).expect("resolve");
-    assert_eq!(resolution, Resolution::Attach(file));
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "a live file is left in place"
-    );
-}
-
-#[test]
-fn cancellation_during_resolve_leaves_the_gateway_discovery_file_untouched() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    live_file(1, "key").write_to(dir.path()).expect("write");
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let run_dir = dir.path().to_owned();
-    let image_name = own_image_name();
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        resolve_named_cancellable_with(
-            &run_dir,
-            &image_name,
-            &worker_cancellation,
-            |_, _, cancellation| {
-                entered.send(()).expect("announce blocked resolve");
-                let _ = cancellation.wait_timeout(std::time::Duration::from_secs(30));
-                Err(crate::ValidationError::Canceled)
-            },
-        )
-    });
-    blocked
-        .recv_timeout(std::time::Duration::from_secs(1))
-        .expect("the resolve phase blocks deterministically");
-
-    let started = std::time::Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the resolve worker joins");
-
-    assert!(
-        started.elapsed() < std::time::Duration::from_millis(250),
-        "cancellation bounds the blocked resolve"
-    );
-    assert!(matches!(result, Err(SidecarError::Canceled)));
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "cancellation never classifies or deletes the gateway discovery file"
-    );
-}
-
-#[test]
-fn cancellation_immediately_before_invalid_file_removal_preserves_the_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(gateway_discovery_file_path(dir.path()), b"not json").expect("write invalid fixture");
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let run_dir = dir.path().to_owned();
-    let (entered, blocked) = mpsc::channel();
-    let (release, released) = mpsc::channel();
-    let removals = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-    let worker_removals = std::sync::Arc::clone(&removals);
-    let worker = std::thread::spawn(move || {
-        resolve_named_cancellable_with_effects(
-            &run_dir,
-            "unused",
-            &worker_cancellation,
-            |_, _, _| -> Result<ValidatedConnection, ValidationError> {
-                panic!("an invalid file never reaches validation")
-            },
-            || {
-                entered.send(()).expect("announce invalid-file removal");
-                released.recv().expect("release invalid-file removal");
-            },
-            |run_dir| {
-                worker_removals.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                remove_stale(run_dir)
-            },
-        )
-    });
-    blocked
-        .recv_timeout(std::time::Duration::from_secs(1))
-        .expect("resolution pauses immediately before invalid-file removal");
-
-    cancellation.cancel();
-    release.send(()).expect("release invalid-file removal");
-    let result = worker.join().expect("resolve worker joins");
-
-    assert!(matches!(result, Err(SidecarError::Canceled)));
-    assert_eq!(
-        removals.load(std::sync::atomic::Ordering::SeqCst),
-        0,
-        "invalid-file cleanup cannot begin after cancellation returns"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "the canceled invalid file remains untouched"
-    );
-}
-
-#[test]
-fn cancellation_immediately_before_failed_validation_removal_preserves_the_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    live_file(1, "key").write_to(dir.path()).expect("write");
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let run_dir = dir.path().to_owned();
-    let (entered, blocked) = mpsc::channel();
-    let (release, released) = mpsc::channel();
-    let removals = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-    let worker_removals = std::sync::Arc::clone(&removals);
-    let worker = std::thread::spawn(move || {
-        resolve_named_cancellable_with_effects(
-            &run_dir,
-            "unused",
-            &worker_cancellation,
-            |_, _, _| Err(ValidationError::Stale(StaleReason::HealthFailed)),
-            || {
-                entered.send(()).expect("announce stale-file removal");
-                released.recv().expect("release stale-file removal");
-            },
-            |run_dir| {
-                worker_removals.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                remove_stale(run_dir)
-            },
-        )
-    });
-    blocked
-        .recv_timeout(std::time::Duration::from_secs(1))
-        .expect("resolution pauses immediately before stale-file removal");
-
-    cancellation.cancel();
-    release.send(()).expect("release stale-file removal");
-    let result = worker.join().expect("resolve worker joins");
-
-    assert!(matches!(result, Err(SidecarError::Canceled)));
-    assert_eq!(
-        removals.load(std::sync::atomic::Ordering::SeqCst),
-        0,
-        "failed-validation cleanup cannot begin after cancellation returns"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "the canceled stale file remains untouched"
-    );
-}
-
-#[test]
-fn is_running_reports_a_live_gateway_without_touching_the_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let port = fixture_gateway("right");
-    live_file(port, "right")
-        .write_to(dir.path())
-        .expect("write");
-
-    assert!(
-        is_running_named(dir.path(), &own_image_name()),
-        "a fully live file reads as running"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "the read-only check never deletes"
-    );
-}
-
-#[test]
-fn is_running_leaves_a_stale_file_in_place() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..live_file(1, "key")
-    };
-    file.write_to(dir.path()).expect("write");
-
-    assert!(
-        !is_running_named(dir.path(), &own_image_name()),
-        "a dead pid reads as not-running"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "stale-file deletion is the prospective owner's privilege"
-    );
-}
-
-#[test]
-fn is_running_reads_absent_and_corrupt_files_as_not_running() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    assert!(
-        !is_running_named(dir.path(), &own_image_name()),
-        "no gateway discovery file reads as not-running"
-    );
-    fs::write(gateway_discovery_file_path(dir.path()), b"not json").expect("write fixture");
-    assert!(
-        !is_running_named(dir.path(), &own_image_name()),
-        "a corrupt file reads as not-running and is left alone"
-    );
-    assert!(
-        gateway_discovery_file_path(dir.path()).exists(),
-        "the corrupt file was not deleted"
-    );
-}
diff --git a/crates/workshop/gateway-discovery/src/stale.rs b/crates/workshop/gateway-discovery/src/stale.rs
deleted file mode 100644
index 761674b54..000000000
--- a/crates/workshop/gateway-discovery/src/stale.rs
+++ /dev/null
@@ -1,258 +0,0 @@
-//! Stale detection: decide whether a gateway discovery file names a live
-//! gateway, and remove it when it does not.
-//!
-//! A file is live when one OS process boot with a `runvil-gateway`
-//! image is unchanged across a same-socket health and bearer proof, and
-//! the file includes a boot identity. Anything else is stale - the Jupyter
-//! phantom-server bug class - and the file is deleted so the next reader
-//! relaunches instead of retrying a corpse.
-
-use std::fs;
-use std::io;
-use std::path::Path;
-
-use crate::error::SidecarError;
-use crate::paths::gateway_discovery_file_path;
-pub(crate) use crate::validated::GATEWAY_IMAGE_NAME;
-use crate::validated::{ValidatedConnection, ValidationError};
-use crate::{CancellationToken, GatewayDiscoveryFile};
-
-/// What [`resolve`] found in the run directory.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum Resolution {
-    /// A live gateway: attach with these parameters.
-    Attach(GatewayDiscoveryFile),
-    /// No gateway discovery file exists: nothing to attach to, nothing to clean.
-    Absent,
-    /// A gateway discovery file existed but was stale; it was removed.
-    Stale(StaleReason),
-}
-
-/// Why a gateway discovery file was judged stale.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
-#[non_exhaustive]
-pub enum StaleReason {
-    /// The file was not valid JSON or failed validation.
-    #[error("the gateway discovery file is invalid")]
-    Invalid,
-    /// The pid is dead.
-    #[error("the recorded gateway process is dead")]
-    ProcessDead,
-    /// The pid is alive but its image is not a `runvil-gateway`
-    /// binary (a reused pid).
-    #[error("the recorded pid belongs to another process image")]
-    ImageMismatch,
-    /// The gateway discovery file has no usable boot identity.
-    #[error("the gateway discovery file has no usable boot identity")]
-    BootIdentityInvalid,
-    /// The pid changed process boot while validation was in progress.
-    #[error("the recorded process identity changed during validation")]
-    ProcessChanged,
-    /// The health endpoint did not answer 200.
-    #[error("the recorded gateway does not answer its health probe")]
-    HealthFailed,
-    /// The bearer key was rejected.
-    #[error("the gateway discovery file bearer was rejected")]
-    KeyRejected,
-}
-
-/// Resolves the gateway discovery file in `run_dir`: attach parameters for a
-/// live gateway, or stale-file cleanup plus the reason.
-///
-/// # Errors
-/// Returns [`SidecarError::Read`] when the file exists but cannot be
-/// read, and [`SidecarError::Remove`] when a stale file cannot be
-/// deleted.
-pub fn resolve(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    resolve_named(run_dir, GATEWAY_IMAGE_NAME)
-}
-
-/// Resolves the gateway discovery file while observing caller cancellation.
-///
-/// Cancellation never classifies or deletes the current file.
-///
-/// # Errors
-/// Returns [`SidecarError::Canceled`] when cancellation wins, plus the
-/// read and remove failures documented by [`resolve`].
-pub fn resolve_cancellable(
-    run_dir: &Path,
-    cancellation: &CancellationToken,
-) -> Result<Resolution, SidecarError> {
-    resolve_named_cancellable(run_dir, GATEWAY_IMAGE_NAME, cancellation)
-}
-
-/// [`resolve`] against a caller-named process image. Test builds only.
-///
-/// This exists for resolution tests that run in process and write a
-/// `gateway.json` naming the test binary's own pid. A test binary is never
-/// named `runvil-gateway`, so such a file would read as `ImageMismatch`
-/// before the resolution logic under test was reached.
-///
-/// It is not the way to exercise the real process-image step. Tests that
-/// want the full gauntlet use the image-copy helper in `test_gateway.rs`
-/// instead, which spawns a child named `runvil-gateway` and calls
-/// [`resolve`] with no seam at all.
-#[cfg(any(test, feature = "test-fixtures"))]
-#[doc(hidden)]
-pub fn resolve_for_test(run_dir: &Path, image_name: &str) -> Result<Resolution, SidecarError> {
-    resolve_named(run_dir, image_name)
-}
-
-/// [`resolve`] against a caller-named process image, so tests can run the
-/// full liveness gauntlet from a test binary, which is never named
-/// `runvil-gateway`.
-pub(crate) fn resolve_named(run_dir: &Path, image_name: &str) -> Result<Resolution, SidecarError> {
-    let file = match GatewayDiscoveryFile::read(run_dir) {
-        Ok(Some(file)) => file,
-        Ok(None) => return Ok(Resolution::Absent),
-        Err(SidecarError::Parse { .. } | SidecarError::Invalid { .. }) => {
-            remove_stale(run_dir)?;
-            return Ok(Resolution::Stale(StaleReason::Invalid));
-        }
-        Err(error) => return Err(error),
-    };
-    match ValidatedConnection::validate_named(file, image_name) {
-        Ok(validated) => Ok(Resolution::Attach(validated.into_gateway_discovery_file())),
-        Err(reason) => {
-            remove_stale(run_dir)?;
-            Ok(Resolution::Stale(reason))
-        }
-    }
-}
-
-pub(crate) fn resolve_named_cancellable(
-    run_dir: &Path,
-    image_name: &str,
-    cancellation: &CancellationToken,
-) -> Result<Resolution, SidecarError> {
-    resolve_named_cancellable_with(
-        run_dir,
-        image_name,
-        cancellation,
-        ValidatedConnection::validate_named_cancellable,
-    )
-}
-
-fn resolve_named_cancellable_with(
-    run_dir: &Path,
-    image_name: &str,
-    cancellation: &CancellationToken,
-    validate: impl FnOnce(
-        GatewayDiscoveryFile,
-        &str,
-        &CancellationToken,
-    ) -> Result<ValidatedConnection, ValidationError>,
-) -> Result<Resolution, SidecarError> {
-    resolve_named_cancellable_with_effects(
-        run_dir,
-        image_name,
-        cancellation,
-        validate,
-        || {},
-        remove_stale,
-    )
-}
-
-fn resolve_named_cancellable_with_effects(
-    run_dir: &Path,
-    image_name: &str,
-    cancellation: &CancellationToken,
-    validate: impl FnOnce(
-        GatewayDiscoveryFile,
-        &str,
-        &CancellationToken,
-    ) -> Result<ValidatedConnection, ValidationError>,
-    mut before_remove: impl FnMut(),
-    mut remove: impl FnMut(&Path) -> Result<(), SidecarError>,
-) -> Result<Resolution, SidecarError> {
-    if cancellation.is_canceled() {
-        return Err(SidecarError::Canceled);
-    }
-    let file = match GatewayDiscoveryFile::read(run_dir) {
-        Ok(Some(file)) => file,
-        Ok(None) if cancellation.is_canceled() => return Err(SidecarError::Canceled),
-        Ok(None) => return Ok(Resolution::Absent),
-        Err(SidecarError::Parse { .. } | SidecarError::Invalid { .. }) => {
-            before_remove();
-            remove_stale_if_active(run_dir, cancellation, &mut remove)?;
-            return Ok(Resolution::Stale(StaleReason::Invalid));
-        }
-        Err(error) => return Err(error),
-    };
-    match validate(file, image_name, cancellation) {
-        Ok(validated) => Ok(Resolution::Attach(validated.into_gateway_discovery_file())),
-        Err(ValidationError::Canceled) => Err(SidecarError::Canceled),
-        Err(ValidationError::Stale(reason)) => {
-            before_remove();
-            remove_stale_if_active(run_dir, cancellation, &mut remove)?;
-            Ok(Resolution::Stale(reason))
-        }
-    }
-}
-
-fn remove_stale_if_active(
-    run_dir: &Path,
-    cancellation: &CancellationToken,
-    remove: &mut impl FnMut(&Path) -> Result<(), SidecarError>,
-) -> Result<(), SidecarError> {
-    cancellation
-        .run_if_active(|| remove(run_dir))
-        .unwrap_or(Err(SidecarError::Canceled))
-}
-
-/// Whether the gateway discovery file in `run_dir` names a live gateway right
-/// now, with no cleanup: the read-only check a diagnostics report runs.
-/// Stale-file deletion is the prospective owner's privilege, so a stale
-/// file reads as not-running and stays on disk for the next launch to
-/// clean.
-#[must_use]
-pub fn is_running(run_dir: &Path) -> bool {
-    is_running_named(run_dir, GATEWAY_IMAGE_NAME)
-}
-
-/// [`is_running`] against a caller-named process image, so a test binary -
-/// never named `runvil-gateway` - can run the full liveness gauntlet.
-fn is_running_named(run_dir: &Path, image_name: &str) -> bool {
-    match GatewayDiscoveryFile::read(run_dir) {
-        Ok(Some(file)) => is_live(&file, image_name),
-        // A missing, unreadable, or invalid file reads as not-running.
-        Ok(None) | Err(_) => false,
-    }
-}
-
-/// Whether the file's gateway is live right now, with no cleanup: the
-/// check a launch-race loser runs, since deleting is the lock holder's
-/// privilege.
-pub(crate) fn is_live(file: &GatewayDiscoveryFile, image_name: &str) -> bool {
-    ValidatedConnection::validate_named(file.clone(), image_name).is_ok()
-}
-
-pub(crate) fn is_live_cancellable(
-    file: &GatewayDiscoveryFile,
-    image_name: &str,
-    cancellation: &CancellationToken,
-) -> Result<bool, SidecarError> {
-    match ValidatedConnection::validate_named_cancellable(file.clone(), image_name, cancellation) {
-        Ok(_) => Ok(true),
-        Err(ValidationError::Stale(_)) => Ok(false),
-        Err(ValidationError::Canceled) => Err(SidecarError::Canceled),
-    }
-}
-
-/// Deletes the stale gateway discovery file, tolerating a concurrent deletion.
-fn remove_stale(run_dir: &Path) -> Result<(), SidecarError> {
-    let path = gateway_discovery_file_path(run_dir);
-    match fs::remove_file(&path) {
-        Ok(()) => Ok(()),
-        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()),
-        Err(error) => Err(SidecarError::Remove {
-            path,
-            source: error,
-        }),
-    }
-}
-
-#[cfg(test)]
-#[path = "stale-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway-discovery/src/sys.rs b/crates/workshop/gateway-discovery/src/sys.rs
deleted file mode 100644
index 046f28b9e..000000000
--- a/crates/workshop/gateway-discovery/src/sys.rs
+++ /dev/null
@@ -1,58 +0,0 @@
-//! Process identity lookup for stale detection: one shim per platform,
-//! each answering "what binary does this pid run, and which process boot
-//! owns the pid", so pid reuse cannot join separate validation observations.
-
-use std::path::PathBuf;
-
-/// An OS-observed process boot, stable for one lifetime and different
-/// when the pid is reused.
-#[derive(Clone, PartialEq, Eq)]
-pub(crate) struct ProcessIdentity {
-    /// The process executable observed for this boot.
-    pub(crate) image: PathBuf,
-    /// Platform start marker: FILETIME, proc start ticks, or timeval.
-    started: u128,
-}
-
-impl ProcessIdentity {
-    /// Assembles one platform observation.
-    pub(crate) const fn new(image: PathBuf, started: u128) -> Self {
-        Self { image, started }
-    }
-
-    /// Assembles a deterministic identity for validation regressions.
-    #[cfg(test)]
-    pub(crate) const fn for_test(image: PathBuf, started: u128) -> Self {
-        Self::new(image, started)
-    }
-}
-
-#[cfg(target_os = "linux")]
-mod linux;
-#[cfg(target_os = "macos")]
-#[expect(
-    unsafe_code,
-    reason = "proc_pidpath and proc_pidinfo are raw C APIs with no safe wrappers"
-)]
-mod macos;
-#[cfg(windows)]
-#[expect(
-    unsafe_code,
-    reason = "process identity uses raw Win32 handle and query APIs"
-)]
-mod windows;
-
-#[cfg(target_os = "linux")]
-pub(crate) use linux::process_identity;
-#[cfg(target_os = "macos")]
-pub(crate) use macos::process_identity;
-#[cfg(windows)]
-pub(crate) use windows::process_identity;
-
-/// Every other platform fails closed: no process identity means the
-/// gateway discovery file is always stale, so a reader relaunches rather than
-/// attaching to an unverified process.
-#[cfg(not(any(windows, target_os = "linux", target_os = "macos")))]
-pub(crate) fn process_identity(_pid: u32) -> Option<ProcessIdentity> {
-    None
-}
diff --git a/crates/workshop/gateway-discovery/src/sys/linux.rs b/crates/workshop/gateway-discovery/src/sys/linux.rs
deleted file mode 100644
index 7b06f1c49..000000000
--- a/crates/workshop/gateway-discovery/src/sys/linux.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-//! Linux process identity lookup: `/proc/<pid>/exe` supplies the image and
-//! field 22 of `/proc/<pid>/stat` supplies the kernel start tick.
-
-use super::ProcessIdentity;
-
-/// The image and start tick for process `pid`, or `None` when the process
-/// disappears, changes identity during observation, or `/proc` is unreadable.
-pub(crate) fn process_identity(pid: u32) -> Option<ProcessIdentity> {
-    let first_start = process_start(pid)?;
-    let image = std::fs::read_link(format!("/proc/{pid}/exe")).ok()?;
-    let second_start = process_start(pid)?;
-    (first_start == second_start).then(|| ProcessIdentity::new(image, u128::from(first_start)))
-}
-
-/// Reads Linux `/proc/<pid>/stat` field 22. The command field is enclosed
-/// in parentheses and may itself contain spaces or closing parentheses,
-/// so fields are counted only after its final delimiter.
-fn process_start(pid: u32) -> Option<u64> {
-    let stat = std::fs::read_to_string(format!("/proc/{pid}/stat")).ok()?;
-    let after_command = stat.get(stat.rfind(')')? + 1..)?;
-    after_command.split_whitespace().nth(19)?.parse().ok()
-}
diff --git a/crates/workshop/gateway-discovery/src/sys/macos.rs b/crates/workshop/gateway-discovery/src/sys/macos.rs
deleted file mode 100644
index 598c294da..000000000
--- a/crates/workshop/gateway-discovery/src/sys/macos.rs
+++ /dev/null
@@ -1,96 +0,0 @@
-//! macOS process identity lookup via libproc: `proc_pidpath` supplies the
-//! image and `PROC_PIDTBSDINFO` supplies the process start timeval.
-
-use std::ffi::OsString;
-use std::mem::{MaybeUninit, size_of};
-use std::os::unix::ffi::OsStringExt as _;
-use std::path::PathBuf;
-
-use super::ProcessIdentity;
-
-/// Buffer size for `proc_pidpath`: `PROC_PIDPATHINFO_MAXSIZE` from
-/// `libproc.h` (4 * MAXPATHLEN).
-const PROC_PIDPATHINFO_MAXSIZE: u32 = 4096;
-/// `PROC_PIDTBSDINFO` from `libproc.h`.
-const PROC_PIDTBSDINFO: i32 = 3;
-
-/// The stable prefix and start fields of Darwin's `proc_bsdinfo`.
-#[repr(C)]
-struct ProcBsdInfo {
-    pbi_flags: u32,
-    pbi_status: u32,
-    pbi_xstatus: u32,
-    pbi_pid: u32,
-    pbi_ppid: u32,
-    pbi_uid: u32,
-    pbi_gid: u32,
-    pbi_ruid: u32,
-    pbi_rgid: u32,
-    pbi_svuid: u32,
-    pbi_svgid: u32,
-    rfu_1: u32,
-    pbi_comm: [libc::c_char; 16],
-    pbi_name: [libc::c_char; 32],
-    pbi_nfiles: u32,
-    pbi_pgid: u32,
-    pbi_pjobc: u32,
-    e_tdev: u32,
-    e_tpgid: u32,
-    pbi_nice: i32,
-    pbi_start_tvsec: u64,
-    pbi_start_tvusec: u64,
-}
-
-/// The image and start timeval for process `pid`, or `None` when the
-/// process disappears, changes identity during observation, or refuses
-/// either query.
-pub(crate) fn process_identity(pid: u32) -> Option<ProcessIdentity> {
-    let first_start = process_start(pid)?;
-    let image = process_image_path(pid)?;
-    let second_start = process_start(pid)?;
-    (first_start == second_start).then(|| ProcessIdentity::new(image, first_start))
-}
-
-/// Reads the kernel's path for one live process.
-fn process_image_path(pid: u32) -> Option<PathBuf> {
-    let pid = i32::try_from(pid).ok()?;
-    let mut buffer = vec![0u8; PROC_PIDPATHINFO_MAXSIZE as usize];
-    // SAFETY: `buffer` is a live allocation of exactly
-    // PROC_PIDPATHINFO_MAXSIZE bytes and the size handed over matches it;
-    // proc_pidpath writes at most that many bytes and returns the count
-    // written, or a value <= 0 on error.
-    let written =
-        unsafe { libc::proc_pidpath(pid, buffer.as_mut_ptr().cast(), PROC_PIDPATHINFO_MAXSIZE) };
-    if written <= 0 {
-        return None;
-    }
-    let written = usize::try_from(written).ok()?;
-    buffer.truncate(written);
-    Some(PathBuf::from(OsString::from_vec(buffer)))
-}
-
-/// Reads the process start timeval through `PROC_PIDTBSDINFO`.
-fn process_start(pid: u32) -> Option<u128> {
-    let pid = i32::try_from(pid).ok()?;
-    let buffer_size = i32::try_from(size_of::<ProcBsdInfo>()).ok()?;
-    let mut info = MaybeUninit::<ProcBsdInfo>::uninit();
-    // SAFETY: `info` points to writable storage of exactly `buffer_size`
-    // bytes. A full-size success initializes the complete structure before
-    // `assume_init`; every other result returns without reading it.
-    let written = unsafe {
-        libc::proc_pidinfo(
-            pid,
-            PROC_PIDTBSDINFO,
-            0,
-            info.as_mut_ptr().cast(),
-            buffer_size,
-        )
-    };
-    if written != buffer_size {
-        return None;
-    }
-    // SAFETY: the full-size `proc_pidinfo` success above initialized every
-    // byte of the `ProcBsdInfo` output structure.
-    let info = unsafe { info.assume_init() };
-    Some(u128::from(info.pbi_start_tvsec) << 64 | u128::from(info.pbi_start_tvusec))
-}
diff --git a/crates/workshop/gateway-discovery/src/sys/windows.rs b/crates/workshop/gateway-discovery/src/sys/windows.rs
deleted file mode 100644
index 58731f16a..000000000
--- a/crates/workshop/gateway-discovery/src/sys/windows.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-//! Windows process identity lookup: one process handle supplies the image
-//! and creation FILETIME, so pid reuse cannot join two observations.
-
-use std::ffi::OsString;
-use std::os::windows::ffi::OsStringExt as _;
-use std::path::PathBuf;
-
-use windows_sys::Win32::Foundation::{CloseHandle, FILETIME, HANDLE};
-use windows_sys::Win32::System::Threading::{
-    GetProcessTimes, OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION, QueryFullProcessImageNameW,
-};
-
-use super::ProcessIdentity;
-
-/// The image and creation time of process `pid`, or `None` when the
-/// process is dead or refuses a limited query.
-pub(crate) fn process_identity(pid: u32) -> Option<ProcessIdentity> {
-    // SAFETY: `OpenProcess` takes a valid access mask and pid; the
-    // returned handle is either null (checked) or a live process handle
-    // that `CloseHandle` below releases exactly once.
-    let handle = unsafe { OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid) };
-    if handle.is_null() {
-        return None;
-    }
-    let identity = query_identity(handle);
-    // SAFETY: `handle` is the live process handle returned by the
-    // `OpenProcess` above, closed exactly once here.
-    unsafe {
-        CloseHandle(handle);
-    }
-    identity
-}
-
-/// Reads one coherent image and creation time from an open process handle.
-fn query_identity(handle: HANDLE) -> Option<ProcessIdentity> {
-    let image = query_image_path(handle)?;
-    let mut creation = FILETIME {
-        dwLowDateTime: 0,
-        dwHighDateTime: 0,
-    };
-    let mut exit = creation;
-    let mut kernel = creation;
-    let mut user = creation;
-    // SAFETY: all pointers name initialized writable FILETIME values, and
-    // `handle` remains open for the complete query.
-    let ok = unsafe {
-        GetProcessTimes(
-            handle,
-            &raw mut creation,
-            &raw mut exit,
-            &raw mut kernel,
-            &raw mut user,
-        )
-    };
-    if ok == 0 {
-        return None;
-    }
-    let started = u128::from(creation.dwHighDateTime) << 32 | u128::from(creation.dwLowDateTime);
-    Some(ProcessIdentity::new(image, started))
-}
-
-/// Reads the image path from an open process handle.
-fn query_image_path(handle: HANDLE) -> Option<PathBuf> {
-    // The long-path ceiling: QueryFullProcessImageNameW fails rather than
-    // truncates when the buffer is too small, so one max-sized buffer
-    // needs no grow loop.
-    const BUFFER_LEN: u32 = 32768;
-    let mut buffer = vec![0u16; BUFFER_LEN as usize];
-    let mut size = BUFFER_LEN;
-    // SAFETY: `buffer` is valid for `size` UTF-16 code units and `size`
-    // starts at its length; on success the call writes the path length
-    // back into `size`, never exceeding the buffer.
-    let ok = unsafe { QueryFullProcessImageNameW(handle, 0, buffer.as_mut_ptr(), &raw mut size) };
-    if ok == 0 {
-        return None;
-    }
-    let length = usize::try_from(size).ok()?;
-    Some(PathBuf::from(OsString::from_wide(buffer.get(..length)?)))
-}
diff --git a/crates/workshop/gateway-discovery/src/validated-tests.rs b/crates/workshop/gateway-discovery/src/validated-tests.rs
deleted file mode 100644
index 071da1a2c..000000000
--- a/crates/workshop/gateway-discovery/src/validated-tests.rs
+++ /dev/null
@@ -1,373 +0,0 @@
-//! Unit tests for building a validated Gateway connection.
-
-use super::*;
-
-use std::io::{Read, Write as _};
-use std::net::TcpListener;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::{Arc, mpsc};
-
-use crate::GatewayDiscoveryFile;
-
-fn own_image_name() -> String {
-    std::env::current_exe()
-        .expect("current exe")
-        .file_name()
-        .expect("the exe has a file name")
-        .to_string_lossy()
-        .into_owned()
-}
-
-fn connection(port: u16, api_key: &str) -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port,
-        api_key: api_key.to_owned(),
-        pid: std::process::id(),
-        epoch: 1_778_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-05-05T12:00:00Z".to_owned(),
-    }
-}
-
-fn dead_pid() -> u32 {
-    let mut child = std::process::Command::new(std::env::current_exe().expect("current exe"))
-        .arg("--list")
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .expect("spawn a short-lived child");
-    let pid = child.id();
-    child.wait().expect("the child exits");
-    pid
-}
-
-fn fixture_gateway(expected_key: &'static str) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            for _ in 0..2 {
-                let mut buffer = [0_u8; 1024];
-                let Ok(read) = stream.read(&mut buffer) else {
-                    break;
-                };
-                let request = String::from_utf8_lossy(&buffer[..read]);
-                let accepted = request.starts_with("GET /health ")
-                    || request.contains(&format!("Authorization: Bearer {expected_key}\r\n"));
-                let response = if accepted {
-                    &b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"[..]
-                } else {
-                    &b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"[..]
-                };
-                if stream.write_all(response).is_err() {
-                    break;
-                }
-            }
-        }
-    });
-    port
-}
-
-#[test]
-fn a_wrong_process_image_cannot_create_a_capability() {
-    let file = connection(1, "key");
-
-    assert_eq!(
-        ValidatedConnection::validate_named(file, "not-the-test-binary"),
-        Err(StaleReason::ImageMismatch)
-    );
-}
-
-#[test]
-fn a_dead_process_cannot_create_a_capability() {
-    let file = GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..connection(1, "key")
-    };
-
-    assert_eq!(
-        ValidatedConnection::validate_named(file, &own_image_name()),
-        Err(StaleReason::ProcessDead)
-    );
-}
-
-#[test]
-fn a_stale_boot_identity_cannot_create_a_capability() {
-    let missing_epoch = GatewayDiscoveryFile {
-        epoch: 0,
-        ..connection(1, "key")
-    };
-    assert_eq!(
-        ValidatedConnection::validate_named(missing_epoch, &own_image_name()),
-        Err(StaleReason::BootIdentityInvalid)
-    );
-
-    let missing_start = GatewayDiscoveryFile {
-        started_at: String::new(),
-        ..connection(1, "key")
-    };
-    assert_eq!(
-        ValidatedConnection::validate_named(missing_start, &own_image_name()),
-        Err(StaleReason::BootIdentityInvalid)
-    );
-}
-
-#[test]
-fn an_invalid_raw_connection_cannot_create_a_capability() {
-    let file = GatewayDiscoveryFile {
-        port: 0,
-        ..connection(1, "key")
-    };
-
-    assert_eq!(
-        ValidatedConnection::validate_named(file, &own_image_name()),
-        Err(StaleReason::Invalid)
-    );
-}
-
-#[test]
-fn failed_health_cannot_create_a_capability() {
-    let file = connection(1, "key");
-
-    assert_eq!(
-        ValidatedConnection::validate_named(file, &own_image_name()),
-        Err(StaleReason::HealthFailed)
-    );
-}
-
-#[test]
-fn an_absolute_validation_deadline_bounds_a_slow_owner() {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind slow owner");
-    let port = listener.local_addr().expect("slow owner address").port();
-    std::thread::spawn(move || {
-        let (mut stream, _) = listener.accept().expect("accept validation");
-        let mut request = [0_u8; 1024];
-        let _ = stream.read(&mut request);
-        std::thread::sleep(Duration::from_secs(1));
-    });
-    let timeout = Duration::from_millis(100);
-    let started = Instant::now();
-
-    let result = ValidatedConnection::validate_named_before(
-        connection(port, "key"),
-        &own_image_name(),
-        started + timeout,
-    );
-
-    assert_eq!(result, Err(StaleReason::HealthFailed));
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "the caller's deadline caps the real network proof"
-    );
-}
-
-#[test]
-fn a_rejected_bearer_cannot_create_a_capability() {
-    let port = fixture_gateway("accepted");
-    let file = connection(port, "rejected");
-
-    assert_eq!(
-        ValidatedConnection::validate_named(file, &own_image_name()),
-        Err(StaleReason::KeyRejected)
-    );
-}
-
-#[test]
-fn a_new_boot_with_the_same_port_and_key_creates_a_distinct_capability() {
-    let port = fixture_gateway("stable-key");
-    let original =
-        ValidatedConnection::validate_named(connection(port, "stable-key"), &own_image_name())
-            .expect("the original connection validates");
-    let replacement_file = GatewayDiscoveryFile {
-        epoch: original.epoch() + 1,
-        started_at: "2026-05-05T12:00:01Z".to_owned(),
-        ..connection(port, "stable-key")
-    };
-    let replacement = ValidatedConnection::validate_named(replacement_file, &own_image_name())
-        .expect("the replacement connection validates");
-
-    assert_eq!(replacement.port(), original.port());
-    assert_eq!(replacement.api_key(), original.api_key());
-    assert!(!replacement.same_boot(&original));
-}
-
-#[test]
-fn debug_output_never_contains_the_bearer() {
-    let secret = "capability-secret";
-    let port = fixture_gateway(secret);
-    let mut raw = connection(port, secret);
-    raw.version = format!("version-{secret}\r\n");
-    raw.started_at = format!("started-{secret}\t");
-    let validated = ValidatedConnection::validate_named(raw, &own_image_name())
-        .expect("the connection validates");
-
-    let debug = format!("{validated:?}");
-    assert!(!debug.contains(secret), "debug output redacts the bearer");
-    assert!(
-        !debug.contains(['\r', '\n', '\t']),
-        "untrusted metadata cannot inject debug output"
-    );
-    assert!(debug.contains(&port.to_string()), "the endpoint is visible");
-}
-
-#[test]
-fn a_process_boot_change_during_the_network_proof_is_rejected() {
-    let image = std::path::PathBuf::from(own_image_name());
-    let before = ProcessIdentity::for_test(image.clone(), 41);
-    let after = ProcessIdentity::for_test(image, 42);
-    let mut observations = [Some(before), Some(after)].into_iter();
-
-    assert_eq!(
-        validate_with(
-            connection(8081, "key"),
-            &own_image_name(),
-            |_| observations.next().flatten(),
-            |_, _, _| ConnectionProbe::Accepted,
-        ),
-        Err(StaleReason::ProcessChanged),
-        "a reused pid cannot complete a mixed proof"
-    );
-}
-
-#[test]
-fn cancellation_inside_the_first_identity_probe_prevents_observation() {
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let image_name = own_image_name();
-    let identity = ProcessIdentity::for_test(std::path::PathBuf::from(&image_name), 41);
-    let observations = Arc::new(AtomicUsize::new(0));
-    let worker_observations = Arc::clone(&observations);
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        validate_cancellable_with(
-            connection(8081, "key"),
-            &image_name,
-            &worker_cancellation,
-            |_| {
-                entered.send(()).expect("announce identity probe");
-                if !worker_cancellation.wait_timeout(Duration::from_secs(30)) {
-                    worker_observations.fetch_add(1, Ordering::SeqCst);
-                }
-                Some(identity.clone())
-            },
-            |_, _, _, _| ConnectionProbe::Accepted,
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the first process identity probe blocks deterministically");
-
-    let started = std::time::Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the validation worker joins");
-
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "cancellation wakes the in-progress process identity probe"
-    );
-    assert!(matches!(result, Err(ValidationError::Canceled)));
-    assert_eq!(
-        observations.load(Ordering::SeqCst),
-        0,
-        "no process observation occurs after cancellation"
-    );
-}
-
-#[test]
-fn cancellation_during_validation_prevents_the_second_identity_observation() {
-    let cancellation = crate::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let image_name = own_image_name();
-    let identity = ProcessIdentity::for_test(std::path::PathBuf::from(&image_name), 41);
-    let observations = Arc::new(AtomicUsize::new(0));
-    let worker_observations = Arc::clone(&observations);
-    let (entered, blocked) = mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        validate_cancellable_with(
-            connection(8081, "key"),
-            &image_name,
-            &worker_cancellation,
-            |_| {
-                worker_observations.fetch_add(1, Ordering::SeqCst);
-                Some(identity.clone())
-            },
-            |_, _, _, cancellation| {
-                entered.send(()).expect("announce blocked validation");
-                let _ = cancellation.wait_timeout(Duration::from_secs(30));
-                ConnectionProbe::Accepted
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("the validation phase blocks deterministically");
-
-    let started = std::time::Instant::now();
-    cancellation.cancel();
-    let result = worker.join().expect("the validation worker joins");
-
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "cancellation bounds the blocked validation"
-    );
-    assert!(matches!(result, Err(ValidationError::Canceled)));
-    assert_eq!(
-        observations.load(Ordering::SeqCst),
-        1,
-        "validation performs no post-cancel process probe"
-    );
-}
-
-#[test]
-fn forged_file_identity_cannot_alias_a_reused_process() {
-    let raw = connection(8081, "key");
-    let image = std::path::PathBuf::from(own_image_name());
-    let first_identity = ProcessIdentity::for_test(image.clone(), 41);
-    let second_identity = ProcessIdentity::for_test(image, 42);
-    let first = validate_with(
-        raw.clone(),
-        &own_image_name(),
-        |_| Some(first_identity.clone()),
-        |_, _, _| ConnectionProbe::Accepted,
-    )
-    .expect("the first coherent proof validates");
-    let second = validate_with(
-        raw,
-        &own_image_name(),
-        |_| Some(second_identity.clone()),
-        |_, _, _| ConnectionProbe::Accepted,
-    )
-    .expect("the replacement's coherent proof validates");
-
-    assert!(
-        !first.same_boot(&second),
-        "identical attacker-controlled file fields cannot forge process identity"
-    );
-}
-
-#[test]
-fn validation_errors_never_contain_the_bearer_or_metadata() {
-    let secret = "capability-secret";
-    let mut raw = connection(8081, secret);
-    raw.version = format!("version-{secret}\r\n");
-    raw.started_at = format!("started-{secret}\t");
-    let image = std::path::PathBuf::from(own_image_name());
-    let identity = ProcessIdentity::for_test(image, 41);
-    let error = validate_with(
-        raw,
-        &own_image_name(),
-        |_| Some(identity.clone()),
-        |_, _, _| ConnectionProbe::KeyRejected,
-    )
-    .expect_err("the bearer is rejected");
-
-    let debug = format!("{error:?}");
-    let display = format!("{error}");
-    for rendered in [debug, display] {
-        assert!(!rendered.contains(secret), "errors redact the bearer");
-        assert!(
-            !rendered.contains(['\r', '\n', '\t']),
-            "untrusted metadata cannot inject errors"
-        );
-    }
-}
diff --git a/crates/workshop/gateway-discovery/src/validated.rs b/crates/workshop/gateway-discovery/src/validated.rs
deleted file mode 100644
index 9be99eee7..000000000
--- a/crates/workshop/gateway-discovery/src/validated.rs
+++ /dev/null
@@ -1,364 +0,0 @@
-//! A live Gateway connection whose process and authority have been
-//! validated.
-
-use std::ffi::OsStr;
-use std::fmt;
-use std::path::Path;
-use std::time::{Duration, Instant};
-
-use crate::health::{self, ConnectionProbe};
-use crate::stale::StaleReason;
-use crate::sys::{ProcessIdentity, process_identity};
-use crate::{CancellationToken, GatewayDiscoveryFile};
-
-/// The image file name a live Gateway process must have.
-#[cfg(windows)]
-pub(crate) const GATEWAY_IMAGE_NAME: &str = "runvil-gateway.exe";
-/// The image file name a live Gateway process must have.
-#[cfg(not(windows))]
-pub(crate) const GATEWAY_IMAGE_NAME: &str = "runvil-gateway";
-
-/// The bearer-gated route used to prove the presented key is accepted.
-const KEY_PROBE_PATH: &str = "/v1/models";
-
-/// Budget for proving health without rejecting one transient failure.
-const LIVENESS_BUDGET: Duration = Duration::from_secs(2);
-
-/// A cancellable validation failure.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
-#[non_exhaustive]
-pub enum ValidationError {
-    /// The caller canceled validation.
-    #[error("connection validation was canceled")]
-    Canceled,
-    /// The connection failed one of the liveness or authority checks.
-    #[error(transparent)]
-    Stale(#[from] StaleReason),
-}
-
-/// A Gateway connection proven live and authorized at construction time.
-///
-/// Safe code outside this crate cannot construct the capability directly.
-/// Construction succeeds only after checking the process image, boot
-/// identity, health endpoint, and bearer acceptance.
-///
-/// Validation observes the OS process boot immediately before and after
-/// the one TCP connection that makes both network checks. This closes the
-/// health-to-bearer replacement gap and rejects pid reuse during that
-/// interval. The capability is a point-in-time proof and makes no claim
-/// that the process remains live after validation returns.
-///
-/// The bearer is deliberately absent from [`Debug`](fmt::Debug) output.
-///
-/// No test-fixture feature exposes another production-capability
-/// constructor.
-///
-/// The crate-private named validator is equally unavailable.
-#[derive(Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub struct ValidatedConnection {
-    connection: GatewayDiscoveryFile,
-    process_identity: ProcessIdentity,
-}
-
-impl ValidatedConnection {
-    /// Validates a raw gateway discovery file against the production Gateway image.
-    ///
-    /// # Errors
-    /// Returns the first [`StaleReason`] that prevents the raw connection
-    /// from proving a live, authorized Gateway boot.
-    pub fn validate(connection: GatewayDiscoveryFile) -> Result<Self, StaleReason> {
-        Self::validate_named(connection, GATEWAY_IMAGE_NAME)
-    }
-
-    /// Validates a raw connection against the production Gateway image
-    /// without allowing the network proof to outlive `deadline`.
-    ///
-    /// # Errors
-    /// Returns the first [`StaleReason`] that prevents the raw connection
-    /// from proving a live, authorized Gateway boot before `deadline`.
-    pub fn validate_before(
-        connection: GatewayDiscoveryFile,
-        deadline: Instant,
-    ) -> Result<Self, StaleReason> {
-        Self::validate_named_before(connection, GATEWAY_IMAGE_NAME, deadline)
-    }
-
-    /// Validates a raw connection while observing caller cancellation.
-    ///
-    /// # Errors
-    /// Returns [`ValidationError::Canceled`] when cancellation wins, or
-    /// [`ValidationError::Stale`] when a liveness or authority check fails.
-    pub fn validate_cancellable(
-        connection: GatewayDiscoveryFile,
-        cancellation: &CancellationToken,
-    ) -> Result<Self, ValidationError> {
-        Self::validate_named_cancellable(connection, GATEWAY_IMAGE_NAME, cancellation)
-    }
-
-    pub(crate) fn validate_named(
-        connection: GatewayDiscoveryFile,
-        image_name: &str,
-    ) -> Result<Self, StaleReason> {
-        validate_with(
-            connection,
-            image_name,
-            process_identity,
-            |address, bearer, deadline| {
-                health::probe_connection_until(address, KEY_PROBE_PATH, bearer, deadline)
-            },
-        )
-    }
-
-    fn validate_named_before(
-        connection: GatewayDiscoveryFile,
-        image_name: &str,
-        deadline: Instant,
-    ) -> Result<Self, StaleReason> {
-        validate_before_with(
-            connection,
-            image_name,
-            deadline,
-            process_identity,
-            |address, bearer, deadline| {
-                health::probe_connection_until(address, KEY_PROBE_PATH, bearer, deadline)
-            },
-        )
-    }
-
-    pub(crate) fn validate_named_cancellable(
-        connection: GatewayDiscoveryFile,
-        image_name: &str,
-        cancellation: &CancellationToken,
-    ) -> Result<Self, ValidationError> {
-        validate_cancellable_with(
-            connection,
-            image_name,
-            cancellation,
-            process_identity,
-            |address, bearer, budget, cancellation| {
-                health::probe_connection_cancellable(
-                    address,
-                    KEY_PROBE_PATH,
-                    bearer,
-                    budget,
-                    cancellation,
-                )
-            },
-        )
-    }
-
-    /// The validated Gateway's loopback port.
-    #[must_use]
-    pub const fn port(&self) -> u16 {
-        self.connection.port
-    }
-
-    /// The validated Gateway process identifier.
-    #[must_use]
-    pub const fn pid(&self) -> u32 {
-        self.connection.pid
-    }
-
-    /// The validated Gateway boot epoch.
-    #[must_use]
-    pub const fn epoch(&self) -> u64 {
-        self.connection.epoch
-    }
-
-    /// The validated Gateway version.
-    #[must_use]
-    pub fn version(&self) -> &str {
-        &self.connection.version
-    }
-
-    /// The validated Gateway boot timestamp.
-    #[must_use]
-    pub fn started_at(&self) -> &str {
-        &self.connection.started_at
-    }
-
-    /// Whether both capabilities name the same validated Gateway boot.
-    #[must_use]
-    pub fn same_boot(&self, other: &Self) -> bool {
-        self.process_identity == other.process_identity
-            && self.pid() == other.pid()
-            && self.epoch() == other.epoch()
-            && self.started_at() == other.started_at()
-    }
-
-    /// The validated bearer required to build an authorized consumer.
-    ///
-    /// Callers must keep this value out of diagnostics. The capability's
-    /// own [`Debug`](fmt::Debug) implementation always redacts it.
-    #[doc(hidden)]
-    #[must_use]
-    pub fn api_key(&self) -> &str {
-        &self.connection.api_key
-    }
-
-    pub(crate) fn gateway_discovery_file(&self) -> &GatewayDiscoveryFile {
-        &self.connection
-    }
-
-    pub(crate) fn into_gateway_discovery_file(self) -> GatewayDiscoveryFile {
-        self.connection
-    }
-}
-
-impl fmt::Debug for ValidatedConnection {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("ValidatedConnection")
-            .field("port", &self.port())
-            .field("pid", &self.pid())
-            .field("epoch", &self.epoch())
-            .field("version", &"[REDACTED]")
-            .field("started_at", &"[REDACTED]")
-            .field("api_key", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Performs one validation while allowing deterministic observation and
-/// network seams in unit tests. Production passes only the platform process
-/// observer and the private shared probe.
-fn validate_with(
-    connection: GatewayDiscoveryFile,
-    image_name: &str,
-    observe_process: impl FnMut(u32) -> Option<ProcessIdentity>,
-    prove_connection: impl FnOnce(&str, &str, Instant) -> ConnectionProbe,
-) -> Result<ValidatedConnection, StaleReason> {
-    validate_before_with(
-        connection,
-        image_name,
-        Instant::now() + LIVENESS_BUDGET,
-        observe_process,
-        prove_connection,
-    )
-}
-
-fn validate_before_with(
-    connection: GatewayDiscoveryFile,
-    image_name: &str,
-    deadline: Instant,
-    mut observe_process: impl FnMut(u32) -> Option<ProcessIdentity>,
-    prove_connection: impl FnOnce(&str, &str, Instant) -> ConnectionProbe,
-) -> Result<ValidatedConnection, StaleReason> {
-    if Instant::now() >= deadline {
-        return Err(StaleReason::HealthFailed);
-    }
-    if connection.validation_error().is_some() {
-        return Err(StaleReason::Invalid);
-    }
-    let Some(before) = observe_process(connection.pid) else {
-        return Err(StaleReason::ProcessDead);
-    };
-    if !image_name_matches(&before.image, image_name) {
-        return Err(StaleReason::ImageMismatch);
-    }
-    if !connection.has_boot_identity() {
-        return Err(StaleReason::BootIdentityInvalid);
-    }
-    if Instant::now() >= deadline {
-        return Err(StaleReason::HealthFailed);
-    }
-    let address = format!("127.0.0.1:{}", connection.port);
-    match prove_connection(&address, &connection.api_key, deadline) {
-        ConnectionProbe::Canceled | ConnectionProbe::HealthFailed => {
-            return Err(StaleReason::HealthFailed);
-        }
-        ConnectionProbe::KeyRejected => return Err(StaleReason::KeyRejected),
-        ConnectionProbe::Accepted => {}
-    }
-    let Some(after) = observe_process(connection.pid) else {
-        return Err(StaleReason::ProcessChanged);
-    };
-    if before != after {
-        return Err(StaleReason::ProcessChanged);
-    }
-    Ok(ValidatedConnection {
-        connection,
-        process_identity: before,
-    })
-}
-
-fn validate_cancellable_with(
-    connection: GatewayDiscoveryFile,
-    image_name: &str,
-    cancellation: &CancellationToken,
-    mut observe_process: impl FnMut(u32) -> Option<ProcessIdentity>,
-    prove_connection: impl FnOnce(&str, &str, Duration, &CancellationToken) -> ConnectionProbe,
-) -> Result<ValidatedConnection, ValidationError> {
-    if cancellation.is_canceled() {
-        return Err(ValidationError::Canceled);
-    }
-    if connection.validation_error().is_some() {
-        return Err(StaleReason::Invalid.into());
-    }
-    let Some(before_observation) = cancellation.run_if_active(|| observe_process(connection.pid))
-    else {
-        return Err(ValidationError::Canceled);
-    };
-    let Some(before) = before_observation else {
-        return Err(StaleReason::ProcessDead.into());
-    };
-    if cancellation.is_canceled() {
-        return Err(ValidationError::Canceled);
-    }
-    if !image_name_matches(&before.image, image_name) {
-        return Err(StaleReason::ImageMismatch.into());
-    }
-    if !connection.has_boot_identity() {
-        return Err(StaleReason::BootIdentityInvalid.into());
-    }
-    let address = format!("127.0.0.1:{}", connection.port);
-    let proof = prove_connection(&address, &connection.api_key, LIVENESS_BUDGET, cancellation);
-    if cancellation.is_canceled() || proof == ConnectionProbe::Canceled {
-        return Err(ValidationError::Canceled);
-    }
-    match proof {
-        ConnectionProbe::HealthFailed => return Err(StaleReason::HealthFailed.into()),
-        ConnectionProbe::KeyRejected => return Err(StaleReason::KeyRejected.into()),
-        ConnectionProbe::Accepted => {}
-        ConnectionProbe::Canceled => return Err(ValidationError::Canceled),
-    }
-    let Some(after_observation) = cancellation.run_if_active(|| observe_process(connection.pid))
-    else {
-        return Err(ValidationError::Canceled);
-    };
-    let Some(after) = after_observation else {
-        return Err(StaleReason::ProcessChanged.into());
-    };
-    if cancellation.is_canceled() {
-        return Err(ValidationError::Canceled);
-    }
-    if before != after {
-        return Err(StaleReason::ProcessChanged.into());
-    }
-    Ok(ValidatedConnection {
-        connection,
-        process_identity: before,
-    })
-}
-
-fn image_name_matches(image: &Path, expected: &str) -> bool {
-    let Some(name) = image.file_name() else {
-        return false;
-    };
-    image_file_name_matches(name, expected)
-}
-
-#[cfg(windows)]
-fn image_file_name_matches(name: &OsStr, expected: &str) -> bool {
-    name.to_string_lossy().eq_ignore_ascii_case(expected)
-}
-
-#[cfg(not(windows))]
-fn image_file_name_matches(name: &OsStr, expected: &str) -> bool {
-    name == OsStr::new(expected)
-}
-
-#[cfg(test)]
-#[path = "validated-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway/Cargo.toml b/crates/workshop/gateway/Cargo.toml
deleted file mode 100644
index 815d0c712..000000000
--- a/crates/workshop/gateway/Cargo.toml
+++ /dev/null
@@ -1,49 +0,0 @@
-[package]
-name = "workshop-gateway"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[features]
-test-fixtures = [
-    "dep:tempfile",
-    "workshop-gateway-discovery/test-fixtures",
-    "workshop-support/test-fixtures",
-]
-
-[dependencies]
-arc-swap.workspace = true
-futures-util.workspace = true
-reqwest.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-workshop-gateway-discovery.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-tokio-tungstenite.workspace = true
-tracing.workspace = true
-url.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-support.workspace = true
-tempfile = { workspace = true, optional = true }
-
-[dev-dependencies]
-axum.workspace = true
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-# The gateway's tests call `workshop_support::fixtures::serve`; enabling the
-# feature here (not only through the crate's own `test-fixtures` feature)
-# keeps `cargo test -p workshop-gateway` compiling without `--all-features`.
-workshop-support = { workspace = true, features = ["test-fixtures"] }
-# The discovery fork's `test-fixtures` feature supplies the `gateway.json`
-# writer and the process lease Workshop's test doubles need.
-workshop-gateway-discovery = { workspace = true, features = ["test-fixtures"] }
-
-[build-dependencies]
-serde_json.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/gateway/build.rs b/crates/workshop/gateway/build.rs
deleted file mode 100644
index d0e8dc8c2..000000000
--- a/crates/workshop/gateway/build.rs
+++ /dev/null
@@ -1,37 +0,0 @@
-//! Embeds the Gateway pin's `min_gateway` so Workshop can compare it with
-//! the version of the Gateway it attaches to.
-//!
-//! The pin is one file for the whole repository, and this crate is where
-//! the Gateway version is known, so the value is baked into this crate's
-//! environment and read back with `env!`.
-
-use std::path::PathBuf;
-
-fn main() {
-    embed_min_gateway();
-}
-
-/// Reads `gateway-pin/pin.json` and sets `RUNVIL_MIN_GATEWAY` to its
-/// `min_gateway` value. A pin that is missing or still a placeholder sets
-/// an empty value, which the comparison reads as "no minimum recorded": a
-/// fresh checkout has to build before anyone can fill the pin in.
-fn embed_min_gateway() {
-    let pin = pin_path();
-    if let Some(path) = &pin {
-        println!("cargo:rerun-if-changed={}", path.display());
-    }
-    let value = pin
-        .and_then(|path| std::fs::read_to_string(path).ok())
-        .and_then(|text| serde_json::from_str::<serde_json::Value>(&text).ok())
-        .and_then(|pin| pin.get("min_gateway")?.as_str().map(str::to_owned))
-        .filter(|value| value != "PLACEHOLDER")
-        .unwrap_or_default();
-    println!("cargo:rustc-env=RUNVIL_MIN_GATEWAY={value}");
-}
-
-/// `<workspace>/gateway-pin/pin.json`, from this crate's manifest directory.
-fn pin_path() -> Option<PathBuf> {
-    let manifest = PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR")?);
-    let root = manifest.parent()?.parent()?.parent()?;
-    Some(root.join("gateway-pin").join("pin.json"))
-}
diff --git a/crates/workshop/gateway/src/binding.rs b/crates/workshop/gateway/src/binding.rs
deleted file mode 100644
index ed4ff4d7b..000000000
--- a/crates/workshop/gateway/src/binding.rs
+++ /dev/null
@@ -1,331 +0,0 @@
-//! Atomically replaceable gateway endpoint and credential state.
-//!
-//! Every gateway-dependent workshop path loads one immutable snapshot
-//! containing the HTTP client, base URL, bearer, and generation.
-//! Publication installs a validated local-sidecar replacement as the next
-//! generation: it builds the complete next snapshot before one atomic
-//! store, then notifies long-lived tasks to reconnect. Teardown closes
-//! publication permanently. Explicitly configured endpoints never receive
-//! an updater from the desktop app.
-
-mod publication;
-mod shutdown;
-
-use std::fmt;
-use std::sync::{Arc, Mutex, PoisonError};
-
-use arc_swap::ArcSwap;
-use tokio::sync::watch;
-
-use crate::client::{GatewayClient, GatewayError};
-
-/// One immutable generation of every gateway client credential.
-pub struct GatewaySnapshot {
-    /// The one client, serving HTTP requests and the Realtime socket alike,
-    /// used by workshop routes and the heartbeat. It holds this
-    /// generation's normalized base URL and bearer.
-    client: GatewayClient,
-    /// Monotonic generation assigned before this snapshot is published.
-    generation: u64,
-    /// Proven local gateway boot, absent for an explicitly configured endpoint.
-    identity: Option<crate::discovery::ValidatedConnection>,
-}
-
-impl fmt::Debug for GatewaySnapshot {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("GatewaySnapshot")
-            .field("client", &self.client)
-            .field("generation", &self.generation)
-            .field("identity", &self.identity)
-            .finish_non_exhaustive()
-    }
-}
-
-impl GatewaySnapshot {
-    /// The gateway client in this generation, for HTTP requests and the
-    /// Realtime socket alike.
-    #[must_use]
-    pub fn client(&self) -> &GatewayClient {
-        &self.client
-    }
-
-    /// The gateway base URL in this generation.
-    #[must_use]
-    pub fn base_url(&self) -> &str {
-        self.client.base_url()
-    }
-
-    /// The gateway bearer in this generation, for consumers that
-    /// authenticate outside the HTTP client.
-    #[must_use]
-    pub fn api_key(&self) -> &str {
-        &self.client.api_key
-    }
-
-    /// This snapshot's monotonic generation.
-    #[must_use]
-    pub fn generation(&self) -> u64 {
-        self.generation
-    }
-}
-
-/// Shared atomic gateway snapshot and replacement notification.
-#[derive(Clone)]
-pub struct GatewayBinding {
-    current: Arc<ArcSwap<GatewaySnapshot>>,
-    changed: watch::Sender<u64>,
-    publication: Arc<Mutex<PublicationState>>,
-}
-
-#[derive(Debug)]
-struct PublicationState {
-    next_generation: u64,
-    closed: bool,
-}
-
-/// A failure to publish a replacement gateway generation.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum GatewayPublicationError {
-    /// The replacement client could not be built.
-    #[error(transparent)]
-    #[non_exhaustive]
-    Build(#[from] GatewayError),
-    /// The binding has permanently revoked replacement publication.
-    #[error("gateway replacement publication is permanently closed")]
-    PublicationClosed,
-}
-
-impl fmt::Debug for GatewayBinding {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("GatewayBinding")
-            .field("current", &self.snapshot())
-            .finish()
-    }
-}
-
-impl GatewayBinding {
-    /// Builds generation zero from one endpoint and credential pair.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Build`] if the HTTP client cannot be built.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    pub fn new(base_url: &str, api_key: &str) -> Result<Self, GatewayError> {
-        Self::new_with_identity(base_url, api_key, None)
-    }
-
-    /// Builds generation zero with an optional validated local identity.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Build`] if the HTTP client cannot be built.
-    pub fn new_with_identity(
-        base_url: &str,
-        api_key: &str,
-        identity: Option<crate::discovery::ValidatedConnection>,
-    ) -> Result<Self, GatewayError> {
-        Ok(Self::from_snapshot(build_snapshot(
-            base_url, api_key, identity,
-        )?))
-    }
-
-    /// Builds a binding around a client with test-specific timeouts.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    #[must_use]
-    pub fn from_client(client: GatewayClient) -> Self {
-        Self::from_snapshot(GatewaySnapshot {
-            client,
-            generation: 0,
-            identity: None,
-        })
-    }
-
-    /// Publishes `snapshot` as generation zero, with replacement
-    /// publication open from generation one.
-    fn from_snapshot(snapshot: GatewaySnapshot) -> Self {
-        Self {
-            current: Arc::new(ArcSwap::from_pointee(snapshot)),
-            changed: watch::channel(0).0,
-            publication: Arc::new(Mutex::new(PublicationState {
-                next_generation: 1,
-                closed: false,
-            })),
-        }
-    }
-
-    /// Loads one endpoint and credential generation atomically.
-    #[must_use]
-    pub fn snapshot(&self) -> Arc<GatewaySnapshot> {
-        self.current.load_full()
-    }
-
-    /// Subscribes to replacements after loading the current generation.
-    #[must_use]
-    pub fn subscribe(&self) -> watch::Receiver<u64> {
-        self.changed.subscribe()
-    }
-
-    /// The currently published generation.
-    #[must_use]
-    pub fn generation(&self) -> u64 {
-        self.snapshot().generation()
-    }
-
-    /// Builds and atomically publishes a replacement, then wakes consumers.
-    ///
-    /// # Errors
-    /// Returns [`GatewayPublicationError::Build`] if the replacement HTTP
-    /// client cannot initialize, or
-    /// [`GatewayPublicationError::PublicationClosed`] after teardown.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    pub fn replace(&self, base_url: &str, api_key: &str) -> Result<(), GatewayPublicationError> {
-        self.replace_with_identity(base_url, api_key, None)
-    }
-
-    /// Builds and atomically publishes a complete replacement generation.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    fn replace_with_identity(
-        &self,
-        base_url: &str,
-        api_key: &str,
-        identity: Option<crate::discovery::ValidatedConnection>,
-    ) -> Result<(), GatewayPublicationError> {
-        let snapshot = build_snapshot(base_url, api_key, identity)?;
-        self.publish_snapshot(snapshot)
-    }
-
-    #[cfg(any(test, feature = "test-fixtures"))]
-    fn publish_snapshot(&self, snapshot: GatewaySnapshot) -> Result<(), GatewayPublicationError> {
-        let mut publication = self
-            .publication
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner);
-        self.commit(&mut publication, snapshot)
-    }
-
-    /// Stores `snapshot` as the next generation under the held publication
-    /// lock, then wakes consumers, unless teardown closed publication.
-    fn commit(
-        &self,
-        publication: &mut PublicationState,
-        mut snapshot: GatewaySnapshot,
-    ) -> Result<(), GatewayPublicationError> {
-        if publication.closed {
-            return Err(GatewayPublicationError::PublicationClosed);
-        }
-        let generation = publication.next_generation;
-        publication.next_generation = generation.saturating_add(1);
-        snapshot.generation = generation;
-        self.current.store(Arc::new(snapshot));
-        self.changed.send_replace(generation);
-        Ok(())
-    }
-
-    fn close_publication(&self) {
-        self.publication
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .closed = true;
-    }
-
-    fn publication_closed(&self) -> bool {
-        self.publication
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .closed
-    }
-
-    /// Creates the restricted handle the desktop app uses for sidecar updates.
-    #[must_use]
-    pub fn updater(&self) -> GatewayUpdater {
-        GatewayUpdater {
-            binding: self.clone(),
-        }
-    }
-}
-
-/// Restricted local-gateway authority for the embedding desktop app.
-///
-/// Replacements accept only validated capabilities, and shutdown reads the
-/// same current immutable snapshot as every workshop consumer. Raw connection
-/// files cannot cross the publication boundary.
-#[derive(Clone)]
-pub struct GatewayUpdater {
-    binding: GatewayBinding,
-}
-
-impl fmt::Debug for GatewayUpdater {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("GatewayUpdater")
-            .finish_non_exhaustive()
-    }
-}
-
-impl GatewayUpdater {
-    /// Atomically replaces the local gateway port and bearer, waking every
-    /// long-lived workshop consumer only after the complete snapshot is live.
-    ///
-    /// # Errors
-    /// Returns [`GatewayPublicationError::Build`] if the replacement HTTP
-    /// client cannot initialize, or
-    /// [`GatewayPublicationError::PublicationClosed`] after teardown revokes
-    /// replacement publication.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    pub fn replace_sidecar(
-        &self,
-        connection: &crate::discovery::ValidatedConnection,
-    ) -> Result<(), GatewayPublicationError> {
-        self.binding.replace_with_identity(
-            &format!("http://127.0.0.1:{}", connection.port()),
-            connection.api_key(),
-            Some(connection.clone()),
-        )
-    }
-
-    /// Replaces the configured gateway in the crate's integration fixtures
-    /// without manufacturing a production sidecar capability.
-    ///
-    /// # Errors
-    /// Returns [`GatewayPublicationError::Build`] if the replacement HTTP
-    /// client cannot initialize, or
-    /// [`GatewayPublicationError::PublicationClosed`] after teardown.
-    #[cfg(feature = "test-fixtures")]
-    pub fn replace_fixture(
-        &self,
-        base_url: &str,
-        api_key: &str,
-    ) -> Result<(), GatewayPublicationError> {
-        self.binding.replace(base_url, api_key)
-    }
-
-    /// Permanently revokes replacement publication for this binding and every
-    /// updater clone.
-    pub fn close_publication(&self) {
-        self.binding.close_publication();
-    }
-
-    /// Whether replacement publication has been permanently revoked.
-    #[must_use]
-    pub fn publication_closed(&self) -> bool {
-        self.binding.publication_closed()
-    }
-}
-
-/// Builds all clients before publication so URL and bearer never tear.
-/// Publication assigns the generation.
-fn build_snapshot(
-    base_url: &str,
-    api_key: &str,
-    identity: Option<crate::discovery::ValidatedConnection>,
-) -> Result<GatewaySnapshot, GatewayError> {
-    Ok(GatewaySnapshot {
-        client: GatewayClient::new(base_url, api_key)?,
-        generation: 0,
-        identity,
-    })
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/gateway/src/binding/publication.rs b/crates/workshop/gateway/src/binding/publication.rs
deleted file mode 100644
index d1f1b0f00..000000000
--- a/crates/workshop/gateway/src/binding/publication.rs
+++ /dev/null
@@ -1,95 +0,0 @@
-//! Cancellation-aware publication of validated gateway replacements.
-
-use std::sync::TryLockError;
-use std::time::Duration;
-
-use super::{GatewayBinding, GatewayPublicationError, GatewayUpdater, build_snapshot};
-
-/// Cancellable replacement lock retry cadence.
-const REPLACEMENT_RETRY_INTERVAL: Duration = Duration::from_millis(10);
-
-impl GatewayBinding {
-    fn replace_with_identity_cancellable(
-        &self,
-        base_url: &str,
-        api_key: &str,
-        identity: crate::discovery::ValidatedConnection,
-        cancellation: &crate::discovery::CancellationToken,
-    ) -> Result<bool, GatewayPublicationError> {
-        self.replace_with_identity_cancellable_with_wait(
-            base_url,
-            api_key,
-            identity,
-            cancellation,
-            crate::discovery::CancellationToken::wait_timeout,
-        )
-    }
-
-    pub(super) fn replace_with_identity_cancellable_with_wait(
-        &self,
-        base_url: &str,
-        api_key: &str,
-        identity: crate::discovery::ValidatedConnection,
-        cancellation: &crate::discovery::CancellationToken,
-        mut wait: impl FnMut(&crate::discovery::CancellationToken, Duration) -> bool,
-    ) -> Result<bool, GatewayPublicationError> {
-        if cancellation.is_canceled() {
-            return if self.publication_closed() {
-                Err(GatewayPublicationError::PublicationClosed)
-            } else {
-                Ok(false)
-            };
-        }
-        let snapshot = build_snapshot(base_url, api_key, Some(identity))?;
-        cancellation
-            .run_if_active(|| {
-                let mut publication = loop {
-                    match self.publication.try_lock() {
-                        Ok(publication) => break publication,
-                        Err(TryLockError::Poisoned(error)) => break error.into_inner(),
-                        Err(TryLockError::WouldBlock) => {
-                            if wait(cancellation, REPLACEMENT_RETRY_INTERVAL) {
-                                return Ok(false);
-                            }
-                        }
-                    }
-                };
-                if cancellation.is_canceled() {
-                    return Ok(false);
-                }
-                self.commit(&mut publication, snapshot).map(|()| true)
-            })
-            .unwrap_or_else(|| {
-                if self.publication_closed() {
-                    Err(GatewayPublicationError::PublicationClosed)
-                } else {
-                    Ok(false)
-                }
-            })
-    }
-}
-
-impl GatewayUpdater {
-    /// Atomically replaces the local gateway unless caller cancellation wins.
-    ///
-    /// Returns `Ok(false)` without publication when cancellation wins while
-    /// another publisher owns the replacement lock.
-    ///
-    /// # Errors
-    /// Returns [`GatewayPublicationError::Build`] if the replacement clients
-    /// cannot initialize, or
-    /// [`GatewayPublicationError::PublicationClosed`] after teardown revokes
-    /// replacement publication.
-    pub fn replace_sidecar_cancellable(
-        &self,
-        connection: &crate::discovery::ValidatedConnection,
-        cancellation: &crate::discovery::CancellationToken,
-    ) -> Result<bool, GatewayPublicationError> {
-        self.binding.replace_with_identity_cancellable(
-            &format!("http://127.0.0.1:{}", connection.port()),
-            connection.api_key(),
-            connection.clone(),
-            cancellation,
-        )
-    }
-}
diff --git a/crates/workshop/gateway/src/binding/shutdown.rs b/crates/workshop/gateway/src/binding/shutdown.rs
deleted file mode 100644
index cef97ddc2..000000000
--- a/crates/workshop/gateway/src/binding/shutdown.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! Shutdown authority derived from a gateway snapshot's validated identity.
-
-use super::{GatewaySnapshot, GatewayUpdater};
-
-impl GatewaySnapshot {
-    /// Whether this generation is a supervised local sidecar: it holds
-    /// a validated local gateway boot, so the workshop may shut it down
-    /// and its supervisor relaunches the sibling. An explicitly configured
-    /// endpoint (a LAN gateway) never is.
-    #[must_use]
-    pub fn is_sidecar(&self) -> bool {
-        self.identity.is_some()
-    }
-
-    /// Requests shutdown from the validated local gateway this snapshot
-    /// names, posting the authenticated `POST /shutdown`.
-    ///
-    /// Returns `Ok(false)` without sending a request when the snapshot
-    /// came from explicit configuration and therefore grants no local
-    /// shutdown authority. The request is blocking I/O; an async caller
-    /// runs it off the executor.
-    ///
-    /// # Errors
-    /// Returns [`crate::discovery::ShutdownError`] when the local gateway
-    /// refuses the request or cannot be reached.
-    pub fn request_shutdown(&self) -> Result<bool, crate::discovery::ShutdownError> {
-        let Some(identity) = self.identity.as_ref() else {
-            return Ok(false);
-        };
-        crate::discovery::request_shutdown(identity)?;
-        Ok(true)
-    }
-}
-
-impl GatewayUpdater {
-    /// Requests shutdown from the validated local gateway in the current
-    /// consumer snapshot, as that snapshot's
-    /// [`GatewaySnapshot::request_shutdown`] does.
-    ///
-    /// Returns `Ok(false)` without sending a request when the current gateway
-    /// came from explicit configuration and therefore grants no local shutdown
-    /// authority.
-    ///
-    /// # Errors
-    /// Returns [`crate::discovery::ShutdownError`] when the current local
-    /// gateway refuses the request or cannot be reached.
-    pub fn request_shutdown(&self) -> Result<bool, crate::discovery::ShutdownError> {
-        self.binding.snapshot().request_shutdown()
-    }
-}
diff --git a/crates/workshop/gateway/src/binding/tests.rs b/crates/workshop/gateway/src/binding/tests.rs
deleted file mode 100644
index bc72a4551..000000000
--- a/crates/workshop/gateway/src/binding/tests.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-//! Gateway binding tests: capability replacement publishes one coherent snapshot and a new identity.
-
-use super::*;
-
-mod atomic;
-mod publication;
-mod shutdown;
-
-fn validated_connection(
-    gateway: &crate::test_gateway::ValidatedGateway,
-    api_key: &str,
-    epoch: u64,
-    started_at: &str,
-) -> crate::discovery::ValidatedConnection {
-    gateway.validate(api_key, epoch, started_at)
-}
-
-#[test]
-fn capability_replacement_publishes_one_coherent_snapshot() {
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let old = binding.snapshot();
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let port = gateway.port();
-    let validated =
-        validated_connection(&gateway, "new-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-
-    binding
-        .updater()
-        .replace_sidecar(&validated)
-        .expect("replacement builds");
-    let new = binding.snapshot();
-
-    assert_eq!(old.client().base_url, "http://127.0.0.1:54375");
-    assert_eq!(old.client().api_key, "old-key");
-    assert_eq!(old.base_url(), "http://127.0.0.1:54375");
-    assert_eq!(old.api_key(), "old-key");
-    assert!(
-        old.identity.is_none(),
-        "configured gateways have no local identity"
-    );
-    assert!(
-        !old.is_sidecar(),
-        "a configured gateway is never a supervised sidecar"
-    );
-    assert_eq!(new.client().base_url, format!("http://127.0.0.1:{port}"));
-    assert_eq!(new.client().api_key, "new-key");
-    assert_eq!(new.base_url(), format!("http://127.0.0.1:{port}"));
-    assert_eq!(new.api_key(), "new-key");
-    let identity = new
-        .identity
-        .as_ref()
-        .expect("the validated identity is published");
-    assert_eq!(identity, &validated);
-    assert!(
-        new.is_sidecar(),
-        "a validated identity makes the snapshot a supervised sidecar"
-    );
-    assert!(new.generation() > old.generation());
-    assert_eq!(binding.generation(), new.generation());
-}
-
-#[test]
-fn same_port_and_key_new_boot_still_publishes_a_new_identity() {
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("stable-key");
-    let first = validated_connection(
-        &gateway,
-        "stable-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    );
-    let replacement = validated_connection(
-        &gateway,
-        "stable-key",
-        1_778_000_002,
-        "2026-09-07T18:00:02Z",
-    );
-    let binding =
-        GatewayBinding::new("http://127.0.0.1:54375", "stable-key").expect("binding builds");
-    binding
-        .updater()
-        .replace_sidecar(&first)
-        .expect("the first identity publishes");
-    let first_snapshot = binding.snapshot();
-    binding
-        .updater()
-        .replace_sidecar(&replacement)
-        .expect("the replacement identity publishes");
-    let replacement_snapshot = binding.snapshot();
-
-    assert_eq!(replacement_snapshot.base_url(), first_snapshot.base_url());
-    assert_eq!(replacement_snapshot.api_key(), first_snapshot.api_key());
-    assert!(
-        replacement_snapshot.generation() > first_snapshot.generation(),
-        "identity replacement advances the generation even with a stable endpoint and bearer"
-    );
-    assert_eq!(
-        replacement_snapshot.identity.as_ref(),
-        Some(&replacement),
-        "the snapshot holds the new validated boot"
-    );
-}
diff --git a/crates/workshop/gateway/src/binding/tests/atomic.rs b/crates/workshop/gateway/src/binding/tests/atomic.rs
deleted file mode 100644
index e4d263f61..000000000
--- a/crates/workshop/gateway/src/binding/tests/atomic.rs
+++ /dev/null
@@ -1,145 +0,0 @@
-//! Binding atomicity: synchronized reads never observe a torn replacement snapshot.
-
-use super::*;
-
-use std::sync::Arc;
-
-#[test]
-fn synchronized_reads_never_observe_a_torn_replacement_snapshot() {
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let validated =
-        validated_connection(&gateway, "new-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-    let new_url = format!("http://127.0.0.1:{}", gateway.port());
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let updater = binding.updater();
-    let (target_tx, target_rx) = std::sync::mpsc::sync_channel(0);
-    let (ready_tx, ready_rx) = std::sync::mpsc::sync_channel(0);
-    let (observed_tx, observed_rx) = std::sync::mpsc::sync_channel(0);
-
-    let samples = std::thread::scope(|scope| {
-        let reader_binding = binding.clone();
-        let reader_validated = validated.clone();
-        let reader_url = new_url.clone();
-        let reader = scope.spawn(move || {
-            let mut samples = 0_usize;
-            while let Ok(target_generation) = target_rx.recv() {
-                ready_tx.send(()).expect("the publisher remains live");
-                loop {
-                    let snapshot = reader_binding.snapshot();
-                    samples += 1;
-                    if snapshot.generation().is_multiple_of(2) {
-                        assert_eq!(snapshot.client().base_url, "http://127.0.0.1:54375");
-                        assert_eq!(snapshot.client().api_key, "old-key");
-                        assert_eq!(snapshot.base_url(), "http://127.0.0.1:54375");
-                        assert_eq!(snapshot.api_key(), "old-key");
-                        assert!(snapshot.identity.is_none());
-                    } else {
-                        assert_eq!(snapshot.client().base_url, reader_url);
-                        assert_eq!(snapshot.client().api_key, "new-key");
-                        assert_eq!(snapshot.base_url(), reader_url);
-                        assert_eq!(snapshot.api_key(), "new-key");
-                        assert_eq!(snapshot.identity.as_ref(), Some(&reader_validated));
-                    }
-                    if snapshot.generation() >= target_generation {
-                        break;
-                    }
-                    std::thread::yield_now();
-                }
-                observed_tx
-                    .send(())
-                    .expect("the publisher observes the sample");
-            }
-            samples
-        });
-
-        for generation in 1_u64..=256 {
-            target_tx.send(generation).expect("the reader remains live");
-            ready_rx.recv().expect("the reader begins sampling");
-            if generation % 2 == 0 {
-                binding
-                    .replace("http://127.0.0.1:54375", "old-key")
-                    .expect("the configured snapshot republishes");
-            } else {
-                updater
-                    .replace_sidecar(&validated)
-                    .expect("the sidecar snapshot publishes");
-            }
-            observed_rx
-                .recv()
-                .expect("the reader observes the published generation");
-        }
-        drop(target_tx);
-        reader.join().expect("the reader does not panic")
-    });
-
-    assert!(samples >= 256, "every synchronized publication is sampled");
-}
-
-#[test]
-fn close_before_publish_preserves_the_complete_original_generation() {
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let validated =
-        validated_connection(&gateway, "new-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let original = binding.snapshot();
-    let updater = binding.updater();
-
-    updater.close_publication();
-    assert!(matches!(
-        updater.replace_sidecar(&validated),
-        Err(GatewayPublicationError::PublicationClosed)
-    ));
-
-    let observed = binding.snapshot();
-    assert!(
-        Arc::ptr_eq(&observed, &original),
-        "close-first ordering neither stores nor advances a generation"
-    );
-    assert_eq!(observed.generation(), 0);
-    assert_eq!(observed.base_url(), "http://127.0.0.1:54375");
-    assert_eq!(observed.api_key(), "old-key");
-    assert!(observed.identity.is_none());
-}
-
-#[test]
-fn publish_before_close_preserves_the_complete_final_generation() {
-    let first_gateway = crate::test_gateway::ValidatedGateway::spawn("first-key");
-    let first = validated_connection(
-        &first_gateway,
-        "first-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    );
-    let second_gateway = crate::test_gateway::ValidatedGateway::spawn("second-key");
-    let second = validated_connection(
-        &second_gateway,
-        "second-key",
-        1_778_000_002,
-        "2026-09-07T18:00:02Z",
-    );
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let updater = binding.updater();
-    updater
-        .replace_sidecar(&first)
-        .expect("publish wins before close");
-    let published = binding.snapshot();
-
-    updater.close_publication();
-    assert!(matches!(
-        updater.replace_sidecar(&second),
-        Err(GatewayPublicationError::PublicationClosed)
-    ));
-
-    let observed = binding.snapshot();
-    assert!(
-        Arc::ptr_eq(&observed, &published),
-        "publish-first ordering retains exactly its final stored generation"
-    );
-    assert_eq!(observed.generation(), 1);
-    assert_eq!(
-        observed.base_url(),
-        format!("http://127.0.0.1:{}", first.port())
-    );
-    assert_eq!(observed.api_key(), "first-key");
-    assert_eq!(observed.identity.as_ref(), Some(&first));
-}
diff --git a/crates/workshop/gateway/src/binding/tests/publication.rs b/crates/workshop/gateway/src/binding/tests/publication.rs
deleted file mode 100644
index 78ebe2c9c..000000000
--- a/crates/workshop/gateway/src/binding/tests/publication.rs
+++ /dev/null
@@ -1,143 +0,0 @@
-//! Binding publication: cancellation wakes contenders and close is a permanent linearization point.
-
-use super::*;
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, PoisonError};
-use std::time::{Duration, Instant};
-
-#[test]
-fn cancellation_wakes_a_replacement_contending_on_the_publication_lock() {
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let original = binding.snapshot();
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let validated =
-        validated_connection(&gateway, "new-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-    let held = binding
-        .publication
-        .lock()
-        .unwrap_or_else(PoisonError::into_inner);
-    let worker_binding = binding.clone();
-    let cancellation = crate::discovery::CancellationToken::new();
-    let worker_cancellation = cancellation.clone();
-    let (entered, blocked) = std::sync::mpsc::channel();
-    let worker = std::thread::spawn(move || {
-        let base_url = format!("http://127.0.0.1:{}", validated.port());
-        let api_key = validated.api_key().to_owned();
-        worker_binding.replace_with_identity_cancellable_with_wait(
-            &base_url,
-            &api_key,
-            validated,
-            &worker_cancellation,
-            |cancellation, delay| {
-                entered
-                    .send(())
-                    .expect("announce publication lock contention");
-                cancellation.wait_timeout(delay)
-            },
-        )
-    });
-    blocked
-        .recv_timeout(Duration::from_secs(1))
-        .expect("replacement blocks inside the real publication boundary");
-
-    let started = Instant::now();
-    cancellation.cancel();
-    let published = worker
-        .join()
-        .expect("replacement worker joins")
-        .expect("replacement build succeeds");
-    drop(held);
-
-    assert!(
-        started.elapsed() < Duration::from_millis(250),
-        "cancellation wakes publication lock contention"
-    );
-    assert!(!published, "the canceled replacement is not published");
-    assert_eq!(
-        binding.snapshot().generation(),
-        original.generation(),
-        "the authoritative snapshot remains the pre-cancel generation"
-    );
-}
-
-#[test]
-fn publication_close_is_permanent_for_every_updater_clone() {
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let original = binding.snapshot();
-    let changed = binding.subscribe();
-    let updater = binding.updater();
-    let clone = updater.clone();
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let validated =
-        validated_connection(&gateway, "new-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-
-    updater.close_publication();
-    for updater in [updater, clone, binding.updater()] {
-        let error = updater
-            .replace_sidecar(&validated)
-            .expect_err("a closed binding rejects every updater clone");
-        assert!(matches!(error, GatewayPublicationError::PublicationClosed));
-    }
-    let cancellation = crate::discovery::CancellationToken::new();
-    cancellation.cancel();
-    assert!(matches!(
-        binding
-            .updater()
-            .replace_sidecar_cancellable(&validated, &cancellation),
-        Err(GatewayPublicationError::PublicationClosed)
-    ));
-
-    assert_eq!(
-        binding.snapshot().generation(),
-        original.generation(),
-        "rejected publication does not advance or store a generation"
-    );
-    assert!(
-        !changed
-            .has_changed()
-            .expect("the watch channel remains live"),
-        "rejected publication does not notify subscribers"
-    );
-}
-
-#[test]
-fn concurrent_publishers_cannot_cross_the_permanent_close_linearization_point() {
-    let binding = GatewayBinding::new("http://127.0.0.1:54375", "old-key").expect("binding builds");
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("new-key");
-    let validated = Arc::new(validated_connection(
-        &gateway,
-        "new-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    ));
-    let closed = Arc::new(AtomicBool::new(false));
-
-    std::thread::scope(|scope| {
-        for _ in 0..8 {
-            let updater = binding.updater();
-            let validated = Arc::clone(&validated);
-            let closed = Arc::clone(&closed);
-            scope.spawn(move || {
-                while !closed.load(Ordering::SeqCst) {
-                    let _ = updater.replace_sidecar(&validated);
-                }
-                for _ in 0..32 {
-                    assert!(matches!(
-                        updater.replace_sidecar(&validated),
-                        Err(GatewayPublicationError::PublicationClosed)
-                    ));
-                }
-            });
-        }
-        binding.updater().close_publication();
-        let closed_generation = binding.generation();
-        closed.store(true, Ordering::SeqCst);
-        std::thread::yield_now();
-        assert_eq!(
-            binding.generation(),
-            closed_generation,
-            "no publisher advances the generation after close returns"
-        );
-    });
-}
diff --git a/crates/workshop/gateway/src/binding/tests/shutdown.rs b/crates/workshop/gateway/src/binding/tests/shutdown.rs
deleted file mode 100644
index 374b7ec7b..000000000
--- a/crates/workshop/gateway/src/binding/tests/shutdown.rs
+++ /dev/null
@@ -1,179 +0,0 @@
-//! Binding shutdown authority: which identity a quit targets and who may post the shutdown.
-
-use super::*;
-
-use std::{sync::mpsc, time::Duration};
-
-const FIXTURE_PHASE_TIMEOUT: Duration = Duration::from_secs(10);
-
-#[derive(Clone, Copy)]
-enum PublicationOrder {
-    QuitFirst,
-    ReplacementFirst,
-}
-
-fn assert_shutdown_target(order: PublicationOrder) {
-    let mut original_gateway = crate::test_gateway::ValidatedGateway::spawn("original-key");
-    let mut replacement_gateway = crate::test_gateway::ValidatedGateway::spawn("replacement-key");
-    let original = validated_connection(
-        &original_gateway,
-        "original-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    );
-    let replacement = validated_connection(
-        &replacement_gateway,
-        "replacement-key",
-        1_778_000_002,
-        "2026-09-07T18:00:02Z",
-    );
-    let binding = GatewayBinding::new_with_identity(
-        &format!("http://127.0.0.1:{}", original.port()),
-        original.api_key(),
-        Some(original.clone()),
-    )
-    .expect("binding builds");
-    let updater = binding.updater();
-    let (publish, await_publish) = mpsc::sync_channel(0);
-    let (completed, await_completion) = mpsc::sync_channel(0);
-    let (quit, await_quit) = mpsc::sync_channel(0);
-
-    let shutdown_requested = std::thread::scope(|scope| {
-        let publish_updater = updater.clone();
-        let worker = scope.spawn(move || {
-            await_publish.recv().expect("publication is released");
-            publish_updater
-                .replace_sidecar(&replacement)
-                .expect("the replacement publishes");
-            completed.send(()).expect("publication is observed");
-        });
-        let shutdown_updater = updater;
-        let shutdown = scope.spawn(move || {
-            await_quit.recv().expect("quit is released");
-            shutdown_updater
-                .request_shutdown()
-                .expect("one coherent generation accepts shutdown")
-        });
-
-        let result = match order {
-            PublicationOrder::QuitFirst => {
-                quit.send(()).expect("release quit");
-                let result = shutdown.join().expect("shutdown does not panic");
-                publish.send(()).expect("release publication");
-                await_completion.recv().expect("observe publication");
-                result
-            }
-            PublicationOrder::ReplacementFirst => {
-                publish.send(()).expect("release publication");
-                await_completion.recv().expect("observe publication");
-                quit.send(()).expect("release quit");
-                shutdown.join().expect("shutdown does not panic")
-            }
-        };
-        worker.join().expect("publisher does not panic");
-        result
-    });
-
-    let original_hit = original_gateway.received_shutdown(FIXTURE_PHASE_TIMEOUT);
-    let replacement_hit = replacement_gateway.received_shutdown(FIXTURE_PHASE_TIMEOUT);
-    let expect_original = matches!(order, PublicationOrder::QuitFirst);
-    assert_eq!(
-        (shutdown_requested, original_hit, replacement_hit),
-        (true, expect_original, !expect_original),
-        "quit targets only the identity current at its controlled snapshot load"
-    );
-}
-
-#[test]
-fn quit_before_replacement_publication_targets_original_identity() {
-    assert_shutdown_target(PublicationOrder::QuitFirst);
-}
-
-#[test]
-fn quit_after_replacement_publication_targets_replacement_identity() {
-    assert_shutdown_target(PublicationOrder::ReplacementFirst);
-}
-
-#[test]
-fn configured_gateway_has_no_shutdown_authority() {
-    let binding =
-        GatewayBinding::new("http://192.0.2.10:8080", "configured-key").expect("binding builds");
-
-    assert!(
-        !binding
-            .updater()
-            .request_shutdown()
-            .expect("a configured Gateway is an intentional no-op"),
-        "the absence of validated local identity denies shutdown authority"
-    );
-}
-
-#[test]
-fn a_sidecar_snapshot_posts_the_authenticated_shutdown_itself() {
-    let mut gateway = crate::test_gateway::ValidatedGateway::spawn("snapshot-key");
-    let identity = validated_connection(
-        &gateway,
-        "snapshot-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    );
-    let base_url = format!("http://127.0.0.1:{}", identity.port());
-    let binding = GatewayBinding::new_with_identity(&base_url, "snapshot-key", Some(identity))
-        .expect("binding builds");
-    let snapshot = binding.snapshot();
-
-    assert!(snapshot.is_sidecar());
-    assert!(
-        snapshot
-            .request_shutdown()
-            .expect("the authenticated shutdown is accepted"),
-        "a sidecar snapshot reports the shutdown it sent"
-    );
-    assert!(
-        gateway.received_shutdown(FIXTURE_PHASE_TIMEOUT),
-        "the shutdown reaches the gateway the snapshot's identity names"
-    );
-}
-
-#[test]
-fn a_configured_snapshot_sends_no_shutdown_and_reports_false() {
-    let binding =
-        GatewayBinding::new("http://192.0.2.10:8080", "configured-key").expect("binding builds");
-    let snapshot = binding.snapshot();
-
-    assert!(!snapshot.is_sidecar());
-    assert!(
-        !snapshot
-            .request_shutdown()
-            .expect("a configured Gateway is an intentional no-op"),
-        "without a validated identity there is nothing to shut down"
-    );
-}
-
-#[test]
-fn publication_close_preserves_shutdown_authority_for_the_current_snapshot() {
-    let mut gateway = crate::test_gateway::ValidatedGateway::spawn("current-key");
-    let current = validated_connection(
-        &gateway,
-        "current-key",
-        1_778_000_001,
-        "2026-09-07T18:00:01Z",
-    );
-    let base_url = format!("http://127.0.0.1:{}", current.port());
-    let api_key = current.api_key().to_owned();
-    let binding = GatewayBinding::new_with_identity(&base_url, &api_key, Some(current))
-        .expect("binding builds");
-    let updater = binding.updater();
-
-    updater.close_publication();
-
-    assert!(
-        updater
-            .request_shutdown()
-            .expect("the current authenticated shutdown is accepted")
-    );
-    assert!(
-        gateway.received_shutdown(FIXTURE_PHASE_TIMEOUT),
-        "closure revokes future publication without tearing current shutdown authority"
-    );
-}
diff --git a/crates/workshop/gateway/src/client.rs b/crates/workshop/gateway/src/client.rs
deleted file mode 100644
index 66615b312..000000000
--- a/crates/workshop/gateway/src/client.rs
+++ /dev/null
@@ -1,372 +0,0 @@
-//! HTTP client for the Runvil gateway's OpenAI-compatible API.
-//!
-//! [`GatewayClient`] wraps `reqwest` with bearer authentication and returns
-//! responses as raw bytes so the workshop routes can relay them to the
-//! caller byte-for-byte. A non-success status from the gateway is *not* an
-//! error here: it is part of the relayed response. The progress
-//! subscription is decoded from SSE into a [`ProgressStream`] of decoded
-//! snapshots.
-
-use std::fmt;
-use std::time::Duration;
-
-mod events;
-mod progress_stream;
-mod socket;
-mod sse;
-
-pub use events::{ForwardedResponse, GatewayResponse, SwitchProfileBody, SwitchResponse};
-pub(crate) use progress_stream::ProgressStream;
-pub use socket::GatewayRealtimeSocket;
-use sse::read;
-
-/// Default bound on a single `GET /health` probe: a gateway that accepts
-/// the connection but never answers must still read as unreachable, and two
-/// seconds keeps the probe well under the heartbeat interval it serves.
-pub(crate) const HEALTH_PROBE_TIMEOUT: Duration = Duration::from_secs(2);
-
-/// TCP connect timeout applied to every request. A gateway that is down or
-/// unreachable should fail fast rather than hanging for the OS default (~21 s
-/// on Linux, ~75 s on Windows).
-const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
-
-/// Default whole-request timeout for non-streaming operations: the model
-/// catalog fetch and the profile selection. Forwarded requests and the
-/// progress subscription can legitimately run for minutes, so the same
-/// bound covers only their header phase (see `send_bounded`) and the
-/// body stays open-ended.
-pub const REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
-
-/// A gateway request failure.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum GatewayError {
-    /// The HTTP client could not be built.
-    #[non_exhaustive]
-    #[error("build gateway http client")]
-    Build(#[source] Box<dyn std::error::Error + Send + Sync>),
-
-    /// The request could not be sent or no response arrived (connect
-    /// refused, DNS, TLS, timeout).
-    #[non_exhaustive]
-    #[error("gateway transport error")]
-    Transport(#[source] Box<dyn std::error::Error + Send + Sync>),
-
-    /// The response body could not be read to completion.
-    #[non_exhaustive]
-    #[error("read gateway response body")]
-    ReadBody(#[source] Box<dyn std::error::Error + Send + Sync>),
-
-    /// The gateway answered a streaming-only request with a non-success
-    /// status (for example 401 on a rejected token). The body is bounded
-    /// and control-escaped.
-    #[non_exhaustive]
-    #[error("gateway answered status {status}: {body}")]
-    Status {
-        /// The gateway's status code.
-        status: reqwest::StatusCode,
-        /// The gateway's error body, bounded and control-escaped.
-        body: String,
-    },
-
-    /// A gateway event stream contained a block that could not be decoded,
-    /// one that grew past its size bound without terminating, or a
-    /// success answer whose body was not the documented JSON shape.
-    #[non_exhaustive]
-    #[error("malformed gateway answer: {message}")]
-    Malformed {
-        /// What was wrong with the block or body.
-        message: String,
-        /// The decode failure, when the block or body was undecodable.
-        #[source]
-        source: Option<Box<dyn std::error::Error + Send + Sync>>,
-    },
-}
-
-impl GatewayError {
-    /// A transport failure manufactured by a test, for the server's
-    /// error-mapping fixtures.
-    #[cfg(feature = "test-fixtures")]
-    #[must_use]
-    pub fn transport_for_test(source: Box<dyn std::error::Error + Send + Sync>) -> Self {
-        Self::Transport(source)
-    }
-}
-
-/// Bearer-authenticated client for the gateway's OpenAI-compatible
-/// endpoints. An empty API key omits the `Authorization` header entirely,
-/// for gateways running with authentication disabled.
-#[derive(Clone)]
-pub struct GatewayClient {
-    http: reqwest::Client,
-    pub(crate) base_url: String,
-    pub(crate) api_key: String,
-    /// Whole-request bound for buffered calls; header-phase bound for
-    /// streaming calls.
-    request_timeout: Duration,
-    /// Whole-request bound for the health probe.
-    health_timeout: Duration,
-}
-
-// Manual so the bearer key is never written to logs.
-impl fmt::Debug for GatewayClient {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("GatewayClient")
-            .field("base_url", &self.base_url)
-            .field("api_key", &"<redacted>")
-            .finish_non_exhaustive()
-    }
-}
-
-impl GatewayClient {
-    /// Builds a client for `base_url` authenticating with `api_key`.
-    ///
-    /// A trailing slash on `base_url` is trimmed so route joins stay clean.
-    /// An empty `api_key` disables authentication: requests then omit the
-    /// `Authorization` header.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Build`] if the TLS backend cannot initialize.
-    pub fn new(base_url: &str, api_key: &str) -> Result<Self, GatewayError> {
-        let http = reqwest::Client::builder()
-            .connect_timeout(CONNECT_TIMEOUT)
-            .build()
-            .map_err(|source| GatewayError::Build(Box::new(source)))?;
-        Ok(Self {
-            http,
-            base_url: base_url.trim_end_matches('/').to_string(),
-            api_key: api_key.to_string(),
-            request_timeout: REQUEST_TIMEOUT,
-            health_timeout: HEALTH_PROBE_TIMEOUT,
-        })
-    }
-
-    /// Overrides the request and probe bounds, so tests can trip them
-    /// without waiting out the production values.
-    #[cfg(test)]
-    pub(crate) fn with_timeouts_for_test(mut self, request: Duration, health: Duration) -> Self {
-        self.request_timeout = request;
-        self.health_timeout = health;
-        self
-    }
-
-    /// Sends `request`, bounding the wait for the response headers on the
-    /// client's request timeout.
-    ///
-    /// The streaming calls use this instead of a whole-request timeout: a
-    /// gateway that accepts the connection and then stalls must fail the
-    /// call rather than hang its caller, but an accepted stream may
-    /// legitimately run for minutes, so only the header phase is bounded
-    /// and the body stream stays open-ended.
-    async fn send_bounded(
-        &self,
-        request: reqwest::RequestBuilder,
-    ) -> Result<reqwest::Response, GatewayError> {
-        match tokio::time::timeout(self.request_timeout, request.send()).await {
-            Ok(Ok(response)) => Ok(response),
-            Ok(Err(source)) => Err(GatewayError::Transport(Box::new(source))),
-            Err(elapsed) => Err(GatewayError::Transport(Box::new(elapsed))),
-        }
-    }
-
-    /// Applies bearer authentication to `request`, unless the client was
-    /// built with an empty API key, in which case the request goes out with
-    /// no `Authorization` header.
-    fn authorize(&self, request: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
-        if self.api_key.is_empty() {
-            request
-        } else {
-            request.bearer_auth(&self.api_key)
-        }
-    }
-
-    /// The gateway's base URL as configured, trailing slash trimmed -
-    /// also the origin the config-panel iframe loads from.
-    #[must_use]
-    pub fn base_url(&self) -> &str {
-        &self.base_url
-    }
-
-    /// Forwards one request to the gateway: `method` on
-    /// `path_and_query`, with an optional JSON `body`, authenticated
-    /// with the client's bearer key. Only the wait for the response
-    /// headers is bounded - a forwarded cache download or config apply
-    /// legitimately runs for minutes - and the whole body is buffered
-    /// for relay. A non-success status is relayed in the returned
-    /// [`ForwardedResponse`].
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed (the header bound elapsing included) and
-    /// [`GatewayError::ReadBody`] if the response body cannot be read.
-    pub async fn forward(
-        &self,
-        method: reqwest::Method,
-        path_and_query: &str,
-        body: Option<Vec<u8>>,
-    ) -> Result<ForwardedResponse, GatewayError> {
-        let mut request = self.authorize(
-            self.http
-                .request(method, format!("{}{}", self.base_url, path_and_query)),
-        );
-        if let Some(bytes) = body {
-            request = request
-                .header(reqwest::header::CONTENT_TYPE, "application/json")
-                .body(bytes);
-        }
-        let response = self.send_bounded(request).await?;
-        let status = response.status();
-        let content_type = response
-            .headers()
-            .get(reqwest::header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok())
-            .map(str::to_string);
-        let body = response
-            .bytes()
-            .await
-            .map_err(|source| GatewayError::ReadBody(Box::new(source)))?
-            .to_vec();
-        Ok(ForwardedResponse {
-            status,
-            content_type,
-            body,
-        })
-    }
-
-    /// Probes the gateway's liveness endpoint, `GET /health`.
-    ///
-    /// Returns `true` only when the gateway answers with a success status:
-    /// a transport failure, a probe timeout, or a non-success answer all
-    /// read as unreachable. The request never includes the client's API key
-    /// (the endpoint is unauthenticated by design) and is capped at the
-    /// probe bound (`HEALTH_PROBE_TIMEOUT` by default).
-    pub async fn health(&self) -> bool {
-        let probe = self
-            .http
-            .get(format!("{}/health", self.base_url))
-            .timeout(self.health_timeout);
-        match probe.send().await {
-            Ok(response) => response.status().is_success(),
-            Err(_) => false,
-        }
-    }
-
-    /// Fetches the gateway's model catalog from `GET /v1/models`.
-    ///
-    /// A non-success status is relayed in the returned [`GatewayResponse`].
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed and [`GatewayError::ReadBody`] if the response body cannot
-    /// be read.
-    pub async fn list_models(&self) -> Result<GatewayResponse, GatewayError> {
-        self.get_json("/v1/models").await
-    }
-
-    /// Fetches the gateway's profile list from `GET /admin/profiles`.
-    ///
-    /// A non-success status is relayed in the returned [`GatewayResponse`].
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed and [`GatewayError::ReadBody`] if the response body cannot
-    /// be read.
-    pub async fn list_profiles(&self) -> Result<GatewayResponse, GatewayError> {
-        self.get_json("/admin/profiles").await
-    }
-
-    /// Fetches the gateway's live status from `GET /admin/status`, which
-    /// reports the active profile's name.
-    ///
-    /// A non-success status is relayed in the returned [`GatewayResponse`].
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed and [`GatewayError::ReadBody`] if the response body cannot
-    /// be read.
-    pub async fn profile_status(&self) -> Result<GatewayResponse, GatewayError> {
-        self.get_json("/admin/status").await
-    }
-
-    /// Sends an authorized `GET` for `path` under the whole-request bound
-    /// and buffers the answer, non-success status included.
-    async fn get_json(&self, path: &str) -> Result<GatewayResponse, GatewayError> {
-        let response = self
-            .authorize(self.http.get(format!("{}{path}", self.base_url)))
-            .timeout(self.request_timeout)
-            .send()
-            .await
-            .map_err(|source| GatewayError::Transport(Box::new(source)))?;
-        read(response).await
-    }
-
-    /// Posts a profile selection to `POST /admin/switch-profile`: `name`
-    /// selects a defined profile, `None` selects no profile (`null` on
-    /// the wire).
-    ///
-    /// The gateway persists the selection and answers one JSON document,
-    /// returned as [`SwitchResponse::Selected`], reporting whether it
-    /// must restart to serve the selection; the caller decides how that
-    /// restart happens. A non-success answer is buffered and returned.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed, [`GatewayError::ReadBody`] if the answer's body cannot
-    /// be read, and [`GatewayError::Malformed`] when a success answer is
-    /// not the documented outcome shape.
-    pub async fn switch_profile(&self, name: Option<&str>) -> Result<SwitchResponse, GatewayError> {
-        let response = self
-            .authorize(
-                self.http
-                    .post(format!("{}/admin/switch-profile", self.base_url)),
-            )
-            .timeout(self.request_timeout)
-            .json(&serde_json::json!({ "name": name }))
-            .send()
-            .await
-            .map_err(|source| GatewayError::Transport(Box::new(source)))?;
-        let answer = read(response).await?;
-        if !answer.status.is_success() {
-            return Ok(SwitchResponse::Buffered(answer));
-        }
-        serde_json::from_slice::<SwitchProfileBody>(&answer.body)
-            .map(SwitchResponse::Selected)
-            .map_err(|source| GatewayError::Malformed {
-                message: "the switch-profile answer is not the outcome document".to_owned(),
-                source: Some(Box::new(source)),
-            })
-    }
-
-    /// Subscribes to the gateway's `GET /admin/progress` event stream.
-    ///
-    /// The returned stream yields every progress event the gateway
-    /// sends, beginning with the snapshot replay of the operations live
-    /// at connect time. Heartbeat comment lines and other non-`data:`
-    /// lines are skipped. Intermediate events are lossy at the source,
-    /// so the stream can drop samples; detect completion only from
-    /// `Finished` events, never from a fraction reaching 1.0. Only the
-    /// wait for the response headers is bounded: the subscription is
-    /// long-lived by design, so the stream itself runs without a deadline.
-    /// The stream ends when the gateway closes the body; whether to
-    /// resubscribe is the caller's decision.
-    ///
-    /// The endpoint answers only an event stream on success, so a
-    /// non-success status (for example 401 on a rejected token) is a
-    /// [`GatewayError::Status`], not a relayed response. Decode failures
-    /// surface as per-item errors instead.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the request cannot be
-    /// completed (the header bound elapsing included),
-    /// [`GatewayError::Status`] on a non-success status, and
-    /// [`GatewayError::ReadBody`] when that answer's body cannot be
-    /// read.
-    pub async fn subscribe_progress(&self) -> Result<ProgressStream, GatewayError> {
-        let request = self.authorize(self.http.get(format!("{}/admin/progress", self.base_url)));
-        let response = self.send_bounded(request).await?;
-        progress_stream::subscribe(response).await
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/gateway/src/client/events.rs b/crates/workshop/gateway/src/client/events.rs
deleted file mode 100644
index 056cef5be..000000000
--- a/crates/workshop/gateway/src/client/events.rs
+++ /dev/null
@@ -1,55 +0,0 @@
-//! The gateway client's wire types: the buffered relay response, the
-//! forwarded config-panel response, and the profile-selection outcome.
-
-use serde::Deserialize;
-
-/// A gateway HTTP response captured for verbatim relay.
-#[derive(Debug)]
-pub struct GatewayResponse {
-    /// The gateway's status code, relayed unchanged.
-    pub status: reqwest::StatusCode,
-    /// The gateway's response body, relayed byte-for-byte.
-    pub body: Vec<u8>,
-}
-
-/// A gateway response captured for the config-panel proxy: the relay
-/// keeps the content type alongside the status and body, because the
-/// config UI distinguishes a buffered JSON answer from an SSE stream by
-/// it.
-#[derive(Debug)]
-pub struct ForwardedResponse {
-    /// The gateway's status code, relayed unchanged.
-    pub status: reqwest::StatusCode,
-    /// The gateway's `Content-Type`, when it sent one.
-    pub content_type: Option<String>,
-    /// The gateway's response body, relayed byte-for-byte.
-    pub body: Vec<u8>,
-}
-
-/// The gateway's answer to a profile selection, `POST /admin/switch-profile`.
-///
-/// An accepted selection answers one JSON document decoding as
-/// [`SwitchProfileBody`]: the gateway persisted the selection and reports
-/// whether it must restart to load it. A refusal (bad auth, a malformed or
-/// undefined name) is buffered rather than reported as an error, matching
-/// the relay contract of the other client methods.
-#[derive(Debug)]
-#[non_exhaustive]
-pub enum SwitchResponse {
-    /// The gateway accepted and persisted the selection.
-    Selected(SwitchProfileBody),
-
-    /// A refusal, buffered: the gateway's error envelope.
-    Buffered(GatewayResponse),
-}
-
-/// The body of an accepted profile selection.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-pub struct SwitchProfileBody {
-    /// The selection now persisted: a profile name, or `None` for no
-    /// profile.
-    pub profile: Option<String>,
-    /// Whether the gateway must restart before the selection is served;
-    /// `false` when the selection already matches the running profile.
-    pub restart_required: bool,
-}
diff --git a/crates/workshop/gateway/src/client/progress_stream.rs b/crates/workshop/gateway/src/client/progress_stream.rs
deleted file mode 100644
index bf6f9cf65..000000000
--- a/crates/workshop/gateway/src/client/progress_stream.rs
+++ /dev/null
@@ -1,210 +0,0 @@
-//! The `GET /admin/progress` subscription: a long-lived SSE stream of
-//! [`Progress`] snapshots, decoded block-by-block under a hard size
-//! bound.
-//!
-//! Unlike a profile switch, which answers a single JSON document, a
-//! progress subscription never terminates on its own and yields
-//! snapshots the workshop renders verbatim, so the decode keeps the
-//! stricter posture the subscriber always had: only
-//! blank-line-terminated blocks dispatch (an incomplete trailing block
-//! is discarded), and a block that grows past `MAX_EVENT_BLOCK` without
-//! its terminator is refused rather than buffered unbounded.
-
-use std::pin::Pin;
-
-use super::super::progress::Progress;
-use futures_util::Stream;
-
-use super::GatewayError;
-
-/// The largest single SSE event block buffered before the stream refuses
-/// it, in bytes. A peer that never sends a blank-line terminator would
-/// otherwise grow the reassembly buffer unbounded; sized well above any
-/// realistic progress event.
-pub(super) const MAX_EVENT_BLOCK: usize = 1024 * 1024;
-
-/// The largest error body kept for a subscription diagnostic, in bytes.
-const MAX_ERROR_BODY: usize = 2000;
-
-/// A stream of decoded [`Progress`] snapshots from the gateway, in
-/// arrival order.
-///
-/// A `data:` block that does not decode is yielded as one error item
-/// without ending the stream; a read failure or an event block oversized
-/// beyond `MAX_EVENT_BLOCK` is yielded as one error item that ends the
-/// stream. The stream ends when the gateway closes the body; whether to
-/// resubscribe is the caller's decision.
-pub(crate) type ProgressStream = Pin<Box<dyn Stream<Item = Result<Progress, GatewayError>> + Send>>;
-
-/// Turns an answered `GET /admin/progress` request into the snapshot
-/// stream.
-///
-/// The endpoint answers only an event stream on success, so a
-/// non-success status is [`GatewayError::Status`] with a bounded,
-/// control-escaped body rather than a relayed response.
-pub(super) async fn subscribe(response: reqwest::Response) -> Result<ProgressStream, GatewayError> {
-    let status = response.status();
-    if !status.is_success() {
-        return Err(GatewayError::Status {
-            status,
-            body: error_body(response).await?,
-        });
-    }
-    Ok(decode(response))
-}
-
-/// Reads at most [`MAX_ERROR_BODY`] bytes of a non-success response
-/// body, escaping control characters so a hostile body cannot forge log
-/// lines or smuggle terminal control sequences into a diagnostic.
-async fn error_body(mut response: reqwest::Response) -> Result<String, GatewayError> {
-    let mut buffer: Vec<u8> = Vec::new();
-    while buffer.len() < MAX_ERROR_BODY {
-        match response.chunk().await {
-            Ok(Some(chunk)) => {
-                let take = (MAX_ERROR_BODY - buffer.len()).min(chunk.len());
-                buffer.extend_from_slice(&chunk[..take]);
-                if take < chunk.len() {
-                    break;
-                }
-            }
-            Ok(None) => break,
-            Err(source) => return Err(GatewayError::ReadBody(Box::new(source))),
-        }
-    }
-    if buffer.is_empty() {
-        return Ok("(empty body)".to_owned());
-    }
-    let lossy = String::from_utf8_lossy(&buffer);
-    let mut escaped = String::with_capacity(lossy.len());
-    for ch in lossy.chars() {
-        if ch.is_control() {
-            escaped.extend(ch.escape_default());
-        } else {
-            escaped.push(ch);
-        }
-    }
-    Ok(escaped)
-}
-
-/// Decodes an SSE body into a snapshot stream: chunks are buffered
-/// until a blank line terminates an event block (CRLF, LF, or CR line
-/// endings alike), comment-only blocks (heartbeats) are skipped, and an
-/// undecodable block becomes one error item rather than killing the
-/// stream. A mid-stream read failure likewise surfaces as one error
-/// item, after which the stream ends. A block that grows past
-/// [`MAX_EVENT_BLOCK`] without a terminator is refused as one error
-/// item, after which the stream ends, so a peer cannot buffer the client
-/// unbounded.
-fn decode(response: reqwest::Response) -> ProgressStream {
-    let events = futures_util::stream::unfold(
-        (response, Vec::new(), false),
-        |(mut response, mut buffer, mut failed)| async move {
-            loop {
-                if let Some(item) = next_buffered_event(&mut buffer) {
-                    return Some((item, (response, buffer, failed)));
-                }
-                if failed {
-                    return None;
-                }
-                match response.chunk().await {
-                    Ok(Some(chunk)) => {
-                        if buffer.len() + chunk.len() > MAX_EVENT_BLOCK {
-                            failed = true;
-                            let item = Err(GatewayError::Malformed {
-                                message: format!(
-                                    "progress event block exceeds the {MAX_EVENT_BLOCK}-byte limit"
-                                ),
-                                source: None,
-                            });
-                            return Some((item, (response, buffer, failed)));
-                        }
-                        buffer.extend_from_slice(&chunk);
-                    }
-                    // An incomplete trailing block is discarded, matching
-                    // the SSE rule that only blank-line-terminated blocks
-                    // dispatch.
-                    Ok(None) => return None,
-                    Err(source) => {
-                        failed = true;
-                        let item = Err(GatewayError::ReadBody(Box::new(source)));
-                        return Some((item, (response, buffer, failed)));
-                    }
-                }
-            }
-        },
-    );
-    Box::pin(events)
-}
-
-/// Pops the next decodable snapshot out of `buffer`, or `None` when no
-/// complete block is buffered yet. Comment-only blocks (heartbeats) are
-/// consumed and skipped.
-fn next_buffered_event(buffer: &mut Vec<u8>) -> Option<Result<Progress, GatewayError>> {
-    loop {
-        let end = block_end(buffer)?;
-        let block: Vec<u8> = buffer.drain(..end).collect();
-        if let Some(item) = parse_event_block(&block) {
-            return Some(item);
-        }
-    }
-}
-
-/// The end (terminator included) of the first complete event block: a
-/// blank line, whether the peer terminates its lines with CRLF, LF, CR,
-/// or a mix.
-///
-/// A CR that ends the buffer counts as a whole terminator, so a CR-only
-/// peer dispatches without waiting for its next chunk. When that CR was
-/// half of a split CRLF, the orphaned LF opens the next block as an empty
-/// line, which carries no payload and is skipped.
-fn block_end(buffer: &[u8]) -> Option<usize> {
-    let mut start = 0;
-    loop {
-        let (length, next) = first_line(buffer.get(start..)?)?;
-        if length == 0 {
-            return Some(start + next);
-        }
-        start += next;
-    }
-}
-
-/// The length of the first line in `bytes` and the offset just past its
-/// CRLF, LF, or CR terminator, or `None` when no terminator is buffered.
-fn first_line(bytes: &[u8]) -> Option<(usize, usize)> {
-    let length = bytes
-        .iter()
-        .position(|byte| matches!(byte, b'\r' | b'\n'))?;
-    let terminator = if bytes[length..].starts_with(b"\r\n") {
-        2
-    } else {
-        1
-    };
-    Some((length, length + terminator))
-}
-
-/// Decodes one SSE event block: `data:` lines join into the payload,
-/// comment lines and unrecognized fields are ignored, and a block with
-/// no payload (a heartbeat) yields `None`.
-fn parse_event_block(block: &[u8]) -> Option<Result<Progress, GatewayError>> {
-    let mut data: Vec<u8> = Vec::new();
-    let mut unread = block;
-    while let Some((length, next)) = first_line(unread) {
-        let line = &unread[..length];
-        unread = &unread[next..];
-        if let Some(rest) = line.strip_prefix(b"data:") {
-            if !data.is_empty() {
-                data.push(b'\n');
-            }
-            data.extend_from_slice(rest.strip_prefix(b" ").unwrap_or(rest));
-        }
-    }
-    if data.is_empty() {
-        return None;
-    }
-    Some(
-        serde_json::from_slice(&data).map_err(|source| GatewayError::Malformed {
-            message: "progress snapshot was not a valid {busy, text} JSON object".to_owned(),
-            source: Some(Box::new(source)),
-        }),
-    )
-}
diff --git a/crates/workshop/gateway/src/client/socket.rs b/crates/workshop/gateway/src/client/socket.rs
deleted file mode 100644
index f093e785d..000000000
--- a/crates/workshop/gateway/src/client/socket.rs
+++ /dev/null
@@ -1,73 +0,0 @@
-//! Authenticated WebSocket connections from the workshop to the gateway.
-
-use tokio_tungstenite::tungstenite::client::IntoClientRequest as _;
-
-use super::{GatewayClient, GatewayError};
-
-/// An authenticated WebSocket connection to the gateway's Realtime transcription.
-pub type GatewayRealtimeSocket =
-    tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
-
-impl GatewayClient {
-    /// Opens the gateway's authenticated Realtime transcription socket.
-    ///
-    /// The target is fixed to `/v1/realtime?intent=transcription`; browser
-    /// query parameters and handshake policy headers never cross the relay.
-    ///
-    /// # Errors
-    /// Returns [`GatewayError::Transport`] if the socket cannot be
-    /// connected (the header bound elapsing included).
-    pub async fn connect_realtime(&self) -> Result<GatewayRealtimeSocket, GatewayError> {
-        let mut request = realtime_url(&self.base_url)?
-            .as_str()
-            .into_client_request()
-            .map_err(|source| GatewayError::Transport(Box::new(source)))?;
-        if !self.api_key.is_empty() {
-            let value = format!("Bearer {}", self.api_key)
-                .parse()
-                .map_err(|source| GatewayError::Transport(Box::new(source)))?;
-            request.headers_mut().insert(
-                tokio_tungstenite::tungstenite::http::header::AUTHORIZATION,
-                value,
-            );
-        }
-        match tokio::time::timeout(
-            self.request_timeout,
-            tokio_tungstenite::connect_async(request),
-        )
-        .await
-        {
-            Ok(Ok((socket, _response))) => Ok(socket),
-            Ok(Err(source)) => Err(GatewayError::Transport(Box::new(source))),
-            Err(elapsed) => Err(GatewayError::Transport(Box::new(elapsed))),
-        }
-    }
-}
-
-/// The Realtime transcription URL under `base_url`, upgraded to its
-/// WebSocket scheme: http to ws and https to wss.
-pub(super) fn realtime_url(base_url: &str) -> Result<url::Url, GatewayError> {
-    let mut url =
-        url::Url::parse(base_url).map_err(|source| GatewayError::Transport(Box::new(source)))?;
-    let scheme = match url.scheme() {
-        "http" => "ws",
-        "https" => "wss",
-        scheme => {
-            return Err(GatewayError::Transport(Box::new(std::io::Error::new(
-                std::io::ErrorKind::InvalidInput,
-                format!("gateway URL scheme {scheme:?} cannot be upgraded to a WebSocket"),
-            ))));
-        }
-    };
-    url.set_scheme(scheme).map_err(|()| {
-        GatewayError::Transport(Box::new(std::io::Error::new(
-            std::io::ErrorKind::InvalidInput,
-            "gateway URL scheme cannot be converted to WebSocket",
-        )))
-    })?;
-    let path = format!("{}/v1/realtime", url.path().trim_end_matches('/'));
-    url.set_path(&path);
-    url.set_query(Some("intent=transcription"));
-    url.set_fragment(None);
-    Ok(url)
-}
diff --git a/crates/workshop/gateway/src/client/sse.rs b/crates/workshop/gateway/src/client/sse.rs
deleted file mode 100644
index c09e2bf15..000000000
--- a/crates/workshop/gateway/src/client/sse.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-//! Response-body capture for the gateway client's buffered calls.
-
-use super::{GatewayError, GatewayResponse};
-
-/// Captures the status and raw body of a gateway response.
-pub(super) async fn read(response: reqwest::Response) -> Result<GatewayResponse, GatewayError> {
-    let status = response.status();
-    let body = response
-        .bytes()
-        .await
-        .map_err(|source| GatewayError::ReadBody(Box::new(source)))?
-        .to_vec();
-    Ok(GatewayResponse { status, body })
-}
diff --git a/crates/workshop/gateway/src/client/tests.rs b/crates/workshop/gateway/src/client/tests.rs
deleted file mode 100644
index 527976c63..000000000
--- a/crates/workshop/gateway/src/client/tests.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-//! Tests for the gateway client: the client basics live here beside the
-//! shared mock-server helper; the progress, socket, switch, and timeout
-//! areas each have their own submodule.
-
-use super::*;
-
-mod progress;
-mod socket;
-mod switch;
-mod timeouts;
-
-/// Binds `app` on a free loopback port and returns its base URL.
-async fn serve(app: axum::Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
-
-#[test]
-fn trailing_slash_is_trimmed_from_base_url() {
-    let client = GatewayClient::new("http://127.0.0.1:8081/", "k").expect("client builds");
-    assert_eq!(client.base_url, "http://127.0.0.1:8081");
-}
-
-#[test]
-fn debug_redacts_the_api_key() {
-    let client = GatewayClient::new("http://127.0.0.1:8081", "secret-key").expect("client");
-    let rendered = format!("{client:?}");
-    assert!(!rendered.contains("secret-key"), "key leaked: {rendered}");
-}
-
-#[tokio::test]
-async fn each_catalog_read_sends_the_bearer_to_its_own_route() {
-    fn echo(route: &'static str) -> axum::routing::MethodRouter {
-        axum::routing::get(move |headers: axum::http::HeaderMap| async move {
-            let auth = headers
-                .get(axum::http::header::AUTHORIZATION)
-                .and_then(|value| value.to_str().ok())
-                .unwrap_or_default()
-                .to_owned();
-            format!("{route} {auth}")
-        })
-    }
-    let app = axum::Router::new()
-        .route("/v1/models", echo("models"))
-        .route("/admin/profiles", echo("profiles"))
-        .route("/admin/status", echo("status"));
-    let client = GatewayClient::new(&serve(app).await, "tok").expect("client builds in tests");
-
-    for (read, expected) in [
-        (client.list_models().await, "models Bearer tok"),
-        (client.list_profiles().await, "profiles Bearer tok"),
-        (client.profile_status().await, "status Bearer tok"),
-    ] {
-        let response = read.expect("the read completes");
-        assert!(
-            response.status.is_success(),
-            "{expected}: {}",
-            response.status
-        );
-        assert_eq!(String::from_utf8_lossy(&response.body), expected);
-    }
-}
diff --git a/crates/workshop/gateway/src/client/tests/progress.rs b/crates/workshop/gateway/src/client/tests/progress.rs
deleted file mode 100644
index a325cfbab..000000000
--- a/crates/workshop/gateway/src/client/tests/progress.rs
+++ /dev/null
@@ -1,319 +0,0 @@
-//! Progress-subscription tests: the `GET /admin/progress` event stream
-//! decodes block-by-block, heartbeat comments are skipped, a malformed
-//! block degrades to one error item without ending the stream, a read
-//! failure or an oversized block ends it, and a non-success status is an
-//! error rather than a stream.
-
-use super::*;
-
-use futures_util::StreamExt as _;
-
-use crate::client::progress_stream::MAX_EVENT_BLOCK;
-use crate::progress::Progress;
-
-/// Serializes a wire-format progress snapshot by hand, so the tests pin
-/// the JSON shape the gateway emits rather than the types crate's
-/// serializer.
-fn snapshot_json(busy: bool, text: &str) -> String {
-    serde_json::json!({"busy": busy, "text": text}).to_string()
-}
-
-/// The decoded snapshot as a `(busy, text)` pair.
-fn decoded(item: &Result<Progress, GatewayError>) -> (bool, String) {
-    let snapshot = item.as_ref().expect("every item decodes");
-    (snapshot.busy, snapshot.text.clone())
-}
-
-/// A mock `GET /admin/progress` that requires the bearer token and
-/// answers with `body` as the verbatim SSE payload.
-fn mock_progress(body: String) -> axum::Router {
-    use axum::Router;
-    use axum::response::IntoResponse;
-    use axum::routing::get;
-
-    Router::new().route(
-        "/admin/progress",
-        get(move |headers: axum::http::HeaderMap| {
-            let body = body.clone();
-            async move {
-                let auth = headers
-                    .get(axum::http::header::AUTHORIZATION)
-                    .and_then(|value| value.to_str().ok());
-                if auth != Some("Bearer tok") {
-                    return (axum::http::StatusCode::UNAUTHORIZED, "bad token").into_response();
-                }
-                (
-                    [(axum::http::header::CONTENT_TYPE, "text/event-stream")],
-                    body,
-                )
-                    .into_response()
-            }
-        }),
-    )
-}
-
-/// A mock `GET /admin/progress` that answers with each of `chunks` as its
-/// own body chunk, so a test controls where the SSE payload splits.
-fn mock_progress_chunks(chunks: Vec<String>) -> axum::Router {
-    axum::Router::new().route(
-        "/admin/progress",
-        axum::routing::get(move || {
-            let chunks: Vec<Result<String, std::convert::Infallible>> =
-                chunks.iter().cloned().map(Ok).collect();
-            async move {
-                (
-                    [(axum::http::header::CONTENT_TYPE, "text/event-stream")],
-                    axum::body::Body::from_stream(futures_util::stream::iter(chunks)),
-                )
-            }
-        }),
-    )
-}
-
-/// Subscribes against `app` and collects the whole event stream.
-async fn collect_events(app: axum::Router) -> Vec<Result<Progress, GatewayError>> {
-    let base_url = serve(app).await;
-    let client = GatewayClient::new(&base_url, "tok").expect("client builds in tests");
-    let events = client
-        .subscribe_progress()
-        .await
-        .expect("a well-formed stream subscribes");
-    events.collect().await
-}
-
-#[tokio::test]
-async fn subscribe_progress_decodes_snapshots_and_skips_heartbeat_comments() {
-    let begun = snapshot_json(true, "Downloading qwen3-8b.gguf");
-    let updated = snapshot_json(true, "Downloading qwen3-8b.gguf 45%");
-    let idle = snapshot_json(false, "");
-    let body = format!(
-        ": heartbeat\n\ndata: {begun}\n\ndata: {updated}\n\n: heartbeat\n\ndata: {idle}\n\n"
-    );
-
-    let events = collect_events(mock_progress(body)).await;
-
-    let snapshots: Vec<(bool, String)> = events.iter().map(decoded).collect();
-    assert_eq!(
-        snapshots,
-        vec![
-            (true, "Downloading qwen3-8b.gguf".to_owned()),
-            (true, "Downloading qwen3-8b.gguf 45%".to_owned()),
-            (false, String::new()),
-        ],
-        "each data block decodes to one busy/text snapshot in arrival order"
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_classifies_a_non_success_status() {
-    let base_url = serve(mock_progress(String::new())).await;
-    let client = GatewayClient::new(&base_url, "wrong-token").expect("client builds in tests");
-
-    let Err(error) = client.subscribe_progress().await else {
-        panic!("a 401 response must surface as an error");
-    };
-    let GatewayError::Status { status, body } = &error else {
-        panic!("a 401 response is a status error, got {error}");
-    };
-    assert_eq!(status.as_u16(), 401);
-    assert_eq!(body, "bad token");
-}
-
-#[tokio::test]
-async fn subscribe_progress_yields_one_error_per_bad_event_and_continues() {
-    let begun = snapshot_json(true, "Loading profile");
-    let finished = snapshot_json(false, "");
-    let body = format!("data: {begun}\n\ndata: {{not json\n\ndata: {finished}\n\n");
-
-    let events = collect_events(mock_progress(body)).await;
-
-    assert_eq!(events.len(), 3, "one item per data block");
-    assert!(events[0].is_ok(), "the leading event decodes");
-    let error = events[1]
-        .as_ref()
-        .expect_err("the undecodable line is one error item");
-    assert!(
-        matches!(error, GatewayError::Malformed { .. }),
-        "an undecodable block is a malformed error, got {error}"
-    );
-    assert!(
-        events[2].is_ok(),
-        "a bad line must not end the stream: the trailing event still arrives"
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_reassembles_an_event_split_across_chunks() {
-    let begun = snapshot_json(true, "Loading profile");
-    let wire = format!("data: {begun}\n\n");
-    let (head, tail) = wire.split_at(wire.len() / 2);
-    let app = mock_progress_chunks(vec![head.to_owned(), tail.to_owned()]);
-
-    let events = collect_events(app).await;
-
-    assert_eq!(events.len(), 1, "the split block decodes as one event");
-    assert!(events[0].is_ok(), "the reassembled event decodes");
-}
-
-#[tokio::test]
-async fn subscribe_progress_skips_the_orphaned_lf_of_a_crlf_split_across_chunks() {
-    // The first chunk ends on the blank line's CR, so its block dispatches
-    // at once, and the LF that opens the next chunk is an empty line.
-    let begun = snapshot_json(true, "Loading profile");
-    let finished = snapshot_json(false, "");
-    let head = format!("data: {begun}\r\n\r");
-    let tail = format!("\ndata: {finished}\r\n\r\n");
-
-    let events = collect_events(mock_progress_chunks(vec![head, tail])).await;
-
-    let snapshots: Vec<(bool, String)> = events.iter().map(decoded).collect();
-    assert_eq!(
-        snapshots,
-        vec![(true, "Loading profile".to_owned()), (false, String::new())],
-        "both events decode and the orphaned LF yields nothing"
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_yields_one_error_on_a_mid_stream_read_failure_then_ends() {
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-    // The server promises a large body, delivers one complete event, then
-    // drops the connection: the read failure must surface as one error
-    // item that ends the stream, not as a hang or a silent close.
-    let begun = snapshot_json(true, "Loading profile");
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let addr = listener.local_addr().unwrap();
-    tokio::spawn(async move {
-        if let Ok((mut sock, _)) = listener.accept().await {
-            let mut buf = [0u8; 1024];
-            let _ = sock.read(&mut buf).await;
-            let header = "HTTP/1.1 200 OK\r\n\
-                 Content-Type: text/event-stream\r\n\
-                 Content-Length: 1000000\r\n\r\n";
-            let _ = sock.write_all(header.as_bytes()).await;
-            let _ = sock
-                .write_all(format!("data: {begun}\n\n").as_bytes())
-                .await;
-            // Socket drops here: the promised body never completes.
-        }
-    });
-    let client = GatewayClient::new(&format!("http://{addr}"), "tok").expect("client builds");
-    let events = client
-        .subscribe_progress()
-        .await
-        .expect("a well-formed stream subscribes")
-        .collect::<Vec<_>>()
-        .await;
-
-    assert_eq!(events.len(), 2, "the decoded event, then one error item");
-    assert!(events[0].is_ok(), "the leading event decodes");
-    let error = events[1]
-        .as_ref()
-        .expect_err("the truncated body is one error item");
-    assert!(
-        matches!(error, GatewayError::ReadBody(_)),
-        "a mid-stream read failure is a body-read error, got {error}"
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_bounds_an_event_block_that_never_terminates() {
-    let body = "x".repeat(MAX_EVENT_BLOCK + 1);
-
-    let events = collect_events(mock_progress(body)).await;
-
-    assert_eq!(events.len(), 1, "the oversized block is one error item");
-    let error = events[0]
-        .as_ref()
-        .expect_err("an unterminated oversized block must be refused");
-    assert!(
-        matches!(error, GatewayError::Malformed { .. }),
-        "an oversized block is a malformed error, got {error}"
-    );
-    assert!(
-        error.to_string().contains("exceeds"),
-        "the bound must report the size limit, got {error}"
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_decodes_crlf_terminated_blocks() {
-    // A peer that terminates its lines with CRLF still dispatches: the
-    // blank-line terminator is `\r\n\r\n`, which contains no `\n\n`.
-    let begun = snapshot_json(true, "Loading profile");
-    let finished = snapshot_json(false, "");
-    let body = format!("data: {begun}\r\n\r\ndata: {finished}\r\n\r\n");
-
-    let events = collect_events(mock_progress(body)).await;
-
-    let snapshots: Vec<(bool, String)> = events.iter().map(decoded).collect();
-    assert_eq!(
-        snapshots,
-        vec![(true, "Loading profile".to_owned()), (false, String::new())]
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_decodes_cr_terminated_blocks() {
-    // A peer that terminates its lines with a bare CR still dispatches,
-    // and a comment line ended by CR alone stays apart from its data line.
-    let begun = snapshot_json(true, "Loading profile");
-    let finished = snapshot_json(false, "");
-    let body = format!("data: {begun}\r\r: heartbeat\rdata: {finished}\r\r");
-
-    let events = collect_events(mock_progress(body)).await;
-
-    let snapshots: Vec<(bool, String)> = events.iter().map(decoded).collect();
-    assert_eq!(
-        snapshots,
-        vec![(true, "Loading profile".to_owned()), (false, String::new())]
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_decodes_blocks_with_mixed_line_terminators() {
-    // Each blank line pairs two different terminators, and one block
-    // ends its comment line with CR and its data line with CRLF.
-    let downloading = snapshot_json(true, "Downloading");
-    let loading = snapshot_json(true, "Loading");
-    let warming = snapshot_json(true, "Warming");
-    let idle = snapshot_json(false, "");
-    let body = format!(
-        "data: {downloading}\n\r\n\
-         data: {loading}\r\n\n\
-         : heartbeat\rdata: {warming}\r\n\r\
-         data: {idle}\n\r"
-    );
-
-    let events = collect_events(mock_progress(body)).await;
-
-    let snapshots: Vec<(bool, String)> = events.iter().map(decoded).collect();
-    assert_eq!(
-        snapshots,
-        vec![
-            (true, "Downloading".to_owned()),
-            (true, "Loading".to_owned()),
-            (true, "Warming".to_owned()),
-            (false, String::new()),
-        ]
-    );
-}
-
-#[tokio::test]
-async fn subscribe_progress_discards_an_incomplete_trailing_block() {
-    // The body ends mid-block: only blank-line-terminated blocks
-    // dispatch, so the partial event is dropped and the stream ends.
-    let begun = snapshot_json(true, "Loading profile");
-    let finished = snapshot_json(false, "");
-    let body = format!("data: {begun}\n\ndata: {finished}");
-
-    let events = collect_events(mock_progress(body)).await;
-
-    assert_eq!(
-        events.len(),
-        1,
-        "the unterminated trailing block is discarded"
-    );
-    assert!(events[0].is_ok(), "the complete event decodes");
-}
diff --git a/crates/workshop/gateway/src/client/tests/socket.rs b/crates/workshop/gateway/src/client/tests/socket.rs
deleted file mode 100644
index fabc3331f..000000000
--- a/crates/workshop/gateway/src/client/tests/socket.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-//! Realtime socket tests: the gateway base URL upgrades to its matching
-//! WebSocket scheme, and any other scheme is refused before connecting.
-
-use super::*;
-
-use crate::client::socket::realtime_url;
-
-#[test]
-fn an_http_gateway_upgrades_to_ws() {
-    let url = realtime_url("http://127.0.0.1:8081").expect("http upgrades");
-    assert_eq!(
-        url.as_str(),
-        "ws://127.0.0.1:8081/v1/realtime?intent=transcription"
-    );
-}
-
-#[test]
-fn an_https_gateway_upgrades_to_wss() {
-    let url = realtime_url("https://gateway.example/prefix").expect("https upgrades");
-    assert_eq!(
-        url.as_str(),
-        "wss://gateway.example/prefix/v1/realtime?intent=transcription"
-    );
-}
-
-#[test]
-fn a_gateway_on_any_other_scheme_is_refused() {
-    for (base_url, scheme) in [
-        ("ftp://gateway.example", "ftp"),
-        ("ws://127.0.0.1:8081", "ws"),
-    ] {
-        let Err(error) = realtime_url(base_url) else {
-            panic!("{base_url} must not upgrade");
-        };
-        let GatewayError::Transport(source) = &error else {
-            panic!("a refused scheme is a transport error, got {error:?}");
-        };
-        assert!(
-            source.to_string().contains(&format!("{scheme:?}")),
-            "the refusal names the scheme, got {source}"
-        );
-    }
-}
diff --git a/crates/workshop/gateway/src/client/tests/switch.rs b/crates/workshop/gateway/src/client/tests/switch.rs
deleted file mode 100644
index fb0ca603e..000000000
--- a/crates/workshop/gateway/src/client/tests/switch.rs
+++ /dev/null
@@ -1,131 +0,0 @@
-//! Switch-profile tests: a named selection and the no-profile selection
-//! each reach the wire as the gateway expects, the JSON answer decodes
-//! with an optional profile, a declined switch is buffered rather than
-//! an error, and an undecodable success is a malformed answer.
-
-use super::*;
-
-use std::sync::{Arc, Mutex};
-
-/// A mock switch route that records every request body it receives and
-/// answers `body`.
-fn recording_switch_route(
-    answer: &'static str,
-) -> (axum::Router, Arc<Mutex<Vec<serde_json::Value>>>) {
-    let received = Arc::new(Mutex::new(Vec::new()));
-    let sink = Arc::clone(&received);
-    let app = axum::Router::new().route(
-        "/admin/switch-profile",
-        axum::routing::post(move |axum::Json(body): axum::Json<serde_json::Value>| {
-            let sink = Arc::clone(&sink);
-            async move {
-                sink.lock()
-                    .expect("the recorder lock is healthy")
-                    .push(body);
-                (
-                    [(axum::http::header::CONTENT_TYPE, "application/json")],
-                    answer,
-                )
-            }
-        }),
-    );
-    (app, received)
-}
-
-#[tokio::test]
-async fn a_named_selection_posts_the_name_and_decodes_the_outcome() {
-    let (app, received) = recording_switch_route(r#"{"profile":"beta","restart_required":true}"#);
-    let base_url = serve(app).await;
-    let client = GatewayClient::new(&base_url, "").expect("client builds in tests");
-    let response = client
-        .switch_profile(Some("beta"))
-        .await
-        .expect("the request completes");
-    let SwitchResponse::Selected(outcome) = response else {
-        panic!("an accepted selection decodes, got {response:?}");
-    };
-    assert_eq!(
-        outcome,
-        SwitchProfileBody {
-            profile: Some("beta".to_string()),
-            restart_required: true,
-        }
-    );
-    assert_eq!(
-        received
-            .lock()
-            .expect("the recorder lock is healthy")
-            .as_slice(),
-        [serde_json::json!({"name": "beta"})],
-        "the selection reaches the gateway as its name"
-    );
-}
-
-#[tokio::test]
-async fn the_no_profile_selection_posts_null_and_decodes_a_null_profile() {
-    let (app, received) = recording_switch_route(r#"{"profile":null,"restart_required":false}"#);
-    let base_url = serve(app).await;
-    let client = GatewayClient::new(&base_url, "").expect("client builds in tests");
-    let response = client
-        .switch_profile(None)
-        .await
-        .expect("the request completes");
-    let SwitchResponse::Selected(outcome) = response else {
-        panic!("an accepted selection decodes, got {response:?}");
-    };
-    assert_eq!(
-        outcome,
-        SwitchProfileBody {
-            profile: None,
-            restart_required: false,
-        }
-    );
-    assert_eq!(
-        received
-            .lock()
-            .expect("the recorder lock is healthy")
-            .as_slice(),
-        [serde_json::json!({"name": null})],
-        "no profile reaches the gateway as an explicit null"
-    );
-}
-
-#[tokio::test]
-async fn a_declined_switch_is_buffered_not_an_error() {
-    let app = axum::Router::new().route(
-        "/admin/switch-profile",
-        axum::routing::post(|| async {
-            (
-                axum::http::StatusCode::BAD_REQUEST,
-                axum::Json(serde_json::json!({
-                    "error": {"message": "bad name", "code": "switch_failed"}
-                })),
-            )
-        }),
-    );
-    let base_url = serve(app).await;
-    let client = GatewayClient::new(&base_url, "").expect("client builds in tests");
-    let response = client
-        .switch_profile(Some("../escape"))
-        .await
-        .expect("a declined request still completes");
-    let SwitchResponse::Buffered(answer) = response else {
-        panic!("a declined switch is buffered, got {response:?}");
-    };
-    assert_eq!(answer.status, reqwest::StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn an_undecodable_success_is_a_malformed_answer() {
-    let (app, _received) = recording_switch_route("data: {\"stage\":\"loading-profile\"}\n\n");
-    let base_url = serve(app).await;
-    let client = GatewayClient::new(&base_url, "").expect("client builds in tests");
-    let error = client
-        .switch_profile(Some("beta"))
-        .await
-        .expect_err("a success body that is not the outcome JSON is refused");
-    assert!(
-        matches!(error, GatewayError::Malformed { .. }),
-        "expected Malformed, got {error:?}"
-    );
-}
diff --git a/crates/workshop/gateway/src/client/tests/timeouts.rs b/crates/workshop/gateway/src/client/tests/timeouts.rs
deleted file mode 100644
index 148326ff9..000000000
--- a/crates/workshop/gateway/src/client/tests/timeouts.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-//! Timeout tests: a gateway that accepts and never answers must trip the
-//! client's bounds rather than hang its caller.
-
-use super::*;
-
-use crate::test_gateway::stalled_gateway;
-
-/// A client against `base_url` whose bounds are tight enough to trip
-/// inside a test.
-fn impatient_client(base_url: &str) -> GatewayClient {
-    GatewayClient::new(base_url, "")
-        .expect("client builds in tests")
-        .with_timeouts_for_test(Duration::from_millis(100), Duration::from_millis(100))
-}
-
-#[tokio::test]
-async fn a_stalled_gateway_trips_the_request_timeout() {
-    let (base_url, _accepted) = stalled_gateway().await;
-    let error = impatient_client(&base_url)
-        .list_models()
-        .await
-        .expect_err("a gateway that never answers must trip the request timeout");
-    assert!(
-        matches!(error, GatewayError::Transport(_)),
-        "expected Transport, got {error:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_stalled_gateway_trips_the_stream_header_bound() {
-    let (base_url, _accepted) = stalled_gateway().await;
-    let Err(error) = impatient_client(&base_url).subscribe_progress().await else {
-        panic!("a gateway that never sends headers must trip the header bound");
-    };
-    assert!(
-        matches!(error, GatewayError::Transport(_)),
-        "expected Transport, got {error:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_stalled_gateway_probe_reads_unreachable() {
-    let (base_url, _accepted) = stalled_gateway().await;
-    assert!(
-        !impatient_client(&base_url).health().await,
-        "a gateway that accepts but never answers must read unreachable"
-    );
-}
diff --git a/crates/workshop/gateway/src/handles.rs b/crates/workshop/gateway/src/handles.rs
deleted file mode 100644
index cbe64d4da..000000000
--- a/crates/workshop/gateway/src/handles.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-//! The gateway subsystem's registration and any handle types. It
-//! registers [`GatewayHandles`] - the replaceable endpoint binding and
-//! the reachability flag - as its state handle set, and its background
-//! tasks - the reachability heartbeat and the gateway progress
-//! subscriber.
-
-use std::sync::Arc;
-
-use workshop_registry::{BackgroundTaskAdapter, Registration, Registry, ShutdownHandle};
-use workshop_support::ReconnectBackoff;
-
-use crate::binding::GatewayBinding;
-use crate::heartbeat::{self, GatewayHealth};
-use crate::progress;
-
-/// The gateway subsystem's shared handles: the atomically replaceable
-/// endpoint binding every gateway call snapshots, and the heartbeat's
-/// reachability flag the gateway-dependent routes short-circuit on.
-#[derive(Debug, Clone)]
-pub struct GatewayHandles {
-    binding: GatewayBinding,
-    health: GatewayHealth,
-}
-
-impl GatewayHandles {
-    /// Bundles the binding and the health flag for registration.
-    #[must_use]
-    pub fn new(binding: GatewayBinding, health: GatewayHealth) -> Self {
-        Self { binding, health }
-    }
-
-    /// The replaceable endpoint binding.
-    #[must_use]
-    pub fn binding(&self) -> &GatewayBinding {
-        &self.binding
-    }
-
-    /// The heartbeat's shared reachability flag.
-    #[must_use]
-    pub fn health(&self) -> &GatewayHealth {
-        &self.health
-    }
-}
-
-/// Registers the gateway subsystem's state handles into the registry.
-/// The returned guard keeps the registration alive; the composition
-/// root holds it for the process lifetime.
-pub fn register(registry: &Registry, handles: GatewayHandles) -> Registration {
-    registry.register_state::<GatewayHandles>(Arc::new(handles))
-}
-
-/// The gateway subsystem's background-task registration guards: the
-/// reachability heartbeat and the gateway progress subscriber. Dropping
-/// them deregisters the tasks.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the tasks"]
-pub struct GatewayTaskRegistrations {
-    /// The reachability heartbeat.
-    pub heartbeat: Registration,
-    /// The gateway progress subscriber.
-    pub subscriber: Registration,
-}
-
-/// Registers the gateway subsystem's background tasks: the
-/// reachability heartbeat and the gateway progress subscriber, both
-/// reporting through the registry's push facade. The tasks spawn when
-/// the server starts serving and stop inside the graceful-shutdown
-/// signal. The returned guards keep the registrations alive; the
-/// composition root holds them for the process lifetime.
-pub fn register_tasks(
-    registry: &Registry,
-    handles: &GatewayHandles,
-    backoff: ReconnectBackoff,
-) -> GatewayTaskRegistrations {
-    let heartbeat = registry.register_task(Arc::new(BackgroundTaskAdapter::new({
-        let registry = registry.clone();
-        let binding = handles.binding().clone();
-        let health = handles.health().clone();
-        move || {
-            let task = heartbeat::spawn(
-                binding.clone(),
-                registry.push(),
-                health.clone(),
-                heartbeat::HEARTBEAT_INTERVAL,
-                backoff.clone(),
-            );
-            ShutdownHandle::new(move || task.shutdown())
-        }
-    })));
-    let subscriber = registry.register_task(Arc::new(BackgroundTaskAdapter::new({
-        let registry = registry.clone();
-        let binding = handles.binding().clone();
-        let health = handles.health().clone();
-        move || {
-            let task = progress::spawn(binding.clone(), registry.push(), health.clone());
-            ShutdownHandle::new(move || task.shutdown())
-        }
-    })));
-    GatewayTaskRegistrations {
-        heartbeat,
-        subscriber,
-    }
-}
diff --git a/crates/workshop/gateway/src/heartbeat-tests.rs b/crates/workshop/gateway/src/heartbeat-tests.rs
deleted file mode 100644
index 067c9155a..000000000
--- a/crates/workshop/gateway/src/heartbeat-tests.rs
+++ /dev/null
@@ -1,238 +0,0 @@
-//! Heartbeat unit tests: the join-line recompute, the probe bound, and
-//! the stop signal and binding replacement ending an in-flight probe or
-//! refresh. The bus-coupled loop behavior (transitions, refreshes,
-//! convergence) is pinned by the workshop-server integration tests, which
-//! compose the heartbeat with the real status, catalog, and menu buses.
-
-use super::*;
-use crate::client::GatewayClient;
-use crate::test_gateway::stalled_gateway;
-
-use std::sync::Arc;
-
-use axum::http::StatusCode;
-use axum::routing::get;
-use tokio::sync::{Notify, broadcast};
-
-fn retained(label: &str) -> StatusBarUpdate {
-    StatusBarUpdate {
-        label: label.to_owned(),
-        description: String::new(),
-        busy: false,
-        severity: Severity::Info,
-        activity: Activity::General,
-    }
-}
-
-/// Binds `app` on a free loopback port and returns its base URL.
-async fn serve(app: axum::Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
-
-/// A recording status sink standing in for the status bus: the push the
-/// heartbeat reports through, the registration keeping the sink alive,
-/// and the receiver the test reads.
-fn status_recorder() -> (
-    Push,
-    workshop_registry::Registration,
-    broadcast::Receiver<StatusBarUpdate>,
-) {
-    let registry = workshop_registry::Registry::new();
-    let (status_tx, rx) = broadcast::channel(16);
-    let sink = registry.register_sink::<dyn workshop_registry::StatusSink>(Arc::new(
-        workshop_registry::StatusSinkAdapter::new(move |update| {
-            let _ = status_tx.send(update);
-        }),
-    ));
-    (registry.push(), sink, rx)
-}
-
-/// The next status line within a generous deadline.
-async fn next_label(rx: &mut broadcast::Receiver<StatusBarUpdate>) -> String {
-    tokio::time::timeout(Duration::from_secs(5), rx.recv())
-        .await
-        .expect("a status update arrives within the deadline")
-        .expect("the recording sink is open")
-        .label
-}
-
-/// Waits for `notify` within a generous deadline.
-async fn notified(notify: &Notify, what: &str) {
-    tokio::time::timeout(Duration::from_secs(5), notify.notified())
-        .await
-        .unwrap_or_else(|_| panic!("{what} within the deadline"));
-}
-
-#[test]
-fn a_join_recomputes_a_stale_connect_announcement_to_the_resting_line() {
-    let health = GatewayHealth::new();
-    let update = join_status(Some(retained(CONNECTED_LABEL)), &health)
-        .expect("a retained transition still yields a join line");
-    assert_eq!(update.label, "Ready");
-    assert_eq!(update.severity, Severity::Info);
-}
-
-#[test]
-fn a_join_recomputes_a_stale_connect_announcement_during_an_outage() {
-    let health = GatewayHealth::new();
-    health.publish(false);
-    let update = join_status(Some(retained(CONNECTED_LABEL)), &health)
-        .expect("a retained transition still yields a join line");
-    assert_eq!(update.label, UNREACHABLE_LABEL);
-    assert_eq!(update.description, UNREACHABLE_DESCRIPTION);
-}
-
-#[test]
-fn a_join_keeps_a_retained_outage_while_the_gateway_is_down() {
-    let health = GatewayHealth::new();
-    health.publish(false);
-    let update = join_status(Some(retained(UNREACHABLE_LABEL)), &health)
-        .expect("the outage line survives the recompute");
-    assert_eq!(update.label, UNREACHABLE_LABEL);
-}
-
-#[test]
-fn a_join_replays_a_retained_frame_describing_real_work() {
-    let health = GatewayHealth::new();
-    let working = Some(StatusBarUpdate {
-        label: "Downloading model".to_owned(),
-        description: "ggml-large-v3.bin".to_owned(),
-        busy: true,
-        severity: Severity::Info,
-        activity: Activity::General,
-    });
-    let update = join_status(working, &health).expect("the work frame replays as-is");
-    assert_eq!(update.label, "Downloading model");
-    assert!(update.busy, "the busy flag survives the join recompute");
-}
-
-#[test]
-fn a_join_with_no_retained_frame_sends_nothing() {
-    let health = GatewayHealth::new();
-    assert!(join_status(None, &health).is_none());
-}
-
-#[test]
-fn the_probe_bound_is_shorter_than_the_heartbeat_interval() {
-    assert!(
-        crate::client::HEALTH_PROBE_TIMEOUT < HEARTBEAT_INTERVAL,
-        "a probe outlasting the interval would back the heartbeat up \
-         behind a stalled gateway"
-    );
-}
-
-#[tokio::test]
-async fn a_wait_with_no_reachability_watch_runs_its_future_to_completion() {
-    let (_stop_tx, mut stop) = oneshot::channel();
-    let (_gateway_tx, mut gateway_changed) = watch::channel(0_u64);
-    let mut signals = Signals {
-        stop: &mut stop,
-        reachable: None,
-        gateway_changed: &mut gateway_changed,
-    };
-    let output = until(
-        async {
-            tokio::time::sleep(Duration::from_millis(20)).await;
-            7
-        },
-        &mut signals,
-    )
-    .await;
-    assert!(
-        matches!(output, Ok(7)),
-        "an absent reachability watch never ends the wait"
-    );
-}
-
-#[tokio::test]
-async fn a_stalled_gateway_reads_unreachable_within_the_probe_bound() {
-    // Without a bounded probe, the first probe would hang forever and the
-    // heartbeat would never report at all.
-    let (stalled, _accepted) = stalled_gateway().await;
-    let client = GatewayClient::new(&stalled, "")
-        .expect("client builds in tests")
-        .with_timeouts_for_test(Duration::from_millis(100), Duration::from_millis(100));
-    let (push, _sink, mut rx) = status_recorder();
-    let heartbeat = spawn(
-        GatewayBinding::from_client(client),
-        push,
-        GatewayHealth::new(),
-        Duration::from_millis(25),
-        ReconnectBackoff::with_schedule(
-            Duration::from_millis(10),
-            Duration::from_millis(40),
-            Duration::from_secs(60),
-        ),
-    );
-    assert_eq!(next_label(&mut rx).await, "Gateway unreachable");
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_binding_replacement_cancels_a_stalled_probe() {
-    let (stalled, accepted) = stalled_gateway().await;
-    let healthy =
-        serve(axum::Router::new().route("/health", get(|| async { StatusCode::OK }))).await;
-    // A probe bound far past the test deadline: only the rebind can end
-    // the stalled probe in time.
-    let client = GatewayClient::new(&stalled, "")
-        .expect("client builds in tests")
-        .with_timeouts_for_test(Duration::from_secs(60), Duration::from_secs(60));
-    let gateway = GatewayBinding::from_client(client);
-    let (push, _sink, mut rx) = status_recorder();
-    let heartbeat = spawn(
-        gateway.clone(),
-        push,
-        GatewayHealth::new(),
-        Duration::from_secs(60),
-        ReconnectBackoff::new(),
-    );
-
-    notified(&accepted, "the first probe reaches the stalled stub").await;
-    gateway
-        .replace(&healthy, "")
-        .expect("the replacement publishes");
-    assert_eq!(
-        next_label(&mut rx).await,
-        CONNECTED_LABEL,
-        "the replacement's probe reports without waiting out the stalled one"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn shutdown_cancels_a_stalled_refresh() {
-    let refreshing = Arc::new(Notify::new());
-    let app = axum::Router::new()
-        .route("/health", get(|| async { StatusCode::OK }))
-        .route(
-            "/v1/models",
-            get({
-                let refreshing = Arc::clone(&refreshing);
-                move || {
-                    refreshing.notify_one();
-                    std::future::pending::<StatusCode>()
-                }
-            }),
-        )
-        .route("/admin/profiles", get(std::future::pending::<StatusCode>))
-        .route("/admin/status", get(std::future::pending::<StatusCode>));
-    let base_url = serve(app).await;
-    let (push, _sink, mut rx) = status_recorder();
-    let heartbeat = spawn(
-        GatewayBinding::new(&base_url, "").expect("the test binding builds"),
-        push,
-        GatewayHealth::new(),
-        Duration::from_secs(60),
-        ReconnectBackoff::new(),
-    );
-
-    assert_eq!(next_label(&mut rx).await, CONNECTED_LABEL);
-    notified(&refreshing, "the catalog refresh reaches the gateway").await;
-    // The stalled refresh holds for the client's request timeout, far
-    // past this deadline, unless the stop signal wins the wait.
-    tokio::time::timeout(Duration::from_secs(5), heartbeat.shutdown())
-        .await
-        .expect("shutdown does not wait out the stalled refresh");
-}
diff --git a/crates/workshop/gateway/src/heartbeat.rs b/crates/workshop/gateway/src/heartbeat.rs
deleted file mode 100644
index 24d5a493f..000000000
--- a/crates/workshop/gateway/src/heartbeat.rs
+++ /dev/null
@@ -1,384 +0,0 @@
-//! The gateway heartbeat: a background task polling the gateway's
-//! `GET /health` endpoint and publishing reachability to the rest of the
-//! server.
-//!
-//! One task is spawned with the server ([`spawn`]): while the gateway
-//! answers, it probes through [`GatewayClient::health`](crate::client::GatewayClient::health) on the fixed
-//! [`HEARTBEAT_INTERVAL`] and publishes the outcome to the shared
-//! [`GatewayHealth`] flag the gateway-dependent routes read; while the
-//! gateway is unreachable, the next probe instead waits out a delay
-//! drawn from the shared [`ReconnectBackoff`] - jittered, escalating,
-//! and reset only by useful work elsewhere (a delivered token or a
-//! successful completion), never by a probe that merely connects, so a
-//! gateway that flaps without delivering keeps escalating. When the
-//! backoff's total-delay budget exhausts, the loop reports the give-up
-//! on the status bus and stops probing for the life of the process.
-//! Status subscribers hear about transitions only - the first probe reports
-//! the initial state ("Connected to gateway" or "Gateway unreachable"),
-//! and after that a status update fires when the answer changes, so a
-//! steady state never spams the status bar. Every transition also feeds
-//! the Model menu's reachability (so `chat_ready` flips with the
-//! gateway), and a transition to reachable (boot's first probe included)
-//! refreshes the gateway's profile state and model catalog into their
-//! buses. If simultaneous startup leaves either source empty, later healthy
-//! ticks retry each source independently until the profile and a selectable
-//! model are both ready, then restore the selection exactly once.
-//!
-//! The task stops through its [`Heartbeat`] handle: the signal wins the
-//! loop's selects, so shutdown never waits out a tick or an in-flight
-//! probe. The server runs the shutdown inside its graceful-shutdown future.
-
-use std::time::Duration;
-
-use tokio::sync::{oneshot, watch};
-
-use workshop_protocol::{Activity, Severity, StatusBarUpdate};
-use workshop_registry::Push;
-use workshop_support::ReconnectBackoff;
-
-use crate::binding::{GatewayBinding, GatewaySnapshot};
-use crate::progress::{Ended, Signals, until};
-use crate::refresh::{refresh_catalog, refresh_profiles};
-
-/// The status line announcing that the gateway answers its health probe.
-const CONNECTED_LABEL: &str = "Connected to gateway";
-/// The status line announcing that the gateway does not answer.
-const UNREACHABLE_LABEL: &str = "Gateway unreachable";
-/// The description sent with the unreachable announcement.
-const UNREACHABLE_DESCRIPTION: &str = "the gateway does not answer its health probe";
-
-/// The status frame a joining session hears first: the bus's retained
-/// frame, unless that frame is one of the heartbeat's transition
-/// announcements. A transition describes a past moment, not the current
-/// state - the boot-time "Connected to gateway" outlives itself within
-/// seconds - so the line is recomputed from the current probe. A retained
-/// frame that reports real work (a download's progress, a chat's activity)
-/// replays as-is.
-#[must_use]
-pub fn join_status(
-    retained: Option<StatusBarUpdate>,
-    health: &GatewayHealth,
-) -> Option<StatusBarUpdate> {
-    let update = retained?;
-    if update.label != CONNECTED_LABEL && update.label != UNREACHABLE_LABEL {
-        return Some(update);
-    }
-    let reachable = health.is_reachable();
-    Some(StatusBarUpdate {
-        label: if reachable {
-            "Ready"
-        } else {
-            UNREACHABLE_LABEL
-        }
-        .to_owned(),
-        description: if reachable {
-            "idle".to_owned()
-        } else {
-            UNREACHABLE_DESCRIPTION.to_owned()
-        },
-        busy: false,
-        severity: Severity::Info,
-        activity: Activity::General,
-    })
-}
-
-/// How often the heartbeat probes a reachable gateway. Probes of an
-/// unreachable gateway follow the [`ReconnectBackoff`] instead.
-pub(crate) const HEARTBEAT_INTERVAL: Duration = Duration::from_secs(5);
-
-/// Shared gateway reachability, written by the heartbeat and read by the
-/// gateway-dependent routes.
-///
-/// The flag starts optimistic (`true`): until the first probe lands, a
-/// request flows to the gateway and fails or succeeds on its own merits,
-/// which keeps a server running without a heartbeat (every router-only
-/// test) behaving as it did before the heartbeat existed.
-#[derive(Debug, Clone)]
-pub struct GatewayHealth {
-    reachable: watch::Sender<bool>,
-}
-
-impl GatewayHealth {
-    /// Starts the flag optimistic; see the type docs for why.
-    #[must_use]
-    pub fn new() -> Self {
-        Self {
-            reachable: watch::channel(true).0,
-        }
-    }
-
-    /// Whether the gateway is currently believed reachable.
-    #[must_use]
-    pub fn is_reachable(&self) -> bool {
-        *self.reachable.borrow()
-    }
-
-    /// Subscribes to reachability changes. The current value is visible
-    /// immediately through the receiver; each later publish that flips the
-    /// flag notifies. The progress subscriber waits on this to hold its
-    /// subscription only while the gateway answers.
-    #[must_use]
-    pub fn subscribe(&self) -> watch::Receiver<bool> {
-        self.reachable.subscribe()
-    }
-
-    /// Publishes one probe outcome. The heartbeat is the only production
-    /// writer; tests publish directly to pin the degraded paths.
-    pub fn publish(&self, reachable: bool) {
-        self.reachable.send_if_modified(|current| {
-            let changed = *current != reachable;
-            *current = reachable;
-            changed
-        });
-    }
-}
-
-impl Default for GatewayHealth {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// A running heartbeat task.
-///
-/// [`Heartbeat::shutdown`] signals the loop to stop and awaits the task.
-/// Dropping the handle without shutting down still stops the task at its
-/// next select point, because the closed channel resolves the stop branch.
-#[derive(Debug)]
-pub struct Heartbeat {
-    stop: Option<oneshot::Sender<()>>,
-    task: Option<tokio::task::JoinHandle<()>>,
-}
-
-impl Heartbeat {
-    /// Signals the heartbeat to stop and waits for its task to finish.
-    pub async fn shutdown(mut self) {
-        if let Some(stop) = self.stop.take() {
-            let _ = stop.send(());
-        }
-        if let Some(task) = self.task.take() {
-            let _ = task.await;
-        }
-    }
-}
-
-/// Spawns the heartbeat loop against `client`, reporting transitions
-/// through `push` and publishing reachability to `health` and to the
-/// menu behind `push`, which recomputes `chat_ready` from it. A
-/// transition to reachable - boot's first probe included - refreshes the
-/// gateway's profile state and model catalog through the same handle,
-/// then restores a model selection when none is applied. Healthy ticks
-/// repeat each incomplete refresh independently, covering a gateway whose
-/// health endpoint becomes ready before its catalog or profile state. The first
-/// probe runs immediately; later probes follow `interval` while the
-/// gateway answers and draw from `backoff` while it does not, ending the
-/// loop when the backoff's budget exhausts.
-#[must_use]
-pub fn spawn(
-    gateway: GatewayBinding,
-    push: Push,
-    health: GatewayHealth,
-    interval: Duration,
-    backoff: ReconnectBackoff,
-) -> Heartbeat {
-    let (stop, mut stopped) = oneshot::channel();
-    let task = tokio::spawn(async move {
-        run(&gateway, &push, &health, interval, &backoff, &mut stopped).await;
-    });
-    Heartbeat {
-        stop: Some(stop),
-        task: Some(task),
-    }
-}
-
-/// Which menu sources have converged since the gateway last became
-/// reachable, and whether the selection restore has run.
-#[derive(Default)]
-struct RefreshState {
-    profiles_ready: bool,
-    catalog_ready: bool,
-    selection_restored: bool,
-}
-
-/// What the probe loop has learned about the current binding: the last
-/// probe verdict and which menu sources have converged. A replaced
-/// binding starts it over.
-#[derive(Default)]
-struct BindingState {
-    last: Option<bool>,
-    refresh: RefreshState,
-}
-
-/// The probe loop: repeats [`cycle`] until the stop signal or an
-/// exhausted backoff budget ends it. A replaced binding restarts the
-/// cycle from the top with fresh state.
-async fn run(
-    gateway: &GatewayBinding,
-    push: &Push,
-    health: &GatewayHealth,
-    interval: Duration,
-    backoff: &ReconnectBackoff,
-    stop: &mut oneshot::Receiver<()>,
-) {
-    let mut gateway_changed = gateway.subscribe();
-    let mut signals = Signals {
-        stop,
-        reachable: None,
-        gateway_changed: &mut gateway_changed,
-    };
-    let mut state = BindingState::default();
-    loop {
-        match cycle(
-            gateway,
-            push,
-            health,
-            interval,
-            backoff,
-            &mut signals,
-            &mut state,
-        )
-        .await
-        {
-            Ok(()) => {}
-            Err(Ended::Stop) => break,
-            // With no reachability watch armed, `Lost` never arrives.
-            Err(Ended::Rebind | Ended::Lost) => state = BindingState::default(),
-        }
-    }
-}
-
-/// One pass of the probe loop, in named phases: wait out the probe
-/// interval, probe the health endpoint, announce a transition, refresh
-/// stale menu sources, and restore the selection. Every wait goes through
-/// [`until`], so the stop signal and a replaced binding end the pass
-/// early.
-async fn cycle(
-    gateway: &GatewayBinding,
-    push: &Push,
-    health: &GatewayHealth,
-    interval: Duration,
-    backoff: &ReconnectBackoff,
-    signals: &mut Signals<'_>,
-    state: &mut BindingState,
-) -> Result<(), Ended> {
-    await_probe_interval(state.last, interval, backoff, push, signals).await?;
-    let snapshot = gateway.snapshot();
-    let generation = snapshot.generation();
-    let reachable = until(snapshot.client().health(), signals).await?;
-    if gateway.generation() != generation {
-        return Err(Ended::Rebind);
-    }
-    announce_transition(push, health, reachable, &mut state.last);
-    let refresh = &mut state.refresh;
-    if !reachable {
-        *refresh = RefreshState::default();
-        return Ok(());
-    }
-    if !refresh.profiles_ready || !refresh.catalog_ready {
-        until(
-            refresh_incomplete_sources(&snapshot, push, refresh),
-            signals,
-        )
-        .await?;
-    }
-    if refresh.profiles_ready && refresh.catalog_ready && !refresh.selection_restored {
-        // A fresh boot has no selection, so restore the remembered
-        // model for the now-known active profile (else the first
-        // catalog model); a reconnect whose selection survived the
-        // outage is a no-op. This branch runs exactly once per reachable
-        // convergence because both readiness facts remain true.
-        push.menu().restore_selection();
-        refresh.selection_restored = true;
-    }
-    Ok(())
-}
-
-/// The wait before a probe: skipped on the first, `interval` while the
-/// gateway answered last time (measured from the previous probe's
-/// completion, so a slow probe never bunches into a catch-up burst), and
-/// the backoff's next delay while it did not, ending the loop when the
-/// backoff's budget exhausts.
-async fn await_probe_interval(
-    last: Option<bool>,
-    interval: Duration,
-    backoff: &ReconnectBackoff,
-    push: &Push,
-    signals: &mut Signals<'_>,
-) -> Result<(), Ended> {
-    let Some(reachable) = last else {
-        return Ok(());
-    };
-    let wait = if reachable {
-        interval
-    } else if let Some(delay) = backoff.next_delay() {
-        delay
-    } else {
-        push.push_failure(
-            "Gateway reconnect stopped",
-            "the reconnect budget is exhausted; restart the workshop to retry",
-            Activity::General,
-        );
-        return Err(Ended::Stop);
-    };
-    until(tokio::time::sleep(wait), signals).await
-}
-
-/// Publishes the probe outcome and, when it differs from the last
-/// verdict, reports the transition to the menu and the status bar.
-fn announce_transition(
-    push: &Push,
-    health: &GatewayHealth,
-    reachable: bool,
-    last: &mut Option<bool>,
-) {
-    health.publish(reachable);
-    let transitioned = *last != Some(reachable);
-    *last = Some(reachable);
-    if transitioned {
-        // The menu recomputes chat_ready from reachability, so the
-        // verdict feeds it before any slower refresh work below.
-        push.menu().set_gateway_reachable(reachable);
-        if reachable {
-            push.push_status_update(
-                CONNECTED_LABEL,
-                "the gateway answers its health probe",
-                Activity::General,
-            );
-        } else {
-            push.push_status_update(
-                UNREACHABLE_LABEL,
-                UNREACHABLE_DESCRIPTION,
-                Activity::General,
-            );
-        }
-    }
-}
-
-/// Refreshes only the gateway-owned menu sources that have not converged.
-/// All menu state is server-owned and reaches the UI via socket pushes -
-/// the UI fetches nothing on boot - so every transition into reachable,
-/// boot's first probe included, (re)populates the profile state and the
-/// model catalog. Healthy ticks independently repeat either refresh until
-/// both sources are populated, because health and one ready source do not
-/// imply the other source is ready; the probe interval bounds retries and
-/// keeps this from becoming a busy loop.
-async fn refresh_incomplete_sources(
-    snapshot: &GatewaySnapshot,
-    push: &Push,
-    refresh: &mut RefreshState,
-) {
-    match (refresh.profiles_ready, refresh.catalog_ready) {
-        (false, false) => {
-            (refresh.profiles_ready, refresh.catalog_ready) = tokio::join!(
-                refresh_profiles(snapshot.client(), push),
-                refresh_catalog(snapshot.client(), push)
-            );
-        }
-        (false, true) => refresh.profiles_ready = refresh_profiles(snapshot.client(), push).await,
-        (true, false) => refresh.catalog_ready = refresh_catalog(snapshot.client(), push).await,
-        (true, true) => {}
-    }
-}
-#[cfg(test)]
-#[path = "heartbeat-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway/src/lib.rs b/crates/workshop/gateway/src/lib.rs
deleted file mode 100644
index c5d22fe29..000000000
--- a/crates/workshop/gateway/src/lib.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-//! workshop-gateway - the gateway subsystem: the bearer-authenticated
-//! HTTP client for the Runvil gateway's OpenAI-compatible API
-//! (`client`), the replaceable endpoint binding (`binding`) and
-//! discovery-file resolution (`resolve`), the reachability heartbeat
-//! (`heartbeat`), the catalog and profile refresh the heartbeat and the
-//! server's profile switch share (`refresh`), and the gateway progress
-//! subscriber (`progress`). Every production module is private, and
-//! the crate root's re-exports are the one public path.
-//!
-//! ## Invariants
-//!
-//! - Tier: service; may depend on: `workshop-protocol`, `workshop-registry`,
-//!   `workshop-support`. `cargo test -p build-xtask` enforces the product
-//!   and container boundaries.
-//! - No axum type appears in this crate's public API: the domain code
-//!   speaks `reqwest` statuses and raw bodies, and the server maps them
-//!   to HTTP responses.
-//! - A bearer key is never written to logs or `Debug` output.
-//! - Workshop reaches model providers only through the gateway, so no
-//!   vendor credential passes through this crate or reaches the page or
-//!   Lua.
-//! - User-visible reporting flows through the registry's push facade, and
-//!   the gateway drives the menu through its
-//!   [`MenuPush`](workshop_registry::MenuPush) face, so this crate never
-//!   names another subsystem's bus.
-//! - The gateway's progress reaches this crate as one wire type defined in
-//!   `progress-wire.rs`: no progress machinery is shared with the gateway
-//!   family, and its field names are pinned by a golden JSON test so drift
-//!   is caught.
-
-mod binding;
-mod client;
-mod handles;
-mod heartbeat;
-mod progress;
-mod refresh;
-mod resolve;
-#[cfg(any(test, feature = "test-fixtures"))]
-pub mod test_gateway;
-mod version;
-
-pub use binding::{GatewayBinding, GatewayPublicationError, GatewaySnapshot, GatewayUpdater};
-pub use client::{
-    ForwardedResponse, GatewayClient, GatewayError, GatewayRealtimeSocket, GatewayResponse,
-    REQUEST_TIMEOUT, SwitchProfileBody, SwitchResponse,
-};
-pub use handles::{GatewayHandles, GatewayTaskRegistrations, register, register_tasks};
-pub use heartbeat::{GatewayHealth, Heartbeat, join_status, spawn as spawn_heartbeat};
-pub use refresh::{refresh_catalog, refresh_profiles};
-pub use resolve::{GatewaySource, ResolveError, ResolvedGateway, report, resolve};
-pub use version::{
-    MIN_GATEWAY, Version, VersionCheck, announce as announce_version, report as report_version,
-};
-
-/// The Gateway discovery contract as Workshop reads it, re-exported whole
-/// from the fork that owns it.
-///
-/// The desktop app may name only `workshop-server-api` among workshop crates,
-/// and the server and its facade are re-exports, so this module binding is
-/// what carries the contract out to the desktop app:
-/// `workshop_server_api::discovery::resolve` and friends. Naming the crate
-/// once here rather than listing its twenty items at each level keeps one
-/// name for one thing.
-pub use workshop_gateway_discovery as discovery;
diff --git a/crates/workshop/gateway/src/progress-wire-tests.rs b/crates/workshop/gateway/src/progress-wire-tests.rs
deleted file mode 100644
index 9b320b20b..000000000
--- a/crates/workshop/gateway/src/progress-wire-tests.rs
+++ /dev/null
@@ -1,66 +0,0 @@
-//! The progress wire contract, pinned by golden JSON.
-//!
-//! Workshop only deserializes `Progress`, so this file pins the field names
-//! and their JSON types rather than a round trip. A rename on the Gateway's
-//! side, or a type change here, fails one of these assertions instead of
-//! silently leaving the status bar stuck.
-
-use super::*;
-
-#[test]
-fn the_canonical_document_decodes_to_the_two_fields() {
-    let snapshot: Progress =
-        serde_json::from_str(r#"{"busy":true,"text":"Downloading qwen3-8b.gguf 45%"}"#)
-            .expect("the canonical document decodes");
-    assert_eq!(
-        snapshot,
-        Progress {
-            busy: true,
-            text: "Downloading qwen3-8b.gguf 45%".to_owned(),
-        }
-    );
-}
-
-#[test]
-fn an_idle_document_decodes_to_an_empty_text() {
-    let snapshot: Progress =
-        serde_json::from_str(r#"{"busy":false,"text":""}"#).expect("an idle document decodes");
-    assert_eq!(snapshot, Progress::default());
-}
-
-#[test]
-fn the_field_names_and_json_types_are_the_contract() {
-    // Pins the wire names and types through a decode of each, so a rename
-    // on either side fails here even if nobody updates a fixture.
-    //
-    // Both fields are required: the Gateway writes the whole snapshot on
-    // every event, so a document missing either one is malformed, and the
-    // decoder reports it rather than filling in a default.
-    for document in [r#"{"busy":true}"#, r#"{"text":"Loading"}"#] {
-        let decoded = serde_json::from_str::<Progress>(document);
-        assert!(
-            decoded.is_err(),
-            "both fields are required, so {document} must not decode: {decoded:?}"
-        );
-    }
-
-    let wrong_type = serde_json::from_str::<Progress>(r#"{"busy":"yes","text":""}"#);
-    assert!(
-        wrong_type.is_err(),
-        "busy is a boolean, not a string: {wrong_type:?}"
-    );
-    let wrong_text = serde_json::from_str::<Progress>(r#"{"busy":false,"text":7}"#);
-    assert!(
-        wrong_text.is_err(),
-        "text is a string, not a number: {wrong_text:?}"
-    );
-}
-
-#[test]
-fn an_unknown_field_is_tolerated() {
-    // A newer Gateway adding a field must not break an older Workshop.
-    let snapshot: Progress =
-        serde_json::from_str(r#"{"busy":true,"text":"Loading","fraction":0.45}"#)
-            .expect("an unknown field is ignored");
-    assert_eq!(snapshot.text, "Loading");
-}
diff --git a/crates/workshop/gateway/src/progress-wire.rs b/crates/workshop/gateway/src/progress-wire.rs
deleted file mode 100644
index c4543b284..000000000
--- a/crates/workshop/gateway/src/progress-wire.rs
+++ /dev/null
@@ -1,35 +0,0 @@
-//! The gateway progress wire type, as Workshop reads it: one live activity,
-//! a busy flag and a producer-owned text.
-//!
-//! [`Progress`] is the shape of one `GET /admin/progress` event and of the
-//! progress field in `GET /admin/status`. Workshop only ever deserializes
-//! it; the Gateway owns the producing side and the anti-flicker policy
-//! lives in [`crate::progress`].
-//!
-//! The field names and types are the contract. [`tests`] pins them against
-//! a golden JSON document, so a rename or a type change on either side
-//! fails here rather than in a status bar that silently stops updating.
-//!
-//! The text is user-visible, so a producer must never place a bearer key,
-//! API key, or other credential in it.
-
-use serde::Deserialize;
-
-/// One snapshot of the Gateway's live activity.
-///
-/// Deserialization tolerates fields this type does not know, which is what
-/// lets a newer Gateway add one without breaking an older Workshop. There
-/// is no schema version.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize)]
-pub struct Progress {
-    /// Whether any activity is live. The UI shows an indeterminate
-    /// barberpole while this is set.
-    pub busy: bool,
-    /// The newest live activity's text, e.g. `"Downloading qwen3-8b.gguf
-    /// 45%"`; empty when idle.
-    pub text: String,
-}
-
-#[cfg(test)]
-#[path = "progress-wire-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway/src/progress.rs b/crates/workshop/gateway/src/progress.rs
deleted file mode 100644
index a9f15752d..000000000
--- a/crates/workshop/gateway/src/progress.rs
+++ /dev/null
@@ -1,352 +0,0 @@
-//! The gateway progress subscriber: a background task that reads the
-//! gateway's `GET /admin/progress` snapshot stream and drives the status
-//! bar's busy indicator through the registry's [`Push`] facade, so
-//! gateway-side work (model downloads, profile switches) shows as a
-//! barberpole plus the gateway's own text.
-//!
-//! The task follows the heartbeat's lifecycle posture: spawned with the
-//! server, stopped through its [`Subscriber`] handle inside the same
-//! graceful-shutdown signal, and driven by the shared [`GatewayHealth`]
-//! verdict rather than by probes of its own. It subscribes while the
-//! gateway reads reachable and idles while it does not; a reconnect
-//! resubscribes. Each snapshot passes through the anti-flicker
-//! `Presenter`, which decides when the bar shows and when it rests.
-//! When the subscription drops - a lost connection or an unreachable
-//! verdict - the bar returns to rest, because progress from a gateway
-//! the workshop can no longer hear is stale; a bar that only just
-//! appeared still waits out its minimum visible time first, so a
-//! dropped stream cannot flash it.
-
-mod presenter;
-#[path = "progress-wire.rs"]
-mod wire;
-
-use std::future::Future;
-use std::time::Duration;
-
-use futures_util::StreamExt;
-use tokio::sync::{oneshot, watch};
-use tokio::time::Instant;
-
-use workshop_registry::Push;
-
-use crate::binding::{GatewayBinding, GatewaySnapshot};
-use crate::client::ProgressStream;
-use crate::heartbeat::GatewayHealth;
-pub(crate) use wire::Progress;
-
-#[cfg(test)]
-use presenter::{MIN_VISIBLE, SHOW_DELAY};
-use presenter::{Policy, Presenter};
-
-/// How long a resubscribe waits when the stream ended while the gateway
-/// still reads reachable, so an endpoint that accepts and immediately
-/// closes cannot spin the loop. A reachability flip restarts at once;
-/// matched to the heartbeat's probe cadence.
-const RESUBSCRIBE_DELAY: Duration = Duration::from_secs(5);
-
-/// The subscriber's durations, injectable so tests can shorten them.
-#[derive(Debug, Clone, Copy)]
-struct Timing {
-    /// Wait before resubscribing to a stream that ended while reachable.
-    resubscribe_delay: Duration,
-    /// The anti-flicker policy the presenter runs.
-    policy: Policy,
-}
-
-impl Timing {
-    /// The production timing.
-    const DEFAULT: Self = Self {
-        resubscribe_delay: RESUBSCRIBE_DELAY,
-        policy: Policy::DEFAULT,
-    };
-}
-
-/// A running subscriber task.
-///
-/// [`Subscriber::shutdown`] signals the task to stop and awaits it.
-/// Dropping the handle without shutting down still stops the task at its
-/// next select point, because the closed channel resolves the stop branch.
-#[derive(Debug)]
-pub(crate) struct Subscriber {
-    stop: Option<oneshot::Sender<()>>,
-    task: Option<tokio::task::JoinHandle<()>>,
-}
-
-impl Subscriber {
-    /// Signals the subscriber to stop and waits for its task to finish.
-    pub(crate) async fn shutdown(mut self) {
-        if let Some(stop) = self.stop.take() {
-            let _ = stop.send(());
-        }
-        if let Some(task) = self.task.take() {
-            let _ = task.await;
-        }
-    }
-}
-
-/// Spawns the subscriber task against the gateway behind `gateway`,
-/// pushing busy and idle frames through `push` while `health` reads
-/// reachable.
-#[must_use]
-pub(crate) fn spawn(gateway: GatewayBinding, push: Push, health: GatewayHealth) -> Subscriber {
-    spawn_with_timing(gateway, push, health, Timing::DEFAULT)
-}
-
-/// [`spawn`] with every duration injected, so tests can shorten them.
-fn spawn_with_timing(
-    gateway: GatewayBinding,
-    push: Push,
-    health: GatewayHealth,
-    timing: Timing,
-) -> Subscriber {
-    let (stop, mut stopped) = oneshot::channel();
-    let task = tokio::spawn(async move {
-        run(&gateway, &push, &health, timing, &mut stopped).await;
-    });
-    Subscriber {
-        stop: Some(stop),
-        task: Some(task),
-    }
-}
-
-/// Why one wait ended early.
-pub(crate) enum Ended {
-    /// The stop signal fired, or a control channel closed: the task
-    /// returns.
-    Stop,
-    /// The endpoint binding was replaced: start over against the new one.
-    Rebind,
-    /// The gateway's reachability changed, or the stream closed: fall
-    /// back to the reconnect loop.
-    Lost,
-}
-
-/// The control signals every wait in a loop listens to beside its own
-/// future. The heartbeat writes reachability rather than following it,
-/// so it leaves `reachable` empty.
-pub(crate) struct Signals<'a> {
-    pub(crate) stop: &'a mut oneshot::Receiver<()>,
-    pub(crate) reachable: Option<&'a mut watch::Receiver<bool>>,
-    pub(crate) gateway_changed: &'a mut watch::Receiver<u64>,
-}
-
-impl Signals<'_> {
-    /// The current reachability verdict, marked seen so the next wait
-    /// wakes only on a later change. Without a watch it reads reachable.
-    fn reachable_now(&mut self) -> bool {
-        self.reachable
-            .as_deref_mut()
-            .is_none_or(|reachable| *reachable.borrow_and_update())
-    }
-}
-
-/// The subscription loop, in named phases: idle while unreachable,
-/// subscribe, drive the subscription, and recover from its end. Every
-/// wait goes through [`until`] and [`ticking`], so the stop signal wins
-/// each select and the presenter's deadlines keep ticking between
-/// subscriptions.
-async fn run(
-    gateway: &GatewayBinding,
-    push: &Push,
-    health: &GatewayHealth,
-    timing: Timing,
-    stop: &mut oneshot::Receiver<()>,
-) {
-    let mut reachable = health.subscribe();
-    let mut gateway_changed = gateway.subscribe();
-    let mut signals = Signals {
-        stop,
-        reachable: Some(&mut reachable),
-        gateway_changed: &mut gateway_changed,
-    };
-    let mut presenter = Presenter::new(timing.policy);
-    loop {
-        if let Err(Ended::Stop) = idle_until_reachable(&mut signals, &mut presenter, push).await {
-            return;
-        }
-        let snapshot = gateway.snapshot();
-        let stream = match subscribe(&snapshot, timing, &mut signals, &mut presenter, push).await {
-            Ok(stream) => stream,
-            Err(Ended::Stop) => return,
-            Err(Ended::Lost | Ended::Rebind) => continue,
-        };
-        let ended = drive_stream(stream, &mut signals, &mut presenter, push).await;
-        if let Err(Ended::Stop) = recover(ended, timing, &mut signals, &mut presenter, push).await {
-            return;
-        }
-    }
-}
-
-/// Idles while the gateway reads unreachable, waking on any control
-/// signal. Returns to proceed with a subscription, or on stop.
-async fn idle_until_reachable(
-    signals: &mut Signals<'_>,
-    presenter: &mut Presenter,
-    push: &Push,
-) -> Result<(), Ended> {
-    while !signals.reachable_now() {
-        match until(
-            ticking(std::future::pending::<()>(), presenter, push),
-            signals,
-        )
-        .await
-        {
-            Err(Ended::Stop) => return Err(Ended::Stop),
-            Err(Ended::Lost | Ended::Rebind) | Ok(()) => {}
-        }
-    }
-    Ok(())
-}
-
-/// Opens one progress subscription, waiting out the resubscribe delay and
-/// looping around when the endpoint declines. Returns the stream, or an
-/// [`Ended`] telling the loop to stop or loop around again.
-async fn subscribe(
-    snapshot: &GatewaySnapshot,
-    timing: Timing,
-    signals: &mut Signals<'_>,
-    presenter: &mut Presenter,
-    push: &Push,
-) -> Result<ProgressStream, Ended> {
-    match until(
-        ticking(snapshot.client().subscribe_progress(), presenter, push),
-        signals,
-    )
-    .await
-    {
-        Err(ended) => return Err(ended),
-        Ok(Ok(stream)) => return Ok(stream),
-        Ok(Err(error)) => {
-            tracing::warn!(%error, "gateway progress subscription failed");
-        }
-    }
-    // A declined subscription waits out the resubscribe delay, then loops
-    // around to try again.
-    match until(
-        ticking(
-            tokio::time::sleep(timing.resubscribe_delay),
-            presenter,
-            push,
-        ),
-        signals,
-    )
-    .await
-    {
-        Err(Ended::Stop) => Err(Ended::Stop),
-        Err(Ended::Lost | Ended::Rebind) | Ok(()) => Err(Ended::Lost),
-    }
-}
-
-/// Drives one subscription: every snapshot reaches the presenter, a
-/// malformed snapshot is skipped, and the stream's own end is reported.
-async fn drive_stream(
-    stream: ProgressStream,
-    signals: &mut Signals<'_>,
-    presenter: &mut Presenter,
-    push: &Push,
-) -> Ended {
-    tokio::pin!(stream);
-    loop {
-        match until(ticking(stream.next(), presenter, push), signals).await {
-            Err(ended) => break ended,
-            Ok(Some(Ok(snapshot))) => presenter.apply(snapshot, Instant::now(), push),
-            // One malformed snapshot or a terminal read failure; the
-            // stream itself decides which by continuing or ending.
-            Ok(Some(Err(error))) => {
-                tracing::warn!(%error, "gateway progress snapshot skipped");
-            }
-            Ok(None) => break Ended::Lost,
-        }
-    }
-}
-
-/// Handles a subscription's end: the bar rests because a subscription the
-/// workshop can no longer hear is stale, and - while still reachable - the
-/// loop waits out the resubscribe delay before subscribing again.
-async fn recover(
-    ended: Ended,
-    timing: Timing,
-    signals: &mut Signals<'_>,
-    presenter: &mut Presenter,
-    push: &Push,
-) -> Result<(), Ended> {
-    match ended {
-        Ended::Stop => return Err(Ended::Stop),
-        Ended::Rebind => {
-            presenter.detach(Instant::now(), push);
-            return Ok(());
-        }
-        Ended::Lost => presenter.detach(Instant::now(), push),
-    }
-    if signals.reachable_now() {
-        match until(
-            ticking(
-                tokio::time::sleep(timing.resubscribe_delay),
-                presenter,
-                push,
-            ),
-            signals,
-        )
-        .await
-        {
-            Err(Ended::Stop) => return Err(Ended::Stop),
-            Err(Ended::Lost | Ended::Rebind) | Ok(()) => {}
-        }
-    }
-    Ok(())
-}
-
-/// Awaits `future` with the control signals armed beside it. A control
-/// signal ends the wait early with its [`Ended`]. Both watch senders live
-/// in the registry's [`GatewayHandles`](crate::GatewayHandles) for the
-/// process lifetime, so a closed watch means shutdown.
-pub(crate) async fn until<F: Future>(
-    future: F,
-    signals: &mut Signals<'_>,
-) -> Result<F::Output, Ended> {
-    tokio::select! {
-        _ = &mut *signals.stop => Err(Ended::Stop),
-        changed = reachability_changed(signals.reachable.as_deref_mut()) => {
-            Err(if changed.is_err() { Ended::Stop } else { Ended::Lost })
-        }
-        changed = signals.gateway_changed.changed() => {
-            Err(if changed.is_err() { Ended::Stop } else { Ended::Rebind })
-        }
-        output = future => Ok(output),
-    }
-}
-
-/// Resolves on the next reachability change, or never without a watch.
-async fn reachability_changed(
-    reachable: Option<&mut watch::Receiver<bool>>,
-) -> Result<(), watch::error::RecvError> {
-    match reachable {
-        Some(reachable) => reachable.changed().await,
-        None => std::future::pending().await,
-    }
-}
-
-/// Awaits `future` while ticking the presenter at each of its deadlines,
-/// so a minimum-visible hold lapses on time even while the loop is
-/// between subscriptions.
-async fn ticking<F: Future>(future: F, presenter: &mut Presenter, push: &Push) -> F::Output {
-    tokio::pin!(future);
-    loop {
-        tokio::select! {
-            () = wake_at(presenter.next_wake()) => presenter.tick(Instant::now(), push),
-            output = &mut future => return output,
-        }
-    }
-}
-
-/// Waits for `at`, or forever when there is no pending deadline.
-async fn wake_at(at: Option<Instant>) {
-    match at {
-        Some(at) => tokio::time::sleep_until(at).await,
-        None => std::future::pending().await,
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/gateway/src/progress/presenter.rs b/crates/workshop/gateway/src/progress/presenter.rs
deleted file mode 100644
index 1c7917869..000000000
--- a/crates/workshop/gateway/src/progress/presenter.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//! The anti-flicker policy between the gateway's progress snapshots and
-//! the status bar: the barberpole appears only once the gateway has been
-//! busy for [`SHOW_DELAY`], stays up at least [`MIN_VISIBLE`] once shown,
-//! and follows the newest text while up. The policy lives here, next to
-//! the subscriber that feeds it, so the UI stays dumb and the wire type
-//! stays a plain busy flag plus text.
-//!
-//! [`Presenter`] is a pure state machine over explicit instants: the
-//! subscriber loop hands it every decoded snapshot and wakes it at
-//! [`Presenter::next_wake`], and the tests drive it with instants of
-//! their own choosing.
-
-use std::time::Duration;
-
-use tokio::time::Instant;
-
-use workshop_protocol::Activity;
-use workshop_registry::Push;
-
-use super::Progress;
-
-/// How long the gateway must stay busy before the barberpole appears;
-/// work shorter than this never disturbs the status bar.
-pub(super) const SHOW_DELAY: Duration = Duration::from_secs(1);
-
-/// How long the barberpole stays up once shown, so work that ends just
-/// past [`SHOW_DELAY`] reads as a completed activity.
-pub(super) const MIN_VISIBLE: Duration = Duration::from_millis(500);
-
-/// The tooltip on every gateway busy frame.
-const DESCRIPTION: &str = "gateway activity";
-
-/// The two anti-flicker durations, injectable so the subscriber tests
-/// run against a live mock gateway without waiting out the production
-/// values.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(super) struct Policy {
-    /// Busy time before the barberpole appears.
-    pub(super) show_delay: Duration,
-    /// Minimum time the barberpole stays up once shown.
-    pub(super) min_visible: Duration,
-}
-
-impl Policy {
-    /// The production policy.
-    pub(super) const DEFAULT: Self = Self {
-        show_delay: SHOW_DELAY,
-        min_visible: MIN_VISIBLE,
-    };
-}
-
-/// The gateway is busy: since when, and its newest text.
-#[derive(Debug)]
-struct Live {
-    since: Instant,
-    text: String,
-}
-
-/// The barberpole is up: since when, and the text last pushed.
-#[derive(Debug)]
-struct Shown {
-    at: Instant,
-    text: String,
-}
-
-/// The anti-flicker state machine over gateway snapshots.
-#[derive(Debug)]
-pub(super) struct Presenter {
-    policy: Policy,
-    live: Option<Live>,
-    shown: Option<Shown>,
-}
-
-impl Presenter {
-    /// A presenter at rest: nothing live, nothing shown.
-    pub(super) fn new(policy: Policy) -> Self {
-        Self {
-            policy,
-            live: None,
-            shown: None,
-        }
-    }
-
-    /// Records one decoded snapshot at `now` and pushes whatever
-    /// transition it calls for. A busy snapshot starts the show delay
-    /// (or replaces the live text); an idle snapshot ends the busy run
-    /// and starts the minimum-visible hold if the bar is up.
-    pub(super) fn apply(&mut self, snapshot: Progress, now: Instant, push: &Push) {
-        if snapshot.busy {
-            match &mut self.live {
-                Some(live) => live.text = snapshot.text,
-                None => {
-                    self.live = Some(Live {
-                        since: now,
-                        text: snapshot.text,
-                    });
-                }
-            }
-        } else {
-            self.live = None;
-        }
-        self.settle(now, push);
-    }
-
-    /// Re-evaluates the deadlines at `now` without a new snapshot: the
-    /// show delay lapsing pushes the bar up, the minimum-visible hold
-    /// lapsing pushes it idle.
-    pub(super) fn tick(&mut self, now: Instant, push: &Push) {
-        self.settle(now, push);
-    }
-
-    /// The next moment [`Presenter::tick`] can change state without a
-    /// snapshot: the show deadline while the gateway warms up, or the
-    /// earliest idle moment once the gateway went idle under a shown bar.
-    pub(super) fn next_wake(&self) -> Option<Instant> {
-        match (&self.live, &self.shown) {
-            (Some(live), None) => Some(live.since + self.policy.show_delay),
-            (None, Some(shown)) => Some(shown.at + self.policy.min_visible),
-            (Some(_), Some(_)) | (None, None) => None,
-        }
-    }
-
-    /// The subscription is gone at `now`: progress from a gateway the
-    /// workshop can no longer hear is stale, so this reads as an idle
-    /// snapshot. Any pending show is forgotten, and a shown bar rests once
-    /// its minimum-visible hold has lapsed, the same hold an idle snapshot
-    /// gets; the subscriber keeps [`Presenter::next_wake`] armed between
-    /// subscriptions so the hold lapses on time.
-    pub(super) fn detach(&mut self, now: Instant, push: &Push) {
-        self.live = None;
-        self.settle(now, push);
-    }
-
-    fn settle(&mut self, now: Instant, push: &Push) {
-        let Some(live) = &self.live else {
-            if let Some(shown) = &self.shown
-                && now.duration_since(shown.at) >= self.policy.min_visible
-            {
-                self.shown = None;
-                push.push_idle();
-            }
-            return;
-        };
-        match self.shown.as_mut() {
-            None => {
-                if now.duration_since(live.since) >= self.policy.show_delay {
-                    push.push_busy(live.text.clone(), DESCRIPTION, Activity::General);
-                    self.shown = Some(Shown {
-                        at: now,
-                        text: live.text.clone(),
-                    });
-                }
-            }
-            Some(shown) => {
-                if shown.text != live.text {
-                    push.push_busy(live.text.clone(), DESCRIPTION, Activity::General);
-                    shown.text.clone_from(&live.text);
-                }
-            }
-        }
-    }
-}
diff --git a/crates/workshop/gateway/src/progress/tests-presenter.rs b/crates/workshop/gateway/src/progress/tests-presenter.rs
deleted file mode 100644
index f7285ea43..000000000
--- a/crates/workshop/gateway/src/progress/tests-presenter.rs
+++ /dev/null
@@ -1,259 +0,0 @@
-//! The anti-flicker presenter pinned with explicit instants: a busy
-//! snapshot shows only after the show delay, an idle snapshot before the
-//! delay pushes nothing, an idle arriving within the minimum visible time
-//! is deferred to it, text changes republish while shown, and a detach
-//! rests a shown bar under the same hold.
-
-use super::*;
-
-/// A presenter under the production policy, its push, and the recorder.
-fn wired() -> (Presenter, Recorder) {
-    (Presenter::new(Policy::DEFAULT), recorder())
-}
-
-fn busy(text: &str) -> Progress {
-    Progress {
-        busy: true,
-        text: text.to_owned(),
-    }
-}
-
-fn idle() -> Progress {
-    Progress::default()
-}
-
-#[tokio::test]
-async fn a_busy_snapshot_pushes_only_once_the_show_delay_has_passed() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    assert!(
-        recorder.pushed().is_empty(),
-        "a fresh busy snapshot must not flash the bar"
-    );
-    assert_eq!(
-        presenter.next_wake(),
-        Some(start + SHOW_DELAY),
-        "the presenter asks to wake exactly at the show deadline"
-    );
-
-    presenter.tick(
-        start + SHOW_DELAY - Duration::from_millis(1),
-        &recorder.push,
-    );
-    assert!(
-        recorder.pushed().is_empty(),
-        "one millisecond short of the delay is still too soon"
-    );
-
-    presenter.tick(start + SHOW_DELAY, &recorder.push);
-    assert_eq!(
-        recorder.pushed(),
-        [("Downloading model".to_owned(), true)],
-        "the delay lapsing pushes one busy frame holding the gateway text"
-    );
-    assert_eq!(
-        presenter.next_wake(),
-        None,
-        "a shown bar with live work has no deadline of its own"
-    );
-}
-
-#[tokio::test]
-async fn an_idle_snapshot_before_the_show_delay_pushes_nothing() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Loading profile"), start, &recorder.push);
-    presenter.apply(idle(), start + Duration::from_millis(300), &recorder.push);
-    presenter.tick(start + SHOW_DELAY * 2, &recorder.push);
-    assert!(
-        recorder.pushed().is_empty(),
-        "sub-second work never disturbs the status bar"
-    );
-    assert_eq!(presenter.next_wake(), None);
-}
-
-#[tokio::test]
-async fn an_idle_snapshot_within_the_minimum_visible_time_is_deferred_to_it() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    assert_eq!(recorder.pushed().len(), 1, "the bar is up");
-
-    let ended = shown + Duration::from_millis(100);
-    presenter.apply(idle(), ended, &recorder.push);
-    assert_eq!(
-        recorder.pushed().len(),
-        1,
-        "an idle arriving 100ms after showing must not flash the bar off"
-    );
-    assert_eq!(
-        presenter.next_wake(),
-        Some(shown + MIN_VISIBLE),
-        "the presenter asks to wake when the minimum visible time lapses"
-    );
-
-    presenter.tick(
-        shown + MIN_VISIBLE - Duration::from_millis(1),
-        &recorder.push,
-    );
-    assert_eq!(recorder.pushed().len(), 1, "still inside the hold");
-
-    presenter.tick(shown + MIN_VISIBLE, &recorder.push);
-    assert_eq!(
-        recorder.pushed(),
-        [
-            ("Downloading model".to_owned(), true),
-            ("Ready".to_owned(), false),
-        ],
-        "the hold lapsing rests the bar"
-    );
-    assert_eq!(presenter.next_wake(), None);
-}
-
-#[tokio::test]
-async fn an_idle_snapshot_after_the_minimum_visible_time_rests_the_bar_at_once() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    presenter.apply(idle(), shown + MIN_VISIBLE * 4, &recorder.push);
-    assert_eq!(
-        recorder.pushed().last(),
-        Some(&("Ready".to_owned(), false)),
-        "an idle past the hold needs no deferral"
-    );
-}
-
-#[tokio::test]
-async fn a_text_change_while_shown_republishes_and_an_unchanged_text_does_not() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model 10%"), start, &recorder.push);
-    presenter.apply(
-        busy("Downloading model 20%"),
-        start + Duration::from_millis(500),
-        &recorder.push,
-    );
-    assert!(
-        recorder.pushed().is_empty(),
-        "text changes before the delay stay pending"
-    );
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    assert_eq!(
-        recorder.pushed(),
-        [("Downloading model 20%".to_owned(), true)],
-        "the delay lapsing pushes the newest text, not the first"
-    );
-
-    presenter.apply(
-        busy("Downloading model 20%"),
-        shown + Duration::from_millis(10),
-        &recorder.push,
-    );
-    assert_eq!(
-        recorder.pushed().len(),
-        1,
-        "a snapshot repeating the shown text is not re-pushed"
-    );
-
-    presenter.apply(
-        busy("Downloading model 30%"),
-        shown + Duration::from_millis(20),
-        &recorder.push,
-    );
-    assert_eq!(
-        recorder.pushed().last(),
-        Some(&("Downloading model 30%".to_owned(), true)),
-        "a new text republishes while the bar is up"
-    );
-}
-
-#[tokio::test]
-async fn work_resuming_during_the_hold_keeps_the_bar_up_without_a_new_delay() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Selecting profile"), start, &recorder.push);
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    presenter.apply(idle(), shown + Duration::from_millis(100), &recorder.push);
-    presenter.apply(
-        busy("Starting models"),
-        shown + Duration::from_millis(200),
-        &recorder.push,
-    );
-    assert_eq!(
-        recorder.pushed(),
-        [
-            ("Selecting profile".to_owned(), true),
-            ("Starting models".to_owned(), true),
-        ],
-        "back-to-back work shares one visible run: no idle frame, no second delay"
-    );
-    assert_eq!(presenter.next_wake(), None);
-}
-
-#[tokio::test]
-async fn a_detach_within_the_minimum_visible_time_is_deferred_to_it() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    presenter.detach(shown + Duration::from_millis(100), &recorder.push);
-    assert_eq!(
-        recorder.pushed().len(),
-        1,
-        "a subscription lost 100ms after showing must not flash the bar off"
-    );
-    assert_eq!(
-        presenter.next_wake(),
-        Some(shown + MIN_VISIBLE),
-        "the presenter asks to wake when the minimum visible time lapses"
-    );
-
-    presenter.tick(shown + MIN_VISIBLE, &recorder.push);
-    assert_eq!(
-        recorder.pushed(),
-        [
-            ("Downloading model".to_owned(), true),
-            ("Ready".to_owned(), false),
-        ],
-        "the hold lapsing rests the bar"
-    );
-    assert_eq!(presenter.next_wake(), None);
-}
-
-#[tokio::test]
-async fn a_detach_after_the_minimum_visible_time_rests_the_bar_at_once() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    let shown = start + SHOW_DELAY;
-    presenter.tick(shown, &recorder.push);
-    presenter.detach(shown + MIN_VISIBLE, &recorder.push);
-    assert_eq!(
-        recorder.pushed().last(),
-        Some(&("Ready".to_owned(), false)),
-        "a lost subscription past the hold rests the bar at once"
-    );
-    assert_eq!(presenter.next_wake(), None);
-}
-
-#[tokio::test]
-async fn a_detach_before_the_bar_showed_forgets_the_pending_work() {
-    let (mut presenter, recorder) = wired();
-    let start = Instant::now();
-    presenter.apply(busy("Downloading model"), start, &recorder.push);
-    presenter.detach(start + Duration::from_millis(300), &recorder.push);
-    assert_eq!(presenter.next_wake(), None);
-    presenter.tick(start + SHOW_DELAY * 2, &recorder.push);
-    assert!(
-        recorder.pushed().is_empty(),
-        "a detach before the bar showed pushes nothing, then or later"
-    );
-}
diff --git a/crates/workshop/gateway/src/progress/tests-recovery.rs b/crates/workshop/gateway/src/progress/tests-recovery.rs
deleted file mode 100644
index 874dc639a..000000000
--- a/crates/workshop/gateway/src/progress/tests-recovery.rs
+++ /dev/null
@@ -1,47 +0,0 @@
-//! Progress subscription recovery: an endpoint replacement moves the subscription at once.
-
-use super::*;
-
-#[tokio::test]
-async fn an_endpoint_replacement_moves_the_progress_subscription_immediately() {
-    let original = Arc::new(MockProgress::new());
-    let original_url = spawn_gateway(Arc::clone(&original).router()).await;
-    let replacement = Arc::new(MockProgress::new());
-    let replacement_url = spawn_gateway(Arc::clone(&replacement).router()).await;
-    let gateway = binding(&original_url);
-    let recorder = recorder();
-    let subscriber = spawn_with_timing(
-        gateway.clone(),
-        recorder.push.clone(),
-        GatewayHealth::new(),
-        FAST_TIMING,
-    );
-
-    wait_for_connections(&original, 1).await;
-    original.send(true, "original-download");
-    recorder.frames_where(|frames| frames.len() == 1).await;
-
-    gateway
-        .replace(&replacement_url, "")
-        .expect("the replacement publishes");
-    let pushed = recorder.frames_where(|frames| frames.len() == 2).await;
-    assert_eq!(
-        pushed[1],
-        ("Ready".to_owned(), false),
-        "the old endpoint's progress is stale the moment the binding moves"
-    );
-    wait_for_connections(&replacement, 1).await;
-    replacement.send(true, "replacement-download");
-    let pushed = recorder.frames_where(|frames| frames.len() == 3).await;
-    assert_eq!(
-        pushed[2],
-        ("replacement-download".to_owned(), true),
-        "the replacement's snapshots drive the bar"
-    );
-    assert_eq!(
-        original.connections.load(Ordering::Relaxed),
-        1,
-        "the old endpoint is never retried after publication"
-    );
-    subscriber.shutdown().await;
-}
diff --git a/crates/workshop/gateway/src/progress/tests.rs b/crates/workshop/gateway/src/progress/tests.rs
deleted file mode 100644
index af02b5473..000000000
--- a/crates/workshop/gateway/src/progress/tests.rs
+++ /dev/null
@@ -1,367 +0,0 @@
-//! Subscriber tests against a mock `GET /admin/progress`: snapshots
-//! reach the status bar as busy frames under the anti-flicker policy,
-//! a malformed snapshot is skipped, a closed stream resubscribes after
-//! the delay, an unreachable gateway holds no subscription, and a
-//! reconnect rests the bar and resubscribes once. A lost subscription
-//! rests the bar under the presenter's minimum-visible hold, which the
-//! loop keeps ticking between subscriptions. The presenter's timing
-//! rules are pinned separately with explicit instants; here the policy
-//! runs at millisecond scale so the mock round trips stay fast.
-
-use super::*;
-
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::{Arc, Mutex, PoisonError};
-
-use axum::extract::State;
-use axum::response::{IntoResponse, Response};
-use tokio::sync::broadcast;
-
-use workshop_protocol::StatusBarUpdate;
-use workshop_registry::{Registration, Registry, StatusSink, StatusSinkAdapter};
-
-/// The anti-flicker policy the mock-gateway tests run under: short
-/// enough that a test waits milliseconds, long enough that a snapshot
-/// still has to outlive the show delay to reach the bar.
-const FAST_POLICY: Policy = Policy {
-    show_delay: Duration::from_millis(40),
-    min_visible: Duration::from_millis(20),
-};
-
-/// The production resubscribe delay is seconds; the tests inject this.
-const FAST_TIMING: Timing = Timing {
-    resubscribe_delay: Duration::from_millis(50),
-    policy: FAST_POLICY,
-};
-
-/// Binds `app` as a mock gateway on a free loopback port and returns its
-/// base URL.
-async fn spawn_gateway(app: axum::Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
-
-/// A replaceable binding for one mock gateway.
-fn binding(base_url: &str) -> GatewayBinding {
-    GatewayBinding::new(base_url, "").expect("the test binding builds")
-}
-
-/// A recording status sink behind a [`Push`]: every frame the subscriber
-/// pushes lands in `frames`, in order.
-struct Recorder {
-    push: Push,
-    frames: Arc<Mutex<Vec<StatusBarUpdate>>>,
-    _guard: Registration,
-}
-
-fn recorder() -> Recorder {
-    let registry = Registry::new();
-    let frames: Arc<Mutex<Vec<StatusBarUpdate>>> = Arc::new(Mutex::new(Vec::new()));
-    let sink = Arc::clone(&frames);
-    let guard =
-        registry.register_sink::<dyn StatusSink>(Arc::new(StatusSinkAdapter::new(move |update| {
-            sink.lock()
-                .unwrap_or_else(PoisonError::into_inner)
-                .push(update);
-        })));
-    Recorder {
-        push: registry.push(),
-        frames,
-        _guard: guard,
-    }
-}
-
-impl Recorder {
-    /// The `(label, busy)` of every frame pushed so far.
-    fn pushed(&self) -> Vec<(String, bool)> {
-        self.frames
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .iter()
-            .map(|update| (update.label.clone(), update.busy))
-            .collect()
-    }
-
-    /// Polls until `accept` holds over the pushed frames, within a
-    /// generous deadline (the heartbeat tests' snapshot_where pattern).
-    async fn frames_where(
-        &self,
-        accept: impl Fn(&[(String, bool)]) -> bool,
-    ) -> Vec<(String, bool)> {
-        tokio::time::timeout(Duration::from_secs(5), async {
-            loop {
-                let pushed = self.pushed();
-                if accept(&pushed) {
-                    return pushed;
-                }
-                tokio::time::sleep(Duration::from_millis(5)).await;
-            }
-        })
-        .await
-        .expect("matching frames arrive within the deadline")
-    }
-}
-
-/// A mock `GET /admin/progress`: every payload published to the feed
-/// streams to every connected subscriber as an SSE `data:` frame, and
-/// `connections` counts how often the endpoint was hit. The receiver
-/// is created before the count increments, so a test that observes a
-/// connection can publish without losing the frame. [`close`](Self::close)
-/// ends every live stream, so a test can drive the resubscribe path.
-struct MockProgress {
-    connections: AtomicUsize,
-    feeds: Mutex<broadcast::Sender<String>>,
-}
-
-impl MockProgress {
-    fn new() -> Self {
-        Self {
-            connections: AtomicUsize::new(0),
-            feeds: Mutex::new(broadcast::channel(16).0),
-        }
-    }
-
-    fn router(self: Arc<Self>) -> axum::Router {
-        axum::Router::new()
-            .route("/admin/progress", axum::routing::get(serve_feed))
-            .with_state(self)
-    }
-
-    /// Publishes one snapshot to every connected subscriber.
-    fn send(&self, busy: bool, text: &str) {
-        self.send_raw(serde_json::json!({"busy": busy, "text": text}).to_string());
-    }
-
-    /// Publishes one raw payload to every connected subscriber.
-    fn send_raw(&self, payload: String) {
-        self.feeds
-            .lock()
-            .expect("the feed lock is not poisoned")
-            .send(payload)
-            .expect("the mock has a subscriber");
-    }
-
-    /// Ends every live stream; later connections subscribe to the
-    /// fresh feed.
-    fn close(&self) {
-        *self.feeds.lock().expect("the feed lock is not poisoned") = broadcast::channel(16).0;
-    }
-}
-
-async fn serve_feed(State(mock): State<Arc<MockProgress>>) -> Response {
-    let rx = mock
-        .feeds
-        .lock()
-        .expect("the feed lock is not poisoned")
-        .subscribe();
-    mock.connections.fetch_add(1, Ordering::Relaxed);
-    let stream = futures_util::stream::unfold(rx, |mut rx| async move {
-        loop {
-            match rx.recv().await {
-                Ok(payload) => {
-                    return Some((
-                        Ok::<_, std::convert::Infallible>(format!("data: {payload}\n\n")),
-                        rx,
-                    ));
-                }
-                Err(broadcast::error::RecvError::Lagged(_)) => {}
-                Err(broadcast::error::RecvError::Closed) => return None,
-            }
-        }
-    });
-    (
-        [(axum::http::header::CONTENT_TYPE, "text/event-stream")],
-        axum::body::Body::from_stream(stream),
-    )
-        .into_response()
-}
-
-/// Polls the mock's connection count until it reaches `n`.
-async fn wait_for_connections(mock: &MockProgress, n: usize) {
-    tokio::time::timeout(Duration::from_secs(5), async {
-        while mock.connections.load(Ordering::Relaxed) < n {
-            tokio::time::sleep(Duration::from_millis(5)).await;
-        }
-    })
-    .await
-    .expect("the subscriber connects within the deadline");
-}
-
-#[tokio::test]
-async fn a_busy_snapshot_reaches_the_status_bar_as_a_busy_frame_with_the_gateway_text() {
-    let mock = Arc::new(MockProgress::new());
-    let base_url = spawn_gateway(Arc::clone(&mock).router()).await;
-    let recorder = recorder();
-    // The flag starts optimistic, so the subscriber connects at once.
-    let subscriber = spawn_with_timing(
-        binding(&base_url),
-        recorder.push.clone(),
-        GatewayHealth::new(),
-        FAST_TIMING,
-    );
-
-    wait_for_connections(&mock, 1).await;
-    mock.send(true, "Downloading qwen3-8b.gguf 45%");
-
-    let pushed = recorder.frames_where(|frames| !frames.is_empty()).await;
-    assert_eq!(
-        pushed,
-        [("Downloading qwen3-8b.gguf 45%".to_owned(), true)],
-        "the gateway's text is the bar's label and the frame is busy"
-    );
-
-    mock.send(false, "");
-    let pushed = recorder.frames_where(|frames| frames.len() == 2).await;
-    assert_eq!(
-        pushed[1],
-        ("Ready".to_owned(), false),
-        "the idle snapshot rests the bar once the minimum visible time passes"
-    );
-    subscriber.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_malformed_snapshot_is_skipped_and_the_stream_continues() {
-    let mock = Arc::new(MockProgress::new());
-    let base_url = spawn_gateway(Arc::clone(&mock).router()).await;
-    let recorder = recorder();
-    let subscriber = spawn_with_timing(
-        binding(&base_url),
-        recorder.push.clone(),
-        GatewayHealth::new(),
-        FAST_TIMING,
-    );
-
-    wait_for_connections(&mock, 1).await;
-    // One undecodable `data:` block ahead of a valid snapshot: the
-    // subscriber warns and continues rather than dropping the stream.
-    mock.send_raw("{not valid json".to_owned());
-    mock.send(true, "Loading profile");
-
-    let pushed = recorder.frames_where(|frames| !frames.is_empty()).await;
-    assert_eq!(
-        pushed,
-        [("Loading profile".to_owned(), true)],
-        "the snapshot after the malformed one still reaches the bar"
-    );
-    assert_eq!(
-        mock.connections.load(Ordering::Relaxed),
-        1,
-        "a malformed snapshot never drops the subscription"
-    );
-    subscriber.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_stream_that_ends_while_reachable_rests_the_bar_and_resubscribes_after_the_delay() {
-    let mock = Arc::new(MockProgress::new());
-    let base_url = spawn_gateway(Arc::clone(&mock).router()).await;
-    let recorder = recorder();
-    let subscriber = spawn_with_timing(
-        binding(&base_url),
-        recorder.push.clone(),
-        GatewayHealth::new(),
-        FAST_TIMING,
-    );
-
-    wait_for_connections(&mock, 1).await;
-    mock.send(true, "Downloading");
-    recorder.frames_where(|frames| frames.len() == 1).await;
-
-    // The stream ends while the gateway still reads reachable: the bar
-    // rests once its minimum visible time lapses, which falls inside the
-    // resubscribe wait, and a fresh subscription follows the delay.
-    let closed = std::time::Instant::now();
-    mock.close();
-    let pushed = recorder.frames_where(|frames| frames.len() == 2).await;
-    assert_eq!(
-        pushed[1],
-        ("Ready".to_owned(), false),
-        "a lost subscription rests the bar: its progress is stale"
-    );
-    wait_for_connections(&mock, 2).await;
-    assert!(
-        closed.elapsed() >= FAST_TIMING.resubscribe_delay,
-        "the resubscribe waits out the delay rather than spinning"
-    );
-    subscriber.shutdown().await;
-}
-
-#[tokio::test]
-async fn an_unreachable_gateway_holds_no_subscription_and_pushes_nothing() {
-    let mock = Arc::new(MockProgress::new());
-    let base_url = spawn_gateway(Arc::clone(&mock).router()).await;
-    let recorder = recorder();
-    let health = GatewayHealth::new();
-    health.publish(false);
-    let subscriber = spawn_with_timing(
-        binding(&base_url),
-        recorder.push.clone(),
-        health.clone(),
-        FAST_TIMING,
-    );
-
-    let quiet = tokio::time::timeout(Duration::from_millis(200), async {
-        wait_for_connections(&mock, 1).await;
-    })
-    .await;
-    assert!(
-        quiet.is_err(),
-        "an unreachable gateway must not be subscribed"
-    );
-    assert!(
-        recorder.pushed().is_empty(),
-        "a subscriber that never connected pushes nothing"
-    );
-
-    health.publish(true);
-    wait_for_connections(&mock, 1).await;
-    subscriber.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_reconnect_rests_the_bar_and_resubscribes_once() {
-    let mock = Arc::new(MockProgress::new());
-    let base_url = spawn_gateway(Arc::clone(&mock).router()).await;
-    let recorder = recorder();
-    let health = GatewayHealth::new();
-    let subscriber = spawn_with_timing(
-        binding(&base_url),
-        recorder.push.clone(),
-        health.clone(),
-        FAST_TIMING,
-    );
-
-    wait_for_connections(&mock, 1).await;
-    mock.send(true, "Downloading");
-    recorder.frames_where(|frames| frames.len() == 1).await;
-
-    health.publish(false);
-    let pushed = recorder.frames_where(|frames| frames.len() == 2).await;
-    assert_eq!(
-        pushed[1],
-        ("Ready".to_owned(), false),
-        "an unreachable verdict rests the bar"
-    );
-
-    health.publish(true);
-    wait_for_connections(&mock, 2).await;
-    mock.send(true, "Starting models");
-    let pushed = recorder.frames_where(|frames| frames.len() == 3).await;
-    assert_eq!(
-        pushed[2],
-        ("Starting models".to_owned(), true),
-        "the fresh subscription's snapshots reach the bar"
-    );
-    assert_eq!(
-        mock.connections.load(Ordering::Relaxed),
-        2,
-        "the reconnect resubscribes exactly once"
-    );
-    subscriber.shutdown().await;
-}
-
-#[path = "tests-presenter.rs"]
-mod presenter;
-#[path = "tests-recovery.rs"]
-mod recovery;
diff --git a/crates/workshop/gateway/src/refresh.rs b/crates/workshop/gateway/src/refresh.rs
deleted file mode 100644
index 0af53d673..000000000
--- a/crates/workshop/gateway/src/refresh.rs
+++ /dev/null
@@ -1,117 +0,0 @@
-//! Gateway profile and model-catalog refresh after reachability.
-
-use workshop_protocol::is_chat_capable;
-use workshop_registry::Push;
-
-use crate::client::GatewayClient;
-
-/// Re-fetches the gateway's model catalog and pushes it to every session.
-///
-/// A failed, declined, or malformed catalog is logged and skipped rather
-/// than pushed: pushing a bad snapshot would clear pickers that still hold
-/// a usable list.
-pub async fn refresh_catalog(client: &GatewayClient, push: &Push) -> bool {
-    let response = match client.list_models().await {
-        Ok(response) => response,
-        Err(error) => {
-            tracing::warn!(%error, "catalog refresh failed");
-            return false;
-        }
-    };
-    if !response.status.is_success() {
-        tracing::warn!(status = %response.status, "catalog refresh was declined");
-        return false;
-    }
-    let body: serde_json::Value = match serde_json::from_slice(&response.body) {
-        Ok(body) => body,
-        Err(error) => {
-            tracing::warn!(%error, "catalog refresh was not JSON");
-            return false;
-        }
-    };
-    let Some(models) = body.get("data").and_then(serde_json::Value::as_array) else {
-        tracing::warn!("catalog refresh is missing its data array");
-        return false;
-    };
-    let selectable = models.iter().any(is_chat_capable);
-    push.push_models_catalog(models.clone());
-    selectable
-}
-
-/// The decoded body of `GET /admin/profiles`.
-#[derive(serde::Deserialize)]
-struct ProfileList {
-    /// Every profile name the gateway can serve, in gateway order.
-    profiles: Vec<String>,
-}
-
-/// The decoded body of `GET /admin/status`, reduced to the one field the
-/// menu needs.
-#[derive(serde::Deserialize)]
-struct ProfileStatus {
-    /// The profile the gateway is serving.
-    profile: Option<String>,
-}
-
-/// Fetches the gateway's profile list and active profile and publishes
-/// them into the workbench snapshot.
-///
-/// A failed or declined profile fetch is a state, not an error: it
-/// degrades its half to empty, as a malformed answer does, so the menu
-/// shows no profiles rather than stale names.
-pub async fn refresh_profiles(client: &GatewayClient, push: &Push) -> bool {
-    let (profiles, active) = tokio::join!(fetch_profile_list(client), fetch_active_profile(client));
-    let ready = profiles.as_ref().is_some_and(|profiles| {
-        !profiles.is_empty()
-            && active
-                .as_ref()
-                .is_some_and(|active| profiles.contains(active))
-    });
-    push.menu()
-        .set_profiles(profiles.unwrap_or_default(), active);
-    ready
-}
-
-/// The gateway's profile names, or `None` on a failed response.
-async fn fetch_profile_list(client: &GatewayClient) -> Option<Vec<String>> {
-    let response = match client.list_profiles().await {
-        Ok(response) => response,
-        Err(error) => {
-            tracing::warn!(%error, "profile list fetch failed");
-            return None;
-        }
-    };
-    if !response.status.is_success() {
-        tracing::warn!(status = %response.status, "profile list was declined");
-        return None;
-    }
-    match serde_json::from_slice::<ProfileList>(&response.body) {
-        Ok(list) => Some(list.profiles),
-        Err(error) => {
-            tracing::warn!(%error, "profile list was not the expected JSON");
-            None
-        }
-    }
-}
-
-/// The active profile name, or `None` on a failed response.
-async fn fetch_active_profile(client: &GatewayClient) -> Option<String> {
-    let response = match client.profile_status().await {
-        Ok(response) => response,
-        Err(error) => {
-            tracing::warn!(%error, "profile status fetch failed");
-            return None;
-        }
-    };
-    if !response.status.is_success() {
-        tracing::warn!(status = %response.status, "profile status was declined");
-        return None;
-    }
-    match serde_json::from_slice::<ProfileStatus>(&response.body) {
-        Ok(status) => status.profile,
-        Err(error) => {
-            tracing::warn!(%error, "profile status was not the expected JSON");
-            None
-        }
-    }
-}
diff --git a/crates/workshop/gateway/src/resolve-tests.rs b/crates/workshop/gateway/src/resolve-tests.rs
deleted file mode 100644
index 7df81781c..000000000
--- a/crates/workshop/gateway/src/resolve-tests.rs
+++ /dev/null
@@ -1,343 +0,0 @@
-//! Gateway resolution tests: discovery file versus explicit config, stale files, and probe failures.
-
-use super::*;
-
-use std::io::{Read, Write as _};
-use std::net::TcpListener;
-
-use crate::discovery::GatewayDiscoveryFile;
-
-/// The test process's own image name, so the probe's pid and image
-/// checks pass and the test reaches the liveness probes.
-fn own_image_name() -> String {
-    std::env::current_exe()
-        .expect("current exe")
-        .file_name()
-        .expect("the exe has a file name")
-        .to_string_lossy()
-        .into_owned()
-}
-
-/// A probe running the real liveness gauntlet against the test
-/// binary's own image.
-fn probe_own_image(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    crate::discovery::resolve_for_test(run_dir, &own_image_name())
-}
-
-/// A gateway discovery file pointing at the test process itself.
-fn live_file(port: u16, api_key: &str) -> GatewayDiscoveryFile {
-    GatewayDiscoveryFile {
-        port,
-        api_key: api_key.to_owned(),
-        pid: std::process::id(),
-        epoch: 1_757_000_000,
-        version: "0.2.0".to_owned(),
-        started_at: "2026-09-03T12:00:00Z".to_owned(),
-    }
-}
-
-/// A pid guaranteed dead: a short-lived child, reaped and dropped so
-/// no handle keeps the process object alive.
-fn dead_pid() -> u32 {
-    let mut child = std::process::Command::new(std::env::current_exe().expect("current exe"))
-        .arg("--list")
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .expect("spawn a short-lived child");
-    let pid = child.id();
-    child.wait().expect("the child exits");
-    drop(child);
-    pid
-}
-
-/// A fixture gateway: answers `GET /health` with 200 and the key
-/// probe with 200 only when the bearer matches `expected_key`.
-fn fixture_gateway(expected_key: &'static str) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fixture");
-    let port = listener.local_addr().expect("fixture address").port();
-    std::thread::spawn(move || {
-        while let Ok((mut stream, _)) = listener.accept() {
-            for _ in 0..2 {
-                let mut buffer = [0u8; 1024];
-                let Ok(read) = stream.read(&mut buffer) else {
-                    break;
-                };
-                let request = String::from_utf8_lossy(&buffer[..read]);
-                let accepted = request.starts_with("GET /health ")
-                    || request.contains(&format!("Authorization: Bearer {expected_key}\r\n"));
-                let response = if accepted {
-                    &b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"[..]
-                } else {
-                    &b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"[..]
-                };
-                if stream.write_all(response).is_err() {
-                    break;
-                }
-            }
-        }
-    });
-    port
-}
-
-/// An explicit gateway config: a LAN URL, never the built-in default.
-fn explicit_config() -> GatewayConfig {
-    GatewayConfig {
-        base_url: "http://gateway.lan:9999".to_owned(),
-        api_key: "config-key".to_owned(),
-    }
-}
-
-#[test]
-fn a_live_gateway_discovery_file_wins_over_explicit_config() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let gateway = crate::test_gateway::ValidatedGateway::spawn("file-key");
-    let port = gateway.port();
-    gateway
-        .gateway_discovery_file("file-key", 1_757_000_000, "2026-09-03T12:00:00Z")
-        .write_to(dir.path())
-        .expect("write");
-
-    let resolved =
-        resolve_with(Some(dir.path()), &explicit_config(), probe).expect("a live file resolves");
-    assert_eq!(resolved.source(), GatewaySource::GatewayDiscoveryFile);
-    assert_eq!(resolved.base_url(), format!("http://127.0.0.1:{port}"));
-    assert_eq!(resolved.api_key(), "file-key");
-    assert_eq!(
-        resolved.identity().map(ValidatedConnection::port),
-        Some(port),
-        "the winning sidecar retains its validated identity for the initial snapshot"
-    );
-    assert_eq!(resolved.stale(), None);
-}
-
-#[test]
-fn a_stale_file_is_cleaned_and_explicit_config_wins() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..live_file(1, "k")
-    };
-    file.write_to(dir.path()).expect("write");
-
-    let resolved = resolve_with(Some(dir.path()), &explicit_config(), probe_own_image)
-        .expect("explicit config is the fallback");
-    assert_eq!(resolved.source(), GatewaySource::Config);
-    assert_eq!(resolved.base_url(), "http://gateway.lan:9999");
-    assert_eq!(resolved.api_key(), "config-key");
-    assert_eq!(resolved.stale(), Some(StaleReason::ProcessDead));
-    assert!(
-        !crate::discovery::gateway_discovery_file_path(dir.path()).exists(),
-        "the stale file was removed"
-    );
-}
-
-#[test]
-fn a_wrong_key_is_reported_distinctly_from_a_dead_pid() {
-    // Wrong key: the pid, image, and health checks pass; the key
-    // probe rejects.
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let port = fixture_gateway("right");
-    live_file(port, "wrong")
-        .write_to(dir.path())
-        .expect("write");
-    let resolved = resolve_with(Some(dir.path()), &explicit_config(), probe_own_image)
-        .expect("explicit config is the fallback");
-    assert_eq!(resolved.stale(), Some(StaleReason::KeyRejected));
-
-    // Dead pid: the process check fails before any probe runs.
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = GatewayDiscoveryFile {
-        pid: dead_pid(),
-        ..live_file(1, "k")
-    };
-    file.write_to(dir.path()).expect("write");
-    let resolved = resolve_with(Some(dir.path()), &explicit_config(), probe_own_image)
-        .expect("explicit config is the fallback");
-    assert_eq!(resolved.stale(), Some(StaleReason::ProcessDead));
-}
-
-#[test]
-fn no_file_and_no_explicit_config_is_the_plain_error() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = GatewayConfig {
-        base_url: String::new(),
-        api_key: String::new(),
-    };
-    let error = resolve_with(Some(dir.path()), &config, probe_own_image)
-        .expect_err("an empty base_url is not explicit config");
-    assert!(
-        error
-            .to_string()
-            .contains("no gateway configured or running"),
-        "the error says it plainly: {error}"
-    );
-    assert_eq!(error.stale(), None, "no file existed to remove");
-}
-
-#[test]
-fn an_explicitly_configured_default_url_is_honored() {
-    // The well-known default URL written by hand is explicit config:
-    // it names a gateway discovery cannot see (an SSH-tunneled remote,
-    // a gateway whose discovery-file write failed), so it must
-    // resolve, not read as an unset value.
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = GatewayConfig {
-        base_url: "http://127.0.0.1:8081".to_owned(),
-        api_key: "config-key".to_owned(),
-    };
-    let resolved = resolve_with(Some(dir.path()), &config, probe_own_image)
-        .expect("an explicitly configured URL resolves");
-    assert_eq!(resolved.source(), GatewaySource::Config);
-    assert_eq!(resolved.base_url(), "http://127.0.0.1:8081");
-    assert_eq!(resolved.api_key(), "config-key");
-}
-
-#[test]
-fn a_stale_file_with_no_explicit_config_names_the_reason_in_the_error() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let port = fixture_gateway("right");
-    live_file(port, "wrong")
-        .write_to(dir.path())
-        .expect("write");
-    let config = GatewayConfig {
-        base_url: String::new(),
-        api_key: String::new(),
-    };
-    let error = resolve_with(Some(dir.path()), &config, probe_own_image)
-        .expect_err("no explicit config remains");
-    assert_eq!(error.stale(), Some(StaleReason::KeyRejected));
-    let message = error.to_string();
-    assert!(
-        message.contains("no gateway configured or running"),
-        "the error says it plainly: {message}"
-    );
-    assert!(
-        message.contains("key was rejected"),
-        "the removed file's reason is named: {message}"
-    );
-}
-
-#[test]
-fn no_file_and_explicit_config_uses_the_config() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let resolved = resolve_with(Some(dir.path()), &explicit_config(), probe_own_image)
-        .expect("explicit config resolves");
-    assert_eq!(resolved.source(), GatewaySource::Config);
-    assert_eq!(resolved.stale(), None);
-}
-
-/// A probe whose discovery-file read fails: a directory sits where
-/// `gateway.json` belongs, so the read errors instead of answering.
-fn probe_read_failure(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    std::fs::create_dir(run_dir.join("gateway.json")).expect("the unreadable file plants");
-    crate::discovery::resolve_for_test(run_dir, &own_image_name())
-}
-
-#[test]
-fn a_probe_io_failure_degrades_to_the_config_fallback() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let resolved = resolve_with(Some(dir.path()), &explicit_config(), probe_read_failure)
-        .expect("a probe failure never fails startup on its own");
-    assert_eq!(resolved.source(), GatewaySource::Config);
-    assert_eq!(resolved.base_url(), "http://gateway.lan:9999");
-    assert_eq!(resolved.stale(), None, "nothing was removed");
-}
-
-#[test]
-fn a_probe_io_failure_with_no_explicit_config_is_the_plain_error() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = GatewayConfig {
-        base_url: String::new(),
-        api_key: String::new(),
-    };
-    let error = resolve_with(Some(dir.path()), &config, probe_read_failure)
-        .expect_err("no explicit config remains after a probe failure");
-    assert!(
-        error
-            .to_string()
-            .contains("no gateway configured or running"),
-        "the error says it plainly: {error}"
-    );
-    assert_eq!(
-        error.stale(),
-        None,
-        "a probe failure does not remove the file"
-    );
-}
-
-#[test]
-fn no_run_directory_skips_discovery() {
-    // The production probe stands in: with no run directory it is
-    // never called, so resolution is the config fallback or the plain
-    // error, and the real run directory is never consulted.
-    let resolved = resolve_with(None, &explicit_config(), probe)
-        .expect("explicit config resolves without a run directory");
-    assert_eq!(resolved.source(), GatewaySource::Config);
-    assert_eq!(resolved.stale(), None);
-
-    let config = GatewayConfig {
-        base_url: String::new(),
-        api_key: String::new(),
-    };
-    let error = resolve_with(None, &config, probe)
-        .expect_err("no run directory and no explicit config is the plain error");
-    assert!(
-        error
-            .to_string()
-            .contains("no gateway configured or running"),
-        "the error says it plainly: {error}"
-    );
-}
-
-#[test]
-fn the_report_names_the_winning_source_and_a_removed_file() {
-    // A recording status sink stands in for the status bus: the report's
-    // frames land on it through the registry's push facade.
-    let registry = workshop_registry::Registry::new();
-    let (status_tx, mut receiver) = tokio::sync::broadcast::channel(16);
-    let _sink = registry.register_sink::<dyn workshop_registry::StatusSink>(std::sync::Arc::new(
-        workshop_registry::StatusSinkAdapter::new(move |update| {
-            let _ = status_tx.send(update);
-        }),
-    ));
-    let push = registry.push();
-
-    let resolved = ResolvedGateway {
-        base_url: "http://127.0.0.1:4000".to_owned(),
-        api_key: "k".to_owned(),
-        identity: None,
-        source: GatewaySource::Config,
-        stale: Some(StaleReason::KeyRejected),
-    };
-    report(&resolved, &push);
-
-    let stale_frame = receiver.try_recv().expect("the stale note is reported");
-    assert_eq!(stale_frame.label, "Stale gateway discovery file");
-    assert!(
-        stale_frame.description.contains("key was rejected"),
-        "the stale reason is named: {}",
-        stale_frame.description
-    );
-    let connecting = receiver.try_recv().expect("the winning source is reported");
-    assert_eq!(connecting.label, "Connecting to gateway");
-    assert!(
-        connecting.description.contains("http://127.0.0.1:4000")
-            && connecting.description.contains("workshop.toml"),
-        "the endpoint and its source are named: {}",
-        connecting.description
-    );
-}
-
-#[test]
-fn debug_redacts_the_api_key() {
-    let resolved = ResolvedGateway {
-        base_url: "http://127.0.0.1:4000".to_owned(),
-        api_key: "secret-key".to_owned(),
-        identity: None,
-        source: GatewaySource::Config,
-        stale: None,
-    };
-    let rendered = format!("{resolved:?}");
-    assert!(!rendered.contains("secret-key"), "key leaked: {rendered}");
-}
diff --git a/crates/workshop/gateway/src/resolve.rs b/crates/workshop/gateway/src/resolve.rs
deleted file mode 100644
index ca2ca4d05..000000000
--- a/crates/workshop/gateway/src/resolve.rs
+++ /dev/null
@@ -1,308 +0,0 @@
-//! Gateway endpoint resolution: a live gateway discovery file in the run
-//! directory first, explicit `[gateway]` config second.
-//!
-//! The Gateway writes `gateway.json` after a successful bind (its own
-//! `runvil-gateway` repository owns the writer), so a workshop that finds a
-//! live file attaches to that gateway - loopback, WSL, or LAN become one
-//! topology. A stale file
-//! is removed by the probe with its reason reported, and explicit config
-//! takes over; with no live file and no explicit config there is nothing
-//! to connect to, which is the plain [`ResolveError`].
-
-use std::fmt;
-use std::path::Path;
-
-use crate::discovery::{Resolution, SidecarError, StaleReason, ValidatedConnection};
-
-use workshop_protocol::Activity;
-use workshop_registry::Push;
-use workshop_support::GatewayConfig;
-
-/// The gateway endpoint state construction connects to, and how it was
-/// found.
-#[derive(Clone, PartialEq, Eq)]
-pub struct ResolvedGateway {
-    base_url: String,
-    api_key: String,
-    identity: Option<ValidatedConnection>,
-    source: GatewaySource,
-    stale: Option<StaleReason>,
-}
-
-// Manual so the bearer key is never written to logs.
-impl fmt::Debug for ResolvedGateway {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ResolvedGateway")
-            .field("base_url", &self.base_url)
-            .field("api_key", &"<redacted>")
-            .field("identity", &self.identity)
-            .field("source", &self.source)
-            .field("stale", &self.stale)
-            .finish()
-    }
-}
-
-/// Which source won gateway endpoint resolution.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum GatewaySource {
-    /// A live `gateway.json` gateway discovery file in the run directory.
-    GatewayDiscoveryFile,
-    /// Explicit `[gateway]` settings from `workshop.toml`.
-    Config,
-}
-
-impl ResolvedGateway {
-    /// The endpoint explicit config names, with no discovery: the bypass
-    /// for an embedding binary that already holds its gateway endpoint, or
-    /// a test fixture.
-    #[must_use]
-    pub fn from_config(config: &GatewayConfig) -> Self {
-        Self {
-            base_url: config.base_url.clone(),
-            api_key: config.api_key.clone(),
-            identity: None,
-            source: GatewaySource::Config,
-            stale: None,
-        }
-    }
-
-    /// The endpoint a validated local gateway boot published, for a test
-    /// fixture holding its own validated identity.
-    #[cfg(feature = "test-fixtures")]
-    #[must_use]
-    pub fn from_validated(identity: ValidatedConnection) -> Self {
-        Self {
-            base_url: format!("http://127.0.0.1:{}", identity.port()),
-            api_key: identity.api_key().to_owned(),
-            identity: Some(identity),
-            source: GatewaySource::GatewayDiscoveryFile,
-            stale: None,
-        }
-    }
-
-    /// The same resolution with its API served from `base_url` instead of
-    /// the identity's own port: a test setup whose shutdown authority (the
-    /// validated fixture process) and API surface (a mock router) are two
-    /// processes.
-    #[cfg(feature = "test-fixtures")]
-    #[must_use]
-    pub fn with_base_url(self, base_url: &str) -> Self {
-        Self {
-            base_url: base_url.trim_end_matches('/').to_owned(),
-            ..self
-        }
-    }
-
-    /// The resolved base URL, for example `http://127.0.0.1:8081`.
-    #[must_use]
-    pub fn base_url(&self) -> &str {
-        &self.base_url
-    }
-
-    /// The resolved bearer key.
-    #[must_use]
-    pub fn api_key(&self) -> &str {
-        &self.api_key
-    }
-
-    /// The validated local gateway boot, when discovery won.
-    #[must_use]
-    pub fn identity(&self) -> Option<&ValidatedConnection> {
-        self.identity.as_ref()
-    }
-
-    /// Which source won the resolution.
-    #[cfg(test)]
-    #[must_use]
-    fn source(&self) -> GatewaySource {
-        self.source
-    }
-
-    /// Why a gateway discovery file was removed on the way to the config
-    /// fallback, when one was.
-    #[must_use]
-    fn stale(&self) -> Option<StaleReason> {
-        self.stale
-    }
-
-    /// The winning source rendered for the status bar and the log.
-    #[must_use]
-    fn source_label(&self) -> &'static str {
-        match self.source {
-            GatewaySource::GatewayDiscoveryFile => "gateway discovery file",
-            GatewaySource::Config => "workshop.toml",
-        }
-    }
-}
-
-/// Gateway endpoint resolution found nothing to connect to.
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-#[non_exhaustive]
-#[error("no gateway configured or running{detail}")]
-pub struct ResolveError {
-    /// The rendered suffix: the stale-file note and the remedy.
-    detail: String,
-    /// Why the gateway discovery file was removed, when one was.
-    stale: Option<StaleReason>,
-}
-
-impl ResolveError {
-    /// The failure with the stale-file note rendered in, when a file was
-    /// removed on the way.
-    fn new(stale: Option<StaleReason>) -> Self {
-        let note = stale
-            .map(|reason| {
-                format!(
-                    " (removed a stale gateway discovery file: {})",
-                    stale_clause(reason)
-                )
-            })
-            .unwrap_or_default();
-        Self {
-            detail: format!(
-                "{note}; start runvil-gateway or set [gateway] base_url and api_key in workshop.toml"
-            ),
-            stale,
-        }
-    }
-
-    /// Why the gateway discovery file was removed, when one was: a wrong key,
-    /// a dead pid, and a foreign image are different problems for the
-    /// operator.
-    #[must_use]
-    pub fn stale(&self) -> Option<StaleReason> {
-        self.stale
-    }
-}
-
-/// Resolves the gateway endpoint for a loaded config: the live gateway
-/// discovery file in the default run directory first, explicit `[gateway]`
-/// config second.
-///
-/// # Errors
-/// Returns [`ResolveError`] when no live gateway discovery file exists and the
-/// config names no explicit gateway.
-pub fn resolve(config: &GatewayConfig) -> Result<ResolvedGateway, ResolveError> {
-    resolve_with(
-        crate::discovery::default_run_dir().as_deref(),
-        config,
-        probe,
-    )
-}
-
-/// The production probe: the fork's stale-detecting resolve.
-fn probe(run_dir: &Path) -> Result<Resolution, SidecarError> {
-    crate::discovery::resolve(run_dir)
-}
-
-/// `resolve` against an explicit run directory and probe, so tests point
-/// at a tempdir and at a probe that accepts the test binary's own image.
-fn resolve_with(
-    run_dir: Option<&Path>,
-    config: &GatewayConfig,
-    probe: fn(&Path) -> Result<Resolution, SidecarError>,
-) -> Result<ResolvedGateway, ResolveError> {
-    let mut stale = None;
-    if let Some(run_dir) = run_dir {
-        match probe(run_dir) {
-            Ok(Resolution::Attach(file)) => match validate_resolved(file) {
-                Ok(identity) => {
-                    return Ok(ResolvedGateway {
-                        base_url: format!("http://127.0.0.1:{}", identity.port()),
-                        api_key: identity.api_key().to_owned(),
-                        identity: Some(identity),
-                        source: GatewaySource::GatewayDiscoveryFile,
-                        stale: None,
-                    });
-                }
-                Err(reason) => stale = Some(reason),
-            },
-            Ok(Resolution::Stale(reason)) => {
-                tracing::warn!(
-                    reason = stale_clause(reason),
-                    "removed a stale gateway discovery file"
-                );
-                stale = Some(reason);
-            }
-            // A read or cleanup I/O failure degrades discovery to the
-            // config fallback; it never fails startup on its own.
-            Err(error) => {
-                tracing::warn!("could not resolve the gateway discovery file: {error}");
-            }
-            // Absent, or any other resolution: nothing to attach to.
-            _ => {}
-        }
-    }
-    if is_explicit(config) {
-        return Ok(ResolvedGateway {
-            base_url: config.base_url.clone(),
-            api_key: config.api_key.clone(),
-            identity: None,
-            source: GatewaySource::Config,
-            stale,
-        });
-    }
-    Err(ResolveError::new(stale))
-}
-
-/// Reifies the shared resolver's live result as the capability stored in
-/// the workshop's immutable gateway snapshot.
-fn validate_resolved(
-    file: crate::discovery::GatewayDiscoveryFile,
-) -> Result<ValidatedConnection, StaleReason> {
-    ValidatedConnection::validate(file)
-}
-
-/// Reports the resolution outcome where the server surfaces startup state:
-/// a removed file's reason and the winning source on the status bus,
-/// the same facts in the log.
-pub fn report(gateway: &ResolvedGateway, push: &Push) {
-    if let Some(reason) = gateway.stale() {
-        push.push_status_update(
-            "Stale gateway discovery file",
-            format!("{}; attaching from workshop.toml", stale_clause(reason)),
-            Activity::General,
-        );
-    }
-    push.push_status_update(
-        "Connecting to gateway",
-        format!(
-            "base URL {} ({})",
-            gateway.base_url(),
-            gateway.source_label()
-        ),
-        Activity::General,
-    );
-    tracing::info!(
-        base_url = %gateway.base_url(),
-        source = gateway.source_label(),
-        "gateway endpoint resolved"
-    );
-}
-
-/// Whether the config names a gateway itself: a non-empty `base_url` is
-/// explicit, an empty one (unset, or an unset `${RUNVIL_GATEWAY_URL}`
-/// interpolation) is not. The explicit fallback exists for the gateways
-/// discovery cannot see - a LAN gateway; a local gateway writes a
-/// gateway discovery file, which discovery finds first.
-fn is_explicit(config: &GatewayConfig) -> bool {
-    !config.base_url.is_empty()
-}
-
-/// Renders a stale reason as a user-facing clause: a wrong key, a dead
-/// pid, and a foreign image are different problems for the operator.
-fn stale_clause(reason: StaleReason) -> &'static str {
-    match reason {
-        StaleReason::Invalid => "the file was not valid",
-        StaleReason::ProcessDead => "the recorded gateway process is dead",
-        StaleReason::ImageMismatch => "the recorded pid belongs to another program",
-        StaleReason::HealthFailed => "the recorded gateway does not answer",
-        StaleReason::KeyRejected => "the file's key was rejected",
-        _ => "the file is stale",
-    }
-}
-
-#[cfg(test)]
-#[path = "resolve-tests.rs"]
-mod tests;
diff --git a/crates/workshop/gateway/src/test_gateway-process.rs b/crates/workshop/gateway/src/test_gateway-process.rs
deleted file mode 100644
index bba435cd9..000000000
--- a/crates/workshop/gateway/src/test_gateway-process.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-//! Child-process protocol for the named local gateway fixture.
-
-use std::io::{Read as _, Write as _};
-use std::net::{TcpListener, TcpStream};
-
-use super::{CONTROL_ADDRESS_ENV, EXPECTED_KEY_ENV, INSTANCE_LEASE_RUN_DIR_ENV};
-
-/// Serves health, bearer, and shutdown requests inside the named child.
-#[expect(
-    clippy::expect_used,
-    reason = "the isolated fixture process fails immediately with the failed invariant"
-)]
-pub(super) fn run() {
-    let Ok(control_address) = std::env::var(CONTROL_ADDRESS_ENV) else {
-        return;
-    };
-    let _instance_lease = std::env::var_os(INSTANCE_LEASE_RUN_DIR_ENV).map(|run_dir| {
-        crate::discovery::GatewayInstanceLease::try_acquire(std::path::Path::new(&run_dir))
-            .expect("acquire named fixture process lease")
-            .expect("the named fixture is the process lease owner")
-    });
-    let expected_key =
-        std::env::var(EXPECTED_KEY_ENV).expect("the fixture child receives an expected key");
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind named fixture Gateway");
-    let port = listener
-        .local_addr()
-        .expect("read named fixture address")
-        .port();
-    let mut control = TcpStream::connect(control_address).expect("connect fixture control");
-    control
-        .write_all(&port.to_be_bytes())
-        .expect("announce named fixture readiness");
-
-    for stream in listener.incoming() {
-        let mut stream = stream.expect("accept named fixture request");
-        let expected_key = expected_key.clone();
-        let mut connection_control = control
-            .try_clone()
-            .expect("clone the fixture control connection");
-        std::thread::spawn(move || {
-            while let Some(shutdown) = answer_request(&mut stream, expected_key.as_bytes()) {
-                if shutdown {
-                    connection_control
-                        .write_all(&[1])
-                        .expect("report the accepted shutdown request");
-                }
-            }
-        });
-    }
-}
-
-fn answer_request(stream: &mut TcpStream, expected_key: &[u8]) -> Option<bool> {
-    let mut buffer = [0_u8; 4096];
-    let Ok(read) = stream.read(&mut buffer) else {
-        return None;
-    };
-    if read == 0 {
-        return None;
-    }
-    let request = &buffer[..read];
-    let accepted = request.starts_with(b"GET /health ") || has_bearer(request, expected_key);
-    let response = if accepted {
-        "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"
-    } else {
-        "HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"
-    };
-    stream
-        .write_all(response.as_bytes())
-        .is_ok()
-        .then(|| accepted && request.starts_with(b"POST /shutdown "))
-}
-
-fn has_bearer(request: &[u8], expected_key: &[u8]) -> bool {
-    request.split(|byte| *byte == b'\n').any(|line| {
-        let line = line.strip_suffix(b"\r").unwrap_or(line);
-        let Some(colon) = line.iter().position(|byte| *byte == b':') else {
-            return false;
-        };
-        if !line[..colon].eq_ignore_ascii_case(b"authorization") {
-            return false;
-        }
-        let value = line[colon + 1..].trim_ascii_start();
-        let Some(space) = value.iter().position(|byte| *byte == b' ') else {
-            return false;
-        };
-        value[..space].eq_ignore_ascii_case(b"bearer") && &value[space + 1..] == expected_key
-    })
-}
-
-#[test]
-fn bearer_credentials_are_byte_exact_and_case_sensitive() {
-    let expected = b"CaseSensitive-Key";
-    assert!(has_bearer(
-        b"GET / HTTP/1.1\r\naUtHoRiZaTiOn: bEaReR CaseSensitive-Key\r\n\r\n",
-        expected
-    ));
-
-    let listener = TcpListener::bind("127.0.0.1:0").expect("bind credential regression");
-    let address = listener.local_addr().expect("read regression address");
-    let client = std::thread::spawn(move || {
-        let mut stream = TcpStream::connect(address).expect("connect credential regression");
-        stream
-            .write_all(
-                b"GET /protected HTTP/1.1\r\nAuthorization: Bearer casesensitive-key\r\n\r\n",
-            )
-            .expect("send wrong-case credential");
-        stream
-            .shutdown(std::net::Shutdown::Write)
-            .expect("finish fixture request");
-        let mut response = String::new();
-        stream
-            .read_to_string(&mut response)
-            .expect("read fixture response");
-        response
-    });
-    let (mut server, _) = listener.accept().expect("accept credential regression");
-    assert!(
-        !answer_request(&mut server, expected).expect("the fixture answers the request"),
-        "an unauthorized request cannot report shutdown"
-    );
-    drop(server);
-    let response = client.join().expect("credential regression client joins");
-    assert!(
-        response.starts_with("HTTP/1.1 401 Unauthorized"),
-        "the shared fixture rejects a bearer that differs only by case: {response}"
-    );
-}
diff --git a/crates/workshop/gateway/src/test_gateway.rs b/crates/workshop/gateway/src/test_gateway.rs
deleted file mode 100644
index f8a72091b..000000000
--- a/crates/workshop/gateway/src/test_gateway.rs
+++ /dev/null
@@ -1,335 +0,0 @@
-//! Gateway test fixtures: the named local gateway process shared by
-//! capability and supervision tests, and a stalled TCP stub for the
-//! timeout tests.
-
-use std::io::Read;
-use std::net::{TcpListener, TcpStream};
-use std::process::{Child, Command, Stdio};
-use std::time::{Duration, Instant};
-
-use crate::discovery::{GatewayDiscoveryFile, ValidatedConnection};
-
-#[path = "test_gateway-process.rs"]
-mod process;
-
-#[cfg(windows)]
-const GATEWAY_EXE_NAME: &str = "runvil-gateway.exe";
-#[cfg(not(windows))]
-const GATEWAY_EXE_NAME: &str = "runvil-gateway";
-
-const CONTROL_ADDRESS_ENV: &str = "RUNVIL_TEST_GATEWAY_CONTROL_ADDRESS";
-const EXPECTED_KEY_ENV: &str = "RUNVIL_TEST_GATEWAY_EXPECTED_KEY";
-const INSTANCE_LEASE_RUN_DIR_ENV: &str = "RUNVIL_TEST_GATEWAY_INSTANCE_LEASE_RUN_DIR";
-
-/// A named child gateway that passes production process-image validation.
-#[derive(Debug)]
-pub struct ValidatedGateway {
-    child: Child,
-    port: u16,
-    control: TcpStream,
-    _directory: tempfile::TempDir,
-}
-
-impl ValidatedGateway {
-    #[cfg(test)]
-    pub(crate) fn spawn(expected_key: &str) -> Self {
-        Self::spawn_in_with_lease(
-            expected_key,
-            "test_gateway::validated_gateway_fixture_process",
-            None,
-        )
-    }
-
-    #[cfg(test)]
-    fn spawn_with_instance_lease(expected_key: &str, run_dir: &std::path::Path) -> Self {
-        Self::spawn_in_with_lease(
-            expected_key,
-            "test_gateway::validated_gateway_fixture_process",
-            Some(run_dir),
-        )
-    }
-
-    /// Starts the fixture in the current test binary through `fixture_test`.
-    ///
-    /// The named ignored test must call
-    /// [`run_validated_gateway_fixture_process`].
-    ///
-    /// # Panics
-    /// Panics when the fixture listener, copied test image, child process, or
-    /// readiness handshake cannot be created.
-    #[must_use]
-    pub fn spawn_in(expected_key: &str, fixture_test: &str) -> Self {
-        Self::spawn_in_with_lease(expected_key, fixture_test, None)
-    }
-
-    #[expect(
-        clippy::expect_used,
-        reason = "test fixture setup fails immediately with the failed invariant"
-    )]
-    fn spawn_in_with_lease(
-        expected_key: &str,
-        fixture_test: &str,
-        lease_run_dir: Option<&std::path::Path>,
-    ) -> Self {
-        let control = TcpListener::bind("127.0.0.1:0").expect("bind fixture control");
-        control
-            .set_nonblocking(true)
-            .expect("make fixture control nonblocking");
-        let directory = tempfile::TempDir::new().expect("create fixture executable directory");
-        let executable = directory.path().join(GATEWAY_EXE_NAME);
-        std::fs::copy(
-            std::env::current_exe().expect("locate test executable"),
-            &executable,
-        )
-        .expect("copy test executable under the Gateway image name");
-        let mut command = Command::new(&executable);
-        command
-            .args(["--exact", fixture_test, "--ignored"])
-            .env(
-                CONTROL_ADDRESS_ENV,
-                control
-                    .local_addr()
-                    .expect("read fixture control address")
-                    .to_string(),
-            )
-            .env(EXPECTED_KEY_ENV, expected_key)
-            .stdin(Stdio::null())
-            .stdout(Stdio::null())
-            .stderr(Stdio::null());
-        if let Some(run_dir) = lease_run_dir {
-            command.env(INSTANCE_LEASE_RUN_DIR_ENV, run_dir);
-        }
-        let mut child = command
-            .spawn()
-            .expect("start the named Gateway fixture process");
-        let deadline = Instant::now() + Duration::from_secs(10);
-        let mut stream = loop {
-            match control.accept() {
-                Ok((stream, _)) => break stream,
-                Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
-                    assert!(
-                        child.try_wait().expect("observe fixture process").is_none(),
-                        "the named Gateway fixture exited before becoming ready"
-                    );
-                    assert!(
-                        Instant::now() < deadline,
-                        "the named Gateway fixture did not become ready"
-                    );
-                    std::thread::sleep(Duration::from_millis(10));
-                }
-                Err(error) => panic!("accept fixture control connection: {error}"),
-            }
-        };
-        stream
-            .set_nonblocking(false)
-            .expect("make accepted fixture control blocking");
-        let mut port = [0_u8; 2];
-        stream
-            .read_exact(&mut port)
-            .expect("read fixture Gateway port");
-        Self {
-            child,
-            port: u16::from_be_bytes(port),
-            control: stream,
-            _directory: directory,
-        }
-    }
-
-    /// Returns the fixture's loopback port.
-    #[must_use]
-    pub const fn port(&self) -> u16 {
-        self.port
-    }
-
-    /// Produces a production-validated capability for this child.
-    ///
-    /// # Panics
-    /// Panics when the supplied bearer or boot identity does not validate
-    /// against the running fixture.
-    #[must_use]
-    #[expect(
-        clippy::expect_used,
-        reason = "test fixture validation fails immediately with the failed invariant"
-    )]
-    pub fn validate(&self, api_key: &str, epoch: u64, started_at: &str) -> ValidatedConnection {
-        ValidatedConnection::validate(self.gateway_discovery_file(api_key, epoch, started_at))
-            .expect("the named local Gateway validates")
-    }
-
-    /// Builds a gateway discovery file naming this child and the supplied boot data.
-    #[must_use]
-    pub fn gateway_discovery_file(
-        &self,
-        api_key: &str,
-        epoch: u64,
-        started_at: &str,
-    ) -> GatewayDiscoveryFile {
-        GatewayDiscoveryFile {
-            port: self.port,
-            api_key: api_key.to_owned(),
-            pid: self.child.id(),
-            epoch,
-            version: "test".to_owned(),
-            started_at: started_at.to_owned(),
-        }
-    }
-
-    /// Waits up to `timeout` for an authenticated shutdown request.
-    ///
-    /// # Panics
-    /// Panics when the control socket cannot be configured or read, or when
-    /// the child sends an invalid control marker.
-    #[expect(
-        clippy::expect_used,
-        reason = "test fixture observation fails immediately with the failed invariant"
-    )]
-    pub fn received_shutdown(&mut self, timeout: Duration) -> bool {
-        self.control
-            .set_read_timeout(Some(timeout))
-            .expect("set fixture control timeout");
-        let mut marker = [0_u8; 1];
-        match self.control.read_exact(&mut marker) {
-            Ok(()) => {
-                assert_eq!(marker, [1], "the fixture reports only shutdown requests");
-                true
-            }
-            Err(error)
-                if matches!(
-                    error.kind(),
-                    std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut
-                ) =>
-            {
-                false
-            }
-            Err(error) => panic!("read fixture shutdown marker: {error}"),
-        }
-    }
-
-    #[cfg(test)]
-    fn terminate_within(&mut self, timeout: Duration) {
-        if self
-            .child
-            .try_wait()
-            .expect("observe named Gateway fixture")
-            .is_none()
-        {
-            let _ = self.child.kill();
-        }
-        let deadline = Instant::now() + timeout;
-        loop {
-            if self
-                .child
-                .try_wait()
-                .expect("observe named Gateway fixture")
-                .is_some()
-            {
-                return;
-            }
-            assert!(
-                Instant::now() < deadline,
-                "the named Gateway fixture did not stop within {timeout:?}"
-            );
-            std::thread::sleep(Duration::from_millis(10));
-        }
-    }
-}
-
-impl Drop for ValidatedGateway {
-    fn drop(&mut self) {
-        if self.child.try_wait().ok().flatten().is_none() {
-            let _ = self.child.kill();
-        }
-        let deadline = Instant::now() + Duration::from_secs(5);
-        while self.child.try_wait().ok().flatten().is_none() && Instant::now() < deadline {
-            std::thread::sleep(Duration::from_millis(10));
-        }
-    }
-}
-
-/// Binds a loopback stub that completes TCP handshakes and never answers,
-/// modeling a gateway that is up but wedged. Returns its base URL and a
-/// handle notified as the stub takes each connection.
-#[cfg(test)]
-pub(crate) async fn stalled_gateway() -> (String, std::sync::Arc<tokio::sync::Notify>) {
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("bind stalled stub");
-    let addr = listener.local_addr().expect("stalled stub address");
-    let accepted = std::sync::Arc::new(tokio::sync::Notify::new());
-    let notify = std::sync::Arc::clone(&accepted);
-    tokio::spawn(async move {
-        // Sockets are held open and never answered until the test's
-        // runtime tears the task down.
-        let mut held = Vec::new();
-        while let Ok((socket, _)) = listener.accept().await {
-            held.push(socket);
-            notify.notify_one();
-        }
-    });
-    (format!("http://{addr}"), accepted)
-}
-
-#[cfg(test)]
-#[test]
-#[ignore = "runs only as a named child process"]
-fn validated_gateway_fixture_process() {
-    run_validated_gateway_fixture_process();
-}
-
-#[cfg(test)]
-#[test]
-fn received_shutdown_waits_for_a_delayed_marker() {
-    let mut gateway = ValidatedGateway::spawn("fixture-key");
-    let validated = gateway.validate("fixture-key", 1_778_000_001, "2026-09-07T18:00:01Z");
-    let delay = Duration::from_millis(100);
-    let started = Instant::now();
-
-    std::thread::scope(|scope| {
-        scope.spawn(move || {
-            std::thread::sleep(delay);
-            crate::discovery::request_shutdown(&validated)
-                .expect("the delayed authenticated shutdown is accepted");
-        });
-        assert!(
-            gateway.received_shutdown(Duration::from_secs(2)),
-            "the control stream waits for the delayed shutdown marker"
-        );
-    });
-
-    assert!(
-        started.elapsed() >= delay,
-        "the delayed marker cannot be reported before it is sent"
-    );
-}
-
-#[cfg(test)]
-#[test]
-fn a_named_fixture_releases_its_process_lease_when_terminated() {
-    let run_dir = tempfile::TempDir::new().expect("create lease run directory");
-    let mut gateway = ValidatedGateway::spawn_with_instance_lease("fixture-key", run_dir.path());
-    assert!(
-        crate::discovery::GatewayInstanceLease::try_acquire(run_dir.path())
-            .expect("contend for the named fixture lease")
-            .is_none(),
-        "the live fixture owns the process lease"
-    );
-
-    gateway.terminate_within(Duration::from_secs(5));
-    assert!(
-        crate::discovery::GatewayInstanceLease::try_acquire(run_dir.path())
-            .expect("recover the named fixture lease")
-            .is_some(),
-        "the operating system releases the lease when the named fixture dies"
-    );
-}
-
-/// Runs the child half of [`ValidatedGateway`] inside an ignored test.
-///
-/// This function never returns during a successful fixture run.
-///
-/// # Panics
-/// Panics when required fixture environment, listener, control connection,
-/// request acceptance, or shutdown reporting cannot be established.
-pub fn run_validated_gateway_fixture_process() {
-    process::run();
-}
diff --git a/crates/workshop/gateway/src/version-tests.rs b/crates/workshop/gateway/src/version-tests.rs
deleted file mode 100644
index 41a7c80da..000000000
--- a/crates/workshop/gateway/src/version-tests.rs
+++ /dev/null
@@ -1,210 +0,0 @@
-//! Unit tests for the Gateway version comparison.
-
-use super::*;
-
-use std::sync::Arc;
-
-use tokio::sync::broadcast;
-
-/// A recording status sink standing in for the status bus, and the push
-/// facade the report writes through.
-fn status_recorder() -> (
-    Push,
-    broadcast::Receiver<workshop_protocol::StatusBarUpdate>,
-    workshop_registry::Registration,
-) {
-    let registry = workshop_registry::Registry::new();
-    let (tx, rx) = broadcast::channel(16);
-    let sink = registry.register_sink::<dyn workshop_registry::StatusSink>(Arc::new(
-        workshop_registry::StatusSinkAdapter::new(move |update| {
-            let _ = tx.send(update);
-        }),
-    ));
-    (registry.push(), rx, sink)
-}
-
-#[test]
-fn parses_a_plain_three_part_version() {
-    assert_eq!(
-        Version::parse("0.4.1"),
-        Some(Version {
-            major: 0,
-            minor: 4,
-            patch: 1
-        })
-    );
-}
-
-#[test]
-fn parses_a_leading_v_and_a_prerelease_suffix() {
-    let expected = Version::parse("1.2.3");
-    assert_eq!(Version::parse("v1.2.3"), expected);
-    assert_eq!(Version::parse("1.2.3-rc.1"), expected);
-    assert_eq!(Version::parse("1.2.3+build.7"), expected);
-}
-
-#[test]
-fn a_two_part_version_treats_the_missing_patch_as_zero() {
-    assert_eq!(Version::parse("2.5"), Version::parse("2.5.0"));
-}
-
-#[test]
-fn a_version_that_is_not_numbers_is_unreadable() {
-    for text in ["", "  ", "unknown", "1.x.0", "1.2.3.4", "-1.0.0"] {
-        assert_eq!(Version::parse(text), None, "{text}");
-    }
-}
-
-#[test]
-fn versions_compare_numerically_not_as_strings() {
-    let older = Version::parse("0.9.0").expect("a version");
-    let newer = Version::parse("0.10.0").expect("a version");
-    assert!(newer > older, "0.10.0 is newer than 0.9.0");
-    assert!(newer.is_at_least(older));
-    assert!(!older.is_at_least(newer));
-    assert_eq!(older.to_string(), "0.9.0");
-}
-
-#[test]
-fn an_equal_version_satisfies_the_minimum() {
-    assert_eq!(
-        VersionCheck::compare("0.4.0", "0.4.0"),
-        VersionCheck::Satisfied {
-            running: Version::parse("0.4.0").expect("a version"),
-            minimum: Version::parse("0.4.0").expect("a version"),
-        }
-    );
-}
-
-#[test]
-fn an_older_gateway_is_reported_too_old() {
-    let check = VersionCheck::compare("0.3.9", "0.4.0");
-    assert!(matches!(check, VersionCheck::TooOld { .. }), "{check:?}");
-    assert!(check.is_problem());
-}
-
-#[test]
-fn a_newer_gateway_satisfies_the_minimum() {
-    assert!(!VersionCheck::compare("2.0.0", "0.4.0").is_problem());
-}
-
-#[test]
-fn an_empty_minimum_means_the_pin_recorded_none() {
-    let check = VersionCheck::compare("0.1.0", "");
-    assert_eq!(check, VersionCheck::NoMinimumRecorded);
-    assert!(
-        !check.is_problem(),
-        "a placeholder pin must not warn about every Gateway"
-    );
-}
-
-#[test]
-fn an_unreadable_version_is_reported_rather_than_assumed() {
-    let check = VersionCheck::compare("nightly", "0.4.0");
-    assert!(
-        matches!(check, VersionCheck::Unreadable { .. }),
-        "an unreadable running version is a problem, not a pass: {check:?}"
-    );
-    assert!(check.is_problem());
-    assert!(VersionCheck::compare("0.4.0", "not a version").is_problem());
-}
-
-#[test]
-fn a_too_old_gateway_warns_on_the_status_bar_and_names_both_versions() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce(&VersionCheck::compare("0.3.9", "0.4.0"), &push);
-    let frame = rx.try_recv().expect("the warning is pushed");
-    assert_eq!(frame.label, "Gateway too old");
-    assert!(
-        frame.description.contains("0.3.9") && frame.description.contains("0.4.0"),
-        "both versions are named: {}",
-        frame.description
-    );
-}
-
-#[test]
-fn an_unreadable_version_warns_on_the_status_bar() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce(&VersionCheck::compare("nightly", "0.4.0"), &push);
-    let frame = rx.try_recv().expect("the warning is pushed");
-    assert_eq!(frame.label, "Gateway version unknown");
-    assert!(
-        frame.description.contains("nightly"),
-        "{}",
-        frame.description
-    );
-}
-
-#[test]
-fn a_satisfied_check_says_nothing_on_the_status_bar() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce(&VersionCheck::compare("0.4.0", "0.4.0"), &push);
-    assert!(
-        rx.try_recv().is_err(),
-        "a healthy boot pushes no status line"
-    );
-}
-
-#[test]
-fn an_unfilled_pin_warns_on_the_status_bar_in_a_release_build() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce_for(&VersionCheck::NoMinimumRecorded, &push, Build::Release);
-    let frame = rx.try_recv().expect("the unfilled pin is pushed");
-    assert_eq!(frame.label, "Gateway version unchecked");
-    assert!(
-        frame.description.contains("no minimum version"),
-        "the description names the cause: {}",
-        frame.description
-    );
-    assert!(
-        frame.description.contains("nothing checks"),
-        "the description names the consequence: {}",
-        frame.description
-    );
-}
-
-#[test]
-fn an_unfilled_pin_stays_off_the_status_bar_in_a_debug_build() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce_for(&VersionCheck::NoMinimumRecorded, &push, Build::Debug);
-    assert!(
-        rx.try_recv().is_err(),
-        "a developer's checkout must not repeat this line on every launch"
-    );
-}
-
-#[test]
-fn the_public_entry_point_follows_the_build_it_was_compiled_into() {
-    let (push, mut rx, _sink) = status_recorder();
-    announce(&VersionCheck::NoMinimumRecorded, &push);
-    if cfg!(debug_assertions) {
-        assert!(
-            rx.try_recv().is_err(),
-            "this test build is a debug build, so the pin reaches the log only"
-        );
-    } else {
-        let frame = rx
-            .try_recv()
-            .expect("a release build shows the unfilled pin");
-        assert_eq!(frame.label, "Gateway version unchecked");
-    }
-}
-
-#[test]
-fn the_pin_minimum_is_the_compiled_default() {
-    // Whatever the pin holds, the constant is its value, never a guess. A
-    // placeholder becomes an empty minimum, which the comparison reads as
-    // "no minimum recorded" rather than as a version to enforce.
-    assert!(
-        MIN_GATEWAY.is_empty() || Version::parse(MIN_GATEWAY).is_some(),
-        "the compiled minimum is empty or a version: {MIN_GATEWAY}"
-    );
-    assert!(
-        !MIN_GATEWAY.contains("PLACEHOLDER"),
-        "a placeholder must never become a minimum to compare against"
-    );
-    assert_eq!(
-        VersionCheck::against_pin("0.0.1"),
-        VersionCheck::compare("0.0.1", MIN_GATEWAY)
-    );
-}
diff --git a/crates/workshop/gateway/src/version.rs b/crates/workshop/gateway/src/version.rs
deleted file mode 100644
index 70553924d..000000000
--- a/crates/workshop/gateway/src/version.rs
+++ /dev/null
@@ -1,256 +0,0 @@
-//! The Gateway version check: does the Gateway Workshop attached to meet
-//! the lowest release the pin allows?
-//!
-//! Workshop and the Gateway ship as separate releases, so a running
-//! Gateway may be older than the pin. Nothing else proves the API surface
-//! matches: the pin's `min_gateway` is the lowest release with every
-//! operation Workshop calls, so a Gateway below it is missing calls that
-//! exist only in later releases.
-//!
-//! Both versions are logged, and a Gateway below the minimum is announced
-//! on the status bar through the same push facade every other startup
-//! phase uses. The versions are compared as dotted numbers, never as
-//! strings: `0.10.0` is newer than `0.9.0`, and a string compare says the
-//! opposite.
-//!
-//! A pin that records no minimum turns the check off, which is a problem
-//! with the build rather than with the Gateway. A release build says so on
-//! the status bar: nothing then guards the Gateway it ships. A debug build
-//! says so in the log only, because it reaches that state on every launch
-//! while the pin is still a placeholder, and a status line for it would be
-//! noise a developer learns to ignore.
-
-use std::cmp::Ordering;
-use std::fmt;
-
-use workshop_protocol::Activity;
-use workshop_registry::Push;
-
-/// The `min_gateway` value the pin recorded when Workshop was built, or
-/// an empty string when the pin was still a placeholder.
-pub const MIN_GATEWAY: &str = env!("RUNVIL_MIN_GATEWAY");
-
-/// A dotted version: a major, a minor, and a patch number.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct Version {
-    major: u64,
-    minor: u64,
-    patch: u64,
-}
-
-impl Version {
-    /// Parses `major.minor.patch`, tolerating a leading `v` and ignoring a
-    /// prerelease or build suffix. Returns `None` for anything else, so a
-    /// version nobody can read is never silently treated as satisfying a
-    /// minimum.
-    #[must_use]
-    pub fn parse(text: &str) -> Option<Self> {
-        let trimmed = text.trim().trim_start_matches('v');
-        let core = trimmed
-            .split(['-', '+'])
-            .next()
-            .filter(|core| !core.is_empty())?;
-        let mut parts = core.split('.');
-        let major = parts.next()?.parse().ok()?;
-        let minor = parts.next()?.parse().ok()?;
-        let patch = parts.next().unwrap_or("0").parse().ok()?;
-        if parts.next().is_some() {
-            return None;
-        }
-        Some(Self {
-            major,
-            minor,
-            patch,
-        })
-    }
-
-    /// Whether this version is at least `floor`.
-    #[must_use]
-    pub fn is_at_least(self, floor: Self) -> bool {
-        self >= floor
-    }
-}
-
-impl Ord for Version {
-    fn cmp(&self, other: &Self) -> Ordering {
-        (self.major, self.minor, self.patch).cmp(&(other.major, other.minor, other.patch))
-    }
-}
-
-impl PartialOrd for Version {
-    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl fmt::Display for Version {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(formatter, "{}.{}.{}", self.major, self.minor, self.patch)
-    }
-}
-
-/// What the check found.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum VersionCheck {
-    /// The pin recorded no minimum, because it is still a placeholder.
-    NoMinimumRecorded,
-    /// The running Gateway meets the pin's minimum.
-    Satisfied {
-        /// The Gateway's version, as the discovery file reported it.
-        running: Version,
-        /// The pin's `min_gateway`.
-        minimum: Version,
-    },
-    /// The running Gateway is older than the pin's minimum.
-    TooOld {
-        /// The Gateway's version, as the discovery file reported it.
-        running: Version,
-        /// The pin's `min_gateway`.
-        minimum: Version,
-    },
-    /// Either version could not be read as numbers. Reported rather than
-    /// assumed either way.
-    Unreadable {
-        /// The Gateway's version, verbatim.
-        running: String,
-        /// The pin's `min_gateway`, verbatim.
-        minimum: String,
-    },
-}
-
-impl VersionCheck {
-    /// Compares a running Gateway's version against a minimum, both as
-    /// text. An empty `minimum` means the pin recorded none.
-    #[must_use]
-    pub fn compare(running: &str, minimum: &str) -> Self {
-        if minimum.trim().is_empty() {
-            return Self::NoMinimumRecorded;
-        }
-        match (Version::parse(running), Version::parse(minimum)) {
-            (Some(running), Some(minimum)) if running.is_at_least(minimum) => {
-                Self::Satisfied { running, minimum }
-            }
-            (Some(running), Some(minimum)) => Self::TooOld { running, minimum },
-            _ => Self::Unreadable {
-                running: running.to_owned(),
-                minimum: minimum.to_owned(),
-            },
-        }
-    }
-
-    /// The check against the pin's recorded minimum.
-    #[must_use]
-    pub fn against_pin(running: &str) -> Self {
-        Self::compare(running, MIN_GATEWAY)
-    }
-
-    /// Whether this check should be shown to the user.
-    #[must_use]
-    pub fn is_problem(&self) -> bool {
-        matches!(self, Self::TooOld { .. } | Self::Unreadable { .. })
-    }
-}
-
-/// Logs both versions and, when the running Gateway is below the pin's
-/// minimum or its version cannot be read, warns on the status bar. A
-/// satisfied check logs and says nothing: every healthy boot looks like
-/// that, and a status line for it would be noise.
-pub fn report(running: &str, push: &Push) {
-    announce(&VersionCheck::against_pin(running), push);
-}
-
-/// Logs `check` and warns on the status bar when it is a problem. Split
-/// from [`report`] so a test can drive any outcome, including one the
-/// committed pin cannot currently produce.
-///
-/// An unfilled pin reaches the status bar in a release build only; the
-/// build split lives in `announce_for`.
-pub fn announce(check: &VersionCheck, push: &Push) {
-    announce_for(check, push, Build::current());
-}
-
-/// Which kind of build is asking. An unfilled pin is a defect in a
-/// shipped build and a normal state in a developer's checkout, so the
-/// status bar is told about the first and not the second.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum Build {
-    /// A debug build: the developer's own `cargo build` or `cargo test`.
-    Debug,
-    /// A release build, which is what an installer ships.
-    Release,
-}
-
-impl Build {
-    /// The build this code was compiled into.
-    fn current() -> Self {
-        if cfg!(debug_assertions) {
-            Self::Debug
-        } else {
-            Self::Release
-        }
-    }
-}
-
-/// Logs `check` and warns on the status bar when it is a problem. `build`
-/// selects whether an unfilled pin also reaches the status bar.
-fn announce_for(check: &VersionCheck, push: &Push, build: Build) {
-    match check {
-        VersionCheck::NoMinimumRecorded => {
-            tracing::warn!("the Gateway pin records no minimum version; the version check is off");
-            // A release build is what an installer ships. An unfilled pin
-            // there leaves the app with no version guard at all, so the
-            // user sees it. A debug build is a developer's own checkout,
-            // where the pin stays a placeholder until a Gateway release
-            // exists, so it stays in the log.
-            if build == Build::Release {
-                push.push_status_update(
-                    "Gateway version unchecked",
-                    "this Workshop was built from a pin with no minimum version, so nothing \
-                     checks the Gateway it attaches to",
-                    Activity::General,
-                );
-            }
-        }
-        VersionCheck::Satisfied { running, minimum } => {
-            tracing::info!(
-                gateway_version = %running,
-                minimum_gateway = %minimum,
-                "the Gateway meets the pin's minimum version"
-            );
-        }
-        VersionCheck::TooOld { running, minimum } => {
-            tracing::warn!(
-                gateway_version = %running,
-                minimum_gateway = %minimum,
-                "the Gateway is older than the pin's minimum version"
-            );
-            push.push_status_update(
-                "Gateway too old",
-                format!(
-                    "the running Gateway is {running} but this Workshop needs at least {minimum}; \
-                     install a newer Gateway"
-                ),
-                Activity::General,
-            );
-        }
-        VersionCheck::Unreadable { running, minimum } => {
-            tracing::warn!(
-                gateway_version = running,
-                minimum_gateway = minimum,
-                "a Gateway version could not be compared with the pin's minimum"
-            );
-            push.push_status_update(
-                "Gateway version unknown",
-                format!(
-                    "could not compare the running Gateway's version ({running}) with the \
-                     required {minimum}"
-                ),
-                Activity::General,
-            );
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "version-tests.rs"]
-mod tests;
diff --git a/crates/workshop/look/AGENTS.md b/crates/workshop/look/AGENTS.md
deleted file mode 100644
index 127fd3ffe..000000000
--- a/crates/workshop/look/AGENTS.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# look
-
-`@workshop/look`, the Workshop family's visual layer. It was forked from `crates/shared-ui` on 2026-09-27 and has no sync obligation: changes here never need to reach `shared-ui`, and `shared-ui` changes never need to reach here.
-
-- Components stay app-agnostic. They own no timer or document listener that outlives their element, and consumers own integration lifecycle.
-- Focus follows Cursor: list rows, tree rows, menu rows, and inputs draw a 1px `--cursor-stroke-focused` outline at offset -1px (`--focus-outline`), and everything else uses the matching state background or opacity behavior. Do not invent a ring or a focus-like shadow.
-- Keep third-party derivation notices and their source comments intact.
diff --git a/crates/workshop/look/THIRD_PARTY_NOTICES.md b/crates/workshop/look/THIRD_PARTY_NOTICES.md
deleted file mode 100644
index 1307f3fca..000000000
--- a/crates/workshop/look/THIRD_PARTY_NOTICES.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# Third-Party Notices
-
-Source in this directory that derives from another project, with the notice its license requires.
-
-## Codicons
-
-`icons.ts` holds the artwork of 31 icons from the Visual Studio Code codicon set - add, agent, arrow-up, ask, bug, check, checklist, chevron-down, chevron-right, close, copy, ellipsis, error, file, file-code, file-media, file-text, folder, gear, globe, info, layers, layout-sidebar-left, layout-sidebar-right, link, mic, new-folder, stop-circle, symbol-keyword, trash, and warning - as inline SVG strings. Each string is the icon's `src/icons/<name>.svg` file from `@vscode/codicons` with only the `width` and `height` attributes changed. `@vscode/codicons` is a `devDependency` that only `test/icons.mjs` reads, to check every string against its source file.
-
-- Project: <https://github.com/microsoft/vscode-codicons>
-- Package: `@vscode/codicons` 0.0.46-24
-- Copyright: (c) Microsoft Corporation
-- License: Creative Commons Attribution 4.0 International (CC-BY-4.0), <https://creativecommons.org/licenses/by/4.0/legalcode>. The codicon font and icon artwork are licensed CC-BY-4.0; the package's code is MIT.
-- Changes: the `width` and `height` attributes of each string are set to the size the consumer needs. The paths are unmodified.
-
-## murm-ui
-
-`dropdown.ts` and `dropdown.css` are ported from the `components/dropdown.ts` and `styles/dropdown.css` files of murm-ui 0.2.0 (commit `336ff7db79d928373e83c3672db6041a0adbc868`), cut to the shared action-menu's needs and restyled onto the Cursor Dark tokens. (Moved here from the workshop UI package, now `crates/workshop/ui/src/parts/`, where the port first landed.)
-
-- Project: <https://github.com/levmv/murm-ui>
-- License: MIT
-
-```text
-MIT License
-
-Copyright (c) 2026 Lev Morozov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
diff --git a/crates/workshop/look/controls.css b/crates/workshop/look/controls.css
deleted file mode 100644
index 6639d3dfe..000000000
--- a/crates/workshop/look/controls.css
+++ /dev/null
@@ -1,229 +0,0 @@
-/* Button, input, select, and switch base classes for the Workshop family's
-   UIs, on the Cursor Dark tokens from tokens.css. The rules live in the
-   components cascade layer: a consuming UI that declares its own layer
-   order keeps its overrides winning on specificity, and a consuming UI
-   with no layers (the workshop) lets its unlayered rules override these.
-   The menu scrollbar rules at the end are the one exception.
-
-   Focus follows Cursor: inputs, selects, list rows, and tree rows draw the
-   1px --focus-outline inside their box (offset -1px); every other control
-   uses its state background. */
-
-@layer components {
-	/* Buttons: 24px tall, 8px padding, 6px radius, 13px weight 400. -sm is
-	   20px tall with a 4px radius. A variant class picks the fill. */
-	.button {
-		display: inline-flex;
-		align-items: center;
-		justify-content: center;
-		gap: var(--space-1);
-		height: var(--height-sm);
-		padding-inline: var(--space-2);
-		border: 1px solid transparent;
-		border-radius: var(--radius);
-		background: transparent;
-		color: var(--cursor-text-primary);
-		font-size: var(--font-size-base);
-		font-weight: 400;
-		white-space: nowrap;
-		cursor: pointer;
-		transition: background-color var(--duration-normal) ease-out, color var(--duration-normal) ease-out,
-			border-color var(--duration-normal) ease-out;
-	}
-	.button:disabled {
-		border-color: transparent;
-		background: var(--cursor-control-disabled-bg);
-		color: var(--cursor-control-disabled-text);
-		pointer-events: none;
-	}
-	.button-sm {
-		height: var(--height-xs);
-		border-radius: var(--radius-sm);
-	}
-	/* Dark label on Cursor's accent; hover mixes 10% white into it. */
-	.button-primary {
-		background: var(--cursor-accent);
-		color: var(--cursor-text-invert);
-	}
-	.button-primary:hover {
-		background: var(--cursor-accent-hover);
-	}
-	.button-secondary {
-		background: var(--cursor-bg-tertiary);
-	}
-	.button-secondary:hover {
-		background: var(--cursor-bg-secondary);
-	}
-	.button-ghost {
-		background: transparent;
-	}
-	.button-ghost:hover {
-		background: var(--cursor-bg-tertiary);
-	}
-	.button-outline {
-		border-color: var(--cursor-stroke-secondary);
-		background: transparent;
-	}
-	.button-outline:hover {
-		background: var(--cursor-bg-quaternary);
-	}
-	.button-danger {
-		border-color: var(--danger);
-		background: color-mix(in srgb, var(--danger) 10%, transparent);
-		color: var(--danger-text);
-	}
-	.button-danger:hover {
-		background: color-mix(in srgb, var(--danger) 15%, transparent);
-	}
-
-	/* Text input: 24px tall, 4px 5px padding, a 1px border at 12% that rises
-	   to 20% on focus, a 6px radius, a 3% fill, 13px/18px text, 150ms
-	   transitions. */
-	.input {
-		height: var(--height-sm);
-		padding: var(--space-1) 5px;
-		border: 1px solid var(--cursor-stroke-secondary);
-		border-radius: var(--radius);
-		background: var(--cursor-bg-input-field);
-		color: var(--cursor-text-primary);
-		font-size: var(--font-size-base);
-		line-height: var(--line-height-base);
-		transition: border-color var(--duration-normal) ease, background-color var(--duration-normal) ease;
-	}
-	.input::placeholder {
-		color: var(--input-placeholder);
-	}
-	input::-ms-reveal {
-		display: none;
-	}
-	.input:focus {
-		border-color: var(--cursor-stroke-primary);
-	}
-	.input:disabled {
-		background: var(--cursor-control-disabled-bg);
-		color: var(--cursor-control-disabled-text);
-	}
-	textarea.input {
-		height: auto;
-	}
-
-	/* Select trigger: 12px text, a 12% border, a 6px radius, and room on the
-	   right for the caret. */
-	.select {
-		display: inline-flex;
-		align-items: center;
-		justify-content: space-between;
-		gap: var(--space-2);
-		padding: 3px 2px 3px 6px;
-		border: 1px solid var(--cursor-stroke-secondary);
-		border-radius: var(--radius);
-		background: transparent;
-		color: var(--cursor-text-primary);
-		font-size: var(--font-size-sm);
-		cursor: pointer;
-		transition: border-color var(--duration-normal) ease, background-color var(--duration-normal) ease;
-	}
-	.select::after {
-		content: "";
-		width: 0.4rem;
-		height: 0.4rem;
-		margin-inline-end: var(--space-1);
-		border-inline-end: 1px solid currentcolor;
-		border-block-end: 1px solid currentcolor;
-		transform: translateY(-0.125rem) rotate(45deg);
-	}
-	.select:hover {
-		background: var(--cursor-bg-quaternary);
-	}
-	.select:disabled {
-		background: var(--cursor-control-disabled-bg);
-		color: var(--cursor-control-disabled-text);
-		cursor: not-allowed;
-	}
-
-	/* Switch, on a <button role="switch" aria-checked>: a 32x20 track, 14%
-	   white when off and green when on, with a 16px white thumb that moves
-	   12px over 200ms. The thumb is the ::after. */
-	.switch {
-		position: relative;
-		display: inline-flex;
-		flex-shrink: 0;
-		align-items: center;
-		width: 32px;
-		height: 20px;
-		padding: 0;
-		border: 0;
-		border-radius: var(--radius-full);
-		background: var(--cursor-bg-secondary);
-		cursor: pointer;
-		transition: background-color var(--duration-slow) ease;
-	}
-	.switch::after {
-		content: "";
-		position: absolute;
-		top: 2px;
-		left: 2px;
-		width: 16px;
-		height: 16px;
-		border-radius: 50%;
-		background: white;
-		transform: translateX(0);
-		transition: transform var(--duration-slow) ease;
-	}
-	.switch[aria-checked="true"] {
-		background: var(--cursor-green);
-	}
-	.switch[aria-checked="true"]::after {
-		transform: translateX(12px);
-	}
-	.switch:disabled {
-		opacity: 0.5;
-		cursor: not-allowed;
-	}
-
-	/* The shared focus outline: 1px inside the box, on inputs, selects, and
-	   the list and tree rows a view marks with .list-row or .tree-row. Menu
-	   rows draw it from dropdown.css. */
-	.input:focus-visible,
-	.select:focus-visible,
-	.list-row:focus-visible,
-	.tree-row:focus-visible {
-		outline: var(--focus-outline);
-		outline-offset: var(--focus-outline-offset);
-	}
-
-	@media (prefers-reduced-motion: reduce) {
-		.button,
-		.input,
-		.select,
-		.switch,
-		.switch::after {
-			transition: none;
-		}
-	}
-}
-
-/* Menu scrollbars: 7px. These rules sit outside the components layer on
-   purpose. The view scrollbars (::-webkit-scrollbar in the consuming UI's
-   base sheet, through the same tokens) are unlayered, and an unlayered rule
-   beats a layered one whatever the specificity, so a layered menu rule would
-   leave a .scrollbar-menu element on the 10px hover-only view bar. Unlayered
-   here, the extra class wins on specificity. Chromium ignores
-   ::-webkit-scrollbar on an element that sets scrollbar-width, so the
-   standard property is only for engines without the pseudo-elements. */
-@supports not selector(::-webkit-scrollbar) {
-	.scrollbar-menu {
-		scrollbar-width: thin;
-	}
-}
-.scrollbar-menu::-webkit-scrollbar {
-	width: var(--scrollbar-width-menu);
-	height: var(--scrollbar-width-menu);
-}
-.scrollbar-menu::-webkit-scrollbar-thumb {
-	border-radius: 0;
-	background: var(--scrollbar-thumb);
-}
-.scrollbar-menu::-webkit-scrollbar-thumb:hover {
-	background: var(--scrollbar-thumb-hover);
-}
diff --git a/crates/workshop/look/css.d.ts b/crates/workshop/look/css.d.ts
deleted file mode 100644
index 7738f0f47..000000000
--- a/crates/workshop/look/css.d.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-// Ambient declaration for the colocated-CSS pattern: components import
-// their stylesheet for the side effect, the consuming UI's esbuild build
-// extracts the CSS into its app.css, and tsc needs the module shape
-// declared to accept the import. Side-effect only - no exports.
-declare module "*.css";
diff --git a/crates/workshop/look/dropdown.css b/crates/workshop/look/dropdown.css
deleted file mode 100644
index 60b33ec13..000000000
--- a/crates/workshop/look/dropdown.css
+++ /dev/null
@@ -1,180 +0,0 @@
-/* The menu surface (.menu, .menu-item) and the floating action menu
-   (.menu-popup) from dropdown.ts, on the Cursor Dark tokens. The danger
-   rows keep the neutral hover wash because --danger-text is tuned to
-   pass 4.5:1 on --bg-hover. All rules live in the components layer so a
-   consumer's own rules override them.
-
-   Derived from murm-ui 0.2.0 styles/dropdown.css, copyright (c) 2026
-   Lev Morozov, MIT License; the full notice is in THIRD_PARTY_NOTICES.md. */
-
-@layer components {
-	/* The menu surface: a raised card of action rows. */
-	.menu {
-		min-width: 8rem;
-		padding: var(--space-1);
-		border: 1px solid var(--border);
-		border-radius: var(--radius-xl);
-		background: var(--bg-elevated);
-		box-shadow: var(--shadow-popup);
-	}
-	.menu-item {
-		display: flex;
-		align-items: center;
-		gap: var(--space-2);
-		width: 100%;
-		min-height: var(--height-base);
-		padding: 0 var(--space-2);
-		border: 0;
-		border-radius: var(--radius);
-		background: transparent;
-		color: var(--cursor-text-primary);
-		font: inherit;
-		font-size: var(--font-size-base);
-		text-align: start;
-		cursor: pointer;
-	}
-	.menu-item:hover {
-		background: var(--bg-hover);
-	}
-	/* Keyboard focus reads through the same state background, plus
-	   Cursor's 1px outline drawn inside the row. */
-	.menu-item:focus-visible {
-		outline: var(--focus-outline);
-		outline-offset: var(--focus-outline-offset);
-		background: var(--bg-hover);
-	}
-	.menu-item[aria-selected="true"],
-	.menu-item--selected {
-		background: var(--cursor-bg-secondary);
-	}
-	.menu-item--danger {
-		color: var(--danger-text);
-	}
-	.menu-item__icon {
-		display: flex;
-		align-items: center;
-		justify-content: center;
-		width: var(--space-4);
-		height: var(--space-4);
-		color: inherit;
-	}
-	.menu-item__label {
-		flex: 1;
-		min-width: 0;
-	}
-	.menu-item__check {
-		margin-inline-start: auto;
-		color: var(--cursor-icon-primary);
-	}
-
-	/* The select menu (add .menu-select beside .menu): the surface a .select
-	   control opens - #181818 with a hairline border and a 6px radius, at
-	   least 160px wide, its rows padded 5px 8px and dimmed to 0.6 opacity
-	   until hovered. */
-	.menu-select {
-		min-width: 160px;
-		padding: 0;
-		border: 1px solid var(--border);
-		border-radius: var(--radius);
-		background: var(--cursor-editor);
-	}
-	.menu-select .menu-item {
-		min-height: 0;
-		padding: 5px var(--space-2);
-		border-radius: 0;
-		opacity: 0.6;
-	}
-	.menu-select .menu-item:hover {
-		opacity: 1;
-	}
-
-	/* The composer menu surface (add .menu-composer beside .menu): the skin
-	   of the mode, model, and @ menus - #181818 with a #F0F0F026 border, a
-	   6px radius, and 2px of padding; rows padded 2px 6px with a 4px radius,
-	   12px text, 14px icons, and a #F0F0F011 highlight. Selection is a 10px
-	   check alone, with no selected fill. A row's description sits under
-	   its label in the quieter text tier. */
-	.menu-composer {
-		min-width: 0;
-		padding: 2px;
-		border: 1px solid var(--cursor-stroke-focused);
-		border-radius: var(--radius);
-		background: var(--cursor-editor);
-		box-shadow: var(--shadow-popup);
-		font-size: var(--font-size-sm);
-		line-height: var(--line-height-sm);
-		overflow-y: auto;
-	}
-	.menu-composer .menu-item {
-		min-height: 0;
-		padding: 2px 6px;
-		border-radius: var(--radius-sm);
-		font-size: var(--font-size-sm);
-		line-height: var(--line-height-sm);
-	}
-	.menu-composer .menu-item:hover,
-	.menu-composer .menu-item:focus-visible,
-	.menu-composer .menu-item[aria-selected="true"] {
-		background: var(--bg-hover);
-	}
-	.menu-composer .menu-item--selected {
-		background: transparent;
-	}
-	.menu-composer .menu-item--selected:hover,
-	.menu-composer .menu-item--selected:focus-visible {
-		background: var(--bg-hover);
-	}
-	.menu-composer .menu-item__icon {
-		width: 14px;
-		height: 14px;
-	}
-	.menu-composer .menu-item__icon svg {
-		width: 14px;
-		height: 14px;
-	}
-	.menu-composer .menu-item__text {
-		display: flex;
-		flex: 1;
-		flex-direction: column;
-		min-width: 0;
-	}
-	.menu-composer .menu-item__description {
-		color: var(--cursor-text-tertiary);
-		font-size: var(--font-size-xs);
-		line-height: var(--line-height-xs);
-	}
-	.menu-composer .menu-item__check {
-		display: inline-flex;
-		flex: none;
-		color: var(--cursor-text-primary);
-	}
-	.menu-composer .menu-item__check svg {
-		width: 10px;
-		height: 10px;
-	}
-
-	/* The floating action menu: fixed against the viewport, fading in. */
-	.menu-popup {
-		position: fixed;
-		z-index: 9999;
-		display: flex;
-		flex-direction: column;
-		min-width: 210px;
-		animation: menu-popup-fade 0.083s linear forwards;
-	}
-
-	@keyframes menu-popup-fade {
-		0% {
-			opacity: 0;
-		}
-		100% {
-			opacity: 1;
-		}
-	}
-
-	@media (prefers-reduced-motion: reduce) {
-		.menu-popup {
-			animation: none;
-		}
-	}
-}
diff --git a/crates/workshop/look/dropdown.ts b/crates/workshop/look/dropdown.ts
deleted file mode 100644
index 414ca40a2..000000000
--- a/crates/workshop/look/dropdown.ts
+++ /dev/null
@@ -1,261 +0,0 @@
-// The floating action menu for the Workshop family's UIs: a list of
-// action buttons anchored below (or, at the viewport's bottom edge,
-// above) a trigger element, rendered on the `.menu` / `.menu-item`
-// surface from dropdown.css. The workshop's mode chip and model picker
-// use it.
-//
-// Ported from the vendored murm-ui dropdown, cut to what the consumers
-// use: no disabled items, no alignment or width options, and the
-// open-menu handle lives on an instance the owner disposes instead of
-// in module state.
-//
-// Derived from murm-ui 0.2.0 `components/dropdown.ts`, copyright (c) 2026
-// Lev Morozov, MIT License; the full notice is in THIRD_PARTY_NOTICES.md.
-
-import "./dropdown.css";
-
-import { ICON_CHECK } from "./icons";
-
-/** One action row in a dropdown menu. */
-export interface DropdownItem {
-  label: string;
-  /** A second line under the label, in the composer skin's quieter tier. */
-  description?: string;
-  iconHtml?: string;
-  selected?: boolean;
-  danger?: boolean;
-  onClick: () => void;
-}
-
-/** How one menu opens. Every field is optional; the default is the shared action menu. */
-export interface DropdownOptions {
-  /**
-   * `composer` is the menu surface of the composer's mode, model, and
-   * `@` menus: #181818 with a 15% border, a 6px radius, 2px padding, 12px
-   * rows, a highlight instead of a selected fill, and a check-only
-   * selection mark drawn as a codicon.
-   */
-  readonly skin?: "composer";
-  /** An extra class on the menu, so the owner can size it. */
-  readonly className?: string;
-  /** Which side of the trigger the menu opens on; default below, flipping above at the bottom edge. */
-  readonly placement?: "above" | "below";
-  /** Pixels added to the trigger's left edge (negative moves left); default 0. */
-  readonly offsetX?: number;
-}
-
-/**
- * Shows floating menus of action buttons. An instance owns at most one
- * open menu: showing another closes the first, and showing from the same
- * trigger toggles the open one closed. The menu closes on an outside
- * pointer press, Escape (restoring the trigger's focus), Tab, or an item
- * activation; ArrowUp/ArrowDown/Home/End move focus through the items.
- */
-export class DropdownMenu {
-  private active: { trigger: HTMLElement; close: (restoreFocus?: boolean) => void } | null = null;
-  private nextMenuId = 0;
-
-  /** Whether this instance has a menu open. */
-  get isOpen(): boolean {
-    return this.active !== null;
-  }
-
-  /** Opens a menu of `items` anchored to `trigger`. */
-  show(
-    trigger: HTMLElement,
-    items: readonly DropdownItem[],
-    point?: Readonly<{ x: number; y: number }>,
-    options: DropdownOptions = {},
-  ): void {
-    if (this.active !== null) {
-      const wasSameTrigger = this.active.trigger === trigger;
-      this.active.close(wasSameTrigger);
-      if (wasSameTrigger) {
-        return;
-      }
-    }
-
-    const menu = document.createElement("div");
-    menu.className = "menu menu-popup";
-    if (options.skin === "composer") {
-      menu.classList.add("menu-composer", "scrollbar-menu");
-    }
-    if (options.className !== undefined) {
-      menu.classList.add(...options.className.split(" ").filter((name) => name !== ""));
-    }
-    menu.id = `menu-popup-${++this.nextMenuId}`;
-    menu.tabIndex = -1;
-    menu.setAttribute("role", "menu");
-    menu.setAttribute("aria-orientation", "vertical");
-
-    const buttons: HTMLButtonElement[] = [];
-    for (const item of items) {
-      const button = document.createElement("button");
-      button.type = "button";
-      button.className =
-        item.danger === true ? "menu-item menu-item--danger" : "menu-item";
-      button.setAttribute("role", "menuitem");
-      if (item.selected === true) {
-        button.classList.add("menu-item--selected");
-        button.setAttribute("aria-current", "true");
-      }
-      if (item.iconHtml !== undefined) {
-        const icon = document.createElement("span");
-        icon.className = "menu-item__icon";
-        icon.innerHTML = item.iconHtml;
-        button.appendChild(icon);
-      }
-      const label = document.createElement("span");
-      label.className = "menu-item__label";
-      label.textContent = item.label;
-      if (item.description === undefined) {
-        button.appendChild(label);
-      } else {
-        const text = document.createElement("span");
-        text.className = "menu-item__text";
-        const description = document.createElement("span");
-        description.className = "menu-item__description";
-        description.textContent = item.description;
-        text.append(label, description);
-        button.appendChild(text);
-      }
-      if (item.selected === true) {
-        const check = document.createElement("span");
-        check.className = "menu-item__check";
-        check.setAttribute("aria-hidden", "true");
-        if (options.skin === "composer") {
-          // A static string from ./icons, never data.
-          check.innerHTML = ICON_CHECK;
-        } else {
-          check.textContent = "✓";
-        }
-        button.appendChild(check);
-      }
-      button.addEventListener("click", (event) => {
-        event.stopPropagation();
-        item.onClick();
-        this.close();
-      });
-      buttons.push(button);
-      menu.appendChild(button);
-    }
-
-    // The trigger's popup wiring is restored on close, so a trigger that
-    // had its own aria state gets it back.
-    const previousHasPopup = trigger.getAttribute("aria-haspopup");
-    const previousExpanded = trigger.getAttribute("aria-expanded");
-    const previousControls = trigger.getAttribute("aria-controls");
-    trigger.setAttribute("aria-haspopup", "menu");
-    trigger.setAttribute("aria-expanded", "true");
-    trigger.setAttribute("aria-controls", menu.id);
-
-    document.body.appendChild(menu);
-
-    // Fixed positioning against the viewport: below the trigger, flipped
-    // above when the menu would overflow the bottom edge, right-aligned
-    // to the trigger when it would overflow the right edge.
-    const triggerRect = trigger.getBoundingClientRect();
-    const menuWidth = menu.offsetWidth;
-    const menuHeight = menu.offsetHeight;
-    if (point !== undefined) {
-      menu.style.left = `${Math.max(4, Math.min(point.x, window.innerWidth - menuWidth - 4))}px`;
-      menu.style.right = "auto";
-      menu.style.top = `${Math.max(4, Math.min(point.y, window.innerHeight - menuHeight - 4))}px`;
-    } else if (
-      options.placement === "above" ||
-      triggerRect.bottom + 4 + menuHeight > window.innerHeight
-    ) {
-      menu.style.top = `${triggerRect.top - menuHeight - 4}px`;
-    } else {
-      menu.style.top = `${triggerRect.bottom + 4}px`;
-    }
-    if (point === undefined) {
-      const left = triggerRect.left + (options.offsetX ?? 0);
-      if (left + menuWidth > window.innerWidth - 16) {
-        menu.style.right = `${window.innerWidth - triggerRect.right}px`;
-        menu.style.left = "auto";
-      } else {
-        menu.style.left = `${Math.max(0, left)}px`;
-        menu.style.right = "auto";
-      }
-    }
-
-    const onOutsidePointerDown = (event: PointerEvent) => {
-      if (!menu.contains(event.target as Node) && !trigger.contains(event.target as Node)) {
-        this.close();
-      }
-    };
-    const onEscape = (event: KeyboardEvent) => {
-      if (event.key === "Escape") {
-        event.preventDefault();
-        this.close(true);
-      }
-    };
-    const focusItem = (offset: number) => {
-      if (buttons.length === 0) {
-        return;
-      }
-      const currentIndex = buttons.indexOf(document.activeElement as HTMLButtonElement);
-      const nextIndex = currentIndex === -1 ? 0 : (currentIndex + offset + buttons.length) % buttons.length;
-      buttons[nextIndex]?.focus();
-    };
-    const onMenuKeydown = (event: KeyboardEvent) => {
-      if (event.key === "ArrowDown") {
-        event.preventDefault();
-        focusItem(1);
-      } else if (event.key === "ArrowUp") {
-        event.preventDefault();
-        focusItem(-1);
-      } else if (event.key === "Home") {
-        event.preventDefault();
-        buttons[0]?.focus();
-      } else if (event.key === "End") {
-        event.preventDefault();
-        buttons[buttons.length - 1]?.focus();
-      } else if (event.key === "Tab") {
-        this.close();
-      }
-    };
-    menu.addEventListener("keydown", onMenuKeydown);
-    menu.focus();
-    document.addEventListener("pointerdown", onOutsidePointerDown);
-    document.addEventListener("keydown", onEscape);
-
-    const entry = {
-      trigger,
-      close: (restoreFocus = false): void => {
-        menu.remove();
-        document.removeEventListener("pointerdown", onOutsidePointerDown);
-        document.removeEventListener("keydown", onEscape);
-        restoreAttribute(trigger, "aria-haspopup", previousHasPopup);
-        restoreAttribute(trigger, "aria-expanded", previousExpanded);
-        restoreAttribute(trigger, "aria-controls", previousControls);
-        if (restoreFocus && trigger.isConnected) {
-          trigger.focus();
-        }
-        if (this.active === entry) {
-          this.active = null;
-        }
-      },
-    };
-    this.active = entry;
-  }
-
-  /** Closes the open menu, if any. */
-  close(restoreFocus = false): void {
-    this.active?.close(restoreFocus);
-  }
-
-  /** Closes the open menu; the owner calls this when it tears down. */
-  dispose(): void {
-    this.close();
-  }
-}
-
-function restoreAttribute(element: HTMLElement, name: string, value: string | null): void {
-  if (value === null) {
-    element.removeAttribute(name);
-    return;
-  }
-  element.setAttribute(name, value);
-}
diff --git a/crates/workshop/look/icons.ts b/crates/workshop/look/icons.ts
deleted file mode 100644
index 0279024aa..000000000
--- a/crates/workshop/look/icons.ts
+++ /dev/null
@@ -1,133 +0,0 @@
-// The workbench's icon strings: inline SVG from VS Code's codicons
-// (https://github.com/microsoft/vscode-codicons, CC-BY-4.0; the notice is in
-// THIRD_PARTY_NOTICES.md), the glyph set Cursor draws its own UI with. Each
-// string is the codicon's src/icons/<name>.svg file with only its size
-// attributes set; the glyph fills with currentColor so the consumer's text
-// color tints it. The width/height attributes are part of the contract:
-// consumers assign these strings to innerHTML and their CSS sizes against the
-// attributes. @vscode/codicons is a devDependency that only test/icons.mjs
-// reads, to check every string against its source file.
-
-/** The Add Folder action, on the header button and the empty-space menu. */
-export const ICON_FOLDER_PLUS =
-  '<svg width="15" height="15" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M2 4.5V6H5.58579C5.71839 6 5.84557 5.94732 5.93934 5.85355L7.29289 4.5L5.93934 3.14645C5.84557 3.05268 5.71839 3 5.58579 3H3.5C2.67157 3 2 3.67157 2 4.5ZM1 4.5C1 3.11929 2.11929 2 3.5 2H5.58579C5.98361 2 6.36514 2.15804 6.64645 2.43934L8.20711 4H12.5C13.8807 4 15 5.11929 15 6.5V7.25716C14.6929 7.00353 14.3578 6.78261 14 6.59971V6.5C14 5.67157 13.3284 5 12.5 5H8.20711L6.64645 6.56066C6.36514 6.84197 5.98361 7 5.58579 7H2V11.5C2 12.3284 2.67157 13 3.5 13H6.20703C6.30564 13.3486 6.43777 13.6832 6.59971 14H3.5C2.11929 14 1 12.8807 1 11.5V4.5ZM16 11.5C16 13.9853 13.9853 16 11.5 16C9.01472 16 7 13.9853 7 11.5C7 9.01472 9.01472 7 11.5 7C13.9853 7 16 9.01472 16 11.5ZM12 9C12 8.72386 11.7761 8.5 11.5 8.5C11.2239 8.5 11 8.72386 11 9V11H9C8.72386 11 8.5 11.2239 8.5 11.5C8.5 11.7761 8.72386 12 9 12H11V14C11 14.2761 11.2239 14.5 11.5 14.5C11.7761 14.5 12 14.2761 12 14V12H14C14.2761 12 14.5 11.7761 14.5 11.5C14.5 11.2239 14.2761 11 14 11H12V9Z"/></svg>';
-
-/** The Remove from Workspace action, on a root row's context menu. */
-export const ICON_TRASH_2 =
-  '<svg width="15" height="15" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M14 2H10C10 0.897 9.103 0 8 0C6.897 0 6 0.897 6 2H2C1.724 2 1.5 2.224 1.5 2.5C1.5 2.776 1.724 3 2 3H2.54L3.349 12.708C3.456 13.994 4.55 15 5.84 15H10.159C11.449 15 12.543 13.993 12.65 12.708L13.459 3H13.999C14.275 3 14.499 2.776 14.499 2.5C14.499 2.224 14.275 2 13.999 2H14ZM8 1C8.551 1 9 1.449 9 2H7C7 1.449 7.449 1 8 1ZM11.655 12.625C11.591 13.396 10.934 14 10.16 14H5.841C5.067 14 4.41 13.396 4.346 12.625L3.544 3H12.458L11.656 12.625H11.655ZM7 5.5V11.5C7 11.776 6.776 12 6.5 12C6.224 12 6 11.776 6 11.5V5.5C6 5.224 6.224 5 6.5 5C6.776 5 7 5.224 7 5.5ZM10 5.5V11.5C10 11.776 9.776 12 9.5 12C9.224 12 9 11.776 9 11.5V5.5C9 5.224 9.224 5 9.5 5C9.776 5 10 5.224 10 5.5Z"/></svg>';
-
-/** The push-to-talk mic, on the agent session's input form. */
-export const ICON_MIC =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 10.9995C9.654 10.9995 11 9.65351 11 7.99951V3.99951C11 2.34551 9.654 0.999512 8 0.999512C6.346 0.999512 5 2.34551 5 3.99951V7.99951C5 9.65351 6.346 10.9995 8 10.9995ZM6 3.99951C6 2.89651 6.897 1.99951 8 1.99951C9.103 1.99951 10 2.89651 10 3.99951V7.99951C10 9.10251 9.103 9.99951 8 9.99951C6.897 9.99951 6 9.10251 6 7.99951V3.99951ZM13 7.49951V7.99951C13 10.5855 11.02 12.6935 8.5 12.9485V14.4995C8.5 14.7755 8.276 14.9995 8 14.9995C7.724 14.9995 7.5 14.7755 7.5 14.4995V12.9485C4.98 12.6935 3 10.5845 3 7.99951V7.49951C3 7.22351 3.224 6.99951 3.5 6.99951C3.776 6.99951 4 7.22351 4 7.49951V7.99951C4 10.2055 5.794 11.9995 8 11.9995C10.206 11.9995 12 10.2055 12 7.99951V7.49951C12 7.22351 12.224 6.99951 12.5 6.99951C12.776 6.99951 13 7.22351 13 7.49951Z"/></svg>';
-
-/** The send arrow, on the agent session's submit button. */
-export const ICON_SEND =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M13.854 7.14576L8.85401 2.14576C8.65901 1.95076 8.34201 1.95076 8.14701 2.14576L3.14601 7.14576C2.95101 7.34076 2.95101 7.65776 3.14601 7.85276C3.34101 8.04776 3.65801 8.04776 3.85301 7.85276L7.99901 3.70676V13.4998C7.99901 13.7758 8.22301 13.9998 8.49901 13.9998C8.77501 13.9998 8.99901 13.7758 8.99901 13.4998V3.70676L13.145 7.85276C13.243 7.95076 13.371 7.99876 13.499 7.99876C13.627 7.99876 13.755 7.94976 13.853 7.85276C14.048 7.65776 14.048 7.34076 13.853 7.14576H13.854Z"/></svg>';
-
-/** A close X: tab closers, mention chips, and toast dismissals. */
-export const ICON_CLOSE =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8.70701 8.00001L12.353 4.35401C12.548 4.15901 12.548 3.84201 12.353 3.64701C12.158 3.45201 11.841 3.45201 11.646 3.64701L8.00001 7.29301L4.35401 3.64701C4.15901 3.45201 3.84201 3.45201 3.64701 3.64701C3.45201 3.84201 3.45201 4.15901 3.64701 4.35401L7.29301 8.00001L3.64701 11.646C3.45201 11.841 3.45201 12.158 3.64701 12.353C3.74501 12.451 3.87301 12.499 4.00101 12.499C4.12901 12.499 4.25701 12.45 4.35501 12.353L8.00101 8.70701L11.647 12.353C11.745 12.451 11.873 12.499 12.001 12.499C12.129 12.499 12.257 12.45 12.355 12.353C12.55 12.158 12.55 11.841 12.355 11.646L8.70901 8.00001H8.70701Z"/></svg>';
-
-/** A right chevron: collapsed disclosure rows and submenu arrows. */
-export const ICON_CHEVRON_RIGHT =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M6.14601 3.14579C5.95101 3.34079 5.95101 3.65779 6.14601 3.85279L10.292 7.99879L6.14601 12.1448C5.95101 12.3398 5.95101 12.6568 6.14601 12.8518C6.34101 13.0468 6.65801 13.0468 6.85301 12.8518L11.353 8.35179C11.548 8.15679 11.548 7.83979 11.353 7.64478L6.85301 3.14479C6.65801 2.94979 6.34101 2.95079 6.14601 3.14579Z"/></svg>';
-
-/** A down chevron: open disclosure rows and dropdown carets. */
-export const ICON_CHEVRON_DOWN =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M3.14598 5.85423L7.64598 10.3542C7.84098 10.5492 8.15798 10.5492 8.35298 10.3542L12.853 5.85423C13.048 5.65923 13.048 5.34223 12.853 5.14723C12.658 4.95223 12.341 4.95223 12.146 5.14723L7.99998 9.29323L3.85398 5.14723C3.65898 4.95223 3.34198 4.95223 3.14698 5.14723C2.95198 5.34223 2.95098 5.65923 3.14598 5.85423Z"/></svg>';
-
-/** The stop button that ends a running agent turn. */
-export const ICON_STOP_CIRCLE =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M6 5C5.44772 5 5 5.44772 5 6V10C5 10.5523 5.44772 11 6 11H10C10.5523 11 11 10.5523 11 10V6C11 5.44772 10.5523 5 10 5H6ZM1 8C1 4.13401 4.13401 1 8 1C11.866 1 15 4.13401 15 8C15 11.866 11.866 15 8 15C4.13401 15 1 11.866 1 8ZM8 2C4.68629 2 2 4.68629 2 8C2 11.3137 4.68629 14 8 14C11.3137 14 14 11.3137 14 8C14 4.68629 11.3137 2 8 2Z"/></svg>';
-
-/** A plus: New Agent and add actions. */
-export const ICON_ADD =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 1.5C8 1.22386 7.77614 1 7.5 1C7.22386 1 7 1.22386 7 1.5V7H1.5C1.22386 7 1 7.22386 1 7.5C1 7.77614 1.22386 8 1.5 8H7V13.5C7 13.7761 7.22386 14 7.5 14C7.77614 14 8 13.7761 8 13.5V8H13.5C13.7761 8 14 7.77614 14 7.5C14 7.22386 13.7761 7 13.5 7H8V1.5Z"/></svg>';
-
-/** The More Actions dots. */
-export const ICON_ELLIPSIS =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M5 8C5 8.55229 4.55228 9 4 9C3.44772 9 3 8.55229 3 8C3 7.44772 3.44772 7 4 7C4.55228 7 5 7.44772 5 8ZM9 8C9 8.55229 8.55229 9 8 9C7.44772 9 7 8.55229 7 8C7 7.44772 7.44772 7 8 7C8.55229 7 9 7.44772 9 8ZM12 9C12.5523 9 13 8.55229 13 8C13 7.44772 12.5523 7 12 7C11.4477 7 11 7.44772 11 8C11 8.55229 11.4477 9 12 9Z"/></svg>';
-
-/** The warning severity glyph. */
-export const ICON_WARNING =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M14.831 11.965L9.206 1.714C8.965 1.274 8.503 1 8 1C7.497 1 7.035 1.274 6.794 1.714L1.169 11.965C1.059 12.167 1 12.395 1 12.625C1 13.383 1.617 14 2.375 14H13.625C14.383 14 15 13.383 15 12.625C15 12.395 14.941 12.167 14.831 11.965ZM13.625 13H2.375C2.168 13 2 12.832 2 12.625C2 12.561 2.016 12.5 2.046 12.445L7.671 2.195C7.736 2.075 7.863 2 8 2C8.137 2 8.264 2.075 8.329 2.195L13.954 12.445C13.984 12.501 14 12.561 14 12.625C14 12.832 13.832 13 13.625 13ZM8.75 11.25C8.75 11.664 8.414 12 8 12C7.586 12 7.25 11.664 7.25 11.25C7.25 10.836 7.586 10.5 8 10.5C8.414 10.5 8.75 10.836 8.75 11.25ZM7.5 9V5.5C7.5 5.224 7.724 5 8 5C8.276 5 8.5 5.224 8.5 5.5V9C8.5 9.276 8.276 9.5 8 9.5C7.724 9.5 7.5 9.276 7.5 9Z"/></svg>';
-
-/** The information severity glyph. */
-export const ICON_INFO =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8.49902 7.49998C8.49902 7.22384 8.27517 6.99998 7.99902 6.99998C7.72288 6.99998 7.49902 7.22384 7.49902 7.49998V10.5C7.49902 10.7761 7.72288 11 7.99902 11C8.27517 11 8.49902 10.7761 8.49902 10.5V7.49998ZM8.74807 5.50001C8.74807 5.91369 8.41271 6.24905 7.99903 6.24905C7.58535 6.24905 7.25 5.91369 7.25 5.50001C7.25 5.08633 7.58535 4.75098 7.99903 4.75098C8.41271 4.75098 8.74807 5.08633 8.74807 5.50001ZM8 1C4.13401 1 1 4.13401 1 8C1 11.866 4.13401 15 8 15C11.866 15 15 11.866 15 8C15 4.13401 11.866 1 8 1ZM2 8C2 4.68629 4.68629 2 8 2C11.3137 2 14 4.68629 14 8C14 11.3137 11.3137 14 8 14C4.68629 14 2 11.3137 2 8Z"/></svg>';
-
-/** The error severity glyph. */
-export const ICON_ERROR =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 1C4.14 1 1 4.14 1 8C1 11.86 4.14 15 8 15C11.86 15 15 11.86 15 8C15 4.14 11.86 1 8 1ZM8 14C4.691 14 2 11.309 2 8C2 4.691 4.691 2 8 2C11.309 2 14 4.691 14 8C14 11.309 11.309 14 8 14ZM10.854 5.854L8.708 8L10.854 10.146C11.049 10.341 11.049 10.658 10.854 10.853C10.756 10.951 10.628 10.999 10.5 10.999C10.372 10.999 10.244 10.95 10.146 10.853L8 8.707L5.854 10.853C5.756 10.951 5.628 10.999 5.5 10.999C5.372 10.999 5.244 10.95 5.146 10.853C4.951 10.658 4.951 10.341 5.146 10.146L7.292 8L5.146 5.854C4.951 5.659 4.951 5.342 5.146 5.147C5.341 4.952 5.658 4.952 5.853 5.147L7.999 7.293L10.145 5.147C10.34 4.952 10.657 4.952 10.852 5.147C11.047 5.342 11.047 5.659 10.852 5.854H10.854Z"/></svg>';
-
-/** A check mark: selected menu rows and copied confirmations. */
-export const ICON_CHECK =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M13.6572 3.13573C13.8583 2.9465 14.175 2.95614 14.3643 3.15722C14.5535 3.35831 14.5438 3.675 14.3428 3.86425L5.84277 11.8642C5.64597 12.0494 5.33756 12.0446 5.14648 11.8535L1.64648 8.35351C1.45121 8.15824 1.45121 7.84174 1.64648 7.64647C1.84174 7.45121 2.15825 7.45121 2.35351 7.64647L5.50976 10.8027L13.6572 3.13573Z"/></svg>';
-
-/** A copy glyph: the turn footer's Copy action. */
-export const ICON_COPY =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M3 5V12.73C2.4 12.38 2 11.74 2 11V5C2 2.79 3.79 1 6 1H9C9.74 1 10.38 1.4 10.73 2H6C4.35 2 3 3.35 3 5ZM11 15H6C4.897 15 4 14.103 4 13V5C4 3.897 4.897 3 6 3H11C12.103 3 13 3.897 13 5V13C13 14.103 12.103 15 11 15ZM12 5C12 4.448 11.552 4 11 4H6C5.448 4 5 4.448 5 5V13C5 13.552 5.448 14 6 14H11C11.552 14 12 13.552 12 13V5Z"/></svg>';
-
-/** The Agent mode glyph, on the mode chip and its menu. */
-export const ICON_AGENT =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M5.10198 3C4.92335 3 4.75829 3.0953 4.66897 3.25L2.07089 7.75C1.98158 7.9047 1.98158 8.0953 2.07089 8.25L4.5746 12.5866C4.72231 12.8424 4.99529 13 5.29071 13C5.65144 13 5.97055 12.7662 6.0792 12.4222L8.96823 3.27622C9.20821 2.51649 9.913 2 10.7097 2C11.3622 2 11.9651 2.34809 12.2914 2.91316L14.7953 7.25C15.0632 7.7141 15.0632 8.2859 14.7953 8.75L12.1972 13.25C11.9292 13.7141 11.434 14 10.8981 14H8.50155C8.22541 14 8.00155 13.7761 8.00155 13.5C8.00155 13.2239 8.22541 13 8.50155 13H10.8981C11.0768 13 11.2418 12.9047 11.3311 12.75L13.9292 8.25C14.0185 8.0953 14.0185 7.9047 13.9292 7.75L11.4254 3.41316C11.2777 3.1575 11.005 3 10.7097 3C10.3493 3 10.0304 3.23369 9.92179 3.57743L7.03276 12.7234C6.7927 13.4834 6.08769 14 5.29071 14C4.63803 14 4.03492 13.6518 3.70858 13.0866L1.20487 8.75C0.936918 8.2859 0.936919 7.7141 1.20487 7.25L3.80295 2.75C4.07089 2.2859 4.56609 2 5.10198 2H7.50155C7.77769 2 8.00155 2.22386 8.00155 2.5C8.00155 2.77614 7.77769 3 7.50155 3H5.10198Z"/></svg>';
-
-/** The Plan mode glyph. */
-export const ICON_CHECKLIST =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M4.85401 2.146C5.04901 2.341 5.04901 2.658 4.85401 2.853L2.85401 4.853C2.65901 5.048 2.34201 5.048 2.14701 4.853L1.14701 3.853C0.952013 3.658 0.952013 3.341 1.14701 3.146C1.34201 2.951 1.65901 2.951 1.85401 3.146L2.50001 3.792L4.14601 2.146C4.34101 1.951 4.65901 1.951 4.85401 2.146ZM14.5 4H6.50001C6.22401 4 6.00001 3.776 6.00001 3.5C6.00001 3.224 6.22401 3 6.50001 3H14.5C14.776 3 15 3.224 15 3.5C15 3.776 14.776 4 14.5 4ZM4.85401 11.146C5.04901 11.341 5.04901 11.658 4.85401 11.853L2.85401 13.853C2.65901 14.048 2.34201 14.048 2.14701 13.853L1.14701 12.853C0.952013 12.658 0.952013 12.341 1.14701 12.146C1.34201 11.951 1.65901 11.951 1.85401 12.146L2.50001 12.792L4.14601 11.146C4.34101 10.951 4.65901 10.951 4.85401 11.146ZM14.5 13H6.50001C6.22401 13 6.00001 12.776 6.00001 12.5C6.00001 12.224 6.22401 12 6.50001 12H14.5C14.776 12 15 12.224 15 12.5C15 12.776 14.776 13 14.5 13ZM4.85401 6.646C5.04901 6.841 5.04901 7.158 4.85401 7.353L2.85401 9.353C2.65901 9.548 2.34201 9.548 2.14701 9.353L1.14701 8.353C0.952013 8.158 0.952013 7.841 1.14701 7.646C1.34201 7.451 1.65901 7.451 1.85401 7.646L2.50001 8.292L4.14601 6.646C4.34101 6.451 4.65901 6.451 4.85401 6.646ZM14.5 8.5H6.50001C6.22401 8.5 6.00001 8.276 6.00001 8C6.00001 7.724 6.22401 7.5 6.50001 7.5H14.5C14.776 7.5 15 7.724 15 8C15 8.276 14.776 8.5 14.5 8.5Z"/></svg>';
-
-/** The Debug mode glyph. */
-export const ICON_BUG =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M14.5 8H13V6C13 5.63 12.898 5.283 12.722 4.985L13.853 3.854C14.048 3.659 14.048 3.342 13.853 3.147C13.658 2.952 13.341 2.952 13.146 3.147L12.015 4.278C11.717 4.102 11.37 4 11 4C11 2.346 9.654 1 8 1C6.346 1 5 2.346 5 4C4.63 4 4.283 4.102 3.985 4.278L2.854 3.147C2.659 2.952 2.342 2.952 2.147 3.147C1.952 3.342 1.952 3.659 2.147 3.854L3.278 4.985C3.102 5.283 3 5.63 3 6V8H1.5C1.224 8 1 8.224 1 8.5C1 8.776 1.224 9 1.5 9H3C3 10.199 3.424 11.3 4.13 12.163L2.396 13.897C2.201 14.092 2.201 14.409 2.396 14.604C2.494 14.702 2.622 14.75 2.75 14.75C2.878 14.75 3.006 14.701 3.104 14.604L4.838 12.87C5.7 13.576 6.802 14 8.001 14C9.2 14 10.301 13.576 11.164 12.87L12.898 14.604C12.996 14.702 13.124 14.75 13.252 14.75C13.38 14.75 13.508 14.701 13.606 14.604C13.801 14.409 13.801 14.092 13.606 13.897L11.872 12.163C12.578 11.301 13.002 10.199 13.002 9H14.502C14.778 9 15.002 8.776 15.002 8.5C15.002 8.224 14.778 8 14.502 8H14.5ZM8 2C9.103 2 10 2.897 10 4H6C6 2.897 6.897 2 8 2ZM12 9C12 11.206 10.206 13 8 13C5.794 13 4 11.206 4 9V6C4 5.449 4.448 5 5 5H11C11.552 5 12 5.449 12 6V9Z"/></svg>';
-
-/** The Multitask mode glyph. */
-export const ICON_LAYERS =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 8.99993C7.819 8.99993 7.643 8.95093 7.486 8.85793L2.486 5.85693C2.186 5.67793 2 5.34893 2 4.99993C2 4.65093 2.187 4.32093 2.486 4.14193L7.486 1.14293C7.789 0.95693 8.207 0.95493 8.517 1.14493L13.513 4.14293C13.813 4.32293 13.999 4.65093 13.999 4.99993C13.999 5.34893 13.812 5.67893 13.513 5.85793L8.513 8.85693C8.357 8.95093 8.181 8.99993 8 8.99993ZM8 1.99993L3 4.99993L8 7.99993L13 4.99993L8 1.99993Z"/><path d="M2.146 6.9873L8 10.5003L13.854 6.9873C13.946 7.1413 14 7.3173 14 7.5003C14 7.8493 13.814 8.1783 13.514 8.3583L8.514 11.3573C8.357 11.4513 8.181 11.5003 8 11.5003C7.819 11.5003 7.642 11.4513 7.486 11.3583L2.486 8.35731C2.187 8.17931 2 7.8503 2 7.5003C2 7.3163 2.054 7.1403 2.146 6.9873Z"/><path d="M2.146 9.4873L8 13.0003L13.854 9.4873C13.946 9.6413 14 9.8173 14 10.0003C14 10.3493 13.814 10.6783 13.514 10.8583L8.514 13.8573C8.357 13.9513 8.181 14.0003 8 14.0003C7.819 14.0003 7.642 13.9513 7.486 13.8583L2.486 10.8573C2.187 10.6793 2 10.3503 2 10.0003C2 9.8163 2.054 9.6403 2.146 9.4873Z"/></svg>';
-
-/** The Ask mode glyph. */
-export const ICON_ASK =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 11C8.414 11 8.75 11.336 8.75 11.75C8.75 12.164 8.414 12.5 8 12.5C7.586 12.5 7.25 12.164 7.25 11.75C7.25 11.336 7.586 11 8 11Z"/><path d="M8 4C9.262 4 10.25 4.988 10.25 6.25C10.25 7.333 9.68352 7.89752 9.22852 8.35352C8.82052 8.76052 8.5 9.082 8.5 9.75C8.5 10.026 8.276 10.25 8 10.25C7.724 10.25 7.5 10.026 7.5 9.75C7.5 8.667 8.06648 8.10248 8.52148 7.64648C8.92948 7.23948 9.25 6.918 9.25 6.25C9.25 5.538 8.712 5 8 5C7.288 5 6.75 5.538 6.75 6.25C6.75 6.526 6.526 6.75 6.25 6.75C5.974 6.75 5.75 6.526 5.75 6.25C5.75 4.988 6.738 4 8 4Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M8 1C11.866 1 14.999 4.13499 14.999 8.00098C14.999 11.867 11.865 15.001 7.99902 15.001C6.72402 15.001 5.52612 14.6585 4.49512 14.0615L1.7666 14.9707C1.70669 14.9906 1.64491 15.001 1.58301 15.001C1.43501 15.001 1.28969 14.9449 1.17969 14.8389C1.02386 14.6889 0.964466 14.4647 1.02344 14.2568L1.85254 11.3506C1.30871 10.3547 1 9.21279 1 8C1 4.134 4.134 1 8 1ZM8.00098 2.00098C4.693 2.00099 2.00099 4.693 2.00098 8.00098C2.00098 9.00398 2.25345 9.99707 2.73145 10.8721L2.92676 11.2324L2.20117 13.7725L4.17871 13.1133L4.60742 12.9697L4.99707 13.1963C5.90503 13.7222 6.94407 14 8 14L8.00098 14.001C11.309 14.001 14.001 11.309 14.001 8.00098C14.001 4.69299 11.309 2.00098 8.00098 2.00098Z"/></svg>';
-
-/** A plain file: the mention chip's generic glyph. */
-export const ICON_FILE =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M5 1C3.89543 1 3 1.89543 3 3V13C3 14.1046 3.89543 15 5 15H11C12.1046 15 13 14.1046 13 13V5.41421C13 5.01639 12.842 4.63486 12.5607 4.35355L9.64645 1.43934C9.36514 1.15804 8.98361 1 8.58579 1H5ZM4 3C4 2.44772 4.44772 2 5 2H8V4.5C8 5.32843 8.67157 6 9.5 6H12V13C12 13.5523 11.5523 14 11 14H5C4.44772 14 4 13.5523 4 13V3ZM11.7929 5H9.5C9.22386 5 9 4.77614 9 4.5V2.20711L11.7929 5Z"/></svg>';
-
-/** A source file: the mention chip's glyph for code extensions. */
-export const ICON_FILE_CODE =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M13.56 4.35L10.65 1.44C10.368 1.16009 9.98732 1.00208 9.58998 1H5.99998C5.47003 1.00158 4.96224 1.2128 4.58751 1.58753C4.21278 1.96227 4.00156 2.47005 3.99998 3V8.83C4.28127 8.9031 4.53719 9.05181 4.73998 9.26C4.84686 9.3602 4.93492 9.47874 4.99998 9.61V3C4.99998 2.73478 5.10534 2.48043 5.29287 2.29289C5.48041 2.10536 5.73476 2 5.99998 2H8.99998V4.5C8.99998 4.89782 9.15801 5.27936 9.43932 5.56066C9.72062 5.84196 10.1022 6 10.5 6H13V13C13 13.2652 12.8946 13.5196 12.7071 13.7071C12.5195 13.8946 12.2652 14 12 14H10.48L9.46998 15H12C12.5299 14.9984 13.0377 14.7872 13.4124 14.4125C13.7872 14.0377 13.9984 13.5299 14 13V5.41C13.9979 5.01266 13.8399 4.63202 13.56 4.35ZM10.5 5C10.3674 5 10.2402 4.94732 10.1464 4.85355C10.0527 4.75979 9.99998 4.63261 9.99998 4.5V2.21L12.79 5H10.5Z"/><path d="M3.47798 14.978C3.34548 14.9777 3.21852 14.9248 3.12498 14.831L1.14598 12.854C1.09942 12.8076 1.06247 12.7524 1.03727 12.6916C1.01206 12.6309 0.999084 12.5658 0.999084 12.5C0.999084 12.4342 1.01206 12.3691 1.03727 12.3084C1.06247 12.2476 1.09942 12.1924 1.14598 12.146L3.14598 10.146C3.23986 10.0521 3.3672 9.99937 3.49998 9.99937C3.63275 9.99937 3.76009 10.0521 3.85398 10.146C3.94787 10.2399 4.00061 10.3672 4.00061 10.5C4.00061 10.6328 3.94787 10.7601 3.85398 10.854L2.20698 12.5L3.83198 14.124C3.90209 14.1939 3.94985 14.2831 3.96922 14.3802C3.98858 14.4773 3.97868 14.578 3.94076 14.6695C3.90284 14.7609 3.83862 14.8391 3.75623 14.894C3.67384 14.9489 3.577 14.9782 3.47798 14.978Z"/><path d="M7.52198 14.978C7.42296 14.9782 7.32611 14.9489 7.24372 14.894C7.16134 14.8391 7.09711 14.7609 7.05919 14.6695C7.02128 14.578 7.01137 14.4773 7.03074 14.3802C7.05011 14.2831 7.09787 14.1939 7.16798 14.124L8.79298 12.5L7.14598 10.854C7.05209 10.7601 6.99935 10.6328 6.99935 10.5C6.99935 10.3672 7.05209 10.2399 7.14598 10.146C7.23986 10.0521 7.3672 9.99937 7.49998 9.99937C7.63275 9.99937 7.76009 10.0521 7.85398 10.146L9.85398 12.146C9.90054 12.1924 9.93748 12.2476 9.96269 12.3084C9.9879 12.3691 10.0009 12.4342 10.0009 12.5C10.0009 12.5658 9.9879 12.6309 9.96269 12.6916C9.93748 12.7524 9.90054 12.8076 9.85398 12.854L7.87498 14.831C7.78144 14.9248 7.65447 14.9777 7.52198 14.978Z"/></svg>';
-
-/** An image or media file: the mention chip's glyph for pictures. */
-export const ICON_FILE_MEDIA =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M6 1C4.89543 1 4 1.89543 4 3V6H5V3C5 2.44772 5.44772 2 6 2H9V4.5C9 5.32843 9.67157 6 10.5 6H13V13C13 13.5523 12.5523 14 12 14H10.9646C10.9141 14.3531 10.8109 14.6891 10.6632 15H12C13.1046 15 14 14.1046 14 13V5.41421C14 5.01639 13.842 4.63486 13.5607 4.35355L10.6464 1.43934C10.3651 1.15804 9.98361 1 9.58579 1H6ZM12.7929 5H10.5C10.2239 5 10 4.77614 10 4.5V2.20711L12.7929 5ZM1 9.5C1 8.11929 2.11929 7 3.5 7H7.5C8.88071 7 10 8.11929 10 9.5V13.5C10 14.0095 9.84756 14.4835 9.5858 14.8787L6.56066 11.8536C5.97487 11.2678 5.02513 11.2678 4.43934 11.8536L1.4142 14.8787C1.15244 14.4835 1 14.0095 1 13.5V9.5ZM8 9.75C8 9.33579 7.66421 9 7.25 9C6.83579 9 6.5 9.33579 6.5 9.75C6.5 10.1642 6.83579 10.5 7.25 10.5C7.66421 10.5 8 10.1642 8 9.75ZM2.12131 15.5858C2.51652 15.8476 2.99046 16 3.5 16H7.5C8.00954 16 8.48348 15.8476 8.87869 15.5858L5.85355 12.5607C5.65829 12.3654 5.34171 12.3654 5.14645 12.5607L2.12131 15.5858Z"/></svg>';
-
-/** A text or markdown file: the mention chip's glyph for prose extensions. */
-export const ICON_FILE_TEXT =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M3 3C3 1.89543 3.89543 1 5 1H8.58579C8.98361 1 9.36514 1.15804 9.64645 1.43934L12.5607 4.35355C12.842 4.63486 13 5.01639 13 5.41421V13C13 14.1046 12.1046 15 11 15H5C3.89543 15 3 14.1046 3 13V3ZM5 2C4.44772 2 4 2.44772 4 3V13C4 13.5523 4.44772 14 5 14H11C11.5523 14 12 13.5523 12 13V6H9.5C8.67157 6 8 5.32843 8 4.5V2H5ZM9.5 5H11.7929L9 2.20711V4.5C9 4.77614 9.22386 5 9.5 5ZM5.5 8C5.22386 8 5 8.22386 5 8.5C5 8.77614 5.22386 9 5.5 9H10.5C10.7761 9 11 8.77614 11 8.5C11 8.22386 10.7761 8 10.5 8H5.5ZM5 10.5C5 10.2239 5.22386 10 5.5 10H10.5C10.7761 10 11 10.2239 11 10.5C11 10.7761 10.7761 11 10.5 11H5.5C5.22386 11 5 10.7761 5 10.5ZM5.5 12C5.22386 12 5 12.2239 5 12.5C5 12.7761 5.22386 13 5.5 13H10.5C10.7761 13 11 12.7761 11 12.5C11 12.2239 10.7761 12 10.5 12H5.5Z"/></svg>';
-
-/** A folder: the mention chip's glyph for directories. */
-export const ICON_FOLDER =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M2 4.5V6H5.58579C5.71839 6 5.84557 5.94732 5.93934 5.85355L7.29289 4.5L5.93934 3.14645C5.84557 3.05268 5.71839 3 5.58579 3H3.5C2.67157 3 2 3.67157 2 4.5ZM1 4.5C1 3.11929 2.11929 2 3.5 2H5.58579C5.98361 2 6.36514 2.15804 6.64645 2.43934L8.20711 4H12.5C13.8807 4 15 5.11929 15 6.5V11.5C15 12.8807 13.8807 14 12.5 14H3.5C2.11929 14 1 12.8807 1 11.5V4.5ZM2 7V11.5C2 12.3284 2.67157 13 3.5 13H12.5C13.3284 13 14 12.3284 14 11.5V6.5C14 5.67157 13.3284 5 12.5 5H8.20711L6.64645 6.56066C6.36514 6.84197 5.98361 7 5.58579 7H2Z"/></svg>';
-
-/** A web address: the mention chip's glyph for sites. */
-export const ICON_GLOBE =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M8 1C4.141 1 1 4.141 1 8C1 11.859 4.141 15 8 15C11.859 15 15 11.859 15 8C15 4.141 11.859 1 8 1ZM8 14C7.422 14 6.686 12.906 6.288 11H9.713C9.315 12.906 8.579 14 8.001 14H8ZM6.121 10C6.044 9.392 6 8.723 6 8C6 7.277 6.044 6.608 6.121 6H9.878C9.955 6.608 9.999 7.277 9.999 8C9.999 8.723 9.955 9.392 9.878 10H6.121ZM2 8C2 7.299 2.121 6.626 2.343 6H5.121C5.041 6.656 5 7.332 5 8C5 8.668 5.041 9.344 5.121 10H2.343C2.121 9.374 2 8.701 2 8ZM8 2C8.578 2 9.314 3.094 9.712 5H6.287C6.685 3.094 7.422 2 8 2ZM10.879 6H13.657C13.879 6.626 14 7.299 14 8C14 8.701 13.879 9.374 13.657 10H10.879C10.959 9.344 11 8.668 11 8C11 7.332 10.959 6.656 10.879 6ZM13.195 5H10.722C10.516 3.938 10.199 2.98 9.775 2.268C11.228 2.719 12.446 3.707 13.195 5ZM6.226 2.268C5.802 2.98 5.484 3.938 5.279 5H2.806C3.556 3.707 4.774 2.718 6.226 2.268ZM2.805 11H5.278C5.484 12.062 5.801 13.02 6.225 13.732C4.772 13.281 3.554 12.293 2.805 11ZM9.774 13.732C10.198 13.02 10.516 12.062 10.721 11H13.194C12.444 12.293 11.226 13.282 9.774 13.732Z"/></svg>';
-
-/** A link: the mention chip's glyph for URLs. */
-export const ICON_LINK =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M9.49999 4H10.5C12.433 4 14 5.567 14 7.5C14 9.36856 12.5357 10.8951 10.6941 10.9948L10.5023 11L9.5023 11.0046C9.22616 11.0059 9.00127 10.783 8.99999 10.5069C8.99888 10.2614 9.17481 10.0565 9.40787 10.0131L9.4977 10.0046L10.5 10C11.8807 10 13 8.88071 13 7.5C13 6.17452 11.9685 5.08996 10.6644 5.00532L10.5 5H9.49999C9.22386 5 8.99999 4.77614 8.99999 4.5C8.99999 4.25454 9.17687 4.05039 9.41012 4.00806L9.49999 4H10.5H9.49999ZM5.5 4H6.5C6.77614 4 7 4.22386 7 4.5C7 4.74546 6.82312 4.94961 6.58988 4.99194L6.5 5H5.5C4.11929 5 3 6.11929 3 7.5C3 8.82548 4.03154 9.91004 5.33562 9.99468L5.5 10H6.5C6.77614 10 7 10.2239 7 10.5C7 10.7455 6.82312 10.9496 6.58988 10.9919L6.5 11H5.5C3.567 11 2 9.433 2 7.5C2 5.63144 3.46428 4.10487 5.30796 4.00518L5.5 4H6.5H5.5ZM5.50023 7L10.5002 7.0023C10.7764 7.00242 11.0001 7.22638 11 7.50252C10.9999 7.74798 10.8229 7.95205 10.5897 7.99428L10.4998 8.0023L5.49977 8C5.22363 7.99987 4.99987 7.77591 5 7.49977C5.00011 7.25431 5.17708 7.05024 5.41035 7.00801L5.50023 7Z"/></svg>';
-
-/** The Toggle Primary Side Bar button on the title bar. */
-export const ICON_LAYOUT_SIDEBAR_LEFT =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M12.5 1C13.881 1 15 2.119 15 3.5V12.5C15 13.881 13.881 15 12.5 15H3.5C2.119 15 1 13.881 1 12.5V3.5C1 2.119 2.119 1 3.5 1H12.5ZM12.5 14C13.328 14 14 13.328 14 12.5V3.5C14 2.672 13.328 2 12.5 2H7V14H12.5Z"/></svg>';
-
-/** The Toggle Agents button on the title bar. */
-export const ICON_LAYOUT_SIDEBAR_RIGHT =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M12.5 1C13.881 1 15 2.119 15 3.5V12.5C15 13.881 13.881 15 12.5 15H3.5C2.119 15 1 13.881 1 12.5V3.5C1 2.119 2.119 1 3.5 1H12.5ZM9 14V2H3.5C2.672 2 2 2.672 2 3.5V12.5C2 13.328 2.672 14 3.5 14H9Z"/></svg>';
-
-/** The settings gear on the title bar. */
-export const ICON_GEAR =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M7.99997 6C6.89497 6 5.99997 6.895 5.99997 8C5.99997 9.105 6.89497 10 7.99997 10C9.10497 10 9.99997 9.105 9.99997 8C9.99997 6.895 9.10497 6 7.99997 6ZM7.99997 9C7.44797 9 6.99997 8.552 6.99997 8C6.99997 7.448 7.44797 7 7.99997 7C8.55197 7 8.99997 7.448 8.99997 8C8.99997 8.552 8.55197 9 7.99997 9ZM14.565 9.715L13.279 8.628C13.245 8.599 13.213 8.567 13.184 8.533C12.888 8.186 12.931 7.667 13.279 7.372L14.565 6.285C14.693 6.177 14.742 6.003 14.691 5.844C14.386 4.903 13.882 4.04 13.219 3.308C13.139 3.22 13.027 3.172 12.912 3.172C12.865 3.172 12.818 3.18 12.773 3.196L11.186 3.761C11.144 3.776 11.1 3.788 11.056 3.796C11.006 3.805 10.956 3.81 10.907 3.81C10.515 3.81 10.167 3.532 10.094 3.134L9.79097 1.482C9.76097 1.318 9.63397 1.188 9.46997 1.153C8.98997 1.051 8.49897 1 8.00097 1C7.50297 1 7.01097 1.052 6.53097 1.153C6.36697 1.188 6.23997 1.318 6.20997 1.482L5.90797 3.134C5.89997 3.178 5.88797 3.221 5.87297 3.263C5.75197 3.6 5.43397 3.81 5.09397 3.81C5.00197 3.81 4.90797 3.794 4.81597 3.762L3.22897 3.197C3.18397 3.181 3.13597 3.173 3.08997 3.173C2.97497 3.173 2.86297 3.221 2.78297 3.309C2.11897 4.041 1.61597 4.904 1.30997 5.845C1.25797 6.004 1.30797 6.178 1.43597 6.286L2.72197 7.373C2.75597 7.402 2.78797 7.434 2.81697 7.468C3.11297 7.815 3.06997 8.334 2.72197 8.629L1.43597 9.716C1.30797 9.824 1.25897 9.998 1.30997 10.157C1.61497 11.098 2.11897 11.961 2.78297 12.693C2.86297 12.781 2.97497 12.829 3.08997 12.829C3.13697 12.829 3.18397 12.821 3.22897 12.805L4.81597 12.24C4.85797 12.225 4.90197 12.213 4.94597 12.205C4.99597 12.196 5.04597 12.192 5.09497 12.192C5.48697 12.192 5.83497 12.47 5.90797 12.868L6.20997 14.52C6.23997 14.684 6.36697 14.814 6.53097 14.849C7.01097 14.951 7.50297 15.002 8.00097 15.002C8.49897 15.002 8.99097 14.95 9.46997 14.849C9.63397 14.814 9.76097 14.684 9.79097 14.52L10.094 12.868C10.102 12.824 10.114 12.781 10.129 12.739C10.25 12.402 10.568 12.192 10.908 12.192C11 12.192 11.094 12.208 11.186 12.24L12.772 12.805C12.818 12.821 12.865 12.829 12.911 12.829C13.026 12.829 13.138 12.781 13.218 12.693C13.882 11.961 14.385 11.098 14.69 10.157C14.742 9.998 14.692 9.824 14.564 9.716L14.565 9.715ZM12.728 11.726L11.521 11.296C11.323 11.226 11.117 11.19 10.908 11.19C10.139 11.19 9.44697 11.676 9.18797 12.399C9.15397 12.492 9.12897 12.588 9.11097 12.686L8.88097 13.937C8.59097 13.979 8.29597 14 8.00097 14C7.70597 14 7.41097 13.979 7.11997 13.936L6.89097 12.685C6.73197 11.818 5.97697 11.189 5.09497 11.189C4.98697 11.189 4.87697 11.199 4.76597 11.219C4.66897 11.237 4.57397 11.262 4.47997 11.295L3.27297 11.725C2.90497 11.264 2.61097 10.759 2.39397 10.214L3.36797 9.391C3.74097 9.076 3.96797 8.634 4.00797 8.148C4.04797 7.662 3.89497 7.19 3.57797 6.818C3.51397 6.743 3.44297 6.672 3.36797 6.608L2.39397 5.785C2.61097 5.24 2.90497 4.734 3.27297 4.274L4.47997 4.704C4.67797 4.774 4.88397 4.81 5.09397 4.81C5.86297 4.81 6.55497 4.324 6.81397 3.601C6.84797 3.507 6.87297 3.411 6.89097 3.314L7.11997 2.063C7.41097 2.021 7.70597 1.999 8.00097 1.999C8.29597 1.999 8.59097 2.02 8.88097 2.062L9.10997 3.313C9.26897 4.18 10.024 4.809 10.906 4.809C11.014 4.809 11.124 4.799 11.234 4.779C11.331 4.761 11.427 4.736 11.521 4.703L12.728 4.273C13.096 4.733 13.39 5.239 13.607 5.784L12.634 6.607C12.261 6.922 12.033 7.364 11.994 7.85C11.954 8.336 12.107 8.809 12.424 9.18C12.489 9.256 12.559 9.326 12.635 9.39L13.609 10.213C13.392 10.758 13.098 11.264 12.73 11.724L12.728 11.726Z"/></svg>';
-
-/** A keyword: the mention chip's glyph for slash commands. */
-export const ICON_SYMBOL_KEYWORD =
-  '<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M9.5 14C9.77614 14 10 14.2239 10 14.5C10 14.7761 9.77614 15 9.5 15H2.5C2.22386 15 2 14.7761 2 14.5C2 14.2239 2.22386 14 2.5 14H9.5Z"/><path d="M6.5 11C6.77614 11 7 11.2239 7 11.5C7 11.7761 6.77614 12 6.5 12H2.5C2.22386 12 2 11.7761 2 11.5C2 11.2239 2.22386 11 2.5 11H6.5Z"/><path d="M13.5 11C13.7761 11 14 11.2239 14 11.5C14 11.7761 13.7761 12 13.5 12H8.5C8.22386 12 8 11.7761 8 11.5C8 11.2239 8.22386 11 8.5 11H13.5Z"/><path d="M8.5 8C8.77614 8 9 8.22386 9 8.5C9 8.77614 8.77614 9 8.5 9H2.5C2.22386 9 2 8.77614 2 8.5C2 8.22386 2.22386 8 2.5 8H8.5Z"/><path d="M13.5 8C13.7761 8 14 8.22386 14 8.5C14 8.77614 13.7761 9 13.5 9H10.5C10.2239 9 10 8.77614 10 8.5C10 8.22386 10.2239 8 10.5 8H13.5Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M9 2C9.55228 2 10 2.44772 10 3V5C10 5.55228 9.55228 6 9 6H3C2.44772 6 2 5.55228 2 5V3C2 2.44772 2.44772 2 3 2H9ZM3 5H9V3H3V5Z"/><path d="M13.5 4C13.7761 4 14 4.22386 14 4.5C14 4.77614 13.7761 5 13.5 5H11.5C11.2239 5 11 4.77614 11 4.5C11 4.22386 11.2239 4 11.5 4H13.5Z"/></svg>';
diff --git a/crates/workshop/look/modal.css b/crates/workshop/look/modal.css
deleted file mode 100644
index c9e69039f..000000000
--- a/crates/workshop/look/modal.css
+++ /dev/null
@@ -1,150 +0,0 @@
-/* Default skin for modal.ts's base classes, on the Cursor Dark tokens.
-   Every rule sits in the components layer, so a consumer's own per-prefix
-   dialog styles override these defaults regardless of bundle order.
-
-   Two skins sit on top of the base, chosen with openModal's `skin`
-   option: the confirmation prompt (save, revert, overwrite) and the form
-   modal (Add Folder, Choose Prompt). Both cover the window; they need no
-   per-dialog copy in a consumer's stylesheet. Their buttons and field
-   take the controls.css classes. */
-
-@layer components {
-	/* Dimmed full-container overlay centering the card, by default over
-	   the viewport; a consumer overlaying a panel re-declares position. */
-	.modal-overlay {
-		position: fixed;
-		inset: 0;
-		z-index: 50;
-		display: grid;
-		place-items: center;
-		background: rgb(0 0 0 / 0.6);
-	}
-	.modal-dialog {
-		width: min(28rem, calc(100vw - 2rem));
-		padding: 1.25rem;
-		border: 1px solid var(--border);
-		border-radius: var(--radius-xl);
-		background: var(--cursor-chrome);
-		box-shadow: 0 16px 48px rgb(0 0 0 / 0.5);
-	}
-	.modal-actions {
-		display: flex;
-		justify-content: flex-end;
-		gap: 0.5rem;
-		margin-block-start: 1rem;
-	}
-
-	/* Confirmation skin: Cursor's workbench dialog. A 0.5 scrim, the card
-	   200px from the top, 300px to min(560px, 92vw) wide, #181818 with a
-	   hairline border and an 8px radius, 12px padding and text, and the
-	   buttons 4px apart. The title is the message and the paragraph its
-	   detail. */
-	.modal-overlay--confirmation {
-		z-index: 2600;
-		display: flex;
-		align-items: flex-start;
-		justify-content: center;
-		padding-top: 200px;
-		background: rgba(0,0,0,.5);
-	}
-	.modal-dialog--confirmation {
-		box-sizing: border-box;
-		width: auto;
-		min-width: 300px;
-		max-width: min(560px, 92vw);
-		padding: var(--space-3);
-		border: 1px solid var(--border);
-		border-radius: var(--radius-lg);
-		background: var(--cursor-editor);
-		box-shadow: 0 4px 20px rgba(0,0,0,.15);
-		color: var(--cursor-text-primary);
-		font-size: var(--font-size-sm);
-	}
-	.modal-dialog--confirmation > h2 {
-		margin: 0;
-		font-size: var(--font-size-sm);
-		font-weight: var(--font-weight-semibold);
-	}
-	.modal-dialog--confirmation > p {
-		margin: var(--space-1) 0 0;
-		color: var(--cursor-text-secondary);
-	}
-	.modal-dialog--confirmation .modal-actions {
-		gap: var(--space-1);
-		margin-block-start: var(--space-3);
-	}
-
-	/* Form skin: the card Cursor's settings pages and quick prompts open.
-	   A 320px card with a 12px radius and a 12% stroke and no shadow; a
-	   14px title in a 12px 16px header, a body padded 12px 16px 16px, and
-	   a footer padded 10px over an 8% top border. It opens in 300ms,
-	   scaling up from 0.97. */
-	.modal-overlay--form {
-		z-index: 2600;
-		background: rgba(0,0,0,.5);
-	}
-	.modal-dialog--form {
-		box-sizing: border-box;
-		width: 320px;
-		max-width: calc(100vw - 2rem);
-		padding: 0;
-		border: 1px solid var(--cursor-stroke-secondary);
-		border-radius: var(--radius-xl);
-		background: var(--cursor-editor);
-		box-shadow: none;
-		color: var(--cursor-text-primary);
-		animation: modal-form-open var(--duration-slower) var(--ease-out-cubic) both;
-	}
-	.modal-dialog--form > h2 {
-		margin: 0;
-		padding: var(--space-3) var(--space-4);
-		font-size: var(--font-size-lg);
-		font-weight: var(--font-weight-medium);
-	}
-	.modal-dialog--form > p {
-		margin: 0;
-		padding: var(--space-3) var(--space-4) 0;
-		color: var(--cursor-text-secondary);
-		font-size: var(--font-size-base);
-	}
-	.modal-dialog--form > div:not(.modal-actions) {
-		display: flex;
-		flex-direction: column;
-		gap: var(--space-1);
-		padding: var(--space-3) var(--space-4) var(--space-4);
-	}
-	.modal-dialog--form > div:not(.modal-actions) label {
-		color: var(--cursor-text-secondary);
-		font-size: var(--font-size-sm);
-	}
-	.modal-dialog--form > div:not(.modal-actions) .input {
-		box-sizing: border-box;
-		width: 100%;
-	}
-	.modal-dialog--form > p + .modal-actions {
-		margin-block-start: var(--space-4);
-	}
-	.modal-dialog--form .modal-actions {
-		gap: var(--space-2);
-		margin: 0;
-		padding: 10px;
-		border-top: 1px solid var(--cursor-stroke-tertiary);
-	}
-
-	@keyframes modal-form-open {
-		from {
-			opacity: 0;
-			transform: scale(0.97);
-		}
-		to {
-			opacity: 1;
-			transform: scale(1);
-		}
-	}
-
-	@media (prefers-reduced-motion: reduce) {
-		.modal-dialog--form {
-			animation: none;
-		}
-	}
-}
diff --git a/crates/workshop/look/modal.ts b/crates/workshop/look/modal.ts
deleted file mode 100644
index 1855edb52..000000000
--- a/crates/workshop/look/modal.ts
+++ /dev/null
@@ -1,313 +0,0 @@
-// The focus-trapped modal dialog for the Workshop family's UIs: an overlay
-// inside a container element, a role="dialog" (or "alertdialog") surface, an
-// optional labeled text field, a Tab focus trap, Escape dismissal,
-// optional backdrop dismissal, and focus return to the invoker.
-//
-// Class contract: the overlay has `modal-overlay` plus
-// `${classPrefix}-overlay`; the dialog has `modal-dialog` plus
-// `${classPrefix}`; the title, message, field, label, input, actions, and
-// buttons have `${classPrefix}__title` / `__line` / `__field` / `__label`
-// / `__input` / `__actions` / `__button` (with `--danger` and `--primary`
-// modifiers). modal.css skins the base classes inside the components layer,
-// so a consumer's own per-prefix rules always win.
-//
-// Skins: `skin: "confirmation"` is Cursor's save/revert/overwrite prompt and
-// `skin: "form"` is its form modal (Add Folder, Choose Prompt). A skinned
-// dialog adds `modal-overlay--${skin}` and `modal-dialog--${skin}`, styles its
-// buttons with the controls.css classes (primary, danger, or secondary), and
-// orders them the way the skin does: a confirmation puts the primary button
-// first (Windows order: Save, Don't Save, Cancel), a form puts it last
-// (Cancel first). The other buttons keep the order they were given.
-
-import "./modal.css";
-
-const FOCUSABLE_SELECTOR =
-  'button, a[href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-
-/** An optional single-line text field between the message and the actions. */
-export interface ModalField {
-  /** The input's id, unique per dialog kind for the label association. */
-  readonly id: string;
-  readonly label: string;
-  /** Placeholder text shown while the field is empty. */
-  readonly placeholder?: string;
-  /** The field's initial text, selected on open so typing replaces it. */
-  readonly value?: string;
-}
-
-/**
- * One dialog action. `run` executes after the dialog dismisses, receiving
- * the field's trimmed value (the empty string when the dialog has none).
- */
-export interface ModalButton {
-  readonly label: string;
-  /**
-   * The button's full class list. Defaults to `${classPrefix}__button`,
-   * with `--danger` and `--primary` modifiers when those flags are set,
-   * and the controls.css button classes when the dialog has a skin.
-   */
-  readonly className?: string;
-  /** Style the button as destructive (only with the default className). */
-  readonly danger?: boolean;
-  /**
-   * The dialog's main action (only with the default className). It takes
-   * the first focus when the dialog has no field, and a skin places it:
-   * first in a confirmation, last in a form.
-   */
-  readonly primary?: boolean;
-  /** Disables the button while the field's trimmed value is empty. */
-  readonly requiresValue?: boolean;
-  readonly run: (value: string) => void;
-}
-
-/** The two dialog skins: Cursor's confirmation prompt and its form modal. */
-export type ModalSkin = "confirmation" | "form";
-
-/** Construction options for {@link openModal}. */
-export interface ModalOptions {
-  /** The element the overlay mounts into. */
-  readonly container: HTMLElement;
-  /** BEM-style class prefix, e.g. "confirm" or "editor-close". */
-  readonly classPrefix: string;
-  /** The title element's id, unique per dialog kind for aria-labelledby. */
-  readonly titleId: string;
-  readonly title: string;
-  readonly message: string;
-  /** The dialog's role; defaults to "dialog". */
-  readonly role?: "dialog" | "alertdialog";
-  /** Cursor's confirmation or form skin; without one the dialog is unskinned. */
-  readonly skin?: ModalSkin;
-  readonly field?: ModalField;
-  readonly buttons: readonly ModalButton[];
-  /** Dismiss when the pointer presses the dimmed backdrop. */
-  readonly dismissOnBackdrop?: boolean;
-  /** Called when Escape or the backdrop dismisses the dialog. */
-  readonly onDismiss?: () => void;
-}
-
-/**
- * The buttons in the order the skin shows them: a confirmation puts the
- * primary buttons first, a form puts them last, and an unskinned dialog
- * keeps the order it was given. The rest keep their relative order.
- */
-function orderedButtons(buttons: readonly ModalButton[], skin: ModalSkin | undefined): readonly ModalButton[] {
-  if (skin === undefined) {
-    return buttons;
-  }
-  const primary = buttons.filter((button) => button.primary === true);
-  const rest = buttons.filter((button) => button.primary !== true);
-  return skin === "confirmation" ? [...primary, ...rest] : [...rest, ...primary];
-}
-
-/** A button's default class list: the prefix classes, plus the controls.css ones in a skinned dialog. */
-function buttonClassName(prefix: string, def: ModalButton, skin: ModalSkin | undefined): string {
-  const classes = [`${prefix}__button`];
-  if (def.danger === true) {
-    classes.push(`${prefix}__button--danger`);
-  }
-  if (def.primary === true) {
-    classes.push(`${prefix}__button--primary`);
-  }
-  if (skin !== undefined) {
-    const variant = def.primary === true ? "button-primary" : def.danger === true ? "button-danger" : "button-secondary";
-    classes.push("button", variant);
-  }
-  return classes.join(" ");
-}
-
-/** The open dialog's handle. */
-export interface ModalHandle {
-  /** Dismisses the dialog if it is still open; safe to call twice. */
-  close(): void;
-  /** True once the dialog has dismissed. */
-  readonly closed: boolean;
-}
-
-/**
- * Opens the dialog and focuses its field when it has one, its first
- * button otherwise. A second call while the same dialog kind is open in
- * the same container element is a no-op and returns an already-closed
- * handle. Escape and backdrop dismissal return focus to the element that
- * was focused when the dialog opened.
- */
-export function openModal(options: ModalOptions): ModalHandle {
-  const prefix = options.classPrefix;
-  if (options.container.querySelector(`.${prefix}-overlay`) !== null) {
-    // The open dialog is owned by the call that created it.
-    return { close: () => undefined, closed: true };
-  }
-  // Duck-typed: the HTMLElement global is absent under node --test.
-  const active = document.activeElement as HTMLElement | null;
-  const invoker = active && typeof active.focus === "function" ? active : null;
-
-  const skin = options.skin;
-  const overlay = document.createElement("div");
-  overlay.className = `modal-overlay ${prefix}-overlay`;
-  if (skin !== undefined) {
-    overlay.classList.add(`modal-overlay--${skin}`);
-  }
-
-  const dialog = document.createElement("section");
-  dialog.className = `modal-dialog ${prefix}`;
-  if (skin !== undefined) {
-    dialog.classList.add(`modal-dialog--${skin}`);
-  }
-  dialog.setAttribute("role", options.role ?? "dialog");
-  dialog.setAttribute("aria-modal", "true");
-  dialog.setAttribute("aria-labelledby", options.titleId);
-
-  const title = document.createElement("h2");
-  title.id = options.titleId;
-  title.className = `${prefix}__title`;
-  title.textContent = options.title;
-
-  const message = document.createElement("p");
-  message.id = `${prefix}-message`;
-  message.className = `${prefix}__line`;
-  message.textContent = options.message;
-  dialog.setAttribute("aria-describedby", message.id);
-
-  let input: HTMLInputElement | null = null;
-  let field: HTMLDivElement | null = null;
-  if (options.field) {
-    field = document.createElement("div");
-    field.className = `${prefix}__field`;
-    const label = document.createElement("label");
-    label.className = `${prefix}__label`;
-    label.htmlFor = options.field.id;
-    label.textContent = options.field.label;
-    input = document.createElement("input");
-    input.type = "text";
-    input.id = options.field.id;
-    input.className = skin === undefined ? `${prefix}__input` : `${prefix}__input input`;
-    if (options.field.placeholder !== undefined) {
-      input.placeholder = options.field.placeholder;
-    }
-    if (options.field.value !== undefined) {
-      input.value = options.field.value;
-    }
-    field.append(label, input);
-  }
-
-  const actions = document.createElement("div");
-  actions.className = `modal-actions ${prefix}__actions`;
-
-  let dismissed = false;
-  const dismiss = (): void => {
-    if (dismissed) {
-      return;
-    }
-    dismissed = true;
-    document.removeEventListener("keydown", onKeydown, true);
-    overlay.remove();
-    if (invoker?.isConnected) {
-      invoker.focus();
-    }
-  };
-
-  const buttons: HTMLButtonElement[] = [];
-  const valueButtons: HTMLButtonElement[] = [];
-  let primaryButton: HTMLButtonElement | null = null;
-  for (const def of orderedButtons(options.buttons, skin)) {
-    const button = document.createElement("button");
-    button.type = "button";
-    button.className = def.className ?? buttonClassName(prefix, def, skin);
-    button.textContent = def.label;
-    if (def.primary === true && primaryButton === null) {
-      primaryButton = button;
-    }
-    if (def.requiresValue === true) {
-      // Disabled until the field holds text; an initial value counts.
-      button.disabled = (options.field?.value ?? "").trim() === "";
-      valueButtons.push(button);
-    }
-    button.addEventListener("click", () => {
-      const value = input?.value.trim() ?? "";
-      dismiss();
-      def.run(value);
-    });
-    buttons.push(button);
-    actions.appendChild(button);
-  }
-
-  if (input) {
-    const boundInput = input;
-    boundInput.addEventListener("input", () => {
-      const empty = boundInput.value.trim() === "";
-      for (const button of valueButtons) {
-        button.disabled = empty;
-      }
-    });
-    // Enter submits through the first value-gated button, which stays
-    // disabled (and therefore inert) while the field is empty; without
-    // one, through the primary button, else the first.
-    boundInput.addEventListener("keydown", (event) => {
-      if (event.key === "Enter") {
-        event.preventDefault();
-        const submit = valueButtons[0] ?? primaryButton ?? buttons[0];
-        if (submit && !submit.disabled) {
-          submit.click();
-        }
-      }
-    });
-  }
-
-  if (field) {
-    dialog.append(title, message, field, actions);
-  } else {
-    dialog.append(title, message, actions);
-  }
-  overlay.appendChild(dialog);
-
-  const onKeydown = (event: KeyboardEvent): void => {
-    if (event.key === "Escape") {
-      event.preventDefault();
-      dismiss();
-      options.onDismiss?.();
-      return;
-    }
-    if (event.key !== "Tab") {
-      return;
-    }
-    const focusable = [...dialog.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR)];
-    const first = focusable[0];
-    const last = focusable[focusable.length - 1];
-    if (!first || !last) {
-      event.preventDefault();
-      return;
-    }
-    const active = document.activeElement;
-    const outside = !active || !dialog.contains(active);
-    if (event.shiftKey && (outside || active === first)) {
-      event.preventDefault();
-      last.focus();
-    } else if (!event.shiftKey && (outside || active === last)) {
-      event.preventDefault();
-      first.focus();
-    }
-  };
-
-  document.addEventListener("keydown", onKeydown, true);
-  if (options.dismissOnBackdrop === true) {
-    overlay.addEventListener("click", (event) => {
-      if (event.target === overlay) {
-        dismiss();
-        options.onDismiss?.();
-      }
-    });
-  }
-  options.container.appendChild(overlay);
-  const firstFocus: HTMLElement | undefined = input ?? primaryButton ?? buttons[0];
-  if (firstFocus) {
-    firstFocus.focus();
-  }
-  if (input && options.field?.value !== undefined) {
-    input.select();
-  }
-  return {
-    close: dismiss,
-    get closed() {
-      return dismissed;
-    },
-  };
-}
diff --git a/crates/workshop/look/package.json b/crates/workshop/look/package.json
deleted file mode 100644
index 5cd95627b..000000000
--- a/crates/workshop/look/package.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "name": "@workshop/look",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "description": "Runvil Workshop family look: the Cursor Dark palette, the size and semantic token tiers, the codicon icon strings, the shimmer, and the behavioral components (modal, dropdown, toast stack, status bar view, progress bar, button/input/select/switch bases) shared by the Workshop's UIs.",
-  "exports": {
-    "./tokens.css": "./tokens.css",
-    "./sizes.css": "./sizes.css",
-    "./semantic.css": "./semantic.css",
-    "./controls.css": "./controls.css",
-    "./shimmer.css": "./shimmer.css",
-    "./shimmer": "./shimmer.ts",
-    "./icons": "./icons.ts",
-    "./modal": "./modal.ts",
-    "./modal.css": "./modal.css",
-    "./dropdown": "./dropdown.ts",
-    "./dropdown.css": "./dropdown.css",
-    "./toast": "./toast.ts",
-    "./toast.css": "./toast.css",
-    "./status-bar": "./status-bar.ts",
-    "./status-bar.css": "./status-bar.css",
-    "./progress": "./progress.ts",
-    "./progress.css": "./progress.css"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit",
-    "test": "node --test \"test/**/*.mjs\""
-  },
-  "devDependencies": {
-    "@vscode/codicons": "^0.0.46-24"
-  }
-}
diff --git a/crates/workshop/look/progress.css b/crates/workshop/look/progress.css
deleted file mode 100644
index d6bbc2bd6..000000000
--- a/crates/workshop/look/progress.css
+++ /dev/null
@@ -1,68 +0,0 @@
-/* The inline progress bar from progress.ts: a thin track whose fill scales
-   by --progress (transform, compositor-only). The fill reads
-   --progress-fill, so a consumer recolors by state with its own modifier
-   class. Rules live in the components layer so consumer overrides win.
-
-   Settings variant (the default): a 4px bar with a 2px radius on a 12%
-   track, the fill easing its transform over 200ms. Indeterminate mode,
-   used when the fraction is null, slides a 34% bar across the track over
-   1.35s.
-
-   Workbench variant (.progress--workbench): 2px, square ends, the fill
-   green and moving over 0.1s linear. */
-
-@layer components {
-	.progress {
-		height: 4px;
-		border-radius: var(--radius-xs);
-		background: var(--cursor-stroke-secondary);
-		overflow: hidden;
-	}
-	.progress__fill {
-		height: 100%;
-		border-radius: inherit;
-		background: var(--progress-fill);
-		transform-origin: 0 50%;
-		transform: scaleX(var(--progress, 0));
-		transition: transform var(--duration-slow) ease-out;
-	}
-
-	.progress--indeterminate .progress__fill {
-		width: 34%;
-		transform: none;
-		transition: none;
-		animation: progress-indeterminate 1.35s ease-in-out infinite;
-	}
-
-	@keyframes progress-indeterminate {
-		from {
-			transform: translateX(-100%);
-		}
-		to {
-			transform: translateX(294%);
-		}
-	}
-
-	.progress--workbench {
-		height: 2px;
-		border-radius: 0;
-		background: transparent;
-	}
-	.progress--workbench .progress__fill {
-		border-radius: 0;
-		background: var(--progress-fill);
-		transition: transform 0.1s linear;
-	}
-
-	@media (prefers-reduced-motion: reduce) {
-		.progress__fill,
-		.progress--workbench .progress__fill {
-			transition: none;
-		}
-		.progress--indeterminate .progress__fill {
-			width: 100%;
-			animation: none;
-			opacity: 0.5;
-		}
-	}
-}
diff --git a/crates/workshop/look/progress.ts b/crates/workshop/look/progress.ts
deleted file mode 100644
index 569d65166..000000000
--- a/crates/workshop/look/progress.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-// The inline progress bar for the Workshop family's UIs: a thin track whose
-// fill scales by the --progress custom property, so updates are
-// compositor-only (transform, never width). Used for determinate readings;
-// a null fraction renders the indeterminate bar, a short fill that slides
-// along the track, with no aria value.
-//
-// Two variants, both from Cursor: the settings bar (the default - a 4px
-// rounded bar, as on Cursor's settings pages) and the workbench bar (a 2px
-// square-ended green line, as under the editor tabs).
-
-import "./progress.css";
-
-/** The two progress variants. */
-export type ProgressVariant = "settings" | "workbench";
-
-/** The mounted bar and its update handle. */
-export interface ProgressBar {
-  /** The track element (role="progressbar"); the consumer appends it. */
-  readonly element: HTMLElement;
-  /** Sets the fill fraction, clamped to 0..1; null shows the indeterminate bar. */
-  setFraction(fraction: number | null): void;
-}
-
-/** Creates an inline progress bar labeled for assistive technology. */
-export function createProgressBar(label: string, variant: ProgressVariant = "settings"): ProgressBar {
-  const element = document.createElement("div");
-  element.className = variant === "workbench" ? "progress progress--workbench" : "progress";
-  element.setAttribute("role", "progressbar");
-  element.setAttribute("aria-label", label);
-  element.setAttribute("aria-valuemin", "0");
-  element.setAttribute("aria-valuemax", "100");
-  const fill = document.createElement("div");
-  fill.className = "progress__fill";
-  element.append(fill);
-
-  return {
-    element,
-    setFraction(fraction: number | null): void {
-      if (fraction === null) {
-        element.removeAttribute("aria-valuenow");
-        fill.style.setProperty("--progress", "0");
-        element.classList.add("progress--indeterminate");
-        return;
-      }
-      element.classList.remove("progress--indeterminate");
-      const clamped = Math.min(Math.max(fraction, 0), 1);
-      fill.style.setProperty("--progress", String(clamped));
-      element.setAttribute("aria-valuenow", String(Math.round(clamped * 100)));
-    },
-  };
-}
diff --git a/crates/workshop/look/semantic.css b/crates/workshop/look/semantic.css
deleted file mode 100644
index edb7ceb61..000000000
--- a/crates/workshop/look/semantic.css
+++ /dev/null
@@ -1,22 +0,0 @@
-/* Tier 2 - semantic aliases: intent-named tokens mapped to base
-   primitives. Theming the app means editing this file (or loading another
-   sheet after it); component CSS below never names a primitive directly
-   when an intent alias exists. */
-:root {
-  /* Borders */
-  --ws-border-width: var(--ws-size-1);
-  --ws-border-width-strong: var(--ws-size-2);
-
-  /* Control sizing */
-  --ws-control-height-compact: var(--ws-size-22);
-  --ws-control-height: var(--ws-size-24);
-  --ws-button-min-height: var(--ws-size-26);
-
-  /* Type */
-  --ws-label-font-size: var(--ws-size-11);
-  --ws-title-font-size: var(--ws-size-18);
-
-  /* Elevation */
-  --ws-popup-shadow: 0 var(--ws-size-8) var(--ws-size-24) var(--ws-shadow-color-overlay);
-  --ws-overlay-scrim: var(--ws-shadow-color-scrim);
-}
diff --git a/crates/workshop/look/shimmer.css b/crates/workshop/look/shimmer.css
deleted file mode 100644
index 272eafaf8..000000000
--- a/crates/workshop/look/shimmer.css
+++ /dev/null
@@ -1,80 +0,0 @@
-/* The shimmering text treatment: a clone of Cursor's own agent-panel
-   status shimmer (the .make-shine class on its "Thinking" / "Planning
-   next moves" spans), recovered verbatim from the installed workbench
-   stylesheet and mapped onto the shared tokens. The sweep runs left to
-   right over a 200% background and reads three variables, so a surface
-   tunes it without a new keyframe:
-
-   --shimmer-base      the resting color the sweep runs through
-   --shimmer-peak      the bright stop at the sweep's center
-   --shimmer-duration  the length of one loop
-
-   The defaults are the original treatment: a 2s loop from the primary
-   text token at 60% to the primary text token. The three tone modifiers
-   below are the transcript's 1s variants.
-
-   Keep the sweep continuous across re-renders and in phase between
-   elements with setShimmer from shimmer.ts, which sets the negative
-   animation-delay from one module start time.
-
-   Under prefers-reduced-motion the animation, gradient, clip, and
-   transparent fill all come off and the text renders in the row's own
-   color (Cursor's glass variant's behavior). */
-
-.ws-shimmer-text {
-	background-image: linear-gradient(
-		90deg,
-		var(--shimmer-base, color-mix(in srgb, var(--cursor-text-primary) 60%, transparent)) 0,
-		var(--shimmer-base, color-mix(in srgb, var(--cursor-text-primary) 60%, transparent)) 25%,
-		var(--shimmer-peak, var(--cursor-text-primary)) 60%,
-		var(--shimmer-base, color-mix(in srgb, var(--cursor-text-primary) 60%, transparent)) 75%,
-		var(--shimmer-base, color-mix(in srgb, var(--cursor-text-primary) 60%, transparent)) 100%
-	);
-	background-size: 200% 100%;
-	background-clip: text;
-	-webkit-background-clip: text;
-	-webkit-text-fill-color: transparent;
-	animation: shine var(--shimmer-duration, 2s) linear infinite;
-}
-
-/* The transcript's tail status ("Planning next moves", "Reconnecting..."):
-   secondary at 60% to secondary. */
-.ws-shimmer-text--status {
-	--shimmer-base: color-mix(in srgb, var(--cursor-text-secondary) 60%, transparent);
-	--shimmer-peak: var(--cursor-text-secondary);
-	--shimmer-duration: 1s;
-}
-
-/* A thinking header: tertiary at 60% to secondary. */
-.ws-shimmer-text--thinking {
-	--shimmer-base: color-mix(in srgb, var(--cursor-text-tertiary) 60%, transparent);
-	--shimmer-peak: var(--cursor-text-secondary);
-	--shimmer-duration: 1s;
-}
-
-/* A running tool's verb: secondary at 60% (tertiary inside the muted
-   scope, where the tiers shift down) to the primary text at 60%. */
-.ws-shimmer-text--tool {
-	--shimmer-base: color-mix(in srgb, var(--cursor-text-secondary) 60%, transparent);
-	--shimmer-peak: color-mix(in srgb, var(--cursor-text-primary) 60%, transparent);
-	--shimmer-duration: 1s;
-}
-
-@keyframes shine {
-	0% {
-		background-position: 200% 0;
-	}
-	to {
-		background-position: -200% 0;
-	}
-}
-
-@media (prefers-reduced-motion: reduce) {
-	.ws-shimmer-text {
-		animation: none;
-		background-image: none;
-		background-clip: unset;
-		-webkit-background-clip: unset;
-		-webkit-text-fill-color: unset;
-	}
-}
diff --git a/crates/workshop/look/shimmer.ts b/crates/workshop/look/shimmer.ts
deleted file mode 100644
index 47bad189a..000000000
--- a/crates/workshop/look/shimmer.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-// The shared shimmer driver: turns the .ws-shimmer-text sweep from
-// shimmer.css on or off for one element and keeps every sweep in phase.
-//
-// The sweep is a CSS animation, and an element that re-renders (a dock tab
-// title, a transcript row rebuilt on a stream delta) would restart it from
-// the left. setShimmer instead sets a negative animation-delay measured from
-// one module start time, `-((now - start) mod duration)`, so an animation
-// that begins at any moment is already where the shared clock says it
-// should be: two elements started at different times sweep in step, and a
-// rebuilt element picks up exactly where the one it replaces was.
-//
-// The duration is the element's own loop: its --shimmer-duration (inline,
-// then computed), else the 1s of a transcript tone modifier (a detached
-// element has no computed style yet), else the stylesheet's 2s default.
-
-import "./shimmer.css";
-
-/** The class that carries the sweep. */
-const SHIMMER_CLASS = "ws-shimmer-text";
-
-/** The stylesheet's default loop, in milliseconds. */
-const DEFAULT_DURATION_MS = 2000;
-
-/** The transcript tone modifiers and their loops; shimmer.css sets the same 1s. */
-const TONE_DURATIONS_MS: Readonly<Record<string, number>> = {
-  "ws-shimmer-text--status": 1000,
-  "ws-shimmer-text--thinking": 1000,
-  "ws-shimmer-text--tool": 1000,
-};
-
-// The one clock every delay is measured from.
-const START_MS = Date.now();
-
-/** Parses a CSS time ("1s", "500ms") to milliseconds, or null when it is not a positive time. */
-function parseDuration(value: string): number | null {
-  const match = /^\s*(\d*\.?\d+)(ms|s)\s*$/.exec(value);
-  if (match === null) {
-    return null;
-  }
-  const amount = Number.parseFloat(match[1] ?? "");
-  const ms = match[2] === "s" ? amount * 1000 : amount;
-  return ms > 0 ? ms : null;
-}
-
-/** The element's loop length in milliseconds. */
-function durationOf(element: HTMLElement): number {
-  const inline = parseDuration(element.style.getPropertyValue("--shimmer-duration"));
-  if (inline !== null) {
-    return inline;
-  }
-  const view = element.ownerDocument.defaultView;
-  const computed = parseDuration(view?.getComputedStyle(element).getPropertyValue("--shimmer-duration") ?? "");
-  if (computed !== null) {
-    return computed;
-  }
-  for (const [className, ms] of Object.entries(TONE_DURATIONS_MS)) {
-    if (element.classList.contains(className)) {
-      return ms;
-    }
-  }
-  return DEFAULT_DURATION_MS;
-}
-
-/**
- * Turns the shimmer on or off for `element`. Turning it on takes the shared
- * phase; calling it again on a running element changes nothing, because
- * moving the delay of a running animation would make the sweep jump. Turning
- * it off clears the class and the delay.
- */
-export function setShimmer(element: HTMLElement, on: boolean): void {
-  if (!on) {
-    element.classList.remove(SHIMMER_CLASS);
-    element.style.animationDelay = "";
-    return;
-  }
-  if (element.classList.contains(SHIMMER_CLASS) && element.style.animationDelay !== "") {
-    return;
-  }
-  element.classList.add(SHIMMER_CLASS);
-  const duration = durationOf(element);
-  const elapsed = (((Date.now() - START_MS) % duration) + duration) % duration;
-  element.style.animationDelay = `-${elapsed}ms`;
-}
diff --git a/crates/workshop/look/sizes.css b/crates/workshop/look/sizes.css
deleted file mode 100644
index b16a3b439..000000000
--- a/crates/workshop/look/sizes.css
+++ /dev/null
@@ -1,70 +0,0 @@
-/* Tier 1 - base primitives: the only stylesheet where raw values live.
-   Component CSS never hardcodes a color, size, or spacing; it references
-   semantic tokens, which resolve to these primitives. */
-:root {
-  /* Size scale (px primitives, named by value) */
-  --ws-size-1: 1px;
-  --ws-size-1-5: 1.5px;
-  --ws-size-2: 2px;
-  --ws-size-2-5: 2.5px;
-  --ws-size-3: 3px;
-  --ws-size-4: 4px;
-  --ws-size-5: 5px;
-  --ws-size-6: 6px;
-  --ws-size-7: 7px;
-  --ws-size-8: 8px;
-  --ws-size-9: 9px;
-  --ws-size-10: 10px;
-  --ws-size-11: 11px;
-  --ws-size-12: 12px;
-  --ws-size-14: 14px;
-  --ws-size-16: 16px;
-  --ws-size-18: 18px;
-  --ws-size-20: 20px;
-  --ws-size-20-5: 20.5px;
-  --ws-size-22: 22px;
-  --ws-size-23: 23px;
-  --ws-size-24: 24px;
-  --ws-size-26: 26px;
-  --ws-size-35: 35px;
-  --ws-size-41: 41px;
-  --ws-size-48: 48px;
-  --ws-size-60: 60px;
-  --ws-size-77: 77px;
-  --ws-size-100: 100px;
-  --ws-size-120: 120px;
-  --ws-size-150: 150px;
-  --ws-size-170: 170px;
-  --ws-size-180: 180px;
-  --ws-size-200: 200px;
-  --ws-size-230: 230px;
-  --ws-size-240: 240px;
-  --ws-size-260: 260px;
-  --ws-size-280: 280px;
-  --ws-size-320: 320px;
-  --ws-size-360: 360px;
-  --ws-size-380: 380px;
-  --ws-size-440: 440px;
-  --ws-size-500: 500px;
-  --ws-size-560: 560px;
-  --ws-size-600: 600px;
-  --ws-size-820: 820px;
-
-  /* Viewport-relative sizes (named by value) */
-  --ws-size-vw-62: 62vw;
-  --ws-size-vw-80: 80vw;
-  --ws-size-vh-40: 40vh;
-
-  /* Relative type sizes (named by value) */
-  --ws-size-em-0-9: 0.9em;
-
-  /* Time primitives (named by value, in milliseconds) */
-  --ws-duration-160: 160ms;
-
-  /* Size scale (rem primitives, named by value) */
-  --ws-size-rem-12: 12rem;
-
-  /* Shadow ink */
-  --ws-shadow-color-overlay: rgba(0, 0, 0, 0.35);
-  --ws-shadow-color-scrim: rgba(0, 0, 0, 0.5);
-}
diff --git a/crates/workshop/look/status-bar.css b/crates/workshop/look/status-bar.css
deleted file mode 100644
index a0c82f814..000000000
--- a/crates/workshop/look/status-bar.css
+++ /dev/null
@@ -1,236 +0,0 @@
-/* Styles for status-bar.ts, which imports this file; esbuild bundles it
-   into the consuming UI's app.css. Themed values come from the :root
-   tokens in tokens.css. Styles the bar itself, the text/extras/right
-   regions, the busy barberpole, the generic status LED primitive
-   (idle lens, lit modifiers, and the pulse/decay transitions), the
-   button host for non-LED items, and the level meter bars. Rules
-   live in the components layer so a consumer's own rules override
-   these. */
-
-/* The status bar: a permanent full-width footer below the desk. The
-   left text shows the current label; the extras region holds consumer
-   controls; the right group holds the barberpole and then the slot with
-   the consumer's LED indicators group. The barberpole hides while idle
-   (the hidden attribute); the indicators never hide. min-height rather
-   than height so a descender never clips against a fixed box. The top
-   line is an inset shadow, as Cursor draws it, so it takes no height. */
-@layer components {
-	.status-bar {
-		flex: none;
-		min-height: var(--status-bar-height);
-		display: flex;
-		align-items: center;
-		background: var(--status-bar-bg);
-		box-shadow: inset 0 1px 0 0 var(--border);
-		font-size: 12px;
-		line-height: 22px;
-		font-variant-numeric: tabular-nums;
-		color: var(--status-bar-text);
-		user-select: none;
-		transition: background-color 0.15s ease-out;
-	}
-
-	.status-bar > * {
-		padding: 0 5px;
-		margin: 0 3px;
-	}
-
-	.status-bar > :first-child {
-		padding-left: 7px;
-	}
-
-	.status-bar > :last-child {
-		padding-right: 7px;
-	}
-
-	.status-bar__text {
-		flex: 1;
-		min-width: 0;
-		overflow: hidden;
-		text-overflow: ellipsis;
-		white-space: nowrap;
-	}
-
-	.status-bar__text--error {
-		color: var(--status-bar-text-error);
-	}
-
-	/* The consumer-controls region between the text and the slot. */
-	.status-bar__extras {
-		display: flex;
-		align-items: center;
-		gap: var(--space-2);
-	}
-	.status-bar__extras:empty {
-		display: none;
-	}
-
-	.status-bar__right {
-		display: flex;
-		align-items: center;
-		gap: var(--space-1);
-	}
-
-	/* The LED indicators group: always visible, standing beside the
-	   barberpole. The gap is one LED-width so two LEDs sit one LED-width
-	   apart. */
-	.status-bar__indicators {
-		display: inline-flex;
-		align-items: center;
-		gap: var(--led-size);
-	}
-
-	.status-bar__slot {
-		flex: none;
-		display: flex;
-		align-items: center;
-		justify-content: flex-end;
-	}
-
-	.status-bar__barberpole[hidden] {
-		display: none;
-	}
-
-	/* The busy barberpole: a thin rounded track painted with diagonal green
-	   stripes that slide while work is in flight. One fill stripe plus one
-	   track gap spans one period horizontally, and the period is twice the
-	   bar height so each stripe is as wide as the bar is tall. The tile is
-	   a square of twice the period: on a 45-degree gradient a 25% step of
-	   the gradient line is exactly one period across, so the tile holds two
-	   stripe pairs and joins its neighbors without a seam. The animation
-	   slides the tile one period per loop, which lands on an identical
-	   frame, so the loop is seamless too. */
-	.status-bar__barberpole {
-		--barberpole-period: calc(2 * var(--progress-height));
-		flex: none;
-		width: var(--progress-width);
-		height: var(--progress-height);
-		border-radius: calc(var(--progress-height) / 2);
-		overflow: hidden;
-		background-color: var(--progress-track);
-		background-image: repeating-linear-gradient(
-			-45deg,
-			var(--progress-fill) 0 12.5%,
-			transparent 12.5% 25%
-		);
-		background-size: calc(2 * var(--barberpole-period)) calc(2 * var(--barberpole-period));
-		box-shadow: 0 0 var(--progress-glow) var(--progress-fill);
-		animation: status-bar-barberpole 0.8s linear infinite;
-	}
-
-	@keyframes status-bar-barberpole {
-		from {
-			background-position: 0 0;
-		}
-		to {
-			background-position: var(--barberpole-period) 0;
-		}
-	}
-
-	/* Reduced motion: the stripes stay, still. */
-	@media (prefers-reduced-motion: reduce) {
-		.status-bar__barberpole {
-			animation: none;
-		}
-	}
-
-	/* The status LEDs: small circles standing in the indicators group
-	   beside the barberpole. Idle is an unlit lens - a dark translucent
-	   disc with a subtle inner highlight. A pulse adds a lit modifier: a
-	   bright radial-gradient core with a layered box-shadow bloom. The
-	   idle rule's transition is the slow ease-out decay; each modifier's
-	   own transition makes the fade-in fast. */
-	.status-bar__led {
-		width: var(--led-size);
-		height: var(--led-size);
-		border-radius: 50%;
-		background: var(--led-off);
-		box-shadow:
-			inset 0 1px 1px var(--led-lens-highlight),
-			inset 0 -1px 2px var(--led-lens-shadow);
-		transition:
-			background var(--led-pulse-ms) ease-out,
-			box-shadow var(--led-pulse-ms) ease-out;
-	}
-
-	.status-bar__led--green,
-	.status-bar__led--amber,
-	.status-bar__led--red {
-		transition:
-			background var(--led-fade-in-ms) ease-in,
-			box-shadow var(--led-fade-in-ms) ease-in;
-	}
-
-	.status-bar__led--green {
-		background: radial-gradient(circle, var(--led-core) 0%, var(--led-green) 60%);
-		box-shadow:
-			0 0 calc(var(--led-glow-radius) / 2) var(--led-green),
-			0 0 var(--led-glow-radius) var(--led-green),
-			0 0 calc(var(--led-glow-radius) * 2) color-mix(in oklab, var(--led-green) 55%, transparent);
-	}
-
-	.status-bar__led--amber {
-		background: radial-gradient(circle, var(--led-core) 0%, var(--led-amber) 60%);
-		box-shadow:
-			0 0 calc(var(--led-glow-radius) / 2) var(--led-amber),
-			0 0 var(--led-glow-radius) var(--led-amber),
-			0 0 calc(var(--led-glow-radius) * 2) color-mix(in oklab, var(--led-amber) 55%, transparent);
-	}
-
-	/* The red lit treatment (the workshop's recording LED). Idle is the
-	   shared unlit lens of the base rule. */
-	.status-bar__led--red {
-		background: radial-gradient(circle, var(--led-core) 0%, var(--led-red) 60%);
-		box-shadow:
-			0 0 calc(var(--led-glow-radius) / 2) var(--led-red),
-			0 0 var(--led-glow-radius) var(--led-red),
-			0 0 calc(var(--led-glow-radius) * 2) color-mix(in oklab, var(--led-red) 55%, transparent);
-	}
-
-	/* A non-LED item standing among the LEDs: a bare button the owner
-	   draws into. It fills the bar's full height with square corners, as
-	   Cursor's status bar items do. Hover takes the hover background and a
-	   press the active one; focus follows the consuming UI's convention. */
-	.status-bar__item {
-		display: inline-flex;
-		align-items: center;
-		height: var(--status-bar-height);
-		padding: 0 var(--status-bar-item-padding-inline);
-		border: none;
-		border-radius: 0;
-		background: transparent;
-		color: inherit;
-		font: inherit;
-		cursor: pointer;
-	}
-
-	.status-bar__item:hover {
-		background: var(--bg-hover);
-	}
-
-	.status-bar__item:active {
-		background: var(--cursor-bg-active);
-	}
-
-	/* The level meter: a row of rounded bars centered on one line. Each
-	   bar's --level (0 to 1, set per frame) sets its height between a dot
-	   and the full meter height. Live bars take the meter color; idle,
-	   they rest as dim dots. */
-	.status-bar__meter {
-		gap: var(--meter-bar-gap);
-	}
-
-	.status-bar__meter-bar {
-		flex: none;
-		width: var(--meter-bar-width);
-		height: calc(
-			var(--meter-bar-width) + var(--level, 0) * (var(--meter-height) - var(--meter-bar-width))
-		);
-		border-radius: calc(var(--meter-bar-width) / 2);
-		background: var(--meter-live);
-	}
-
-	.status-bar__meter--idle .status-bar__meter-bar {
-		background: var(--meter-idle);
-	}
-}
diff --git a/crates/workshop/look/status-bar.ts b/crates/workshop/look/status-bar.ts
deleted file mode 100644
index 565cb62bb..000000000
--- a/crates/workshop/look/status-bar.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-// The status bar view for the Workshop family's UIs: a permanent
-// full-width footer with a text region on the left and, on the right, a
-// barberpole beside the indicators group. The barberpole is an
-// indeterminate busy signal: it shows while work is in flight and hides
-// otherwise, and it never displaces the indicators - the LEDs stay
-// visible either way. Each UI populates the indicators group with its own
-// LEDs (the workshop: the indicator slots its features register) and the
-// extras region with its own controls. The view owns no timers, listeners, or polling; the
-// consumer drives it through setText and setBusy and owns every
-// lifecycle.
-
-import "./status-bar.css";
-
-/** Options for {@link StatusBarView.setText}. */
-export interface StatusBarText {
-  /** Paint the text in the error color. */
-  readonly error?: boolean;
-  /** The bar's tooltip; defaults to cleared. */
-  readonly tooltip?: string;
-}
-
-/** The mounted view and its regions. */
-export interface StatusBarView {
-  /** The `<footer class="status-bar">` element; the consumer appends it. */
-  readonly element: HTMLElement;
-  /** The left text region. */
-  readonly text: HTMLElement;
-  /** The animated busy barberpole; hidden while idle. */
-  readonly barberpole: HTMLElement;
-  /** The indicators group; the consumer fills it with its LEDs. */
-  readonly indicators: HTMLElement;
-  /** The region between the text and the right group for consumer controls. */
-  readonly extras: HTMLElement;
-  /** Sets the left text, its error styling, and the bar tooltip. */
-  setText(label: string, options?: StatusBarText): void;
-  /**
-   * Shows or hides the barberpole. The toggle sets the `hidden`
-   * attribute on the barberpole alone and never touches the indicators
-   * group or its contents, so a live LED keeps glowing beside it.
-   */
-  setBusy(busy: boolean): void;
-}
-
-/** Creates the status bar view. */
-export function createStatusBarView(): StatusBarView {
-  const element = document.createElement("footer");
-  element.className = "status-bar";
-  element.setAttribute("role", "status");
-  element.setAttribute("aria-live", "polite");
-
-  const text = document.createElement("span");
-  text.className = "status-bar__text";
-
-  const extras = document.createElement("span");
-  extras.className = "status-bar__extras";
-
-  const right = document.createElement("span");
-  right.className = "status-bar__right";
-  // An indeterminate progressbar: role without aria-valuenow tells
-  // assistive tech that work is in flight with no known fraction.
-  const barberpole = document.createElement("span");
-  barberpole.className = "status-bar__barberpole";
-  barberpole.setAttribute("role", "progressbar");
-  barberpole.setAttribute("aria-label", "Busy");
-  barberpole.hidden = true;
-  const slot = document.createElement("span");
-  slot.className = "status-bar__slot";
-  const indicators = document.createElement("span");
-  indicators.className = "status-bar__indicators";
-  slot.append(indicators);
-  // The barberpole sits immediately before the indicators group.
-  right.append(barberpole, slot);
-  element.append(text, extras, right);
-
-  return {
-    element,
-    text,
-    barberpole,
-    indicators,
-    extras,
-    setText(label: string, options?: StatusBarText): void {
-      text.textContent = label;
-      element.title = options?.tooltip ?? "";
-      text.classList.toggle("status-bar__text--error", options?.error === true);
-    },
-    setBusy(busy: boolean): void {
-      barberpole.hidden = !busy;
-    },
-  };
-}
diff --git a/crates/workshop/look/test/boundary.mjs b/crates/workshop/look/test/boundary.mjs
deleted file mode 100644
index 255caa1db..000000000
--- a/crates/workshop/look/test/boundary.mjs
+++ /dev/null
@@ -1,130 +0,0 @@
-// The look boundary guard: `@workshop/look` is the family's base visual
-// layer, so its sources import only their own files. Walks
-// every `.ts` and `.css` file outside `test/` and `node_modules/` and
-// fails on any import, re-export, dynamic import, triple-slash reference,
-// or CSS `@import` whose specifier is not a relative path that stays
-// inside the package, naming the offending file and
-// specifier. `shared-ui`, the Workshop UI, other `@workshop/*` packages,
-// `lucide`, and escaping relative paths all fail. Type-only imports count: the scan
-// reads source text, so nothing is elided before it looks. No jsdom: this
-// is a source-text check.
-// Run: node test/boundary.mjs (from crates/workshop/look).
-import assert from "node:assert/strict";
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import { test } from "node:test";
-import { fileURLToPath } from "node:url";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const TS_PATTERNS = [
-  // import x from "a"; import { x } from "a"; import type { X } from "a";
-  // export { x } from "a"; export * from "a". The clause holds no quotes,
-  // so the match cannot run on into a string literal.
-  /^\s*(?:import|export)\b[^;"'`]*?\bfrom\s*["']([^"']+)["']/gm,
-  // import "a";
-  /^\s*import\s*["']([^"']+)["']/gm,
-  // import("a")
-  /\bimport\s*\(\s*["']([^"']+)["']/g,
-  // import x = require("a")
-  /\brequire\s*\(\s*["']([^"']+)["']/g,
-  // /// <reference path="a" /> and /// <reference types="a" />
-  /^\s*\/\/\/\s*<reference\s+(?:path|types)\s*=\s*["']([^"']+)["']/gm,
-];
-
-// @import "a"; @import url("a"); @import url(a);
-const CSS_IMPORT = /@import\s+(?:url\(\s*)?["']?([^"')\s;]+)/g;
-
-export function importSpecifiers(file, text) {
-  if (file.endsWith(".css")) {
-    const code = text.replace(/\/\*[\s\S]*?\*\//g, "");
-    return [...code.matchAll(CSS_IMPORT)].map((match) => match[1]);
-  }
-  return TS_PATTERNS.flatMap((pattern) => [...text.matchAll(pattern)].map((match) => match[1]));
-}
-
-export function violation(file, specifier) {
-  if (!specifier.startsWith("./") && !specifier.startsWith("../")) {
-    return "not a relative path";
-  }
-  const relative = path.relative(lookDir, path.resolve(path.dirname(file), specifier));
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    return "a relative path that leaves the package";
-  }
-  return null;
-}
-
-const files = (await readdir(lookDir, { recursive: true, withFileTypes: true }))
-  .filter((entry) => entry.isFile() && /\.(ts|css)$/.test(entry.name))
-  .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name))
-  .filter((file) => {
-    const segments = path.relative(lookDir, file).split(path.sep);
-    return segments[0] !== "test" && !segments.includes("node_modules");
-  })
-  .sort();
-
-test("the walk reaches the package's TypeScript and CSS sources", () => {
-  assert.ok(files.some((file) => file.endsWith(".ts")), "the walk found no .ts source");
-  assert.ok(files.some((file) => file.endsWith(".css")), "the walk found no .css source");
-});
-
-test("the scan reads every import form", () => {
-  const ts = [
-    'import "./a.css";',
-    'import x from "./b";',
-    "import {",
-    "  c,",
-    "  d,",
-    '} from "./c";',
-    'import type { E } from "./e";',
-    'export { f } from "./f";',
-    'export * from "./g";',
-    'const h = await import("./h");',
-    'import i = require("./i");',
-    '/// <reference path="./j.d.ts" />',
-    'export type Kind = "success" | "error";',
-    'export const k = Array.from("./not-an-import");',
-  ].join("\n");
-  assert.deepEqual(
-    importSpecifiers(path.join(lookDir, "probe.ts"), ts).sort(),
-    ["./a.css", "./b", "./c", "./e", "./f", "./g", "./h", "./i", "./j.d.ts"],
-  );
-  const css = [
-    '@import "./a.css";',
-    "@import url('./b.css');",
-    "@import url(./c.css);",
-    '/* @import "./commented.css"; */',
-  ].join("\n");
-  assert.deepEqual(importSpecifiers(path.join(lookDir, "probe.css"), css), ["./a.css", "./b.css", "./c.css"]);
-});
-
-test("the classifier admits own files and rejects everything else, lucide included", () => {
-  const from = path.join(lookDir, "toast.ts");
-  for (const specifier of ["./toast.css", "./icons", "../look/modal"]) {
-    assert.equal(violation(from, specifier), null, `${specifier} should be allowed`);
-  }
-  for (const specifier of [
-    "lucide",
-    "@vscode/codicons",
-    "shared-ui/toast",
-    "@workshop/ui",
-    "@workshop/shell",
-    "lucide/dist/esm/icons/mic",
-    "../ui/src/main",
-    "../../shared-ui/tokens.css",
-    "/abs/path",
-  ]) {
-    assert.notEqual(violation(from, specifier), null, `${specifier} should be rejected`);
-  }
-});
-
-test("no look source imports outside the package", async () => {
-  const offenders = [];
-  for (const file of files) {
-    for (const specifier of importSpecifiers(file, await readFile(file, "utf8"))) {
-      const reason = violation(file, specifier);
-      if (reason !== null) offenders.push(`${path.relative(lookDir, file)}: "${specifier}" (${reason})`);
-    }
-  }
-  assert.deepEqual(offenders, [], `boundary violations:\n  ${offenders.join("\n  ")}`);
-});
diff --git a/crates/workshop/look/test/icons.mjs b/crates/workshop/look/test/icons.mjs
deleted file mode 100644
index 43864739e..000000000
--- a/crates/workshop/look/test/icons.mjs
+++ /dev/null
@@ -1,126 +0,0 @@
-// Unit test for the codicon icon strings (icons.ts). Bundles the module with
-// esbuild, imports it via a data URL under jsdom, and asserts that every
-// exported icon is a parseable inline SVG string that equals its
-// @vscode/codicons source file (src/icons/<name>.svg) apart from the size
-// attributes, and that the four names the panels already import keep
-// their pixel sizes - the panels assign these strings to innerHTML and
-// their CSS sizes against the attributes. The package is a devDependency
-// that only this test reads: the shipped strings are inline.
-// Run: node test/icons.mjs (from crates/workshop/look).
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-
-const result = await esbuild.build({
-  entryPoints: [path.join(lookDir, "icons.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = result.outputFiles[0].text;
-const icons = await import(`data:text/javascript;base64,${Buffer.from(code).toString("base64")}`);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Every export, with the codicon it renders and its pixel size. The four
-// names the panels already import keep their sizes (15, 15, 16, 16) and
-// switch to new-folder, trash, mic, and arrow-up; the rest are 16px.
-const expected = {
-  ICON_FOLDER_PLUS: { codicon: "new-folder", size: 15 },
-  ICON_TRASH_2: { codicon: "trash", size: 15 },
-  ICON_MIC: { codicon: "mic", size: 16 },
-  ICON_SEND: { codicon: "arrow-up", size: 16 },
-  ICON_CLOSE: { codicon: "close", size: 16 },
-  ICON_CHEVRON_RIGHT: { codicon: "chevron-right", size: 16 },
-  ICON_CHEVRON_DOWN: { codicon: "chevron-down", size: 16 },
-  ICON_STOP_CIRCLE: { codicon: "stop-circle", size: 16 },
-  ICON_ADD: { codicon: "add", size: 16 },
-  ICON_ELLIPSIS: { codicon: "ellipsis", size: 16 },
-  ICON_WARNING: { codicon: "warning", size: 16 },
-  ICON_INFO: { codicon: "info", size: 16 },
-  ICON_ERROR: { codicon: "error", size: 16 },
-  ICON_CHECK: { codicon: "check", size: 16 },
-  ICON_COPY: { codicon: "copy", size: 16 },
-  // The glyphs the composer and agent chrome draw once lucide is gone: the five
-  // mode glyphs and the mention chip's file, folder, and link family.
-  ICON_AGENT: { codicon: "agent", size: 16 },
-  ICON_CHECKLIST: { codicon: "checklist", size: 16 },
-  ICON_BUG: { codicon: "bug", size: 16 },
-  ICON_LAYERS: { codicon: "layers", size: 16 },
-  ICON_ASK: { codicon: "ask", size: 16 },
-  ICON_FILE: { codicon: "file", size: 16 },
-  ICON_FILE_CODE: { codicon: "file-code", size: 16 },
-  ICON_FILE_MEDIA: { codicon: "file-media", size: 16 },
-  ICON_FILE_TEXT: { codicon: "file-text", size: 16 },
-  ICON_FOLDER: { codicon: "folder", size: 16 },
-  ICON_GLOBE: { codicon: "globe", size: 16 },
-  ICON_LINK: { codicon: "link", size: 16 },
-  ICON_SYMBOL_KEYWORD: { codicon: "symbol-keyword", size: 16 },
-  // The title bar's toolbars: Toggle Primary Side Bar, Toggle Agents, and the settings gear.
-  ICON_LAYOUT_SIDEBAR_LEFT: { codicon: "layout-sidebar-left", size: 16 },
-  ICON_LAYOUT_SIDEBAR_RIGHT: { codicon: "layout-sidebar-right", size: 16 },
-  ICON_GEAR: { codicon: "gear", size: 16 },
-};
-
-check(
-  "the module exports exactly the icon names the surfaces import",
-  Object.keys(icons).sort().join(",") === Object.keys(expected).sort().join(","),
-);
-check(
-  "every export is a different codicon, thirty-one in all",
-  new Set(Object.values(expected).map((entry) => entry.codicon)).size === 31,
-);
-
-// The codicon package root, found through its package.json.
-const require = createRequire(path.join(lookDir, "package.json"));
-const codiconDir = path.dirname(require.resolve("@vscode/codicons/package.json"));
-
-// The size attributes are the only thing the strings may change.
-const withoutSize = (svg) => svg.replace(/\s(?:width|height)="[^"]*"/g, "").trim();
-
-const container = dom.window.document.createElement("div");
-for (const [name, { codicon, size }] of Object.entries(expected)) {
-  const value = icons[name];
-  check(`${name} is a non-empty string`, typeof value === "string" && value.length > 0);
-  if (typeof value !== "string") continue;
-
-  const source = await readFile(path.join(codiconDir, "src", "icons", `${codicon}.svg`), "utf8");
-  check(
-    `${name} equals ${codicon}.svg apart from the size attributes`,
-    withoutSize(value) === withoutSize(source),
-  );
-
-  container.innerHTML = value;
-  const svg = container.firstElementChild;
-  check(`${name} parses to a single svg element`, container.children.length === 1 && svg?.tagName.toLowerCase() === "svg");
-  if (!svg || svg.tagName.toLowerCase() !== "svg") continue;
-
-  check(`${name} keeps its width of ${size}`, svg.getAttribute("width") === String(size));
-  check(`${name} keeps its height of ${size}`, svg.getAttribute("height") === String(size));
-  check(`${name} keeps the 16-unit codicon viewBox`, svg.getAttribute("viewBox") === "0 0 16 16");
-  check(`${name} is a filled glyph in currentColor`, svg.getAttribute("fill") === "currentColor");
-  check(`${name} carries no stroke attributes`, svg.getAttribute("stroke") === null);
-  check(`${name} contains at least one drawing element`, svg.children.length > 0);
-}
-
-if (failures.length > 0) {
-  console.error(`icons: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("icons: all assertions passed");
diff --git a/crates/workshop/look/test/shared-modal.mjs b/crates/workshop/look/test/shared-modal.mjs
deleted file mode 100644
index 055e86f53..000000000
--- a/crates/workshop/look/test/shared-modal.mjs
+++ /dev/null
@@ -1,373 +0,0 @@
-// Unit test for the shared focus-trapped modal (modal.ts): the overlay and
-// dialog structure with the prefix class contract, the Tab trap cycling
-// both directions, Escape and backdrop dismissal with focus return to the
-// invoker, the requiresValue gating with Enter submission, the per-kind
-// duplicate guard, the `primary` flag, and the two skins (the confirmation
-// prompt puts the primary button first, the Windows order; the form modal
-// puts Cancel first and the primary last). Bundles the module with esbuild
-// and drives it against jsdom.
-// Run: node test/shared-modal.mjs (from crates/workshop/look).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(lookDir, "modal.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module imports its colocated CSS; the test drives only the JS,
-  // and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { openModal } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function pressKey(target, key, shiftKey = false) {
-  target.dispatchEvent(
-    new window.KeyboardEvent("keydown", { key, shiftKey, bubbles: true, cancelable: true }),
-  );
-}
-
-const container = window.document.createElement("div");
-window.document.body.append(container);
-const invoker = window.document.createElement("button");
-invoker.textContent = "open";
-window.document.body.append(invoker);
-invoker.focus();
-
-// --- Structure and the prefix class contract -------------------------------------
-
-let chosen = null;
-let dismissed = 0;
-const handle = openModal({
-  container,
-  classPrefix: "confirm",
-  titleId: "confirm-title",
-  title: "Delete the model?",
-  message: "This removes the model.",
-  role: "alertdialog",
-  dismissOnBackdrop: true,
-  onDismiss: () => (dismissed += 1),
-  buttons: [
-    { label: "Cancel", className: "button button-outline", run: () => (chosen = false) },
-    { label: "Delete", className: "button button-danger", run: () => (chosen = true) },
-  ],
-});
-
-const overlay = container.querySelector(".confirm-overlay");
-check("the overlay mounts into the container", overlay !== null);
-check("the overlay has the shared base class", overlay?.classList.contains("modal-overlay"));
-const dialog = container.querySelector(".confirm");
-check("the dialog has the shared base class", dialog?.classList.contains("modal-dialog"));
-check("the dialog is an alertdialog", dialog?.getAttribute("role") === "alertdialog");
-check("the dialog is modal", dialog?.getAttribute("aria-modal") === "true");
-check("the dialog labels by the title", dialog?.getAttribute("aria-labelledby") === "confirm-title");
-check(
-  "the dialog describes by the message",
-  dialog?.getAttribute("aria-describedby") === container.querySelector(".confirm__line")?.id,
-);
-check("the title renders", container.querySelector(".confirm__title")?.textContent === "Delete the model?");
-check("the message renders", container.querySelector(".confirm__line")?.textContent === "This removes the model.");
-check("the actions have the prefix class", container.querySelector(".confirm__actions") !== null);
-check("focus lands on the first button", window.document.activeElement?.textContent === "Cancel");
-
-// --- The duplicate guard ----------------------------------------------------------
-
-const second = openModal({
-  container,
-  classPrefix: "confirm",
-  titleId: "confirm-title",
-  title: "Again?",
-  message: "no",
-  buttons: [{ label: "OK", run: () => undefined }],
-});
-check("a second dialog of the same kind is a no-op", container.querySelectorAll(".confirm-overlay").length === 1);
-check("the duplicate handle reads closed", second.closed === true);
-
-// --- The Tab trap cycles both directions -------------------------------------------
-// jsdom has no default Tab navigation, so only the trap's boundary wraps
-// are observable: Tab on the last button, Shift+Tab on the first.
-
-const cancelButton = [...container.querySelectorAll(".confirm__actions button")].find(
-  (button) => button.textContent === "Cancel",
-);
-const deleteButton = [...container.querySelectorAll(".confirm__actions button")].find(
-  (button) => button.textContent === "Delete",
-);
-deleteButton.focus();
-pressKey(window.document, "Tab");
-check("Tab on the last button wraps to the first", window.document.activeElement === cancelButton);
-pressKey(window.document, "Tab", true);
-check("Shift+Tab on the first button wraps to the last", window.document.activeElement === deleteButton);
-
-// --- Escape dismisses with focus return ----------------------------------------------
-
-pressKey(window.document, "Escape");
-check("Escape dismisses the dialog", container.querySelector(".confirm-overlay") === null);
-check("Escape fires onDismiss", dismissed === 1);
-check("Escape runs no button", chosen === null);
-check("Escape returns focus to the invoker", window.document.activeElement === invoker);
-check("the handle reads closed after dismissal", handle.closed === true);
-
-// --- The backdrop dismisses; the card does not ---------------------------------------
-
-openModal({
-  container,
-  classPrefix: "confirm",
-  titleId: "confirm-title",
-  title: "t",
-  message: "m",
-  dismissOnBackdrop: true,
-  onDismiss: () => (dismissed += 1),
-  buttons: [{ label: "OK", className: "button", run: () => (chosen = true) }],
-});
-container.querySelector(".confirm").dispatchEvent(new window.MouseEvent("click", { bubbles: true }));
-check("a click on the card keeps the dialog open", container.querySelector(".confirm-overlay") !== null);
-container.querySelector(".confirm-overlay").dispatchEvent(new window.MouseEvent("click", { bubbles: true }));
-check("a backdrop click dismisses", container.querySelector(".confirm-overlay") === null);
-check("the backdrop fires onDismiss", dismissed === 2);
-
-// --- The field: requiresValue gating and Enter submission -----------------------------
-
-let fieldValue = null;
-openModal({
-  container,
-  classPrefix: "ws-workspace-add",
-  titleId: "workspace-add-title",
-  title: "Add Folder",
-  message: "Enter the path.",
-  field: { id: "workspace-add-path", label: "Folder path" },
-  buttons: [
-    { label: "Add", requiresValue: true, run: (value) => (fieldValue = value) },
-    { label: "Cancel", run: () => undefined },
-  ],
-});
-const input = container.querySelector("#workspace-add-path");
-const addButton = [...container.querySelectorAll(".ws-workspace-add__button")].find(
-  (button) => button.textContent === "Add",
-);
-check("the field renders with its label", container.querySelector(".ws-workspace-add__label") !== null);
-check("focus lands on the field", window.document.activeElement === input);
-check("the gated button starts disabled", addButton?.disabled === true);
-pressKey(input, "Enter");
-check("Enter with an empty field submits nothing", fieldValue === null);
-input.value = "  C:\\models  ";
-input.dispatchEvent(new window.Event("input", { bubbles: true }));
-check("typing enables the gated button", addButton?.disabled === false);
-pressKey(input, "Enter");
-check("Enter submits the trimmed value", fieldValue === "C:\\models");
-check("the submission dismissed the dialog", container.querySelector(".ws-workspace-add-overlay") === null);
-
-// --- The primary flag ------------------------------------------------------------------
-
-const labelsOf = (prefix) =>
-  [...container.querySelectorAll(`.${prefix}__actions button`)].map((button) => button.textContent);
-
-openModal({
-  container,
-  classPrefix: "plain",
-  titleId: "plain-title",
-  title: "t",
-  message: "m",
-  buttons: [
-    { label: "Cancel", run: () => undefined },
-    { label: "Go", primary: true, run: () => undefined },
-  ],
-});
-const plainGo = [...container.querySelectorAll(".plain__actions button")].find(
-  (button) => button.textContent === "Go",
-);
-check("a primary button takes the --primary modifier", plainGo?.classList.contains("plain__button--primary"));
-check(
-  "a non-primary button has no --primary modifier",
-  !container.querySelector(".plain__actions button")?.classList.contains("plain__button--primary"),
-);
-check("focus lands on the primary button when there is no field", window.document.activeElement === plainGo);
-check("an unskinned dialog keeps the given order", labelsOf("plain").join(",") === "Cancel,Go");
-check("an unskinned dialog has no skin classes", container.querySelector(".plain-overlay")?.className === "modal-overlay plain-overlay");
-pressKey(window.document, "Escape");
-
-// --- The confirmation skin: primary first, the Windows order --------------------------------
-
-function openConfirmation(buttons) {
-  return openModal({
-    container,
-    classPrefix: "confirm-skin",
-    titleId: "confirm-skin-title",
-    title: "Do you want to save the changes you made to a.md?",
-    message: "Your changes will be lost if you don't save them.",
-    skin: "confirmation",
-    buttons,
-  });
-}
-
-openConfirmation([
-  { label: "Save", primary: true, run: () => undefined },
-  { label: "Don't Save", run: () => undefined },
-  { label: "Cancel", run: () => undefined },
-]);
-check(
-  "the confirmation overlay carries the skin class",
-  container.querySelector(".confirm-skin-overlay")?.classList.contains("modal-overlay--confirmation"),
-);
-check(
-  "the confirmation dialog carries the skin class",
-  container.querySelector(".confirm-skin")?.classList.contains("modal-dialog--confirmation"),
-);
-check(
-  "the Windows order is Save, Don't Save, Cancel",
-  labelsOf("confirm-skin").join("|") === "Save|Don't Save|Cancel",
-);
-check(
-  "focus lands on the primary Save",
-  window.document.activeElement?.textContent === "Save",
-);
-const skinButtons = [...container.querySelectorAll(".confirm-skin__actions button")];
-check(
-  "the primary button takes the primary control classes",
-  skinButtons[0].classList.contains("button") && skinButtons[0].classList.contains("button-primary"),
-);
-check(
-  "a plain button takes the secondary control classes",
-  skinButtons[1].classList.contains("button") && skinButtons[1].classList.contains("button-secondary"),
-);
-pressKey(window.document, "Escape");
-
-openConfirmation([
-  { label: "Cancel", run: () => undefined },
-  { label: "Don't Save", run: () => undefined },
-  { label: "Save", primary: true, run: () => undefined },
-]);
-check(
-  "the confirmation skin moves the primary button first and keeps the rest in order",
-  labelsOf("confirm-skin").join("|") === "Save|Cancel|Don't Save",
-);
-pressKey(window.document, "Escape");
-
-openConfirmation([
-  { label: "Revert", danger: true, run: () => undefined },
-  { label: "Cancel", run: () => undefined },
-]);
-const revertButtons = [...container.querySelectorAll(".confirm-skin__actions button")];
-check(
-  "a danger button takes the danger control class and the --danger modifier",
-  revertButtons[0].classList.contains("button-danger") &&
-    revertButtons[0].classList.contains("confirm-skin__button--danger"),
-);
-check(
-  "a skinned dialog with no primary button keeps the given order",
-  labelsOf("confirm-skin").join("|") === "Revert|Cancel",
-);
-pressKey(window.document, "Escape");
-
-// --- The form skin: Cancel first, the primary last --------------------------------------------
-
-let formValue = null;
-openModal({
-  container,
-  classPrefix: "form-skin",
-  titleId: "form-skin-title",
-  title: "Add Folder",
-  message: "Enter the path.",
-  skin: "form",
-  field: { id: "form-skin-path", label: "Folder path" },
-  buttons: [
-    { label: "Add", primary: true, requiresValue: true, run: (value) => (formValue = value) },
-    { label: "Cancel", run: () => undefined },
-  ],
-});
-check(
-  "the form overlay carries the skin class",
-  container.querySelector(".form-skin-overlay")?.classList.contains("modal-overlay--form"),
-);
-check(
-  "the form dialog carries the skin class",
-  container.querySelector(".form-skin")?.classList.contains("modal-dialog--form"),
-);
-check("the form skin puts Cancel first and the primary last", labelsOf("form-skin").join("|") === "Cancel|Add");
-check("the gated primary starts disabled", container.querySelector(".form-skin__actions button:last-child")?.disabled === true);
-const formInput = container.querySelector("#form-skin-path");
-check("focus lands on the field", window.document.activeElement === formInput);
-check("a skinned field's input takes the input control class", formInput.classList.contains("input"));
-formInput.value = "C:\\work";
-formInput.dispatchEvent(new window.Event("input", { bubbles: true }));
-pressKey(formInput, "Enter");
-check("Enter submits through the primary button wherever it sits", formValue === "C:\\work");
-
-// --- Enter in a field dialog whose primary button has no requiresValue -------------------------
-// The form skin reorders the buttons to Cancel, Save, so the first button is Cancel. With no
-// value-gated button, Enter has to take the primary button and not fall through to the first one.
-
-const plainRuns = [];
-openModal({
-  container,
-  classPrefix: "form-plain",
-  titleId: "form-plain-title",
-  title: "Rename",
-  message: "Enter the new name.",
-  skin: "form",
-  field: { id: "form-plain-name", label: "Name" },
-  buttons: [
-    { label: "Save", primary: true, run: (value) => plainRuns.push(`Save:${value}`) },
-    { label: "Cancel", run: () => plainRuns.push("Cancel") },
-  ],
-});
-check(
-  "a form dialog with a plain primary puts Cancel first, so the first button is not the primary",
-  labelsOf("form-plain").join("|") === "Cancel|Save",
-);
-const plainInput = container.querySelector("#form-plain-name");
-plainInput.value = "notes";
-pressKey(plainInput, "Enter");
-check("Enter runs the plain primary button with the field value", plainRuns.join(",") === "Save:notes");
-check("Enter does not run Cancel, the first button after reordering", !plainRuns.includes("Cancel"));
-check("Enter dismisses the dialog", container.querySelector(".form-plain-overlay") === null);
-
-// An unskinned dialog keeps the given order, so the primary is not first there either.
-const unskinnedRuns = [];
-openModal({
-  container,
-  classPrefix: "field-plain",
-  titleId: "field-plain-title",
-  title: "Rename",
-  message: "Enter the new name.",
-  field: { id: "field-plain-name", label: "Name" },
-  buttons: [
-    { label: "Cancel", run: () => unskinnedRuns.push("Cancel") },
-    { label: "Save", primary: true, run: (value) => unskinnedRuns.push(`Save:${value}`) },
-  ],
-});
-pressKey(container.querySelector("#field-plain-name"), "Enter");
-check(
-  "Enter takes the primary button in an unskinned dialog too, not the first",
-  unskinnedRuns.join(",") === "Save:",
-);
-
-if (failures.length > 0) {
-  console.error(`shared-modal: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("shared-modal: all assertions passed");
diff --git a/crates/workshop/look/test/shared-progress.mjs b/crates/workshop/look/test/shared-progress.mjs
deleted file mode 100644
index 048c82c5d..000000000
--- a/crates/workshop/look/test/shared-progress.mjs
+++ /dev/null
@@ -1,84 +0,0 @@
-// Unit test for the shared progress bar (progress.ts): the settings variant
-// is the default and the workbench variant is a modifier class; a null
-// fraction renders the indeterminate bar (a class the stylesheet animates)
-// with no aria value, and any number clears it again; fractions clamp to
-// 0..1 and set the fill's --progress scale and the aria value. Bundles the
-// module with esbuild and drives it against jsdom.
-// Run: node test/shared-progress.mjs (from crates/workshop/look).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(lookDir, "progress.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module imports its colocated CSS; the test drives only the JS.
-  loader: { ".css": "empty" },
-});
-const { createProgressBar } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const fillOf = (bar) => bar.element.querySelector(".progress__fill");
-
-// --- Structure and the default variant --------------------------------------------
-
-const bar = createProgressBar("Update download progress");
-const el = bar.element;
-check("the track is a progressbar", el.getAttribute("role") === "progressbar");
-check("the track is labeled", el.getAttribute("aria-label") === "Update download progress");
-check("the track has the progress class", el.classList.contains("progress"));
-check("the default variant adds no modifier", [...el.classList].join(" ") === "progress");
-check("the track holds one fill", el.children.length === 1 && fillOf(bar) !== null);
-
-// --- Determinate ------------------------------------------------------------------
-
-bar.setFraction(0.25);
-check("a fraction scales the fill", fillOf(bar).style.getPropertyValue("--progress") === "0.25");
-check("a fraction sets the aria value", el.getAttribute("aria-valuenow") === "25");
-check("a fraction is not indeterminate", !el.classList.contains("progress--indeterminate"));
-bar.setFraction(1.7);
-check("a fraction above 1 clamps to full", fillOf(bar).style.getPropertyValue("--progress") === "1" && el.getAttribute("aria-valuenow") === "100");
-bar.setFraction(-3);
-check("a fraction below 0 clamps to empty", fillOf(bar).style.getPropertyValue("--progress") === "0" && el.getAttribute("aria-valuenow") === "0");
-
-// --- Indeterminate ----------------------------------------------------------------
-
-bar.setFraction(null);
-check("a null fraction is indeterminate", el.classList.contains("progress--indeterminate"));
-check("a null fraction drops the aria value", !el.hasAttribute("aria-valuenow"));
-bar.setFraction(0.5);
-check("a number after null clears the indeterminate state", !el.classList.contains("progress--indeterminate"));
-check("a number after null restores the aria value", el.getAttribute("aria-valuenow") === "50");
-
-// --- The workbench variant --------------------------------------------------------
-
-const workbench = createProgressBar("Loading", "workbench");
-check("the workbench variant takes the modifier class", workbench.element.classList.contains("progress--workbench"));
-check("the workbench variant keeps the progress class", workbench.element.classList.contains("progress"));
-workbench.setFraction(null);
-check("the workbench variant goes indeterminate on null", workbench.element.classList.contains("progress--indeterminate"));
-
-if (failures.length > 0) {
-  console.error(`shared-progress: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("shared-progress: all assertions passed");
diff --git a/crates/workshop/look/test/shared-status-bar.mjs b/crates/workshop/look/test/shared-status-bar.mjs
deleted file mode 100644
index 1eebfd25c..000000000
--- a/crates/workshop/look/test/shared-status-bar.mjs
+++ /dev/null
@@ -1,142 +0,0 @@
-// Unit test for the shared status bar view (status-bar.ts): the
-// barberpole beside the consumer's indicators group (setBusy shows and
-// hides the barberpole, the group stays visible throughout and keeps its
-// contents, the barberpole precedes the group in DOM order), the reading
-// order the workshop's fill gives the right group (barberpole, meter,
-// record LED, inference LED), the text region's label, tooltip, and
-// error styling, and the extras region the consumers fill. Bundles the
-// module with esbuild and drives it against jsdom.
-// Run: node test/shared-status-bar.mjs (from crates/workshop/look).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(lookDir, "status-bar.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module imports its colocated CSS; the test drives only the JS,
-  // and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { createStatusBarView } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const view = createStatusBarView();
-window.document.body.append(view.element);
-
-// A consumer's indicator: busy toggling must never touch its contents.
-const led = window.document.createElement("span");
-led.className = "status-bar__led";
-view.indicators.append(led);
-
-// --- The view's structure ----------------------------------------------------
-
-check("the element is the status-bar footer", view.element.matches("footer.status-bar"));
-check("the bar is a polite live region", view.element.getAttribute("aria-live") === "polite");
-check(
-  "the barberpole is the view's element of that class",
-  view.barberpole === view.element.querySelector(".status-bar__barberpole"),
-);
-check("the barberpole starts hidden", view.barberpole.hidden === true);
-check("the indicators group starts visible", view.indicators.hidden === false);
-check(
-  "the barberpole sits in the right group",
-  view.barberpole.parentElement?.matches(".status-bar__right") === true,
-);
-check(
-  "the barberpole precedes the indicators group in DOM order",
-  (view.barberpole.compareDocumentPosition(view.indicators) & Node.DOCUMENT_POSITION_FOLLOWING) !== 0,
-);
-check(
-  "the barberpole is an indeterminate progressbar to assistive tech",
-  view.barberpole.getAttribute("role") === "progressbar" &&
-    !view.barberpole.hasAttribute("aria-valuenow"),
-);
-check("no <progress> element remains in the view", view.element.querySelector("progress") === null);
-check("the text region starts empty", view.text.textContent === "");
-check("the extras region is empty until the consumer fills it", view.extras.childElementCount === 0);
-
-// --- The busy toggle --------------------------------------------------------------
-
-view.setBusy(true);
-check("setBusy(true) shows the barberpole", view.barberpole.hidden === false);
-check("setBusy(true) leaves the indicators group visible", view.indicators.hidden === false);
-check("setBusy(true) kept the consumer's LED in the group", view.indicators.contains(led));
-
-view.setBusy(true);
-check("a repeated setBusy(true) keeps the barberpole shown", view.barberpole.hidden === false);
-
-view.setBusy(false);
-check("setBusy(false) hides the barberpole", view.barberpole.hidden === true);
-check("setBusy(false) leaves the indicators group visible", view.indicators.hidden === false);
-check("the group still holds the consumer's LED", view.indicators.contains(led));
-check("the view exposes no renderSlot", typeof view.renderSlot === "undefined");
-check("the view exposes no progress element", typeof view.progress === "undefined");
-
-// --- Reading order ----------------------------------------------------------------
-
-// The workshop's fill: a meter button, then the record and inference LEDs.
-const meter = window.document.createElement("button");
-meter.className = "status-bar__item status-bar__meter";
-const record = window.document.createElement("span");
-record.className = "status-bar__led";
-const inference = window.document.createElement("span");
-inference.className = "status-bar__led";
-view.indicators.replaceChildren(meter, record, inference);
-const right = view.element.querySelector(".status-bar__right");
-const reading = () => [...right.querySelectorAll(".status-bar__barberpole, .status-bar__indicators > *")];
-const expected = [view.barberpole, meter, record, inference];
-const readsInOrder = () =>
-  reading().length === expected.length && reading().every((el, index) => el === expected[index]);
-check("the right group reads barberpole, meter, record LED, inference LED", readsInOrder());
-check(
-  "nothing sits between the barberpole and the indicators group",
-  view.barberpole.nextElementSibling?.firstElementChild === view.indicators,
-);
-view.setBusy(true);
-check("a busy bar keeps the reading order", readsInOrder());
-view.setBusy(false);
-check("an idle bar keeps the reading order", readsInOrder());
-
-// --- The text region --------------------------------------------------------------
-
-view.setText("Downloading model", { tooltip: "1 of 2" });
-check("setText sets the label", view.text.textContent === "Downloading model");
-check("setText sets the tooltip on the bar", view.element.title === "1 of 2");
-check("the error styling starts off", !view.text.classList.contains("status-bar__text--error"));
-
-view.setText("The download failed", { error: true });
-check("an error label takes the error styling", view.text.classList.contains("status-bar__text--error"));
-check("a missing tooltip clears the bar's title", view.element.title === "");
-
-view.setText("Ready", { error: false });
-check("a later setText clears the error styling", !view.text.classList.contains("status-bar__text--error"));
-
-if (failures.length > 0) {
-  console.error(`shared-status-bar: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("shared-status-bar: all assertions passed");
diff --git a/crates/workshop/look/test/shared-toast.mjs b/crates/workshop/look/test/shared-toast.mjs
deleted file mode 100644
index 4f5fc6f1c..000000000
--- a/crates/workshop/look/test/shared-toast.mjs
+++ /dev/null
@@ -1,211 +0,0 @@
-// Unit test for the shared toast stack (toast.ts): show() puts a kind-classed
-// toast on top of a polite live region, the stack keeps the newest three,
-// each toast leaves after its severity's lifetime (info and success 15s,
-// warning 18s, error 20s), hovering or focusing a toast pauses its timer
-// and the remaining time resumes on leave, a close X dismisses at once, and
-// every kind carries its codicon glyph. Bundles the module with esbuild and
-// drives it against jsdom with mocked timers and a mocked clock.
-// Run: node test/shared-toast.mjs (from crates/workshop/look).
-import path from "node:path";
-import { mock } from "node:test";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createToastStack } from "./toast.ts";
-      export { ICON_CHECK, ICON_ERROR, ICON_INFO, ICON_WARNING } from "./icons.ts";
-    `,
-    resolveDir: lookDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module imports its colocated CSS; the test drives only the JS,
-  // and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { createToastStack, ICON_CHECK, ICON_ERROR, ICON_INFO, ICON_WARNING } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The hover pause measures elapsed time with the clock, so it is mocked too.
-mock.timers.enable({ apis: ["setTimeout", "Date"] });
-
-/** Builds a stack in the document, answering it with its toasts, newest first. */
-function mount() {
-  window.document.body.replaceChildren();
-  const stack = createToastStack();
-  window.document.body.append(stack.element);
-  return { stack, toasts: () => [...stack.element.querySelectorAll(".toast")] };
-}
-
-const hover = (toast, type) => toast.dispatchEvent(new window.MouseEvent(type, { bubbles: false }));
-
-// --- The stack and one toast ---------------------------------------------------
-
-{
-  const { stack, toasts } = mount();
-  check("the stack is a polite live region", stack.element.getAttribute("aria-live") === "polite");
-  check("the stack announces as status", stack.element.getAttribute("role") === "status");
-
-  stack.show("Runvil 1.2.3 is available", "info");
-  const [toast] = toasts();
-  check("show appends one toast per call", toasts().length === 1);
-  check("the toast has its kind class", toast?.classList.contains("toast-info") === true);
-  check(
-    "the toast renders its message in its own element",
-    toast?.querySelector(".toast__message")?.textContent === "Runvil 1.2.3 is available",
-  );
-  check("the toast's text is only its message", toast?.textContent === "Runvil 1.2.3 is available");
-  check("the toast has a close button", toast?.querySelector("button.toast__close")?.type === "button");
-  check(
-    "the close button is named for assistive tech",
-    toast?.querySelector("button.toast__close")?.getAttribute("aria-label") === "Clear Notification",
-  );
-  check("the close button carries an X glyph", toast?.querySelector(".toast__close svg") !== null);
-  check("the glyph is hidden from assistive tech", toast?.querySelector(".toast__icon")?.getAttribute("aria-hidden") === "true");
-}
-
-// --- Every kind has its codicon -------------------------------------------------
-
-for (const [kind, icon] of [
-  ["info", ICON_INFO],
-  ["warning", ICON_WARNING],
-  ["error", ICON_ERROR],
-  ["success", ICON_CHECK],
-]) {
-  const { stack, toasts } = mount();
-  stack.show("glyph", kind);
-  const [toast] = toasts();
-  // The DOM re-serializes the icon string, so compare it with the same string parsed the same way.
-  const expected = window.document.createElement("span");
-  expected.innerHTML = icon;
-  check(`a ${kind} toast has its kind class`, toast?.classList.contains(`toast-${kind}`) === true);
-  check(
-    `a ${kind} toast draws its codicon`,
-    expected.querySelector("path") !== null && toast?.querySelector(".toast__icon")?.innerHTML === expected.innerHTML,
-  );
-}
-
-// --- Newest on top, three visible -----------------------------------------------
-
-{
-  const { stack, toasts } = mount();
-  const text = () => toasts().map((toast) => toast.querySelector(".toast__message").textContent);
-  stack.show("first", "info");
-  stack.show("second", "info");
-  check("the newest toast is on top", text().join(",") === "second,first");
-  stack.show("third", "info");
-  check("three toasts show together", text().join(",") === "third,second,first");
-  stack.show("fourth", "info");
-  check("a fourth pushes the oldest out", text().join(",") === "fourth,third,second");
-  mock.timers.tick(15000);
-  check("the survivors still time out", toasts().length === 0);
-}
-
-// --- Lifetimes by severity ------------------------------------------------------
-
-for (const [kind, lifetime] of [
-  ["info", 15000],
-  ["success", 15000],
-  ["warning", 18000],
-  ["error", 20000],
-]) {
-  const { stack, toasts } = mount();
-  stack.show("timed", kind);
-  mock.timers.tick(lifetime - 1);
-  check(`a ${kind} toast stays for ${lifetime - 1}ms`, toasts().length === 1);
-  mock.timers.tick(1);
-  check(`a ${kind} toast leaves at ${lifetime}ms`, toasts().length === 0);
-}
-
-// --- Hover pauses the timer, leaving resumes the remainder -----------------------
-
-{
-  const { stack, toasts } = mount();
-  stack.show("hovered", "info");
-  const [toast] = toasts();
-  mock.timers.tick(5000);
-  hover(toast, "mouseenter");
-  mock.timers.tick(60000);
-  check("a hovered toast outlives its lifetime", toasts().length === 1);
-  hover(toast, "mouseleave");
-  mock.timers.tick(9999);
-  check("leaving resumes the remaining 10s, not a fresh 15s", toasts().length === 1);
-  mock.timers.tick(1);
-  check("the toast leaves when the remainder runs out", toasts().length === 0);
-}
-
-{
-  // A second hover pauses the remainder again, and keyboard focus pauses too.
-  const { stack, toasts } = mount();
-  stack.show("twice", "warning");
-  const [toast] = toasts();
-  mock.timers.tick(8000);
-  hover(toast, "mouseenter");
-  hover(toast, "mouseleave");
-  mock.timers.tick(4000);
-  hover(toast, "mouseenter");
-  mock.timers.tick(30000);
-  hover(toast, "mouseleave");
-  mock.timers.tick(5999);
-  check("two hovers spend only the time between them", toasts().length === 1);
-  mock.timers.tick(1);
-  check("the remainder after two pauses is 18s - 12s", toasts().length === 0);
-
-  const { stack: focusStack, toasts: focusToasts } = mount();
-  focusStack.show("focused", "error");
-  const [focused] = focusToasts();
-  focused.dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  mock.timers.tick(60000);
-  check("a focused toast waits", focusToasts().length === 1);
-  focused.dispatchEvent(new window.FocusEvent("focusout", { bubbles: true }));
-  mock.timers.tick(20000);
-  check("a toast resumes when focus leaves", focusToasts().length === 0);
-}
-
-// --- The close X ------------------------------------------------------------------
-
-{
-  const { stack, toasts } = mount();
-  stack.show("keep", "info");
-  stack.show("close me", "error");
-  const closing = toasts()[0];
-  closing.querySelector(".toast__close").click();
-  check("the close X removes its toast at once", toasts().length === 1);
-  check("the other toast stays", toasts()[0].querySelector(".toast__message").textContent === "keep");
-  closing.querySelector(".toast__close").click();
-  mock.timers.tick(25000);
-  check("a dismissed toast's timer never touches the stack again", toasts().length === 0);
-}
-
-mock.timers.reset();
-
-if (failures.length > 0) {
-  console.error(`shared-toast: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("shared-toast: all assertions passed");
diff --git a/crates/workshop/look/test/shimmer.mjs b/crates/workshop/look/test/shimmer.mjs
deleted file mode 100644
index 7dc72f006..000000000
--- a/crates/workshop/look/test/shimmer.mjs
+++ /dev/null
@@ -1,207 +0,0 @@
-// Unit test for the shared shimmer (shimmer.ts and shimmer.css). The sweep's
-// phase comes from one module start time, so every shimmering element is in
-// phase and a rebuilt element does not restart the sweep: two elements
-// started at different times, and a rebuilt copy, all read the same phase.
-// The stylesheet carries the tunable variables, the three 1s transcript
-// tones, and the reduced-motion contract (the shimmer stops and the row
-// keeps its own resting color). Bundles the module with esbuild and drives
-// it against jsdom with a scripted clock.
-// Run: node test/shimmer.mjs (from crates/workshop/look).
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(lookDir, "shimmer.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module may import its colocated CSS; the test drives only the JS.
-  loader: { ".css": "empty" },
-});
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The module reads its start time at load, so the clock is scripted before
-// the import: the module starts at START, and every call below runs at a
-// time the test chooses.
-const START = 1_000_000;
-let clock = START;
-const realNow = Date.now;
-Date.now = () => clock;
-const { setShimmer } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-const at = (offsetMs) => {
-  clock = START + offsetMs;
-};
-
-const make = () => window.document.body.appendChild(window.document.createElement("span"));
-
-// --- One shared phase -----------------------------------------------------------
-
-at(300);
-const firstStartedAt = clock;
-const first = make();
-setShimmer(first, true);
-check("setShimmer(on) adds the shimmer class", first.classList.contains("ws-shimmer-text"));
-check("the delay is negative and measured from the module start", first.style.animationDelay === "-300ms");
-
-at(4_500);
-const secondStartedAt = clock;
-const second = make();
-setShimmer(second, true);
-check("a later element's delay is the elapsed time within the 2s loop", second.style.animationDelay === "-500ms");
-
-// An animation started at time t with delay -d is d ms into the loop at t, so
-// two elements are in phase when (t - d) agrees modulo the loop length. Both
-// t and d are read back from what setShimmer actually set, not recomputed.
-const period = 2000;
-const delayOf = (element) => -Number.parseFloat(element.style.animationDelay);
-const phaseOrigin = (startedAt, element) => startedAt - delayOf(element);
-const modulo = (value) => ((value % period) + period) % period;
-check(
-  "two elements started at different times share one phase",
-  modulo(phaseOrigin(firstStartedAt, first) - phaseOrigin(secondStartedAt, second)) === 0,
-);
-
-at(4_500);
-const rebuilt = make();
-setShimmer(rebuilt, true);
-check("a rebuilt element gets the delay of an existing one started at the same time", rebuilt.style.animationDelay === second.style.animationDelay);
-
-// --- A running element is not restarted -----------------------------------------
-
-at(7_100);
-setShimmer(second, true);
-check("setShimmer(on) on a running element leaves its delay alone", second.style.animationDelay === "-500ms");
-
-// --- Off ------------------------------------------------------------------------
-
-setShimmer(second, false);
-check("setShimmer(off) removes the shimmer class", !second.classList.contains("ws-shimmer-text"));
-check("setShimmer(off) clears the delay", second.style.animationDelay === "");
-at(7_300);
-setShimmer(second, true);
-check("turning it back on takes the shared phase again", second.style.animationDelay === `-${(7_300) % period}ms`);
-
-// --- The element's own duration -------------------------------------------------
-
-at(2_700);
-const custom = make();
-custom.style.setProperty("--shimmer-duration", "1s");
-setShimmer(custom, true);
-check("an element's --shimmer-duration sets the loop the delay wraps in", custom.style.animationDelay === "-700ms");
-
-const millis = make();
-millis.style.setProperty("--shimmer-duration", "500ms");
-setShimmer(millis, true);
-check("a duration in milliseconds is read too", millis.style.animationDelay === "-200ms");
-
-// A tone modifier is a 1s loop in the stylesheet; a detached element has no
-// computed style, so the module knows the tones itself.
-for (const tone of ["status", "thinking", "tool"]) {
-  const toned = window.document.createElement("span");
-  toned.className = `ws-shimmer-text--${tone}`;
-  setShimmer(toned, true);
-  check(`the ${tone} tone wraps the delay in its 1s loop`, toned.style.animationDelay === "-700ms");
-}
-
-Date.now = realNow;
-
-// --- shimmer.css ----------------------------------------------------------------
-
-const css = await readFile(path.join(lookDir, "shimmer.css"), "utf8");
-const code = css.replace(/\/\*[\s\S]*?\*\//g, "");
-const [mainCss, reducedCss = ""] = code.split("@media (prefers-reduced-motion: reduce)");
-const flat = (text) => text.replace(/\s+/g, " ");
-
-function declarations(text, selector) {
-  const out = {};
-  const pattern = /([^{}]+)\{([^{}]*)\}/g;
-  for (const match of text.matchAll(pattern)) {
-    const selectors = match[1].split(",").map((entry) => flat(entry).trim());
-    if (!selectors.includes(selector)) continue;
-    for (const declaration of match[2].split(";")) {
-      const colon = declaration.indexOf(":");
-      if (colon < 0) continue;
-      out[declaration.slice(0, colon).trim()] = flat(declaration.slice(colon + 1)).trim();
-    }
-  }
-  return out;
-}
-
-const base = declarations(mainCss, ".ws-shimmer-text");
-check(
-  "the gradient reads --shimmer-base and --shimmer-peak",
-  (base["background-image"] ?? "").includes("var(--shimmer-base,") &&
-    (base["background-image"] ?? "").includes("var(--shimmer-peak,"),
-);
-check(
-  "the base defaults to the primary text at 60%",
-  (base["background-image"] ?? "").includes("var(--shimmer-base, color-mix(in srgb, var(--cursor-text-primary) 60%, transparent))"),
-);
-check(
-  "the peak defaults to the primary text",
-  (base["background-image"] ?? "").includes("var(--shimmer-peak, var(--cursor-text-primary))"),
-);
-check(
-  "the loop reads --shimmer-duration with a 2s default",
-  (base.animation ?? "").includes("var(--shimmer-duration, 2s)"),
-);
-
-const tones = {
-  status: {
-    base: "color-mix(in srgb, var(--cursor-text-secondary) 60%, transparent)",
-    peak: "var(--cursor-text-secondary)",
-  },
-  thinking: {
-    base: "color-mix(in srgb, var(--cursor-text-tertiary) 60%, transparent)",
-    peak: "var(--cursor-text-secondary)",
-  },
-  tool: {
-    base: "color-mix(in srgb, var(--cursor-text-secondary) 60%, transparent)",
-    peak: "color-mix(in srgb, var(--cursor-text-primary) 60%, transparent)",
-  },
-};
-for (const [tone, expected] of Object.entries(tones)) {
-  const rule = declarations(mainCss, `.ws-shimmer-text--${tone}`);
-  check(`the ${tone} tone loops in 1s`, rule["--shimmer-duration"] === "1s");
-  check(`the ${tone} tone base is ${expected.base}`, rule["--shimmer-base"] === expected.base);
-  check(`the ${tone} tone peak is ${expected.peak}`, rule["--shimmer-peak"] === expected.peak);
-}
-
-const reduced = declarations(reducedCss, ".ws-shimmer-text");
-check("reduced motion stops the animation", reduced.animation === "none");
-check("reduced motion drops the gradient", reduced["background-image"] === "none");
-check("reduced motion restores the text clip", reduced["background-clip"] === "unset");
-check("reduced motion restores the text fill", reduced["-webkit-text-fill-color"] === "unset");
-check(
-  "reduced motion leaves the row's own resting color",
-  reduced.color === undefined,
-);
-
-if (failures.length > 0) {
-  console.error(`shimmer: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("shimmer: all assertions passed");
diff --git a/crates/workshop/look/test/skin-css.mjs b/crates/workshop/look/test/skin-css.mjs
deleted file mode 100644
index 73823d800..000000000
--- a/crates/workshop/look/test/skin-css.mjs
+++ /dev/null
@@ -1,413 +0,0 @@
-// Stylesheet contract for the Cursor IDE foundation: the token values in
-// tokens.css, the controls in controls.css (button, input, select, the
-// switch, the shared focus outline and menu scrollbar), the select menu in
-// dropdown.css, the progress variants in progress.css, and the two dialog
-// skins in modal.css. jsdom applies no stylesheets, so the values are read
-// from the source text: each rule's declarations are collected by selector
-// and every var() is resolved against the :root tokens, so a test names the
-// value a reader sees (24px, #3FA266) instead of the token that carries it.
-// Run: node test/skin-css.mjs (from crates/workshop/look).
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const flat = (text) => text.replace(/\s+/g, " ").trim();
-const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, "");
-
-/** Every rule as { selectors, declarations }, nesting flattened (at-rule headers are dropped). */
-function parseRules(css) {
-  const rules = [];
-  for (const match of stripComments(css).matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
-    const selectors = match[1].split(",").map(flat);
-    const declarations = {};
-    for (const declaration of match[2].split(";")) {
-      const colon = declaration.indexOf(":");
-      if (colon < 0) continue;
-      declarations[declaration.slice(0, colon).trim()] = flat(declaration.slice(colon + 1));
-    }
-    rules.push({ selectors, declarations });
-  }
-  return rules;
-}
-
-const read = (name) => readFile(path.join(lookDir, name), "utf8");
-const tokensCss = await read("tokens.css");
-const tokenRules = parseRules(tokensCss).filter((rule) => rule.selectors.includes(":root"));
-const tokens = Object.assign({}, ...tokenRules.map((rule) => rule.declarations));
-
-/** Resolves var() references, with fallbacks, against the :root tokens. */
-function resolve(value, depth = 0) {
-  if (value === undefined || depth > 12) return value;
-  return value.replace(/var\(\s*(--[a-z0-9-]+)\s*(?:,\s*((?:[^()]|\([^()]*\))*))?\)/gi, (_, name, fallback) => {
-    const known = tokens[name];
-    if (known !== undefined) return resolve(known, depth + 1);
-    return fallback === undefined ? "" : resolve(flat(fallback), depth + 1);
-  });
-}
-
-/** Removes every `@media (prefers-reduced-motion: reduce) { ... }` block, which only turns motion off. */
-function withoutReducedMotion(css) {
-  const marker = "@media (prefers-reduced-motion: reduce)";
-  let text = css;
-  for (let start = text.indexOf(marker); start >= 0; start = text.indexOf(marker)) {
-    const open = text.indexOf("{", start);
-    let depth = 0;
-    let end = open;
-    for (; end < text.length; end += 1) {
-      if (text[end] === "{") depth += 1;
-      if (text[end] === "}") depth -= 1;
-      if (depth === 0) break;
-    }
-    text = text.slice(0, start) + text.slice(end + 1);
-  }
-  return text;
-}
-
-function sheet(css) {
-  const rules = parseRules(withoutReducedMotion(stripComments(css)));
-  return {
-    /** The merged declarations of every rule that lists `selector`, later rules winning. */
-    of(selector) {
-      const merged = {};
-      for (const rule of rules) {
-        if (rule.selectors.includes(selector)) Object.assign(merged, rule.declarations);
-      }
-      return merged;
-    },
-    has(selector) {
-      return rules.some((rule) => rule.selectors.includes(selector));
-    },
-    /** The resolved value of one property on `selector`. */
-    value(selector, property) {
-      return resolve(this.of(selector)[property]) ?? "";
-    },
-  };
-}
-
-// --- tokens.css --------------------------------------------------------------------
-
-const token = (name) => resolve(tokens[name]);
-check("red is the IDE's #E34671", token("--cursor-red") === "#E34671");
-check("blue is the IDE's #81A1C1", token("--cursor-blue") === "#81A1C1");
-check("cyan is the IDE's #88C0D0", token("--cursor-cyan") === "#88C0D0");
-check("the sidebar is #141414", token("--cursor-sidebar") === "#141414");
-check("the active state background is #F0F0F01E", token("--cursor-bg-active") === "#F0F0F01E");
-check("the focused state background is #F0F0F01E", token("--cursor-bg-focused") === "#F0F0F01E");
-check("the primary shadow ink is #00000066", token("--cursor-shadow-primary") === "#00000066");
-check(
-  "the secondary shadow ink is 60% of the primary",
-  token("--cursor-shadow-secondary") === "color-mix(in srgb, #00000066 60%, transparent)",
-);
-check(
-  "the tertiary shadow ink is 30% of the primary",
-  token("--cursor-shadow-tertiary") === "color-mix(in srgb, #00000066 30%, transparent)",
-);
-check(
-  "the base box-shadow stack is the IDE's three layers",
-  /0 0 0 1px .+, 0 0 4px 0(px)? .+, 0 8px 24px -2px /.test(tokens["--cursor-box-shadow-base"] ?? ""),
-);
-check(
-  "the xl box-shadow stack is the IDE's four layers",
-  /0 0 0 1px .+, 0 0 4px 0 .+, 0 12px 24px 0 .+, 0 24px 36px 0 /.test(tokens["--cursor-box-shadow-xl"] ?? ""),
-);
-check("the link color is #81A1C1", token("--cursor-text-link") === "#81A1C1");
-check("the accent is the IDE's #81A1C1", token("--cursor-accent") === "#81A1C1");
-check(
-  "the accent hover mixes 10% white into the accent",
-  token("--cursor-accent-hover") === "color-mix(in srgb, white 10%, #81A1C1)",
-);
-check(
-  "the accent at 8% is its own token",
-  token("--cursor-accent-subtle") === "color-mix(in srgb, #81A1C1 8%, transparent)",
-);
-check("the input field background is 3% of the base", token("--cursor-bg-input-field") === "color-mix(in srgb, #F0F0F0 3%, transparent)");
-check("the inverted text is #181818", token("--cursor-text-invert") === "#181818");
-check("the disabled control background is defined", (tokens["--cursor-control-disabled-bg"] ?? "") !== "");
-check("the disabled control text is defined", (tokens["--cursor-control-disabled-text"] ?? "") !== "");
-check("the extra-small radius is 2px", token("--radius-xs") === "2px");
-check("the slower duration is 300ms", token("--duration-slower") === "300ms");
-check(
-  "tertiary text aliases the Cursor tertiary tier",
-  tokens["--text-tertiary"] === "var(--cursor-text-tertiary)",
-);
-check(
-  "quaternary text aliases the Cursor quaternary tier",
-  tokens["--text-quaternary"] === "var(--cursor-text-quaternary)",
-);
-check(
-  "tertiary is the brighter of the two tiers (60% over 36%)",
-  token("--text-tertiary").includes("60%") && token("--text-quaternary").includes("36%"),
-);
-check(
-  "the code font is Cursor's stack",
-  tokens["--code-font"] === 'Consolas, Menlo, Monaco, "Droid Sans Mono", "Courier New", monospace',
-);
-check("the view scrollbar is 10px", token("--scrollbar-width") === "10px");
-check("the menu scrollbar is 7px", token("--scrollbar-width-menu") === "7px");
-check(
-  "the focus outline is 1px at the focused stroke",
-  token("--focus-outline") === "1px solid color-mix(in srgb, #F0F0F0 15%, transparent)",
-);
-check("the focus outline sits at offset -1px", token("--focus-outline-offset") === "-1px");
-
-// --- controls.css ------------------------------------------------------------------
-
-const controls = sheet(await read("controls.css"));
-
-check(".button is 24px tall", controls.value(".button", "height") === "24px");
-check(".button has 8px side padding", controls.value(".button", "padding-inline") === "8px");
-check(".button has a 6px radius", controls.value(".button", "border-radius") === "6px");
-check(".button is 13px", controls.value(".button", "font-size") === "13px");
-check(".button is weight 400", controls.value(".button", "font-weight") === "400");
-check(".button-sm is 20px tall", controls.value(".button-sm", "height") === "20px");
-check(".button-sm has a 4px radius", controls.value(".button-sm", "border-radius") === "4px");
-check(".button-xs is gone", !controls.has(".button-xs"));
-
-check(".button-primary has #181818 text", controls.value(".button-primary", "color") === "#181818");
-check(".button-primary is the accent, not gold", controls.value(".button-primary", "background") === "#81A1C1");
-check(
-  ".button-primary hover mixes 10% white into the accent",
-  controls.value(".button-primary:hover", "background") === "color-mix(in srgb, white 10%, #81A1C1)",
-);
-check(
-  ".button-secondary is an 8% fill",
-  controls.value(".button-secondary", "background").includes("8%"),
-);
-check(
-  ".button-secondary is 14% on hover",
-  controls.value(".button-secondary:hover", "background").includes("14%"),
-);
-check(".button-ghost is transparent", controls.value(".button-ghost", "background") === "transparent");
-check(
-  ".button-outline is transparent with a 12% border",
-  controls.value(".button-outline", "background") === "transparent" &&
-    controls.value(".button-outline", "border-color").includes("12%"),
-);
-check(".button-danger exists", controls.has(".button-danger"));
-check(
-  ".button:disabled uses the disabled control colors",
-  controls.value(".button:disabled", "background") === token("--cursor-control-disabled-bg") &&
-    controls.value(".button:disabled", "color") === token("--cursor-control-disabled-text"),
-);
-
-check(".input is 24px tall", controls.value(".input", "height") === "24px");
-check(".input pads 4px 5px", controls.value(".input", "padding") === "4px 5px");
-check(".input has a 1px border at 12%", controls.value(".input", "border").startsWith("1px solid") && controls.value(".input", "border").includes("12%"));
-check(".input has a 6px radius", controls.value(".input", "border-radius") === "6px");
-check(".input has a 3% fill", controls.value(".input", "background").includes("3%"));
-check(".input is 13px on an 18px line", controls.value(".input", "font-size") === "13px" && controls.value(".input", "line-height") === "18px");
-check(".input transitions in 150ms", controls.value(".input", "transition").includes("150ms"));
-check(".input border rises to 20% on focus", controls.value(".input:focus", "border-color").includes("20%"));
-
-check(".select is 12px text", controls.value(".select", "font-size") === "12px");
-check(".select has a 12% border", controls.value(".select", "border").includes("12%"));
-check(".select has a 6px radius", controls.value(".select", "border-radius") === "6px");
-check(".select pads 3px 2px 3px 6px", controls.value(".select", "padding") === "3px 2px 3px 6px");
-
-check(".switch track is 32px wide", controls.value(".switch", "width") === "32px");
-check(".switch track is 20px tall", controls.value(".switch", "height") === "20px");
-check(".switch is 14% white when off", controls.value(".switch", "background").includes("14%"));
-check(".switch is #3FA266 when on", controls.value('.switch[aria-checked="true"]', "background") === "#3FA266");
-check(".switch thumb is 16px", controls.value(".switch::after", "width") === "16px" && controls.value(".switch::after", "height") === "16px");
-check(".switch thumb is white", ["white", "#fff", "#FFFFFF"].includes(controls.value(".switch::after", "background")));
-check(".switch thumb eases over 200ms", controls.value(".switch::after", "transition").includes("200ms"));
-check(
-  ".switch thumb moves 12px when on",
-  controls.value('.switch[aria-checked="true"]::after', "transform") === "translateX(12px)",
-);
-check(".switch:disabled is dimmed", controls.has(".switch:disabled"));
-
-const focusSelectors = [".input:focus-visible", ".select:focus-visible", ".list-row:focus-visible", ".tree-row:focus-visible"];
-for (const selector of focusSelectors) {
-  check(
-    `${selector} draws the 1px outline at offset -1px`,
-    controls.value(selector, "outline") === "1px solid color-mix(in srgb, #F0F0F0 15%, transparent)" &&
-      controls.value(selector, "outline-offset") === "-1px",
-  );
-}
-
-check(
-  "menus use 7px scrollbars",
-  controls.value(".scrollbar-menu::-webkit-scrollbar", "width") === "7px",
-);
-
-// --- dropdown.css ------------------------------------------------------------------
-
-const dropdown = sheet(await read("dropdown.css"));
-check("the select menu is #181818", dropdown.value(".menu-select", "background") === "#181818");
-check("the select menu has a #F0F0F013 border", dropdown.value(".menu-select", "border").includes("#F0F0F013"));
-check("the select menu has a 6px radius", dropdown.value(".menu-select", "border-radius") === "6px");
-check("the select menu is at least 160px wide", dropdown.value(".menu-select", "min-width") === "160px");
-check("select items pad 5px 8px", dropdown.value(".menu-select .menu-item", "padding") === "5px 8px");
-check("select items rest at 0.6 opacity", dropdown.value(".menu-select .menu-item", "opacity") === "0.6");
-check("select items are fully opaque on hover", dropdown.value(".menu-select .menu-item:hover", "opacity") === "1");
-check(
-  "menu rows draw the shared focus outline",
-  dropdown.value(".menu-item:focus-visible", "outline") === "1px solid color-mix(in srgb, #F0F0F0 15%, transparent)" &&
-    dropdown.value(".menu-item:focus-visible", "outline-offset") === "-1px",
-);
-
-// The composer menu surface: the mode, model, and @ menus.
-check("the composer menu is #181818", dropdown.value(".menu-composer", "background") === "#181818");
-check(
-  "the composer menu has a 1px border at 15% of the base text color",
-  dropdown.value(".menu-composer", "border") === "1px solid color-mix(in srgb, #F0F0F0 15%, transparent)",
-);
-check("the composer menu has a 6px radius", dropdown.value(".menu-composer", "border-radius") === "6px");
-check("the composer menu pads 2px", dropdown.value(".menu-composer", "padding") === "2px");
-check("the composer menu sets 12px text", dropdown.value(".menu-composer", "font-size") === "12px");
-check(
-  "composer rows pad 2px 6px with a 4px radius and 12px text",
-  dropdown.value(".menu-composer .menu-item", "padding") === "2px 6px" &&
-    dropdown.value(".menu-composer .menu-item", "border-radius") === "4px" &&
-    dropdown.value(".menu-composer .menu-item", "font-size") === "12px",
-);
-check(
-  "composer row icons are 14px",
-  dropdown.value(".menu-composer .menu-item__icon svg", "width") === "14px" &&
-    dropdown.value(".menu-composer .menu-item__icon svg", "height") === "14px",
-);
-check(
-  "a composer row highlights #F0F0F011",
-  dropdown.value(".menu-composer .menu-item:hover", "background") === "#F0F0F011",
-);
-check(
-  "a selected composer row has no selected fill, only the check",
-  dropdown.value(".menu-composer .menu-item--selected", "background") === "transparent",
-);
-check(
-  "the composer check is 10px",
-  dropdown.value(".menu-composer .menu-item__check svg", "width") === "10px" &&
-    dropdown.value(".menu-composer .menu-item__check svg", "height") === "10px",
-);
-check(
-  "a composer row's description reads in the tertiary tier at 11px",
-  dropdown.value(".menu-composer .menu-item__description", "font-size") === "11px" &&
-    dropdown.value(".menu-composer .menu-item__description", "color").includes("60%"),
-);
-
-// --- progress.css ------------------------------------------------------------------
-
-const progress = sheet(await read("progress.css"));
-check("the settings bar is 4px", progress.value(".progress", "height") === "4px");
-check("the settings bar has a 2px radius", progress.value(".progress", "border-radius") === "2px");
-check("the settings track is 12%", progress.value(".progress", "background").includes("12%"));
-check("the settings fill eases its transform over 200ms", progress.value(".progress__fill", "transition").includes("200ms"));
-check(
-  "the indeterminate fill is a 34% bar sliding over 1.35s",
-  progress.value(".progress--indeterminate .progress__fill", "width") === "34%" &&
-    progress.value(".progress--indeterminate .progress__fill", "animation").includes("1.35s"),
-);
-check("the workbench bar is 2px", progress.value(".progress--workbench", "height") === "2px");
-check("the workbench bar has square ends", progress.value(".progress--workbench", "border-radius") === "0");
-check("the workbench fill is green", progress.value(".progress--workbench .progress__fill", "background") === "#3FA266");
-check(
-  "the workbench fill moves over 0.1s linear",
-  progress.value(".progress--workbench .progress__fill", "transition").includes("0.1s linear"),
-);
-
-// --- modal.css ---------------------------------------------------------------------
-
-const modal = sheet(await read("modal.css"));
-check("the confirmation scrim is 0.5", modal.value(".modal-overlay--confirmation", "background") === "rgba(0,0,0,.5)");
-check("the confirmation card sits 200px from the top", modal.value(".modal-overlay--confirmation", "padding-top") === "200px");
-check(
-  "the confirmation card is 300px to min(560px, 92vw)",
-  modal.value(".modal-dialog--confirmation", "min-width") === "300px" &&
-    modal.value(".modal-dialog--confirmation", "max-width") === "min(560px, 92vw)",
-);
-check("the confirmation card is #181818", modal.value(".modal-dialog--confirmation", "background") === "#181818");
-check("the confirmation card has a 1px #F0F0F013 border", modal.value(".modal-dialog--confirmation", "border") === "1px solid #F0F0F013");
-check("the confirmation card has an 8px radius", modal.value(".modal-dialog--confirmation", "border-radius") === "8px");
-check(
-  "the confirmation card has the 0 4px 20px shadow",
-  modal.value(".modal-dialog--confirmation", "box-shadow") === "0 4px 20px rgba(0,0,0,.15)",
-);
-check("the confirmation card pads 12px", modal.value(".modal-dialog--confirmation", "padding") === "12px");
-check("confirmation buttons sit 4px apart", modal.value(".modal-dialog--confirmation .modal-actions", "gap") === "4px");
-
-check("the form card is 320px wide", modal.value(".modal-dialog--form", "width") === "320px");
-check("the form card has a 12px radius", modal.value(".modal-dialog--form", "border-radius") === "12px");
-check("the form card has a 12% stroke", modal.value(".modal-dialog--form", "border").includes("12%"));
-check("the form card has no shadow", modal.value(".modal-dialog--form", "box-shadow") === "none");
-check("the form backdrop is rgba(0,0,0,.5)", modal.value(".modal-overlay--form", "background") === "rgba(0,0,0,.5)");
-check("the form card opens in 300ms", modal.value(".modal-dialog--form", "animation").includes("300ms"));
-check(
-  "the form card scales up from 0.97",
-  stripCommentsIncludes(await read("modal.css"), "scale(0.97)"),
-);
-check("the form footer pads 10px", modal.value(".modal-dialog--form .modal-actions", "padding") === "10px");
-check("the form footer has a top border at 8%", modal.value(".modal-dialog--form .modal-actions", "border-top").includes("8%"));
-
-function stripCommentsIncludes(css, needle) {
-  return stripComments(css).includes(needle);
-}
-
-// --- Toasts (toast.css) --------------------------------------------------------------
-
-const toast = sheet(await read("toast.css"));
-check("the stack sits 25px from the bottom", toast.value(".toast-stack", "inset-block-end") === "25px");
-check("the stack sits 3px from the left", toast.value(".toast-stack", "inset-inline-start") === "3px");
-check("the stack is a fixed column", toast.value(".toast-stack", "position") === "fixed" && toast.value(".toast-stack", "flex-direction") === "column");
-check("the toast card is 340px wide", toast.value(".toast", "width") === "340px");
-check("the toast card keeps a 6px margin", toast.value(".toast", "margin") === "6px");
-check("the toast card is #181818", toast.value(".toast", "background").toLowerCase() === "#181818");
-check("the toast card has no border", toast.value(".toast", "border") === "none");
-check("the toast card has the IDE's base shadow", toast.value(".toast", "box-shadow") === resolve(tokens["--cursor-box-shadow-base"]));
-check("the toast card blurs what is behind it by 40px", toast.value(".toast", "backdrop-filter") === "blur(40px)");
-check("the toast text is 12px over 16px", toast.value(".toast", "font-size") === "12px" && toast.value(".toast", "line-height") === "16px");
-check("the toast slides up over 0.3s", toast.value(".toast", "animation").includes("300ms") && toast.has("from") && toast.has("to"));
-check("no kind paints a colored edge", !toast.has(".toast-error") && !toast.has(".toast-info") && !toast.has(".toast-success"));
-check("the toast glyph is 12px", toast.value(".toast__icon svg", "width") === "12px" && toast.value(".toast__icon svg", "height") === "12px");
-check("an info glyph is #3794FF", toast.value(".toast-info .toast__icon", "color").toLowerCase() === "#3794ff");
-check("a warning glyph is #F1B467", toast.value(".toast-warning .toast__icon", "color").toLowerCase() === "#f1b467");
-check("an error glyph is #E34671", toast.value(".toast-error .toast__icon", "color").toLowerCase() === "#e34671");
-check("a success glyph is green", toast.value(".toast-success .toast__icon", "color").toLowerCase() === "#3fa266");
-check("the close X is invisible until the toast is hovered", toast.value(".toast__close", "opacity") === "0" && toast.value(".toast:hover .toast__close", "opacity") === "0.5");
-check("the close X stays in the layout, so the keyboard can reach it", toast.value(".toast__close", "display") === "flex");
-check("the close X also shows while the toast holds focus", toast.value(".toast:focus-within .toast__close", "opacity") === "0.5");
-
-// --- The status bar (status-bar.css) --------------------------------------------------
-
-const statusBar = sheet(await read("status-bar.css"));
-check("the bar's top line is an inset shadow", /^inset 0 1px 0 0 /.test(statusBar.value(".status-bar", "box-shadow")));
-check("the bar has no top border", !("border-top" in statusBar.of(".status-bar")));
-check("an item fills the 22px bar", statusBar.value(".status-bar__item", "height") === "22px");
-check("an item pads 0 5px", statusBar.value(".status-bar__item", "padding") === "0 5px");
-check("an item has square corners", statusBar.value(".status-bar__item", "border-radius") === "0");
-check("a pressed item is #F0F0F01E", statusBar.value(".status-bar__item:active", "background").toLowerCase() === "#f0f0f01e");
-check("a hovered item keeps the hover wash", statusBar.value(".status-bar__item:hover", "background") === resolve(tokens["--bg-hover"]));
-
-// --- Reduced motion ------------------------------------------------------------------
-
-/** The text of the sheet's `@media (prefers-reduced-motion: reduce)` blocks, or "". */
-function reducedMotionBlocks(css) {
-  const code = stripComments(css);
-  return code.length - withoutReducedMotion(code).length > 0
-    ? code.split("@media (prefers-reduced-motion: reduce)").slice(1).join("\n")
-    : "";
-}
-const reduced = {
-  controls: reducedMotionBlocks(await read("controls.css")),
-  progress: reducedMotionBlocks(await read("progress.css")),
-  modal: reducedMotionBlocks(await read("modal.css")),
-  toast: reducedMotionBlocks(await read("toast.css")),
-};
-check("the controls drop their transitions under reduced motion", /\.switch::after[\s\S]*transition:\s*none/.test(reduced.controls));
-check("the progress bars drop their transitions and the slide under reduced motion", /transition:\s*none/.test(reduced.progress) && /animation:\s*none/.test(reduced.progress));
-check("the form modal drops its open animation under reduced motion", /animation:\s*none/.test(reduced.modal));
-check("a toast drops its slide-up under reduced motion", /\.toast\s*\{[^}]*animation:\s*none/.test(reduced.toast));
-
-if (failures.length > 0) {
-  console.error(`skin-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("skin-css: all assertions passed");
diff --git a/crates/workshop/look/test/workshop-dropdown.mjs b/crates/workshop/look/test/workshop-dropdown.mjs
deleted file mode 100644
index bdea002db..000000000
--- a/crates/workshop/look/test/workshop-dropdown.mjs
+++ /dev/null
@@ -1,282 +0,0 @@
-// Unit test for the shared action menu (dropdown.ts), the floating menu
-// the workshop's mode chip and model picker open. Bundles the module with
-// esbuild and drives it against jsdom. Covers: opening renders a
-// role=menu of menuitem buttons and wires the trigger's
-// aria-haspopup/expanded/controls; activating an item runs its action,
-// closes the menu, and restores the trigger's prior aria attributes; a
-// danger item has the modifier class and an iconHtml renders inside
-// the item; Escape closes and returns focus to the trigger; an outside
-// pointer press closes while an inside press does not; showing from the
-// same trigger toggles the menu closed and showing from another trigger
-// swaps menus; ArrowDown/ArrowUp/Home/End move focus through the items
-// with wrapping; dispose() closes an open menu so a disposed owner leaves
-// no orphan in the DOM.
-// Run: node test/workshop-dropdown.mjs (from crates/workshop/look).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const lookDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(lookDir, "dropdown.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module imports its colocated CSS; the test drives only the JS,
-  // and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { DropdownMenu } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function menuEl() {
-  return window.document.querySelector(".menu-popup");
-}
-
-function itemsOf(menu) {
-  return [...menu.querySelectorAll(".menu-item")];
-}
-
-function pressKey(target, key) {
-  target.dispatchEvent(new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }));
-}
-
-function pointerDownOn(target) {
-  target.dispatchEvent(new window.Event("pointerdown", { bubbles: true }));
-}
-
-const trigger = window.document.createElement("button");
-trigger.type = "button";
-trigger.textContent = "open";
-window.document.body.appendChild(trigger);
-const otherTrigger = window.document.createElement("button");
-otherTrigger.type = "button";
-window.document.body.appendChild(otherTrigger);
-
-const dropdown = new DropdownMenu();
-
-// --- Opening renders the menu and wires the trigger's aria state ------------
-
-let firstClicks = 0;
-let dangerClicks = 0;
-dropdown.show(trigger, [
-  { label: "First", iconHtml: "<svg></svg>", onClick: () => (firstClicks += 1) },
-  { label: "Second", danger: true, onClick: () => (dangerClicks += 1) },
-]);
-
-{
-  const menu = menuEl();
-  check("showing appends one menu to the document", menu !== null);
-  check("the menu has role=menu", menu?.getAttribute("role") === "menu");
-  const items = itemsOf(menu);
-  check("the menu renders one button per item", items.length === 2);
-  check(
-    "every item is a type=button menuitem",
-    items.every(
-      (item) =>
-        item instanceof window.HTMLButtonElement &&
-        item.type === "button" &&
-        item.getAttribute("role") === "menuitem",
-    ),
-  );
-  check("an item renders its label", items[0]?.textContent === "First");
-  check(
-    "an iconHtml renders inside the item's icon span",
-    items[0]?.querySelector(".menu-item__icon svg") !== null,
-  );
-  check(
-    "a danger item has the danger modifier class",
-    items[1]?.classList.contains("menu-item--danger") === true &&
-      items[0]?.classList.contains("menu-item--danger") === false,
-  );
-  check("the trigger gains aria-haspopup=menu", trigger.getAttribute("aria-haspopup") === "menu");
-  check("the trigger gains aria-expanded=true", trigger.getAttribute("aria-expanded") === "true");
-  check("the trigger's aria-controls names the menu", trigger.getAttribute("aria-controls") === menu?.id);
-}
-
-// --- Arrow keys, Home, and End move focus through the items -----------------
-
-{
-  const menu = menuEl();
-  const items = itemsOf(menu);
-  pressKey(menu, "ArrowDown");
-  check("ArrowDown from the menu focuses the first item", window.document.activeElement === items[0]);
-  pressKey(menu, "ArrowDown");
-  check("ArrowDown advances to the next item", window.document.activeElement === items[1]);
-  pressKey(menu, "ArrowDown");
-  check("ArrowDown wraps from the last item to the first", window.document.activeElement === items[0]);
-  pressKey(menu, "ArrowUp");
-  check("ArrowUp wraps from the first item to the last", window.document.activeElement === items[1]);
-  pressKey(menu, "Home");
-  check("Home jumps to the first item", window.document.activeElement === items[0]);
-  pressKey(menu, "End");
-  check("End jumps to the last item", window.document.activeElement === items[1]);
-}
-
-// --- Activating an item runs its action and closes the menu -----------------
-
-{
-  itemsOf(menuEl())[0].click();
-  check("clicking an item runs its onClick once", firstClicks === 1 && dangerClicks === 0);
-  check("clicking an item closes the menu", menuEl() === null);
-  check("closing removes aria-haspopup from the trigger", trigger.getAttribute("aria-haspopup") === null);
-  check("closing removes aria-expanded from the trigger", trigger.getAttribute("aria-expanded") === null);
-  check("closing removes aria-controls from the trigger", trigger.getAttribute("aria-controls") === null);
-}
-
-// --- Escape closes and returns focus to the trigger --------------------------
-
-{
-  dropdown.show(trigger, [{ label: "Only", onClick: () => undefined }]);
-  check("the menu reopens for the Escape case", menuEl() !== null);
-  pressKey(window.document, "Escape");
-  check("Escape closes the menu", menuEl() === null);
-  check("Escape returns focus to the trigger", window.document.activeElement === trigger);
-}
-
-// --- Outside pointer presses close; inside presses do not --------------------
-
-{
-  dropdown.show(trigger, [{ label: "Only", onClick: () => undefined }]);
-  pointerDownOn(itemsOf(menuEl())[0]);
-  check("a pointer press inside the menu keeps it open", menuEl() !== null);
-  pointerDownOn(trigger);
-  check("a pointer press on the trigger keeps the menu open", menuEl() !== null);
-  pointerDownOn(window.document.body);
-  check("a pointer press outside the menu closes it", menuEl() === null);
-}
-
-// --- Same-trigger show toggles closed; another trigger swaps menus -----------
-
-{
-  dropdown.show(trigger, [{ label: "Only", onClick: () => undefined }]);
-  const first = menuEl();
-  dropdown.show(trigger, [{ label: "Only", onClick: () => undefined }]);
-  check("showing again from the same trigger toggles the menu closed", menuEl() === null);
-  check("the toggled-away menu left the document", first?.isConnected === false);
-
-  dropdown.show(trigger, [{ label: "Only", onClick: () => undefined }]);
-  const before = menuEl();
-  dropdown.show(otherTrigger, [{ label: "Other", onClick: () => undefined }]);
-  const after = menuEl();
-  check(
-    "showing from another trigger swaps to a new menu",
-    before?.isConnected === false && after !== null && after !== before,
-  );
-  check(
-    "the swap moves the aria wiring to the new trigger",
-    trigger.getAttribute("aria-expanded") === null && otherTrigger.getAttribute("aria-expanded") === "true",
-  );
-  check(
-    "one menu at a time",
-    window.document.querySelectorAll(".menu-popup").length === 1,
-  );
-}
-
-// --- The composer skin: check-only selection, descriptions, placement --------
-
-{
-  const anchored = window.document.createElement("button");
-  anchored.type = "button";
-  window.document.body.appendChild(anchored);
-  // jsdom has no layout, so the trigger's rect and the menu's measured size are stubbed.
-  anchored.getBoundingClientRect = () => ({
-    x: 40, y: 200, left: 40, right: 100, top: 200, bottom: 224, width: 60, height: 24, toJSON: () => ({}),
-  });
-  const probe = new DropdownMenu();
-  probe.show(
-    anchored,
-    [
-      { label: "Agent", description: "Plan, search, build anything", selected: true, onClick: () => undefined },
-      { label: "Plan", onClick: () => undefined },
-    ],
-    undefined,
-    { skin: "composer", className: "ws-test-menu", placement: "above", offsetX: -6 },
-  );
-  // The earlier menu from `dropdown` is still open, so the probe's is the last one.
-  const menu = [...window.document.querySelectorAll(".menu-popup")].at(-1);
-  const rows = itemsOf(menu);
-  check(
-    "the composer skin adds its classes beside the shared ones",
-    menu?.classList.contains("menu") === true &&
-      menu.classList.contains("menu-popup") &&
-      menu.classList.contains("menu-composer") &&
-      menu.classList.contains("scrollbar-menu"),
-  );
-  check("an options className lands on the menu", menu?.classList.contains("ws-test-menu") === true);
-  check(
-    "a description sits under its label in one text column",
-    rows[0]?.querySelector(".menu-item__text > .menu-item__label")?.textContent === "Agent" &&
-      rows[0]?.querySelector(".menu-item__text > .menu-item__description")?.textContent ===
-        "Plan, search, build anything",
-  );
-  check(
-    "a row without a description keeps the bare label",
-    rows[1]?.querySelector(".menu-item__text") === null &&
-      rows[1]?.querySelector(":scope > .menu-item__label")?.textContent === "Plan",
-  );
-  check(
-    "the selected row's check is a codicon, not a text glyph",
-    rows[0]?.querySelector(".menu-item__check svg") !== null &&
-      rows[0]?.querySelector(".menu-item__check")?.textContent === "",
-  );
-  check(
-    "an above placement with an offset opens at the trigger's left minus 6px",
-    menu?.style.left === "34px" && menu?.style.right === "auto",
-  );
-  check(
-    "an above placement sits over the trigger, not under it",
-    Number.parseFloat(menu?.style.top ?? "999") < 200,
-  );
-  probe.dispose();
-  anchored.remove();
-}
-
-{
-  // The plain skin is untouched: the text check, no composer classes.
-  const plain = new DropdownMenu();
-  plain.show(trigger, [{ label: "One", selected: true, onClick: () => undefined }]);
-  const last = [...window.document.querySelectorAll(".menu-popup")].at(-1);
-  check(
-    "the default skin keeps the text check and no composer class",
-    last?.classList.contains("menu-composer") === false &&
-      itemsOf(last)[0]?.querySelector(".menu-item__check")?.textContent === "✓",
-  );
-  plain.dispose();
-}
-
-// --- dispose() closes the open menu ------------------------------------------
-
-{
-  check("a menu is open before dispose", menuEl() !== null);
-  dropdown.dispose();
-  check("dispose closes the open menu", menuEl() === null);
-  check("dispose restores the trigger's aria state", otherTrigger.getAttribute("aria-expanded") === null);
-}
-
-if (failures.length > 0) {
-  console.error(`workshop-dropdown: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-dropdown: all assertions passed");
diff --git a/crates/workshop/look/toast.css b/crates/workshop/look/toast.css
deleted file mode 100644
index 8ff4dd3ef..000000000
--- a/crates/workshop/look/toast.css
+++ /dev/null
@@ -1,123 +0,0 @@
-/* The toast stack, bottom-left, in Cursor's notification-toast style on the
-   Cursor Dark tokens: a #181818 card with the IDE's base shadow and no
-   border, a 12px codicon for the severity, and a close X that shows while
-   the toast is hovered or holds focus. The stack sits 25px from the bottom,
-   which clears the 22px status bar by the IDE's 3px; a consumer whose chrome
-   differs retunes that through --toast-inset-block-end. Rules live in the
-   components layer so consumer overrides win. */
-
-@layer components {
-	.toast-stack {
-		position: fixed;
-		inset-block-end: var(--toast-inset-block-end);
-		inset-inline-start: var(--toast-inset-inline-start);
-		z-index: 60;
-		display: flex;
-		flex-direction: column;
-	}
-
-	/* The newest toast is first in the stack, so it sits on top. */
-	.toast {
-		display: flex;
-		align-items: flex-start;
-		gap: var(--space-1-5);
-		box-sizing: border-box;
-		width: var(--toast-width);
-		margin: var(--toast-margin);
-		padding: var(--space-2);
-		border: none;
-		border-radius: var(--radius);
-		background: var(--cursor-bg-elevated);
-		box-shadow: var(--cursor-box-shadow-base);
-		backdrop-filter: blur(var(--toast-blur));
-		font-size: var(--font-size-sm);
-		line-height: var(--line-height-sm);
-		color: var(--text);
-		animation: toast-slide-up var(--duration-slower) ease-out;
-	}
-
-	@keyframes toast-slide-up {
-		from {
-			opacity: 0;
-			transform: translateY(100%);
-		}
-		to {
-			opacity: 1;
-			transform: none;
-		}
-	}
-
-	.toast__icon {
-		display: flex;
-		flex: 0 0 14px;
-		align-items: center;
-		justify-content: center;
-		height: 16px;
-		margin-inline-start: 2px;
-	}
-
-	.toast__icon svg {
-		width: 12px;
-		height: 12px;
-	}
-
-	.toast-info .toast__icon {
-		color: var(--toast-icon-info);
-	}
-	.toast-success .toast__icon {
-		color: var(--toast-icon-success);
-	}
-	.toast-warning .toast__icon {
-		color: var(--toast-icon-warning);
-	}
-	.toast-error .toast__icon {
-		color: var(--toast-icon-error);
-	}
-
-	.toast__message {
-		flex: 1;
-		min-width: 0;
-		overflow-wrap: anywhere;
-	}
-
-	/* The close X: invisible until the toast is hovered or holds focus, as
-	   the IDE's toolbar container is. It hides by opacity rather than
-	   display, so the keyboard can still tab to it, and tabbing to it shows
-	   it. */
-	.toast__close {
-		display: flex;
-		flex: none;
-		align-items: center;
-		justify-content: center;
-		width: 16px;
-		height: 16px;
-		padding: 0;
-		border: none;
-		border-radius: var(--radius-sm);
-		background: transparent;
-		color: inherit;
-		opacity: 0;
-		cursor: pointer;
-	}
-
-	.toast:hover .toast__close,
-	.toast:focus-within .toast__close {
-		opacity: 0.5;
-	}
-
-	.toast__close:hover {
-		opacity: 1;
-		background: var(--cursor-toolbar-hover);
-	}
-
-	.toast__close svg {
-		width: 12px;
-		height: 12px;
-	}
-
-	@media (prefers-reduced-motion: reduce) {
-		.toast {
-			animation: none;
-		}
-	}
-}
diff --git a/crates/workshop/look/toast.ts b/crates/workshop/look/toast.ts
deleted file mode 100644
index e3c877cc9..000000000
--- a/crates/workshop/look/toast.ts
+++ /dev/null
@@ -1,155 +0,0 @@
-// The toast stack, bottom-left, in Cursor's notification-toast style
-// [Adapted: Open WebUI]: a card per message with a severity codicon, the
-// newest on top and three at most, each leaving after its severity's
-// lifetime. Hovering or focusing a toast pauses its timer and shows a
-// close X. For the Workshop family's UIs: the workshop mounts one for
-// update notifications, copy confirmations, and command failures.
-
-import "./toast.css";
-import { ICON_CHECK, ICON_CLOSE, ICON_ERROR, ICON_INFO, ICON_WARNING } from "./icons";
-
-/** How long a toast stays, by severity: info and success 15s, warning 18s, error 20s. */
-const TOAST_LIFETIME_MS = {
-  info: 15000,
-  success: 15000,
-  warning: 18000,
-  error: 20000,
-} as const;
-
-/** The most toasts the stack shows at once; a newer one pushes the oldest out. */
-const MAX_VISIBLE = 3;
-
-/** The toast severity, which picks the glyph, its color, and the lifetime. */
-export type ToastKind = keyof typeof TOAST_LIFETIME_MS;
-
-/** Each severity's codicon: a check for success, the severity glyphs for the rest. */
-const KIND_ICONS: Readonly<Record<ToastKind, string>> = {
-  info: ICON_INFO,
-  success: ICON_CHECK,
-  warning: ICON_WARNING,
-  error: ICON_ERROR,
-};
-
-/** The toast stack: one fixed-position element plus a show method. */
-export interface ToastStack {
-  /** The stack element; the composition root appends it once. */
-  element: HTMLElement;
-  /** Pushes one toast on top; it removes itself after its lifetime. */
-  show(message: string, kind: ToastKind): void;
-}
-
-/**
- * Schedules a callback without keeping a Node test process alive:
- * Node's setTimeout returns a handle with `unref`, the browser's
- * returns a number and the optional call is a no-op. Answers the
- * function that cancels the callback.
- */
-export function scheduleTimeout(callback: () => void, ms: number): () => void {
-  const timer = setTimeout(callback, ms);
-  (timer as unknown as { unref?: () => void }).unref?.();
-  return () => clearTimeout(timer);
-}
-
-/** One toast on the stack and the handle that removes it early. */
-interface LiveToast {
-  readonly element: HTMLElement;
-  /** Removes the toast and cancels its timer. Safe to call twice. */
-  dismiss(): void;
-}
-
-/** Creates the toast stack. */
-export function createToastStack(): ToastStack {
-  const element = document.createElement("div");
-  element.className = "toast-stack";
-  // A live region: screen readers announce each appended toast.
-  element.setAttribute("role", "status");
-  element.setAttribute("aria-live", "polite");
-
-  // Newest first, matching the DOM order top to bottom.
-  const live: LiveToast[] = [];
-
-  function build(message: string, kind: ToastKind): LiveToast {
-    const toast = document.createElement("div");
-    toast.className = `toast toast-${kind}`;
-
-    const icon = document.createElement("span");
-    icon.className = "toast__icon";
-    icon.setAttribute("aria-hidden", "true");
-    icon.innerHTML = KIND_ICONS[kind];
-
-    const text = document.createElement("span");
-    text.className = "toast__message";
-    text.textContent = message;
-
-    const close = document.createElement("button");
-    close.type = "button";
-    close.className = "toast__close";
-    close.setAttribute("aria-label", "Clear Notification");
-    close.innerHTML = ICON_CLOSE;
-
-    toast.append(icon, text, close);
-
-    // The timer runs while nothing holds the toast. Hover and focus each
-    // hold it: a hold cancels the timer and keeps the unspent time, and
-    // the last release restarts the timer with what was left.
-    let remaining: number = TOAST_LIFETIME_MS[kind];
-    let startedAt = Date.now();
-    let cancelTimer: (() => void) | null = null;
-    let holds = 0;
-    let dismissed = false;
-
-    const dismiss = (): void => {
-      if (dismissed) {
-        return;
-      }
-      dismissed = true;
-      cancelTimer?.();
-      cancelTimer = null;
-      toast.remove();
-      const index = live.findIndex((entry) => entry.element === toast);
-      if (index !== -1) {
-        live.splice(index, 1);
-      }
-    };
-    const start = (): void => {
-      startedAt = Date.now();
-      cancelTimer = scheduleTimeout(dismiss, remaining);
-    };
-    const hold = (): void => {
-      holds += 1;
-      if (holds === 1 && cancelTimer !== null) {
-        cancelTimer();
-        cancelTimer = null;
-        remaining = Math.max(0, remaining - (Date.now() - startedAt));
-      }
-    };
-    const release = (): void => {
-      holds = Math.max(0, holds - 1);
-      if (holds === 0 && !dismissed && cancelTimer === null) {
-        start();
-      }
-    };
-
-    toast.addEventListener("mouseenter", hold);
-    toast.addEventListener("mouseleave", release);
-    toast.addEventListener("focusin", hold);
-    toast.addEventListener("focusout", release);
-    close.addEventListener("click", dismiss);
-    start();
-
-    return { element: toast, dismiss };
-  }
-
-  return {
-    element,
-    show(message: string, kind: ToastKind): void {
-      const toast = build(message, kind);
-      live.unshift(toast);
-      element.prepend(toast.element);
-      // The oldest sit at the end; push out whatever no longer fits.
-      while (live.length > MAX_VISIBLE) {
-        live[live.length - 1]?.dismiss();
-      }
-    },
-  };
-}
diff --git a/crates/workshop/look/tokens.css b/crates/workshop/look/tokens.css
deleted file mode 100644
index 34820db2b..000000000
--- a/crates/workshop/look/tokens.css
+++ /dev/null
@@ -1,420 +0,0 @@
-/* ==========================================================================
-   Workshop family Cursor Dark palette sheet
-
-   The palette tier of @workshop/look and the single source of truth for
-   every visual value the Workshop family's UIs share: palette, type,
-   spacing, radius, and the status bar's progress and LED effects. No
-   component stylesheet hardcodes a color or a themed length. The Gateway
-   config UI keeps its own copy in crates/shared-ui; edits here never
-   reach it.
-
-   The surface, text, border, spacing, radius, shadow, and motion values
-   mirror Cursor's dark theme (extracted from its workbench tokens), with
-   the IDE's own overrides for red, blue, cyan, the sidebar, the state
-   backgrounds, and the shadow inks. The --cursor-* values are exact
-   copies from Cursor's installed theme and workbench stylesheet - never
-   approximate them, and keep the color-mix() formulas intact (never
-   encode premultiplied RGB as straight-alpha hex). --accent stays
-   Runvil gold for the surfaces that have not moved to Cursor's
-   accent yet; Cursor's own accent is --cursor-accent.
-
-   The :root block is the workshop's original sheet, copied over verbatim.
-   ========================================================================== */
-
-:root {
-  /* Cursor Dark primitives (from cursor-dark-color-theme.json + JS registry) */
-  --cursor-base: #F0F0F0;
-  --cursor-chrome: #141414;
-  --cursor-editor: #181818;
-  --cursor-sidebar: #141414;
-  --cursor-focus: #F0F0F0;
-  /* The IDE's accent is its button background, which is also its link color. */
-  --cursor-accent: #81A1C1;
-  --cursor-brand: #F54E00;
-  --cursor-blue: #81A1C1;
-  --cursor-cyan: #88C0D0;
-  --cursor-green: #3FA266;
-  --cursor-red: #E34671;
-  --cursor-danger: #E34671;
-  --cursor-yellow: #F1B467;
-  --cursor-magenta: #B48EAD;
-  --cursor-orange: #D08770;
-  --cursor-purple: #9386F2;
-  --cursor-multitask: #B180D7;
-
-  /* Cursor Dark derived surfaces */
-  --cursor-bg-quinary: color-mix(in srgb, var(--cursor-base) 4%, transparent);
-  --cursor-bg-quaternary: color-mix(in srgb, var(--cursor-base) 6%, transparent);
-  --cursor-bg-tertiary: color-mix(in srgb, var(--cursor-base) 8%, transparent);
-  --cursor-bg-secondary: color-mix(in srgb, var(--cursor-base) 14%, transparent);
-  --cursor-bg-primary: color-mix(in srgb, var(--cursor-base) 20%, transparent);
-  --cursor-bg-active: #F0F0F01E;
-  --cursor-bg-focused: #F0F0F01E;
-  /* The IDE's toolbar-button hover wash (tab closers, pane header buttons) */
-  --cursor-toolbar-hover: #5A5D5E50;
-  --cursor-bg-card: var(--cursor-bg-quaternary);
-  --cursor-bg-elevated: #181818;
-  --cursor-bg-input-surface: var(--cursor-bg-quaternary);
-  --cursor-bg-input-field: color-mix(in srgb, var(--cursor-base) 3%, transparent);
-
-  /* Cursor Dark accent (the IDE's primary button and link color) */
-  --cursor-accent-hover: color-mix(in srgb, white 10%, var(--cursor-accent));
-  --cursor-accent-subtle: color-mix(in srgb, var(--cursor-accent) 8%, transparent);
-
-  /* Cursor Dark disabled controls */
-  --cursor-control-disabled-bg: var(--cursor-bg-tertiary);
-  --cursor-control-disabled-text: var(--cursor-text-quaternary);
-
-  /* Cursor Dark derived strokes */
-  --cursor-stroke-quaternary: color-mix(in srgb, var(--cursor-base) 4%, transparent);
-  --cursor-stroke-tertiary: color-mix(in srgb, var(--cursor-base) 8%, transparent);
-  --cursor-stroke-secondary: color-mix(in srgb, var(--cursor-base) 12%, transparent);
-  --cursor-stroke-primary: color-mix(in srgb, var(--cursor-base) 20%, transparent);
-  --cursor-stroke-focused: color-mix(in srgb, var(--cursor-focus, var(--cursor-base)) 15%, transparent);
-
-  /* Cursor Dark derived text */
-  --cursor-text-primary: #F0F0F0;
-  --cursor-text-secondary: color-mix(in srgb, var(--cursor-base) 74%, transparent);
-  --cursor-text-tertiary: color-mix(in srgb, var(--cursor-base) 60%, transparent);
-  --cursor-text-quaternary: color-mix(in srgb, var(--cursor-base) 36%, transparent);
-  --cursor-text-link: #81A1C1;
-  --cursor-text-invert: #181818;
-
-  /* Cursor Dark derived icons */
-  --cursor-icon-primary: #F0F0F0;
-  --cursor-icon-secondary: color-mix(in srgb, var(--cursor-base) 66%, transparent);
-  --cursor-icon-tertiary: color-mix(in srgb, var(--cursor-base) 52%, transparent);
-  --cursor-icon-quaternary: color-mix(in srgb, var(--cursor-base) 28%, transparent);
-
-  /* Cursor Dark shadows: the IDE derives the secondary and tertiary inks
-     as 60% and 30% of the widget shadow, and builds its box-shadow stacks
-     from them. The stacks' 1px ring is the widget border. */
-  --cursor-shadow-primary: #00000066;
-  --cursor-shadow-secondary: color-mix(in srgb, var(--cursor-shadow-primary) 60%, transparent);
-  --cursor-shadow-tertiary: color-mix(in srgb, var(--cursor-shadow-primary) 30%, transparent);
-  --cursor-box-shadow-base:
-    0 0 0 1px var(--cursor-stroke-tertiary),
-    0 0 4px 0px var(--cursor-shadow-secondary),
-    0 8px 24px -2px var(--cursor-shadow-secondary);
-  --cursor-box-shadow-xl:
-    0 0 0 1px var(--cursor-stroke-tertiary),
-    0 0 4px 0 var(--cursor-shadow-secondary),
-    0 12px 24px 0 var(--cursor-shadow-secondary),
-    0 24px 36px 0 var(--cursor-shadow-secondary);
-
-  /* VS Code theme surfaces (white-based alpha, for desk chrome) */
-  --bg: #181818;
-  --bg-raised: #141414;
-  --bg-hover: #F0F0F011;
-  --bg-card: #F0F0F00A;
-  --bg-input: #F0F0F00A;
-  --bg-elevated: #181818;
-
-  /* Text and borders (opacity tiers over the dark surfaces) */
-  --text: #F0F0F0;
-  --text-muted: #F0F0F0BD;
-  /* The quietest label: an inactive editor tab, the tree's section title */
-  --text-faint: #F0F0F05C;
-  --text-tertiary: var(--cursor-text-tertiary);
-  --text-quaternary: var(--cursor-text-quaternary);
-  --input-placeholder: #F0F0F099;
-  --border: #F0F0F013;
-  --border-subtle: #F0F0F011;
-
-  /* Dock and tree: an editor tab in a group that is not the active one washes
-     on hover; the tree's indent guides are dim while it is hovered and lit
-     for the list holding the focused row */
-  --tab-unfocused-hover: #2A2A2AB3;
-  --tree-indent-guide: var(--border);
-  --tree-indent-guide-active: #F0F0F030;
-
-  /* Accent and semantics */
-  --accent: #e4b570;
-  --accent-dim: #b89059;
-  --accent-bright: color-mix(in srgb, var(--accent) 88%, #ffffff);
-  --danger: #E34671;
-  --danger-text: #FC6B83;
-  --on-danger: #ffffff;
-  --hover-glow: var(--accent, #e4b570);
-  --color-red: var(--cursor-red);
-  --color-green: #3FA266;
-  --color-yellow: #F1B467;
-  --color-cyan: var(--cursor-cyan);
-  --color-blue: var(--cursor-blue);
-  --color-purple: #9386F2;
-
-  /* Type */
-  --font-prose: -apple-system, BlinkMacSystemFont, "Segoe WPC", "Segoe UI", sans-serif;
-  --code-font: Consolas, Menlo, Monaco, "Droid Sans Mono", "Courier New", monospace;
-  --font-size-xs: 11px;
-  --font-size-sm: 12px;
-  --font-size-base: 13px;
-  --font-size-lg: 14px;
-  --line-height-xs: 14px;
-  --line-height-sm: 16px;
-  --line-height-base: 18px;
-  --line-height-lg: 22px;
-  --letter-spacing-base: -0.08px;
-  --letter-spacing-lg: -0.15px;
-  --font-weight-medium: 500;
-  --font-weight-semibold: 590;
-
-  /* Spacing scale (4px base unit) */
-  --space-1: 4px;
-  --space-1-5: 6px;
-  --space-2: 8px;
-  --space-3: 12px;
-  --space-4: 16px;
-  --space-5: 20px;
-  --space-6: 24px;
-  --space-7: 28px;
-  --space-8: 32px;
-  --space-9: 36px;
-  --space-10: 40px;
-  --space-11: 44px;
-  --space-12: 48px;
-  --space-13: 52px;
-  --space-14: 56px;
-  --space-15: 60px;
-  --space-16: 64px;
-  --space-17: 68px;
-  --space-18: 72px;
-  --space-19: 76px;
-  --space-20: 80px;
-
-  /* Radius */
-  --radius-xs: 2px;
-  --radius: 6px;
-  --radius-sm: 4px;
-  --radius-lg: 8px;
-  --radius-xl: 12px;
-  --radius-full: 9999px;
-
-  /* Control heights */
-  --height-xs: 20px;
-  --height-sm: 24px;
-  --height-base: 28px;
-  --height-lg: 32px;
-
-  /* Shadows */
-  --shadow-primary: var(--cursor-shadow-primary);
-  --shadow-secondary: var(--cursor-shadow-secondary);
-  --shadow-tertiary: var(--cursor-shadow-tertiary);
-  --shadow-popup: 0 3px 8px var(--cursor-shadow-secondary), 0 2px 5px var(--cursor-shadow-secondary), 0 1px 1px var(--cursor-shadow-secondary);
-
-  /* Syntax highlighting (code blocks): the agent's markdown fills Shiki's
-     --shiki-* slots from these. The IDE reads the Cursor Dark editor theme
-     for the foreground (#F0F0F0) and the comment (#F0F0F099, italic); the
-     rest are Cursor's syntax defaults. */
-  --syntax-bg: #181818;
-  --syntax-fg: #F0F0F0;
-  --syntax-keyword: #82D2CE;
-  --syntax-string: #E394DC;
-  --syntax-string-expression: #E394DC;
-  --syntax-function: #EFB080;
-  --syntax-number: #EBC88C;
-  --syntax-comment: #F0F0F099;
-  --syntax-constant: #F8C762;
-  --syntax-link: #87C3FF;
-  --syntax-parameter: #D6D6DD;
-  --syntax-punctuation: #D6D6DD;
-
-  /* Editor (CodeMirror): Cursor Dark's editor.* theme colors over Monaco's
-     stock geometry. The surface's theme and highlight style read these. */
-  --editor-bg: #181818;
-  --editor-fg: #F0F0F0;
-  --editor-font-size: 14px;
-  --editor-line-height: 19px;
-  --editor-gutter-bg: #181818;
-  --editor-line-number: #F0F0F05C;
-  --editor-line-number-active: #F0F0F0;
-  --editor-line-number-min-width: 5ch;
-  --editor-glyph-margin: 19px;
-  --editor-fold-lane: 26px;
-  --editor-current-line: #262626;
-  --editor-selection: #40404099;
-  --editor-selection-inactive: #40404077;
-  --editor-selection-radius: 3px;
-  --editor-cursor: #F0F0F0;
-  --editor-cursor-width: 2px;
-  --editor-cursor-shift: -1px;
-  --editor-find-match: #88C0D044;
-  --editor-find-match-current: #88C0D066;
-  --editor-word-highlight: #F0F0F01E;
-  --editor-selection-highlight: #404040CC;
-  --editor-bracket-match: #F0F0F01E;
-  --editor-whitespace: #505050B3;
-  --editor-fold-chevron: #C5C5C5;
-  --editor-fold-fade: 0.5s;
-  --editor-fold-placeholder: #808080;
-  --editor-scrollbar-width: 14px;
-  --editor-scrollbar-height: 12px;
-  --editor-scrollbar-thumb: #F0F0F011;
-  --editor-scrollbar-thumb-hover: #F0F0F01E;
-  /* The floating find widget: 419px wide, 33px rows, 28px from the right */
-  --editor-widget-bg: #141414;
-  --editor-find-width: 419px;
-  --editor-find-row-height: 33px;
-  --editor-find-right: 28px;
-  --editor-find-field-height: 24px;
-  --editor-find-button-size: 22px;
-  --editor-find-count-width: 69px;
-
-  /* Editor syntax: the Cursor Dark theme's tokenColors, by lezer tag */
-  --editor-token-keyword: #82D2CE;
-  --editor-token-operator: #D6D6DD;
-  --editor-token-punctuation: #D6D6DD;
-  --editor-token-string: #E394DC;
-  --editor-token-number: #EBC88D;
-  --editor-token-constant: var(--editor-fg);
-  --editor-token-comment: #F0F0F099;
-  --editor-token-type: #EFB080;
-  --editor-token-function: #EFB080;
-  --editor-token-variable: #87C3FF;
-  --editor-token-constant-variable: #AAA0FA;
-  --editor-token-property: #AAA0FA;
-  --editor-token-attribute: #AAA0FA;
-  --editor-token-tag: #87C3FF;
-  --editor-token-tag-punctuation: #A4A4A4;
-  --editor-token-heading: #88C0D0;
-  --editor-token-link: #82D2CE;
-  --editor-token-strong: #F8C762;
-  --editor-token-emphasis: #82D2CE;
-  --editor-token-invalid: #D6D6DD;
-
-  /* Motion */
-  --duration-instant: 50ms;
-  --duration-fast: 100ms;
-  --duration-normal: 150ms;
-  --duration-slow: 200ms;
-  --duration-slower: 300ms;
-  --ease-out-cubic: cubic-bezier(0.215, 0.61, 0.355, 1);
-  --ease-out-quint: cubic-bezier(0.16, 1, 0.3, 1);
-
-  /* Component tokens (consumed by the agent-window components) */
-  --mention-bg: color-mix(in srgb, var(--cursor-blue) 24%, transparent);
-  --mention-text: var(--cursor-blue);
-  --tool-card-bg: #181818;
-  --tool-card-border: var(--cursor-stroke-tertiary);
-  --tool-card-header-height: 28px;
-  --prompt-input-bg: color-mix(in srgb, var(--bg-input) 90%, transparent);
-  --prompt-input-border: var(--cursor-stroke-secondary);
-  --prompt-input-border-focus: var(--cursor-stroke-primary);
-  --prompt-input-min-height: 22px;
-  --prompt-input-max-height: 240px;
-  --prompt-input-radius: 6px;
-  --model-trigger-height: 20px;
-  --model-trigger-radius: 4px;
-  --token-ring-track: var(--cursor-stroke-tertiary);
-  --token-ring-fill: var(--cursor-icon-secondary);
-  --agent-max-width: 840px;
-  --agent-card-radius: 12px;
-  --feed-padding-inline: 12px;
-  --feed-row-gap: 14px;
-  --agent-outer-padding: 10px;
-  --bubble-radius: 12px;
-  --assistant-inset: 13px;
-  --space-2-5: 10px;
-  --token-ring-size: 15px;
-
-  /* Toasts: Cursor's notification toast. The stack sits 25px from the bottom
-     (the 22px status bar plus the IDE's 3px) and 3px from the left; a card is
-     340px wide with a 6px margin and blurs what is behind it by 40px. The
-     severity glyphs use the IDE's own info blue, which is not the accent. */
-  --toast-width: 340px;
-  --toast-margin: 6px;
-  --toast-blur: 40px;
-  --toast-inset-block-end: 25px;
-  --toast-inset-inline-start: 3px;
-  --toast-icon-info: #3794FF;
-  --toast-icon-success: var(--cursor-green);
-  --toast-icon-warning: var(--cursor-yellow);
-  --toast-icon-error: var(--cursor-red);
-
-  /* Status bar */
-  --status-bar-height: 22px;
-  --status-bar-bg: #141414;
-  --status-bar-text: #F0F0F099;
-  --status-bar-text-error: #FC6B83;
-  --status-bar-padding-inline: 7px;
-  --status-bar-gap: 3px;
-  --status-bar-item-padding-inline: 5px;
-
-  /* Status bar barberpole (the fill and track also color the block
-     progress bar in progress.css) */
-  --progress-width: 144px; /* 1.5in at CSS 96dpi; px so it composes with sibling px tokens */
-  --progress-height: 6px; /* also sets the stripe width: one stripe is one bar height */
-  --progress-fill: #3FA266; /* the sliding stripes */
-  --progress-track: #F0F0F011; /* the gaps between stripes */
-  --progress-glow: 4px; /* blur radius of the barberpole's box-shadow glow */
-
-  /* Status bar activity LED */
-  --led-size: 10px;
-  --led-green: #3FA266;
-  --led-amber: #F1B467;
-  --led-red: #ff2a4d;
-  --led-off: #F0F0F011;
-  --led-core: #ffffff;
-  --led-glow-radius: 6px;
-  --led-pulse-ms: 250ms;
-  --led-fade-in-ms: 60ms;
-  --led-lens-highlight: #F0F0F02E;
-  --led-lens-shadow: #00000073;
-
-  /* Status bar mic meter */
-  --meter-height: 12px; /* a full-scale bar */
-  --meter-bar-width: 2px; /* also the diameter of a silent or idle bar's dot */
-  --meter-bar-gap: 1px;
-  --meter-live: var(--led-green);
-  --meter-idle: var(--text-tertiary);
-
-  /* Window title bar (custom Windows chrome) */
-  --titlebar-height: 35px;
-  --titlebar-bg: #141414;
-  --titlebar-foreground: #F0F0F084;
-  /* Cursor's inactive-window title-bar text is brighter than its active text */
-  --titlebar-foreground-inactive: #F0F0F099;
-  --titlebar-divider: #F0F0F013;
-  --titlebar-accent: var(--accent);
-  --titlebar-glyph: #F0F0F084;
-  --titlebar-hover: #F0F0F011;
-  --titlebar-control-hover: #FFFFFF1A;
-  --titlebar-folder-hover: #FFFFFF14;
-  --titlebar-control-width: 46px;
-  --titlebar-close-hover: #E81123E6;
-  --titlebar-close-glyph-hover: #ffffff;
-  /* The app icon is 16px, centered in a box as tall as the bar and flush to the left edge */
-  --titlebar-icon-size: 16px;
-  --titlebar-icon-box: var(--titlebar-height);
-  --titlebar-tool-size: 22px;
-  --titlebar-font-size: 13px;
-  /* left inset clearing the native traffic lights under macOS overlay chrome */
-  --titlebar-macos-inset: 78px;
-  --titlebar-popover-min-width: 160px;
-  --titlebar-popover-shadow: 0 2px 8px rgba(0, 0, 0, 0.4);
-  /* A disabled menu row's label, dimmer than the row's own half opacity leaves it */
-  --menu-disabled-label: #CCCCCC80;
-
-  /* Scrollbars: views use square bars shown while the scroller is hovered
-     (applied globally by the consuming UI's base sheet); menus use the
-     narrower bar (.scrollbar-menu in controls.css) */
-  --scrollbar-width: 10px;
-  --scrollbar-width-menu: 7px;
-  --scrollbar-thumb: #F0F0F011;
-  --scrollbar-thumb-hover: #F0F0F01E;
-
-  /* Keybinding chips (the IDE's keybindingLabel colors) and the quick input's
-     group-label line and filter-match color (pickerGroup.border and
-     list.highlightForeground) */
-  --keybinding-label-bg: #8080802B;
-  --keybinding-label-text: #CCCCCC;
-  --keybinding-label-border: #33333399;
-  --keybinding-label-border-bottom: #44444499;
-  --quick-input-separator: #F0F0F01C;
-  --list-highlight: var(--cursor-cyan);
-
-  /* Focus: Cursor draws a 1px outline inside list rows, tree rows, menu
-     rows, and inputs (controls.css and dropdown.css apply it) */
-  --focus-outline: 1px solid var(--cursor-stroke-focused);
-  --focus-outline-offset: -1px;
-}
diff --git a/crates/workshop/look/tsconfig.json b/crates/workshop/look/tsconfig.json
deleted file mode 100644
index 522d4a93f..000000000
--- a/crates/workshop/look/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "noEmit": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "verbatimModuleSyntax": true,
-    "noFallthroughCasesInSwitch": true,
-    "forceConsistentCasingInFileNames": true
-  },
-  "include": ["*.ts"]
-}
diff --git a/crates/workshop/menu/Cargo.toml b/crates/workshop/menu/Cargo.toml
deleted file mode 100644
index 04e7e15bc..000000000
--- a/crates/workshop/menu/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "workshop-menu"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-tracing.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-support.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/menu/src/catalog-chat.rs b/crates/workshop/menu/src/catalog-chat.rs
deleted file mode 100644
index f2754620e..000000000
--- a/crates/workshop/menu/src/catalog-chat.rs
+++ /dev/null
@@ -1,66 +0,0 @@
-//! Chat-capable catalog generation tracking.
-
-use std::sync::{Arc, Mutex, PoisonError};
-
-use tokio::sync::watch;
-
-/// One immutable chat-capable catalog generation.
-#[derive(Debug, Clone, Default)]
-pub struct ChatCatalog {
-    /// Monotonically increasing whenever the chat-capable subset changes.
-    pub generation: u64,
-    /// The chat-capable entries for this generation.
-    pub models: Vec<serde_json::Value>,
-}
-
-/// Shared retained chat catalog and its generation notification.
-#[derive(Debug, Clone)]
-pub(super) struct ChatCatalogBus {
-    latest: Arc<Mutex<ChatCatalog>>,
-    generation: watch::Sender<u64>,
-}
-
-impl ChatCatalogBus {
-    /// Creates an empty generation tracker.
-    pub(super) fn new() -> Self {
-        Self {
-            latest: Arc::new(Mutex::new(ChatCatalog::default())),
-            generation: watch::channel(0).0,
-        }
-    }
-
-    /// Returns the current generation only when it can serve chat.
-    pub(super) fn latest(&self) -> Option<ChatCatalog> {
-        let chat = self
-            .latest
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .clone();
-        (!chat.models.is_empty()).then_some(chat)
-    }
-
-    /// Subscribes to changes of the chat-capable subset.
-    pub(super) fn subscribe(&self) -> watch::Receiver<u64> {
-        self.generation.subscribe()
-    }
-
-    /// Replaces the retained generation with `models`, which the catalog
-    /// bus has already filtered to chat-capable entries, advancing only
-    /// when they change. Transcription-only churn does not disturb chat
-    /// runs.
-    pub(super) fn publish(&self, models: &[serde_json::Value]) {
-        let changed = {
-            let mut latest = self.latest.lock().unwrap_or_else(PoisonError::into_inner);
-            if latest.models == models {
-                None
-            } else {
-                latest.generation = latest.generation.wrapping_add(1);
-                latest.models = models.to_vec();
-                Some(latest.generation)
-            }
-        };
-        if let Some(generation) = changed {
-            self.generation.send_replace(generation);
-        }
-    }
-}
diff --git a/crates/workshop/menu/src/catalog-tests.rs b/crates/workshop/menu/src/catalog-tests.rs
deleted file mode 100644
index bd3a652a7..000000000
--- a/crates/workshop/menu/src/catalog-tests.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-//! Catalog bus tests: publishing without subscribers, snapshot retention, lagged receivers, and the chat-capable filter.
-
-use super::*;
-
-#[test]
-fn a_publish_keeps_only_chat_capable_models_and_non_chat_churn_keeps_the_generation() {
-    let bus = CatalogBus::new();
-    bus.publish(vec![
-        serde_json::json!({"id": "chat-model"}),
-        serde_json::json!({"id": "whisper-base", "kind": "transcription"}),
-    ]);
-    assert_eq!(
-        bus.latest().expect("the publish is retained").models,
-        [serde_json::json!({"id": "chat-model"})],
-        "the push holds only the chat-capable entries"
-    );
-    let generation = bus
-        .latest_chat()
-        .expect("a chat model was published")
-        .generation;
-    bus.publish(vec![
-        serde_json::json!({"id": "chat-model"}),
-        serde_json::json!({"id": "whisper-small", "kind": "transcription"}),
-    ]);
-    assert_eq!(
-        bus.latest_chat()
-            .expect("the chat model is still published")
-            .generation,
-        generation,
-        "transcription-only churn leaves the chat generation alone"
-    );
-}
-
-#[tokio::test]
-async fn publishing_with_no_subscribers_is_a_no_op() {
-    let bus = CatalogBus::new();
-    bus.publish(vec![serde_json::json!({"id": "test-model"})]);
-}
-
-#[test]
-fn the_newest_push_is_retained_for_the_connect_snapshot() {
-    let bus = CatalogBus::new();
-    assert!(bus.latest().is_none(), "an untouched bus has no snapshot");
-    bus.publish(vec![serde_json::json!({"id": "old"})]);
-    bus.publish(vec![serde_json::json!({"id": "new"})]);
-    let latest = bus.latest().expect("the bus retains the newest push");
-    assert_eq!(
-        latest.models[0]["id"], "new",
-        "a session connecting now snapshots the newest catalog"
-    );
-}
-
-#[tokio::test]
-async fn a_lagged_receiver_skips_ahead_instead_of_blocking() {
-    let bus = CatalogBus::new();
-    let mut receiver = bus.subscribe();
-    for index in 0..=CATALOG_CHANNEL_CAPACITY {
-        bus.publish(vec![serde_json::json!({"id": format!("model-{index}")})]);
-    }
-    match receiver.recv().await {
-        Err(broadcast::error::RecvError::Lagged(1)) => {}
-        other => panic!("expected a lag report of one, got {other:?}"),
-    }
-    let resumed = receiver.recv().await.expect("the ring still holds pushes");
-    assert_eq!(
-        resumed.models[0]["id"], "model-1",
-        "receiving resumes at the oldest retained push"
-    );
-}
diff --git a/crates/workshop/menu/src/catalog.rs b/crates/workshop/menu/src/catalog.rs
deleted file mode 100644
index 9a98f76bb..000000000
--- a/crates/workshop/menu/src/catalog.rs
+++ /dev/null
@@ -1,95 +0,0 @@
-//! The chat-capable model catalog push channel, rebroadcast to every
-//! connected `/ws` session as a `{"type":"models",...}` frame.
-//!
-//! The heartbeat republishes the catalog when the gateway comes back
-//! (unreachable to connected), so a UI that booted while the gateway was
-//! down refreshes its model picker without a reload. The channel is a
-//! [`RetainedBus`]: publishing never blocks, a publish with no sessions
-//! is a no-op, and a lagging session skips ahead - every push is a
-//! complete snapshot, so an overwritten one loses nothing. The bus also
-//! retains the newest push, so a session that connects later sends the
-//! current catalog immediately - the delivery contract's
-//! resend-on-reconnect for ephemeral frames.
-
-use tokio::sync::{broadcast, watch};
-
-use workshop_protocol::CatalogPush;
-use workshop_support::RetainedBus;
-
-#[path = "catalog-chat.rs"]
-mod chat;
-pub use chat::ChatCatalog;
-use chat::ChatCatalogBus;
-pub use workshop_protocol::is_chat_capable;
-
-/// Ring capacity of the catalog bus. Pushes are rare (one per gateway
-/// reconnect) and each is a full snapshot, so a handful of slots is
-/// generous.
-const CATALOG_CHANNEL_CAPACITY: usize = 4;
-
-/// The shared catalog bus: a cloneable handle onto the broadcast channel,
-/// mirroring the status subsystem's [`RetainedBus`]-backed status bus.
-#[derive(Debug, Clone)]
-pub struct CatalogBus {
-    bus: RetainedBus<CatalogPush>,
-    chat: ChatCatalogBus,
-}
-
-impl CatalogBus {
-    /// Creates a bus with no subscribers, an empty ring, and no snapshot.
-    #[must_use]
-    pub fn new() -> Self {
-        Self {
-            bus: RetainedBus::new(CATALOG_CHANNEL_CAPACITY),
-            chat: ChatCatalogBus::new(),
-        }
-    }
-
-    /// Subscribes to every push sent from this call onward.
-    #[must_use]
-    pub fn subscribe(&self) -> broadcast::Receiver<CatalogPush> {
-        self.bus.subscribe()
-    }
-
-    /// The most recently published catalog, retained so a session
-    /// connecting later can send the current catalog as its snapshot.
-    #[must_use]
-    pub fn latest(&self) -> Option<CatalogPush> {
-        self.bus.latest()
-    }
-
-    /// The current non-empty chat-capable catalog generation.
-    #[must_use]
-    pub fn latest_chat(&self) -> Option<ChatCatalog> {
-        self.chat.latest()
-    }
-
-    /// Subscribes to chat-capable catalog generation changes.
-    #[must_use]
-    pub fn subscribe_chat_generation(&self) -> watch::Receiver<u64> {
-        self.chat.subscribe()
-    }
-
-    /// Broadcasts one catalog, keeping only its chat-capable entries. With
-    /// no subscribers this is a no-op; a slow subscriber skips ahead
-    /// rather than applying backpressure.
-    ///
-    /// This is the catalog's only chat-capable filter: the chat
-    /// generation and the menu read the filtered push as is.
-    pub fn publish(&self, models: Vec<serde_json::Value>) {
-        let models = models.into_iter().filter(is_chat_capable).collect();
-        let push = CatalogPush { models };
-        self.chat.publish(&push.models);
-        self.bus.send(push);
-    }
-}
-
-impl Default for CatalogBus {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-#[path = "catalog-tests.rs"]
-mod tests;
diff --git a/crates/workshop/menu/src/handles.rs b/crates/workshop/menu/src/handles.rs
deleted file mode 100644
index 79c5ef4ac..000000000
--- a/crates/workshop/menu/src/handles.rs
+++ /dev/null
@@ -1,96 +0,0 @@
-//! The menu subsystem's registration and any handle types. It registers
-//! the catalog sink and the workbench sink the registry's push facade
-//! drives, and [`MenuHandles`] - the chat model catalog channel and the
-//! workbench bus - as its state handle set, which the composition root
-//! requires by type.
-
-use std::sync::Arc;
-
-use workshop_registry::{
-    CatalogSink, CatalogSinkAdapter, MenuSink, MenuSinkAdapter, Registration, Registry,
-};
-
-use crate::{CatalogBus, MenuBus};
-
-/// The menu subsystem's state handles: the chat model catalog channel
-/// and the workbench bus, bundled for registration into the subsystem
-/// registry so the composition root fetches them by slot instead of
-/// holding them by name.
-#[derive(Debug, Clone)]
-pub struct MenuHandles {
-    catalog: CatalogBus,
-    menu: MenuBus,
-}
-
-impl MenuHandles {
-    /// Bundles the catalog channel and the menu bus for registration.
-    #[must_use]
-    pub fn new(catalog: CatalogBus, menu: MenuBus) -> Self {
-        Self { catalog, menu }
-    }
-
-    /// The chat model catalog channel.
-    #[must_use]
-    pub fn catalog(&self) -> &CatalogBus {
-        &self.catalog
-    }
-
-    /// The workbench menu bus.
-    #[must_use]
-    pub fn menu(&self) -> &MenuBus {
-        &self.menu
-    }
-}
-
-/// The menu subsystem's registration guards: the catalog sink, the
-/// workbench sink, and the menu's state handle. Dropping them
-/// deregisters the subsystem.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the subsystem"]
-pub struct MenuRegistrations {
-    /// The catalog channel's receiving end.
-    pub catalog_sink: Registration,
-    /// The workbench mutators.
-    pub menu_sink: Registration,
-    /// The menu's state handle.
-    pub state: Registration,
-}
-
-/// Registers the menu subsystem into the registry: the catalog
-/// channel's receiving end and the workbench mutators, which same-tier
-/// subsystems (the gateway heartbeat's refreshes) drive through the
-/// registry's push facade, plus the subsystem's state handles. The
-/// returned guards keep the registrations alive; the composition root
-/// holds them for the process lifetime.
-pub fn register(registry: &Registry, catalog: &CatalogBus, menu: &MenuBus) -> MenuRegistrations {
-    let catalog_guard =
-        registry.register_sink::<dyn CatalogSink>(Arc::new(CatalogSinkAdapter::new({
-            let catalog = catalog.clone();
-            move |models| catalog.publish(models)
-        })));
-    let menu_guard = registry.register_sink::<dyn MenuSink>(Arc::new(MenuSinkAdapter::new(
-        {
-            let menu = menu.clone();
-            move |reachable| menu.set_gateway_reachable(reachable)
-        },
-        {
-            let menu = menu.clone();
-            move |profiles, active| menu.set_profiles(profiles, active)
-        },
-        {
-            let menu = menu.clone();
-            move || menu.restore_selection()
-        },
-        {
-            let menu = menu.clone();
-            move || menu.reconcile_catalog()
-        },
-    )));
-    let state = registry
-        .register_state::<MenuHandles>(Arc::new(MenuHandles::new(catalog.clone(), menu.clone())));
-    MenuRegistrations {
-        catalog_sink: catalog_guard,
-        menu_sink: menu_guard,
-        state,
-    }
-}
diff --git a/crates/workshop/menu/src/lib.rs b/crates/workshop/menu/src/lib.rs
deleted file mode 100644
index 4b60aadd9..000000000
--- a/crates/workshop/menu/src/lib.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-//! workshop-menu - the server-owned Model menu subsystem: the workbench
-//! snapshot pushed to every `/ws` session as a `{"type":"workbench",...}`
-//! frame, the chat-capable model catalog channel rebroadcast as
-//! `{"type":"models",...}` frames, and the per-profile model memory
-//! persisted in the state directory.
-//!
-//! ## Invariants
-//!
-//! - Tier: service; may depend on: `workshop-protocol`, `workshop-registry`,
-//!   `workshop-support`. `cargo test -p build-xtask` enforces the product
-//!   and container boundaries.
-//! - The server owns all Model-menu state and the UI only renders it;
-//!   `chat_ready` is computed here and never derived client-side.
-//! - Publishing never blocks: a publish with no sessions is a no-op, and
-//!   a lagging session skips ahead - every push is a complete snapshot, so
-//!   an overwritten one loses nothing. Both buses retain the newest push,
-//!   so a session connecting later receives the current state immediately.
-//! - A refused mutation is a value returned to the caller, and a
-//!   missing, unreadable, or corrupt memory file means "no memory yet" -
-//!   logged and tolerated, never fatal.
-
-pub mod catalog;
-mod handles;
-pub mod menu;
-
-pub use catalog::{CatalogBus, ChatCatalog, is_chat_capable};
-pub use handles::{MenuHandles, MenuRegistrations, register};
-pub use menu::{MenuBus, MenuRefusal, SwitchOutcome};
diff --git a/crates/workshop/menu/src/menu.rs b/crates/workshop/menu/src/menu.rs
deleted file mode 100644
index 433ab522a..000000000
--- a/crates/workshop/menu/src/menu.rs
+++ /dev/null
@@ -1,434 +0,0 @@
-//! The server-owned Model menu: the workbench snapshot pushed to every
-//! `/ws` session as a `{"type":"workbench",...}` frame, its broadcast
-//! bus, and the per-profile model memory persisted in the state directory.
-//!
-//! The server owns all Model-menu state and the UI only renders it; in
-//! particular `chat_ready` is computed here - a chat-capable model
-//! selected, no switch in flight, gateway reachable - and never derived
-//! client-side. Like the catalog bus, the channel is a tokio broadcast:
-//! publishing never blocks, a publish with no sessions is a no-op, and a
-//! lagging session skips ahead - every push is a complete snapshot, so an
-//! overwritten one loses nothing. The bus also retains the newest push,
-//! so a session that connects later sends the current menu immediately -
-//! the delivery contract's resend-on-reconnect for ephemeral frames.
-//!
-//! A refused mutation (an unknown model id, a second switch while one
-//! runs) is a value returned to the caller, and a missing, unreadable,
-//! or corrupt memory file means "no memory yet" - logged and tolerated,
-//! never fatal. The memory file holds server state only; the UI's panel
-//! layout is view state and persists through the UI-state buckets
-//! (`workshop-user-state` and the workspace file).
-
-mod memory;
-
-use std::collections::HashMap;
-use std::path::Path;
-use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
-
-use tokio::sync::broadcast;
-
-use workshop_protocol::WorkbenchSnapshot;
-use workshop_support::RetainedBus;
-
-use crate::catalog::CatalogBus;
-
-use self::memory::{MemoryWriter, PendingWrite, WORKSHOP_STATE_FILE, load_memory, store_pending};
-
-/// Ring capacity of the menu bus. Pushes follow user interactions and
-/// heartbeat transitions, so a handful of slots is generous.
-const MENU_CHANNEL_CAPACITY: usize = 8;
-
-/// The shared menu bus: the Model-menu state, its mutators, and the
-/// broadcast channel their snapshots fan out on, mirroring
-/// [`crate::catalog::CatalogBus`].
-///
-/// Clones are cheap (a few `Arc` bumps) and share one state, one retained
-/// snapshot, and one channel.
-#[derive(Debug, Clone)]
-pub struct MenuBus {
-    bus: RetainedBus<WorkbenchSnapshot>,
-    state: Arc<Mutex<MenuState>>,
-    // Selections are validated against the retained catalog and
-    // `chat_ready` reads its emptiness, so the menu holds its own handle.
-    catalog: CatalogBus,
-}
-
-/// The mutable Model-menu state behind the bus.
-#[derive(Debug)]
-struct MenuState {
-    /// Every gateway profile name, in gateway order.
-    profiles: Vec<String>,
-    /// The profile the gateway is serving, once known.
-    active: Option<String>,
-    /// The selection a switch is applying, while one is in flight.
-    switching: Option<SwitchTarget>,
-    /// The model chat requests go to, once one is selected.
-    selected_model: Option<String>,
-    /// The heartbeat's verdict on the gateway.
-    gateway_reachable: bool,
-    /// Remembered model selection per profile name, persisted to
-    /// [`WORKSHOP_STATE_FILE`].
-    last_selected: HashMap<String, String>,
-    /// The memory file's writer; `None` disables persistence.
-    memory: Option<MemoryWriter>,
-}
-
-/// What an in-flight switch selects: a named profile, or no profile at
-/// all. Distinct from "no switch running", which is the absence of a
-/// target.
-#[derive(Debug, Clone, PartialEq, Eq)]
-enum SwitchTarget {
-    /// A defined profile, by name.
-    Profile(String),
-    /// No profile: the gateway serves remote models only.
-    NoProfile,
-}
-
-impl SwitchTarget {
-    /// The target as the optional profile name the wire and the active
-    /// state hold.
-    fn name(&self) -> Option<&str> {
-        match self {
-            Self::Profile(name) => Some(name),
-            Self::NoProfile => None,
-        }
-    }
-}
-
-/// Renders an optional profile name for a refusal message.
-fn describe_target(name: Option<&str>) -> String {
-    name.map_or_else(|| "no profile".to_owned(), |name| format!("{name:?}"))
-}
-
-impl MenuState {
-    /// Applies the remembered-else-first selection rule for `profile`:
-    /// the remembered model when `models` still holds it, else the first
-    /// catalog model. Records the choice in per-profile memory and
-    /// returns its pending write when a model was selected. Shared by
-    /// [`MenuBus::finish_switch`] and [`MenuBus::restore_selection`].
-    #[must_use]
-    fn select_for_profile(
-        &mut self,
-        profile: String,
-        models: &[serde_json::Value],
-    ) -> Option<PendingWrite> {
-        self.selected_model = self
-            .last_selected
-            .get(&profile)
-            .filter(|id| models_contain(models, id))
-            .cloned()
-            .or_else(|| first_model_id(models));
-        let id = self.selected_model.clone()?;
-        self.remember(profile, id)
-    }
-
-    /// Records `id` as the remembered model for `profile` and snapshots
-    /// the serialized memory as a [`PendingWrite`] for the caller to
-    /// perform once the state lock is released - the mutators run on the
-    /// async runtime, and file IO under the guard would block the
-    /// executor. `None` when persistence is disabled.
-    #[must_use]
-    fn remember(&mut self, profile: String, id: String) -> Option<PendingWrite> {
-        self.last_selected.insert(profile, id);
-        let memory = self.memory.as_mut()?;
-        let payload = serde_json::json!({ "last_selected": &self.last_selected });
-        Some(memory.pending(payload.to_string().into_bytes()))
-    }
-}
-
-/// A refused menu mutation. A refusal is a state to report, not an error
-/// to escalate: the caller relays it and the applied state is untouched.
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-#[non_exhaustive]
-pub enum MenuRefusal {
-    /// The requested model id is not in the current catalog.
-    #[error("unknown model {id:?}: not in the current catalog")]
-    #[non_exhaustive]
-    UnknownModel {
-        /// The id that was requested.
-        id: String,
-    },
-
-    /// A profile switch is already in flight; switches are single-flight.
-    #[error("a switch to {} is already in progress", describe_target(.name.as_deref()))]
-    #[non_exhaustive]
-    SwitchInProgress {
-        /// The target of the switch already running: a profile name, or
-        /// `None` for a switch to no profile.
-        name: Option<String>,
-    },
-}
-
-/// How a profile switch ended, reported by whoever ran it.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SwitchOutcome {
-    /// The gateway serves the target selection.
-    Completed,
-    /// The selection persisted but the gateway must restart to load it;
-    /// the previously active profile still serves.
-    Deferred,
-    /// The switch failed; the previously active profile still serves.
-    Failed,
-}
-
-impl MenuBus {
-    /// Creates a bus with no subscribers, an empty ring, and no snapshot,
-    /// loading the per-profile model memory from `state_dir` when one is
-    /// given. A missing, unreadable, or corrupt memory file means "no
-    /// memory yet": logged and tolerated, never fatal.
-    #[must_use]
-    pub fn new(catalog: CatalogBus, state_dir: Option<&Path>) -> Self {
-        let memory_path = state_dir.map(|dir| dir.join(WORKSHOP_STATE_FILE));
-        let last_selected = memory_path.as_deref().map(load_memory).unwrap_or_default();
-        Self {
-            bus: RetainedBus::new(MENU_CHANNEL_CAPACITY),
-            state: Arc::new(Mutex::new(MenuState {
-                profiles: Vec::new(),
-                active: None,
-                switching: None,
-                selected_model: None,
-                gateway_reachable: false,
-                last_selected,
-                memory: memory_path.map(MemoryWriter::new),
-            })),
-            catalog,
-        }
-    }
-
-    /// Subscribes to every snapshot published from this call onward.
-    #[must_use]
-    pub fn subscribe(&self) -> broadcast::Receiver<WorkbenchSnapshot> {
-        self.bus.subscribe()
-    }
-
-    /// The most recently published snapshot, retained so a session
-    /// connecting later can send the current menu as its snapshot.
-    #[must_use]
-    pub fn latest(&self) -> Option<WorkbenchSnapshot> {
-        self.bus.latest()
-    }
-
-    /// Selects `id` as the chat model and publishes a fresh snapshot,
-    /// remembering the choice for the active profile.
-    ///
-    /// # Errors
-    /// Returns [`MenuRefusal::UnknownModel`] when `id` is not in the
-    /// current catalog; the refused selection is not applied.
-    pub fn set_selected(&self, id: &str) -> Result<(), MenuRefusal> {
-        if !self.catalog_has(id) {
-            return Err(MenuRefusal::UnknownModel { id: id.to_string() });
-        }
-        let mut state = self.lock_state();
-        state.selected_model = Some(id.to_string());
-        let pending = state
-            .active
-            .clone()
-            .and_then(|profile| state.remember(profile, id.to_string()));
-        self.publish(&state);
-        drop(state);
-        store_pending(pending);
-        Ok(())
-    }
-
-    /// Marks a switch to profile `name` - or to no profile, for `None` -
-    /// as in flight and publishes a fresh snapshot; `chat_ready` is false
-    /// until the switch finishes. The wire snapshot names the target
-    /// profile while one is being selected and holds `null` for a
-    /// switch to no profile; `switch_in_flight` is true for either.
-    ///
-    /// # Errors
-    /// Returns [`MenuRefusal::SwitchInProgress`] while another switch
-    /// runs - switches are single-flight because the gateway applies one
-    /// selection at a time.
-    pub fn begin_switch(&self, name: Option<&str>) -> Result<(), MenuRefusal> {
-        let mut state = self.lock_state();
-        if let Some(running) = &state.switching {
-            return Err(MenuRefusal::SwitchInProgress {
-                name: running.name().map(str::to_owned),
-            });
-        }
-        state.switching = Some(name.map_or(SwitchTarget::NoProfile, |name| {
-            SwitchTarget::Profile(name.to_owned())
-        }));
-        self.publish(&state);
-        Ok(())
-    }
-
-    /// Ends the in-flight switch and publishes a fresh snapshot. On
-    /// [`SwitchOutcome::Completed`] the target becomes the active
-    /// selection and the model selection moves to the remembered model
-    /// for the target profile when the catalog still holds that model,
-    /// else to the first catalog model; a switch to no profile selects
-    /// the first catalog model. On [`SwitchOutcome::Deferred`] and
-    /// [`SwitchOutcome::Failed`] the previous profile stays active. A
-    /// finish with no switch in flight is logged and ignored.
-    pub fn finish_switch(&self, outcome: SwitchOutcome) {
-        let mut state = self.lock_state();
-        let Some(target) = state.switching.take() else {
-            tracing::warn!("finish_switch with no switch in flight; ignored");
-            return;
-        };
-        let mut pending = None;
-        if outcome == SwitchOutcome::Completed {
-            let models = self.catalog_models();
-            match target {
-                SwitchTarget::Profile(profile) => {
-                    state.active = Some(profile.clone());
-                    pending = state.select_for_profile(profile, &models);
-                }
-                SwitchTarget::NoProfile => {
-                    state.active = None;
-                    state.selected_model = first_model_id(&models);
-                }
-            }
-        }
-        self.publish(&state);
-        drop(state);
-        store_pending(pending);
-    }
-
-    /// Restores a boot-time selection: when nothing is selected and the
-    /// catalog holds a model, selects the remembered model for the
-    /// active profile when the catalog still holds it, else the first
-    /// catalog model - the rule [`MenuBus::finish_switch`] applies - and
-    /// publishes a fresh snapshot. With a selection already applied, or
-    /// no selectable catalog model, this is a no-op and publishes
-    /// nothing. The heartbeat calls this after its boot and reconnect
-    /// refreshes settle, so a reconnect whose selection survived the
-    /// outage changes nothing.
-    pub fn restore_selection(&self) {
-        let mut state = self.lock_state();
-        if state.selected_model.is_some() {
-            return;
-        }
-        let models = self.catalog_models();
-        let pending = if let Some(profile) = state.active.clone() {
-            state.select_for_profile(profile, &models)
-        } else {
-            // No active profile means no memory to consult and none to
-            // record; fall straight back to the first catalog model.
-            state.selected_model = first_model_id(&models);
-            None
-        };
-        if state.selected_model.is_none() {
-            return;
-        }
-        self.publish(&state);
-        drop(state);
-        store_pending(pending);
-    }
-
-    /// Records the heartbeat's verdict on the gateway and publishes a
-    /// fresh snapshot; `chat_ready` is false while the gateway is down.
-    pub fn set_gateway_reachable(&self, reachable: bool) {
-        let mut state = self.lock_state();
-        state.gateway_reachable = reachable;
-        self.publish(&state);
-    }
-
-    /// Records the gateway's profile list and active profile and
-    /// publishes a fresh snapshot. The boot and reconnect paths feed
-    /// this from the gateway's profile endpoints; a failed or declined
-    /// profile fetch feeds an empty list. The selection is untouched:
-    /// catalog reconciliation owns selection validity, not the profile
-    /// list.
-    pub fn set_profiles(&self, profiles: Vec<String>, active: Option<String>) {
-        let mut state = self.lock_state();
-        state.profiles = profiles;
-        state.active = active;
-        self.publish(&state);
-    }
-
-    /// Revalidates the selection against the current catalog - a selected
-    /// model the catalog no longer holds is cleared - and republishes the
-    /// snapshot when it changed.
-    /// [`workshop_registry::Push::push_models_catalog`] calls this after
-    /// every catalog publish, making that method the single choke point
-    /// where catalog and menu reconcile.
-    pub fn reconcile_catalog(&self) {
-        let mut state = self.lock_state();
-        if let Some(selected) = &state.selected_model
-            && !self.catalog_has(selected)
-        {
-            state.selected_model = None;
-        }
-        let snapshot = self.snapshot(&state);
-        if self.latest().as_ref() != Some(&snapshot) {
-            self.send(snapshot);
-        }
-    }
-
-    /// The state guard, recovering a lock poisoned by a panicking peer
-    /// rather than wedging the process.
-    fn lock_state(&self) -> MutexGuard<'_, MenuState> {
-        self.state.lock().unwrap_or_else(PoisonError::into_inner)
-    }
-
-    /// Builds the wire snapshot of `state`, computing `chat_ready` from
-    /// its four conditions.
-    fn snapshot(&self, state: &MenuState) -> WorkbenchSnapshot {
-        let catalog_has_chat = self
-            .catalog
-            .latest()
-            .is_some_and(|push| !push.models.is_empty());
-        WorkbenchSnapshot {
-            profiles: state.profiles.clone(),
-            active: state.active.clone(),
-            switching: state
-                .switching
-                .as_ref()
-                .and_then(|target| target.name().map(str::to_owned)),
-            switch_in_flight: state.switching.is_some(),
-            selected_model: state.selected_model.clone(),
-            chat_ready: catalog_has_chat
-                && state.selected_model.is_some()
-                && state.switching.is_none()
-                && state.gateway_reachable,
-        }
-    }
-
-    /// Snapshots `state` and broadcasts it.
-    fn publish(&self, state: &MenuState) {
-        self.send(self.snapshot(state));
-    }
-
-    /// Broadcasts one snapshot. With no subscribers this is a no-op; a
-    /// slow subscriber skips ahead rather than applying backpressure.
-    fn send(&self, snapshot: WorkbenchSnapshot) {
-        self.bus.send(snapshot);
-    }
-
-    /// Whether `id` names a model in the current catalog snapshot.
-    fn catalog_has(&self, id: &str) -> bool {
-        self.catalog
-            .latest()
-            .is_some_and(|push| models_contain(&push.models, id))
-    }
-
-    /// The current catalog's models array, empty before the first push.
-    fn catalog_models(&self) -> Vec<serde_json::Value> {
-        self.catalog
-            .latest()
-            .map_or_else(Vec::new, |push| push.models)
-    }
-}
-
-/// Whether the catalog `models` array holds an entry whose `id` is `id`.
-fn models_contain(models: &[serde_json::Value], id: &str) -> bool {
-    models
-        .iter()
-        .any(|model| model.get("id").and_then(serde_json::Value::as_str) == Some(id))
-}
-
-/// The `id` of the first catalog entry, when there is one.
-fn first_model_id(models: &[serde_json::Value]) -> Option<String> {
-    models.iter().find_map(|model| {
-        model
-            .get("id")
-            .and_then(serde_json::Value::as_str)
-            .map(str::to_string)
-    })
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/menu/src/menu/memory.rs b/crates/workshop/menu/src/menu/memory.rs
deleted file mode 100644
index 8c2f7959b..000000000
--- a/crates/workshop/menu/src/menu/memory.rs
+++ /dev/null
@@ -1,138 +0,0 @@
-//! The per-profile model memory's file: its on-disk shape, the tolerant
-//! load, and the off-executor atomic write.
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex, PoisonError};
-
-/// Name of the persisted server-state file, written in the server's
-/// state directory.
-pub(super) const WORKSHOP_STATE_FILE: &str = "workshop-state.json";
-
-/// The memory file's writer: where the memory persists, the sequence the
-/// next snapshot takes, and the write gate its pending writes share. It
-/// lives in the menu state, so snapshots take their sequences under the
-/// state lock, in the order their contents were captured.
-#[derive(Debug)]
-pub(super) struct MemoryWriter {
-    /// Where the memory persists.
-    path: PathBuf,
-    /// The sequence of the last snapshot taken; 0 before the first.
-    last_taken: u64,
-    /// Shared with every pending write; see [`PendingWrite`].
-    gate: Arc<Mutex<u64>>,
-}
-
-impl MemoryWriter {
-    /// A writer for the memory file at `path`, with nothing taken or
-    /// written yet.
-    pub(super) fn new(path: PathBuf) -> Self {
-        Self {
-            path,
-            last_taken: 0,
-            gate: Arc::default(),
-        }
-    }
-
-    /// Takes `bytes` as the newest snapshot awaiting its write.
-    pub(super) fn pending(&mut self, bytes: Vec<u8>) -> PendingWrite {
-        self.last_taken += 1;
-        PendingWrite {
-            path: self.path.clone(),
-            bytes,
-            sequence: self.last_taken,
-            gate: Arc::clone(&self.gate),
-        }
-    }
-}
-
-/// One serialized memory snapshot awaiting its write: the bytes, path,
-/// and sequence are captured under the state lock, and the write runs
-/// after the guard drops, off the async executor.
-#[derive(Debug)]
-pub(super) struct PendingWrite {
-    /// Where the memory persists.
-    path: PathBuf,
-    /// The serialized [`WORKSHOP_STATE_FILE`] contents.
-    bytes: Vec<u8>,
-    /// The snapshot's place in capture order, starting at 1.
-    sequence: u64,
-    /// The memory file's write gate: held across each write so writes
-    /// never interleave, it holds the sequence of the last snapshot
-    /// written, 0 before the first.
-    gate: Arc<Mutex<u64>>,
-}
-
-/// The persisted shape of [`WORKSHOP_STATE_FILE`]. Server state only:
-/// the UI's panel layout is view state and persists through the UI-state
-/// buckets (`workshop-user-state` and the workspace file), never here.
-#[derive(Debug, serde::Deserialize)]
-struct StoredState {
-    /// Remembered model selection per profile name.
-    last_selected: HashMap<String, String>,
-}
-
-/// Loads the per-profile model memory. A missing, unreadable, or corrupt
-/// file means "no memory yet": logged and tolerated.
-pub(super) fn load_memory(path: &Path) -> HashMap<String, String> {
-    let raw = match std::fs::read_to_string(path) {
-        Ok(raw) => raw,
-        Err(error) => {
-            if error.kind() != std::io::ErrorKind::NotFound {
-                tracing::warn!(
-                    %error,
-                    path = %path.display(),
-                    "workshop state unreadable; starting with no model memory"
-                );
-            }
-            return HashMap::new();
-        }
-    };
-    match serde_json::from_str::<StoredState>(&raw) {
-        Ok(stored) => stored.last_selected,
-        Err(error) => {
-            tracing::warn!(
-                %error,
-                path = %path.display(),
-                "workshop state corrupt; starting with no model memory"
-            );
-            HashMap::new()
-        }
-    }
-}
-
-/// Performs a pending memory write off the async executor. On a runtime
-/// the file IO moves to the blocking pool and completes in the
-/// background - the memory file is a best-effort cache, so no caller
-/// awaits it. Outside a runtime (the unit tests drive the mutators
-/// synchronously) the write runs inline instead.
-pub(super) fn store_pending(pending: Option<PendingWrite>) {
-    let Some(pending) = pending else { return };
-    match tokio::runtime::Handle::try_current() {
-        Ok(handle) => {
-            handle.spawn_blocking(move || store_memory(&pending));
-        }
-        Err(_) => store_memory(&pending),
-    }
-}
-
-/// Writes one per-profile model-memory snapshot through the shared
-/// atomic-write helper, so a crash mid-write cannot leave a truncated
-/// [`WORKSHOP_STATE_FILE`]. Pending writes reach the blocking pool in
-/// no guaranteed order, so the gate serializes them and skips a snapshot
-/// no newer than the last one written: the newest snapshot wins. A
-/// failed write costs the memory, not the process: logged and tolerated.
-pub(super) fn store_memory(pending: &PendingWrite) {
-    let mut last_written = pending.gate.lock().unwrap_or_else(PoisonError::into_inner);
-    if pending.sequence <= *last_written {
-        return;
-    }
-    match workshop_support::write_atomic(&pending.path, &pending.bytes) {
-        Ok(()) => *last_written = pending.sequence,
-        Err(error) => tracing::warn!(
-            %error,
-            path = %pending.path.display(),
-            "workshop state write failed; model memory not persisted"
-        ),
-    }
-}
diff --git a/crates/workshop/menu/src/menu/tests-memory.rs b/crates/workshop/menu/src/menu/tests-memory.rs
deleted file mode 100644
index 1ea0f4d0a..000000000
--- a/crates/workshop/menu/src/menu/tests-memory.rs
+++ /dev/null
@@ -1,206 +0,0 @@
-//! Per-profile model memory: remembered selections across switches, the
-//! state file's round trip and its tolerated failures, latest-wins
-//! writes, and the boot-time selection restore.
-
-use super::*;
-
-use super::super::memory::store_memory;
-
-#[test]
-fn a_selection_is_remembered_per_profile_across_switches() {
-    let menu = menu_of(&["model-a", "model-b", "model-c"]);
-    onto_profile(&menu, "main");
-    menu.set_selected("model-c")
-        .expect("the id is in the catalog");
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    menu.finish_switch(SwitchOutcome::Completed);
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "a profile with no memory selects the first model"
-    );
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    menu.begin_switch(Some("main"))
-        .expect("no switch is running");
-    menu.finish_switch(SwitchOutcome::Completed);
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-c"),
-        "the remembered model for the profile is restored"
-    );
-}
-
-#[test]
-fn model_memory_round_trips_through_the_state_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let catalog = catalog_of(&["model-a", "model-b"]);
-    {
-        let menu = MenuBus::new(catalog.clone(), Some(dir.path()));
-        onto_profile(&menu, "main");
-        menu.set_selected("model-b")
-            .expect("the id is in the catalog");
-    }
-    let reborn = MenuBus::new(catalog, Some(dir.path()));
-    onto_profile(&reborn, "main");
-    assert_eq!(
-        snapshot(&reborn).selected_model.as_deref(),
-        Some("model-b"),
-        "the persisted memory survives a restart"
-    );
-}
-
-#[test]
-fn a_missing_state_file_means_no_memory_yet() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let menu = MenuBus::new(catalog_of(&["model-a"]), Some(dir.path()));
-    onto_profile(&menu, "main");
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "no memory yet: the first catalog model is selected"
-    );
-}
-
-#[test]
-fn a_corrupt_state_file_means_no_memory_yet() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(dir.path().join(WORKSHOP_STATE_FILE), "not json {").expect("write fixture");
-    let menu = MenuBus::new(catalog_of(&["model-a"]), Some(dir.path()));
-    onto_profile(&menu, "main");
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "corrupt memory degrades to no memory, never to a failure"
-    );
-}
-
-#[test]
-fn an_unreadable_state_file_means_no_memory_yet() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // A directory in the file's place: reads and writes both fail for
-    // a reason other than NotFound, and both must degrade.
-    std::fs::create_dir(dir.path().join(WORKSHOP_STATE_FILE))
-        .expect("directory in the file's place");
-    let menu = MenuBus::new(catalog_of(&["model-a"]), Some(dir.path()));
-    onto_profile(&menu, "main");
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "unreadable memory degrades to no memory, never to a failure"
-    );
-}
-
-#[test]
-fn writes_landing_newest_first_leave_the_newest_snapshot_on_disk() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join(WORKSHOP_STATE_FILE);
-    let mut writer = MemoryWriter::new(path.clone());
-    let older = writer.pending(br#"{"last_selected":{"main":"model-a"}}"#.to_vec());
-    let newer = writer.pending(br#"{"last_selected":{"main":"model-b"}}"#.to_vec());
-    store_memory(&newer);
-    store_memory(&older);
-    assert_eq!(
-        std::fs::read_to_string(&path).expect("the newer snapshot was written"),
-        r#"{"last_selected":{"main":"model-b"}}"#,
-        "an older snapshot landing last never overwrites the newest"
-    );
-}
-
-#[test]
-fn a_remembered_model_gone_from_the_catalog_falls_back_to_the_first() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(
-        dir.path().join(WORKSHOP_STATE_FILE),
-        r#"{"last_selected":{"main":"retired-model"}}"#,
-    )
-    .expect("write fixture");
-    let menu = MenuBus::new(catalog_of(&["model-a"]), Some(dir.path()));
-    onto_profile(&menu, "main");
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "a remembered model the catalog no longer holds falls back to the first"
-    );
-}
-
-#[test]
-fn restore_selection_picks_the_remembered_model_for_the_active_profile() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(
-        dir.path().join(WORKSHOP_STATE_FILE),
-        r#"{"last_selected":{"main":"model-b"}}"#,
-    )
-    .expect("write fixture");
-    let menu = MenuBus::new(catalog_of(&["model-a", "model-b"]), Some(dir.path()));
-    menu.set_profiles(vec!["main".to_string()], Some("main".to_string()));
-    menu.restore_selection();
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-b"),
-        "boot restores the remembered model for the active profile"
-    );
-}
-
-#[test]
-fn restore_selection_falls_back_to_the_first_model_when_memory_is_stale() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(
-        dir.path().join(WORKSHOP_STATE_FILE),
-        r#"{"last_selected":{"main":"retired-model"}}"#,
-    )
-    .expect("write fixture");
-    let menu = MenuBus::new(catalog_of(&["model-a", "model-b"]), Some(dir.path()));
-    menu.set_profiles(vec!["main".to_string()], Some("main".to_string()));
-    menu.restore_selection();
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "a remembered model the catalog lacks falls back to the first"
-    );
-}
-
-#[test]
-fn restore_selection_without_an_active_profile_picks_the_first_model() {
-    let menu = menu_of(&["model-a", "model-b"]);
-    menu.restore_selection();
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "with no active profile there is no memory; the first model serves"
-    );
-}
-
-#[test]
-fn restore_selection_with_a_selection_applied_publishes_nothing() {
-    let menu = menu_of(&["model-a", "model-b"]);
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    let mut receiver = menu.subscribe();
-    menu.restore_selection();
-    assert!(
-        matches!(receiver.try_recv(), Err(TryRecvError::Empty)),
-        "an existing selection makes the restore a no-op"
-    );
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-b"),
-        "the surviving selection is untouched"
-    );
-}
-
-#[test]
-fn restore_selection_with_an_empty_catalog_publishes_nothing() {
-    let menu = menu_of(&[]);
-    let mut receiver = menu.subscribe();
-    menu.restore_selection();
-    assert!(
-        matches!(receiver.try_recv(), Err(TryRecvError::Empty)),
-        "an empty catalog leaves nothing to restore"
-    );
-    assert!(
-        menu.latest().is_none(),
-        "a no-op restore retains no snapshot"
-    );
-}
diff --git a/crates/workshop/menu/src/menu/tests.rs b/crates/workshop/menu/src/menu/tests.rs
deleted file mode 100644
index 076683d09..000000000
--- a/crates/workshop/menu/src/menu/tests.rs
+++ /dev/null
@@ -1,353 +0,0 @@
-//! Menu bus tests: model selection, profile switches, refusals, and the published snapshots.
-
-use super::*;
-
-use tokio::sync::broadcast::error::{RecvError, TryRecvError};
-
-#[path = "tests-memory.rs"]
-mod memory;
-
-/// A catalog bus already holding one push of the given model ids.
-fn catalog_of(ids: &[&str]) -> CatalogBus {
-    let catalog = CatalogBus::new();
-    catalog.publish(ids.iter().map(|id| serde_json::json!({"id": id})).collect());
-    catalog
-}
-
-/// A menu with no persistence, on a catalog of the given model ids.
-fn menu_of(ids: &[&str]) -> MenuBus {
-    MenuBus::new(catalog_of(ids), None)
-}
-
-/// Drives `menu` to full readiness on `profile`: gateway reachable
-/// and a completed switch, which selects a model.
-fn onto_profile(menu: &MenuBus, profile: &str) {
-    menu.set_gateway_reachable(true);
-    menu.begin_switch(Some(profile))
-        .expect("no switch is running");
-    menu.finish_switch(SwitchOutcome::Completed);
-}
-
-/// The retained snapshot, which every mutation publishes.
-fn snapshot(menu: &MenuBus) -> WorkbenchSnapshot {
-    menu.latest().expect("a mutation published a snapshot")
-}
-
-#[test]
-fn a_known_model_selects_and_publishes_the_snapshot() {
-    let menu = menu_of(&["model-a", "model-b"]);
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    assert_eq!(snapshot(&menu).selected_model.as_deref(), Some("model-b"));
-}
-
-#[test]
-fn an_unknown_model_is_refused_and_not_applied() {
-    let menu = menu_of(&["model-a"]);
-    menu.set_selected("model-a")
-        .expect("the id is in the catalog");
-    let refusal = menu
-        .set_selected("model-x")
-        .expect_err("an unknown id is refused");
-    assert_eq!(
-        refusal,
-        MenuRefusal::UnknownModel {
-            id: "model-x".to_string()
-        }
-    );
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-a"),
-        "a refused selection leaves the applied one in place"
-    );
-}
-
-#[test]
-fn a_switch_publishes_its_begin_and_its_finish() {
-    let menu = menu_of(&["model-a"]);
-    menu.set_gateway_reachable(true);
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    let during = snapshot(&menu);
-    assert_eq!(during.switching.as_deref(), Some("coding"));
-    assert!(during.switch_in_flight, "a named switch is in flight");
-    assert!(!during.chat_ready, "a switch in flight blocks chat");
-    menu.finish_switch(SwitchOutcome::Completed);
-    let after = snapshot(&menu);
-    assert_eq!(after.active.as_deref(), Some("coding"));
-    assert_eq!(after.switching, None);
-    assert!(
-        !after.switch_in_flight,
-        "the finish clears the in-flight mark"
-    );
-    assert_eq!(
-        after.selected_model.as_deref(),
-        Some("model-a"),
-        "with no memory for the profile the first catalog model is selected"
-    );
-    assert!(after.chat_ready);
-}
-
-#[test]
-fn a_failed_switch_keeps_the_previous_profile() {
-    let menu = menu_of(&["model-a"]);
-    onto_profile(&menu, "main");
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    menu.finish_switch(SwitchOutcome::Failed);
-    let after = snapshot(&menu);
-    assert_eq!(after.active.as_deref(), Some("main"));
-    assert_eq!(after.switching, None);
-    assert!(after.chat_ready, "the previous profile still serves");
-}
-
-#[test]
-fn a_second_switch_while_one_runs_is_refused() {
-    let menu = menu_of(&["model-a"]);
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    let refusal = menu
-        .begin_switch(Some("writing"))
-        .expect_err("switches are single-flight");
-    assert_eq!(
-        refusal,
-        MenuRefusal::SwitchInProgress {
-            name: Some("coding".to_string())
-        }
-    );
-    assert_eq!(
-        refusal.to_string(),
-        "a switch to \"coding\" is already in progress",
-        "the refusal names the running switch's target"
-    );
-    assert_eq!(
-        snapshot(&menu).switching.as_deref(),
-        Some("coding"),
-        "the refused switch is not applied"
-    );
-}
-
-#[test]
-fn a_switch_to_no_profile_blocks_chat_and_settles_with_no_active_profile() {
-    let menu = menu_of(&["model-a", "model-b"]);
-    onto_profile(&menu, "main");
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    menu.begin_switch(None).expect("no switch is running");
-    let during = snapshot(&menu);
-    assert_eq!(
-        during.switching, None,
-        "the wire frame names no target while no profile is being selected"
-    );
-    assert!(
-        during.switch_in_flight,
-        "the frame still reports a switch to no profile as in flight"
-    );
-    assert!(!during.chat_ready, "a switch in flight blocks chat");
-    assert_eq!(
-        during.active.as_deref(),
-        Some("main"),
-        "the previous profile still serves while the switch runs"
-    );
-    let refusal = menu
-        .begin_switch(Some("coding"))
-        .expect_err("switches are single-flight even toward no profile");
-    assert_eq!(refusal, MenuRefusal::SwitchInProgress { name: None });
-    assert_eq!(
-        refusal.to_string(),
-        "a switch to no profile is already in progress"
-    );
-    menu.finish_switch(SwitchOutcome::Completed);
-    let after = snapshot(&menu);
-    assert_eq!(after.active, None, "no profile is active once it settles");
-    assert_eq!(after.switching, None);
-    assert!(
-        !after.switch_in_flight,
-        "the finish clears the in-flight mark"
-    );
-    assert_eq!(
-        after.selected_model.as_deref(),
-        Some("model-a"),
-        "with no profile there is no memory; the first catalog model serves"
-    );
-    assert!(after.chat_ready, "chat is usable with no profile selected");
-}
-
-#[test]
-fn a_deferred_switch_keeps_the_previous_profile_and_clears_the_switch() {
-    let menu = menu_of(&["model-a"]);
-    onto_profile(&menu, "main");
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    menu.finish_switch(SwitchOutcome::Deferred);
-    let after = snapshot(&menu);
-    assert_eq!(
-        after.active.as_deref(),
-        Some("main"),
-        "the selection persisted but the running profile is unchanged"
-    );
-    assert_eq!(after.switching, None);
-    assert!(after.chat_ready, "the previous profile still serves");
-}
-
-#[test]
-fn finishing_with_no_switch_in_flight_is_tolerated() {
-    let menu = menu_of(&[]);
-    menu.finish_switch(SwitchOutcome::Completed);
-    assert!(menu.latest().is_none(), "a no-op finish publishes nothing");
-}
-
-#[test]
-fn the_newest_snapshot_is_retained_for_the_connect_snapshot() {
-    let menu = menu_of(&["model-a", "model-b"]);
-    assert!(menu.latest().is_none(), "an untouched menu has no snapshot");
-    menu.set_selected("model-a")
-        .expect("the id is in the catalog");
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    assert_eq!(
-        snapshot(&menu).selected_model.as_deref(),
-        Some("model-b"),
-        "a session connecting now snapshots the newest state"
-    );
-}
-
-#[tokio::test]
-async fn a_lagged_receiver_skips_ahead_instead_of_blocking() {
-    let menu = menu_of(&["model-a"]);
-    let mut receiver = menu.subscribe();
-    for _ in 0..=MENU_CHANNEL_CAPACITY {
-        menu.set_gateway_reachable(true);
-    }
-    match receiver.recv().await {
-        Err(RecvError::Lagged(1)) => {}
-        other => panic!("expected a lag report of one, got {other:?}"),
-    }
-    receiver
-        .recv()
-        .await
-        .expect("the ring still holds snapshots");
-}
-
-#[test]
-fn a_catalog_change_clears_a_selection_it_no_longer_holds() {
-    let catalog = catalog_of(&["model-a"]);
-    let menu = MenuBus::new(catalog.clone(), None);
-    menu.set_selected("model-a")
-        .expect("the id is in the catalog");
-    catalog.publish(vec![serde_json::json!({"id": "model-b"})]);
-    menu.reconcile_catalog();
-    assert_eq!(
-        snapshot(&menu).selected_model,
-        None,
-        "the vanished selection is revalidated away"
-    );
-}
-
-#[test]
-fn a_catalog_change_that_keeps_the_selection_republishes_nothing() {
-    let catalog = catalog_of(&["model-a"]);
-    let menu = MenuBus::new(catalog.clone(), None);
-    menu.set_selected("model-a")
-        .expect("the id is in the catalog");
-    let mut receiver = menu.subscribe();
-    catalog.publish(vec![
-        serde_json::json!({"id": "model-a"}),
-        serde_json::json!({"id": "model-b"}),
-    ]);
-    menu.reconcile_catalog();
-    assert!(
-        matches!(receiver.try_recv(), Err(TryRecvError::Empty)),
-        "an unchanged snapshot is not republished"
-    );
-}
-
-#[test]
-fn chat_ready_is_true_only_when_every_condition_holds() {
-    let catalog = catalog_of(&["model-a"]);
-    let menu = MenuBus::new(catalog.clone(), None);
-    onto_profile(&menu, "main");
-    assert!(
-        snapshot(&menu).chat_ready,
-        "non-empty catalog, a selection, no switch, gateway up"
-    );
-
-    menu.set_gateway_reachable(false);
-    assert!(!snapshot(&menu).chat_ready, "gateway down forces false");
-    menu.set_gateway_reachable(true);
-
-    menu.begin_switch(Some("coding"))
-        .expect("no switch is running");
-    assert!(
-        !snapshot(&menu).chat_ready,
-        "a switch in flight forces false"
-    );
-    menu.finish_switch(SwitchOutcome::Completed);
-    assert!(
-        snapshot(&menu).chat_ready,
-        "the finished switch restores readiness"
-    );
-
-    catalog.publish(vec![serde_json::json!({"id": "model-b"})]);
-    menu.reconcile_catalog();
-    let cleared = snapshot(&menu);
-    assert_eq!(cleared.selected_model, None);
-    assert!(!cleared.chat_ready, "no selection forces false");
-
-    menu.set_selected("model-b")
-        .expect("the id is in the catalog");
-    catalog.publish(Vec::new());
-    menu.reconcile_catalog();
-    assert!(!snapshot(&menu).chat_ready, "an empty catalog forces false");
-}
-
-#[test]
-fn chat_ready_is_false_before_the_heartbeat_reports_reachability() {
-    let menu = menu_of(&["model-a"]);
-    menu.set_selected("model-a")
-        .expect("the id is in the catalog");
-    assert!(
-        !snapshot(&menu).chat_ready,
-        "a fresh menu boots unreachable: catalog and selection alone \
-         must not open chat before the heartbeat's first verdict"
-    );
-}
-
-#[test]
-fn set_profiles_publishes_the_list_and_the_active_profile() {
-    let menu = menu_of(&["model-a"]);
-    menu.set_profiles(
-        vec!["main".to_string(), "coding".to_string()],
-        Some("main".to_string()),
-    );
-    let published = snapshot(&menu);
-    assert_eq!(published.profiles, ["main", "coding"]);
-    assert_eq!(published.active.as_deref(), Some("main"));
-}
-
-#[test]
-fn set_profiles_leaves_the_selection_and_readiness_alone() {
-    let menu = menu_of(&["model-a"]);
-    onto_profile(&menu, "main");
-    menu.set_profiles(vec!["main".to_string()], Some("main".to_string()));
-    let after = snapshot(&menu);
-    assert_eq!(
-        after.selected_model.as_deref(),
-        Some("model-a"),
-        "the profile list does not own selection validity"
-    );
-    assert!(after.chat_ready, "readiness survives a profile refresh");
-}
-
-#[test]
-fn an_empty_profile_list_replaces_a_populated_one() {
-    let menu = menu_of(&[]);
-    menu.set_profiles(vec!["main".to_string()], Some("main".to_string()));
-    menu.set_profiles(Vec::new(), None);
-    let after = snapshot(&menu);
-    assert!(
-        after.profiles.is_empty(),
-        "a failed or declined profile fetch publishes an empty list"
-    );
-    assert_eq!(after.active, None);
-}
diff --git a/crates/workshop/menu/tests/it/main.rs b/crates/workshop/menu/tests/it/main.rs
deleted file mode 100644
index bab82c7ef..000000000
--- a/crates/workshop/menu/tests/it/main.rs
+++ /dev/null
@@ -1,88 +0,0 @@
-//! Integration tests for `workshop-menu`: the registration contract -
-//! the catalog sink, the workbench sink, and the menu's state handles
-//! served through the registry's contribution collections.
-
-use workshop_menu::{CatalogBus, MenuBus, MenuHandles, register};
-use workshop_registry::{CatalogSink, MenuSink, Registry};
-
-/// A catalog of chat models with the given ids.
-fn models(ids: &[&str]) -> Vec<serde_json::Value> {
-    ids.iter()
-        .map(|id| serde_json::json!({ "id": id }))
-        .collect()
-}
-
-#[test]
-fn the_registered_sinks_drive_the_registered_buses() {
-    let registry = Registry::new();
-    let catalog = CatalogBus::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let _guards = register(&registry, &catalog, &menu);
-    let catalog_sink = registry
-        .sink::<dyn CatalogSink>()
-        .expect("the catalog sink is registered");
-    let menu_sink = registry
-        .sink::<dyn MenuSink>()
-        .expect("the menu sink is registered");
-
-    catalog_sink.publish(models(&["model-a"]));
-    assert_eq!(
-        catalog.latest().expect("the catalog sink publishes").models,
-        models(&["model-a"]),
-        "the catalog sink publishes onto the caller's catalog bus"
-    );
-
-    menu_sink.set_profiles(vec!["main".to_owned()], Some("main".to_owned()));
-    menu_sink.set_gateway_reachable(true);
-    menu_sink.restore_selection();
-    let ready = menu.latest().expect("the menu sink publishes");
-    assert_eq!(ready.profiles, ["main"]);
-    assert_eq!(ready.active.as_deref(), Some("main"));
-    assert_eq!(
-        ready.selected_model.as_deref(),
-        Some("model-a"),
-        "the restore selects from the catalog the sink published"
-    );
-    assert!(
-        ready.chat_ready,
-        "the reachability verdict reached the menu"
-    );
-
-    catalog_sink.publish(models(&["model-b"]));
-    menu_sink.reconcile_catalog();
-    assert_eq!(
-        menu.latest()
-            .expect("the reconcile republishes")
-            .selected_model,
-        None,
-        "the reconcile clears a selection the new catalog lacks"
-    );
-
-    let handles = registry
-        .state::<MenuHandles>()
-        .expect("the menu's state handles are registered");
-    assert_eq!(
-        handles.catalog().latest().map(|push| push.models),
-        Some(models(&["model-b"])),
-        "the state handles share the caller's catalog bus"
-    );
-    assert_eq!(
-        handles.menu().latest(),
-        menu.latest(),
-        "the state handles share the caller's menu bus"
-    );
-}
-
-#[test]
-fn dropping_the_guards_deregisters_every_contribution() {
-    let registry = Registry::new();
-    let catalog = CatalogBus::new();
-    let guards = register(&registry, &catalog, &MenuBus::new(catalog.clone(), None));
-    assert!(registry.sink::<dyn CatalogSink>().is_some());
-    assert!(registry.sink::<dyn MenuSink>().is_some());
-    assert!(registry.state::<MenuHandles>().is_some());
-    drop(guards);
-    assert!(registry.sink::<dyn CatalogSink>().is_none());
-    assert!(registry.sink::<dyn MenuSink>().is_none());
-    assert!(registry.state::<MenuHandles>().is_none());
-}
diff --git a/crates/workshop/package-lock.json b/crates/workshop/package-lock.json
deleted file mode 100644
index 7b24fc0e1..000000000
--- a/crates/workshop/package-lock.json
+++ /dev/null
@@ -1,3297 +0,0 @@
-{
-  "name": "workshop",
-  "version": "0.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "workspaces": [
-        "ui",
-        "look",
-        "platform"
-      ],
-      "devDependencies": {
-        "@tauri-apps/cli": "2.12.2",
-        "esbuild": "^0.28.2",
-        "jsdom": "^30.0.1",
-        "typescript": "^7.0.2"
-      }
-    },
-    "look": {
-      "name": "@workshop/look",
-      "version": "0.0.0",
-      "devDependencies": {
-        "@vscode/codicons": "^0.0.46-24"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color": {
-      "version": "6.0.7",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-6.0.7.tgz",
-      "integrity": "sha512-vC/bk1Lz7Tn/EfU9/apOTBk80/8dyGyWMowPoV1tJ52muDGsDqt2HPT2klrFUiY60MQmQv9q8yIht15JnBgDGw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/css-calc": "^3.3.0",
-        "@csstools/css-color-parser": "^4.1.10",
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0",
-        "lru-cache": "^11.5.2"
-      },
-      "engines": {
-        "node": "^22.13.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@asamuzakjp/dom-selector": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-8.3.2.tgz",
-      "integrity": "sha512-93Z1N+BQNXysodoicpOIyNh2drHfz/CTf9nnT0FEx72GJcIiwgydD7tGAr78j41LsYn3hlRn+LdGPuBLn1Bl8Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bidi-js": "^1.0.3",
-        "css-tree": "^3.2.1",
-        "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.5.2"
-      },
-      "engines": {
-        "node": "^22.13.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@bramus/specificity": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
-      "integrity": "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "css-tree": "^3.0.0"
-      },
-      "bin": {
-        "specificity": "bin/cli.js"
-      }
-    },
-    "node_modules/@codemirror/autocomplete": {
-      "version": "6.20.3",
-      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.20.3.tgz",
-      "integrity": "sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/language": "^6.0.0",
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.17.0",
-        "@lezer/common": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/commands": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.11.0.tgz",
-      "integrity": "sha512-/K4Rl5BN0OtTiPWmJCdqODu38XnDMsDxKY5rgrPnCkutPTJf2wVbkoixLfealF5Kwse/s8P8M5jAiURiwSwnFA==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/language": "^6.0.0",
-        "@codemirror/state": "^6.7.0",
-        "@codemirror/view": "^6.27.0",
-        "@lezer/common": "^1.1.0"
-      }
-    },
-    "node_modules/@codemirror/lang-css": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-css/-/lang-css-6.3.1.tgz",
-      "integrity": "sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.0.0",
-        "@codemirror/language": "^6.0.0",
-        "@codemirror/state": "^6.0.0",
-        "@lezer/common": "^1.0.2",
-        "@lezer/css": "^1.1.7"
-      }
-    },
-    "node_modules/@codemirror/lang-html": {
-      "version": "6.4.12",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-html/-/lang-html-6.4.12.tgz",
-      "integrity": "sha512-pw2ReWKUqSkbvh76RAT4NYxiogRu+PWkR2ukAwO9uOgrm8uipkzjtKKtNpyeAQwHOqxEeSvAXZ6vr3AfyB9y/w==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.0.0",
-        "@codemirror/lang-css": "^6.0.0",
-        "@codemirror/lang-javascript": "^6.0.0",
-        "@codemirror/language": "^6.4.0",
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.17.0",
-        "@lezer/common": "^1.0.0",
-        "@lezer/css": "^1.1.0",
-        "@lezer/html": "^1.3.12"
-      }
-    },
-    "node_modules/@codemirror/lang-javascript": {
-      "version": "6.2.5",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-javascript/-/lang-javascript-6.2.5.tgz",
-      "integrity": "sha512-zD4e5mS+50htS7F+TYjBPsiIFGanfVqg4HyUz6WNFikgOPf2BgKlx+TQedI1w6n/IqRBVBbBWmGFdLB/7uxO4A==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.0.0",
-        "@codemirror/language": "^6.6.0",
-        "@codemirror/lint": "^6.0.0",
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.17.0",
-        "@lezer/common": "^1.0.0",
-        "@lezer/javascript": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/lang-json": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-json/-/lang-json-6.0.2.tgz",
-      "integrity": "sha512-x2OtO+AvwEHrEwR0FyyPtfDUiloG3rnVTSZV1W8UteaLL8/MajQd8DpvUb2YVzC+/T18aSDv0H9mu+xw0EStoQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/language": "^6.0.0",
-        "@lezer/json": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/lang-markdown": {
-      "version": "6.5.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-markdown/-/lang-markdown-6.5.2.tgz",
-      "integrity": "sha512-AwBOdkWYuA//WcM0xO5PfHPUcmz/O2i5o0Nsg1U69SII/loCJlFI1Romd9xp2HYb1kYJRGZotyqRghuHH5n8Kw==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.7.1",
-        "@codemirror/lang-html": "^6.0.0",
-        "@codemirror/language": "^6.3.0",
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.0.0",
-        "@lezer/common": "^1.2.1",
-        "@lezer/markdown": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/lang-python": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-python/-/lang-python-6.2.1.tgz",
-      "integrity": "sha512-IRjC8RUBhn9mGR9ywecNhB51yePWCGgvHfY1lWN/Mrp3cKuHr0isDKia+9HnvhiWNnMpbGhWrkhuWOc09exRyw==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.3.2",
-        "@codemirror/language": "^6.8.0",
-        "@codemirror/state": "^6.0.0",
-        "@lezer/common": "^1.2.1",
-        "@lezer/python": "^1.1.4"
-      }
-    },
-    "node_modules/@codemirror/lang-rust": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-rust/-/lang-rust-6.0.2.tgz",
-      "integrity": "sha512-EZaGjCUegtiU7kSMvOfEZpaCReowEf3yNidYu7+vfuGTm9ow4mthAparY5hisJqOHmJowVH3Upu+eJlUji6qqA==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/language": "^6.0.0",
-        "@lezer/rust": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/lang-yaml": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-yaml/-/lang-yaml-6.1.3.tgz",
-      "integrity": "sha512-AZ8DJBuXGVHybpBQhmZtgew5//4hv3tdkXnr3vDmOUMJRuB6vn/uuwtmTOTlqEaQFg3hQSVeA90NmvIQyUV6FQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.0.0",
-        "@codemirror/language": "^6.0.0",
-        "@codemirror/state": "^6.0.0",
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.2.0",
-        "@lezer/lr": "^1.0.0",
-        "@lezer/yaml": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/language": {
-      "version": "6.12.4",
-      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.4.tgz",
-      "integrity": "sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.23.0",
-        "@lezer/common": "^1.5.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0",
-        "style-mod": "^4.0.0"
-      }
-    },
-    "node_modules/@codemirror/legacy-modes": {
-      "version": "6.5.3",
-      "resolved": "https://registry.npmjs.org/@codemirror/legacy-modes/-/legacy-modes-6.5.3.tgz",
-      "integrity": "sha512-xCsmIzH78MyWkib9jlPaaun57XNkfbMIhagfaZVd0iLTqlpw3jXaIcbZm72MTmmn64eTZpBVNjbyYh+QXnxRsg==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/language": "^6.0.0"
-      }
-    },
-    "node_modules/@codemirror/lint": {
-      "version": "6.9.7",
-      "resolved": "https://registry.npmjs.org/@codemirror/lint/-/lint-6.9.7.tgz",
-      "integrity": "sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.42.0",
-        "crelt": "^1.0.5"
-      }
-    },
-    "node_modules/@codemirror/search": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/search/-/search-6.7.1.tgz",
-      "integrity": "sha512-uMe5UO6PamJtSHrXhhHOzSX3ReWtiJrva6GnPMwSOrZtiExb5X5eExhr2OUZQVvdxPsKpY3Ro2mFbQadpPWmHA==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/state": "^6.0.0",
-        "@codemirror/view": "^6.37.0",
-        "crelt": "^1.0.5"
-      }
-    },
-    "node_modules/@codemirror/state": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.7.1.tgz",
-      "integrity": "sha512-9QzNDgE4EYDnAHfrTlR2lwiPciiOymLtwKK+8yHQzCc7GXhAP9xdEbEJFy2IWB1j9UGUl9BsgMmTo/ImA02T7A==",
-      "license": "MIT",
-      "dependencies": {
-        "@marijn/find-cluster-break": "^1.0.0"
-      }
-    },
-    "node_modules/@codemirror/view": {
-      "version": "6.43.9",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.9.tgz",
-      "integrity": "sha512-sTuUzTpPMFebRhg6dawChoKKgndIwfjmJgKVxBefPElcU2NwQ6AFroupk0SFqEerQyZOGRfDNnSN8Dw/lMAsXw==",
-      "license": "MIT",
-      "dependencies": {
-        "@codemirror/state": "^6.7.0",
-        "crelt": "^1.0.6",
-        "style-mod": "^4.1.0",
-        "w3c-keyname": "^2.2.4"
-      }
-    },
-    "node_modules/@csstools/color-helpers": {
-      "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
-      "integrity": "sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=20.19.0"
-      }
-    },
-    "node_modules/@csstools/css-calc": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-3.3.0.tgz",
-      "integrity": "sha512-c5ihYsPkdG6JCkU2zTMm4+k6r7RXuGxtWYhu5DHMIiF1FHzrfmHL5so11AoFpUv/tu61xfcmT4AmKoFfMPoqdQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-color-parser": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.0.tgz",
-      "integrity": "sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/color-helpers": "^6.1.1",
-        "@csstools/css-calc": "^3.3.0"
-      },
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-parser-algorithms": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-4.0.0.tgz",
-      "integrity": "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.8.tgz",
-      "integrity": "sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "peerDependencies": {
-        "css-tree": "^3.2.1"
-      },
-      "peerDependenciesMeta": {
-        "css-tree": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@csstools/css-tokenizer": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
-      "integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
-      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
-      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
-      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
-      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
-      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
-      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
-      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
-      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
-      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
-      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
-      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
-      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
-      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
-      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
-      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
-      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
-      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
-      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
-      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
-      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
-      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
-      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
-      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@exodus/bytes": {
-      "version": "1.15.1",
-      "resolved": "https://registry.npmjs.org/@exodus/bytes/-/bytes-1.15.1.tgz",
-      "integrity": "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      },
-      "peerDependencies": {
-        "@noble/hashes": "^1.8.0 || ^2.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@noble/hashes": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@floating-ui/core": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
-      "integrity": "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@floating-ui/utils": "^0.2.12"
-      }
-    },
-    "node_modules/@floating-ui/dom": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.8.0.tgz",
-      "integrity": "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@floating-ui/core": "^1.8.0",
-        "@floating-ui/utils": "^0.2.12"
-      }
-    },
-    "node_modules/@floating-ui/utils": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.12.tgz",
-      "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@lezer/common": {
-      "version": "1.5.2",
-      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.5.2.tgz",
-      "integrity": "sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==",
-      "license": "MIT"
-    },
-    "node_modules/@lezer/css": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/@lezer/css/-/css-1.3.6.tgz",
-      "integrity": "sha512-YJE78Wcg+zX8f10hiHWQ4Az48Qr/c13eId0VtRQYLBpxHDmDeSrXIlkbl+fJGW42rWC/uoUco9mhBZeVWP/A1g==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.3.0"
-      }
-    },
-    "node_modules/@lezer/highlight": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.3.tgz",
-      "integrity": "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.3.0"
-      }
-    },
-    "node_modules/@lezer/html": {
-      "version": "1.3.13",
-      "resolved": "https://registry.npmjs.org/@lezer/html/-/html-1.3.13.tgz",
-      "integrity": "sha512-oI7n6NJml729m7pjm9lvLvmXbdoMoi2f+1pwSDJkl9d68zGr7a9Btz8NdHTGQZtW2DA25ybeuv/SyDb9D5tseg==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/javascript": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.5.4.tgz",
-      "integrity": "sha512-vvYx3MhWqeZtGPwDStM2dwgljd5smolYD2lR2UyFcHfxbBQebqx8yjmFmxtJ/E6nN6u1D9srOiVWm3Rb4tmcUA==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.1.3",
-        "@lezer/lr": "^1.3.0"
-      }
-    },
-    "node_modules/@lezer/json": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@lezer/json/-/json-1.0.3.tgz",
-      "integrity": "sha512-BP9KzdF9Y35PDpv04r0VeSTKDeox5vVr3efE7eBbx3r4s3oNLfunchejZhjArmeieBH+nVOpgIiBJpEAv8ilqQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/lr": {
-      "version": "1.4.10",
-      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.10.tgz",
-      "integrity": "sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/markdown": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/@lezer/markdown/-/markdown-1.7.2.tgz",
-      "integrity": "sha512-iTkYvoVcKt3WkeL7qUDyXHONZEwLio4wj8KTNi2dnjQEXBZKMV63BpQrPqfsM+OkvuRbiSTAcycYAsQzLhRNoQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.5.0",
-        "@lezer/highlight": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/python": {
-      "version": "1.1.19",
-      "resolved": "https://registry.npmjs.org/@lezer/python/-/python-1.1.19.tgz",
-      "integrity": "sha512-MhQIURHRytsNzP/YXnqpYKW6la6voAH3kyplTOOiCdjyFY6cWWGFVmYVdHIPrElqSDf4iCDktQCockB9FxuhzQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/rust": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@lezer/rust/-/rust-1.0.2.tgz",
-      "integrity": "sha512-Lz5sIPBdF2FUXcWeCu1//ojFAZqzTQNRga0aYv6dYXqJqPfMdCAI0NzajWUd4Xijj1IKJLtjoXRPMvTKWBcqKg==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/yaml": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@lezer/yaml/-/yaml-1.0.4.tgz",
-      "integrity": "sha512-2lrrHqxalACEbxIbsjhqGpSW8kWpUKuY6RHgnSAFZa6qK62wvnPxA8hGOwOoDbwHcOFs5M4o27mjGu+P7TvBmw==",
-      "license": "MIT",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.4.0"
-      }
-    },
-    "node_modules/@marijn/find-cluster-break": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.4.tgz",
-      "integrity": "sha512-Wy0V7+SGUjnF9/TkiM1hKVDPj7jKXduPNboMVtHTA8dySMURWqfg/JZ9E2Sq8JgSJmkl7k7Qe9FLeMSrSraWmQ==",
-      "license": "MIT"
-    },
-    "node_modules/@shikijs/core": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.4.3.tgz",
-      "integrity": "sha512-QCR4q2ZO/ILJEuwiBMel4wdcTDb1JGwfjKTxPDF6x8ixOaluPrVqIn06C99AcRPhmYlBR56d/Fb+GN58GzExpg==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/primitive": "4.4.3",
-        "@shikijs/types": "4.4.3",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.5",
-        "hast-util-to-html": "^9.0.5"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.4.3.tgz",
-      "integrity": "sha512-FbOjFJp9VLdo1Wevs10BBtVxiTWwNLqZh5Gkhjgda/ioL15YOgeSl9n+6XMa3qRlPQzfhFNe641SrynFHYG0nQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.4.3",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "oniguruma-to-es": "^4.3.6"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.4.3.tgz",
-      "integrity": "sha512-EcOQkxdxGQrc1Row/cC2c96/v1dbZqGnEVu1qTuT/MJmp6+cXCvQussowVmCv5Tqr3KuY3c7IbM6HTW3LJ1k9w==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.4.3",
-        "@shikijs/vscode-textmate": "^10.0.2"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/langs": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.4.3.tgz",
-      "integrity": "sha512-ePic0yfAJGOF83D5wBHK/00EjK65oahBYxFk5epgq33WRv7X9UuxLEV8PtR0szC0z8dl7INIpIodB99JRFlR+A==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.4.3"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/primitive": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.4.3.tgz",
-      "integrity": "sha512-m0wBeLDQDeIxRdUmrCPdQqfuUamDwRL5isCfYbguKD6NiaKpVbsv+3J81DyIKgNW5h4WAIIr8T4EkgQrBBxvaQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.4.3",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.5"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/themes": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.4.3.tgz",
-      "integrity": "sha512-w8UHjeUnIR965KMWJHUPXOc2mNJUnK3vpVLYLvw5IYU2mnTTJ89E24OrJDBNiJDQ0qzb0tc4l7mrIXx5cFeIyw==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.4.3"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/types": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.4.3.tgz",
-      "integrity": "sha512-UEJxmRR++MAGR6hugn0vgVS2W/6lWAts84FFSrnlH9sP0LNol7E5+NQ792pH8liWUhyMyjhTgSUH3k7iD7tc5g==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.5"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/vscode-textmate": {
-      "version": "10.0.2",
-      "resolved": "https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz",
-      "integrity": "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==",
-      "license": "MIT"
-    },
-    "node_modules/@tauri-apps/api": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.11.1.tgz",
-      "integrity": "sha512-M2FPuYND2m+wh5hfW9ZpSdxMPdEJovPBWwoHJmwUpysTYNHaOkVFN419m/K0LIgjb/7KU2vBgsUepJWugQCvAA==",
-      "license": "Apache-2.0 OR MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/tauri"
-      }
-    },
-    "node_modules/@tauri-apps/cli": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.12.2.tgz",
-      "integrity": "sha512-PMSppzAnlT+BvZtRKuidxjRSm2r5t8kDpJ/czmmQUa0AtDNTwrjLE8vApK3phCWGg7isfnYL46Dl1jB4ArI0hA==",
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "bin": {
-        "tauri": "tauri.js"
-      },
-      "engines": {
-        "node": ">= 10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/tauri"
-      },
-      "optionalDependencies": {
-        "@tauri-apps/cli-darwin-arm64": "2.12.2",
-        "@tauri-apps/cli-darwin-x64": "2.12.2",
-        "@tauri-apps/cli-linux-arm-gnueabihf": "2.12.2",
-        "@tauri-apps/cli-linux-arm64-gnu": "2.12.2",
-        "@tauri-apps/cli-linux-arm64-musl": "2.12.2",
-        "@tauri-apps/cli-linux-riscv64-gnu": "2.12.2",
-        "@tauri-apps/cli-linux-x64-gnu": "2.12.2",
-        "@tauri-apps/cli-linux-x64-musl": "2.12.2",
-        "@tauri-apps/cli-win32-arm64-msvc": "2.12.2",
-        "@tauri-apps/cli-win32-ia32-msvc": "2.12.2",
-        "@tauri-apps/cli-win32-x64-msvc": "2.12.2"
-      }
-    },
-    "node_modules/@tauri-apps/cli-darwin-arm64": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.12.2.tgz",
-      "integrity": "sha512-Lk3zaBTfzNvA7670Al5PNgo2M/95uaDPe1yp+ILJeDOmol87XiYuK5E5+FUbK5e6U6OORx9qpZdOo2U+5tETtQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-darwin-x64": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.12.2.tgz",
-      "integrity": "sha512-2CyYjJ833JB3sKRz4B0W/Tv4oOVC16ws1bxdSCWj1XvrmanWwvZi99e5tNIoCHwHhcOm0jh+sh0PCGQyls6Z+w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.12.2.tgz",
-      "integrity": "sha512-uvt2xbone4JftKarelssi86Kqnl7JiG1Smh5+Ae+nZmtM+JUhTGmqkcqfUPXRW8Ygwog92POZvd4oGDN9j8eXQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-arm64-gnu": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.12.2.tgz",
-      "integrity": "sha512-DZlDJ24u3tlocKOYqzR+b2M+Qr+5WFcoMBZ7EfdhHN5j3ZXwBBpms4G4gyNvPCrak5vMzmdZ65ecBXPJcC+5sA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-arm64-musl": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.12.2.tgz",
-      "integrity": "sha512-pb+RTZUYH/p0gR4j4ecCCq+FNfz3W3eKuUQvVEBn7MQZx6DzfLO7FaYzt2NyDKWpdNN3lP10mdzOvw3R5P5aAQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.12.2.tgz",
-      "integrity": "sha512-nidEvDUJyHYNbIv9MUk6KiEix8IXfRh4Wj2G2SA5g8nFmgbBCwazUNWYiG/LhNeNbfZpBMLerRBUtoQ5K0GidA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-x64-gnu": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.12.2.tgz",
-      "integrity": "sha512-gkXyYn3w+Xfc8nz/DleEbkm1M7bBuU2cejqUXNmI98cA2P5kp+oPmS4ALTorb1FaNWjpsKoYZBWsbS9BXxYFkQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-linux-x64-musl": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.12.2.tgz",
-      "integrity": "sha512-MrjgoZ09s8Hsn99XvxSNvK8NQTZxi7XiyK3FxxytzfHgz2jb3qUT69CZtsokRkN/zdi9rCgrMtq+w9XNICjcfQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-win32-arm64-msvc": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.12.2.tgz",
-      "integrity": "sha512-BR+CYM7iF3lkfyTtVkwMQU/s9hwegLpj3UqDjaxKCPmixQCa1csBBPy3C75V+FhLtOjIXNna4Gt6Vm9oxbV+qA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-win32-ia32-msvc": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.12.2.tgz",
-      "integrity": "sha512-zODJo9l3TbNBM+GrO/yPqGeELNMK5cjIc+QHh1WQc3l8tD+jDZGTQyYuAxViCsM6Uh5uWJ//RnCZG9LXrvsXww==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/cli-win32-x64-msvc": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.12.2.tgz",
-      "integrity": "sha512-cQXI2ZaZmwBDt0XATCqASVanYizxkEE3ceQVlVHXaQ51HzsQUWA04c9Nz7LrrY2lgAu3jFMyat+8Yz3Z2R2qBA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 OR MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tauri-apps/plugin-dialog": {
-      "version": "2.7.3",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.7.3.tgz",
-      "integrity": "sha512-CRgE+7TP4tvq9MjBU6f04NLTFIqVMLKHk3hAqlhil00ngK9ACTrXPH3oHpKMProxILodd3YjBoKbMwSI4IEcfA==",
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@tauri-apps/api": "^2.11.0"
-      }
-    },
-    "node_modules/@tauri-apps/plugin-process": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-process/-/plugin-process-2.3.1.tgz",
-      "integrity": "sha512-nCa4fGVaDL/B9ai03VyPOjfAHRHSBz5v6F/ObsB73r/dA3MHHhZtldaDMIc0V/pnUw9ehzr2iEG+XkSEyC0JJA==",
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@tauri-apps/api": "^2.8.0"
-      }
-    },
-    "node_modules/@tauri-apps/plugin-updater": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.11.0.tgz",
-      "integrity": "sha512-AE36XkOoSna24G40jZMY15nzAnkXEPL/73tGoseGrtGOHuI/cZwWzHpZFLjKXDPgzYZ435z1gHu28LgrsBwIxQ==",
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@tauri-apps/api": "^2.11.0"
-      }
-    },
-    "node_modules/@tiptap/core": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/core/-/core-3.31.0.tgz",
-      "integrity": "sha512-SY3yE2ACharFvk0BKgotV6SbwV8R4tN5fGtWOM6deY4JNF3v6CXOD78RFwjs2HSohGWBRyJVPDvrX9nfi8Nsxg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-blockquote": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-blockquote/-/extension-blockquote-3.31.0.tgz",
-      "integrity": "sha512-E1EcYp28NOEKLkMqf9Z4t/ZjVO5hOX/c5r9nu/sfp5+KePj4TaxGDcruijP5DYJuKxlsZx2lr6/lldiK9KilXw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-bold": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-bold/-/extension-bold-3.31.0.tgz",
-      "integrity": "sha512-KB3V3/8/XSrXNM0m7Svgg8xjwG/mr9nYh0krGznmDK1eArxj2GQd5h2g0QiBy8e+G//NMEbWQxSKbhKUKz7aoQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-bullet-list": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-bullet-list/-/extension-bullet-list-3.31.0.tgz",
-      "integrity": "sha512-jLrzWDzBhfeOK/idnrpyncTuRamBNGCscDC7omG1S+CD3CFuDrp5Ws2tcv5fgASt2Vc/f9Y9zC+gOPkeIEpYFA==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extension-list": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-code": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-code/-/extension-code-3.31.0.tgz",
-      "integrity": "sha512-QWo9oItNzyzNMXoCOG4/PiCNYoTjhUKtI5NE7iRJhd9op3KsLoyIO+og+P+0ORxG59Ic76SkXl2/lILaVsB48g==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-code-block": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-code-block/-/extension-code-block-3.31.0.tgz",
-      "integrity": "sha512-y/A6N96gBPjEHqVYZ3u/yO/Anyo92iDWgYqShMXAvHprn2Ipmn32wIkX05Kv983fa6j6ySXF7A1nJdHcGCl5aQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-document": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-document/-/extension-document-3.31.0.tgz",
-      "integrity": "sha512-C2eDFoBlcRAb4sgbc9ZH+mrFFbjIS9VyoERGeDum3QRdqLEKU1h14Th7isHpGQzTvTywhXQxqXC64mgeSGXLsA==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-dropcursor": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-dropcursor/-/extension-dropcursor-3.31.0.tgz",
-      "integrity": "sha512-hIZOPfM0sGkAhPV69IK1zWMbWBd3wmhS0XCKBRcXUWrE2MW4kkaSyYprSFqtqFuUa3lVIEFrlME1WOEBJ2/2rg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extensions": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-gapcursor": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-gapcursor/-/extension-gapcursor-3.31.0.tgz",
-      "integrity": "sha512-TY1S9D9x86iIHiPiDU4KtRmLYTgE6RKa54jXubFyekUYFmgNfHuUunWmpK/Rvy6tkG1CKHNL7X+wdo8QXi+hcw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extensions": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-hard-break": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-hard-break/-/extension-hard-break-3.31.0.tgz",
-      "integrity": "sha512-e3e3YwTSxzO1bYalphs3A3zr+nYRWASMKFPzviO0C2P7vKE4kT4rvCYCWuUxIpfit8Vnh6TFVIkhrQ/6IFlDzw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-heading": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-heading/-/extension-heading-3.31.0.tgz",
-      "integrity": "sha512-ryQnvq2iUW2IwjbLniGlRZliNA5YserRTX2mCKyQcv8z/u062J01JDLlX73o47tu4DjuBzmkx6t5SsiXNODRcg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-horizontal-rule": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-horizontal-rule/-/extension-horizontal-rule-3.31.0.tgz",
-      "integrity": "sha512-RTKLnuEmGJOlxzLOmKo85hstXfuLlg+zQSKAggdD6BrSTDR5fdPZXnZTb/gDCo6chCR5BoKHu7Xv1spnPzRmEw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-italic": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-italic/-/extension-italic-3.31.0.tgz",
-      "integrity": "sha512-8Top75aMS9feCtKYADWOYLrJjx3SGvazETWZdEwDYDGZtEOB7q2+FxcRu2xi+K6Lx9LhzxS9ChULtNdBuRevkQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-link": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-link/-/extension-link-3.31.0.tgz",
-      "integrity": "sha512-arzZYxyf6in2BzdB3GR53VhSlE3ZwmY8CflXRo1xHpSpxq393myLP6FnaxLPxcfcScfOOsaYh2KAED0HJoBZfA==",
-      "license": "MIT",
-      "dependencies": {
-        "linkifyjs": "^4.3.3"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-list": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-list/-/extension-list-3.31.0.tgz",
-      "integrity": "sha512-cED2TPewS3CtzZUdCZNG/qbc6vHJunKRzkFiT8x3RF+pmtIQlrPRH5Y9sbkzLt3yg0ua5KMGFtBH37AHaKUFDw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-list-item": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-list-item/-/extension-list-item-3.31.0.tgz",
-      "integrity": "sha512-ayZa+KEMigJis0s8n3X3pqRxzsMuom9JoqE6byJ5NP2oaI2HOQ95yfcuILNKukg1nXG8vkgifEsXxjXz4O2o2g==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extension-list": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-list-keymap": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-list-keymap/-/extension-list-keymap-3.31.0.tgz",
-      "integrity": "sha512-bmZZmQyH0PibpIUA2thA3Cgm82cnrcC4oU4eNqiaoUqrva1NuOIqb71L2Br9keBnmtQKEtkzdODs4x+eI53kBg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extension-list": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-mention": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-mention/-/extension-mention-3.31.0.tgz",
-      "integrity": "sha512-BqCFfRM0oEmu8XgOFgfhusK5RJbLF8WG4BnKdgaKCVUNLGqbqXvQgKXcwLKO530PmoWjfD4sUdlusV4ZaRnhMg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0",
-        "@tiptap/suggestion": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-ordered-list": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-ordered-list/-/extension-ordered-list-3.31.0.tgz",
-      "integrity": "sha512-KLCax7pI/3JTCkMY01n2+CXwZRPPsIVR1fvSmkFMryUPonkkMYWSUlXCuYKvF22+kM0gU0kiXsVjqsn/YFdeDg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extension-list": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-paragraph": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-paragraph/-/extension-paragraph-3.31.0.tgz",
-      "integrity": "sha512-78l9D/jpKvvWXrBBzYPfgqwonBY76+1MMgSovkPffIbya+jaYDJdZhIpeCZXtSBDnw8cYE/rheAeusN1QG3SVQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-placeholder": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-placeholder/-/extension-placeholder-3.31.0.tgz",
-      "integrity": "sha512-zH1Z8xZX72P7wZ3HD6fUGJ7XTVWMgyN5Sy+OiD3tuuxfr/oUvS6ykaoGBdHGTMBdrXZpp+GfAcch1MrvLGn8oA==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/extensions": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-strike": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-strike/-/extension-strike-3.31.0.tgz",
-      "integrity": "sha512-M1X94ve0TNU7LrHCDn6nKf6vM8PEaKQt3FLTwhTIw5uTbx2Imw+uyRrySDdxLWHY/ul8x17I2w9MVLqK/D+Zvw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-text": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-text/-/extension-text-3.31.0.tgz",
-      "integrity": "sha512-K+8nIKgNNBiL1+AarcuzvPoRpjuFk5qOe9MM/n9O3HyTTLeWNfRV/zFifcpSoHmhf0QvEAXqmnxDiIpyCpy9+g==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extension-underline": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-underline/-/extension-underline-3.31.0.tgz",
-      "integrity": "sha512-B4VK5nu0UdKl7OiMvIcjDPMYmhe8+v1B763Is/GzPSJOMstUHRqAqPx2AsPla6A4UGuZwTx//ajVa5QAGionZQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/extensions": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/extensions/-/extensions-3.31.0.tgz",
-      "integrity": "sha512-WOv9Y1VjhzAYycrIGPygwmLkoO/UdFYFE5uDWN+FJWMui5sLmLrmfKtOOYzeWIevxomFGix/wl5hqaVGIev1+g==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@tiptap/pm": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/pm/-/pm-3.31.0.tgz",
-      "integrity": "sha512-JGPUSPLDFPjgFZHcNSghVJmEfvYp2SRPZQ1K8AZOuviEsUNvkYmJsBdudeYwUYNzYO38L4Yy0G6UMSuniBDIMg==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-changeset": "^2.4.1",
-        "prosemirror-commands": "^1.7.1",
-        "prosemirror-dropcursor": "^1.8.2",
-        "prosemirror-gapcursor": "^1.4.1",
-        "prosemirror-history": "^1.5.0",
-        "prosemirror-inputrules": "^1.5.1",
-        "prosemirror-keymap": "^1.2.3",
-        "prosemirror-model": "^1.25.11",
-        "prosemirror-schema-list": "^1.5.1",
-        "prosemirror-state": "^1.4.4",
-        "prosemirror-tables": "^1.8.5",
-        "prosemirror-transform": "^1.12.0",
-        "prosemirror-view": "^1.41.9"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      }
-    },
-    "node_modules/@tiptap/starter-kit": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/starter-kit/-/starter-kit-3.31.0.tgz",
-      "integrity": "sha512-P80nhDEsBf6EMTaRb/ld3BaQW7iqITPR6BiIjOjbO3QDivCz/rGDKSS6q4ngsXfXOpSBc/clo/g0OyAdA8+Q4Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@tiptap/core": "3.31.0",
-        "@tiptap/extension-blockquote": "3.31.0",
-        "@tiptap/extension-bold": "3.31.0",
-        "@tiptap/extension-bullet-list": "3.31.0",
-        "@tiptap/extension-code": "3.31.0",
-        "@tiptap/extension-code-block": "3.31.0",
-        "@tiptap/extension-document": "3.31.0",
-        "@tiptap/extension-dropcursor": "3.31.0",
-        "@tiptap/extension-gapcursor": "3.31.0",
-        "@tiptap/extension-hard-break": "3.31.0",
-        "@tiptap/extension-heading": "3.31.0",
-        "@tiptap/extension-horizontal-rule": "3.31.0",
-        "@tiptap/extension-italic": "3.31.0",
-        "@tiptap/extension-link": "3.31.0",
-        "@tiptap/extension-list": "3.31.0",
-        "@tiptap/extension-list-item": "3.31.0",
-        "@tiptap/extension-list-keymap": "3.31.0",
-        "@tiptap/extension-ordered-list": "3.31.0",
-        "@tiptap/extension-paragraph": "3.31.0",
-        "@tiptap/extension-strike": "3.31.0",
-        "@tiptap/extension-text": "3.31.0",
-        "@tiptap/extension-underline": "3.31.0",
-        "@tiptap/extensions": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      }
-    },
-    "node_modules/@tiptap/suggestion": {
-      "version": "3.31.0",
-      "resolved": "https://registry.npmjs.org/@tiptap/suggestion/-/suggestion-3.31.0.tgz",
-      "integrity": "sha512-p/m8K4jmF+b5JdRcZ5onOKxJf3dsTcXhnV6qAjDu1xrvpY8lXZe4DXgtuAUvh5Q4Msmq6IYuMAvleR4WAkIXIQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/ueberdosis"
-      },
-      "peerDependencies": {
-        "@floating-ui/dom": "^1.0.0",
-        "@tiptap/core": "3.31.0",
-        "@tiptap/pm": "3.31.0"
-      }
-    },
-    "node_modules/@types/hast": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
-      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "*"
-      }
-    },
-    "node_modules/@types/mdast": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
-      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "*"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz",
-      "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.3.0"
-      }
-    },
-    "node_modules/@types/trusted-types": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@types/unist": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
-      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
-      "license": "MIT"
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@ungap/structured-clone": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
-      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
-      "license": "ISC"
-    },
-    "node_modules/@vscode/codicons": {
-      "version": "0.0.46-24",
-      "resolved": "https://registry.npmjs.org/@vscode/codicons/-/codicons-0.0.46-24.tgz",
-      "integrity": "sha512-KIDWUYxG6eh+DHRg+3G4bS487T+g1ZkLfB4HylOBbCcHsvLdfLMRM/m92DS1Ljhi8nglLr9ucwwWhHTEAC+DpA==",
-      "dev": true,
-      "license": "CC-BY-4.0"
-    },
-    "node_modules/@workshop/look": {
-      "resolved": "look",
-      "link": true
-    },
-    "node_modules/@workshop/platform": {
-      "resolved": "platform",
-      "link": true
-    },
-    "node_modules/bidi-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/bidi-js/-/bidi-js-1.0.3.tgz",
-      "integrity": "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "require-from-string": "^2.0.2"
-      }
-    },
-    "node_modules/ccount": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
-      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-html4": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
-      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-legacy": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
-      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/comma-separated-tokens": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
-      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/crelt": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.7.tgz",
-      "integrity": "sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA==",
-      "license": "MIT"
-    },
-    "node_modules/css-tree": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
-      "integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mdn-data": "2.27.1",
-        "source-map-js": "^1.2.1"
-      },
-      "engines": {
-        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
-      }
-    },
-    "node_modules/data-urls": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
-      "integrity": "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^16.0.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      }
-    },
-    "node_modules/data-urls/node_modules/whatwg-url": {
-      "version": "16.0.1",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-16.0.1.tgz",
-      "integrity": "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.11.0",
-        "tr46": "^6.0.0",
-        "webidl-conversions": "^8.0.1"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      }
-    },
-    "node_modules/decimal.js": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
-      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/dequal": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
-      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/devlop": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
-      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "license": "MIT",
-      "dependencies": {
-        "dequal": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/dockview": {
-      "version": "8.3.1",
-      "resolved": "https://registry.npmjs.org/dockview/-/dockview-8.3.1.tgz",
-      "integrity": "sha512-2odBC9cDKcVCVx8Db86vq9s9JZKzbgvdkxDzcfsrD9nORLc5UqhLgLvVcJguorBv7CyEpKDzFO1JVLYWJCYrJA==",
-      "license": "MIT",
-      "dependencies": {
-        "dockview-core": "^8.3.1"
-      }
-    },
-    "node_modules/dockview-core": {
-      "version": "8.3.1",
-      "resolved": "https://registry.npmjs.org/dockview-core/-/dockview-core-8.3.1.tgz",
-      "integrity": "sha512-6Loais9hlIRo25sTQSWGWlgbPr22ddoLBzpGDFaTnocawnC45twp5f2S2WxUz5/HPa/a65I4yxKUqZa8xrcc5Q==",
-      "license": "MIT"
-    },
-    "node_modules/dompurify": {
-      "version": "3.4.14",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz",
-      "integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
-    "node_modules/entities": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-8.0.0.tgz",
-      "integrity": "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
-    "node_modules/esbuild": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
-      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.2",
-        "@esbuild/android-arm": "0.28.2",
-        "@esbuild/android-arm64": "0.28.2",
-        "@esbuild/android-x64": "0.28.2",
-        "@esbuild/darwin-arm64": "0.28.2",
-        "@esbuild/darwin-x64": "0.28.2",
-        "@esbuild/freebsd-arm64": "0.28.2",
-        "@esbuild/freebsd-x64": "0.28.2",
-        "@esbuild/linux-arm": "0.28.2",
-        "@esbuild/linux-arm64": "0.28.2",
-        "@esbuild/linux-ia32": "0.28.2",
-        "@esbuild/linux-loong64": "0.28.2",
-        "@esbuild/linux-mips64el": "0.28.2",
-        "@esbuild/linux-ppc64": "0.28.2",
-        "@esbuild/linux-riscv64": "0.28.2",
-        "@esbuild/linux-s390x": "0.28.2",
-        "@esbuild/linux-x64": "0.28.2",
-        "@esbuild/netbsd-arm64": "0.28.2",
-        "@esbuild/netbsd-x64": "0.28.2",
-        "@esbuild/openbsd-arm64": "0.28.2",
-        "@esbuild/openbsd-x64": "0.28.2",
-        "@esbuild/openharmony-arm64": "0.28.2",
-        "@esbuild/sunos-x64": "0.28.2",
-        "@esbuild/win32-arm64": "0.28.2",
-        "@esbuild/win32-ia32": "0.28.2",
-        "@esbuild/win32-x64": "0.28.2"
-      }
-    },
-    "node_modules/hast-util-to-html": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/hast-util-to-html/-/hast-util-to-html-9.0.5.tgz",
-      "integrity": "sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/hast": "^3.0.0",
-        "@types/unist": "^3.0.0",
-        "ccount": "^2.0.0",
-        "comma-separated-tokens": "^2.0.0",
-        "hast-util-whitespace": "^3.0.0",
-        "html-void-elements": "^3.0.0",
-        "mdast-util-to-hast": "^13.0.0",
-        "property-information": "^7.0.0",
-        "space-separated-tokens": "^2.0.0",
-        "stringify-entities": "^4.0.0",
-        "zwitch": "^2.0.4"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/hast-util-whitespace": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
-      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/hast": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/html-encoding-sniffer": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz",
-      "integrity": "sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.6.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      }
-    },
-    "node_modules/html-void-elements": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/html-void-elements/-/html-void-elements-3.0.0.tgz",
-      "integrity": "sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-potential-custom-element-name": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/jsdom": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.0.1.tgz",
-      "integrity": "sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@asamuzakjp/css-color": "^6.0.5",
-        "@asamuzakjp/dom-selector": "^8.3.0",
-        "@bramus/specificity": "^2.4.2",
-        "@csstools/css-syntax-patches-for-csstree": "^1.1.7",
-        "@exodus/bytes": "^1.15.1",
-        "css-tree": "^3.2.1",
-        "data-urls": "^7.0.0",
-        "decimal.js": "^10.6.0",
-        "html-encoding-sniffer": "^6.0.0",
-        "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.5.2",
-        "parse5": "^8.0.1",
-        "saxes": "^6.0.0",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^6.0.2",
-        "undici": "^8.9.0",
-        "w3c-xmlserializer": "^5.0.0",
-        "webidl-conversions": "^8.0.1",
-        "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^17.1.0",
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      },
-      "peerDependencies": {
-        "canvas": "^3.2.3"
-      },
-      "peerDependenciesMeta": {
-        "canvas": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/linkifyjs": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/linkifyjs/-/linkifyjs-4.3.3.tgz",
-      "integrity": "sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==",
-      "license": "MIT"
-    },
-    "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/marked": {
-      "version": "18.0.11",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.11.tgz",
-      "integrity": "sha512-HnslJfsZkRPBDJRHvVtAaWlZHEpSu7u8LgQuJCELjRKuWR+hpq4A7sLq3p8HaI9ypVoXDXxV34CsQJEe1+J5Aw==",
-      "license": "MIT",
-      "bin": {
-        "marked": "bin/marked.js"
-      },
-      "engines": {
-        "node": ">= 20"
-      }
-    },
-    "node_modules/mdast-util-to-hast": {
-      "version": "13.2.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
-      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/hast": "^3.0.0",
-        "@types/mdast": "^4.0.0",
-        "@ungap/structured-clone": "^1.0.0",
-        "devlop": "^1.0.0",
-        "micromark-util-sanitize-uri": "^2.0.0",
-        "trim-lines": "^3.0.0",
-        "unist-util-position": "^5.0.0",
-        "unist-util-visit": "^5.0.0",
-        "vfile": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdn-data": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
-      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
-      "dev": true,
-      "license": "CC0-1.0"
-    },
-    "node_modules/micromark-util-character": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
-      "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-encode": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
-      "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/micromark-util-sanitize-uri": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
-      "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-encode": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-symbol": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
-      "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/micromark-util-types": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
-      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/oniguruma-parser": {
-      "version": "0.12.2",
-      "resolved": "https://registry.npmjs.org/oniguruma-parser/-/oniguruma-parser-0.12.2.tgz",
-      "integrity": "sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw==",
-      "license": "MIT"
-    },
-    "node_modules/oniguruma-to-es": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/oniguruma-to-es/-/oniguruma-to-es-4.3.6.tgz",
-      "integrity": "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA==",
-      "license": "MIT",
-      "dependencies": {
-        "oniguruma-parser": "^0.12.2",
-        "regex": "^6.1.0",
-        "regex-recursion": "^6.0.2"
-      }
-    },
-    "node_modules/orderedmap": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/orderedmap/-/orderedmap-2.1.1.tgz",
-      "integrity": "sha512-TvAWxi0nDe1j/rtMcWcIj94+Ffe6n7zhow33h40SKxmsmozs6dz/e+EajymfoFcHd7sxNn8yHM8839uixMOV6g==",
-      "license": "MIT"
-    },
-    "node_modules/parse5": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
-      "integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "entities": "^8.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/inikulin/parse5?sponsor=1"
-      }
-    },
-    "node_modules/property-information": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
-      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/prosemirror-changeset": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/prosemirror-changeset/-/prosemirror-changeset-2.4.2.tgz",
-      "integrity": "sha512-ViYrjMSg3YFiXwIhKaluu+/mi3Yrxt6AR8ri14ulTaGcZtXO1CThl7A2gv79qx5fQnOw8woKwyBU2u+9PVCm3w==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-transform": "^1.0.0"
-      }
-    },
-    "node_modules/prosemirror-commands": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/prosemirror-commands/-/prosemirror-commands-1.7.2.tgz",
-      "integrity": "sha512-q6Q6szxqdu9Xd6EcdKsqXghu5nQdZTpB4Q9yd04WRc7/jt763e/rT60Owh0L1GYY+T46o5rD+9lEN36dZS43tw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-model": "^1.0.0",
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-transform": "^1.10.2"
-      }
-    },
-    "node_modules/prosemirror-dropcursor": {
-      "version": "1.8.3",
-      "resolved": "https://registry.npmjs.org/prosemirror-dropcursor/-/prosemirror-dropcursor-1.8.3.tgz",
-      "integrity": "sha512-FoYbsJR8gK+DGlqhNoE29Loa38eIZPzQRIb1VMaDNBoo4OLP6vVof/jR8qFY/6XvUd6Dhug8MDCHl2a/h8RTfQ==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-transform": "^1.1.0",
-        "prosemirror-view": "^1.1.0"
-      }
-    },
-    "node_modules/prosemirror-gapcursor": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/prosemirror-gapcursor/-/prosemirror-gapcursor-1.4.1.tgz",
-      "integrity": "sha512-pMdYaEnjNMSwl11yjEGtgTmLkR08m/Vl+Jj443167p9eB3HVQKhYCc4gmHVDsLPODfZfjr/MmirsdyZziXbQKw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-keymap": "^1.0.0",
-        "prosemirror-model": "^1.0.0",
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-view": "^1.0.0"
-      }
-    },
-    "node_modules/prosemirror-history": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/prosemirror-history/-/prosemirror-history-1.5.0.tgz",
-      "integrity": "sha512-zlzTiH01eKA55UAf1MEjtssJeHnGxO0j4K4Dpx+gnmX9n+SHNlDqI2oO1Kv1iPN5B1dm5fsljCfqKF9nFL6HRg==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-state": "^1.2.2",
-        "prosemirror-transform": "^1.0.0",
-        "prosemirror-view": "^1.31.0",
-        "rope-sequence": "^1.3.0"
-      }
-    },
-    "node_modules/prosemirror-inputrules": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/prosemirror-inputrules/-/prosemirror-inputrules-1.5.1.tgz",
-      "integrity": "sha512-7wj4uMjKaXWAQ1CDgxNzNtR9AlsuwzHfdFH1ygEHA2KHF2DOEaXl1CJfNPAKCg9qNEh4rum975QLaCiQPyY6Fw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-transform": "^1.0.0"
-      }
-    },
-    "node_modules/prosemirror-keymap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/prosemirror-keymap/-/prosemirror-keymap-1.2.3.tgz",
-      "integrity": "sha512-4HucRlpiLd1IPQQXNqeo81BGtkY8Ai5smHhKW9jjPKRc2wQIxksg7Hl1tTI2IfT2B/LgX6bfYvXxEpJl7aKYKw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-state": "^1.0.0",
-        "w3c-keyname": "^2.2.0"
-      }
-    },
-    "node_modules/prosemirror-model": {
-      "version": "1.25.11",
-      "resolved": "https://registry.npmjs.org/prosemirror-model/-/prosemirror-model-1.25.11.tgz",
-      "integrity": "sha512-QWg9RhnpLlogAmp3p96uEFrE5txQpFynd4vhBAELkwgOCWQs/X0yCzB3/hrHqiPwf91RG5KyWq6553zs9JqIOQ==",
-      "license": "MIT",
-      "dependencies": {
-        "orderedmap": "^2.0.0"
-      }
-    },
-    "node_modules/prosemirror-schema-list": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/prosemirror-schema-list/-/prosemirror-schema-list-1.5.1.tgz",
-      "integrity": "sha512-927lFx/uwyQaGwJxLWCZRkjXG0p48KpMj6ueoYiu4JX05GGuGcgzAy62dfiV8eFZftgyBUvLx76RsMe20fJl+Q==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-model": "^1.0.0",
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-transform": "^1.7.3"
-      }
-    },
-    "node_modules/prosemirror-state": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/prosemirror-state/-/prosemirror-state-1.4.4.tgz",
-      "integrity": "sha512-6jiYHH2CIGbCfnxdHbXZ12gySFY/fz/ulZE333G6bPqIZ4F+TXo9ifiR86nAHpWnfoNjOb3o5ESi7J8Uz1jXHw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-model": "^1.0.0",
-        "prosemirror-transform": "^1.0.0",
-        "prosemirror-view": "^1.27.0"
-      }
-    },
-    "node_modules/prosemirror-tables": {
-      "version": "1.8.5",
-      "resolved": "https://registry.npmjs.org/prosemirror-tables/-/prosemirror-tables-1.8.5.tgz",
-      "integrity": "sha512-V/0cDCsHKHe/tfWkeCmthNUcEp1IVO3p6vwN8XtwE9PZQLAZJigbw3QoraAdfJPir4NKJtNvOB8oYGKRl+t0Dw==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-keymap": "^1.2.3",
-        "prosemirror-model": "^1.25.4",
-        "prosemirror-state": "^1.4.4",
-        "prosemirror-transform": "^1.10.5",
-        "prosemirror-view": "^1.41.4"
-      }
-    },
-    "node_modules/prosemirror-transform": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/prosemirror-transform/-/prosemirror-transform-1.12.1.tgz",
-      "integrity": "sha512-t4F5615FycnCqsX7ShTUs8+jfnwcf46kuFRvSl/3qFx2QTZ4DjgowesLHQXcFP7G//TjesqZG3WtgL7vdyVJyA==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-model": "^1.21.0"
-      }
-    },
-    "node_modules/prosemirror-view": {
-      "version": "1.42.3",
-      "resolved": "https://registry.npmjs.org/prosemirror-view/-/prosemirror-view-1.42.3.tgz",
-      "integrity": "sha512-oTN7EtH+CpwxU9NrwEYWd0UZ4JUx7l048l5A2Xppm4p/60isZYLnth9QVQmC3VRIvdrIWCxwZSd+Uz791G31/w==",
-      "license": "MIT",
-      "dependencies": {
-        "prosemirror-model": "^1.25.8",
-        "prosemirror-state": "^1.0.0",
-        "prosemirror-transform": "^1.1.0"
-      }
-    },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/regex": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/regex/-/regex-6.1.0.tgz",
-      "integrity": "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg==",
-      "license": "MIT",
-      "dependencies": {
-        "regex-utilities": "^2.3.0"
-      }
-    },
-    "node_modules/regex-recursion": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/regex-recursion/-/regex-recursion-6.0.2.tgz",
-      "integrity": "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg==",
-      "license": "MIT",
-      "dependencies": {
-        "regex-utilities": "^2.3.0"
-      }
-    },
-    "node_modules/regex-utilities": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/regex-utilities/-/regex-utilities-2.3.0.tgz",
-      "integrity": "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng==",
-      "license": "MIT"
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/rope-sequence": {
-      "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/rope-sequence/-/rope-sequence-1.3.4.tgz",
-      "integrity": "sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ==",
-      "license": "MIT"
-    },
-    "node_modules/saxes": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
-      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "xmlchars": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=v12.22.7"
-      }
-    },
-    "node_modules/shiki": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.4.3.tgz",
-      "integrity": "sha512-Mb/GvXPHBAXdgGIcnfU5L3ldpn1XcxrGkPHwqgRx17/I2XRfqlFKk2vGkHWINn1kdXvzJZeuO3is6I9KLPFm0g==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/core": "4.4.3",
-        "@shikijs/engine-javascript": "4.4.3",
-        "@shikijs/engine-oniguruma": "4.4.3",
-        "@shikijs/langs": "4.4.3",
-        "@shikijs/themes": "4.4.3",
-        "@shikijs/types": "4.4.3",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.5"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/space-separated-tokens": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
-      "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/stringify-entities": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
-      "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==",
-      "license": "MIT",
-      "dependencies": {
-        "character-entities-html4": "^2.0.0",
-        "character-entities-legacy": "^3.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/style-mod": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/style-mod/-/style-mod-4.1.3.tgz",
-      "integrity": "sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==",
-      "license": "MIT"
-    },
-    "node_modules/symbol-tree": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/tldts": {
-      "version": "7.4.11",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.11.tgz",
-      "integrity": "sha512-aBiNayCfTQxuIJBm06M+xR14cYaYlDlSXZbgsnKzKNxDKUVq7KFwTjwBSsb7m9Y5xO8WfPnBc63WaYFMTGlvqw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tldts-core": "^7.4.11"
-      },
-      "bin": {
-        "tldts": "bin/cli.js"
-      }
-    },
-    "node_modules/tldts-core": {
-      "version": "7.4.11",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.11.tgz",
-      "integrity": "sha512-CW3WN2rIIE/Of21mulhgnGOwoDyEFNygyIBOONSdyAuSATgMMUCpLeUlB+E8sAwA5xRV9hYPl+kyZ9citHCaKg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/tough-cookie": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
-      "integrity": "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tldts": "^7.0.5"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/tr46": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-6.0.0.tgz",
-      "integrity": "sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "punycode": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/trim-lines": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
-      "integrity": "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc"
-      },
-      "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
-      }
-    },
-    "node_modules/undici": {
-      "version": "8.10.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz",
-      "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=22.19.0"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/unist-util-is": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
-      "integrity": "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-position": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unist-util-position/-/unist-util-position-5.0.0.tgz",
-      "integrity": "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-stringify-position": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
-      "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.1.0.tgz",
-      "integrity": "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0",
-        "unist-util-is": "^6.0.0",
-        "unist-util-visit-parents": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit-parents": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
-      "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0",
-        "unist-util-is": "^6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
-      "integrity": "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0",
-        "vfile-message": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-message": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-4.0.3.tgz",
-      "integrity": "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/unist": "^3.0.0",
-        "unist-util-stringify-position": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/w3c-keyname": {
-      "version": "2.2.8",
-      "resolved": "https://registry.npmjs.org/w3c-keyname/-/w3c-keyname-2.2.8.tgz",
-      "integrity": "sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==",
-      "license": "MIT"
-    },
-    "node_modules/w3c-xmlserializer": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
-      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz",
-      "integrity": "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/whatwg-mimetype": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz",
-      "integrity": "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/whatwg-url": {
-      "version": "17.1.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-17.1.0.tgz",
-      "integrity": "sha512-3GeworPmc2ZfEEHP7lEbUfBX/L75wdEsi0rLNhXcXxnoN5jyq0SL5gCy06SGW2cyTIZdTvWIDQNQoza++vKeaw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.15.1",
-        "tr46": "^6.0.0",
-        "webidl-conversions": "^8.0.1"
-      },
-      "engines": {
-        "node": "^22.14.0 || >=24.0.0"
-      }
-    },
-    "node_modules/workshop-ui": {
-      "resolved": "ui",
-      "link": true
-    },
-    "node_modules/xml-name-validator": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
-      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/xmlchars": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/zwitch": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
-      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "platform": {
-      "name": "@workshop/platform",
-      "version": "0.0.0",
-      "dependencies": {
-        "dockview": "^8.3.1"
-      }
-    },
-    "ui": {
-      "name": "workshop-ui",
-      "version": "0.0.0",
-      "dependencies": {
-        "@codemirror/autocomplete": "^6.20.3",
-        "@codemirror/commands": "^6.11.0",
-        "@codemirror/lang-javascript": "^6.2.5",
-        "@codemirror/lang-json": "^6.0.2",
-        "@codemirror/lang-markdown": "^6.5.2",
-        "@codemirror/lang-python": "^6.2.1",
-        "@codemirror/lang-rust": "^6.0.2",
-        "@codemirror/lang-yaml": "^6.1.3",
-        "@codemirror/language": "^6.12.4",
-        "@codemirror/legacy-modes": "^6.5.3",
-        "@codemirror/lint": "^6.9.7",
-        "@codemirror/search": "^6.7.1",
-        "@codemirror/state": "^6.7.1",
-        "@codemirror/view": "^6.43.9",
-        "@lezer/highlight": "^1.2.3",
-        "@tauri-apps/api": "^2.11.1",
-        "@tauri-apps/plugin-dialog": "^2.7.3",
-        "@tauri-apps/plugin-process": "^2.3.1",
-        "@tauri-apps/plugin-updater": "^2.11.0",
-        "@tiptap/core": "^3.31.0",
-        "@tiptap/extension-mention": "^3.31.0",
-        "@tiptap/extension-placeholder": "^3.31.0",
-        "@tiptap/pm": "^3.31.0",
-        "@tiptap/starter-kit": "^3.31.0",
-        "@tiptap/suggestion": "^3.31.0",
-        "@workshop/look": "*",
-        "@workshop/platform": "*",
-        "dockview": "^8.3.1",
-        "dompurify": "^3.4.14",
-        "marked": "^18.0.11",
-        "shiki": "^4.4.3"
-      },
-      "devDependencies": {
-        "@types/node": "^26.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    }
-  }
-}
diff --git a/crates/workshop/package.json b/crates/workshop/package.json
deleted file mode 100644
index b211eb3e9..000000000
--- a/crates/workshop/package.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "private": true,
-  "workspaces": [
-    "ui",
-    "look",
-    "platform"
-  ],
-  "devDependencies": {
-    "@tauri-apps/cli": "2.12.2",
-    "esbuild": "^0.28.2",
-    "jsdom": "^30.0.1",
-    "typescript": "^7.0.2"
-  }
-}
diff --git a/crates/workshop/platform/AGENTS.md b/crates/workshop/platform/AGENTS.md
deleted file mode 100644
index 2ccf0cfb5..000000000
--- a/crates/workshop/platform/AGENTS.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# platform
-
-- `dockview` imports are type-only by convention: the boundary guard (`test/boundary.mjs`) does not check import kind, so keep them `import type`.
-- Framework contracts and their service tokens live here. Product contracts and their tokens stay in `crates/workshop/ui/src/services/`.
-- Nothing here names a feature, a panel type, or an LED.
diff --git a/crates/workshop/platform/action-registry.ts b/crates/workshop/platform/action-registry.ts
deleted file mode 100644
index 826f87ae7..000000000
--- a/crates/workshop/platform/action-registry.ts
+++ /dev/null
@@ -1,200 +0,0 @@
-// The action registry: the single registration point every feature
-// contribution file calls (the VS Code registerAction2 pattern). One
-// action descriptor fans out into three registries, the command
-// registry, the menu registry, and the keybinding registry. The command
-// registry gets the command with its metadata, the menu registry gets
-// one row per menu entry plus a CommandPalette row when f1 is set, and
-// the keybinding registry gets the keybinding rule with the action's
-// precondition ANDed into the rule's when, so a chord never fires while
-// the command's precondition fails.
-//
-// Every when, precondition, toggled, and keybinding string is parsed
-// once at registration; a malformed string comes back as a ParseError
-// value with nothing registered, so a bad contribution can never throw
-// at render or dispatch. A successful registration returns one
-// DisposableStore that unwinds the command, the menu rows, and the
-// keybinding rule together.
-//
-// The module-level registerAction writes to the shared Commands, Menus,
-// and KeybindingsRegistry singletons; tests build their own with
-// createActionRegistry.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { err, ok, type Result } from "./result";
-import { DisposableStore, type IDisposable } from "./lifecycle";
-import { Commands, type CommandRegistry } from "./command-registry";
-import { ContextKeyExpr, type ParseError } from "./context-key-expr";
-import { detectPlatform, parseKeybinding, type KeybindingPlatform } from "./keybinding-parser";
-import { KeybindingsRegistry, type KeybindingWeight } from "./keybinding-registry";
-import { MenuId, Menus, type MenuRegistry } from "./menu-registry";
-
-/** One menu placement for an action. */
-export interface ActionMenuEntry {
-  /** The menu the row lands in. */
-  readonly id: MenuId;
-  /** The sort group; "navigation" sorts first. */
-  readonly group?: string;
-  /** The position within the group. */
-  readonly order?: number;
-  /** The when-expression gating the row's visibility. */
-  readonly when?: string;
-  /** The arguments passed to the command's run. */
-  readonly args?: readonly unknown[];
-}
-
-/** The action's keybinding, in the shape of VS Code's keybinding contribution. */
-export interface ActionKeybinding {
-  /** The chord string, e.g. "ctrlcmd+s" or "ctrl+m ctrl+o". */
-  readonly keybinding: string;
-  /** The when-expression gating the rule; the precondition is ANDed in. */
-  readonly when?: string;
-  /** The weight tier; defaults to WorkbenchContrib. */
-  readonly weight?: KeybindingWeight;
-}
-
-/** One action: a command plus its menu, palette, and keybinding placements. */
-export interface ActionDescriptor {
-  /** The command id, e.g. "workbench.action.files.save". */
-  readonly id: string;
-  /** The display title, e.g. "Save". */
-  readonly title: string;
-  /** The category prefix, e.g. "File". */
-  readonly category?: string;
-  /** When true, the action appears in the command palette. */
-  readonly f1?: boolean;
-  /** The when-expression gating enablement; ANDed into the keybinding's when. */
-  readonly precondition?: string;
-  /** The when-expression driving the checked state. */
-  readonly toggled?: string;
-  /** The action's keybinding rule. */
-  readonly keybinding?: ActionKeybinding;
-  /** The menus the action appears in. */
-  readonly menu?: readonly ActionMenuEntry[];
-  /** Runs the command; arguments come from the menu row or the caller. */
-  readonly run: (...args: readonly unknown[]) => void | Promise<void>;
-}
-
-/** The registries an action registry writes to, plus the chord platform. */
-export interface ActionRegistryDeps {
-  readonly commands: CommandRegistry;
-  readonly menus: MenuRegistry;
-  readonly keybindings: KeybindingsRegistry;
-  /** The platform chord strings parse against (the ctrlcmd resolution). */
-  readonly platform: KeybindingPlatform;
-}
-
-/** The action registrar over one set of registries. */
-export interface ActionRegistry {
-  /**
-   * Registers one action across the command, menu, and keybinding
-   * registries. Every expression and chord string is parsed first; a
-   * malformed string returns a ParseError and registers nothing. On
-   * success the returned DisposableStore unwinds the command, every
-   * menu row, and the keybinding rule together.
-   */
-  registerAction(action: ActionDescriptor): Result<IDisposable, ParseError>;
-}
-
-/** Parses a when-expression, tagging the failure with the field name. */
-function validateWhen(field: string, when: string | undefined): Result<undefined, ParseError> {
-  if (when === undefined) {
-    return ok(undefined);
-  }
-  const parsed = ContextKeyExpr.deserialize(when);
-  if (!parsed.ok) {
-    return err({ message: `${field} '${when}' is malformed: ${parsed.error.message}`, offset: parsed.error.offset });
-  }
-  return ok(undefined);
-}
-
-/** Joins the precondition and a rule when into one ANDed expression. */
-function combineWhen(precondition: string | undefined, when: string | undefined): string | undefined {
-  if (precondition !== undefined && when !== undefined) {
-    return `(${precondition}) && (${when})`;
-  }
-  return precondition ?? when;
-}
-
-/** Builds an action registry over `deps`. */
-export function createActionRegistry(deps: ActionRegistryDeps): ActionRegistry {
-  function registerAction(action: ActionDescriptor): Result<IDisposable, ParseError> {
-    const precondition = validateWhen("precondition", action.precondition);
-    if (!precondition.ok) {
-      return precondition;
-    }
-    const toggled = validateWhen("toggled", action.toggled);
-    if (!toggled.ok) {
-      return toggled;
-    }
-    for (const entry of action.menu ?? []) {
-      const menuWhen = validateWhen(`menu '${entry.id}' when`, entry.when);
-      if (!menuWhen.ok) {
-        return menuWhen;
-      }
-    }
-    if (action.keybinding !== undefined) {
-      const chord = parseKeybinding(action.keybinding.keybinding, deps.platform);
-      if (!chord.ok) {
-        return err({
-          message: `keybinding '${action.keybinding.keybinding}' for '${action.id}' is malformed: ${chord.error.message}`,
-          offset: chord.error.offset,
-        });
-      }
-      const keyWhen = validateWhen("keybinding when", action.keybinding.when);
-      if (!keyWhen.ok) {
-        return keyWhen;
-      }
-    }
-
-    const store = new DisposableStore();
-    store.add(
-      deps.commands.register(action.id, {
-        run: action.run,
-        title: action.title,
-        category: action.category,
-        precondition: action.precondition,
-        toggled: action.toggled,
-      }),
-    );
-    for (const entry of action.menu ?? []) {
-      store.add(
-        deps.menus.appendMenuItem(entry.id, {
-          command: action.id,
-          args: entry.args,
-          when: entry.when,
-          group: entry.group,
-          order: entry.order,
-        }),
-      );
-    }
-    if (action.f1 === true) {
-      store.add(deps.menus.appendMenuItem(MenuId.CommandPalette, { command: action.id }));
-    }
-    if (action.keybinding !== undefined) {
-      store.add(
-        deps.keybindings.registerKeybindingRule({
-          id: action.id,
-          keybinding: action.keybinding.keybinding,
-          when: combineWhen(action.precondition, action.keybinding.when),
-          weight: action.keybinding.weight,
-        }),
-      );
-    }
-    return ok(store);
-  }
-
-  return { registerAction };
-}
-
-const shared = createActionRegistry({
-  commands: Commands,
-  menus: Menus,
-  keybindings: KeybindingsRegistry,
-  platform: detectPlatform(),
-});
-
-/** Registers one action into the shared registries. */
-export function registerAction(action: ActionDescriptor): Result<IDisposable, ParseError> {
-  return shared.registerAction(action);
-}
diff --git a/crates/workshop/platform/command-registry.ts b/crates/workshop/platform/command-registry.ts
deleted file mode 100644
index 0d7868d7e..000000000
--- a/crates/workshop/platform/command-registry.ts
+++ /dev/null
@@ -1,142 +0,0 @@
-// The command registry: a Map of command actions keyed by command id
-// (the VS Code registerAction2 pattern). Every invocable action - menu
-// rows, keybinding rules, command-palette entries - is an action
-// registered once and dispatched by id, so the surfaces that trigger a
-// command never name the code that performs it. An action is a run
-// function plus metadata (title, category, precondition, toggled);
-// presentation (label, shortcut, enabled state) lives with the surfaces
-// that render it.
-//
-// The module-level Commands instance is the shared registry the
-// composition root and feature contribution files populate; the menu
-// widget, the keybinding dispatcher, and quick input read it. Tests
-// construct their own instances for isolation.
-//
-// A command that throws or rejects is reported through onDidFailCommand
-// and still rejects its execute, so a caller that awaits the run keeps its
-// own handling. The report is how the app raises Cursor's "Command '{0}'
-// resulted in an error" toast without this package knowing about toasts.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { Emitter, type Event } from "./event";
-import { toDisposable, type IDisposable } from "./lifecycle";
-
-/** One invocable action. */
-export interface CommandAction {
-  /**
-   * Runs the command. Arguments come from the menu row or the caller;
-   * the implementation narrows them, never casts.
-   */
-  readonly run: (...args: readonly unknown[]) => void | Promise<void>;
-  /** The display title, e.g. "Save". */
-  readonly title?: string;
-  /** The category prefix, e.g. "File". */
-  readonly category?: string;
-  /** The when-expression gating enablement. */
-  readonly precondition?: string;
-  /** The when-expression driving the checked state. */
-  readonly toggled?: string;
-}
-
-/** One failed command run, as onDidFailCommand reports it. */
-export interface CommandFailure {
-  /** The id the failed command was registered under. */
-  readonly id: string;
-  /**
-   * The command's palette label: "Category: Title", the bare title when it
-   * has no category, or the id when it has no title.
-   */
-  readonly label: string;
-  /** What the command threw or rejected with. */
-  readonly error: unknown;
-}
-
-/** The label the command palette shows for `action`, falling back to its id. */
-function commandLabel(id: string, action: CommandAction): string {
-  if (action.title === undefined) {
-    return id;
-  }
-  return action.category === undefined ? action.title : `${action.category}: ${action.title}`;
-}
-
-/**
- * Logs a command failure's detail on the console. The registry has already
- * reported the failure, so a fire-and-forget caller needs no more than this
- * to keep the error object where a developer can read it.
- */
-export function logCommandFailure(commandId: string, error: unknown): void {
-  console.error(`command '${commandId}' failed`, error);
-}
-
-export class CommandRegistry {
-  private readonly commands = new Map<string, CommandAction>();
-  private readonly failures = new Emitter<CommandFailure>();
-
-  /** Fires when a command run throws or rejects, before execute rejects. */
-  readonly onDidFailCommand: Event<CommandFailure> = this.failures.event;
-
-  /**
-   * Registers `action` under `id`. Re-registering an id upserts: the
-   * new action replaces the old, so re-running a setup (a test
-   * scenario, a hot reload) never duplicates. The returned disposable
-   * unregisters only if this registration is still current, so
-   * disposing a stale registration cannot evict its replacement.
-   */
-  register(id: string, action: CommandAction): IDisposable {
-    this.commands.set(id, action);
-    return toDisposable(() => {
-      if (this.commands.get(id) === action) {
-        this.commands.delete(id);
-      }
-    });
-  }
-
-  /** The action registered under `id`, if any. */
-  lookup(id: string): CommandAction | undefined {
-    return this.commands.get(id);
-  }
-
-  /**
-   * The palette label of the command under `id` (see CommandFailure.label),
-   * or `id` itself when nothing is registered there.
-   */
-  labelOf(id: string): string {
-    const action = this.commands.get(id);
-    return action === undefined ? id : commandLabel(id, action);
-  }
-
-  /**
-   * Runs the command registered under `id`, awaiting an async run.
-   * Answers false when no command is registered - a shortcut whose
-   * owning feature has not activated yet is a no-op, never a crash.
-   * A run that throws or rejects fires onDidFailCommand, then rejects
-   * with the same error.
-   */
-  async execute(id: string, ...args: readonly unknown[]): Promise<boolean> {
-    const action = this.commands.get(id);
-    if (action === undefined) {
-      return false;
-    }
-    try {
-      await action.run(...args);
-    } catch (error) {
-      this.failures.fire({ id, label: commandLabel(id, action), error });
-      throw error;
-    }
-    return true;
-  }
-}
-
-/** The shared registry the running app dispatches through. */
-export const Commands = new CommandRegistry();
-
-/** Registers a command into the shared registry. */
-export function registerCommand(id: string, action: CommandAction): IDisposable {
-  return Commands.register(id, action);
-}
-
-/** Dispatches a command by id through the shared registry. */
-export async function executeCommand(id: string, ...args: readonly unknown[]): Promise<boolean> {
-  return Commands.execute(id, ...args);
-}
diff --git a/crates/workshop/platform/context-key-expr.ts b/crates/workshop/platform/context-key-expr.ts
deleted file mode 100644
index d2a510061..000000000
--- a/crates/workshop/platform/context-key-expr.ts
+++ /dev/null
@@ -1,281 +0,0 @@
-// The when-expression language for context keys: the small declarative
-// syntax that menus, keybindings, and action preconditions use to say
-// "this row applies when editorTextFocus && editorLangId == 'rust'".
-// The grammar is the VS Code subset: a key (truthy test), !key,
-// key == 'value' and key != 'value' against a single-quoted string
-// literal, &&, ||, parentheses, and the literals true and false.
-// deserialize parses once at registration and returns a Result - a
-// malformed string is a value the registrar reports, never an exception
-// thrown later at render. The parsed expression evaluates against a key
-// lookup and names the keys it reads through keys(), so subscribers can
-// re-evaluate only when a relevant key changes.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { err, ok, type Result } from "./result";
-
-/** A parse failure: what went wrong and where in the source string. */
-export interface ParseError {
-  readonly message: string;
-  /** The character offset in the source where parsing stopped. */
-  readonly offset: number;
-}
-
-/**
- * A parsed when-expression. evaluate reads key values through the
- * supplied lookup (undefined for an unset key); keys() returns the names
- * the expression reads, for change filtering.
- */
-export interface ContextKeyExpression {
-  evaluate(getValue: (key: string) => unknown): boolean;
-  keys(): ReadonlySet<string>;
-}
-
-type Token =
-  | { readonly kind: "ident"; readonly name: string; readonly offset: number }
-  | { readonly kind: "string"; readonly value: string; readonly offset: number }
-  | { readonly kind: "not" | "and" | "or" | "lparen" | "rparen" | "eq" | "ne"; readonly offset: number };
-
-/** Internal control flow for parse failures; caught at the deserialize boundary. */
-class ParseFailure extends Error {
-  constructor(readonly parseError: ParseError) {
-    super(parseError.message);
-  }
-}
-
-function fail(message: string, offset: number): never {
-  throw new ParseFailure({ message, offset });
-}
-
-const NO_KEYS: ReadonlySet<string> = new Set();
-
-function literal(value: boolean): ContextKeyExpression {
-  return { evaluate: () => value, keys: () => NO_KEYS };
-}
-
-function keyTest(name: string): ContextKeyExpression {
-  const keys: ReadonlySet<string> = new Set([name]);
-  return { evaluate: (getValue) => Boolean(getValue(name)), keys: () => keys };
-}
-
-function comparison(name: string, value: string, negate: boolean): ContextKeyExpression {
-  const keys: ReadonlySet<string> = new Set([name]);
-  return {
-    evaluate: (getValue) => {
-      const actual = getValue(name);
-      // Unset keys never equal a literal; numbers and booleans compare by
-      // their string form so `flag == 'true'` reads naturally.
-      const equal = actual !== undefined && actual !== null && String(actual) === value;
-      return negate ? !equal : equal;
-    },
-    keys: () => keys,
-  };
-}
-
-function negateExpr(inner: ContextKeyExpression): ContextKeyExpression {
-  return { evaluate: (getValue) => !inner.evaluate(getValue), keys: () => inner.keys() };
-}
-
-function junction(
-  kind: "and" | "or",
-  left: ContextKeyExpression,
-  right: ContextKeyExpression,
-): ContextKeyExpression {
-  const keys: ReadonlySet<string> = new Set([...left.keys(), ...right.keys()]);
-  return {
-    evaluate: (getValue) =>
-      kind === "and" ? left.evaluate(getValue) && right.evaluate(getValue) : left.evaluate(getValue) || right.evaluate(getValue),
-    keys: () => keys,
-  };
-}
-
-function isIdentStart(ch: string): boolean {
-  return (ch >= "a" && ch <= "z") || (ch >= "A" && ch <= "Z") || ch === "_";
-}
-
-function isIdentPart(ch: string): boolean {
-  return isIdentStart(ch) || (ch >= "0" && ch <= "9") || ch === "." || ch === "-" || ch === "/";
-}
-
-function tokenize(input: string): readonly Token[] {
-  const tokens: Token[] = [];
-  let i = 0;
-  while (i < input.length) {
-    const ch = input.charAt(i);
-    if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
-      i += 1;
-      continue;
-    }
-    if (ch === "(") {
-      tokens.push({ kind: "lparen", offset: i });
-      i += 1;
-      continue;
-    }
-    if (ch === ")") {
-      tokens.push({ kind: "rparen", offset: i });
-      i += 1;
-      continue;
-    }
-    if (ch === "!") {
-      if (input.charAt(i + 1) === "=") {
-        tokens.push({ kind: "ne", offset: i });
-        i += 2;
-      } else {
-        tokens.push({ kind: "not", offset: i });
-        i += 1;
-      }
-      continue;
-    }
-    if (ch === "=") {
-      if (input.charAt(i + 1) !== "=") {
-        fail("expected '=='", i);
-      }
-      tokens.push({ kind: "eq", offset: i });
-      i += 2;
-      continue;
-    }
-    if (ch === "&") {
-      if (input.charAt(i + 1) !== "&") {
-        fail("expected '&&'", i);
-      }
-      tokens.push({ kind: "and", offset: i });
-      i += 2;
-      continue;
-    }
-    if (ch === "|") {
-      if (input.charAt(i + 1) !== "|") {
-        fail("expected '||'", i);
-      }
-      tokens.push({ kind: "or", offset: i });
-      i += 2;
-      continue;
-    }
-    if (ch === "'") {
-      const end = input.indexOf("'", i + 1);
-      if (end === -1) {
-        fail("unterminated string literal", i);
-      }
-      tokens.push({ kind: "string", value: input.slice(i + 1, end), offset: i });
-      i = end + 1;
-      continue;
-    }
-    if (isIdentStart(ch)) {
-      let j = i + 1;
-      while (j < input.length && isIdentPart(input.charAt(j))) {
-        j += 1;
-      }
-      tokens.push({ kind: "ident", name: input.slice(i, j), offset: i });
-      i = j;
-      continue;
-    }
-    fail(`unexpected character '${ch}'`, i);
-  }
-  return tokens;
-}
-
-/**
- * Recursive-descent parser over the token stream. Precedence, tightest
- * first: comparison and !, then &&, then ||; parentheses override.
- */
-class Parser {
-  private pos = 0;
-
-  constructor(private readonly tokens: readonly Token[]) {}
-
-  parse(): ContextKeyExpression {
-    const expr = this.parseOr();
-    const rest = this.peek();
-    if (rest !== undefined) {
-      fail("unexpected trailing input", rest.offset);
-    }
-    return expr;
-  }
-
-  private peek(): Token | undefined {
-    return this.tokens[this.pos];
-  }
-
-  private parseOr(): ContextKeyExpression {
-    let left = this.parseAnd();
-    while (this.peek()?.kind === "or") {
-      this.pos += 1;
-      left = junction("or", left, this.parseAnd());
-    }
-    return left;
-  }
-
-  private parseAnd(): ContextKeyExpression {
-    let left = this.parseUnary();
-    while (this.peek()?.kind === "and") {
-      this.pos += 1;
-      left = junction("and", left, this.parseUnary());
-    }
-    return left;
-  }
-
-  private parseUnary(): ContextKeyExpression {
-    const token = this.peek();
-    if (token?.kind === "not") {
-      this.pos += 1;
-      return negateExpr(this.parseUnary());
-    }
-    return this.parsePrimary();
-  }
-
-  private parsePrimary(): ContextKeyExpression {
-    const token = this.peek();
-    if (token === undefined) {
-      fail("expected an expression", this.tokens.length > 0 ? (this.tokens[this.tokens.length - 1]?.offset ?? 0) + 1 : 0);
-    }
-    if (token.kind === "lparen") {
-      this.pos += 1;
-      const inner = this.parseOr();
-      const closing = this.peek();
-      if (closing?.kind !== "rparen") {
-        fail("expected ')'", closing?.offset ?? token.offset);
-      }
-      this.pos += 1;
-      return inner;
-    }
-    if (token.kind === "ident") {
-      this.pos += 1;
-      if (token.name === "true") {
-        return literal(true);
-      }
-      if (token.name === "false") {
-        return literal(false);
-      }
-      const operator = this.peek();
-      if (operator?.kind === "eq" || operator?.kind === "ne") {
-        this.pos += 1;
-        const value = this.peek();
-        if (value?.kind !== "string") {
-          fail("expected a quoted string value", value?.offset ?? operator.offset);
-        }
-        this.pos += 1;
-        return comparison(token.name, value.value, operator.kind === "ne");
-      }
-      return keyTest(token.name);
-    }
-    fail("expected a key, '(', 'true', or 'false'", token.offset);
-  }
-}
-
-/** The when-expression entry point: parse a string into an evaluable expression. */
-export const ContextKeyExpr = {
-  /**
-   * Parses `when`. Returns the expression on success; on failure returns
-   * a ParseError value naming the problem and its offset - callers report
-   * it once at registration instead of throwing at render.
-   */
-  deserialize(when: string): Result<ContextKeyExpression, ParseError> {
-    try {
-      return ok(new Parser(tokenize(when)).parse());
-    } catch (failure) {
-      if (failure instanceof ParseFailure) {
-        return err(failure.parseError);
-      }
-      throw failure;
-    }
-  },
-} as const;
diff --git a/crates/workshop/platform/context-key-service.ts b/crates/workshop/platform/context-key-service.ts
deleted file mode 100644
index b50767ee0..000000000
--- a/crates/workshop/platform/context-key-service.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-// The context-key service: the single store of named context values
-// (editorTextFocus, editorLangId, inputFocus, config.editor.*) that
-// menus, keybindings, and action preconditions evaluate their `when`
-// expressions against. Features bind keys with createKey in their
-// register() or in main.ts - never at contribution-module scope, because
-// a service instance must exist first - and run bodies read or write
-// them through the registry at call time. One global service holds every
-// key; the seam for per-DOM-subtree scoping later is this service, not
-// its callers.
-//
-// The change event includes affectsSome so a subscriber (a menu, the
-// dispatcher) re-evaluates only the expressions that read the keys that
-// actually changed, instead of every expression on every write.
-//
-// The service self-registers with a default factory, so any bundle that
-// touches it gets the singleton without composition-root wiring.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { Emitter } from "./event";
-import type { Event } from "./event";
-import type { IDisposable } from "./lifecycle";
-import { ContextKeyExpr } from "./context-key-expr";
-import type { ContextKeyExpression } from "./context-key-expr";
-import { createServiceToken, registerService } from "./service-registry";
-
-/**
- * The change payload: affectsSome answers whether any of the subscriber's
- * referenced keys changed, so it can skip re-evaluation when they did not.
- */
-export interface ContextKeyChangeEvent {
-  affectsSome(keys: ReadonlySet<string>): boolean;
-}
-
-/**
- * A context key bound to a name in the service. set writes and fires the
- * change event; get returns the current value (the declared default until
- * the first set); reset restores the declared default and fires.
- */
-export interface ContextKey<T> {
-  set(value: T): void;
-  get(): T;
-  reset(): void;
-}
-
-/** The store of context values and the evaluator for when-expressions. */
-export class ContextKeyService implements IDisposable {
-  private readonly values = new Map<string, unknown>();
-  private readonly changeEmitter = new Emitter<ContextKeyChangeEvent>();
-
-  /** Fires when any key's value changes; layout and menu code hook it. */
-  readonly onDidChangeContext: Event<ContextKeyChangeEvent> = this.changeEmitter.event;
-
-  /**
-   * Binds a key to `name` with `defaultValue`. The default is visible
-   * through getValue immediately, so an expression can match before any
-   * set. Re-binding an existing name keeps the current value.
-   */
-  createKey<T>(name: string, defaultValue: T): ContextKey<T> {
-    if (!this.values.has(name)) {
-      this.values.set(name, defaultValue);
-    }
-    return {
-      set: (value: T): void => this.setValue(name, value),
-      // The map holds unknown; the key's own writes are the only source
-      // for this name after binding, so the read is the declared T.
-      get: (): T => (this.values.get(name) as T | undefined) ?? defaultValue,
-      reset: (): void => this.setValue(name, defaultValue),
-    };
-  }
-
-  /** The current value of a key, or undefined when no key declared it. */
-  getValue(name: string): unknown {
-    return this.values.get(name);
-  }
-
-  /**
-   * Evaluates a when-expression against the current values. Accepts a
-   * parsed expression or a source string; undefined means "always". A
-   * malformed string never matches - registration is where malformed
-   * strings are reported, so a stray string reaching here is a bug that
-   * should hide the row, not throw.
-   */
-  contextMatchesRules(expr: string | ContextKeyExpression | undefined): boolean {
-    if (expr === undefined) {
-      return true;
-    }
-    if (typeof expr === "string") {
-      const result = ContextKeyExpr.deserialize(expr);
-      if (!result.ok) {
-        return false;
-      }
-      return result.value.evaluate((key) => this.getValue(key));
-    }
-    return expr.evaluate((key) => this.getValue(key));
-  }
-
-  private setValue(name: string, value: unknown): void {
-    this.values.set(name, value);
-    const changed: ReadonlySet<string> = new Set([name]);
-    this.changeEmitter.fire({
-      affectsSome: (keys) => {
-        for (const key of keys) {
-          if (changed.has(key)) {
-            return true;
-          }
-        }
-        return false;
-      },
-    });
-  }
-
-  dispose(): void {
-    this.changeEmitter.dispose();
-  }
-}
-
-/** The registry token for the context-key singleton. */
-export const CONTEXT_KEY_SERVICE = createServiceToken<ContextKeyService>("workshop.contextKey");
-
-// Self-registration: the default instance is shared by every consumer in
-// the process. The composition root may re-register to rebind.
-registerService(CONTEXT_KEY_SERVICE, () => new ContextKeyService());
diff --git a/crates/workshop/platform/event.ts b/crates/workshop/platform/event.ts
deleted file mode 100644
index 17633e9f0..000000000
--- a/crates/workshop/platform/event.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-// Minimal typed event primitive for the Workshop family's UIs. Generic and
-// DOM-free: imports only this package's own files.
-
-import type { IDisposable } from "./lifecycle";
-
-/** Subscribes `listener`; disposing the returned handle unsubscribes it. */
-export type Event<T> = (listener: (value: T) => void) => IDisposable;
-
-/**
- * Single-signal typed emitter. The owner keeps the Emitter private, exposes
- * `event` for subscribers, publishes with fire(), and routes the whole thing
- * through its lifecycle so dispose() severs every subscription at once.
- */
-export class Emitter<T> implements IDisposable {
-  private readonly _listeners = new Set<(value: T) => void>();
-  private _isDisposed = false;
-
-  /** The subscribe function handed to consumers (e.g. `onDidChange`). */
-  readonly event: Event<T> = (listener) => {
-    if (!this._isDisposed) {
-      this._listeners.add(listener);
-    }
-    return { dispose: () => this._listeners.delete(listener) };
-  };
-
-  /** Delivers `value` to every currently subscribed listener. */
-  fire(value: T): void {
-    if (this._isDisposed) {
-      return;
-    }
-    for (const listener of this._listeners) {
-      listener(value);
-    }
-  }
-
-  /** Drops all listeners; later fire() and event() calls are no-ops. */
-  dispose(): void {
-    this._isDisposed = true;
-    this._listeners.clear();
-  }
-}
diff --git a/crates/workshop/platform/keybinding-parser.ts b/crates/workshop/platform/keybinding-parser.ts
deleted file mode 100644
index b9e4ec60f..000000000
--- a/crates/workshop/platform/keybinding-parser.ts
+++ /dev/null
@@ -1,304 +0,0 @@
-// The keybinding parser: turns chord strings ("ctrl+m ctrl+o") into
-// structured Chord values and maps KeyboardEvents onto the same shape.
-// The modifier vocabulary is VS Code's: ctrl, shift, alt, meta (alias
-// cmd), and ctrlcmd, which resolves to meta on macOS and ctrl everywhere
-// else, so one catalog row binds Cmd+S on macOS and Ctrl+S elsewhere
-// without a per-OS table. The key vocabulary is letters, digits,
-// f1-f12, the named editing and navigation keys, numpad0-numpad9,
-// numpad_add and numpad_subtract, and punctuation by unshifted glyph.
-//
-// A KeyboardEvent maps through event.code, never event.key: the code
-// names the physical key, so Ctrl+Shift+= and Ctrl+= both read as "="
-// and Numpad0 stays distinct from Digit0.
-//
-// Parsing returns a Result - a malformed string is a value the registrar
-// reports once at registration, never an exception thrown at dispatch.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { err, ok, type Result } from "./result";
-import type { ParseError } from "./context-key-expr";
-
-/** The platforms keybindings resolve against. */
-export type KeybindingPlatform = "windows" | "mac" | "linux";
-
-/**
- * The running platform, from the browser's navigator when present.
- * Plain-node tests and unknown environments resolve to windows, the
- * platform whose chords the catalog's keybinding column shows.
- */
-export function detectPlatform(): KeybindingPlatform {
-  const nav = typeof navigator === "undefined" ? undefined : navigator;
-  const text = `${nav?.platform ?? ""} ${nav?.userAgent ?? ""}`.toLowerCase();
-  if (text.includes("mac")) {
-    return "mac";
-  }
-  if (text.includes("linux")) {
-    return "linux";
-  }
-  return "windows";
-}
-
-/**
- * One pressed chord: the modifier state plus a key from the vocabulary.
- * The key is stored in its canonical lowercase form ("s", "0", "f5",
- * "numpad0", "pagedown", "=").
- */
-export interface Chord {
-  readonly ctrl: boolean;
-  readonly shift: boolean;
-  readonly alt: boolean;
-  readonly meta: boolean;
-  readonly key: string;
-}
-
-/** The named (non-letter, non-digit, non-punctuation) key vocabulary. */
-const NAMED_KEYS: ReadonlySet<string> = new Set([
-  ...Array.from({ length: 12 }, (_, i) => `f${i + 1}`),
-  "enter",
-  "escape",
-  "tab",
-  "space",
-  "backspace",
-  "delete",
-  "insert",
-  "home",
-  "end",
-  "pageup",
-  "pagedown",
-  "up",
-  "down",
-  "left",
-  "right",
-  ...Array.from({ length: 10 }, (_, i) => `numpad${i}`),
-  // VS Code's names for the numpad plus and minus keys. A bare "+" cannot
-  // be a key token because "+" separates the chord's parts.
-  "numpad_add",
-  "numpad_subtract",
-]);
-
-/** Punctuation keys, named by their unshifted glyph. */
-const PUNCTUATION_KEYS: ReadonlySet<string> = new Set(["=", "-", "[", "]", "\\", ";", "'", ",", ".", "/", "`"]);
-
-function isKeyToken(token: string): boolean {
-  if (token.length === 1) {
-    const ch = token.charAt(0);
-    return (ch >= "a" && ch <= "z") || (ch >= "0" && ch <= "9") || PUNCTUATION_KEYS.has(token);
-  }
-  return NAMED_KEYS.has(token);
-}
-
-/** Internal control flow for parse failures; caught at the parse boundary. */
-class ParseFailure extends Error {
-  constructor(readonly parseError: ParseError) {
-    super(parseError.message);
-  }
-}
-
-function fail(message: string, offset: number): never {
-  throw new ParseFailure({ message, offset });
-}
-
-function parseChord(text: string, offset: number, platform: KeybindingPlatform): Chord {
-  const parts = text.split("+");
-  const key = parts[parts.length - 1] ?? "";
-  if (key === "" || !isKeyToken(key)) {
-    fail(`unknown key '${key}'`, offset);
-  }
-  let ctrl = false;
-  let shift = false;
-  let alt = false;
-  let meta = false;
-  for (const part of parts.slice(0, -1)) {
-    switch (part) {
-      case "ctrl":
-        ctrl = true;
-        break;
-      case "shift":
-        shift = true;
-        break;
-      case "alt":
-        alt = true;
-        break;
-      case "meta":
-      case "cmd":
-        meta = true;
-        break;
-      case "ctrlcmd":
-        // VS Code's CtrlCmd: Cmd on macOS, Ctrl everywhere else.
-        if (platform === "mac") {
-          meta = true;
-        } else {
-          ctrl = true;
-        }
-        break;
-      default:
-        fail(`unknown modifier '${part}'`, offset);
-    }
-  }
-  return { ctrl, shift, alt, meta, key };
-}
-
-/**
- * Parses a whitespace-separated chord string ("ctrl+m ctrl+o") into
- * Chord values. Modifier and key tokens are case-insensitive; spaces
- * inside a chord are not allowed. `ctrlcmd` resolves against `platform`,
- * which defaults to the detected platform. Returns a ParseError value on
- * malformed input.
- */
-export function parseKeybinding(text: string, platform: KeybindingPlatform = detectPlatform()): Result<readonly Chord[], ParseError> {
-  try {
-    const trimmed = text.trim();
-    if (trimmed === "") {
-      fail("expected a keybinding", 0);
-    }
-    const chords: Chord[] = [];
-    let offset = 0;
-    for (const chordText of trimmed.split(/\s+/)) {
-      const at = text.indexOf(chordText, offset);
-      chords.push(parseChord(chordText.toLowerCase(), at === -1 ? offset : at, platform));
-      offset = (at === -1 ? offset : at) + chordText.length;
-    }
-    return ok(chords);
-  } catch (failure) {
-    if (failure instanceof ParseFailure) {
-      return err(failure.parseError);
-    }
-    throw failure;
-  }
-}
-
-/** The event.code to key-vocabulary mapping for non-letter keys. */
-const CODE_TO_KEY: Readonly<Record<string, string>> = {
-  Enter: "enter",
-  Escape: "escape",
-  Tab: "tab",
-  Space: "space",
-  Backspace: "backspace",
-  Delete: "delete",
-  Insert: "insert",
-  Home: "home",
-  End: "end",
-  PageUp: "pageup",
-  PageDown: "pagedown",
-  ArrowUp: "up",
-  ArrowDown: "down",
-  ArrowLeft: "left",
-  ArrowRight: "right",
-  Equal: "=",
-  Minus: "-",
-  BracketLeft: "[",
-  BracketRight: "]",
-  Backslash: "\\",
-  Semicolon: ";",
-  Quote: "'",
-  Comma: ",",
-  Period: ".",
-  Slash: "/",
-  Backquote: "`",
-};
-
-function keyFromCode(code: string): string | undefined {
-  if (/^Key[A-Z]$/.test(code)) {
-    return code.slice(3).toLowerCase();
-  }
-  if (/^Digit[0-9]$/.test(code)) {
-    return code.slice(5);
-  }
-  if (/^Numpad[0-9]$/.test(code)) {
-    return code.toLowerCase();
-  }
-  if (code === "NumpadAdd") {
-    return "numpad_add";
-  }
-  if (code === "NumpadSubtract") {
-    return "numpad_subtract";
-  }
-  if (/^F([1-9]|1[0-2])$/.test(code)) {
-    return code.toLowerCase();
-  }
-  return CODE_TO_KEY[code];
-}
-
-/**
- * Maps a KeyboardEvent to a Chord through event.code, never event.key:
- * the code names the physical key, so Ctrl+Shift+= and Ctrl+= both read
- * as "=" and Numpad0 stays distinct from Digit0. Modifier-only presses
- * and unmapped codes answer undefined.
- */
-export function chordFromKeyboardEvent(event: KeyboardEvent): Chord | undefined {
-  const key = keyFromCode(event.code);
-  if (key === undefined) {
-    return undefined;
-  }
-  return { ctrl: event.ctrlKey, shift: event.shiftKey, alt: event.altKey, meta: event.metaKey, key };
-}
-
-/** Structural chord equality. */
-export function chordsEqual(a: Chord, b: Chord): boolean {
-  return a.ctrl === b.ctrl && a.shift === b.shift && a.alt === b.alt && a.meta === b.meta && a.key === b.key;
-}
-
-const KEY_LABELS: Readonly<Record<string, string>> = {
-  enter: "Enter",
-  escape: "Escape",
-  tab: "Tab",
-  space: "Space",
-  backspace: "Backspace",
-  delete: "Delete",
-  insert: "Insert",
-  home: "Home",
-  end: "End",
-  pageup: "PageUp",
-  pagedown: "PageDown",
-  up: "Up",
-  down: "Down",
-  left: "Left",
-  right: "Right",
-  numpad_add: "NumPad_Add",
-  numpad_subtract: "NumPad_Subtract",
-};
-
-function keyLabel(key: string): string {
-  if (key.length === 1 && key >= "a" && key <= "z") {
-    return key.toUpperCase();
-  }
-  // Function keys render in VS Code's form: F11, not f11.
-  if (/^f(?:[1-9]|1[0-2])$/.test(key)) {
-    return key.toUpperCase();
-  }
-  // The digit keys label by suffix ("NumPad0"); plus and minus have their
-  // own table entries, VS Code's "NumPad_Add" and "NumPad_Subtract".
-  if (/^numpad[0-9]$/.test(key)) {
-    return `NumPad${key.slice(6)}`;
-  }
-  return KEY_LABELS[key] ?? key;
-}
-
-/**
- * Renders a chord for display: "Ctrl+M" on Windows and Linux, "Cmd+S"
- * for meta chords on macOS. Modifiers render in Ctrl, Shift, Alt, Meta
- * order.
- */
-export function formatChord(chord: Chord, platform: KeybindingPlatform = detectPlatform()): string {
-  const parts: string[] = [];
-  if (chord.ctrl) {
-    parts.push("Ctrl");
-  }
-  if (chord.shift) {
-    parts.push("Shift");
-  }
-  if (chord.alt) {
-    parts.push("Alt");
-  }
-  if (chord.meta) {
-    parts.push(platform === "mac" ? "Cmd" : "Meta");
-  }
-  parts.push(keyLabel(chord.key));
-  return parts.join("+");
-}
-
-/** Renders a chord sequence for display: "Ctrl+M Ctrl+O". */
-export function formatKeybinding(chords: readonly Chord[], platform: KeybindingPlatform = detectPlatform()): string {
-  return chords.map((chord) => formatChord(chord, platform)).join(" ");
-}
diff --git a/crates/workshop/platform/keybinding-registry.ts b/crates/workshop/platform/keybinding-registry.ts
deleted file mode 100644
index d6da73ed6..000000000
--- a/crates/workshop/platform/keybinding-registry.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-// The keybindings registry: the module-level store of keybinding rules
-// (the shape of VS Code's IKeybindingRule) that feature contribution
-// files write at module scope and the dispatcher reads through a
-// resolver snapshot. Each rule names a command id and a chord string,
-// with optional mac and linux overrides so one row binds Cmd+S on macOS
-// and Ctrl+S elsewhere; the ctrlcmd token inside the chord string covers
-// the common case without an override.
-//
-// Chord and when strings are parsed once at registration; a malformed
-// string is reported to the console once and the rule is dropped, so a
-// bad contribution can never throw at dispatch. Registration returns a
-// disposable that removes only its own rule.
-//
-// The module-level KeybindingsRegistry singleton resolves against the
-// detected platform; tests build their own with createKeybindingsRegistry.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { toDisposable, type IDisposable } from "./lifecycle";
-import { ContextKeyExpr, type ContextKeyExpression } from "./context-key-expr";
-import { detectPlatform, formatKeybinding, parseKeybinding, type KeybindingPlatform } from "./keybinding-parser";
-import { KeybindingResolver, type ResolvedKeybindingRule } from "./keybinding-resolver";
-
-/**
- * VS Code's weight tiers. Editor actions register at EditorContrib,
- * workbench actions at WorkbenchContrib (the default); higher tiers win
- * when several rules claim the same chord.
- */
-export const KeybindingWeight = {
-  EditorCore: 0,
-  EditorContrib: 100,
-  WorkbenchContrib: 200,
-  BuiltinExtension: 300,
-  ExternalExtension: 400,
-} as const;
-
-/** A weight tier from the KeybindingWeight const object. */
-export type KeybindingWeight = (typeof KeybindingWeight)[keyof typeof KeybindingWeight];
-
-/** One keybinding rule, in the shape of VS Code's IKeybindingRule. */
-export interface KeybindingRule {
-  /** The command the chord dispatches. */
-  readonly id: string;
-  /** The chord string, e.g. "ctrlcmd+s" or "ctrl+m ctrl+o". */
-  readonly keybinding: string;
-  /** The macOS chord, when it differs from the default. */
-  readonly mac?: string;
-  /** The Linux chord, when it differs from the default. */
-  readonly linux?: string;
-  /** The when-expression gating the rule. */
-  readonly when?: string;
-  /** The weight tier; defaults to WorkbenchContrib. */
-  readonly weight?: KeybindingWeight;
-}
-
-/** The label for a command's keybinding, rendered per platform. */
-export interface KeybindingLabel {
-  getLabel(): string;
-}
-
-/** The rule store the dispatcher and menu labels read. */
-export interface KeybindingsRegistry {
-  /**
-   * Registers one rule. The chord string (or the running platform's
-   * override) and the when string are parsed now; a malformed string is
-   * reported once and the rule is dropped. The returned disposable
-   * removes only this registration.
-   */
-  registerKeybindingRule(rule: KeybindingRule): IDisposable;
-  /** A resolver snapshot over the currently registered rules. */
-  getResolver(): KeybindingResolver;
-  /**
-   * The display label for a command's keybinding, or undefined when no
-   * rule binds it. With several rules for one command, the first whose
-   * when passes against `context` is the label, else the first
-   * registered.
-   */
-  lookupKeybinding(commandId: string, context?: (key: string) => unknown): KeybindingLabel | undefined;
-}
-
-interface StoredRule {
-  readonly resolved: ResolvedKeybindingRule & { readonly when?: ContextKeyExpression };
-  readonly chords: ResolvedKeybindingRule["chords"];
-}
-
-/** Builds a registry resolving chord strings against `platform`. */
-export function createKeybindingsRegistry(platform: KeybindingPlatform): KeybindingsRegistry {
-  const rules: StoredRule[] = [];
-  let nextOrder = 0;
-
-  function registerKeybindingRule(rule: KeybindingRule): IDisposable {
-    const source = platform === "mac" ? (rule.mac ?? rule.keybinding) : platform === "linux" ? (rule.linux ?? rule.keybinding) : rule.keybinding;
-    const parsed = parseKeybinding(source, platform);
-    if (!parsed.ok) {
-      console.error(`keybinding for '${rule.id}' is malformed: ${parsed.error.message} at offset ${parsed.error.offset}`);
-      return toDisposable(() => {});
-    }
-    let when: ContextKeyExpression | undefined;
-    if (rule.when !== undefined) {
-      const parsedWhen = ContextKeyExpr.deserialize(rule.when);
-      if (!parsedWhen.ok) {
-        console.error(`when for keybinding '${rule.id}' is malformed: ${parsedWhen.error.message} at offset ${parsedWhen.error.offset}`);
-        return toDisposable(() => {});
-      }
-      when = parsedWhen.value;
-    }
-    const stored: StoredRule = {
-      chords: parsed.value,
-      resolved: {
-        commandId: rule.id,
-        chords: parsed.value,
-        when,
-        weight: rule.weight ?? KeybindingWeight.WorkbenchContrib,
-        order: nextOrder,
-      },
-    };
-    nextOrder += 1;
-    rules.push(stored);
-    return toDisposable(() => {
-      const index = rules.indexOf(stored);
-      if (index !== -1) {
-        rules.splice(index, 1);
-      }
-    });
-  }
-
-  return {
-    registerKeybindingRule,
-    getResolver(): KeybindingResolver {
-      return new KeybindingResolver(rules.map((rule) => rule.resolved));
-    },
-    lookupKeybinding(commandId: string, context?: (key: string) => unknown): KeybindingLabel | undefined {
-      const bound = rules.filter((rule) => rule.resolved.commandId === commandId);
-      const matching =
-        context === undefined ? undefined : bound.find((rule) => rule.resolved.when?.evaluate(context) ?? true);
-      const found = matching ?? bound[0];
-      if (found === undefined) {
-        return undefined;
-      }
-      return { getLabel: () => formatKeybinding(found.chords, platform) };
-    },
-  };
-}
-
-/** The shared registry the running app's contributions populate. */
-export const KeybindingsRegistry: KeybindingsRegistry = createKeybindingsRegistry(detectPlatform());
diff --git a/crates/workshop/platform/keybinding-resolver.ts b/crates/workshop/platform/keybinding-resolver.ts
deleted file mode 100644
index 7a28f6c1a..000000000
--- a/crates/workshop/platform/keybinding-resolver.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-// The keybinding resolver: a pure, DOM-free lookup from pressed chords
-// to a command id. The dispatcher feeds it the chords pressed so far;
-// it answers KbFound when a rule's full sequence matched (and its `when`
-// passes against the context service), MoreChordsNeeded when the pressed
-// chords are a strict prefix of some rule, and NoMatchingKb otherwise.
-// Among exact matches the highest weight wins; at equal weight the last
-// registered rule wins, so a feature can override a built-in binding.
-//
-// hasRuleForChord answers whether any rule starts with the chord
-// regardless of `when`: the dispatcher uses it to decide whether to
-// swallow a key whose rule is context-gated, so a claimed chord never
-// falls through to CodeMirror or the webview default.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { chordsEqual, type Chord } from "./keybinding-parser";
-import type { ContextKeyExpression } from "./context-key-expr";
-import type { ContextKeyService } from "./context-key-service";
-
-/**
- * One registered rule in resolver form: the command to run, the chord
- * sequence already resolved for the running platform, the parsed (or
- * source) when expression, the weight tier, and the registration order
- * used for the equal-weight tiebreak.
- */
-export interface ResolvedKeybindingRule {
-  readonly commandId: string;
-  readonly chords: readonly Chord[];
-  readonly when?: string | ContextKeyExpression;
-  readonly weight: number;
-  readonly order: number;
-}
-
-/** The resolver's answer for one pressed-chord prefix. */
-export type KeybindingResolveResult =
-  | { readonly kind: "NoMatchingKb" }
-  | { readonly kind: "MoreChordsNeeded" }
-  | { readonly kind: "KbFound"; readonly commandId: string };
-
-function isPrefix(pressed: readonly Chord[], chords: readonly Chord[]): boolean {
-  if (pressed.length > chords.length) {
-    return false;
-  }
-  return pressed.every((chord, index) => chordsEqual(chord, chords[index] as Chord));
-}
-
-/** Pure chord-sequence resolution over a snapshot of rules. */
-export class KeybindingResolver {
-  constructor(private readonly rules: readonly ResolvedKeybindingRule[]) {}
-
-  /**
-   * Resolves the chords pressed so far against the context. Exact
-   * matches whose when passes win by weight, then by registration order;
-   * when no exact match passes but a longer rule shares the prefix, the
-   * answer is MoreChordsNeeded.
-   */
-  resolve(context: Pick<ContextKeyService, "contextMatchesRules">, pressedChords: readonly Chord[]): KeybindingResolveResult {
-    const candidates = this.rules.filter((rule) => isPrefix(pressedChords, rule.chords));
-    let best: ResolvedKeybindingRule | undefined;
-    for (const rule of candidates) {
-      if (rule.chords.length !== pressedChords.length || !context.contextMatchesRules(rule.when)) {
-        continue;
-      }
-      if (best === undefined || rule.weight > best.weight || (rule.weight === best.weight && rule.order > best.order)) {
-        best = rule;
-      }
-    }
-    if (best !== undefined) {
-      return { kind: "KbFound", commandId: best.commandId };
-    }
-    if (candidates.some((rule) => rule.chords.length > pressedChords.length)) {
-      return { kind: "MoreChordsNeeded" };
-    }
-    return { kind: "NoMatchingKb" };
-  }
-
-  /**
-   * Answers whether any rule's sequence starts with `chord`, regardless
-   * of when - the dispatcher swallows claimed chords even when their
-   * rule is context-gated.
-   */
-  hasRuleForChord(chord: Chord): boolean {
-    return this.rules.some((rule) => isPrefix([chord], rule.chords));
-  }
-}
diff --git a/crates/workshop/platform/lifecycle.ts b/crates/workshop/platform/lifecycle.ts
deleted file mode 100644
index 0bafaf5f8..000000000
--- a/crates/workshop/platform/lifecycle.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-// Object lifetime primitives for the Workshop family's UIs. Generic and
-// DOM-free: imports only this package's own files.
-
-/** A resource that frees itself when dispose() is called. */
-export interface IDisposable {
-  dispose(): void;
-}
-
-/**
- * Wraps a bare cleanup function as an IDisposable, so ad hoc teardown
- * (removeEventListener pairs, unsubscribe closures, timer clears) can be
- * routed through a DisposableStore.
- */
-export function toDisposable(dispose: () => void): IDisposable {
-  return { dispose };
-}
-
-/**
- * Receives DisposableStore lifetime notifications while installed via
- * setDisposableTracker. Test-only seam: the shared leak-check test helper
- * is its only consumer.
- */
-export interface IDisposableTracker {
-  /** Called when a store is constructed. */
-  trackCreated(store: DisposableStore): void;
-  /** Called the first time a store is disposed. */
-  trackDisposed(store: DisposableStore): void;
-}
-
-let tracker: IDisposableTracker | undefined;
-
-/**
- * Installs `next` as the store tracker, or clears it with undefined.
- * Off by default, so production pays one undefined check per store
- * construction and disposal. Test-only seam: the shared leak-check test
- * helper (test/helpers/leak-check.mjs) is its only consumer.
- */
-export function setDisposableTracker(next: IDisposableTracker | undefined): void {
-  tracker = next;
-}
-
-/** Collects disposables and releases them together, in insertion order. */
-export class DisposableStore implements IDisposable {
-  private readonly _items = new Set<IDisposable>();
-  private _isDisposed = false;
-
-  constructor() {
-    tracker?.trackCreated(this);
-  }
-
-  /**
-   * Takes ownership of `item` and returns it. If the store is already
-   * disposed the item is disposed immediately, so late registration
-   * cannot leak.
-   */
-  add<T extends IDisposable>(item: T): T {
-    if (this._isDisposed) {
-      item.dispose();
-    } else {
-      this._items.add(item);
-    }
-    return item;
-  }
-
-  /** Disposes everything held. Safe to call more than once. */
-  dispose(): void {
-    if (this._isDisposed) {
-      return;
-    }
-    this._isDisposed = true;
-    tracker?.trackDisposed(this);
-    for (const item of this._items) {
-      item.dispose();
-    }
-    this._items.clear();
-  }
-}
-
-/**
- * Base class for objects that own other disposables. Subclasses route
- * every child (listener, emitter, nested Disposable) through _register
- * so that one dispose() tears down the whole tree.
- */
-export abstract class Disposable implements IDisposable {
-  private readonly _store = new DisposableStore();
-
-  /** Ties `item`'s lifetime to this object's and returns it. */
-  protected _register<T extends IDisposable>(item: T): T {
-    return this._store.add(item);
-  }
-
-  /** Releases every registered child. */
-  dispose(): void {
-    this._store.dispose();
-  }
-}
diff --git a/crates/workshop/platform/menu-registry.ts b/crates/workshop/platform/menu-registry.ts
deleted file mode 100644
index 172f407e0..000000000
--- a/crates/workshop/platform/menu-registry.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-// The menu registry: a Map of menu rows per menu id (the VS Code
-// MenuRegistry pattern). A row is either a reference to a command in
-// the command registry or a submenu whose payload is another menu id;
-// the menubar is the root menu's submenu rows. Menus whose rows are
-// dynamic (Open Recent mirrors the recent-files store) register a
-// provider instead of static rows, and the widget re-reads it at every
-// open. Separators are group boundaries; there is no separator row
-// kind.
-//
-// The module-level Menus instance is the shared registry the
-// composition root and feature contribution files populate; tests
-// construct their own.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { toDisposable, type IDisposable } from "./lifecycle";
-
-/**
- * The well-known menu ids. Features add their own ids - the type is
- * plain string - so this object names only the ids the workbench
- * itself contributes to.
- */
-export const MenuId = {
-  MenubarMainMenu: "menubar",
-  MenubarFileMenu: "menubar/file",
-  MenubarEditMenu: "menubar/edit",
-  MenubarSelectionMenu: "menubar/selection",
-  MenubarViewMenu: "menubar/view",
-  MenubarGoMenu: "menubar/go",
-  MenubarRunMenu: "menubar/run",
-  MenubarTerminalMenu: "menubar/terminal",
-  MenubarHelpMenu: "menubar/help",
-  MenubarRecentMenu: "menubar/file/recent",
-  CommandPalette: "commandPalette",
-  CommandCenter: "commandCenter",
-  EditorTitleContext: "editor/title/context",
-} as const;
-
-/** A menu id. Plain string so features add their own. */
-export type MenuId = string;
-
-/** A menu row that dispatches a command from the command registry. */
-export interface MenuItem {
-  /** The command id the row dispatches. */
-  readonly command: string;
-  /** The arguments passed to the command's run. */
-  readonly args?: readonly unknown[];
-  /** The row label; defaults to the command's title. */
-  readonly title?: string;
-  /** The when-expression gating visibility. */
-  readonly when?: string;
-  /** The sort group; "navigation" sorts first. */
-  readonly group?: string;
-  /** The position within the group. */
-  readonly order?: number;
-}
-
-/** A menu row that opens another menu. */
-export interface SubmenuItem {
-  /** The menu id this row opens. */
-  readonly submenu: MenuId;
-  /** The row label. */
-  readonly title: string;
-  /** The when-expression gating visibility. */
-  readonly when?: string;
-  /** The sort group; "navigation" sorts first. */
-  readonly group?: string;
-  /** The position within the group. */
-  readonly order?: number;
-}
-
-/** One menu row: a command reference or a submenu. */
-export type MenuRow = MenuItem | SubmenuItem;
-
-/** The dynamic row source for a menu, re-read at every open. */
-export type MenuItemsProvider = () => readonly MenuItem[];
-
-/** The row's upsert identity: the command id or the submenu id. */
-function rowId(row: MenuRow): string {
-  return "submenu" in row ? row.submenu : row.command;
-}
-
-/** The row's sort title: its label, else the command id. */
-function rowTitle(row: MenuRow): string {
-  return row.title ?? ("submenu" in row ? row.submenu : row.command);
-}
-
-/**
- * Sorts rows into render order: the navigation group first, then
- * groups lexically, then order, then title. A row without a group
- * joins navigation, matching VS Code's implicit default. Group
- * clusters come out contiguous, so the widget draws separators on the
- * boundaries.
- */
-function compareRows(a: MenuRow, b: MenuRow): number {
-  const groupA = a.group ?? "navigation";
-  const groupB = b.group ?? "navigation";
-  const navA = groupA === "navigation" ? 0 : 1;
-  const navB = groupB === "navigation" ? 0 : 1;
-  if (navA !== navB) {
-    return navA - navB;
-  }
-  if (groupA !== groupB) {
-    return groupA < groupB ? -1 : 1;
-  }
-  const order = (a.order ?? 0) - (b.order ?? 0);
-  if (order !== 0) {
-    return order;
-  }
-  const titleA = rowTitle(a);
-  const titleB = rowTitle(b);
-  if (titleA !== titleB) {
-    return titleA < titleB ? -1 : 1;
-  }
-  return 0;
-}
-
-export class MenuRegistry {
-  private readonly items = new Map<string, MenuRow[]>();
-  private readonly providers = new Map<string, MenuItemsProvider>();
-
-  /**
-   * Places a row in a menu. The row's identity is its command id or
-   * submenu id: re-appending it upserts in place, so re-running a
-   * setup never duplicates rows. The returned disposable removes only
-   * this registration, so disposing a stale row cannot evict its
-   * replacement.
-   */
-  appendMenuItem(menuId: MenuId, item: MenuItem | SubmenuItem): IDisposable {
-    let list = this.items.get(menuId);
-    if (list === undefined) {
-      list = [];
-      this.items.set(menuId, list);
-    }
-    const existing = list.findIndex((row) => rowId(row) === rowId(item));
-    if (existing === -1) {
-      list.push(item);
-    } else {
-      list[existing] = item;
-    }
-    return toDisposable(() => {
-      const current = this.items.get(menuId);
-      const index = current?.indexOf(item) ?? -1;
-      if (current !== undefined && index !== -1) {
-        current.splice(index, 1);
-      }
-    });
-  }
-
-  /** Registers the dynamic row source for a menu; replaces any previous. */
-  setProvider(menuId: MenuId, provider: MenuItemsProvider): IDisposable {
-    this.providers.set(menuId, provider);
-    return toDisposable(() => {
-      if (this.providers.get(menuId) === provider) {
-        this.providers.delete(menuId);
-      }
-    });
-  }
-
-  /**
-   * The menu's rows, static and provider rows sorted together:
-   * navigation first, then groups lexically, then order, then title.
-   */
-  getMenuItems(menuId: MenuId): readonly MenuRow[] {
-    const statics = this.items.get(menuId) ?? [];
-    const dynamic = this.providers.get(menuId)?.() ?? [];
-    return [...statics, ...dynamic].sort(compareRows);
-  }
-}
-
-/** The shared registry the running app renders menus from. */
-export const Menus = new MenuRegistry();
-
-/** Places a row in a menu of the shared registry. */
-export function appendMenuItem(menuId: MenuId, item: MenuItem | SubmenuItem): IDisposable {
-  return Menus.appendMenuItem(menuId, item);
-}
diff --git a/crates/workshop/platform/package.json b/crates/workshop/platform/package.json
deleted file mode 100644
index acd1cf42a..000000000
--- a/crates/workshop/platform/package.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "name": "@workshop/platform",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "description": "Runvil Workshop family platform: the browser-side UI mechanics shared by the Workshop's UIs, with no visuals and no product vocabulary.",
-  "exports": {
-    "./event": "./event.ts",
-    "./lifecycle": "./lifecycle.ts",
-    "./result": "./result.ts",
-    "./service-registry": "./service-registry.ts",
-    "./command-registry": "./command-registry.ts",
-    "./menu-registry": "./menu-registry.ts",
-    "./keybinding-parser": "./keybinding-parser.ts",
-    "./keybinding-resolver": "./keybinding-resolver.ts",
-    "./keybinding-registry": "./keybinding-registry.ts",
-    "./context-key-expr": "./context-key-expr.ts",
-    "./context-key-service": "./context-key-service.ts",
-    "./action-registry": "./action-registry.ts",
-    "./quick-access-registry": "./quick-access-registry.ts",
-    "./reconnect-backoff": "./reconnect-backoff.ts",
-    "./text-control-service": "./text-control-service.ts",
-    "./status-bar": "./status-bar.ts",
-    "./status-indicators": "./status-indicators.ts",
-    "./workshop-part": "./workshop-part.ts",
-    "./panel-registry": "./panel-registry.ts"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit",
-    "test": "node --test \"test/**/*.mjs\""
-  },
-  "dependencies": {
-    "dockview": "^8.3.1"
-  }
-}
diff --git a/crates/workshop/platform/panel-registry.ts b/crates/workshop/platform/panel-registry.ts
deleted file mode 100644
index a15d38c01..000000000
--- a/crates/workshop/platform/panel-registry.ts
+++ /dev/null
@@ -1,194 +0,0 @@
-// The panel registry: every dockview panel kind is declared here once -
-// its zone affinity, title, identity rule, and the import thunk that
-// lazy-loads its feature directory - and the feature's own register()
-// installs the panel factory when the chunk resolves. The registry is
-// open: it declares no panel kind itself; each feature registers its own
-// from an eager module that evaluates before the layout boots. It holds
-// metadata eagerly and code lazily: placement resolves from the entries
-// without the panel implementations landing in the initial bundle, and
-// the first activation of a panel loads its directory on demand.
-//
-// The registry itself is DOM-free data plus the load machinery; the
-// renderer that swaps a resolved panel into the dock lives with the
-// application.
-
-import type { DockviewApi, IContentRenderer } from "dockview";
-
-import { DisposableStore, type IDisposable } from "./lifecycle";
-import { createServiceToken, type ServiceToken } from "./service-registry";
-
-/** The dock's named tab banks. */
-export const ZONE_NAMES = ["left", "main", "right"] as const;
-export type ZoneName = (typeof ZONE_NAMES)[number];
-
-/** A registered panel kind's name. */
-export type PanelType = string;
-
-/**
- * Parameters passed into a panel open. They must be JSON-safe: Dockview
- * serializes them into the saved layout, and a restored panel receives
- * them back as its only state.
- */
-export type PanelParams = Record<string, unknown>;
-
-/**
- * The contract a lazy feature directory's barrel (index.ts) satisfies.
- * register() installs what belongs to the chunk: the directory's panel
- * factory, chunk-bound quick-access providers, and context keys that
- * follow the dock. Actions, menu rows, and keybinding rules do not belong
- * here - they register at module scope from an eager module, because
- * register() runs only when the chunk loads and the boot-time menus must
- * render before that. register() returns a disposable the registry holds
- * for the page lifetime. It may return a promise when activation has
- * async setup; the panel mounts after it resolves.
- */
-export interface PanelFeatureModule {
-  register?: () => IDisposable | Promise<IDisposable> | void | Promise<void>;
-}
-
-/** One panel kind's registration: static metadata plus the lazy thunk. */
-export interface PanelTypeEntry {
-  readonly type: PanelType;
-  /** The tab title: fixed, or computed from the open's params. */
-  readonly title: string | ((params: PanelParams) => string);
-  /** The zone a new panel opens in when the user has not moved it. */
-  readonly defaultZone: ZoneName;
-  /** False when the tab strip must not close the panel. Defaults to true. */
-  readonly closable?: boolean;
-  /**
-   * True when the operator may rename the panel's tab: a double-click opens
-   * an inline editor and the tab menu offers Rename. The name lasts for the
-   * session only; the panel's own title is untouched. Defaults to false.
-   */
-  readonly renamable?: boolean;
-  /**
-   * The panel id for one open. Without it, a string `instance` param keys
-   * the id as `type:instance`, and otherwise the kind is a singleton.
-   * An id must start with `type:` or equal `type`, so the type is
-   * recoverable by splitting at the first colon.
-   */
-  readonly panelId?: (params: PanelParams) => string;
-  /** Loads the feature directory's barrel; esbuild splits it into a chunk. */
-  readonly load: () => Promise<PanelFeatureModule>;
-}
-
-/** The composition root's dock, registered by the zone layer at boot. */
-export const DOCK: ServiceToken<DockviewApi> = createServiceToken<DockviewApi>("workshop.dock");
-
-/**
- * The seam a lazy panel wrapper exposes: the real panel once the feature
- * chunk has resolved. Code that inspects dock content (instanceof checks
- * against a feature's panel class) must unwrap through
- * resolvePanelContent, never read view.content directly.
- */
-export interface LazyPanelContainer {
-  readonly resolvedPanel: IContentRenderer | null;
-}
-
-/**
- * Unwraps a dockview content renderer to the real panel: a lazy wrapper
- * answers its resolved panel (itself while the chunk is still loading,
- * so instanceof checks against feature classes simply fail until then);
- * any other renderer answers itself.
- */
-export function resolvePanelContent(content: IContentRenderer): IContentRenderer {
-  const container = content as IContentRenderer & Partial<LazyPanelContainer>;
-  return container.resolvedPanel ?? content;
-}
-
-const entries = new Map<string, PanelTypeEntry>();
-const factories = new Map<string, () => IContentRenderer>();
-// The directories whose register() has already run, keyed by the module
-// namespace object the thunk resolved to: two panel kinds sharing one
-// directory still register it once.
-const registeredModules = new WeakSet<object>();
-const loadPromises = new Map<string, Promise<(() => IContentRenderer) | undefined>>();
-// Owns every directory registration's disposable. Page-lifetime by
-// design: a panel closing must not unregister its directory's commands
-// and factories, because a reopened panel needs them again.
-const registrationStore = new DisposableStore();
-
-/**
- * Declares one panel kind. Throws when the type is already registered.
- * The returned disposable removes the registration.
- */
-export function registerPanelType(entry: PanelTypeEntry): IDisposable {
-  if (entries.has(entry.type)) {
-    throw new Error(`the panel type "${entry.type}" is already registered`);
-  }
-  entries.set(entry.type, entry);
-  loadPromises.delete(entry.type);
-  return {
-    dispose: () => {
-      if (entries.get(entry.type) === entry) {
-        entries.delete(entry.type);
-        loadPromises.delete(entry.type);
-      }
-    },
-  };
-}
-
-/**
- * Installs a panel kind's factory; the feature directory's register()
- * calls this when its chunk loads. Re-registering replaces the factory.
- */
-export function registerPanelFactory(
-  type: string,
-  factory: () => IContentRenderer,
-): IDisposable {
-  factories.set(type, factory);
-  return {
-    dispose: () => {
-      if (factories.get(type) === factory) {
-        factories.delete(type);
-      }
-    },
-  };
-}
-
-/** Narrows a Dockview component name to a registered panel type. */
-export function isPanelType(name: string): name is PanelType {
-  return entries.has(name);
-}
-
-/** The registration for a panel kind, or undefined for unknown names. */
-export function panelTypeEntry(name: string): PanelTypeEntry | undefined {
-  return entries.get(name);
-}
-
-/**
- * Loads a panel kind's feature chunk, running the directory's register()
- * the first time, and answers the installed factory. Concurrent loads of
- * one type share the in-flight promise. Undefined when the type is
- * unknown; rejects when the chunk loads but installs no factory.
- */
-export function loadPanelType(type: string): Promise<(() => IContentRenderer) | undefined> {
-  const existing = loadPromises.get(type);
-  if (existing !== undefined) {
-    return existing;
-  }
-  const entry = entries.get(type);
-  if (entry === undefined) {
-    return Promise.resolve(undefined);
-  }
-  const promise = (async () => {
-    const module = await entry.load();
-    if (!registeredModules.has(module)) {
-      registeredModules.add(module);
-      const registration = await module.register?.();
-      if (registration !== undefined && registration !== null) {
-        registrationStore.add(registration);
-      }
-    }
-    const factory = factories.get(type);
-    if (factory === undefined) {
-      throw new Error(`the ${type} feature directory registered no panel factory`);
-    }
-    return factory;
-  })();
-  loadPromises.set(type, promise);
-  // A failed load must not poison the registry: the next activation
-  // retries the import.
-  promise.catch(() => loadPromises.delete(type));
-  return promise;
-}
diff --git a/crates/workshop/platform/quick-access-registry.ts b/crates/workshop/platform/quick-access-registry.ts
deleted file mode 100644
index 3c28039d1..000000000
--- a/crates/workshop/platform/quick-access-registry.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-// The quick-access registry: the module-level store of quick-access
-// provider descriptors (the shape of VS Code's
-// IQuickAccessProviderDescriptor) that feature contribution files write
-// at module scope and the quick input widget reads to route its input.
-// Each descriptor names the prefix that claims the input ("" is the
-// default file provider, ">" the command palette), the placeholder the
-// input shows while the provider is active, the help entries the ?
-// mode lists, and a factory that builds the provider lazily.
-//
-// Routing is longest-prefix: the registered prefix that is a prefix of
-// the input value and longer than every other match wins, so "debug "
-// beats "debug" beats "" regardless of registration order. Registration
-// upserts by prefix and returns a disposable that removes only its own
-// registration, so disposing a replaced provider keeps its replacement.
-//
-// The registry never calls the factory; the quick input widget owns the
-// provider shape and narrows what the factory returns.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { toDisposable, type IDisposable } from "./lifecycle";
-
-/** One row in the ? help list, and optionally one in the command center's modes list. */
-export interface QuickAccessHelpEntry {
-  /** What the mode does, e.g. "Show and Run Commands". */
-  readonly description: string;
-  /** The prefix that enters the mode; the provider's own prefix when absent. */
-  readonly prefix?: string;
-  /** The command that opens the mode; both lists show that command's keybinding. */
-  readonly commandId?: string;
-  /**
-   * Where the entry sits in the command center's modes list, ascending. An
-   * entry without an order stays out of that list and shows only under ?.
-   */
-  readonly commandCenterOrder?: number;
-  /** The modes list's label when it should differ from `description`. */
-  readonly commandCenterLabel?: string;
-}
-
-/** A quick-access provider registration, keyed by its prefix. */
-export interface QuickAccessProviderDescriptor {
-  /** The input prefix that routes to this provider; "" is the default. */
-  readonly prefix: string;
-  /** The placeholder text the input shows while this provider is active. */
-  readonly placeholder: string;
-  /** The rows this provider contributes to the ? help list. */
-  readonly helpEntries: readonly QuickAccessHelpEntry[];
-  /**
-   * Builds the provider lazily. The registry stores the factory and
-   * never calls it; the quick input widget owns the provider shape.
-   */
-  readonly factory: () => unknown;
-}
-
-/** The provider store the quick input widget reads. */
-export interface QuickAccessRegistry {
-  /**
-   * Registers one provider. A second registration with the same prefix
-   * replaces the first. The returned disposable removes only this
-   * registration.
-   */
-  registerQuickAccessProvider(descriptor: QuickAccessProviderDescriptor): IDisposable;
-  /**
-   * The descriptor whose prefix is the longest prefix of `value`, or
-   * undefined when no prefix matches (possible only without a ""
-   * provider, since "" is a prefix of every value).
-   */
-  getQuickAccessProvider(value: string): QuickAccessProviderDescriptor | undefined;
-  /** Every registered provider, feeding the ? help list. */
-  getQuickAccessProviders(): readonly QuickAccessProviderDescriptor[];
-}
-
-/** Builds an empty registry. */
-export function createQuickAccessRegistry(): QuickAccessRegistry {
-  const providers: QuickAccessProviderDescriptor[] = [];
-
-  function registerQuickAccessProvider(descriptor: QuickAccessProviderDescriptor): IDisposable {
-    const existing = providers.findIndex((provider) => provider.prefix === descriptor.prefix);
-    if (existing !== -1) {
-      providers.splice(existing, 1);
-    }
-    providers.push(descriptor);
-    return toDisposable(() => {
-      const index = providers.indexOf(descriptor);
-      if (index !== -1) {
-        providers.splice(index, 1);
-      }
-    });
-  }
-
-  return {
-    registerQuickAccessProvider,
-    getQuickAccessProvider(value: string): QuickAccessProviderDescriptor | undefined {
-      let best: QuickAccessProviderDescriptor | undefined;
-      for (const provider of providers) {
-        if (value.startsWith(provider.prefix) && (best === undefined || provider.prefix.length > best.prefix.length)) {
-          best = provider;
-        }
-      }
-      return best;
-    },
-    getQuickAccessProviders(): readonly QuickAccessProviderDescriptor[] {
-      return providers.slice();
-    },
-  };
-}
-
-/** The shared registry the running app's contributions populate. */
-export const QuickAccessRegistry: QuickAccessRegistry = createQuickAccessRegistry();
diff --git a/crates/workshop/platform/reconnect-backoff.ts b/crates/workshop/platform/reconnect-backoff.ts
deleted file mode 100644
index 680e0eb4d..000000000
--- a/crates/workshop/platform/reconnect-backoff.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-// Exponential reconnect backoff, shared by the persistent workshop socket
-// (workshop-socket.ts), the agent-session socket (agent-socket.ts), and
-// the Realtime transcription socket (realtime-transcription.ts). The
-// computed delay starts at `initialMs`, each failure doubles it, and `maxMs`
-// keeps a down server from pushing it out of bounds. Each wait applies equal
-// jitter to the computed delay - half fixed plus a random share of the other
-// half - so clients that drop together do not retry in lockstep. One timer at
-// a time: scheduling while an attempt is already waiting stacks nothing. A
-// successful open resets the computed delay to `initialMs`; disposal cancels
-// any pending attempt.
-
-export interface ReconnectBackoffOptions {
-  readonly initialMs?: number;
-  readonly maxMs?: number;
-  /** Returns a value in [0, 1); defaults to `Math.random`. */
-  readonly random?: () => number;
-}
-
-const DEFAULT_INITIAL_MS = 1000;
-const DEFAULT_MAX_MS = 30_000;
-
-export class ReconnectBackoff {
-  private readonly initialMs: number;
-  private readonly maxMs: number;
-  private readonly random: () => number;
-  private delayMs: number;
-  private timer: ReturnType<typeof setTimeout> | null = null;
-
-  constructor(options: ReconnectBackoffOptions = {}) {
-    this.initialMs = options.initialMs ?? DEFAULT_INITIAL_MS;
-    this.maxMs = options.maxMs ?? DEFAULT_MAX_MS;
-    this.random = options.random ?? Math.random;
-    this.delayMs = this.initialMs;
-  }
-
-  /**
-   * Cancels any pending attempt and restores the initial delay - the
-   * successful-open path, so the next dropout starts over at `initialMs`.
-   */
-  reset(): void {
-    this.cancel();
-    this.delayMs = this.initialMs;
-  }
-
-  /** Cancels any pending attempt; the disposal teardown path. */
-  cancel(): void {
-    if (this.timer !== null) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-  }
-
-  /**
-   * Schedules the next attempt with exponential backoff: `retry` runs
-   * after the current computed delay with equal jitter applied, and the
-   * computed delay doubles per failed attempt up to `maxMs`. One timer at
-   * a time - a call while an attempt is already waiting stacks nothing.
-   */
-  schedule(retry: () => void): void {
-    if (this.timer !== null) {
-      return;
-    }
-    const computed = this.delayMs;
-    this.delayMs = Math.min(computed * 2, this.maxMs);
-    const half = computed / 2;
-    this.timer = setTimeout(() => {
-      this.timer = null;
-      retry();
-    }, half + this.random() * half);
-  }
-}
diff --git a/crates/workshop/platform/result.ts b/crates/workshop/platform/result.ts
deleted file mode 100644
index b0513fe9d..000000000
--- a/crates/workshop/platform/result.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-// The outcome type for fallible operations whose callers branch on the
-// result instead of catching: parsers and registrars return a Result, so
-// a malformed input is a value the caller reports, never an exception
-// thrown later.
-
-/** The outcome of one fallible operation: a value, or a typed error. */
-export type Result<T, E> =
-  | { readonly ok: true; readonly value: T }
-  | { readonly ok: false; readonly error: E };
-
-/** Wraps a value in a successful Result. */
-export function ok<T>(value: T): Result<T, never> {
-  return { ok: true, value };
-}
-
-/** Wraps an error in a failed Result. */
-export function err<E>(error: E): Result<never, E> {
-  return { ok: false, error };
-}
diff --git a/crates/workshop/platform/service-registry.ts b/crates/workshop/platform/service-registry.ts
deleted file mode 100644
index 55d4f2d86..000000000
--- a/crates/workshop/platform/service-registry.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-// The service registry: one module-level collection mapping service
-// tokens to lazy factories, the SPA-side mirror of the server's
-// workshop-registry proxy slots. Subsystems self-register at module scope
-// or from the composition root; consumers resolve with getService and
-// never name each other's modules. Instantiation is lazy - the factory
-// runs on the first get, and the instance is cached for the page
-// lifetime, which is what lets session state (zone placement, the tree's
-// expansion) survive the panels that own it closing and reopening.
-//
-// Generic and DOM-free: imports only this package's own files.
-
-import { toDisposable, type IDisposable } from "./lifecycle";
-
-/**
- * The identity of one service. The type parameter is phantom: it only
- * ties a token to the type its factory must produce, so a lookup cannot
- * resolve the wrong service without a type error.
- */
-export interface ServiceToken<T> {
-  readonly id: string;
-  /** Phantom brand; never present at runtime. */
-  readonly _service?: T;
-}
-
-/** Mints a service token. Ids are diagnostic only, but keep them unique. */
-export function createServiceToken<T>(id: string): ServiceToken<T> {
-  return { id };
-}
-
-interface Registration {
-  readonly factory: () => unknown;
-  /** The lazily built instance; undefined until the first get. */
-  instance: unknown;
-  /** True once the factory has run (instance may still be undefined). */
-  built: boolean;
-}
-
-const registrations = new Map<ServiceToken<unknown>, Registration>();
-
-/**
- * Receives one notification per getService call while installed via
- * setServiceObserver. Test-only seam: the boot test helper is its only
- * consumer, recording where the first resolution falls in the boot
- * sequence relative to the fetches around it.
- */
-export interface IServiceObserver {
-  /** Called on every resolution, before the factory may run. */
-  serviceResolved(id: string): void;
-}
-
-let observer: IServiceObserver | undefined;
-
-/**
- * Installs `next` as the resolution observer, or clears it with undefined.
- * Off by default, so production pays one undefined check per resolution.
- * Test-only seam: the shared boot test helper (test/helpers/boot.mjs) is
- * its only consumer.
- */
-export function setServiceObserver(next: IServiceObserver | undefined): void {
-  observer = next;
-}
-
-/**
- * Registers `factory` as the producer for `token`. Re-registering a token
- * replaces the factory and drops any cached instance - the next get
- * rebuilds from the new factory - which is how tests rebind a service
- * (the dock, a status sink) without process restarts. The returned
- * disposable unregisters only if this registration is still current, so
- * disposing a stale registration cannot evict its replacement.
- */
-export function registerService<T>(token: ServiceToken<T>, factory: () => T): IDisposable {
-  const registration: Registration = { factory: () => factory(), instance: undefined, built: false };
-  registrations.set(token as ServiceToken<unknown>, registration);
-  return toDisposable(() => {
-    if (registrations.get(token as ServiceToken<unknown>) === registration) {
-      registrations.delete(token as ServiceToken<unknown>);
-    }
-  });
-}
-
-/**
- * Resolves `token`, building the instance on first use. Throws when the
- * token was never registered: a missing service is a wiring bug, and a
- * loud throw naming the token beats a downstream null dereference.
- */
-export function getService<T>(token: ServiceToken<T>): T {
-  observer?.serviceResolved(token.id);
-  const registration = registrations.get(token as ServiceToken<unknown>);
-  if (registration === undefined) {
-    throw new Error(`no service registered for ${token.id}`);
-  }
-  if (!registration.built) {
-    registration.instance = registration.factory();
-    registration.built = true;
-  }
-  return registration.instance as T;
-}
-
-/**
- * Resolves `token` when present, null when unregistered. For optional
- * composition-root services: a panel created outside the composition root
- * (a registry test) gets no status bar and stays silent rather than
- * failing to construct.
- */
-export function getServiceOrNull<T>(token: ServiceToken<T>): T | null {
-  return registrations.has(token as ServiceToken<unknown>) ? getService(token) : null;
-}
diff --git a/crates/workshop/platform/status-bar.ts b/crates/workshop/platform/status-bar.ts
deleted file mode 100644
index d3875168b..000000000
--- a/crates/workshop/platform/status-bar.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-// The status bar service contract: the shape panels resolve through the
-// registry to paint action outcomes onto the bar. The Workshop UI's
-// implementation is DOM-bound - it builds the shared status bar view and
-// appends it to the body - so only this interface and the token live
-// here, in the DOM-free platform package.
-
-import { createServiceToken, type ServiceToken } from "./service-registry";
-
-/** The status-bar surface consumers resolve from the registry. */
-export interface StatusBar {
-  /**
-   * Shows a locally-originated message. An info message paints the bar's
-   * text, and the next observer frame overwrites it. An error is raised as a
-   * toast instead, so it stays readable after the next frame lands.
-   */
-  showLocal(label: string, severity: "info" | "error"): void;
-  /** Whether the bar is currently shown. */
-  readonly isVisible: boolean;
-  /** Shows or hides the bar. */
-  setVisible(visible: boolean): void;
-}
-
-/**
- * The registry token for the composition root's StatusBar, resolved by
- * panels that paint action outcomes onto it (the Workshop tree's grant
- * flows). Registered by the composition root at boot; unregistered in
- * tests that drive panels standalone, where the panels stay silent.
- */
-export const STATUS_BAR: ServiceToken<StatusBar> =
-  createServiceToken<StatusBar>("workshop.statusBar");
diff --git a/crates/workshop/platform/status-indicators.ts b/crates/workshop/platform/status-indicators.ts
deleted file mode 100644
index 153071970..000000000
--- a/crates/workshop/platform/status-indicators.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-// The status indicator slots contract: features register LED-style
-// indicators, and clickable non-LED slots they draw into themselves,
-// into the status bar's indicators group and drive each one through its
-// handle. The Workshop UI's status bar implements it; only this
-// interface and the token live here, in the DOM-free platform package.
-
-import type { IDisposable } from "./lifecycle";
-import { createServiceToken, type ServiceToken } from "./service-registry";
-
-/** An indicator's lit color; null is the unlit lens. */
-export type IndicatorState = "green" | "amber" | "red" | null;
-
-/** One indicator's registration. */
-export interface StatusIndicatorOptions {
-  /** Unique across the bar; a duplicate throws. */
-  readonly id: string;
-  /** The accessible label, unless `decorative`. */
-  readonly name: string;
-  /** Sorts ascending, left to right. */
-  readonly order: number;
-  /** Hidden from assistive tech instead of labelled. */
-  readonly decorative?: boolean;
-}
-
-/** A registered indicator; dispose removes it from the bar. */
-export interface StatusIndicatorHandle extends IDisposable {
-  /** Shows exactly one color, or none for null. A tooltip sets the title and joins the label. */
-  set(state: IndicatorState, tooltip?: string): void;
-}
-
-/** One non-LED slot's registration. */
-export interface StatusSlotOptions {
-  /** Unique across the bar, indicators included; a duplicate throws. */
-  readonly id: string;
-  /** The accessible label. */
-  readonly name: string;
-  /** Sorts ascending among the indicators, left to right. */
-  readonly order: number;
-  /** Runs on every click. */
-  readonly activate: () => void;
-}
-
-/** A registered non-LED slot; dispose removes it from the bar and stops activating. */
-export interface StatusSlotHandle extends IDisposable {
-  /** The slot's host element, which its owner draws into. */
-  readonly element: HTMLElement;
-  /** Sets the title, which joins the label; none restores the plain name. */
-  setTooltip(tooltip?: string): void;
-}
-
-/** The indicator slots, which consumers resolve from the registry. */
-export interface StatusIndicators {
-  /** Adds one indicator in `order`; throws on a duplicate id. */
-  register(options: StatusIndicatorOptions): StatusIndicatorHandle;
-  /** Adds one non-LED slot in `order` among the indicators; throws on a duplicate id. */
-  registerSlot(options: StatusSlotOptions): StatusSlotHandle;
-}
-
-/** The registry token for the indicator slots the composition root registers. */
-export const STATUS_INDICATORS: ServiceToken<StatusIndicators> =
-  createServiceToken<StatusIndicators>("workshop.statusIndicators");
diff --git a/crates/workshop/platform/test/actions.mjs b/crates/workshop/platform/test/actions.mjs
deleted file mode 100644
index b38dce89a..000000000
--- a/crates/workshop/platform/test/actions.mjs
+++ /dev/null
@@ -1,256 +0,0 @@
-// Unit test for the action registry (action-registry.ts):
-// registerAction fans one descriptor out into the command, menu, and
-// keybinding registries - the command with its metadata, one menu row
-// per menu entry plus a CommandPalette row when f1 is set, and the
-// keybinding rule with the precondition ANDed into its when. The
-// returned DisposableStore unwinds every registration together, and
-// malformed when/precondition/toggled/keybinding strings come back as
-// ParseError values at registration with nothing registered. Bundles
-// the modules with esbuild and drives them.
-// Run: node --test test/actions.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createActionRegistry, registerAction } from "./action-registry.ts";
-      export { CommandRegistry, Commands } from "./command-registry.ts";
-      export { MenuRegistry, MenuId } from "./menu-registry.ts";
-      export { createKeybindingsRegistry } from "./keybinding-registry.ts";
-      export { ContextKeyService } from "./context-key-service.ts";
-    `,
-    resolveDir: platformDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const {
-  createActionRegistry,
-  registerAction,
-  CommandRegistry,
-  Commands,
-  MenuRegistry,
-  MenuId,
-  createKeybindingsRegistry,
-  ContextKeyService,
-} = await import(`data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function chord(ctrl, shift, alt, meta, key) {
-  return { ctrl, shift, alt, meta, key };
-}
-
-function setup() {
-  const commands = new CommandRegistry();
-  const menus = new MenuRegistry();
-  const keybindings = createKeybindingsRegistry("windows");
-  const actions = createActionRegistry({ commands, menus, keybindings, platform: "windows" });
-  return { commands, menus, keybindings, actions };
-}
-
-{
-  // One descriptor fans out into all three registries.
-  const { commands, menus, keybindings, actions } = setup();
-  let ran = 0;
-  const result = actions.registerAction({
-    id: "file.save",
-    title: "Save",
-    category: "File",
-    f1: true,
-    precondition: "editorTextFocus",
-    toggled: "editorDirty",
-    keybinding: { keybinding: "ctrl+s", weight: 100 },
-    menu: [
-      { id: MenuId.MenubarFileMenu, group: "1_save", order: 1, args: ["quiet"] },
-      { id: "menubar/file/share", when: "hasProfile" },
-    ],
-    run: () => {
-      ran += 1;
-    },
-  });
-  check("a valid action registers ok", result.ok === true);
-  const command = commands.lookup("file.save");
-  check("the command is registered", command !== undefined);
-  check("the command records its metadata", command?.title === "Save" && command?.category === "File" && command?.precondition === "editorTextFocus" && command?.toggled === "editorDirty");
-  const fileRows = menus.getMenuItems(MenuId.MenubarFileMenu);
-  check("the menu entry lands in its menu", fileRows.length === 1 && fileRows[0]?.command === "file.save" && fileRows[0]?.group === "1_save");
-  check("the menu entry records its args", fileRows[0]?.args?.[0] === "quiet");
-  const shareRows = menus.getMenuItems("menubar/file/share");
-  check("a second menu entry lands in its own menu", shareRows.length === 1 && shareRows[0]?.when === "hasProfile");
-  const paletteRows = menus.getMenuItems(MenuId.CommandPalette);
-  check("f1 places a palette row", paletteRows.length === 1 && paletteRows[0]?.command === "file.save");
-  const context = new ContextKeyService();
-  context.createKey("editorTextFocus", true);
-  const outcome = keybindings.getResolver().resolve(context, [chord(true, false, false, false, "s")]);
-  check("the keybinding rule resolves", outcome.kind === "KbFound" && outcome.commandId === "file.save");
-  check("the keybinding label is available", keybindings.lookupKeybinding("file.save")?.getLabel() === "Ctrl+S");
-  await commands.execute("file.save");
-  check("the command runs through the registry", ran === 1);
-  context.dispose();
-}
-
-{
-  // Without f1 there is no palette row.
-  const { menus, actions } = setup();
-  const result = actions.registerAction({ id: "view.zoom", title: "Zoom", run: () => {} });
-  check("a minimal action registers ok", result.ok === true);
-  check("no f1 means no palette row", menus.getMenuItems(MenuId.CommandPalette).length === 0);
-  result.value.dispose();
-}
-
-{
-  // The precondition is ANDed into the keybinding's when.
-  const { keybindings, actions } = setup();
-  const result = actions.registerAction({
-    id: "editor.format",
-    title: "Format",
-    precondition: "editorTextFocus",
-    keybinding: { keybinding: "ctrl+k ctrl+f", when: "editorLangId == 'rust'" },
-    run: () => {},
-  });
-  check("an action with both precondition and when registers ok", result.ok === true);
-  const context = new ContextKeyService();
-  const focus = context.createKey("editorTextFocus", false);
-  const lang = context.createKey("editorLangId", "plaintext");
-  const chords = [chord(true, false, false, false, "k"), chord(true, false, false, false, "f")];
-  check("the chord needs the precondition", keybindings.getResolver().resolve(context, chords).kind === "NoMatchingKb");
-  focus.set(true);
-  check("the chord needs the keybinding when", keybindings.getResolver().resolve(context, chords).kind === "NoMatchingKb");
-  lang.set("rust");
-  const outcome = keybindings.getResolver().resolve(context, chords);
-  check("precondition AND when together release the chord", outcome.kind === "KbFound" && outcome.commandId === "editor.format");
-  context.dispose();
-  result.value.dispose();
-}
-
-{
-  // A precondition alone becomes the keybinding's when.
-  const { keybindings, actions } = setup();
-  actions.registerAction({
-    id: "editor.comment",
-    title: "Comment",
-    precondition: "editorTextFocus",
-    keybinding: { keybinding: "ctrl+/" },
-    run: () => {},
-  });
-  const context = new ContextKeyService();
-  const focus = context.createKey("editorTextFocus", false);
-  check("the precondition gates the chord", keybindings.getResolver().resolve(context, [chord(true, false, false, false, "/")]).kind === "NoMatchingKb");
-  focus.set(true);
-  check("a met precondition releases the chord", keybindings.getResolver().resolve(context, [chord(true, false, false, false, "/")]).kind === "KbFound");
-  context.dispose();
-}
-
-{
-  // The returned store unwinds every registration together.
-  const { commands, menus, keybindings, actions } = setup();
-  const result = actions.registerAction({
-    id: "file.reopen",
-    title: "Reopen",
-    f1: true,
-    keybinding: { keybinding: "ctrl+r" },
-    menu: [{ id: MenuId.MenubarFileMenu }],
-    run: () => {},
-  });
-  check("dispose-ready action registered ok", result.ok === true);
-  result.value.dispose();
-  check("dispose unregisters the command", commands.lookup("file.reopen") === undefined);
-  check("dispose removes the menu row", menus.getMenuItems(MenuId.MenubarFileMenu).length === 0);
-  check("dispose removes the palette row", menus.getMenuItems(MenuId.CommandPalette).length === 0);
-  check("dispose removes the keybinding label", keybindings.lookupKeybinding("file.reopen") === undefined);
-  const context = new ContextKeyService();
-  check("dispose removes the keybinding rule", keybindings.getResolver().resolve(context, [chord(true, false, false, false, "r")]).kind === "NoMatchingKb");
-  context.dispose();
-}
-
-{
-  // Re-registering an id upserts instead of duplicating rows.
-  const { commands, menus, actions } = setup();
-  const first = actions.registerAction({ id: "a.b", title: "One", f1: true, run: () => {} });
-  const second = actions.registerAction({ id: "a.b", title: "Two", f1: true, run: () => {} });
-  check("re-registration is ok", first.ok === true && second.ok === true);
-  check("re-registration upserts the command", commands.lookup("a.b")?.title === "Two");
-  check("re-registration does not duplicate the palette row", menus.getMenuItems(MenuId.CommandPalette).length === 1);
-  first.value.dispose();
-  check("disposing the stale registration keeps the replacement", commands.lookup("a.b")?.title === "Two");
-  second.value.dispose();
-}
-
-{
-  // Malformed strings come back as errors and register nothing.
-  const { commands, menus, keybindings, actions } = setup();
-  const badPrecondition = actions.registerAction({
-    id: "bad.precondition",
-    title: "Bad",
-    precondition: "a &&",
-    keybinding: { keybinding: "ctrl+p" },
-    menu: [{ id: MenuId.MenubarFileMenu }],
-    run: () => {},
-  });
-  check("a malformed precondition is returned", badPrecondition.ok === false && typeof badPrecondition.error.message === "string");
-  check("a malformed precondition registers no command", commands.lookup("bad.precondition") === undefined);
-  check("a malformed precondition registers no menu row", menus.getMenuItems(MenuId.MenubarFileMenu).length === 0);
-  check("a malformed precondition registers no keybinding", keybindings.lookupKeybinding("bad.precondition") === undefined);
-
-  const badToggled = actions.registerAction({ id: "bad.toggled", title: "Bad", toggled: "x ==", run: () => {} });
-  check("a malformed toggled is returned", badToggled.ok === false);
-  check("a malformed toggled registers nothing", commands.lookup("bad.toggled") === undefined);
-
-  const badMenuWhen = actions.registerAction({
-    id: "bad.menuwhen",
-    title: "Bad",
-    menu: [{ id: MenuId.MenubarFileMenu, when: "(open" }],
-    run: () => {},
-  });
-  check("a malformed menu when is returned", badMenuWhen.ok === false);
-  check("a malformed menu when registers nothing", commands.lookup("bad.menuwhen") === undefined);
-
-  const badKeyWhen = actions.registerAction({
-    id: "bad.keywhen",
-    title: "Bad",
-    keybinding: { keybinding: "ctrl+q", when: "!!" },
-    run: () => {},
-  });
-  check("a malformed keybinding when is returned", badKeyWhen.ok === false);
-  check("a malformed keybinding when registers nothing", commands.lookup("bad.keywhen") === undefined);
-
-  const badChord = actions.registerAction({
-    id: "bad.chord",
-    title: "Bad",
-    keybinding: { keybinding: "ctrl+banana" },
-    run: () => {},
-  });
-  check("a malformed chord is returned", badChord.ok === false);
-  check("a malformed chord registers nothing", commands.lookup("bad.chord") === undefined);
-  check("a malformed chord reaches no resolver", keybindings.getResolver().resolve(new ContextKeyService(), [chord(true, false, false, false, "p")]).kind === "NoMatchingKb");
-}
-
-{
-  // The module-level registerAction writes to the shared registries.
-  const result = registerAction({ id: "test.shared.action", title: "Shared", f1: true, run: () => {} });
-  check("the shared registerAction is ok", result.ok === true);
-  check("the shared registerAction reaches the shared commands", Commands.lookup("test.shared.action")?.title === "Shared");
-  result.value.dispose();
-  check("the shared registration unwinds", Commands.lookup("test.shared.action") === undefined);
-}
-
-if (failures.length > 0) {
-  console.error(`actions: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("actions: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/boundary.mjs b/crates/workshop/platform/test/boundary.mjs
deleted file mode 100644
index e23c4c93e..000000000
--- a/crates/workshop/platform/test/boundary.mjs
+++ /dev/null
@@ -1,114 +0,0 @@
-// The platform boundary guard: `@workshop/platform` is the family's
-// browser-side UI mechanics, so its sources import only their own files
-// and `dockview`. Walks every `.ts` file outside `test/` and
-// `node_modules/` and fails on any import, re-export, dynamic import, or
-// triple-slash reference whose specifier is neither a relative path that
-// stays inside the package nor `dockview`, naming the offending file and
-// specifier. `@workshop/look`, the Workshop UI, other packages, and
-// escaping relative paths all fail. Type-only imports count: the scan
-// reads source text, so nothing is elided before it looks. No jsdom: this
-// is a source-text check.
-// Run: node --test test/boundary.mjs (from crates/workshop/platform).
-import assert from "node:assert/strict";
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import { test } from "node:test";
-import { fileURLToPath } from "node:url";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const PATTERNS = [
-  // import x from "a"; import { x } from "a"; import type { X } from "a";
-  // export { x } from "a"; export * from "a". The clause holds no quotes,
-  // so the match cannot run on into a string literal.
-  /^\s*(?:import|export)\b[^;"'`]*?\bfrom\s*["']([^"']+)["']/gm,
-  // import "a";
-  /^\s*import\s*["']([^"']+)["']/gm,
-  // import("a")
-  /\bimport\s*\(\s*["']([^"']+)["']/g,
-  // import x = require("a")
-  /\brequire\s*\(\s*["']([^"']+)["']/g,
-  // /// <reference path="a" /> and /// <reference types="a" />
-  /^\s*\/\/\/\s*<reference\s+(?:path|types)\s*=\s*["']([^"']+)["']/gm,
-];
-
-export function importSpecifiers(text) {
-  return PATTERNS.flatMap((pattern) => [...text.matchAll(pattern)].map((match) => match[1]));
-}
-
-export function violation(file, specifier) {
-  if (specifier === "dockview") return null;
-  if (!specifier.startsWith("./") && !specifier.startsWith("../")) {
-    return "not a relative path or dockview";
-  }
-  const relative = path.relative(platformDir, path.resolve(path.dirname(file), specifier));
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    return "a relative path that leaves the package";
-  }
-  return null;
-}
-
-const files = (await readdir(platformDir, { recursive: true, withFileTypes: true }))
-  .filter((entry) => entry.isFile() && entry.name.endsWith(".ts"))
-  .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name))
-  .filter((file) => {
-    const segments = path.relative(platformDir, file).split(path.sep);
-    return segments[0] !== "test" && !segments.includes("node_modules");
-  })
-  .sort();
-
-test("the walk reaches the package's TypeScript sources", () => {
-  assert.ok(files.length > 0, "the walk found no .ts source");
-});
-
-test("the scan reads every import form", () => {
-  const ts = [
-    'import "./a";',
-    'import x from "./b";',
-    "import {",
-    "  c,",
-    "  d,",
-    '} from "./c";',
-    'import type { E } from "./e";',
-    'export { f } from "./f";',
-    'export * from "./g";',
-    'const h = await import("./h");',
-    'import i = require("./i");',
-    '/// <reference path="./j.d.ts" />',
-    'export type Kind = "ok" | "err";',
-    'export const k = Array.from("./not-an-import");',
-  ].join("\n");
-  assert.deepEqual(importSpecifiers(ts).sort(), ["./a", "./b", "./c", "./e", "./f", "./g", "./h", "./i", "./j.d.ts"]);
-});
-
-test("the classifier admits own files and dockview and rejects everything else", () => {
-  const from = path.join(platformDir, "result.ts");
-  for (const specifier of ["./result", "../platform/result", "dockview"]) {
-    assert.equal(violation(from, specifier), null, `${specifier} should be allowed`);
-  }
-  for (const specifier of [
-    "@workshop/look",
-    "@workshop/look/icons",
-    "workshop-ui",
-    "@workshop/ui",
-    "dockview-core",
-    "dockview/dist/esm",
-    "lucide",
-    "../ui/src/services/error-catalog",
-    "../look/icons",
-    "/abs/path",
-  ]) {
-    assert.notEqual(violation(from, specifier), null, `${specifier} should be rejected`);
-  }
-});
-
-test("no platform source imports outside the package or dockview", async () => {
-  const offenders = [];
-  for (const file of files) {
-    for (const specifier of importSpecifiers(await readFile(file, "utf8"))) {
-      const reason = violation(file, specifier);
-      if (reason !== null) offenders.push(`${path.relative(platformDir, file)}: "${specifier}" (${reason})`);
-    }
-  }
-  assert.deepEqual(offenders, [], `boundary violations:\n  ${offenders.join("\n  ")}`);
-});
diff --git a/crates/workshop/platform/test/command-failures.mjs b/crates/workshop/platform/test/command-failures.mjs
deleted file mode 100644
index 059142a55..000000000
--- a/crates/workshop/platform/test/command-failures.mjs
+++ /dev/null
@@ -1,129 +0,0 @@
-// Unit test for the command registry's failure report (command-registry.ts):
-// a command that rejects or throws fires onDidFailCommand with its id, its
-// palette label (Category: Title, the bare title, or the id), and the error,
-// and execute still rejects with that same error so a caller that awaits the
-// run keeps its own handling. A command that succeeds, an unregistered id, and
-// a disposed subscription report nothing. The UI turns the report into the
-// "Command '{0}' resulted in an error" toast; the platform stays DOM-free.
-// Run: node --test test/command-failures.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `export { CommandRegistry } from "./command-registry.ts";`,
-    resolveDir: platformDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { CommandRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** Runs `id` and answers the rejection, or "resolved" when it did not reject. */
-async function settle(commands, id) {
-  try {
-    await commands.execute(id);
-    return "resolved";
-  } catch (error) {
-    return error;
-  }
-}
-
-{
-  // A rejection reports once, with the palette label, and still rejects.
-  const commands = new CommandRegistry();
-  const boom = new Error("disk full");
-  commands.register("file.save", { title: "Save", category: "File", run: () => Promise.reject(boom) });
-  const reports = [];
-  commands.onDidFailCommand((failure) => reports.push(failure));
-  const outcome = await settle(commands, "file.save");
-  check("execute still rejects with the command's own error", outcome === boom);
-  check("a rejection reports exactly once", reports.length === 1);
-  check("the report names the command id", reports[0]?.id === "file.save");
-  check("the report label is Category: Title", reports[0]?.label === "File: Save");
-  check("the report carries the error", reports[0]?.error === boom);
-}
-
-{
-  // A synchronous throw reports the same way, and the label falls back.
-  const commands = new CommandRegistry();
-  const crash = new TypeError("not a function");
-  commands.register("window.reload", {
-    title: "Reload Window",
-    run: () => {
-      throw crash;
-    },
-  });
-  commands.register("bare.command", {
-    run: () => {
-      throw crash;
-    },
-  });
-  const reports = [];
-  commands.onDidFailCommand((failure) => reports.push(failure));
-  const outcome = await settle(commands, "window.reload");
-  check("a synchronous throw rejects execute with the same error", outcome === crash);
-  check("a category-less label is the bare title", reports[0]?.label === "Reload Window");
-  await settle(commands, "bare.command");
-  check("a command without a title labels with its id", reports[1]?.label === "bare.command");
-}
-
-{
-  // Success, an unknown id, and a disposed subscription report nothing.
-  const commands = new CommandRegistry();
-  commands.register("ok", { title: "Fine", run: () => {} });
-  commands.register("bad", { title: "Bad", run: () => Promise.reject(new Error("no")) });
-  const reports = [];
-  const subscription = commands.onDidFailCommand((failure) => reports.push(failure));
-  check("a successful command resolves true", (await commands.execute("ok")) === true);
-  check("an unregistered id resolves false", (await commands.execute("missing")) === false);
-  check("neither reports a failure", reports.length === 0);
-  subscription.dispose();
-  await settle(commands, "bad");
-  check("a disposed subscription hears nothing", reports.length === 0);
-}
-
-{
-  // labelOf answers the same label a failure reports, for a run that bypassed the registry.
-  const commands = new CommandRegistry();
-  commands.register("file.save", { title: "Save", category: "File", run: () => {} });
-  commands.register("window.reload", { title: "Reload Window", run: () => {} });
-  commands.register("bare.command", { run: () => {} });
-  check("labelOf is Category: Title", commands.labelOf("file.save") === "File: Save");
-  check("labelOf is the bare title without a category", commands.labelOf("window.reload") === "Reload Window");
-  check("labelOf is the id without a title", commands.labelOf("bare.command") === "bare.command");
-  check("labelOf is the id for an unregistered command", commands.labelOf("missing.command") === "missing.command");
-}
-
-{
-  // Two registries report independently: a test registry never feeds the shared one.
-  const first = new CommandRegistry();
-  const second = new CommandRegistry();
-  first.register("bad", { title: "Bad", run: () => Promise.reject(new Error("no")) });
-  const heard = [];
-  second.onDidFailCommand((failure) => heard.push(failure));
-  await settle(first, "bad");
-  check("a failure reports only on the registry that ran it", heard.length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`command-failures: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("command-failures: all assertions passed");
diff --git a/crates/workshop/platform/test/context-keys.mjs b/crates/workshop/platform/test/context-keys.mjs
deleted file mode 100644
index 5baffb163..000000000
--- a/crates/workshop/platform/test/context-keys.mjs
+++ /dev/null
@@ -1,183 +0,0 @@
-// Unit test for the context-key expression parser and service
-// (context-key-expr.ts, context-key-service.ts):
-// the `when` expression language (key, !key, == / != against a string
-// literal, &&, ||, parentheses, true, false) parsed into an evaluable
-// expression that names the keys it reads, and the service that holds
-// key values, binds keys with defaults, evaluates expressions, and fires
-// a change event whose affectsSome lets subscribers re-evaluate only the
-// expressions that read the changed keys. Bundles the modules with
-// esbuild and drives them. Covers: the expression subset, precedence and
-// parentheses, keys() collection, parse failures returned as Result
-// values (never thrown), createKey defaults visible through getValue,
-// set/get/reset, and affectsSome on the change event.
-// Run: node --test test/context-keys.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { ContextKeyExpr } from "./context-key-expr.ts";
-      export { ContextKeyService, CONTEXT_KEY_SERVICE } from "./context-key-service.ts";
-      export { getService } from "./service-registry.ts";
-    `,
-    resolveDir: platformDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { ContextKeyExpr, ContextKeyService, CONTEXT_KEY_SERVICE, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function evaluate(when, values) {
-  const result = ContextKeyExpr.deserialize(when);
-  if (!result.ok) return `parse-error: ${result.error.message}`;
-  return result.value.evaluate((key) => values[key]);
-}
-
-// --- Self-registration --------------------------------------------------------
-
-const shared = getService(CONTEXT_KEY_SERVICE);
-check("the CONTEXT_KEY_SERVICE token self-registers", shared instanceof ContextKeyService);
-check("the registry caches one instance", getService(CONTEXT_KEY_SERVICE) === shared);
-
-// --- Expression subset ----------------------------------------------------------
-
-check("a bare key is truthy", evaluate("editorTextFocus", { editorTextFocus: true }) === true);
-check("a bare key fails on falsy", evaluate("editorTextFocus", { editorTextFocus: false }) === false);
-check("an unknown key is falsy", evaluate("editorTextFocus", {}) === false);
-check("! negates", evaluate("!editorTextFocus", { editorTextFocus: false }) === true);
-check("!! is a double negation", evaluate("!!a", { a: 1 }) === true);
-check("== matches a string literal", evaluate("editorLangId == 'rust'", { editorLangId: "rust" }) === true);
-check("== rejects a different value", evaluate("editorLangId == 'rust'", { editorLangId: "json" }) === false);
-check("== fails when the key is unset", evaluate("editorLangId == 'rust'", {}) === false);
-check("!= matches a different value", evaluate("editorLangId != 'rust'", { editorLangId: "json" }) === true);
-check("!= rejects an equal value", evaluate("editorLangId != 'rust'", { editorLangId: "rust" }) === false);
-check("true is true", evaluate("true", {}) === true);
-check("false is false", evaluate("false", {}) === false);
-check("&& needs both sides", evaluate("a && b", { a: true, b: false }) === false);
-check("|| needs one side", evaluate("a || b", { a: false, b: true }) === true);
-check("&& binds tighter than ||", evaluate("a || b && c", { a: false, b: true, c: true }) === true);
-check("parentheses override precedence", evaluate("(a || b) && c", { a: true, b: false, c: false }) === false);
-check(
-  "a compound expression evaluates",
-  evaluate("editorTextFocus && editorLangId == 'rust' || !inputFocus", {
-    editorTextFocus: true,
-    editorLangId: "rust",
-    inputFocus: true,
-  }) === true,
-);
-check("whitespace is insignificant", evaluate("  a   &&\n\tb  ", { a: true, b: true }) === true);
-check("dotted and dashed keys parse", evaluate("config.editor.wordWrap == 'on'", { "config.editor.wordWrap": "on" }) === true);
-
-// --- keys() ---------------------------------------------------------------------
-
-{
-  const result = ContextKeyExpr.deserialize("a && !b || c == 'x'");
-  check("deserialize succeeds for a compound expression", result.ok);
-  const keys = result.ok ? [...result.value.keys()].sort() : [];
-  check("keys() names every referenced key", keys.join(",") === "a,b,c");
-  const noKeys = ContextKeyExpr.deserialize("true");
-  check("a literal references no keys", noKeys.ok && noKeys.value.keys().size === 0);
-  const repeated = ContextKeyExpr.deserialize("a && a");
-  check("a repeated key is collected once", repeated.ok && repeated.value.keys().size === 1);
-}
-
-// --- Parse errors as values -------------------------------------------------------
-
-{
-  const empty = ContextKeyExpr.deserialize("");
-  check("an empty string is a parse error, not a throw", !empty.ok && typeof empty.error.message === "string");
-  const dangling = ContextKeyExpr.deserialize("a &&");
-  check("a dangling operator is a parse error", !dangling.ok);
-  const unquoted = ContextKeyExpr.deserialize("a == foo");
-  check("an unquoted comparison value is a parse error", !unquoted.ok);
-  const unclosed = ContextKeyExpr.deserialize("(a || b");
-  check("an unclosed parenthesis is a parse error", !unclosed.ok);
-  const singleAmp = ContextKeyExpr.deserialize("a & b");
-  check("a single & is a parse error", !singleAmp.ok);
-  const trailing = ContextKeyExpr.deserialize("a b");
-  check("trailing input is a parse error", !trailing.ok);
-  const bare = ContextKeyExpr.deserialize("==");
-  check("an operator with no key is a parse error", !bare.ok);
-  const withOffset = ContextKeyExpr.deserialize("a && )");
-  check("a parse error reports a numeric offset", !withOffset.ok && typeof withOffset.error.offset === "number");
-}
-
-// --- The service -------------------------------------------------------------------
-
-const service = new ContextKeyService();
-
-check("an unbound key reads undefined", service.getValue("nope") === undefined);
-check("contextMatchesRules(undefined) is true", service.contextMatchesRules(undefined) === true);
-check("a malformed when string never matches", service.contextMatchesRules("a &&") === false);
-
-const editorTextFocus = service.createKey("editorTextFocus", false);
-check("createKey's default is visible through getValue", service.getValue("editorTextFocus") === false);
-check("the key's get returns the default", editorTextFocus.get() === false);
-check("contextMatchesRules evaluates a string against the service", service.contextMatchesRules("editorTextFocus") === false);
-check("contextMatchesRules honors the default", service.contextMatchesRules("!editorTextFocus") === true);
-
-let lastEvent = null;
-let fires = 0;
-const subscription = service.onDidChangeContext((event) => {
-  fires += 1;
-  lastEvent = event;
-});
-
-editorTextFocus.set(true);
-check("set stores the value", editorTextFocus.get() === true);
-check("set fires the change event", fires === 1);
-check(
-  "affectsSome is true for the changed key",
-  lastEvent !== null && lastEvent.affectsSome(new Set(["editorTextFocus", "other"])) === true,
-);
-check(
-  "affectsSome is false for untouched keys",
-  lastEvent !== null && lastEvent.affectsSome(new Set(["inputFocus"])) === false,
-);
-check("the new value flips evaluation", service.contextMatchesRules("editorTextFocus") === true);
-
-editorTextFocus.reset();
-check("reset restores the default", editorTextFocus.get() === false);
-check("reset fires the change event", fires === 2);
-
-{
-  const parsed = ContextKeyExpr.deserialize("editorTextFocus && editorLangId == 'rust'");
-  check("the compound expression parses", parsed.ok);
-  check("an expression object evaluates against the service", parsed.ok && service.contextMatchesRules(parsed.value) === false);
-  const langId = service.createKey("editorLangId", "json");
-  langId.set("rust");
-  editorTextFocus.set(true);
-  check("evaluation follows later sets", parsed.ok && service.contextMatchesRules(parsed.value) === true);
-}
-
-const firesBeforeDispose = fires;
-subscription.dispose();
-editorTextFocus.set(false);
-check("disposing the subscription stops events", fires === firesBeforeDispose);
-
-service.dispose();
-shared.dispose();
-
-if (failures.length > 0) {
-  console.error(`context-keys: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("context-keys: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/keybindings.mjs b/crates/workshop/platform/test/keybindings.mjs
deleted file mode 100644
index 2edeab023..000000000
--- a/crates/workshop/platform/test/keybindings.mjs
+++ /dev/null
@@ -1,373 +0,0 @@
-// Unit test for the keybinding parser, resolver, and registry
-// (keybinding-parser.ts, keybinding-resolver.ts,
-// keybinding-registry.ts): chord-string parsing with the
-// ctrlcmd token resolved per platform, KeyboardEvent mapping through
-// event.code (never event.key, so Ctrl+Shift+= reads as = and Numpad0 is
-// distinct from Digit0), the pure resolver's NoMatchingKb /
-// MoreChordsNeeded / KbFound outcomes with when filtering and weight
-// tiers, and the registry's mac/linux overrides, disposable
-// unregistration, and per-platform lookupKeybinding labels, which a
-// context lookup steers to the first rule whose when passes. Bundles the
-// modules with esbuild and drives them.
-// Run: node --test test/keybindings.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { parseKeybinding, chordFromKeyboardEvent, formatChord, formatKeybinding, detectPlatform } from "./keybinding-parser.ts";
-      export { KeybindingResolver } from "./keybinding-resolver.ts";
-      export { KeybindingsRegistry, KeybindingWeight, createKeybindingsRegistry } from "./keybinding-registry.ts";
-      export { ContextKeyService } from "./context-key-service.ts";
-    `,
-    resolveDir: platformDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const {
-  parseKeybinding,
-  chordFromKeyboardEvent,
-  formatChord,
-  formatKeybinding,
-  detectPlatform,
-  KeybindingResolver,
-  KeybindingsRegistry,
-  KeybindingWeight,
-  createKeybindingsRegistry,
-  ContextKeyService,
-} = await import(`data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function chord(ctrl, shift, alt, meta, key) {
-  return { ctrl, shift, alt, meta, key };
-}
-
-function sameChord(a, b) {
-  return a.ctrl === b.ctrl && a.shift === b.shift && a.alt === b.alt && a.meta === b.meta && a.key === b.key;
-}
-
-function parseOk(text, platform) {
-  const result = parseKeybinding(text, platform);
-  if (!result.ok) return `parse-error: ${result.error.message}`;
-  return result.value;
-}
-
-function keyEvent(code, mods = {}) {
-  return {
-    code,
-    ctrlKey: mods.ctrl === true,
-    shiftKey: mods.shift === true,
-    altKey: mods.alt === true,
-    metaKey: mods.meta === true,
-  };
-}
-
-// --- Platform detection -------------------------------------------------------
-
-check("detectPlatform answers a known platform", ["windows", "mac", "linux"].includes(detectPlatform()));
-
-// --- Chord parsing ------------------------------------------------------------
-
-{
-  const chords = parseOk("ctrl+s", "windows");
-  check("ctrl+s parses to one chord", Array.isArray(chords) && chords.length === 1);
-  check("ctrl+s sets ctrl and the key", Array.isArray(chords) && sameChord(chords[0], chord(true, false, false, false, "s")));
-}
-{
-  const chords = parseOk("ctrl+m ctrl+o", "windows");
-  check("a chord sequence parses to two chords", Array.isArray(chords) && chords.length === 2);
-  check(
-    "the second chord parses",
-    Array.isArray(chords) && sameChord(chords[1], chord(true, false, false, false, "o")),
-  );
-}
-check("modifier and key case is insignificant", sameChord(parseOk("Ctrl+Shift+P", "windows")[0], chord(true, true, false, false, "p")));
-check("cmd is a meta alias", sameChord(parseOk("cmd+p", "mac")[0], chord(false, false, false, true, "p")));
-check("meta parses", sameChord(parseOk("meta+p", "windows")[0], chord(false, false, false, true, "p")));
-check("alt parses", sameChord(parseOk("alt+up", "windows")[0], chord(false, false, true, false, "up")));
-check("several modifiers combine", sameChord(parseOk("ctrl+alt+shift+f", "linux")[0], chord(true, true, true, false, "f")));
-
-// --- ctrlcmd platform resolution ------------------------------------------------
-
-check("ctrlcmd is meta on mac", sameChord(parseOk("ctrlcmd+s", "mac")[0], chord(false, false, false, true, "s")));
-check("ctrlcmd is ctrl on windows", sameChord(parseOk("ctrlcmd+s", "windows")[0], chord(true, false, false, false, "s")));
-check("ctrlcmd is ctrl on linux", sameChord(parseOk("ctrlcmd+s", "linux")[0], chord(true, false, false, false, "s")));
-
-// --- Key vocabulary ---------------------------------------------------------------
-
-check("a digit key parses", sameChord(parseOk("ctrl+0", "windows")[0], chord(true, false, false, false, "0")));
-check("a function key parses", sameChord(parseOk("f5", "windows")[0], chord(false, false, false, false, "f5")));
-check("a numpad key parses", sameChord(parseOk("ctrl+numpad0", "windows")[0], chord(true, false, false, false, "numpad0")));
-check("numpad_add parses", sameChord(parseOk("ctrl+numpad_add", "windows")[0], chord(true, false, false, false, "numpad_add")));
-check(
-  "numpad_subtract parses",
-  sameChord(parseOk("ctrl+numpad_subtract", "windows")[0], chord(true, false, false, false, "numpad_subtract")),
-);
-check("numpad_add parses under ctrlcmd on mac", sameChord(parseOk("ctrlcmd+numpad_add", "mac")[0], chord(false, false, false, true, "numpad_add")));
-check("a bare numpad+ glyph is not a key name", !parseKeybinding("ctrl+numpad+", "windows").ok);
-check("numpad_multiply stays outside the vocabulary", !parseKeybinding("ctrl+numpad_multiply", "windows").ok);
-check("a named key parses", sameChord(parseOk("ctrl+pagedown", "windows")[0], chord(true, false, false, false, "pagedown")));
-check("punctuation parses by glyph", sameChord(parseOk("ctrl+shift+=", "windows")[0], chord(true, true, false, false, "=")));
-check("backquote parses", sameChord(parseOk("ctrl+`", "windows")[0], chord(true, false, false, false, "`")));
-check("surrounding whitespace is insignificant", sameChord(parseOk("  ctrl+s  ", "windows")[0], chord(true, false, false, false, "s")));
-
-// --- Parse errors as values --------------------------------------------------------
-
-check("an empty string is a parse error", !parseKeybinding("", "windows").ok);
-check("a dangling modifier is a parse error", !parseKeybinding("ctrl+", "windows").ok);
-check("a bare modifier is a parse error", !parseKeybinding("ctrl", "windows").ok);
-check("an unknown modifier is a parse error", !parseKeybinding("hyper+s", "windows").ok);
-check("an unknown key is a parse error", !parseKeybinding("ctrl+banana", "windows").ok);
-check("a trailing plus is a parse error", !parseKeybinding("ctrl+s+", "windows").ok);
-check("a space inside a chord is a parse error", !parseKeybinding("ctrl + s", "windows").ok);
-{
-  const result = parseKeybinding("ctrl+banana", "windows");
-  check("a parse error reports a message and offset", !result.ok && typeof result.error.message === "string" && typeof result.error.offset === "number");
-}
-
-// --- KeyboardEvent mapping through event.code ----------------------------------------
-
-check("KeyS maps to s", sameChord(chordFromKeyboardEvent(keyEvent("KeyS", { ctrl: true })), chord(true, false, false, false, "s")));
-check(
-  "Equal with shift still reads as =",
-  sameChord(chordFromKeyboardEvent(keyEvent("Equal", { ctrl: true, shift: true })), chord(true, true, false, false, "=")),
-);
-check("Numpad0 is distinct from Digit0", sameChord(chordFromKeyboardEvent(keyEvent("Numpad0", { ctrl: true })), chord(true, false, false, false, "numpad0")));
-check("Digit0 maps to 0", sameChord(chordFromKeyboardEvent(keyEvent("Digit0", { ctrl: true })), chord(true, false, false, false, "0")));
-check(
-  "NumpadAdd maps to numpad_add, distinct from the shifted = key",
-  sameChord(chordFromKeyboardEvent(keyEvent("NumpadAdd", { ctrl: true })), chord(true, false, false, false, "numpad_add")),
-);
-check(
-  "NumpadSubtract maps to numpad_subtract, distinct from the - key",
-  sameChord(chordFromKeyboardEvent(keyEvent("NumpadSubtract", { ctrl: true })), chord(true, false, false, false, "numpad_subtract")),
-);
-check("NumpadMultiply is unmapped", chordFromKeyboardEvent(keyEvent("NumpadMultiply", { ctrl: true })) === undefined);
-check("ArrowDown maps to down", sameChord(chordFromKeyboardEvent(keyEvent("ArrowDown", { alt: true })), chord(false, false, true, false, "down")));
-check("a modifier-only event maps to undefined", chordFromKeyboardEvent(keyEvent("ControlLeft", { ctrl: true })) === undefined);
-check("an unmapped code maps to undefined", chordFromKeyboardEvent(keyEvent("AudioVolumeUp")) === undefined);
-
-// --- Labels ---------------------------------------------------------------------------
-
-check("a chord label renders Ctrl+M", formatChord(chord(true, false, false, false, "m"), "windows") === "Ctrl+M");
-check(
-  "a sequence label renders Ctrl+M Ctrl+O",
-  formatKeybinding([chord(true, false, false, false, "m"), chord(true, false, false, false, "o")], "windows") === "Ctrl+M Ctrl+O",
-);
-check("meta renders Cmd on mac", formatChord(chord(false, false, false, true, "s"), "mac") === "Cmd+S");
-check("meta does not render Cmd off mac", formatChord(chord(false, false, false, true, "s"), "windows") !== "Cmd+S");
-check("numpad0 labels as NumPad0", formatChord(chord(true, false, false, false, "numpad0"), "windows") === "Ctrl+NumPad0");
-check("numpad_add labels as NumPad_Add", formatChord(chord(true, false, false, false, "numpad_add"), "windows") === "Ctrl+NumPad_Add");
-check(
-  "numpad_subtract labels as NumPad_Subtract",
-  formatChord(chord(true, false, false, false, "numpad_subtract"), "windows") === "Ctrl+NumPad_Subtract",
-);
-check("pagedown labels as PageDown", formatChord(chord(true, false, false, false, "pagedown"), "windows") === "Ctrl+PageDown");
-check("punctuation labels as its glyph", formatChord(chord(true, true, false, false, "="), "windows") === "Ctrl+Shift+=");
-
-// --- The resolver ------------------------------------------------------------------------
-
-function rule(commandId, keys, options = {}) {
-  return {
-    commandId,
-    chords: keys,
-    when: options.when,
-    weight: options.weight ?? 0,
-    order: options.order ?? 0,
-  };
-}
-
-const ctrlM = [chord(true, false, false, false, "m")];
-const ctrlMO = [chord(true, false, false, false, "m"), chord(true, false, false, false, "o")];
-
-{
-  const resolver = new KeybindingResolver([]);
-  const outcome = resolver.resolve(new ContextKeyService(), ctrlM);
-  check("no rules is NoMatchingKb", outcome.kind === "NoMatchingKb");
-}
-{
-  const resolver = new KeybindingResolver([rule("editor.save", ctrlM)]);
-  const outcome = resolver.resolve(new ContextKeyService(), ctrlM);
-  check("an exact match is KbFound", outcome.kind === "KbFound" && outcome.commandId === "editor.save");
-}
-{
-  const resolver = new KeybindingResolver([rule("workbench.open", ctrlMO)]);
-  const first = resolver.resolve(new ContextKeyService(), ctrlM);
-  check("a prefix of a longer rule is MoreChordsNeeded", first.kind === "MoreChordsNeeded");
-  const second = resolver.resolve(new ContextKeyService(), ctrlMO);
-  check("the full chord sequence is KbFound", second.kind === "KbFound" && second.commandId === "workbench.open");
-}
-{
-  const resolver = new KeybindingResolver([rule("editor.save", ctrlM)]);
-  const outcome = resolver.resolve(new ContextKeyService(), [chord(true, false, false, false, "x")]);
-  check("an unrelated chord is NoMatchingKb", outcome.kind === "NoMatchingKb");
-}
-
-// when filtering against a live context service
-{
-  const context = new ContextKeyService();
-  const focus = context.createKey("editorTextFocus", false);
-  const resolver = new KeybindingResolver([rule("editor.save", ctrlM, { when: "editorTextFocus" })]);
-  check("a failing when hides the rule", resolver.resolve(context, ctrlM).kind === "NoMatchingKb");
-  focus.set(true);
-  const outcome = resolver.resolve(context, ctrlM);
-  check("a passing when finds the rule", outcome.kind === "KbFound" && outcome.commandId === "editor.save");
-  context.dispose();
-}
-{
-  // A failing when on the exact rule does not block a longer candidate.
-  const context = new ContextKeyService();
-  const resolver = new KeybindingResolver([
-    rule("short.cmd", ctrlM, { when: "false" }),
-    rule("long.cmd", ctrlMO),
-  ]);
-  check("a longer candidate survives a failed when", resolver.resolve(context, ctrlM).kind === "MoreChordsNeeded");
-  context.dispose();
-}
-
-// weights and registration order
-{
-  const low = rule("low.cmd", ctrlM, { weight: KeybindingWeight.EditorContrib, order: 0 });
-  const high = rule("high.cmd", ctrlM, { weight: KeybindingWeight.WorkbenchContrib, order: 1 });
-  const resolver = new KeybindingResolver([low, high]);
-  const outcome = resolver.resolve(new ContextKeyService(), ctrlM);
-  check("the higher weight wins", outcome.kind === "KbFound" && outcome.commandId === "high.cmd");
-}
-{
-  const first = rule("first.cmd", ctrlM, { weight: KeybindingWeight.WorkbenchContrib, order: 0 });
-  const second = rule("second.cmd", ctrlM, { weight: KeybindingWeight.WorkbenchContrib, order: 1 });
-  const resolver = new KeybindingResolver([first, second]);
-  const outcome = resolver.resolve(new ContextKeyService(), ctrlM);
-  check("last registered wins at equal weight", outcome.kind === "KbFound" && outcome.commandId === "second.cmd");
-}
-
-// hasRuleForChord
-{
-  const resolver = new KeybindingResolver([rule("gated.cmd", ctrlMO, { when: "false" })]);
-  check("hasRuleForChord ignores when", resolver.hasRuleForChord(chord(true, false, false, false, "m")) === true);
-  check("hasRuleForChord is false for an unbound chord", resolver.hasRuleForChord(chord(true, false, false, false, "x")) === false);
-}
-
-// --- The registry ---------------------------------------------------------------------------
-
-check("KeybindingWeight defines the VS Code tiers", KeybindingWeight.EditorCore === 0 && KeybindingWeight.EditorContrib === 100 && KeybindingWeight.WorkbenchContrib === 200 && KeybindingWeight.BuiltinExtension === 300 && KeybindingWeight.ExternalExtension === 400);
-
-{
-  const registry = createKeybindingsRegistry("windows");
-  const registration = registry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrlcmd+s" });
-  const resolver = registry.getResolver();
-  const outcome = resolver.resolve(new ContextKeyService(), [chord(true, false, false, false, "s")]);
-  check("a registered rule resolves", outcome.kind === "KbFound" && outcome.commandId === "editor.save");
-  registration.dispose();
-  const after = registry.getResolver().resolve(new ContextKeyService(), [chord(true, false, false, false, "s")]);
-  check("disposing the registration unbinds the rule", after.kind === "NoMatchingKb");
-}
-{
-  // The mac override replaces the default keybinding on mac only.
-  const macRegistry = createKeybindingsRegistry("mac");
-  macRegistry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrl+s", mac: "cmd+shift+s" });
-  const macOutcome = macRegistry.getResolver().resolve(new ContextKeyService(), [chord(false, true, false, true, "s")]);
-  check("the mac override binds on mac", macOutcome.kind === "KbFound" && macOutcome.commandId === "editor.save");
-  const macDefault = macRegistry.getResolver().resolve(new ContextKeyService(), [chord(true, false, false, false, "s")]);
-  check("the default keybinding is replaced on mac", macDefault.kind === "NoMatchingKb");
-  const winRegistry = createKeybindingsRegistry("windows");
-  winRegistry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrl+s", mac: "cmd+shift+s" });
-  const winOutcome = winRegistry.getResolver().resolve(new ContextKeyService(), [chord(true, false, false, false, "s")]);
-  check("the default keybinding binds off mac", winOutcome.kind === "KbFound" && winOutcome.commandId === "editor.save");
-}
-{
-  const linuxRegistry = createKeybindingsRegistry("linux");
-  linuxRegistry.registerKeybindingRule({ id: "workbench.open", keybinding: "ctrl+p", linux: "ctrl+alt+p" });
-  const outcome = linuxRegistry.getResolver().resolve(new ContextKeyService(), [chord(true, false, true, false, "p")]);
-  check("the linux override binds on linux", outcome.kind === "KbFound" && outcome.commandId === "workbench.open");
-}
-{
-  // ctrlcmd flows through the registry per platform.
-  const macRegistry = createKeybindingsRegistry("mac");
-  macRegistry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrlcmd+s" });
-  const outcome = macRegistry.getResolver().resolve(new ContextKeyService(), [chord(false, false, false, true, "s")]);
-  check("ctrlcmd binds meta on mac through the registry", outcome.kind === "KbFound");
-}
-{
-  const registry = createKeybindingsRegistry("windows");
-  registry.registerKeybindingRule({ id: "chrome.resetZoom", keybinding: "ctrl+numpad0" });
-  registry.registerKeybindingRule({ id: "chrome.resetZoom", keybinding: "ctrl+0" });
-  const label = registry.lookupKeybinding("chrome.resetZoom");
-  check("lookupKeybinding labels the first registered rule", label !== undefined && label.getLabel() === "Ctrl+NumPad0");
-  check("lookupKeybinding is undefined for an unknown command", registry.lookupKeybinding("nope") === undefined);
-}
-{
-  // A context lookup picks the first rule whose when passes, else the first registered.
-  const registry = createKeybindingsRegistry("windows");
-  registry.registerKeybindingRule({ id: "tab.close", keybinding: "ctrl+f4", when: "editorTextFocus" });
-  registry.registerKeybindingRule({ id: "tab.close", keybinding: "ctrl+w", when: "activeEditor == 'agent'" });
-  const values = new Map([["activeEditor", "agent"]]);
-  const label = (context) => registry.lookupKeybinding("tab.close", context)?.getLabel();
-  check("a context lookup labels the first rule its when passes", label((key) => values.get(key)) === "Ctrl+W");
-  values.set("activeEditor", "editor");
-  check("a context no rule passes falls back to the first registered rule", label((key) => values.get(key)) === "Ctrl+F4");
-  check("a lookup without context labels the first registered rule", label(undefined) === "Ctrl+F4");
-}
-{
-  const macRegistry = createKeybindingsRegistry("mac");
-  macRegistry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrlcmd+s" });
-  const label = macRegistry.lookupKeybinding("editor.save");
-  check("the label renders per platform", label !== undefined && label.getLabel() === "Cmd+S");
-}
-{
-  // Malformed strings are reported once at registration and never match.
-  const errors = [];
-  const originalError = console.error;
-  console.error = (message) => errors.push(String(message));
-  try {
-    const registry = createKeybindingsRegistry("windows");
-    registry.registerKeybindingRule({ id: "bad.chord", keybinding: "ctrl+banana" });
-    registry.registerKeybindingRule({ id: "bad.when", keybinding: "ctrl+s", when: "a &&" });
-    check("a malformed keybinding is reported at registration", errors.length === 2);
-    check("a malformed keybinding never resolves", registry.getResolver().resolve(new ContextKeyService(), ctrlM).kind === "NoMatchingKb");
-    check("a malformed rule has no label", registry.lookupKeybinding("bad.chord") === undefined);
-    check("a malformed when never resolves", registry.getResolver().resolve(new ContextKeyService(), [chord(true, false, false, false, "s")]).kind === "NoMatchingKb");
-  } finally {
-    console.error = originalError;
-  }
-}
-{
-  // A registered when gates resolution through the registry.
-  const context = new ContextKeyService();
-  const focus = context.createKey("editorTextFocus", false);
-  const registry = createKeybindingsRegistry("windows");
-  registry.registerKeybindingRule({ id: "editor.save", keybinding: "ctrl+s", when: "editorTextFocus" });
-  check("a failing when gates a registry rule", registry.getResolver().resolve(context, [chord(true, false, false, false, "s")]).kind === "NoMatchingKb");
-  focus.set(true);
-  check("a passing when releases a registry rule", registry.getResolver().resolve(context, [chord(true, false, false, false, "s")]).kind === "KbFound");
-  context.dispose();
-}
-{
-  // The module-level singleton shares the detect-platform behavior.
-  const registration = KeybindingsRegistry.registerKeybindingRule({ id: "test.singleton", keybinding: "f9" });
-  const outcome = KeybindingsRegistry.getResolver().resolve(new ContextKeyService(), [chord(false, false, false, false, "f9")]);
-  check("the KeybindingsRegistry singleton resolves rules", outcome.kind === "KbFound" && outcome.commandId === "test.singleton");
-  registration.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`keybindings: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("keybindings: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/lifecycle.mjs b/crates/workshop/platform/test/lifecycle.mjs
deleted file mode 100644
index e2273f185..000000000
--- a/crates/workshop/platform/test/lifecycle.mjs
+++ /dev/null
@@ -1,124 +0,0 @@
-// Unit test for the lifecycle primitives (lifecycle.ts) and the
-// event emitter (event.ts). Bundles each TS module with esbuild
-// and imports it via a data URL. Covers: _register ties children to the
-// parent and dispose cascades down the tree; DisposableStore disposes all
-// held items in insertion order, tolerates double-dispose, and disposes
-// late additions immediately;
-// Emitter delivers to subscribers, the returned disposable unsubscribes,
-// and nothing is delivered after the emitter is disposed.
-// Run: node test/lifecycle.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-async function loadModule(file) {
-  const bundle = await esbuild.build({
-    entryPoints: [path.join(platformDir, file)],
-    bundle: true,
-    write: false,
-    format: "esm",
-    platform: "browser",
-    target: "es2022",
-    logLevel: "silent",
-  });
-  const code = bundle.outputFiles[0].text;
-  return import(`data:text/javascript;base64,${Buffer.from(code).toString("base64")}`);
-}
-
-const { Disposable, DisposableStore } = await loadModule("lifecycle.ts");
-const { Emitter } = await loadModule("event.ts");
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// A leaf disposable that records how many times it was disposed.
-function leaf(onDispose) {
-  const item = {
-    disposeCount: 0,
-    dispose: () => {
-      item.disposeCount++;
-      onDispose?.();
-    },
-  };
-  return item;
-}
-
-// --- DisposableStore: dispose-all, double-dispose, late add ------------------
-
-{
-  const store = new DisposableStore();
-  const order = [];
-  const first = store.add(leaf(() => order.push("first")));
-  const second = store.add(leaf(() => order.push("second")));
-  check("add returns the item it was given", store.add(leaf()).disposeCount === 0);
-  store.dispose();
-  check("dispose releases every held item", first.disposeCount === 1 && second.disposeCount === 1);
-  check("items are disposed in insertion order", order.join(",") === "first,second");
-  store.dispose();
-  check("double-dispose does not re-dispose items", first.disposeCount === 1);
-  const late = store.add(leaf());
-  check("adding to a disposed store disposes immediately", late.disposeCount === 1);
-}
-
-// --- Disposable base: _register routing and cascade --------------------------
-
-{
-  class Child extends Disposable {
-    constructor() {
-      super();
-      this.item = this._register(leaf());
-    }
-  }
-  class Parent extends Disposable {
-    constructor() {
-      super();
-      this.child = this._register(new Child());
-      this.item = this._register(leaf());
-    }
-  }
-  const parent = new Parent();
-  check(
-    "_register returns the child it was given",
-    parent.item.disposeCount === 0 && parent.child instanceof Child,
-  );
-  parent.dispose();
-  check("dispose releases directly registered items", parent.item.disposeCount === 1);
-  check("dispose cascades to registered children", parent.child.item.disposeCount === 1);
-  parent.dispose();
-  check("double-dispose of a Disposable is harmless", parent.item.disposeCount === 1);
-}
-
-// --- Emitter: subscribe, fire, unsubscribe, dispose ---------------------------
-
-{
-  const emitter = new Emitter();
-  const seen = [];
-  const subscription = emitter.event((value) => seen.push(value));
-  emitter.fire("one");
-  check("a subscriber receives fired values", seen.join(",") === "one");
-  subscription.dispose();
-  emitter.fire("two");
-  check("an unsubscribed listener receives nothing", seen.join(",") === "one");
-
-  const kept = [];
-  emitter.event((value) => kept.push(value));
-  emitter.fire("three");
-  emitter.dispose();
-  emitter.fire("four");
-  check("nothing is delivered after the emitter is disposed", kept.join(",") === "three");
-  const lateSeen = [];
-  emitter.event((value) => lateSeen.push(value));
-  emitter.fire("five");
-  check("subscribing to a disposed emitter is a no-op", lateSeen.length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`lifecycle: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("lifecycle: all assertions passed");
diff --git a/crates/workshop/platform/test/quick-access.mjs b/crates/workshop/platform/test/quick-access.mjs
deleted file mode 100644
index ea8d57859..000000000
--- a/crates/workshop/platform/test/quick-access.mjs
+++ /dev/null
@@ -1,157 +0,0 @@
-// Unit test for the quick-access registry
-// (quick-access-registry.ts): longest-prefix routing of an
-// input value to its provider, upsert-by-prefix registration with
-// disposables that unregister only their own registration, and the
-// provider listing that feeds the ? help list. Bundles the module with
-// esbuild and drives it.
-// Run: node --test test/quick-access.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { QuickAccessRegistry, createQuickAccessRegistry } from "./quick-access-registry.ts";
-    `,
-    resolveDir: platformDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { QuickAccessRegistry, createQuickAccessRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function provider(prefix, options = {}) {
-  return {
-    prefix,
-    placeholder: options.placeholder ?? `placeholder for ${prefix}`,
-    helpEntries: options.helpEntries ?? [{ description: `help for ${prefix}`, prefix }],
-    factory: options.factory ?? (() => ({ tag: prefix })),
-  };
-}
-
-// --- Longest-prefix routing ---------------------------------------------------
-
-{
-  const registry = createQuickAccessRegistry();
-  check("an empty registry routes nothing", registry.getQuickAccessProvider("anything") === undefined);
-}
-{
-  const registry = createQuickAccessRegistry();
-  registry.registerQuickAccessProvider(provider(""));
-  registry.registerQuickAccessProvider(provider(">"));
-  registry.registerQuickAccessProvider(provider(":"));
-  check("the empty prefix is the default route", registry.getQuickAccessProvider("file.ts")?.prefix === "");
-  check("a bare input routes to the default provider", registry.getQuickAccessProvider("")?.prefix === "");
-  check("a prefix routes to its provider", registry.getQuickAccessProvider(">save")?.prefix === ">");
-  check("another prefix routes to its provider", registry.getQuickAccessProvider(":42")?.prefix === ":");
-  check("the bare prefix still routes", registry.getQuickAccessProvider(">")?.prefix === ">");
-}
-{
-  // Longest matching prefix wins over shorter ones that also match.
-  const registry = createQuickAccessRegistry();
-  registry.registerQuickAccessProvider(provider(""));
-  registry.registerQuickAccessProvider(provider("debug"));
-  registry.registerQuickAccessProvider(provider("debug "));
-  check("the longest matching prefix wins", registry.getQuickAccessProvider("debug launch")?.prefix === "debug ");
-  check("a shorter match serves its own values", registry.getQuickAccessProvider("debugger")?.prefix === "debug");
-}
-{
-  // Registration order does not decide the route; prefix length does.
-  const registry = createQuickAccessRegistry();
-  registry.registerQuickAccessProvider(provider("debug "));
-  registry.registerQuickAccessProvider(provider(""));
-  registry.registerQuickAccessProvider(provider("debug"));
-  check("length beats registration order", registry.getQuickAccessProvider("debug x")?.prefix === "debug ");
-}
-{
-  // Without an empty-prefix provider, unrouted values get nothing.
-  const registry = createQuickAccessRegistry();
-  registry.registerQuickAccessProvider(provider(">"));
-  check("no default provider means no route", registry.getQuickAccessProvider("file.ts") === undefined);
-}
-
-// --- Upsert by prefix -----------------------------------------------------------
-
-{
-  const registry = createQuickAccessRegistry();
-  const first = registry.registerQuickAccessProvider(provider(">", { placeholder: "first" }));
-  registry.registerQuickAccessProvider(provider(">", { placeholder: "second" }));
-  check("a second registration replaces the first", registry.getQuickAccessProvider(">x")?.placeholder === "second");
-  first.dispose();
-  check("disposing the replaced registration keeps the replacement", registry.getQuickAccessProvider(">x")?.placeholder === "second");
-}
-
-// --- Disposal -------------------------------------------------------------------
-
-{
-  const registry = createQuickAccessRegistry();
-  const registration = registry.registerQuickAccessProvider(provider("%"));
-  check("a registered provider routes", registry.getQuickAccessProvider("%x")?.prefix === "%");
-  registration.dispose();
-  check("disposing unregisters the provider", registry.getQuickAccessProvider("%x") === undefined);
-  registration.dispose();
-  check("double disposal is harmless", registry.getQuickAccessProvider("%x") === undefined);
-}
-{
-  // Disposing one provider leaves the others routing.
-  const registry = createQuickAccessRegistry();
-  const files = registry.registerQuickAccessProvider(provider(""));
-  registry.registerQuickAccessProvider(provider(">"));
-  files.dispose();
-  check("disposing the default leaves prefixed routes", registry.getQuickAccessProvider(">x")?.prefix === ">");
-  check("disposing the default removes the default route", registry.getQuickAccessProvider("x") === undefined);
-}
-
-// --- The ? help list ---------------------------------------------------------------
-
-{
-  const registry = createQuickAccessRegistry();
-  registry.registerQuickAccessProvider(provider("", { helpEntries: [{ description: "Go to File", prefix: "" }] }));
-  registry.registerQuickAccessProvider(provider(">", { helpEntries: [{ description: "Show and Run Commands", prefix: ">" }] }));
-  registry.registerQuickAccessProvider(provider("?", { helpEntries: [{ description: "Show Help", prefix: "?" }] }));
-  const providers = registry.getQuickAccessProviders();
-  check("the listing includes every provider", providers.length === 3);
-  check(
-    "the listing includes help entries",
-    providers.some((entry) => entry.helpEntries.some((help) => help.description === "Show and Run Commands" && help.prefix === ">")),
-  );
-  check(
-    "the listing includes placeholders",
-    providers.every((entry) => typeof entry.placeholder === "string" && entry.placeholder.length > 0),
-  );
-  const stale = registry.registerQuickAccessProvider(provider("@"));
-  stale.dispose();
-  check("the listing drops disposed providers", registry.getQuickAccessProviders().length === 3);
-}
-
-// --- The module-level singleton -----------------------------------------------------
-
-{
-  const registration = QuickAccessRegistry.registerQuickAccessProvider(provider("test-singleton:"));
-  check("the QuickAccessRegistry singleton routes", QuickAccessRegistry.getQuickAccessProvider("test-singleton:x")?.prefix === "test-singleton:");
-  registration.dispose();
-  check("the singleton unregisters on dispose", QuickAccessRegistry.getQuickAccessProvider("test-singleton:x") === undefined);
-}
-
-if (failures.length > 0) {
-  console.error(`quick-access: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("quick-access: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/reconnect-backoff.mjs b/crates/workshop/platform/test/reconnect-backoff.mjs
deleted file mode 100644
index aaa48dcb2..000000000
--- a/crates/workshop/platform/test/reconnect-backoff.mjs
+++ /dev/null
@@ -1,165 +0,0 @@
-// Unit test for the shared reconnect backoff (reconnect-backoff.ts,
-// consumed by the Workshop UI's workshop and agent sockets): exponential growth,
-// the cap, the reset that a successful open triggers, and the equal jitter
-// bounds. Bundles the module with esbuild and drives it against scripted fake
-// timers and an injected random source, so the growth, cap, reset, and jitter
-// are pinned deterministically without waiting on a real clock: the delay
-// argument each schedule hands to setTimeout is captured, and the queued
-// callback is fired by hand.
-// Run: node --test test/reconnect-backoff.mjs (from crates/workshop/platform).
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(platformDir, "reconnect-backoff.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-reconnect-backoff-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { ReconnectBackoff } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Scripted timers: capture the delay and callback without waiting, so the
-// growth, cap, and reset are asserted on the exact delay values the module
-// hands to setTimeout.
-const pending = [];
-let nextId = 1;
-globalThis.setTimeout = (fn, delay) => {
-  const id = nextId++;
-  pending.push({ id, fn, delay, cleared: false, fired: false });
-  return id;
-};
-globalThis.clearTimeout = (id) => {
-  const timer = pending.find((entry) => entry.id === id);
-  if (timer !== undefined) timer.cleared = true;
-};
-
-/** The delay of the most recently scheduled, still-pending attempt. */
-function lastDelay() {
-  const live = pending.filter((entry) => !entry.cleared && !entry.fired);
-  return live.length === 0 ? undefined : live[live.length - 1].delay;
-}
-
-/** Fires the oldest pending attempt, as the real timer would. */
-function fireNext() {
-  const timer = pending.find((entry) => !entry.cleared && !entry.fired);
-  if (timer === undefined) throw new Error("no pending timer to fire");
-  timer.fired = true;
-  timer.fn();
-}
-
-// --- Growth, the cap, and the reset at the jitter's lower bound -------------
-
-// Equal jitter waits half the computed delay plus a random share of the other
-// half. A source of 0 pins the lower bound: exactly half of a computed delay
-// that still doubles to the cap and resets to the initial delay.
-{
-  const backoff = new ReconnectBackoff({ initialMs: 1000, maxMs: 3000, random: () => 0 });
-  let retries = 0;
-  const retry = () => {
-    retries += 1;
-  };
-
-  backoff.schedule(retry);
-  check("the first retry waits half the initial delay at the lower bound", lastDelay() === 500);
-  backoff.schedule(retry);
-  check(
-    "a second schedule while one is waiting stacks nothing",
-    pending.filter((entry) => !entry.cleared && !entry.fired).length === 1,
-  );
-
-  fireNext();
-  check("the first attempt's retry fires", retries === 1);
-  backoff.schedule(retry);
-  check("the computed delay doubles after a failed attempt", lastDelay() === 1000);
-
-  fireNext();
-  backoff.schedule(retry);
-  check(
-    "the computed delay caps at the maximum instead of doubling past it",
-    lastDelay() === 1500,
-  );
-
-  fireNext();
-  backoff.schedule(retry);
-  check("the computed delay stays capped at the maximum", lastDelay() === 1500);
-
-  fireNext();
-  backoff.reset();
-  backoff.schedule(retry);
-  check("reset restores the initial computed delay", lastDelay() === 500);
-  fireNext();
-}
-
-// --- The jitter's upper bound -----------------------------------------------
-
-// A source just under 1 waits just under the full computed delay, so the
-// jitter never pushes a wait past the computed delay or the cap.
-{
-  const justUnderOne = 0.999;
-  const backoff = new ReconnectBackoff({
-    initialMs: 1000,
-    maxMs: 3000,
-    random: () => justUnderOne,
-  });
-  const justUnder = (delay, full) => delay > full * justUnderOne && delay < full;
-
-  for (const [attempt, full] of [1000, 2000, 3000, 3000].entries()) {
-    backoff.schedule(() => {});
-    check(
-      `attempt ${attempt + 1} waits just under its full ${full}ms delay at the upper bound`,
-      justUnder(lastDelay(), full),
-    );
-    fireNext();
-  }
-
-  backoff.reset();
-  backoff.schedule(() => {});
-  check(
-    "reset restores just under the full initial delay at the upper bound",
-    justUnder(lastDelay(), 1000),
-  );
-  fireNext();
-}
-
-// --- The defaults -----------------------------------------------------------
-
-{
-  const realRandom = Math.random;
-  Math.random = () => 0.5;
-  const backoff = new ReconnectBackoff();
-  backoff.schedule(() => {});
-  Math.random = realRandom;
-  check(
-    "the default jitter source is Math.random over a one-second initial delay",
-    lastDelay() === 750,
-  );
-  backoff.cancel();
-  check(
-    "cancel clears the pending timer",
-    pending.filter((entry) => !entry.cleared && !entry.fired).length === 0,
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`reconnect-backoff: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("reconnect-backoff: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/service-registry.mjs b/crates/workshop/platform/test/service-registry.mjs
deleted file mode 100644
index 70501e13e..000000000
--- a/crates/workshop/platform/test/service-registry.mjs
+++ /dev/null
@@ -1,96 +0,0 @@
-// Unit test for the service registry (service-registry.ts):
-// the token-keyed registry every subsystem self-registers into. Bundles
-// the module with esbuild and drives the public API. Covers: lookup of an
-// unregistered token (null from getServiceOrNull, a naming throw from
-// getService), lazy instantiation on first get with caching afterwards,
-// replacement semantics when a token is re-registered (the stale cached
-// instance is dropped), unregistering through the registration's
-// disposable, and independence between tokens.
-// Run: node test/service-registry.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(platformDir, "service-registry.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { createServiceToken, registerService, getService, getServiceOrNull } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Unregistered tokens ----------------------------------------------------
-
-const MISSING = createServiceToken("test.missing");
-check("getServiceOrNull answers null for an unregistered token", getServiceOrNull(MISSING) === null);
-let threw = null;
-try {
-  getService(MISSING);
-} catch (error) {
-  threw = error;
-}
-check(
-  "getService throws and names the token for an unregistered token",
-  threw !== null && threw.message.includes("test.missing"),
-);
-
-// --- Lazy instantiation and caching ------------------------------------------
-
-const CACHED = createServiceToken("test.cached");
-let builds = 0;
-registerService(CACHED, () => {
-  builds += 1;
-  return { serial: builds };
-});
-check("the factory does not run at registration time", builds === 0);
-const first = getService(CACHED);
-check("the first get instantiates through the factory", builds === 1 && first.serial === 1);
-check("the instance is cached across gets", getService(CACHED) === first && builds === 1);
-
-// --- Replacement drops the stale cached instance ------------------------------
-
-registerService(CACHED, () => {
-  builds += 1;
-  return { serial: builds };
-});
-const replaced = getService(CACHED);
-check(
-  "re-registering replaces the factory and drops the cached instance",
-  replaced !== first && replaced.serial === 2 && builds === 2,
-);
-
-// --- The registration disposable unregisters ---------------------------------
-
-const REMOVABLE = createServiceToken("test.removable");
-const registration = registerService(REMOVABLE, () => ({}));
-check("a registered token resolves", getServiceOrNull(REMOVABLE) !== null);
-registration.dispose();
-check("disposing the registration unregisters the token", getServiceOrNull(REMOVABLE) === null);
-
-// --- Tokens are independent ----------------------------------------------------
-
-const A = createServiceToken("test.a");
-const B = createServiceToken("test.b");
-registerService(A, () => "a");
-registerService(B, () => "b");
-check("tokens resolve their own instances", getService(A) === "a" && getService(B) === "b");
-
-if (failures.length > 0) {
-  console.error(`service-registry: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("service-registry: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/test/workshop-part.mjs b/crates/workshop/platform/test/workshop-part.mjs
deleted file mode 100644
index bd0a95fec..000000000
--- a/crates/workshop/platform/test/workshop-part.mjs
+++ /dev/null
@@ -1,83 +0,0 @@
-// Unit test for the WorkshopPart base class (workshop-part.ts):
-// the Part/Composite hierarchy root every dockview panel extends. Bundles
-// the module with esbuild and drives a concrete subclass against jsdom.
-// Covers: the element exists before init, init runs create() exactly once
-// with the element as the parent (a second init does not rebuild),
-// layout() accepts a dimension, and dispose() releases children registered
-// through the inherited _register.
-// Run: node test/workshop-part.mjs (from crates/workshop/platform).
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const platformDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.HTMLElement = dom.window.HTMLElement;
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(platformDir, "workshop-part.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { WorkshopPart } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-class TestPart extends WorkshopPart {
-  createCount = 0;
-  create(parent) {
-    this.createCount += 1;
-    this.createParent = parent;
-    const child = document.createElement("span");
-    child.className = "test-part-child";
-    parent.appendChild(child);
-  }
-}
-
-const part = new TestPart();
-check("the element exists before init", part.element instanceof HTMLElement);
-check("create has not run before init", part.createCount === 0);
-
-const params = { params: {}, api: {} };
-part.init(params);
-check("init runs create once", part.createCount === 1);
-check("create receives the part's own element as the parent", part.createParent === part.element);
-check("create built the part's content into the element", !!part.element.querySelector(".test-part-child"));
-part.init(params);
-check("a second init does not rebuild the content", part.createCount === 1);
-
-// layout() takes a dimension and is a no-op by default.
-let layoutThrew = false;
-try {
-  part.layout({ width: 800, height: 600 });
-} catch {
-  layoutThrew = true;
-}
-check("layout accepts a dimension", !layoutThrew);
-
-// dispose() releases children registered through the inherited _register.
-let childDisposed = false;
-part._register({ dispose: () => (childDisposed = true) });
-part.dispose();
-check("dispose releases registered children", childDisposed);
-
-if (failures.length > 0) {
-  console.error(`workshop-part: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-part: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/platform/text-control-service.ts b/crates/workshop/platform/text-control-service.ts
deleted file mode 100644
index ef77c5da5..000000000
--- a/crates/workshop/platform/text-control-service.ts
+++ /dev/null
@@ -1,239 +0,0 @@
-// The text-control service: one undo/redo/select-all surface over every
-// text-editing widget. Each widget registers an adapter rooted at its DOM
-// subtree (the CodeMirror editor surface, the agent's ProseMirror prompt,
-// future Run-panel boxes); the service tracks which root contains focus
-// and routes the edit commands to that adapter. When no adapter claims
-// focus - a native input, textarea, or contentEditable - the commands
-// fall back to document.execCommand on the last focused editable, which
-// preserves the native undo stack.
-//
-// The service owns the document focus tracker and binds the inputFocus,
-// editorTextFocus, and textInputFocus context keys, so menus and
-// keybindings see focus state from first paint: main.ts resolves the
-// TEXT_CONTROL_SERVICE token at boot. The tracker also remembers the
-// last editable target, because clicking a menu row moves focus to the
-// menu before the command runs.
-//
-// DOM-aware but app-free: imports only this package's own files.
-
-import { toDisposable } from "./lifecycle";
-import type { IDisposable } from "./lifecycle";
-import { CONTEXT_KEY_SERVICE } from "./context-key-service";
-import type { ContextKey, ContextKeyService } from "./context-key-service";
-import { createServiceToken, getService, registerService } from "./service-registry";
-
-/**
- * A text-editing widget's edit surface. `kind` names the widget family
- * ("codemirror", "prosemirror"); editorTextFocus follows the codemirror
- * kind. canUndo/canRedo report history depth so a command on an empty
- * stack falls back to execCommand instead of no-op-ing.
- */
-export interface TextControl {
-  readonly kind: string;
-  undo(): void;
-  redo(): void;
-  selectAll(): void;
-  canUndo?(): boolean;
-  canRedo?(): boolean;
-}
-
-/** The native text inputs and textareas: what inputFocus means. */
-function isTextInput(element: Element | null): element is HTMLElement {
-  // The constructor globals are probed: a partial-DOM environment (a jsdom test
-  // shimming only the keys it needs) may lack them.
-  if (typeof HTMLElement === "undefined" || !(element instanceof HTMLElement)) {
-    return false;
-  }
-  if (typeof HTMLTextAreaElement !== "undefined" && element instanceof HTMLTextAreaElement) {
-    return !element.disabled && !element.readOnly;
-  }
-  if (typeof HTMLInputElement !== "undefined" && element instanceof HTMLInputElement) {
-    const textLike = ["text", "search", "url", "tel", "email", "password"];
-    return !element.disabled && !element.readOnly && textLike.includes(element.type);
-  }
-  return false;
-}
-
-/**
- * Whether the element edits natively, jsdom-compatible: jsdom leaves
- * isContentEditable undefined, so the state comes from the nearest
- * contenteditable ancestor's attribute. An invalid value reads as true
- * rather than the spec's "inherit" - a deliberate simplification.
- */
-function isContentEditable(element: HTMLElement): boolean {
-  const editable = element.closest("[contenteditable]");
-  if (editable === null) {
-    return false;
-  }
-  return editable.getAttribute("contenteditable")?.toLowerCase() !== "false";
-}
-
-/** Anything the execCommand fallback can act on natively. */
-function isEditable(element: Element | null): element is HTMLElement {
-  if (isTextInput(element)) {
-    return true;
-  }
-  return (
-    typeof HTMLElement !== "undefined" && element instanceof HTMLElement && isContentEditable(element)
-  );
-}
-
-/** The page's document, or null where none exists (a DOM-free environment). */
-function defaultDocument(): Document | null {
-  return typeof globalThis.document === "undefined" ? null : globalThis.document;
-}
-
-/**
- * The registry of text-control adapters and the owner of the focus
- * context keys. Constructed with the context-key service and the document
- * to track; the default factory resolves both from the service registry
- * and the page globals.
- */
-export class TextControlService implements IDisposable {
-  private readonly controls = new Map<HTMLElement, TextControl>();
-  private readonly inputFocusKey: ContextKey<boolean>;
-  private readonly editorTextFocusKey: ContextKey<boolean>;
-  private readonly textInputFocusKey: ContextKey<boolean>;
-  private readonly doc: Document | null;
-  private editTarget: HTMLElement | null = null;
-
-  constructor(contextKeys: ContextKeyService, doc: Document | null = defaultDocument()) {
-    this.doc = doc;
-    this.inputFocusKey = contextKeys.createKey("inputFocus", false);
-    this.editorTextFocusKey = contextKeys.createKey("editorTextFocus", false);
-    this.textInputFocusKey = contextKeys.createKey("textInputFocus", false);
-    doc?.addEventListener("focusin", this.onFocusIn);
-    doc?.addEventListener("focusout", this.onFocusOut);
-  }
-
-  /** The adapter whose root contains focus, or null. */
-  get active(): TextControl | null {
-    return this.controlFor(this.doc?.activeElement ?? null);
-  }
-
-  /**
-   * Registers `control` as the edit surface for `root`'s subtree.
-   * Re-registering the same root replaces the adapter; the returned
-   * disposable unregisters only its own registration.
-   */
-  register(root: HTMLElement, control: TextControl): IDisposable {
-    this.controls.set(root, control);
-    this.recompute();
-    return toDisposable(() => {
-      if (this.controls.get(root) === control) {
-        this.controls.delete(root);
-        this.recompute();
-      }
-    });
-  }
-
-  /** Undo on the active adapter, or the native fallback. */
-  undo(): void {
-    const active = this.active;
-    if (active !== null && (active.canUndo === undefined || active.canUndo())) {
-      active.undo();
-      return;
-    }
-    this.runFallback("undo");
-  }
-
-  /** Redo on the active adapter, or the native fallback. */
-  redo(): void {
-    const active = this.active;
-    if (active !== null && (active.canRedo === undefined || active.canRedo())) {
-      active.redo();
-      return;
-    }
-    this.runFallback("redo");
-  }
-
-  /** Select-all on the active adapter, or the native fallback. */
-  selectAll(): void {
-    const active = this.active;
-    if (active !== null) {
-      active.selectAll();
-      return;
-    }
-    this.runFallback("selectAll");
-  }
-
-  /**
-   * Cut/copy/paste: always the native path, on the remembered editable.
-   * CodeMirror and ProseMirror serve the command through the clipboard
-   * events the execCommand fires; native editables keep their own
-   * semantics.
-   */
-  execCommand(command: "cut" | "copy" | "paste"): void {
-    this.runFallback(command);
-  }
-
-  private readonly onFocusIn = (event: FocusEvent): void => {
-    const target = event.target instanceof Element ? event.target : null;
-    if (isEditable(target)) {
-      this.editTarget = target;
-    }
-    this.recompute();
-  };
-
-  private readonly onFocusOut = (event: FocusEvent): void => {
-    // Focus moving to another element recomputes on that element's
-    // focusin; focus leaving the page (no related target) clears here.
-    if (event.relatedTarget === null) {
-      this.recompute(null);
-    }
-  };
-
-  /** The adapter whose root contains `element`, or null. */
-  private controlFor(element: Element | null): TextControl | null {
-    if (element === null) {
-      return null;
-    }
-    for (const [root, control] of this.controls) {
-      if (root.contains(element)) {
-        return control;
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Re-evaluates the three focus keys against `element` - the document's
-   * active element by default, null when focus left the page.
-   */
-  private recompute(element: Element | null = this.doc?.activeElement ?? null): void {
-    const active = this.controlFor(element);
-    this.editorTextFocusKey.set(active !== null && active.kind === "codemirror");
-    this.inputFocusKey.set(isTextInput(element));
-    this.textInputFocusKey.set(active !== null || isEditable(element));
-  }
-
-  /**
-   * The native path: refocus the last editable element (a menu click has
-   * moved focus since) and execCommand, which preserves the editable's
-   * native undo stack. A disconnected or absent target no-ops, as does a
-   * document without execCommand (jsdom).
-   */
-  private runFallback(command: string): void {
-    const target = this.editTarget;
-    if (target === null || !target.isConnected) {
-      return;
-    }
-    target.focus();
-    if (this.doc !== null && typeof this.doc.execCommand === "function") {
-      this.doc.execCommand(command);
-    }
-  }
-
-  dispose(): void {
-    this.doc?.removeEventListener("focusin", this.onFocusIn);
-    this.doc?.removeEventListener("focusout", this.onFocusOut);
-  }
-}
-
-/** The registry token for the text-control singleton. */
-export const TEXT_CONTROL_SERVICE = createServiceToken<TextControlService>("workshop.textControl");
-
-// Self-registration: the default instance is shared by every consumer in
-// the process. main.ts resolves the token at boot so the focus keys exist
-// from first paint.
-registerService(TEXT_CONTROL_SERVICE, () => new TextControlService(getService(CONTEXT_KEY_SERVICE)));
diff --git a/crates/workshop/platform/tsconfig.json b/crates/workshop/platform/tsconfig.json
deleted file mode 100644
index 522d4a93f..000000000
--- a/crates/workshop/platform/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "noEmit": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "verbatimModuleSyntax": true,
-    "noFallthroughCasesInSwitch": true,
-    "forceConsistentCasingInFileNames": true
-  },
-  "include": ["*.ts"]
-}
diff --git a/crates/workshop/platform/workshop-part.ts b/crates/workshop/platform/workshop-part.ts
deleted file mode 100644
index ff601d3ed..000000000
--- a/crates/workshop/platform/workshop-part.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-// The WorkshopPart base class: the root of the workbench's Part
-// hierarchy (the VS Code Part/Composite pattern). Every dockview panel
-// extends it. The base owns the panel's root element, keeps the panel api
-// dockview hands each init, runs the subclass's create() exactly once on
-// the first init - dockview calls init when the panel mounts, and a
-// restored or re-added panel must never rebuild its DOM - and provides the
-// layout() hook panels override when they care about their dimensions and
-// the confirmClose() veto the close commands await, beside the isDirty()
-// query the close path re-checks. Disposal comes from
-// Disposable: every child a panel registers through _register tears down
-// with one dispose() from the dock.
-//
-// Generic panel infrastructure: imports only this package's own files and
-// type-only `dockview`.
-
-import type { DockviewPanelApi, GroupPanelPartInitParameters, IContentRenderer } from "dockview";
-
-import { Disposable } from "./lifecycle";
-
-/** A width/height pair, as the dock reports it to resizable parts. */
-export interface IDimension {
-  readonly width: number;
-  readonly height: number;
-}
-
-export abstract class WorkshopPart extends Disposable implements IContentRenderer {
-  readonly element: HTMLElement = document.createElement("div");
-  /** The dock's handle on this panel, from the latest init; null before the first. */
-  protected panelApi: DockviewPanelApi | null = null;
-  private created = false;
-
-  /**
-   * Dockview's mount seam: stores the panel api, then builds the part's
-   * content into its element on the first call. Later calls (a panel
-   * re-added after a layout restore) leave the built DOM alone.
-   */
-  init(parameters: GroupPanelPartInitParameters): void {
-    this.panelApi = parameters.api;
-    if (this.created) {
-      return;
-    }
-    this.created = true;
-    this.create(this.element);
-  }
-
-  /** Builds the part's content under `parent`. Called once, by init. */
-  protected abstract create(parent: HTMLElement): void;
-
-  /**
-   * Whether the part may close; the close commands await the answer before
-   * closing its panel. Resolves true. A part holding unsaved work
-   * overrides it to ask first.
-   */
-  confirmClose(): Promise<boolean> {
-    return Promise.resolve(true);
-  }
-
-  /** Whether the part holds unsaved changes; the close path re-checks it. */
-  isDirty(): boolean {
-    return false;
-  }
-
-  /**
-   * Reacts to a resize. A no-op for parts that lay themselves out. The
-   * dual signature serves both contracts: dockview calls parts with
-   * (width, height); workshop code passes an IDimension, matching the
-   * VS Code Part hierarchy this class models.
-   */
-  layout(dimension: IDimension): void;
-  layout(width: number, height: number): void;
-  layout(..._args: [IDimension] | [number, number]): void {}
-}
diff --git a/crates/workshop/plugin-bashkit/Cargo.toml b/crates/workshop/plugin-bashkit/Cargo.toml
deleted file mode 100644
index eade1e49f..000000000
--- a/crates/workshop/plugin-bashkit/Cargo.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-[package]
-name = "workshop-plugin-bashkit"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-# A dynamic library, which is the file Workshop's Plugin directory holds,
-# and an rlib, so the server can depend on this crate and have Cargo
-# build the library with every build of Workshop. The library is named
-# for the Plugin, so the file is `plugin_bashkit.dll`,
-# `libplugin_bashkit.so`, or `libplugin_bashkit.dylib`.
-[lib]
-name = "plugin_bashkit"
-crate-type = ["cdylib", "rlib"]
-
-[dependencies]
-# The bashkit Plugin, linked in with its own export off.
-bashkit-plugin.workspace = true
-# `export_plugin!`, which exports the Plugin's entry point from this
-# library.
-runvil-plugin-sdk.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/plugin-bashkit/src/lib.rs b/crates/workshop/plugin-bashkit/src/lib.rs
deleted file mode 100644
index 560650501..000000000
--- a/crates/workshop/plugin-bashkit/src/lib.rs
+++ /dev/null
@@ -1,30 +0,0 @@
-//! `workshop-plugin-bashkit` - the bashkit Plugin as the dynamic library
-//! Workshop ships in its Plugin directory: `plugin_bashkit.dll` on
-//! Windows, `libplugin_bashkit.so` on Linux, and
-//! `libplugin_bashkit.dylib` on macOS. The Plugin inserts the Pack
-//! `runvil/bash`, whose one tool runs a command in a bash shell inside
-//! the run.
-//!
-//! The Plugin's code lives in its own repository,
-//! `cppalliance/runvil-plugin-bashkit`, which the root `Cargo.toml` pins
-//! by commit. Cargo gives a git dependency's own library a file name with
-//! a hash in it, which no test and no installer could find, so this crate
-//! links the Plugin in and exports its entry point under a file name the
-//! workspace fixes. Cargo writes that file to `deps` in the profile's
-//! directory whenever it builds the server, and `cargo workshop` copies
-//! it from there into the Plugin directory.
-//!
-//! ## Invariants
-//!
-//! - Tier: library Plugin; may depend on no `workshop-*` crate, and only
-//!   the server may name it. `cargo test -p build-xtask` enforces the
-//!   tiers.
-//! - Holds no code of its own beyond the export of `runvil_plugin`.
-//! - The server depends on this crate only so that Cargo builds the
-//!   library. No Workshop crate links it in or calls it: Workshop reaches
-//!   the Plugin through the library alone.
-//! - Names the Plugin SDK at the commit the pinned bashkit Plugin was
-//!   built against. Cargo links one copy of the contract into a build, so
-//!   a pin that disagrees fails to resolve.
-
-runvil_plugin_sdk::export_plugin!(bashkit_plugin::Bashkit);
diff --git a/crates/workshop/plugin-std/Cargo.toml b/crates/workshop/plugin-std/Cargo.toml
deleted file mode 100644
index ad545d563..000000000
--- a/crates/workshop/plugin-std/Cargo.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-[package]
-name = "workshop-plugin-std"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-# A dynamic library, which is the file Workshop's Plugin directory holds,
-# and an rlib, so the server can depend on this crate and have Cargo
-# build the library with every build of Workshop. The library is named
-# for the Plugin, so the file is `plugin_std.dll`, `libplugin_std.so`, or
-# `libplugin_std.dylib`.
-[lib]
-name = "plugin_std"
-crate-type = ["cdylib", "rlib"]
-
-[dependencies]
-# The std Plugin, linked in with its own export off.
-std-plugin.workspace = true
-# `export_plugin!`, which exports the Plugin's entry point from this
-# library.
-runvil-plugin-sdk.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/plugin-std/src/lib.rs b/crates/workshop/plugin-std/src/lib.rs
deleted file mode 100644
index a89d2da65..000000000
--- a/crates/workshop/plugin-std/src/lib.rs
+++ /dev/null
@@ -1,27 +0,0 @@
-//! `workshop-plugin-std` - the std Plugin as the dynamic library Workshop
-//! ships in its Plugin directory: `plugin_std.dll` on Windows,
-//! `libplugin_std.so` on Linux, and `libplugin_std.dylib` on macOS.
-//!
-//! The Plugin's code lives in its own repository,
-//! `cppalliance/runvil-plugin-std`, which the root `Cargo.toml` pins by
-//! commit. Cargo gives a git dependency's own library a file name with a
-//! hash in it, which no test and no installer could find, so this crate
-//! links the Plugin in and exports its entry point under a file name the
-//! workspace fixes. Cargo writes that file to `deps` in the profile's
-//! directory whenever it builds the server, and `cargo workshop` copies
-//! it from there into the Plugin directory.
-//!
-//! ## Invariants
-//!
-//! - Tier: library Plugin; may depend on no `workshop-*` crate, and only
-//!   the server may name it. `cargo test -p build-xtask` enforces the
-//!   tiers.
-//! - Holds no code of its own beyond the export of `runvil_plugin`.
-//! - The server depends on this crate only so that Cargo builds the
-//!   library. No Workshop crate links it in or calls it: Workshop reaches
-//!   the Plugin through the library alone.
-//! - Names the Plugin SDK at the commit the pinned std Plugin was built
-//!   against. Cargo links one copy of the contract into a build, so a pin
-//!   that disagrees fails to resolve.
-
-runvil_plugin_sdk::export_plugin!(std_plugin::Std);
diff --git a/crates/workshop/protocol/Cargo.toml b/crates/workshop/protocol/Cargo.toml
deleted file mode 100644
index 87116baa4..000000000
--- a/crates/workshop/protocol/Cargo.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-[package]
-name = "workshop-protocol"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-serde.workspace = true
-serde_json.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/protocol/src/catalog.rs b/crates/workshop/protocol/src/catalog.rs
deleted file mode 100644
index 64cbe2334..000000000
--- a/crates/workshop/protocol/src/catalog.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-//! Catalog frames: the `{"type":"models",...}` pushes.
-
-use serde::Serialize;
-
-/// One pushed model catalog.
-#[derive(Debug, Clone, PartialEq)]
-pub struct CatalogPush {
-    /// The chat-capable subset of the gateway's model array.
-    pub models: Vec<serde_json::Value>,
-}
-
-impl CatalogPush {
-    /// The push as a wire frame: `"type": "models"` beside the array.
-    #[must_use]
-    pub fn frame(&self) -> CatalogFrame<'_> {
-        CatalogFrame {
-            kind: "models",
-            models: &self.models,
-        }
-    }
-}
-
-/// The serialized shape of a catalog push on the socket, matching the
-/// workshop protocol's frame taxonomy.
-///
-/// Delivery: ephemeral - the newest push holds the whole catalog and
-/// supersedes every older one; the catalog is resent on reconnect.
-#[derive(Debug, Serialize)]
-pub struct CatalogFrame<'a> {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    models: &'a [serde_json::Value],
-}
-
-/// Whether one gateway catalog row can back a chat model binding.
-///
-/// This is wire semantics - it interprets the gateway's catalog shape -
-/// so it sits here rather than in any one subsystem: the menu filters
-/// its picker by it, and the gateway subsystem's catalog refresh reads
-/// readiness from it.
-#[must_use]
-pub fn is_chat_capable(model: &serde_json::Value) -> bool {
-    let has_id = model
-        .get("id")
-        .and_then(serde_json::Value::as_str)
-        .is_some_and(|id| !id.is_empty());
-    let chat_kind = match model.get("kind") {
-        None => true,
-        Some(serde_json::Value::String(kind)) => kind == "chat",
-        Some(_) => false,
-    };
-    has_id && chat_kind
-}
diff --git a/crates/workshop/protocol/src/error.rs b/crates/workshop/protocol/src/error.rs
deleted file mode 100644
index d19410114..000000000
--- a/crates/workshop/protocol/src/error.rs
+++ /dev/null
@@ -1,70 +0,0 @@
-//! Error shapes on the wire: the socket `error` frame and the HTTP error
-//! envelope.
-
-use serde::Serialize;
-
-/// A failure report answered to one inbound frame - a malformed frame, a
-/// refused menu event, or an agent-session failure:
-/// `{"type":"error","message":"..."}` plus the echoed request `id`.
-///
-/// Delivery: durable on the workshop socket - a direct per-request reply
-/// sent by the loop that owns the socket. The agent-session socket
-/// additionally pushes id-less error frames for session-level failures;
-/// that delivery is ephemeral and documented in `workshop-server`'s
-/// `agents::wire` module.
-#[derive(Debug, Serialize)]
-pub struct ErrorFrame {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    message: String,
-    /// The request's `id`, echoed verbatim when the request had one and
-    /// omitted from the wire when it did not.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    id: Option<serde_json::Value>,
-}
-
-impl ErrorFrame {
-    /// Builds an error frame holding `message`, echoing `id` when present.
-    #[must_use]
-    pub fn new(message: String, id: Option<&serde_json::Value>) -> Self {
-        Self {
-            kind: "error",
-            message,
-            id: id.cloned(),
-        }
-    }
-}
-
-/// The opaque wire error envelope every HTTP failure answers with:
-/// `{"error":{"message":"...","code":"..."}}`.
-///
-/// The server maps its per-crate error types onto status codes and renders
-/// this envelope; the shape is pinned here so the wire contract sits in
-/// one place. Failures rendered as plain text (the asset 404) never take
-/// this shape.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub struct ErrorEnvelope {
-    error: EnvelopeBody,
-}
-
-/// The envelope payload: the user-visible message and the
-/// machine-readable code.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-struct EnvelopeBody {
-    message: String,
-    code: String,
-}
-
-impl ErrorEnvelope {
-    /// Builds the envelope holding `message` under the machine-readable
-    /// `code`.
-    #[must_use]
-    pub fn new(message: impl Into<String>, code: impl Into<String>) -> Self {
-        Self {
-            error: EnvelopeBody {
-                message: message.into(),
-                code: code.into(),
-            },
-        }
-    }
-}
diff --git a/crates/workshop/protocol/src/input.rs b/crates/workshop/protocol/src/input.rs
deleted file mode 100644
index 9502bac9f..000000000
--- a/crates/workshop/protocol/src/input.rs
+++ /dev/null
@@ -1,19 +0,0 @@
-//! The agent-session input frame: the operator's message.
-
-use serde::Deserialize;
-
-/// The operator's message, sent at any time. Wire type `input_response`.
-///
-/// `{"type":"input_response","text":"..."}` goes to the session's run
-/// whenever the operator sends it: it answers the agent while the agent
-/// waits on its inbox, and steers the turn while the agent works.
-///
-/// The session routes on the envelope's `type` and deserializes the body
-/// with serde, which ignores the envelope tag itself. `text` is the
-/// operator's input, byte-exact as typed. Like every inbound frame it
-/// takes no delivery classification, because the server pushes none.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-pub struct InputResponse {
-    /// The operator's text, byte-exact as typed.
-    pub text: String,
-}
diff --git a/crates/workshop/protocol/src/lib.rs b/crates/workshop/protocol/src/lib.rs
deleted file mode 100644
index 45412ea77..000000000
--- a/crates/workshop/protocol/src/lib.rs
+++ /dev/null
@@ -1,107 +0,0 @@
-//! workshop-protocol - the wire protocol of the workshop sockets: the
-//! `/ws` frames and the operator's input frame of `/agents/ws`, typed
-//! with zero I/O.
-//!
-//! Frames are grouped by direction - inbound (client to server) first,
-//! outbound (server to client) second. Every wire shape is pinned by the
-//! plain tests in `tests/it`. The TypeScript half of this contract is
-//! `crates/workshop/ui/src/services/protocol.ts`; the two files
-//! cross-cite each other so a shape change touches both or neither. The
-//! workshop-socket frame family is additionally pinned by the shared
-//! fixture `tests/fixtures/workshop-frames.json`, asserted by the
-//! `workshop_frames` test here and by the SPA suite's
-//! `crates/workshop/ui/test/workshop-wire-fixtures.mjs`. The wire shapes
-//! are additionally frozen end to end by the characterization tests in
-//! `workshop-server`'s `tests/it`.
-//!
-//! ## Invariants
-//!
-//! - Tier: vocabulary; may depend on: no internal `workshop-*` crates.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - Zero I/O: no sockets, tasks, or clocks, so every wire shape is
-//!   pinned by a plain test.
-//!
-//! # Inbound workshop-socket frames
-//!
-//! `{"type":"select_model","model":"..."}`
-//! ([`SelectModelFrame`]) selects the chat model: the menu validates the
-//! id against the retained catalog and publishes a fresh
-//! [`WorkbenchFrame`] on success; an unknown model is refused with an
-//! `error` frame. `{"type":"switch_profile","name":"..."}`
-//! ([`SwitchProfileFrame`]) selects a gateway profile, `null` selecting
-//! no profile: the pending snapshot publishes immediately, the steps of
-//! the selection arrive as [`StatusFrame`]s, and the settled menu
-//! publishes a final [`WorkbenchFrame`] and a [`CatalogFrame`]; a switch
-//! requested while one runs is refused with an `error` frame. Both
-//! events may include an optional `id`, echoed on the `error` frame that
-//! refuses them.
-//!
-//! No inbound frame is pushed by the server, so none takes a delivery
-//! classification; the reply frames they trigger are classified below.
-//!
-//! # Agent-session input frame
-//!
-//! An agent session's operator sends a message with an `input_response`
-//! frame, parsed as [`InputResponse`], at any time. The server sends it
-//! to the session's run, whose agent reads it from its main chain's
-//! inbox: it answers the agent while the agent waits there, and steers
-//! the turn while the agent works. When the agent waits for the operator
-//! is in the session's durable event log, as `awaiting_input` events, so
-//! no frame of this crate announces it. The server's agent socket routes
-//! this frame; this crate pins its shape.
-//!
-//! # Delivery contract
-//!
-//! Every frame the server pushes has exactly one of two delivery
-//! semantics. The session loops are built on this classification, so no
-//! pushed frame type ships unclassified.
-//!
-//! **Durable** frames are always delivered, and may coalesce. Where the
-//! data is shared fan-out state, the producer records it and wakes each
-//! connection loop through a `Notify`; the loop compares the shared
-//! revision against its own per-client cursor and sends everything past
-//! the cursor, so a missed wakeup is harmless. A durable frame that answers
-//! the connection's own request (a `launch` acknowledgment) is sent
-//! directly by the loop that owns the socket, without a cursor - no shared
-//! state exists for a cursor to index.
-//!
-//! **Ephemeral** frames may drop under lag. They are sent on bounded
-//! channels (a broadcast where the state fans out); a client too slow
-//! to drain its channel lags out and its connection may drop. The drop is
-//! harmless because every ephemeral frame has a self-contained repair
-//! path: status and catalog are complete snapshots resent on reconnect.
-//!
-//! ## Classification
-//!
-//! Workshop socket (`/ws`):
-//!
-//! - [`ErrorFrame`] - durable on this socket. The direct reply refusing
-//!   a malformed frame or a menu event, sent by the loop that owns the
-//!   socket - the contract's no-cursor case.
-//! - [`StatusFrame`] - ephemeral. Every update is a complete snapshot of
-//!   the bar, so a lagging client loses nothing by skipping
-//!   intermediates, and the current status is resent on reconnect.
-//! - [`CatalogFrame`] - ephemeral. Each push holds the whole catalog
-//!   verbatim; the newest push supersedes every older one and the
-//!   catalog is resent on reconnect.
-//! - [`WorkbenchFrame`] - ephemeral. Every push is a complete snapshot
-//!   of the server-owned Model-menu state, retained and resent on
-//!   reconnect, like the catalog frame. The connect-time send -
-//!   the retained snapshot follows the status and catalog snapshots on
-//!   every new session, so the UI boots with zero HTTP state fetches -
-//!   is that resend promise, not a third delivery class.
-
-mod catalog;
-mod error;
-mod input;
-mod menu;
-mod status;
-mod workbench;
-
-pub use catalog::{CatalogFrame, CatalogPush, is_chat_capable};
-pub use error::{ErrorEnvelope, ErrorFrame};
-pub use input::InputResponse;
-pub use menu::{SelectModelFrame, SwitchProfileFrame};
-pub use status::{Activity, Severity, StatusBarUpdate, StatusFrame};
-pub use workbench::{WorkbenchFrame, WorkbenchSnapshot};
diff --git a/crates/workshop/protocol/src/menu.rs b/crates/workshop/protocol/src/menu.rs
deleted file mode 100644
index 0bb9edc32..000000000
--- a/crates/workshop/protocol/src/menu.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-//! Inbound Model-menu frames: the model and profile selection events.
-
-use serde::{Deserialize, Deserializer};
-
-/// The inbound model selection: `{"type":"select_model","model":"..."}`.
-///
-/// `model` is the retained catalog id to select; the key itself is
-/// required, so a frame that omits it is malformed rather than an empty
-/// selection. The session routes on the envelope's `type` and
-/// deserializes the body with serde, which ignores the envelope tag and
-/// the optional `id` the session echoes on a refusal. Like every inbound
-/// frame it takes no delivery classification, because the server pushes
-/// none.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-#[non_exhaustive]
-pub struct SelectModelFrame {
-    /// The catalog id to select for chat.
-    pub model: String,
-}
-
-/// The inbound profile selection: `{"type":"switch_profile","name":...}`.
-///
-/// `name` is a profile name, or `null` to select no profile; the key
-/// itself is required, so a frame that omits it is malformed rather than
-/// a no-profile selection. The session routes on the envelope's `type`
-/// and deserializes the body with serde, which ignores the envelope tag
-/// and the optional `id` the session echoes on a refusal. Like every
-/// inbound frame it takes no delivery classification, because the server
-/// pushes none.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-#[non_exhaustive]
-pub struct SwitchProfileFrame {
-    /// The profile to select, or `None` (`null` on the wire) for no
-    /// profile.
-    #[serde(deserialize_with = "required_nullable")]
-    pub name: Option<String>,
-}
-
-/// Deserializes a nullable string whose key must be present: serde's
-/// derive treats a missing `Option` field as `None` unless the field
-/// names its own deserializer, and this field names one, so an absent
-/// `name` fails instead of selecting no profile.
-fn required_nullable<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
-where
-    D: Deserializer<'de>,
-{
-    Option::<String>::deserialize(deserializer)
-}
diff --git a/crates/workshop/protocol/src/status.rs b/crates/workshop/protocol/src/status.rs
deleted file mode 100644
index dc9eea32d..000000000
--- a/crates/workshop/protocol/src/status.rs
+++ /dev/null
@@ -1,74 +0,0 @@
-//! Status-bar frames: the `{"type":"status",...}` updates.
-
-use serde::Serialize;
-
-/// One status bar update: what the bar should show right now.
-///
-/// Every update is a complete snapshot, so a lagging receiver loses nothing
-/// by skipping intermediates. `label` is the short text rendered in the
-/// status bar; `description` is the longer tooltip shown on hover.
-#[derive(Debug, Clone, PartialEq, Serialize)]
-pub struct StatusBarUpdate {
-    /// Short text rendered in the status bar.
-    pub label: String,
-    /// Longer text shown as the bar's tooltip.
-    pub description: String,
-    /// Whether work is in flight: the status bar shows its indeterminate
-    /// barberpole while this is set. The text in `label` says what the
-    /// work is; there is no fraction on the wire.
-    pub busy: bool,
-    /// How loudly the update speaks; the UI ignores `Debug` updates.
-    pub severity: Severity,
-    /// Which subsystem is active, driving the bar's activity indicator.
-    pub activity: Activity,
-}
-
-impl StatusBarUpdate {
-    /// The update as a wire frame: its own fields plus `"type": "status"`.
-    #[must_use]
-    pub fn frame(&self) -> StatusFrame<'_> {
-        StatusFrame {
-            kind: "status",
-            update: self,
-        }
-    }
-}
-
-/// How loudly a status update speaks.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Severity {
-    /// User-visible status text.
-    Info,
-    /// Internal instrumentation; the UI ignores it for display.
-    Debug,
-    /// A failure the user should see.
-    Error,
-}
-
-/// The subsystem an update belongs to, driving the activity indicator.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Activity {
-    /// No specific subsystem; the activity LED stays dark.
-    General,
-    /// A model turn in flight: amber on the activity LED.
-    Thinking,
-    /// Output tokens arriving: green on the activity LED.
-    Generating,
-}
-
-/// The serialized shape of one update on the socket: the update's fields
-/// flattened beside `"type": "status"`, matching the workshop protocol's frame
-/// taxonomy.
-///
-/// Delivery: ephemeral - every update is a complete snapshot, so a
-/// lagging client skips intermediates and the current status is resent
-/// on reconnect.
-#[derive(Debug, Serialize)]
-pub struct StatusFrame<'a> {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    #[serde(flatten)]
-    update: &'a StatusBarUpdate,
-}
diff --git a/crates/workshop/protocol/src/workbench.rs b/crates/workshop/protocol/src/workbench.rs
deleted file mode 100644
index aa11ede64..000000000
--- a/crates/workshop/protocol/src/workbench.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-//! Workbench frames: the `{"type":"workbench",...}` menu snapshots.
-
-use serde::Serialize;
-
-/// One pushed workbench snapshot: the server-owned Model-menu state.
-///
-/// The server computes `chat_ready` - a chat-capable model available, one
-/// selected, no switch in flight, gateway reachable - and the UI never
-/// derives it.
-///
-/// `switching` names the target when it is a profile; `switch_in_flight`
-/// is true for any in-flight target, including no profile.
-#[derive(Debug, Clone, PartialEq)]
-pub struct WorkbenchSnapshot {
-    /// Every gateway profile name, in gateway order.
-    pub profiles: Vec<String>,
-    /// The profile the gateway is serving, once known.
-    pub active: Option<String>,
-    /// The profile a switch is loading, while one is in flight. `None`
-    /// when no switch runs and when the in-flight switch selects no
-    /// profile.
-    pub switching: Option<String>,
-    /// Whether a switch is in flight, whatever its target.
-    pub switch_in_flight: bool,
-    /// The model chat requests go to, once one is selected.
-    pub selected_model: Option<String>,
-    /// Whether a chat can be submitted right now.
-    pub chat_ready: bool,
-}
-
-impl WorkbenchSnapshot {
-    /// The snapshot as a wire frame: `"type": "workbench"` beside the
-    /// fields, with `selected_model` shortened to `selected` on the wire.
-    #[must_use]
-    pub fn frame(&self) -> WorkbenchFrame<'_> {
-        WorkbenchFrame {
-            kind: "workbench",
-            profiles: &self.profiles,
-            active: self.active.as_deref(),
-            switching: self.switching.as_deref(),
-            switch_in_flight: self.switch_in_flight,
-            selected: self.selected_model.as_deref(),
-            chat_ready: self.chat_ready,
-        }
-    }
-}
-
-/// The serialized shape of a workbench push on the socket, matching the
-/// workshop protocol's frame taxonomy. Absent options serialize as `null`,
-/// never as omitted keys: every push is the complete menu state.
-///
-/// Delivery: ephemeral - every push is a complete snapshot of the menu
-/// state, retained and resent on reconnect, like the catalog frame.
-#[derive(Debug, Serialize)]
-pub struct WorkbenchFrame<'a> {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    profiles: &'a [String],
-    active: Option<&'a str>,
-    switching: Option<&'a str>,
-    switch_in_flight: bool,
-    selected: Option<&'a str>,
-    chat_ready: bool,
-}
diff --git a/crates/workshop/protocol/tests/fixtures/workshop-frames.json b/crates/workshop/protocol/tests/fixtures/workshop-frames.json
deleted file mode 100644
index b35a4b01d..000000000
--- a/crates/workshop/protocol/tests/fixtures/workshop-frames.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "error": { "type": "error", "message": "unknown model", "id": 3 },
-  "models": { "type": "models", "models": [{ "id": "test-model", "object": "model" }] },
-  "select_model": { "type": "select_model", "model": "test-model" },
-  "status": {
-    "type": "status",
-    "label": "Ready",
-    "description": "idle",
-    "severity": "info",
-    "activity": "general",
-    "busy": false
-  },
-  "switch_profile": { "type": "switch_profile", "name": "beta" },
-  "workbench": {
-    "type": "workbench",
-    "profiles": ["main", "coding"],
-    "active": "main",
-    "switching": null,
-    "switch_in_flight": false,
-    "selected": "test-model",
-    "chat_ready": true
-  }
-}
diff --git a/crates/workshop/protocol/tests/it/frames.rs b/crates/workshop/protocol/tests/it/frames.rs
deleted file mode 100644
index 6e47416b1..000000000
--- a/crates/workshop/protocol/tests/it/frames.rs
+++ /dev/null
@@ -1,221 +0,0 @@
-//! Per-frame wire-shape pins: each test asserts one frame against an
-//! exact `serde_json::json!` literal, so a field rename, retype, or
-//! optionality change fails here before it reaches a socket.
-
-use workshop_protocol::{
-    Activity, CatalogPush, ErrorEnvelope, ErrorFrame, InputResponse, Severity, StatusBarUpdate,
-    SwitchProfileFrame, WorkbenchSnapshot,
-};
-
-/// Builds a minimal update with the given label.
-fn stub(label: impl Into<String>) -> StatusBarUpdate {
-    StatusBarUpdate {
-        label: label.into(),
-        description: String::new(),
-        busy: false,
-        severity: Severity::Info,
-        activity: Activity::General,
-    }
-}
-
-#[test]
-fn a_status_update_serializes_as_a_status_frame() {
-    let frame = serde_json::to_value(stub("Ready").frame()).expect("the frame serializes");
-    assert_eq!(
-        frame,
-        serde_json::json!({
-            "type": "status",
-            "label": "Ready",
-            "description": "",
-            "busy": false,
-            "severity": "info",
-            "activity": "general",
-        }),
-        "the wire shape matches the workshop protocol's frame taxonomy"
-    );
-}
-
-#[test]
-fn busy_and_the_remaining_variants_serialize() {
-    let update = StatusBarUpdate {
-        busy: true,
-        severity: Severity::Error,
-        activity: Activity::Thinking,
-        ..stub("Working")
-    };
-    let frame = serde_json::to_value(update.frame()).expect("the frame serializes");
-    assert_eq!(
-        frame["busy"],
-        serde_json::json!(true),
-        "the busy flag appears on the frame as a plain boolean, never a progress object"
-    );
-    assert!(
-        frame.get("progress").is_none(),
-        "the determinate progress object is gone from the wire"
-    );
-    assert_eq!(frame["severity"], "error");
-    assert_eq!(frame["activity"], "thinking");
-    // Debug serializes too; the UI, not the bus, ignores it.
-    let debug = serde_json::to_value(
-        StatusBarUpdate {
-            severity: Severity::Debug,
-            activity: Activity::Generating,
-            ..stub("x")
-        }
-        .frame(),
-    )
-    .expect("the frame serializes");
-    assert_eq!(debug["severity"], "debug");
-    assert_eq!(debug["activity"], "generating");
-}
-
-#[test]
-fn a_catalog_push_serializes_as_a_models_frame() {
-    let push = CatalogPush {
-        models: vec![serde_json::json!({"id": "test-model", "object": "model"})],
-    };
-    let frame = serde_json::to_value(push.frame()).expect("the frame serializes");
-    assert_eq!(
-        frame,
-        serde_json::json!({
-            "type": "models",
-            "models": [{"id": "test-model", "object": "model"}],
-        }),
-        "the wire shape matches the workshop protocol's frame taxonomy"
-    );
-}
-
-#[test]
-fn a_workbench_snapshot_serializes_as_a_workbench_frame() {
-    let snapshot = WorkbenchSnapshot {
-        profiles: vec!["main".to_string(), "coding".to_string()],
-        active: Some("main".to_string()),
-        switching: None,
-        switch_in_flight: false,
-        selected_model: Some("claude-sonnet-4-6".to_string()),
-        chat_ready: true,
-    };
-    let frame = serde_json::to_value(snapshot.frame()).expect("the frame serializes");
-    assert_eq!(
-        frame,
-        serde_json::json!({
-            "type": "workbench",
-            "profiles": ["main", "coding"],
-            "active": "main",
-            "switching": null,
-            "switch_in_flight": false,
-            "selected": "claude-sonnet-4-6",
-            "chat_ready": true,
-        }),
-        "the wire shape matches the workshop protocol's frame taxonomy"
-    );
-}
-
-#[test]
-fn a_switch_to_no_profile_is_visible_on_the_workbench_frame() {
-    let snapshot = WorkbenchSnapshot {
-        profiles: vec!["main".to_string()],
-        active: Some("main".to_string()),
-        switching: None,
-        switch_in_flight: true,
-        selected_model: Some("claude-sonnet-4-6".to_string()),
-        chat_ready: false,
-    };
-    let frame = serde_json::to_value(snapshot.frame()).expect("the frame serializes");
-    assert_eq!(
-        frame["switching"],
-        serde_json::Value::Null,
-        "a switch to no profile names no target"
-    );
-    assert_eq!(
-        frame["switch_in_flight"], true,
-        "the frame still reports the switch in flight, independent of the target name"
-    );
-}
-
-#[test]
-fn an_input_response_parses_its_body_byte_exact_ignoring_the_envelope() {
-    let gnarly = "line1\r\nline2 \"quoted\" {\"text\":\"decoy\"} \\slash 🦀";
-    let response: InputResponse = serde_json::from_value(serde_json::json!({
-        "type": "input_response",
-        "text": gnarly,
-    }))
-    .expect("the frame parses with its envelope tag present");
-    assert_eq!(
-        response.text, gnarly,
-        "the operator's text survives the wire byte-exact"
-    );
-}
-
-#[test]
-fn an_input_response_without_text_is_refused() {
-    assert!(
-        serde_json::from_value::<InputResponse>(serde_json::json!({
-            "type": "input_response",
-        }))
-        .is_err(),
-        "a message must carry its text"
-    );
-}
-
-#[test]
-fn a_switch_profile_frame_accepts_a_name_or_null_and_refuses_the_rest() {
-    let named: SwitchProfileFrame = serde_json::from_value(serde_json::json!({
-        "type": "switch_profile",
-        "name": "beta",
-        "id": 4,
-    }))
-    .expect("a named selection parses with its envelope present");
-    assert_eq!(named.name.as_deref(), Some("beta"));
-
-    let none: SwitchProfileFrame =
-        serde_json::from_value(serde_json::json!({"type": "switch_profile", "name": null}))
-            .expect("null selects no profile");
-    assert_eq!(none.name, None, "a null name is the no-profile selection");
-
-    assert!(
-        serde_json::from_value::<SwitchProfileFrame>(serde_json::json!({
-            "type": "switch_profile"
-        }))
-        .is_err(),
-        "an absent name is a malformed frame, not a no-profile selection"
-    );
-    assert!(
-        serde_json::from_value::<SwitchProfileFrame>(serde_json::json!({
-            "type": "switch_profile",
-            "name": 7,
-        }))
-        .is_err(),
-        "a non-string name is refused"
-    );
-}
-
-#[test]
-fn an_error_frame_serializes_with_and_without_the_echoed_id() {
-    let untagged = serde_json::to_value(ErrorFrame::new("Gateway unreachable".to_string(), None))
-        .expect("the frame serializes");
-    assert_eq!(
-        untagged,
-        serde_json::json!({"type": "error", "message": "Gateway unreachable"})
-    );
-    let id = serde_json::json!(7);
-    let tagged = serde_json::to_value(ErrorFrame::new(
-        "Gateway unreachable".to_string(),
-        Some(&id),
-    ))
-    .expect("the frame serializes");
-    assert_eq!(
-        tagged,
-        serde_json::json!({"type": "error", "message": "Gateway unreachable", "id": 7})
-    );
-}
-
-#[test]
-fn an_error_envelope_serializes_as_message_and_code_under_error() {
-    let envelope = ErrorEnvelope::new("file cannot be read", "read_file");
-    assert_eq!(
-        serde_json::to_value(&envelope).expect("the envelope serializes"),
-        serde_json::json!({"error": {"message": "file cannot be read", "code": "read_file"}}),
-        "the wire shape matches the envelope the server has always answered with"
-    );
-}
diff --git a/crates/workshop/protocol/tests/it/main.rs b/crates/workshop/protocol/tests/it/main.rs
deleted file mode 100644
index 0e61ce35d..000000000
--- a/crates/workshop/protocol/tests/it/main.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-//! Integration tests for `workshop-protocol`: the wire-shape pins.
-
-mod frames;
-mod workshop_frames;
diff --git a/crates/workshop/protocol/tests/it/workshop_frames.rs b/crates/workshop/protocol/tests/it/workshop_frames.rs
deleted file mode 100644
index 99e753885..000000000
--- a/crates/workshop/protocol/tests/it/workshop_frames.rs
+++ /dev/null
@@ -1,110 +0,0 @@
-//! The shared workshop-frame fixture pins: the same JSON the SPA suite
-//! (`crates/workshop/ui/test/workshop-wire-fixtures.mjs`) asserts, so a
-//! wire drift on either side fails that side's fixture test.
-
-use workshop_protocol::{
-    Activity, CatalogPush, ErrorFrame, SelectModelFrame, Severity, StatusBarUpdate,
-    SwitchProfileFrame, WorkbenchSnapshot,
-};
-
-/// The shared workshop-frame fixture, asserted as the same JSON by the
-/// SPA suite: a wire drift on either side fails that side's fixture test.
-const WORKSHOP_FRAME_FIXTURE: &str = include_str!("../fixtures/workshop-frames.json");
-
-/// Parses the shared fixture into one object keyed by case name.
-fn workshop_fixture() -> serde_json::Value {
-    match serde_json::from_str(WORKSHOP_FRAME_FIXTURE) {
-        Ok(fixture) => fixture,
-        Err(error) => panic!("the fixture is valid JSON: {error}"),
-    }
-}
-
-#[test]
-fn the_shared_fixture_pins_exactly_the_agreed_case_list() {
-    let fixture = workshop_fixture();
-    let mut cases: Vec<&str> = fixture
-        .as_object()
-        .expect("the fixture is one object keyed by case name")
-        .keys()
-        .map(String::as_str)
-        .collect();
-    cases.sort_unstable();
-    assert_eq!(
-        cases,
-        [
-            "error",
-            "models",
-            "select_model",
-            "status",
-            "switch_profile",
-            "workbench",
-        ],
-        "both suites pin exactly the same case list, so a case added on \
-         one side fails the other"
-    );
-}
-
-#[test]
-fn server_to_client_workshop_frames_match_the_shared_fixture() {
-    // Each typed frame serializes to its fixture entry, compared as
-    // values so key order in the file is free.
-    let fixture = workshop_fixture();
-    assert_eq!(
-        serde_json::to_value(
-            StatusBarUpdate {
-                label: "Ready".to_owned(),
-                description: "idle".to_owned(),
-                busy: false,
-                severity: Severity::Info,
-                activity: Activity::General,
-            }
-            .frame(),
-        )
-        .expect("the frame serializes"),
-        fixture["status"]
-    );
-    assert_eq!(
-        serde_json::to_value(
-            CatalogPush {
-                models: vec![serde_json::json!({"id": "test-model", "object": "model"})],
-            }
-            .frame(),
-        )
-        .expect("the frame serializes"),
-        fixture["models"]
-    );
-    assert_eq!(
-        serde_json::to_value(
-            WorkbenchSnapshot {
-                profiles: vec!["main".to_owned(), "coding".to_owned()],
-                active: Some("main".to_owned()),
-                switching: None,
-                switch_in_flight: false,
-                selected_model: Some("test-model".to_owned()),
-                chat_ready: true,
-            }
-            .frame(),
-        )
-        .expect("the frame serializes"),
-        fixture["workbench"]
-    );
-    let id = serde_json::json!(3);
-    assert_eq!(
-        serde_json::to_value(ErrorFrame::new("unknown model".to_owned(), Some(&id)))
-            .expect("the frame serializes"),
-        fixture["error"]
-    );
-}
-
-#[test]
-fn client_to_server_workshop_frames_match_the_shared_fixture() {
-    // Both inbound frames parse through their typed bodies, which ignore
-    // the envelope tag and the optional `id` the session echoes.
-    let fixture = workshop_fixture();
-    let select: SelectModelFrame = serde_json::from_value(fixture["select_model"].clone())
-        .expect("the fixture select_model parses");
-    assert_eq!(select.model, "test-model");
-    let switch: SwitchProfileFrame = serde_json::from_value(fixture["switch_profile"].clone())
-        .expect("the fixture switch_profile parses");
-    assert_eq!(switch.name.as_deref(), Some("beta"));
-}
diff --git a/crates/workshop/registry/Cargo.toml b/crates/workshop/registry/Cargo.toml
deleted file mode 100644
index a5d67529d..000000000
--- a/crates/workshop/registry/Cargo.toml
+++ /dev/null
@@ -1,19 +0,0 @@
-[package]
-name = "workshop-registry"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-axum.workspace = true
-serde_json.workspace = true
-tokio.workspace = true
-workshop-protocol.workspace = true
-
-[dev-dependencies]
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/registry/src/lib.rs b/crates/workshop/registry/src/lib.rs
deleted file mode 100644
index 8b890f752..000000000
--- a/crates/workshop/registry/src/lib.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! workshop-registry - the keystone of the workshop server
-//! decomposition: four contribution collections into which subsystems
-//! self-register - routes and background tasks as ordered vectors of
-//! trait objects, state handles and push sinks as maps keyed by type.
-//! Consumers reach subsystems through the registry instead of by name,
-//! so the composition root never hand-wires what a subsystem can
-//! announce itself.
-//!
-//! The runtime links the subsystem-named seams carry: the gateway
-//! drives the menu through [`MenuPush`], publishing a model catalog
-//! forces a menu reconcile through [`Push::push_models_catalog`], and
-//! agent sessions read the workspace's granted roots through
-//! [`WorkspaceRoots`].
-//!
-//! ## Invariants
-//!
-//! - Tier: vocabulary; may depend on: `workshop-protocol` (the wire
-//!   types the push-channel contributions use). `cargo test -p build-xtask`
-//!   enforces the product and container boundaries.
-//! - Every subsystem trait is sealed (a private empty supertrait), so
-//!   only this crate implements them: registrants plug in through the
-//!   adapters provided here, never by implementing a trait downstream.
-//! - Subsystem names live in the sealed traits ([`MenuSink`],
-//!   [`CatalogSink`], [`StatusChannel`], [`StatusSink`],
-//!   [`WorkspaceRoots`]) and in the [`MenuPush`] struct behind
-//!   [`Push::menu`], the facade's one per-subsystem accessor; the
-//!   collections stay keyed by type, never by a per-subsystem field. A
-//!   new subsystem adds its trait and adapter here, a compose helper in
-//!   the server's composition root, and a [`Registry::require`] there
-//!   for its handle set.
-//! - An unregistered contribution is a graceful no-op, never an error:
-//!   consumers branch on `None` and continue degraded, and the [`Push`]
-//!   facade drops intents whose sink is unregistered. The composition
-//!   root alone is total: it calls [`Registry::require`] for the boot
-//!   set, so a missing required contribution fails startup with a typed
-//!   error naming the absent type.
-//! - A registration is alive exactly as long as its guard: dropping the
-//!   guard deregisters the contribution.
-
-mod push;
-mod registry;
-mod traits;
-
-pub use push::{MenuPush, Push};
-pub use registry::{MissingContribution, Registration, Registry};
-pub use traits::{
-    BackgroundTask, BackgroundTaskAdapter, CatalogSink, CatalogSinkAdapter, MenuSink,
-    MenuSinkAdapter, RouteRegistrar, RouteRegistrarAdapter, ShutdownHandle, StatusChannel,
-    StatusChannelAdapter, StatusSink, StatusSinkAdapter, WorkspaceRoots, WorkspaceRootsAdapter,
-};
diff --git a/crates/workshop/registry/src/push-tests.rs b/crates/workshop/registry/src/push-tests.rs
deleted file mode 100644
index a2ae67ac0..000000000
--- a/crates/workshop/registry/src/push-tests.rs
+++ /dev/null
@@ -1,284 +0,0 @@
-//! Tests for the [`Push`] facade: every intent lands on the right sink
-//! with the right frame, and an empty slot degrades the intent to a
-//! no-op. The sinks are recording adapters - closures capturing into
-//! channels - so the assertions read like the bus-receiver assertions in
-//! the producers' own crates.
-
-use std::sync::{Arc, Mutex, PoisonError};
-
-use tokio::sync::broadcast;
-
-use super::*;
-use crate::{
-    CatalogSinkAdapter, MenuSinkAdapter, Registration, StatusSink, StatusSinkAdapter,
-    traits::{CatalogSink, MenuSink},
-};
-use workshop_protocol::StatusBarUpdate;
-
-/// A registry wired with recording sinks: status and catalog frames go
-/// to broadcast receivers, menu mutator calls to a shared log.
-struct Recording {
-    push: Push,
-    status_rx: broadcast::Receiver<StatusBarUpdate>,
-    catalog_rx: broadcast::Receiver<Vec<serde_json::Value>>,
-    menu_calls: Arc<Mutex<Vec<String>>>,
-    // The registrations keep the sinks alive for the test's duration.
-    _guards: (Registration, Registration, Registration),
-}
-
-/// Wires a registry with recording sink adapters and returns its push
-/// facade plus the recording ends.
-fn wired() -> Recording {
-    let registry = Registry::new();
-    let (status_tx, status_rx) = broadcast::channel(16);
-    let (catalog_tx, catalog_rx) = broadcast::channel(16);
-    let menu_calls: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(Vec::new()));
-    let status_guard =
-        registry.register_sink::<dyn StatusSink>(Arc::new(StatusSinkAdapter::new(move |update| {
-            // A send only fails when the test dropped its receiver.
-            let _ = status_tx.send(update);
-        })));
-    let catalog_guard = registry.register_sink::<dyn CatalogSink>(Arc::new(
-        CatalogSinkAdapter::new(move |models| {
-            let _ = catalog_tx.send(models);
-        }),
-    ));
-    let menu_guard = {
-        let calls = Arc::clone(&menu_calls);
-        registry.register_sink::<dyn MenuSink>(Arc::new(MenuSinkAdapter::new(
-            {
-                let calls = Arc::clone(&calls);
-                move |reachable| record(&calls, format!("reachable:{reachable}"))
-            },
-            {
-                let calls = Arc::clone(&calls);
-                move |profiles, active| {
-                    record(&calls, format!("profiles:{}:{active:?}", profiles.len()));
-                }
-            },
-            {
-                let calls = Arc::clone(&calls);
-                move || record(&calls, "restore".to_string())
-            },
-            move || record(&calls, "reconcile".to_string()),
-        )))
-    };
-    Recording {
-        push: registry.push(),
-        status_rx,
-        catalog_rx,
-        menu_calls,
-        _guards: (status_guard, catalog_guard, menu_guard),
-    }
-}
-
-/// Appends one menu mutator call to the recording.
-fn record(calls: &Mutex<Vec<String>>, call: String) {
-    calls
-        .lock()
-        .unwrap_or_else(PoisonError::into_inner)
-        .push(call);
-}
-
-/// The menu mutator calls recorded so far.
-fn menu_calls(recording: &Recording) -> Vec<String> {
-    recording
-        .menu_calls
-        .lock()
-        .unwrap_or_else(PoisonError::into_inner)
-        .clone()
-}
-
-#[tokio::test]
-async fn a_status_update_reaches_the_sink_at_info_severity() {
-    let mut recording = wired();
-    recording.push.push_status_update(
-        "Connected to gateway",
-        "the probe answered",
-        Activity::General,
-    );
-    let update = recording
-        .status_rx
-        .recv()
-        .await
-        .expect("the update reaches the sink");
-    assert_eq!(
-        update,
-        StatusBarUpdate {
-            label: "Connected to gateway".to_string(),
-            description: "the probe answered".to_string(),
-            busy: false,
-            severity: Severity::Info,
-            activity: Activity::General,
-        }
-    );
-}
-
-#[tokio::test]
-async fn a_failure_reaches_the_sink_at_error_severity() {
-    let mut recording = wired();
-    recording
-        .push
-        .push_failure("Connection lost", "the gateway hung up", Activity::General);
-    let update = recording
-        .status_rx
-        .recv()
-        .await
-        .expect("the update reaches the sink");
-    assert_eq!(
-        update,
-        StatusBarUpdate {
-            label: "Connection lost".to_string(),
-            description: "the gateway hung up".to_string(),
-            busy: false,
-            severity: Severity::Error,
-            activity: Activity::General,
-        }
-    );
-}
-
-#[tokio::test]
-async fn an_activity_pulse_reaches_the_sink_at_debug_severity() {
-    let mut recording = wired();
-    recording.push.push_activity(
-        "Streaming response...",
-        "a gateway response chunk",
-        Activity::Generating,
-    );
-    let update = recording
-        .status_rx
-        .recv()
-        .await
-        .expect("the update reaches the sink");
-    assert_eq!(
-        update,
-        StatusBarUpdate {
-            label: "Streaming response...".to_string(),
-            description: "a gateway response chunk".to_string(),
-            busy: false,
-            severity: Severity::Debug,
-            activity: Activity::Generating,
-        }
-    );
-}
-
-#[tokio::test]
-async fn busy_reaches_the_sink_as_an_info_frame_with_the_busy_flag_set() {
-    let mut recording = wired();
-    recording
-        .push
-        .push_busy("Downloading model", "ggml-large-v3.bin", Activity::General);
-    let update = recording
-        .status_rx
-        .recv()
-        .await
-        .expect("the update reaches the sink");
-    assert_eq!(
-        update,
-        StatusBarUpdate {
-            label: "Downloading model".to_string(),
-            description: "ggml-large-v3.bin".to_string(),
-            busy: true,
-            severity: Severity::Info,
-            activity: Activity::General,
-        }
-    );
-}
-
-#[tokio::test]
-async fn idle_reaches_the_sink_as_the_resting_update() {
-    let mut recording = wired();
-    recording.push.push_idle();
-    let update = recording
-        .status_rx
-        .recv()
-        .await
-        .expect("the update reaches the sink");
-    assert_eq!(
-        update,
-        StatusBarUpdate {
-            label: "Ready".to_string(),
-            description: "idle".to_string(),
-            busy: false,
-            severity: Severity::Info,
-            activity: Activity::General,
-        }
-    );
-}
-
-#[tokio::test]
-async fn a_models_catalog_reaches_the_sink_as_one_snapshot() {
-    let mut recording = wired();
-    let models = vec![serde_json::json!({"id": "test-model", "object": "model"})];
-    recording.push.push_models_catalog(models.clone());
-    let received = recording
-        .catalog_rx
-        .recv()
-        .await
-        .expect("the push reaches the sink");
-    assert_eq!(received, models, "the catalog sink takes the raw models");
-}
-
-#[tokio::test]
-async fn a_catalog_push_reconciles_the_workbench_selection() {
-    let recording = wired();
-    recording
-        .push
-        .push_models_catalog(vec![serde_json::json!({"id": "model-a"})]);
-    assert_eq!(
-        menu_calls(&recording),
-        ["reconcile"],
-        "every catalog publish revalidates the menu's selection"
-    );
-}
-
-#[test]
-fn the_menu_handle_drives_the_menu_sink_mutators() {
-    let recording = wired();
-    let menu = recording.push.menu();
-    menu.set_gateway_reachable(true);
-    menu.set_profiles(vec!["main".to_string()], Some("main".to_string()));
-    menu.restore_selection();
-    assert_eq!(
-        menu_calls(&recording),
-        ["reachable:true", "profiles:1:Some(\"main\")", "restore"],
-    );
-}
-
-#[test]
-fn intents_on_empty_slots_are_no_ops() {
-    let push = Registry::new().push();
-    // None of these panic or fail without registered sinks.
-    push.push_status_update("label", "description", Activity::General);
-    push.push_failure("label", "description", Activity::General);
-    push.push_activity("label", "description", Activity::General);
-    push.push_busy("label", "description", Activity::General);
-    push.push_idle();
-    push.push_models_catalog(Vec::new());
-    let menu = push.menu();
-    menu.set_gateway_reachable(false);
-    menu.set_profiles(Vec::new(), None);
-    menu.restore_selection();
-}
-
-#[test]
-fn dropping_a_registration_stops_its_intents() {
-    let registry = Registry::new();
-    let (status_tx, mut status_rx) = broadcast::channel(16);
-    let guard =
-        registry.register_sink::<dyn StatusSink>(Arc::new(StatusSinkAdapter::new(move |update| {
-            let _ = status_tx.send(update);
-        })));
-    let push = registry.push();
-    push.push_idle();
-    assert!(
-        status_rx.try_recv().is_ok(),
-        "the registered sink receives the intent"
-    );
-    drop(guard);
-    push.push_idle();
-    assert!(
-        status_rx.try_recv().is_err(),
-        "the dropped registration deregisters the sink"
-    );
-}
diff --git a/crates/workshop/registry/src/push.rs b/crates/workshop/registry/src/push.rs
deleted file mode 100644
index 6529cfc94..000000000
--- a/crates/workshop/registry/src/push.rs
+++ /dev/null
@@ -1,179 +0,0 @@
-//! The intent-named push facade over the producer sink slots: business
-//! code reports what happened and never chooses a severity or builds a
-//! bus payload (SiYuan's `PushReloadFiletree` pattern).
-//!
-//! Producers hold a [`Push`] and speak in intents - a status update, a
-//! failure, an activity pulse, busy, idle, a fresh model catalog;
-//! workbench producers drive the Model-menu mutators through
-//! [`Push::menu`], and every mutation publishes its own snapshot. What
-//! each intent becomes on the wire is decided here and in
-//! `workshop-protocol`, nowhere else. The sinks stay the transport:
-//! every `/ws` session subscribes to the status, catalog, and menu
-//! buses behind the sink slots and serializes what it receives.
-//!
-//! Every intent degrades to a no-op while its sink slot is empty, so a
-//! producer spawned before its subsystem registers never fails.
-
-use workshop_protocol::{Activity, Severity, StatusBarUpdate};
-
-use crate::Registry;
-use crate::traits::{CatalogSink, MenuSink, StatusSink};
-
-/// The intent-named push handle over the status, catalog, and menu sink
-/// slots.
-///
-/// Clones are cheap (a few `Arc` bumps) and every clone reads the same
-/// registry slots, so producers take their own copy, as they did with
-/// the buses themselves.
-#[derive(Debug, Clone)]
-pub struct Push {
-    registry: Registry,
-}
-
-impl Push {
-    /// Wraps the registry whose sink slots every unsolicited push flows
-    /// through.
-    pub(crate) fn new(registry: Registry) -> Self {
-        Self { registry }
-    }
-
-    /// Pushes a user-visible status update: a `{"type":"status",...}`
-    /// `StatusFrame` at info severity, not busy.
-    pub fn push_status_update(
-        &self,
-        label: impl Into<String>,
-        description: impl Into<String>,
-        activity: Activity,
-    ) {
-        self.emit(label, description, false, Severity::Info, activity);
-    }
-
-    /// Pushes a failure the user should see: a `{"type":"status",...}`
-    /// `StatusFrame` at error severity.
-    pub fn push_failure(
-        &self,
-        label: impl Into<String>,
-        description: impl Into<String>,
-        activity: Activity,
-    ) {
-        self.emit(label, description, false, Severity::Error, activity);
-    }
-
-    /// Pushes an activity pulse the UI does not display as text: a
-    /// `{"type":"status",...}` `StatusFrame` at debug severity, whose
-    /// `activity` field drives the status bar's LED.
-    pub fn push_activity(
-        &self,
-        label: impl Into<String>,
-        description: impl Into<String>,
-        activity: Activity,
-    ) {
-        self.emit(label, description, false, Severity::Debug, activity);
-    }
-
-    /// Pushes work in flight: a `{"type":"status",...}` `StatusFrame`
-    /// at [`Severity::Info`] with `busy` set, which the status bar
-    /// renders as its text plus the indeterminate barberpole. The work
-    /// ends with any later non-busy frame - [`Push::push_idle`], a
-    /// status update, or a failure.
-    pub fn push_busy(
-        &self,
-        label: impl Into<String>,
-        description: impl Into<String>,
-        activity: Activity,
-    ) {
-        self.emit(label, description, true, Severity::Info, activity);
-    }
-
-    /// Pushes the status bar back to its resting state: the
-    /// `Ready`/`idle` `{"type":"status",...}` `StatusFrame`.
-    pub fn push_idle(&self) {
-        self.push_status_update("Ready", "idle", Activity::General);
-    }
-
-    /// Pushes one complete model catalog snapshot: a
-    /// `{"type":"models",...}` `CatalogFrame` containing only chat-capable
-    /// entries. The single choke point for catalog publishes: the menu
-    /// revalidates its selection against the new catalog and republishes
-    /// the workbench snapshot when it changed.
-    pub fn push_models_catalog(&self, models: Vec<serde_json::Value>) {
-        if let Some(catalog) = self.registry.sink::<dyn CatalogSink>() {
-            catalog.publish(models);
-        }
-        if let Some(menu) = self.registry.sink::<dyn MenuSink>() {
-            menu.reconcile_catalog();
-        }
-    }
-
-    /// The menu sink behind the facade, for producers that drive the
-    /// Model-menu mutators directly: the heartbeat feeds reachability
-    /// and the gateway's profile state through this handle.
-    #[must_use]
-    pub fn menu(&self) -> MenuPush {
-        MenuPush {
-            registry: self.registry.clone(),
-        }
-    }
-
-    /// Builds one status frame and emits it into the status sink; a
-    /// no-op while the status subsystem has not registered.
-    fn emit(
-        &self,
-        label: impl Into<String>,
-        description: impl Into<String>,
-        busy: bool,
-        severity: Severity,
-        activity: Activity,
-    ) {
-        let Some(status) = self.registry.sink::<dyn StatusSink>() else {
-            return;
-        };
-        status.emit(StatusBarUpdate {
-            label: label.into(),
-            description: description.into(),
-            busy,
-            severity,
-            activity,
-        });
-    }
-}
-
-/// The menu-mutator face of [`Push`]: the workbench mutators the
-/// gateway subsystem drives, reading the registry's menu sink slot.
-/// Every mutator is a no-op while the menu subsystem has not
-/// registered.
-#[derive(Debug, Clone)]
-pub struct MenuPush {
-    registry: Registry,
-}
-
-impl MenuPush {
-    /// Records the heartbeat's verdict on the gateway; `chat_ready` is
-    /// false while the gateway is down.
-    pub fn set_gateway_reachable(&self, reachable: bool) {
-        if let Some(menu) = self.registry.sink::<dyn MenuSink>() {
-            menu.set_gateway_reachable(reachable);
-        }
-    }
-
-    /// Records the gateway's profile list and active profile. A failed
-    /// or declined profile fetch feeds an empty list - a state, not an
-    /// error.
-    pub fn set_profiles(&self, profiles: Vec<String>, active: Option<String>) {
-        if let Some(menu) = self.registry.sink::<dyn MenuSink>() {
-            menu.set_profiles(profiles, active);
-        }
-    }
-
-    /// Restores a boot-time selection when none is applied; with a
-    /// selection already applied this is a no-op.
-    pub fn restore_selection(&self) {
-        if let Some(menu) = self.registry.sink::<dyn MenuSink>() {
-            menu.restore_selection();
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "push-tests.rs"]
-mod tests;
diff --git a/crates/workshop/registry/src/registry.rs b/crates/workshop/registry/src/registry.rs
deleted file mode 100644
index 5675e827c..000000000
--- a/crates/workshop/registry/src/registry.rs
+++ /dev/null
@@ -1,381 +0,0 @@
-//! The central registry: four contribution collections - routes and
-//! background tasks as ordered vectors of trait objects, state handles
-//! and push sinks as maps keyed by `TypeId`. The single downcast lives
-//! here; callers see typed `Option`s.
-
-use std::any::{Any, TypeId};
-use std::collections::HashMap;
-use std::fmt;
-use std::sync::{Arc, PoisonError, RwLock, RwLockReadGuard, RwLockWriteGuard};
-
-use crate::push::Push;
-use crate::traits::{BackgroundTask, RouteRegistrar};
-
-/// Reads the lock, tolerating a poisoned guard: a panicking registrant
-/// must not take down every consumer.
-fn read<T>(lock: &RwLock<T>) -> RwLockReadGuard<'_, T> {
-    lock.read().unwrap_or_else(PoisonError::into_inner)
-}
-
-/// Writes the lock, tolerating a poisoned guard.
-fn write<T>(lock: &RwLock<T>) -> RwLockWriteGuard<'_, T> {
-    lock.write().unwrap_or_else(PoisonError::into_inner)
-}
-
-/// A type-keyed contribution cell: one entry per Rust type, the `Arc<T>`
-/// boxed so trait-object handle sets (`Arc<dyn Trait>`) store beside
-/// concrete ones.
-#[derive(Default)]
-struct TypeMap {
-    entries: HashMap<TypeId, Box<dyn Any + Send + Sync>>,
-}
-
-impl TypeMap {
-    /// The contribution registered under `T`, downcast back to its
-    /// `Arc<T>`.
-    fn get<T: ?Sized + Send + Sync + 'static>(&self) -> Option<Arc<T>> {
-        self.entries
-            .get(&TypeId::of::<T>())?
-            .downcast_ref::<Arc<T>>()
-            .cloned()
-    }
-
-    /// Registers `contribution` under `T`, replacing any previous
-    /// occupant.
-    fn insert<T: ?Sized + Send + Sync + 'static>(&mut self, contribution: &Arc<T>) {
-        self.entries
-            .insert(TypeId::of::<T>(), Box::new(Arc::clone(contribution)));
-    }
-
-    /// Removes `contribution` from `T`'s key when it is still the
-    /// occupant, so a stale guard never evicts a newer registration.
-    fn remove<T: ?Sized + Send + Sync + 'static>(&mut self, contribution: &Arc<T>) {
-        let current = self
-            .entries
-            .get(&TypeId::of::<T>())
-            .and_then(|entry| entry.downcast_ref::<Arc<T>>())
-            .is_some_and(|current| Arc::ptr_eq(current, contribution));
-        if current {
-            self.entries.remove(&TypeId::of::<T>());
-        }
-    }
-}
-
-impl fmt::Debug for TypeMap {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("TypeMap")
-            .field("registered", &self.entries.len())
-            .finish()
-    }
-}
-
-/// The central registry subsystems self-register into.
-///
-/// Clones are cheap (every collection is an `Arc`) and share the same
-/// collections, so every handle the composition root hands out sees the
-/// same registrations.
-#[derive(Clone, Default)]
-pub struct Registry {
-    routes: Arc<RwLock<Vec<Arc<dyn RouteRegistrar>>>>,
-    tasks: Arc<RwLock<Vec<Arc<dyn BackgroundTask>>>>,
-    state: Arc<RwLock<TypeMap>>,
-    sinks: Arc<RwLock<TypeMap>>,
-}
-
-impl fmt::Debug for Registry {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Registry")
-            .field("routes", &read(&self.routes).len())
-            .field("tasks", &read(&self.tasks).len())
-            .field("state", &read(&self.state))
-            .field("sinks", &read(&self.sinks))
-            .finish()
-    }
-}
-
-impl Registry {
-    /// An empty registry: every collection empty until its subsystems
-    /// register.
-    #[must_use]
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Registers a route contribution; the server merges every
-    /// registrant into its API router in registration order. The
-    /// returned guard keeps the contribution alive: dropping it removes
-    /// the registrant.
-    pub fn register_routes(&self, registrar: Arc<dyn RouteRegistrar>) -> Registration {
-        write(&self.routes).push(Arc::clone(&registrar));
-        let routes = Arc::downgrade(&self.routes);
-        Registration::new(move || {
-            let Some(routes) = routes.upgrade() else {
-                return;
-            };
-            write(&routes).retain(|current| !Arc::ptr_eq(current, &registrar));
-        })
-    }
-
-    /// Registers a background task; the server spawns every registrant
-    /// with serving and stops each through its [`ShutdownHandle`](crate::ShutdownHandle)
-    /// in the graceful-shutdown closure.
-    pub fn register_task(&self, task: Arc<dyn BackgroundTask>) -> Registration {
-        write(&self.tasks).push(Arc::clone(&task));
-        let tasks = Arc::downgrade(&self.tasks);
-        Registration::new(move || {
-            let Some(tasks) = tasks.upgrade() else {
-                return;
-            };
-            write(&tasks).retain(|current| !Arc::ptr_eq(current, &task));
-        })
-    }
-
-    /// Registers a state handle set under its type; consumers read it
-    /// back with [`Registry::state`]. Re-registering `T` replaces the
-    /// previous occupant, whose stale guard then deregisters nothing.
-    pub fn register_state<T>(&self, handles: Arc<T>) -> Registration
-    where
-        T: ?Sized + Send + Sync + 'static,
-    {
-        write(&self.state).insert(&handles);
-        let state = Arc::downgrade(&self.state);
-        Registration::new(move || {
-            let Some(state) = state.upgrade() else {
-                return;
-            };
-            write(&state).remove(&handles);
-        })
-    }
-
-    /// Registers a producer sink under its trait type; the [`Push`]
-    /// facade resolves it with [`Registry::sink`].
-    pub fn register_sink<T>(&self, sink: Arc<T>) -> Registration
-    where
-        T: ?Sized + Send + Sync + 'static,
-    {
-        write(&self.sinks).insert(&sink);
-        let sinks = Arc::downgrade(&self.sinks);
-        Registration::new(move || {
-            let Some(sinks) = sinks.upgrade() else {
-                return;
-            };
-            write(&sinks).remove(&sink);
-        })
-    }
-
-    /// Every registered route contribution, in registration order.
-    #[must_use]
-    pub fn routes(&self) -> Vec<Arc<dyn RouteRegistrar>> {
-        read(&self.routes).clone()
-    }
-
-    /// Every registered background task, in registration order.
-    #[must_use]
-    pub fn tasks(&self) -> Vec<Arc<dyn BackgroundTask>> {
-        read(&self.tasks).clone()
-    }
-
-    /// The state handle set registered under `T`, or `None` while its
-    /// subsystem has not registered - a graceful no-op the consumer
-    /// branches on.
-    #[must_use]
-    pub fn state<T>(&self) -> Option<Arc<T>>
-    where
-        T: ?Sized + Send + Sync + 'static,
-    {
-        read(&self.state).get::<T>()
-    }
-
-    /// The producer sink registered under `T`, or `None` while its
-    /// subsystem has not registered.
-    #[must_use]
-    pub fn sink<T>(&self) -> Option<Arc<T>>
-    where
-        T: ?Sized + Send + Sync + 'static,
-    {
-        read(&self.sinks).get::<T>()
-    }
-
-    /// [`Registry::state`] made total at the composition root: a missing
-    /// contribution is a boot failure naming `T`, not a later panic.
-    ///
-    /// # Errors
-    /// Returns [`MissingContribution`] naming `T` when no subsystem has
-    /// registered it.
-    pub fn require<T>(&self) -> Result<Arc<T>, MissingContribution>
-    where
-        T: ?Sized + Send + Sync + 'static,
-    {
-        self.state::<T>().ok_or(MissingContribution {
-            contribution: std::any::type_name::<T>(),
-        })
-    }
-
-    /// The intent-named push facade over the producer sink collection,
-    /// for subsystems that report what happened without naming another
-    /// subsystem's bus.
-    #[must_use]
-    pub fn push(&self) -> Push {
-        Push::new(self.clone())
-    }
-}
-
-/// A required contribution is absent from the registry: the composition
-/// root failed to register a subsystem before sharing state.
-#[derive(Debug)]
-pub struct MissingContribution {
-    contribution: &'static str,
-}
-
-impl MissingContribution {
-    /// The fully qualified type name of the missing contribution.
-    #[must_use]
-    pub fn contribution(&self) -> &'static str {
-        self.contribution
-    }
-}
-
-impl fmt::Display for MissingContribution {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(formatter, "no subsystem registered `{}`", self.contribution)
-    }
-}
-
-impl std::error::Error for MissingContribution {}
-
-/// The registration guard: keeps the contribution registered while
-/// held.
-///
-/// Dropping the guard removes the contribution from its collection,
-/// unless the key has since been re-registered - a stale guard never
-/// evicts a newer occupant.
-#[must_use = "dropping the guard deregisters the contribution"]
-pub struct Registration {
-    remove: Option<Box<dyn FnOnce() + Send + Sync>>,
-}
-
-impl Registration {
-    /// Builds the guard from its deregistration action.
-    fn new(remove: impl FnOnce() + Send + Sync + 'static) -> Self {
-        Self {
-            remove: Some(Box::new(remove)),
-        }
-    }
-}
-
-impl Drop for Registration {
-    fn drop(&mut self) {
-        if let Some(remove) = self.remove.take() {
-            remove();
-        }
-    }
-}
-
-impl fmt::Debug for Registration {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("Registration").finish()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::traits::{
-        BackgroundTaskAdapter, RouteRegistrarAdapter, ShutdownHandle, StatusSink, StatusSinkAdapter,
-    };
-
-    #[test]
-    fn registered_state_is_served_by_type() {
-        let registry = Registry::new();
-        let _registration = registry.register_state(Arc::new("handles".to_string()));
-        let handles = registry
-            .state::<String>()
-            .expect("the registered handle set is served");
-        assert_eq!(handles.as_str(), "handles");
-    }
-
-    #[test]
-    fn state_of_an_unregistered_type_is_none() {
-        let registry = Registry::new();
-        let _registration = registry.register_state(Arc::new("handles".to_string()));
-        assert!(
-            registry.state::<u64>().is_none(),
-            "a type no subsystem registered serves nothing"
-        );
-    }
-
-    #[test]
-    fn dropping_the_registration_empties_the_key() {
-        let registry = Registry::new();
-        let registration = registry.register_state(Arc::new("handles".to_string()));
-        assert!(registry.state::<String>().is_some());
-        drop(registration);
-        assert!(
-            registry.state::<String>().is_none(),
-            "the key empties when the guard drops"
-        );
-    }
-
-    #[test]
-    fn route_registrants_are_served_in_registration_order() {
-        let registry = Registry::new();
-        let first: Arc<dyn RouteRegistrar> =
-            Arc::new(RouteRegistrarAdapter::new(axum::Router::new));
-        let second: Arc<dyn RouteRegistrar> =
-            Arc::new(RouteRegistrarAdapter::new(axum::Router::new));
-        let _first_guard = registry.register_routes(Arc::clone(&first));
-        let _second_guard = registry.register_routes(Arc::clone(&second));
-        let routes = registry.routes();
-        assert_eq!(routes.len(), 2, "both registrants are served");
-        assert!(
-            Arc::ptr_eq(&routes[0], &first) && Arc::ptr_eq(&routes[1], &second),
-            "registrants are served in registration order"
-        );
-    }
-
-    #[test]
-    fn a_registered_task_is_served_until_its_guard_drops() {
-        let registry = Registry::new();
-        let task: Arc<dyn BackgroundTask> = Arc::new(BackgroundTaskAdapter::new(|| {
-            ShutdownHandle::new(|| async {})
-        }));
-        let registration = registry.register_task(Arc::clone(&task));
-        let tasks = registry.tasks();
-        assert_eq!(tasks.len(), 1, "the registered task is served");
-        assert!(
-            Arc::ptr_eq(&tasks[0], &task),
-            "the served task is the registered one"
-        );
-        drop(registration);
-        assert!(
-            registry.tasks().is_empty(),
-            "dropping the guard removes the task"
-        );
-    }
-
-    #[test]
-    fn require_on_a_missing_key_names_the_missing_type() {
-        let registry = Registry::new();
-        let error = registry
-            .require::<String>()
-            .expect_err("an unregistered type fails require");
-        assert_eq!(error.contribution(), std::any::type_name::<String>());
-        assert!(
-            error.to_string().contains("String"),
-            "the error message names the missing type: {error}"
-        );
-    }
-
-    #[test]
-    fn a_sink_round_trips_through_its_trait_type() {
-        let registry = Registry::new();
-        let _registration =
-            registry.register_sink::<dyn StatusSink>(Arc::new(StatusSinkAdapter::new(|_| {})));
-        assert!(
-            registry.sink::<dyn StatusSink>().is_some(),
-            "the sink collection serves the registered trait object"
-        );
-    }
-}
diff --git a/crates/workshop/registry/src/traits.rs b/crates/workshop/registry/src/traits.rs
deleted file mode 100644
index 3e35e21b4..000000000
--- a/crates/workshop/registry/src/traits.rs
+++ /dev/null
@@ -1,448 +0,0 @@
-//! The sealed subsystem traits: one per contribution kind in the
-//! decomposition's inventory (routes, background tasks, push channels
-//! and sinks, shared views).
-//!
-//! All are sealed behind a private supertrait, so only this crate can
-//! implement them. A registrant plugs its subsystem in through an
-//! adapter this crate provides, never by implementing a trait
-//! downstream.
-
-use std::fmt;
-use std::path::PathBuf;
-use std::pin::Pin;
-
-use axum::Router;
-use tokio::sync::{broadcast, watch};
-
-use workshop_protocol::StatusBarUpdate;
-
-/// The sealing boundary: a private empty supertrait no downstream crate
-/// can name, so the subsystem traits below cannot be implemented outside
-/// this crate.
-mod sealed {
-    /// The private empty supertrait sealing every subsystem trait.
-    pub trait Sealed {}
-}
-use sealed::Sealed;
-
-/// Route registration: a subsystem contributes its HTTP routes, merged
-/// into the server's API router at composition time. Registered by the
-/// `handles.rs` of `workshop-workspace` and `workshop-user-state`, and by
-/// the server's sessions subsystem.
-pub trait RouteRegistrar: Sealed + Send + Sync {
-    /// The subsystem's routes, with their state already applied.
-    fn routes(&self) -> Router;
-}
-
-/// Background task spawning: a subsystem starts one long-lived task, so
-/// the composition root holds no `tokio::spawn` calls of its own.
-/// Registered by the `handles.rs` of `workshop-gateway` and
-/// `workshop-workspace`, and by the server's sessions subsystem.
-pub trait BackgroundTask: Sealed + Send + Sync {
-    /// Spawns the task; the returned handle is the server's shutdown
-    /// lever.
-    fn spawn(&self) -> ShutdownHandle;
-}
-
-/// The boxed closure producing the boxed stop-and-await future one
-/// task's shutdown resolves to.
-type Stop = Box<dyn FnOnce() -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>;
-
-/// The shutdown lever of one spawned background task: a concrete type,
-/// never a trait with an `async fn` method, which would not be
-/// dyn-compatible. Signaling and awaiting are one call, so the server's
-/// graceful-shutdown closure cannot fire a stop it forgets to await.
-pub struct ShutdownHandle {
-    stop: Option<Stop>,
-}
-
-impl ShutdownHandle {
-    /// Wraps a closure yielding the task's stop-and-await future.
-    #[must_use]
-    pub fn new<F, Fut>(stop: F) -> Self
-    where
-        F: FnOnce() -> Fut + Send + 'static,
-        Fut: Future<Output = ()> + Send + 'static,
-    {
-        Self {
-            stop: Some(Box::new(move || Box::pin(stop()))),
-        }
-    }
-
-    /// Signals the task to stop and waits for it to finish.
-    pub async fn shutdown(mut self) {
-        if let Some(stop) = self.stop.take() {
-            stop().await;
-        }
-    }
-}
-
-impl fmt::Debug for ShutdownHandle {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("ShutdownHandle").finish()
-    }
-}
-
-/// The status-bar push channel: the retained snapshot plus live
-/// subscription every `/ws` session forwards. Registered by
-/// `workshop-status`'s `handles.rs`.
-pub trait StatusChannel: Sealed + Send + Sync {
-    /// Subscribes to every update sent from this call onward.
-    fn subscribe(&self) -> broadcast::Receiver<StatusBarUpdate>;
-    /// The most recently emitted update, retained so a session
-    /// connecting later can send the current status as its snapshot.
-    fn latest(&self) -> Option<StatusBarUpdate>;
-}
-
-/// The status producer sink: the status subsystem's receiving end for
-/// [`StatusBarUpdate`]s emitted by subsystems in other crates. The
-/// [`Push`](crate::Push) facade builds the frames; the sink only
-/// accepts them, so a producer in a same-tier crate never names the
-/// status bus's type. Registered by `workshop-status`'s `handles.rs`.
-pub trait StatusSink: Sealed + Send + Sync {
-    /// Emits one update onto the status bus.
-    fn emit(&self, update: StatusBarUpdate);
-}
-
-/// The catalog producer sink: the menu subsystem's receiving end for
-/// refreshed model catalogs published by the gateway subsystem.
-/// Registered by `workshop-menu`'s `handles.rs`.
-pub trait CatalogSink: Sealed + Send + Sync {
-    /// Publishes one complete model catalog snapshot.
-    fn publish(&self, models: Vec<serde_json::Value>);
-}
-
-/// The menu producer sink: the menu subsystem's receiving end for the
-/// workbench mutators the gateway subsystem drives - reachability
-/// verdicts, profile state, and selection restores. Registered by
-/// `workshop-menu`'s `handles.rs`.
-pub trait MenuSink: Sealed + Send + Sync {
-    /// Records the heartbeat's verdict on gateway reachability.
-    fn set_gateway_reachable(&self, reachable: bool);
-    /// Records the gateway's profile list and active profile.
-    fn set_profiles(&self, profiles: Vec<String>, active: Option<String>);
-    /// Restores a boot-time selection when none is applied.
-    fn restore_selection(&self);
-    /// Revalidates the selection against the catalog just published.
-    fn reconcile_catalog(&self);
-}
-
-/// A [`StatusChannel`] backed by two closures over the status bus: the
-/// registration adapter for the status subsystem. The registry's traits
-/// are sealed, so the registrant plugs its bus in through this adapter
-/// rather than implementing the trait itself.
-pub struct StatusChannelAdapter<S, L> {
-    subscribe: S,
-    latest: L,
-}
-
-impl<S, L> StatusChannelAdapter<S, L>
-where
-    S: Fn() -> broadcast::Receiver<StatusBarUpdate> + Send + Sync,
-    L: Fn() -> Option<StatusBarUpdate> + Send + Sync,
-{
-    /// Builds the adapter from the bus's subscribe and latest closures.
-    #[must_use]
-    pub fn new(subscribe: S, latest: L) -> Self {
-        Self { subscribe, latest }
-    }
-}
-
-impl<S, L> Sealed for StatusChannelAdapter<S, L>
-where
-    S: Fn() -> broadcast::Receiver<StatusBarUpdate> + Send + Sync,
-    L: Fn() -> Option<StatusBarUpdate> + Send + Sync,
-{
-}
-
-impl<S, L> StatusChannel for StatusChannelAdapter<S, L>
-where
-    S: Fn() -> broadcast::Receiver<StatusBarUpdate> + Send + Sync,
-    L: Fn() -> Option<StatusBarUpdate> + Send + Sync,
-{
-    fn subscribe(&self) -> broadcast::Receiver<StatusBarUpdate> {
-        (self.subscribe)()
-    }
-
-    fn latest(&self) -> Option<StatusBarUpdate> {
-        (self.latest)()
-    }
-}
-
-impl<S, L> fmt::Debug for StatusChannelAdapter<S, L> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("StatusChannelAdapter").finish()
-    }
-}
-
-/// A [`StatusSink`] backed by one closure over the status bus: the
-/// registration adapter for the status subsystem's producer side. The
-/// registry's traits are sealed, so the registrant plugs its bus in
-/// through this adapter rather than implementing the trait itself.
-pub struct StatusSinkAdapter<E> {
-    emit: E,
-}
-
-impl<E> StatusSinkAdapter<E>
-where
-    E: Fn(StatusBarUpdate) + Send + Sync,
-{
-    /// Builds the adapter from the bus's emit closure.
-    #[must_use]
-    pub fn new(emit: E) -> Self {
-        Self { emit }
-    }
-}
-
-impl<E> Sealed for StatusSinkAdapter<E> where E: Fn(StatusBarUpdate) + Send + Sync {}
-
-impl<E> StatusSink for StatusSinkAdapter<E>
-where
-    E: Fn(StatusBarUpdate) + Send + Sync,
-{
-    fn emit(&self, update: StatusBarUpdate) {
-        (self.emit)(update);
-    }
-}
-
-impl<E> fmt::Debug for StatusSinkAdapter<E> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("StatusSinkAdapter").finish()
-    }
-}
-
-/// A [`CatalogSink`] backed by one closure over the catalog bus: the
-/// registration adapter for the menu subsystem's catalog channel.
-pub struct CatalogSinkAdapter<P> {
-    publish: P,
-}
-
-impl<P> CatalogSinkAdapter<P>
-where
-    P: Fn(Vec<serde_json::Value>) + Send + Sync,
-{
-    /// Builds the adapter from the bus's publish closure.
-    #[must_use]
-    pub fn new(publish: P) -> Self {
-        Self { publish }
-    }
-}
-
-impl<P> Sealed for CatalogSinkAdapter<P> where P: Fn(Vec<serde_json::Value>) + Send + Sync {}
-
-impl<P> CatalogSink for CatalogSinkAdapter<P>
-where
-    P: Fn(Vec<serde_json::Value>) + Send + Sync,
-{
-    fn publish(&self, models: Vec<serde_json::Value>) {
-        (self.publish)(models);
-    }
-}
-
-impl<P> fmt::Debug for CatalogSinkAdapter<P> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("CatalogSinkAdapter").finish()
-    }
-}
-
-/// The workspace subsystem's granted-root view: the narrow state handle
-/// the server's agent-session bindings read through the registry.
-/// Registered by `workshop-workspace`'s `handles.rs`.
-pub trait WorkspaceRoots: Sealed + Send + Sync {
-    /// The granted workspace roots in stable sorted order.
-    fn granted_roots(&self) -> Vec<PathBuf>;
-    /// A watch on the grant-set generation: it changes on every grant,
-    /// revoke, and workspace switch, so a consumer re-reads
-    /// [`WorkspaceRoots::granted_roots`] when it wakes.
-    fn subscribe(&self) -> watch::Receiver<u64>;
-}
-
-/// A [`WorkspaceRoots`] backed by two closures over the workspace's grant
-/// set, one reading the roots and one subscribing to its generation: the
-/// registration adapter for the workspace subsystem. The registry's
-/// traits are sealed, so the registrant plugs its state in through this
-/// adapter rather than implementing the trait itself.
-pub struct WorkspaceRootsAdapter<F, S> {
-    roots: F,
-    subscribe: S,
-}
-
-impl<F, S> WorkspaceRootsAdapter<F, S>
-where
-    F: Fn() -> Vec<PathBuf> + Send + Sync,
-    S: Fn() -> watch::Receiver<u64> + Send + Sync,
-{
-    /// Builds the adapter from the workspace's granted-roots closure and
-    /// its grant-set generation subscribe closure.
-    #[must_use]
-    pub fn new(roots: F, subscribe: S) -> Self {
-        Self { roots, subscribe }
-    }
-}
-
-impl<F, S> Sealed for WorkspaceRootsAdapter<F, S>
-where
-    F: Fn() -> Vec<PathBuf> + Send + Sync,
-    S: Fn() -> watch::Receiver<u64> + Send + Sync,
-{
-}
-
-impl<F, S> WorkspaceRoots for WorkspaceRootsAdapter<F, S>
-where
-    F: Fn() -> Vec<PathBuf> + Send + Sync,
-    S: Fn() -> watch::Receiver<u64> + Send + Sync,
-{
-    fn granted_roots(&self) -> Vec<PathBuf> {
-        (self.roots)()
-    }
-
-    fn subscribe(&self) -> watch::Receiver<u64> {
-        (self.subscribe)()
-    }
-}
-
-impl<F, S> fmt::Debug for WorkspaceRootsAdapter<F, S> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("WorkspaceRootsAdapter").finish()
-    }
-}
-
-/// A [`RouteRegistrar`] backed by one closure building the subsystem's
-/// router: the registration adapter for a subsystem's routes. The
-/// registry's traits are sealed, so the registrant plugs its routes in
-/// through this adapter rather than implementing the trait itself.
-pub struct RouteRegistrarAdapter<F> {
-    build: F,
-}
-
-impl<F> RouteRegistrarAdapter<F>
-where
-    F: Fn() -> Router + Send + Sync,
-{
-    /// Builds the adapter from the subsystem's router constructor.
-    #[must_use]
-    pub fn new(build: F) -> Self {
-        Self { build }
-    }
-}
-
-impl<F> Sealed for RouteRegistrarAdapter<F> where F: Fn() -> Router + Send + Sync {}
-
-impl<F> RouteRegistrar for RouteRegistrarAdapter<F>
-where
-    F: Fn() -> Router + Send + Sync,
-{
-    fn routes(&self) -> Router {
-        (self.build)()
-    }
-}
-
-impl<F> fmt::Debug for RouteRegistrarAdapter<F> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("RouteRegistrarAdapter").finish()
-    }
-}
-
-/// A [`BackgroundTask`] backed by one closure spawning the subsystem's
-/// task: the registration adapter for a background task. The registry's
-/// traits are sealed, so the registrant plugs its task in through this
-/// adapter rather than implementing the trait itself.
-pub struct BackgroundTaskAdapter<F> {
-    spawn: F,
-}
-
-impl<F> BackgroundTaskAdapter<F>
-where
-    F: Fn() -> ShutdownHandle + Send + Sync,
-{
-    /// Builds the adapter from the subsystem's spawn closure.
-    #[must_use]
-    pub fn new(spawn: F) -> Self {
-        Self { spawn }
-    }
-}
-
-impl<F> Sealed for BackgroundTaskAdapter<F> where F: Fn() -> ShutdownHandle + Send + Sync {}
-
-impl<F> BackgroundTask for BackgroundTaskAdapter<F>
-where
-    F: Fn() -> ShutdownHandle + Send + Sync,
-{
-    fn spawn(&self) -> ShutdownHandle {
-        (self.spawn)()
-    }
-}
-
-impl<F> fmt::Debug for BackgroundTaskAdapter<F> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("BackgroundTaskAdapter").finish()
-    }
-}
-
-/// A [`MenuSink`] backed by closures over the menu bus's mutators: the
-/// registration adapter for the menu subsystem's workbench state.
-pub struct MenuSinkAdapter<R, P, S, C> {
-    reachable: R,
-    profiles: P,
-    restore: S,
-    reconcile: C,
-}
-
-impl<R, P, S, C> MenuSinkAdapter<R, P, S, C>
-where
-    R: Fn(bool) + Send + Sync,
-    P: Fn(Vec<String>, Option<String>) + Send + Sync,
-    S: Fn() + Send + Sync,
-    C: Fn() + Send + Sync,
-{
-    /// Builds the adapter from the menu bus's mutator closures, in the
-    /// [`MenuSink`] trait's method order.
-    #[must_use]
-    pub fn new(reachable: R, profiles: P, restore: S, reconcile: C) -> Self {
-        Self {
-            reachable,
-            profiles,
-            restore,
-            reconcile,
-        }
-    }
-}
-
-impl<R, P, S, C> Sealed for MenuSinkAdapter<R, P, S, C>
-where
-    R: Fn(bool) + Send + Sync,
-    P: Fn(Vec<String>, Option<String>) + Send + Sync,
-    S: Fn() + Send + Sync,
-    C: Fn() + Send + Sync,
-{
-}
-
-impl<R, P, S, C> MenuSink for MenuSinkAdapter<R, P, S, C>
-where
-    R: Fn(bool) + Send + Sync,
-    P: Fn(Vec<String>, Option<String>) + Send + Sync,
-    S: Fn() + Send + Sync,
-    C: Fn() + Send + Sync,
-{
-    fn set_gateway_reachable(&self, reachable: bool) {
-        (self.reachable)(reachable);
-    }
-
-    fn set_profiles(&self, profiles: Vec<String>, active: Option<String>) {
-        (self.profiles)(profiles, active);
-    }
-
-    fn restore_selection(&self) {
-        (self.restore)();
-    }
-
-    fn reconcile_catalog(&self) {
-        (self.reconcile)();
-    }
-}
-
-impl<R, P, S, C> fmt::Debug for MenuSinkAdapter<R, P, S, C> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.debug_struct("MenuSinkAdapter").finish()
-    }
-}
diff --git a/crates/workshop/registry/tests/it/main.rs b/crates/workshop/registry/tests/it/main.rs
deleted file mode 100644
index 3b2788dae..000000000
--- a/crates/workshop/registry/tests/it/main.rs
+++ /dev/null
@@ -1,225 +0,0 @@
-//! Integration tests for `workshop-registry`: the contribution
-//! collection contract - routes and tasks as ordered vectors, state
-//! handles and push sinks keyed by type.
-
-use std::sync::{Arc, Mutex, PoisonError};
-
-use tokio::sync::{broadcast, watch};
-
-use workshop_protocol::{Activity, Severity, StatusBarUpdate};
-use workshop_registry::{Registry, StatusChannel, StatusChannelAdapter};
-
-/// The adapter's boxed subscribe closure type.
-type Subscribe = Box<dyn Fn() -> broadcast::Receiver<StatusBarUpdate> + Send + Sync>;
-/// The adapter's boxed latest-snapshot closure type.
-type Latest = Box<dyn Fn() -> Option<StatusBarUpdate> + Send + Sync>;
-
-/// A hand-rolled status bus plus its registration adapter: a broadcast
-/// sender and a retained snapshot, mirroring the registrant's real bus.
-struct TestBus {
-    adapter: StatusChannelAdapter<Subscribe, Latest>,
-    sender: broadcast::Sender<StatusBarUpdate>,
-    latest: Arc<Mutex<Option<StatusBarUpdate>>>,
-}
-
-/// Builds a test bus with a fresh channel and no snapshot.
-fn status_adapter() -> TestBus {
-    let (sender, _) = broadcast::channel(4);
-    let latest = Arc::new(Mutex::new(None));
-    let subscribe: Subscribe = Box::new({
-        let sender = sender.clone();
-        move || sender.subscribe()
-    });
-    let latest_snapshot: Latest = Box::new({
-        let latest = Arc::clone(&latest);
-        move || {
-            latest
-                .lock()
-                .unwrap_or_else(PoisonError::into_inner)
-                .clone()
-        }
-    });
-    TestBus {
-        adapter: StatusChannelAdapter::new(subscribe, latest_snapshot),
-        sender,
-        latest,
-    }
-}
-
-/// A status update with only a label.
-fn update(label: &str) -> StatusBarUpdate {
-    StatusBarUpdate {
-        label: label.to_string(),
-        description: String::new(),
-        busy: false,
-        severity: Severity::Info,
-        activity: Activity::General,
-    }
-}
-
-#[test]
-fn an_empty_registry_serves_no_contributions() {
-    let registry = Registry::new();
-    assert!(registry.routes().is_empty());
-    assert!(registry.tasks().is_empty());
-    assert!(registry.state::<String>().is_none());
-    assert!(registry.state::<dyn StatusChannel>().is_none());
-}
-
-#[test]
-fn a_registered_status_channel_serves_subscribe_and_latest() {
-    let registry = Registry::new();
-    let bus = status_adapter();
-    let _registration = registry.register_state::<dyn StatusChannel>(Arc::new(bus.adapter));
-    let channel = registry
-        .state::<dyn StatusChannel>()
-        .expect("the registered channel is served");
-    *bus.latest.lock().unwrap_or_else(PoisonError::into_inner) = Some(update("Ready"));
-    assert_eq!(
-        channel.latest().map(|update| update.label),
-        Some("Ready".to_string()),
-        "the collection serves the registrant's retained snapshot"
-    );
-    let mut receiver = channel.subscribe();
-    bus.sender
-        .send(update("Working"))
-        .expect("a receiver is subscribed");
-    assert_eq!(
-        receiver
-            .try_recv()
-            .expect("the send reaches the subscriber")
-            .label,
-        "Working"
-    );
-}
-
-#[test]
-fn dropping_the_guard_deregisters_the_contribution() {
-    let registry = Registry::new();
-    let bus = status_adapter();
-    let registration = registry.register_state::<dyn StatusChannel>(Arc::new(bus.adapter));
-    assert!(registry.state::<dyn StatusChannel>().is_some());
-    drop(registration);
-    assert!(
-        registry.state::<dyn StatusChannel>().is_none(),
-        "the key empties when the guard drops"
-    );
-}
-
-#[test]
-fn a_stale_guard_never_evicts_a_newer_occupant() {
-    let registry = Registry::new();
-    let stale = registry.register_state::<dyn StatusChannel>(Arc::new(status_adapter().adapter));
-    let _current = registry.register_state::<dyn StatusChannel>(Arc::new(status_adapter().adapter));
-    drop(stale);
-    assert!(
-        registry.state::<dyn StatusChannel>().is_some(),
-        "the replacement survives the stale guard's drop"
-    );
-}
-
-#[test]
-fn registry_clones_share_the_same_collections() {
-    let registry = Registry::new();
-    let clone = registry.clone();
-    let _registration =
-        registry.register_state::<dyn StatusChannel>(Arc::new(status_adapter().adapter));
-    assert!(
-        clone.state::<dyn StatusChannel>().is_some(),
-        "a registration through one handle is visible through every clone"
-    );
-}
-
-#[test]
-fn the_workspace_roots_handle_serves_the_registrants_grants() {
-    use std::path::PathBuf;
-
-    use workshop_registry::{WorkspaceRoots, WorkspaceRootsAdapter};
-
-    let registry = Registry::new();
-    assert!(
-        registry.state::<dyn WorkspaceRoots>().is_none(),
-        "an unregistered roots handle is a graceful no-op"
-    );
-    let registration = registry.register_state::<dyn WorkspaceRoots>(Arc::new(
-        WorkspaceRootsAdapter::new(|| vec![PathBuf::from("/granted")], || watch::channel(0).1),
-    ));
-    let roots = registry
-        .state::<dyn WorkspaceRoots>()
-        .expect("the registered roots handle is served");
-    assert_eq!(roots.granted_roots(), vec![PathBuf::from("/granted")]);
-    drop(registration);
-    assert!(
-        registry.state::<dyn WorkspaceRoots>().is_none(),
-        "the key empties when the guard drops"
-    );
-}
-
-#[test]
-fn the_workspace_roots_handle_serves_the_registrants_change_signal() {
-    use std::path::PathBuf;
-
-    use workshop_registry::{WorkspaceRoots, WorkspaceRootsAdapter};
-
-    let registry = Registry::new();
-    let generation = watch::Sender::new(0_u64);
-    let _registration = registry.register_state::<dyn WorkspaceRoots>(Arc::new(
-        WorkspaceRootsAdapter::new(Vec::<PathBuf>::new, {
-            let generation = generation.clone();
-            move || generation.subscribe()
-        }),
-    ));
-    let mut receiver = registry
-        .state::<dyn WorkspaceRoots>()
-        .expect("the registered roots handle is served")
-        .subscribe();
-    generation.send_modify(|value| *value += 1);
-    assert!(
-        receiver
-            .has_changed()
-            .expect("the registrant's sender is alive"),
-        "a bump through the registrant's sender reaches the subscriber"
-    );
-    assert_eq!(*receiver.borrow_and_update(), 1);
-}
-
-#[test]
-fn route_registrants_build_their_routers_in_registration_order() {
-    use workshop_registry::RouteRegistrarAdapter;
-
-    let registry = Registry::new();
-    assert!(registry.routes().is_empty());
-    let first: Arc<dyn workshop_registry::RouteRegistrar> =
-        Arc::new(RouteRegistrarAdapter::new(axum::Router::new));
-    let second: Arc<dyn workshop_registry::RouteRegistrar> =
-        Arc::new(RouteRegistrarAdapter::new(axum::Router::new));
-    let first_guard = registry.register_routes(Arc::clone(&first));
-    let _second_guard = registry.register_routes(Arc::clone(&second));
-    let routes = registry.routes();
-    assert_eq!(routes.len(), 2, "both registrants are served");
-    assert!(
-        Arc::ptr_eq(&routes[0], &first) && Arc::ptr_eq(&routes[1], &second),
-        "registrants are served in registration order"
-    );
-    drop(first_guard);
-    assert_eq!(
-        registry.routes().len(),
-        1,
-        "a dropped guard removes only its own registrant"
-    );
-}
-
-#[test]
-fn a_registered_state_handle_downcasts_to_its_concrete_type() {
-    let registry = Registry::new();
-    assert!(registry.state::<String>().is_none());
-    let _registration = registry.register_state(Arc::new("handles".to_string()));
-    let handles = registry
-        .state::<String>()
-        .expect("the registered handle set is served");
-    assert_eq!(handles.as_str(), "handles");
-    assert!(
-        registry.state::<u64>().is_none(),
-        "state handles are keyed by type"
-    );
-}
diff --git a/crates/workshop/run-log/Cargo.toml b/crates/workshop/run-log/Cargo.toml
deleted file mode 100644
index 2f6947e59..000000000
--- a/crates/workshop/run-log/Cargo.toml
+++ /dev/null
@@ -1,25 +0,0 @@
-[package]
-name = "workshop-run-log"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-# The one crate a Host depends on: the recorder trait and the record
-# values the log stores and returns, and the error a run ends with and
-# its code, which the log stores and rebuilds. The fidelity suite also
-# round-trips a run's events through the log.
-runvil.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio = { workspace = true, features = ["fs", "sync"] }
-turso.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/run-log/README.md b/crates/workshop/run-log/README.md
deleted file mode 100644
index 2104a527b..000000000
--- a/crates/workshop/run-log/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Workshop run log
-
-This crate keeps Workshop's append-only record of every run: each effect, answer, and event the Harness records, in order, stored in a local database. Workshop, as the Host, supplies it to the Harness as each run's recorder, and nothing reads a record back into the Engine.
diff --git a/crates/workshop/run-log/src/append.rs b/crates/workshop/run-log/src/append.rs
deleted file mode 100644
index 69db0dd6f..000000000
--- a/crates/workshop/run-log/src/append.rs
+++ /dev/null
@@ -1,236 +0,0 @@
-//! The write path: open a log, begin a run, append records, end the run.
-
-use std::fmt;
-use std::io;
-use std::path::Path;
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use runvil::Error;
-
-use crate::error::LogError;
-use crate::record::{Record, RunId, RunMeta, Seq};
-use crate::schema;
-
-/// An open run log: one connection to one Turso database holding the
-/// `runs` and `records` tables.
-///
-/// Every method takes `&mut self`: the effect loop is the log's one
-/// writer, and exclusive access is what lets `append` read the next `seq`
-/// and insert under it without a transaction. [`TursoRecorder`](crate::TursoRecorder)
-/// serves several tasks and wraps the log in its own lock.
-pub struct RunLog {
-    conn: turso::Connection,
-}
-
-impl fmt::Debug for RunLog {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("RunLog").finish_non_exhaustive()
-    }
-}
-
-impl RunLog {
-    /// Opens the log at `path`, creating the file and the schema when
-    /// absent. The parent directory must already exist: this creates the
-    /// file, never a directory.
-    ///
-    /// # Errors
-    /// Returns [`LogError::Io`] when `path` is not UTF-8 (Turso addresses
-    /// databases by string), and [`LogError::Database`] when the database
-    /// cannot open the file or apply the schema.
-    pub async fn open(path: &Path) -> Result<Self, LogError> {
-        let name = path.to_str().ok_or_else(|| {
-            LogError::io(
-                format!("open {}", path.display()),
-                io::Error::new(io::ErrorKind::InvalidInput, "run log path must be utf-8"),
-            )
-        })?;
-        Self::open_str(name).await
-    }
-
-    /// Opens a log that lives only as long as this value: for tests and
-    /// for Hosts that keep no history.
-    ///
-    /// # Errors
-    /// Returns [`LogError::Database`] when the database cannot build the
-    /// database or apply the schema.
-    pub async fn in_memory() -> Result<Self, LogError> {
-        Self::open_str(":memory:").await
-    }
-
-    async fn open_str(path: &str) -> Result<Self, LogError> {
-        Self::over(connect(path).await?).await
-    }
-
-    /// The log over `conn`, with the schema applied.
-    async fn over(conn: turso::Connection) -> Result<Self, LogError> {
-        conn.execute_batch(schema::SCHEMA).await?;
-        Ok(Self { conn })
-    }
-
-    /// Opens a run of `agent`, the agent the Host launched, and returns its
-    /// identity. `meta.started_at` is stored as its UTC milliseconds since
-    /// the Unix epoch; the log stamps nothing at begin.
-    ///
-    /// # Errors
-    /// Returns [`LogError::Database`] when the row cannot be written.
-    pub async fn begin_run(&mut self, meta: RunMeta, agent: &str) -> Result<RunId, LogError> {
-        self.conn
-            .execute(
-                schema::INSERT_RUN,
-                (
-                    agent,
-                    meta.seed.to_string(),
-                    i64::from(meta.flags),
-                    meta.started_at.unix_millis(),
-                ),
-            )
-            .await?;
-        Ok(RunId::from_raw(self.conn.last_insert_rowid()))
-    }
-
-    /// Appends one record to `run` and returns the position the log
-    /// assigned it: one past the run's last, `0` for the first. The record
-    /// is stamped with the wall clock at append.
-    ///
-    /// # Errors
-    /// Returns [`LogError::UnknownRun`] when `run` was never begun here,
-    /// [`LogError::RunEnded`] when it has ended, [`LogError::Payload`]
-    /// when the payload does not serialize, and [`LogError::Database`]
-    /// when the database refuses the write.
-    pub async fn append(&mut self, run: RunId, record: Record) -> Result<Seq, LogError> {
-        self.require_open(run).await?;
-        let seq = self.next_seq(run).await?;
-        let payload = serde_json::to_string(&record.payload)?;
-        self.conn
-            .execute(
-                schema::INSERT_RECORD,
-                (
-                    run.get(),
-                    signed(seq.get()),
-                    record.task_id,
-                    i64::from(record.task_seq),
-                    record.kind.as_str(),
-                    record.effect_id.map(signed),
-                    payload,
-                    now_ms(),
-                ),
-            )
-            .await?;
-        Ok(seq)
-    }
-
-    /// Closes `run` with its `result`, stamping `ended_at` with the wall
-    /// clock. A run closes exactly once. `Ok` stores the final text under
-    /// the status `completed`. `Err` stores the error's code tag and its
-    /// located message under the status `canceled` when the error is a
-    /// cancel, and `failed` otherwise.
-    ///
-    /// # Errors
-    /// Returns [`LogError::UnknownRun`] when `run` was never begun here,
-    /// [`LogError::RunEnded`] when it has already closed, and
-    /// [`LogError::Database`] when the database refuses the write.
-    pub async fn end_run(
-        &mut self,
-        run: RunId,
-        result: Result<String, Error>,
-    ) -> Result<(), LogError> {
-        self.require_open(run).await?;
-        let (status, final_text, error_code, error_message) = match result {
-            Ok(final_text) => ("completed", Some(final_text), None, None),
-            Err(error) => {
-                let status = if error.is_canceled() {
-                    "canceled"
-                } else {
-                    "failed"
-                };
-                let message = error.located_message();
-                (status, None, Some(error.code.tag()), Some(message))
-            }
-        };
-        let changed = self
-            .conn
-            .execute(
-                schema::UPDATE_RUN_ENDED,
-                (
-                    run.get(),
-                    now_ms(),
-                    status,
-                    final_text,
-                    error_code,
-                    error_message,
-                ),
-            )
-            .await?;
-        // `require_open` saw the row open a moment ago and this value has
-        // the only connection, so zero changes cannot happen; the check
-        // keeps the exactly-once rule honest against a shared file.
-        if changed == 0 {
-            return Err(LogError::RunEnded(run));
-        }
-        Ok(())
-    }
-
-    /// The connection, for the read side.
-    pub(crate) const fn conn(&self) -> &turso::Connection {
-        &self.conn
-    }
-
-    /// Fails unless `run` exists and has not ended.
-    async fn require_open(&self, run: RunId) -> Result<(), LogError> {
-        let mut rows = self
-            .conn
-            .query(schema::SELECT_RUN_ENDED_AT, (run.get(),))
-            .await?;
-        match rows.next().await? {
-            None => Err(LogError::UnknownRun(run)),
-            Some(row) => match row.get::<Option<i64>>(0)? {
-                None => Ok(()),
-                Some(_) => Err(LogError::RunEnded(run)),
-            },
-        }
-    }
-
-    /// One past `run`'s last `seq`; `0` when it has no records.
-    async fn next_seq(&self, run: RunId) -> Result<Seq, LogError> {
-        let mut rows = self
-            .conn
-            .query(schema::SELECT_NEXT_SEQ, (run.get(),))
-            .await?;
-        let next = match rows.next().await? {
-            Some(row) => row.get::<i64>(0)?,
-            None => 0,
-        };
-        u64::try_from(next)
-            .map(Seq::from_raw)
-            .map_err(|_| LogError::Corrupt(format!("expected a non-negative seq, found {next}")))
-    }
-}
-
-/// One connection to the database at `path`, which Turso creates when
-/// absent.
-async fn connect(path: &str) -> Result<turso::Connection, LogError> {
-    let database = turso::Builder::new_local(path).build().await?;
-    Ok(database.connect()?)
-}
-
-/// A `u64` as the `i64` SQLite stores: the same bits, so the round trip
-/// through [`unsigned`] is lossless. Values past `i64::MAX` read as
-/// negative in raw SQL, which nothing here does.
-const fn signed(value: u64) -> i64 {
-    i64::from_le_bytes(value.to_le_bytes())
-}
-
-/// The inverse of [`signed`].
-pub(crate) const fn unsigned(value: i64) -> u64 {
-    u64::from_le_bytes(value.to_le_bytes())
-}
-
-/// The wall clock as UTC milliseconds since the Unix epoch; `0` on a clock
-/// set before the epoch, which is a display column's problem.
-fn now_ms() -> i64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .ok()
-        .and_then(|elapsed| i64::try_from(elapsed.as_millis()).ok())
-        .unwrap_or(0)
-}
diff --git a/crates/workshop/run-log/src/error.rs b/crates/workshop/run-log/src/error.rs
deleted file mode 100644
index b2b9586a2..000000000
--- a/crates/workshop/run-log/src/error.rs
+++ /dev/null
@@ -1,72 +0,0 @@
-//! The run log's failure vocabulary.
-
-use std::io;
-
-use crate::RunId;
-
-/// Why a run log operation failed.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum LogError {
-    /// The database refused an operation; the database's error is
-    /// the source.
-    #[error("run log database")]
-    Database {
-        /// The database's error.
-        #[source]
-        source: turso::Error,
-    },
-    /// The log file could not be addressed; `context` names the operation
-    /// and the path, and the I/O error is the source.
-    #[error("run log file: {context}")]
-    Io {
-        /// The operation and the path it addressed, such as
-        /// `create /a/runs`.
-        context: String,
-        /// The I/O error.
-        #[source]
-        source: io::Error,
-    },
-    /// A payload could not be serialized on the way in or parsed on the
-    /// way out; the serde error is the source.
-    #[error("run log payload")]
-    Payload {
-        /// The serde error.
-        #[source]
-        source: serde_json::Error,
-    },
-    /// No run with this id was ever begun in this log.
-    #[error("run log: unknown run {0}")]
-    UnknownRun(RunId),
-    /// The run has already ended; nothing more may be written to it.
-    #[error("run log: run {0} has ended")]
-    RunEnded(RunId),
-    /// A stored row disagrees with the schema: expected the named shape,
-    /// found the described value.
-    #[error("run log: corrupt row: {0}")]
-    Corrupt(String),
-}
-
-impl LogError {
-    /// [`LogError::Io`] for `source`, with `context` naming the operation
-    /// and the path. There is no `From<io::Error>`: a bare `?` would drop
-    /// both.
-    pub(crate) fn io(context: impl Into<String>, source: io::Error) -> Self {
-        LogError::Io {
-            context: context.into(),
-            source,
-        }
-    }
-}
-
-impl From<turso::Error> for LogError {
-    fn from(source: turso::Error) -> Self {
-        LogError::Database { source }
-    }
-}
-
-impl From<serde_json::Error> for LogError {
-    fn from(source: serde_json::Error) -> Self {
-        LogError::Payload { source }
-    }
-}
diff --git a/crates/workshop/run-log/src/lib.rs b/crates/workshop/run-log/src/lib.rs
deleted file mode 100644
index cf796033d..000000000
--- a/crates/workshop/run-log/src/lib.rs
+++ /dev/null
@@ -1,60 +0,0 @@
-//! workshop-run-log - the Workshop run log: an append-only Turso record of
-//! every run and, per run, every effect, answer, and event in loop order,
-//! and the recorder that lets the Harness write to it.
-//!
-//! ## Invariants
-//!
-//! - Tier: feature; may depend on: `workshop-protocol`,
-//!   `workshop-registry`, `workshop-support`, and the service crates;
-//!   today it names none of them. Outside the family it may name
-//!   `runvil`, the one crate a Host depends on for the Harness and the
-//!   Engine. Never on `workshop-server`, an Engine crate, or a private
-//!   Harness or Gateway crate.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - The Harness holds no database and no storage path: this crate is
-//!   where the Host's recorder keeps a run's history. It reaches the
-//!   Harness only through `runvil::harness`.
-//! - `records` is append-only: a record's `seq` is the effect loop's
-//!   order, not the clock's, assigned by the log in call order, and no
-//!   record is updated or deleted once written. A `runs` row is written
-//!   at `begin_run` and closed exactly once at `end_run`; a closed run
-//!   accepts no more records.
-//! - Every `u64` the Engine hands over (`effect_id`) is stored as its
-//!   two's-complement `i64`, losslessly; the run's 32-byte `seed` is
-//!   stored as its 64 lowercase hex characters; a `task_id` is the Engine's
-//!   hierarchical task path stored as text; timestamps are UTC
-//!   milliseconds since the Unix epoch. `started_at` is the caller's;
-//!   `at` and `ended_at` are the log's wall clock.
-//! - A run's result is stored under its `status`: `completed` with its
-//!   final text, or `failed` or `canceled` with its error's code tag and
-//!   located message, `canceled` exactly when the code is `canceled`. It
-//!   reads back as the same final text, or as an error with the same code
-//!   and located message, the code's default prose, no location, and no
-//!   facts. A row in any other shape reads as `LogError::Corrupt`.
-//! - A stored payload round-trips: `Record::payload` is written with
-//!   `serde_json::to_string` and read back with `from_str`, and the parsed
-//!   value equals the original with the same text. The workspace enables
-//!   `serde_json`'s `float_roundtrip` feature, and `Value::Object` orders
-//!   keys by `BTreeMap` rather than by insertion, so both hold. The
-//!   fidelity test in `tests/it/fidelity.rs` pins it.
-//! - `TursoRecorder` serializes every call behind its own lock, and calls
-//!   from different runs may overlap. The database opens on the first
-//!   call, and an open that fails leaves nothing behind, so the next call
-//!   tries again. A write the log refuses fails the run it belongs to; the
-//!   recorder never skips a record.
-//! - The `agent` column is the Host's, not the Harness's: the
-//!   `AgentRecorder` a launch gets from `TursoRecorder::for_agent` is the
-//!   only `RunRecorder` here, and it writes its agent at `begin_run`.
-
-mod append;
-mod error;
-mod read;
-mod record;
-mod recorder;
-mod schema;
-
-pub use append::RunLog;
-pub use error::LogError;
-pub use record::{Record, RecordFilter, RecordKind, RunId, RunMeta, RunRow, Seq, StoredRecord};
-pub use recorder::{AgentRecorder, TursoRecorder};
diff --git a/crates/workshop/run-log/src/read.rs b/crates/workshop/run-log/src/read.rs
deleted file mode 100644
index 261517645..000000000
--- a/crates/workshop/run-log/src/read.rs
+++ /dev/null
@@ -1,169 +0,0 @@
-//! The read side: one run's row and its records, whole or sliced by kind.
-
-use runvil::{Error, ErrorCode, RunSeed, Timestamp};
-
-use crate::append::{RunLog, unsigned};
-use crate::error::LogError;
-use crate::record::{Record, RecordFilter, RecordKind, RunId, RunMeta, RunRow, Seq, StoredRecord};
-use crate::schema;
-
-impl RunLog {
-    /// Reads `run`'s row.
-    ///
-    /// # Errors
-    /// Returns [`LogError::UnknownRun`] when `run` was never begun here,
-    /// [`LogError::Corrupt`] when the row does not fit the schema, and
-    /// [`LogError::Database`] when the database cannot read it.
-    pub async fn run(&self, run: RunId) -> Result<RunRow, LogError> {
-        let mut rows = self.conn().query(schema::SELECT_RUN, (run.get(),)).await?;
-        let Some(row) = rows.next().await? else {
-            return Err(LogError::UnknownRun(run));
-        };
-        let meta = RunMeta {
-            seed: to_seed(row.get::<String>(1)?)?,
-            flags: to_u32(row.get(2)?, "flags")?,
-            started_at: Timestamp::from_unix_millis(row.get(3)?),
-        };
-        let agent = row.get(0)?;
-        let ended_at: Option<i64> = row.get(4)?;
-        let result = match row.get::<Option<String>>(5)? {
-            None => None,
-            Some(status) => {
-                let error_code: Option<String> = row.get(7)?;
-                Some(parse_result(
-                    &status,
-                    row.get(6)?,
-                    error_code.as_deref(),
-                    row.get(8)?,
-                )?)
-            }
-        };
-        Ok(RunRow {
-            id: run,
-            meta,
-            agent,
-            ended_at,
-            result,
-        })
-    }
-
-    /// Reads the records of `run` that `filter` selects, in the order
-    /// [`RecordFilter`] documents. A run with nothing selected reads as
-    /// empty; an unknown run is refused.
-    ///
-    /// # Errors
-    /// Returns [`LogError::UnknownRun`] when `run` was never begun here,
-    /// [`LogError::Corrupt`] when a row does not fit the schema,
-    /// [`LogError::Payload`] when a payload does not parse, and
-    /// [`LogError::Database`] when the database cannot read.
-    pub async fn records(
-        &self,
-        run: RunId,
-        filter: RecordFilter,
-    ) -> Result<Vec<StoredRecord>, LogError> {
-        self.run(run).await?;
-        let kind = filter.kind.map(RecordKind::as_str);
-        let limit = filter.last.map_or(-1, i64::from);
-        let mut rows = self
-            .conn()
-            .query(schema::SELECT_RECORDS, (run.get(), kind, limit))
-            .await?;
-        // The query reads newest first so `LIMIT` keeps the final
-        // records; oldest first is the order callers expect.
-        let mut records = Vec::new();
-        while let Some(row) = rows.next().await? {
-            let kind: String = row.get(3)?;
-            let kind = RecordKind::parse(&kind).ok_or_else(|| {
-                LogError::Corrupt(format!(
-                    "expected kind effect, answer, or event, found {kind:?}"
-                ))
-            })?;
-            let payload: String = row.get(5)?;
-            records.push(StoredRecord {
-                seq: Seq::from_raw(unsigned(row.get(0)?)),
-                at: row.get(6)?,
-                record: Record {
-                    task_id: row.get(1)?,
-                    task_seq: to_u32(row.get(2)?, "task_seq")?,
-                    kind,
-                    effect_id: row.get::<Option<i64>>(4)?.map(unsigned),
-                    payload: serde_json::from_str(&payload)?,
-                },
-            });
-        }
-        records.reverse();
-        Ok(records)
-    }
-
-    /// Every `event` record of `run` in `seq` order, the loop's order:
-    /// what a session view renders.
-    ///
-    /// # Errors
-    /// Returns [`LogError::UnknownRun`] when `run` was never begun here,
-    /// [`LogError::Corrupt`] when a row does not fit the schema,
-    /// [`LogError::Payload`] when a payload does not parse, and
-    /// [`LogError::Database`] when the database cannot read.
-    pub async fn transcript(&self, run: RunId) -> Result<Vec<StoredRecord>, LogError> {
-        let filter = RecordFilter {
-            kind: Some(RecordKind::Event),
-            last: None,
-        };
-        self.records(run, filter).await
-    }
-}
-
-/// A stored `u32` column, refusing anything outside the type.
-fn to_u32(value: i64, column: &str) -> Result<u32, LogError> {
-    u32::try_from(value)
-        .map_err(|_| LogError::Corrupt(format!("expected {column} to fit u32, found {value}")))
-}
-
-/// A stored `seed` column, parsed as `RunSeed`'s serde form defines it.
-fn to_seed(text: String) -> Result<RunSeed, LogError> {
-    serde_json::from_value(serde_json::Value::String(text))
-        .map_err(|error| LogError::Corrupt(format!("seed: {error}")))
-}
-
-/// A stored `error_code` column, parsed as [`ErrorCode::from_tag`] reads it.
-fn to_code(tag: &str) -> Result<ErrorCode, LogError> {
-    ErrorCode::from_tag(tag).ok_or_else(|| {
-        LogError::Corrupt(format!(
-            "expected error_code to be an ErrorCode tag, found {tag:?}"
-        ))
-    })
-}
-
-/// Rebuilds a run's result from its four result columns.
-///
-/// Three shapes read back: `completed` with its final text and no error
-/// columns, `failed` with a code other than `canceled` and a message, and
-/// `canceled` with the code `canceled` and a message. The rebuilt error
-/// has its code's default prose and no location or facts, since the
-/// stored message is the located message and already ends with any
-/// location.
-fn parse_result(
-    status: &str,
-    final_text: Option<String>,
-    error_code: Option<&str>,
-    error_message: Option<String>,
-) -> Result<Result<String, Error>, LogError> {
-    if !matches!(status, "completed" | "failed" | "canceled") {
-        return Err(LogError::Corrupt(format!(
-            "expected status completed, failed, or canceled, found {status:?}"
-        )));
-    }
-    let code = error_code.map(to_code).transpose()?;
-    match (status, final_text, code, error_message) {
-        ("completed", Some(final_text), None, None) => Ok(Ok(final_text)),
-        ("failed", None, Some(code), Some(message)) if code != ErrorCode::Canceled => {
-            Ok(Err(Error::new(code, message, code.prose())))
-        }
-        ("canceled", None, Some(code @ ErrorCode::Canceled), Some(message)) => {
-            Ok(Err(Error::new(code, message, code.prose())))
-        }
-        (status, final_text, _, error_message) => Err(LogError::Corrupt(format!(
-            "expected result columns to match {status:?}, found final_text={final_text:?} \
-             error_code={error_code:?} error_message={error_message:?}"
-        ))),
-    }
-}
diff --git a/crates/workshop/run-log/src/record.rs b/crates/workshop/run-log/src/record.rs
deleted file mode 100644
index a0014572f..000000000
--- a/crates/workshop/run-log/src/record.rs
+++ /dev/null
@@ -1,80 +0,0 @@
-//! The values the run log stores and returns.
-//!
-//! The values the Harness hands a recorder (`Record`, `RunMeta`, and
-//! their parts) are re-exported from `runvil::harness`, so a log and the
-//! effect loop share one definition of each. A run's result is the
-//! Engine's own `Result<String, Error>`.
-
-use std::fmt;
-
-use runvil::Error;
-pub use runvil::harness::{Record, RecordKind, RunId, RunMeta};
-
-/// A record's position in its run: the effect loop's order, assigned by
-/// the log in call order, starting at `0` and strictly increasing.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
-pub struct Seq(u64);
-
-impl Seq {
-    /// Wraps a raw position.
-    #[must_use]
-    pub const fn from_raw(raw: u64) -> Self {
-        Self(raw)
-    }
-
-    /// The raw position.
-    #[must_use]
-    pub const fn get(self) -> u64 {
-        self.0
-    }
-}
-
-impl fmt::Display for Seq {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-/// Which of a run's records to read. The default reads them all.
-///
-/// Records come back in `seq` order, the loop's order. `last` keeps only
-/// the final `n`.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct RecordFilter {
-    /// Only records of this kind.
-    pub kind: Option<RecordKind>,
-    /// Only the final `n` records.
-    pub last: Option<u32>,
-}
-
-/// One record as the log returns it.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub struct StoredRecord {
-    /// The record's position in its run.
-    pub seq: Seq,
-    /// When the record was appended, UTC milliseconds since the Unix epoch.
-    pub at: i64,
-    /// The record itself.
-    pub record: Record,
-}
-
-/// One run as the log returns it.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub struct RunRow {
-    /// The run's identity.
-    pub id: RunId,
-    /// What the Harness knew when the run began.
-    pub meta: RunMeta,
-    /// The agent the Host launched, written beside the Harness's metadata.
-    pub agent: String,
-    /// When the run ended, UTC milliseconds since the Unix epoch; `None`
-    /// while the run is open.
-    pub ended_at: Option<i64>,
-    /// How the run ended: its final text, or the error that ended it,
-    /// which holds the stored code and located message, the code's
-    /// default prose, no location, and no facts. A cancel is the error
-    /// whose code is `canceled`. `None` while the run is open.
-    pub result: Option<Result<String, Error>>,
-}
diff --git a/crates/workshop/run-log/src/recorder.rs b/crates/workshop/run-log/src/recorder.rs
deleted file mode 100644
index 1331b3a2d..000000000
--- a/crates/workshop/run-log/src/recorder.rs
+++ /dev/null
@@ -1,140 +0,0 @@
-//! The recorder that writes the Harness's runs to a run log.
-
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-use runvil::harness::{Record, RunId, RunMeta, RunRecorder, make_recorder_error};
-use runvil::{BoxFuture, Error};
-use tokio::sync::Mutex;
-
-use crate::{LogError, RunLog};
-
-/// The file under the state directory the run log is stored in.
-const RUNS_FILE: &str = "runs.db";
-
-/// The Turso [`RunLog`] a Host keeps every run in, shared by the
-/// [`AgentRecorder`] of each launch.
-///
-/// The log is one file, `runs.db`, under the state directory the recorder
-/// is built with. Building the recorder touches nothing. The first call
-/// creates the directory and opens the file, and an open that fails leaves
-/// the recorder unopened, so the next call tries again. Every call takes
-/// the recorder's own lock, so runs that overlap write one at a time.
-///
-/// The Harness writes through the handle [`for_agent`](Self::for_agent)
-/// returns, which names the launched agent in the row of each run it
-/// begins. A failed write comes back as a [`make_recorder_error`] whose message
-/// holds the log's [`LogError`]. The Harness stops the run that hit it.
-#[derive(Debug)]
-pub struct TursoRecorder {
-    /// The directory the database file sits in.
-    dir: PathBuf,
-    /// The database file.
-    path: PathBuf,
-    /// The open log, `None` until a call has opened it.
-    log: Mutex<Option<RunLog>>,
-}
-
-impl TursoRecorder {
-    /// A recorder that keeps its log in `runs.db` under `state_dir`. The
-    /// directory and the file are created by the first call, not here.
-    #[must_use]
-    pub fn new(state_dir: impl Into<PathBuf>) -> Self {
-        let dir = state_dir.into();
-        let path = dir.join(RUNS_FILE);
-        Self {
-            dir,
-            path,
-            log: Mutex::new(None),
-        }
-    }
-
-    /// The database file the recorder writes. Open it with
-    /// [`RunLog::open`] to read a run back once the recorder is gone.
-    #[must_use]
-    pub fn path(&self) -> &Path {
-        &self.path
-    }
-
-    /// The recorder for one launch of `agent`: each run it begins is
-    /// written to this log with `agent` in its row. Building it touches
-    /// nothing.
-    #[must_use]
-    pub fn for_agent(self: &Arc<Self>, agent: impl Into<String>) -> AgentRecorder {
-        AgentRecorder {
-            recorder: Arc::clone(self),
-            agent: agent.into(),
-        }
-    }
-
-    /// The open log in `slot`, opening it first when no call has yet.
-    async fn open<'a>(&self, slot: &'a mut Option<RunLog>) -> Result<&'a mut RunLog, LogError> {
-        if let Some(log) = slot {
-            Ok(log)
-        } else {
-            tokio::fs::create_dir_all(&self.dir)
-                .await
-                .map_err(|e| LogError::io(format!("create {}", self.dir.display()), e))?;
-            let log = RunLog::open(&self.path).await?;
-            Ok(slot.insert(log))
-        }
-    }
-}
-
-/// A [`RunRecorder`] for one launch: it writes to its [`TursoRecorder`]'s
-/// log and fills the `agent` column of each run it begins with the agent
-/// the Host launched.
-#[derive(Debug)]
-pub struct AgentRecorder {
-    /// The log every call writes to.
-    recorder: Arc<TursoRecorder>,
-    /// The launched agent, written at `begin_run`.
-    agent: String,
-}
-
-impl RunRecorder for AgentRecorder {
-    fn begin_run(&self, meta: RunMeta) -> BoxFuture<'_, Result<RunId, Error>> {
-        Box::pin(async move {
-            let mut slot = self.recorder.log.lock().await;
-            let log = self
-                .recorder
-                .open(&mut slot)
-                .await
-                .map_err(make_recorder_error)?;
-            log.begin_run(meta, &self.agent)
-                .await
-                .map_err(make_recorder_error)
-        })
-    }
-
-    fn append(&self, run: RunId, record: Record) -> BoxFuture<'_, Result<(), Error>> {
-        Box::pin(async move {
-            let mut slot = self.recorder.log.lock().await;
-            let log = self
-                .recorder
-                .open(&mut slot)
-                .await
-                .map_err(make_recorder_error)?;
-            log.append(run, record)
-                .await
-                .map(drop)
-                .map_err(make_recorder_error)
-        })
-    }
-
-    fn end_run(
-        &self,
-        run: RunId,
-        result: Result<String, Error>,
-    ) -> BoxFuture<'_, Result<(), Error>> {
-        Box::pin(async move {
-            let mut slot = self.recorder.log.lock().await;
-            let log = self
-                .recorder
-                .open(&mut slot)
-                .await
-                .map_err(make_recorder_error)?;
-            log.end_run(run, result).await.map_err(make_recorder_error)
-        })
-    }
-}
diff --git a/crates/workshop/run-log/src/schema.rs b/crates/workshop/run-log/src/schema.rs
deleted file mode 100644
index d05ad08ef..000000000
--- a/crates/workshop/run-log/src/schema.rs
+++ /dev/null
@@ -1,85 +0,0 @@
-//! The run log's tables.
-//!
-//! Two tables. `runs` holds one row per run: written at `begin_run`, closed
-//! exactly once at `end_run` when `ended_at` and the result columns fill.
-//! `status` is `completed`, `failed`, or `canceled`. A completed run fills
-//! `final_text`; a failed or canceled run fills `error_code` with its
-//! error's `ErrorCode::tag` and `error_message` with its located message.
-//! `records` holds, per run, every effect, answer, and event in effect-loop
-//! order. `seq` is the loop's order, not the clock's; `at` is the wall
-//! clock at append, kept for display only. `(task_id, task_seq)` is the
-//! record's `Provenance`, stored beside the payload.
-//!
-//! Every integer that is a `u64` in Rust (`effect_id`) is stored
-//! as its two's-complement `i64` reinterpretation, since SQLite integers
-//! are signed; see `append::signed` and `append::unsigned`. `seed` is the
-//! run's 32-byte seed as 64 lowercase hex characters. `task_id` is the
-//! Engine's hierarchical task path (`0`, `0.2`, `0.2.1`) stored as text,
-//! since a path of unbounded depth has no integer form. Timestamps are UTC
-//! milliseconds since the Unix epoch.
-
-/// The DDL, idempotent so an existing file opens without change.
-pub(crate) const SCHEMA: &str = "
-CREATE TABLE IF NOT EXISTS runs (
-    run_id        INTEGER PRIMARY KEY,
-    agent         TEXT    NOT NULL,
-    seed          TEXT    NOT NULL,
-    flags         INTEGER NOT NULL,
-    started_at    INTEGER NOT NULL,
-    ended_at      INTEGER,
-    status        TEXT    CHECK (status IN ('completed', 'failed', 'canceled')),
-    final_text    TEXT,
-    error_code    TEXT,
-    error_message TEXT
-);
-
-CREATE TABLE IF NOT EXISTS records (
-    run_id    INTEGER NOT NULL REFERENCES runs (run_id),
-    seq       INTEGER NOT NULL,
-    task_id   TEXT    NOT NULL,
-    task_seq  INTEGER NOT NULL,
-    kind      TEXT    NOT NULL CHECK (kind IN ('effect', 'answer', 'event')),
-    effect_id INTEGER,
-    payload   TEXT    NOT NULL,
-    at        INTEGER NOT NULL,
-    PRIMARY KEY (run_id, seq)
-);
-";
-
-/// Opens a run: every column of `runs` that `begin_run` knows.
-pub(crate) const INSERT_RUN: &str = "INSERT INTO runs \
-    (agent, seed, flags, started_at) \
-    VALUES (?1, ?2, ?3, ?4)";
-
-/// Whether a run exists and whether it has ended: one row with `ended_at`.
-pub(crate) const SELECT_RUN_ENDED_AT: &str = "SELECT ended_at FROM runs WHERE run_id = ?1";
-
-/// The next `seq` for a run: one past its maximum, `0` when it has none.
-pub(crate) const SELECT_NEXT_SEQ: &str =
-    "SELECT COALESCE(MAX(seq), -1) + 1 FROM records WHERE run_id = ?1";
-
-/// Appends one record.
-pub(crate) const INSERT_RECORD: &str = "INSERT INTO records \
-    (run_id, seq, task_id, task_seq, kind, effect_id, payload, at) \
-    VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)";
-
-/// Closes a run. The `ended_at IS NULL` guard makes a second close a
-/// no-op the caller detects through the change count.
-pub(crate) const UPDATE_RUN_ENDED: &str = "UPDATE runs SET \
-    ended_at = ?2, status = ?3, final_text = ?4, error_code = ?5, error_message = ?6 \
-    WHERE run_id = ?1 AND ended_at IS NULL";
-
-/// One run row, columns in [`crate::read`]'s order.
-pub(crate) const SELECT_RUN: &str = "SELECT \
-    agent, seed, flags, started_at, \
-    ended_at, status, final_text, error_code, error_message \
-    FROM runs WHERE run_id = ?1";
-
-/// A run's records, newest first by `seq`, optionally one kind only
-/// (`?2` null means every kind), at most `?3` of them (`-1` means all).
-/// Newest first so `LIMIT` keeps the final records; the reader reverses.
-/// Columns in [`crate::read`]'s order.
-pub(crate) const SELECT_RECORDS: &str = "SELECT \
-    seq, task_id, task_seq, kind, effect_id, payload, at \
-    FROM records WHERE run_id = ?1 AND (?2 IS NULL OR kind = ?2) \
-    ORDER BY seq DESC LIMIT ?3";
diff --git a/crates/workshop/run-log/tests/it/append.rs b/crates/workshop/run-log/tests/it/append.rs
deleted file mode 100644
index 532891346..000000000
--- a/crates/workshop/run-log/tests/it/append.rs
+++ /dev/null
@@ -1,379 +0,0 @@
-//! The write path: a run begins, records append in loop order, the run ends.
-
-use std::num::NonZeroU32;
-
-use runvil::{Error, ErrorCode, ErrorFact, RunSeed, SourceLoc, Timestamp};
-use serde_json::json;
-use workshop_run_log::{LogError, Record, RecordFilter, RecordKind, RunId, RunLog, RunMeta};
-
-/// Every record of a run, in loop order.
-const ALL: RecordFilter = RecordFilter {
-    kind: None,
-    last: None,
-};
-
-/// The agent the Host launched, stored beside the Harness's metadata.
-const AGENT: &str = "chat";
-
-/// A run's opening row as the Harness would write it.
-fn meta() -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([0xfe; 32]),
-        flags: 0,
-        started_at: Timestamp::from_unix_millis(1_700_000_000_000),
-    }
-}
-
-/// One record of `kind` on task 0 at `task_seq`.
-fn record(kind: RecordKind, task_seq: u32, effect_id: Option<u64>) -> Record {
-    Record {
-        task_id: "0".to_owned(),
-        task_seq,
-        kind,
-        effect_id,
-        payload: json!({ "task_seq": task_seq }),
-    }
-}
-
-#[tokio::test]
-async fn a_new_log_has_neither_a_name_nor_a_prompt_hash_column() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let path = dir.path().join("runs.db");
-    drop(RunLog::open(&path).await.unwrap());
-
-    let database = turso::Builder::new_local(path.to_str().unwrap())
-        .build()
-        .await
-        .unwrap();
-    let conn = database.connect().unwrap();
-    let mut rows = conn.query("PRAGMA table_info(runs)", ()).await.unwrap();
-    let mut columns = Vec::new();
-    while let Some(row) = rows.next().await.unwrap() {
-        columns.push(row.get::<String>(1).unwrap());
-    }
-    assert!(
-        columns.iter().any(|column| column == "agent"),
-        "the pragma lists the runs table's columns: {columns:?}"
-    );
-    assert!(
-        !columns
-            .iter()
-            .any(|column| column == "name" || column == "prompt_hash"),
-        "the runs table holds neither the run's name nor a prompt hash: {columns:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_run_with_three_records_round_trips_through_an_in_memory_log() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-
-    log.append(run, record(RecordKind::Effect, 0, Some(7)))
-        .await
-        .unwrap();
-    log.append(run, record(RecordKind::Answer, 1, Some(7)))
-        .await
-        .unwrap();
-    log.append(run, record(RecordKind::Event, 2, None))
-        .await
-        .unwrap();
-
-    let row = log.run(run).await.unwrap();
-    assert_eq!(row.id, run);
-    assert_eq!(row.meta, meta());
-    assert_eq!(row.agent, AGENT, "the agent is stored beside the meta");
-    assert_eq!(row.ended_at, None);
-    assert_eq!(row.result, None);
-
-    let records = log.records(run, ALL).await.unwrap();
-    assert_eq!(records.len(), 3);
-    let kinds: Vec<RecordKind> = records.iter().map(|stored| stored.record.kind).collect();
-    assert_eq!(
-        kinds,
-        [RecordKind::Effect, RecordKind::Answer, RecordKind::Event]
-    );
-    let effect_ids: Vec<Option<u64>> = records
-        .iter()
-        .map(|stored| stored.record.effect_id)
-        .collect();
-    assert_eq!(effect_ids, [Some(7), Some(7), None]);
-    for (index, stored) in records.iter().enumerate() {
-        let task_seq = u32::try_from(index).unwrap();
-        assert_eq!(stored.record.task_id, "0");
-        assert_eq!(stored.record.task_seq, task_seq);
-        assert_eq!(stored.record.payload, json!({ "task_seq": task_seq }));
-        assert!(stored.at >= row.meta.started_at.unix_millis());
-    }
-}
-
-#[tokio::test]
-async fn seq_is_assigned_in_call_order_and_strictly_increases() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-
-    let mut seqs = Vec::new();
-    for task_seq in 0..5 {
-        let seq = log
-            .append(run, record(RecordKind::Event, task_seq, None))
-            .await
-            .unwrap();
-        seqs.push(seq);
-    }
-    let raw: Vec<u64> = seqs.iter().map(|seq| seq.get()).collect();
-    assert_eq!(raw, [0, 1, 2, 3, 4]);
-
-    let stored: Vec<u64> = log
-        .records(run, ALL)
-        .await
-        .unwrap()
-        .iter()
-        .map(|stored| stored.seq.get())
-        .collect();
-    assert_eq!(stored, raw);
-}
-
-#[tokio::test]
-async fn seq_is_per_run_so_two_runs_each_start_at_zero() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let first = log.begin_run(meta(), AGENT).await.unwrap();
-    let second = log.begin_run(meta(), AGENT).await.unwrap();
-    assert_ne!(first, second);
-
-    log.append(first, record(RecordKind::Event, 0, None))
-        .await
-        .unwrap();
-    let seq = log
-        .append(second, record(RecordKind::Event, 0, None))
-        .await
-        .unwrap();
-    assert_eq!(seq.get(), 0);
-    assert_eq!(log.records(first, ALL).await.unwrap().len(), 1);
-    assert_eq!(log.records(second, ALL).await.unwrap().len(), 1);
-}
-
-#[tokio::test]
-async fn a_filter_selects_by_kind_and_keeps_the_last_n() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    // Two tasks interleaved (the main walk and its first child); records
-    // come back in loop order, not in any one task's `task_seq` order.
-    let appended = [
-        ("0", 0, RecordKind::Event),
-        ("0.0", 1, RecordKind::Event),
-        ("0", 1, RecordKind::Effect),
-        ("0.0", 0, RecordKind::Event),
-        ("0", 2, RecordKind::Event),
-    ];
-    for (task_id, task_seq, kind) in appended {
-        let mut record = record(kind, task_seq, None);
-        record.task_id = task_id.to_owned();
-        log.append(run, record).await.unwrap();
-    }
-    let positions = |records: Vec<workshop_run_log::StoredRecord>| -> Vec<(String, u32)> {
-        records
-            .into_iter()
-            .map(|stored| (stored.record.task_id, stored.record.task_seq))
-            .collect()
-    };
-    let expected = |positions: &[(&str, u32)]| -> Vec<(String, u32)> {
-        positions
-            .iter()
-            .map(|(task, seq)| ((*task).to_owned(), *seq))
-            .collect()
-    };
-
-    let events = RecordFilter {
-        kind: Some(RecordKind::Event),
-        ..ALL
-    };
-    let all_events = log.records(run, events.clone()).await.unwrap();
-    assert_eq!(
-        positions(all_events),
-        expected(&[("0", 0), ("0.0", 1), ("0.0", 0), ("0", 2)])
-    );
-
-    let last_two = log
-        .records(
-            run,
-            RecordFilter {
-                last: Some(2),
-                ..ALL
-            },
-        )
-        .await
-        .unwrap();
-    assert_eq!(positions(last_two), expected(&[("0.0", 0), ("0", 2)]));
-
-    let last_event = log
-        .records(
-            run,
-            RecordFilter {
-                last: Some(1),
-                ..events
-            },
-        )
-        .await
-        .unwrap();
-    assert_eq!(positions(last_event), expected(&[("0", 2)]));
-}
-
-#[tokio::test]
-async fn end_run_fills_ended_at_and_the_result() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    log.end_run(run, Ok("done".to_owned())).await.unwrap();
-
-    let row = log.run(run).await.unwrap();
-    assert!(
-        row.ended_at
-            .is_some_and(|at| at >= row.meta.started_at.unix_millis())
-    );
-    assert_eq!(row.result, Some(Ok("done".to_owned())));
-}
-
-#[tokio::test]
-async fn a_failed_run_keeps_its_code_and_located_message() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    let mut error = Error::new(
-        ErrorCode::ToolBackend,
-        "expected a reply, got nothing",
-        "the tool's own prose",
-    );
-    error.at = Some(SourceLoc::line("prompt.md", NonZeroU32::new(7).unwrap()));
-    error.facts.insert(ErrorFact::Path, json!("/notes.md"));
-    log.end_run(run, Err(error.clone())).await.unwrap();
-
-    let Some(Err(read)) = log.run(run).await.unwrap().result else {
-        panic!("a failed run reads back as an error");
-    };
-    assert_eq!(read.code, error.code);
-    assert_eq!(read.located_message(), error.located_message());
-    assert!(
-        read.located_message().ends_with("(at prompt.md:7)"),
-        "the location reads back inside the message: {read:?}"
-    );
-    assert_eq!(
-        read.prose,
-        error.code.prose(),
-        "the prose is the code's default"
-    );
-    assert_eq!(read.at, None, "the location is stored only in the message");
-    assert!(read.facts.is_empty(), "facts are not stored: {read:?}");
-}
-
-#[tokio::test]
-async fn a_canceled_run_reads_back_as_a_cancel() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    log.end_run(run, Err(Error::canceled())).await.unwrap();
-
-    let Some(Err(read)) = log.run(run).await.unwrap().result else {
-        panic!("a canceled run reads back as an error");
-    };
-    assert!(
-        read.is_canceled(),
-        "the error read back is a cancel: {read:?}"
-    );
-    assert_eq!(read.located_message(), Error::canceled().located_message());
-}
-
-#[tokio::test]
-async fn a_run_ends_exactly_once() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    log.end_run(run, Err(Error::canceled())).await.unwrap();
-
-    let again = log.end_run(run, Err(Error::canceled())).await;
-    assert!(matches!(again, Err(LogError::RunEnded(id)) if id == run));
-
-    let late = log.append(run, record(RecordKind::Event, 0, None)).await;
-    assert!(matches!(late, Err(LogError::RunEnded(id)) if id == run));
-}
-
-#[tokio::test]
-async fn an_unknown_run_is_refused() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let ghost = RunId::from_raw(41);
-
-    let appended = log.append(ghost, record(RecordKind::Event, 0, None)).await;
-    assert!(matches!(appended, Err(LogError::UnknownRun(id)) if id == ghost));
-
-    let ended = log.end_run(ghost, Err(Error::canceled())).await;
-    assert!(matches!(ended, Err(LogError::UnknownRun(id)) if id == ghost));
-
-    let read = log.run(ghost).await;
-    assert!(matches!(read, Err(LogError::UnknownRun(id)) if id == ghost));
-}
-
-#[tokio::test]
-async fn a_32_byte_seed_survives_a_run_log_round_trip() {
-    // Distinct bytes from a leading `07` to a trailing `ff`, so a dropped
-    // leading zero, a swapped pair, or a sign bit shows.
-    let seed = RunSeed::from_bytes(std::array::from_fn(|i| u8::try_from(i * 8 + 7).unwrap()));
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-    let run = {
-        let mut log = RunLog::open(&path).await.unwrap();
-        let meta = RunMeta { seed, ..meta() };
-        log.begin_run(meta, AGENT).await.unwrap()
-    };
-
-    let log = RunLog::open(&path).await.unwrap();
-    let read = log.run(run).await.unwrap().meta.seed;
-    assert_eq!(read.as_bytes(), seed.as_bytes());
-    drop(log);
-
-    let raw = turso::Builder::new_local(path.to_str().unwrap())
-        .build()
-        .await
-        .unwrap()
-        .connect()
-        .unwrap();
-    let mut rows = raw
-        .query("SELECT seed FROM runs WHERE run_id = ?1", (run.get(),))
-        .await
-        .unwrap();
-    let stored: String = rows.next().await.unwrap().unwrap().get(0).unwrap();
-    assert_eq!(
-        stored,
-        seed.to_string(),
-        "the column holds the 64 hex digits"
-    );
-    drop(rows);
-    raw.execute(
-        "UPDATE runs SET seed = 'not a seed' WHERE run_id = ?1",
-        (run.get(),),
-    )
-    .await
-    .unwrap();
-    drop(raw);
-
-    let log = RunLog::open(&path).await.unwrap();
-    let refused = log.run(run).await;
-    assert!(
-        matches!(&refused, Err(LogError::Corrupt(message)) if message.contains("seed")),
-        "a malformed seed is a read error naming the column: {refused:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_log_on_disk_keeps_its_rows_across_reopen() {
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-
-    let run = {
-        let mut log = RunLog::open(&path).await.unwrap();
-        let run = log.begin_run(meta(), AGENT).await.unwrap();
-        log.append(run, record(RecordKind::Event, 0, None))
-            .await
-            .unwrap();
-        log.end_run(run, Err(Error::canceled())).await.unwrap();
-        run
-    };
-
-    let log = RunLog::open(&path).await.unwrap();
-    let row = log.run(run).await.unwrap();
-    assert!(matches!(row.result, Some(Err(error)) if error.is_canceled()));
-    assert_eq!(log.records(run, ALL).await.unwrap().len(), 1);
-}
diff --git a/crates/workshop/run-log/tests/it/fidelity.rs b/crates/workshop/run-log/tests/it/fidelity.rs
deleted file mode 100644
index 2f73153bb..000000000
--- a/crates/workshop/run-log/tests/it/fidelity.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//! Payload fidelity: a stored payload reads back as the identical value.
-//!
-//! The log writes a record's payload as JSON text and parses it back on
-//! read; replay compares the parsed value against the one that produced it,
-//! so a float whose text does not parse exactly, or an object whose key
-//! order changes, would make a replayed run differ from the run that ran.
-
-use runvil::event::{Event, ReplyOrigin};
-use runvil::ids::{Provenance, RoundId, TaskId};
-use runvil::metrics::{CallMetrics, ClientTiming, LlamaTimings, Usage, VllmMetrics};
-use runvil::{Error, RunSeed, Timestamp};
-use serde_json::{Map, Value, json};
-use workshop_run_log::{Record, RecordFilter, RecordKind, RunLog, RunMeta};
-
-/// A double whose shortest decimal text a plain parser reads back as the
-/// neighbour `3.9078`: the defect exact parsing removes.
-const AWKWARD: f64 = 3.907_800_000_000_000_4;
-
-/// Every record of a run, in loop order.
-const ALL: RecordFilter = RecordFilter {
-    kind: None,
-    last: None,
-};
-
-/// A run's opening row, as the Harness would write it.
-fn meta() -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([3; 32]),
-        flags: 0,
-        started_at: Timestamp::from_unix_millis(1_700_000_000_000),
-    }
-}
-
-/// The replay key every fidelity event carries.
-fn provenance() -> Result<Provenance, Error> {
-    Ok(Provenance::new("0".parse::<TaskId>()?, 0))
-}
-
-/// Appends `payload` as the one event of a fresh run and asserts the log
-/// returns the identical value and the identical text.
-async fn round_trips(payload: Value) -> Result<(), Box<dyn std::error::Error>> {
-    let mut log = RunLog::in_memory().await?;
-    let run = log.begin_run(meta(), "chat").await?;
-    log.append(
-        run,
-        Record {
-            task_id: "0".to_owned(),
-            task_seq: 0,
-            kind: RecordKind::Event,
-            effect_id: None,
-            payload: payload.clone(),
-        },
-    )
-    .await?;
-
-    let stored = log.records(run, ALL).await?;
-    assert_eq!(
-        stored.len(),
-        1,
-        "the run holds exactly the one event appended"
-    );
-    let returned = &stored[0].record.payload;
-    assert_eq!(returned, &payload, "the value survives the round trip");
-    assert_eq!(
-        serde_json::to_string(returned)?,
-        serde_json::to_string(&payload)?,
-        "the stored text is canonical for the value"
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn awkward_floats_round_trip_through_the_log() {
-    // Each of these is a double whose shortest decimal text a plain
-    // parser does not reproduce; without exact parsing the value read
-    // back is a neighbour of the one written.
-    round_trips(json!({
-        "sum": 0.1 + 0.2,
-        "noise": AWKWARD,
-        "tiny": 1e-7,
-        "huge": 1e21,
-        "max": f64::MAX,
-        "negative_zero": -0.0,
-    }))
-    .await
-    .unwrap();
-}
-
-#[tokio::test]
-async fn nested_objects_round_trip_with_canonical_key_order() {
-    // Insertion order is deliberately not sorted; a `Value` object is a
-    // `BTreeMap`, so the stored text orders keys by byte value whatever
-    // the insertion order, and that canonical order must survive the read.
-    let mut inner = Map::new();
-    inner.insert("zulu".to_owned(), json!(1));
-    inner.insert("alpha".to_owned(), json!({ "yankee": 2, "bravo": 3 }));
-    inner.insert("mike".to_owned(), json!([{ "delta": 4, "charlie": 5 }]));
-
-    let mut outer = Map::new();
-    outer.insert("second".to_owned(), Value::Object(inner));
-    outer.insert("first".to_owned(), json!(true));
-
-    let payload = Value::Object(outer);
-    assert_eq!(
-        serde_json::to_string(&payload).unwrap(),
-        r#"{"first":true,"second":{"alpha":{"bravo":3,"yankee":2},"mike":[{"charlie":5,"delta":4}],"zulu":1}}"#
-    );
-    round_trips(payload).await.unwrap();
-}
-
-#[tokio::test]
-async fn arrays_of_mixed_numbers_round_trip_through_the_log() {
-    round_trips(json!({
-        "mixed": [0, -1, 1.5, 0.1 + 0.2, AWKWARD, 1e21, i64::MIN, u64::MAX],
-        "nested": [[1.25, 2], [3.5]],
-    }))
-    .await
-    .unwrap();
-}
-
-#[tokio::test]
-async fn a_real_assistant_reply_with_metrics_round_trips_through_the_log() {
-    let event = Event::AssistantReply {
-        section: "chat".to_owned(),
-        provenance: provenance().unwrap(),
-        turn: 2,
-        round: RoundId::new(1),
-        text: "hello".to_owned(),
-        finish_reason: Some("stop".to_owned()),
-        model: "llama-3".to_owned(),
-        origin: ReplyOrigin::Chat,
-        metrics: Some(
-            CallMetrics::new()
-                .with_usage(Some(
-                    Usage::new(7, 3, 10)
-                        .with_cached_tokens(Some(2))
-                        .with_reasoning_tokens(Some(1)),
-                ))
-                .with_llama(Some(
-                    LlamaTimings::new(7, AWKWARD, 560.0, 3, 30.5, 98.5)
-                        .with_draft_n(4)
-                        .with_draft_n_accepted(2),
-                ))
-                .with_vllm(Some(
-                    VllmMetrics::new()
-                        .with_time_to_first_token_ms(Some(8.5))
-                        .with_generation_time_ms(Some(22.5))
-                        .with_queue_time_ms(Some(1.5))
-                        .with_mean_itl_ms(Some(7.5))
-                        .with_tokens_per_second(Some(133.5)),
-                ))
-                .with_client(Some(
-                    ClientTiming::new(0.1 + 0.2)
-                        .with_ttft_ms(Some(3.907_800_000_000_000_4))
-                        .with_mean_itl_ms(Some(8.25)),
-                )),
-        ),
-    };
-    round_trips(serde_json::to_value(&event).unwrap())
-        .await
-        .unwrap();
-}
diff --git a/crates/workshop/run-log/tests/it/main.rs b/crates/workshop/run-log/tests/it/main.rs
deleted file mode 100644
index 07a2d1c57..000000000
--- a/crates/workshop/run-log/tests/it/main.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-//! Integration tests for `workshop-run-log`.
-
-mod append;
-mod fidelity;
-mod read;
-mod recorder;
-mod result;
diff --git a/crates/workshop/run-log/tests/it/read.rs b/crates/workshop/run-log/tests/it/read.rs
deleted file mode 100644
index 7c5aa223d..000000000
--- a/crates/workshop/run-log/tests/it/read.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-//! The read path: the whole transcript for session views.
-
-use runvil::{RunSeed, Timestamp};
-use serde_json::json;
-use workshop_run_log::{LogError, Record, RecordKind, RunId, RunLog, RunMeta};
-
-/// The agent the Host launched.
-const AGENT: &str = "chat";
-
-/// A run's opening row.
-fn meta() -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([3; 32]),
-        flags: 0,
-        started_at: Timestamp::from_unix_millis(1_700_000_000_000),
-    }
-}
-
-/// One record with the given provenance and kind and an empty payload.
-fn record(task_id: &str, task_seq: u32, kind: RecordKind) -> Record {
-    Record {
-        task_id: task_id.to_owned(),
-        task_seq,
-        kind,
-        effect_id: (kind != RecordKind::Event).then_some(u64::from(task_seq)),
-        payload: json!({}),
-    }
-}
-
-/// Two tasks interleaved in loop order (the main walk `0` and its first
-/// child `0.0`), each task's events arriving out of `task_seq` order, with
-/// an effect and its answer mixed in so the event-only transcript has
-/// something to exclude. Returns the run.
-async fn interleaved_run(log: &mut RunLog) -> Result<RunId, LogError> {
-    let run = log.begin_run(meta(), AGENT).await?;
-    let appended = [
-        ("0", 0, RecordKind::Event),
-        ("0.0", 2, RecordKind::Event),
-        ("0", 1, RecordKind::Effect),
-        ("0.0", 0, RecordKind::Event),
-        ("0", 2, RecordKind::Answer),
-        ("0", 3, RecordKind::Event),
-        ("0.0", 1, RecordKind::Event),
-        ("0", 4, RecordKind::Event),
-    ];
-    for (task_id, task_seq, kind) in appended {
-        log.append(run, record(task_id, task_seq, kind)).await?;
-    }
-    Ok(run)
-}
-
-#[tokio::test]
-async fn transcript_returns_every_event_in_seq_order_and_nothing_else() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = interleaved_run(&mut log).await.unwrap();
-
-    let transcript = log.transcript(run).await.unwrap();
-    let seqs: Vec<u64> = transcript.iter().map(|stored| stored.seq.get()).collect();
-    assert_eq!(seqs, [0, 1, 3, 5, 6, 7]);
-    let provenance: Vec<(&str, u32)> = transcript
-        .iter()
-        .map(|stored| (stored.record.task_id.as_str(), stored.record.task_seq))
-        .collect();
-    assert_eq!(
-        provenance,
-        [
-            ("0", 0),
-            ("0.0", 2),
-            ("0.0", 0),
-            ("0", 3),
-            ("0.0", 1),
-            ("0", 4)
-        ]
-    );
-    assert!(
-        transcript
-            .iter()
-            .all(|stored| stored.record.kind == RecordKind::Event)
-    );
-}
-
-#[tokio::test]
-async fn transcript_of_a_run_with_no_events_is_empty() {
-    let mut log = RunLog::in_memory().await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    log.append(run, record("0", 0, RecordKind::Effect))
-        .await
-        .unwrap();
-    assert!(log.transcript(run).await.unwrap().is_empty());
-}
-
-#[tokio::test]
-async fn the_event_readers_refuse_an_unknown_run() {
-    let log = RunLog::in_memory().await.unwrap();
-    let ghost = RunId::from_raw(41);
-
-    let transcript = log.transcript(ghost).await;
-    assert!(matches!(transcript, Err(LogError::UnknownRun(id)) if id == ghost));
-}
diff --git a/crates/workshop/run-log/tests/it/recorder.rs b/crates/workshop/run-log/tests/it/recorder.rs
deleted file mode 100644
index c16669731..000000000
--- a/crates/workshop/run-log/tests/it/recorder.rs
+++ /dev/null
@@ -1,293 +0,0 @@
-//! `TursoRecorder`: a whole run goes in through a per-run handle's
-//! recorder trait and comes back out through `RunLog`.
-
-// clippy.toml's allow-unwrap-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking is what these are for.
-#![expect(
-    clippy::unwrap_used,
-    reason = "test helpers fail by panicking with the failure shown"
-)]
-
-use std::fs;
-use std::path::Path;
-use std::sync::Arc;
-
-use runvil::harness::{Record, RecordKind, RunId, RunMeta, RunRecorder};
-use runvil::{Error, ErrorCode, RunSeed, Timestamp};
-use serde_json::json;
-use workshop_run_log::{LogError, RecordFilter, RunLog, TursoRecorder};
-
-/// Every record of a run, in loop order.
-const ALL: RecordFilter = RecordFilter {
-    kind: None,
-    last: None,
-};
-
-/// The agent the Host launched.
-const AGENT: &str = "chat";
-
-/// When a test's first run starts.
-const FIRST: Timestamp = Timestamp::from_unix_millis(1_700_000_000_000);
-
-/// When a test's second run starts, so a read tells the two runs apart.
-const SECOND: Timestamp = Timestamp::from_unix_millis(1_700_000_000_001);
-
-/// A run's opening row as the Harness would write it, starting at
-/// `started_at`.
-fn meta(started_at: Timestamp) -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([0xfe; 32]),
-        flags: 0,
-        started_at,
-    }
-}
-
-/// One record of `kind` on task 0 at `task_seq`, tagged with `owner` so a
-/// read can tell whose it is.
-fn record(kind: RecordKind, task_seq: u32, effect_id: Option<u64>, owner: &str) -> Record {
-    Record {
-        task_id: "0".to_owned(),
-        task_seq,
-        kind,
-        effect_id,
-        payload: json!({ "owner": owner, "task_seq": task_seq }),
-    }
-}
-
-/// Opens the file a recorder wrote, once the recorder is gone.
-async fn read_back(path: &Path) -> RunLog {
-    RunLog::open(path).await.unwrap()
-}
-
-/// The text of the log failure behind a recorder error.
-fn log_failure(error: &Error) -> &str {
-    assert_eq!(error.code, ErrorCode::RecorderFailed);
-    let Some(cause) = error.message.strip_prefix("the run recorder failed: ") else {
-        panic!("a recorder error carries its cause in its message: {error:?}");
-    };
-    cause
-}
-
-#[tokio::test]
-async fn a_whole_run_goes_in_through_the_recorder_and_reads_back_through_the_log() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let state = dir.path().join("harness");
-    let turso = Arc::new(TursoRecorder::new(&state));
-    let path = turso.path().to_path_buf();
-    assert_eq!(path.parent(), Some(state.as_path()));
-    let recorder = turso.for_agent(AGENT);
-    assert!(
-        !state.exists(),
-        "building the recorder and its handle touches no file; the first run does"
-    );
-
-    let run = recorder.begin_run(meta(FIRST)).await.unwrap();
-    recorder
-        .append(run, record(RecordKind::Effect, 0, Some(7), "a"))
-        .await
-        .unwrap();
-    recorder
-        .append(run, record(RecordKind::Answer, 1, Some(7), "a"))
-        .await
-        .unwrap();
-    recorder
-        .append(run, record(RecordKind::Event, 2, None, "a"))
-        .await
-        .unwrap();
-    recorder.end_run(run, Ok("done".to_owned())).await.unwrap();
-    drop((recorder, turso));
-
-    let log = read_back(&path).await;
-    let row = log.run(run).await.unwrap();
-    assert_eq!(row.meta, meta(FIRST));
-    assert_eq!(row.agent, AGENT, "the handle writes its agent");
-    assert_eq!(row.result, Some(Ok("done".to_owned())));
-    assert!(row.ended_at.is_some());
-
-    let records = log.records(run, ALL).await.unwrap();
-    let stored: Vec<(RecordKind, u32, Option<u64>)> = records
-        .iter()
-        .map(|stored| {
-            (
-                stored.record.kind,
-                stored.record.task_seq,
-                stored.record.effect_id,
-            )
-        })
-        .collect();
-    assert_eq!(
-        stored,
-        [
-            (RecordKind::Effect, 0, Some(7)),
-            (RecordKind::Answer, 1, Some(7)),
-            (RecordKind::Event, 2, None),
-        ]
-    );
-    for (index, stored) in records.iter().enumerate() {
-        let task_seq = u32::try_from(index).unwrap();
-        assert_eq!(
-            stored.record.payload,
-            json!({ "owner": "a", "task_seq": task_seq })
-        );
-    }
-}
-
-#[tokio::test]
-async fn each_handle_writes_its_own_agent_into_the_shared_log() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let turso = Arc::new(TursoRecorder::new(dir.path().join("harness")));
-    let path = turso.path().to_path_buf();
-    let chat = turso.for_agent("chat");
-    let echo = turso.for_agent("echo");
-
-    let first = chat.begin_run(meta(FIRST)).await.unwrap();
-    let second = echo.begin_run(meta(SECOND)).await.unwrap();
-    assert_ne!(first, second, "both handles write one log");
-    chat.end_run(first, Err(Error::canceled())).await.unwrap();
-    echo.end_run(second, Err(Error::canceled())).await.unwrap();
-    drop((chat, echo, turso));
-
-    let log = read_back(&path).await;
-    for (run, started_at, agent) in [(first, FIRST, "chat"), (second, SECOND, "echo")] {
-        let row = log.run(run).await.unwrap();
-        assert_eq!(row.meta.started_at, started_at);
-        assert_eq!(row.agent, agent, "run {run} names its own handle's agent");
-    }
-}
-
-#[tokio::test]
-async fn a_failed_open_is_retried_by_the_next_call() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let state = dir.path().join("harness");
-    fs::write(&state, b"a file where the state directory belongs").unwrap();
-    let turso = Arc::new(TursoRecorder::new(&state));
-    let recorder = turso.for_agent(AGENT);
-
-    let error = recorder.begin_run(meta(FIRST)).await.unwrap_err();
-    assert!(
-        log_failure(&error).starts_with("run log file: "),
-        "the directory cannot be created: {error:?}"
-    );
-
-    fs::remove_file(&state).unwrap();
-    let run = recorder.begin_run(meta(FIRST)).await.unwrap();
-    recorder
-        .append(run, record(RecordKind::Event, 0, None, "a"))
-        .await
-        .unwrap();
-    recorder.end_run(run, Err(Error::canceled())).await.unwrap();
-    let path = turso.path().to_path_buf();
-    drop((recorder, turso));
-
-    let log = read_back(&path).await;
-    assert!(matches!(
-        log.run(run).await.unwrap().result,
-        Some(Err(error)) if error.is_canceled()
-    ));
-    assert_eq!(log.records(run, ALL).await.unwrap().len(), 1);
-}
-
-#[tokio::test]
-async fn the_same_file_reopens_with_its_rows() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let state = dir.path().join("harness");
-
-    let first = Arc::new(TursoRecorder::new(&state));
-    let handle = first.for_agent(AGENT);
-    let earlier = handle.begin_run(meta(FIRST)).await.unwrap();
-    handle
-        .append(earlier, record(RecordKind::Event, 0, None, "first"))
-        .await
-        .unwrap();
-    handle
-        .end_run(earlier, Err(Error::canceled()))
-        .await
-        .unwrap();
-    drop((handle, first));
-
-    let second = Arc::new(TursoRecorder::new(&state));
-    let later = second
-        .for_agent(AGENT)
-        .begin_run(meta(SECOND))
-        .await
-        .unwrap();
-    assert_ne!(later, earlier, "a reopened file issues a fresh run id");
-    let path = second.path().to_path_buf();
-    drop(second);
-
-    let log = read_back(&path).await;
-    let kept = log.run(earlier).await.unwrap();
-    assert_eq!(kept.meta.started_at, FIRST);
-    assert!(matches!(kept.result, Some(Err(error)) if error.is_canceled()));
-    assert_eq!(log.records(earlier, ALL).await.unwrap().len(), 1);
-    let open = log.run(later).await.unwrap();
-    assert_eq!(open.meta.started_at, SECOND);
-    assert_eq!(open.result, None);
-}
-
-#[tokio::test]
-async fn a_write_the_log_refuses_reaches_the_caller_as_a_recorder_error() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let recorder = Arc::new(TursoRecorder::new(dir.path().join("harness"))).for_agent(AGENT);
-
-    let unknown = RunId::from_raw(41);
-    let error = recorder
-        .append(unknown, record(RecordKind::Event, 0, None, "a"))
-        .await
-        .unwrap_err();
-    assert!(
-        log_failure(&error) == LogError::UnknownRun(unknown).to_string(),
-        "{error:?}"
-    );
-
-    let run = recorder.begin_run(meta(FIRST)).await.unwrap();
-    recorder.end_run(run, Err(Error::canceled())).await.unwrap();
-    let error = recorder
-        .end_run(run, Err(Error::canceled()))
-        .await
-        .unwrap_err();
-    assert!(
-        log_failure(&error) == LogError::RunEnded(run).to_string(),
-        "{error:?}"
-    );
-}
-
-/// Begins a run for `owner`, appends three events, and ends it.
-async fn whole_run(recorder: &impl RunRecorder, owner: &str) -> RunId {
-    let run = recorder.begin_run(meta(FIRST)).await.unwrap();
-    for task_seq in 0..3 {
-        recorder
-            .append(run, record(RecordKind::Event, task_seq, None, owner))
-            .await
-            .unwrap();
-    }
-    recorder.end_run(run, Err(Error::canceled())).await.unwrap();
-    run
-}
-
-#[tokio::test]
-async fn runs_that_overlap_keep_their_own_records() {
-    let dir = tempfile::TempDir::new().unwrap();
-    let turso = Arc::new(TursoRecorder::new(dir.path().join("harness")));
-    let recorder = turso.for_agent(AGENT);
-
-    let (one, two) = tokio::join!(whole_run(&recorder, "one"), whole_run(&recorder, "two"));
-    assert_ne!(one, two);
-    let path = turso.path().to_path_buf();
-    drop((recorder, turso));
-
-    let log = read_back(&path).await;
-    for (run, owner) in [(one, "one"), (two, "two")] {
-        let records = log.records(run, ALL).await.unwrap();
-        let owners: Vec<&str> = records
-            .iter()
-            .map(|stored| stored.record.payload["owner"].as_str().unwrap())
-            .collect();
-        assert_eq!(owners, [owner; 3]);
-        let task_seqs: Vec<u32> = records
-            .iter()
-            .map(|stored| stored.record.task_seq)
-            .collect();
-        assert_eq!(task_seqs, [0, 1, 2]);
-    }
-}
diff --git a/crates/workshop/run-log/tests/it/result.rs b/crates/workshop/run-log/tests/it/result.rs
deleted file mode 100644
index d239b5efb..000000000
--- a/crates/workshop/run-log/tests/it/result.rs
+++ /dev/null
@@ -1,209 +0,0 @@
-//! The stored form of a run's result: the raw columns `end_run` writes,
-//! and the rows `run` refuses because they fit no result.
-
-// clippy.toml's allow-unwrap-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking is what these are for.
-#![expect(
-    clippy::unwrap_used,
-    reason = "test helpers fail by panicking with the failure shown"
-)]
-
-use std::num::NonZeroU32;
-use std::path::Path;
-
-use runvil::{Error, ErrorCode, RunSeed, SourceLoc, Timestamp};
-use workshop_run_log::{LogError, RunId, RunLog, RunMeta, RunRow};
-
-/// The agent the Host launched.
-const AGENT: &str = "chat";
-
-/// A run's opening row.
-fn meta() -> RunMeta {
-    RunMeta {
-        seed: RunSeed::from_bytes([5; 32]),
-        flags: 0,
-        started_at: Timestamp::from_unix_millis(1_700_000_000_000),
-    }
-}
-
-/// A failure that is not a cancel.
-fn failure() -> Error {
-    let code = ErrorCode::ToolBackend;
-    Error::new(code, "expected a reply, got nothing", code.prose())
-}
-
-/// Begins a run in the log file at `path`, ends it with `result`, and
-/// closes the log.
-async fn ended(path: &Path, result: Result<String, Error>) -> RunId {
-    let mut log = RunLog::open(path).await.unwrap();
-    let run = log.begin_run(meta(), AGENT).await.unwrap();
-    log.end_run(run, result).await.unwrap();
-    run
-}
-
-/// A direct connection to the log file at `path`, past the log's own
-/// reads and writes.
-async fn connect(path: &Path) -> turso::Connection {
-    turso::Builder::new_local(path.to_str().unwrap())
-        .build()
-        .await
-        .unwrap()
-        .connect()
-        .unwrap()
-}
-
-/// Reopens the log file at `path` and reads `run`'s row.
-async fn reread(path: &Path, run: RunId) -> Result<RunRow, LogError> {
-    let log = RunLog::open(path).await.unwrap();
-    log.run(run).await
-}
-
-#[tokio::test]
-async fn the_status_and_error_code_columns_hold_the_status_and_the_code_tag() {
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-    let mut located = Error::new(
-        ErrorCode::NotFound,
-        "expected /notes.md to exist, found nothing",
-        ErrorCode::NotFound.prose(),
-    );
-    located.at = Some(SourceLoc::line("prompt.md", NonZeroU32::new(3).unwrap()));
-    let failed = ended(&path, Err(located.clone())).await;
-    let canceled = ended(&path, Err(Error::canceled())).await;
-    let completed = ended(&path, Ok("done".to_owned())).await;
-
-    let raw = connect(&path).await;
-    let expected = [
-        (
-            failed,
-            "failed",
-            None,
-            Some(ErrorCode::NotFound.tag().to_owned()),
-            Some(located.located_message()),
-        ),
-        (
-            canceled,
-            "canceled",
-            None,
-            Some(ErrorCode::Canceled.tag().to_owned()),
-            Some(Error::canceled().located_message()),
-        ),
-        (completed, "completed", Some("done".to_owned()), None, None),
-    ];
-    for (run, status, final_text, error_code, error_message) in expected {
-        let mut rows = raw
-            .query(
-                "SELECT status, final_text, error_code, error_message FROM runs \
-                 WHERE run_id = ?1",
-                (run.get(),),
-            )
-            .await
-            .unwrap();
-        let row = rows.next().await.unwrap().unwrap();
-        assert_eq!(row.get::<String>(0).unwrap(), status, "run {run}'s status");
-        assert_eq!(
-            row.get::<Option<String>>(1).unwrap(),
-            final_text,
-            "run {run}'s final_text"
-        );
-        assert_eq!(
-            row.get::<Option<String>>(2).unwrap(),
-            error_code,
-            "run {run}'s error_code is its code's tag"
-        );
-        assert_eq!(
-            row.get::<Option<String>>(3).unwrap(),
-            error_message,
-            "run {run}'s error_message is its located message"
-        );
-    }
-}
-
-#[tokio::test]
-async fn an_unknown_code_tag_in_error_code_reads_as_corrupt() {
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-    let run = ended(&path, Err(failure())).await;
-    let raw = connect(&path).await;
-    raw.execute(
-        "UPDATE runs SET error_code = 'exploded' WHERE run_id = ?1",
-        (run.get(),),
-    )
-    .await
-    .unwrap();
-    drop(raw);
-
-    let refused = reread(&path, run).await;
-    assert!(
-        matches!(&refused, Err(LogError::Corrupt(message))
-            if message.contains("error_code") && message.contains("exploded")),
-        "an unknown code tag is a read error naming the column and the tag: {refused:?}"
-    );
-}
-
-#[tokio::test]
-async fn an_unknown_status_reads_as_corrupt() {
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-    let run = ended(&path, Ok("done".to_owned())).await;
-    let raw = connect(&path).await;
-    let update = "UPDATE runs SET status = 'exploded' WHERE run_id = ?1";
-    assert!(
-        raw.execute(update, (run.get(),)).await.is_err(),
-        "the schema refuses an unknown status"
-    );
-    raw.execute("PRAGMA ignore_check_constraints = ON", ())
-        .await
-        .unwrap();
-    raw.execute(update, (run.get(),)).await.unwrap();
-    drop(raw);
-
-    let refused = reread(&path, run).await;
-    assert!(
-        matches!(&refused, Err(LogError::Corrupt(message))
-            if message.contains("status") && message.contains("exploded")),
-        "an unknown status is a read error naming the status: {refused:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_row_whose_columns_fit_no_result_reads_as_corrupt() {
-    let dir = tempfile::tempdir().unwrap();
-    let path = dir.path().join("runs.db");
-    let run = ended(&path, Ok("done".to_owned())).await;
-    // Each row breaks one rule of the three shapes: a completed run has
-    // its final text alone, and a failed or canceled run has a code and a
-    // message, the code `canceled` exactly when the run is canceled.
-    let shapes = [
-        ("completed", None, None, None),
-        (
-            "completed",
-            Some("done"),
-            Some("tool_backend"),
-            Some("failed"),
-        ),
-        ("failed", None, Some("tool_backend"), None),
-        ("failed", Some("done"), Some("tool_backend"), Some("failed")),
-        ("failed", None, Some("canceled"), Some("canceled")),
-        ("canceled", None, Some("tool_backend"), Some("failed")),
-        ("canceled", None, None, Some("canceled")),
-    ];
-    for (status, final_text, error_code, error_message) in shapes {
-        let raw = connect(&path).await;
-        raw.execute(
-            "UPDATE runs SET status = ?2, final_text = ?3, error_code = ?4, \
-             error_message = ?5 WHERE run_id = ?1",
-            (run.get(), status, final_text, error_code, error_message),
-        )
-        .await
-        .unwrap();
-        drop(raw);
-
-        let refused = reread(&path, run).await;
-        assert!(
-            matches!(refused, Err(LogError::Corrupt(_))),
-            "status {status} with final_text={final_text:?} error_code={error_code:?} \
-             error_message={error_message:?} reads as corrupt: {refused:?}"
-        );
-    }
-}
diff --git a/crates/workshop/server-api/Cargo.toml b/crates/workshop/server-api/Cargo.toml
deleted file mode 100644
index 80ac7ba4a..000000000
--- a/crates/workshop/server-api/Cargo.toml
+++ /dev/null
@@ -1,22 +0,0 @@
-[package]
-name = "workshop-server-api"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[features]
-default = []
-# Forwards the server's integration-test seams (`fixtures`) to the desktop app's
-# tests without the desktop app depending on `workshop-server` itself.
-test-fixtures = ["workshop-server/test-fixtures"]
-
-[dependencies]
-workshop-server.workspace = true
-
-[dev-dependencies]
-workshop-server-api = { path = ".", features = ["test-fixtures"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/server-api/src/lib-tests.rs b/crates/workshop/server-api/src/lib-tests.rs
deleted file mode 100644
index 93c03165b..000000000
--- a/crates/workshop/server-api/src/lib-tests.rs
+++ /dev/null
@@ -1,49 +0,0 @@
-//! Desktop-app-facing surface tests: every re-export is named and the fixtures feature forwards the seams.
-
-use super::*;
-
-/// The unqualified type name of `T`, so the assertions read as the
-/// shipping surface reads.
-fn short_name<T>() -> &'static str {
-    let name = std::any::type_name::<T>();
-    name.rsplit("::").next().unwrap_or(name)
-}
-
-/// Compile-level check: `spawn` resolves and has the server's signature.
-fn spawn_signature(start: fn(Config) -> Result<ServerHandle, SpawnError>) {
-    let _ = start;
-}
-
-/// Compile-level check: `list_plugin_dir` resolves and has the server's
-/// signature.
-fn list_signature(list: fn(&std::path::Path) -> std::io::Result<PluginListing>) {
-    let _ = list;
-}
-
-#[test]
-fn the_desktop_app_facing_surface_names_every_re_export() {
-    // Configuration.
-    assert_eq!(short_name::<AgentsConfig>(), "AgentsConfig");
-    assert_eq!(short_name::<Config>(), "Config");
-    assert_eq!(short_name::<GatewayConfig>(), "GatewayConfig");
-    assert_eq!(short_name::<ServerConfig>(), "ServerConfig");
-    // The in-process server lifecycle.
-    spawn_signature(spawn);
-    assert_eq!(short_name::<ServerHandle>(), "ServerHandle");
-    assert_eq!(short_name::<SpawnError>(), "SpawnError");
-    assert_eq!(short_name::<Termination>(), "Termination");
-    // The Gateway publication seam.
-    assert_eq!(short_name::<GatewayUpdater>(), "GatewayUpdater");
-    assert_eq!(
-        short_name::<GatewayPublicationError>(),
-        "GatewayPublicationError"
-    );
-    // The listing of a Plugin directory.
-    list_signature(list_plugin_dir);
-    assert_eq!(short_name::<PluginListing>(), "PluginListing");
-}
-
-#[test]
-fn the_test_fixtures_feature_forwards_the_server_seams() {
-    spawn_signature(fixtures::spawn);
-}
diff --git a/crates/workshop/server-api/src/lib.rs b/crates/workshop/server-api/src/lib.rs
deleted file mode 100644
index cbb13cf3f..000000000
--- a/crates/workshop/server-api/src/lib.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-//! workshop-server-api - the desktop app's entire view of the workshop
-//! server: re-exports only.
-//!
-//! The desktop app (`workshop`) depends on this crate and never on
-//! `workshop-server`, so server internals do not resolve in the desktop app at
-//! all. The surface is the configuration types, the in-process server
-//! lifecycle, the Gateway publication seam, and the listing of a Plugin
-//! directory; the `test-fixtures` feature forwards the server's
-//! integration-test seams.
-//!
-//! ## Invariants
-//!
-//! - Tier: desktop-app boundary; may depend on: `workshop-server` only.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - This crate is re-exports only: no types, functions, or logic of its
-//!   own. Anything the desktop app needs is a `pub use` of a `workshop-server`
-//!   item, and the desktop app's sole view of the server is this crate.
-
-pub use workshop_server::{
-    AgentsConfig, Config, GatewayConfig, GatewayPublicationError, GatewayUpdater, PluginListing,
-    ServerConfig, ServerHandle, SpawnError, Termination, discovery, list_plugin_dir, spawn,
-};
-
-/// The server's integration-test seams, forwarded to the desktop app's tests.
-#[cfg(feature = "test-fixtures")]
-pub use workshop_server::fixtures;
-
-#[cfg(test)]
-#[path = "lib-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/AGENTS.md b/crates/workshop/server/AGENTS.md
deleted file mode 100644
index 765d1631e..000000000
--- a/crates/workshop/server/AGENTS.md
+++ /dev/null
@@ -1,4 +0,0 @@
-# workshop-server
-
-- Do not install global tracing state or retain process-global initialization that ignores the embedding binary's arguments.
-- Do not pass one subsystem's handles into another subsystem's constructor, and do not reintroduce per-request panics on missing registrations.
diff --git a/crates/workshop/server/Cargo.toml b/crates/workshop/server/Cargo.toml
deleted file mode 100644
index b27d5a8ec..000000000
--- a/crates/workshop/server/Cargo.toml
+++ /dev/null
@@ -1,90 +0,0 @@
-[package]
-name = "workshop-server"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-[dependencies]
-# `SearchProvider`, which the agent sessions' Gateway search implements,
-# is an `async_trait` trait.
-async-trait.workspace = true
-axum.workspace = true
-futures-util.workspace = true
-# The one crate a Host depends on: each conversation's launch builds the
-# per-run Harness that runs it, the agent socket frames a run's events as
-# transcript entries and the status reporter derives status from them,
-# the prompt parser sits behind the `/prompts/contract` route, and the
-# agent sessions provide the server's runtime under the Plugin
-# contract's tokio runtime service name.
-runvil.workspace = true
-# The Gateway web search client the agent sessions' search provider
-# sends each search through.
-harness-gateway-client.workspace = true
-# The web Pack every agent run's Host installs: `runvil/web`, with the
-# search-provider and runtime services it reads.
-plugin-web.workspace = true
-# The MCP client Pack, installed once over every server of the
-# configured `mcp.json`.
-plugin-mcp.workspace = true
-# The std Plugin's dynamic library, which holds the file-tool Pack
-# `runvil/std`. Nothing here links it in or calls it: the dependency makes
-# Cargo build the library with every build of the server, into `deps`
-# beside the test executables, and the server loads it from its Plugin
-# directory like any other library Plugin.
-workshop-plugin-std.workspace = true
-# The bashkit Plugin's dynamic library, which holds the shell Pack
-# `runvil/bash`. Like std's, it is here only so that Cargo builds it.
-workshop-plugin-bashkit.workspace = true
-reqwest.workspace = true
-rust-embed.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-socket2.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-tokio-tungstenite.workspace = true
-tracing.workspace = true
-url.workspace = true
-# The conversation layer: the conversation table, transcripts, agent
-# discovery, and the recorder tee each run writes through.
-workshop-agents.workspace = true
-workshop-gateway.workspace = true
-workshop-menu.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-run-log.workspace = true
-workshop-status.workspace = true
-workshop-support.workspace = true
-workshop-user-state.workspace = true
-workshop-workspace.workspace = true
-tempfile = { workspace = true, optional = true }
-
-[features]
-default = []
-test-fixtures = [
-    "dep:tempfile",
-    "workshop-gateway/test-fixtures",
-    "workshop-support/test-fixtures",
-    "workshop-workspace/test-fixtures",
-]
-
-[dev-dependencies]
-workshop-server = { path = ".", features = ["test-fixtures"] }
-tempfile.workspace = true
-tokio = { workspace = true, features = ["test-util"] }
-tower.workspace = true
-
-# The build script bundles the UI with esbuild into OUT_DIR through the
-# shared helper; nothing UI-built lands in the repository.
-[build-dependencies]
-build-ui = { path = "../../build-ui" }
-
-[lints]
-workspace = true
-
-# Not released through cargo-dist; the gateway is the only disted package
-# (see dist-workspace.toml).
-[package.metadata.dist]
-dist = false
diff --git a/crates/workshop/server/build.rs b/crates/workshop/server/build.rs
deleted file mode 100644
index a69db7781..000000000
--- a/crates/workshop/server/build.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-//! Builds the workshop UI bundle before the Rust compile: esbuild on
-//! `../ui/src/main.ts` (the sibling `crates/workshop/ui/` package) plus
-//! copies of the static assets, all written to `$OUT_DIR/ui-dist/` (never
-//! into the repository). The crate version is baked into the bundle as
-//! `__APP_VERSION__`. Requires Node.js 22 on `PATH` and one `npm ci` in
-//! the `crates/workshop/` npm workspace per checkout (`npm ci --prefix
-//! crates/workshop` from the repository root).
-
-fn main() -> std::process::ExitCode {
-    match build_ui::build_sibling(
-        "../ui",
-        build_ui::UiBuild {
-            static_files: build_ui::WORKSHOP_STATIC_FILES,
-            define_app_version: true,
-            splitting: true,
-        },
-    ) {
-        Ok(()) => std::process::ExitCode::SUCCESS,
-        Err(error) => {
-            eprintln!("{error}");
-            std::process::ExitCode::FAILURE
-        }
-    }
-}
diff --git a/crates/workshop/server/src/agents.rs b/crates/workshop/server/src/agents.rs
deleted file mode 100644
index d50bc9e9d..000000000
--- a/crates/workshop/server/src/agents.rs
+++ /dev/null
@@ -1,532 +0,0 @@
-//! The agent-sessions subsystem of the server: the `/agents/ws`
-//! agent-session socket ([`socket`]) and its frames ([`wire`]), the
-//! `/v1/models` catalog relay ([`relay`]), their shared route state
-//! ([`state`]), and [`AgentSessions`], the server's launcher of agent
-//! conversations. The `/ws` workshop socket sits outside this subsystem;
-//! the two share only [`crate::websocket`].
-//!
-//! The server builds one [`Host`] at startup: its `Packs`, installed from
-//! the linked web and mcp Plugins, mcp over the servers of the configured
-//! `mcp.json`, the library Plugins in the configured Plugin directory,
-//! the std Plugin with the file-tool Pack and the bashkit Plugin with the
-//! shell Pack among them, and the built-ins subagents and user; a finder
-//! that reads
-//! each agent from the agents folder through `load_agent`; and the tokio
-//! timer. Each launch opens a conversation in `workshop-agents` and builds
-//! that conversation's one run its own [`RunSetup`]: the conversation's
-//! recorder tee on a handle of the run log's [`TursoRecorder`] that names
-//! the launched agent, a per-run broker over the server's inference broker
-//! ([`broker`]), and a user, the conversation's operator, so the run holds
-//! `runvil/user`; the operator's messages reach the run's main chain
-//! through the conversation. The run makes its own instance of each Pack
-//! it holds and drops them when it ends. The run reaches the gateway only
-//! through its per-run broker, which follows the live gateway binding and
-//! sends each round to the dropdown's current pick. Each run's filesystem
-//! is an in-memory root, with a read-only mount beside it for each of two
-//! demos whose switch is on: the language guide, and the machine's C
-//! drive (`language_guide`). Both switches are committed as off. The run's
-//! setup carries the Host state ([`bindings`]): the menu's pick and the
-//! workspace's granted roots, read once the menu's catalog holds a
-//! chat-capable model. Status-bar reporting stays in the server
-//! (`status`): a per-conversation reporter derives it from the
-//! conversation's events, deltas, and failure reports.
-//!
-//! **Registry carve-out.** Conversations survive socket disconnect and
-//! sockets attach and detach (`socket`), so the launcher keeps the
-//! conversation table the server's socket rule otherwise forbids. The rule
-//! governed per-request relay work, where every held resource belonged to
-//! one socket; a conversation is longer-lived than any socket on purpose.
-
-mod bindings;
-mod broker;
-mod gateway;
-mod language_guide;
-mod relay;
-mod search;
-mod socket;
-mod socket_frames;
-mod state;
-mod status;
-mod wire;
-
-use std::fmt;
-use std::io;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-use plugin_web::SEARCH_PROVIDER;
-use runvil::harness::{Packs, PluginReport, RunId, insert_plugin_dir};
-use runvil::plugin::{HostServices, PackRegistry, ServiceKey};
-use runvil::{Error, ErrorCode, ErrorFact, Host, RunSetup};
-use serde_json::{Map, Value};
-use workshop_agents::{
-    Conversation, ConversationId, Conversations, LaunchError, TokioTimer, discover_agents,
-    load_agent,
-};
-use workshop_registry::Registry;
-use workshop_run_log::TursoRecorder;
-use workshop_support::{Config, ReconnectBackoff};
-
-use bindings::with_host_state;
-use broker::{RunBroker, WorkshopBroker};
-use gateway::usable_gateway;
-use search::GatewaySearchProvider;
-use socket::Receivers;
-pub(crate) use state::{SessionsState, register};
-
-/// The directory under the server's state directory the run log sits in:
-/// the `runs.db` every conversation's run is recorded in.
-const HARNESS_STATE_DIR: &str = "harness";
-
-/// The key the server provides its runtime under: the Plugin contract's
-/// tokio runtime service, as the handle it supplies.
-const RUNTIME: ServiceKey<tokio::runtime::Handle> = ServiceKey::new(runvil::plugin::TOKIO_RUNTIME);
-
-/// The server's installed Packs over its Host-wide [`services`], and what
-/// its Plugin directory loaded. `mcp` is the `[agents] mcp` setting: the
-/// mcp Pack is installed over the servers of the file it names. `plugins`
-/// is the `[agents] plugins` setting: the directory whose library Plugins
-/// are loaded.
-fn host_packs(
-    registry: &Registry,
-    mcp: Option<&Path>,
-    plugins: Option<&Path>,
-) -> (Packs, Option<PluginReport>) {
-    with_plugins(&services(registry), read_mcp_servers(mcp), plugins)
-}
-
-/// The `mcpServers` object of the `mcp.json`-format file at `setting`,
-/// with every other top-level key ignored. No setting or a missing file
-/// gives an empty object, and so does a file that cannot be read or is
-/// not an `mcpServers` object, with a warning that names the file and the
-/// rule and holds no entry value. The object is handed on as it stands:
-/// the mcp Pack refuses a malformed entry on its own, and the other
-/// servers still connect.
-fn read_mcp_servers(setting: Option<&Path>) -> Value {
-    let none = || Value::Object(serde_json::Map::new());
-    let Some(path) = setting else {
-        return none();
-    };
-    let text = match std::fs::read_to_string(path) {
-        Ok(text) => text,
-        Err(error) if error.kind() == io::ErrorKind::NotFound => return none(),
-        Err(error) => {
-            tracing::warn!(
-                path = %path.display(),
-                %error,
-                "the MCP file could not be read; no MCP servers are configured"
-            );
-            return none();
-        }
-    };
-    let document = match serde_json::from_str::<Value>(&text) {
-        Ok(document) => document,
-        Err(error) => {
-            tracing::warn!(
-                path = %path.display(),
-                %error,
-                "the MCP file is not valid JSON; no MCP servers are configured"
-            );
-            return none();
-        }
-    };
-    let Value::Object(mut top) = document else {
-        tracing::warn!(
-            path = %path.display(),
-            "the MCP file must be a JSON object; no MCP servers are configured"
-        );
-        return none();
-    };
-    match top.remove("mcpServers") {
-        None => none(),
-        Some(servers @ Value::Object(_)) => servers,
-        Some(_) => {
-            tracing::warn!(
-                path = %path.display(),
-                "the MCP file's `mcpServers` must be a JSON object; no MCP servers are configured"
-            );
-            none()
-        }
-    }
-}
-
-/// The Packs of the server's Host, and what its Plugin directory loaded.
-///
-/// The linked Plugins, web and mcp, install first with the Host-wide
-/// `services`, mcp with the `servers` object as its configuration. Then
-/// every library Plugin in the directory `plugins` loads, when the server
-/// is given one. The std Plugin, whose Pack holds the file tools, and the
-/// bashkit Plugin, whose Pack holds the shell, are two of those
-/// libraries, so a Host whose Plugin directory lacks one has no `std` or
-/// no `bash` Pack and refuses a prompt that requires it. A `tracing`
-/// warning says so at startup. The registry also holds the built-ins
-/// `subagents` and `user`, and each run makes its own instances of the
-/// Packs it holds. The report lists each library Plugin that loaded and
-/// each failure.
-fn with_plugins(
-    services: &HostServices,
-    servers: Value,
-    plugins: Option<&Path>,
-) -> (Packs, Option<PluginReport>) {
-    let mut packs = PackRegistry::new();
-    if let Err(error) = plugin_web::install(&mut packs, Value::Null, services) {
-        tracing::warn!(%error, "the web Plugin inserted no Pack");
-    }
-    let mcp = Map::from_iter([("mcp".to_owned(), servers)]);
-    if let Err(error) = plugin_mcp::install(&mut packs, Value::Object(mcp), services) {
-        tracing::warn!(%error, "the mcp Plugin inserted no Pack");
-    }
-    let report = plugins.and_then(|directory| load_plugin_dir(&mut packs, directory));
-    for pack in SHIPPED_PACKS {
-        if !holds(&packs, pack) {
-            tracing::warn!(
-                directory = ?plugins,
-                pack,
-                "no library Plugin inserted a Pack that Workshop ships; an agent that requires it is refused"
-            );
-        }
-    }
-    (Packs::new(packs), report)
-}
-
-/// The Packs that only a library Plugin Workshop ships inserts: the file
-/// tools, from the std Plugin, and the shell, from the bashkit Plugin.
-const SHIPPED_PACKS: [&str; 2] = ["runvil/std", "runvil/bash"];
-
-/// Whether `packs` holds the Pack named `pack`, a vendor and a Pack id.
-fn holds(packs: &PackRegistry, pack: &str) -> bool {
-    packs.list().any(|(info, _)| info.fqn == pack)
-}
-
-/// What the library Plugins in one directory do when they are loaded.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct PluginListing {
-    /// Each Plugin that loads, as its name, a space, and its version, in
-    /// the order the directory loads them.
-    pub loaded: Vec<String>,
-    /// Each library that does not load, as its path and the reason.
-    pub failed: Vec<String>,
-}
-
-/// Loads every library Plugin in `directory`, lists what each did, and
-/// unloads them all again.
-///
-/// The desktop app prints the listing for `runvil-workshop --plugins`.
-/// Workshop keeps no log, so this is how a person, or an installer test,
-/// sees which Plugins an installation loads.
-///
-/// # Errors
-/// Returns the I/O error when `directory` cannot be read, as when it does
-/// not exist.
-pub fn list_plugin_dir(directory: &Path) -> io::Result<PluginListing> {
-    let mut packs = PackRegistry::new();
-    let report = insert_plugin_dir(&mut packs, directory)?;
-    let loaded = report
-        .plugins()
-        .iter()
-        .map(|plugin| format!("{} {}", plugin.name(), plugin.version()))
-        .collect();
-    let failed = report
-        .failures()
-        .iter()
-        .map(|failure| {
-            let path = failure
-                .facts
-                .get(&ErrorFact::Path)
-                .and_then(Value::as_str)
-                .unwrap_or_default();
-            format!("{path}: {failure}")
-        })
-        .collect();
-    Ok(PluginListing { loaded, failed })
-}
-
-/// Loads every library Plugin in `directory` and returns the report of
-/// what loaded, or `None` when the directory cannot be read. A directory
-/// that does not exist is a state, not a failure: a build that has not
-/// placed its Plugins has none. Each Plugin that loaded is logged with
-/// its name, version, and source, and each library that did not, with its
-/// path and the reason; one failure never stops the others.
-fn load_plugin_dir(packs: &mut PackRegistry, directory: &Path) -> Option<PluginReport> {
-    let report = match insert_plugin_dir(packs, directory) {
-        Ok(report) => report,
-        Err(error) if error.kind() == io::ErrorKind::NotFound => return None,
-        Err(error) => {
-            tracing::warn!(
-                directory = %directory.display(),
-                %error,
-                "the Plugin directory could not be read; no library Plugin is loaded"
-            );
-            return None;
-        }
-    };
-    for plugin in report.plugins() {
-        tracing::info!(
-            name = plugin.name(),
-            version = plugin.version(),
-            source = ?plugin.source(),
-            "loaded a library Plugin"
-        );
-    }
-    for failure in report.failures() {
-        let path = failure
-            .facts
-            .get(&ErrorFact::Path)
-            .and_then(Value::as_str)
-            .unwrap_or_default();
-        tracing::warn!(path, error = %failure, "a library Plugin did not load");
-    }
-    Some(report)
-}
-
-/// The Host-wide services the Plugins' `install`s read: the search
-/// provider over the gateway `registry` holds, and the runtime the server
-/// runs on, under the Plugin contract's tokio runtime service. Built
-/// outside a runtime, as a synchronous test does, the runtime is left
-/// out, web and mcp are inserted unavailable, and a run that requires
-/// either is refused.
-fn services(registry: &Registry) -> HostServices {
-    let mut services = HostServices::new();
-    // Two valid, distinct literals into an empty map, so neither call
-    // can be refused.
-    let _ = services.provide(
-        &SEARCH_PROVIDER,
-        Arc::new(GatewaySearchProvider::new(registry.clone())),
-    );
-    if let Ok(runtime) = tokio::runtime::Handle::try_current() {
-        let _ = services.provide(&RUNTIME, Arc::new(runtime));
-    }
-    services
-}
-
-/// The Host finder over the agents folder at `agents_path`: the source
-/// `load_agent` reads for each name, or its refusal as [`agent_error`].
-fn agent_finder(agents_path: PathBuf) -> impl Fn(&str) -> Result<String, Error> + Send + Sync {
-    move |name: &str| {
-        load_agent(&agents_path, name)
-            .map(|(_file, source)| source)
-            .map_err(|refusal| agent_error(&refusal))
-    }
-}
-
-/// The Host finder's failure for an agent `load_agent` refused: the
-/// refusal's display text, under `NotFound` for an agent discovery does
-/// not list and `Io` for one whose source cannot be read.
-fn agent_error(refusal: &LaunchError) -> Error {
-    let code = match refusal {
-        LaunchError::UnknownAgent { .. } => ErrorCode::NotFound,
-        _ => ErrorCode::Io,
-    };
-    Error::new(code, refusal.to_string(), code.prose())
-}
-
-/// The server's launcher of agent conversations: discovery, launch,
-/// lookup, and close, plus the server-side work a launch wires up - the
-/// run's setup and the status reporter.
-///
-/// Typed and construction-phased: the registry, the server's backoff, the
-/// run log, and the Host every run shares are captured when
-/// the composition root builds it, and the other subsystems are read
-/// through the registry at the point of use, so this handle never holds
-/// another subsystem's handle.
-#[derive(Clone)]
-pub struct AgentSessions {
-    inner: Arc<Inner>,
-}
-
-/// The shared state behind the cloneable handle.
-struct Inner {
-    /// The subsystem registry: the gateway and menu handles, the
-    /// workspace roots, and the push facade are read through it.
-    registry: Registry,
-    /// Reset on completed replies: an agent reply is useful gateway work.
-    backoff: ReconnectBackoff,
-    /// The folder the launchable agents are discovered in.
-    agents_path: PathBuf,
-    /// The run log every run is recorded in, through a handle naming its
-    /// agent behind each run's tee.
-    recorder: Arc<TursoRecorder>,
-    /// The inference broker behind each run's broker.
-    broker: WorkshopBroker,
-    /// What every run shares: the installed Packs each run makes its
-    /// instances of, the finder that reads each agent from the agents
-    /// folder, and the tokio timer.
-    host: Arc<Host>,
-    /// What the Plugin directory loaded, held so that a library Plugin
-    /// which inserted no Pack still stays loaded for as long as the
-    /// launcher lives.
-    _plugins: Option<PluginReport>,
-    /// The running conversations.
-    conversations: Conversations,
-}
-
-impl fmt::Debug for AgentSessions {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("AgentSessions")
-            .field("conversations", &self.inner.conversations)
-            .finish_non_exhaustive()
-    }
-}
-
-impl AgentSessions {
-    /// Builds the launcher for `config` over the subsystem registry and
-    /// the server's reconnect backoff. The only file this reads is the
-    /// `[agents] mcp` file, when the setting names one, and the only
-    /// connections it starts are the background ones to that file's MCP
-    /// servers, on the server's runtime. It opens each dynamic library in
-    /// the `[agents] plugins` directory, when the setting names one, and
-    /// loads its Plugin, which runs that library's code. Nothing else is
-    /// spawned and nothing else touches the filesystem here: the run log
-    /// opens under the state directory when the first run starts.
-    #[must_use]
-    pub fn new(config: &Config, registry: Registry, backoff: ReconnectBackoff) -> Self {
-        let (packs, plugins) = host_packs(
-            &registry,
-            config.agents.mcp.as_deref(),
-            config.agents.plugins.as_deref(),
-        );
-        let agents_path = config.agents.path.clone();
-        let host = Host {
-            packs,
-            prompts: Arc::new(agent_finder(agents_path.clone())),
-            timer: Arc::new(TokioTimer),
-        };
-        Self {
-            inner: Arc::new(Inner {
-                agents_path,
-                recorder: Arc::new(TursoRecorder::new(
-                    config.server.state_dir.join(HARNESS_STATE_DIR),
-                )),
-                broker: WorkshopBroker::new(registry.clone()),
-                host: Arc::new(host),
-                _plugins: plugins,
-                conversations: Conversations::new(),
-                registry,
-                backoff,
-            }),
-        }
-    }
-
-    /// The launchable agent names: the `.md` file stems under the
-    /// configured agents directory plus the built-in `chat`, sorted.
-    #[must_use]
-    pub fn discover(&self) -> Vec<String> {
-        discover_agents(&self.inner.agents_path)
-    }
-
-    /// Launches a conversation running the discovered agent `name` and
-    /// returns it with its channels, subscribed before the run starts so
-    /// the launching socket sees everything the run reports, a parse
-    /// failure included. Its run goes until its program returns, fails,
-    /// or [`close`](Self::close) ends it; a stop drops only the round in
-    /// flight.
-    ///
-    /// A launch with no usable gateway is refused before the agent is
-    /// read, since its every model round would fail.
-    ///
-    /// # Errors
-    /// Returns [`LaunchRefusal::GatewayUnusable`] when no gateway is
-    /// registered or its URL or key cannot build, and the conversation's
-    /// own [`LaunchError`] otherwise: an unknown agent or an unreadable
-    /// agent source.
-    async fn launch(&self, name: &str) -> Result<(Conversation, Receivers), LaunchRefusal> {
-        if usable_gateway(&self.inner.registry).is_none() {
-            return Err(LaunchRefusal::GatewayUnusable);
-        }
-        // The folder walk and the source read are filesystem work, so
-        // they run on the blocking pool; a worker that cannot report is
-        // the same unreadable state as an unreadable file. The run reads
-        // the agent again through the Host's finder when it parses it.
-        let agents_path = self.inner.agents_path.clone();
-        let agent = name.to_owned();
-        tokio::task::spawn_blocking(move || load_agent(&agents_path, &agent))
-            .await
-            .unwrap_or_else(|join| {
-                Err(LaunchError::Unreadable {
-                    source: io::Error::other(join),
-                })
-            })?;
-        let conversation = self.inner.conversations.open(name);
-        let receivers = Receivers::subscribe(&conversation);
-        status::spawn_reporter(
-            &conversation,
-            self.inner.registry.push(),
-            self.inner.backoff.clone(),
-        );
-        tokio::spawn(self.clone().drive(conversation.clone()));
-        Ok((conversation, receivers))
-    }
-
-    /// Runs `conversation`'s one run of its agent. The setup's selected
-    /// model and workspace roots are read once the menu's catalog holds a
-    /// chat-capable model, so a pick made while the catalog was empty is
-    /// the one the run binds; a close during that wait ends the run before
-    /// it begins.
-    async fn drive(self, conversation: Conversation) {
-        tokio::select! {
-            () = conversation.closing() => {}
-            () = self.inner.broker.chat_model_ready() => {}
-        }
-        let setup = with_host_state(&self.inner.registry, self.setup_for(&conversation));
-        conversation
-            .run(Arc::clone(&self.inner.host), conversation.agent(), setup)
-            .await;
-    }
-
-    /// The setup of `conversation`'s run before the Host state is read:
-    /// its recorder tee over a run-log handle naming its agent, its broker,
-    /// its filesystem, and a user, since every conversation has an
-    /// operator.
-    fn setup_for(&self, conversation: &Conversation) -> RunSetup {
-        let recorder = conversation.recorder(Arc::new(
-            self.inner.recorder.for_agent(conversation.agent()),
-        ));
-        let broker = Arc::new(RunBroker::new(
-            self.inner.broker.clone(),
-            conversation.clone(),
-        ));
-        RunSetup {
-            vfs: language_guide::run_vfs(),
-            has_user: true,
-            ..RunSetup::new(recorder, broker)
-        }
-    }
-
-    /// The running conversation with this id, when one exists: how a
-    /// socket reattaches after a disconnect.
-    fn get(&self, id: &str) -> Option<Conversation> {
-        self.inner.conversations.get(&ConversationId::new(id))
-    }
-
-    /// Ends the conversation with this id: its run is canceled, and the
-    /// conversation leaves the table at once. Returns whether a
-    /// conversation was ended.
-    #[must_use]
-    pub fn close(&self, id: &str) -> bool {
-        self.inner.conversations.close(&ConversationId::new(id))
-    }
-
-    /// The one run of the running conversation with this id, as the run
-    /// log issued it; `None` when no such conversation is running or its
-    /// run has not begun.
-    #[must_use]
-    pub fn run_id(&self, id: &str) -> Option<RunId> {
-        self.get(id)?.run_id()
-    }
-}
-
-/// A refused agent launch, relayed to the client as an error frame.
-#[derive(Debug, thiserror::Error)]
-enum LaunchRefusal {
-    /// No gateway is registered, or the registered gateway's URL or key
-    /// cannot build, so no agent could complete a model round.
-    #[error("agent sessions need a usable gateway binding; check the gateway base URL and key")]
-    GatewayUnusable,
-    /// The agent was refused.
-    #[error(transparent)]
-    Refused(#[from] LaunchError),
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/server/src/agents/bindings-tests.rs b/crates/workshop/server/src/agents/bindings-tests.rs
deleted file mode 100644
index ba6ccc429..000000000
--- a/crates/workshop/server/src/agents/bindings-tests.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-//! Host binding tests: a run's setup takes the selection and the granted
-//! roots.
-
-use std::sync::Arc;
-
-use runvil::harness::MemoryRecorder;
-use tokio::sync::watch;
-use workshop_menu::{CatalogBus, MenuBus};
-use workshop_registry::{WorkspaceRoots, WorkspaceRootsAdapter};
-
-use super::*;
-use crate::agents::tests::OfflineBroker;
-
-/// A setup with nothing selected and no roots.
-fn empty_setup() -> RunSetup {
-    RunSetup::new(Arc::new(MemoryRecorder::new()), Arc::new(OfflineBroker))
-}
-
-#[test]
-fn a_runs_setup_takes_the_selection_and_the_granted_roots() {
-    let registry = Registry::new();
-    let empty = with_host_state(&registry, empty_setup());
-    assert_eq!(
-        empty.selected_model, None,
-        "an unregistered menu serves no selection"
-    );
-    assert!(
-        empty.workspace_roots.is_empty(),
-        "an unregistered workspace serves no roots"
-    );
-
-    let catalog = CatalogBus::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let _menu_guards = workshop_menu::register(&registry, &catalog, &menu);
-    let registered = with_host_state(&registry, empty_setup());
-    assert_eq!(
-        registered.selected_model, None,
-        "a registered menu with nothing selected still serves no selection"
-    );
-
-    catalog.publish(vec![serde_json::json!({ "id": "test-model" })]);
-    menu.set_selected("test-model")
-        .expect("the id is in the catalog");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let granted = dir.path().to_path_buf();
-    let _roots =
-        registry.register_state::<dyn WorkspaceRoots>(Arc::new(WorkspaceRootsAdapter::new(
-            {
-                let granted = granted.clone();
-                move || vec![granted.clone()]
-            },
-            || watch::channel(0).1,
-        )));
-
-    let setup = with_host_state(&registry, empty_setup());
-    assert_eq!(setup.selected_model.as_deref(), Some("test-model"));
-    assert_eq!(
-        setup.workspace_roots,
-        vec![granted],
-        "the roots are read through the registry's WorkspaceRoots slot"
-    );
-}
diff --git a/crates/workshop/server/src/agents/bindings.rs b/crates/workshop/server/src/agents/bindings.rs
deleted file mode 100644
index b987645b9..000000000
--- a/crates/workshop/server/src/agents/bindings.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-//! The Host state a conversation's run carries in its setup: the menu's
-//! selected model and the workspace's granted roots, read through the
-//! registry as the run starts, which the run's `ui()` and model
-//! resolution read for the whole run.
-
-use runvil::RunSetup;
-use workshop_menu::MenuHandles;
-use workshop_registry::{Registry, WorkspaceRoots};
-
-/// `setup` with its selected model and workspace roots read from
-/// `registry`: `selected_model` from the menu's retained workbench state
-/// and the granted workspace roots from the registry's roots slot, so this
-/// crate reads the workspace through the slot the workspace subsystem
-/// registered. An unregistered subsystem's part reads as no selection or
-/// no roots.
-pub(super) fn with_host_state(registry: &Registry, setup: RunSetup) -> RunSetup {
-    let selected_model = registry
-        .state::<MenuHandles>()
-        .and_then(|handles| handles.menu().latest())
-        .and_then(|snapshot| snapshot.selected_model);
-    let workspace_roots = registry
-        .state::<dyn WorkspaceRoots>()
-        .map_or_else(Vec::new, |roots| roots.granted_roots());
-    RunSetup {
-        selected_model,
-        workspace_roots,
-        ..setup
-    }
-}
-
-#[cfg(test)]
-#[path = "bindings-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/broker-tests.rs b/crates/workshop/server/src/agents/broker-tests.rs
deleted file mode 100644
index f6a0d333c..000000000
--- a/crates/workshop/server/src/agents/broker-tests.rs
+++ /dev/null
@@ -1,361 +0,0 @@
-//! Workshop broker tests: with no gateway registered, or with one whose
-//! key cannot build, every round and model list fails as `Unavailable`
-//! with no URL or key in the message, after a replacement binding is
-//! published the next round and the next model list reach the
-//! replacement, a model list waits while the menu's catalog holds no
-//! chat-capable model, a streaming round hands its pieces to its callback
-//! and answers whole, a run's broker streams only its section's own
-//! rounds into the conversation, and the window comparison flags a pick
-//! whose context window is smaller than the round's binding's.
-
-use std::num::NonZeroU32;
-use std::sync::{Arc, Mutex, PoisonError};
-use std::time::Duration;
-
-use axum::Router;
-use axum::http::{HeaderMap, StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use harness_gateway_client::StreamDelta;
-use runvil::effect::Round;
-use runvil::event::ReplyOrigin;
-use runvil::harness::InferenceBroker;
-use runvil::ids::RoundId;
-use runvil::model::{
-    CompletionOptions, CompletionResult, Message, ModelBinding, ModelId, ModelInvocation, phrase,
-};
-use runvil::{Error, ErrorCode};
-use serde_json::json;
-use workshop_agents::{Conversations, DeltaKind};
-use workshop_gateway::{GatewayBinding, GatewayHandles, GatewayHealth};
-use workshop_menu::{CatalogBus, MenuBus};
-use workshop_registry::{Registration, Registry};
-
-use super::{RunBroker, WorkshopBroker, narrower_pick_window};
-use crate::app::test_helpers::spawn_gateway;
-
-/// A registry holding gateway handles bound to `base_url` under `key`,
-/// with the binding and the guard that keeps the registration alive.
-fn registry_with_gateway(base_url: &str, key: &str) -> (Registry, GatewayBinding, Registration) {
-    let registry = Registry::new();
-    let binding = GatewayBinding::new(base_url, key).expect("the binding builds");
-    let guard = workshop_gateway::register(
-        &registry,
-        GatewayHandles::new(binding.clone(), GatewayHealth::new()),
-    );
-    (registry, binding, guard)
-}
-
-/// A mock Gateway keyed with `key` that lists one model named `model` and
-/// answers every round with `from <model>`; a request under another key
-/// is refused.
-fn keyed_gateway(model: &'static str, key: &'static str) -> Router {
-    let keyed = move |headers: &HeaderMap| {
-        headers
-            .get(header::AUTHORIZATION)
-            .and_then(|value| value.to_str().ok())
-            .is_some_and(|bearer| bearer == format!("Bearer {key}"))
-    };
-    Router::new()
-        .route(
-            "/v1/models",
-            get(move |headers: HeaderMap| async move {
-                if !keyed(&headers) {
-                    return StatusCode::UNAUTHORIZED.into_response();
-                }
-                axum::Json(json!({ "data": [{
-                    "id": model, "description": model, "context": 131_072, "thinking": "never",
-                }] }))
-                .into_response()
-            }),
-        )
-        .route(
-            "/v1/chat/completions",
-            post(move |headers: HeaderMap| async move {
-                if !keyed(&headers) {
-                    return StatusCode::UNAUTHORIZED.into_response();
-                }
-                reply_stream(model)
-            }),
-        )
-}
-
-/// One round's SSE reply: `from <model>` in one content chunk, then a
-/// stop.
-fn reply_stream(model: &str) -> Response {
-    let mut body = String::new();
-    for chunk in [
-        json!({ "model": model, "choices": [{
-            "index": 0, "delta": { "content": format!("from {model}") }, "finish_reason": null,
-        }] }),
-        json!({ "model": model, "choices": [{
-            "index": 0, "delta": {}, "finish_reason": "stop",
-        }] }),
-    ] {
-        body.push_str("data: ");
-        body.push_str(&chunk.to_string());
-        body.push_str("\n\n");
-    }
-    body.push_str("data: [DONE]\n\n");
-    ([(header::CONTENT_TYPE, "text/event-stream")], body).into_response()
-}
-
-/// A binding for one round; the broker sends the round under its options,
-/// so the binding's own fields are inert here.
-fn binding() -> ModelBinding {
-    ModelBinding::new(
-        "writer",
-        "the round's model",
-        ModelId::gateway("m").expect("a literal model name is valid"),
-        ModelInvocation::new(),
-        NonZeroU32::new(4096).expect("4096 is non-zero"),
-    )
-}
-
-/// Runs one round on `broker` and returns its reply text.
-async fn round(broker: &WorkshopBroker) -> Result<String, Error> {
-    let completion = broker
-        .chat(
-            binding(),
-            vec![Message::user("hi")],
-            Vec::new(),
-            CompletionOptions::new("m"),
-            Round::new(RoundId::new(0), ReplyOrigin::Infer),
-        )
-        .await?;
-    match completion.result() {
-        CompletionResult::Text(text) => Ok(text.clone()),
-        other => panic!("the round replies with text: {other:?}"),
-    }
-}
-
-/// Runs one streaming round on `broker` and returns its reply text beside
-/// every piece its callback was handed.
-async fn streamed_round(broker: &WorkshopBroker) -> (Result<String, Error>, Vec<StreamDelta>) {
-    let kept: Arc<Mutex<Vec<StreamDelta>>> = Arc::default();
-    let sink = Arc::clone(&kept);
-    let completion = broker
-        .chat_streaming(
-            binding(),
-            vec![Message::user("hi")],
-            Vec::new(),
-            CompletionOptions::new("m"),
-            Arc::new(move |piece| {
-                sink.lock()
-                    .unwrap_or_else(PoisonError::into_inner)
-                    .push(piece);
-            }),
-        )
-        .await;
-    let reply = completion.map(|completion| match completion.result() {
-        CompletionResult::Text(text) => text.clone(),
-        other => panic!("the round replies with text: {other:?}"),
-    });
-    let pieces = kept.lock().unwrap_or_else(PoisonError::into_inner).clone();
-    (reply, pieces)
-}
-
-/// Lists the models on `broker` and returns their names.
-async fn listed(broker: &WorkshopBroker) -> Result<Vec<String>, Error> {
-    let catalog = broker.models().await?;
-    Ok(catalog
-        .models()
-        .iter()
-        .map(|model| model.id().name().to_owned())
-        .collect())
-}
-
-/// Asserts `error` is `Unavailable` with exactly the code's fixed phrase,
-/// so no URL or key rides in its message.
-fn assert_unavailable(error: &Error) {
-    let code = ErrorCode::Unavailable;
-    assert_eq!(error.code, code);
-    assert_eq!(
-        error.to_string(),
-        phrase(code),
-        "the message is the fixed phrase alone"
-    );
-}
-
-#[tokio::test]
-async fn without_a_gateway_registration_rounds_and_model_lists_fail_as_unavailable() {
-    let broker = WorkshopBroker::new(Registry::new());
-    let error = round(&broker).await.expect_err("no gateway, no round");
-    assert_unavailable(&error);
-    let (reply, pieces) = streamed_round(&broker).await;
-    assert_unavailable(&reply.expect_err("no gateway, no streaming round"));
-    assert!(pieces.is_empty(), "a refused round streams nothing");
-    let error = listed(&broker)
-        .await
-        .expect_err("no gateway, no model list");
-    assert_unavailable(&error);
-}
-
-#[tokio::test]
-async fn a_streaming_round_hands_its_pieces_to_the_callback_and_answers_whole() {
-    let gateway = spawn_gateway(keyed_gateway("first-model", "first-key")).await;
-    let (registry, _binding, _guard) = registry_with_gateway(&gateway, "first-key");
-    let broker = WorkshopBroker::new(registry);
-
-    let (reply, pieces) = streamed_round(&broker).await;
-    assert_eq!(
-        reply.expect("the gateway answers"),
-        "from first-model",
-        "the completed reply travels in the answer"
-    );
-    assert_eq!(
-        pieces,
-        [StreamDelta::Text("from first-model".to_owned())],
-        "the reply's one content chunk reaches the callback as it arrives"
-    );
-}
-
-#[tokio::test]
-async fn a_gateway_whose_key_cannot_build_fails_as_unavailable_naming_no_url() {
-    let url = "http://127.0.0.1:9";
-    let (registry, _binding, _guard) = registry_with_gateway(url, "");
-    let broker = WorkshopBroker::new(registry);
-    let error = round(&broker)
-        .await
-        .expect_err("an empty key builds no broker");
-    assert_unavailable(&error);
-    assert!(!error.to_string().contains(url), "{error}");
-    let error = listed(&broker)
-        .await
-        .expect_err("an empty key lists no model");
-    assert_unavailable(&error);
-    assert!(!error.to_string().contains(url), "{error}");
-}
-
-#[tokio::test]
-async fn after_a_replacement_the_next_round_and_model_list_reach_the_replacement() {
-    let first = spawn_gateway(keyed_gateway("first-model", "first-key")).await;
-    let second = spawn_gateway(keyed_gateway("second-model", "second-key")).await;
-    let (registry, binding, _guard) = registry_with_gateway(&first, "first-key");
-    let broker = WorkshopBroker::new(registry);
-    assert_eq!(
-        listed(&broker).await.expect("the first gateway lists"),
-        ["first-model"]
-    );
-    assert_eq!(
-        round(&broker).await.expect("the first gateway answers"),
-        "from first-model"
-    );
-
-    binding
-        .replace(&second, "second-key")
-        .expect("the replacement publishes");
-    assert_eq!(
-        listed(&broker).await.expect("the replacement lists"),
-        ["second-model"],
-        "the next model list reaches the replacement under its key"
-    );
-    assert_eq!(
-        round(&broker).await.expect("the replacement answers"),
-        "from second-model",
-        "the next round reaches the replacement under its key"
-    );
-}
-
-#[tokio::test]
-async fn a_model_list_waits_until_the_catalog_holds_a_chat_capable_model() {
-    let gateway = spawn_gateway(keyed_gateway("first-model", "first-key")).await;
-    let (registry, _binding, _guard) = registry_with_gateway(&gateway, "first-key");
-    let catalog = CatalogBus::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let _menu_guards = workshop_menu::register(&registry, &catalog, &menu);
-    let broker = WorkshopBroker::new(registry);
-
-    let mut listing = Box::pin(listed(&broker));
-    catalog.publish(vec![
-        json!({ "id": "whisper-base-en", "kind": "transcription" }),
-    ]);
-    assert!(
-        tokio::time::timeout(Duration::from_millis(200), &mut listing)
-            .await
-            .is_err(),
-        "a catalog holding no chat-capable model keeps the list waiting"
-    );
-
-    catalog.publish(vec![json!({ "id": "first-model", "kind": "chat" })]);
-    let models = tokio::time::timeout(Duration::from_secs(10), listing)
-        .await
-        .expect("the list answers once a chat-capable model is published")
-        .expect("the gateway lists");
-    assert_eq!(models, ["first-model"], "the list is the gateway's own");
-}
-
-/// Runs one round of `origin` numbered `id` on a conversation's run
-/// broker and returns its reply text.
-async fn run_round(broker: &RunBroker, id: u64, origin: ReplyOrigin) -> String {
-    let completion = broker
-        .chat(
-            binding(),
-            vec![Message::user("hi")],
-            Vec::new(),
-            CompletionOptions::new("m"),
-            Round::new(RoundId::new(id), origin),
-        )
-        .await
-        .expect("the gateway answers");
-    match completion.result() {
-        CompletionResult::Text(text) => text.clone(),
-        other => panic!("the round replies with text: {other:?}"),
-    }
-}
-
-#[tokio::test]
-async fn a_sections_round_streams_into_its_conversation_under_the_round_id_and_an_infer_round_does_not()
- {
-    let gateway = spawn_gateway(keyed_gateway("first-model", "first-key")).await;
-    let (registry, _binding, _guard) = registry_with_gateway(&gateway, "first-key");
-    let conversation = Conversations::new().open("chat");
-    let mut deltas = conversation.subscribe_deltas();
-    let broker = RunBroker::new(WorkshopBroker::new(registry), conversation);
-
-    assert_eq!(
-        run_round(&broker, 4, ReplyOrigin::Infer).await,
-        "from first-model"
-    );
-    assert!(
-        deltas.try_recv().is_err(),
-        "a nested infer round streams nothing"
-    );
-
-    assert_eq!(
-        run_round(&broker, 3, ReplyOrigin::Chat).await,
-        "from first-model"
-    );
-    let delta = deltas.try_recv().expect("the section's round streamed");
-    assert_eq!(delta.kind, DeltaKind::Text);
-    assert_eq!(delta.content, "from first-model");
-    assert_eq!(delta.reply, 3, "the piece carries its round's id");
-}
-
-#[test]
-fn the_window_comparison_flags_a_pick_smaller_than_the_binding_and_not_an_equal_or_larger_one() {
-    let models = [
-        json!({ "id": "smaller", "kind": "chat", "context": 4095 }),
-        json!({ "id": "equal", "kind": "chat", "context": 4096 }),
-        json!({ "id": "larger", "kind": "chat", "context": 131_072 }),
-        json!({ "id": "unsized", "kind": "chat" }),
-    ];
-    let bound = NonZeroU32::new(4096).expect("4096 is non-zero");
-    assert_eq!(
-        narrower_pick_window(&models, "smaller", bound),
-        Some(4095),
-        "a pick one token short of the binding's window warns"
-    );
-    assert_eq!(narrower_pick_window(&models, "equal", bound), None);
-    assert_eq!(narrower_pick_window(&models, "larger", bound), None);
-    assert_eq!(
-        narrower_pick_window(&models, "unsized", bound),
-        None,
-        "a pick the catalog lists without a window has nothing to compare"
-    );
-    assert_eq!(
-        narrower_pick_window(&models, "unlisted", bound),
-        None,
-        "a pick the catalog does not list has nothing to compare"
-    );
-}
diff --git a/crates/workshop/server/src/agents/broker.rs b/crates/workshop/server/src/agents/broker.rs
deleted file mode 100644
index 30ec65af1..000000000
--- a/crates/workshop/server/src/agents/broker.rs
+++ /dev/null
@@ -1,250 +0,0 @@
-//! The agent conversations' inference brokers: [`WorkshopBroker`], which
-//! sends every model round and model list through the current Gateway
-//! generation, and [`RunBroker`], one run's view of it, which streams the
-//! run's own rounds into its conversation.
-//!
-//! The Workshop broker holds the server's [`Registry`] and reads the
-//! gateway through it on every call, as the search provider does, so a
-//! replaced gateway serves the next round. It keeps the Gateway broker of
-//! the last generation it served under. A model list first waits until
-//! the menu's catalog holds a chat-capable model, so a conversation
-//! launched before the Gateway's catalog arrives starts its run only once
-//! it can bind one.
-//!
-//! Each round reads the dropdown's pick through the registry as it is
-//! sent, so a model picked between rounds serves the next one; a round
-//! already in flight finishes on its model.
-
-use std::num::NonZeroU32;
-use std::sync::{Arc, Mutex, PoisonError};
-
-use harness_gateway_client::{GatewayBroker, StreamDelta};
-use runvil::effect::Round;
-use runvil::event::ReplyOrigin;
-use runvil::harness::InferenceBroker;
-use runvil::model::{
-    Completion, CompletionOptions, Message, ModelBinding, ModelCatalog, ToolSchema,
-    make_completion_error, phrase,
-};
-use runvil::{BoxFuture, Error, ErrorCode};
-use workshop_agents::{Conversation, DeltaKind};
-use workshop_menu::{CatalogBus, MenuHandles};
-use workshop_registry::Registry;
-
-use super::gateway::usable_gateway;
-
-/// Serves rounds and model lists through the Gateway the server's registry
-/// currently holds.
-#[derive(Clone)]
-pub(super) struct WorkshopBroker {
-    /// The subsystem registry the gateway and menu handles are read
-    /// through.
-    registry: Registry,
-    /// The broker built for the last generation served under, shared with
-    /// the model lists still waiting.
-    cached: Arc<Mutex<Option<(u64, GatewayBroker)>>>,
-}
-
-impl WorkshopBroker {
-    /// Builds the broker over the server's subsystem registry.
-    pub(super) fn new(registry: Registry) -> Self {
-        Self {
-            registry,
-            cached: Arc::new(Mutex::new(None)),
-        }
-    }
-
-    /// The Gateway broker for the current generation, built on the first
-    /// call under it. No usable gateway fails as `Unavailable` with the
-    /// code's fixed phrase, so no URL or key reaches the message.
-    fn current(&self) -> Result<GatewayBroker, Error> {
-        let unavailable = ErrorCode::Unavailable;
-        let gateway = usable_gateway(&self.registry)
-            .ok_or_else(|| make_completion_error(unavailable, phrase(unavailable)))?;
-        // A poisoned lock holds a pair written whole by one store.
-        let mut cached = self.cached.lock().unwrap_or_else(PoisonError::into_inner);
-        if let Some((generation, broker)) = cached.as_ref()
-            && *generation == gateway.generation
-        {
-            return Ok(broker.clone());
-        }
-        let broker = GatewayBroker::new(gateway.endpoint, gateway.key);
-        *cached = Some((gateway.generation, broker.clone()));
-        Ok(broker)
-    }
-
-    /// Resolves once the menu's catalog holds a chat-capable model, at
-    /// once when no menu is registered.
-    pub(super) async fn chat_model_ready(&self) {
-        if let Some(menu) = self.registry.state::<MenuHandles>() {
-            chat_model_published(menu.catalog()).await;
-        }
-    }
-
-    /// `options` sent to the dropdown's current pick: when the menu's
-    /// selected model differs from the model `options` names, it replaces
-    /// that model and every other field stays. With no menu or no pick,
-    /// `options` goes as it came. A pick whose context window, as the
-    /// menu's catalog lists it, is smaller than `binding`'s is logged and
-    /// still sent.
-    fn routed(&self, binding: &ModelBinding, options: CompletionOptions) -> CompletionOptions {
-        let Some(menu) = self.registry.state::<MenuHandles>() else {
-            return options;
-        };
-        let Some(pick) = menu
-            .menu()
-            .latest()
-            .and_then(|snapshot| snapshot.selected_model)
-        else {
-            return options;
-        };
-        if pick == options.model() {
-            return options;
-        }
-        let models = menu
-            .catalog()
-            .latest()
-            .map_or_else(Vec::new, |push| push.models);
-        if let Some(pick_window) = narrower_pick_window(&models, &pick, binding.context()) {
-            tracing::warn!(
-                pick_window,
-                binding_window = binding.context().get(),
-                "the selected model's context window is smaller than the launch model's; \
-                 the round is sent to the selected model anyway"
-            );
-        }
-        options.with_model(pick)
-    }
-
-    /// Runs one round through the current generation's Gateway broker,
-    /// sent to the dropdown's current pick, handing `on_piece` each live
-    /// piece of the reply as it arrives.
-    fn chat_streaming(
-        &self,
-        binding: ModelBinding,
-        messages: Vec<Message>,
-        tools: Vec<ToolSchema>,
-        options: CompletionOptions,
-        on_piece: Arc<dyn Fn(StreamDelta) + Send + Sync>,
-    ) -> BoxFuture<'static, Result<Box<Completion>, Error>> {
-        match self.current() {
-            Ok(broker) => {
-                let options = self.routed(&binding, options);
-                broker.chat_streaming(binding, messages, tools, options, on_piece)
-            }
-            Err(error) => Box::pin(async move { Err(error) }),
-        }
-    }
-}
-
-impl InferenceBroker for WorkshopBroker {
-    fn models(&self) -> BoxFuture<'static, Result<ModelCatalog, Error>> {
-        let broker = self.clone();
-        Box::pin(async move {
-            broker.chat_model_ready().await;
-            broker.current()?.models().await
-        })
-    }
-
-    fn chat(
-        &self,
-        binding: ModelBinding,
-        messages: Vec<Message>,
-        tools: Vec<ToolSchema>,
-        options: CompletionOptions,
-        round: Round,
-    ) -> BoxFuture<'static, Result<Box<Completion>, Error>> {
-        match self.current() {
-            Ok(broker) => {
-                let options = self.routed(&binding, options);
-                broker.chat(binding, messages, tools, options, round)
-            }
-            Err(error) => Box::pin(async move { Err(error) }),
-        }
-    }
-}
-
-/// The context window `models`, the menu's catalog, lists for `pick`
-/// when it is smaller than `bound`, the window the round's binding holds.
-/// A pick the catalog does not list, or lists without a window, has
-/// nothing to compare.
-fn narrower_pick_window(
-    models: &[serde_json::Value],
-    pick: &str,
-    bound: NonZeroU32,
-) -> Option<u64> {
-    models
-        .iter()
-        .find(|model| model.get("id").and_then(serde_json::Value::as_str) == Some(pick))
-        .and_then(|model| model.get("context"))
-        .and_then(serde_json::Value::as_u64)
-        .filter(|window| *window < u64::from(bound.get()))
-}
-
-/// One run's broker over the Workshop broker: a section's own round
-/// streams its live pieces into the run's conversation, stamped with the
-/// round's id, and every other call goes through as it came.
-pub(super) struct RunBroker {
-    inner: WorkshopBroker,
-    conversation: Conversation,
-}
-
-impl RunBroker {
-    /// The broker for `conversation`'s run over `inner`.
-    pub(super) fn new(inner: WorkshopBroker, conversation: Conversation) -> Self {
-        Self {
-            inner,
-            conversation,
-        }
-    }
-}
-
-impl InferenceBroker for RunBroker {
-    fn models(&self) -> BoxFuture<'static, Result<ModelCatalog, Error>> {
-        self.inner.models()
-    }
-
-    fn chat(
-        &self,
-        binding: ModelBinding,
-        messages: Vec<Message>,
-        tools: Vec<ToolSchema>,
-        options: CompletionOptions,
-        round: Round,
-    ) -> BoxFuture<'static, Result<Box<Completion>, Error>> {
-        // Only a section's own round has a live reader; a nested
-        // `models.infer` round is read whole from its answer.
-        if round.origin != ReplyOrigin::Chat {
-            return self.inner.chat(binding, messages, tools, options, round);
-        }
-        let conversation = self.conversation.clone();
-        let on_piece = Arc::new(move |piece: StreamDelta| {
-            let (kind, content) = match piece {
-                StreamDelta::Text(text) => (DeltaKind::Text, text),
-                StreamDelta::Reasoning(text) => (DeltaKind::Reasoning, text),
-                // The enum is non-exhaustive across the crate seam; any
-                // other piece has no delta kind and stays unshown.
-                _ => return,
-            };
-            conversation.publish_delta(round.id, kind, content);
-        });
-        self.inner
-            .chat_streaming(binding, messages, tools, options, on_piece)
-    }
-}
-
-/// Waits until `catalog` holds a chat-capable model. The watch is taken
-/// before the first read, so a generation published between the two still
-/// wakes the wait.
-async fn chat_model_published(catalog: &CatalogBus) {
-    let mut generation = catalog.subscribe_chat_generation();
-    while catalog.latest_chat().is_none() {
-        if generation.changed().await.is_err() {
-            return;
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "broker-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/gateway.rs b/crates/workshop/server/src/agents/gateway.rs
deleted file mode 100644
index 8543d092a..000000000
--- a/crates/workshop/server/src/agents/gateway.rs
+++ /dev/null
@@ -1,41 +0,0 @@
-//! The one read of a usable gateway that the agent sessions' broker,
-//! search provider, and launch refusal share: the generation, the API
-//! root, and the bearer of the gateway the registry currently holds.
-//!
-//! It reads no heartbeat health; a caller that needs reachability checks
-//! it itself.
-
-use harness_gateway_client::{GatewayEndpoint, SecretString};
-use workshop_gateway::GatewayHandles;
-use workshop_registry::Registry;
-
-/// One gateway generation whose endpoint and key both build.
-pub(super) struct UsableGateway {
-    /// The generation the server assigned before publishing it.
-    pub(super) generation: u64,
-    /// The gateway's OpenAI-compatible API root: its base URL with `/v1`.
-    pub(super) endpoint: GatewayEndpoint,
-    /// The bearer paired with the base URL.
-    pub(super) key: SecretString,
-}
-
-impl UsableGateway {
-    /// The current generation of `handles`, or `None` when its URL or key
-    /// cannot build an endpoint and a bearer.
-    pub(super) fn read(handles: &GatewayHandles) -> Option<Self> {
-        let snapshot = handles.binding().snapshot();
-        let api_root = format!("{}/v1", snapshot.base_url().trim_end_matches('/'));
-        Some(Self {
-            generation: snapshot.generation(),
-            endpoint: GatewayEndpoint::new(&api_root).ok()?,
-            key: SecretString::new(snapshot.api_key()).ok()?,
-        })
-    }
-}
-
-/// The gateway `registry` holds, or `None` when no gateway handles are
-/// registered or the current generation's URL or key cannot build.
-pub(super) fn usable_gateway(registry: &Registry) -> Option<UsableGateway> {
-    let handles = registry.state::<GatewayHandles>()?;
-    UsableGateway::read(&handles)
-}
diff --git a/crates/workshop/server/src/agents/language_guide.rs b/crates/workshop/server/src/agents/language_guide.rs
deleted file mode 100644
index c71ced589..000000000
--- a/crates/workshop/server/src/agents/language_guide.rs
+++ /dev/null
@@ -1,78 +0,0 @@
-//! Two demos of the virtual filesystem, each a read-only mount in every
-//! run behind a switch that is committed as off.
-//!
-//! [`ENABLED`] mounts the Runvil prompting language guide at [`MOUNT`], so
-//! an agent can read the language's own documentation with the file
-//! tools. The guide's pages are read from [`SOURCE`], a directory on one
-//! machine. The chat agent's system prompt, which names the mount, is in
-//! `chat.md` and is toggled there.
-//!
-//! [`C_DRIVE`] mounts this machine's whole C drive at [`C_DRIVE_MOUNT`],
-//! so the shell and the file tools can be tried on real files.
-//!
-//! Both are hacks, and both are all here. With both switches off, a run
-//! has its plain in-memory root.
-
-use std::path::Path;
-
-use runvil::vfs::{RealBackend, VfsRef, Writability};
-
-/// The switch: `true` mounts the guide in every run.
-const ENABLED: bool = false;
-
-/// The directory on this machine that holds the guide's pages.
-const SOURCE: &str = r"C:\Users\Vinnie\cursor\runvil-docs\src\language";
-
-/// The virtual path a run sees the guide at.
-const MOUNT: &str = "/_runvil/language-guide";
-
-/// The switch: `true` mounts the whole C drive, read-only, in every run.
-///
-/// It is committed as `false`. While it is on, a model can read every
-/// file the person who runs Workshop can, what it reads goes to the
-/// model's provider, and a search that starts at `/` walks the drive.
-const C_DRIVE: bool = false;
-
-/// The root of the drive [`C_DRIVE`] mounts.
-const C_DRIVE_SOURCE: &str = r"C:\";
-
-/// The virtual path a run sees the drive at, so `C:\Users` is `/c/Users`,
-/// the path Git Bash gives it.
-const C_DRIVE_MOUNT: &str = "/c";
-
-/// The filesystem for one run: the in-memory root, with the guide mounted
-/// at [`MOUNT`] when [`ENABLED`], and the C drive mounted at
-/// [`C_DRIVE_MOUNT`] when [`C_DRIVE`].
-pub(super) fn run_vfs() -> VfsRef {
-    let mut vfs = VfsRef::default();
-    if ENABLED {
-        vfs = mount_at(vfs, MOUNT, Path::new(SOURCE));
-    }
-    if C_DRIVE {
-        vfs = mount_at(vfs, C_DRIVE_MOUNT, Path::new(C_DRIVE_SOURCE));
-    }
-    vfs
-}
-
-/// `base` with the directory `source` mounted read-only at `mount`, an
-/// absolute virtual path. A `source` that cannot be mounted leaves `base`
-/// as it is and logs a warning, because a run without the mount still
-/// works. So a machine with no such directory, as one with no C drive,
-/// runs with the switch on as it does with it off.
-fn mount_at(base: VfsRef, mount: &str, source: &Path) -> VfsRef {
-    match RealBackend::rooted(source) {
-        Ok(backend) => base.overlay(mount, backend.with_writability(Writability::ReadOnly)),
-        Err(error) => {
-            tracing::warn!(
-                source = %source.display(),
-                mount,
-                %error,
-                "a directory is not mounted; runs start without it"
-            );
-            base
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/server/src/agents/language_guide/tests.rs b/crates/workshop/server/src/agents/language_guide/tests.rs
deleted file mode 100644
index 3862e46d1..000000000
--- a/crates/workshop/server/src/agents/language_guide/tests.rs
+++ /dev/null
@@ -1,289 +0,0 @@
-//! Mapping a local directory into a run's filesystem: a directory mapped
-//! under `/_runvil` reads through the mapping, is reached by listing down
-//! from the root, refuses writes, leaves the in-memory root writable, and
-//! is visible to a prompt that runs over the filesystem. Two directories
-//! mapped one after the other are both visible, as the guide and the C
-//! drive are with both switches on. Every test uses a local directory it
-//! makes, so none depends on the language guide's files or on a path on
-//! any one machine, but for the one that maps a drive's root, which runs
-//! on Windows alone.
-
-use std::error::Error;
-use std::path::Path;
-
-use runvil::vfs::{Access, FileType, Origin, VfsError, VfsRef};
-use workshop_registry::Registry;
-
-use super::mount_at;
-#[cfg(windows)]
-use super::{C_DRIVE_MOUNT, C_DRIVE_SOURCE};
-use crate::agents::host_packs;
-use crate::agents::tests::{BASHKIT_LIBRARY, plugin_dir, plugin_dir_of, run_prompt_over};
-
-/// What a test returns: any error from setup or from the VFS fails it.
-type Outcome = Result<(), Box<dyn Error>>;
-
-/// Where the local directory is mapped.
-const MOUNT: &str = "/_runvil/test";
-
-/// The one page the local directory holds.
-const PAGE: &str = "hello.md";
-
-/// What that page says.
-const TEXT: &str = "# Hello from a local page\n";
-
-/// A directory holding the one page.
-fn local_directory() -> Result<tempfile::TempDir, Box<dyn Error>> {
-    let directory = tempfile::tempdir().map_err(|e| format!("create a temp dir: {e}"))?;
-    let page = directory.path().join(PAGE);
-    std::fs::write(&page, TEXT).map_err(|e| format!("write {}: {e}", page.display()))?;
-    Ok(directory)
-}
-
-/// The filesystem with `source` mapped to [`MOUNT`].
-fn filesystem_with(source: &Path) -> VfsRef {
-    mount_at(VfsRef::default(), MOUNT, source)
-}
-
-/// A run's access over the filesystem with `source` mapped to [`MOUNT`].
-fn access_with(source: &Path) -> Result<Access, VfsError> {
-    filesystem_with(source).acquire(Origin::new("local mapping test"))
-}
-
-#[test]
-fn a_page_of_the_directory_reads_through_the_mapping() -> Outcome {
-    let directory = local_directory()?;
-    let access = access_with(directory.path())?;
-
-    assert_eq!(access.read_string(&format!("{MOUNT}/{PAGE}"))?, TEXT);
-    let names: Vec<String> = access
-        .list(MOUNT)?
-        .into_iter()
-        .map(|entry| entry.name)
-        .collect();
-    assert_eq!(names, [PAGE]);
-    Ok(())
-}
-
-#[test]
-fn listing_down_from_the_root_reaches_the_directory() -> Outcome {
-    let directory = local_directory()?;
-    let access = access_with(directory.path())?;
-    let names = |path: &str| -> Result<Vec<String>, VfsError> {
-        Ok(access
-            .list(path)?
-            .into_iter()
-            .map(|entry| entry.name)
-            .collect())
-    };
-
-    // The in-memory root holds nothing, so the mapping is the only way down.
-    assert_eq!(names("/")?, ["_runvil"]);
-    assert_eq!(names("/_runvil")?, ["test"]);
-    assert_eq!(names(MOUNT)?, [PAGE]);
-    assert_eq!(access.stat("/_runvil")?.file_type, FileType::Directory);
-    Ok(())
-}
-
-#[test]
-fn the_mapping_refuses_a_write_and_leaves_the_page_alone() -> Outcome {
-    let directory = local_directory()?;
-    let access = access_with(directory.path())?;
-
-    let created = access.write(&format!("{MOUNT}/new.md"), b"new");
-    assert!(
-        matches!(created, Err(VfsError::ReadOnly { .. })),
-        "{created:?}"
-    );
-    let replaced = access.write(&format!("{MOUNT}/{PAGE}"), b"changed");
-    assert!(
-        matches!(replaced, Err(VfsError::ReadOnly { .. })),
-        "{replaced:?}"
-    );
-    let page = directory.path().join(PAGE);
-    let text =
-        std::fs::read_to_string(&page).map_err(|e| format!("read {}: {e}", page.display()))?;
-    assert_eq!(text, TEXT);
-    assert!(!directory.path().join("new.md").exists());
-    Ok(())
-}
-
-#[test]
-fn the_in_memory_root_stays_writable_beside_the_mapping() -> Outcome {
-    let directory = local_directory()?;
-    let access = access_with(directory.path())?;
-
-    access.write("/scratch.txt", b"kept")?;
-    assert_eq!(access.read_string("/scratch.txt")?, "kept");
-    Ok(())
-}
-
-#[test]
-fn a_directory_that_cannot_be_mapped_leaves_the_run_its_root() -> Outcome {
-    let directory = local_directory()?;
-    let missing = directory.path().join("no-such-directory");
-    let access = access_with(&missing)?;
-
-    assert!(!access.exists(MOUNT)?, "nothing is mapped");
-    access.write("/scratch.txt", b"kept")?;
-    assert_eq!(access.read_string("/scratch.txt")?, "kept");
-    Ok(())
-}
-
-/// Where a second local directory is mapped.
-const OTHER_MOUNT: &str = "/c";
-
-/// The one page the second local directory holds.
-const OTHER_PAGE: &str = "other.md";
-
-/// What that page says.
-const OTHER_TEXT: &str = "# Hello from another page\n";
-
-/// A second directory, holding its own page.
-fn other_directory() -> Result<tempfile::TempDir, Box<dyn Error>> {
-    let directory = tempfile::tempdir().map_err(|e| format!("create a temp dir: {e}"))?;
-    let page = directory.path().join(OTHER_PAGE);
-    std::fs::write(&page, OTHER_TEXT).map_err(|e| format!("write {}: {e}", page.display()))?;
-    Ok(directory)
-}
-
-#[test]
-fn two_directories_mapped_one_after_the_other_are_both_visible() -> Outcome {
-    let first = local_directory()?;
-    let second = other_directory()?;
-    let access = mount_at(filesystem_with(first.path()), OTHER_MOUNT, second.path())
-        .acquire(Origin::new("two mappings test"))?;
-
-    assert_eq!(access.read_string(&format!("{MOUNT}/{PAGE}"))?, TEXT);
-    assert_eq!(
-        access.read_string(&format!("{OTHER_MOUNT}/{OTHER_PAGE}"))?,
-        OTHER_TEXT
-    );
-    let names: Vec<String> = access
-        .list("/")?
-        .into_iter()
-        .map(|entry| entry.name)
-        .collect();
-    assert_eq!(names, ["_runvil", "c"], "the root lists both ways down");
-
-    let written = access.write(&format!("{OTHER_MOUNT}/new.md"), b"new");
-    assert!(
-        matches!(written, Err(VfsError::ReadOnly { .. })),
-        "{written:?}"
-    );
-    access.write("/scratch.txt", b"kept")?;
-    assert_eq!(access.read_string("/scratch.txt")?, "kept");
-    Ok(())
-}
-
-/// The root of a drive maps as any directory does, which is what the C
-/// drive switch relies on. A machine with no C drive has nothing to map.
-#[cfg(windows)]
-#[test]
-fn a_drives_root_maps_read_only_like_any_directory() -> Outcome {
-    let root = Path::new(C_DRIVE_SOURCE);
-    if !root.is_dir() {
-        return Ok(());
-    }
-    let access =
-        mount_at(VfsRef::default(), C_DRIVE_MOUNT, root).acquire(Origin::new("drive root test"))?;
-
-    assert_eq!(access.stat(C_DRIVE_MOUNT)?.file_type, FileType::Directory);
-    assert!(
-        !access.list(C_DRIVE_MOUNT)?.is_empty(),
-        "the drive's root lists its entries"
-    );
-    let written = access.write(&format!("{C_DRIVE_MOUNT}/runvil-test.tmp"), b"x");
-    assert!(
-        matches!(written, Err(VfsError::ReadOnly { .. })),
-        "{written:?}"
-    );
-    Ok(())
-}
-
-/// A prompt that lists `/_runvil` and reads the mapped page with the `std`
-/// file tools, and returns both answers.
-const PROMPT: &str = r"---
-name: sees-the-mapping
-description: lists and reads a mapped directory
-runvil: 0
-uses:
-  - std
----
-
-# Sees the mapping
-
-## Only
-
-```lua
-local listing = tools.call('std/dir', { target_directory = '/_runvil' })
-local page = tools.call('std/read', { path = '/_runvil/test/hello.md' })
-return listing .. '\n' .. page
-```
-";
-
-#[tokio::test]
-async fn a_prompt_sees_the_directory_mapped_under_the_runvil_mount() -> Outcome {
-    let directory = local_directory()?;
-    // The std Plugin is a library, which the Host loads from a directory.
-    let (plugins, _library) = plugin_dir("sees-the-mapping");
-    let (host, _) = host_packs(&Registry::new(), None, Some(plugins.path()));
-
-    let result = run_prompt_over(host, PROMPT.to_owned(), filesystem_with(directory.path())).await;
-
-    let Ok(Ok(final_text)) = result else {
-        return Err(format!("the prompt did not complete: {result:?}").into());
-    };
-    assert!(
-        final_text.contains("  - test/"),
-        "the prompt lists the mapping under /_runvil: {final_text}"
-    );
-    assert!(
-        final_text.contains("     1|# Hello from a local page"),
-        "the prompt reads the mapped page: {final_text}"
-    );
-    Ok(())
-}
-
-/// A prompt that lists the root and reads a page of each mapped
-/// directory with the shell, and returns what the shell answers.
-const SHELL_PROMPT: &str = r"---
-name: shells-over-the-mappings
-description: reads two mapped directories with the shell
-runvil: 0
-uses: [bash]
----
-
-# Shells over the mappings
-
-## Only
-
-```lua
-return tools.call('bash/shell', {
-  command = 'ls /; cat /c/other.md /_runvil/test/hello.md',
-})
-```
-";
-
-#[tokio::test]
-async fn the_shell_reads_two_directories_mapped_into_its_run() -> Outcome {
-    let first = local_directory()?;
-    let second = other_directory()?;
-    let vfs = mount_at(filesystem_with(first.path()), OTHER_MOUNT, second.path());
-    let (plugins, _library) = plugin_dir_of("shells-over-the-mappings", BASHKIT_LIBRARY);
-    let (host, _) = host_packs(&Registry::new(), None, Some(plugins.path()));
-
-    let result = run_prompt_over(host, SHELL_PROMPT.to_owned(), vfs).await;
-
-    let Ok(Ok(final_text)) = result else {
-        return Err(format!("the prompt did not complete: {result:?}").into());
-    };
-    assert!(
-        final_text.contains(
-            "Exit code: 0\n\nCommand output:\n\n```\n_runvil\nc\n# Hello from another page\n\
-             # Hello from a local page\n```"
-        ),
-        "the shell lists both mappings at the root and reads a page of each: {final_text}"
-    );
-    Ok(())
-}
diff --git a/crates/workshop/server/src/agents/relay-tests.rs b/crates/workshop/server/src/agents/relay-tests.rs
deleted file mode 100644
index 2c9f7573c..000000000
--- a/crates/workshop/server/src/agents/relay-tests.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-//! Catalog relay tests: gateway responses pass through byte for byte and outages become 502.
-
-use super::*;
-
-use axum::Router;
-use axum::body::Body;
-use axum::http::{HeaderMap, Request, header};
-use axum::routing::get;
-use tower::ServiceExt as _;
-use workshop_gateway::{GatewayBinding, GatewayHandles, GatewayHealth};
-use workshop_registry::{Registration, Registry};
-
-use crate::agents::state::routes;
-
-const CATALOG: &str = r#"{"object":"list","data":[{"id":"test-model","object":"model","created":1,"owned_by":"runvil"}]}"#;
-const UPSTREAM_ERROR: &str =
-    r#"{"error":{"message":"model unloaded","code":"upstream_unavailable"}}"#;
-
-/// Collects a response body already buffered in memory.
-async fn body_bytes(response: Response) -> axum::body::Bytes {
-    axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already")
-}
-
-/// Binds `app` as a mock gateway on a free loopback port and returns its
-/// base URL.
-async fn spawn_gateway(app: Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
-
-/// Builds the sessions route state against a stub gateway address: the
-/// gateway handle set registered into the registry the state reads it
-/// through, the push sinks unregistered (pushes are graceful no-ops),
-/// the state directory a fresh tempdir returned alongside so it outlives
-/// the test.
-fn state_for(base_url: &str) -> (SessionsState, tempfile::TempDir, Registration) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let registry = Registry::new();
-    let gateway = GatewayBinding::new(base_url, "test-key").expect("the binding builds");
-    let guard = workshop_gateway::register(
-        &registry,
-        GatewayHandles::new(gateway, GatewayHealth::new()),
-    );
-    let state = SessionsState::new(registry, |_| true);
-    (state, dir, guard)
-}
-
-fn authorized(headers: &HeaderMap) -> bool {
-    headers
-        .get(header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok())
-        == Some("Bearer test-key")
-}
-
-async fn mock_models(headers: HeaderMap) -> Response {
-    if !authorized(&headers) {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-    ([(header::CONTENT_TYPE, "application/json")], CATALOG).into_response()
-}
-
-async fn mock_broken_models() -> Response {
-    (
-        StatusCode::SERVICE_UNAVAILABLE,
-        [(header::CONTENT_TYPE, "application/json")],
-        UPSTREAM_ERROR,
-    )
-        .into_response()
-}
-
-fn models_request() -> Request<Body> {
-    Request::builder()
-        .uri("/v1/models")
-        .body(Body::empty())
-        .expect("static request parts are valid")
-}
-
-#[tokio::test]
-async fn models_are_relayed_byte_for_byte() {
-    let base_url = spawn_gateway(Router::new().route("/v1/models", get(mock_models))).await;
-    let (state, _dir, _guard) = state_for(&base_url);
-    let response = routes(state)
-        .oneshot(models_request())
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(&body_bytes(response).await[..], CATALOG.as_bytes());
-}
-
-#[tokio::test]
-async fn gateway_error_status_is_relayed_byte_for_byte() {
-    let base_url = spawn_gateway(Router::new().route("/v1/models", get(mock_broken_models))).await;
-    let (state, _dir, _guard) = state_for(&base_url);
-    let response = routes(state)
-        .oneshot(models_request())
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-    assert_eq!(&body_bytes(response).await[..], UPSTREAM_ERROR.as_bytes());
-}
-
-#[tokio::test]
-async fn unreachable_gateway_becomes_bad_gateway() {
-    // Port 1 is never listening, so the connect fails deterministically.
-    let (state, _dir, _guard) = state_for("http://127.0.0.1:1");
-    let response = routes(state)
-        .oneshot(models_request())
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::BAD_GATEWAY);
-    let body = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&body).expect("error body is JSON");
-    assert_eq!(json["error"]["code"], "gateway_unreachable");
-}
-
-#[tokio::test]
-async fn a_gateway_known_down_short_circuits_the_catalog_with_bad_gateway() {
-    let (state, _dir, _guard) = state_for("http://127.0.0.1:1");
-    state
-        .health()
-        .expect("the gateway handles are registered")
-        .publish(false);
-    let response = routes(state)
-        .oneshot(models_request())
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::BAD_GATEWAY);
-    let body = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&body).expect("error body is JSON");
-    assert_eq!(json["error"]["code"], "gateway_unreachable");
-    assert_eq!(
-        json["error"]["message"], "Gateway unreachable",
-        "the short-circuit message is user-visible"
-    );
-}
diff --git a/crates/workshop/server/src/agents/relay.rs b/crates/workshop/server/src/agents/relay.rs
deleted file mode 100644
index 77a244509..000000000
--- a/crates/workshop/server/src/agents/relay.rs
+++ /dev/null
@@ -1,98 +0,0 @@
-//! The buffered gateway relay: the `/v1/models` catalog passthrough and
-//! the helpers that shape gateway responses for the wire.
-
-use axum::extract::State;
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-
-use workshop_gateway::{GatewayError, GatewayResponse};
-use workshop_protocol::{Activity, ErrorEnvelope};
-use workshop_registry::Push;
-
-use super::state::SessionsState;
-
-/// Relays the gateway's model catalog to the caller verbatim.
-///
-/// While the heartbeat reports the gateway down, the route
-/// short-circuits: it answers 502 with a user-visible message instead of
-/// fetching the catalog.
-pub(super) async fn models(State(state): State<SessionsState>) -> Response {
-    // An unregistered gateway subsystem reads as the health flag's
-    // optimistic default; a registered one short-circuits while down.
-    if state.health().is_some_and(|health| !health.is_reachable()) {
-        return envelope(StatusCode::BAD_GATEWAY, "Gateway unreachable".to_string());
-    }
-    let push = state.push();
-    push.push_status_update(
-        "Loading models...",
-        "fetching the gateway model catalog",
-        Activity::General,
-    );
-    let Some(gateway) = state.gateway_snapshot() else {
-        return envelope(StatusCode::BAD_GATEWAY, "Gateway unreachable".to_string());
-    };
-    let result = gateway.client().list_models().await;
-    report_gateway_outcome(&push, &result, "GET /v1/models");
-    relay(result)
-}
-
-/// Reports a gateway call's outcome on the status bus: back to idle on
-/// success, otherwise the error label matching the failure shape.
-fn report_gateway_outcome(
-    push: &Push,
-    result: &Result<GatewayResponse, GatewayError>,
-    route: &str,
-) {
-    match result {
-        Ok(upstream) if upstream.status.is_success() => push.push_idle(),
-        Ok(upstream) => push.push_failure(
-            format!("Gateway error: {}", upstream.status),
-            format!("{route} answered a non-success status"),
-            Activity::General,
-        ),
-        Err(error) => push.push_failure("Connection lost", error.to_string(), Activity::General),
-    }
-}
-
-/// Turns a gateway call outcome into the workshop's HTTP response.
-///
-/// Success (any status) is relayed byte-for-byte; a transport failure
-/// becomes `502 Bad Gateway` in the `gateway_unreachable` wire envelope.
-fn relay(result: Result<GatewayResponse, GatewayError>) -> Response {
-    match result {
-        Ok(upstream) => (
-            upstream.status,
-            [(header::CONTENT_TYPE, "application/json")],
-            upstream.body,
-        )
-            .into_response(),
-        Err(error) => envelope(StatusCode::BAD_GATEWAY, gateway_message(&error)),
-    }
-}
-
-/// The wire message of a gateway transport failure: the error's own
-/// summary line, with the source chain appended in debug builds only.
-fn gateway_message(error: &GatewayError) -> String {
-    use std::fmt::Write as _;
-    let mut message = error.to_string();
-    if workshop_support::LEAK_DETAIL {
-        let mut source = std::error::Error::source(error);
-        while let Some(cause) = source {
-            // fmt::Write to a String cannot fail; the Result is a trait
-            // artifact.
-            let _ = write!(message, ": {cause}");
-            source = cause.source();
-        }
-    }
-    message
-}
-
-/// Renders one `gateway_unreachable` envelope at `status`.
-fn envelope(status: StatusCode, message: String) -> Response {
-    let envelope = ErrorEnvelope::new(message, "gateway_unreachable");
-    workshop_support::envelope_response(status, &envelope)
-}
-
-#[cfg(test)]
-#[path = "relay-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/search-tests.rs b/crates/workshop/server/src/agents/search-tests.rs
deleted file mode 100644
index 1e53c6f93..000000000
--- a/crates/workshop/server/src/agents/search-tests.rs
+++ /dev/null
@@ -1,150 +0,0 @@
-//! Search provider tests: a replaced gateway serves the next search, and a
-//! missing or down gateway fails as `request failed`.
-
-use std::sync::{Arc, Mutex};
-
-use axum::Json;
-use axum::Router;
-use axum::http::HeaderMap;
-use axum::routing::post;
-use plugin_web::{SearchError, SearchErrorKind, SearchProvider, SearchQuery};
-use serde_json::{Value, json};
-use workshop_gateway::{GatewayBinding, GatewayHandles, GatewayHealth};
-use workshop_registry::{Registration, Registry};
-
-use super::GatewaySearchProvider;
-use crate::app::test_helpers::spawn_gateway;
-
-/// A registry holding gateway handles bound to `base_url` under the
-/// fixture bearer, with the binding, the health flag, and the guard that
-/// keeps the registration alive.
-fn registry_with_gateway(
-    base_url: &str,
-) -> (Registry, GatewayBinding, GatewayHealth, Registration) {
-    let registry = Registry::new();
-    let binding = GatewayBinding::new(base_url, "test-key").expect("the binding builds");
-    let health = GatewayHealth::new();
-    let guard = workshop_gateway::register(
-        &registry,
-        GatewayHandles::new(binding.clone(), health.clone()),
-    );
-    (registry, binding, health, guard)
-}
-
-/// A query for `text` with every option left out.
-fn query(text: &str) -> SearchQuery {
-    SearchQuery {
-        query: text.to_owned(),
-        ..SearchQuery::default()
-    }
-}
-
-/// The Authorization header and body of each search a mock received.
-type Seen = Arc<Mutex<Vec<(Option<String>, Value)>>>;
-
-/// A mock Gateway that records each search and answers `reply`.
-fn recording_gateway(seen: Seen, reply: Value) -> Router {
-    Router::new().route(
-        "/v1/tools/web_search",
-        post(move |headers: HeaderMap, Json(body): Json<Value>| {
-            let seen = Arc::clone(&seen);
-            let reply = reply.clone();
-            async move {
-                let auth = headers
-                    .get("authorization")
-                    .and_then(|value| value.to_str().ok())
-                    .map(str::to_owned);
-                seen.lock()
-                    .expect("the capture lock is healthy")
-                    .push((auth, body));
-                Json(reply)
-            }
-        }),
-    )
-}
-
-#[tokio::test]
-async fn a_replaced_gateway_serves_the_next_search() {
-    let first = spawn_gateway(recording_gateway(
-        Seen::default(),
-        json!({ "query": "hi", "results": [{ "url": "https://first.example" }] }),
-    ))
-    .await;
-    let second_seen = Seen::default();
-    let second = spawn_gateway(recording_gateway(
-        Arc::clone(&second_seen),
-        json!({ "query": "hi", "results": [{ "url": "https://second.example" }] }),
-    ))
-    .await;
-    let (registry, binding, _health, _guard) = registry_with_gateway(&first);
-    let provider = GatewaySearchProvider::new(registry);
-
-    let before = provider
-        .search(query("hi"))
-        .await
-        .expect("the first search succeeds");
-    assert_eq!(before.results[0].url, "https://first.example");
-
-    binding
-        .replace(&second, "replacement-key")
-        .expect("the replacement publishes");
-    let after = provider
-        .search(query("hi"))
-        .await
-        .expect("the second search succeeds");
-    assert_eq!(
-        after.results[0].url, "https://second.example",
-        "the new generation's gateway answers"
-    );
-    assert_eq!(
-        second_seen.lock().expect("the capture lock is healthy")[0]
-            .0
-            .as_deref(),
-        Some("Bearer replacement-key"),
-        "the new generation's key is presented"
-    );
-}
-
-/// Asserts `error` is the bare transport failure that names no gateway
-/// detail.
-fn assert_no_gateway(error: &SearchError) {
-    assert_eq!(error.kind(), SearchErrorKind::Transport);
-    assert_eq!(error.to_string(), "request failed");
-    assert!(
-        std::error::Error::source(error).is_none(),
-        "no endpoint or key detail rides along"
-    );
-}
-
-#[tokio::test]
-async fn without_a_gateway_registration_a_search_fails_as_request_failed() {
-    let provider = GatewaySearchProvider::new(Registry::new());
-    let error = provider
-        .search(query("hi"))
-        .await
-        .expect_err("no gateway, no search");
-    assert_no_gateway(&error);
-}
-
-#[tokio::test]
-async fn a_gateway_the_heartbeat_reports_down_fails_as_request_failed() {
-    let seen = Seen::default();
-    let base = spawn_gateway(recording_gateway(
-        Arc::clone(&seen),
-        json!({ "query": "hi", "results": [] }),
-    ))
-    .await;
-    let (registry, _binding, health, _guard) = registry_with_gateway(&base);
-    health.publish(false);
-    let provider = GatewaySearchProvider::new(registry);
-
-    let error = provider
-        .search(query("hi"))
-        .await
-        .expect_err("a down gateway is not searched");
-    assert_no_gateway(&error);
-    assert!(
-        seen.lock().expect("the capture lock is healthy").is_empty(),
-        "nothing is sent to a gateway reported down"
-    );
-}
diff --git a/crates/workshop/server/src/agents/search.rs b/crates/workshop/server/src/agents/search.rs
deleted file mode 100644
index 5b40545a7..000000000
--- a/crates/workshop/server/src/agents/search.rs
+++ /dev/null
@@ -1,76 +0,0 @@
-//! The agent sessions' search provider: every `web/search`
-//! call runs through the current Gateway generation's web search relay.
-//!
-//! The provider holds the server's [`Registry`] and reads the gateway
-//! handles through it on every search, as the inference broker does, so a
-//! replaced gateway serves the next search. It keeps the [`GatewaySearch`]
-//! of the last generation it searched under and hands each search to it.
-
-use std::sync::{Mutex, PoisonError};
-
-use harness_gateway_client::GatewaySearch;
-use plugin_web::{SearchError, SearchErrorKind, SearchProvider, SearchQuery, SearchResults};
-use workshop_gateway::GatewayHandles;
-use workshop_registry::Registry;
-
-use super::gateway::UsableGateway;
-
-/// The message a search fails with when no usable Gateway client exists,
-/// so no endpoint or key detail reaches the model.
-const NO_GATEWAY: &str = "request failed";
-
-/// Searches through the Gateway the server's registry currently holds.
-pub(super) struct GatewaySearchProvider {
-    /// The subsystem registry the gateway handles are read through.
-    registry: Registry,
-    /// The client built for the last generation searched under.
-    cached: Mutex<Option<(u64, GatewaySearch)>>,
-}
-
-impl GatewaySearchProvider {
-    /// Builds the provider over the server's subsystem registry.
-    pub(super) fn new(registry: Registry) -> Self {
-        Self {
-            registry,
-            cached: Mutex::new(None),
-        }
-    }
-
-    /// The client for the current gateway generation, built on the first
-    /// search under it. A missing gateway registration, a gateway the
-    /// heartbeat reports down, or an endpoint or key that cannot be built
-    /// fails as transport with [`NO_GATEWAY`].
-    fn client(&self) -> Result<GatewaySearch, SearchError> {
-        let no_gateway = || SearchError::new(SearchErrorKind::Transport, NO_GATEWAY);
-        let handles = self
-            .registry
-            .state::<GatewayHandles>()
-            .ok_or_else(no_gateway)?;
-        if !handles.health().is_reachable() {
-            return Err(no_gateway());
-        }
-        let gateway = UsableGateway::read(&handles).ok_or_else(no_gateway)?;
-        // A poisoned lock holds a pair written whole by one store.
-        let mut cached = self.cached.lock().unwrap_or_else(PoisonError::into_inner);
-        if let Some((generation, client)) = cached.as_ref()
-            && *generation == gateway.generation
-        {
-            return Ok(client.clone());
-        }
-        let client = GatewaySearch::new(gateway.endpoint, gateway.key);
-        *cached = Some((gateway.generation, client.clone()));
-        Ok(client)
-    }
-}
-
-#[async_trait::async_trait]
-impl SearchProvider for GatewaySearchProvider {
-    async fn search(&self, query: SearchQuery) -> Result<SearchResults, SearchError> {
-        let client = self.client()?;
-        SearchProvider::search(&client, query).await
-    }
-}
-
-#[cfg(test)]
-#[path = "search-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/socket-tests.rs b/crates/workshop/server/src/agents/socket-tests.rs
deleted file mode 100644
index 22b9fdc7b..000000000
--- a/crates/workshop/server/src/agents/socket-tests.rs
+++ /dev/null
@@ -1,97 +0,0 @@
-//! The agent socket's rendering of a refused launch: the error frame's
-//! text includes the refusal's cause chain, not just its outermost
-//! message. A launch hands back receivers subscribed before its run
-//! starts, so they hold a failure the run reported and ended on before
-//! any socket attached.
-
-use std::io;
-use std::time::Duration;
-
-use serde_json::json;
-use tokio::sync::broadcast::error::TryRecvError;
-use workshop_agents::{FailureKind, LaunchError, SessionState};
-use workshop_gateway::ResolvedGateway;
-use workshop_support::{AgentsConfig, Config};
-
-use super::*;
-use crate::app::state_with_gateway;
-use crate::app::test_helpers::config_for;
-
-#[test]
-fn a_refused_launch_frame_includes_the_cause_text() {
-    let cause = "agents directory is locked by another process";
-    let refusal = LaunchRefusal::Refused(LaunchError::Unreadable {
-        source: io::Error::new(io::ErrorKind::PermissionDenied, cause),
-    });
-
-    let rendered = refusal_text(&refusal);
-
-    assert!(
-        rendered.contains("agent session state unavailable"),
-        "the refusal's own message is missing: {rendered}"
-    );
-    assert!(
-        rendered.contains(cause),
-        "the cause text is missing from the frame: {rendered}"
-    );
-}
-
-#[test]
-fn an_unusable_gateway_renders_its_own_message_alone() {
-    assert_eq!(
-        refusal_text(&LaunchRefusal::GatewayUnusable),
-        "agent sessions need a usable gateway binding; check the gateway base URL and key"
-    );
-}
-
-#[tokio::test]
-async fn a_launch_hands_back_the_parse_failure_its_run_ended_on_before_any_attach() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let agents_dir = dir.path().join("agents");
-    std::fs::create_dir(&agents_dir).expect("the agents directory creates");
-    // Readable, so the launch check accepts it, but with no frontmatter,
-    // so the run's parse fails before the run begins.
-    std::fs::write(agents_dir.join("broken.md"), "# Broken\n").expect("the agent writes");
-    let config = Config {
-        agents: AgentsConfig {
-            path: agents_dir,
-            ..AgentsConfig::default()
-        },
-        ..config_for("http://127.0.0.1:1", dir.path())
-    };
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let state = state_with_gateway(&config, &gateway).expect("state builds in tests");
-    // A run starts only once the catalog holds a chat-capable model.
-    state
-        .catalog()
-        .publish(vec![json!({ "id": "test-model", "object": "model" })]);
-
-    let (conversation, mut receivers) = state
-        .agents()
-        .launch("broken")
-        .await
-        .expect("the launch is accepted");
-    tokio::time::timeout(Duration::from_secs(10), async {
-        while conversation.state() != SessionState::Closed {
-            tokio::time::sleep(Duration::from_millis(10)).await;
-        }
-    })
-    .await
-    .expect("the failed parse ends the conversation");
-
-    assert_eq!(
-        conversation.subscribe_errors().try_recv(),
-        Err(TryRecvError::Closed),
-        "a socket subscribing only after the run ended would see nothing"
-    );
-    let failure = receivers
-        .errors
-        .try_recv()
-        .expect("the launch's receiver kept the failure");
-    assert_eq!(failure.kind, FailureKind::RunFailed);
-    assert!(
-        failure.message.contains("frontmatter delimiter"),
-        "the failure is the parse's own: {}",
-        failure.message
-    );
-}
diff --git a/crates/workshop/server/src/agents/socket.rs b/crates/workshop/server/src/agents/socket.rs
deleted file mode 100644
index 163cdff46..000000000
--- a/crates/workshop/server/src/agents/socket.rs
+++ /dev/null
@@ -1,463 +0,0 @@
-//! The `/agents/ws` WebSocket endpoint: one socket serving one agent
-//! conversation at a time.
-//!
-//! On connect the server pushes the discovered agent list. The client
-//! then sends `{"type":"launch","agent":"..."}` to start a conversation
-//! or `{"type":"attach","session":"..."}` to reattach to a running one -
-//! conversations outlive sockets, so a reconnect replays the
-//! conversation's transcript from index zero, the agent's waits on its
-//! inbox (`awaiting_input`) included. While attached, the loop streams
-//! three families: durable `agent_event` frames drained from the
-//! conversation's transcript by a per-client cursor (the event broadcast
-//! is only the wakeup, so a lagged receiver loses nothing), ephemeral
-//! `agent_delta` frames from the conversation's delta channel (drops
-//! repair via the superseding event), and ephemeral `error` frames
-//! reporting a failed model round the program survived or a run that
-//! ended in error. `{"type":"input_response","text":"..."}` sends the
-//! operator's message to the run whenever the operator sends it: an
-//! accepted message dispatches the turn (the Thinking status push), and a
-//! refused one is answered with an error frame saying whether the run has
-//! ended or not started yet; `{"type":"cancel"}` stops the round in
-//! flight - a stop reason, never an error: a message already sent stays
-//! queued for the agent, and the frames that follow are the same run's
-//! own.
-//!
-//! One task owns the socket: a single `select!` loop reads and writes
-//! the same handle, per the server's socket rule; the conversation table
-//! behind it is the launcher's, [`super`]'s documented carve-out.
-
-use axum::extract::State;
-use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
-use axum::http::HeaderMap;
-use axum::response::Response;
-use runvil::harness::display_chain;
-use tokio::sync::broadcast;
-use tokio::sync::broadcast::error::RecvError;
-
-use workshop_agents::{Conversation, Delta, SessionEvent, SessionFailure, SessionState};
-use workshop_protocol::{Activity, ErrorFrame, InputResponse};
-use workshop_support::recv_or_pending;
-
-use super::LaunchRefusal;
-use super::socket_frames::{delta_frame, drain_events, frame_entry};
-use super::state::SessionsState;
-use crate::agents::wire::{AgentSessionFrame, AgentsFrame, RequestRefusal, SessionRequest};
-use crate::websocket::{cross_site_refusal, send_error, send_frame};
-
-/// Upgrades a `GET /agents/ws` request to an agent-session socket. A
-/// foreign `Origin` is refused with 403, as the workshop socket's
-/// upgrade is.
-pub(super) async fn upgrade(
-    State(state): State<SessionsState>,
-    headers: HeaderMap,
-    ws: WebSocketUpgrade,
-) -> Response {
-    if !state.origin_allowed(&headers) {
-        return cross_site_refusal();
-    }
-    ws.on_upgrade(move |socket| run_socket(socket, state))
-}
-
-/// The attachment state of one socket: the conversation it serves and the
-/// per-client cursors deriving durable-frame indices.
-pub(super) struct Attached {
-    /// The conversation this socket serves.
-    pub(super) conversation: Conversation,
-    /// The next transcript index to consider; everything below it has
-    /// been read (framed or skipped) for this client already.
-    pub(super) cursor: u64,
-    /// The wire index the next framed entry takes: the count of
-    /// transcript entries with a wire shape sent so far, so the durable
-    /// frames number the transcript the client renders, gap-free.
-    pub(super) framed: u64,
-}
-
-/// Runs one agent-session socket until it closes or fails.
-async fn run_socket(mut socket: WebSocket, state: SessionsState) {
-    // The list is discovered per connect: the frame is a complete
-    // snapshot, so a directory edited between connects is picked up by
-    // the next window with no push machinery. An unregistered sessions
-    // handle degrades the discovery to the empty list.
-    let discovered = state
-        .agents()
-        .map_or_else(Vec::new, |agents| agents.discover());
-    if !send_frame(&mut socket, &AgentsFrame::new(discovered)).await {
-        return;
-    }
-    let mut attached: Option<Attached> = None;
-    // The subscriptions are stored beside the attachment (not inside it)
-    // so the select! arms below can borrow them while the inbound arm
-    // borrows `attached`; attach() and the arms keep them all in step.
-    let mut events_rx: Option<broadcast::Receiver<SessionEvent>> = None;
-    let mut deltas_rx: Option<broadcast::Receiver<Delta>> = None;
-    let mut errors_rx: Option<broadcast::Receiver<SessionFailure>> = None;
-
-    loop {
-        let open = tokio::select! {
-            // Biased, in this order: error reports first - one-off and
-            // causally ahead of the wait that follows a failed round, so
-            // the error frame precedes the next `awaiting_input` on the
-            // wire; inbound next keeps the socket read at all times, so a
-            // cancel lands while a stream runs hot; deltas before the
-            // event drain, so when a whole round sits queued the chunks
-            // flush before the durable event that supersedes them; the
-            // event drain last loses nothing, because the cursor
-            // delivers everything past it whenever it runs.
-            biased;
-            received = recv_or_pending(&mut errors_rx) => {
-                forward_error(received, &mut errors_rx, &mut socket).await
-            }
-            inbound = socket.recv() => {
-                let subscriptions = (&mut events_rx, &mut deltas_rx, &mut errors_rx);
-                on_inbound(&state, inbound, &mut attached, subscriptions, &mut socket).await
-            }
-            received = recv_or_pending(&mut deltas_rx) => {
-                forward_delta(received, &mut deltas_rx, &mut socket).await
-            }
-            received = recv_or_pending(&mut events_rx) => {
-                forward_event(received, &mut events_rx, attached.as_mut(), &mut socket).await
-            }
-        };
-        if !open {
-            break;
-        }
-    }
-    // The socket detaches; the conversation lives on. Reconnecting
-    // replays the transcript.
-}
-
-/// Forwards one session error report. Errors are ephemeral: a lagged
-/// receiver misses only what the durable transcript shows as a turn with
-/// no reply. A `false` return means the client is gone.
-async fn forward_error(
-    received: Result<SessionFailure, RecvError>,
-    errors_rx: &mut Option<broadcast::Receiver<SessionFailure>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match received {
-        Ok(failure) => send_frame(socket, &ErrorFrame::new(failure.message, None)).await,
-        Err(RecvError::Lagged(skipped)) => {
-            tracing::debug!(skipped, "agent error receiver lagged; reports dropped");
-            true
-        }
-        Err(RecvError::Closed) => {
-            *errors_rx = None;
-            true
-        }
-    }
-}
-
-/// Handles one inbound socket read. A `false` return means the socket
-/// closed or failed, or the client is gone.
-async fn on_inbound(
-    state: &SessionsState,
-    inbound: Option<Result<Message, axum::Error>>,
-    attached: &mut Option<Attached>,
-    subscriptions: Subscriptions<'_>,
-    socket: &mut WebSocket,
-) -> bool {
-    match inbound {
-        Some(Ok(Message::Text(text))) => {
-            handle_frame(state, &text, attached, subscriptions, socket).await
-        }
-        Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Binary(_))) => true,
-        Some(Ok(Message::Close(_))) | None => false,
-        Some(Err(error)) => {
-            tracing::warn!(%error, "agent session socket failed");
-            false
-        }
-    }
-}
-
-/// Forwards one delta. Deltas are ephemeral: a lagged client skips chunks
-/// and the superseding durable event repairs the transcript. A `false`
-/// return means the client is gone.
-async fn forward_delta(
-    received: Result<Delta, RecvError>,
-    deltas_rx: &mut Option<broadcast::Receiver<Delta>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match received {
-        Ok(delta) => match delta_frame(delta) {
-            Some(frame) => send_frame(socket, &frame).await,
-            None => true,
-        },
-        Err(RecvError::Lagged(skipped)) => {
-            tracing::debug!(skipped, "agent delta receiver lagged; chunks dropped");
-            true
-        }
-        Err(RecvError::Closed) => {
-            *deltas_rx = None;
-            true
-        }
-    }
-}
-
-/// Handles one event wakeup. The broadcast is only the wakeup: a live
-/// entry at the cursor frames directly, and anything else (a gap, a lag,
-/// even a closed receiver) drains the transcript from the cursor, so no
-/// entry is ever lost. A `false` return means the client is gone.
-async fn forward_event(
-    received: Result<SessionEvent, RecvError>,
-    events_rx: &mut Option<broadcast::Receiver<SessionEvent>>,
-    attached: Option<&mut Attached>,
-    socket: &mut WebSocket,
-) -> bool {
-    match (received, attached) {
-        (Err(RecvError::Closed), _) => {
-            *events_rx = None;
-            true
-        }
-        (received, Some(attached)) => on_event_wake(attached, received.ok(), socket).await,
-        (_, None) => true,
-    }
-}
-
-/// A conversation's three live channels, subscribed together, so the
-/// socket that attaches with them misses nothing sent from that point
-/// on. A receiver still yields what was queued after its channel
-/// closes, so a run that fails and ends before the socket attaches
-/// still reaches it.
-pub(super) struct Receivers {
-    events: broadcast::Receiver<SessionEvent>,
-    deltas: broadcast::Receiver<Delta>,
-    errors: broadcast::Receiver<SessionFailure>,
-}
-
-impl Receivers {
-    /// Subscribes to every live channel of `conversation`.
-    pub(super) fn subscribe(conversation: &Conversation) -> Receivers {
-        Receivers {
-            events: conversation.subscribe_events(),
-            deltas: conversation.subscribe_deltas(),
-            errors: conversation.subscribe_errors(),
-        }
-    }
-}
-
-/// The three channel subscriptions an attachment holds, passed as one
-/// bundle so [`handle_frame`] can replace them atomically on attach.
-type Subscriptions<'a> = (
-    &'a mut Option<broadcast::Receiver<SessionEvent>>,
-    &'a mut Option<broadcast::Receiver<Delta>>,
-    &'a mut Option<broadcast::Receiver<SessionFailure>>,
-);
-
-/// Handles one inbound text frame. A `false` return means the client is
-/// gone and the socket loop should end.
-async fn handle_frame(
-    state: &SessionsState,
-    text: &str,
-    attached: &mut Option<Attached>,
-    subscriptions: Subscriptions<'_>,
-    socket: &mut WebSocket,
-) -> bool {
-    let frame: serde_json::Value = match serde_json::from_str(text) {
-        Ok(frame) => frame,
-        Err(error) => {
-            send_error(socket, None, format!("invalid JSON frame: {error}")).await;
-            return true;
-        }
-    };
-    let request = match frame.get("type").and_then(serde_json::Value::as_str) {
-        Some("input_response") => {
-            answer_input(state, frame, attached.as_ref(), socket).await;
-            return true;
-        }
-        _ => SessionRequest::parse(&frame),
-    };
-    let open = match request {
-        Ok(SessionRequest::Cancel) => {
-            if let Some(attached) = attached.as_ref() {
-                // A stop is a stop reason: no reply frame of any kind. The
-                // round in flight is dropped, and a message already sent
-                // stays queued for the agent.
-                attached.conversation.stop_round();
-            } else {
-                send_error(socket, None, "cancel before a session is attached").await;
-            }
-            return true;
-        }
-        Ok(SessionRequest::Launch { agent }) => Ok(OpenRequest::Launch { agent }),
-        Ok(SessionRequest::Attach { session }) => Ok(OpenRequest::Attach { session }),
-        Err(refusal @ RequestRefusal::UnknownType) => {
-            send_error(socket, None, refusal.to_string()).await;
-            return true;
-        }
-        Err(
-            refusal @ (RequestRefusal::LaunchWithoutAgent | RequestRefusal::AttachWithoutSession),
-        ) => Err(refusal),
-    };
-    handle_open(state, open, attached, subscriptions, socket).await
-}
-
-/// A [`SessionRequest`] that opens a conversation.
-enum OpenRequest {
-    /// Start a conversation running `agent`.
-    Launch { agent: String },
-    /// Reattach to the running conversation `session`.
-    Attach { session: String },
-}
-
-/// Handles an `input_response` frame: sends the operator's message to the
-/// attached conversation's run and, when the run accepts it, reports the
-/// dispatched turn; a message the run refuses is answered with an error
-/// frame.
-async fn answer_input(
-    state: &SessionsState,
-    frame: serde_json::Value,
-    attached: Option<&Attached>,
-    socket: &mut WebSocket,
-) {
-    let Some(attached) = attached else {
-        send_error(socket, None, "input_response before a session is attached").await;
-        return;
-    };
-    let response: InputResponse = match serde_json::from_value(frame) {
-        Ok(response) => response,
-        Err(error) => {
-            send_error(socket, None, format!("invalid input_response: {error}")).await;
-            return;
-        }
-    };
-    let conversation = &attached.conversation;
-    if conversation.send_input(response.text) {
-        // The run took the message: the turn is dispatched.
-        state.push().push_status_update(
-            "Running agent turn",
-            format!("agent `{}` is thinking", conversation.agent()),
-            Activity::Thinking,
-        );
-    } else {
-        send_error(socket, None, refused_input_text(conversation)).await;
-    }
-}
-
-/// The text of the error frame answering a message the run refused: the
-/// run either has no Harness yet or has ended. A run that has started
-/// takes every message until it ends, so a refusal after its start means
-/// it ended, even before the conversation is `Closed`.
-fn refused_input_text(conversation: &Conversation) -> &'static str {
-    if conversation.state() == SessionState::Closed || conversation.run_id().is_some() {
-        "The agent's run has ended, so your message was not sent."
-    } else {
-        "The agent is not taking messages yet, so your message was not sent."
-    }
-}
-
-/// Handles a `launch` or `attach` request, or the refusal of a malformed
-/// one: resolves the conversation it names and attaches the socket to
-/// it. One socket serves one conversation - agent windows are modal - so
-/// a second open on an attached socket is refused, before the frame's
-/// own shape is. A `false` return means the client is gone.
-async fn handle_open(
-    state: &SessionsState,
-    open: Result<OpenRequest, RequestRefusal>,
-    attached: &mut Option<Attached>,
-    subscriptions: Subscriptions<'_>,
-    socket: &mut WebSocket,
-) -> bool {
-    if attached.is_some() {
-        send_error(
-            socket,
-            None,
-            "this socket already serves a session; agent windows are modal",
-        )
-        .await;
-        return true;
-    }
-    let Some(agents) = state.agents() else {
-        send_error(socket, None, "agent sessions are unavailable").await;
-        return true;
-    };
-    let (conversation, receivers) = match open {
-        Ok(OpenRequest::Launch { agent }) => match agents.launch(&agent).await {
-            Ok(launched) => launched,
-            Err(refusal) => {
-                send_error(socket, None, refusal_text(&refusal)).await;
-                return true;
-            }
-        },
-        Ok(OpenRequest::Attach { session: id }) => {
-            let Some(conversation) = agents.get(&id) else {
-                send_error(socket, None, "unknown agent session").await;
-                return true;
-            };
-            let receivers = Receivers::subscribe(&conversation);
-            (conversation, receivers)
-        }
-        Err(refusal) => {
-            send_error(socket, None, refusal.to_string()).await;
-            return true;
-        }
-    };
-    attach(conversation, receivers, attached, subscriptions, socket).await
-}
-
-/// The text of the error frame reporting a refused launch: the refusal
-/// and its cause chain. A refusal's `Display` is only its own
-/// message, so an unreadable agent source would otherwise reach the
-/// client as the bare "agent session state unavailable" with the
-/// filesystem's diagnosis gone.
-fn refusal_text(refusal: &LaunchRefusal) -> String {
-    display_chain(refusal)
-}
-
-/// Attaches the socket to `conversation`: takes `receivers` as the
-/// socket's three subscriptions (subscribed before the replay, so nothing
-/// lands between them unseen), acknowledges with the session frame, and
-/// replays the conversation's transcript from index zero, so a client
-/// that attaches while the agent waits on its inbox ends on that wait's
-/// `awaiting_input`. A `false` return means the client is gone.
-async fn attach(
-    conversation: Conversation,
-    receivers: Receivers,
-    attached: &mut Option<Attached>,
-    (events_rx, deltas_rx, errors_rx): Subscriptions<'_>,
-    socket: &mut WebSocket,
-) -> bool {
-    let Receivers {
-        events,
-        deltas,
-        errors,
-    } = receivers;
-    *events_rx = Some(events);
-    *deltas_rx = Some(deltas);
-    *errors_rx = Some(errors);
-    let acknowledgment = AgentSessionFrame::new(
-        conversation.id().to_string(),
-        conversation.agent().to_owned(),
-    );
-    let mut state = Attached {
-        conversation,
-        cursor: 0,
-        framed: 0,
-    };
-    if !send_frame(socket, &acknowledgment).await || !drain_events(&mut state, socket).await {
-        return false;
-    }
-    *attached = Some(state);
-    true
-}
-
-/// Frames what an event wakeup delivered: the live entry itself when it
-/// is the entry at the cursor (or one the replay already covered, which
-/// frames nothing), else - a gap past the cursor, or a lag that delivered
-/// no entry - the transcript from the cursor on. A `false` return means
-/// the client is gone.
-async fn on_event_wake(
-    attached: &mut Attached,
-    entry: Option<SessionEvent>,
-    socket: &mut WebSocket,
-) -> bool {
-    match entry {
-        Some(entry) if entry.index <= attached.cursor => {
-            frame_entry(attached, &entry, socket).await
-        }
-        _ => drain_events(attached, socket).await,
-    }
-}
-
-#[cfg(test)]
-#[path = "socket-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/socket_frames-tests.rs b/crates/workshop/server/src/agents/socket_frames-tests.rs
deleted file mode 100644
index 28961ab5e..000000000
--- a/crates/workshop/server/src/agents/socket_frames-tests.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-//! Table-driven tests for the agent socket's framing helpers: the pure
-//! render function that maps the conversation's deltas onto Workshop wire
-//! shapes, and the cursor and wire-index bookkeeping behind every durable
-//! `agent_event` frame.
-
-use runvil::event::Event;
-use runvil::ids::{ChainId, Provenance, TaskId};
-use workshop_agents::{Delta, SessionEvent};
-
-use super::{advance, delta_frame};
-use crate::agents::wire::{AgentDeltaFrame, AgentDeltaKind, AgentEventFrame};
-
-#[test]
-fn delta_frames_map_conversation_channels_to_wire_shapes() {
-    // The conversation's `Delta` is `#[non_exhaustive]`, so each
-    // fixture is deserialized rather than written as a struct literal.
-    let cases = [
-        (
-            r#"{"kind":"text","content":"po","reply":2}"#,
-            Some(AgentDeltaFrame::new(
-                AgentDeltaKind::Text,
-                "po".to_owned(),
-                2,
-            )),
-        ),
-        (
-            r#"{"kind":"reasoning","content":"hmm","reply":3}"#,
-            Some(AgentDeltaFrame::new(
-                AgentDeltaKind::Reasoning,
-                "hmm".to_owned(),
-                3,
-            )),
-        ),
-    ];
-
-    for (json, expected) in cases {
-        let delta: Delta = serde_json::from_str(json).expect("the delta fixture parses");
-        assert_eq!(delta_frame(delta), expected);
-    }
-}
-
-/// The root task's zeroth sequence: the wire does not expose it.
-fn provenance() -> Provenance {
-    Provenance::new(TaskId::from(ChainId::root()), 0)
-}
-
-/// The operator's message as it entered the main chain's inbox, which has
-/// a wire shape.
-fn operator_message(text: &str) -> Event {
-    Event::InboxMessage {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        text: text.to_owned(),
-    }
-}
-
-/// A transcript entry holding `event` in its persisted shape.
-fn entry(index: u64, reply: Option<u64>, event: &Event) -> SessionEvent {
-    SessionEvent {
-        index,
-        reply,
-        event: serde_json::to_value(event).expect("an engine event serializes"),
-    }
-}
-
-/// The frame `event` renders at wire index `index`.
-fn frame(index: u64, reply: Option<u64>, event: &Event) -> AgentEventFrame {
-    AgentEventFrame::new(index, reply, event).expect("an operator message frames")
-}
-
-#[test]
-fn framed_entries_take_gap_free_wire_indices_past_unframed_ones() {
-    let hello = operator_message("hello");
-    let again = operator_message("again");
-    let lifecycle = Event::SectionStarted {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-    };
-    let entries = [
-        entry(0, None, &hello),
-        entry(1, None, &lifecycle),
-        SessionEvent {
-            index: 2,
-            reply: None,
-            event: serde_json::json!({ "kind": "from_a_later_build" }),
-        },
-        entry(3, Some(1), &again),
-    ];
-    let (mut cursor, mut framed) = (0, 0);
-
-    let rendered: Vec<_> = entries
-        .iter()
-        .map(|entry| advance(&mut cursor, &mut framed, entry))
-        .collect();
-
-    assert_eq!(
-        rendered,
-        [
-            Some(frame(0, None, &hello)),
-            None,
-            None,
-            Some(frame(1, Some(1), &again)),
-        ],
-        "a lifecycle entry and an unreadable payload frame nothing and take no wire index"
-    );
-    assert_eq!(cursor, 4, "the cursor moves past every entry read");
-    assert_eq!(framed, 2, "only framed entries take a wire index");
-}
-
-#[test]
-fn an_entry_below_the_cursor_moves_neither_cursor() {
-    let (mut cursor, mut framed) = (5, 3);
-
-    let replayed = advance(
-        &mut cursor,
-        &mut framed,
-        &entry(4, None, &operator_message("seen")),
-    );
-
-    assert_eq!(replayed, None, "an entry already read never frames twice");
-    assert_eq!((cursor, framed), (5, 3));
-}
-
-#[test]
-fn a_live_entry_past_a_gap_moves_the_cursor_beyond_it() {
-    let late = operator_message("late");
-    let (mut cursor, mut framed) = (2, 1);
-
-    let live = advance(&mut cursor, &mut framed, &entry(6, None, &late));
-
-    assert_eq!(
-        live,
-        Some(frame(1, None, &late)),
-        "the wire index counts frames sent, not transcript entries"
-    );
-    assert_eq!((cursor, framed), (7, 2));
-}
diff --git a/crates/workshop/server/src/agents/socket_frames.rs b/crates/workshop/server/src/agents/socket_frames.rs
deleted file mode 100644
index 4abd0e7f2..000000000
--- a/crates/workshop/server/src/agents/socket_frames.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-//! The agent socket's framing helpers: the pure render function that
-//! maps the conversation's delta vocabulary onto Workshop's wire shape,
-//! and the durable-event framing that drains a conversation's transcript
-//! past the per-client cursor.
-
-use axum::extract::ws::WebSocket;
-use runvil::event::Event;
-use workshop_agents::{Delta, DeltaKind, SessionEvent};
-
-use super::socket::Attached;
-use crate::agents::wire::{AgentDeltaFrame, AgentDeltaKind, AgentEventFrame};
-use crate::websocket::send_frame;
-
-/// Renders a conversation's delta as the protocol's delta frame, the reply stamp
-/// passed through; `None` for a side channel the wire has no label for,
-/// dropped like a lagged delta because the completed-reply event repairs
-/// the transcript.
-pub(super) fn delta_frame(delta: Delta) -> Option<AgentDeltaFrame> {
-    let channel = match delta.kind {
-        DeltaKind::Text => AgentDeltaKind::Text,
-        DeltaKind::Reasoning => AgentDeltaKind::Reasoning,
-        // The conversation's `DeltaKind` is `#[non_exhaustive]`.
-        _ => return None,
-    };
-    Some(AgentDeltaFrame::new(channel, delta.content, delta.reply))
-}
-
-/// Sends every transcript entry past the client's cursor as a durable
-/// `agent_event` frame stamped with its wire index and, on the
-/// model-round content kinds, the reply stamp its deltas had. A `false`
-/// return means the client is gone.
-pub(super) async fn drain_events(attached: &mut Attached, socket: &mut WebSocket) -> bool {
-    let transcript = attached.conversation.transcript(attached.cursor);
-    for entry in &transcript {
-        if !frame_entry(attached, entry, socket).await {
-            return false;
-        }
-    }
-    true
-}
-
-/// Frames one transcript entry at or past the cursor and advances the
-/// cursor over it. An entry with no wire shape (every lifecycle event but
-/// the run's end, task and debug events, and a task's inbox events)
-/// advances the cursor without a frame or a wire index. A `false` return
-/// means the client is gone.
-pub(super) async fn frame_entry(
-    attached: &mut Attached,
-    entry: &SessionEvent,
-    socket: &mut WebSocket,
-) -> bool {
-    match advance(&mut attached.cursor, &mut attached.framed, entry) {
-        Some(frame) => send_frame(socket, &frame).await,
-        None => true,
-    }
-}
-
-/// Moves the transcript `cursor` past `entry` and returns the entry's
-/// frame, stamped with the wire index `framed` and advancing it. An entry
-/// below the cursor was already read and moves neither; an entry with no
-/// wire shape moves only the cursor.
-fn advance(cursor: &mut u64, framed: &mut u64, entry: &SessionEvent) -> Option<AgentEventFrame> {
-    if entry.index < *cursor {
-        return None;
-    }
-    *cursor = entry.index + 1;
-    // A stored payload this build cannot read has no wire shape either;
-    // the transcript's index sequence stays whole.
-    let event = serde_json::from_value::<Event>(entry.event.clone()).ok()?;
-    let frame = AgentEventFrame::new(*framed, entry.reply, &event)?;
-    *framed += 1;
-    Some(frame)
-}
-
-#[cfg(test)]
-#[path = "socket_frames-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/state.rs b/crates/workshop/server/src/agents/state.rs
deleted file mode 100644
index d5574e7e8..000000000
--- a/crates/workshop/server/src/agents/state.rs
+++ /dev/null
@@ -1,94 +0,0 @@
-//! The sessions subsystem's shared route state and its registry
-//! registration: the state every sessions route handler draws its
-//! handles from, the router constructor, and the `register` entry point
-//! the composition root calls.
-
-use std::ops::Deref;
-use std::sync::Arc;
-
-use axum::Router;
-use axum::http::HeaderMap;
-use axum::routing::get;
-
-use workshop_registry::{Registration, Registry, RouteRegistrarAdapter};
-use workshop_support::{RELAY_DEADLINE, with_deadline};
-
-use super::{AgentSessions, relay, socket};
-use crate::websocket::SocketState;
-
-/// The shared state of the sessions subsystem's routes: the socket state
-/// every socket route shares (registry, origin policy, and the gateway
-/// and push accessors, reached through `Deref`), plus the agent-session
-/// opener, read through the registry's type-keyed state collection at
-/// the point of use as an `Option` whose `None` degrades the feature.
-#[derive(Debug, Clone)]
-pub(crate) struct SessionsState {
-    socket: SocketState,
-}
-
-impl SessionsState {
-    /// Builds the route state over the subsystem registry and the
-    /// server's origin policy.
-    #[must_use]
-    pub(crate) fn new(registry: Registry, origin_allowed: fn(&HeaderMap) -> bool) -> Self {
-        Self {
-            socket: SocketState::new(registry, origin_allowed),
-        }
-    }
-
-    /// The agent-session opener behind `/agents/ws`, or `None` while
-    /// the sessions subsystem has not registered.
-    pub(super) fn agents(&self) -> Option<AgentSessions> {
-        self.registry()
-            .state::<AgentSessions>()
-            .map(|agents| (*agents).clone())
-    }
-}
-
-impl Deref for SessionsState {
-    type Target = SocketState;
-
-    fn deref(&self) -> &SocketState {
-        &self.socket
-    }
-}
-
-/// The sessions subsystem's routes: the `/v1/models` catalog relay on the
-/// relay deadline, and the `/agents/ws` WebSocket upgrade, which answers
-/// immediately and then outlives any deadline.
-pub(super) fn routes(state: SessionsState) -> Router {
-    with_deadline(
-        Router::new().route("/v1/models", get(relay::models)),
-        RELAY_DEADLINE,
-    )
-    .route("/agents/ws", get(socket::upgrade))
-    .with_state(state)
-}
-
-/// The sessions subsystem's registration guards: its routes and the
-/// agent-session launcher. Dropping them deregisters the subsystem.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the subsystem"]
-pub(crate) struct SessionsRegistrations {
-    /// The `/v1/models` and `/agents/ws` route registrar.
-    pub(crate) routes: Registration,
-    /// The agent-session launcher as a state handle.
-    pub(crate) agents: Registration,
-}
-
-/// Registers the sessions subsystem into the registry: its routes, merged
-/// into the server's API router, and the agent-session launcher as a
-/// state handle. The returned guards keep the registrations alive; the
-/// composition root holds them for the process lifetime.
-pub(crate) fn register(
-    registry: &Registry,
-    state: &SessionsState,
-    agents: &AgentSessions,
-) -> SessionsRegistrations {
-    let routes = registry.register_routes(Arc::new(RouteRegistrarAdapter::new({
-        let state = state.clone();
-        move || routes(state.clone())
-    })));
-    let agents = registry.register_state::<AgentSessions>(Arc::new(agents.clone()));
-    SessionsRegistrations { routes, agents }
-}
diff --git a/crates/workshop/server/src/agents/status-tests.rs b/crates/workshop/server/src/agents/status-tests.rs
deleted file mode 100644
index f4e4feaea..000000000
--- a/crates/workshop/server/src/agents/status-tests.rs
+++ /dev/null
@@ -1,278 +0,0 @@
-//! Agent status tests: which conversation events push a status frame and reset the backoff.
-
-use std::fmt;
-use std::time::Duration;
-
-use runvil::ids::{ChainId, Provenance, RoundId, TaskId};
-use workshop_protocol::Severity;
-use workshop_registry::Registry;
-use workshop_status::StatusBus;
-
-use super::*;
-
-/// A push facade wired to a real status bus through the registry, with
-/// the bus's receiver and the registration guards a test reads through.
-fn wired_push() -> (
-    Push,
-    broadcast::Receiver<workshop_protocol::StatusBarUpdate>,
-    impl fmt::Debug + Send + Sync + 'static + use<>,
-) {
-    let status = StatusBus::new();
-    let status_rx = status.subscribe();
-    let registry = Registry::new();
-    let guards = workshop_status::register(&registry, &status);
-    (registry.push(), status_rx, guards)
-}
-
-/// A session event holding one Engine event under the fixed test
-/// coordinates, in the persisted shape the reporter reads.
-fn session_event(event: &Event) -> SessionEvent {
-    SessionEvent {
-        index: 0,
-        reply: None,
-        event: serde_json::to_value(event).expect("an engine event serializes"),
-    }
-}
-
-fn reply_event() -> Event {
-    Event::AssistantReply {
-        section: "chat".to_owned(),
-        provenance: Provenance::new(TaskId::from(ChainId::root()), 0),
-        turn: 1,
-        round: RoundId::new(0),
-        text: "hello".to_owned(),
-        finish_reason: None,
-        model: "m".to_owned(),
-        metrics: None,
-        origin: runvil::event::ReplyOrigin::Chat,
-    }
-}
-
-/// `task` parked on its empty inbox.
-fn waiting_event(task: TaskId) -> Event {
-    Event::InboxWaiting {
-        section: "chat".to_owned(),
-        provenance: Provenance::new(task, 0),
-    }
-}
-
-/// The main chain's program returning, which ends the run.
-fn run_succeeded() -> Event {
-    Event::RunSucceeded {
-        section: "chat".to_owned(),
-        provenance: Provenance::new(TaskId::from(ChainId::root()), 0),
-    }
-}
-
-/// The four failure kinds the session reports on its error channel: a
-/// failed model turn and a failed tool call the program survived, a run
-/// that ended in error, and the synthetic terminal of a cancel. Each
-/// must release the turn-dispatch Thinking push with a terminal,
-/// non-thinking status; the survived turns keep the boundary as their
-/// label because the agent is still running, and only a run that ended
-/// reads `Agent failed`. The label comes from the kind alone: the message
-/// is deliberately unlike the label, so a reporter that read the sentence
-/// would mislabel every row.
-#[test]
-fn every_error_report_pushes_a_terminal_failure_status() {
-    let (push, mut status_rx, _guards) = wired_push();
-    let reports = [
-        (
-            FailureKind::ModelTurnFailed,
-            "round 3 in agent `chat`",
-            "Model turn failed",
-        ),
-        (
-            FailureKind::ToolCallFailed,
-            "call 7 in agent `chat`",
-            "Tool call failed",
-        ),
-        (
-            FailureKind::RunFailed,
-            "agent run failed: kaboom",
-            "Agent failed",
-        ),
-        (FailureKind::Canceled, "run canceled", "Agent failed"),
-    ];
-
-    for (kind, message, label) in reports {
-        let failure = SessionFailure {
-            kind,
-            message: message.to_owned(),
-        };
-        on_error(&failure, &push);
-        let update = status_rx
-            .try_recv()
-            .expect("the report pushes a terminal status");
-        assert_eq!(update.severity, Severity::Error, "kind: {kind:?}");
-        assert_eq!(
-            update.activity,
-            Activity::General,
-            "a non-thinking activity releases the status bar's sustained amber LED"
-        );
-        assert_eq!(
-            update.label, label,
-            "the label is chosen by the kind, never by the sentence: {kind:?}"
-        );
-        assert_eq!(
-            update.description, message,
-            "the message passes through unchanged as the status description"
-        );
-    }
-}
-
-#[test]
-fn the_status_stays_busy_across_a_reply_and_goes_idle_at_the_main_chains_wait() {
-    let (push, mut status_rx, _guards) = wired_push();
-    let backoff = ReconnectBackoff::with_schedule(
-        Duration::from_millis(1),
-        Duration::from_millis(8),
-        Duration::from_secs(1),
-    );
-    let _ = backoff.next_delay();
-    assert!(
-        backoff.is_escalated_for_test(),
-        "a handed-out delay escalates the schedule"
-    );
-
-    on_event(&session_event(&reply_event()), &push, &backoff);
-    assert!(
-        status_rx.try_recv().is_err(),
-        "a reply does not end the turn: a message that lands as it does makes the loop go on"
-    );
-    assert!(
-        !backoff.is_escalated_for_test(),
-        "an agent reply is useful gateway work and resets the backoff"
-    );
-
-    let task = TaskId::from(ChainId::root().child(0));
-    on_event(&session_event(&waiting_event(task)), &push, &backoff);
-    assert!(
-        status_rx.try_recv().is_err(),
-        "a task waiting on its inbox ends no turn of the operator's"
-    );
-
-    let main = TaskId::from(ChainId::root());
-    on_event(&session_event(&waiting_event(main)), &push, &backoff);
-    let update = status_rx
-        .try_recv()
-        .expect("the main chain's wait on its inbox pushes the idle status");
-    assert_eq!(update.severity, Severity::Info);
-    assert_eq!(update.activity, Activity::General);
-    assert_eq!(update.label, "Ready");
-}
-
-#[test]
-fn the_main_chains_run_success_pushes_the_idle_status() {
-    let (push, mut status_rx, _guards) = wired_push();
-    let backoff = ReconnectBackoff::new();
-    let failed = Event::RunFailed {
-        section: "chat".to_owned(),
-        provenance: Provenance::new(TaskId::from(ChainId::root()), 0),
-    };
-
-    on_event(&session_event(&failed), &push, &backoff);
-    assert!(
-        status_rx.try_recv().is_err(),
-        "a failed run's failure report sets its status, so its end pushes nothing"
-    );
-
-    on_event(&session_event(&run_succeeded()), &push, &backoff);
-    let update = status_rx
-        .try_recv()
-        .expect("a run that returned waits on no inbox, so its success pushes the idle status");
-    assert_eq!(update.severity, Severity::Info);
-    assert_eq!(update.activity, Activity::General);
-    assert_eq!(update.label, "Ready");
-}
-
-/// The conversation closes its three channels together as its run ends,
-/// when the run's last reports can still be queued: the final round's
-/// pulse, the run's success, a failure report. Each still reaches the
-/// status bar, deltas first, and the reporter returns once all three have
-/// closed.
-#[tokio::test]
-async fn the_reporter_drains_every_channel_after_they_close() {
-    let (push, mut status_rx, _guards) = wired_push();
-    let (events_tx, events) = broadcast::channel::<SessionEvent>(1);
-    let (deltas_tx, deltas) = broadcast::channel::<Delta>(1);
-    let (errors_tx, errors) = broadcast::channel::<SessionFailure>(1);
-    let delta: Delta = serde_json::from_str(r#"{"kind":"text","content":"po","reply":1}"#)
-        .expect("the delta fixture parses");
-    deltas_tx
-        .send(delta)
-        .expect("the reporter's receiver is subscribed");
-    events_tx
-        .send(session_event(&run_succeeded()))
-        .expect("the reporter's receiver is subscribed");
-    errors_tx
-        .send(SessionFailure {
-            kind: FailureKind::RunFailed,
-            message: "the run could not be recorded: disk full".to_owned(),
-        })
-        .expect("the reporter's receiver is subscribed");
-    drop((events_tx, deltas_tx, errors_tx));
-
-    report(events, deltas, errors, push, ReconnectBackoff::new()).await;
-
-    let labels: Vec<String> = std::iter::from_fn(|| status_rx.try_recv().ok())
-        .map(|update| update.label)
-        .collect();
-    assert_eq!(
-        labels,
-        ["Streaming response...", "Ready", "Agent failed"],
-        "every report queued at the close reaches the status bar, deltas first"
-    );
-}
-
-#[test]
-fn each_delta_pulses_the_activity_of_its_channel() {
-    let (push, mut status_rx, _guards) = wired_push();
-    // The conversation's `Delta` is `#[non_exhaustive]`, so each
-    // fixture is deserialized rather than written as a struct literal.
-    let cases = [
-        (
-            r#"{"kind":"text","content":"po","reply":1}"#,
-            Activity::Generating,
-        ),
-        (
-            r#"{"kind":"reasoning","content":"hmm","reply":1}"#,
-            Activity::Thinking,
-        ),
-    ];
-
-    for (json, activity) in cases {
-        let delta: Delta = serde_json::from_str(json).expect("the delta fixture parses");
-        on_delta(&delta, &push);
-        let update = status_rx
-            .try_recv()
-            .expect("every delta pushes an activity pulse");
-        assert_eq!(
-            update.activity, activity,
-            "the channel picks the LED: {json}"
-        );
-        assert_eq!(
-            update.severity,
-            Severity::Debug,
-            "a pulse drives the LED and is never displayed as text"
-        );
-        assert_eq!(update.label, "Streaming response...");
-    }
-}
-
-#[test]
-fn a_lifecycle_event_pushes_nothing() {
-    let (push, mut status_rx, _guards) = wired_push();
-    let backoff = ReconnectBackoff::new();
-    let started = Event::SectionStarted {
-        section: "chat".to_owned(),
-        provenance: Provenance::new(TaskId::from(ChainId::root()), 0),
-    };
-
-    on_event(&session_event(&started), &push, &backoff);
-
-    assert!(
-        status_rx.try_recv().is_err(),
-        "the status bar has nothing to say about a section starting"
-    );
-}
diff --git a/crates/workshop/server/src/agents/status.rs b/crates/workshop/server/src/agents/status.rs
deleted file mode 100644
index 115de31e2..000000000
--- a/crates/workshop/server/src/agents/status.rs
+++ /dev/null
@@ -1,142 +0,0 @@
-//! The server's status reporter for one agent conversation: the
-//! status-bar frames and the backoff reset, derived in the server from
-//! the conversation's live events, deltas, and failure reports.
-//!
-//! One reporter task per conversation, spawned at launch. It holds only
-//! the conversation's broadcast receivers, never the conversation, and
-//! the conversation's channels close when its run ends, so the loop
-//! returns with it.
-
-use runvil::event::Event;
-use runvil::ids::{ChainId, TaskId};
-use tokio::sync::broadcast;
-use workshop_agents::{Conversation, Delta, DeltaKind, FailureKind, SessionEvent, SessionFailure};
-use workshop_protocol::Activity;
-use workshop_registry::Push;
-use workshop_support::ReconnectBackoff;
-
-/// Spawns the reporter for `conversation`, reporting through `push` and
-/// resetting `backoff` on completed replies.
-pub(super) fn spawn_reporter(conversation: &Conversation, push: Push, backoff: ReconnectBackoff) {
-    let events = conversation.subscribe_events();
-    let deltas = conversation.subscribe_deltas();
-    let errors = conversation.subscribe_errors();
-    tokio::spawn(report(events, deltas, errors, push, backoff));
-}
-
-/// Reports until all of the conversation's channels have closed. They
-/// close together as the run ends, when its last reports, its success or
-/// its failure, can still be queued, so each channel is drained to its
-/// close. Deltas are drained ahead of events, so a round's activity
-/// pulses precede the idle the main chain's next wait or its run's
-/// success pushes when both sit queued.
-async fn report(
-    mut events: broadcast::Receiver<SessionEvent>,
-    mut deltas: broadcast::Receiver<Delta>,
-    mut errors: broadcast::Receiver<SessionFailure>,
-    push: Push,
-    backoff: ReconnectBackoff,
-) {
-    let (mut deltas_open, mut events_open, mut errors_open) = (true, true, true);
-    loop {
-        tokio::select! {
-            biased;
-            received = deltas.recv(), if deltas_open => match received {
-                Ok(delta) => on_delta(&delta, &push),
-                // Pulses are ephemeral: a lost chunk's LED state is
-                // repaired by the next one or by the next wait's idle.
-                Err(broadcast::error::RecvError::Lagged(_)) => {}
-                Err(broadcast::error::RecvError::Closed) => deltas_open = false,
-            },
-            received = events.recv(), if events_open => match received {
-                Ok(event) => on_event(&event, &push, &backoff),
-                // A lagged receiver missed at most a status transition the
-                // next event restates; the transcript still holds every event.
-                Err(broadcast::error::RecvError::Lagged(_)) => {}
-                Err(broadcast::error::RecvError::Closed) => events_open = false,
-            },
-            received = errors.recv(), if errors_open => match received {
-                Ok(failure) => on_error(&failure, &push),
-                // Reports are ephemeral like the deltas; a lagged receiver
-                // missed a failure the error frame already reported.
-                Err(broadcast::error::RecvError::Lagged(_)) => {}
-                Err(broadcast::error::RecvError::Closed) => errors_open = false,
-            },
-            else => return,
-        }
-    }
-}
-
-/// The activity pulse that lights the status LED: Generating for answer
-/// content, Thinking for the reasoning side channel.
-fn on_delta(delta: &Delta, push: &Push) {
-    let activity = match delta.kind {
-        DeltaKind::Reasoning => Activity::Thinking,
-        // `Text`, or any other kind of the conversation's
-        // `#[non_exhaustive]` `DeltaKind`: the agent is producing output.
-        _ => Activity::Generating,
-    };
-    push.push_activity("Streaming response...", "an agent response chunk", activity);
-}
-
-/// The side effects the server wires to the conversation's events: the
-/// backoff reset at a completed reply (an agent reply is useful gateway
-/// work), and the idle status that releases the turn-dispatch Thinking
-/// push once the main chain waits on its inbox or its run succeeds. A
-/// reply alone leaves the status busy, since a message that lands as it
-/// does makes the loop go on. A failed run's end pushes nothing, since
-/// its failure report sets the status.
-fn on_event(event: &SessionEvent, push: &Push, backoff: &ReconnectBackoff) {
-    let Ok(event) = serde_json::from_value::<Event>(event.event.clone()) else {
-        // An event payload this build cannot read: the status bar has
-        // nothing to say about it.
-        return;
-    };
-    match event {
-        Event::AssistantReply { .. } => backoff.record_useful_work(),
-        Event::InboxWaiting { provenance, .. } | Event::RunSucceeded { provenance, .. }
-            if provenance.task == TaskId::from(ChainId::root()) =>
-        {
-            push.push_idle();
-        }
-        _ => {}
-    }
-}
-
-/// The label for a run that ended in error or was cut short: the agent
-/// itself is gone.
-const RUN_FAILED_LABEL: &str = "Agent failed";
-
-/// The operator-facing failure status for one of the conversation's
-/// failure reports. The conversation reports the kind - a failed model
-/// turn or tool call the program survived, a run that ended in error, or
-/// a run a close cut short - and the server labels it; the report's
-/// message passes through as the description, the same text the socket's
-/// error frame reports. Each kind is terminal for its turn, so this status
-/// releases the turn-dispatch Thinking push at once. A run that failed or
-/// was cut short waits on its inbox no more, so for it this status is the
-/// one frame that does; without it the status bar's sustained amber LED
-/// never returns to idle.
-fn on_error(failure: &SessionFailure, push: &Push) {
-    push.push_failure(
-        failure_label(failure.kind),
-        &failure.message,
-        Activity::General,
-    );
-}
-
-/// The status label for one failure kind: a survived turn is labelled by
-/// its boundary, so the status bar tells a still-running agent from one
-/// whose run ended. The match is exhaustive on purpose: a new kind fails
-/// this build until it is labelled here.
-fn failure_label(kind: FailureKind) -> &'static str {
-    match kind {
-        FailureKind::ModelTurnFailed => "Model turn failed",
-        FailureKind::ToolCallFailed => "Tool call failed",
-        FailureKind::RunFailed | FailureKind::Canceled => RUN_FAILED_LABEL,
-    }
-}
-
-#[cfg(test)]
-#[path = "status-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/agents/tests.rs b/crates/workshop/server/src/agents/tests.rs
deleted file mode 100644
index fb74514e8..000000000
--- a/crates/workshop/server/src/agents/tests.rs
+++ /dev/null
@@ -1,603 +0,0 @@
-//! The agent conversations' Harness setup: after the server calls the
-//! two linked Plugins, loads the std Plugin's library from its Plugin
-//! directory, and builds its Host, every run of a conversation, which
-//! has a user, holds the `web`, `subagents`, `mcp`, `std`, and `user`
-//! Packs. A prompt declaring `web` or the built-in
-//! `subagents` prepares over the server's installed Packs, a Host without
-//! the search provider installs web unavailable and refuses the prompt as
-//! it parses, naming that service, and outside a runtime the services leave
-//! the runtime out. The `mcp.json` reader returns the `mcpServers` object
-//! as it stands, or an empty one, and a prompt declaring `mcp` prepares,
-//! because the one mcp Pack reads the runtime the server provides. The
-//! servers value is the mcp Pack's configuration, so one it refuses
-//! refuses a prompt requiring `mcp` as it parses. The Host's finder
-//! refuses an unknown agent as `NotFound` and an unreadable one as `Io`,
-//! each with the launch refusal's own text. A configured Plugin directory
-//! loads each library Plugin in it and reports each file that is none,
-//! and a directory that does not exist loads nothing. A prompt reads a
-//! file of its run through the std library's `Read` tool and through the
-//! bashkit library's `Shell` tool, and a Host with no Plugin directory
-//! refuses a prompt that requires `std` or `bash`.
-
-use std::env::consts::{DLL_EXTENSION, DLL_PREFIX, DLL_SUFFIX};
-use std::path::PathBuf;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::time::Duration;
-
-use plugin_web::SEARCH_PROVIDER;
-use runvil::effect::Round;
-use runvil::harness::{InferenceBroker, MemoryRecorder, Packs, PluginSource};
-use runvil::model::{
-    Completion, CompletionOptions, Message, ModelBinding, ModelCatalog, ToolSchema,
-    make_completion_error, phrase,
-};
-use runvil::plugin::{HostServices, PackRegistry, ServiceKey, TOKIO_RUNTIME};
-use runvil::vfs::{Origin, VfsRef};
-use runvil::{BoxFuture, Error, ErrorCode, ErrorFact, Host, RunSetup};
-use serde_json::json;
-use workshop_agents::{Conversations, SessionState, TokioTimer, load_agent};
-use workshop_registry::Registry;
-
-use super::{
-    PluginListing, SHIPPED_PACKS, agent_finder, holds, host_packs, list_plugin_dir,
-    load_plugin_dir, read_mcp_servers, services, with_plugins,
-};
-
-/// The runtime's key, built from the Plugin contract's name as any Host
-/// builds it.
-const RUNTIME: ServiceKey<tokio::runtime::Handle> = ServiceKey::new(TOKIO_RUNTIME);
-
-/// A prompt that requires the Pack `pack` and returns a fixed text.
-fn requiring(pack: &str) -> String {
-    format!(
-        "---\nname: browses\ndescription: needs {pack}\nrunvil: 0\n\
-        uses:\n  - {pack}\n---\n\n\
-        # Browses\n\n## Only\n\n```lua\nreturn 'browsed'\n```\n"
-    )
-}
-
-/// Lists no model and refuses every round as `Unavailable`, so a run
-/// binds no model and nothing is fetched.
-pub(super) struct OfflineBroker;
-
-impl InferenceBroker for OfflineBroker {
-    fn models(&self) -> BoxFuture<'static, Result<ModelCatalog, Error>> {
-        Box::pin(async { Ok(ModelCatalog::empty()) })
-    }
-
-    fn chat(
-        &self,
-        _binding: ModelBinding,
-        _messages: Vec<Message>,
-        _tools: Vec<ToolSchema>,
-        _options: CompletionOptions,
-        _round: Round,
-    ) -> BoxFuture<'static, Result<Box<Completion>, Error>> {
-        let code = ErrorCode::Unavailable;
-        Box::pin(async move { Err(make_completion_error(code, phrase(code))) })
-    }
-}
-
-/// Runs the prompt `source` as one conversation over `packs` and the
-/// default in-memory filesystem; see [`run_prompt_over`].
-async fn run_prompt(packs: Packs, source: String) -> Result<Result<String, Error>, String> {
-    run_prompt_over(packs, source, VfsRef::default()).await
-}
-
-/// Runs the prompt `source` as one conversation, which has a user, on a
-/// Host over `packs` and the filesystem `vfs`, then reads the
-/// conversation's state and how it ended: the result of its one run, or
-/// the message of the run-failed report when the Host refused the prompt
-/// as it parsed it and no run began.
-pub(super) async fn run_prompt_over(
-    packs: Packs,
-    source: String,
-    vfs: VfsRef,
-) -> Result<Result<String, Error>, String> {
-    let recorder = Arc::new(MemoryRecorder::new());
-    let conversation = Conversations::new().open("browses");
-    let mut errors = conversation.subscribe_errors();
-    let host = Arc::new(Host {
-        packs,
-        prompts: Arc::new(move |_: &str| -> Result<String, Error> { Ok(source.clone()) }),
-        timer: Arc::new(TokioTimer),
-    });
-    let setup = RunSetup {
-        vfs,
-        has_user: true,
-        ..RunSetup::new(
-            conversation.recorder(recorder.clone()),
-            Arc::new(OfflineBroker),
-        )
-    };
-    tokio::time::timeout(
-        Duration::from_secs(10),
-        conversation.run(host, "browses", setup),
-    )
-    .await
-    .expect("the run ends in time");
-    assert_eq!(
-        conversation.state(),
-        SessionState::Closed,
-        "the conversation ends with its run"
-    );
-    match conversation.run_id() {
-        Some(run) => Ok(recorder.result(run).expect("the recorder ended the run")),
-        None => Err(errors
-            .try_recv()
-            .expect("a prompt refused before its run is reported")
-            .message),
-    }
-}
-
-/// An `mcp.json` file in a new directory holding `text`.
-fn mcp_file(text: &str) -> (tempfile::TempDir, std::path::PathBuf) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("mcp.json");
-    std::fs::write(&path, text).expect("write fixture");
-    (dir, path)
-}
-
-#[tokio::test]
-async fn every_run_holds_the_packs_the_three_plugins_add_and_the_builtins() {
-    let lists = "---\nname: lists\ndescription: reads its Packs\nrunvil: 0\n---\n\n\
-        # Lists\n\n## Only\n\n```lua\n\
-        local names = {}\n\
-        for _, id in ipairs({ 'web', 'subagents', 'mcp', 'std', 'user' }) do\n\
-          names[#names + 1] = tools.packs.get(id).name\n\
-        end\n\
-        return table.concat(names, ',') .. '|' .. tostring(tools.packs.get('user-input'))\n```\n";
-    let (dir, _library) = plugin_dir("every-run-holds");
-    let (host, _) = host_packs(&Registry::new(), None, Some(dir.path()));
-    assert_eq!(
-        run_prompt(host, lists.to_owned()).await,
-        Ok(Ok("web,subagents,mcp,std,user|nil".to_owned())),
-        "a run that declares nothing holds every runvil Pack the server installed, the \
-         built-ins, and the user Pack its user brings, and no user-input Pack"
-    );
-}
-
-#[tokio::test]
-async fn a_prompt_declaring_web_prepares_on_the_servers_built_packs() {
-    let (host, _) = host_packs(&Registry::new(), None, None);
-    assert_eq!(
-        run_prompt(host, requiring("web")).await,
-        Ok(Ok("browsed".to_owned())),
-        "the server adds web and provides both services its install reads"
-    );
-}
-
-#[tokio::test]
-async fn a_prompt_declaring_subagents_prepares_on_the_servers_built_packs() {
-    let (host, _) = host_packs(&Registry::new(), None, None);
-    assert_eq!(
-        run_prompt(host, requiring("subagents")).await,
-        Ok(Ok("browsed".to_owned())),
-        "the server's Host installs the built-in subagents"
-    );
-}
-
-#[tokio::test]
-async fn a_host_without_the_search_provider_refuses_a_prompt_requiring_web() {
-    let mut runtime_only = HostServices::new();
-    runtime_only
-        .provide(&RUNTIME, Arc::new(tokio::runtime::Handle::current()))
-        .expect("an empty map takes the runtime");
-    let (host, _) = with_plugins(&runtime_only, json!({}), None);
-
-    let result = run_prompt(host, requiring("web")).await;
-    let Err(message) = result else {
-        panic!("the Host refuses the prompt as it parses: {result:?}");
-    };
-    assert!(
-        message.contains(
-            "- web is unavailable: web needs runvil/search-provider, and this host provides none"
-        ),
-        "the refusal names the Pack and the missing service: {message}"
-    );
-}
-
-#[test]
-fn outside_a_runtime_the_services_leave_the_runtime_out() {
-    let services = services(&Registry::new());
-    assert!(services.provides(&SEARCH_PROVIDER.id()));
-    assert!(
-        !services.provides(&RUNTIME.id()),
-        "a synchronous caller has no runtime to provide"
-    );
-}
-
-#[test]
-fn the_finder_refuses_an_unknown_agent_as_not_found_and_an_unreadable_one_as_io() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // Discovery lists `broken`, but its bytes are not UTF-8, so its read
-    // fails.
-    std::fs::write(dir.path().join("broken.md"), [0xff, 0xfe]).expect("write fixture");
-    let finder = agent_finder(dir.path().to_path_buf());
-
-    for (name, code) in [("missing", ErrorCode::NotFound), ("broken", ErrorCode::Io)] {
-        let error = finder(name).expect_err("the finder refuses the agent");
-        let refusal = load_agent(dir.path(), name).expect_err("the launch check refuses it too");
-        assert_eq!(error.code, code, "{name}");
-        assert_eq!(error.message, refusal.to_string(), "{name}");
-        assert_eq!(error.prose, code.prose(), "{name}");
-    }
-}
-
-#[tokio::test]
-async fn a_prompt_declaring_mcp_prepares_on_the_runtime_the_server_provides() {
-    // The server's own `services` provides the runtime, and `plugin-mcp`
-    // reads it through a key of its own even with no servers, so only a
-    // run over both shows the two keys name the same service.
-    let (host, _) = host_packs(&Registry::new(), None, None);
-    assert_eq!(
-        run_prompt(host, requiring("mcp")).await,
-        Ok(Ok("browsed".to_owned())),
-        "the server adds mcp once, and its install finds the server's runtime"
-    );
-}
-
-#[tokio::test]
-async fn the_servers_value_is_the_mcp_packs_configuration() {
-    // A value that is neither null nor an object is the one configuration
-    // the install refuses, so only that value reaching it fails the run.
-    let (host, _) = with_plugins(&services(&Registry::new()), json!([]), None);
-
-    let result = run_prompt(host, requiring("mcp")).await;
-    let Err(message) = result else {
-        panic!("the Host refuses the prompt as it parses: {result:?}");
-    };
-    assert!(
-        message.contains("- mcp is unavailable: the MCP configuration must be a JSON object"),
-        "the refusal names the mcp Pack and its configuration rule: {message}"
-    );
-}
-
-/// Counts the Plugin directories this process has made, so two tests
-/// never share one.
-static PLUGIN_DIRS: AtomicUsize = AtomicUsize::new(0);
-
-/// The std Plugin's library, as Cargo names it.
-const STD_LIBRARY: &str = "plugin_std";
-
-/// The bashkit Plugin's library, as Cargo names it.
-pub(super) const BASHKIT_LIBRARY: &str = "plugin_bashkit";
-
-/// The file name of the dynamic library `library`.
-fn library_file(library: &str) -> String {
-    format!("{DLL_PREFIX}{library}{DLL_SUFFIX}")
-}
-
-/// A Plugin directory for the test named `test`, holding a copy of the
-/// dynamic library `library`, and that copy's path. Cargo builds the
-/// library beside this test executable, because the crate depends on the
-/// `workshop-plugin-*` crate that exports it. The directory's name comes
-/// from the test, the process id, and a counter.
-pub(super) fn plugin_dir_of(test: &str, library: &str) -> (tempfile::TempDir, PathBuf) {
-    let prefix = format!(
-        "{test}-{}-{}-",
-        std::process::id(),
-        PLUGIN_DIRS.fetch_add(1, Ordering::Relaxed)
-    );
-    let dir = tempfile::Builder::new()
-        .prefix(&prefix)
-        .tempdir()
-        .expect("a temporary directory is made");
-    let exe = std::env::current_exe().expect("the test executable has a path");
-    let built = exe
-        .parent()
-        .expect("the test executable has a directory")
-        .join(library_file(library));
-    let copy = dir.path().join(library_file(library));
-    std::fs::copy(built, &copy).expect("the Plugin's library is copied");
-    (dir, copy)
-}
-
-/// A Plugin directory for the test named `test`, holding a copy of the
-/// std Plugin's library, and that copy's path.
-pub(super) fn plugin_dir(test: &str) -> (tempfile::TempDir, PathBuf) {
-    plugin_dir_of(test, STD_LIBRARY)
-}
-
-#[test]
-fn a_plugin_directory_loads_the_std_plugin_from_its_library() {
-    let (dir, library) = plugin_dir("loads-std");
-    let mut packs = PackRegistry::new();
-    let report = load_plugin_dir(&mut packs, dir.path()).expect("the directory is read");
-
-    assert!(report.failures().is_empty(), "{:?}", report.failures());
-    let [plugin] = report.plugins() else {
-        panic!("one library loads one Plugin: {:?}", report.plugins());
-    };
-    assert_eq!(plugin.name(), "std");
-    assert_eq!(plugin.version(), "0.1.0");
-    assert_eq!(
-        plugin.source(),
-        &PluginSource::Library(std::path::absolute(&library).expect("the path is made absolute"))
-    );
-}
-
-#[test]
-fn a_file_that_is_no_library_is_reported_and_the_std_plugin_still_loads() {
-    let (dir, _library) = plugin_dir("reports-a-bad-file");
-    let bad = dir.path().join(format!("a-text-file.{DLL_EXTENSION}"));
-    std::fs::write(&bad, "not a library").expect("write fixture");
-    let mut packs = PackRegistry::new();
-    let report = load_plugin_dir(&mut packs, dir.path()).expect("the directory is read");
-
-    assert_eq!(report.plugins().len(), 1, "{:?}", report.plugins());
-    let [failure] = report.failures() else {
-        panic!("the text file is the one failure: {:?}", report.failures());
-    };
-    assert_eq!(failure.code, ErrorCode::PluginLoadFailed);
-    assert_eq!(failure.facts.get(&ErrorFact::Reason), Some(&json!("open")));
-    let expected = std::path::absolute(&bad).expect("the path is made absolute");
-    assert_eq!(
-        failure.facts.get(&ErrorFact::Path),
-        Some(&json!(expected.display().to_string()))
-    );
-}
-
-#[test]
-fn a_listing_names_each_plugin_that_loads_and_each_library_that_does_not() {
-    let (dir, _library) = plugin_dir("lists-std");
-    assert_eq!(
-        list_plugin_dir(dir.path()).expect("the directory is read"),
-        PluginListing {
-            loaded: vec!["std 0.1.0".to_owned()],
-            failed: Vec::new(),
-        }
-    );
-
-    let bad = dir.path().join(format!("a-text-file.{DLL_EXTENSION}"));
-    std::fs::write(&bad, "not a library").expect("write fixture");
-    let listing = list_plugin_dir(dir.path()).expect("the directory is read");
-    assert_eq!(listing.loaded, ["std 0.1.0"]);
-    let [failed] = listing.failed.as_slice() else {
-        panic!("the text file is the one failure: {:?}", listing.failed);
-    };
-    let path = std::path::absolute(&bad).expect("the path is made absolute");
-    assert!(
-        failed.starts_with(&format!("{}: ", path.display())),
-        "the line opens with the library's path: {failed}"
-    );
-
-    let missing = list_plugin_dir(&dir.path().join("absent")).expect_err("no such directory");
-    assert_eq!(missing.kind(), std::io::ErrorKind::NotFound);
-}
-
-#[test]
-fn a_plugin_directory_that_does_not_exist_loads_nothing() {
-    let (dir, _library) = plugin_dir("missing-directory");
-    let mut packs = PackRegistry::new();
-    assert!(
-        load_plugin_dir(&mut packs, &dir.path().join("absent")).is_none(),
-        "a missing directory is a state, not a failure"
-    );
-}
-
-#[tokio::test]
-async fn the_servers_host_loads_its_plugin_directory_beside_the_linked_plugins() {
-    let (dir, _library) = plugin_dir("server-host");
-    let (host, report) = host_packs(&Registry::new(), None, Some(dir.path()));
-
-    let report = report.expect("the configured directory is read");
-    let names: Vec<&str> = report
-        .plugins()
-        .iter()
-        .map(|plugin| plugin.name())
-        .collect();
-    assert_eq!(names, ["std"]);
-    assert_eq!(
-        run_prompt(host, requiring("std")).await,
-        Ok(Ok("browsed".to_owned())),
-        "the library's Pack is installed, so a prompt that requires std runs"
-    );
-}
-
-#[test]
-fn only_a_plugin_directory_with_a_shipped_library_gives_the_host_its_pack() {
-    for (library, pack) in [
-        (STD_LIBRARY, "runvil/std"),
-        (BASHKIT_LIBRARY, "runvil/bash"),
-    ] {
-        assert!(SHIPPED_PACKS.contains(&pack), "{pack}");
-        let (dir, _library) = plugin_dir_of("holds-a-shipped-pack", library);
-        let mut packs = PackRegistry::new();
-        load_plugin_dir(&mut packs, dir.path()).expect("the directory is read");
-        assert!(holds(&packs, pack), "{library} inserts {pack}");
-        assert!(
-            !holds(&PackRegistry::new(), pack),
-            "{pack} is not among the built-ins"
-        );
-    }
-}
-
-/// A prompt that declares `std` and returns what `std/read` answers for
-/// `/notes.md`, then what `std/write` answers.
-const READS_NOTES: &str = "---\nname: reads\ndescription: reads a file\nrunvil: 0\n\
-    uses:\n  - std\n---\n\n# Reads\n\n## Only\n\n```lua\n\
-    local read = tools.call('std/read', { path = '/notes.md' })\n\
-    local write = tools.call('std/write', { path = '/out.md', contents = 'x' })\n\
-    return read .. '|' .. write\n```\n";
-
-#[tokio::test]
-async fn a_prompt_reads_a_file_of_its_run_through_the_std_library_plugin() {
-    let (dir, _library) = plugin_dir("reads-notes");
-    let (host, report) = host_packs(&Registry::new(), None, Some(dir.path()));
-    let report = report.expect("the configured directory is read");
-    assert!(report.failures().is_empty(), "{:?}", report.failures());
-
-    let vfs = VfsRef::default();
-    vfs.acquire(Origin::new("seed"))
-        .expect("a fresh memory filesystem acquires")
-        .write("/notes.md", b"hello\nworld\n")
-        .expect("the file is seeded");
-
-    let result = run_prompt_over(host, READS_NOTES.to_owned(), vfs).await;
-    let Ok(Ok(text)) = result else {
-        panic!("the run ends with its text: {result:?}");
-    };
-    // Each numbered line holds a `|`, and the stub's text holds none.
-    let (read, write) = text.rsplit_once('|').expect("the prompt joins two answers");
-    assert!(
-        read.contains("     1|hello\n     2|world\n"),
-        "Read answers the file's numbered lines: {read}"
-    );
-    assert!(
-        read.contains("<untrusted_input_"),
-        "file text reaches the script marked as untrusted: {read}"
-    );
-    assert_eq!(
-        write,
-        "The Write tool is not implemented in this build. The implementation is missing and \
-         nothing in this session will change that. Calling Write again is safe, but it will \
-         return this same result every time, whatever the arguments. Carry on without it.",
-        "Write is still a stub, and its text is trusted, so it comes back as it is"
-    );
-}
-
-#[tokio::test]
-async fn without_a_plugin_directory_a_prompt_requiring_a_shipped_pack_is_refused() {
-    for pack in ["std", "bash"] {
-        let (host, report) = host_packs(&Registry::new(), None, None);
-        assert!(report.is_none(), "no directory is read");
-
-        let result = run_prompt(host, requiring(pack)).await;
-        let Err(message) = result else {
-            panic!("the Host refuses the prompt as it parses: {result:?}");
-        };
-        assert!(
-            message.contains(&format!(
-                "- {pack} is unavailable: runvil/{pack} is not installed"
-            )),
-            "the refusal names the Pack no Plugin inserted: {message}"
-        );
-    }
-}
-
-/// A prompt that declares `bash` and returns what `bash/shell` answers
-/// for a command that reads `/notes.md` and then writes a file.
-const RUNS_A_COMMAND: &str = "---\nname: shells\ndescription: runs a command\nrunvil: 0\n\
-    uses:\n  - bash\n---\n\n# Shells\n\n## Only\n\n```lua\n\
-    return tools.call('bash/shell', { command = 'cat /notes.md; echo x > /out.md' })\n```\n";
-
-#[tokio::test]
-async fn a_prompt_runs_a_command_over_its_runs_files_through_the_bashkit_library_plugin() {
-    let (dir, _library) = plugin_dir_of("runs-a-command", BASHKIT_LIBRARY);
-    let (host, report) = host_packs(&Registry::new(), None, Some(dir.path()));
-    let report = report.expect("the configured directory is read");
-    assert!(report.failures().is_empty(), "{:?}", report.failures());
-    let names: Vec<&str> = report
-        .plugins()
-        .iter()
-        .map(|plugin| plugin.name())
-        .collect();
-    assert_eq!(names, ["bashkit"]);
-
-    let vfs = VfsRef::default();
-    vfs.acquire(Origin::new("seed"))
-        .expect("a fresh memory filesystem acquires")
-        .write("/notes.md", b"hello\nworld\n")
-        .expect("the file is seeded");
-
-    let result = run_prompt_over(host, RUNS_A_COMMAND.to_owned(), vfs.clone()).await;
-    let Ok(Ok(text)) = result else {
-        panic!("the run ends with its text: {result:?}");
-    };
-    assert!(
-        text.contains("<untrusted_input_"),
-        "a command's output reaches the script marked as untrusted: {text}"
-    );
-    assert!(
-        text.contains("Exit code: 1\n") && text.contains("```\nhello\nworld\n"),
-        "the shell reads the file through the run's filesystem, and the write fails the \
-         command: {text}"
-    );
-    assert!(
-        text.contains("/out.md: the shell cannot change files in this build"),
-        "the shell says why the write failed: {text}"
-    );
-    let written = vfs
-        .acquire(Origin::new("check"))
-        .expect("the filesystem acquires")
-        .exists("/out.md")
-        .expect("the filesystem answers");
-    assert!(!written, "the shell changes no file of the run");
-}
-
-#[test]
-fn no_setting_reads_no_file_and_gives_no_servers() {
-    assert_eq!(read_mcp_servers(None), json!({}));
-}
-
-#[test]
-fn a_missing_mcp_file_gives_no_servers() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    assert_eq!(
-        read_mcp_servers(Some(&dir.path().join("absent.json"))),
-        json!({})
-    );
-}
-
-#[test]
-fn an_unreadable_mcp_file_gives_no_servers() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // A directory in the file's place fails the read for a reason other
-    // than a missing file.
-    let path = dir.path().join("mcp.json");
-    std::fs::create_dir(&path).expect("directory in the file's place");
-    assert_eq!(read_mcp_servers(Some(&path)), json!({}));
-}
-
-#[test]
-fn a_malformed_mcp_file_gives_no_servers() {
-    for text in ["{ \"mcpServers\": ", "[]", "{ \"mcpServers\": [] }"] {
-        let (_dir, path) = mcp_file(text);
-        assert_eq!(
-            read_mcp_servers(Some(&path)),
-            json!({}),
-            "`{text}` is not an object with an mcpServers object"
-        );
-    }
-}
-
-#[test]
-fn a_file_without_mcp_servers_gives_no_servers() {
-    let (_dir, path) = mcp_file(r#"{ "inputs": [] }"#);
-    assert_eq!(read_mcp_servers(Some(&path)), json!({}));
-}
-
-#[test]
-fn an_entry_that_is_not_an_object_is_handed_on_for_the_pack_to_refuse() {
-    let (_dir, path) = mcp_file(r#"{ "mcpServers": { "a": 1, "b": { "url": "x" } } }"#);
-    assert_eq!(
-        read_mcp_servers(Some(&path)),
-        json!({ "a": 1, "b": { "url": "x" } }),
-        "one bad entry does not drop the file's other servers"
-    );
-}
-
-#[test]
-fn a_valid_mcp_file_reads_back_its_servers_object_and_ignores_other_keys() {
-    let (_dir, path) = mcp_file(
-        r#"{
-            "inputs": [{ "id": "token" }],
-            "mcpServers": {
-                "wg21": { "url": "https://example.test/mcp" },
-                "GitHub": { "command": "x", "args": ["a"] },
-                "docs": { "url": "https://example.test/docs" }
-            }
-        }"#,
-    );
-    assert_eq!(
-        read_mcp_servers(Some(&path)),
-        json!({
-            "wg21": { "url": "https://example.test/mcp" },
-            "GitHub": { "command": "x", "args": ["a"] },
-            "docs": { "url": "https://example.test/docs" }
-        }),
-        "the servers object is handed on verbatim, names and entries alike"
-    );
-}
diff --git a/crates/workshop/server/src/agents/wire-tests.rs b/crates/workshop/server/src/agents/wire-tests.rs
deleted file mode 100644
index 69327469e..000000000
--- a/crates/workshop/server/src/agents/wire-tests.rs
+++ /dev/null
@@ -1,501 +0,0 @@
-//! Wire-shape pins for the agent-session frames: each outbound frame
-//! against its exact JSON, the inbound requests against their variants
-//! and refusals, and both directions against the shared fixture the SPA
-//! suite (`crates/workshop/ui/test/agent-wire-fixtures.mjs`) asserts, so a
-//! wire drift on either side fails that side's fixture test. Only the main
-//! chain's inbox events and its run's end frame: the operator's message as
-//! `user_message`, the wait for it as `awaiting_input`, and the end as
-//! `run_ended`.
-
-use std::path::Path;
-
-use runvil::ToolId;
-use runvil::event::{Event, ReplyOrigin};
-use runvil::ids::{ChainId, Provenance, RoundId, TaskId};
-use runvil::metrics::{CallMetrics, ClientTiming, LlamaTimings, ToolCallEvent, Usage, VllmMetrics};
-use workshop_protocol::InputResponse;
-
-use super::*;
-
-/// Parses the shared fixture into one object keyed by case name.
-fn agent_fixture() -> serde_json::Value {
-    let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/agent-frames.json");
-    let text = std::fs::read_to_string(&path)
-        .unwrap_or_else(|error| panic!("the fixture {} is readable: {error}", path.display()));
-    serde_json::from_str(&text).unwrap_or_else(|error| panic!("the fixture is valid JSON: {error}"))
-}
-
-/// The root task's zeroth sequence: the provenance every test event
-/// holds, since the wire does not expose it.
-fn provenance() -> Provenance {
-    Provenance::new(TaskId::from(ChainId::root()), 0)
-}
-
-/// The provenance of the first task the main chain spawned.
-fn task_provenance() -> Provenance {
-    Provenance::new(TaskId::from(ChainId::root().child(0)), 0)
-}
-
-/// The operator's message in the `chat` section, as it entered the main
-/// chain's inbox: the fixture's `agent_event_minimal` entry as the Engine
-/// event it projects from.
-fn operator_message(text: &str) -> Event {
-    Event::InboxMessage {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        text: text.to_owned(),
-    }
-}
-
-/// The main chain parked on its empty inbox in the `chat` section: the
-/// fixture's `agent_event_awaiting` entry as the Engine event it projects
-/// from.
-fn awaiting() -> Event {
-    Event::InboxWaiting {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-    }
-}
-
-/// The run's end in the `chat` section, reported under the main chain:
-/// the fixture's `agent_event_run_ended` entry as the Engine event it
-/// projects from.
-fn run_succeeded() -> Event {
-    Event::RunSucceeded {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-    }
-}
-
-/// The fixture's `agent_event_stamped` entry as the Engine event it
-/// projects from, every metrics section populated.
-fn stamped_fixture_event() -> Event {
-    Event::AssistantReply {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        turn: 2,
-        round: RoundId::new(1),
-        text: "hello".to_owned(),
-        finish_reason: Some("stop".to_owned()),
-        model: "llama-3".to_owned(),
-        origin: ReplyOrigin::Chat,
-        metrics: Some(
-            CallMetrics::new()
-                .with_usage(Some(
-                    Usage::new(7, 3, 10)
-                        .with_cached_tokens(Some(2))
-                        .with_reasoning_tokens(Some(1)),
-                ))
-                .with_llama(Some(
-                    LlamaTimings::new(7, 12.5, 560.0, 3, 30.5, 98.5)
-                        .with_draft_n(4)
-                        .with_draft_n_accepted(2),
-                ))
-                .with_vllm(Some(
-                    VllmMetrics::new()
-                        .with_time_to_first_token_ms(Some(8.5))
-                        .with_generation_time_ms(Some(22.5))
-                        .with_queue_time_ms(Some(1.5))
-                        .with_mean_itl_ms(Some(7.5))
-                        .with_tokens_per_second(Some(133.5)),
-                ))
-                .with_client(Some(
-                    ClientTiming::new(41.5)
-                        .with_ttft_ms(Some(9.5))
-                        .with_mean_itl_ms(Some(8.25)),
-                )),
-        ),
-    }
-}
-
-/// Serializes one frame to its JSON value.
-fn wire(frame: &impl Serialize) -> serde_json::Value {
-    serde_json::to_value(frame).expect("the frame serializes")
-}
-
-#[test]
-fn an_agents_frame_serializes_the_discovered_names() {
-    assert_eq!(
-        wire(&AgentsFrame::new(vec![
-            "chat".to_owned(),
-            "research".to_owned()
-        ])),
-        serde_json::json!({"type": "agents", "agents": ["chat", "research"]}),
-        "the wire shape matches the workshop protocol's frame taxonomy"
-    );
-}
-
-#[test]
-fn an_agent_session_frame_serializes_its_id_and_agent() {
-    assert_eq!(
-        wire(&AgentSessionFrame::new(
-            "a1b2".to_owned(),
-            "chat".to_owned()
-        )),
-        serde_json::json!({"type": "agent_session", "session": "a1b2", "agent": "chat"}),
-    );
-}
-
-#[test]
-fn an_agent_event_frame_has_its_log_index_and_optional_reply_id() {
-    let event = operator_message("hi");
-    let plain = wire(&AgentEventFrame::new(3, None, &event).expect("an operator message frames"));
-    assert_eq!(plain["type"], "agent_event");
-    assert_eq!(plain["index"], 3, "the frame reports the entry's log index");
-    assert!(
-        plain.get("reply").is_none(),
-        "an absent reply id is omitted from the wire, not serialized as null"
-    );
-    assert_eq!(
-        plain["event"],
-        serde_json::json!({
-            "kind": "user_message", "section": "chat", "turn": 0, "content": "hi",
-        }),
-        "the entry serializes in its ACP-labelled wire shape"
-    );
-    let stamped =
-        wire(&AgentEventFrame::new(4, Some(1), &event).expect("an operator message frames"));
-    assert_eq!(
-        stamped["reply"], 1,
-        "a superseding event is stamped with the same reply id as its deltas"
-    );
-}
-
-#[test]
-fn the_main_chains_inbox_events_frame_as_the_operators_message_and_the_wait_for_it() {
-    let message = wire(
-        &AgentEventFrame::new(1, None, &operator_message("two words"))
-            .expect("the main chain's message frames"),
-    );
-    assert_eq!(
-        message["event"],
-        serde_json::json!({
-            "kind": "user_message", "section": "chat", "turn": 0, "content": "two words",
-        }),
-        "a message in the main chain's inbox is the operator's, framed on turn 0"
-    );
-    let waiting =
-        wire(&AgentEventFrame::new(0, None, &awaiting()).expect("the main chain's wait frames"));
-    assert_eq!(
-        waiting["event"],
-        serde_json::json!({
-            "kind": "awaiting_input", "section": "chat", "turn": 0, "content": "",
-        }),
-        "the main chain parking on its empty inbox is the wait for the operator"
-    );
-}
-
-#[test]
-fn the_main_chains_run_end_frames_as_run_ended_with_empty_content() {
-    let failed = Event::RunFailed {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-    };
-    for event in [run_succeeded(), failed] {
-        let frame = wire(&AgentEventFrame::new(5, None, &event).expect("the run's end frames"));
-        assert_eq!(
-            frame["event"],
-            serde_json::json!({
-                "kind": "run_ended", "section": "chat", "turn": 0, "content": "",
-            }),
-            "a run that returned or failed takes no more messages: {event:?}"
-        );
-    }
-    let foreign = Event::RunSucceeded {
-        section: "Worker".to_owned(),
-        provenance: task_provenance(),
-    };
-    assert!(
-        AgentEventFrame::new(0, None, &foreign).is_none(),
-        "only the main chain reports the run's end, as only its inbox frames"
-    );
-}
-
-#[test]
-fn a_tasks_inbox_events_have_no_wire_shape() {
-    let message = Event::InboxMessage {
-        section: "Worker".to_owned(),
-        provenance: task_provenance(),
-        text: "also cover the tests".to_owned(),
-    };
-    let waiting = Event::InboxWaiting {
-        section: "Worker".to_owned(),
-        provenance: task_provenance(),
-    };
-    for event in [message, waiting] {
-        assert!(
-            AgentEventFrame::new(0, None, &event).is_none(),
-            "a task's inbox is its owner's business, never the operator's: {event:?}"
-        );
-    }
-}
-
-#[test]
-fn an_agent_event_frame_renders_tool_call_batches_and_skips_lifecycle_events() {
-    let batch = Event::AssistantToolCalls {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        turn: 1,
-        round: RoundId::new(0),
-        model: "llama-3".to_owned(),
-        calls: vec![ToolCallEvent::new(
-            "call_1",
-            "read_file",
-            serde_json::json!({ "path": "notes.txt" }),
-        )],
-    };
-    let frame = wire(&AgentEventFrame::new(0, Some(0), &batch).expect("a tool-call batch frames"));
-    assert_eq!(frame["event"]["kind"], "tool_call");
-    assert_eq!(
-        frame["event"]["content"],
-        r#"[{"id":"call_1","name":"read_file","arguments":{"path":"notes.txt"}}]"#,
-        "a batch renders as the JSON array of its calls in one string field"
-    );
-    assert_eq!(frame["event"]["model"], "llama-3");
-
-    let lifecycle = Event::SectionStarted {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-    };
-    assert!(
-        AgentEventFrame::new(1, None, &lifecycle).is_none(),
-        "a lifecycle event has no wire label and never frames"
-    );
-}
-
-#[test]
-fn an_agent_event_frame_keeps_the_model_on_thinking_and_the_call_id_on_tool_results() {
-    let thinking = Event::Thinking {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        turn: 2,
-        round: RoundId::new(1),
-        model: "llama-3".to_owned(),
-        text: "weighing the options".to_owned(),
-    };
-    let thought =
-        wire(&AgentEventFrame::new(5, Some(2), &thinking).expect("a thinking event frames"));
-    assert_eq!(
-        thought["event"],
-        serde_json::json!({
-            "kind": "agent_thought", "section": "chat", "turn": 2,
-            "content": "weighing the options", "model": "llama-3",
-        }),
-        "a thinking block keeps its model and omits the tool-call id"
-    );
-
-    let result = tool_result("call_7", "read_file", "files/read", None, "the file's text");
-    let update = wire(&AgentEventFrame::new(6, None, &result).expect("a tool-result event frames"));
-    assert_eq!(
-        update["event"],
-        serde_json::json!({
-            "kind": "tool_call_update", "section": "chat", "turn": 2,
-            "content": "the file's text", "tool_call_id": "call_7",
-        }),
-        "a tool result keeps the id it answers and its content, and omits the model"
-    );
-}
-
-#[test]
-fn a_scripts_tool_result_stays_a_tool_call_update() {
-    let result = tool_result("", "fetch", "web/fetch", Some("runvil"), "the page");
-    let frame = wire(&AgentEventFrame::new(7, None, &result).expect("a tool-result event frames"));
-    assert_eq!(
-        frame["event"]["kind"], "tool_call_update",
-        "only a message in the main chain's inbox is the operator's message"
-    );
-}
-
-/// An untrusted tool result in the `chat` section on turn 2, answering
-/// `tool_call_id` (empty for a script's call) under `alias`, bound to the
-/// tool `tool` of a Pack from `vendor`.
-fn tool_result(
-    tool_call_id: &str,
-    alias: &str,
-    tool: &str,
-    vendor: Option<&str>,
-    content: &str,
-) -> Event {
-    Event::ToolResult {
-        section: "chat".to_owned(),
-        provenance: provenance(),
-        turn: 2,
-        tool_call_id: tool_call_id.to_owned(),
-        alias: alias.to_owned(),
-        tool: ToolId::parse(tool).expect("a valid tool id"),
-        vendor: vendor.map(str::to_owned),
-        content: content.to_owned(),
-        trusted: false,
-    }
-}
-
-#[test]
-fn an_agent_delta_frame_is_stamped_with_its_superseding_reply_id() {
-    assert_eq!(
-        wire(&AgentDeltaFrame::new(
-            AgentDeltaKind::Text,
-            "po".to_owned(),
-            2
-        )),
-        serde_json::json!({"type": "agent_delta", "kind": "text", "content": "po", "reply": 2}),
-    );
-    assert_eq!(
-        wire(&AgentDeltaFrame::new(
-            AgentDeltaKind::Reasoning,
-            "hmm".to_owned(),
-            2
-        )),
-        serde_json::json!({
-            "type": "agent_delta", "kind": "reasoning", "content": "hmm", "reply": 2,
-        }),
-    );
-}
-
-#[test]
-fn each_request_frame_parses_into_its_variant() {
-    let cases = [
-        (
-            serde_json::json!({"type": "launch", "agent": "chat"}),
-            SessionRequest::Launch {
-                agent: "chat".to_owned(),
-            },
-        ),
-        (
-            serde_json::json!({"type": "attach", "session": "a1b2"}),
-            SessionRequest::Attach {
-                session: "a1b2".to_owned(),
-            },
-        ),
-        (
-            serde_json::json!({"type": "cancel"}),
-            SessionRequest::Cancel,
-        ),
-        (
-            serde_json::json!({"type": "cancel", "id": 4}),
-            SessionRequest::Cancel,
-        ),
-    ];
-    for (frame, expected) in cases {
-        assert_eq!(SessionRequest::parse(&frame), Ok(expected), "{frame}");
-    }
-}
-
-#[test]
-fn malformed_request_frames_are_refused_with_the_socket_messages() {
-    let unknown = "unknown frame type; expected \"launch\", \"attach\", \"input_response\", \
-                   or \"cancel\"";
-    let cases = [
-        (
-            serde_json::json!({"type": "launch"}),
-            "launch frame without an agent name",
-        ),
-        (
-            serde_json::json!({"type": "launch", "agent": 7}),
-            "launch frame without an agent name",
-        ),
-        (
-            serde_json::json!({"type": "attach"}),
-            "attach frame without a session id",
-        ),
-        (
-            serde_json::json!({"type": "attach", "session": null}),
-            "attach frame without a session id",
-        ),
-        (serde_json::json!({"type": "mystery"}), unknown),
-        (serde_json::json!({"agent": "chat"}), unknown),
-        (serde_json::json!({"type": 7}), unknown),
-        (serde_json::json!(["cancel"]), unknown),
-        (serde_json::json!("cancel"), unknown),
-    ];
-    for (frame, message) in cases {
-        let refusal = SessionRequest::parse(&frame).expect_err("the frame is refused");
-        assert_eq!(refusal.to_string(), message, "{frame}");
-    }
-}
-
-#[test]
-fn the_shared_fixture_pins_exactly_the_agreed_case_list() {
-    let fixture = agent_fixture();
-    let mut cases: Vec<&str> = fixture
-        .as_object()
-        .expect("the fixture is one object keyed by case name")
-        .keys()
-        .map(String::as_str)
-        .collect();
-    cases.sort_unstable();
-    assert_eq!(
-        cases,
-        [
-            "agent_delta_reasoning",
-            "agent_delta_text",
-            "agent_event_awaiting",
-            "agent_event_minimal",
-            "agent_event_run_ended",
-            "agent_event_stamped",
-            "agent_session",
-            "agents",
-            "attach",
-            "cancel",
-            "input_response",
-            "launch",
-        ],
-        "both suites pin exactly the same case list, so a case added on \
-         one side fails the other"
-    );
-}
-
-#[test]
-fn server_to_client_agent_frames_match_the_shared_fixture() {
-    // Each typed frame serializes to its fixture entry, compared as
-    // values so key order in the file is free.
-    let fixture = agent_fixture();
-    let agents = AgentsFrame::new(vec!["chat".to_owned(), "research".to_owned()]);
-    assert_eq!(wire(&agents), fixture["agents"]);
-    let session = AgentSessionFrame::new("a1b2".to_owned(), "chat".to_owned());
-    assert_eq!(wire(&session), fixture["agent_session"]);
-    assert_eq!(
-        wire(&AgentEventFrame::new(3, None, &operator_message("hi"))),
-        fixture["agent_event_minimal"]
-    );
-    assert_eq!(
-        wire(&AgentEventFrame::new(2, None, &awaiting())),
-        fixture["agent_event_awaiting"]
-    );
-    assert_eq!(
-        wire(&AgentEventFrame::new(5, None, &run_succeeded())),
-        fixture["agent_event_run_ended"]
-    );
-    assert_eq!(
-        wire(&AgentEventFrame::new(4, Some(1), &stamped_fixture_event())),
-        fixture["agent_event_stamped"],
-        "the event serializes in its wire shape, metrics and all"
-    );
-    let text = AgentDeltaFrame::new(AgentDeltaKind::Text, "po".to_owned(), 2);
-    assert_eq!(wire(&text), fixture["agent_delta_text"]);
-    let reasoning = AgentDeltaFrame::new(AgentDeltaKind::Reasoning, "hmm".to_owned(), 2);
-    assert_eq!(wire(&reasoning), fixture["agent_delta_reasoning"]);
-}
-
-#[test]
-fn client_to_server_agent_frames_match_the_shared_fixture() {
-    let fixture = agent_fixture();
-    let response: InputResponse = serde_json::from_value(fixture["input_response"].clone())
-        .expect("the fixture input_response parses");
-    assert_eq!(response.text, "two words");
-    assert_eq!(
-        SessionRequest::parse(&fixture["launch"]),
-        Ok(SessionRequest::Launch {
-            agent: "chat".to_owned()
-        })
-    );
-    assert_eq!(
-        SessionRequest::parse(&fixture["attach"]),
-        Ok(SessionRequest::Attach {
-            session: "a1b2".to_owned()
-        })
-    );
-    assert_eq!(
-        SessionRequest::parse(&fixture["cancel"]),
-        Ok(SessionRequest::Cancel)
-    );
-}
diff --git a/crates/workshop/server/src/agents/wire.rs b/crates/workshop/server/src/agents/wire.rs
deleted file mode 100644
index eac7765ad..000000000
--- a/crates/workshop/server/src/agents/wire.rs
+++ /dev/null
@@ -1,416 +0,0 @@
-//! Agent-session frames: the `/agents/ws` socket's frame family, typed
-//! beside the socket that is their only producer.
-//!
-//! On connect the server pushes [`AgentsFrame`], the discovered agent
-//! list. The client opens a session with `{"type":"launch","agent":"..."}`
-//! or reattaches with `{"type":"attach","session":"..."}`; either is
-//! answered with [`AgentSessionFrame`] naming the session id. A running
-//! session streams [`AgentEventFrame`]s - the durable event log, each
-//! frame holding its log index, replayed from the top on attach - and
-//! [`AgentDeltaFrame`]s, the ephemeral live chunks, each stamped with the
-//! `reply` id of its round. The event log says when the agent waits on
-//! its empty inbox for the operator
-//! (`awaiting_input`), holds each message the operator sent
-//! (`user_message`), and closes with `run_ended` once the run ends, after
-//! which the run takes no more messages. `{"type":"cancel"}` fires the
-//! session's turn-cancel: cancellation is a stop reason, never an error -
-//! no error frame follows, and the agent's chat loop returns to its
-//! inbox, where it goes on with a message already queued and otherwise
-//! waits.
-//! Frames already in flight from the canceled round may still arrive
-//! after the cancel: a defined grace window, never a protocol violation.
-//! The canceled round never settles, so the SPA drops its pending chunks
-//! once a later round settles. The three client requests parse as
-//! [`SessionRequest`]; the operator's message, `input_response`, stays in
-//! `workshop-protocol`.
-//!
-//! A session-level failure is pushed as an id-less
-//! [`ErrorFrame`](workshop_protocol::ErrorFrame): a model round that
-//! failed while the program survived it (the built-in chat `pcall`s
-//! `models.loop` and returns to waiting), or a run that ended in error.
-//! Delivery on this socket: ephemeral - the reports are sent on a bounded
-//! broadcast beside the deltas and may drop under lag; the durable
-//! transcript already shows the failed turn as one without a reply, and
-//! terminal failures also land on the status bus.
-//!
-//! The TypeScript half of this contract is
-//! `crates/workshop/ui/src/services/protocol.ts`; the two files
-//! cross-cite each other so a shape change touches both or neither.
-//! Every shape is pinned by this module's tests and by the shared fixture
-//! `tests/fixtures/agent-frames.json`, asserted as the same JSON by the
-//! SPA suite's `crates/workshop/ui/test/agent-wire-fixtures.mjs`, so drift
-//! on either side fails that side's tests.
-
-use runvil::event::Event;
-use runvil::ids::{ChainId, TaskId};
-use runvil::metrics::{CallMetrics, ToolCallEvent};
-use serde::{Deserialize, Serialize};
-
-/// A session request the client sends: `launch`, `attach`, or `cancel`.
-/// Fields beyond the ones a variant names are ignored.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case")]
-pub(super) enum SessionRequest {
-    /// `{"type":"launch","agent":"..."}` starts a session running `agent`.
-    Launch {
-        /// The discovered agent to run.
-        agent: String,
-    },
-    /// `{"type":"attach","session":"..."}` reattaches to a running
-    /// session.
-    Attach {
-        /// The id an earlier [`AgentSessionFrame`] named.
-        session: String,
-    },
-    /// `{"type":"cancel"}` fires the attached session's turn-cancel.
-    Cancel,
-}
-
-/// Why an inbound frame is not a [`SessionRequest`]. Each variant renders
-/// as the socket's refusal text, so serde's own error text never reaches
-/// the client.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
-pub(super) enum RequestRefusal {
-    /// A `launch` frame whose `agent` is absent or not a string.
-    #[error("launch frame without an agent name")]
-    LaunchWithoutAgent,
-    /// An `attach` frame whose `session` is absent or not a string.
-    #[error("attach frame without a session id")]
-    AttachWithoutSession,
-    /// A frame whose `type` names no request. The socket routes
-    /// `input_response` before parsing, so the text lists it too.
-    #[error(
-        "unknown frame type; expected \"launch\", \"attach\", \"input_response\", \
-         or \"cancel\""
-    )]
-    UnknownType,
-}
-
-impl SessionRequest {
-    /// Parses one inbound frame. Only a JSON object carries a `type`, so
-    /// anything else is an unknown type.
-    ///
-    /// # Errors
-    /// Returns the [`RequestRefusal`] naming what the frame lacks.
-    pub(super) fn parse(frame: &serde_json::Value) -> Result<Self, RequestRefusal> {
-        let refusal = match frame.get("type").and_then(serde_json::Value::as_str) {
-            Some("launch") => RequestRefusal::LaunchWithoutAgent,
-            Some("attach") => RequestRefusal::AttachWithoutSession,
-            Some("cancel") => RequestRefusal::UnknownType,
-            _ => return Err(RequestRefusal::UnknownType),
-        };
-        Self::deserialize(frame).map_err(|_| refusal)
-    }
-}
-
-/// The agent list pushed when an `/agents/ws` socket connects:
-/// `{"type":"agents","agents":["chat","research"]}`.
-///
-/// Delivery: ephemeral - every push is the complete discovered list,
-/// resent on every connect; there is no incremental form to lose.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub(super) struct AgentsFrame {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    /// The launchable agent names, in discovery order.
-    agents: Vec<String>,
-}
-
-impl AgentsFrame {
-    /// Builds the list frame over the discovered agent names.
-    #[must_use]
-    pub(super) fn new(agents: Vec<String>) -> Self {
-        Self {
-            kind: "agents",
-            agents,
-        }
-    }
-}
-
-/// The direct reply to a `launch` or `attach` frame:
-/// `{"type":"agent_session","session":"...","agent":"..."}`. The client
-/// keeps the session id to reattach after a disconnect - sessions
-/// outlive sockets.
-///
-/// Delivery: durable - a direct per-request reply sent by the loop that
-/// owns the socket, the contract's no-cursor case.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub(super) struct AgentSessionFrame {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    /// The session's unguessable id.
-    session: String,
-    /// The launched agent's name.
-    agent: String,
-}
-
-impl AgentSessionFrame {
-    /// Builds the acknowledgment for `session` running `agent`.
-    #[must_use]
-    pub(super) fn new(session: String, agent: String) -> Self {
-        Self {
-            kind: "agent_session",
-            session,
-            agent,
-        }
-    }
-}
-
-/// The kind of one agent event, named as the Agent Client Protocol's
-/// `sessionUpdate` kinds are, so the SPA's transcript stays
-/// ACP-conversant:
-///
-/// | Variant | Label |
-/// |---|---|
-/// | [`AssistantReply`](Self::AssistantReply) | `agent_message` |
-/// | [`AssistantToolCalls`](Self::AssistantToolCalls) | `tool_call` |
-/// | [`ToolResult`](Self::ToolResult) | `tool_call_update` |
-/// | [`Thinking`](Self::Thinking) | `agent_thought` |
-/// | [`UserInput`](Self::UserInput) | `user_message` |
-/// | [`AwaitingInput`](Self::AwaitingInput) | `awaiting_input` |
-/// | [`RunEnded`](Self::RunEnded) | `run_ended` |
-///
-/// Exactly the Engine's content [`Event`] variants a transcript renders,
-/// the main chain's inbox events, and its run's end: every other
-/// lifecycle event, task and debug events, and a task's inbox events
-/// never frame.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize)]
-#[non_exhaustive]
-enum AgentEventKind {
-    /// A completed assistant reply.
-    #[serde(rename = "agent_message")]
-    AssistantReply,
-    /// A batch of tool calls the model requested.
-    #[serde(rename = "tool_call")]
-    AssistantToolCalls,
-    /// The result of one dispatched tool call.
-    #[serde(rename = "tool_call_update")]
-    ToolResult,
-    /// A completed block of model thinking.
-    #[serde(rename = "agent_thought")]
-    Thinking,
-    /// Text the user supplied.
-    #[serde(rename = "user_message")]
-    UserInput,
-    /// The agent waits on its empty inbox for the operator's next message.
-    #[serde(rename = "awaiting_input")]
-    AwaitingInput,
-    /// The agent's run ended, succeeded or failed, from the run's
-    /// `RunSucceeded` or `RunFailed` event: it takes no more messages.
-    #[serde(rename = "run_ended")]
-    RunEnded,
-}
-
-/// One content [`Event`] in the shape the `/agents/ws` wire uses: the
-/// ACP-labelled `kind`, the reporting `section`, the model-turn counter,
-/// the kind-specific `content` string (a tool-call batch renders as the
-/// JSON array of its calls), and the model, tool-call id, finish reason,
-/// and metrics where the kind includes them. `content` and every other
-/// free-text field is untrusted model-, tool-, or user-authored data.
-#[derive(Debug, Clone, PartialEq, Serialize)]
-#[non_exhaustive]
-struct AgentEvent {
-    /// What kind of thing happened.
-    kind: AgentEventKind,
-    /// The reporting scope: the agent's name.
-    section: String,
-    /// The model-turn counter the event was reported under.
-    turn: u32,
-    /// The kind-specific untrusted payload.
-    content: String,
-    /// The model that produced the event, for model-attributed kinds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    model: Option<String>,
-    /// The provider-issued tool-call id the event answers to, for tool
-    /// results.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    tool_call_id: Option<String>,
-    /// The provider's finish reason, when it sent one.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    finish_reason: Option<String>,
-    /// Everything measured about the model call that produced the event.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    metrics: Option<CallMetrics>,
-}
-
-/// Whether `event` was reported under the main chain, task `0`, whose
-/// inbox the operator's messages fill.
-fn on_main_chain(event: &Event) -> bool {
-    event.provenance().task == TaskId::from(ChainId::root())
-}
-
-impl AgentEvent {
-    /// Projects one Engine event onto the wire shape, or `None` for a
-    /// variant the transcript does not render (every lifecycle event but
-    /// the run's end, task and debug events, and a task's inbox events). A
-    /// message that entered the main chain's inbox frames as the
-    /// operator's `user_message`, since only the operator fills that
-    /// inbox, the main chain parking on its empty inbox frames as
-    /// `awaiting_input`, and the run's end under the main chain frames as
-    /// `run_ended` with empty content.
-    #[must_use]
-    fn from_event(event: &Event) -> Option<Self> {
-        let base = |kind: AgentEventKind, turn: u32, content: String| AgentEvent {
-            kind,
-            section: event.section().to_owned(),
-            turn,
-            content,
-            model: None,
-            tool_call_id: None,
-            finish_reason: None,
-            metrics: None,
-        };
-        Some(match event {
-            Event::Thinking {
-                turn, model, text, ..
-            } => AgentEvent {
-                model: Some(model.clone()),
-                ..base(AgentEventKind::Thinking, *turn, text.clone())
-            },
-            Event::AssistantReply {
-                turn,
-                text,
-                finish_reason,
-                model,
-                metrics,
-                ..
-            } => AgentEvent {
-                model: Some(model.clone()),
-                finish_reason: finish_reason.clone(),
-                metrics: metrics.clone(),
-                ..base(AgentEventKind::AssistantReply, *turn, text.clone())
-            },
-            Event::AssistantToolCalls {
-                turn, model, calls, ..
-            } => AgentEvent {
-                model: Some(model.clone()),
-                ..base(
-                    AgentEventKind::AssistantToolCalls,
-                    *turn,
-                    render_tool_calls(calls),
-                )
-            },
-            Event::InboxMessage { text, .. } if on_main_chain(event) => {
-                base(AgentEventKind::UserInput, 0, text.clone())
-            }
-            Event::InboxWaiting { .. } if on_main_chain(event) => {
-                base(AgentEventKind::AwaitingInput, 0, String::new())
-            }
-            Event::RunSucceeded { .. } | Event::RunFailed { .. } if on_main_chain(event) => {
-                base(AgentEventKind::RunEnded, 0, String::new())
-            }
-            Event::ToolResult {
-                turn,
-                tool_call_id,
-                content,
-                ..
-            } => AgentEvent {
-                tool_call_id: Some(tool_call_id.clone()),
-                ..base(AgentEventKind::ToolResult, *turn, content.clone())
-            },
-            _ => return None,
-        })
-    }
-}
-
-/// Renders a tool-call batch as the JSON array of its calls, so a reader
-/// parses the ids, names, and arguments back out of one string field.
-/// The calls hold only strings and JSON values, so serialization cannot
-/// fail; the fallback keeps the projection total.
-fn render_tool_calls(calls: &[ToolCallEvent]) -> String {
-    serde_json::to_string(calls).unwrap_or_else(|_| "[]".to_owned())
-}
-
-/// One durable entry of an agent session's event log:
-/// `{"type":"agent_event","index":N,"event":{...}}` plus, on the
-/// model-round content kinds (`agent_thought`, `agent_message`,
-/// `tool_call`), the `reply` id that coalesces the round's ephemeral
-/// deltas away (see [`AgentDeltaFrame`]).
-///
-/// Delivery: durable - `index` is the entry's position in the session's
-/// event log, and the per-client cursor recovers everything past it on
-/// reconnect.
-#[derive(Debug, Clone, PartialEq, Serialize)]
-pub(super) struct AgentEventFrame {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    /// The entry's log index.
-    index: u64,
-    /// The reply id this event settles, present on the model-round
-    /// content kinds and omitted elsewhere.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    reply: Option<u64>,
-    /// The logged entry, in its wire shape.
-    event: AgentEvent,
-}
-
-impl AgentEventFrame {
-    /// Builds the frame for the entry at `index`, or `None` when `event`
-    /// is a variant the transcript does not render.
-    #[must_use]
-    pub(super) fn new(index: u64, reply: Option<u64>, event: &Event) -> Option<Self> {
-        Some(Self {
-            kind: "agent_event",
-            index,
-            reply,
-            event: AgentEvent::from_event(event)?,
-        })
-    }
-}
-
-/// Which streaming side channel one agent delta belongs to.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-#[non_exhaustive]
-pub(super) enum AgentDeltaKind {
-    /// Answer content, superseded by the round's `agent_message` event.
-    Text,
-    /// Reasoning content, superseded by the round's `agent_thought`
-    /// event.
-    Reasoning,
-}
-
-/// One live streaming chunk of an agent's model round:
-/// `{"type":"agent_delta","kind":"text","content":"...","reply":N}`.
-///
-/// Every delta is stamped with the `reply` id of its round, the id the
-/// round's durable event carries, so the SPA coalesces chunks by that id
-/// and replaces them when the event arrives (the ACP messageId
-/// chunk-vs-upsert rule). A withdrawn round ends with no superseding
-/// event: a message that lands while a round streams withdraws it, and
-/// the reissued round streams under a new id, so the SPA drops the
-/// withdrawn round's chunks at that `user_message`.
-///
-/// Delivery: ephemeral - deltas are sent on a bounded broadcast and may drop
-/// under lag; the completed-reply event is the repair path, which is why
-/// agent deltas never enter the event log.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub(super) struct AgentDeltaFrame {
-    #[serde(rename = "type")]
-    kind: &'static str,
-    /// Which side channel the chunk belongs to.
-    #[serde(rename = "kind")]
-    channel: AgentDeltaKind,
-    /// The chunk's text.
-    content: String,
-    /// The id of the delta's round.
-    reply: u64,
-}
-
-impl AgentDeltaFrame {
-    /// Builds a delta frame holding `content` on `channel`, stamped with
-    /// its round's `reply` id.
-    #[must_use]
-    pub(super) fn new(channel: AgentDeltaKind, content: String, reply: u64) -> Self {
-        Self {
-            kind: "agent_delta",
-            channel,
-            content,
-            reply,
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "wire-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/app.rs b/crates/workshop/server/src/app.rs
deleted file mode 100644
index afe7a0a08..000000000
--- a/crates/workshop/server/src/app.rs
+++ /dev/null
@@ -1,380 +0,0 @@
-//! Shared handler state and the composition root that assembles the
-//! per-feature routers into the workshop server.
-//!
-//! [`AppState`] delegates subsystem state to the [`Registry`]: each
-//! subsystem owns its state behind a narrow handle registered
-//! there, and consumers fetch the handles through the registry's
-//! type-keyed state collection. The Harness every agent session runs in
-//! is registered the same way. What remains here is the server's own
-//! runtime infrastructure - the shared reconnect backoff - plus the
-//! registration guards keeping every self-registration alive.
-
-mod compose;
-#[cfg(any(test, feature = "test-fixtures"))]
-pub(crate) mod test_helpers;
-#[cfg(test)]
-mod tests;
-
-use std::fmt;
-use std::sync::Arc;
-
-use axum::Router;
-
-#[cfg(test)]
-use workshop_gateway::GatewayBinding;
-use workshop_gateway::{
-    GatewayClient, GatewayError, GatewayHandles, GatewayHealth, GatewaySnapshot, GatewayUpdater,
-    ResolvedGateway,
-};
-use workshop_menu::MenuHandles;
-use workshop_menu::catalog::CatalogBus;
-use workshop_menu::menu::MenuBus;
-use workshop_registry::{Push, Registration, Registry};
-use workshop_status::StatusBus;
-use workshop_support::{Config, DEFAULT_DEADLINE, ReconnectBackoff, with_deadline};
-use workshop_workspace::Workspace;
-
-use crate::agents::AgentSessions;
-use crate::routes;
-
-/// Shared handler state: the subsystem registry, the server's runtime
-/// infrastructure, and the registration guards. Subsystem handles - the
-/// gateway binding and health flag, the status, catalog, and menu buses,
-/// the agent-session registry - are fetched through the registry's state
-/// collection, where each subsystem self-registers them.
-#[derive(Debug, Clone)]
-pub struct AppState {
-    backoff: ReconnectBackoff,
-    registry: Registry,
-    // Keeps the subsystems' self-registrations alive; dropping the last
-    // state clone deregisters them.
-    _registrations: Registrations,
-}
-
-/// The registration guards keeping every subsystem's self-registrations
-/// alive: the push channels, the producer sinks, the state handles, the
-/// route registrars, the background tasks, and the workspace roots view.
-#[derive(Clone)]
-struct Registrations {
-    guards: Vec<Arc<Registration>>,
-}
-
-impl Registrations {
-    fn new() -> Self {
-        Self { guards: Vec::new() }
-    }
-
-    /// Holds one registration guard for the state's lifetime.
-    fn hold(&mut self, guard: Registration) {
-        self.guards.push(Arc::new(guard));
-    }
-}
-
-impl fmt::Debug for Registrations {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Registrations")
-            .field("held", &self.guards.len())
-            .finish()
-    }
-}
-
-impl AppState {
-    /// Builds shared state from the loaded configuration, resolving the
-    /// gateway endpoint first: a live gateway discovery file in the run
-    /// directory wins over explicit `[gateway]` config.
-    ///
-    /// # Errors
-    /// Returns `StateError::Resolution` when no live gateway discovery file
-    /// exists and the config has no explicit gateway, and
-    /// `StateError::Gateway` if the HTTP client cannot be built.
-    pub fn new(config: &Config) -> Result<Self, StateError> {
-        let gateway = workshop_gateway::resolve(&config.gateway).map_err(StateError::Resolution)?;
-        state_with_gateway(config, &gateway)
-    }
-
-    /// The status bus, which every `/ws` session subscribes to so it can
-    /// forward updates; producers report through [`AppState::push`].
-    ///
-    /// # Panics
-    /// Panics when the composition root never registered the bus - a bug
-    /// boot already refuses: `state_with_gateway` requires every
-    /// contribution before sharing state.
-    #[must_use]
-    pub fn status(&self) -> StatusBus {
-        self.required::<StatusBus>()
-    }
-
-    /// The push facade over the status, catalog, and menu sinks, held
-    /// by every subsystem that reports what happened.
-    #[must_use]
-    pub fn push(&self) -> Push {
-        self.registry.push()
-    }
-
-    /// A clone of the handle set a subsystem registered as `T`.
-    ///
-    /// # Panics
-    /// Panics when the composition root never registered `T` - a bug
-    /// boot already refuses: [`state_with_gateway`] requires every
-    /// contribution before sharing state.
-    fn required<T: Clone + Send + Sync + 'static>(&self) -> T {
-        self.registry
-            .require::<T>()
-            .map_or_else(|error| panic!("{error}"), |handles| (*handles).clone())
-    }
-
-    /// The gateway subsystem's registered handles.
-    fn gateway_handles(&self) -> GatewayHandles {
-        self.required::<GatewayHandles>()
-    }
-
-    /// The menu subsystem's registered handles.
-    fn menu_handles(&self) -> MenuHandles {
-        self.required::<MenuHandles>()
-    }
-
-    /// One atomic Gateway endpoint and credential generation.
-    pub(crate) fn gateway_snapshot(&self) -> Arc<GatewaySnapshot> {
-        self.gateway_handles().binding().snapshot()
-    }
-
-    /// A clone of the currently published Gateway HTTP client.
-    #[must_use]
-    pub fn gateway_client(&self) -> GatewayClient {
-        self.gateway_snapshot().client().clone()
-    }
-
-    /// The replaceable Gateway binding shared with long-lived tasks.
-    #[cfg(test)]
-    pub(crate) fn gateway_binding(&self) -> GatewayBinding {
-        self.gateway_handles().binding().clone()
-    }
-
-    /// Restricted local-Gateway authority for the embedding binary.
-    pub(crate) fn gateway_updater(&self) -> GatewayUpdater {
-        self.gateway_handles().binding().updater()
-    }
-
-    /// Permanently revokes gateway publication before application teardown.
-    pub(crate) fn close_gateway_publication(&self) {
-        self.gateway_handles()
-            .binding()
-            .updater()
-            .close_publication();
-    }
-
-    /// Shared gateway reachability, published by the heartbeat; the
-    /// gateway-dependent routes read it to short-circuit while the gateway
-    /// is down.
-    #[must_use]
-    pub fn health(&self) -> GatewayHealth {
-        self.gateway_handles().health().clone()
-    }
-
-    /// The shared reconnect backoff: the heartbeat draws probe delays
-    /// from it while the gateway is down, and the agent sessions reset it
-    /// on useful work - a completed model reply.
-    #[must_use]
-    pub fn backoff(&self) -> ReconnectBackoff {
-        self.backoff.clone()
-    }
-
-    /// The catalog bus, which the heartbeat publishes the refreshed model
-    /// catalog to on a gateway reconnect and every `/ws` session forwards
-    /// from.
-    #[must_use]
-    pub fn catalog(&self) -> CatalogBus {
-        self.menu_handles().catalog().clone()
-    }
-
-    /// The menu bus, whose workbench snapshots every `/ws` session
-    /// forwards and whose mutators the session's menu events drive.
-    #[must_use]
-    pub fn menu(&self) -> MenuBus {
-        self.menu_handles().menu().clone()
-    }
-
-    /// The subsystem registry: the contribution collections the
-    /// subsystems self-register into, so consumers reach them by type
-    /// instead of by name.
-    #[must_use]
-    pub fn registry(&self) -> &Registry {
-        &self.registry
-    }
-
-    /// The agent-session opener: discovery, launch, and the running
-    /// sessions behind the `/agents/ws` socket, every one of them run in
-    /// the Harness. Sessions outlive sockets, so the embedding binary ends
-    /// one through `AgentSessions::close`.
-    ///
-    /// # Panics
-    /// Panics when the composition root never registered the opener - a
-    /// bug boot already refuses: `state_with_gateway` requires every
-    /// contribution before sharing state.
-    #[must_use]
-    pub fn agents(&self) -> AgentSessions {
-        self.required::<AgentSessions>()
-    }
-
-    /// Reopens the workspace file that was open when the server last
-    /// ran, and returns whether one was reopened. Boot awaits this after
-    /// binding the listener and before it serves, so the first
-    /// request already sees the restored grants. It never fails: a
-    /// missing or corrupt pointer, a vanished target, or a refused file
-    /// logs and leaves the workspace ephemeral.
-    ///
-    /// # Panics
-    /// Panics when the composition root never registered the workspace -
-    /// a bug boot already refuses: `state_with_gateway` requires every
-    /// contribution before sharing state.
-    pub async fn reopen_last_workspace(&self) -> bool {
-        self.required::<Workspace>().reopen_last().await
-    }
-}
-
-/// One subsystem's `register` call, named so a boot-composition test can
-/// omit it and watch startup refuse to share state.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[cfg_attr(
-    not(any(test, feature = "test-fixtures")),
-    expect(
-        unreachable_pub,
-        reason = "the gated `fixtures` module is its only public path"
-    )
-)]
-pub enum Omit {
-    /// `workshop_status::register`.
-    Status,
-    /// `workshop_menu::register`.
-    Menu,
-    /// `workshop_gateway::register`.
-    Gateway,
-    /// `workshop_workspace::register`.
-    Workspace,
-    /// `agents::register`: the agent-sessions routes, the Harness, and
-    /// the agent-session opener.
-    AgentSessions,
-    /// `workshop_user_state::register`.
-    UserState,
-}
-
-/// Builds shared state against an already-resolved gateway endpoint: the
-/// construction phase an embedding binary holding its own endpoint enters
-/// directly, skipping gateway discovery file resolution.
-///
-/// The composition root: every subsystem is constructed here, registers
-/// itself into the registry, and is thereafter reached through the
-/// registry's collections - routes included, which [`router`] merges
-/// from the route vector.
-///
-/// # Errors
-/// Returns `StateError::Gateway` if the HTTP client cannot be built,
-/// and `StateError::Composition` when a required contribution is
-/// absent after every subsystem has registered.
-#[cfg_attr(
-    not(any(test, feature = "test-fixtures")),
-    expect(
-        unreachable_pub,
-        reason = "the gated `fixtures` module is its only public path"
-    )
-)]
-pub fn state_with_gateway(
-    config: &Config,
-    gateway: &ResolvedGateway,
-) -> Result<AppState, StateError> {
-    compose::compose(config, gateway, None, None)
-}
-
-/// [`state_with_gateway`] with the profile switch's sidecar restart bound
-/// replaced: the seam for a test that must trip the bound without
-/// waiting out the production value.
-///
-/// # Errors
-/// Returns `StateError::Gateway` if the HTTP client cannot be built,
-/// and `StateError::Composition` when a required contribution is
-/// absent after every subsystem has registered.
-#[cfg(feature = "test-fixtures")]
-pub fn state_with_gateway_and_restart_bound(
-    config: &Config,
-    gateway: &ResolvedGateway,
-    restart_bound: std::time::Duration,
-) -> Result<AppState, StateError> {
-    compose::compose(config, gateway, None, Some(restart_bound))
-}
-
-/// [`state_with_gateway`] with one subsystem's `register` call removed:
-/// the boot-failure test's seam, proving a missing required contribution
-/// fails boot with a typed error naming it.
-///
-/// # Errors
-/// Returns `StateError::Gateway` if the HTTP client cannot be built,
-/// and `StateError::Composition` naming the omitted subsystem's
-/// contribution.
-#[cfg(any(test, feature = "test-fixtures"))]
-pub fn state_with_gateway_omitting(
-    config: &Config,
-    gateway: &ResolvedGateway,
-    omit: Omit,
-) -> Result<AppState, StateError> {
-    compose::compose(config, gateway, Some(omit), None)
-}
-
-/// A shared-state construction failure: rich, init-only, and never sent
-/// over the wire (the HTTP failure type is `crate::error::AppError`).
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum StateError {
-    /// The gateway HTTP client could not be built.
-    #[non_exhaustive]
-    #[error("build gateway client")]
-    Gateway(#[source] GatewayError),
-
-    /// No gateway endpoint could be resolved: no live gateway discovery file and
-    /// no explicit `[gateway]` config.
-    #[non_exhaustive]
-    #[error("resolve the gateway endpoint")]
-    Resolution(#[source] workshop_gateway::ResolveError),
-
-    /// A required subsystem contribution was never registered: the
-    /// composition root itself is broken, so boot fails naming the
-    /// absent type instead of panicking later at first use.
-    #[non_exhaustive]
-    #[error("compose the subsystem registry")]
-    Composition(#[from] workshop_registry::MissingContribution),
-}
-
-/// Returns the workshop server router with every route mounted: the
-/// server's own feature routers from `crate::routes`, plus the
-/// subsystems' routers merged from the registry's route vector in
-/// registration order - an empty vector is a graceful no-op. The API
-/// routes sit behind the
-/// `crate::cross_site` guard; `/health` and the UI assets stay outside it
-/// so the desktop app probe, heartbeat, and initial navigation keep working.
-/// Every response includes the `crate::csp` policy: the desktop app's webview
-/// loads the UI as an External origin, so the server sets the page's
-/// Content-Security-Policy. Each subsystem applies its own deadline tier:
-/// the default on the workspace routes, the relay tier on `/v1/models`,
-/// none on the WebSocket upgrades.
-pub fn router(state: AppState) -> Router {
-    let registry = state.registry().clone();
-    let mut api = Router::new()
-        .merge(routes::realtime::routes(state.clone()))
-        .merge(routes::gateway_config::routes(state))
-        .merge(with_deadline(routes::prompts::routes(), DEFAULT_DEADLINE));
-    // The subsystems' routes merge in registration order; an empty
-    // vector is a graceful no-op.
-    for registrar in registry.routes() {
-        api = api.merge(registrar.routes());
-    }
-    let api = api.layer(axum::middleware::from_fn(crate::cross_site::guard));
-    Router::new()
-        .merge(with_deadline(routes::assets::routes(), DEFAULT_DEADLINE))
-        .merge(with_deadline(routes::health::routes(), DEFAULT_DEADLINE))
-        .merge(api)
-        // The outermost layer on the server's own routes: every response
-        // is stamped with the CSP, error envelopes included, so the desktop app's
-        // External-origin webview runs under the policy no matter which
-        // route answered.
-        .layer(axum::middleware::from_fn(crate::csp::header))
-}
diff --git a/crates/workshop/server/src/app/compose.rs b/crates/workshop/server/src/app/compose.rs
deleted file mode 100644
index 9a84f70e9..000000000
--- a/crates/workshop/server/src/app/compose.rs
+++ /dev/null
@@ -1,225 +0,0 @@
-//! The composition root: constructs every subsystem, registers it into
-//! the shared [`Registry`], and assembles the shared [`AppState`]. Each
-//! subsystem owns a `register` helper here so the composition reads as a
-//! single list of subsystem registrations in registration order.
-
-use std::sync::Arc;
-
-use workshop_gateway::{GatewayBinding, GatewayHandles, GatewayHealth, ResolvedGateway};
-use workshop_menu::MenuHandles;
-use workshop_menu::catalog::CatalogBus;
-use workshop_menu::menu::MenuBus;
-use workshop_registry::{Push, Registry, WorkspaceRoots};
-use workshop_status::StatusBus;
-use workshop_support::{Config, ReconnectBackoff};
-use workshop_user_state::UserStateStore;
-use workshop_workspace::Workspace;
-
-use super::{AppState, Omit, Registrations, StateError};
-use crate::agents::{self, AgentSessions, SessionsState};
-use crate::workshop_socket::{self, WorkshopSocketState};
-
-/// The composition root behind [`super::state_with_gateway`]; `omit`
-/// removes one subsystem's `register` call for the boot-failure test, and
-/// `restart_bound` replaces the `/ws` socket's sidecar restart bound when
-/// given.
-pub(super) fn compose(
-    config: &Config,
-    gateway: &ResolvedGateway,
-    omit: Option<Omit>,
-    restart_bound: Option<std::time::Duration>,
-) -> Result<AppState, StateError> {
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    // The per-profile model memory lives in the state directory; a bad
-    // or missing memory file costs the memory, never startup.
-    let state_dir = &config.server.state_dir;
-    // A crash between an atomic write's temp file and its rename
-    // orphans the temp; boot is the one moment the directory is
-    // known and quiet, so it is swept here.
-    workshop_support::sweep_orphaned_temps(state_dir);
-    let menu = MenuBus::new(catalog.clone(), Some(state_dir));
-    // The subsystems self-register: consumers reach their channels,
-    // sinks, state handles, routes, and tasks through the registry's
-    // collections instead of by name.
-    let registry = Registry::new();
-    let mut registrations = Registrations::new();
-    register_status(&registry, &mut registrations, &status, omit);
-    register_menu(&registry, &mut registrations, &catalog, &menu, omit);
-    let push = registry.push();
-    let backoff = register_gateway(&registry, &mut registrations, gateway, &push, omit)?;
-    register_workspace(&registry, &mut registrations, state_dir, omit);
-    register_user_state(&registry, &mut registrations, state_dir, omit);
-    register_sessions(&registry, &mut registrations, config, &backoff, omit);
-    register_workshop_socket(&registry, &mut registrations, restart_bound);
-    // The boot contract: every subsystem's handle set is present before
-    // state is shared, so a missing contribution fails here, naming the
-    // type, instead of panicking later at first use.
-    registry.require::<StatusBus>()?;
-    registry.require::<MenuHandles>()?;
-    registry.require::<GatewayHandles>()?;
-    registry.require::<AgentSessions>()?;
-    registry.require::<Workspace>()?;
-    registry.require::<dyn WorkspaceRoots>()?;
-    registry.require::<UserStateStore>()?;
-    push.push_idle();
-    Ok(AppState {
-        backoff,
-        registry,
-        _registrations: registrations,
-    })
-}
-
-/// The status subsystem: its bus plus the push channel, sink, and state
-/// handle it self-registers.
-fn register_status(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    status: &StatusBus,
-    omit: Option<Omit>,
-) {
-    if omit != Some(Omit::Status) {
-        let regs = workshop_status::register(registry, status);
-        registrations.hold(regs.channel);
-        registrations.hold(regs.sink);
-        registrations.hold(regs.state);
-    }
-}
-
-/// The menu subsystem: its catalog and menu buses plus the sinks and
-/// state handle it self-registers.
-fn register_menu(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    catalog: &CatalogBus,
-    menu: &MenuBus,
-    omit: Option<Omit>,
-) {
-    if omit != Some(Omit::Menu) {
-        let regs = workshop_menu::register(registry, catalog, menu);
-        registrations.hold(regs.catalog_sink);
-        registrations.hold(regs.menu_sink);
-        registrations.hold(regs.state);
-    }
-}
-
-/// The gateway subsystem: reports the resolved gateway, builds the
-/// replaceable binding, and self-registers its handles and background
-/// tasks. Returns the shared reconnect backoff the sessions subsystem
-/// later draws from.
-fn register_gateway(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    gateway: &ResolvedGateway,
-    push: &Push,
-    omit: Option<Omit>,
-) -> Result<ReconnectBackoff, StateError> {
-    // Startup phases are reported as they run; with no client connected
-    // yet these land on an empty bus, ready for the first session.
-    workshop_gateway::report(gateway, push);
-    // The Gateway ships as a separate release, so the running one may be
-    // older than this Workshop needs. Its version arrives in the discovery
-    // file; an explicit config has no discovery file, so there is nothing
-    // to compare and the pin's minimum is simply not checked.
-    if let Some(identity) = gateway.identity() {
-        workshop_gateway::report_version(identity.version(), push);
-    }
-    let gateway_binding = GatewayBinding::new_with_identity(
-        gateway.base_url(),
-        gateway.api_key(),
-        gateway.identity().cloned(),
-    )
-    .map_err(StateError::Gateway)?;
-    let backoff = ReconnectBackoff::new();
-    let health = GatewayHealth::new();
-    let gateway_handles = GatewayHandles::new(gateway_binding, health.clone());
-    if omit != Some(Omit::Gateway) {
-        registrations.hold(workshop_gateway::register(
-            registry,
-            gateway_handles.clone(),
-        ));
-    }
-    // The background tasks register beside the state handles; the server
-    // spawns them from the registry's task vector when it starts
-    // serving.
-    let tasks = workshop_gateway::register_tasks(registry, &gateway_handles, backoff.clone());
-    registrations.hold(tasks.heartbeat);
-    registrations.hold(tasks.subscriber);
-    Ok(backoff)
-}
-
-/// The workspace subsystem: its file handle plus the routes, state,
-/// roots, and shutdown task it self-registers.
-fn register_workspace(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    state_dir: &std::path::Path,
-    omit: Option<Omit>,
-) {
-    // The workspace remembers its last-used file in the state directory;
-    // boot follows that memory through `reopen_last_workspace` once the
-    // runtime is up, since the reopen is async and composition is not.
-    let workspace = Workspace::with_state_dir(state_dir);
-    if omit != Some(Omit::Workspace) {
-        let regs = workshop_workspace::register(registry, &workspace);
-        registrations.hold(regs.routes);
-        registrations.hold(regs.state);
-        registrations.hold(regs.roots);
-        // The shutdown lever that closes the workspace file inside the
-        // graceful stop, so a quit leaves one complete file and no
-        // sidecar.
-        registrations.hold(workshop_workspace::register_tasks(registry, &workspace));
-    }
-}
-
-/// The user-state subsystem: the account-scoped UI state store plus the
-/// routes and state handle it self-registers.
-fn register_user_state(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    state_dir: &std::path::Path,
-    omit: Option<Omit>,
-) {
-    if omit != Some(Omit::UserState) {
-        // The account-scoped UI state lives beside the menu memory in the
-        // state directory; a bad or missing file costs the state, never
-        // startup.
-        let user_state = Arc::new(UserStateStore::new(state_dir));
-        let regs = workshop_user_state::register(registry, user_state);
-        registrations.hold(regs.routes);
-        registrations.hold(regs.state);
-    }
-}
-
-/// The agent-sessions subsystem: the agent-session launcher, which builds
-/// each conversation's per-run Harness, and its route state, plus the
-/// routes it self-registers.
-fn register_sessions(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    config: &Config,
-    backoff: &ReconnectBackoff,
-    omit: Option<Omit>,
-) {
-    let agents = AgentSessions::new(config, registry.clone(), backoff.clone());
-    let sessions = SessionsState::new(registry.clone(), crate::cross_site::origin_allowed);
-    if omit != Some(Omit::AgentSessions) {
-        let regs = agents::register(registry, &sessions, &agents);
-        registrations.hold(regs.routes);
-        registrations.hold(regs.agents);
-    }
-}
-
-/// The `/ws` workshop socket: its route state, with the sidecar restart
-/// bound replaced when given, and the route it self-registers.
-fn register_workshop_socket(
-    registry: &Registry,
-    registrations: &mut Registrations,
-    restart_bound: Option<std::time::Duration>,
-) {
-    let mut state = WorkshopSocketState::new(registry.clone(), crate::cross_site::origin_allowed);
-    if let Some(bound) = restart_bound {
-        state = state.with_restart_bound(bound);
-    }
-    registrations.hold(workshop_socket::register(registry, &state));
-}
diff --git a/crates/workshop/server/src/app/test_helpers.rs b/crates/workshop/server/src/app/test_helpers.rs
deleted file mode 100644
index db9f8ce1e..000000000
--- a/crates/workshop/server/src/app/test_helpers.rs
+++ /dev/null
@@ -1,68 +0,0 @@
-//! Shared fixtures for the router tests here and in the
-//! [`crate::routes`] feature modules: state construction against a stub
-//! gateway address and the small helpers every route test leans on.
-//! [`spawn_gateway`] is additionally re-exported to the
-//! integration-test binary through the `test-fixtures` feature the
-//! crate's own dev-dependency enables.
-
-#[cfg(test)]
-use std::path::Path;
-
-use axum::Router;
-#[cfg(test)]
-use axum::body::to_bytes;
-#[cfg(test)]
-use axum::response::Response;
-
-#[cfg(test)]
-use crate::app::{AppState, state_with_gateway};
-#[cfg(test)]
-use workshop_support::{AgentsConfig, Config, GatewayConfig, ServerConfig};
-
-/// Builds a configuration pointing at `base_url`, anchoring the state
-/// directory at `state_dir`.
-#[cfg(test)]
-pub(crate) fn config_for(base_url: &str, state_dir: &Path) -> Config {
-    Config {
-        gateway: GatewayConfig {
-            base_url: base_url.to_string(),
-            api_key: "test-key".to_string(),
-        },
-        server: ServerConfig {
-            state_dir: state_dir.to_path_buf(),
-            ..ServerConfig::default()
-        },
-        agents: AgentsConfig::default(),
-    }
-}
-
-/// Builds state whose state directory is a fresh tempdir, returned
-/// alongside so the directory outlives the test. Discovery is
-/// bypassed: a test never consults the real run directory.
-#[cfg(test)]
-pub(crate) fn state_for(base_url: &str) -> (AppState, tempfile::TempDir) {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let config = config_for(base_url, state_dir.path());
-    let gateway = workshop_gateway::ResolvedGateway::from_config(&config.gateway);
-    let state = state_with_gateway(&config, &gateway).expect("state builds in tests");
-    (state, state_dir)
-}
-
-/// Collects a response body already buffered in memory.
-#[cfg(test)]
-pub(crate) async fn body_bytes(response: Response) -> axum::body::Bytes {
-    to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already")
-}
-
-/// Binds `app` as a mock gateway on a free loopback port and returns its
-/// base URL.
-///
-/// # Panics
-/// Panics when the loopback bind fails or the bound address cannot be
-/// read.
-pub async fn spawn_gateway(app: Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
diff --git a/crates/workshop/server/src/app/tests.rs b/crates/workshop/server/src/app/tests.rs
deleted file mode 100644
index 050d7ca72..000000000
--- a/crates/workshop/server/src/app/tests.rs
+++ /dev/null
@@ -1,235 +0,0 @@
-//! App state tests: boot-time workspace reopening, auth headers, defaults, and route refusals.
-
-use super::*;
-
-use axum::http::{HeaderMap, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-
-use super::test_helpers::{body_bytes, config_for, spawn_gateway, state_for};
-use workshop_gateway::GatewayClient;
-
-/// The `last-workspace` pointer file inside `state_dir`.
-fn pointer_path(state_dir: &std::path::Path) -> std::path::PathBuf {
-    state_dir.join("last-workspace")
-}
-
-/// Builds state anchored at `state_dir`, reopens the last workspace the
-/// way boot does, and returns the state with whether anything reopened.
-async fn booted_state(state_dir: &std::path::Path) -> (AppState, bool) {
-    let config = config_for("http://127.0.0.1:1", state_dir);
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let state = state_with_gateway(&config, &gateway).expect("boot never fails on the pointer");
-    let reopened = state.reopen_last_workspace().await;
-    (state, reopened)
-}
-
-/// `GET /workspace/file/current` through the full router, parsed.
-async fn current_file(state: AppState) -> serde_json::Value {
-    use tower::ServiceExt as _;
-
-    let request = axum::http::Request::builder()
-        .uri("/workspace/file/current")
-        .body(axum::body::Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), axum::http::StatusCode::OK);
-    serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON")
-}
-
-#[tokio::test]
-async fn boot_reopens_the_workspace_the_pointer_names() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("mine.rvwork");
-    // Author the file in a previous "run", then let go of it.
-    let author = Workspace::new();
-    let granted = author.grant(root.path()).expect("grant the root");
-    author.save_as(&file).await.expect("save as creates");
-    author.close_backing_for_test().await;
-    std::fs::write(
-        pointer_path(state_dir.path()),
-        file.to_string_lossy().as_bytes(),
-    )
-    .expect("the pointer writes");
-
-    let (state, reopened) = booted_state(state_dir.path()).await;
-    assert!(reopened, "boot follows the pointer");
-
-    let current = current_file(state).await;
-    assert_eq!(current["path"], serde_json::json!(file));
-    assert_eq!(current["name"], "mine");
-    assert_eq!(
-        current["grants"],
-        serde_json::json!([{ "path": granted, "exists": true }]),
-        "the file's grants are live before the listener serves"
-    );
-}
-
-#[tokio::test]
-async fn boot_with_corrupt_pointer_bytes_starts_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(pointer_path(state_dir.path()), [0xff, 0xfe, 0x00, 0xc3])
-        .expect("the corrupt pointer writes");
-
-    let (state, reopened) = booted_state(state_dir.path()).await;
-    assert!(!reopened, "garbage names no workspace");
-
-    let current = current_file(state).await;
-    assert_eq!(current["path"], serde_json::Value::Null);
-    assert_eq!(current["grants"], serde_json::json!([]));
-}
-
-#[tokio::test]
-async fn boot_with_a_pointer_to_a_vanished_file_starts_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let gone = home.path().join("gone.rvwork");
-    std::fs::write(
-        pointer_path(state_dir.path()),
-        gone.to_string_lossy().as_bytes(),
-    )
-    .expect("the pointer writes");
-
-    let (state, reopened) = booted_state(state_dir.path()).await;
-    assert!(!reopened, "a vanished target cannot reopen");
-
-    let current = current_file(state).await;
-    assert_eq!(current["path"], serde_json::Value::Null);
-    assert!(!gone.exists(), "boot never creates the pointed file");
-}
-
-#[tokio::test]
-async fn boot_with_a_pointer_to_an_alien_database_starts_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let alien = home.path().join("alien.rvwork");
-    workshop_workspace::create_alien_database_for_test(&alien)
-        .await
-        .expect("the alien database creates");
-    std::fs::write(
-        pointer_path(state_dir.path()),
-        alien.to_string_lossy().as_bytes(),
-    )
-    .expect("the pointer writes");
-
-    let (state, reopened) = booted_state(state_dir.path()).await;
-    assert!(!reopened, "a refused file does not reopen");
-
-    let current = current_file(state).await;
-    assert_eq!(current["path"], serde_json::Value::Null);
-    assert_eq!(current["grants"], serde_json::json!([]));
-}
-
-/// Reports whether the request included an `Authorization` header, so
-/// the client tests can observe what was sent.
-async fn mock_auth_probe(headers: HeaderMap) -> Response {
-    let body = if headers.contains_key(header::AUTHORIZATION) {
-        "auth"
-    } else {
-        "no-auth"
-    };
-    ([(header::CONTENT_TYPE, "text/plain")], body).into_response()
-}
-
-#[tokio::test]
-async fn empty_api_key_sends_no_authorization_header() {
-    let base_url = spawn_gateway(Router::new().route("/v1/models", get(mock_auth_probe))).await;
-    let anonymous = GatewayClient::new(&base_url, "").expect("client builds");
-    let response = anonymous.list_models().await.expect("request completes");
-    assert_eq!(response.body, b"no-auth", "empty key sends no header");
-
-    let keyed = GatewayClient::new(&base_url, "test-key").expect("client builds");
-    let response = keyed.list_models().await.expect("request completes");
-    assert_eq!(response.body, b"auth", "a set key still authenticates");
-}
-
-#[test]
-fn default_bind_is_loopback_port_7910() {
-    assert_eq!(workshop_support::DEFAULT_ADDR, "127.0.0.1:7910");
-}
-
-#[test]
-fn the_relay_deadline_outlasts_the_gateway_request_timeout() {
-    assert!(
-        workshop_support::RELAY_DEADLINE > workshop_gateway::REQUEST_TIMEOUT,
-        "the route deadline must let the gateway client time out first, \
-         so the caller sees the relay's 502 rather than a blunt 408"
-    );
-}
-
-#[test]
-fn boot_without_the_user_state_subsystem_fails_naming_its_store() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = config_for("http://127.0.0.1:1", dir.path());
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let error = state_with_gateway_omitting(&config, &gateway, Omit::UserState)
-        .expect_err("boot fails when the user-state subsystem never registers");
-    let cause = std::error::Error::source(&error)
-        .expect("the composition failure reports the registry's cause");
-    assert!(
-        cause.to_string().contains("UserStateStore"),
-        "the failure's cause names the missing store: {error}: {cause}"
-    );
-}
-
-#[test]
-fn startup_sweeps_orphaned_temp_files_from_the_state_directory() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // Residue of a write that crashed between its temp file and its
-    // rename in a previous run.
-    let orphan = dir.path().join("workshop-state.json.42-7.rv-tmp");
-    std::fs::write(&orphan, "partial").expect("the simulated crash residue writes");
-    let config = config_for("http://127.0.0.1:1", dir.path());
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let _state = state_with_gateway(&config, &gateway).expect("state builds");
-    assert!(
-        !orphan.exists(),
-        "state construction sweeps orphaned temp files from the state directory"
-    );
-}
-
-/// A plain GET to `/ws` without upgrade headers is rejected with 400,
-/// which proves the sessions subsystem's route is mounted through the
-/// registry; the WebSocket flow is covered by the integration binary's
-/// `session` modules over a live socket.
-#[tokio::test]
-async fn ws_route_rejects_a_non_upgrade_get() {
-    use tower::ServiceExt as _;
-
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = axum::http::Request::builder()
-        .uri("/ws")
-        .body(axum::body::Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), axum::http::StatusCode::BAD_REQUEST);
-}
-
-/// The router mounts no `/chat` route: a `POST /chat` answers 404.
-#[tokio::test]
-async fn post_chat_is_absent_and_answers_not_found() {
-    use tower::ServiceExt as _;
-
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = axum::http::Request::builder()
-        .method("POST")
-        .uri("/chat")
-        .header(header::CONTENT_TYPE, "application/json")
-        .body(axum::body::Body::from(
-            r#"{"model":"test-model","messages":[{"role":"user","content":"ping"}]}"#,
-        ))
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), axum::http::StatusCode::NOT_FOUND);
-}
diff --git a/crates/workshop/server/src/assets.rs b/crates/workshop/server/src/assets.rs
deleted file mode 100644
index 11b9f7683..000000000
--- a/crates/workshop/server/src/assets.rs
+++ /dev/null
@@ -1,155 +0,0 @@
-//! The embedded workshop UI assets and the file-serving helper; the routes
-//! that expose them sit in [`crate::routes::assets`].
-
-use axum::http::header;
-use axum::response::{IntoResponse, Response};
-
-use crate::error::AppError;
-
-/// The workshop UI assets under `$OUT_DIR/ui-dist/`, written by the crate's
-/// build script (the esbuild bundle plus copies of the static files). Debug
-/// builds read the files from disk at request time, so UI edits need no Rust
-/// recompile; release builds embed them into the binary.
-#[derive(rust_embed::Embed)]
-#[folder = "$OUT_DIR/ui-dist/"]
-pub(crate) struct UiAssets;
-
-/// How long a cache may hold one asset.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum CachePolicy {
-    /// A stable URL whose content changes between builds (`index.html`,
-    /// the logical `app.js` route): force revalidation on every load, so
-    /// a heuristic cache never serves a stale script against a newer
-    /// server.
-    Revalidate,
-    /// A content-hashed URL (`bundle/app-<hash>.js`, the chunks): the
-    /// name changes when the content does, so the response may be cached
-    /// forever.
-    Immutable,
-}
-
-impl CachePolicy {
-    /// The Cache-Control header value for the policy.
-    fn header_value(self) -> &'static str {
-        match self {
-            Self::Revalidate => "no-cache",
-            Self::Immutable => "public, max-age=31536000, immutable",
-        }
-    }
-}
-
-/// The build's logical-to-hashed name map, parsed from the UI build's
-/// `manifest.json`. The server resolves the stable routes (`/app.js`,
-/// `/app.css`) through it to the current hashed files.
-#[derive(Clone, Debug)]
-pub(crate) struct AssetManifest {
-    /// The hashed bundle path serving the logical `app.js`.
-    app_js: String,
-    /// The hashed bundle path serving the logical `app.css`.
-    app_css: String,
-}
-
-impl AssetManifest {
-    /// The hashed target for one logical name, or None when the manifest
-    /// does not map it.
-    pub(crate) fn resolve(&self, logical: &str) -> Option<&str> {
-        match logical {
-            "app.js" => Some(&self.app_js),
-            "app.css" => Some(&self.app_css),
-            _ => None,
-        }
-    }
-}
-
-/// The server's webview asset layer: the embedded UI bundle.
-pub(crate) struct EmbeddedAssets;
-
-impl EmbeddedAssets {
-    /// Returns one asset's bytes, or None when the name is absent.
-    pub(crate) fn get(path: &str) -> Option<Vec<u8>> {
-        UiAssets::get(path).map(|asset| asset.data.into_owned())
-    }
-
-    /// The build's asset manifest, or None when the build emitted none.
-    pub(crate) fn manifest() -> Option<AssetManifest> {
-        let asset = UiAssets::get("manifest.json")?;
-        // A parse failure is safe to ignore: the build writes the manifest
-        // itself and embeds it beside the assets, so malformed JSON means a
-        // corrupt build output rather than user input. Treating it as "no
-        // manifest" degrades the logical routes to the same AssetMissing
-        // 404 a missing manifest produces, instead of panicking the server.
-        let value: serde_json::Value = serde_json::from_slice(&asset.data).ok()?;
-        let target = |logical: &str| value.get(logical)?.as_str().map(str::to_string);
-        Some(AssetManifest {
-            app_js: target("app.js")?,
-            app_css: target("app.css")?,
-        })
-    }
-}
-
-/// Serves one embedded UI asset with the given content type and cache
-/// policy.
-pub(crate) fn ui_asset(path: &str, content_type: &'static str, cache: CachePolicy) -> Response {
-    match EmbeddedAssets::get(path) {
-        Some(data) => (
-            [
-                (header::CONTENT_TYPE, content_type),
-                (header::CACHE_CONTROL, cache.header_value()),
-            ],
-            data,
-        )
-            .into_response(),
-        None => AppError::AssetMissing(path.to_string()).into_response(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use axum::http::StatusCode;
-
-    use super::*;
-
-    /// Asserts an asset name answers 404 rather than file contents.
-    fn assert_asset_misses(path: &str) {
-        let response = ui_asset(path, "text/plain; charset=utf-8", CachePolicy::Revalidate);
-        assert_eq!(
-            response.status(),
-            StatusCode::NOT_FOUND,
-            "{path:?} must not escape the asset root"
-        );
-    }
-
-    // These pin traversal parity between the two build profiles: release
-    // misses the embed map by construction, while a debug build reads
-    // `$OUT_DIR/ui-dist/` from disk at request time and must refuse names
-    // resolving outside it. That guarantee covers request-supplied names
-    // only: rust-embed 8.12.0 deliberately still serves an out-of-root
-    // symlink planted inside the asset root, a bypass outside the parity
-    // pinned here. The absolute target names this crate's own manifest - a
-    // file that exists on disk - so it can only fail on containment; the
-    // relative targets may also fail on absence.
-
-    #[test]
-    fn relative_traversal_answers_not_found() {
-        assert_asset_misses("../../Cargo.toml");
-    }
-
-    #[test]
-    fn backslash_traversal_answers_not_found() {
-        assert_asset_misses(r"..\..\Cargo.toml");
-    }
-
-    #[test]
-    fn absolute_path_answers_not_found() {
-        assert_asset_misses(concat!(env!("CARGO_MANIFEST_DIR"), "/Cargo.toml"));
-    }
-
-    #[test]
-    fn the_cache_policies_render_their_header_values() {
-        assert_eq!(CachePolicy::Revalidate.header_value(), "no-cache");
-        assert_eq!(
-            CachePolicy::Immutable.header_value(),
-            "public, max-age=31536000, immutable"
-        );
-    }
-}
diff --git a/crates/workshop/server/src/cross_site.rs b/crates/workshop/server/src/cross_site.rs
deleted file mode 100644
index 840643051..000000000
--- a/crates/workshop/server/src/cross_site.rs
+++ /dev/null
@@ -1,340 +0,0 @@
-//! Cross-site request blocking for the loopback workshop server.
-//!
-//! Any webpage the user visits can issue requests to `127.0.0.1`, so
-//! without these checks the workspace-write and WebSocket endpoints are
-//! open to CSRF and DNS rebinding. Three layers close the hole. The
-//! [`guard`] middleware wraps the API router: it refuses any request a
-//! browser marks `Sec-Fetch-Site: cross-site`, refuses any request whose
-//! `Host` names a non-loopback authority (a DNS-rebound page's requests
-//! are same-origin under Sec-Fetch and can declare any content type, so
-//! the attacker's hostname in `Host` is the one signal rebinding cannot
-//! forge), and requires body-bearing requests to declare
-//! `application/json`, which forces a CORS preflight no cross-site page
-//! passes. WebSocket upgrades bypass Sec-Fetch in older browsers, so all
-//! three upgrade handlers additionally check the `Origin`. The `/ws` and
-//! `/agents/ws` handlers use [`origin_allowed`]: an `Origin` header, when
-//! present, must be a loopback http(s) origin - which admits both the
-//! desktop app webview (it loads the workshop's own loopback URL) and a
-//! browser tab on the workshop's address, and refuses every foreign site.
-//! The `/v1/realtime` handler is stricter: a browser `Origin` must match
-//! the request's own authority, host and port. A request with no `Origin`
-//! is a native client, not a browser, and passes. `/health` and the UI
-//! assets stay outside the guard so the desktop app probe and heartbeat keep
-//! working.
-
-use axum::extract::Request;
-use axum::http::{HeaderMap, Method, header};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-
-use crate::error::AppError;
-
-/// Refuses cross-site requests, rebound hosts, and non-JSON bodies on the
-/// API router.
-///
-/// A request with `Sec-Fetch-Site: cross-site` or naming a
-/// non-loopback `Host` answers 403; a POST, PUT, or PATCH whose
-/// `Content-Type` is not `application/json` answers 415. Everything else
-/// passes through.
-pub(crate) async fn guard(request: Request, next: Next) -> Response {
-    if request
-        .headers()
-        .get("sec-fetch-site")
-        .is_some_and(|site| site.as_bytes().eq_ignore_ascii_case(b"cross-site"))
-    {
-        return AppError::CrossSite.into_response();
-    }
-    if !host_is_loopback(&request) {
-        return AppError::CrossSite.into_response();
-    }
-    let has_body = [Method::POST, Method::PUT, Method::PATCH].contains(request.method());
-    if has_body && !declares_json(request.headers()) {
-        return AppError::NotJson.into_response();
-    }
-    next.run(request).await
-}
-
-/// Whether the request's authority is loopback, closing DNS rebinding: a
-/// page on a rebound hostname reaches this server with same-origin
-/// Sec-Fetch metadata and a freely chosen content type, but its `Host`
-/// still holds the attacker's name. The URI authority (HTTP/2,
-/// absolute-form) wins over the `Host` header. A request naming no
-/// authority at all passes - browsers always send `Host`, so that is a
-/// native client.
-fn host_is_loopback(request: &Request) -> bool {
-    let authority = match request.uri().authority() {
-        Some(authority) => authority.as_str(),
-        None => match request.headers().get(header::HOST) {
-            Some(host) => match host.to_str() {
-                Ok(host) => host,
-                Err(_) => return false,
-            },
-            None => return true,
-        },
-    };
-    is_loopback_origin(&format!("http://{authority}"))
-}
-
-/// Whether the request declares an `application/json` body, ignoring
-/// parameters such as `charset`.
-fn declares_json(headers: &HeaderMap) -> bool {
-    headers
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .map(|value| value.split(';').next().unwrap_or_default().trim())
-        .is_some_and(|essence| essence.eq_ignore_ascii_case("application/json"))
-}
-
-/// Whether a WebSocket upgrade's `Origin` is acceptable: absent (a native
-/// client), or a loopback http(s) origin - the desktop app webview and the
-/// workshop's own browser-tab origin are both loopback.
-pub(crate) fn origin_allowed(headers: &HeaderMap) -> bool {
-    let Some(origin) = headers.get(header::ORIGIN) else {
-        return true;
-    };
-    origin.to_str().is_ok_and(is_loopback_origin)
-}
-
-/// Whether `origin` parses as an http(s) URL whose host is loopback. The
-/// opaque `null` origin (sandboxed iframes) does not parse and is refused.
-fn is_loopback_origin(origin: &str) -> bool {
-    let Ok(url) = url::Url::parse(origin) else {
-        return false;
-    };
-    if !matches!(url.scheme(), "http" | "https") {
-        return false;
-    }
-    match url.host() {
-        Some(url::Host::Ipv4(address)) => address.is_loopback(),
-        Some(url::Host::Ipv6(address)) => address.is_loopback(),
-        Some(url::Host::Domain(domain)) => domain.eq_ignore_ascii_case("localhost"),
-        None => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use axum::body::Body;
-    use axum::http::{Request, StatusCode};
-    use tokio_tungstenite::tungstenite;
-    use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-    use tower::ServiceExt;
-
-    use crate::app::router;
-    use crate::app::test_helpers::{body_bytes, config_for, state_for};
-
-    #[test]
-    fn loopback_origins_are_allowed() {
-        for origin in [
-            "http://127.0.0.1:7910",
-            "http://127.5.0.1",
-            "http://localhost:7910",
-            "http://LOCALHOST",
-            "http://[::1]:7910",
-            "https://127.0.0.1",
-        ] {
-            assert!(is_loopback_origin(origin), "{origin} must be allowed");
-        }
-    }
-
-    #[test]
-    fn foreign_and_malformed_origins_are_refused() {
-        for origin in [
-            "https://evil.example",
-            "http://192.168.1.10:7910",
-            "https://localhost.evil.example",
-            "file:///etc/passwd",
-            "null",
-            "",
-        ] {
-            assert!(!is_loopback_origin(origin), "{origin} must be refused");
-        }
-    }
-
-    #[test]
-    fn an_absent_origin_is_a_native_client_and_passes() {
-        assert!(origin_allowed(&HeaderMap::new()));
-    }
-
-    /// Reads the `error.code` of a JSON error envelope.
-    async fn envelope_code(response: axum::response::Response) -> String {
-        let body = body_bytes(response).await;
-        let json: serde_json::Value = serde_json::from_slice(&body).expect("the body is JSON");
-        json["error"]["code"]
-            .as_str()
-            .expect("the envelope includes a code")
-            .to_owned()
-    }
-
-    #[tokio::test]
-    async fn cross_site_requests_are_refused_and_health_stays_exempt() {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        let app = router(state);
-        for path in ["/v1/models", "/ws", "/workspace/tree"] {
-            let request = Request::builder()
-                .uri(path)
-                .header("sec-fetch-site", "cross-site")
-                .body(Body::empty())
-                .expect("static request parts are valid");
-            let response = app
-                .clone()
-                .oneshot(request)
-                .await
-                .expect("the router is infallible");
-            assert_eq!(response.status(), StatusCode::FORBIDDEN, "for {path}");
-            assert_eq!(envelope_code(response).await, "cross_site", "for {path}");
-        }
-        for site in ["same-origin", "none"] {
-            let request = Request::builder()
-                .uri("/workspace/tree")
-                .header("sec-fetch-site", site)
-                .body(Body::empty())
-                .expect("static request parts are valid");
-            let response = app
-                .clone()
-                .oneshot(request)
-                .await
-                .expect("the router is infallible");
-            assert_eq!(response.status(), StatusCode::OK, "for {site}");
-        }
-        let request = Request::builder()
-            .uri("/health")
-            .header("sec-fetch-site", "cross-site")
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = app
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(
-            response.status(),
-            StatusCode::OK,
-            "/health stays exempt for the desktop app probe and heartbeat"
-        );
-    }
-
-    #[tokio::test]
-    async fn a_dns_rebound_host_is_refused() {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        let app = router(state);
-        // A rebound page's fetch arrives same-origin under Sec-Fetch with
-        // any content type it likes; only Host betrays it.
-        let request = Request::builder()
-            .uri("/workspace/tree")
-            .header("host", "rebound.example:7910")
-            .header("sec-fetch-site", "same-origin")
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = app
-            .clone()
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(response.status(), StatusCode::FORBIDDEN);
-        assert_eq!(envelope_code(response).await, "cross_site");
-        for host in ["127.0.0.1:7910", "localhost:7910", "[::1]:7910"] {
-            let request = Request::builder()
-                .uri("/workspace/tree")
-                .header("host", host)
-                .body(Body::empty())
-                .expect("static request parts are valid");
-            let response = app
-                .clone()
-                .oneshot(request)
-                .await
-                .expect("the router is infallible");
-            assert_eq!(response.status(), StatusCode::OK, "for {host}");
-        }
-    }
-
-    #[tokio::test]
-    async fn post_bodies_must_declare_json() {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        let app = router(state);
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let body = serde_json::json!({ "path": dir.path() }).to_string();
-
-        let refused = app
-            .clone()
-            .oneshot(
-                Request::builder()
-                    .method("POST")
-                    .uri("/workspace/grant")
-                    .header("content-type", "text/plain")
-                    .body(Body::from(body.clone()))
-                    .expect("static request parts are valid"),
-            )
-            .await
-            .expect("the router is infallible");
-        assert_eq!(refused.status(), StatusCode::UNSUPPORTED_MEDIA_TYPE);
-        assert_eq!(envelope_code(refused).await, "not_json");
-
-        let accepted = app
-            .oneshot(
-                Request::builder()
-                    .method("POST")
-                    .uri("/workspace/grant")
-                    .header("content-type", "application/json; charset=utf-8")
-                    .body(Body::from(body))
-                    .expect("static request parts are valid"),
-            )
-            .await
-            .expect("the router is infallible");
-        assert_eq!(
-            accepted.status(),
-            StatusCode::OK,
-            "a declared JSON body passes the guard, parameters and all"
-        );
-    }
-
-    /// Connects a WebSocket to `path` on the live server with an optional
-    /// `Origin` header, returning the handshake outcome.
-    async fn ws_connect(
-        base: &str,
-        path: &str,
-        origin: Option<&str>,
-    ) -> Result<(), tungstenite::Error> {
-        let address = base.strip_prefix("http://").expect("the URL is http");
-        let mut request = format!("ws://{address}{path}")
-            .into_client_request()
-            .expect("the handshake request builds");
-        if let Some(origin) = origin {
-            request.headers_mut().insert(
-                "origin",
-                origin.parse().expect("the origin is a valid header value"),
-            );
-        }
-        tokio_tungstenite::connect_async(request).await.map(|_| ())
-    }
-
-    #[tokio::test]
-    async fn ws_upgrades_enforce_the_origin_allowlist() {
-        let state_dir = tempfile::TempDir::new().expect("tempdir");
-        let mut config = config_for("http://127.0.0.1:1", state_dir.path());
-        config.server.bind = "127.0.0.1:0".to_string();
-        let server = crate::serve::spawn(config).expect("server spawns");
-        let url = server.url().to_string();
-        for path in ["/ws"] {
-            ws_connect(&url, path, None)
-                .await
-                .expect("a native client with no Origin upgrades");
-            ws_connect(&url, path, Some(&url))
-                .await
-                .expect("the workshop's own loopback origin (the desktop app webview) upgrades");
-            let error = ws_connect(&url, path, Some("https://evil.example"))
-                .await
-                .expect_err("a cross-site origin must be refused");
-            match error {
-                tungstenite::Error::Http(response) => assert_eq!(
-                    response.status(),
-                    tungstenite::http::StatusCode::FORBIDDEN,
-                    "for {path}"
-                ),
-                other => panic!("expected an HTTP 403 refusal for {path}, got {other:?}"),
-            }
-        }
-        server.shutdown().expect("graceful shutdown succeeds");
-    }
-}
diff --git a/crates/workshop/server/src/csp.rs b/crates/workshop/server/src/csp.rs
deleted file mode 100644
index 249df2c29..000000000
--- a/crates/workshop/server/src/csp.rs
+++ /dev/null
@@ -1,157 +0,0 @@
-//! The Content-Security-Policy stamped on every server response.
-//!
-//! The desktop app loads the UI as an External-origin Tauri webview, so
-//! the page's policy is the server's to set: there is no `tauri.conf.json`
-//! CSP for a remote document. The policy keeps the SPA self-contained -
-//! scripts and workers from this origin only - while `connect-src` admits
-//! the two IPC endpoints Tauri calls from an External origin (`ipc:` on
-//! the custom-protocol platforms, `http://ipc.localhost` under WebView2)
-//! and the loopback WebSocket spellings. WebKit does not treat
-//! `connect-src 'self'` as covering WebSockets, so the `ws://` sources
-//! are spelled out for WebKitGTK and WKWebView; the port wildcard covers
-//! the desktop app's OS-assigned bind.
-
-use axum::extract::Request;
-use axum::http::{HeaderValue, header};
-use axum::middleware::Next;
-use axum::response::Response;
-
-/// The policy value, one header for every response.
-///
-/// `img-src` keeps `https:` so model-written markdown can still render
-/// remote images. `style-src` keeps `'unsafe-inline'` because the UI's
-/// styling is partly runtime-injected and cannot be nonced: CodeMirror 6
-/// mounts its modules as `<style>` elements through style-mod, and Shiki
-/// emits inline `style` color attributes, which Chromium gates through
-/// the `style-src-attr` fallback to `style-src`. The directives that gate
-/// code execution and connections stay strict.
-const POLICY: &str = "default-src 'self'; script-src 'self'; \
-                      style-src 'self' 'unsafe-inline'; \
-                      connect-src 'self' ipc: http://ipc.localhost ws://127.0.0.1:* \
-                      ws://localhost:* ws://[::1]:*; img-src 'self' data: blob: https:; \
-                      worker-src 'self'; object-src 'none'; base-uri 'none'; \
-                      frame-ancestors 'none'";
-
-/// The same policy with self-framing allowed, for the proxied config SPA
-/// only: the Gateway Config panel iframes `/gateway/config/` from the
-/// workshop window, and `frame-ancestors 'none'` makes Chromium refuse
-/// the frame outright ("refused to connect"). `'self'` admits the
-/// same-origin desktop app and still forbids every foreign framer.
-const POLICY_FRAMEABLE: &str = "default-src 'self'; script-src 'self'; \
-                      style-src 'self' 'unsafe-inline'; \
-                      connect-src 'self' ipc: http://ipc.localhost ws://127.0.0.1:* \
-                      ws://localhost:* ws://[::1]:*; img-src 'self' data: blob: https:; \
-                      worker-src 'self'; object-src 'none'; base-uri 'none'; \
-                      frame-ancestors 'self'";
-
-/// Middleware stamping `Content-Security-Policy` on every response,
-/// including error envelopes. The proxied config SPA (`/gateway/config/`)
-/// receives the self-frameable variant; everything else forbids framing.
-pub(crate) async fn header(request: Request, next: Next) -> Response {
-    let frameable = request.uri().path().starts_with("/gateway/config/");
-    let mut response = next.run(request).await;
-    response.headers_mut().insert(
-        header::CONTENT_SECURITY_POLICY,
-        HeaderValue::from_static(if frameable { POLICY_FRAMEABLE } else { POLICY }),
-    );
-    response
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use axum::body::Body;
-    use axum::http::{Request, StatusCode};
-    use tower::ServiceExt;
-
-    use crate::app::router;
-    use crate::app::test_helpers::state_for;
-
-    /// Fetches `uri` against the composed router and returns the response.
-    async fn get(uri: &str) -> axum::response::Response {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        router(state)
-            .oneshot(
-                Request::builder()
-                    .uri(uri)
-                    .body(Body::empty())
-                    .expect("static request parts are valid"),
-            )
-            .await
-            .expect("the router is infallible")
-    }
-
-    #[tokio::test]
-    async fn every_response_is_stamped_with_the_policy() {
-        // The UI document, its asset, the health probe, and an API error
-        // envelope: the header is stamped at the composition root, so no
-        // response class escapes it.
-        for uri in ["/", "/app.js", "/health", "/workspace/tree"] {
-            let response = get(uri).await;
-            let value = response
-                .headers()
-                .get(header::CONTENT_SECURITY_POLICY)
-                .unwrap_or_else(|| panic!("{uri} is stamped with the policy"));
-            assert_eq!(value, POLICY, "{uri} is stamped with the exact policy");
-        }
-    }
-
-    #[tokio::test]
-    async fn the_proxied_config_spa_allows_self_framing() {
-        // The Gateway Config panel iframes `/gateway/config/` from the
-        // workshop window; `frame-ancestors 'none'` there makes Chromium
-        // refuse the frame ("refused to connect"). The gateway is
-        // unreachable in this fixture, so the answer is a 502 - the
-        // middleware stamps the header on error envelopes too, which is
-        // the point: the policy must not depend on the proxy's outcome.
-        let response = get("/gateway/config/").await;
-        let value = response
-            .headers()
-            .get(header::CONTENT_SECURITY_POLICY)
-            .expect("the proxied config route is stamped with the policy");
-        assert_eq!(value, POLICY_FRAMEABLE, "self-framing for the panel");
-    }
-
-    #[tokio::test]
-    async fn the_policy_admits_tauri_ipc_and_the_loopback_socket() {
-        let response = get("/health").await;
-        assert_eq!(response.status(), StatusCode::OK);
-        let policy = response
-            .headers()
-            .get(header::CONTENT_SECURITY_POLICY)
-            .expect("the policy header is present")
-            .to_str()
-            .expect("the policy is ASCII");
-        // The break this pins: drop the IPC sources and the desktop app webview's
-        // Tauri calls fail closed from the External origin.
-        assert!(
-            policy.contains("connect-src 'self' ipc: http://ipc.localhost"),
-            "connect-src admits the Tauri IPC endpoints: {policy}"
-        );
-        assert!(
-            policy.contains("ws://127.0.0.1:*"),
-            "connect-src admits the loopback WebSocket: {policy}"
-        );
-    }
-
-    #[tokio::test]
-    async fn the_policy_admits_runtime_injected_styles() {
-        let response = get("/health").await;
-        let policy = response
-            .headers()
-            .get(header::CONTENT_SECURITY_POLICY)
-            .expect("the policy header is present")
-            .to_str()
-            .expect("the policy is ASCII");
-        // The break this pins: a self-only style policy refuses the
-        // `<style>` elements CodeMirror 6 mounts through style-mod and
-        // the inline `style` color attributes Shiki emits (Chromium gates
-        // attributes through the style-src-attr fallback), leaving the
-        // editor unstyled and code blocks uncolored.
-        assert!(
-            policy.contains("style-src 'self' 'unsafe-inline'"),
-            "style-src admits the UI's runtime-injected styles: {policy}"
-        );
-    }
-}
diff --git a/crates/workshop/server/src/error.rs b/crates/workshop/server/src/error.rs
deleted file mode 100644
index 2d324664a..000000000
--- a/crates/workshop/server/src/error.rs
+++ /dev/null
@@ -1,234 +0,0 @@
-//! The opaque wire error every HTTP failure answers with.
-//!
-//! [`AppError`] is the boundary between the server's failures and the HTTP
-//! response: one variant per wire failure, each mapped to one status
-//! code by the central [`IntoResponse`] impl, so the same failure is
-//! built in one place no matter which handler hits it.
-//! Conversions in are explicit - handler seams name a variant constructor;
-//! no `#[from]` derive exists on this side of the boundary. The feature
-//! crates map their own error types at their own route boundaries
-//! (`workshop_workspace::WorkspaceError`, the sessions relay's gateway
-//! envelope); this server type covers the server's own routes.
-//! Internal failure detail (the source chain) reaches the response body in
-//! debug builds only; production bodies stay at each variant's own message,
-//! close to the status text. Rich construction-time errors sit elsewhere
-//! ([`workshop_support::ConfigError`], [`crate::serve::SpawnError`]) and
-//! never cross the wire.
-
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-
-use runvil::{Error, ErrorCode};
-use workshop_gateway::GatewayError;
-use workshop_protocol::ErrorEnvelope;
-use workshop_support::{LEAK_DETAIL, envelope_response, render_message};
-
-/// A failure answered over the HTTP wire.
-///
-/// Every variant renders as exactly one status code. Variants with a
-/// source keep it out of `Display`; [`render_message`] appends the chain to
-/// the response body in debug builds only.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub(crate) enum AppError {
-    /// An attempted gateway call failed in transport. Transparent so the
-    /// wire message stays the [`GatewayError`]'s own summary line.
-    #[error(transparent)]
-    Gateway(GatewayError),
-
-    /// The request arrived from a cross-site browser context: a
-    /// `Sec-Fetch-Site: cross-site` marking, a non-loopback `Host`
-    /// (DNS rebinding), or a foreign WebSocket `Origin` (see
-    /// [`crate::cross_site`]).
-    #[error("cross-site request refused")]
-    CrossSite,
-
-    /// A body-bearing request did not declare an `application/json` body.
-    #[error("request body is not application/json")]
-    NotJson,
-
-    /// The config-panel proxy refused to forward a path outside its
-    /// allowlist (see [`crate::routes::gateway_config`]).
-    #[error("path is not forwardable to the gateway")]
-    ForwardDenied,
-
-    /// An embedded UI asset is missing from the bundle.
-    #[error("ui asset not found: {0}")]
-    AssetMissing(String),
-
-    /// A posted prompt failed to parse; the code names the failure's code
-    /// and the message carries the parser's `line N: ` prefix.
-    #[error("{message}")]
-    PromptParse {
-        /// The pre-rendered message, including the `line N: ` prefix when
-        /// the parser located the failure in the prompt.
-        message: String,
-        /// The wire code for the parse failure's code.
-        code: &'static str,
-    },
-}
-
-impl AppError {
-    /// Builds the wire error for a prompt that failed to parse: the code
-    /// names the failure's code and the message carries the parser's
-    /// `line N: ` prefix, the line the failure starts on, when it located
-    /// the failure in the prompt. An internal failure's location is a Rust
-    /// line, so its message has no prefix.
-    pub(crate) fn prompt_parse(error: &Error) -> Self {
-        let code = match error.code {
-            ErrorCode::FrontmatterInvalid => "parse_frontmatter",
-            ErrorCode::StructureInvalid => "parse_structure",
-            ErrorCode::FenceInvalid => "parse_fence",
-            ErrorCode::LuaCompile => "parse_lua",
-            ErrorCode::Internal => "parse_internal",
-            // Any other code has no wire code of its own.
-            _ => "parse_error",
-        };
-        let message = match &error.at {
-            Some(at) if error.code != ErrorCode::Internal => {
-                format!("line {}: {}", at.start_line, error.message)
-            }
-            _ => error.message.clone(),
-        };
-        Self::PromptParse { message, code }
-    }
-
-    /// The one HTTP status this failure answers with.
-    fn status(&self) -> StatusCode {
-        match self {
-            Self::Gateway(_) => StatusCode::BAD_GATEWAY,
-            Self::CrossSite | Self::ForwardDenied => StatusCode::FORBIDDEN,
-            Self::NotJson => StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            Self::PromptParse { .. } => StatusCode::UNPROCESSABLE_ENTITY,
-            Self::AssetMissing(_) => StatusCode::NOT_FOUND,
-        }
-    }
-
-    /// The machine-readable code of the JSON error envelope, or `None` for
-    /// the failures rendered as plain text instead of the envelope.
-    fn code(&self) -> Option<&'static str> {
-        match self {
-            Self::Gateway(_) => Some("gateway_unreachable"),
-            Self::CrossSite => Some("cross_site"),
-            Self::NotJson => Some("not_json"),
-            Self::ForwardDenied => Some("forward_denied"),
-            Self::PromptParse { code, .. } => Some(code),
-            Self::AssetMissing(_) => None,
-        }
-    }
-}
-
-impl IntoResponse for AppError {
-    fn into_response(self) -> Response {
-        let status = self.status();
-        match self.code() {
-            Some(code) => {
-                let envelope = ErrorEnvelope::new(render_message(&self, LEAK_DETAIL), code);
-                envelope_response(status, &envelope)
-            }
-            None => (
-                status,
-                [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-                self.to_string(),
-            )
-                .into_response(),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use std::io;
-
-    use crate::app::test_helpers::body_bytes;
-
-    /// A distinctive injected cause for leak-boundary assertions.
-    fn injected_io() -> io::Error {
-        io::Error::other("injected disk failure")
-    }
-
-    #[test]
-    fn gateway_failures_map_to_bad_gateway() {
-        let transport =
-            AppError::Gateway(GatewayError::transport_for_test(Box::new(injected_io())));
-        assert_eq!(transport.status(), StatusCode::BAD_GATEWAY);
-        assert_eq!(transport.code(), Some("gateway_unreachable"));
-    }
-
-    #[test]
-    fn the_asset_miss_maps_to_not_found_with_no_envelope_code() {
-        let miss = AppError::AssetMissing("app.js".to_string());
-        assert_eq!(miss.status(), StatusCode::NOT_FOUND);
-        assert_eq!(miss.code(), None, "the asset 404 is plain text, not JSON");
-    }
-
-    #[tokio::test]
-    async fn the_json_envelope_has_message_code_and_content_type() {
-        let response = AppError::CrossSite.into_response();
-        assert_eq!(response.status(), StatusCode::FORBIDDEN);
-        let content_type = response
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .expect("the envelope sets content-type");
-        assert_eq!(content_type, "application/json");
-        let body = body_bytes(response).await;
-        let json: serde_json::Value = serde_json::from_slice(&body).expect("the envelope is JSON");
-        assert_eq!(
-            json["error"]["message"], "cross-site request refused",
-            "the pinned user-visible message is identical in every build"
-        );
-        assert_eq!(json["error"]["code"], "cross_site");
-    }
-
-    #[tokio::test]
-    async fn the_asset_miss_renders_the_plain_text_diagnostic() {
-        let response = AppError::AssetMissing("app.js".to_string()).into_response();
-        assert_eq!(response.status(), StatusCode::NOT_FOUND);
-        let content_type = response
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .expect("the diagnostic sets content-type");
-        assert_eq!(content_type, "text/plain; charset=utf-8");
-        assert_eq!(
-            &body_bytes(response).await[..],
-            b"ui asset not found: app.js"
-        );
-    }
-
-    #[test]
-    fn production_messages_stay_at_the_variant_text() {
-        let gateway = AppError::Gateway(GatewayError::transport_for_test(Box::new(injected_io())));
-        assert_eq!(
-            render_message(&gateway, false),
-            "gateway transport error",
-            "the transport failure keeps its pre-split production message"
-        );
-    }
-
-    #[test]
-    fn debug_messages_append_the_source_chain() {
-        let gateway = AppError::Gateway(GatewayError::transport_for_test(Box::new(injected_io())));
-        assert_eq!(
-            render_message(&gateway, true),
-            "gateway transport error: injected disk failure"
-        );
-    }
-
-    /// Tests run under debug assertions, so the live envelope must
-    /// include the detail the debug side of the boundary promises, in
-    /// the exact message format.
-    #[cfg(debug_assertions)]
-    #[tokio::test]
-    async fn debug_builds_leak_detail_into_the_live_envelope() {
-        let response = AppError::Gateway(GatewayError::transport_for_test(Box::new(injected_io())))
-            .into_response();
-        let body = body_bytes(response).await;
-        let json: serde_json::Value = serde_json::from_slice(&body).expect("the envelope is JSON");
-        assert_eq!(
-            json["error"]["message"],
-            "gateway transport error: injected disk failure"
-        );
-    }
-}
diff --git a/crates/workshop/server/src/fixtures.rs b/crates/workshop/server/src/fixtures.rs
deleted file mode 100644
index 4dc380ff8..000000000
--- a/crates/workshop/server/src/fixtures.rs
+++ /dev/null
@@ -1,75 +0,0 @@
-//! Integration-test seams that exercise Workshop behavior in-process.
-
-#[cfg(feature = "test-fixtures")]
-pub use crate::app::state_with_gateway_and_restart_bound;
-pub use crate::app::{Omit, state_with_gateway, state_with_gateway_omitting};
-pub use workshop_gateway::{GatewayHealth, Heartbeat};
-pub use workshop_menu::catalog::CatalogBus;
-pub use workshop_menu::menu::{MenuBus, MenuRefusal};
-pub use workshop_protocol::{Activity, Severity, StatusBarUpdate};
-pub use workshop_registry::Push;
-pub use workshop_status::status::StatusBus;
-pub use workshop_support::ReconnectBackoff;
-
-#[cfg(feature = "test-fixtures")]
-pub use crate::app::test_helpers::spawn_gateway;
-#[cfg(feature = "test-fixtures")]
-pub use workshop_gateway::test_gateway::{ValidatedGateway, run_validated_gateway_fixture_process};
-
-/// Returns the embedding binary's restricted Gateway publisher from fixture state.
-#[cfg(feature = "test-fixtures")]
-#[must_use]
-pub fn gateway_updater(state: &crate::AppState) -> crate::GatewayUpdater {
-    state.gateway_updater()
-}
-
-/// Replaces a configured Gateway fixture without creating a production
-/// sidecar capability.
-///
-/// # Errors
-/// Returns [`crate::GatewayPublicationError::Build`] when the fixture client
-/// cannot initialize, or
-/// [`crate::GatewayPublicationError::PublicationClosed`] after teardown.
-#[cfg(feature = "test-fixtures")]
-pub fn replace_gateway(
-    updater: &crate::GatewayUpdater,
-    base_url: &str,
-    api_key: &str,
-) -> Result<(), crate::GatewayPublicationError> {
-    updater.replace_fixture(base_url, api_key)
-}
-
-/// Starts a heartbeat around a fixture Gateway client.
-#[cfg(feature = "test-fixtures")]
-#[must_use]
-pub fn spawn_heartbeat(
-    client: workshop_gateway::GatewayClient,
-    push: Push,
-    health: GatewayHealth,
-    interval: std::time::Duration,
-    backoff: ReconnectBackoff,
-) -> Heartbeat {
-    workshop_gateway::spawn_heartbeat(
-        workshop_gateway::GatewayBinding::from_client(client),
-        push,
-        health,
-        interval,
-        backoff,
-    )
-}
-
-/// The named child-process half of [`ValidatedGateway`]: the fixture
-/// spawns a copy of this test binary with this test's name, so the name
-/// must stay in sync with the `spawn_in` call sites.
-#[cfg(test)]
-#[test]
-#[ignore = "runs only as a named child process"]
-fn validated_gateway_fixture_process() {
-    run_validated_gateway_fixture_process();
-}
-
-/// Spawns a Workshop test server against the explicit configured Gateway.
-#[cfg(feature = "test-fixtures")]
-pub fn spawn(config: crate::Config) -> Result<crate::ServerHandle, crate::SpawnError> {
-    crate::serve::spawn_resolved(config)
-}
diff --git a/crates/workshop/server/src/lib.rs b/crates/workshop/server/src/lib.rs
deleted file mode 100644
index 3351ed11e..000000000
--- a/crates/workshop/server/src/lib.rs
+++ /dev/null
@@ -1,92 +0,0 @@
-//! Runvil Workshop HTTP server.
-//!
-//! Holds the `workshop.toml` configuration, the Runvil gateway client,
-//! and the axum router. Start at
-//! [`Config::load`] for configuration, `AgentSessions` for the
-//! agent-session launcher behind `/agents/ws` (each conversation's run
-//! is a Harness of its own, reached through `runvil`), and [`router`]
-//! for the HTTP API; [`spawn`] runs the whole server in-process on its
-//! own thread for embedding binaries.
-//!
-//! The crate is the composition root of the workshop server
-//! decomposition: the feature subsystems (`workshop-user-state`,
-//! `workshop-workspace`, and the agent-sessions subsystem in `agents`,
-//! which serves the `/agents/ws` agent-session socket and the
-//! `/v1/models` catalog relay, owns that socket's wire frames in
-//! `agents::wire`, builds each conversation's run over `workshop-agents`,
-//! the conversation layer, and records every run in the run log of
-//! `workshop-run-log`), the `/ws` workshop socket in
-//! `workshop_socket` (the two sockets share `websocket`), the
-//! domain services (`workshop-gateway`, `workshop-status`,
-//! `workshop-menu`), and the vocabulary crates (`workshop-protocol`,
-//! `workshop-registry`, `workshop-support`) are assembled in `app`
-//! (helpers in `app::compose`), where every subsystem self-registers its
-//! routes, state handles, and push channels into the registry.
-//!
-//! ## Invariants
-//!
-//! - Tier: server; may depend on: the vocabulary crates
-//!   (`workshop-gateway-discovery`, `workshop-protocol`,
-//!   `workshop-registry`, `workshop-support`),
-//!   the service crates (`workshop-gateway`, `workshop-menu`,
-//!   `workshop-status`), the feature crates (`workshop-agents`,
-//!   `workshop-run-log`, `workshop-user-state`, `workshop-workspace`),
-//!   the Harness's public crates `runvil` and `harness-gateway-client`,
-//!   the Plugin crates `plugin-web` and `plugin-mcp`, and
-//!   `workshop-plugin-std` and `workshop-plugin-bashkit`, the libraries
-//!   of the std Plugin and the bashkit Plugin, which the server loads
-//!   from its Plugin directory and never links.
-//!   It reaches the Engine and the Plugin contract through `runvil`
-//!   alone, never through an Engine crate.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries. Read `crates/workshop/server/AGENTS.md` before adding an
-//!   import.
-//! - One task owns each socket: a single `select!` loop reads inbound
-//!   frames and writes every outbound frame itself - no outbox channel,
-//!   no writer task. Agent conversations are the documented carve-out:
-//!   they outlive sockets on purpose.
-//! - Status-bar reporting for a conversation is derived in the server
-//!   from the conversation's events, deltas, and failure reports.
-//! - The workspace's granted roots are read through the registry's
-//!   `WorkspaceRoots` slot, never by naming the workspace crate's
-//!   internals: subsystems meet through the registry.
-//! - Every API route sits behind `cross_site::guard`, which refuses
-//!   cross-site requests and any `Host` that names a non-loopback
-//!   authority; `/health` and the UI assets stay outside it.
-//! - Every WebSocket upgrade checks its `Origin`: `/ws` and `/agents/ws`
-//!   admit any loopback origin through `cross_site::origin_allowed`, and
-//!   `/v1/realtime` applies a stricter same-origin check that requires a
-//!   browser `Origin` to match the request's own authority. The
-//!   cross-site guard stays the security boundary.
-//! - Every conversation's run has a user: it holds `runvil/user`, and the
-//!   operator's messages reach its main chain only through its
-//!   conversation.
-
-mod agents;
-mod app;
-mod assets;
-mod cross_site;
-mod csp;
-mod error;
-mod routes;
-mod serve;
-mod websocket;
-mod workshop_socket;
-
-/// Crate-internal test seams, re-exported to the integration-test binary.
-/// The socket behavior tests drive the status, catalog, and menu buses,
-/// the health flag, the backoff, and the heartbeat directly, so those
-/// types surface here, hidden from the docs. The module exists only in
-/// test builds and under the `test-fixtures` feature, which the crate's
-/// own dev-dependency enables for every test build while production
-/// builds do not.
-#[cfg(any(test, feature = "test-fixtures"))]
-#[doc(hidden)]
-pub mod fixtures;
-
-pub use agents::{PluginListing, list_plugin_dir};
-pub use app::{AppState, router};
-pub use serve::{ServerHandle, SpawnError, Termination, spawn};
-pub use workshop_gateway::discovery;
-pub use workshop_gateway::{GatewayPublicationError, GatewayUpdater, ResolvedGateway};
-pub use workshop_support::{AgentsConfig, Config, GatewayConfig, ServerConfig};
diff --git a/crates/workshop/server/src/routes.rs b/crates/workshop/server/src/routes.rs
deleted file mode 100644
index 92c700796..000000000
--- a/crates/workshop/server/src/routes.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-//! Per-feature route constructors, one child module per domain, composed
-//! into the full router by [`crate::app::router`]. The feature
-//! subsystems (`/ws`, `/agents/ws`, `/v1/models`, `/workspace/*`,
-//! `/user/state`) self-register their routes through the registry
-//! instead of appearing here.
-
-pub(crate) mod assets;
-pub(crate) mod gateway_config;
-pub(crate) mod health;
-pub(crate) mod prompts;
-pub(crate) mod realtime;
diff --git a/crates/workshop/server/src/routes/assets-tests.rs b/crates/workshop/server/src/routes/assets-tests.rs
deleted file mode 100644
index 65d87e2b8..000000000
--- a/crates/workshop/server/src/routes/assets-tests.rs
+++ /dev/null
@@ -1,287 +0,0 @@
-//! Asset route tests: content types, cache headers, hashed bundles, and chunk-path confinement.
-
-use axum::body::Body;
-use axum::http::{Request, Response, StatusCode, header};
-use tower::ServiceExt;
-
-use crate::app::router;
-use crate::app::test_helpers::{body_bytes, state_for};
-
-/// Performs one GET against the router and returns the response.
-async fn get(uri: &str) -> Response<Body> {
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri(uri)
-        .body(Body::empty())
-        .unwrap_or_else(|_| panic!("static request parts are valid"));
-    router(state)
-        .oneshot(request)
-        .await
-        .unwrap_or_else(|_| panic!("the router is infallible"))
-}
-
-/// The response's Cache-Control value.
-fn cache_control(response: &Response<Body>) -> &header::HeaderValue {
-    response
-        .headers()
-        .get(header::CACHE_CONTROL)
-        .unwrap_or_else(|| panic!("the response sets cache-control"))
-}
-
-/// The build's asset manifest: the logical-to-hashed name map the UI
-/// build emits next to the bundle.
-fn asset_manifest() -> serde_json::Value {
-    let asset = crate::assets::UiAssets::get("manifest.json")
-        .unwrap_or_else(|| panic!("the UI build emits manifest.json"));
-    serde_json::from_slice(&asset.data)
-        .unwrap_or_else(|error| panic!("manifest.json is valid JSON: {error}"))
-}
-
-/// The manifest's hashed bundle target for one logical name.
-fn manifest_target(logical: &str) -> String {
-    asset_manifest()[logical]
-        .as_str()
-        .unwrap_or_else(|| panic!("the manifest maps {logical}"))
-        .to_string()
-}
-
-/// Asserts a static UI route answers 200 with the expected content type
-/// and a non-empty body.
-async fn assert_ui_asset(uri: &str, expected_content_type: &str) {
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri(uri)
-        .body(Body::empty())
-        .unwrap_or_else(|_| panic!("static request parts are valid"));
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .unwrap_or_else(|_| panic!("the router is infallible"));
-    assert_eq!(response.status(), StatusCode::OK, "{uri} serves");
-    let content_type = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .unwrap_or_else(|| panic!("{uri} sets content-type"));
-    assert_eq!(content_type, expected_content_type, "{uri} content type");
-    assert!(
-        !body_bytes(response).await.is_empty(),
-        "{uri} body is non-empty"
-    );
-}
-
-/// Every asset must force revalidation: the bundle is unversioned, so
-/// a heuristic cache with no validator serves a stale script against a
-/// newer server.
-#[tokio::test]
-async fn every_asset_forces_revalidation() {
-    for uri in [
-        "/",
-        "/app.js",
-        "/style.css",
-        "/app.css",
-        "/pcm-worklet.js",
-        "/icons/runvil-icon.png",
-        "/icons/runvil-icon@2x.png",
-    ] {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        let request = Request::builder()
-            .uri(uri)
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = router(state).oneshot(request).await.expect("infallible");
-        let cache_control = response
-            .headers()
-            .get(header::CACHE_CONTROL)
-            .unwrap_or_else(|| panic!("{uri} sets cache-control"));
-        assert_eq!(cache_control, "no-cache", "{uri} cache-control");
-    }
-}
-
-#[tokio::test]
-async fn index_is_served_at_the_root() {
-    assert_ui_asset("/", "text/html; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn app_js_is_served_as_javascript() {
-    assert_ui_asset("/app.js", "text/javascript; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn style_css_is_served_as_css() {
-    assert_ui_asset("/style.css", "text/css; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn bundled_app_css_is_served_as_css() {
-    assert_ui_asset("/app.css", "text/css; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn pcm_worklet_is_served_as_javascript() {
-    assert_ui_asset("/pcm-worklet.js", "text/javascript; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn program_icon_is_served_as_png() {
-    assert_ui_asset("/icons/runvil-icon.png", "image/png").await;
-}
-
-#[tokio::test]
-async fn program_icon_2x_is_served_as_png() {
-    assert_ui_asset("/icons/runvil-icon@2x.png", "image/png").await;
-}
-
-/// The code-split chunks have content-hashed names, so the test discovers
-/// one through the embedded asset listing rather than naming it.
-fn first_chunk_name(extension: &str) -> String {
-    crate::assets::UiAssets::iter()
-        .map(std::borrow::Cow::into_owned)
-        .find(|name| name.starts_with("chunks/") && name.ends_with(extension))
-        .unwrap_or_else(|| panic!("the UI build emits a chunks/*{extension} chunk"))
-}
-
-#[tokio::test]
-async fn a_code_split_chunk_is_served_as_javascript() {
-    let name = first_chunk_name(".js");
-    assert_ui_asset(&format!("/{name}"), "text/javascript; charset=utf-8").await;
-}
-
-#[tokio::test]
-async fn a_chunk_without_a_bundle_extension_is_not_found() {
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri("/chunks/app.toml")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state).oneshot(request).await.expect("infallible");
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn a_chunk_name_cannot_escape_the_asset_root() {
-    // The wildcard captures the remainder raw; ui_asset's own tests pin
-    // traversal refusal for the names it is handed. Here the route must
-    // not 500 on a hostile name.
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri("/chunks/..%2F..%2FCargo.toml")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state).oneshot(request).await.expect("infallible");
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn a_missing_chunk_is_not_found() {
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri("/chunks/chunk-DEADBEEF00.js")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state).oneshot(request).await.expect("infallible");
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn the_manifest_maps_logical_names_to_hashed_bundle_files() {
-    let manifest = asset_manifest();
-    for (logical, extension) in [("app.js", ".js"), ("app.css", ".css")] {
-        let target = manifest[logical]
-            .as_str()
-            .unwrap_or_else(|| panic!("the manifest maps {logical}"));
-        assert!(
-            target.starts_with("bundle/app-") && target.ends_with(extension),
-            "{logical} maps to a content-hashed bundle file, got {target:?}"
-        );
-        assert!(
-            crate::assets::UiAssets::get(target).is_some(),
-            "the manifest target {target:?} exists in the bundle"
-        );
-    }
-}
-
-#[tokio::test]
-async fn the_index_page_references_the_hashed_bundle() {
-    let response = get("/").await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let html = String::from_utf8(body_bytes(response).await.to_vec()).expect("index.html is UTF-8");
-    let script = manifest_target("app.js");
-    let styles = manifest_target("app.css");
-    assert!(
-        html.contains(&format!("src=\"/{script}\"")),
-        "index.html loads the hashed script {script:?}"
-    );
-    assert!(
-        html.contains(&format!("href=\"/{styles}\"")),
-        "index.html loads the hashed styles {styles:?}"
-    );
-    assert!(
-        !html.contains("src=\"/app.js\""),
-        "index.html never references the unversioned script"
-    );
-}
-
-#[tokio::test]
-async fn the_logical_app_routes_serve_the_hashed_bytes() {
-    for (uri, logical) in [("/app.js", "app.js"), ("/app.css", "app.css")] {
-        let response = get(uri).await;
-        assert_eq!(response.status(), StatusCode::OK, "{uri} serves");
-        assert_eq!(
-            cache_control(&response),
-            "no-cache",
-            "{uri} is a stable URL and must revalidate"
-        );
-        let expected = crate::assets::UiAssets::get(&manifest_target(logical))
-            .expect("the manifest target exists");
-        assert_eq!(
-            &body_bytes(response).await[..],
-            &expected.data[..],
-            "{uri} serves the manifest target's bytes"
-        );
-    }
-}
-
-#[tokio::test]
-async fn hashed_bundle_assets_are_cached_immutably() {
-    for logical in ["app.js", "app.css"] {
-        let target = manifest_target(logical);
-        let response = get(&format!("/{target}")).await;
-        assert_eq!(response.status(), StatusCode::OK, "/{target} serves");
-        assert_eq!(
-            cache_control(&response),
-            "public, max-age=31536000, immutable",
-            "/{target} is content-hashed, so its URL never changes meaning"
-        );
-    }
-}
-
-#[tokio::test]
-async fn a_code_split_chunk_is_cached_immutably() {
-    let name = first_chunk_name(".js");
-    let response = get(&format!("/{name}")).await;
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        cache_control(&response),
-        "public, max-age=31536000, immutable",
-        "chunk names are content-hashed, so their URLs never change meaning"
-    );
-}
-
-#[tokio::test]
-async fn a_bundle_name_without_a_bundle_extension_is_not_found() {
-    let response = get("/bundle/app.toml").await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn a_bundle_name_cannot_escape_the_asset_root() {
-    let response = get("/bundle/..%2F..%2FCargo.toml").await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn a_missing_bundle_file_is_not_found() {
-    let response = get("/bundle/app-DEADBEEF00.js").await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-}
diff --git a/crates/workshop/server/src/routes/assets.rs b/crates/workshop/server/src/routes/assets.rs
deleted file mode 100644
index 56793fd6e..000000000
--- a/crates/workshop/server/src/routes/assets.rs
+++ /dev/null
@@ -1,159 +0,0 @@
-//! Routes serving the embedded workshop UI assets.
-
-use axum::Router;
-use axum::extract::Path;
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-
-use crate::assets::{self, CachePolicy};
-use crate::error::AppError;
-
-/// The UI asset routes: the index page, the bundled script and styles
-/// (stable logical routes resolving through the build's manifest, plus
-/// the content-hashed `bundle/` files the stamped index page loads
-/// directly), the code-split chunks the bundle lazy-loads, the PCM
-/// worklet, and the program icon at 1x and 2x. Stateless: every response
-/// comes straight from the [`EmbeddedAssets`](assets::EmbeddedAssets).
-pub(crate) fn routes() -> Router {
-    Router::new()
-        .route("/", get(ui_index))
-        .route("/app.js", get(ui_app_js))
-        .route("/app.css", get(ui_app_css))
-        .route("/style.css", get(ui_style_css))
-        .route("/pcm-worklet.js", get(ui_pcm_worklet))
-        .route("/bundle/{*name}", get(ui_bundle))
-        .route("/chunks/{*name}", get(ui_chunk))
-        .route("/icons/runvil-icon.png", get(ui_program_icon))
-        .route("/icons/runvil-icon@2x.png", get(ui_program_icon_2x))
-}
-
-/// Serves the chat UI's `index.html`.
-async fn ui_index() -> Response {
-    assets::ui_asset(
-        "index.html",
-        "text/html; charset=utf-8",
-        CachePolicy::Revalidate,
-    )
-}
-
-/// Serves the bundled application script through the stable logical
-/// route: the build's manifest maps `app.js` to the current
-/// content-hashed file, whose bytes this answers with. The URL keeps its
-/// meaning across builds, so the response must revalidate; the stamped
-/// index page loads the hashed URL (immutable) directly.
-async fn ui_app_js() -> Response {
-    logical_asset("app.js", "text/javascript; charset=utf-8")
-}
-
-/// Serves the stylesheet esbuild extracts from the bundle's CSS imports
-/// (the dockview styles and the workshop components' colocated CSS),
-/// through the same manifest resolution as the script.
-async fn ui_app_css() -> Response {
-    logical_asset("app.css", "text/css; charset=utf-8")
-}
-
-/// Serves one logical bundle route by resolving the build manifest to
-/// the current hashed file.
-fn logical_asset(logical: &str, content_type: &'static str) -> Response {
-    let Some(manifest) = assets::EmbeddedAssets::manifest() else {
-        return AppError::AssetMissing(logical.to_string()).into_response();
-    };
-    let Some(target) = manifest.resolve(logical) else {
-        return AppError::AssetMissing(logical.to_string()).into_response();
-    };
-    assets::ui_asset(target, content_type, CachePolicy::Revalidate)
-}
-
-/// Serves the chat UI's own stylesheet.
-async fn ui_style_css() -> Response {
-    assets::ui_asset(
-        "style.css",
-        "text/css; charset=utf-8",
-        CachePolicy::Revalidate,
-    )
-}
-
-/// Serves the AudioWorklet PCM capture processor.
-async fn ui_pcm_worklet() -> Response {
-    assets::ui_asset(
-        "pcm-worklet.js",
-        "text/javascript; charset=utf-8",
-        CachePolicy::Revalidate,
-    )
-}
-
-/// The content type for one wildcard-served bundle file, or None when
-/// the extension is not one esbuild emits.
-fn bundle_content_type(name: &str) -> Option<&'static str> {
-    let extension_is = |expected: &str| {
-        std::path::Path::new(name)
-            .extension()
-            .is_some_and(|extension| extension.eq_ignore_ascii_case(expected))
-    };
-    if extension_is("js") {
-        Some("text/javascript; charset=utf-8")
-    } else if extension_is("css") {
-        Some("text/css; charset=utf-8")
-    } else {
-        None
-    }
-}
-
-/// Serves one content-hashed entry file. esbuild emits the entry (and
-/// its extracted stylesheet) under `bundle/` with content-hashed names,
-/// so the routes cannot name them individually; the wildcard stays inside
-/// the embedded asset root through [`assets::ui_asset`], and only the two
-/// kinds esbuild emits are served. The names change with the content, so
-/// the responses are cached immutably.
-async fn ui_bundle(Path(name): Path<String>) -> Response {
-    let Some(content_type) = bundle_content_type(&name) else {
-        return AppError::AssetMissing(format!("bundle/{name}")).into_response();
-    };
-    assets::ui_asset(
-        &format!("bundle/{name}"),
-        content_type,
-        CachePolicy::Immutable,
-    )
-}
-
-/// Serves one code-split bundle chunk. esbuild emits the lazily loaded
-/// feature chunks (the agent session's Shiki/TipTap graph, the editor's
-/// CodeMirror) under `chunks/` with content-hashed names, so the routes
-/// cannot name them individually; the wildcard stays inside the embedded
-/// asset root through [`assets::ui_asset`], and only the two kinds
-/// esbuild emits are served. The names change with the content, so the
-/// responses are cached immutably.
-async fn ui_chunk(Path(name): Path<String>) -> Response {
-    let Some(content_type) = bundle_content_type(&name) else {
-        return AppError::AssetMissing(format!("chunks/{name}")).into_response();
-    };
-    assets::ui_asset(
-        &format!("chunks/{name}"),
-        content_type,
-        CachePolicy::Immutable,
-    )
-}
-
-/// Serves the program icon shown in the custom title bar at 1x (128 px),
-/// the `src` of the title bar `<img>`.
-async fn ui_program_icon() -> Response {
-    assets::ui_asset(
-        "icons/runvil-icon.png",
-        "image/png",
-        CachePolicy::Revalidate,
-    )
-}
-
-/// Serves the program icon at 2x (256 px), the title bar's `srcset`
-/// entry for high-DPI displays.
-async fn ui_program_icon_2x() -> Response {
-    assets::ui_asset(
-        "icons/runvil-icon@2x.png",
-        "image/png",
-        CachePolicy::Revalidate,
-    )
-}
-
-#[cfg(test)]
-#[path = "assets-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/routes/gateway_config-tests-recovery.rs b/crates/workshop/server/src/routes/gateway_config-tests-recovery.rs
deleted file mode 100644
index dd41ebe96..000000000
--- a/crates/workshop/server/src/routes/gateway_config-tests-recovery.rs
+++ /dev/null
@@ -1,57 +0,0 @@
-//! Gateway config recovery: the origin and config proxy follow one replacement snapshot.
-
-use super::*;
-
-#[tokio::test]
-async fn origin_and_config_proxy_follow_one_replacement_snapshot() {
-    let gateway = axum::Router::new().route(
-        "/admin/status",
-        axum_get(|headers: axum::http::HeaderMap| async move {
-            if headers
-                .get(header::AUTHORIZATION)
-                .and_then(|value| value.to_str().ok())
-                == Some("Bearer replacement-key")
-            {
-                StatusCode::OK
-            } else {
-                StatusCode::UNAUTHORIZED
-            }
-        }),
-    );
-    let replacement = spawn_gateway(gateway).await;
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    state
-        .gateway_binding()
-        .replace(&replacement, "replacement-key")
-        .expect("the replacement publishes");
-    let app = router(state);
-
-    let origin = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/gateway/origin")
-                .body(Body::empty())
-                .expect("the origin request builds"),
-        )
-        .await
-        .expect("the router is infallible");
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(origin).await).expect("the origin body is JSON");
-    assert_eq!(json["origin"], replacement);
-
-    let proxied = app
-        .oneshot(
-            Request::builder()
-                .uri("/gateway/api/admin/status")
-                .body(Body::empty())
-                .expect("the proxy request builds"),
-        )
-        .await
-        .expect("the router is infallible");
-    assert_eq!(
-        proxied.status(),
-        StatusCode::OK,
-        "the proxy uses the replacement bearer with the replacement URL"
-    );
-}
diff --git a/crates/workshop/server/src/routes/gateway_config-tests.rs b/crates/workshop/server/src/routes/gateway_config-tests.rs
deleted file mode 100644
index 344edccf7..000000000
--- a/crates/workshop/server/src/routes/gateway_config-tests.rs
+++ /dev/null
@@ -1,259 +0,0 @@
-//! Gateway config proxy tests: the allowlist rule, forwarding with the bearer key, and refusals.
-
-use super::*;
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::response::IntoResponse;
-use axum::routing::{get as axum_get, put as axum_put};
-use tower::ServiceExt;
-
-use crate::app::router;
-use crate::app::test_helpers::{body_bytes, spawn_gateway, state_for};
-
-#[path = "gateway_config-tests-recovery.rs"]
-mod recovery;
-
-#[test]
-fn the_rule_admits_the_admin_surface_and_the_cache_reads_and_refuses_the_rest() {
-    for (method, path) in [
-        // Every current /admin/ route the gateway serves.
-        (Method::GET, "/admin/config"),
-        (Method::PUT, "/admin/config"),
-        (Method::GET, "/admin/config-dirty"),
-        (Method::GET, "/admin/config-pending"),
-        (Method::POST, "/admin/config-apply"),
-        (Method::POST, "/admin/config-revert"),
-        (Method::GET, "/admin/env"),
-        (Method::PUT, "/admin/env"),
-        (Method::GET, "/admin/chat-templates"),
-        (Method::GET, "/admin/cloud-models"),
-        (Method::POST, "/admin/cloud-models/refresh"),
-        (Method::GET, "/admin/model-info"),
-        (Method::GET, "/admin/orphans"),
-        (Method::POST, "/admin/reveal"),
-        (Method::GET, "/admin/status"),
-        (Method::GET, "/admin/system"),
-        (Method::GET, "/admin/hf/search"),
-        (Method::POST, "/admin/queue/cancel"),
-        (Method::POST, "/admin/queue/cancel-pending"),
-        (Method::POST, "/admin/switch-profile"),
-        (Method::GET, "/admin/profiles"),
-        // The two cache reads outside /admin/.
-        (Method::GET, "/v1/cache"),
-        (
-            Method::DELETE,
-            "/v1/cache/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        ),
-    ] {
-        assert!(
-            forward_allowed(&method, path),
-            "{method} {path} must be forwardable"
-        );
-    }
-    for (method, path) in [
-        (Method::GET, "/admin/progress"),
-        (Method::GET, "/admin"),
-        (Method::GET, "/admin/hf/../../v1/chat/completions"),
-        (Method::GET, "/admin/hf/..\\..\\v1\\chat\\completions"),
-        (Method::GET, "/admin/hf/./search"),
-        (Method::GET, "/v1/models"),
-        (Method::POST, "/v1/chat/completions"),
-        (Method::POST, "/v1/cache"),
-        (Method::DELETE, "/v1/cache/abc123"),
-        (Method::GET, "/health"),
-        (Method::POST, "/shutdown"),
-        (Method::GET, "/config/"),
-    ] {
-        assert!(
-            !forward_allowed(&method, path),
-            "{method} {path} must be refused"
-        );
-    }
-}
-
-#[tokio::test]
-async fn the_origin_route_answers_the_configured_gateway_base_url() {
-    let (state, _state_dir) = state_for("http://127.0.0.1:8081");
-    let request = Request::builder()
-        .uri("/gateway/origin")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["origin"], "http://127.0.0.1:8081");
-}
-
-#[tokio::test]
-async fn the_proxy_forwards_an_allowlisted_path_with_the_bearer_key() {
-    let gateway = axum::Router::new().route(
-        "/admin/status",
-        axum_get(|headers: axum::http::HeaderMap| async move {
-            let authorized = headers
-                .get(header::AUTHORIZATION)
-                .and_then(|value| value.to_str().ok())
-                == Some("Bearer test-key");
-            (
-                [(header::CONTENT_TYPE, "application/json")],
-                format!(r#"{{"profile":"default","authorized":{authorized}}}"#),
-            )
-        }),
-    );
-    let base_url = spawn_gateway(gateway).await;
-    let (state, _state_dir) = state_for(&base_url);
-    let request = Request::builder()
-        .uri("/gateway/api/admin/status")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        response
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/json"),
-        "the gateway's content type is relayed"
-    );
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["profile"], "default", "the body is relayed verbatim");
-    assert_eq!(
-        json["authorized"], true,
-        "the forward sends the workshop's bearer key"
-    );
-}
-
-#[tokio::test]
-async fn the_proxied_config_assets_force_revalidation() {
-    let gateway = axum::Router::new().route(
-        "/config/app.js",
-        axum_get(|| async move {
-            (
-                [(header::CONTENT_TYPE, "text/javascript; charset=utf-8")],
-                "// bundle",
-            )
-        }),
-    );
-    let base_url = spawn_gateway(gateway).await;
-    let (state, _state_dir) = state_for(&base_url);
-    let request = Request::builder()
-        .uri("/gateway/config/app.js")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    // The relayed bundle is unversioned; without this the panel's
-    // WebView2 serves a cached script against a newer gateway.
-    assert_eq!(
-        response
-            .headers()
-            .get(header::CACHE_CONTROL)
-            .and_then(|value| value.to_str().ok()),
-        Some("no-cache"),
-        "the relay forces revalidation"
-    );
-}
-
-#[tokio::test]
-async fn the_proxy_forwards_the_query_string_and_a_json_body() {
-    let gateway = axum::Router::new().route(
-        "/admin/config",
-        axum_put(
-            |headers: axum::http::HeaderMap, request: axum::extract::Request| async move {
-                let declared_json = headers
-                    .get(header::CONTENT_TYPE)
-                    .and_then(|value| value.to_str().ok())
-                    == Some("application/json");
-                let body = axum::body::to_bytes(request.into_body(), usize::MAX)
-                    .await
-                    .unwrap_or_default();
-                (
-                    [(header::CONTENT_TYPE, "application/json")],
-                    format!(
-                        r#"{{"declared_json":{declared_json},"echo":{}}}"#,
-                        String::from_utf8_lossy(&body)
-                    ),
-                )
-                    .into_response()
-            },
-        ),
-    );
-    let base_url = spawn_gateway(gateway).await;
-    let (state, _state_dir) = state_for(&base_url);
-    let request = Request::builder()
-        .method("PUT")
-        .uri("/gateway/api/admin/config?source=panel")
-        .header(header::CONTENT_TYPE, "application/json")
-        .body(Body::from(r#"{"active_profile":"beta"}"#))
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["declared_json"], true, "the body forwards as JSON");
-    assert_eq!(
-        json["echo"]["active_profile"], "beta",
-        "the body forwards verbatim"
-    );
-}
-
-#[tokio::test]
-async fn the_proxy_refuses_a_non_allowlisted_path_without_dialing() {
-    // An unroutable gateway address: a refused path must answer 403
-    // before any dial, so no transport error can occur.
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    for path in [
-        "/gateway/api/v1/chat/completions",
-        "/gateway/api/admin/progress",
-        "/gateway/api/admin/hf/../../v1/chat/completions",
-    ] {
-        let request = Request::builder()
-            .uri(path)
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = router(state.clone())
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(response.status(), StatusCode::FORBIDDEN, "for {path}");
-        let json: serde_json::Value =
-            serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-        assert_eq!(json["error"]["code"], "forward_denied", "for {path}");
-    }
-}
-
-#[tokio::test]
-async fn the_proxy_sits_behind_the_cross_site_guard() {
-    // The workshop listener binds loopback only; on top of that the
-    // cross-site guard refuses a DNS-rebound Host, so the proxy is
-    // covered by the same wall as the rest of the API surface.
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .uri("/gateway/api/admin/status")
-        .header("host", "rebound.example:7910")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["error"]["code"], "cross_site");
-}
diff --git a/crates/workshop/server/src/routes/gateway_config.rs b/crates/workshop/server/src/routes/gateway_config.rs
deleted file mode 100644
index 32411d64e..000000000
--- a/crates/workshop/server/src/routes/gateway_config.rs
+++ /dev/null
@@ -1,184 +0,0 @@
-//! The gateway-config panel's server side.
-//!
-//! Two routes serve the workshop UI's embedded config panel. `GET
-//! /gateway/origin` reports the gateway's base URL so the UI can build
-//! the panel iframe's address. `/gateway/api/{*path}` is the narrow
-//! proxy the panel's postMessage bridge calls: it forwards the
-//! gateway's `/admin/` surface (minus the progress stream) and the two
-//! cache reads to the gateway with the bearer key attached, so the key
-//! never reaches any browser context. The routes mount
-//! inside the API group, so the [`crate::cross_site`] guard applies and
-//! a non-loopback `Host` is refused; the workshop listener itself binds
-//! loopback only, which keeps the whole proxy unreachable from the LAN.
-
-use axum::Router;
-use axum::body::{Body, Bytes};
-use axum::extract::{Path, RawQuery, State};
-use axum::http::{Method, StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::{any, get};
-
-use crate::app::AppState;
-use crate::error::AppError;
-use workshop_gateway::ForwardedResponse;
-use workshop_support::{DEFAULT_DEADLINE, with_deadline};
-
-/// The gateway-config panel routes. The origin probe is local and
-/// instant, so it has the default deadline. The forward route and the two
-/// config-asset routes are added after the layer and have none: a
-/// forwarded cache download or config apply legitimately runs for
-/// minutes, and for every proxied request the gateway client already
-/// bounds the header phase.
-pub(crate) fn routes(state: AppState) -> Router {
-    with_deadline(
-        Router::new().route("/gateway/origin", get(gateway_origin)),
-        DEFAULT_DEADLINE,
-    )
-    .route("/gateway/api/{*path}", any(gateway_forward))
-    // The config SPA assets, proxied same-origin so the panel iframe
-    // loads from the workshop's own origin instead of the gateway's
-    // port. A cross-origin iframe makes Chromium spawn renderer
-    // processes that flash a console window on some Windows configs.
-    .route("/gateway/config/", get(gateway_config_index))
-    .route("/gateway/config/{*path}", get(gateway_config_assets))
-    .with_state(state)
-}
-
-/// Whether the proxy forwards `method` and `path`. The rule: any method
-/// on a path under `/admin/` forwards, with one exception - `GET
-/// /admin/progress` is refused because the workshop owns progress
-/// display, so the panel must never subscribe - plus two admitted routes
-/// outside `/admin/`: `GET /v1/cache` and `DELETE /v1/cache/<digest>`
-/// for a well-formed 64-hex digest. Everything else is refused: chat
-/// completions, the model list, `/health`, `/shutdown`, the config UI
-/// assets, and `POST /v1/cache`. Dot segments are refused outright,
-/// because the forwarding URL parse would normalize them and
-/// a `..` under `/admin/` could otherwise escape onto a refused path;
-/// backslashes are refused for the same reason (the WHATWG parse folds
-/// them into slashes). A forwarded `/admin/` path the gateway does not
-/// serve is the gateway's 404 or 405 to answer.
-fn forward_allowed(method: &Method, path: &str) -> bool {
-    if has_normalizing_segment(path) {
-        return false;
-    }
-    if path.starts_with("/admin/") {
-        return !(*method == Method::GET && path == "/admin/progress");
-    }
-    match *method {
-        Method::GET => path == "/v1/cache",
-        Method::DELETE => path.strip_prefix("/v1/cache/").is_some_and(|digest| {
-            digest.len() == 64 && digest.bytes().all(|byte| byte.is_ascii_hexdigit())
-        }),
-        _ => false,
-    }
-}
-
-/// Whether `path` holds a `.` or `..` segment or a backslash: parts the
-/// forwarding URL parse would normalize, letting a path escape the prefix
-/// it was admitted under.
-fn has_normalizing_segment(path: &str) -> bool {
-    path.split('/')
-        .any(|segment| segment == "." || segment == ".." || segment.contains('\\'))
-}
-
-/// Relays a forwarded gateway response - status, content type, and body
-/// byte-for-byte - adding `cache_control` when given.
-fn relay(forwarded: ForwardedResponse, cache_control: Option<&'static str>) -> Response {
-    let status = StatusCode::from_u16(forwarded.status.as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
-    let mut builder = Response::builder().status(status);
-    if let Some(content_type) = &forwarded.content_type {
-        builder = builder.header(header::CONTENT_TYPE, content_type);
-    }
-    if let Some(cache_control) = cache_control {
-        builder = builder.header(header::CACHE_CONTROL, cache_control);
-    }
-    // The parts are valid by construction (the status came off the wire,
-    // the content type round-tripped a valid header), so the build
-    // cannot fail; a failure would be a bug, answered as a plain 502.
-    builder
-        .body(Body::from(forwarded.body))
-        .unwrap_or_else(|_| StatusCode::BAD_GATEWAY.into_response())
-}
-
-/// Answers the gateway's base URL, so the workshop UI can point the
-/// config panel's iframe at `<origin>/config/?mode=panel`.
-async fn gateway_origin(State(state): State<AppState>) -> Response {
-    let gateway = state.gateway_snapshot();
-    let body = serde_json::json!({ "origin": gateway.base_url() });
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "application/json")],
-        body.to_string(),
-    )
-        .into_response()
-}
-
-/// Proxies the config SPA's index page from the gateway so the panel
-/// iframe loads same-origin.
-async fn gateway_config_index(State(state): State<AppState>) -> Result<Response, AppError> {
-    proxy_config_asset(&state, "/config/").await
-}
-
-/// Proxies the config SPA's sub-assets (JS, CSS, icons) from the gateway.
-async fn gateway_config_assets(
-    State(state): State<AppState>,
-    Path(path): Path<String>,
-) -> Result<Response, AppError> {
-    let path = format!("/config/{path}");
-    if has_normalizing_segment(&path) {
-        return Err(AppError::ForwardDenied);
-    }
-    proxy_config_asset(&state, &path).await
-}
-
-/// The shared proxy core: GET the gateway's config asset and relay it.
-async fn proxy_config_asset(state: &AppState, path: &str) -> Result<Response, AppError> {
-    let gateway = state.gateway_snapshot();
-    let forwarded = gateway
-        .client()
-        .forward(reqwest::Method::GET, path, None)
-        .await
-        .map_err(AppError::Gateway)?;
-    // The relayed SPA assets are unversioned; force revalidation so the
-    // panel never runs a cached script against a newer gateway.
-    Ok(relay(forwarded, Some("no-cache")))
-}
-
-/// Forwards one admitted request to the gateway with the bearer key
-/// attached, relaying status, content type, and body byte-for-byte.
-async fn gateway_forward(
-    State(state): State<AppState>,
-    Path(path): Path<String>,
-    RawQuery(query): RawQuery,
-    method: Method,
-    body: Bytes,
-) -> Result<Response, AppError> {
-    let path = format!("/{path}");
-    if !forward_allowed(&method, &path) {
-        return Err(AppError::ForwardDenied);
-    }
-    let path_and_query = match query {
-        Some(query) => format!("{path}?{query}"),
-        None => path,
-    };
-    // The axum and reqwest method types come from potentially different
-    // `http` crate versions, so the conversion goes through the name; a
-    // name reqwest cannot represent is refused rather than forwarded.
-    let method = reqwest::Method::from_bytes(method.as_str().as_bytes())
-        .map_err(|_| AppError::ForwardDenied)?;
-    let gateway = state.gateway_snapshot();
-    let forwarded = gateway
-        .client()
-        .forward(
-            method,
-            &path_and_query,
-            (!body.is_empty()).then(|| body.to_vec()),
-        )
-        .await
-        .map_err(AppError::Gateway)?;
-    Ok(relay(forwarded, None))
-}
-
-#[cfg(test)]
-#[path = "gateway_config-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/routes/health.rs b/crates/workshop/server/src/routes/health.rs
deleted file mode 100644
index ea2d655d3..000000000
--- a/crates/workshop/server/src/routes/health.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! The liveness probe route.
-
-use axum::Router;
-use axum::http::header;
-use axum::response::IntoResponse;
-use axum::routing::get;
-
-/// The health probe route, stateless by design so it answers even while
-/// every backing service is degraded.
-pub(crate) fn routes() -> Router {
-    Router::new().route("/health", get(health))
-}
-
-/// Answers the health probe with a static JSON body.
-async fn health() -> impl IntoResponse {
-    (
-        [(header::CONTENT_TYPE, "application/json")],
-        r#"{"status":"serving"}"#,
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use axum::body::Body;
-    use axum::http::{Request, StatusCode, header};
-    use tower::ServiceExt;
-
-    use crate::app::router;
-    use crate::app::test_helpers::{body_bytes, state_for};
-
-    #[tokio::test]
-    async fn health_returns_serving() {
-        let (state, _state_dir) = state_for("http://127.0.0.1:1");
-        let request = Request::builder()
-            .uri("/health")
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = router(state)
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(response.status(), StatusCode::OK);
-        let content_type = response
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .expect("the health handler sets content-type");
-        assert_eq!(content_type, "application/json");
-        assert_eq!(&body_bytes(response).await[..], br#"{"status":"serving"}"#);
-    }
-}
diff --git a/crates/workshop/server/src/routes/prompts-tests.rs b/crates/workshop/server/src/routes/prompts-tests.rs
deleted file mode 100644
index d738da5c2..000000000
--- a/crates/workshop/server/src/routes/prompts-tests.rs
+++ /dev/null
@@ -1,205 +0,0 @@
-//! Tests for the `POST /prompts/contract` route: the wire contract the
-//! Run window renders, and the `422` parse-failure envelope and its
-//! message.
-
-use std::num::NonZeroU32;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use runvil::{Error, ErrorCode, SourceLoc};
-use tower::ServiceExt as _;
-
-use crate::app::router;
-use crate::app::test_helpers::{body_bytes, state_for};
-use crate::error::AppError;
-
-/// Posts `body` to `/prompts/contract` on the assembled server router and
-/// returns the status with the decoded JSON body.
-async fn post_contract(body: serde_json::Value) -> (StatusCode, serde_json::Value) {
-    let (state, _state_dir) = state_for("http://127.0.0.1:1");
-    let request = Request::builder()
-        .method("POST")
-        .uri("/prompts/contract")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body.to_string()))
-        .expect("static request parts are valid");
-    let response = router(state)
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    let status = response.status();
-    let bytes = body_bytes(response).await;
-    let json = serde_json::from_slice(&bytes).expect("the body is JSON");
-    (status, json)
-}
-
-/// A prompt exercising every frontmatter key in the contract.
-const FULL_PROMPT: &str = r"---
-name: full
-description: does everything
-runvil: 0
-max_tool_iterations: 5
-input:
-  path: paper.md
-  description: the paper
-output:
-  path: out.md
-  description: the result
-uses:
-  - web
-  - fs
-  - acme/poop
-args:
-  topic:
-    type: string
-    description: the topic
-  count:
-    type: integer
-    optional: true
-    default: 3
-models:
-  strong:
-    min_context: 200000
-    thinking: true
-  fast: {}
----
-
-# Full
-
-## Only
-
-Body text.
-";
-
-#[tokio::test]
-async fn a_full_frontmatter_prompt_answers_every_contract_section() {
-    let body = serde_json::json!({ "name": "full", "text": FULL_PROMPT });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::OK);
-    assert_eq!(json["name"], "full");
-    assert_eq!(json["description"], "does everything");
-    assert_eq!(json["runvil"], 0);
-    assert_eq!(json["max_tool_iterations"], 5);
-    assert_eq!(
-        json["input"],
-        serde_json::json!({ "path": "paper.md", "description": "the paper" })
-    );
-    assert_eq!(
-        json["output"],
-        serde_json::json!({ "path": "out.md", "description": "the result" })
-    );
-    // Packs keep declaration order, each sent by its Pack id alone; the
-    // map-backed sections are sorted by name or label.
-    assert_eq!(
-        json["uses"],
-        serde_json::json!([
-            { "id": "web" },
-            { "id": "fs" },
-            { "id": "poop" },
-        ])
-    );
-    assert_eq!(
-        json["args"],
-        serde_json::json!({
-            "implicit": false,
-            "fields": [
-                { "name": "count", "type": "integer", "optional": true, "default": 3, "description": null },
-                { "name": "topic", "type": "string", "optional": false, "default": null, "description": "the topic" },
-            ],
-        })
-    );
-    assert_eq!(
-        json["models"],
-        serde_json::json!([
-            { "label": "strong", "min_context": 200_000, "thinking": true },
-            { "label": "fast", "min_context": null, "thinking": null },
-        ])
-    );
-}
-
-#[tokio::test]
-async fn a_broken_yaml_key_answers_parse_frontmatter_with_the_line() {
-    let text = "---\nname: [unclosed\ndescription: x\n---\n\n# T\n\n## S\n\np\n";
-    let body = serde_json::json!({ "name": "broken", "text": text });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY);
-    assert_eq!(json["error"]["code"], "parse_frontmatter");
-    let message = json["error"]["message"].as_str().expect("a message");
-    assert!(
-        message.starts_with("line 2: "),
-        "the YAML failure line is prefixed: {message}"
-    );
-}
-
-#[test]
-fn an_internal_parse_failure_names_no_prompt_line() {
-    // An internal failure's location is a Rust line, never a prompt line.
-    let internal = ErrorCode::Internal;
-    let mut error = Error::new(
-        internal,
-        "internal invariant violated: a test fault",
-        internal.prose(),
-    );
-    error.at = NonZeroU32::new(9).map(|line| SourceLoc::line("crates/x/src/lib.rs", line));
-    let AppError::PromptParse { message, code } = AppError::prompt_parse(&error) else {
-        panic!("a parse failure answers as a prompt-parse wire error");
-    };
-    assert_eq!(code, "parse_internal");
-    assert_eq!(message, "internal invariant violated: a test fault");
-}
-
-#[tokio::test]
-async fn a_prompt_without_args_yields_the_implicit_prose_field() {
-    let text = "---\nname: plain\ndescription: no args\n---\n\n# Plain\n\n## S\n\np\n";
-    let body = serde_json::json!({ "name": "plain", "text": text });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::OK);
-    assert_eq!(
-        json["args"],
-        serde_json::json!({
-            "implicit": true,
-            "fields": [
-                { "name": "prose", "type": "string", "optional": true, "default": null, "description": "Freeform input for this prompt" },
-            ],
-        })
-    );
-    assert_eq!(
-        json["models"],
-        serde_json::json!([]),
-        "a prompt with no models key declares no role requirements"
-    );
-}
-
-#[tokio::test]
-async fn a_lua_error_answers_parse_lua() {
-    let text =
-        "---\nname: badlua\ndescription: bad lua\n---\n\n# Bad\n\n## S\n\n```lua\nreturn (\n```\n";
-    let body = serde_json::json!({ "name": "badlua", "text": text });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY);
-    assert_eq!(json["error"]["code"], "parse_lua");
-}
-
-#[tokio::test]
-async fn the_contract_has_no_tools_section() {
-    let body = serde_json::json!({ "name": "full", "text": FULL_PROMPT });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::OK);
-    assert!(
-        json.get("tools").is_none(),
-        "the contract carries no tools key: {json}"
-    );
-}
-
-#[tokio::test]
-async fn the_dto_serializes_absent_declarations_as_nulls() {
-    let text = "---\nname: nulls\ndescription: absent keys\n---\n\n# Nulls\n\n## S\n\np\n";
-    let body = serde_json::json!({ "name": "nulls", "text": text });
-    let (status, json) = post_contract(body).await;
-    assert_eq!(status, StatusCode::OK);
-    // Absent declarations serialize as explicit nulls, not missing keys.
-    assert!(json["input"].is_null());
-    assert!(json["output"].is_null());
-    assert!(json["max_tool_iterations"].is_null());
-    assert!(json["runvil"].is_null());
-}
diff --git a/crates/workshop/server/src/routes/prompts.rs b/crates/workshop/server/src/routes/prompts.rs
deleted file mode 100644
index 65028f9de..000000000
--- a/crates/workshop/server/src/routes/prompts.rs
+++ /dev/null
@@ -1,212 +0,0 @@
-//! The `/prompts/*` route handlers: parsing prompt text into the Run
-//! window's contract DTO.
-//!
-//! The parse route is pure - no state, no disk, no clock: it turns the
-//! posted markdown into the contract the Run window renders, or a `422`
-//! envelope naming the parse failure kind and line. The parser's own
-//! types are `Deserialize`-only, so the wire DTO is hand-written
-//! `Serialize` structs built from [`Frontmatter`] accessors.
-
-use axum::Json;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::post;
-use serde::{Deserialize, Serialize};
-
-use runvil::Prompt;
-use runvil::model::ModelRole;
-use runvil::packs::PackRef;
-use runvil::prompt::{ArgDecl, ArgsDecl, FileDecl, Frontmatter, RoleRequirements};
-
-use crate::error::AppError;
-
-/// The `/prompts/contract` route. The parse is pure, so the router
-/// carries no state; the server mounts it under the default deadline and
-/// its cross-site guard.
-pub(crate) fn routes() -> axum::Router {
-    axum::Router::new().route("/prompts/contract", post(contract))
-}
-
-/// The JSON body of `POST /prompts/contract`.
-#[derive(Debug, Deserialize)]
-struct ContractRequest {
-    /// The prompt's display name (the file's, when it came from one).
-    name: String,
-    /// The prompt markdown to parse.
-    text: String,
-}
-
-/// The Run-window contract: everything the panel renders, built from
-/// the parsed frontmatter.
-#[derive(Debug, Serialize)]
-struct ContractResponse {
-    /// The prompt's identifier.
-    name: String,
-    /// The one-line description shown in listings.
-    description: String,
-    /// The Engine major the `runvil:` key declares; `null` when absent.
-    runvil: Option<u32>,
-    /// The declared tool-loop cap; `null` for the runtime default.
-    max_tool_iterations: Option<u32>,
-    /// The declared input file; `null` when absent.
-    input: Option<FileDto>,
-    /// The declared output file; `null` when absent.
-    output: Option<FileDto>,
-    /// The declared Packs, in declaration order.
-    uses: Vec<PackDto>,
-    /// The typed args declaration.
-    args: ArgsDto,
-    /// The declared model roles, sorted by label.
-    models: Vec<ModelDto>,
-}
-
-/// A declared input or output file.
-#[derive(Debug, Serialize)]
-struct FileDto {
-    /// The store-internal path.
-    path: String,
-    /// The human-readable purpose.
-    description: String,
-}
-
-impl From<&FileDecl> for FileDto {
-    fn from(decl: &FileDecl) -> Self {
-        Self {
-            path: decl.path().to_owned(),
-            description: decl.description().to_owned(),
-        }
-    }
-}
-
-/// A declared Pack.
-#[derive(Debug, Serialize)]
-struct PackDto {
-    /// The Pack id, such as `web`, which is `poop` for `acme/poop`.
-    id: String,
-}
-
-impl From<&PackRef> for PackDto {
-    fn from(entry: &PackRef) -> Self {
-        Self {
-            id: entry.id().to_string(),
-        }
-    }
-}
-
-/// The typed args declaration.
-#[derive(Debug, Serialize)]
-struct ArgsDto {
-    /// True when the declaration is the implicit default (no `args:` key).
-    implicit: bool,
-    /// The declared fields, sorted by name.
-    fields: Vec<ArgDto>,
-}
-
-impl From<&ArgsDecl> for ArgsDto {
-    fn from(decl: &ArgsDecl) -> Self {
-        Self {
-            implicit: decl.is_default(),
-            fields: decl
-                .iter()
-                .map(|(name, arg)| ArgDto::new(name, arg))
-                .collect(),
-        }
-    }
-}
-
-/// One declared arg.
-#[derive(Debug, Serialize)]
-struct ArgDto {
-    /// The arg name.
-    name: String,
-    /// The declared type (`string`, `boolean`, `integer`, `number`).
-    #[serde(rename = "type")]
-    kind: String,
-    /// Whether a call may omit the field.
-    optional: bool,
-    /// The declared default; `null` when absent.
-    default: Option<serde_json::Value>,
-    /// The human-readable description; `null` when absent.
-    description: Option<String>,
-}
-
-impl ArgDto {
-    /// Builds the DTO for the arg declared under `name`.
-    fn new(name: &str, decl: &ArgDecl) -> Self {
-        Self {
-            name: name.to_owned(),
-            kind: decl.kind().to_string(),
-            optional: decl.is_optional(),
-            // A declared default is validated against the declared type
-            // at parse, so it is always a JSON-representable scalar.
-            default: decl
-                .default()
-                .and_then(|value| serde_json::to_value(value).ok()),
-            description: decl.description().map(str::to_owned),
-        }
-    }
-}
-
-/// The requirements a prompt declares for one model role.
-#[derive(Debug, Serialize)]
-struct ModelDto {
-    /// The role name.
-    label: String,
-    /// The minimum context window in tokens; `null` when absent.
-    min_context: Option<u32>,
-    /// The thinking requirement; `null` when absent.
-    thinking: Option<bool>,
-}
-
-impl ModelDto {
-    /// Builds the DTO for the requirements declared for `role`.
-    fn new(role: ModelRole, declared: RoleRequirements) -> Self {
-        Self {
-            label: role.as_str().to_owned(),
-            min_context: declared.min_context().map(std::num::NonZeroU32::get),
-            thinking: declared.thinking(),
-        }
-    }
-}
-
-impl From<&Frontmatter> for ContractResponse {
-    fn from(frontmatter: &Frontmatter) -> Self {
-        Self {
-            name: frontmatter.name().to_owned(),
-            description: frontmatter.description().to_owned(),
-            runvil: frontmatter.runvil(),
-            max_tool_iterations: frontmatter
-                .max_tool_iterations()
-                .map(std::num::NonZeroU32::get),
-            input: frontmatter.input().map(FileDto::from),
-            output: frontmatter.output().map(FileDto::from),
-            uses: frontmatter.uses().iter().map(PackDto::from).collect(),
-            args: ArgsDto::from(frontmatter.args()),
-            models: ModelRole::ALL
-                .into_iter()
-                .filter_map(|role| {
-                    frontmatter
-                        .role_requirements(role)
-                        .map(|declared| ModelDto::new(role, *declared))
-                })
-                .collect(),
-        }
-    }
-}
-
-/// Parses the posted prompt text and answers the contract DTO, or a
-/// `422` envelope when the text is not a valid prompt.
-async fn contract(Json(body): Json<ContractRequest>) -> Response {
-    match Prompt::parse(&|_: &str| Ok(body.text.clone()), &body.name) {
-        Ok(prompt) => (
-            StatusCode::OK,
-            Json(ContractResponse::from(prompt.frontmatter())),
-        )
-            .into_response(),
-        Err(error) => AppError::prompt_parse(&error).into_response(),
-    }
-}
-
-#[cfg(test)]
-#[path = "prompts-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/routes/realtime-origin-tests.rs b/crates/workshop/server/src/routes/realtime-origin-tests.rs
deleted file mode 100644
index fe66d845f..000000000
--- a/crates/workshop/server/src/routes/realtime-origin-tests.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-//! The same-origin rule's cases: exact match, absent Origin, normalization,
-//! and every mismatch that must fail closed.
-
-use super::*;
-
-#[test]
-fn a_native_client_with_a_valid_request_authority_is_admitted() {
-    assert!(same_origin_authority_allowed(None, Some("127.0.0.1:7910")));
-    assert!(!same_origin_authority_allowed(None, None));
-    assert!(!same_origin_authority_allowed(None, Some("localhost:bad")));
-}
-
-#[test]
-fn matching_normalized_authorities_are_admitted() {
-    for (origin, authority) in [
-        ("http://127.0.0.1:7910", "127.0.0.1:7910"),
-        ("http://localhost:7910", "LOCALHOST:7910"),
-        ("http://[::1]:7910", "[::1]:7910"),
-        ("http://[0:0:0:0:0:0:0:1]:7910", "[::1]:7910"),
-    ] {
-        assert!(
-            same_origin_authority_allowed(Some(origin), Some(authority)),
-            "{origin} must match {authority}"
-        );
-    }
-}
-
-#[test]
-fn mismatches_wrong_ports_and_malformed_values_are_refused() {
-    for (origin, authority) in [
-        ("http://127.0.0.1:7910", "localhost:7910"),
-        ("http://localhost:7910", "localhost:7911"),
-        ("http://[0:0:0:0:0:0:0:1]:7910", "[::1]:7911"),
-        ("http://[0:0:0:0:0:0:0:2]:7910", "[::1]:7910"),
-        ("http://evil.example:7910", "localhost:7910"),
-        ("https://localhost:7910", "localhost:7910"),
-        ("http://localhost:bad", "localhost:7910"),
-        ("http://localhost:7910/path", "localhost:7910"),
-        ("null", "localhost:7910"),
-        ("", "localhost:7910"),
-    ] {
-        assert!(
-            !same_origin_authority_allowed(Some(origin), Some(authority)),
-            "{origin} must not match {authority}"
-        );
-    }
-}
-
-#[test]
-fn a_userinfo_bearing_authority_is_refused() {
-    assert!(!same_origin_authority_allowed(
-        Some("http://user@localhost:7910"),
-        Some("localhost:7910")
-    ));
-    assert!(!same_origin_authority_allowed(
-        Some("http://localhost:7910"),
-        Some("user@localhost:7910")
-    ));
-}
diff --git a/crates/workshop/server/src/routes/realtime-origin.rs b/crates/workshop/server/src/routes/realtime-origin.rs
deleted file mode 100644
index 4d0826983..000000000
--- a/crates/workshop/server/src/routes/realtime-origin.rs
+++ /dev/null
@@ -1,96 +0,0 @@
-//! Same-origin policy for the Workshop Realtime socket.
-//!
-//! A browser `Origin` on `/v1/realtime` must match the request's own
-//! authority: same host (IP compared by value, domain compared ASCII
-//! case-insensitively) and the same explicit port. An absent `Origin`
-//! denotes a native client, which is admitted as long as the request
-//! authority is present and valid. Missing or malformed values fail closed.
-//!
-//! The cross-site guard is the security boundary for the loopback socket
-//! as a whole; this is the stricter rule for the one route a browser page
-//! reaches with credentials, and it is deliberately narrower than the
-//! guard.
-
-use axum::http::uri::Authority;
-
-/// Whether a Workshop WebSocket `Origin` matches its request authority.
-///
-/// An absent `Origin` denotes a native client, but the request authority
-/// must still be present and valid. A browser `Origin` must be an exact
-/// HTTP origin whose normalized authority equals the validated request
-/// authority. Missing or malformed values and host or port mismatches fail
-/// closed.
-pub(super) fn same_origin_authority_allowed(
-    origin: Option<&str>,
-    request_authority: Option<&str>,
-) -> bool {
-    let Some(request_authority) = request_authority.and_then(parse_authority) else {
-        return false;
-    };
-    origin.is_none_or(|origin| {
-        parse_http_origin_authority(origin).is_some_and(|origin_authority| {
-            same_origin_authority(&origin_authority, &request_authority)
-        })
-    })
-}
-
-/// Compares normalized hosts while preserving explicit port equality.
-fn same_origin_authority(left: &Authority, right: &Authority) -> bool {
-    left.port_u16() == right.port_u16() && same_authority_host(left.host(), right.host())
-}
-
-/// Compares IP hosts by value and domain hosts ASCII case-insensitively.
-fn same_authority_host(left: &str, right: &str) -> bool {
-    let parse_ip = |host: &str| {
-        host.strip_prefix('[')
-            .and_then(|host| host.strip_suffix(']'))
-            .unwrap_or(host)
-            .parse::<std::net::IpAddr>()
-            .ok()
-    };
-    match (parse_ip(left), parse_ip(right)) {
-        (Some(left), Some(right)) => left == right,
-        (None, None) => left.eq_ignore_ascii_case(right),
-        _ => false,
-    }
-}
-
-/// Parses an exact HTTP origin and returns its authority.
-fn parse_http_origin_authority(origin: &str) -> Option<Authority> {
-    let (scheme, authority) = origin.split_once("://")?;
-    if !scheme.eq_ignore_ascii_case("http") {
-        return None;
-    }
-    parse_authority(authority)
-}
-
-/// Parses an authority and rejects ports outside the `u16` range.
-fn parse_authority(authority: &str) -> Option<Authority> {
-    let port = if let Some(bracketed) = authority.strip_prefix('[') {
-        let close = bracketed.find(']')?;
-        match &bracketed[close + 1..] {
-            "" => None,
-            suffix => Some(suffix.strip_prefix(':')?),
-        }
-    } else {
-        match authority.split_once(':') {
-            Some((host, port)) if !host.is_empty() && !port.contains(':') => Some(port),
-            Some(_) => return None,
-            None => None,
-        }
-    };
-    if authority.contains('@')
-        || port.is_some_and(|port| port.is_empty() || port.parse::<u16>().is_err())
-    {
-        return None;
-    }
-    let authority = authority.parse::<Authority>().ok()?;
-    if authority.host().is_empty() {
-        return None;
-    }
-    Some(authority)
-}
-
-#[cfg(test)]
-#[path = "realtime-origin-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/routes/realtime-tests.rs b/crates/workshop/server/src/routes/realtime-tests.rs
deleted file mode 100644
index 05d0b32b5..000000000
--- a/crates/workshop/server/src/routes/realtime-tests.rs
+++ /dev/null
@@ -1,95 +0,0 @@
-//! Realtime relay refusal tests: the origin allowlist and the
-//! no-subprotocol rule, asserted against a live server so each refusal's
-//! status and body are pinned exactly as the browser sees them.
-
-use axum::http::StatusCode;
-use tokio_tungstenite::tungstenite::Error as SocketError;
-use tokio_tungstenite::tungstenite::client::IntoClientRequest as _;
-
-use crate::app::test_helpers::config_for;
-
-/// Builds a `/v1/realtime` upgrade request with an optional `Origin` and an
-/// optional requested subprotocol.
-fn request_with(
-    base: &str,
-    origin: Option<&str>,
-    subprotocol: Option<&str>,
-) -> tokio_tungstenite::tungstenite::http::Request<()> {
-    let address = base
-        .strip_prefix("http://")
-        .expect("the server URL is http");
-    let mut request = format!("ws://{address}/v1/realtime")
-        .into_client_request()
-        .expect("the WebSocket request builds");
-    if let Some(origin) = origin {
-        request.headers_mut().insert(
-            "origin",
-            origin
-                .parse()
-                .expect("the test Origin is a valid header value"),
-        );
-    }
-    if let Some(subprotocol) = subprotocol {
-        request.headers_mut().insert(
-            "sec-websocket-protocol",
-            subprotocol
-                .parse()
-                .expect("the test subprotocol is a valid header value"),
-        );
-    }
-    request
-}
-
-/// Runs the handshake and returns the HTTP response that refused it.
-async fn refused_response(
-    request: tokio_tungstenite::tungstenite::http::Request<()>,
-) -> tokio_tungstenite::tungstenite::http::Response<Option<Vec<u8>>> {
-    let error = tokio_tungstenite::connect_async(request)
-        .await
-        .expect_err("the WebSocket handshake is refused");
-    let SocketError::Http(response) = error else {
-        panic!("the refusal is an HTTP response, got {error:?}");
-    };
-    *response
-}
-
-#[tokio::test]
-async fn a_foreign_origin_is_refused_with_an_empty_forbidden_body() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let mut config = config_for("http://127.0.0.1:1", state_dir.path());
-    config.server.bind = "127.0.0.1:0".to_string();
-    let server = crate::serve::spawn_resolved(config).expect("server spawns");
-
-    let response = refused_response(request_with(
-        server.url(),
-        Some("https://evil.example"),
-        None,
-    ))
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    assert!(
-        response.body().as_deref().is_none_or(<[u8]>::is_empty),
-        "the refusal body is empty"
-    );
-
-    server.shutdown().expect("graceful shutdown succeeds");
-}
-
-#[tokio::test]
-async fn a_requested_subprotocol_is_refused_with_an_empty_bad_request_body() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let mut config = config_for("http://127.0.0.1:1", state_dir.path());
-    config.server.bind = "127.0.0.1:0".to_string();
-    let server = crate::serve::spawn_resolved(config).expect("server spawns");
-
-    let response = refused_response(request_with(server.url(), None, Some("realtime"))).await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert!(
-        response.body().as_deref().is_none_or(<[u8]>::is_empty),
-        "the refusal body is empty"
-    );
-
-    server.shutdown().expect("graceful shutdown succeeds");
-}
diff --git a/crates/workshop/server/src/routes/realtime.rs b/crates/workshop/server/src/routes/realtime.rs
deleted file mode 100644
index 78bbb9d70..000000000
--- a/crates/workshop/server/src/routes/realtime.rs
+++ /dev/null
@@ -1,193 +0,0 @@
-//! Same-origin, payload-opaque relay for Gateway Realtime transcription.
-//!
-//! The one route a browser page reaches with credentials gets a stricter
-//! Origin rule than the cross-site guard applies to the rest of the socket:
-//! a browser `Origin` must match the request's own authority. That rule
-//! lives in the private `origin` child module.
-
-use std::time::Duration;
-
-use axum::Router;
-use axum::extract::State;
-use axum::extract::ws::{CloseFrame as BrowserCloseFrame, Message as BrowserMessage};
-use axum::extract::ws::{WebSocket, WebSocketUpgrade};
-use axum::http::{HeaderMap, StatusCode, Uri, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use futures_util::{SinkExt as _, StreamExt as _};
-use tokio_tungstenite::tungstenite::Message as GatewayMessage;
-use tokio_tungstenite::tungstenite::protocol::CloseFrame as GatewayCloseFrame;
-
-use crate::app::AppState;
-use workshop_gateway::GatewayRealtimeSocket;
-
-#[path = "realtime-origin.rs"]
-mod origin;
-
-const RELAY_IO_DEADLINE: Duration = Duration::from_millis(500);
-
-/// The Workshop endpoint mirroring Gateway Realtime transcription.
-pub(crate) fn routes(state: AppState) -> Router {
-    Router::new()
-        .route("/v1/realtime", get(upgrade))
-        .with_state(state)
-}
-
-async fn upgrade(
-    State(state): State<AppState>,
-    uri: Uri,
-    headers: HeaderMap,
-    ws: WebSocketUpgrade,
-) -> Response {
-    if !same_origin_allowed(&uri, &headers) {
-        return StatusCode::FORBIDDEN.into_response();
-    }
-    if ws.requested_protocols().next().is_some() {
-        return StatusCode::BAD_REQUEST.into_response();
-    }
-    let gateway = state.gateway_snapshot();
-    match gateway.client().connect_realtime().await {
-        Ok(gateway) => ws.on_upgrade(move |browser| relay(browser, gateway)),
-        Err(error) => {
-            tracing::warn!(%error, "could not connect the Workshop Realtime relay to the gateway");
-            StatusCode::BAD_GATEWAY.into_response()
-        }
-    }
-}
-
-fn same_origin_allowed(uri: &Uri, headers: &HeaderMap) -> bool {
-    let Ok(origin) = single_header(headers, header::ORIGIN) else {
-        return false;
-    };
-    let authority = match uri.authority() {
-        Some(authority) => Some(authority.as_str()),
-        None => match single_header(headers, header::HOST) {
-            Ok(authority) => authority,
-            Err(()) => return false,
-        },
-    };
-    origin::same_origin_authority_allowed(origin, authority)
-}
-fn single_header(headers: &HeaderMap, name: header::HeaderName) -> Result<Option<&str>, ()> {
-    let mut values = headers.get_all(name).iter();
-    let Some(first) = values.next() else {
-        return Ok(None);
-    };
-    if values.next().is_some() {
-        return Err(());
-    }
-    first.to_str().map(Some).map_err(|_| ())
-}
-
-async fn relay(mut browser: WebSocket, mut gateway: GatewayRealtimeSocket) {
-    loop {
-        tokio::select! {
-            gateway_frame = gateway.next() => {
-                let Some(Ok(frame)) = gateway_frame else {
-                    close_browser(&mut browser).await;
-                    return;
-                };
-                match frame {
-                    GatewayMessage::Text(text) => {
-                        if !send_browser(&mut browser, BrowserMessage::Text(text.to_string().into())).await {
-                            return;
-                        }
-                    }
-                    GatewayMessage::Binary(bytes) => {
-                        if !send_browser(&mut browser, BrowserMessage::Binary(bytes.to_vec().into())).await {
-                            return;
-                        }
-                    }
-                    GatewayMessage::Ping(_) => {
-                        if !flush_gateway(&mut gateway).await {
-                            return;
-                        }
-                    }
-                    GatewayMessage::Pong(_) | GatewayMessage::Frame(_) => {}
-                    GatewayMessage::Close(frame) => {
-                        let outgoing = BrowserMessage::Close(frame.map(|frame| BrowserCloseFrame {
-                            code: frame.code.into(),
-                            reason: frame.reason.to_string().into(),
-                        }));
-                        let _sent = send_browser(&mut browser, outgoing).await;
-                        let _flushed = flush_gateway(&mut gateway).await;
-                        return;
-                    }
-                }
-            }
-            browser_frame = browser.recv() => {
-                let Some(Ok(frame)) = browser_frame else {
-                    close_gateway(&mut gateway).await;
-                    return;
-                };
-                match frame {
-                    BrowserMessage::Text(text) => {
-                        if !send_gateway(&mut gateway, GatewayMessage::Text(text.to_string().into())).await {
-                            return;
-                        }
-                    }
-                    BrowserMessage::Binary(bytes) => {
-                        if !send_gateway(&mut gateway, GatewayMessage::Binary(bytes.to_vec().into())).await {
-                            return;
-                        }
-                    }
-                    BrowserMessage::Ping(_) => {
-                        if !flush_browser(&mut browser).await {
-                            return;
-                        }
-                    }
-                    BrowserMessage::Pong(_) => {}
-                    BrowserMessage::Close(frame) => {
-                        let outgoing = GatewayMessage::Close(frame.map(|frame| GatewayCloseFrame {
-                            code: frame.code.into(),
-                            reason: frame.reason.to_string().into(),
-                        }));
-                        let _sent = send_gateway(&mut gateway, outgoing).await;
-                        let _flushed = flush_browser(&mut browser).await;
-                        return;
-                    }
-                }
-            }
-        }
-    }
-}
-
-async fn send_browser(browser: &mut WebSocket, message: BrowserMessage) -> bool {
-    matches!(
-        tokio::time::timeout(RELAY_IO_DEADLINE, browser.send(message)).await,
-        Ok(Ok(()))
-    )
-}
-
-async fn send_gateway(gateway: &mut GatewayRealtimeSocket, message: GatewayMessage) -> bool {
-    matches!(
-        tokio::time::timeout(RELAY_IO_DEADLINE, gateway.send(message)).await,
-        Ok(Ok(()))
-    )
-}
-
-async fn flush_browser(browser: &mut WebSocket) -> bool {
-    matches!(
-        tokio::time::timeout(RELAY_IO_DEADLINE, browser.flush()).await,
-        Ok(Ok(()))
-    )
-}
-
-async fn flush_gateway(gateway: &mut GatewayRealtimeSocket) -> bool {
-    matches!(
-        tokio::time::timeout(RELAY_IO_DEADLINE, gateway.flush()).await,
-        Ok(Ok(()))
-    )
-}
-
-async fn close_browser(browser: &mut WebSocket) {
-    let _bounded = tokio::time::timeout(RELAY_IO_DEADLINE, browser.close()).await;
-}
-
-async fn close_gateway(gateway: &mut GatewayRealtimeSocket) {
-    let _bounded = tokio::time::timeout(RELAY_IO_DEADLINE, gateway.close(None)).await;
-}
-
-#[cfg(test)]
-#[path = "realtime-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/serve-tests.rs b/crates/workshop/server/src/serve-tests.rs
deleted file mode 100644
index ac1594e00..000000000
--- a/crates/workshop/server/src/serve-tests.rs
+++ /dev/null
@@ -1,426 +0,0 @@
-//! Server lifecycle tests: readiness, graceful shutdown under held connections, and port release.
-
-use super::*;
-
-use std::path::{Path, PathBuf};
-
-use workshop_support::{AgentsConfig, GatewayConfig, ServerConfig};
-fn test_config(bind: &str, state_dir: &Path) -> Config {
-    Config {
-        gateway: GatewayConfig {
-            base_url: "http://127.0.0.1:1".to_string(),
-            api_key: "test-key".to_string(),
-        },
-        server: ServerConfig {
-            bind: bind.to_string(),
-            state_dir: state_dir.to_path_buf(),
-        },
-        agents: AgentsConfig::default(),
-    }
-}
-
-#[tokio::test]
-async fn readiness_means_the_health_endpoint_answers() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-    let url = server.url().to_string();
-    assert!(
-        url.starts_with("http://127.0.0.1:"),
-        "the URL names the bound loopback address: {url}"
-    );
-
-    let response = reqwest::get(format!("{url}/health"))
-        .await
-        .expect("the health endpoint answers once spawn returns");
-    assert_eq!(response.status(), reqwest::StatusCode::OK);
-    let body = response.text().await.expect("the health body reads");
-    assert_eq!(body, r#"{"status":"serving"}"#);
-
-    server.shutdown().expect("graceful shutdown succeeds");
-}
-
-/// The test config points the gateway at port 1, which never listens:
-/// the server must still boot and serve - the UI and its own health
-/// endpoint do not depend on the gateway, and the heartbeat reports
-/// the outage instead of failing startup.
-#[tokio::test]
-async fn the_server_boots_and_serves_the_ui_with_an_unreachable_gateway() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-    let url = server.url().to_string();
-
-    let health = reqwest::get(format!("{url}/health"))
-        .await
-        .expect("the health endpoint answers");
-    assert_eq!(health.status(), reqwest::StatusCode::OK);
-    let index = reqwest::get(format!("{url}/"))
-        .await
-        .expect("the UI answers");
-    assert_eq!(index.status(), reqwest::StatusCode::OK);
-
-    server.shutdown().expect("graceful shutdown succeeds");
-}
-
-/// The `-wal` sidecar the workspace file's database keeps beside `path`
-/// while the file is open.
-fn wal_of(path: &Path) -> PathBuf {
-    let mut name = path.as_os_str().to_owned();
-    name.push("-wal");
-    PathBuf::from(name)
-}
-
-/// Authors a workspace file at `file` granting `root` in a previous
-/// "run", lets go of it, and points `state_dir`'s `last-workspace` at
-/// it. Returns the granted path.
-async fn point_at_authored_workspace(state_dir: &Path, file: &Path, root: &Path) -> PathBuf {
-    let author = workshop_workspace::Workspace::new();
-    let granted = author.grant(root).expect("grant the root");
-    author.save_as(file).await.expect("save as creates");
-    author.close_backing_for_test().await;
-    std::fs::write(
-        state_dir.join("last-workspace"),
-        file.to_string_lossy().as_bytes(),
-    )
-    .expect("the pointer writes");
-    granted
-}
-
-/// The boot wiring itself, not a re-implementation of it: `serve_thread`
-/// must follow the `last-workspace` pointer before it signals readiness,
-/// so the first request over the real listener already sees the reopened
-/// file and its grants. Deleting the `reopen_last_workspace` call in
-/// `serve_thread` fails this test and nothing else.
-#[tokio::test]
-async fn spawn_reopens_the_pointed_workspace_before_readiness() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("mine.rvwork");
-    let granted = point_at_authored_workspace(state_dir.path(), &file, root.path()).await;
-
-    let server = spawn_with_grace(test_config("127.0.0.1:0", state_dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-    let url = server.url().to_string();
-
-    let response = reqwest::get(format!("{url}/workspace/file/current"))
-        .await
-        .expect("the workspace file endpoint answers once spawn returns");
-    assert_eq!(response.status(), reqwest::StatusCode::OK);
-    let current: serde_json::Value = response.json().await.expect("the body is JSON");
-    assert_eq!(current["path"], serde_json::json!(file));
-    assert_eq!(current["name"], "mine");
-    assert_eq!(
-        current["grants"],
-        serde_json::json!([{ "path": granted, "exists": true }]),
-        "the file's grants are live on the first request after readiness"
-    );
-
-    server.shutdown().expect("graceful shutdown succeeds");
-}
-
-/// A grace window short enough that the forced path proves itself in
-/// milliseconds instead of stalling the suite.
-const TEST_GRACE: Duration = Duration::from_millis(200);
-
-/// Connects a WebSocket to the workshop socket and returns it for the
-/// caller to hold open.
-async fn hold_ws_open(
-    url: &str,
-) -> tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>> {
-    let address = url.strip_prefix("http://").expect("the URL is http");
-    let (socket, _) = tokio_tungstenite::connect_async(format!("ws://{address}/ws"))
-        .await
-        .expect("the chat socket connects");
-    socket
-}
-
-/// Opens a raw connection and wedges it mid-request: the head promises
-/// a body that never fully arrives, so the handler waits on the body,
-/// no response begins, and the connection holds axum's graceful drain
-/// open until torn down. The head must pass the cross-site guard - a
-/// loopback `Host` and a JSON content type - or the guard answers 403
-/// without ever polling the body and nothing wedges.
-async fn wedge_http_connection(url: &str) -> tokio::net::TcpStream {
-    use tokio::io::AsyncWriteExt as _;
-
-    let address = url.strip_prefix("http://").expect("the URL is http");
-    let mut wedged = tokio::net::TcpStream::connect(address)
-        .await
-        .expect("the raw connection opens");
-    wedged
-        .write_all(
-            b"POST /workspace/grant HTTP/1.1\r\nhost: 127.0.0.1\r\n\
-              content-type: application/json\r\ncontent-length: 64\r\n\r\n{",
-        )
-        .await
-        .expect("the wedged request head sends");
-    // Give the accept loop and the handler a beat to pick the request
-    // up, so the connection is in-flight before shutdown begins.
-    tokio::time::sleep(Duration::from_millis(50)).await;
-    wedged
-}
-
-/// A client that never closes its WebSocket must not park shutdown
-/// forever. The upgrade detaches the session from axum's graceful
-/// drain, so today this stop is even graceful; the assertion pins only
-/// the bound, which the watchdog keeps true however axum's connection
-/// tracking evolves.
-#[tokio::test]
-async fn a_held_websocket_does_not_block_shutdown_past_the_grace_window() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), TEST_GRACE)
-        .expect("server spawns");
-    let _held = hold_ws_open(server.url()).await;
-
-    let begun = std::time::Instant::now();
-    server
-        .shutdown()
-        .expect("shutdown returns despite the held socket");
-    assert!(
-        begun.elapsed() < Duration::from_secs(3),
-        "shutdown must return shortly after the grace window, took {:?}",
-        begun.elapsed()
-    );
-}
-
-/// A connection wedged mid-request does hold the graceful drain open,
-/// so the watchdog must abandon the wait at the window and report the
-/// stop as forced.
-#[tokio::test]
-async fn a_wedged_http_connection_is_forced_out_at_the_grace_window() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), TEST_GRACE)
-        .expect("server spawns");
-    let _wedged = wedge_http_connection(server.url()).await;
-
-    let begun = std::time::Instant::now();
-    let outcome = server
-        .shutdown()
-        .expect("shutdown returns despite the wedged connection");
-    assert_eq!(
-        outcome,
-        Termination::Forced,
-        "an in-flight request cannot drain; the watchdog must force the stop"
-    );
-    assert!(
-        begun.elapsed() < Duration::from_secs(3),
-        "shutdown must return shortly after the grace window, took {:?}",
-        begun.elapsed()
-    );
-}
-
-#[tokio::test]
-async fn an_idle_shutdown_completes_gracefully_without_spending_the_window() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-
-    let begun = std::time::Instant::now();
-    let outcome = server.shutdown().expect("graceful shutdown succeeds");
-    assert_eq!(
-        outcome,
-        Termination::Graceful,
-        "nothing held the drain open"
-    );
-    assert!(
-        begun.elapsed() < SHUTDOWN_GRACE,
-        "an idle server must stop before the watchdog matters, took {:?}",
-        begun.elapsed()
-    );
-}
-
-#[test]
-fn server_shutdown_permanently_closes_every_host_updater_clone() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-    let updater = server.gateway_updater();
-    let clone = updater.clone();
-
-    server.shutdown().expect("graceful shutdown succeeds");
-
-    assert!(updater.publication_closed());
-    assert!(
-        clone.publication_closed(),
-        "application teardown closes the shared publication state for every clone"
-    );
-}
-
-#[test]
-fn server_handle_reports_the_identity_initially_published_into_state() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let gateway = workshop_gateway::test_gateway::ValidatedGateway::spawn_in(
-        "initial-key",
-        "fixtures::validated_gateway_fixture_process",
-    );
-    let identity = gateway.validate("initial-key", 1_778_000_001, "2026-09-08T18:00:01Z");
-    let resolved = ResolvedGateway::from_validated(identity.clone());
-    let server = spawn_inner(
-        test_config("127.0.0.1:0", dir.path()),
-        Some(resolved),
-        SHUTDOWN_GRACE,
-    )
-    .expect("server spawns");
-
-    assert!(
-        server
-            .initial_gateway_identity()
-            .is_some_and(|published| published.same_boot(&identity)),
-        "the host can authenticate which launch candidate entered server state"
-    );
-    server.shutdown().expect("graceful shutdown succeeds");
-}
-
-/// The stopped barrier: when `shutdown` returns, the server is really
-/// gone - nothing listens on its address - even when the stop was
-/// forced.
-#[tokio::test]
-async fn the_stopped_barrier_reports_after_serving_has_ended() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), TEST_GRACE)
-        .expect("server spawns");
-    let address = server
-        .url()
-        .strip_prefix("http://")
-        .expect("the URL is http")
-        .to_string();
-    let _wedged = wedge_http_connection(server.url()).await;
-
-    let outcome = server.shutdown().expect("shutdown returns");
-    assert_eq!(
-        outcome,
-        Termination::Forced,
-        "the wedged connection forces the stop"
-    );
-    let refused = tokio::net::TcpStream::connect(&address).await;
-    assert!(
-        refused.is_err(),
-        "the stopped barrier resolves only after serving has ended, yet {address} accepted"
-    );
-}
-
-#[tokio::test]
-async fn shutdown_releases_the_bound_port() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let server = spawn_with_grace(test_config("127.0.0.1:0", dir.path()), SHUTDOWN_GRACE)
-        .expect("server spawns");
-    let address = server
-        .url()
-        .strip_prefix("http://")
-        .expect("the URL is http")
-        .to_string();
-    server.shutdown().expect("graceful shutdown succeeds");
-
-    let listener = tokio::net::TcpListener::bind(&address)
-        .await
-        .expect("the port is free after shutdown");
-    drop(listener);
-}
-
-#[test]
-fn a_bind_conflict_fails_spawn_with_io_error() {
-    let blocker = std::net::TcpListener::bind("127.0.0.1:0").expect("bind blocker");
-    let address = blocker.local_addr().expect("blocker address");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = test_config(&address.to_string(), dir.path());
-    let error = spawn_with_grace(config, SHUTDOWN_GRACE).expect_err("a taken port must fail spawn");
-    assert!(
-        matches!(error, SpawnError::Io(_)),
-        "expected Io, got {error:?}"
-    );
-}
-
-/// The listener binds before the pointed workspace reopens, so a taken
-/// port fails boot without ever opening the file: nothing is left
-/// holding it, and no `-wal` sidecar is stranded beside it.
-#[tokio::test]
-async fn a_bind_conflict_leaves_the_pointed_workspace_unopened() {
-    let blocker = std::net::TcpListener::bind("127.0.0.1:0").expect("bind blocker");
-    let address = blocker.local_addr().expect("blocker address");
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("mine.rvwork");
-    point_at_authored_workspace(state_dir.path(), &file, root.path()).await;
-
-    let config = test_config(&address.to_string(), state_dir.path());
-    let error = spawn_with_grace(config, SHUTDOWN_GRACE).expect_err("a taken port must fail spawn");
-    assert!(
-        matches!(error, SpawnError::Io(_)),
-        "expected Io, got {error:?}"
-    );
-    assert!(
-        !wal_of(&file).exists(),
-        "a failed bind opened the pointed workspace and stranded its wal sidecar"
-    );
-}
-
-/// `spawn` refuses a non-loopback bind address before the server thread
-/// starts: no state is composed, so the boot temp sweep never runs and
-/// the pointed workspace file is never opened.
-#[tokio::test]
-async fn a_non_loopback_bind_fails_spawn_before_state_is_composed() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("mine.rvwork");
-    point_at_authored_workspace(state_dir.path(), &file, root.path()).await;
-    // Residue the boot sweep would remove if state were composed.
-    let orphan = state_dir.path().join("workshop-state.json.42-7.rv-tmp");
-    std::fs::write(&orphan, "partial").expect("the simulated crash residue writes");
-
-    let config = test_config("0.0.0.0:0", state_dir.path());
-    let error =
-        spawn_with_grace(config, SHUTDOWN_GRACE).expect_err("a non-loopback bind must fail spawn");
-    assert!(
-        matches!(&error, SpawnError::Io(io) if io.kind() == std::io::ErrorKind::InvalidInput),
-        "expected an InvalidInput Io error, got {error:?}"
-    );
-    assert!(
-        orphan.exists(),
-        "the boot temp sweep ran before the loopback check"
-    );
-    assert!(
-        !wal_of(&file).exists(),
-        "the pointed workspace was opened before the loopback check"
-    );
-}
-
-/// The server may only ever bind to loopback: a wildcard or LAN address
-/// would expose the workshop to other machines. `reuse_bind` refuses those
-/// before it creates a socket, so the error is `InvalidInput` rather than
-/// a late bind failure.
-#[tokio::test]
-async fn non_loopback_binds_are_refused_with_invalid_input() {
-    for address in ["0.0.0.0:0", "[::]:0", "192.168.1.10:0"] {
-        let error = reuse_bind(address).expect_err("a non-loopback address must be refused");
-        assert_eq!(
-            error.kind(),
-            std::io::ErrorKind::InvalidInput,
-            "refusing {address} must be an InvalidInput error"
-        );
-    }
-}
-
-#[tokio::test]
-async fn a_loopback_address_binds() {
-    let listener = reuse_bind("127.0.0.1:0").expect("a loopback address binds");
-    drop(listener);
-}
-
-/// A runner without IPv6 may fail an `[::1]` bind for a platform reason,
-/// but the refusal itself must never be the loopback check, so the error
-/// kind is anything but `InvalidInput`.
-#[tokio::test]
-async fn an_ipv6_loopback_bind_is_not_refused_with_invalid_input() {
-    match reuse_bind("[::1]:0") {
-        Ok(listener) => drop(listener),
-        Err(error) => assert_ne!(
-            error.kind(),
-            std::io::ErrorKind::InvalidInput,
-            "an IPv6 loopback bind must not be refused with InvalidInput"
-        ),
-    }
-}
diff --git a/crates/workshop/server/src/serve.rs b/crates/workshop/server/src/serve.rs
deleted file mode 100644
index 40840aee5..000000000
--- a/crates/workshop/server/src/serve.rs
+++ /dev/null
@@ -1,378 +0,0 @@
-//! In-process serving: the workshop server on a dedicated thread.
-//!
-//! [`spawn`] builds the shared state, binds the listener, and serves on its
-//! own thread with its own tokio runtime, so an embedding binary (the
-//! desktop app) keeps its main thread. The call blocks until the listener
-//! is bound - that bind is the readiness signal - and the returned
-//! [`ServerHandle`] holds the base URL and a graceful-shutdown switch. The
-//! stop side is bounded: a watchdog gives in-flight connections a grace
-//! window to drain and then tears the runtime down anyway, and a stopped
-//! barrier reports [`Termination`] back through [`ServerHandle::shutdown`],
-//! so a held socket can never park the embedding binary.
-
-use std::sync::mpsc;
-use std::thread::JoinHandle;
-use std::time::Duration;
-
-use crate::app::{StateError, router, state_with_gateway};
-use workshop_gateway::{GatewayUpdater, ResolvedGateway};
-use workshop_support::Config;
-
-/// How long a signaled shutdown waits for in-flight connections to drain
-/// before the watchdog abandons the graceful path. axum's drain waits on
-/// every connection it still tracks - a request wedged mid-body never
-/// drains - so this bound keeps one stuck client from parking the embedding
-/// binary's join forever. (Held WebSockets detach from the drain at upgrade.)
-const SHUTDOWN_GRACE: Duration = Duration::from_secs(5);
-
-/// How long either ending waits for the runtime to tear down. Canceled
-/// async tasks collapse at their next yield, but a wedged blocking task
-/// would otherwise hold the runtime's drop - and with it the embedding
-/// binary's join - open indefinitely.
-const RUNTIME_TEARDOWN: Duration = Duration::from_secs(1);
-
-/// How a [`ServerHandle::shutdown`] ended.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum Termination {
-    /// Every in-flight connection drained within the grace window.
-    Graceful,
-    /// The grace window lapsed with connections still held open, and the
-    /// runtime was torn down anyway.
-    Forced,
-}
-
-/// A running workshop server on its own thread.
-///
-/// Dropping the handle without calling [`ServerHandle::shutdown`] still
-/// signals the server to stop, but does not wait for it.
-#[derive(Debug)]
-pub struct ServerHandle {
-    url: String,
-    gateway: GatewayUpdater,
-    initial_gateway_identity: Option<workshop_gateway::discovery::ValidatedConnection>,
-    shutdown: Option<tokio::sync::oneshot::Sender<()>>,
-    stopped: mpsc::Receiver<Termination>,
-    thread: Option<JoinHandle<std::io::Result<()>>>,
-}
-
-impl ServerHandle {
-    /// Returns the base URL the server is listening on, for example
-    /// `http://127.0.0.1:7910`.
-    #[must_use]
-    pub fn url(&self) -> &str {
-        &self.url
-    }
-
-    /// Returns the restricted local-Gateway handle used by an embedding
-    /// desktop app to replace a sidecar atomically and request shutdown from
-    /// the current validated generation.
-    #[must_use]
-    pub fn gateway_updater(&self) -> GatewayUpdater {
-        self.gateway.clone()
-    }
-
-    /// Returns the validated local Gateway identity initially published into
-    /// server state, or `None` when explicit configuration won resolution.
-    #[must_use]
-    pub fn initial_gateway_identity(
-        &self,
-    ) -> Option<&workshop_gateway::discovery::ValidatedConnection> {
-        self.initial_gateway_identity.as_ref()
-    }
-
-    /// Signals shutdown and waits for the server thread to finish,
-    /// reporting how the stop ended.
-    ///
-    /// The wait is bounded by the server's own watchdog: in-flight
-    /// connections get a grace window to drain, and when one outlasts it
-    /// (a request wedged mid-body), the runtime is torn down anyway and
-    /// the stop reports [`Termination::Forced`].
-    ///
-    /// # Errors
-    /// Returns `std::io::Error` if the server stopped with an error or the
-    /// server thread panicked.
-    pub fn shutdown(mut self) -> std::io::Result<Termination> {
-        self.gateway.close_publication();
-        if let Some(shutdown) = self.shutdown.take() {
-            let _ = shutdown.send(());
-        }
-        let stopped = self.stopped.recv();
-        self.join_inner()?;
-        // The barrier is sent on every post-readiness path, so a missing
-        // report means the thread died without running its teardown.
-        stopped.map_err(|_| std::io::Error::other("the server thread stopped without reporting"))
-    }
-
-    /// Waits for the server thread to finish on its own, without signaling
-    /// shutdown.
-    ///
-    /// # Errors
-    /// Returns `std::io::Error` if the server stopped with an error or the
-    /// server thread panicked.
-    pub fn join(mut self) -> std::io::Result<()> {
-        self.join_inner()
-    }
-
-    fn join_inner(&mut self) -> std::io::Result<()> {
-        let Some(thread) = self.thread.take() else {
-            return Ok(());
-        };
-        match thread.join() {
-            Ok(result) => result,
-            Err(_) => Err(std::io::Error::other("workshop server thread panicked")),
-        }
-    }
-}
-
-impl Drop for ServerHandle {
-    fn drop(&mut self) {
-        self.gateway.close_publication();
-        if let Some(shutdown) = self.shutdown.take() {
-            let _ = shutdown.send(());
-        }
-    }
-}
-
-/// A failure to start the in-process workshop server: rich, init-only, and
-/// never sent over the wire, so `#[from]` conveniences are welcome here.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum SpawnError {
-    /// The gateway endpoint could not be resolved, or the shared state
-    /// could not be built.
-    #[non_exhaustive]
-    #[error("build shared state")]
-    State(#[from] StateError),
-
-    /// An I/O failure: the bind address is not loopback, the listener
-    /// bind failed, the bound address could not be read, or the server
-    /// thread could not be spawned.
-    #[non_exhaustive]
-    #[error("start workshop server")]
-    Io(#[from] std::io::Error),
-}
-
-/// Spawns the workshop server on a dedicated thread and blocks until the
-/// listener is bound.
-///
-/// The bound listener is the readiness signal: when this returns `Ok`, the
-/// server is accepting connections at [`ServerHandle::url`].
-///
-/// # Errors
-/// Returns [`SpawnError::State`] if the gateway endpoint cannot be
-/// resolved (no live gateway discovery file and no explicit `[gateway]` config)
-/// or the shared state cannot be built, and [`SpawnError::Io`] if the
-/// bind address is not loopback, the bind fails, or the server thread
-/// cannot be spawned.
-pub fn spawn(config: Config) -> Result<ServerHandle, SpawnError> {
-    spawn_inner(config, None, SHUTDOWN_GRACE)
-}
-
-#[cfg(feature = "test-fixtures")]
-pub(crate) fn spawn_resolved(config: Config) -> Result<ServerHandle, SpawnError> {
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    spawn_inner(config, Some(gateway), SHUTDOWN_GRACE)
-}
-
-/// [`spawn`] with the shutdown grace window injectable, so tests prove the
-/// forced path in milliseconds instead of waiting out the real window.
-/// Discovery is bypassed, so a test never consults the real run directory.
-#[cfg(test)]
-fn spawn_with_grace(config: Config, grace: Duration) -> Result<ServerHandle, SpawnError> {
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    spawn_inner(config, Some(gateway), grace)
-}
-
-fn spawn_inner(
-    config: Config,
-    gateway: Option<ResolvedGateway>,
-    grace: Duration,
-) -> Result<ServerHandle, SpawnError> {
-    // Composing state sweeps the state directory and reopening follows
-    // the workspace pointer, so a refused address must fail before either.
-    // `loopback_address` names the address in its message already.
-    loopback_address(&config.server.bind).map_err(SpawnError::Io)?;
-    // Discovery runs before the server thread starts: a resolution
-    // failure is the plain no-gateway error, never a bind-then-fail.
-    let gateway = match gateway {
-        Some(gateway) => gateway,
-        None => workshop_gateway::resolve(&config.gateway).map_err(StateError::Resolution)?,
-    };
-    let initial_gateway_identity = gateway.identity().cloned();
-    let (ready_tx, ready_rx) = mpsc::channel();
-    let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
-    let (stopped_tx, stopped_rx) = mpsc::channel();
-    let thread = std::thread::Builder::new()
-        .name("workshop-server".to_string())
-        .spawn(move || serve_thread(config, gateway, ready_tx, shutdown_rx, &stopped_tx, grace))
-        .map_err(|e| {
-            SpawnError::Io(std::io::Error::new(
-                e.kind(),
-                format!("spawn the workshop-server thread: {e}"),
-            ))
-        })?;
-    match ready_rx.recv() {
-        Ok(Ok((url, gateway))) => Ok(ServerHandle {
-            url,
-            gateway,
-            initial_gateway_identity,
-            shutdown: Some(shutdown_tx),
-            stopped: stopped_rx,
-            thread: Some(thread),
-        }),
-        Ok(Err(error)) => {
-            let _ = thread.join();
-            Err(error)
-        }
-        Err(_) => {
-            let _ = thread.join();
-            Err(SpawnError::Io(std::io::Error::other(
-                "workshop server thread exited before binding",
-            )))
-        }
-    }
-}
-
-/// The server thread's body: build a runtime, build state, bind, reopen
-/// the last workspace, signal readiness through `ready`, then serve until
-/// `shutdown` resolves. When it does, a watchdog bounds the graceful drain
-/// at `grace` before tearing the runtime down anyway, and `stopped` reports
-/// which of the two endings ran.
-///
-/// Startup failures are reported through `ready`; only serving failures
-/// become the thread's return value.
-fn serve_thread(
-    config: Config,
-    gateway: ResolvedGateway,
-    ready: mpsc::Sender<Result<(String, GatewayUpdater), SpawnError>>,
-    shutdown: tokio::sync::oneshot::Receiver<()>,
-    stopped: &mpsc::Sender<Termination>,
-    grace: Duration,
-) -> std::io::Result<()> {
-    let runtime = match tokio::runtime::Builder::new_multi_thread()
-        .enable_all()
-        .build()
-    {
-        Ok(runtime) => runtime,
-        Err(error) => {
-            let _ = ready.send(Err(SpawnError::Io(error)));
-            return Ok(());
-        }
-    };
-    let (outcome, result) = runtime.block_on(async move {
-        let state = match state_with_gateway(&config, &gateway) {
-            Ok(state) => state,
-            Err(error) => {
-                let _ = ready.send(Err(SpawnError::State(error)));
-                return (Termination::Graceful, Ok(()));
-            }
-        };
-        let listener = match reuse_bind(&config.server.bind) {
-            Ok(listener) => listener,
-            Err(error) => {
-                let _ = ready.send(Err(SpawnError::Io(error)));
-                return (Termination::Graceful, Ok(()));
-            }
-        };
-        let address = match listener.local_addr() {
-            Ok(address) => address,
-            Err(error) => return (Termination::Graceful, Err(error)),
-        };
-        // The last-used workspace is restored after the bind, so a failed
-        // bind never opens its file, and before readiness, so readiness
-        // means the grants are already in place; a pointer that cannot be
-        // followed starts ephemeral and never fails boot.
-        state.reopen_last_workspace().await;
-        let app = router(state.clone());
-        let _ = ready.send(Ok((format!("http://{address}"), state.gateway_updater())));
-        // The subsystems' registered background tasks start with serving
-        // and stop inside the same graceful-shutdown signal, so they
-        // never outlive the server.
-        let tasks: Vec<_> = state
-            .registry()
-            .tasks()
-            .iter()
-            .map(|task| task.spawn())
-            .collect();
-        let (draining_tx, draining_rx) = tokio::sync::oneshot::channel();
-        let serve = async {
-            axum::serve(listener, app)
-                .with_graceful_shutdown(async move {
-                    let _ = shutdown.await;
-                    // Arm the watchdog before draining the background
-                    // tasks, so the grace window bounds the whole stop.
-                    let _ = draining_tx.send(());
-                    for task in tasks {
-                        task.shutdown().await;
-                    }
-                })
-                .await
-        };
-        // axum's graceful shutdown waits for every connection it still
-        // tracks - a request wedged mid-body parks it, while WebSockets
-        // detach at upgrade (both pinned by the shutdown tests); once the
-        // window lapses the watchdog wins the select and the graceful
-        // wait is abandoned with the serve future.
-        let watchdog = async {
-            let _ = draining_rx.await;
-            tokio::time::sleep(grace).await;
-        };
-        let outcome = tokio::select! {
-            result = serve => (Termination::Graceful, result),
-            () = watchdog => (Termination::Forced, Ok(())),
-        };
-        state.close_gateway_publication();
-        outcome
-    });
-    // The barrier reports before teardown: the embedding binary's join is
-    // bounded by RUNTIME_TEARDOWN, not by what abandoned tasks still hold.
-    let _ = stopped.send(outcome);
-    // A graceful serve-return is not quiescence: sessions that detached at
-    // upgrade can still be running, so both endings take the bounded
-    // teardown - canceled tasks collapse at their next yield, and a wedged
-    // blocking task is abandoned so it cannot park the embedding binary.
-    // Never `process::exit` here - this crate runs inside embedding binaries.
-    runtime.shutdown_timeout(RUNTIME_TEARDOWN);
-    result
-}
-
-/// Parses `address` as a socket address and refuses any that is not
-/// loopback, with [`std::io::ErrorKind::InvalidInput`] either way.
-fn loopback_address(address: &str) -> std::io::Result<std::net::SocketAddr> {
-    let addr: std::net::SocketAddr = address.parse().map_err(|e| {
-        std::io::Error::new(
-            std::io::ErrorKind::InvalidInput,
-            format!("parse bind address {address}: {e}"),
-        )
-    })?;
-    if !addr.ip().is_loopback() {
-        return Err(std::io::Error::new(
-            std::io::ErrorKind::InvalidInput,
-            format!("refusing to bind {addr}: the workshop server binds only to loopback"),
-        ));
-    }
-    Ok(addr)
-}
-
-/// Binds a TCP listener with `SO_REUSEADDR` so a restart doesn't fail on
-/// TIME_WAIT sockets from the previous instance.
-fn reuse_bind(address: &str) -> std::io::Result<tokio::net::TcpListener> {
-    // A second line of defense behind `spawn_inner`'s check: the socket
-    // itself never binds a non-loopback address.
-    let addr = loopback_address(address)?;
-    let socket = socket2::Socket::new(
-        socket2::Domain::for_address(addr),
-        socket2::Type::STREAM,
-        Some(socket2::Protocol::TCP),
-    )?;
-    socket.set_reuse_address(true)?;
-    socket.set_nonblocking(true)?;
-    socket.bind(&addr.into())?;
-    socket.listen(1024)?;
-    tokio::net::TcpListener::from_std(socket.into())
-}
-
-#[cfg(test)]
-#[path = "serve-tests.rs"]
-mod tests;
diff --git a/crates/workshop/server/src/websocket.rs b/crates/workshop/server/src/websocket.rs
deleted file mode 100644
index 6679c2fc3..000000000
--- a/crates/workshop/server/src/websocket.rs
+++ /dev/null
@@ -1,114 +0,0 @@
-//! What the server's two WebSocket endpoints share: the frame-sending
-//! helpers, the cross-site upgrade refusal, and [`SocketState`], the
-//! route state both the `/ws` workshop socket
-//! ([`crate::workshop_socket`]) and the sessions subsystem's routes
-//! ([`crate::agents`]) wrap. Neither of those modules imports the other;
-//! both import this one.
-
-use std::sync::Arc;
-
-use axum::extract::ws::{Message, WebSocket};
-use axum::http::HeaderMap;
-use axum::response::{IntoResponse, Response};
-
-use workshop_gateway::{GatewayHandles, GatewayHealth, GatewaySnapshot};
-use workshop_protocol::{ErrorEnvelope, ErrorFrame};
-use workshop_registry::{Push, Registry};
-
-/// The route state every socket route draws from: the subsystem registry
-/// its handles are read through, and the server's WebSocket origin
-/// policy. Each handle is read through the registry's type-keyed state
-/// collection at the point of use, an `Option` whose `None` degrades the
-/// feature rather than failing the route.
-///
-/// The origin policy is injected by the server as a plain function: the
-/// cross-site guard is the server's security boundary (its `cross_site`
-/// module), and the socket routes apply it to every upgrade without
-/// owning the policy.
-#[derive(Debug, Clone)]
-pub(crate) struct SocketState {
-    registry: Registry,
-    origin_allowed: fn(&HeaderMap) -> bool,
-}
-
-impl SocketState {
-    /// Builds the state over the subsystem registry and the server's
-    /// origin policy.
-    #[must_use]
-    pub(crate) fn new(registry: Registry, origin_allowed: fn(&HeaderMap) -> bool) -> Self {
-        Self {
-            registry,
-            origin_allowed,
-        }
-    }
-
-    /// The subsystem registry: the status push channel and the push
-    /// facade are reached through its collections.
-    pub(crate) fn registry(&self) -> &Registry {
-        &self.registry
-    }
-
-    /// The push facade over the status, catalog, and menu sinks.
-    pub(crate) fn push(&self) -> Push {
-        self.registry.push()
-    }
-
-    /// Shared gateway reachability, published by the heartbeat; `None`
-    /// while the gateway subsystem has not registered reads as the
-    /// flag's optimistic default.
-    pub(crate) fn health(&self) -> Option<GatewayHealth> {
-        self.registry
-            .state::<GatewayHandles>()
-            .map(|handles| handles.health().clone())
-    }
-
-    /// One atomic Gateway endpoint and credential generation, or `None`
-    /// while the gateway subsystem has not registered.
-    pub(crate) fn gateway_snapshot(&self) -> Option<Arc<GatewaySnapshot>> {
-        self.registry
-            .state::<GatewayHandles>()
-            .map(|handles| handles.binding().snapshot())
-    }
-
-    /// The server's WebSocket origin policy, applied to every upgrade.
-    pub(crate) fn origin_allowed(&self, headers: &HeaderMap) -> bool {
-        (self.origin_allowed)(headers)
-    }
-}
-
-/// The 403 refusal every WebSocket upgrade answers a foreign `Origin`
-/// with: the same `cross_site` envelope the server's guard middleware
-/// renders for plain HTTP requests.
-pub(crate) fn cross_site_refusal() -> Response {
-    let envelope = ErrorEnvelope::new("cross-site request refused", "cross_site");
-    // Serializing the envelope cannot fail: two strings only.
-    let body = serde_json::to_string(&envelope)
-        .unwrap_or_else(|_| "cross-site request refused".to_string());
-    (
-        axum::http::StatusCode::FORBIDDEN,
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        body,
-    )
-        .into_response()
-}
-
-/// Sends one JSON text frame; a false return means the client is gone.
-pub(crate) async fn send_frame<F: serde::Serialize>(socket: &mut WebSocket, frame: &F) -> bool {
-    // Serializing the protocol frames cannot fail: strings, integers, and
-    // JSON values only. A frame that somehow cannot serialize is skipped,
-    // which is not a gone client.
-    let Ok(text) = serde_json::to_string(frame) else {
-        return true;
-    };
-    socket.send(Message::Text(text.into())).await.is_ok()
-}
-
-/// Sends one `error` frame with `message`, tagged with the request's
-/// `id` when there is one, ignoring a dead client.
-pub(crate) async fn send_error(
-    socket: &mut WebSocket,
-    id: Option<&serde_json::Value>,
-    message: impl Into<String>,
-) {
-    let _ = send_frame(socket, &ErrorFrame::new(message.into(), id)).await;
-}
diff --git a/crates/workshop/server/src/workshop_socket-menu.rs b/crates/workshop/server/src/workshop_socket-menu.rs
deleted file mode 100644
index 8cbe03282..000000000
--- a/crates/workshop/server/src/workshop_socket-menu.rs
+++ /dev/null
@@ -1,327 +0,0 @@
-//! The socket side of the Model menu: `select_model` and
-//! `switch_profile` frame handling, plus the profile-selection task that
-//! persists the selection on the gateway, restarts a supervised sidecar
-//! to load it, and holds the status bar busy until it settles. The menu
-//! state and bus sit in the menu subsystem (`workshop-menu`); this
-//! module is only the session's orchestration of them.
-
-use std::sync::Arc;
-use std::time::Duration;
-
-use axum::extract::ws::WebSocket;
-
-use workshop_gateway::{
-    GatewayClient, GatewayError, GatewayResponse, GatewaySnapshot, SwitchResponse, refresh_catalog,
-    refresh_profiles,
-};
-use workshop_menu::{MenuBus, SwitchOutcome};
-use workshop_protocol::{Activity, SelectModelFrame, SwitchProfileFrame};
-use workshop_registry::Push;
-
-use crate::websocket::send_error;
-
-use super::WorkshopSocketState;
-
-/// Handles a `select_model` frame: the menu validates the id against
-/// the retained catalog and publishes the fresh workbench snapshot,
-/// which reaches this client through its own menu branch. Handled
-/// inline in the session loop - a map lookup and a broadcast send cost
-/// microseconds between two deltas. A refusal (an unknown model, a
-/// missing field) is answered with an `error` frame and the session
-/// continues.
-pub(super) async fn select_model(
-    state: &WorkshopSocketState,
-    id: Option<&serde_json::Value>,
-    frame: &serde_json::Value,
-    socket: &mut WebSocket,
-) {
-    let Ok(request) = serde_json::from_value::<SelectModelFrame>(frame.clone()) else {
-        send_error(socket, id, "select_model needs a \"model\" string").await;
-        return;
-    };
-    let Some(menu) = state.menu() else {
-        send_error(socket, id, "the model menu is unavailable").await;
-        return;
-    };
-    if let Err(refusal) = menu.set_selected(&request.model) {
-        send_error(socket, id, refusal.to_string()).await;
-    }
-}
-
-/// Handles a `switch_profile` frame: `begin_switch` publishes the
-/// pending snapshot (`switching` set, `chat_ready` false) before this
-/// returns, and the selection itself runs on its own task. A refusal (a
-/// switch already in flight, a missing or mistyped `name`) is answered
-/// with an `error` frame and the session continues.
-pub(super) async fn start_switch(
-    state: &WorkshopSocketState,
-    id: Option<&serde_json::Value>,
-    frame: &serde_json::Value,
-    socket: &mut WebSocket,
-) {
-    let Ok(request) = serde_json::from_value::<SwitchProfileFrame>(frame.clone()) else {
-        send_error(
-            socket,
-            id,
-            "switch_profile needs a \"name\" string, or null for no profile",
-        )
-        .await;
-        return;
-    };
-    let Some(menu) = state.menu() else {
-        send_error(socket, id, "the model menu is unavailable").await;
-        return;
-    };
-    let Some(snapshot) = state.gateway_snapshot() else {
-        send_error(socket, id, "the gateway is unavailable").await;
-        return;
-    };
-    if let Err(refusal) = menu.begin_switch(request.name.as_deref()) {
-        send_error(socket, id, refusal.to_string()).await;
-        return;
-    }
-    // Deliberately not client-scoped - a stated exception to the crate's
-    // drop-guard cancellation rule: a profile selection is global server
-    // state, not work held on behalf of one client, so it runs to
-    // completion (and settles the menu) even if the clicking client
-    // disconnects mid-switch.
-    let push = state.push();
-    let state = state.clone();
-    tokio::spawn(async move {
-        run_switch(&state, snapshot, &push, &menu, request.name.as_deref()).await;
-    });
-}
-
-/// The status-bar text while a selection runs; the bar stays busy under
-/// it until the switch settles with its own terminal frame.
-const SWITCHING_LABEL: &str = "Switching profile...";
-
-/// How often the sequence re-reads the published gateway generation while
-/// waiting for the relaunched sidecar.
-const REPLACEMENT_POLL: Duration = Duration::from_millis(250);
-
-/// Runs one profile selection to its end and settles the menu: the
-/// selection persisted and served (through a sidecar restart when the
-/// gateway asks for one) refetches the profile state and model catalog
-/// through the serving gateway and completes; a selection a LAN gateway
-/// must be restarted by hand to load settles deferred, the running
-/// profile unchanged; a failure restores the truthful pre-switch state
-/// and reports itself.
-///
-/// The status bar goes busy once, here at the start; every settled arm
-/// ends with a non-busy frame (idle, the deferred notice, or the
-/// failure), so no separate idle push is needed.
-async fn run_switch(
-    state: &WorkshopSocketState,
-    snapshot: Arc<GatewaySnapshot>,
-    push: &Push,
-    menu: &MenuBus,
-    name: Option<&str>,
-) {
-    push.push_busy(
-        SWITCHING_LABEL,
-        format!("switching to {}", describe(name)),
-        Activity::General,
-    );
-    match drive_switch(state, &snapshot, name).await {
-        Ok(Settled::Serving(client)) => {
-            // The settled snapshot reads a fresh catalog and profile list
-            // from the gateway that now serves the selection.
-            tokio::join!(
-                refresh_profiles(&client, push),
-                refresh_catalog(&client, push)
-            );
-            menu.finish_switch(SwitchOutcome::Completed);
-            push.push_idle();
-        }
-        Ok(Settled::RestartRequired) => {
-            menu.finish_switch(SwitchOutcome::Deferred);
-            push.push_status_update("Profile selected", deferred_notice(name), Activity::General);
-        }
-        Err(failure) => {
-            // A gateway that refused or dropped the selection still
-            // serves, and its state may have changed, so the menu
-            // refetches before it settles. A sidecar that was shut down
-            // and never came back has nothing truthful to fetch: the
-            // heartbeat reports the outage and repopulates the menu when
-            // a generation does appear.
-            if failure.gateway_serves()
-                && let Some(current) = state.gateway_snapshot()
-            {
-                tokio::join!(
-                    refresh_profiles(current.client(), push),
-                    refresh_catalog(current.client(), push)
-                );
-            }
-            menu.finish_switch(SwitchOutcome::Failed);
-            push.push_failure(
-                "Profile switch failed",
-                failure.to_string(),
-                Activity::General,
-            );
-        }
-    }
-}
-
-/// How a selection ended short of failure.
-enum Settled {
-    /// The gateway behind `client` serves the selection.
-    Serving(GatewayClient),
-    /// The selection persisted, but the gateway is not a supervised
-    /// sidecar: the operator restarts it by hand.
-    RestartRequired,
-}
-
-/// Why one profile selection did not complete. The display text is the
-/// user-facing description pushed with the failure status, so each
-/// variant renders exactly the message the stringly channel reported.
-#[derive(Debug, thiserror::Error)]
-enum SwitchFailure {
-    /// The selection request failed in transit; the client's typed error
-    /// is retained as the cause.
-    #[error(transparent)]
-    Transport(GatewayError),
-    /// The gateway refused the selection; the payload is the gateway's
-    /// own refusal message, relayed verbatim.
-    #[error("{0}")]
-    Refused(String),
-    /// The sidecar refused or never received its shutdown request.
-    #[error("the gateway did not accept its shutdown request: {0}")]
-    Shutdown(String),
-    /// No replacement gateway serving the selection appeared in time.
-    #[error("gateway did not return after restart")]
-    RestartTimeout,
-}
-
-impl SwitchFailure {
-    /// Whether the published gateway generation still serves after this
-    /// failure: true before any shutdown went out, false once the sidecar
-    /// was asked to exit.
-    fn gateway_serves(&self) -> bool {
-        matches!(self, Self::Transport(_) | Self::Refused(_))
-    }
-}
-
-/// Posts the selection and runs the sequence: `Serving` at once when the
-/// gateway needs no restart, `RestartRequired` when it does but is not a
-/// supervised sidecar, else the shutdown-and-reappear step whose
-/// replacement generation ends up `Serving`.
-async fn drive_switch(
-    state: &WorkshopSocketState,
-    snapshot: &Arc<GatewaySnapshot>,
-    name: Option<&str>,
-) -> Result<Settled, SwitchFailure> {
-    let outcome = match snapshot.client().switch_profile(name).await {
-        Ok(SwitchResponse::Selected(outcome)) => outcome,
-        Ok(SwitchResponse::Buffered(refusal)) => {
-            return Err(SwitchFailure::Refused(switch_refusal(&refusal)));
-        }
-        // A variant this build does not know: the gateway may grow
-        // response shapes, and a lost selection never degrades the server.
-        Ok(_) => {
-            return Err(SwitchFailure::Refused(
-                "unrecognized gateway answer".to_owned(),
-            ));
-        }
-        Err(error) => return Err(SwitchFailure::Transport(error)),
-    };
-    if !outcome.restart_required {
-        return Ok(Settled::Serving(snapshot.client().clone()));
-    }
-    if !snapshot.is_sidecar() {
-        return Ok(Settled::RestartRequired);
-    }
-    let generation = snapshot.generation();
-    // The shutdown request is blocking I/O against the sidecar; the
-    // supervisor relaunches the sibling once the process exits.
-    let shutdown = Arc::clone(snapshot);
-    match tokio::task::spawn_blocking(move || shutdown.request_shutdown()).await {
-        Ok(Ok(_)) => {}
-        Ok(Err(error)) => return Err(SwitchFailure::Shutdown(error.to_string())),
-        Err(join) => return Err(SwitchFailure::Shutdown(join.to_string())),
-    }
-    // The captured pre-restart client is never used past this point: the
-    // relaunched sidecar binds a fresh port and key, published as a new
-    // generation by the supervisor.
-    let replacement = await_replacement(state, generation, name).await?;
-    Ok(Settled::Serving(replacement.client().clone()))
-}
-
-/// Waits for a published generation newer than `generation` whose status
-/// reports `target` as the served profile, within the state's restart
-/// bound.
-async fn await_replacement(
-    state: &WorkshopSocketState,
-    generation: u64,
-    target: Option<&str>,
-) -> Result<Arc<GatewaySnapshot>, SwitchFailure> {
-    let converged = async {
-        loop {
-            if let Some(candidate) = state.gateway_snapshot()
-                && candidate.generation() > generation
-                && served_profile(candidate.client())
-                    .await
-                    .as_ref()
-                    .map(Option::as_deref)
-                    == Some(target)
-            {
-                return candidate;
-            }
-            tokio::time::sleep(REPLACEMENT_POLL).await;
-        }
-    };
-    tokio::time::timeout(state.restart_bound(), converged)
-        .await
-        .map_err(|_| SwitchFailure::RestartTimeout)
-}
-
-/// The profile `GET /admin/status` reports as served - `Some(None)` for
-/// a gateway serving no profile - or `None` when the gateway did not
-/// answer with a status document.
-async fn served_profile(client: &GatewayClient) -> Option<Option<String>> {
-    let response = client.profile_status().await.ok()?;
-    if !response.status.is_success() {
-        return None;
-    }
-    let body: serde_json::Value = serde_json::from_slice(&response.body).ok()?;
-    let profile = body.get("profile")?;
-    if profile.is_null() {
-        return Some(None);
-    }
-    profile.as_str().map(|name| Some(name.to_owned()))
-}
-
-/// The notice for a selection a LAN gateway persisted but must be
-/// restarted by hand to apply: a named profile is loaded by the restart,
-/// no profile unloads whatever the gateway is running.
-fn deferred_notice(name: Option<&str>) -> String {
-    name.map_or_else(
-        || "no profile selected; restart the gateway to unload the running profile".to_owned(),
-        |name| format!("profile {name:?} selected; restart the gateway to load it"),
-    )
-}
-
-/// Renders the selection for status text: the quoted profile name, or
-/// `no profile`.
-fn describe(name: Option<&str>) -> String {
-    name.map_or_else(|| "no profile".to_owned(), |name| format!("{name:?}"))
-}
-
-/// The failure description of a buffered switch refusal: the gateway's
-/// own error message when its envelope has one, else the status.
-fn switch_refusal(refusal: &GatewayResponse) -> String {
-    value_from_bytes(&refusal.body)
-        .get("error")
-        .and_then(|error| error.get("message"))
-        .and_then(serde_json::Value::as_str)
-        .map_or_else(
-            || format!("gateway declined the switch with status {}", refusal.status),
-            str::to_string,
-        )
-}
-
-/// Parses a gateway body as JSON, falling back to a plain string.
-fn value_from_bytes(body: &[u8]) -> serde_json::Value {
-    serde_json::from_slice(body)
-        .unwrap_or_else(|_| serde_json::Value::String(String::from_utf8_lossy(body).into_owned()))
-}
diff --git a/crates/workshop/server/src/workshop_socket.rs b/crates/workshop/server/src/workshop_socket.rs
deleted file mode 100644
index 5bcaf295f..000000000
--- a/crates/workshop/server/src/workshop_socket.rs
+++ /dev/null
@@ -1,383 +0,0 @@
-//! The `/ws` WebSocket endpoint: one persistent socket for the
-//! workshop's downstream JSON - unsolicited status updates from the
-//! status bus, model catalog pushes, and workbench snapshots - plus the
-//! inbound Model-menu events.
-//!
-//! A client upgrades `GET /ws` once. The Model-menu events arrive on
-//! that socket. `{"type":"select_model","model":"..."}` selects the
-//! chat model: the menu validates the id against the retained catalog and
-//! publishes the fresh workbench snapshot, handled inline because a map
-//! lookup and a broadcast send cost microseconds; an unknown model is
-//! refused with an `error` frame. `{"type":"switch_profile","name":...}`
-//! selects a gateway profile (`null` selects no profile): `begin_switch`
-//! publishes the pending snapshot (`switching` set, `chat_ready` false)
-//! before the frame handler returns, and the selection itself runs on
-//! its own task - it persists the selection on the gateway, restarts a
-//! supervised sidecar when the gateway must reload, reports each step as
-//! determinate status-bar progress, refetches the profile state and model
-//! catalog, and settles the menu. A second switch while one runs is
-//! refused with an `error` frame. Both events echo an `id` on their
-//! refusals when the frame included one. A frame that is not a
-//! well-formed menu event is answered with an `error` frame and the
-//! session continues. Chat itself is on the `/agents/ws` socket, served
-//! by the sessions subsystem.
-//!
-//! One task owns the socket: a single `select!` loop reads inbound frames
-//! and writes every outbound frame itself - no outbox channel, no writer
-//! task. Status updates from the status subsystem, catalog pushes and
-//! workbench snapshots from the menu subsystem flow as they publish. On
-//! connect the session first sends the retained status, catalog, and
-//! workbench snapshots, honoring the delivery contract's resend promise
-//! (see `workshop-protocol`) - the UI boots from this socket alone, with
-//! zero HTTP state fetches; after that the buses forward as they publish,
-//! and a session too slow to drain them skips ahead to the newest
-//! snapshot rather than slowing the producers.
-//!
-//! The status channel is reached through the subsystem registry
-//! ([`SocketState::registry`]), not named directly: an unregistered
-//! slot degrades the session to no status frames rather than failing it.
-
-#[path = "workshop_socket-menu.rs"]
-mod menu;
-
-use std::ops::Deref;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::Duration;
-
-use axum::Router;
-use axum::extract::State;
-use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
-use axum::http::HeaderMap;
-use axum::response::Response;
-use axum::routing::get;
-use tokio::sync::broadcast;
-use tokio::sync::broadcast::error::RecvError;
-
-use workshop_menu::{CatalogBus, MenuBus, MenuHandles};
-use workshop_protocol::{CatalogPush, StatusBarUpdate, WorkbenchSnapshot};
-use workshop_registry::{Registration, Registry, RouteRegistrarAdapter};
-use workshop_support::recv_or_pending;
-
-use crate::websocket::{SocketState, cross_site_refusal, send_error, send_frame};
-
-use self::menu::{select_model, start_switch};
-
-/// How long a profile switch waits for a relaunched sidecar gateway to
-/// publish a replacement generation serving the selection before the
-/// switch fails. Model downloads never run inside this window (the boot
-/// load publishes its listener first), so it covers process exit, the
-/// supervisor's relaunch, and the bind.
-const DEFAULT_RESTART_BOUND: Duration = Duration::from_secs(90);
-
-/// The `/ws` route state: the socket state every socket route shares
-/// (registry, origin policy, and the gateway and push accessors, reached
-/// through `Deref`), plus the catalog and menu buses the session forwards
-/// and the bound a profile switch waits for a relaunched sidecar.
-#[derive(Debug, Clone)]
-pub(crate) struct WorkshopSocketState {
-    socket: SocketState,
-    restart_bound: Duration,
-}
-
-impl WorkshopSocketState {
-    /// Builds the route state over the subsystem registry and the
-    /// server's origin policy, with the default restart bound.
-    #[must_use]
-    pub(crate) fn new(registry: Registry, origin_allowed: fn(&HeaderMap) -> bool) -> Self {
-        Self {
-            socket: SocketState::new(registry, origin_allowed),
-            restart_bound: DEFAULT_RESTART_BOUND,
-        }
-    }
-
-    /// Replaces the bound a profile switch waits for a relaunched sidecar
-    /// (see [`DEFAULT_RESTART_BOUND`]); an embedding binary with a slower
-    /// supervisor, or a test that must trip the bound, sets it here.
-    #[must_use]
-    pub(crate) fn with_restart_bound(mut self, bound: Duration) -> Self {
-        self.restart_bound = bound;
-        self
-    }
-
-    /// The bound a profile switch waits for a relaunched sidecar.
-    fn restart_bound(&self) -> Duration {
-        self.restart_bound
-    }
-
-    /// The catalog bus every `/ws` session forwards from, or `None`
-    /// while the menu subsystem has not registered.
-    fn catalog(&self) -> Option<CatalogBus> {
-        self.registry()
-            .state::<MenuHandles>()
-            .map(|handles| handles.catalog().clone())
-    }
-
-    /// The menu bus every `/ws` session forwards and drives, or `None`
-    /// while the menu subsystem has not registered.
-    fn menu(&self) -> Option<MenuBus> {
-        self.registry()
-            .state::<MenuHandles>()
-            .map(|handles| handles.menu().clone())
-    }
-}
-
-impl Deref for WorkshopSocketState {
-    type Target = SocketState;
-
-    fn deref(&self) -> &SocketState {
-        &self.socket
-    }
-}
-
-/// The `/ws` route. The upgrade answers immediately and then outlives
-/// any deadline, so none applies.
-fn routes(state: WorkshopSocketState) -> Router {
-    Router::new().route("/ws", get(upgrade)).with_state(state)
-}
-
-/// Registers the `/ws` route into the registry, merged into the server's
-/// API router. The returned guard keeps the registration alive; the
-/// composition root holds it for the process lifetime.
-pub(crate) fn register(registry: &Registry, state: &WorkshopSocketState) -> Registration {
-    registry.register_routes(Arc::new(RouteRegistrarAdapter::new({
-        let state = state.clone();
-        move || routes(state.clone())
-    })))
-}
-
-/// Connection ids for log correlation, handed out in connection order.
-static NEXT_CONNECTION: AtomicU64 = AtomicU64::new(1);
-
-/// Logs the connection close when the connection task ends, however it
-/// ends, so the connection loop's exit paths need no cleanup calls.
-struct ConnectionLog {
-    connection: u64,
-}
-
-impl Drop for ConnectionLog {
-    fn drop(&mut self) {
-        tracing::info!(connection = self.connection, "workshop socket closed");
-    }
-}
-
-/// Upgrades a `GET /ws` request to a WebSocket connection. A foreign
-/// `Origin` is refused with 403: WS upgrades bypass Sec-Fetch in older
-/// browsers, so the server's loopback origin policy guards the upgrade
-/// itself.
-async fn upgrade(
-    State(state): State<WorkshopSocketState>,
-    headers: HeaderMap,
-    ws: WebSocketUpgrade,
-) -> Response {
-    if !state.origin_allowed(&headers) {
-        return cross_site_refusal();
-    }
-    ws.on_upgrade(move |socket| run_connection(socket, state))
-}
-
-/// Runs one connection until the socket closes or fails: a single
-/// `select!` loop owning the socket for both reading and writing.
-async fn run_connection(mut socket: WebSocket, state: WorkshopSocketState) {
-    let connection = NEXT_CONNECTION.fetch_add(1, Ordering::Relaxed);
-    tracing::info!(connection, "workshop socket opened");
-    let _closed = ConnectionLog { connection };
-
-    // Subscribe before snapshotting, so an update emitted between the two
-    // arrives at least once; the possible duplicate is harmless because
-    // status and catalog frames are complete snapshots. Every bus comes
-    // from the registry's state collection: unregistered is a graceful
-    // no-op, so the branch below pends forever instead of failing.
-    let status = state
-        .registry()
-        .state::<dyn workshop_registry::StatusChannel>();
-    let mut status_rx = status.as_ref().map(|channel| channel.subscribe());
-    let mut catalog_rx = state.catalog().map(|catalog| catalog.subscribe());
-    let mut menu_rx = state.menu().map(|menu| menu.subscribe());
-    // The delivery contract resends the current status, catalog, and
-    // workbench snapshots on reconnect; the buses retain the newest copy
-    // for exactly this send, so the UI boots with zero HTTP state fetches.
-    // The status line is the one exception: a retained heartbeat transition
-    // ("Connected to gateway") describes a past moment, so the join line is
-    // recomputed from the current probe instead of replayed stale.
-    let retained = status.as_ref().and_then(|channel| channel.latest());
-    let join = match state.health() {
-        Some(health) => workshop_gateway::join_status(retained, &health),
-        None => retained,
-    };
-    if let Some(update) = join
-        && !send_frame(&mut socket, &update.frame()).await
-    {
-        return;
-    }
-    if let Some(catalog) = state.catalog().and_then(|catalog| catalog.latest())
-        && !send_frame(&mut socket, &catalog.frame()).await
-    {
-        return;
-    }
-    if let Some(snapshot) = state.menu().and_then(|menu| menu.latest())
-        && !send_frame(&mut socket, &snapshot.frame()).await
-    {
-        return;
-    }
-
-    // The buses close only when the server state tears down; a closed bus
-    // drops its receiver, which leaves its branch pending rather than
-    // spinning the loop on `Closed`. An unregistered bus has no receiver
-    // from the start, so its branch never runs.
-    loop {
-        let open = tokio::select! {
-            // Biased, buses first: draining them ahead of inbound bounds
-            // their staleness at one frame, and the client sends at human
-            // pace, so inbound can never starve.
-            biased;
-            // The ephemeral path: bounded broadcasts. A lagged receiver
-            // skips ahead to the retained window, which is a resync
-            // because every status and catalog frame is a complete
-            // snapshot.
-            received = recv_or_pending(&mut status_rx) => {
-                forward_status(connection, received, &mut status_rx, &mut socket).await
-            }
-            received = recv_or_pending(&mut catalog_rx) => {
-                forward_catalog(connection, received, &mut catalog_rx, &mut socket).await
-            }
-            received = recv_or_pending(&mut menu_rx) => {
-                forward_snapshot(connection, received, &mut menu_rx, &mut socket).await
-            }
-            inbound = socket.recv() => on_inbound(connection, &state, inbound, &mut socket).await,
-        };
-        if !open {
-            break;
-        }
-    }
-}
-
-/// Forwards one status-bus delivery. A `false` return means the client
-/// is gone.
-async fn forward_status(
-    connection: u64,
-    received: Result<StatusBarUpdate, RecvError>,
-    status_rx: &mut Option<broadcast::Receiver<StatusBarUpdate>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match received {
-        Ok(update) => send_frame(socket, &update.frame()).await,
-        Err(RecvError::Lagged(skipped)) => {
-            tracing::debug!(
-                connection,
-                skipped,
-                "status receiver lagged; skipped updates"
-            );
-            true
-        }
-        Err(RecvError::Closed) => {
-            *status_rx = None;
-            true
-        }
-    }
-}
-
-/// Forwards one catalog-bus delivery. A `false` return means the client
-/// is gone.
-async fn forward_catalog(
-    connection: u64,
-    received: Result<CatalogPush, RecvError>,
-    catalog_rx: &mut Option<broadcast::Receiver<CatalogPush>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match received {
-        Ok(catalog) => send_frame(socket, &catalog.frame()).await,
-        Err(RecvError::Lagged(skipped)) => {
-            tracing::debug!(
-                connection,
-                skipped,
-                "catalog receiver lagged; skipped pushes"
-            );
-            true
-        }
-        Err(RecvError::Closed) => {
-            *catalog_rx = None;
-            true
-        }
-    }
-}
-
-/// Forwards one menu-bus delivery. A `false` return means the client is
-/// gone.
-async fn forward_snapshot(
-    connection: u64,
-    received: Result<WorkbenchSnapshot, RecvError>,
-    menu_rx: &mut Option<broadcast::Receiver<WorkbenchSnapshot>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match received {
-        Ok(snapshot) => send_frame(socket, &snapshot.frame()).await,
-        Err(RecvError::Lagged(skipped)) => {
-            tracing::debug!(
-                connection,
-                skipped,
-                "menu receiver lagged; skipped snapshots"
-            );
-            true
-        }
-        Err(RecvError::Closed) => {
-            *menu_rx = None;
-            true
-        }
-    }
-}
-
-/// Handles one inbound socket read. A `false` return means the socket
-/// closed or failed.
-async fn on_inbound(
-    connection: u64,
-    state: &WorkshopSocketState,
-    inbound: Option<Result<Message, axum::Error>>,
-    socket: &mut WebSocket,
-) -> bool {
-    match inbound {
-        Some(Ok(Message::Text(text))) => {
-            handle_frame(state, &text, socket).await;
-            true
-        }
-        // Binary frames are ignored here; pings and pongs are answered by
-        // axum itself.
-        Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Binary(_))) => true,
-        Some(Ok(Message::Close(_))) | None => false,
-        Some(Err(error)) => {
-            tracing::warn!(connection, %error, "workshop socket failed");
-            false
-        }
-    }
-}
-
-/// Handles one inbound text frame: `select_model` and `switch_profile`
-/// drive the Model menu, and anything else is answered with an `error`
-/// frame. Refusals echo the frame's `id` when it included one.
-async fn handle_frame(state: &WorkshopSocketState, text: &str, socket: &mut WebSocket) {
-    let frame: serde_json::Value = match serde_json::from_str(text) {
-        Ok(frame) => frame,
-        Err(error) => {
-            send_error(socket, None, format!("invalid JSON frame: {error}")).await;
-            return;
-        }
-    };
-    // The event id, echoed on the refusal so the client can correlate it.
-    // Absent and null both mean untagged.
-    let id = frame.get("id").cloned().filter(|id| !id.is_null());
-    let kind = frame.get("type").and_then(serde_json::Value::as_str);
-    if kind == Some("select_model") {
-        select_model(state, id.as_ref(), &frame, socket).await;
-        return;
-    }
-    if kind == Some("switch_profile") {
-        start_switch(state, id.as_ref(), &frame, socket).await;
-        return;
-    }
-    send_error(
-        socket,
-        id.as_ref(),
-        "unknown frame type; expected \"select_model\" or \"switch_profile\"",
-    )
-    .await;
-}
diff --git a/crates/workshop/server/tests/common/mod.rs b/crates/workshop/server/tests/common/mod.rs
deleted file mode 100644
index 31051d34a..000000000
--- a/crates/workshop/server/tests/common/mod.rs
+++ /dev/null
@@ -1,419 +0,0 @@
-//! Shared helpers for the workshop server integration tests: an in-process
-//! spawn fixture over [`workshop_server::spawn`], a router-level fixture
-//! over composed state, the SSE echo and typed catalog mock gateways
-//! serve, a typed JSON WebSocket client over tokio-tungstenite, and the
-//! `/agents/ws` connect-and-launch pair.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions and
-// #[cfg(test)] modules only, not integration-test helpers; failing a test
-// by panicking with the invariant named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-use std::env::consts::{DLL_PREFIX, DLL_SUFFIX};
-use std::path::{Path, PathBuf};
-use std::sync::OnceLock;
-use std::time::{Duration, SystemTime};
-
-use axum::http::header;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{MethodRouter, get};
-use futures_util::{SinkExt, StreamExt};
-use serde_json::json;
-use tokio::net::TcpStream;
-use tokio_tungstenite::tungstenite::Message;
-use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
-use workshop_server::fixtures::state_with_gateway;
-use workshop_server::{
-    AgentsConfig, AppState, Config, GatewayConfig, ResolvedGateway, ServerConfig, ServerHandle,
-    router,
-};
-
-/// How long one frame read may take before the test fails: generous enough
-/// for a slow CI runner, far below any test's own deadline.
-pub(crate) const RECV_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// The name of each library Plugin Workshop ships, as Cargo names its
-/// library: the std Plugin's and the bashkit Plugin's.
-const PLUGIN_LIBRARIES: [&str; 2] = ["plugin_std", "plugin_bashkit"];
-
-/// A Plugin directory that holds the library of each Plugin Workshop
-/// ships and nothing else, for a server whose agents declare `std` or
-/// `bash`, as the built-in chat agent does.
-///
-/// Cargo builds each library beside this test executable, because the
-/// server depends on `workshop-plugin-std` and `workshop-plugin-bashkit`.
-/// That directory holds other libraries too, so the Plugin directory is
-/// one beside it, with a hard link to each library. Every test of a build
-/// shares it: a server may keep a library loaded until its test's process
-/// exits, and Windows cannot remove a loaded library, so a copy for each
-/// test would be left behind in the temporary directory.
-pub(crate) fn plugin_dir() -> PathBuf {
-    /// The directory, made once for each test process.
-    static DIRECTORY: OnceLock<PathBuf> = OnceLock::new();
-    DIRECTORY.get_or_init(make_plugin_dir).clone()
-}
-
-/// Makes the directory [`plugin_dir`] returns, with the links in it.
-fn make_plugin_dir() -> PathBuf {
-    let exe = std::env::current_exe().expect("the test executable has a path");
-    let beside = exe.parent().expect("the test executable has a directory");
-    let directory = beside.join("workshop-server-plugins");
-    std::fs::create_dir_all(&directory).expect("the Plugin directory is made");
-    for library in PLUGIN_LIBRARIES {
-        let file = format!("{DLL_PREFIX}{library}{DLL_SUFFIX}");
-        link_into(&directory, &beside.join(&file), &file);
-    }
-    directory
-}
-
-/// Links the library `built` into `directory` under the name `file`,
-/// unless a link to it is there already.
-fn link_into(directory: &Path, built: &Path, file: &str) {
-    let link = directory.join(file);
-    if !is_link_to(&link, built) {
-        // A link an earlier build left names that build's library. Each
-        // test is its own process, and another may read the directory at
-        // any moment. So the new link is made under a name of this
-        // process, which the loader skips for its extension, and renamed
-        // over the old one: the directory is never without the library.
-        let staged = directory.join(format!("{file}.{}.tmp", std::process::id()));
-        let _ = std::fs::remove_file(&staged);
-        let placed =
-            std::fs::hard_link(built, &staged).and_then(|()| std::fs::rename(&staged, &link));
-        if let Err(error) = placed {
-            let _ = std::fs::remove_file(&staged);
-            // Another process may have placed the link first, and Windows
-            // does not replace a library that a process has loaded.
-            assert!(
-                is_link_to(&link, built),
-                "cannot link {} to {}: {error}",
-                link.display(),
-                built.display()
-            );
-        }
-    }
-}
-
-/// Whether `link` and `built` have one length and one modification time,
-/// as two names of one file do.
-fn is_link_to(link: &Path, built: &Path) -> bool {
-    let stamp = |path: &Path| -> Option<(u64, SystemTime)> {
-        let metadata = std::fs::metadata(path).ok()?;
-        Some((metadata.len(), metadata.modified().ok()?))
-    };
-    stamp(link).is_some_and(|linked| Some(linked) == stamp(built))
-}
-
-/// A workshop server spawned in-process for one test, anchoring its state
-/// in a tempdir that lives as long as the fixture.
-///
-/// Dropping the fixture shuts the server down and waits for its thread, so
-/// every state file is closed before the tempdir is deleted.
-pub(crate) struct TestServer {
-    handle: Option<ServerHandle>,
-    /// Held as an `Option` only so [`TestServer::shutdown_keeping_state_dir`]
-    /// can move it out past the `Drop` impl; it is `Some` until then.
-    state_dir: Option<tempfile::TempDir>,
-}
-
-impl TestServer {
-    /// Spawns the server against the gateway at `gateway_base_url` over a
-    /// fresh state directory. Discovery is bypassed: a test never
-    /// consults the real run directory.
-    pub(crate) fn spawn(gateway_base_url: &str) -> Self {
-        Self::spawn_in(gateway_base_url, tempfile::TempDir::new().expect("tempdir"))
-    }
-
-    /// Spawns the server against the gateway at `gateway_base_url` over
-    /// `state_dir`, which the fixture then owns: the relaunch seam, fed
-    /// by [`TestServer::shutdown_keeping_state_dir`] of a previous
-    /// server.
-    pub(crate) fn spawn_in(gateway_base_url: &str, state_dir: tempfile::TempDir) -> Self {
-        let config = Config {
-            gateway: GatewayConfig {
-                base_url: gateway_base_url.to_string(),
-                api_key: "test-key".to_string(),
-            },
-            server: ServerConfig {
-                bind: "127.0.0.1:0".to_string(),
-                state_dir: state_dir.path().to_path_buf(),
-            },
-            agents: AgentsConfig::default(),
-        };
-        let handle = workshop_server::fixtures::spawn(config).expect("the workshop server spawns");
-        Self {
-            handle: Some(handle),
-            state_dir: Some(state_dir),
-        }
-    }
-
-    /// The state directory this server persists into.
-    pub(crate) fn state_dir(&self) -> &std::path::Path {
-        self.state_dir
-            .as_ref()
-            .expect("the state dir is held until shutdown")
-            .path()
-    }
-
-    /// Shuts the server down, waits for its thread, and hands back the
-    /// state directory intact so a second server can boot over it.
-    pub(crate) fn shutdown_keeping_state_dir(mut self) -> tempfile::TempDir {
-        if let Some(handle) = self.handle.take() {
-            handle.shutdown().expect("the server shuts down cleanly");
-        }
-        self.state_dir
-            .take()
-            .expect("the state dir is held until shutdown")
-    }
-
-    /// The `ws://` URL of `path` on this server, for example `/ws` or
-    /// `/v1/realtime`.
-    pub(crate) fn ws_url(&self, path: &str) -> String {
-        let url = self
-            .handle
-            .as_ref()
-            .expect("the handle is held until drop")
-            .url();
-        let rest = url
-            .strip_prefix("http")
-            .expect("the server URL scheme is http");
-        format!("ws{rest}{path}")
-    }
-
-    /// The `http://` URL of `path` on this server.
-    pub(crate) fn http_url(&self, path: &str) -> String {
-        format!(
-            "{}{path}",
-            self.handle
-                .as_ref()
-                .expect("the handle is held until drop")
-                .url()
-        )
-    }
-
-    /// Atomically replaces the local sidecar endpoint and bearer used by
-    /// every gateway-dependent Workshop path.
-    pub(crate) fn replace_gateway(&self, gateway_base_url: &str, api_key: &str) {
-        let updater = self
-            .handle
-            .as_ref()
-            .expect("the handle is held until drop")
-            .gateway_updater();
-        workshop_server::fixtures::replace_gateway(&updater, gateway_base_url, api_key)
-            .expect("the replacement endpoint publishes");
-    }
-}
-
-impl Drop for TestServer {
-    fn drop(&mut self) {
-        if let Some(handle) = self.handle.take() {
-            // A failed shutdown must not double-panic a failing test.
-            let _ = handle.shutdown();
-        }
-    }
-}
-
-// The crate's own fixture, shared here instead of duplicated: binds a mock
-// gateway on a free loopback port and returns its base URL.
-pub(crate) use workshop_server::fixtures::spawn_gateway;
-
-/// The configuration a router-level test composes state from: the
-/// gateway at `gateway_base_url` under the fixture bearer, state in
-/// `state_dir`, and the default agents directory.
-pub(crate) fn test_config(gateway_base_url: &str, state_dir: &Path) -> Config {
-    Config {
-        gateway: GatewayConfig {
-            base_url: gateway_base_url.to_string(),
-            api_key: "test-key".to_string(),
-        },
-        server: ServerConfig {
-            state_dir: state_dir.to_path_buf(),
-            ..ServerConfig::default()
-        },
-        agents: AgentsConfig::default(),
-    }
-}
-
-/// Composes state from `config` and binds the full workshop router over
-/// it, returning the state and the server's `ws://` base URL. Discovery
-/// is bypassed: a test never consults the real run directory. The
-/// router is bound without the serving loop, so no registered task runs
-/// unless the test spawns it.
-pub(crate) async fn spawn_router(config: &Config) -> (AppState, String) {
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let state = state_with_gateway(config, &gateway).expect("state builds in tests");
-    let base = serve_router(&state).await;
-    (state, base)
-}
-
-/// Binds the full workshop router over `state` on a free loopback port
-/// and returns the server's `ws://` base URL.
-pub(crate) async fn serve_router(state: &AppState) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(router(state.clone())).await;
-    format!("ws://{addr}")
-}
-
-/// One SSE data line holding `event`.
-pub(crate) fn sse_line(event: &serde_json::Value) -> String {
-    format!("data: {event}\n\n")
-}
-
-/// One streaming chunk in OpenAI's format, attributed to `model`.
-pub(crate) fn sse_chunk(
-    model: &str,
-    delta: &serde_json::Value,
-    finish: &serde_json::Value,
-) -> serde_json::Value {
-    json!({
-        "model": model,
-        "choices": [{ "index": 0, "delta": delta, "finish_reason": finish }],
-    })
-}
-
-/// Streams `echo:<text>` as an SSE completion attributed to `model`: a
-/// reasoning chunk, the content split across two chunks, the finish
-/// chunk, and the `[DONE]` sentinel - so a turn provably yields multiple
-/// live deltas.
-pub(crate) fn echo_stream(model: &str, text: &str) -> Response {
-    let null = serde_json::Value::Null;
-    let reply = format!("echo:{text}");
-    let mut middle = reply.len() / 2;
-    while !reply.is_char_boundary(middle) {
-        middle -= 1;
-    }
-    let (first, second) = reply.split_at(middle);
-    let mut sse = String::new();
-    for event in [
-        sse_chunk(model, &json!({ "role": "assistant" }), &null),
-        sse_chunk(model, &json!({ "reasoning_content": "mm" }), &null),
-        sse_chunk(model, &json!({ "content": first }), &null),
-        sse_chunk(model, &json!({ "content": second }), &null),
-        sse_chunk(model, &json!({}), &json!("stop")),
-    ] {
-        sse.push_str(&sse_line(&event));
-    }
-    sse.push_str("data: [DONE]\n\n");
-    ([(header::CONTENT_TYPE, "text/event-stream")], sse).into_response()
-}
-
-/// The typed `/v1/models` route a launch resolves the menu selection
-/// through, listing `ids` in order. Every entry is a chat model whose
-/// window clears the built-in chat's declared minimum, so a test pins
-/// the Host's wiring rather than a refused binding.
-pub(crate) fn typed_catalog(ids: &'static [&'static str]) -> MethodRouter {
-    get(move || async move {
-        let data: Vec<serde_json::Value> = ids
-            .iter()
-            .map(|id| {
-                json!({
-                    "id": id, "object": "model", "kind": "chat", "description": id,
-                    "context": 200_000, "thinking": "never",
-                })
-            })
-            .collect();
-        axum::Json(json!({ "object": "list", "data": data }))
-    })
-}
-
-/// A typed JSON WebSocket client: JSON and control frames out, JSON frames
-/// in, every receive bounded by a timeout.
-pub(crate) struct JsonSocket {
-    socket: WebSocketStream<MaybeTlsStream<TcpStream>>,
-}
-
-impl JsonSocket {
-    /// Connects to a `ws://` URL.
-    pub(crate) async fn connect(url: &str) -> Self {
-        let (socket, _) = tokio_tungstenite::connect_async(url)
-            .await
-            .expect("the WebSocket connects");
-        Self { socket }
-    }
-
-    /// Sends one JSON value as a text frame.
-    pub(crate) async fn send_json(&mut self, value: &serde_json::Value) {
-        self.send_text(&value.to_string()).await;
-    }
-
-    /// Sends one raw text frame, for control messages and malformed input.
-    pub(crate) async fn send_text(&mut self, text: &str) {
-        self.socket
-            .send(Message::Text(text.to_string().into()))
-            .await
-            .expect("the text frame is sent");
-    }
-
-    /// Receives the next text frame and parses it as JSON, failing after
-    /// [`RECV_TIMEOUT`].
-    pub(crate) async fn recv_json(&mut self) -> serde_json::Value {
-        self.recv_json_within(RECV_TIMEOUT).await
-    }
-
-    /// Receives the next text frame and parses it as JSON, failing after
-    /// `deadline`.
-    async fn recv_json_within(&mut self, deadline: Duration) -> serde_json::Value {
-        let message = tokio::time::timeout(deadline, self.socket.next())
-            .await
-            .expect("a frame arrives within the deadline")
-            .expect("the socket is open")
-            .expect("the frame is not a socket error");
-        let text = message.into_text().expect("the frame is text");
-        serde_json::from_str(&text).expect("the frame is JSON")
-    }
-
-    /// Receives frames until `keep` accepts one, failing after `deadline`.
-    pub(crate) async fn recv_until(
-        &mut self,
-        deadline: Duration,
-        keep: impl Fn(&serde_json::Value) -> bool,
-    ) -> serde_json::Value {
-        tokio::time::timeout(deadline, async {
-            loop {
-                let frame = self.recv_json_within(deadline).await;
-                if keep(&frame) {
-                    break frame;
-                }
-            }
-        })
-        .await
-        .expect("a matching frame arrives within the deadline")
-    }
-
-    /// Closes the socket with the normal close handshake.
-    pub(crate) async fn close(mut self) {
-        self.socket.close(None).await.expect("the socket closes");
-    }
-}
-
-/// Connects to `/agents/ws` at `base`, asserting the connect-time push
-/// lists exactly `agents`.
-pub(crate) async fn connect_agents(base: &str, agents: &[&str]) -> JsonSocket {
-    let mut socket = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(
-        socket.recv_json().await,
-        json!({ "type": "agents", "agents": agents }),
-        "the connect-time push lists the offered agents"
-    );
-    socket
-}
-
-/// Launches `agent` on `socket` and returns the session id from the
-/// acknowledgment frame.
-pub(crate) async fn launch(socket: &mut JsonSocket, agent: &str) -> String {
-    socket
-        .send_json(&json!({ "type": "launch", "agent": agent }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(
-        frame["type"], "agent_session",
-        "launch acknowledged: {frame}"
-    );
-    assert_eq!(frame["agent"], agent);
-    frame["session"]
-        .as_str()
-        .expect("the acknowledgment includes the session id")
-        .to_owned()
-}
diff --git a/crates/workshop/server/tests/fixtures/agent-frames.json b/crates/workshop/server/tests/fixtures/agent-frames.json
deleted file mode 100644
index 875785039..000000000
--- a/crates/workshop/server/tests/fixtures/agent-frames.json
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  "agents": { "type": "agents", "agents": ["chat", "research"] },
-  "agent_session": { "type": "agent_session", "session": "a1b2", "agent": "chat" },
-  "agent_event_minimal": {
-    "type": "agent_event",
-    "index": 3,
-    "event": {
-      "kind": "user_message",
-      "section": "chat",
-      "turn": 0,
-      "content": "hi"
-    }
-  },
-  "agent_event_awaiting": {
-    "type": "agent_event",
-    "index": 2,
-    "event": {
-      "kind": "awaiting_input",
-      "section": "chat",
-      "turn": 0,
-      "content": ""
-    }
-  },
-  "agent_event_run_ended": {
-    "type": "agent_event",
-    "index": 5,
-    "event": {
-      "kind": "run_ended",
-      "section": "chat",
-      "turn": 0,
-      "content": ""
-    }
-  },
-  "agent_event_stamped": {
-    "type": "agent_event",
-    "index": 4,
-    "reply": 1,
-    "event": {
-      "kind": "agent_message",
-      "section": "chat",
-      "turn": 2,
-      "content": "hello",
-      "model": "llama-3",
-      "finish_reason": "stop",
-      "metrics": {
-        "usage": {
-          "prompt_tokens": 7,
-          "completion_tokens": 3,
-          "total_tokens": 10,
-          "cached_tokens": 2,
-          "reasoning_tokens": 1
-        },
-        "llama": {
-          "prompt_n": 7,
-          "prompt_ms": 12.5,
-          "prompt_per_second": 560.0,
-          "predicted_n": 3,
-          "predicted_ms": 30.5,
-          "predicted_per_second": 98.5,
-          "draft_n": 4,
-          "draft_n_accepted": 2
-        },
-        "vllm": {
-          "time_to_first_token_ms": 8.5,
-          "generation_time_ms": 22.5,
-          "queue_time_ms": 1.5,
-          "mean_itl_ms": 7.5,
-          "tokens_per_second": 133.5
-        },
-        "client": { "ttft_ms": 9.5, "mean_itl_ms": 8.25, "e2e_ms": 41.5 }
-      }
-    }
-  },
-  "agent_delta_text": { "type": "agent_delta", "kind": "text", "content": "po", "reply": 2 },
-  "agent_delta_reasoning": {
-    "type": "agent_delta",
-    "kind": "reasoning",
-    "content": "hmm",
-    "reply": 2
-  },
-  "input_response": { "type": "input_response", "text": "two words" },
-  "launch": { "type": "launch", "agent": "chat" },
-  "attach": { "type": "attach", "session": "a1b2" },
-  "cancel": { "type": "cancel" }
-}
diff --git a/crates/workshop/server/tests/fixtures/realtime/client-events.json b/crates/workshop/server/tests/fixtures/realtime/client-events.json
deleted file mode 100644
index 934df03c4..000000000
--- a/crates/workshop/server/tests/fixtures/realtime/client-events.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "input_audio_buffer_append": {
-    "type": "input_audio_buffer.append",
-    "audio": "AAABAP//",
-    "event_id": "client_append_1"
-  },
-  "input_audio_buffer_clear": {
-    "type": "input_audio_buffer.clear"
-  },
-  "input_audio_buffer_commit": {
-    "type": "input_audio_buffer.commit"
-  },
-  "session_update": {
-    "type": "session.update",
-    "session": {
-      "type": "transcription",
-      "audio": {
-        "input": {
-          "format": {
-            "type": "audio/pcm",
-            "rate": 24000
-          },
-          "noise_reduction": null,
-          "transcription": {
-            "model": "realtime-transcribe",
-            "prompt": "meeting notes"
-          },
-          "turn_detection": null
-        }
-      },
-      "include": [
-        "item.input_audio_transcription.hypothesis"
-      ]
-    },
-    "event_id": "client_update_1"
-  }
-}
diff --git a/crates/workshop/server/tests/fixtures/realtime/effective-sessions.json b/crates/workshop/server/tests/fixtures/realtime/effective-sessions.json
deleted file mode 100644
index eabdbd567..000000000
--- a/crates/workshop/server/tests/fixtures/realtime/effective-sessions.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "default": {
-    "id": "sess_canonical",
-    "object": "realtime.transcription_session",
-    "type": "transcription",
-    "audio": {
-      "input": {
-        "format": {
-          "type": "audio/pcm",
-          "rate": 24000
-        },
-        "noise_reduction": null,
-        "transcription": {
-          "model": "realtime-transcribe",
-          "prompt": ""
-        },
-        "turn_detection": null
-      }
-    },
-    "include": []
-  },
-  "updated": {
-    "id": "sess_canonical",
-    "object": "realtime.transcription_session",
-    "type": "transcription",
-    "audio": {
-      "input": {
-        "format": {
-          "type": "audio/pcm",
-          "rate": 24000
-        },
-        "noise_reduction": null,
-        "transcription": {
-          "model": "realtime-transcribe",
-          "prompt": "meeting notes"
-        },
-        "turn_detection": null
-      }
-    },
-    "include": [
-      "item.input_audio_transcription.hypothesis"
-    ]
-  }
-}
diff --git a/crates/workshop/server/tests/fixtures/realtime/invalid-sequences.json b/crates/workshop/server/tests/fixtures/realtime/invalid-sequences.json
deleted file mode 100644
index 2d3c16a3d..000000000
--- a/crates/workshop/server/tests/fixtures/realtime/invalid-sequences.json
+++ /dev/null
@@ -1,224 +0,0 @@
-{
-  "append_after_precommit_failure": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "AA==", "event_id": "client_append_after_failure" }, "setup": { "pending_precommit_failure": true } },
-    "expected_error": { "event_id": "evt_append_after_failure", "type": "error", "error": { "type": "invalid_request_error", "code": "precommit_transcription_failed", "message": "Further appends are rejected after accurate precommit failure", "param": "audio", "event_id": "client_append_after_failure" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "append_invalid_base64": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "***", "event_id": "client_invalid_base64" } },
-    "expected_error": { "event_id": "evt_invalid_base64", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_base64_audio", "message": "Audio must be valid Base64", "param": "audio", "event_id": "client_invalid_base64" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "append_limit_exceeded": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "AA==", "event_id": "client_append_limit" }, "materialize": { "decoded_audio_bytes": 15728641 } },
-    "expected_error": { "event_id": "evt_append_limit", "type": "error", "error": { "type": "invalid_request_error", "code": "audio_append_too_large", "message": "Decoded audio exceeds the 15 MiB append limit", "param": "audio", "event_id": "client_append_limit" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "append_unknown_field": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "AA==", "extra": true, "event_id": "client_append_unknown" } },
-    "expected_error": { "event_id": "evt_append_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field extra", "param": "extra", "event_id": "client_append_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "clear_unknown_field": {
-    "input": { "message": { "type": "input_audio_buffer.clear", "extra": true, "event_id": "client_clear_unknown" } },
-    "expected_error": { "event_id": "evt_clear_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field extra", "param": "extra", "event_id": "client_clear_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "commit_short_audio": {
-    "input": { "message": { "type": "input_audio_buffer.commit", "event_id": "client_short_commit" }, "setup": { "buffered_audio_ms": 99 } },
-    "expected_error": { "event_id": "evt_short_commit", "type": "error", "error": { "type": "invalid_request_error", "code": "audio_too_short", "message": "A commit requires at least 100 ms of audio", "param": "audio", "event_id": "client_short_commit" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "commit_unknown_field": {
-    "input": { "message": { "type": "input_audio_buffer.commit", "extra": true, "event_id": "client_commit_unknown" } },
-    "expected_error": { "event_id": "evt_commit_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field extra", "param": "extra", "event_id": "client_commit_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "dangling_pcm_byte_on_commit": {
-    "input": { "message": { "type": "input_audio_buffer.commit", "event_id": "client_odd_pcm" }, "setup": { "pending_pcm_bytes": [1] } },
-    "expected_error": { "event_id": "evt_odd_pcm", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_pcm_audio", "message": "PCM16 audio ends with an incomplete sample", "param": "audio", "event_id": "client_odd_pcm" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "excessive_queue_lag": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "AAA=", "event_id": "client_queue_lag" }, "setup": { "audio_lag_ms": 2001 } },
-    "expected_error": { "event_id": "evt_queue_lag", "type": "error", "error": { "type": "overload_error", "code": "audio_queue_lag", "message": "Audio queue lag exceeds two seconds", "param": "audio", "event_id": "client_queue_lag" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "invalid_client_event_id": {
-    "input": { "message": { "type": "input_audio_buffer.clear", "event_id": 7 } },
-    "expected_error": { "event_id": "evt_invalid_client_id", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_event_id", "message": "event_id must be a string", "param": "event_id", "event_id": null } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "invalid_include_type": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "include": "item.input_audio_transcription.hypothesis" }, "event_id": "client_include_type" } },
-    "expected_error": { "event_id": "evt_include_type", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_include", "message": "session.include must be an array", "param": "session.include", "event_id": "client_include_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "invalid_prompt_type": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "prompt": 7 } } } }, "event_id": "client_prompt_type" } },
-    "expected_error": { "event_id": "evt_prompt_type", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_prompt", "message": "Transcription prompt must be a string", "param": "session.audio.input.transcription.prompt", "event_id": "client_prompt_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "malformed_json": {
-    "input": { "wire_text": "{\"type\":\"input_audio_buffer.clear\"" },
-    "expected_error": { "event_id": "evt_malformed_json", "type": "error", "error": { "type": "invalid_request_error", "code": "invalid_json", "message": "The client event is not valid JSON" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "maximum_committed_items": {
-    "input": { "message": { "type": "input_audio_buffer.commit", "event_id": "client_item_limit" }, "setup": { "committed_items_finalizing": 4, "buffered_audio_ms": 100 } },
-    "expected_error": { "event_id": "evt_item_limit", "type": "error", "error": { "type": "overload_error", "code": "too_many_committed_items", "message": "At most four committed items may finalize concurrently", "param": null, "event_id": "client_item_limit" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "maximum_unfinalized_audio": {
-    "input": { "message": { "type": "input_audio_buffer.append", "audio": "AAA=", "event_id": "client_audio_limit" }, "setup": { "unfinalized_audio_ms": 30000 } },
-    "expected_error": { "event_id": "evt_audio_limit", "type": "error", "error": { "type": "overload_error", "code": "too_much_unfinalized_audio", "message": "Unfinalized audio exceeds 30 seconds: 30000 ms retained, 1 ms requested", "param": "audio", "event_id": "client_audio_limit" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "missing_append_audio": {
-    "input": { "message": { "type": "input_audio_buffer.append", "event_id": "client_missing_audio" } },
-    "expected_error": { "event_id": "evt_missing_audio", "type": "error", "error": { "type": "invalid_request_error", "code": "missing_required_field", "message": "Missing required field audio", "param": "audio", "event_id": "client_missing_audio" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "missing_client_event_type": {
-    "input": { "message": { "event_id": "client_missing_type" } },
-    "expected_error": { "event_id": "evt_missing_type", "type": "error", "error": { "type": "invalid_request_error", "code": "missing_required_field", "message": "Missing required field type", "param": "type", "event_id": "client_missing_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "missing_session": {
-    "input": { "message": { "type": "session.update", "event_id": "client_missing_session" } },
-    "expected_error": { "event_id": "evt_missing_session", "type": "error", "error": { "type": "invalid_request_error", "code": "missing_required_field", "message": "Missing required field session", "param": "session", "event_id": "client_missing_session" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "missing_session_type": {
-    "input": { "message": { "type": "session.update", "session": {}, "event_id": "client_missing_session_type" } },
-    "expected_error": { "event_id": "evt_missing_session_type", "type": "error", "error": { "type": "invalid_request_error", "code": "missing_required_field", "message": "Missing required field session.type", "param": "session.type", "event_id": "client_missing_session_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "non_null_noise_reduction": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "noise_reduction": { "type": "near_field" } } } }, "event_id": "client_noise_reduction" } },
-    "expected_error": { "event_id": "evt_noise_reduction", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_noise_reduction", "message": "Only null noise reduction is supported", "param": "session.audio.input.noise_reduction", "event_id": "client_noise_reduction" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "non_null_turn_detection": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "turn_detection": { "type": "server_vad" } } } }, "event_id": "client_turn_detection" } },
-    "expected_error": { "event_id": "evt_turn_detection", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_turn_detection", "message": "Only null turn detection is supported", "param": "session.audio.input.turn_detection", "event_id": "client_turn_detection" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "repeated_include": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "include": ["item.input_audio_transcription.hypothesis", "item.input_audio_transcription.hypothesis"] }, "event_id": "client_repeated_include" } },
-    "expected_error": { "event_id": "evt_repeated_include", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_include", "message": "session.include repeats an include value", "param": "session.include", "event_id": "client_repeated_include" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "session_audio_unknown_field": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": {}, "output": {} } }, "event_id": "client_audio_unknown" } },
-    "expected_error": { "event_id": "evt_audio_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field session.audio.output", "param": "session.audio.output", "event_id": "client_audio_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "session_input_unknown_field": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "extra": true } } }, "event_id": "client_input_unknown" } },
-    "expected_error": { "event_id": "evt_input_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field session.audio.input.extra", "param": "session.audio.input.extra", "event_id": "client_input_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "session_transcription_unknown_field": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "extra": true } } } }, "event_id": "client_transcription_unknown" } },
-    "expected_error": { "event_id": "evt_transcription_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field session.audio.input.transcription.extra", "param": "session.audio.input.transcription.extra", "event_id": "client_transcription_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "session_unknown_field": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "extra": true }, "event_id": "client_session_unknown" } },
-    "expected_error": { "event_id": "evt_session_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field session.extra", "param": "session.extra", "event_id": "client_session_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "session_update_unknown_field": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription" }, "extra": true, "event_id": "client_update_unknown" } },
-    "expected_error": { "event_id": "evt_update_unknown", "type": "error", "error": { "type": "invalid_request_error", "code": "unknown_field", "message": "Unknown field extra", "param": "extra", "event_id": "client_update_unknown" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unknown_event_type": {
-    "input": { "message": { "type": "response.create", "event_id": "client_unknown_type" } },
-    "expected_error": { "event_id": "evt_unknown_type", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_event_type", "message": "Unsupported client event type response.create", "param": "type", "event_id": "client_unknown_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unknown_include": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "include": ["item.input_audio_transcription.logprobs"] }, "event_id": "client_unknown_include" } },
-    "expected_error": { "event_id": "evt_unknown_include", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_include", "message": "Unsupported include value item.input_audio_transcription.logprobs", "param": "session.include", "event_id": "client_unknown_include" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_delay": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "delay_ms": 500 } } } }, "event_id": "client_delay" } },
-    "expected_error": { "event_id": "evt_delay", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_delay", "message": "Transcription delay is not supported", "param": "session.audio.input.transcription.delay_ms", "event_id": "client_delay" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_format_rate": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 16000 } } } }, "event_id": "client_format_rate" } },
-    "expected_error": { "event_id": "evt_format_rate", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_audio_format", "message": "Only 24 kHz PCM audio is supported", "param": "session.audio.input.format.rate", "event_id": "client_format_rate" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_format_type": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "format": { "type": "audio/wav", "rate": 24000 } } } }, "event_id": "client_format_type" } },
-    "expected_error": { "event_id": "evt_format_type", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_audio_format", "message": "Only audio/pcm is supported", "param": "session.audio.input.format.type", "event_id": "client_format_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_keywords": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "keywords": ["Runvil"] } } } }, "event_id": "client_keywords" } },
-    "expected_error": { "event_id": "evt_keywords", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_keywords", "message": "Transcription keywords are not supported", "param": "session.audio.input.transcription.keywords", "event_id": "client_keywords" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_language": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "language": "en" } } } }, "event_id": "client_language" } },
-    "expected_error": { "event_id": "evt_language", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_language", "message": "A transcription language is not supported", "param": "session.audio.input.transcription.language", "event_id": "client_language" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_logprobs": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "logprobs": true } } } }, "event_id": "client_logprobs" } },
-    "expected_error": { "event_id": "evt_logprobs", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_logprobs", "message": "Transcription logprobs are not supported", "param": "session.audio.input.transcription.logprobs", "event_id": "client_logprobs" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "unsupported_model": {
-    "input": { "message": { "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "model": "whisper-1" } } } }, "event_id": "client_model" } },
-    "expected_error": { "event_id": "evt_model", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_model", "message": "Only realtime-transcribe is supported", "param": "session.audio.input.transcription.model", "event_id": "client_model" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  },
-  "wrong_session_type": {
-    "input": { "message": { "type": "session.update", "session": { "type": "realtime" }, "event_id": "client_session_type" } },
-    "expected_error": { "event_id": "evt_session_type", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_session_type", "message": "Only transcription sessions are supported", "param": "session.type", "event_id": "client_session_type" } },
-    "effective_session_after": "default",
-    "keeps_connection_usable": true
-  }
-}
diff --git a/crates/workshop/server/tests/fixtures/realtime/server-events.json b/crates/workshop/server/tests/fixtures/realtime/server-events.json
deleted file mode 100644
index d3eddd325..000000000
--- a/crates/workshop/server/tests/fixtures/realtime/server-events.json
+++ /dev/null
@@ -1,153 +0,0 @@
-{
-  "conversation_item_created": {
-    "event_id": "evt_item_created",
-    "type": "conversation.item.created",
-    "previous_item_id": null,
-    "item": {
-      "id": "item_alpha",
-      "type": "message",
-      "status": "completed",
-      "role": "user",
-      "content": [
-        {
-          "type": "input_audio",
-          "transcript": null
-        }
-      ]
-    }
-  },
-  "error_correlated": {
-    "event_id": "evt_error_correlated",
-    "type": "error",
-    "error": {
-      "type": "invalid_request_error",
-      "code": "unsupported_model",
-      "message": "Only realtime-transcribe is supported",
-      "param": "session.audio.input.transcription.model",
-      "event_id": "client_bad_update"
-    }
-  },
-  "error_minimal": {
-    "event_id": "evt_error_minimal",
-    "type": "error",
-    "error": {
-      "type": "server_error",
-      "code": "internal_error",
-      "message": "Transcription failed"
-    }
-  },
-  "error_uncorrelated": {
-    "event_id": "evt_error_uncorrelated",
-    "type": "error",
-    "error": {
-      "type": "server_error",
-      "code": "engine_replaced",
-      "message": "The speech engine was replaced",
-      "param": null,
-      "event_id": null
-    }
-  },
-  "input_audio_buffer_cleared": {
-    "event_id": "evt_buffer_cleared",
-    "type": "input_audio_buffer.cleared"
-  },
-  "input_audio_buffer_committed": {
-    "event_id": "evt_buffer_committed",
-    "type": "input_audio_buffer.committed",
-    "item_id": "item_alpha",
-    "previous_item_id": null
-  },
-  "session_created": {
-    "event_id": "evt_session_created",
-    "type": "session.created",
-    "session": {
-      "id": "sess_canonical",
-      "object": "realtime.transcription_session",
-      "type": "transcription",
-      "audio": {
-        "input": {
-          "format": {
-            "type": "audio/pcm",
-            "rate": 24000
-          },
-          "noise_reduction": null,
-          "transcription": {
-            "model": "realtime-transcribe",
-            "prompt": ""
-          },
-          "turn_detection": null
-        }
-      },
-      "include": []
-    }
-  },
-  "session_updated": {
-    "event_id": "evt_session_updated",
-    "type": "session.updated",
-    "session": {
-      "id": "sess_canonical",
-      "object": "realtime.transcription_session",
-      "type": "transcription",
-      "audio": {
-        "input": {
-          "format": {
-            "type": "audio/pcm",
-            "rate": 24000
-          },
-          "noise_reduction": null,
-          "transcription": {
-            "model": "realtime-transcribe",
-            "prompt": "meeting notes"
-          },
-          "turn_detection": null
-        }
-      },
-      "include": [
-        "item.input_audio_transcription.hypothesis"
-      ]
-    }
-  },
-  "transcription_completed": {
-    "event_id": "evt_transcription_completed",
-    "type": "conversation.item.input_audio_transcription.completed",
-    "item_id": "item_alpha",
-    "content_index": 0,
-    "transcript": "Hello, world",
-    "usage": {
-      "type": "duration",
-      "seconds": 1.25
-    }
-  },
-  "transcription_delta": {
-    "event_id": "evt_transcription_delta",
-    "type": "conversation.item.input_audio_transcription.delta",
-    "item_id": "item_alpha",
-    "content_index": 0,
-    "delta": "Hello"
-  },
-  "transcription_failed": {
-    "event_id": "evt_transcription_failed",
-    "type": "conversation.item.input_audio_transcription.failed",
-    "item_id": "item_beta",
-    "content_index": 0,
-    "error": {
-      "type": "server_error",
-      "code": "transcription_failed",
-      "message": "Authoritative transcription failed",
-      "param": "audio"
-    }
-  },
-  "transcription_hypothesis": {
-    "event_id": "evt_transcription_hypothesis",
-    "type": "conversation.item.input_audio_transcription.hypothesis",
-    "item_id": "item_alpha",
-    "content_index": 0,
-    "revision": 3,
-    "transcript": "Hello, world",
-    "finalized": "Hello",
-    "agreed": ", wor",
-    "tentative": "ld",
-    "audio_start_ms": 0,
-    "audio_end_ms": 1250
-  }
-}
diff --git a/crates/workshop/server/tests/fixtures/realtime/valid-sequences.json b/crates/workshop/server/tests/fixtures/realtime/valid-sequences.json
deleted file mode 100644
index 44228ba3c..000000000
--- a/crates/workshop/server/tests/fixtures/realtime/valid-sequences.json
+++ /dev/null
@@ -1,189 +0,0 @@
-{
-  "clear_retires_only_uncommitted_input": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAABAP//", "event_id": "client_clear_append" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.clear", "event_id": "client_clear" } },
-      { "direction": "server", "message": { "event_id": "evt_clear", "type": "input_audio_buffer.cleared" } }
-    ],
-    "invariants": [
-      "clear cancels and retires only uncommitted work",
-      "clear resets partial PCM and resampler state",
-      "clear leaves committed items untouched"
-    ]
-  },
-  "configuration_snapshot_isolation": {
-    "events": [
-      { "direction": "server", "message": { "event_id": "evt_snapshot_created", "type": "session.created", "session": { "id": "sess_snapshot", "object": "realtime.transcription_session", "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 24000 }, "noise_reduction": null, "transcription": { "model": "realtime-transcribe", "prompt": "" }, "turn_detection": null } }, "include": [] } } },
-      { "direction": "client", "message": { "event_id": "client_prompt_first", "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "model": "realtime-transcribe", "prompt": "first prompt" } } } } } },
-      { "direction": "server", "message": { "event_id": "evt_prompt_first", "type": "session.updated", "session": { "id": "sess_snapshot", "object": "realtime.transcription_session", "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 24000 }, "noise_reduction": null, "transcription": { "model": "realtime-transcribe", "prompt": "first prompt" }, "turn_detection": null } }, "include": [] } } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "event_id": "client_prompt_second", "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "model": "realtime-transcribe", "prompt": "second prompt" } } } } } },
-      { "direction": "server", "message": { "event_id": "evt_prompt_second", "type": "session.updated", "session": { "id": "sess_snapshot", "object": "realtime.transcription_session", "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 24000 }, "noise_reduction": null, "transcription": { "model": "realtime-transcribe", "prompt": "second prompt" }, "turn_detection": null } }, "include": [] } } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_snapshot_commit", "type": "input_audio_buffer.committed", "item_id": "item_snapshot", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_snapshot_item", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_snapshot", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "server", "message": { "event_id": "evt_snapshot_done", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_snapshot", "content_index": 0, "transcript": "first prompt remained attached", "usage": { "type": "duration", "seconds": 0.25 } } }
-    ],
-    "invariants": [
-      "the first append snapshots format model prompt and include",
-      "the later update affects only the next input buffer",
-      "the update response contains the complete effective session"
-    ]
-  },
-  "durable_lineage": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_lineage_commit_a", "type": "input_audio_buffer.committed", "item_id": "item_lineage_a", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_lineage_item_a", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_lineage_a", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "server", "message": { "event_id": "evt_lineage_done_a", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_lineage_a", "content_index": 0, "transcript": "first", "usage": { "type": "duration", "seconds": 0.2 } } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_lineage_commit_b", "type": "input_audio_buffer.committed", "item_id": "item_lineage_b", "previous_item_id": "item_lineage_a" } },
-      { "direction": "server", "message": { "event_id": "evt_lineage_item_b", "type": "conversation.item.created", "previous_item_id": "item_lineage_a", "item": { "id": "item_lineage_b", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } }
-    ],
-    "invariants": [
-      "durable commit order survives removal of completed items",
-      "previous_item_id is determined only by commit order"
-    ]
-  },
-  "first_event_readiness": {
-    "events": [
-      { "direction": "server", "message": { "event_id": "evt_ready", "type": "session.created", "session": { "id": "sess_ready", "object": "realtime.transcription_session", "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 24000 }, "noise_reduction": null, "transcription": { "model": "realtime-transcribe", "prompt": "" }, "turn_detection": null } }, "include": [] } } }
-    ],
-    "invariants": [
-      "session.created is the first server event",
-      "the connection starts ready with the advertised defaults"
-    ]
-  },
-  "hypothesis_negotiation": {
-    "events": [
-      { "direction": "client", "message": { "event_id": "client_hypothesis", "type": "session.update", "session": { "type": "transcription", "include": ["item.input_audio_transcription.hypothesis"] } } },
-      { "direction": "server", "message": { "event_id": "evt_hypothesis_updated", "type": "session.updated", "session": { "id": "sess_hypothesis", "object": "realtime.transcription_session", "type": "transcription", "audio": { "input": { "format": { "type": "audio/pcm", "rate": 24000 }, "noise_reduction": null, "transcription": { "model": "realtime-transcribe", "prompt": "" }, "turn_detection": null } }, "include": ["item.input_audio_transcription.hypothesis"] } } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAABAP//" } },
-      { "direction": "server", "message": { "event_id": "evt_hypothesis", "type": "conversation.item.input_audio_transcription.hypothesis", "item_id": "item_hypothesis", "content_index": 0, "revision": 1, "transcript": "Hello", "finalized": "Hel", "agreed": "l", "tentative": "o", "audio_start_ms": 0, "audio_end_ms": 250 } },
-      { "direction": "server", "message": { "event_id": "evt_hypothesis_2", "type": "conversation.item.input_audio_transcription.hypothesis", "item_id": "item_hypothesis", "content_index": 0, "revision": 2, "transcript": "Hello!", "finalized": "Hello", "agreed": "", "tentative": "!", "audio_start_ms": 0, "audio_end_ms": 300 } },
-      { "direction": "server", "message": { "event_id": "evt_hypothesis_done", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_hypothesis", "content_index": 0, "transcript": "Hello", "usage": { "type": "duration", "seconds": 0.25 } } }
-    ],
-    "invariants": [
-      "hypotheses are emitted only after exact include negotiation",
-      "hypothesis revisions increase monotonically",
-      "completion is authoritative"
-    ]
-  },
-  "producer_hypothesis_ownership": {
-    "events": [
-      { "direction": "client", "message": { "event_id": "client_producer_hypothesis", "type": "session.update", "session": { "type": "transcription", "include": ["item.input_audio_transcription.hypothesis"] } } },
-      { "direction": "server", "message": { "event_id": "evt_producer_hypothesis_3", "type": "conversation.item.input_audio_transcription.hypothesis", "item_id": "item_producer_hypothesis", "content_index": 0, "revision": 3, "transcript": "ask not your country new tail first", "finalized": "ask not your country", "agreed": "", "tentative": " new tail first", "audio_start_ms": 0, "audio_end_ms": 8100 } },
-      { "direction": "server", "message": { "event_id": "evt_producer_hypothesis_4", "type": "conversation.item.input_audio_transcription.hypothesis", "item_id": "item_producer_hypothesis", "content_index": 0, "revision": 4, "transcript": "ask not your country new tail second", "finalized": "ask not your country", "agreed": " new tail", "tentative": " second", "audio_start_ms": 0, "audio_end_ms": 8200 } }
-    ],
-    "invariants": [
-      "producer snapshots partition finalized agreed and tentative text without overlap",
-      "each field owns its exact leading boundary whitespace",
-      "the visible transcript is the fields concatenated exactly once"
-    ]
-  },
-  "immediate_commit_and_provisional_promotion": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "event_id": "client_commit", "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_commit", "type": "input_audio_buffer.committed", "item_id": "item_provisional", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_item", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_provisional", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } }
-    ],
-    "invariants": [
-      "commit acknowledgment and item creation are immediate",
-      "the provisional item ID is promoted unchanged",
-      "server IDs are not derived from the client event ID"
-    ]
-  },
-  "optional_client_ids_and_error_correlation": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "event_id": "client_optional" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "client", "message": { "event_id": "client_bad_update", "type": "session.update", "session": { "type": "transcription", "audio": { "input": { "transcription": { "model": "not-supported" } } } } } },
-      { "direction": "server", "message": { "event_id": "evt_bad_update", "type": "error", "error": { "type": "invalid_request_error", "code": "unsupported_model", "message": "Only realtime-transcribe is supported", "param": "session.audio.input.transcription.model", "event_id": "client_bad_update" } } }
-    ],
-    "invariants": [
-      "client event IDs are optional opaque strings",
-      "a client event ID is echoed only in its correlated error",
-      "server event IDs are independently generated"
-    ]
-  },
-  "overlapping_items_reverse_completion": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_commit_a", "type": "input_audio_buffer.committed", "item_id": "item_overlap_a", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_item_a", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_overlap_a", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_commit_b", "type": "input_audio_buffer.committed", "item_id": "item_overlap_b", "previous_item_id": "item_overlap_a" } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_item_b", "type": "conversation.item.created", "previous_item_id": "item_overlap_a", "item": { "id": "item_overlap_b", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_done_b", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_overlap_b", "content_index": 0, "transcript": "second", "usage": { "type": "duration", "seconds": 0.2 } } },
-      { "direction": "server", "message": { "event_id": "evt_overlap_done_a", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_overlap_a", "content_index": 0, "transcript": "first", "usage": { "type": "duration", "seconds": 0.2 } } }
-    ],
-    "invariants": [
-      "committed items finalize independently",
-      "completion order may differ from durable commit order",
-      "each item has one terminal outcome"
-    ]
-  },
-  "pending_precommit_failure_clear": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAABAP//" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.clear" } },
-      { "direction": "server", "message": { "event_id": "evt_pending_clear", "type": "input_audio_buffer.cleared" } }
-    ],
-    "invariants": [
-      "clear discards a pending precommit failure",
-      "clear does not invent an item or emit an item failure"
-    ]
-  },
-  "pending_precommit_failure_commit": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_pending_commit", "type": "input_audio_buffer.committed", "item_id": "item_pending", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_pending_item", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_pending", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "server", "message": { "event_id": "evt_pending_failed", "type": "conversation.item.input_audio_transcription.failed", "item_id": "item_pending", "content_index": 0, "error": { "type": "server_error", "code": "precommit_transcription_failed", "message": "Accurate precommit transcription failed", "param": null } } }
-    ],
-    "invariants": [
-      "commit establishes the item before reporting the pending failure",
-      "the item receives exactly one terminal failure"
-    ]
-  },
-  "saturated_commit_retry": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "client", "message": { "event_id": "client_commit_saturated", "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_commit_saturated", "type": "error", "error": { "type": "overload_error", "code": "too_many_committed_items", "message": "At most four committed items may finalize concurrently", "param": null, "event_id": "client_commit_saturated" } } },
-      { "direction": "server", "message": { "event_id": "evt_capacity_released", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_existing", "content_index": 0, "transcript": "released", "usage": { "type": "duration", "seconds": 0.2 } } },
-      { "direction": "client", "message": { "event_id": "client_commit_retry", "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_commit_retry", "type": "input_audio_buffer.committed", "item_id": "item_retry", "previous_item_id": "item_existing" } },
-      { "direction": "server", "message": { "event_id": "evt_item_retry", "type": "conversation.item.created", "previous_item_id": "item_existing", "item": { "id": "item_retry", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } }
-    ],
-    "invariants": [
-      "commit reserves every bounded resource before detaching input",
-      "a saturated commit leaves the same provisional input retryable",
-      "retry promotes the original provisional item ID"
-    ]
-  },
-  "standard_live_deltas_before_commit": {
-    "events": [
-      { "direction": "client", "message": { "type": "input_audio_buffer.append", "audio": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } },
-      { "direction": "server", "message": { "event_id": "evt_delta_live", "type": "conversation.item.input_audio_transcription.delta", "item_id": "item_delta", "content_index": 0, "delta": "Hello" } },
-      { "direction": "client", "message": { "type": "input_audio_buffer.commit" } },
-      { "direction": "server", "message": { "event_id": "evt_delta_commit", "type": "input_audio_buffer.committed", "item_id": "item_delta", "previous_item_id": null } },
-      { "direction": "server", "message": { "event_id": "evt_delta_item", "type": "conversation.item.created", "previous_item_id": null, "item": { "id": "item_delta", "type": "message", "status": "completed", "role": "user", "content": [{ "type": "input_audio", "transcript": null }] } } },
-      { "direction": "server", "message": { "event_id": "evt_delta_rest", "type": "conversation.item.input_audio_transcription.delta", "item_id": "item_delta", "content_index": 0, "delta": " big world" } },
-      { "direction": "server", "message": { "event_id": "evt_delta_done", "type": "conversation.item.input_audio_transcription.completed", "item_id": "item_delta", "content_index": 0, "transcript": "Hello big world", "usage": { "type": "duration", "seconds": 0.2 } } }
-    ],
-    "invariants": [
-      "standard deltas arrive during the take, before commit",
-      "deltas only append to text already sent and hold back the last two agreed words until commit",
-      "commit sends the held-back rest once, after conversation item creation",
-      "accepted deltas are not internally dropped while the peer remains writable",
-      "completion remains authoritative"
-    ]
-  }
-}
diff --git a/crates/workshop/server/tests/it/agents.rs b/crates/workshop/server/tests/it/agents.rs
deleted file mode 100644
index 2d596e84c..000000000
--- a/crates/workshop/server/tests/it/agents.rs
+++ /dev/null
@@ -1,226 +0,0 @@
-//! End-to-end agent-session tests over the `/agents/ws` socket: launch,
-//! the full turn cycle with reply-id coalescing and indexed durable
-//! frames, a message that steers a running turn, reconnect replay, the
-//! stop, conversation isolation, status-bus order, backoff reset, and
-//! teardown - all in-process against an SSE mock gateway.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking with the invariant
-// named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-use std::sync::{Arc, Mutex};
-use std::time::Duration;
-
-use axum::Router;
-use axum::response::Response;
-use axum::routing::post;
-use serde_json::json;
-
-use workshop_server::fixtures::{gateway_updater, replace_gateway as replace_fixture_gateway};
-use workshop_server::{AgentsConfig, AppState, Config};
-
-use crate::common::{
-    JsonSocket, connect_agents, echo_stream, launch, plugin_dir, spawn_gateway, spawn_router,
-    test_config, typed_catalog,
-};
-
-/// The echo agent: a Markdown prompt on the unified runtime that loops
-/// on `tasks.receive()`, runs one chat round per message against the
-/// fixture's `test-model`, and returns on `quit`.
-const ECHO_MD: &str = r"---
-name: echo
-description: The echo test agent on the unified runtime.
-runvil: 0
-uses:
-  - user
----
-
-# Echo
-
-## Conversation
-
-```lua
-while true do
-    local text = tasks.receive()
-    if text == 'quit' then
-        return
-    end
-    messages:user(text)
-    models.loop(models.get('test-model'))
-end
-```
-";
-
-/// Streams `echo:<last user message>` from `test-model` as an SSE
-/// completion.
-async fn echo_completions(body: String) -> Response {
-    let body: serde_json::Value = serde_json::from_str(&body).expect("the request is JSON");
-    let text = body["messages"]
-        .as_array()
-        .and_then(|messages| messages.last())
-        .and_then(|message| message["content"].as_str())
-        .expect("the request includes a user message");
-    echo_stream("test-model", text)
-}
-
-/// Adds the typed `/v1/models` catalog holding every id these tests
-/// select; a mock without this route fails the launch with the reported
-/// catalog-fetch cause.
-fn with_typed_catalog(router: Router) -> Router {
-    router.route(
-        "/v1/models",
-        typed_catalog(&["model-a", "model-b", "model-c", "test-model"]),
-    )
-}
-
-/// Records one completion body for endpoint and binding assertions.
-fn record_request(requests: &Mutex<Vec<serde_json::Value>>, body: &str) {
-    requests
-        .lock()
-        .expect("the request capture lock is healthy")
-        .push(serde_json::from_str(body).expect("the request is JSON"));
-}
-
-/// Binds the workshop router against an echoing SSE mock gateway, with
-/// one discovered agent (`echo`) and the retained catalog already
-/// holding `test-model`. Returns the server's base `ws://` URL, the
-/// tempdir keeping the state alive, and the shared state handle.
-async fn spawn_agent_server() -> (String, tempfile::TempDir, AppState) {
-    let base_url = spawn_gateway(with_typed_catalog(
-        Router::new().route("/v1/chat/completions", post(echo_completions)),
-    ))
-    .await;
-    spawn_agent_server_for_gateway(base_url).await
-}
-
-/// Binds the workshop router to an injected Gateway endpoint.
-async fn spawn_agent_server_for_gateway(base_url: String) -> (String, tempfile::TempDir, AppState) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let agents_dir = dir.path().join("agents");
-    std::fs::create_dir(&agents_dir).expect("the agents directory creates");
-    std::fs::write(agents_dir.join("echo.md"), ECHO_MD).expect("the echo agent writes");
-    let config = Config {
-        agents: AgentsConfig {
-            path: agents_dir,
-            plugins: Some(plugin_dir()),
-            ..AgentsConfig::default()
-        },
-        ..test_config(&base_url, dir.path())
-    };
-    let (state, base) = spawn_router(&config).await;
-    // A run starts only once the retained catalog has a chat-capable
-    // model, so the catalog lands before any test launches.
-    state
-        .catalog()
-        .publish(vec![json!({ "id": "test-model", "object": "model" })]);
-    (base, dir, state)
-}
-
-/// Publishes `base_url` as the next complete Gateway generation.
-fn replace_gateway(state: &AppState, base_url: &str, _epoch: u64) {
-    replace_fixture_gateway(&gateway_updater(state), base_url, "replacement-key")
-        .expect("the replacement Gateway publishes");
-}
-
-/// Connects to `/agents/ws`, where the connect-time push lists the
-/// discovered agents plus the built-in chat.
-async fn connect(base: &str) -> JsonSocket {
-    connect_agents(base, &["chat", "echo"]).await
-}
-
-/// Launches the echo agent on `socket` and returns its session id.
-async fn launch_echo(socket: &mut JsonSocket) -> String {
-    launch(socket, "echo").await
-}
-
-/// Whether `frame` is the durable event of the agent waiting on its empty
-/// inbox for the operator.
-pub(crate) fn is_awaiting(frame: &serde_json::Value) -> bool {
-    frame["type"] == "agent_event" && frame["event"]["kind"] == "awaiting_input"
-}
-
-/// Receives frames until the agent's next `awaiting_input` event and
-/// returns it, asserting no error frame slips through on the way.
-pub(crate) async fn next_wait(socket: &mut JsonSocket) -> serde_json::Value {
-    socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "no error frame may come between: {frame}"
-            );
-            is_awaiting(frame)
-        })
-        .await
-}
-
-/// Sends the operator's message `text`.
-pub(crate) async fn answer(socket: &mut JsonSocket, text: &str) {
-    socket
-        .send_json(&json!({ "type": "input_response", "text": text }))
-        .await;
-}
-
-/// Everything one turn produced, collected until its completed reply
-/// event: the delta frames, the durable event frames, and apart from
-/// them the `awaiting_input` events on the way, which only a replay puts
-/// ahead of a turn: live, the wait that leads into a turn was read before
-/// its message was sent.
-pub(crate) struct Turn {
-    pub(crate) deltas: Vec<serde_json::Value>,
-    pub(crate) events: Vec<serde_json::Value>,
-    pub(crate) waits: Vec<serde_json::Value>,
-}
-
-/// Collects frames until the turn's `agent_message` event arrives,
-/// splitting deltas, durable events, and waits, and refusing error
-/// frames.
-pub(crate) async fn collect_turn(socket: &mut JsonSocket) -> Turn {
-    let mut deltas = Vec::new();
-    let mut events = Vec::new();
-    let mut waits = Vec::new();
-    tokio::time::timeout(Duration::from_secs(10), async {
-        loop {
-            let frame = socket.recv_json().await;
-            match frame["type"].as_str() {
-                Some("agent_delta") => deltas.push(frame),
-                Some("agent_event") if is_awaiting(&frame) => waits.push(frame),
-                Some("agent_event") => {
-                    let done = frame["event"]["kind"] == "agent_message";
-                    events.push(frame);
-                    if done {
-                        break;
-                    }
-                }
-                Some("error") => panic!("no error frame may come between a turn's frames: {frame}"),
-                // Status frames interleave freely.
-                _ => {}
-            }
-        }
-    })
-    .await
-    .expect("the turn completes within the deadline");
-    Turn {
-        deltas,
-        events,
-        waits,
-    }
-}
-
-/// Concatenates the turn's text-delta contents.
-pub(crate) fn delta_text(turn: &Turn) -> String {
-    turn.deltas
-        .iter()
-        .filter(|delta| delta["kind"] == "text")
-        .filter_map(|delta| delta["content"].as_str())
-        .collect()
-}
-
-mod lifecycle;
-mod refusals;
-mod replacement;
-mod revoke;
-mod turns;
diff --git a/crates/workshop/server/tests/it/agents/lifecycle.rs b/crates/workshop/server/tests/it/agents/lifecycle.rs
deleted file mode 100644
index 184fc10d9..000000000
--- a/crates/workshop/server/tests/it/agents/lifecycle.rs
+++ /dev/null
@@ -1,309 +0,0 @@
-//! Session lifecycle over `/agents/ws`: session isolation, status-bus
-//! ordering with the backoff reset, a close ending a waiting session, a
-//! program that returns framing its run's end and refusing a later
-//! message, a terminal agent failure and a parse failure each surfacing
-//! as an error frame, and the run log under the state directory.
-
-use workshop_run_log::{RunId, RunLog};
-
-use super::*;
-
-#[tokio::test]
-async fn two_sessions_do_not_cross_talk() {
-    let (base, _dir, _state) = spawn_agent_server().await;
-    let mut first = connect(&base).await;
-    let mut second = connect(&base).await;
-    let first_id = launch_echo(&mut first).await;
-    let second_id = launch_echo(&mut second).await;
-    assert_ne!(first_id, second_id, "every launch is its own session");
-
-    next_wait(&mut first).await;
-    next_wait(&mut second).await;
-    answer(&mut first, "alpha").await;
-    answer(&mut second, "beta").await;
-    let first_turn = collect_turn(&mut first).await;
-    let second_turn = collect_turn(&mut second).await;
-
-    assert_eq!(delta_text(&first_turn), "echo:alpha");
-    assert_eq!(delta_text(&second_turn), "echo:beta");
-    for turn in [&first_turn, &second_turn] {
-        let indices: Vec<u64> = turn
-            .events
-            .iter()
-            .filter_map(|event| event["index"].as_u64())
-            .collect();
-        assert_eq!(
-            indices,
-            [1, 2, 3],
-            "each session's log is its own: after its own wait at 0, no foreign entries \
-             shift the indices"
-        );
-    }
-    assert_eq!(
-        first_turn.events[0]["event"]["content"], "alpha",
-        "the first session's history holds only its own input"
-    );
-    assert_eq!(
-        second_turn.events[0]["event"]["content"], "beta",
-        "the second session's history holds only its own input"
-    );
-    first.close().await;
-    second.close().await;
-}
-
-#[tokio::test]
-async fn status_frames_fire_in_order_and_a_completed_reply_resets_the_backoff() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    // The backoff stands escalated, as after an outage; the completed
-    // reply is the useful work that returns it to base.
-    let _ = state.backoff().next_delay();
-    let _ = state.backoff().next_delay();
-    assert!(state.backoff().is_escalated_for_test());
-
-    // Status updates arrive on the main `/ws` socket as unsolicited frames.
-    let mut status = JsonSocket::connect(&format!("{base}/ws")).await;
-    let mut socket = connect(&base).await;
-    let _session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:ping");
-
-    // Thinking on turn dispatch, Generating on the first answer delta,
-    // idle at the agent's next wait on its inbox - scanned in order
-    // through the status stream.
-    let deadline = Duration::from_secs(10);
-    let thinking = status
-        .recv_until(deadline, |frame| {
-            frame["type"] == "status" && frame["activity"] == "thinking"
-        })
-        .await;
-    assert_eq!(thinking["label"], "Running agent turn");
-    let generating = status
-        .recv_until(deadline, |frame| {
-            frame["type"] == "status" && frame["activity"] == "generating"
-        })
-        .await;
-    assert_eq!(generating["label"], "Streaming response...");
-    let idle = status
-        .recv_until(deadline, |frame| {
-            frame["type"] == "status" && frame["label"] == "Ready"
-        })
-        .await;
-    assert_eq!(idle["activity"], "general");
-    assert!(
-        !state.backoff().is_escalated_for_test(),
-        "a completed reply records useful work and resets the backoff"
-    );
-    socket.close().await;
-    status.close().await;
-}
-
-#[tokio::test]
-async fn a_close_ends_a_waiting_session_and_cancels_its_run() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-    assert!(
-        state.agents().run_id(&session).is_some(),
-        "the session waiting on its inbox holds its begun run"
-    );
-
-    assert!(state.agents().close(&session), "the session closes");
-    assert!(
-        state.agents().run_id(&session).is_none(),
-        "a closed session leaves the registry at once"
-    );
-    let canceled = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        canceled["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("canceled")),
-        "the client learns the waiting run was canceled: {canceled}"
-    );
-    assert!(
-        !state.agents().close(&session),
-        "closing an already-closed session is a no-op"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_program_that_returns_frames_run_ended_and_a_later_message_is_refused() {
-    let (base, _dir, _state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let _session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-
-    answer(&mut socket, "quit").await;
-    let ended = socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "a program that returns ends its run without an error: {frame}"
-            );
-            frame["type"] == "agent_event" && frame["event"]["kind"] == "run_ended"
-        })
-        .await;
-    assert_eq!(
-        ended,
-        json!({
-            "type": "agent_event",
-            "index": 2,
-            "event": { "kind": "run_ended", "section": "Echo", "turn": 0, "content": "" },
-        }),
-        "the run's end frames right after the message it returned on, under the prompt's title"
-    );
-
-    answer(&mut socket, "too late").await;
-    let refusal = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert_eq!(
-        refusal["message"], "The agent's run has ended, so your message was not sent.",
-        "a message after the run's end is refused out loud: {refusal}"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_terminal_agent_failure_reaches_the_socket_as_an_error_frame() {
-    let (base, dir, state) = spawn_agent_server().await;
-    // An agent that dies after its first input, so the socket is attached
-    // and subscribed long before the failure fires.
-    std::fs::write(
-        dir.path().join("agents").join("boom.md"),
-        r"---
-name: boom
-description: The terminally failing test agent.
-runvil: 0
-uses:
-  - user
----
-
-# Boom
-
-## Conversation
-
-```lua
-tasks.receive()
-error('kaboom')
-```
-",
-    )
-    .expect("the boom agent writes");
-    let mut socket = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(
-        socket.recv_json().await,
-        json!({ "type": "agents", "agents": ["boom", "chat", "echo"] }),
-        "the freshly written agent is discovered on this connect"
-    );
-    socket
-        .send_json(&json!({ "type": "launch", "agent": "boom" }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "agent_session");
-    let session = frame["session"]
-        .as_str()
-        .expect("the acknowledgment includes the session id")
-        .to_owned();
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "go").await;
-    let error = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        error["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("kaboom")),
-        "the run's own failure reaches the SPA as an error frame, not just \
-         the status bus: {error}"
-    );
-    // The failed run ends the session; the registry lets it go.
-    tokio::time::timeout(Duration::from_secs(10), async {
-        while state.agents().run_id(&session).is_some() {
-            tokio::time::sleep(Duration::from_millis(10)).await;
-        }
-    })
-    .await
-    .expect("a failed run leaves the registry");
-    socket.close().await;
-}
-
-#[tokio::test(flavor = "multi_thread")]
-async fn an_agent_that_fails_to_parse_reaches_the_socket_as_an_error_frame() {
-    let (base, dir, _state) = spawn_agent_server().await;
-    // Readable, so the launch is accepted, but with no frontmatter, so
-    // the run fails at once, before the socket has attached.
-    std::fs::write(dir.path().join("agents").join("broken.md"), "# Broken\n")
-        .expect("the broken agent writes");
-    let mut socket = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(
-        socket.recv_json().await,
-        json!({ "type": "agents", "agents": ["broken", "chat", "echo"] }),
-        "the freshly written agent is discovered on this connect"
-    );
-    socket
-        .send_json(&json!({ "type": "launch", "agent": "broken" }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "agent_session", "the launch is acknowledged");
-
-    let error = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        error["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("frontmatter delimiter")),
-        "the parse failure reaches the SPA as an error frame: {error}"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_launched_run_is_recorded_in_the_run_log_under_the_state_directory() {
-    let (base, dir, state) = spawn_agent_server().await;
-    let log_file = dir.path().join("harness").join("runs.db");
-    assert!(
-        !log_file.exists(),
-        "the server opens no run log until a run starts"
-    );
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:ping");
-    assert!(state.agents().close(&session), "the session closes");
-
-    // The first run in a fresh log is run 1. Its end is the last write,
-    // so the row reads closed once the run has been recorded whole.
-    let run = RunId::from_raw(1);
-    let (log, row) = tokio::time::timeout(Duration::from_secs(10), async {
-        loop {
-            if let Ok(log) = RunLog::open(&log_file).await
-                && let Ok(row) = log.run(run).await
-                && row.result.is_some()
-            {
-                return (log, row);
-            }
-            tokio::time::sleep(Duration::from_millis(10)).await;
-        }
-    })
-    .await
-    .expect("the run is recorded and closed within the deadline");
-    assert_eq!(row.agent, "echo", "Workshop writes the launched agent");
-    let events = log.transcript(run).await.expect("the events read back");
-    assert!(
-        events
-            .iter()
-            .any(|stored| stored.record.payload.to_string().contains("echo:ping")),
-        "the recorded events hold the reply: {events:?}"
-    );
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/agents/refusals.rs b/crates/workshop/server/tests/it/agents/refusals.rs
deleted file mode 100644
index 0e200407c..000000000
--- a/crates/workshop/server/tests/it/agents/refusals.rs
+++ /dev/null
@@ -1,149 +0,0 @@
-//! Protocol refusals over `/agents/ws`: every malformed or out-of-turn
-//! frame is an error frame, the socket survives its refusals, a message
-//! before the run starts is refused, and a launch with no usable gateway
-//! is refused.
-
-use super::*;
-
-#[tokio::test]
-async fn a_launch_with_no_usable_gateway_is_refused_with_the_refusal_text() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    replace_fixture_gateway(&gateway_updater(&state), "http://127.0.0.1:9", "")
-        .expect("a keyless replacement still publishes");
-    let mut socket = connect(&base).await;
-
-    socket
-        .send_json(&json!({ "type": "launch", "agent": "echo" }))
-        .await;
-    let frame = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains(
-                "agent sessions need a usable gateway binding; check the gateway base URL and key"
-            )),
-        "a gateway with an empty key refuses the launch: {frame}"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_message_before_the_run_starts_is_refused_with_an_error_frame() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    // With no chat-capable model in the catalog, the launched run waits in
-    // the server's broker, so it has no Harness to take a message yet.
-    state.catalog().publish(vec![]);
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    assert_eq!(
-        state.agents().run_id(&session),
-        None,
-        "the run waits for a chat-capable model"
-    );
-
-    answer(&mut socket, "too early").await;
-    let refusal = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert_eq!(
-        refusal["message"], "The agent is not taking messages yet, so your message was not sent.",
-        "a message before the run starts is refused out loud: {refusal}"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn refusals_are_error_frames_and_the_socket_survives() {
-    let (base, _dir, _state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-
-    socket
-        .send_json(&json!({ "type": "launch", "agent": "ghost" }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "error");
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("unknown agent")),
-        "an unknown agent is refused by name: {frame}"
-    );
-
-    socket
-        .send_json(&json!({ "type": "attach", "session": "not-a-session" }))
-        .await;
-    assert_eq!(socket.recv_json().await["type"], "error");
-
-    socket.send_json(&json!({ "type": "cancel" })).await;
-    assert_eq!(
-        socket.recv_json().await["type"],
-        "error",
-        "a cancel before any session is attached is refused"
-    );
-
-    socket.send_text("{ not json").await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "error");
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("invalid JSON")),
-        "a malformed frame is refused, not fatal: {frame}"
-    );
-
-    socket.send_json(&json!({ "type": "mystery" })).await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "error");
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("unknown frame type")),
-        "an unknown type is refused naming the expected ones: {frame}"
-    );
-
-    socket
-        .send_json(&json!({ "type": "input_response", "text": "hi" }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(frame["type"], "error");
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("before a session is attached")),
-        "an input_response before any session is attached is refused: {frame}"
-    );
-
-    // The socket survives its refusals: a real launch still works, and a
-    // second launch on the same socket is refused - agent windows are
-    // modal, one session per socket.
-    let _session = launch_echo(&mut socket).await;
-    socket
-        .send_json(&json!({ "type": "launch", "agent": "echo" }))
-        .await;
-    let frame = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("modal")),
-        "a second launch on an attached socket is refused: {frame}"
-    );
-
-    // Attached, an input_response still validates its shape.
-    socket
-        .send_json(&json!({ "type": "input_response", "text": 7 }))
-        .await;
-    let frame = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        frame["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("invalid input_response")),
-        "a shapeless input_response is refused, not fatal: {frame}"
-    );
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/agents/replacement.rs b/crates/workshop/server/tests/it/agents/replacement.rs
deleted file mode 100644
index 2a6409934..000000000
--- a/crates/workshop/server/tests/it/agents/replacement.rs
+++ /dev/null
@@ -1,80 +0,0 @@
-//! Gateway replacement against a live agent conversation: the Harness
-//! holds no gateway, so a replacement published while `chat` waits on its
-//! inbox retires nothing, and the next message's round reaches the
-//! replacement.
-
-use super::*;
-
-/// A gateway that records each completion body into `requests` and echoes
-/// the last user message, with the typed catalog every test selects from.
-fn recording_gateway(requests: Arc<Mutex<Vec<serde_json::Value>>>) -> Router {
-    with_typed_catalog(Router::new().route(
-        "/v1/chat/completions",
-        post(move |body: String| {
-            let requests = Arc::clone(&requests);
-            async move {
-                record_request(&requests, &body);
-                echo_completions(body).await
-            }
-        }),
-    ))
-}
-
-#[tokio::test]
-async fn a_replacement_published_while_chat_waits_leaves_the_wait_and_answers_on_the_replacement() {
-    let original_requests = Arc::new(Mutex::new(Vec::new()));
-    let original = spawn_gateway(recording_gateway(Arc::clone(&original_requests))).await;
-    let (base, _dir, state) = spawn_agent_server_for_gateway(original).await;
-    state
-        .menu()
-        .set_selected("test-model")
-        .expect("the retained catalog holds test-model");
-    let mut socket = connect(&base).await;
-    let session = launch(&mut socket, "chat").await;
-    next_wait(&mut socket).await;
-
-    let replacement_requests = Arc::new(Mutex::new(Vec::new()));
-    let replacement = spawn_gateway(recording_gateway(Arc::clone(&replacement_requests))).await;
-    replace_gateway(&state, &replacement, 1_757_000_000);
-
-    // The chat still waits on its inbox, so the next message answers it.
-    answer(&mut socket, "after replacement").await;
-    let reply = socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "no error frame may come between: {frame}"
-            );
-            assert!(
-                !is_awaiting(frame),
-                "the chat answers the message before it waits again: {frame}"
-            );
-            frame["type"] == "agent_event" && frame["event"]["kind"] == "agent_message"
-        })
-        .await;
-    assert_eq!(reply["event"]["content"], "echo:after replacement");
-    assert!(
-        original_requests
-            .lock()
-            .expect("the request capture lock is healthy")
-            .is_empty(),
-        "the original gateway receives no post-publication round"
-    );
-    {
-        let requests = replacement_requests
-            .lock()
-            .expect("the request capture lock is healthy");
-        assert_eq!(
-            requests.len(),
-            1,
-            "the next message's round reaches the replacement"
-        );
-        assert_eq!(requests[0]["model"], "test-model");
-    }
-    assert_eq!(
-        state.agents().run_id(&session),
-        Some(workshop_run_log::RunId::from_raw(1)),
-        "the replacement keeps the conversation's one run, the first the log began"
-    );
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/agents/revoke.rs b/crates/workshop/server/tests/it/agents/revoke.rs
deleted file mode 100644
index fe73fd63b..000000000
--- a/crates/workshop/server/tests/it/agents/revoke.rs
+++ /dev/null
@@ -1,116 +0,0 @@
-//! Workspace revokes against agent conversations: a root revoked while one
-//! conversation runs is gone from the Host snapshot the next
-//! conversation's run reads, and the running one keeps its launch
-//! snapshot.
-
-use tokio::sync::mpsc;
-use workshop_workspace::Workspace;
-
-use super::*;
-
-/// The roots agent: its run opens with a model round naming the `ui()`
-/// snapshot's workspace root, then echoes each input with the root its
-/// `ui()` reports at that turn.
-const ROOTS_MD: &str = r"---
-name: roots
-description: The roots test agent on the unified runtime.
-runvil: 0
-uses:
-  - user
----
-
-# Roots
-
-## Conversation
-
-```lua
-messages:user('launch@' .. tostring(ui().workspace_root))
-models.loop(models.get('test-model'))
-while true do
-    local text = tasks.receive()
-    messages:user(text .. '@' .. tostring(ui().workspace_root))
-    models.loop(models.get('test-model'))
-end
-```
-";
-
-/// The last message of the next model round the gateway received.
-async fn next_round(rounds: &mut mpsc::UnboundedReceiver<String>) -> String {
-    tokio::time::timeout(Duration::from_secs(10), rounds.recv())
-        .await
-        .expect("the model round arrives in time")
-        .expect("the gateway is alive")
-}
-
-/// The content of a completion request's last message.
-fn last_content(body: &str) -> String {
-    let body: serde_json::Value = serde_json::from_str(body).expect("the request is JSON");
-    body["messages"]
-        .as_array()
-        .and_then(|messages| messages.last())
-        .and_then(|message| message["content"].as_str())
-        .expect("the request includes a message")
-        .to_owned()
-}
-
-#[tokio::test]
-async fn a_revoke_reaches_the_next_conversation_and_a_running_one_keeps_its_launch_snapshot() {
-    let (rounds_tx, mut rounds) = mpsc::unbounded_channel();
-    let gateway = spawn_gateway(with_typed_catalog(Router::new().route(
-        "/v1/chat/completions",
-        post(move |body: String| {
-            let rounds_tx = rounds_tx.clone();
-            async move {
-                let _ = rounds_tx.send(last_content(&body));
-                echo_completions(body).await
-            }
-        }),
-    )))
-    .await;
-    let (base, dir, state) = spawn_agent_server_for_gateway(gateway).await;
-    std::fs::write(dir.path().join("agents").join("roots.md"), ROOTS_MD)
-        .expect("the roots agent writes");
-    let workspace = state
-        .registry()
-        .state::<Workspace>()
-        .expect("the workspace is registered");
-    let folder = tempfile::TempDir::new().expect("tempdir");
-    let granted = workspace
-        .grant_and_persist(folder.path())
-        .await
-        .expect("the folder grants");
-
-    let mut running = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(running.recv_json().await["type"], "agents");
-    let _running = launch(&mut running, "roots").await;
-    assert_eq!(
-        next_round(&mut rounds).await,
-        format!("launch@{}", granted.display()),
-        "the launch reads the granted folder"
-    );
-    next_wait(&mut running).await;
-
-    // The revoke lands while the first conversation waits on its inbox.
-    workspace
-        .revoke_and_persist(&granted)
-        .await
-        .expect("the folder revokes");
-
-    let mut next = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(next.recv_json().await["type"], "agents");
-    let _next = launch(&mut next, "roots").await;
-    assert_eq!(
-        next_round(&mut rounds).await,
-        "launch@nil",
-        "the next conversation reads roots without the revoked folder"
-    );
-
-    answer(&mut running, "turn").await;
-    assert_eq!(
-        next_round(&mut rounds).await,
-        format!("turn@{}", granted.display()),
-        "the running conversation keeps the snapshot it launched with"
-    );
-    running.close().await;
-    next.close().await;
-}
diff --git a/crates/workshop/server/tests/it/agents/turns.rs b/crates/workshop/server/tests/it/agents/turns.rs
deleted file mode 100644
index 8d543961c..000000000
--- a/crates/workshop/server/tests/it/agents/turns.rs
+++ /dev/null
@@ -1,418 +0,0 @@
-//! The turn cycle over `/agents/ws`: the agent's waits on its inbox and a
-//! full turn's deltas and indexed durable events, a message that steers a
-//! turn while its tool call runs, reconnect replay ending on the agent's
-//! wait, and a stop that keeps the conversation's run and its wait.
-
-use axum::http::header;
-use axum::response::IntoResponse;
-use tokio::sync::Notify;
-
-use crate::common::{sse_chunk, sse_line};
-
-use super::*;
-
-/// The steered agent: it offers the web tools, and loops reading the
-/// operator's next message and running the model loop over it.
-const STEER_MD: &str = r"---
-name: steer
-description: The steered test agent on the unified runtime.
-runvil: 0
-uses:
-  - user
-  - web
----
-
-# Steer
-
-## Conversation
-
-```lua
-tools.offer('web')
-while true do
-    messages:user(tasks.receive())
-    models.loop(models.get('test-model'))
-end
-```
-";
-
-/// What the agent's first `awaiting_input` frames as: the log's first
-/// entry, in the agent's `Conversation` section.
-fn first_wait() -> serde_json::Value {
-    json!({
-        "type": "agent_event",
-        "index": 0,
-        "event": { "kind": "awaiting_input", "section": "Conversation", "turn": 0, "content": "" },
-    })
-}
-
-#[tokio::test]
-async fn a_full_turn_streams_deltas_and_indexed_events_sharing_the_reply_id() {
-    let (base, _dir, _state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let _session = launch_echo(&mut socket).await;
-
-    // Turn one, after the agent's first wait on its inbox.
-    assert_eq!(
-        next_wait(&mut socket).await,
-        first_wait(),
-        "the agent parking on its empty inbox is the log's first entry"
-    );
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-
-    assert_eq!(
-        delta_text(&turn),
-        "echo:ping",
-        "the live text deltas assemble the reply"
-    );
-    assert!(
-        turn.deltas
-            .iter()
-            .filter(|delta| delta["kind"] == "text")
-            .count()
-            >= 2,
-        "the mock splits content, so the turn streams multiple live chunks"
-    );
-    assert!(
-        turn.deltas.iter().all(|delta| delta["reply"] == 0),
-        "every first-turn delta is stamped with superseding reply id 0: {:?}",
-        turn.deltas
-    );
-    let kinds: Vec<&str> = turn
-        .events
-        .iter()
-        .filter_map(|event| event["event"]["kind"].as_str())
-        .collect();
-    assert_eq!(
-        kinds,
-        ["user_message", "agent_thought", "agent_message"],
-        "the durable record of one turn: the operator's message, thinking, reply - the \
-         message frames as the operator's own, so no tool_call_update exists"
-    );
-    let indices: Vec<u64> = turn
-        .events
-        .iter()
-        .filter_map(|event| event["index"].as_u64())
-        .collect();
-    assert_eq!(
-        indices,
-        [1, 2, 3],
-        "durable frames are stamped with monotonically increasing log indices"
-    );
-    assert_eq!(turn.events[0]["event"]["content"], "ping");
-    assert!(
-        turn.events[0].get("reply").is_none(),
-        "a user_message settles no deltas, so its reply id is omitted"
-    );
-    assert_eq!(
-        turn.events[1]["reply"], 0,
-        "the thinking event supersedes the reasoning deltas of its round"
-    );
-    assert_eq!(turn.events[2]["event"]["content"], "echo:ping");
-    assert_eq!(
-        turn.events[2]["reply"], 0,
-        "deltas and the completed reply share the superseding event id"
-    );
-
-    // The next message works: the agent waits again, and the full turn
-    // cycle repeats with the next reply id and continuing indices.
-    assert_eq!(next_wait(&mut socket).await["index"], 4);
-    answer(&mut socket, "pong").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:pong");
-    assert!(
-        turn.deltas.iter().all(|delta| delta["reply"] == 1),
-        "the second round's deltas are stamped with the next reply id"
-    );
-    let indices: Vec<u64> = turn
-        .events
-        .iter()
-        .filter_map(|event| event["index"].as_u64())
-        .collect();
-    assert_eq!(indices, [5, 6, 7], "indices continue across turns");
-    assert_eq!(turn.events[2]["reply"], 1);
-    socket.close().await;
-}
-
-/// Streams one tool-call round attributed to `model`: a call to the web
-/// Pack's search, by its wire name, for `docs`.
-fn search_round(model: &str) -> Response {
-    let null = serde_json::Value::Null;
-    let call = json!({ "tool_calls": [{
-        "index": 0, "id": "call_1", "type": "function",
-        "function": { "name": "web_search", "arguments": "{\"query\":\"docs\"}" },
-    }] });
-    let mut sse = String::new();
-    for event in [
-        sse_chunk(model, &json!({ "role": "assistant" }), &null),
-        sse_chunk(model, &call, &null),
-        sse_chunk(model, &json!({}), &json!("tool_calls")),
-    ] {
-        sse.push_str(&sse_line(&event));
-    }
-    sse.push_str("data: [DONE]\n\n");
-    ([(header::CONTENT_TYPE, "text/event-stream")], sse).into_response()
-}
-
-/// The `(role, content)` of each message one captured request sent, with
-/// a tool-call turn's empty content read as empty.
-fn roles_and_contents(request: &serde_json::Value) -> Vec<(String, String)> {
-    request["messages"]
-        .as_array()
-        .expect("a captured request holds its messages")
-        .iter()
-        .map(|message| {
-            (
-                message["role"].as_str().unwrap_or_default().to_owned(),
-                message["content"].as_str().unwrap_or_default().to_owned(),
-            )
-        })
-        .collect()
-}
-
-/// Serves the steered agent's gateway and returns its base URL. The model
-/// streams a search round for its first request and echoes each later
-/// one, and `requests` captures every request; each search notifies
-/// `searching`, then holds until `release` notifies.
-async fn steer_gateway(
-    requests: &Arc<Mutex<Vec<serde_json::Value>>>,
-    searching: &Arc<Notify>,
-    release: &Arc<Notify>,
-) -> String {
-    let (captured, started, gate) = (
-        Arc::clone(requests),
-        Arc::clone(searching),
-        Arc::clone(release),
-    );
-    spawn_gateway(with_typed_catalog(
-        Router::new()
-            .route(
-                "/v1/chat/completions",
-                post(move |body: String| {
-                    let captured = Arc::clone(&captured);
-                    async move {
-                        record_request(&captured, &body);
-                        let first = captured
-                            .lock()
-                            .expect("the request capture lock is healthy")
-                            .len()
-                            == 1;
-                        if first {
-                            search_round("test-model")
-                        } else {
-                            echo_completions(body).await
-                        }
-                    }
-                }),
-            )
-            .route(
-                "/v1/tools/web_search",
-                post(move || {
-                    let (started, gate) = (Arc::clone(&started), Arc::clone(&gate));
-                    async move {
-                        started.notify_one();
-                        gate.notified().await;
-                        axum::Json(json!({ "query": "docs", "results": [] }))
-                    }
-                }),
-            ),
-    ))
-    .await
-}
-
-#[tokio::test]
-async fn a_message_sent_while_a_tool_call_runs_is_a_user_message_the_next_request_holds() {
-    let requests = Arc::new(Mutex::new(Vec::new()));
-    let (searching, release) = (Arc::new(Notify::new()), Arc::new(Notify::new()));
-    let gateway = steer_gateway(&requests, &searching, &release).await;
-    let (base, dir, _state) = spawn_agent_server_for_gateway(gateway).await;
-    std::fs::write(dir.path().join("agents").join("steer.md"), STEER_MD)
-        .expect("the steer agent writes");
-    let mut socket = JsonSocket::connect(&format!("{base}/agents/ws")).await;
-    assert_eq!(socket.recv_json().await["type"], "agents");
-    let _session = launch(&mut socket, "steer").await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "find the docs").await;
-    tokio::time::timeout(Duration::from_secs(10), searching.notified())
-        .await
-        .expect("the model's search call is running");
-    answer(&mut socket, "also check the tests").await;
-
-    let steered = socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "no error frame may come between: {frame}"
-            );
-            assert_ne!(
-                frame["event"]["kind"], "tool_call_update",
-                "the message is a user_message before the held search answers: {frame}"
-            );
-            frame["type"] == "agent_event"
-                && frame["event"]["kind"] == "user_message"
-                && frame["event"]["content"] == "also check the tests"
-        })
-        .await;
-    assert!(
-        steered.get("reply").is_none(),
-        "the steering message is the operator's, framed as typed"
-    );
-    assert_eq!(
-        requests
-            .lock()
-            .expect("the request capture lock is healthy")
-            .len(),
-        1,
-        "the message asks for no model round while the search runs"
-    );
-
-    release.notify_one();
-    let reply = socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "no error frame may come between: {frame}"
-            );
-            frame["type"] == "agent_event" && frame["event"]["kind"] == "agent_message"
-        })
-        .await;
-    let held = "This message arrived while you were working:\n\nalso check the tests";
-    assert_eq!(reply["event"]["content"], format!("echo:{held}"));
-    let requests = requests
-        .lock()
-        .expect("the request capture lock is healthy")
-        .clone();
-    assert_eq!(
-        requests.len(),
-        2,
-        "the search round, then the one that holds the message"
-    );
-    let sent = roles_and_contents(&requests[1]);
-    let roles: Vec<&str> = sent.iter().map(|(role, _)| role.as_str()).collect();
-    assert_eq!(
-        roles[roles.len() - 3..],
-        ["assistant", "tool", "user"],
-        "the search call finished and its result went first: {sent:?}"
-    );
-    assert_eq!(
-        sent.last().map(|(_, content)| content.as_str()),
-        Some(held),
-        "the next request holds the message under its arrival line"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn reconnect_replays_the_log_and_ends_on_the_agents_wait() {
-    let (base, _dir, _state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    let opening = next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let live = collect_turn(&mut socket).await;
-    let pending = next_wait(&mut socket).await;
-    // The socket dies mid-session; the session survives.
-    socket.close().await;
-
-    let mut socket = connect(&base).await;
-    socket
-        .send_json(&json!({ "type": "attach", "session": session }))
-        .await;
-    let frame = socket.recv_json().await;
-    assert_eq!(
-        frame["type"], "agent_session",
-        "attach is acknowledged: {frame}"
-    );
-    let replayed = collect_turn(&mut socket).await;
-    assert_eq!(
-        replayed.waits,
-        [opening],
-        "the replay opens with the wait the first message answered"
-    );
-    assert_eq!(
-        replayed.events, live.events,
-        "reconnect replays the persisted entries byte-alike: same indices, stamps, events"
-    );
-    assert_eq!(
-        next_wait(&mut socket).await,
-        pending,
-        "the replayed log ends on the agent's wait for its next message"
-    );
-
-    // The reattached session is live: the next message runs a full turn.
-    answer(&mut socket, "again").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:again");
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_cancel_while_the_agent_waits_leaves_the_wait_and_the_next_message_answers_it() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-    let run = state
-        .agents()
-        .run_id(&session)
-        .expect("the conversation's run has begun");
-
-    socket.send_json(&json!({ "type": "cancel" })).await;
-    answer(&mut socket, "after cancel").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(
-        delta_text(&turn),
-        "echo:after cancel",
-        "the wait the stop left answers the next message with a full turn"
-    );
-    assert!(
-        turn.waits.is_empty(),
-        "the stop never woke the wait, so it did not wait again: {:?}",
-        turn.waits
-    );
-    assert_eq!(
-        state.agents().run_id(&session),
-        Some(run),
-        "the stop keeps the conversation's one run"
-    );
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_stop_keeps_the_conversations_one_run_while_transcript_indices_continue() {
-    let (base, _dir, state) = spawn_agent_server().await;
-    let mut socket = connect(&base).await;
-    let session = launch_echo(&mut socket).await;
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let first = collect_turn(&mut socket).await;
-    let run = state
-        .agents()
-        .run_id(&session)
-        .expect("the conversation's run has begun");
-
-    assert_eq!(next_wait(&mut socket).await["index"], 4);
-    socket.send_json(&json!({ "type": "cancel" })).await;
-    answer(&mut socket, "pong").await;
-    let second = collect_turn(&mut socket).await;
-
-    assert_eq!(delta_text(&second), "echo:pong");
-    let indices: Vec<u64> = first
-        .events
-        .iter()
-        .chain(&second.events)
-        .filter_map(|event| event["index"].as_u64())
-        .collect();
-    assert_eq!(
-        indices,
-        [1, 2, 3, 5, 6, 7],
-        "the transcript keeps numbering across the stop, around the agent's waits"
-    );
-    assert_eq!(
-        state.agents().run_id(&session),
-        Some(run),
-        "the stop keeps the conversation's one run"
-    );
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/boot.rs b/crates/workshop/server/tests/it/boot.rs
deleted file mode 100644
index 2382afeb3..000000000
--- a/crates/workshop/server/tests/it/boot.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-//! Boot composition: a subsystem whose `register` call is missing fails
-//! state construction at boot, naming the absent contribution, instead
-//! of panicking later at first use.
-
-use workshop_server::fixtures::{Omit, state_with_gateway_omitting};
-use workshop_server::{AgentsConfig, Config, GatewayConfig, ResolvedGateway, ServerConfig};
-
-/// A config against a stub gateway address, its state directory a fresh
-/// tempdir.
-fn config_for(state_dir: &std::path::Path) -> Config {
-    Config {
-        gateway: GatewayConfig {
-            base_url: "http://127.0.0.1:1".to_string(),
-            api_key: "test-key".to_string(),
-        },
-        server: ServerConfig {
-            state_dir: state_dir.to_path_buf(),
-            ..ServerConfig::default()
-        },
-        agents: AgentsConfig::default(),
-    }
-}
-
-#[test]
-fn a_missing_required_contribution_fails_boot_naming_it() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let config = config_for(state_dir.path());
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    let error = state_with_gateway_omitting(&config, &gateway, Omit::Menu)
-        .expect_err("boot fails when the menu subsystem never registers");
-    // The composition error renders only its own frame; the absent
-    // contribution is named by its `source()`.
-    let cause = std::error::Error::source(&error)
-        .expect("the composition failure reports the registry's cause");
-    assert!(
-        cause.to_string().contains("MenuHandles"),
-        "the failure's cause names the missing contribution: {error}: {cause}"
-    );
-}
-
-#[test]
-fn a_complete_composition_boots() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let config = config_for(state_dir.path());
-    let gateway = ResolvedGateway::from_config(&config.gateway);
-    workshop_server::fixtures::state_with_gateway(&config, &gateway)
-        .expect("every subsystem registered: boot succeeds");
-}
diff --git a/crates/workshop/server/tests/it/chat_gate.rs b/crates/workshop/server/tests/it/chat_gate.rs
deleted file mode 100644
index 116d1d2e9..000000000
--- a/crates/workshop/server/tests/it/chat_gate.rs
+++ /dev/null
@@ -1,227 +0,0 @@
-//! THE CHAT GATE: in-process tests over the SSE mock gateway, each
-//! pinned to a behavior the built-in `chat` agent must keep.
-//!
-//! Every test launches the embedded `agents/chat.md`: the fixture's
-//! agents directory does not exist, so what runs is exactly what ships -
-//! a Markdown prompt on the unified runtime. A conversation's transcript
-//! sits in Workshop's memory, and the Harness records each run through
-//! the Host's recorder, so no gate here spans a server restart; reconnect
-//! within one process is the agents suite's.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking with the invariant
-// named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-use std::sync::{Arc, Mutex};
-use std::time::Duration;
-
-use axum::Router;
-use axum::body::Body;
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use futures_util::StreamExt as _;
-use serde_json::json;
-
-use workshop_server::fixtures::{gateway_updater, replace_gateway};
-use workshop_server::{AgentsConfig, AppState, Config};
-
-use crate::agents::{answer, collect_turn, delta_text, is_awaiting, next_wait};
-use crate::common::{
-    JsonSocket, connect_agents, echo_stream, launch, plugin_dir, spawn_gateway, spawn_router,
-    sse_chunk, sse_line, test_config, typed_catalog,
-};
-
-/// Every completion request body the gate mock received, in arrival
-/// order: the gate's proof of exactly what the model was shown.
-type CapturedRequests = Arc<Mutex<Vec<serde_json::Value>>>;
-
-/// The gate mock: streams `echo:<last user message>` as a reasoning chunk
-/// plus split content, echoing the requested model id back on every
-/// chunk. Two message texts select failure shapes - `fail` is declined
-/// with a 500, and `hang` opens the stream, sends one content chunk, and
-/// never finishes. Every request body is captured for the history proofs.
-fn gate_completions(captured: &CapturedRequests, body: &str) -> Response {
-    let request: serde_json::Value = serde_json::from_str(body).expect("the request is JSON");
-    captured
-        .lock()
-        .expect("the capture lock is healthy")
-        .push(request.clone());
-    let model = request["model"].as_str().unwrap_or("test-model").to_owned();
-    let last = request["messages"]
-        .as_array()
-        .and_then(|messages| messages.last())
-        .and_then(|message| message["content"].as_str())
-        .expect("the request includes a user message")
-        .to_owned();
-    if last == "fail" {
-        return (StatusCode::INTERNAL_SERVER_ERROR, "injected model failure").into_response();
-    }
-    let null = serde_json::Value::Null;
-    if last == "hang" {
-        let opening = sse_line(&sse_chunk(&model, &json!({ "role": "assistant" }), &null))
-            + &sse_line(&sse_chunk(&model, &json!({ "content": "nev" }), &null));
-        let stream = futures_util::stream::iter([Ok::<_, std::io::Error>(opening)])
-            .chain(futures_util::stream::pending());
-        return (
-            [(header::CONTENT_TYPE, "text/event-stream")],
-            Body::from_stream(stream),
-        )
-            .into_response();
-    }
-    echo_stream(&model, &last)
-}
-
-/// One workshop server over the gate mock. The agents directory is
-/// missing on purpose: every `chat` launch runs the embedded built-in.
-struct GateServer {
-    /// The server's `ws://` base URL.
-    ws_base: String,
-    /// The shared state handle: menu, catalog, and session registry.
-    state: AppState,
-    /// The mock's captured request bodies.
-    captured: CapturedRequests,
-    /// The state directory the run log sits under, kept alive.
-    dir: tempfile::TempDir,
-}
-
-/// Every id a gate may select, in the order the typed catalog lists
-/// them.
-const GATE_MODELS: &[&str] = &["model-b", "model-a", "test-model", "claude-opus-4-6"];
-
-/// Spawns the gate server with `models` in the retained catalog and the
-/// first of them selected in the menu.
-async fn spawn_chat_server(models: &[&str]) -> GateServer {
-    spawn_chat_server_with_selection(models, models.first().copied()).await
-}
-
-/// Spawns the gate server with an explicit menu selection. `None` keeps
-/// the catalog available to the launched agent while its live `ui()`
-/// snapshot has no selected binding.
-async fn spawn_chat_server_with_selection(models: &[&str], selected: Option<&str>) -> GateServer {
-    let captured = CapturedRequests::default();
-    let mock = Arc::clone(&captured);
-    let gateway_url = spawn_gateway(
-        Router::new()
-            .route(
-                "/v1/chat/completions",
-                post(move |body: String| {
-                    let captured = Arc::clone(&mock);
-                    async move { gate_completions(&captured, &body) }
-                }),
-            )
-            .route(
-                "/admin/profiles",
-                get(|| async { axum::Json(json!({"profiles": ["main", "beta"]})) }),
-            )
-            .route(
-                "/admin/status",
-                get(|| async { axum::Json(json!({"profile": "beta"})) }),
-            )
-            .route("/v1/models", typed_catalog(GATE_MODELS)),
-    )
-    .await;
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = Config {
-        agents: AgentsConfig {
-            path: dir.path().join("missing-agents"),
-            plugins: Some(plugin_dir()),
-            ..AgentsConfig::default()
-        },
-        ..test_config(&gateway_url, dir.path())
-    };
-    let (state, ws_base) = spawn_router(&config).await;
-    state.catalog().publish(
-        models
-            .iter()
-            .map(|id| json!({ "id": id, "object": "model" }))
-            .collect(),
-    );
-    if let Some(selected) = selected {
-        state
-            .menu()
-            .set_selected(selected)
-            .expect("the selected model is in the retained catalog");
-    }
-    GateServer {
-        ws_base,
-        state,
-        captured,
-        dir,
-    }
-}
-
-/// Connects to `/agents/ws`, asserting the connect-time list is exactly
-/// the built-in: end-to-end proof that a missing agents directory still
-/// offers `chat`.
-async fn connect_chat(base: &str) -> JsonSocket {
-    connect_agents(base, &["chat"]).await
-}
-
-/// Launches the built-in chat and returns the session id.
-async fn launch_chat(socket: &mut JsonSocket) -> String {
-    launch(socket, "chat").await
-}
-
-/// Asserts that the chat in `session` is dormant: its run has not begun,
-/// so it has not waited on its inbox, and no error is buffered. The
-/// socket refuses an unknown frame type inline, and its biased loop sends
-/// a queued error frame before reading inbound, so a premature error
-/// arrives ahead of the refusal.
-async fn assert_chat_quiet(server: &GateServer, session: &str, socket: &mut JsonSocket) {
-    assert_eq!(
-        server.state.agents().run_id(session),
-        None,
-        "chat must stay dormant until a chat-capable catalog exists, yet its run has begun"
-    );
-    socket.send_json(&json!({ "type": "quiet_probe" })).await;
-    let frame = socket.recv_json().await;
-    assert!(
-        frame["type"] == "error"
-            && frame["message"]
-                .as_str()
-                .is_some_and(|message| message.starts_with("unknown frame type")),
-        "chat must stay dormant until a chat-capable catalog exists, got {frame}"
-    );
-}
-
-/// The `(role, content)` pairs of one captured request's message list,
-/// without its leading system messages: these gates pin the conversation,
-/// so they read the same whether or not the chat agent opens with a
-/// system message.
-fn role_content_pairs(request: &serde_json::Value) -> Vec<(String, String)> {
-    request["messages"]
-        .as_array()
-        .expect("a captured request includes a messages array")
-        .iter()
-        .skip_while(|message| message["role"] == "system")
-        .map(|message| {
-            (
-                message["role"]
-                    .as_str()
-                    .expect("every message has a role")
-                    .to_owned(),
-                message["content"]
-                    .as_str()
-                    .expect("every message has string content")
-                    .to_owned(),
-            )
-        })
-        .collect()
-}
-
-/// Builds one owned `(role, content)` pair for the assertions.
-fn pair(role: &str, content: &str) -> (String, String) {
-    (role.to_owned(), content.to_owned())
-}
-
-mod canonical_sequence;
-mod compaction;
-mod lifecycle;
-mod overload;
-mod protocol;
-mod recovery;
diff --git a/crates/workshop/server/tests/it/chat_gate/canonical_sequence.rs b/crates/workshop/server/tests/it/chat_gate/canonical_sequence.rs
deleted file mode 100644
index 5996a4ee7..000000000
--- a/crates/workshop/server/tests/it/chat_gate/canonical_sequence.rs
+++ /dev/null
@@ -1,234 +0,0 @@
-//! The history gates: the operator's message frames as their own and
-//! reaches the model as typed, the conversation accumulates byte-exact
-//! across turns, and its rounds advertise the web tools.
-
-use super::*;
-
-/// GATE 11 - the operator's message. The chat reads it through
-/// `tasks.receive()`: the log shows each wait on its inbox as
-/// `awaiting_input`, the message frames as the operator's `user_message`
-/// rather than a tool result, and the model receives the text as typed.
-#[tokio::test]
-async fn gate_the_operators_message_frames_as_a_user_message_between_wait_frames() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-
-    let typed = "two  words\r\n\"quoted\" 🦀";
-    let first = next_wait(&mut socket).await;
-    assert_eq!(
-        first["event"],
-        json!({ "kind": "awaiting_input", "section": "Conversation", "turn": 0, "content": "" }),
-        "the chat's first read of its empty inbox frames as the wait for the operator"
-    );
-    answer(&mut socket, typed).await;
-    let turn = collect_turn(&mut socket).await;
-    let kinds: Vec<&str> = turn
-        .events
-        .iter()
-        .filter_map(|event| event["event"]["kind"].as_str())
-        .collect();
-    assert_eq!(
-        kinds,
-        ["user_message", "agent_thought", "agent_message"],
-        "the message shows as the operator's own, never as a tool call update"
-    );
-    assert_eq!(
-        turn.events[0]["event"],
-        json!({
-            "kind": "user_message", "section": "Conversation", "turn": 0, "content": typed,
-        }),
-        "the operator's text frames byte-exact"
-    );
-    assert!(
-        turn.events[0].get("reply").is_none(),
-        "a user_message settles no deltas, so its reply id is omitted"
-    );
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(
-            role_content_pairs(&requests[0]),
-            vec![pair("user", typed)],
-            "the model receives the operator's text as typed"
-        );
-    }
-
-    // A stop while the chat waits leaves that wait: the next message
-    // answers it in the same run, and the turn it starts frames like the
-    // first.
-    next_wait(&mut socket).await;
-    let run = server
-        .state
-        .agents()
-        .run_id(&session)
-        .expect("the chat's run has begun");
-    socket.send_json(&json!({ "type": "cancel" })).await;
-    answer(&mut socket, "after stop").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(
-        turn.events[0]["event"]["content"], "after stop",
-        "the wait the stop left answered the next message"
-    );
-    assert!(turn.waits.is_empty(), "the stop never woke the wait");
-    assert_eq!(
-        server.state.agents().run_id(&session),
-        Some(run),
-        "the stop keeps the chat's one run"
-    );
-    socket.close().await;
-}
-
-/// GATE 1 - multi-turn history. The conversation accumulates turn over
-/// turn, and what the user typed reaches the model byte-exact with no
-/// untrusted envelope around it.
-#[tokio::test]
-async fn gate_history_accumulates_across_three_turns_byte_exact() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    let gnarly = "line1\r\nline2 \"quoted\" {\"text\":\"decoy\"} \\slash 🦀";
-    let inputs = ["first ping", gnarly, "third"];
-    for input in inputs {
-        next_wait(&mut socket).await;
-        answer(&mut socket, input).await;
-        let turn = collect_turn(&mut socket).await;
-        assert_eq!(delta_text(&turn), format!("echo:{input}"));
-    }
-
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(requests.len(), 3, "three turns are three model rounds");
-        assert_eq!(
-            role_content_pairs(&requests[0]),
-            vec![pair("user", "first ping")],
-            "the first round sends exactly the first input"
-        );
-        assert_eq!(
-            role_content_pairs(&requests[1]),
-            vec![
-                pair("user", "first ping"),
-                pair("assistant", "echo:first ping"),
-                pair("user", gnarly),
-            ],
-            "the second round sends the first exchange plus the new input, \
-             the gnarly user text byte-exact and envelope-free"
-        );
-        assert_eq!(
-            role_content_pairs(&requests[2]),
-            vec![
-                pair("user", "first ping"),
-                pair("assistant", "echo:first ping"),
-                pair("user", gnarly),
-                pair("assistant", &format!("echo:{gnarly}")),
-                pair("user", "third"),
-            ],
-            "the third round sends the whole accumulated conversation"
-        );
-    }
-    socket.close().await;
-}
-
-/// GATE 13 - file tools. The chat offers the extra Packs, so its rounds
-/// advertise the `std` file tools the model reads the language guide with.
-#[tokio::test]
-async fn gate_a_conversation_round_advertises_the_file_tools() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:ping");
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        let names: Vec<&str> = requests[0]["tools"]
-            .as_array()
-            .expect("the conversation round advertises tools")
-            .iter()
-            .filter_map(|tool| tool["function"]["name"].as_str())
-            .collect();
-        for wire in ["Read", "ListDir", "Grep"] {
-            assert!(
-                names.contains(&wire),
-                "the conversation round advertises {wire}, got {names:?}"
-            );
-        }
-    }
-    socket.close().await;
-}
-
-/// GATE 14 - the shell. The chat requires the `bash` Pack and offers it
-/// between `std` and `web`, so each round's tool list holds `Shell`
-/// itself, after the file tools and before the web tools. A tool the
-/// model could only find through the discovery tools would not be in
-/// the list.
-#[tokio::test]
-async fn gate_a_conversation_round_advertises_the_shell_after_the_file_tools() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:ping");
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        let names: Vec<&str> = requests[0]["tools"]
-            .as_array()
-            .expect("the conversation round advertises tools")
-            .iter()
-            .filter_map(|tool| tool["function"]["name"].as_str())
-            .collect();
-        let place = |wire: &str| {
-            names
-                .iter()
-                .position(|name| *name == wire)
-                .unwrap_or_else(|| {
-                    panic!("the conversation round advertises {wire}, got {names:?}")
-                })
-        };
-        let shell = place("Shell");
-        for wire in ["Read", "ListDir", "Grep"] {
-            assert!(place(wire) < shell, "{wire} comes before Shell: {names:?}");
-        }
-        for wire in ["web_fetch", "web_search"] {
-            assert!(shell < place(wire), "Shell comes before {wire}: {names:?}");
-        }
-    }
-    socket.close().await;
-}
-
-/// GATE 12 - web tools. The chat's `## Conversation` section offers the
-/// `web` Pack, so the rounds its model loop sends advertise the
-/// Pack's fetch and search tools; an offer in the H1 would not reach
-/// them.
-#[tokio::test]
-async fn gate_a_conversation_round_advertises_the_web_tools() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:ping");
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        let names: Vec<&str> = requests[0]["tools"]
-            .as_array()
-            .expect("the conversation round advertises tools")
-            .iter()
-            .filter_map(|tool| tool["function"]["name"].as_str())
-            .collect();
-        for wire in ["web_fetch", "web_search"] {
-            assert!(
-                names.contains(&wire),
-                "the conversation round advertises {wire}, got {names:?}"
-            );
-        }
-    }
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/chat_gate/compaction.rs b/crates/workshop/server/tests/it/chat_gate/compaction.rs
deleted file mode 100644
index a223bd318..000000000
--- a/crates/workshop/server/tests/it/chat_gate/compaction.rs
+++ /dev/null
@@ -1,218 +0,0 @@
-//! The compaction gate: a conversation that outgrows the model's context
-//! window summarizes its older turns, and every later turn still answers.
-
-use super::*;
-
-/// The most messages the compacting mock admits in one request; a longer
-/// one is refused as a context overflow. System messages do not count, so
-/// the gate is the same whether or not the chat agent opens with one.
-const MESSAGE_LIMIT: usize = 4;
-
-/// The opening of the chat compactor's summary request.
-const SUMMARIZE: &str = "Summarize this conversation:";
-
-/// The opening of the user record a summary replaces older turns with.
-const SUMMARY: &str = "Summary of the earlier conversation: ";
-
-/// Whether `request` is the compactor's summary request: its last message
-/// opens with [`SUMMARIZE`].
-fn is_summary_request(request: &serde_json::Value) -> bool {
-    request["messages"]
-        .as_array()
-        .and_then(|messages| messages.last())
-        .and_then(|message| message["content"].as_str())
-        .is_some_and(|content| content.starts_with(SUMMARIZE))
-}
-
-/// Streams `reply` as an SSE completion attributed to `model`, shaped like
-/// [`echo_stream`] without the echo prefix.
-fn reply_stream(model: &str, reply: &str) -> Response {
-    let null = serde_json::Value::Null;
-    let mut sse = String::new();
-    for event in [
-        sse_chunk(model, &json!({ "role": "assistant" }), &null),
-        sse_chunk(model, &json!({ "content": reply }), &null),
-        sse_chunk(model, &json!({}), &json!("stop")),
-    ] {
-        sse.push_str(&sse_line(&event));
-    }
-    sse.push_str("data: [DONE]\n\n");
-    ([(header::CONTENT_TYPE, "text/event-stream")], sse).into_response()
-}
-
-/// The compacting mock: a request carrying more than [`MESSAGE_LIMIT`]
-/// messages is a 400 naming `context_length_exceeded`, a summary request
-/// streams `summary`, and every other request streams
-/// `echo:<last user message>`. Every request body is captured.
-fn compacting_completions(captured: &CapturedRequests, body: &str) -> Response {
-    let request: serde_json::Value = serde_json::from_str(body).expect("the request is JSON");
-    captured
-        .lock()
-        .expect("the capture lock is healthy")
-        .push(request.clone());
-    let model = request["model"].as_str().unwrap_or("test-model").to_owned();
-    let messages = request["messages"]
-        .as_array()
-        .expect("the request includes a messages array");
-    let counted = messages
-        .iter()
-        .filter(|message| message["role"] != "system")
-        .count();
-    if counted > MESSAGE_LIMIT {
-        let refusal = json!({ "error": {
-            "message": "This request exceeds the model's maximum context length.",
-            "code": "context_length_exceeded",
-        } });
-        return (StatusCode::BAD_REQUEST, axum::Json(refusal)).into_response();
-    }
-    if is_summary_request(&request) {
-        return reply_stream(&model, "summary");
-    }
-    let last = messages
-        .last()
-        .and_then(|message| message["content"].as_str())
-        .expect("the request includes a user message");
-    echo_stream(&model, last)
-}
-
-/// Spawns the gate server over the compacting mock, with `test-model` in
-/// the retained catalog and selected in the menu.
-async fn spawn_compacting_server() -> GateServer {
-    let captured = CapturedRequests::default();
-    let mock = Arc::clone(&captured);
-    let gateway_url = spawn_gateway(
-        Router::new()
-            .route(
-                "/v1/chat/completions",
-                post(move |body: String| {
-                    let captured = Arc::clone(&mock);
-                    async move { compacting_completions(&captured, &body) }
-                }),
-            )
-            .route("/v1/models", typed_catalog(&["test-model"])),
-    )
-    .await;
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let config = Config {
-        agents: AgentsConfig {
-            path: dir.path().join("missing-agents"),
-            plugins: Some(plugin_dir()),
-            ..AgentsConfig::default()
-        },
-        ..test_config(&gateway_url, dir.path())
-    };
-    let (state, ws_base) = spawn_router(&config).await;
-    state
-        .catalog()
-        .publish(vec![json!({ "id": "test-model", "object": "model" })]);
-    state
-        .menu()
-        .set_selected("test-model")
-        .expect("the selected model is in the retained catalog");
-    GateServer {
-        ws_base,
-        state,
-        captured,
-        dir,
-    }
-}
-
-/// Collects frames until the `agent_message` event holding `reply`
-/// arrives, refusing error frames and any wait on the inbox before it.
-/// Any other message, such as the summary round's own reply, is skipped.
-async fn collect_reply(socket: &mut JsonSocket, reply: &str) {
-    tokio::time::timeout(Duration::from_secs(10), async {
-        loop {
-            let frame = socket.recv_json().await;
-            match frame["type"].as_str() {
-                Some("agent_event")
-                    if frame["event"]["kind"] == "agent_message"
-                        && frame["event"]["content"] == reply =>
-                {
-                    break;
-                }
-                Some("agent_event") if is_awaiting(&frame) => {
-                    panic!("the chat waits again only after the reply: {frame}")
-                }
-                Some("error") => {
-                    panic!("no error frame may come between the reply's frames: {frame}")
-                }
-                _ => {}
-            }
-        }
-    })
-    .await
-    .unwrap_or_else(|_| panic!("the turn delivers the reply `{reply:.40}` within the deadline"));
-}
-
-/// GATE 13 - context overflow. Once the conversation outgrows the
-/// model's context window, each overflowing turn reports its failed round,
-/// summarizes the turns before the last two into one user record, and
-/// answers on the retry; every later turn answers the same way.
-#[tokio::test]
-async fn gate_context_overflow_summarizes_older_turns_and_later_turns_answer() {
-    let server = spawn_compacting_server().await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    // The typed catalog's 200,000-token window keeps the precheck quiet,
-    // so only the mock's message limit overflows: from turn 3 on, the
-    // uncompacted history carries more than four messages. The long turn
-    // is two-byte characters, so its capped excerpt must end on a
-    // character boundary for the summary request to be valid UTF-8.
-    let long = "é".repeat(50_000);
-    let inputs = [long.as_str(), "second", "third", "fourth"];
-    for (index, input) in inputs.into_iter().enumerate() {
-        next_wait(&mut socket).await;
-        answer(&mut socket, input).await;
-        if index >= 2 {
-            let error = socket
-                .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-                .await;
-            assert!(
-                error["message"]
-                    .as_str()
-                    .is_some_and(|message| message.contains("Model turn failed")),
-                "the overflowed round surfaces as a failed model turn: {error}"
-            );
-        }
-        collect_reply(&mut socket, &format!("echo:{input}")).await;
-    }
-
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(
-            requests.len(),
-            8,
-            "two plain turns, then an overflow, a summary, and a retry for each of turns 3 and 4"
-        );
-        let summaries: Vec<usize> = (0..requests.len())
-            .filter(|&index| is_summary_request(&requests[index]))
-            .collect();
-        assert_eq!(summaries.len(), 2, "each overflowing turn summarizes once");
-        for index in summaries {
-            for (_, content) in role_content_pairs(&requests[index]) {
-                assert!(
-                    content.len() < 4_000,
-                    "each summarized record is capped, so the summary request stays small: \
-                     {} characters",
-                    content.len()
-                );
-            }
-            let retry = requests
-                .get(index + 1)
-                .expect("the retried round follows the summary request");
-            let first = role_content_pairs(retry)
-                .into_iter()
-                .next()
-                .expect("the retried round sends messages");
-            assert_eq!(first.0, "user", "the retry opens with the summary record");
-            assert!(
-                first.1.starts_with(SUMMARY),
-                "the retry opens with the summary of the earlier turns: {}",
-                first.1
-            );
-        }
-    }
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/chat_gate/lifecycle.rs b/crates/workshop/server/tests/it/chat_gate/lifecycle.rs
deleted file mode 100644
index 10f992ef6..000000000
--- a/crates/workshop/server/tests/it/chat_gate/lifecycle.rs
+++ /dev/null
@@ -1,162 +0,0 @@
-//! Run lifecycle gates: the dropdown's pick serving each next round, and
-//! delayed startup convergence on the server broker's catalog wait.
-
-use workshop_run_log::{RecordFilter, RecordKind, RunId, RunLog};
-
-use super::*;
-
-/// The model each answered round of `run` names in the run log, in
-/// round order, read once the run is recorded whole.
-async fn answered_models(server: &GateServer, run: RunId) -> Vec<String> {
-    let log_file = server.dir.path().join("harness").join("runs.db");
-    let log = tokio::time::timeout(Duration::from_secs(10), async {
-        loop {
-            if let Ok(log) = RunLog::open(&log_file).await
-                && let Ok(row) = log.run(run).await
-                && row.result.is_some()
-            {
-                return log;
-            }
-            tokio::time::sleep(Duration::from_millis(10)).await;
-        }
-    })
-    .await
-    .expect("the run is recorded and closed within the deadline");
-    let answers = RecordFilter {
-        kind: Some(RecordKind::Answer),
-        last: None,
-    };
-    log.records(run, answers)
-        .await
-        .expect("the answers read back")
-        .iter()
-        .filter_map(|stored| stored.record.payload.pointer("/Chat/Ok/model"))
-        .map(|model| model.as_str().expect("a round's model is text").to_owned())
-        .collect()
-}
-
-/// GATE 3 - model switch. The dropdown's pick is read at each round, so
-/// a model picked between turns serves the live run's next round, and
-/// that round's reply event and its answer in the run log name it.
-#[tokio::test]
-async fn gate_a_model_picked_between_turns_serves_the_next_round() {
-    let server = spawn_chat_server(&["model-a", "model-b"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "one").await;
-    let turn = collect_turn(&mut socket).await;
-    let reply = turn.events.last().expect("the first turn completes");
-    assert_eq!(
-        reply["event"]["model"], "model-a",
-        "the first turn runs on the selected model"
-    );
-
-    server
-        .state
-        .menu()
-        .set_selected("model-b")
-        .expect("model-b is in the retained catalog");
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "two").await;
-    let turn = collect_turn(&mut socket).await;
-    let reply = turn.events.last().expect("the second turn completes");
-    assert_eq!(
-        reply["event"]["model"], "model-b",
-        "the next round's reply names the model picked between turns"
-    );
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(requests[0]["model"], "model-a");
-        assert_eq!(
-            requests[1]["model"], "model-b",
-            "the next round is sent to the new pick"
-        );
-    }
-
-    let run = server
-        .state
-        .agents()
-        .run_id(&session)
-        .expect("the conversation's run has begun");
-    assert!(server.state.agents().close(&session), "the session closes");
-    assert_eq!(
-        answered_models(&server, run).await,
-        ["model-a", "model-b"],
-        "each round's answer record names the model that served it"
-    );
-    socket.close().await;
-}
-
-/// GATE 8 - delayed startup convergence. Launch acknowledgment may precede
-/// the Gateway catalog, but the run waits in the server's broker until
-/// the catalog holds a chat-capable model, then binds the selection made
-/// meanwhile. Transcription-only publication neither readies nor starts
-/// chat.
-#[tokio::test]
-async fn gate_delayed_catalog_starts_chat_only_after_a_chat_model_arrives() {
-    let server = spawn_chat_server(&[]).await;
-    server.state.menu().set_gateway_reachable(true);
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-    let mut workbench = JsonSocket::connect(&format!("{}/ws", server.ws_base)).await;
-    let initial = workbench
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "models")
-        .await;
-    assert_eq!(initial["models"], json!([]));
-
-    assert_chat_quiet(&server, &session, &mut socket).await;
-    server.state.catalog().publish(vec![
-        json!({"id": "whisper-base-en", "kind": "transcription", "object": "model"}),
-        json!({"id": "whisper-small-en", "kind": "transcription", "object": "model"}),
-        json!({"id": "realtime-transcribe", "kind": "transcription", "object": "model"}),
-    ]);
-    server.state.menu().reconcile_catalog();
-    assert!(
-        server.state.menu().set_selected("whisper-base-en").is_err(),
-        "a transcription-only entry cannot become the selected chat binding"
-    );
-    let speech_only = workbench
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "models")
-        .await;
-    assert_eq!(
-        speech_only["models"],
-        json!([]),
-        "the shared catalog feeding both model menus publishes no speech-only choices"
-    );
-    assert_chat_quiet(&server, &session, &mut socket).await;
-
-    server.state.catalog().publish(vec![
-        json!({"id": "whisper-base-en", "kind": "transcription", "object": "model"}),
-        json!({"id": "claude-opus-4-6", "kind": "chat", "object": "model"}),
-        json!({"id": "whisper-small-en", "kind": "transcription", "object": "model"}),
-        json!({"id": "realtime-transcribe", "kind": "transcription", "object": "model"}),
-    ]);
-    server.state.menu().reconcile_catalog();
-    server
-        .state
-        .menu()
-        .set_selected("claude-opus-4-6")
-        .expect("the chat model is selectable");
-    let chat_only = workbench
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "models")
-        .await;
-    assert_eq!(
-        chat_only["models"],
-        json!([{"id": "claude-opus-4-6", "kind": "chat", "object": "model"}]),
-        "both chat-facing choosers receive only the chat-capable model"
-    );
-    next_wait(&mut socket).await;
-    answer(&mut socket, "after startup").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:after startup");
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(requests.len(), 1, "exactly one completion was dispatched");
-        assert_eq!(requests[0]["model"], "claude-opus-4-6");
-    }
-    workbench.close().await;
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/chat_gate/overload.rs b/crates/workshop/server/tests/it/chat_gate/overload.rs
deleted file mode 100644
index f2077d304..000000000
--- a/crates/workshop/server/tests/it/chat_gate/overload.rs
+++ /dev/null
@@ -1,70 +0,0 @@
-//! The stop gate: a stop mid-generation returns to waiting without an
-//! error, and the run keeps its conversation.
-
-use super::*;
-
-/// GATE 5 - stop. The stop button kills generation mid-stream without
-/// an error, and the chat is immediately usable again with the
-/// conversation so far.
-#[tokio::test]
-async fn gate_cancel_mid_generation_returns_to_waiting_and_next_input_works() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    let run = server
-        .state
-        .agents()
-        .run_id(&session)
-        .expect("the chat's run has begun");
-    answer(&mut socket, "hang").await;
-    // Generation is provably live: a text chunk of the never-finishing
-    // stream has reached the wire.
-    let delta = socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            assert_ne!(
-                frame["type"], "error",
-                "the hanging turn is not an error: {frame}"
-            );
-            frame["type"] == "agent_delta" && frame["kind"] == "text"
-        })
-        .await;
-    assert_eq!(delta["content"], "nev");
-
-    socket.send_json(&json!({ "type": "cancel" })).await;
-
-    // A stop is a stop reason: the chat's pcall takes the dropped round,
-    // and its loop waits on its inbox again, and next_wait refuses error
-    // frames on the way - which asserts exactly the no-error contract.
-    next_wait(&mut socket).await;
-    assert_eq!(
-        server.state.agents().run_id(&session),
-        Some(run),
-        "the chat waits again in the same run: the stop dropped only its round"
-    );
-    answer(&mut socket, "after cancel").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(
-        delta_text(&turn),
-        "echo:hang\n\nafter cancel",
-        "the next input after a mid-generation stop runs a full turn"
-    );
-    assert!(
-        turn.events
-            .iter()
-            .all(|event| event["event"]["content"] != "echo:hang"),
-        "the stopped generation never completes into a reply"
-    );
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(requests.len(), 2, "the stopped round and the next one");
-        assert_eq!(
-            role_content_pairs(&requests[1]),
-            vec![pair("user", "hang\n\nafter cancel")],
-            "the next round's request holds the earlier turn: the stopped \
-             input stays in the retained message list beside the new one"
-        );
-    }
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/chat_gate/protocol.rs b/crates/workshop/server/tests/it/chat_gate/protocol.rs
deleted file mode 100644
index a1f540021..000000000
--- a/crates/workshop/server/tests/it/chat_gate/protocol.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-//! The streaming gate: live text and reasoning deltas, superseded by the
-//! completed reply under the same id.
-
-use super::*;
-
-/// GATE 2 - live streaming. While the model generates, the client sees
-/// answer text and reasoning arrive as live chunks, and the completed
-/// reply supersedes them under the same id.
-#[tokio::test]
-async fn gate_streaming_delivers_text_and_reasoning_deltas_then_the_reply() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "ping").await;
-    let turn = collect_turn(&mut socket).await;
-
-    let reasoning: String = turn
-        .deltas
-        .iter()
-        .filter(|delta| delta["kind"] == "reasoning")
-        .filter_map(|delta| delta["content"].as_str())
-        .collect();
-    assert_eq!(
-        reasoning, "mm",
-        "reasoning streams live on its own side channel during generation"
-    );
-    assert!(
-        turn.deltas
-            .iter()
-            .filter(|delta| delta["kind"] == "text")
-            .count()
-            >= 2,
-        "the mock splits content, so generation provably streams in chunks"
-    );
-    assert_eq!(
-        delta_text(&turn),
-        "echo:ping",
-        "the live text chunks assemble the reply"
-    );
-
-    let reply = turn
-        .events
-        .last()
-        .expect("the turn ends with its reply event");
-    assert_eq!(reply["event"]["kind"], "agent_message");
-    assert_eq!(
-        reply["event"]["content"], "echo:ping",
-        "the completed reply arrives after the deltas it supersedes"
-    );
-    assert!(
-        turn.deltas
-            .iter()
-            .all(|delta| delta["reply"] == reply["reply"]),
-        "deltas and the completed reply share the superseding id"
-    );
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/chat_gate/recovery.rs b/crates/workshop/server/tests/it/chat_gate/recovery.rs
deleted file mode 100644
index 571617ee8..000000000
--- a/crates/workshop/server/tests/it/chat_gate/recovery.rs
+++ /dev/null
@@ -1,170 +0,0 @@
-//! Recovery gates: a live chat's wait answering on a replacement Gateway,
-//! a failed completion the chat survives, and a selection lost while the
-//! chat waits.
-
-use super::*;
-
-#[tokio::test]
-async fn a_live_chat_wait_answers_on_the_replacement_port_and_key() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-    next_wait(&mut socket).await;
-
-    let replacement_captured = CapturedRequests::default();
-    let captured = Arc::clone(&replacement_captured);
-    let replacement = spawn_gateway(Router::new().route(
-        "/v1/chat/completions",
-        post(move |headers: axum::http::HeaderMap, body: String| {
-            let captured = Arc::clone(&captured);
-            async move {
-                if headers
-                    .get(header::AUTHORIZATION)
-                    .and_then(|value| value.to_str().ok())
-                    != Some("Bearer replacement-key")
-                {
-                    return StatusCode::UNAUTHORIZED.into_response();
-                }
-                gate_completions(&captured, &body)
-            }
-        }),
-    ))
-    .await;
-    replace_gateway(
-        &gateway_updater(&server.state),
-        &replacement,
-        "replacement-key",
-    )
-    .expect("the replacement publishes");
-
-    // The run the original gateway served still waits on its inbox, and
-    // the next message's round goes to the replacement port under the
-    // replacement key.
-    answer(&mut socket, "after gateway recovery").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:after gateway recovery");
-    assert!(
-        server
-            .captured
-            .lock()
-            .expect("the original capture lock is healthy")
-            .is_empty(),
-        "the old endpoint receives no post-publication completion"
-    );
-    assert_eq!(
-        replacement_captured
-            .lock()
-            .expect("the replacement capture lock is healthy")
-            .len(),
-        1,
-        "the replacement endpoint and bearer complete the next turn"
-    );
-    assert_eq!(
-        server.state.agents().run_id(&session),
-        Some(workshop_run_log::RunId::from_raw(1)),
-        "the replacement keeps the conversation's one run, the first the log began"
-    );
-    socket.close().await;
-}
-
-/// GATE 6 - error survival. A failed completion surfaces an error to
-/// the operator and the chat keeps working.
-#[tokio::test]
-async fn gate_model_failure_surfaces_an_error_and_the_next_input_works() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let _session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    answer(&mut socket, "fail").await;
-    let error = socket
-        .recv_until(Duration::from_secs(10), |frame| frame["type"] == "error")
-        .await;
-    assert!(
-        error["message"]
-            .as_str()
-            .is_some_and(|message| message.contains("Model turn failed")),
-        "the failed model call surfaces as an error frame naming the boundary: {error}"
-    );
-
-    // The pcall'd failure never kills the program: the loop returns to
-    // tasks.receive() and the next turn is a normal one. The failed input
-    // stays in the retained message list, so the projection joins the two
-    // consecutive user utterances with a blank line.
-    next_wait(&mut socket).await;
-    answer(&mut socket, "recovered").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(
-        delta_text(&turn),
-        "echo:fail\n\nrecovered",
-        "the next input still works after the failure, with the failed input retained"
-    );
-    let reply = turn.events.last().expect("the recovery turn completes");
-    assert_eq!(reply["event"]["content"], "echo:fail\n\nrecovered");
-    socket.close().await;
-}
-
-/// GATE 7 - selection-loss recovery, unified-runtime semantics: the run's
-/// model is the dropdown selection bound at launch, so a selection that
-/// vanishes while the chat waits skips nothing - the frozen binding drives
-/// the next turn to completion, and the same run keeps serving turns
-/// until a close ends it.
-#[tokio::test]
-async fn gate_selection_loss_leaves_the_runs_frozen_binding_untouched() {
-    let server = spawn_chat_server(&["test-model"]).await;
-    let mut socket = connect_chat(&server.ws_base).await;
-    let session = launch_chat(&mut socket).await;
-
-    next_wait(&mut socket).await;
-    server.state.catalog().publish(Vec::new());
-    server.state.menu().reconcile_catalog();
-    answer(&mut socket, "accepted before loss").await;
-
-    // The selection is gone, but the run's binding was frozen at launch:
-    // the turn after the loss dispatches and completes, and no error frame
-    // surfaces.
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(delta_text(&turn), "echo:accepted before loss");
-    assert!(
-        server.state.agents().run_id(&session).is_some(),
-        "the launched session remains registered"
-    );
-
-    server
-        .state
-        .catalog()
-        .publish(vec![json!({ "id": "test-model", "object": "model" })]);
-    server
-        .state
-        .menu()
-        .set_selected("test-model")
-        .expect("the retained model can be selected for recovery");
-    next_wait(&mut socket).await;
-    answer(&mut socket, "recovered after selection").await;
-    let turn = collect_turn(&mut socket).await;
-    assert_eq!(
-        delta_text(&turn),
-        "echo:recovered after selection",
-        "the same run answers the next input on its frozen binding"
-    );
-    {
-        let requests = server.captured.lock().expect("the capture lock is healthy");
-        assert_eq!(
-            requests.len(),
-            2,
-            "both turns reach the gateway on the frozen model"
-        );
-        assert_eq!(requests[0]["model"], "test-model");
-        assert_eq!(requests[1]["model"], "test-model");
-        assert_eq!(
-            role_content_pairs(&requests[1]),
-            vec![
-                pair("user", "accepted before loss"),
-                pair("assistant", "echo:accepted before loss"),
-                pair("user", "recovered after selection"),
-            ],
-            "the same run retains its message list across the selection loss"
-        );
-    }
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/heartbeat.rs b/crates/workshop/server/tests/it/heartbeat.rs
deleted file mode 100644
index 8e0fc6912..000000000
--- a/crates/workshop/server/tests/it/heartbeat.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-//! Characterization tests for the heartbeat-driven frames on the workshop
-//! socket: the outage status while the gateway is known down, and the
-//! refreshed catalog push on reconnect.
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::time::Duration;
-
-use axum::Router;
-use axum::extract::State;
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use serde_json::json;
-
-use crate::common::{JsonSocket, RECV_TIMEOUT, TestServer, spawn_gateway};
-
-/// The catalog the mock gateway serves from `/v1/models`.
-const CATALOG: &str =
-    r#"{"object":"list","data":[{"id":"test-model","object":"model","owned_by":"runvil"}]}"#;
-
-/// A mock `/health` whose answer flips under test control.
-async fn flippable_health(State(healthy): State<Arc<AtomicBool>>) -> Response {
-    if healthy.load(Ordering::Relaxed) {
-        StatusCode::OK.into_response()
-    } else {
-        StatusCode::SERVICE_UNAVAILABLE.into_response()
-    }
-}
-
-/// A static mock catalog for the reconnect push.
-async fn mock_models() -> Response {
-    ([(header::CONTENT_TYPE, "application/json")], CATALOG).into_response()
-}
-
-/// Waits until the heartbeat's observed outage reaches this socket as
-/// the "Gateway unreachable" status frame - the connect snapshot or a
-/// live push, whichever lands first.
-async fn await_gateway_known_down(socket: &mut JsonSocket) {
-    socket
-        .recv_until(Duration::from_secs(10), |frame| {
-            frame["type"] == "status" && frame["label"] == "Gateway unreachable"
-        })
-        .await;
-}
-
-#[tokio::test]
-async fn a_gateway_known_down_publishes_the_outage_status() {
-    // Nothing listens on port 1, so the probe fails deterministically.
-    let server = TestServer::spawn("http://127.0.0.1:1");
-    let mut socket = JsonSocket::connect(&server.ws_url("/ws")).await;
-    await_gateway_known_down(&mut socket).await;
-    socket.close().await;
-}
-
-#[tokio::test]
-async fn a_gateway_reconnect_pushes_the_refreshed_catalog() {
-    let healthy = Arc::new(AtomicBool::new(false));
-    let gateway = Router::new()
-        .route("/health", get(flippable_health))
-        .route("/v1/models", get(mock_models))
-        .with_state(Arc::clone(&healthy));
-    let base_url = spawn_gateway(gateway).await;
-    let server = TestServer::spawn(&base_url);
-    let mut socket = JsonSocket::connect(&server.ws_url("/ws")).await;
-    // Hold the flip until the outage is observable, so the recovery is a
-    // real down-to-up transition; the initial connect pushes no catalog.
-    await_gateway_known_down(&mut socket).await;
-
-    healthy.store(true, Ordering::Relaxed);
-    // The next probe lands within the 5 s heartbeat interval and the
-    // catalog arrives behind the "Connected to gateway" status frame.
-    let frame = socket
-        .recv_until(Duration::from_secs(30), |frame| frame["type"] == "models")
-        .await;
-    assert_eq!(
-        frame,
-        json!({
-            "type": "models",
-            "models": [{"id": "test-model", "object": "model", "owned_by": "runvil"}],
-        }),
-        "the refreshed catalog arrives as one models frame"
-    );
-
-    // The push above happened before this connection existed, so only the
-    // retained snapshot can deliver the catalog here - the contract's
-    // resend of the catalog on reconnect.
-    let mut late = JsonSocket::connect(&server.ws_url("/ws")).await;
-    let resent = late
-        .recv_until(RECV_TIMEOUT, |frame| frame["type"] == "models")
-        .await;
-    assert_eq!(
-        resent,
-        json!({
-            "type": "models",
-            "models": [{"id": "test-model", "object": "model", "owned_by": "runvil"}],
-        }),
-        "a connection made after the push still receives the catalog"
-    );
-    late.close().await;
-    socket.close().await;
-}
diff --git a/crates/workshop/server/tests/it/heartbeat_loop.rs b/crates/workshop/server/tests/it/heartbeat_loop.rs
deleted file mode 100644
index ca32ecd85..000000000
--- a/crates/workshop/server/tests/it/heartbeat_loop.rs
+++ /dev/null
@@ -1,446 +0,0 @@
-//! The heartbeat loop's behavior against the real status, catalog, and
-//! menu buses: transition announcements, refresh-on-reconnect, startup
-//! convergence, and the backoff's anti-flap rule. These tests compose
-//! `workshop-gateway`'s heartbeat with `workshop-status` and
-//! `workshop-menu`'s buses through the registry's push facade - the
-//! composition only the server can make, so they sit in its integration
-//! binary rather than in any one subsystem crate.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions and
-// #[cfg(test)] modules only, not integration-test helpers; failing a test
-// by panicking with the invariant named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-use std::time::Duration;
-
-use axum::Router;
-use axum::extract::State;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use tokio::sync::{broadcast, watch};
-
-use workshop_gateway::{GatewayBinding, GatewayHealth, Heartbeat};
-use workshop_menu::{CatalogBus, MenuBus};
-use workshop_protocol::{CatalogPush, Severity, StatusBarUpdate, WorkbenchSnapshot};
-use workshop_registry::{Push, Registration, Registry};
-use workshop_status::StatusBus;
-use workshop_support::ReconnectBackoff;
-
-/// The registration guards keeping the test's contributions alive.
-type Guards = (
-    Registration,
-    Registration,
-    Registration,
-    Registration,
-    Registration,
-    Registration,
-);
-
-/// Wires the buses into a fresh registry and returns the push facade
-/// plus the guards keeping the registrations alive.
-fn wired_push(status: &StatusBus, catalog: &CatalogBus, menu: &MenuBus) -> (Push, Guards) {
-    let registry = Registry::new();
-    let status_regs = workshop_status::register(&registry, status);
-    let menu_regs = workshop_menu::register(&registry, catalog, menu);
-    (
-        registry.push(),
-        (
-            status_regs.channel,
-            status_regs.sink,
-            status_regs.state,
-            menu_regs.catalog_sink,
-            menu_regs.menu_sink,
-            menu_regs.state,
-        ),
-    )
-}
-
-/// Fast enough that transitions, and the probes a quiet check counts,
-/// arrive without real waiting.
-const TEST_INTERVAL: Duration = Duration::from_millis(25);
-
-const CATALOG: &str =
-    r#"{"object":"list","data":[{"id":"test-model","object":"model","owned_by":"runvil"}]}"#;
-
-/// A mock `/health` answer under test control, and the count of probes
-/// served. The loop is sequential - wait, probe, announce, refresh - so
-/// a served probe proves every earlier probe's announcement and refresh
-/// are done.
-#[derive(Clone)]
-struct MockHealth {
-    healthy: Arc<AtomicBool>,
-    probes: watch::Sender<usize>,
-}
-
-/// A mock `/health` whose answer flips under test control.
-async fn flippable_health(State(mock): State<MockHealth>) -> Response {
-    mock.probes.send_modify(|served| *served += 1);
-    if mock.healthy.load(Ordering::Relaxed) {
-        StatusCode::OK.into_response()
-    } else {
-        StatusCode::SERVICE_UNAVAILABLE.into_response()
-    }
-}
-
-/// A router serving only the flippable `/health`, and the count of the
-/// probes it serves.
-fn health_only(healthy: Arc<AtomicBool>) -> (Router, watch::Receiver<usize>) {
-    let (probes, served) = watch::channel(0);
-    let router = Router::new()
-        .route("/health", get(flippable_health))
-        .with_state(MockHealth { healthy, probes });
-    (router, served)
-}
-
-/// A static mock catalog for the refresh-on-reconnect tests.
-async fn mock_models() -> Response {
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        CATALOG,
-    )
-        .into_response()
-}
-
-/// A static mock profile list for the profile-populate tests.
-async fn mock_profiles() -> Response {
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        r#"{"profiles":["coding","main"]}"#,
-    )
-        .into_response()
-}
-
-/// A static mock gateway status naming the active profile.
-async fn mock_profile_status() -> Response {
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        r#"{"profile":"main","models":["test-model"]}"#,
-    )
-        .into_response()
-}
-
-/// Binds a mock gateway whose `/health` flips with `healthy`, with a
-/// static `/v1/models` and the profile endpoints beside it.
-async fn spawn_gateway(healthy: Arc<AtomicBool>) -> String {
-    spawn_probed_gateway(healthy).await.0
-}
-
-/// [`spawn_gateway`], also returning the count of health probes served.
-async fn spawn_probed_gateway(healthy: Arc<AtomicBool>) -> (String, watch::Receiver<usize>) {
-    let (health, probes) = health_only(healthy);
-    let app = health
-        .route("/v1/models", get(mock_models))
-        .route("/admin/profiles", get(mock_profiles))
-        .route("/admin/status", get(mock_profile_status));
-    (serve(app).await, probes)
-}
-
-/// Binds a loopback listener that accepts each connection and drops it
-/// unanswered: an unreachable gateway whose failed probes are counted
-/// the way [`flippable_health`] counts answered ones.
-async fn spawn_silent_gateway() -> (String, watch::Receiver<usize>) {
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("a loopback port binds");
-    let addr = listener.local_addr().expect("the listener has an address");
-    let (probes, served) = watch::channel(0);
-    drop(tokio::spawn(async move {
-        while let Ok((connection, _)) = listener.accept().await {
-            probes.send_modify(|count| *count += 1);
-            drop(connection);
-        }
-    }));
-    (format!("http://{addr}"), served)
-}
-
-/// Binds `app` on a free loopback port and returns its base URL.
-async fn serve(app: Router) -> String {
-    let (addr, _handle) = workshop_support::fixtures::serve(app).await;
-    format!("http://{addr}")
-}
-
-/// A backoff fast enough that a down-phase probe retries within a few
-/// ticks, with a budget no test exhausts by accident.
-fn test_backoff() -> ReconnectBackoff {
-    ReconnectBackoff::with_schedule(
-        Duration::from_millis(10),
-        Duration::from_millis(40),
-        Duration::from_secs(60),
-    )
-}
-
-/// Starts a heartbeat against `base_url` on the fast interval, wired to
-/// `status` and `catalog`; returns the handle, the shared health flag,
-/// the menu bus the heartbeat feeds, its reconnect backoff, and the
-/// guards keeping the sink registrations alive.
-fn heartbeat_on(
-    base_url: &str,
-    status: &StatusBus,
-    catalog: &CatalogBus,
-) -> (Heartbeat, GatewayHealth, MenuBus, ReconnectBackoff, Guards) {
-    let gateway =
-        GatewayBinding::new_with_identity(base_url, "", None).expect("binding builds in tests");
-    let health = GatewayHealth::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let backoff = test_backoff();
-    let (push, guards) = wired_push(status, catalog, &menu);
-    let heartbeat = workshop_gateway::spawn_heartbeat(
-        gateway,
-        push,
-        health.clone(),
-        TEST_INTERVAL,
-        backoff.clone(),
-    );
-    (heartbeat, health, menu, backoff, guards)
-}
-
-/// Receives the next status update within a generous deadline.
-async fn next_update(rx: &mut broadcast::Receiver<StatusBarUpdate>) -> StatusBarUpdate {
-    tokio::time::timeout(Duration::from_secs(5), rx.recv())
-        .await
-        .expect("a status update arrives within the deadline")
-        .expect("the status bus is open")
-}
-
-/// Waits until the mock serves `count` more probes, so every probe
-/// before the last of them has finished its announcement and refresh.
-async fn await_probes(probes: &mut watch::Receiver<usize>, count: usize) {
-    let target = *probes.borrow_and_update() + count;
-    tokio::time::timeout(
-        Duration::from_secs(5),
-        probes.wait_for(|served| *served >= target),
-    )
-    .await
-    .expect("the probes are served within the deadline")
-    .expect("the mock gateway keeps counting");
-}
-
-/// Asserts that a steady state re-emits nothing: once three more probes
-/// are served, at least two probes after the last transition have
-/// finished without an update.
-async fn assert_quiet(
-    rx: &mut broadcast::Receiver<StatusBarUpdate>,
-    probes: &mut watch::Receiver<usize>,
-) {
-    await_probes(probes, 3).await;
-    let quiet = rx.try_recv();
-    assert!(
-        matches!(quiet, Err(broadcast::error::TryRecvError::Empty)),
-        "a steady state must not re-emit, got {quiet:?}"
-    );
-}
-
-/// Polls the retained menu snapshot until `accept` holds, within a
-/// generous deadline. Polling the retained copy rather than
-/// subscribing sidesteps the race between the heartbeat's publishes
-/// and the test's subscription.
-async fn snapshot_where(
-    menu: &MenuBus,
-    accept: impl Fn(&WorkbenchSnapshot) -> bool,
-) -> WorkbenchSnapshot {
-    tokio::time::timeout(Duration::from_secs(5), async {
-        loop {
-            if let Some(snapshot) = menu.latest()
-                && accept(&snapshot)
-            {
-                return snapshot;
-            }
-            tokio::time::sleep(Duration::from_millis(5)).await;
-        }
-    })
-    .await
-    .expect("a matching snapshot is retained within the deadline")
-}
-
-#[tokio::test]
-async fn a_healthy_gateway_fires_connected_once_and_stays_quiet() {
-    let healthy = Arc::new(AtomicBool::new(true));
-    let (base_url, mut probes) = spawn_probed_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut rx = status.subscribe();
-    let (heartbeat, health, _menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    let update = next_update(&mut rx).await;
-    assert_eq!(update.label, "Connected to gateway");
-    assert_eq!(update.severity, Severity::Info);
-    assert_eq!(update.activity, workshop_protocol::Activity::General);
-    assert!(health.is_reachable(), "the probe published reachable");
-    assert_quiet(&mut rx, &mut probes).await;
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn an_unreachable_gateway_fires_unreachable_once_and_stays_quiet() {
-    let (base_url, mut probes) = spawn_silent_gateway().await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut rx = status.subscribe();
-    let (heartbeat, health, _menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    let update = next_update(&mut rx).await;
-    assert_eq!(update.label, "Gateway unreachable");
-    assert_eq!(update.severity, Severity::Info);
-    assert_eq!(update.activity, workshop_protocol::Activity::General);
-    assert!(!health.is_reachable(), "the probe published unreachable");
-    assert_quiet(&mut rx, &mut probes).await;
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn each_transition_fires_exactly_one_update() {
-    let healthy = Arc::new(AtomicBool::new(true));
-    let (base_url, mut probes) = spawn_probed_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut rx = status.subscribe();
-    let (heartbeat, health, _menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(next_update(&mut rx).await.label, "Connected to gateway");
-    healthy.store(false, Ordering::Relaxed);
-    assert_eq!(next_update(&mut rx).await.label, "Gateway unreachable");
-    assert!(!health.is_reachable());
-    healthy.store(true, Ordering::Relaxed);
-    assert_eq!(next_update(&mut rx).await.label, "Connected to gateway");
-    assert!(health.is_reachable());
-    assert_quiet(&mut rx, &mut probes).await;
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn reachability_transitions_flip_chat_ready() {
-    let healthy = Arc::new(AtomicBool::new(true));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    // Readiness needs a non-empty catalog and a selection; the mock
-    // catalog holds test-model, so a reconnect's refresh keeps it.
-    catalog.publish(vec![serde_json::json!({"id": "test-model"})]);
-    let mut status_rx = status.subscribe();
-    let (heartbeat, _health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Connected to gateway"
-    );
-    menu.set_selected("test-model")
-        .expect("the id is in the catalog");
-    snapshot_where(&menu, |snapshot| snapshot.chat_ready).await;
-
-    healthy.store(false, Ordering::Relaxed);
-    let down = snapshot_where(&menu, |snapshot| !snapshot.chat_ready).await;
-    assert_eq!(
-        down.selected_model.as_deref(),
-        Some("test-model"),
-        "only reachability flipped; the selection survives the outage"
-    );
-
-    healthy.store(true, Ordering::Relaxed);
-    snapshot_where(&menu, |snapshot| snapshot.chat_ready).await;
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_mere_connect_keeps_the_backoff_escalated() {
-    // The anti-flap rule this step exists for: an outage escalates the
-    // backoff, and a gateway that answers its probe again (connects
-    // without delivering any useful work) must leave the escalation
-    // standing, so the next outage keeps the slow schedule.
-    let healthy = Arc::new(AtomicBool::new(false));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut rx = status.subscribe();
-    let (heartbeat, health, _menu, backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(next_update(&mut rx).await.label, "Gateway unreachable");
-    healthy.store(true, Ordering::Relaxed);
-    assert_eq!(next_update(&mut rx).await.label, "Connected to gateway");
-    assert!(health.is_reachable());
-    assert!(
-        backoff.is_escalated_for_test(),
-        "reconnecting without useful work must not reset the backoff"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn an_exhausted_budget_stops_reconnect_probes_with_a_give_up_report() {
-    let healthy = Arc::new(AtomicBool::new(false));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut rx = status.subscribe();
-    let gateway =
-        GatewayBinding::new_with_identity(&base_url, "", None).expect("binding builds in tests");
-    let health = GatewayHealth::new();
-    // The loop is handed the only reachability sender, so this watch
-    // closes exactly when the loop ends.
-    let mut verdict = health.subscribe();
-    let menu = MenuBus::new(catalog.clone(), None);
-    // A budget of a few schedule steps: exhausted within a handful of
-    // failed probes, well inside the test deadline.
-    let backoff = ReconnectBackoff::with_schedule(
-        Duration::from_millis(10),
-        Duration::from_millis(20),
-        Duration::from_millis(50),
-    );
-    let (push, _guards) = wired_push(&status, &catalog, &menu);
-    let heartbeat =
-        workshop_gateway::spawn_heartbeat(gateway, push, health, TEST_INTERVAL, backoff);
-
-    assert_eq!(next_update(&mut rx).await.label, "Gateway unreachable");
-    let report = next_update(&mut rx).await;
-    assert_eq!(report.label, "Gateway reconnect stopped");
-    assert_eq!(report.severity, Severity::Error);
-    // The gateway coming back after the give-up changes nothing: the
-    // loop has ended, so no probe ever notices.
-    healthy.store(true, Ordering::Relaxed);
-    tokio::time::timeout(Duration::from_secs(5), async {
-        while verdict.changed().await.is_ok() {}
-    })
-    .await
-    .expect("the loop ends with its give-up report");
-    let after = rx.try_recv();
-    assert!(
-        matches!(after, Err(broadcast::error::TryRecvError::Empty)),
-        "an ended loop reports nothing more, got {after:?}"
-    );
-    assert!(
-        !*verdict.borrow(),
-        "an ended loop leaves the last verdict standing"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn shutdown_stops_the_task_without_waiting_out_the_interval() {
-    // A long interval: if the stop signal did not win the select, the
-    // shutdown would block for the whole minute.
-    let status = StatusBus::new();
-    let gateway = GatewayBinding::new_with_identity("http://127.0.0.1:1", "", None)
-        .expect("binding builds in tests");
-    let catalog = CatalogBus::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let (push, _guards) = wired_push(&status, &catalog, &menu);
-    let heartbeat = workshop_gateway::spawn_heartbeat(
-        gateway,
-        push,
-        GatewayHealth::new(),
-        Duration::from_secs(60),
-        ReconnectBackoff::new(),
-    );
-    tokio::time::timeout(Duration::from_secs(5), heartbeat.shutdown())
-        .await
-        .expect("shutdown does not wait out the interval");
-}
-
-mod recovery;
-mod refresh_on_reconnect;
-mod startup_convergence;
diff --git a/crates/workshop/server/tests/it/heartbeat_loop/recovery.rs b/crates/workshop/server/tests/it/heartbeat_loop/recovery.rs
deleted file mode 100644
index 88a42c21e..000000000
--- a/crates/workshop/server/tests/it/heartbeat_loop/recovery.rs
+++ /dev/null
@@ -1,63 +0,0 @@
-//! Heartbeat recovery: a replaced endpoint wakes the heartbeat and refreshes with its new key.
-
-use super::*;
-
-/// Catalog route that accepts only the replacement sidecar bearer.
-async fn replacement_models(headers: axum::http::HeaderMap) -> Response {
-    if headers
-        .get(axum::http::header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok())
-        != Some("Bearer replacement-key")
-    {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-    mock_models().await
-}
-
-#[tokio::test]
-async fn a_replaced_endpoint_wakes_the_heartbeat_and_refreshes_with_its_new_key() {
-    let replacement = serve(
-        Router::new()
-            .route("/health", get(|| async { StatusCode::OK }))
-            .route("/v1/models", get(replacement_models))
-            .route("/admin/profiles", get(mock_profiles))
-            .route("/admin/status", get(mock_profile_status)),
-    )
-    .await;
-    let gateway = GatewayBinding::new_with_identity("http://127.0.0.1:1", "old-key", None)
-        .expect("binding builds");
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let menu = MenuBus::new(catalog.clone(), None);
-    let health = GatewayHealth::new();
-    let mut status_rx = status.subscribe();
-    let mut catalog_rx = catalog.subscribe();
-    let (push, _guards) = wired_push(&status, &catalog, &menu);
-    let heartbeat = workshop_gateway::spawn_heartbeat(
-        gateway.clone(),
-        push,
-        health.clone(),
-        Duration::from_secs(60),
-        test_backoff(),
-    );
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Gateway unreachable"
-    );
-    gateway
-        .replace(&replacement, "replacement-key")
-        .expect("the replacement publishes");
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Connected to gateway",
-        "publication wakes the heartbeat without waiting out its backoff"
-    );
-    let models = tokio::time::timeout(Duration::from_secs(5), catalog_rx.recv())
-        .await
-        .expect("the replacement catalog arrives")
-        .expect("the catalog channel stays open");
-    assert_eq!(models.models[0]["id"], "test-model");
-    assert!(health.is_reachable());
-    heartbeat.shutdown().await;
-}
diff --git a/crates/workshop/server/tests/it/heartbeat_loop/refresh_on_reconnect.rs b/crates/workshop/server/tests/it/heartbeat_loop/refresh_on_reconnect.rs
deleted file mode 100644
index 61d94d26d..000000000
--- a/crates/workshop/server/tests/it/heartbeat_loop/refresh_on_reconnect.rs
+++ /dev/null
@@ -1,115 +0,0 @@
-//! Heartbeat refresh-on-reconnect: a transition to reachable repopulates the catalog and profile state.
-
-use super::*;
-
-#[tokio::test]
-async fn a_reconnect_pushes_the_refreshed_catalog() {
-    let healthy = Arc::new(AtomicBool::new(false));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut status_rx = status.subscribe();
-    let mut catalog_rx = catalog.subscribe();
-    let (heartbeat, _health, _menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Gateway unreachable"
-    );
-    healthy.store(true, Ordering::Relaxed);
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Connected to gateway"
-    );
-    let push: CatalogPush = tokio::time::timeout(Duration::from_secs(5), catalog_rx.recv())
-        .await
-        .expect("the refreshed catalog arrives within the deadline")
-        .expect("the catalog bus is open");
-    assert_eq!(
-        push.models,
-        serde_json::json!([{"id": "test-model", "object": "model", "owned_by": "runvil"}])
-            .as_array()
-            .expect("the fixture is an array")
-            .clone(),
-        "the push includes every chat-capable gateway model"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_reconnect_whose_refresh_is_declined_pushes_no_catalog() {
-    // No /v1/models route: the refresh is declined with a 404, and a
-    // declined refresh is skipped rather than pushed - pushing it
-    // would empty pickers that still hold a usable list.
-    let healthy = Arc::new(AtomicBool::new(false));
-    let (health, mut probes) = health_only(Arc::clone(&healthy));
-    let base_url = serve(health).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut status_rx = status.subscribe();
-    let mut catalog_rx = catalog.subscribe();
-    let (heartbeat, _health, _menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Gateway unreachable"
-    );
-    healthy.store(true, Ordering::Relaxed);
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Connected to gateway"
-    );
-    // Two more probes: the reconnect's declined refresh and one healthy
-    // retry have both finished.
-    await_probes(&mut probes, 2).await;
-    let quiet = catalog_rx.try_recv();
-    assert!(
-        matches!(quiet, Err(broadcast::error::TryRecvError::Empty)),
-        "a declined refresh is skipped, not pushed, got {quiet:?}"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_down_to_up_transition_publishes_a_populated_snapshot() {
-    let healthy = Arc::new(AtomicBool::new(false));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut status_rx = status.subscribe();
-    let (heartbeat, _health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Gateway unreachable"
-    );
-    healthy.store(true, Ordering::Relaxed);
-    let populated = snapshot_where(&menu, |snapshot| !snapshot.profiles.is_empty()).await;
-    assert_eq!(populated.profiles, ["coding", "main"]);
-    assert_eq!(populated.active.as_deref(), Some("main"));
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_gateway_without_profile_support_publishes_an_empty_list() {
-    // Only /health exists: the profile endpoints answer 404, which
-    // is a state, not an error - the reconnect publishes an empty
-    // list rather than keeping the stale names.
-    let healthy = Arc::new(AtomicBool::new(false));
-    let (health, _probes) = health_only(Arc::clone(&healthy));
-    let base_url = serve(health).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut status_rx = status.subscribe();
-    let (heartbeat, _health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    assert_eq!(
-        next_update(&mut status_rx).await.label,
-        "Gateway unreachable"
-    );
-    menu.set_profiles(vec!["stale".to_string()], Some("stale".to_string()));
-    healthy.store(true, Ordering::Relaxed);
-    let emptied = snapshot_where(&menu, |snapshot| snapshot.profiles.is_empty()).await;
-    assert_eq!(emptied.active, None, "the stale active profile clears");
-    heartbeat.shutdown().await;
-}
diff --git a/crates/workshop/server/tests/it/heartbeat_loop/startup_convergence.rs b/crates/workshop/server/tests/it/heartbeat_loop/startup_convergence.rs
deleted file mode 100644
index c304bf5bd..000000000
--- a/crates/workshop/server/tests/it/heartbeat_loop/startup_convergence.rs
+++ /dev/null
@@ -1,217 +0,0 @@
-//! Heartbeat startup convergence: the initial connect retries until catalog and profiles are ready.
-
-use super::*;
-
-/// Startup state whose health is continuously true while its catalog
-/// becomes ready later.
-struct DelayedCatalog {
-    ready: AtomicBool,
-    requests: AtomicUsize,
-}
-
-/// Startup state whose catalog is ready before both profile endpoints.
-struct DelayedProfiles {
-    ready: AtomicBool,
-    list_requests: AtomicUsize,
-    status_requests: AtomicUsize,
-}
-
-/// A catalog that is empty until the test publishes readiness.
-async fn delayed_models(State(state): State<Arc<DelayedCatalog>>) -> Response {
-    state.requests.fetch_add(1, Ordering::Relaxed);
-    let body = if state.ready.load(Ordering::Relaxed) {
-        CATALOG
-    } else {
-        r#"{"object":"list","data":[]}"#
-    };
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        body,
-    )
-        .into_response()
-}
-
-async fn delayed_profiles(State(state): State<Arc<DelayedProfiles>>) -> Response {
-    state.list_requests.fetch_add(1, Ordering::Relaxed);
-    let body = if state.ready.load(Ordering::Relaxed) {
-        r#"{"profiles":["coding","main"]}"#
-    } else {
-        r#"{"profiles":[]}"#
-    };
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        body,
-    )
-        .into_response()
-}
-
-async fn delayed_profile_status(State(state): State<Arc<DelayedProfiles>>) -> Response {
-    state.status_requests.fetch_add(1, Ordering::Relaxed);
-    let body = if state.ready.load(Ordering::Relaxed) {
-        r#"{"profile":"main","models":["test-model"]}"#
-    } else {
-        r#"{"profile":null,"models":[]}"#
-    };
-    (
-        [(axum::http::header::CONTENT_TYPE, "application/json")],
-        body,
-    )
-        .into_response()
-}
-
-#[tokio::test]
-async fn the_initial_connect_populates_the_profile_state() {
-    let healthy = Arc::new(AtomicBool::new(true));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let (heartbeat, _health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    let populated = snapshot_where(&menu, |snapshot| !snapshot.profiles.is_empty()).await;
-    assert_eq!(populated.profiles, ["coding", "main"]);
-    assert_eq!(populated.active.as_deref(), Some("main"));
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn the_initial_connect_pushes_the_catalog_and_readies_chat() {
-    let healthy = Arc::new(AtomicBool::new(true));
-    let base_url = spawn_gateway(Arc::clone(&healthy)).await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let mut catalog_rx = catalog.subscribe();
-    let (heartbeat, _health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    let push: CatalogPush = tokio::time::timeout(Duration::from_secs(5), catalog_rx.recv())
-        .await
-        .expect("the boot catalog arrives within the deadline")
-        .expect("the catalog bus is open");
-    assert_eq!(
-        push.models,
-        serde_json::json!([{"id": "test-model", "object": "model", "owned_by": "runvil"}])
-            .as_array()
-            .expect("the fixture is an array")
-            .clone(),
-        "the push includes every chat-capable gateway model"
-    );
-    let ready = snapshot_where(&menu, |snapshot| snapshot.chat_ready).await;
-    assert_eq!(
-        ready.selected_model.as_deref(),
-        Some("test-model"),
-        "boot restores a selection without any user interaction"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_healthy_gateway_retries_refresh_until_its_catalog_is_ready() {
-    let state = Arc::new(DelayedCatalog {
-        ready: AtomicBool::new(false),
-        requests: AtomicUsize::new(0),
-    });
-    let base_url = serve(
-        Router::new()
-            .route("/health", get(|| async { StatusCode::OK }))
-            .route("/v1/models", get(delayed_models))
-            .route("/admin/profiles", get(mock_profiles))
-            .route("/admin/status", get(mock_profile_status))
-            .with_state(Arc::clone(&state)),
-    )
-    .await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let (heartbeat, health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    tokio::time::timeout(Duration::from_secs(5), async {
-        while state.requests.load(Ordering::Relaxed) < 1 {
-            tokio::time::sleep(Duration::from_millis(5)).await;
-        }
-    })
-    .await
-    .expect("the first empty refresh completes");
-    assert!(health.is_reachable(), "health stays continuously true");
-    assert!(
-        menu.latest()
-            .is_some_and(|snapshot| snapshot.selected_model.is_none()),
-        "an empty first catalog cannot restore a selection"
-    );
-
-    state.ready.store(true, Ordering::Relaxed);
-    let ready = snapshot_where(&menu, |snapshot| snapshot.chat_ready).await;
-    assert_eq!(ready.selected_model.as_deref(), Some("test-model"));
-    assert!(
-        state.requests.load(Ordering::Relaxed) >= 2,
-        "readiness changed without a health transition, so refresh had to retry"
-    );
-
-    let requests_after_restore = state.requests.load(Ordering::Relaxed);
-    // The quiet window must be real time: the probes are real loopback HTTP
-    // on the test runtime, and a paused-clock advance cannot drive them.
-    tokio::time::sleep(TEST_INTERVAL * 4).await;
-    assert_eq!(
-        state.requests.load(Ordering::Relaxed),
-        requests_after_restore,
-        "selection restoration ends refresh retries"
-    );
-    heartbeat.shutdown().await;
-}
-
-#[tokio::test]
-async fn a_healthy_gateway_waits_for_profiles_after_its_catalog_is_ready() {
-    let state = Arc::new(DelayedProfiles {
-        ready: AtomicBool::new(false),
-        list_requests: AtomicUsize::new(0),
-        status_requests: AtomicUsize::new(0),
-    });
-    let base_url = serve(
-        Router::new()
-            .route("/health", get(|| async { StatusCode::OK }))
-            .route("/v1/models", get(mock_models))
-            .route("/admin/profiles", get(delayed_profiles))
-            .route("/admin/status", get(delayed_profile_status))
-            .with_state(Arc::clone(&state)),
-    )
-    .await;
-    let status = StatusBus::new();
-    let catalog = CatalogBus::new();
-    let (heartbeat, health, menu, _backoff, _guards) = heartbeat_on(&base_url, &status, &catalog);
-
-    tokio::time::timeout(Duration::from_secs(5), async {
-        loop {
-            let snapshot = menu.latest();
-            if state.list_requests.load(Ordering::Relaxed) >= 1
-                && state.status_requests.load(Ordering::Relaxed) >= 1
-                && catalog
-                    .latest()
-                    .is_some_and(|catalog| !catalog.models.is_empty())
-                && snapshot.is_some_and(|snapshot| snapshot.profiles.is_empty())
-            {
-                break;
-            }
-            tokio::time::sleep(Duration::from_millis(5)).await;
-        }
-    })
-    .await
-    .expect("the first empty profile refresh completes");
-    assert!(health.is_reachable(), "health stays continuously true");
-    assert_eq!(
-        menu.latest().and_then(|snapshot| snapshot.selected_model),
-        None,
-        "catalog readiness alone cannot end startup convergence"
-    );
-
-    state.ready.store(true, Ordering::Relaxed);
-    let ready = snapshot_where(&menu, |snapshot| {
-        snapshot.profiles == ["coding", "main"]
-            && snapshot.active.as_deref() == Some("main")
-            && snapshot.chat_ready
-    })
-    .await;
-    assert_eq!(ready.selected_model.as_deref(), Some("test-model"));
-    assert!(
-        state.list_requests.load(Ordering::Relaxed) >= 2
-            && state.status_requests.load(Ordering::Relaxed) >= 2,
-        "profile readiness changed without a health transition, so both endpoints had to retry"
-    );
-    heartbeat.shutdown().await;
-}
diff --git a/crates/workshop/server/tests/it/main.rs b/crates/workshop/server/tests/it/main.rs
deleted file mode 100644
index 7ac67a355..000000000
--- a/crates/workshop/server/tests/it/main.rs
+++ /dev/null
@@ -1,21 +0,0 @@
-//! Workshop server integration tests, one module per behavior area: the
-//! `/ws` socket and its heartbeat-driven frames, the `/agents/ws` socket
-//! and the built-in chat agent's gate, the realtime relay, the
-//! heartbeat loop, boot composition, the user-state bucket, the std file
-//! tools over a real directory, the workspace file across a graceful
-//! shutdown, and the workspace save deadline through the full router.
-
-#[path = "../common/mod.rs"]
-mod common;
-
-mod agents;
-mod boot;
-mod chat_gate;
-mod heartbeat;
-mod heartbeat_loop;
-mod realtime_relay;
-mod std_real_directory;
-mod user_state;
-mod workshop_socket;
-mod workspace_shutdown;
-mod workspace_timeout;
diff --git a/crates/workshop/server/tests/it/realtime_relay.rs b/crates/workshop/server/tests/it/realtime_relay.rs
deleted file mode 100644
index 98f901251..000000000
--- a/crates/workshop/server/tests/it/realtime_relay.rs
+++ /dev/null
@@ -1,381 +0,0 @@
-//! Additive Workshop relay for Gateway Realtime transcription.
-
-#![expect(
-    clippy::expect_used,
-    reason = "integration-test helpers panic with the failed wire invariant"
-)]
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex};
-
-use axum::Router;
-use axum::extract::State;
-use axum::extract::ws::{CloseFrame, Message, WebSocketUpgrade};
-use axum::http::{HeaderMap, StatusCode, Uri, header};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use futures_util::{SinkExt as _, StreamExt as _};
-use tokio::io::AsyncWriteExt as _;
-use tokio::sync::Notify;
-use tokio_tungstenite::tungstenite::client::IntoClientRequest as _;
-use tokio_tungstenite::tungstenite::{Error as SocketError, Message as ClientMessage};
-
-use crate::common::{RECV_TIMEOUT, TestServer, spawn_gateway};
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-struct UpstreamRequest {
-    path: String,
-    query: String,
-    has_origin: bool,
-    has_subprotocol: bool,
-}
-
-#[derive(Clone, Default)]
-struct UpstreamProbe {
-    request: Arc<Mutex<Option<UpstreamRequest>>>,
-    pings: Arc<Mutex<Vec<Vec<u8>>>>,
-    pongs: Arc<Mutex<Vec<Vec<u8>>>>,
-    browser_close: Arc<Mutex<Option<(u16, String)>>>,
-    control_seen: Arc<Notify>,
-    close_seen: Arc<Notify>,
-    disconnected: Arc<Notify>,
-}
-
-#[derive(Clone, Default)]
-struct FixtureUpstream {
-    frames: Arc<Vec<String>>,
-    gateway_bearer_seen: Arc<AtomicBool>,
-    browser_bearer_seen: Arc<AtomicBool>,
-}
-
-fn canonical_server_frames() -> Vec<String> {
-    // Workshop's own copy of the canonical sequences, under this crate's
-    // test fixtures. The Gateway keeps its own copy; `build-xtask`'s
-    // `realtime_wire_conformance` test reports drift between the two.
-    let fixtures: serde_json::Value =
-        serde_json::from_slice(include_bytes!("../fixtures/realtime/valid-sequences.json"))
-            .expect("canonical Realtime sequences parse");
-    [
-        "first_event_readiness",
-        "hypothesis_negotiation",
-        "overlapping_items_reverse_completion",
-        "clear_retires_only_uncommitted_input",
-        "saturated_commit_retry",
-    ]
-    .into_iter()
-    .flat_map(|name| {
-        fixtures[name]["events"]
-            .as_array()
-            .expect("canonical sequence has events")
-            .iter()
-            .filter(|entry| entry["direction"] == "server")
-            .map(|entry| {
-                serde_json::to_string(&entry["message"]).expect("canonical event serializes")
-            })
-            .collect::<Vec<_>>()
-    })
-    .collect()
-}
-
-impl UpstreamProbe {
-    fn request(&self) -> UpstreamRequest {
-        self.request
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .clone()
-            .expect("the upstream handshake was recorded")
-    }
-
-    fn pings(&self) -> Vec<Vec<u8>> {
-        self.pings
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .clone()
-    }
-
-    fn pongs(&self) -> Vec<Vec<u8>> {
-        self.pongs
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .clone()
-    }
-
-    fn browser_close(&self) -> Option<(u16, String)> {
-        self.browser_close
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .clone()
-    }
-}
-
-async fn fixture_upstream(
-    State(fixture): State<FixtureUpstream>,
-    headers: HeaderMap,
-    ws: WebSocketUpgrade,
-) -> Response {
-    let authorization = headers
-        .get(header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok())
-        .unwrap_or_default();
-    fixture
-        .gateway_bearer_seen
-        .store(authorization == "Bearer test-key", Ordering::Release);
-    fixture
-        .browser_bearer_seen
-        .store(authorization.contains("browser-secret"), Ordering::Release);
-    if authorization != "Bearer test-key" {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-    ws.on_upgrade(move |mut socket| async move {
-        for frame in fixture.frames.iter() {
-            if socket
-                .send(Message::Text(frame.clone().into()))
-                .await
-                .is_err()
-            {
-                return;
-            }
-        }
-        while let Some(Ok(message)) = socket.recv().await {
-            match message {
-                Message::Text(text) => {
-                    if socket.send(Message::Text(text)).await.is_err() {
-                        return;
-                    }
-                }
-                Message::Binary(bytes) => {
-                    if socket.send(Message::Binary(bytes)).await.is_err() {
-                        return;
-                    }
-                }
-                Message::Close(_) => return,
-                Message::Ping(_) | Message::Pong(_) => {}
-            }
-        }
-    })
-}
-
-async fn upstream(
-    State(probe): State<UpstreamProbe>,
-    headers: HeaderMap,
-    uri: Uri,
-    ws: WebSocketUpgrade,
-) -> Response {
-    let authorization = headers
-        .get(header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok())
-        .unwrap_or_default()
-        .to_owned();
-    let has_origin = headers.contains_key(header::ORIGIN);
-    let has_subprotocol = headers.contains_key("sec-websocket-protocol");
-    *probe
-        .request
-        .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(UpstreamRequest {
-        path: uri.path().to_owned(),
-        query: uri.query().unwrap_or_default().to_owned(),
-        has_origin,
-        has_subprotocol,
-    });
-    if authorization != "Bearer test-key" {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-    ws.on_upgrade(move |mut socket| async move {
-        while let Some(Ok(message)) = socket.recv().await {
-            match message {
-                Message::Text(text) => {
-                    if socket.send(Message::Text(text)).await.is_err() {
-                        return;
-                    }
-                }
-                Message::Binary(bytes) => {
-                    if socket.send(Message::Binary(bytes)).await.is_err()
-                        || socket
-                            .send(Message::Ping(vec![9, 8, 7].into()))
-                            .await
-                            .is_err()
-                        || socket
-                            .send(Message::Pong(vec![6, 5, 4].into()))
-                            .await
-                            .is_err()
-                    {
-                        return;
-                    }
-                }
-                Message::Pong(bytes) => {
-                    probe
-                        .pongs
-                        .lock()
-                        .unwrap_or_else(std::sync::PoisonError::into_inner)
-                        .push(bytes.to_vec());
-                    probe.control_seen.notify_one();
-                }
-                Message::Close(frame) => {
-                    if let Some(frame) = frame {
-                        *probe
-                            .browser_close
-                            .lock()
-                            .unwrap_or_else(std::sync::PoisonError::into_inner) =
-                            Some((frame.code, frame.reason.to_string()));
-                    }
-                    probe.close_seen.notify_one();
-                    return;
-                }
-                Message::Ping(bytes) => {
-                    probe
-                        .pings
-                        .lock()
-                        .unwrap_or_else(std::sync::PoisonError::into_inner)
-                        .push(bytes.to_vec());
-                    probe.control_seen.notify_one();
-                }
-            }
-        }
-        probe.disconnected.notify_one();
-    })
-}
-
-async fn spawn_probe() -> (String, UpstreamProbe) {
-    let probe = UpstreamProbe::default();
-    let app = Router::new()
-        .route("/v1/realtime", get(upstream))
-        .with_state(probe.clone());
-    (spawn_gateway(app).await, probe)
-}
-
-async fn recv(
-    socket: &mut tokio_tungstenite::WebSocketStream<
-        tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
-    >,
-) -> ClientMessage {
-    tokio::time::timeout(RECV_TIMEOUT, socket.next())
-        .await
-        .expect("a frame arrives before the deadline")
-        .expect("the relay socket stays open")
-        .expect("the relayed frame is valid")
-}
-
-/// Asserts that no frame precedes the echo of a fresh text marker. The
-/// relay forwards each direction in order and the probe upstream echoes
-/// in order, so a duplicate or forwarded frame already on its way
-/// arrives ahead of the echo, and the upstream has read every frame
-/// relayed before the marker.
-async fn assert_no_frame(
-    socket: &mut tokio_tungstenite::WebSocketStream<
-        tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
-    >,
-) {
-    let marker = "no-frame marker";
-    socket
-        .send(ClientMessage::Text(marker.into()))
-        .await
-        .expect("the marker sends");
-    assert_eq!(
-        recv(socket).await,
-        ClientMessage::Text(marker.into()),
-        "the terminated control frame produces no duplicate or forwarded frame"
-    );
-}
-
-async fn upstream_close(ws: WebSocketUpgrade) -> Response {
-    ws.on_upgrade(|mut socket| async move {
-        let _ = socket
-            .send(Message::Close(Some(CloseFrame {
-                code: 4101,
-                reason: "upstream finished".into(),
-            })))
-            .await;
-    })
-}
-
-#[derive(Clone, Default)]
-struct StalledPeerProbe {
-    frame_sent: Arc<AtomicBool>,
-    frame_sent_event: Arc<Notify>,
-}
-
-impl StalledPeerProbe {
-    async fn wait_for_frame(&self) {
-        let notified = self.frame_sent_event.notified();
-        if self.frame_sent.load(Ordering::Acquire) {
-            return;
-        }
-        notified.await;
-    }
-}
-
-async fn send_large_frame_then_disconnect(
-    State(probe): State<StalledPeerProbe>,
-    ws: WebSocketUpgrade,
-) -> Response {
-    ws.on_upgrade(move |mut socket| async move {
-        if socket
-            .send(Message::Binary(vec![0x5a; 32 * 1024 * 1024].into()))
-            .await
-            .is_ok()
-        {
-            probe.frame_sent.store(true, Ordering::Release);
-            probe.frame_sent_event.notify_one();
-        }
-    })
-}
-
-async fn recovered_upstream(headers: HeaderMap, ws: WebSocketUpgrade) -> Response {
-    let authorized = headers
-        .get(header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok())
-        == Some("Bearer replacement-key");
-    if !authorized {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-    ws.on_upgrade(|mut socket| async move {
-        for event in [
-            r#"{"type":"session.created","session":{"id":"replacement"}}"#,
-            r#"{"type":"session.updated","session":{"include":["item.input_audio_transcription.hypothesis"]}}"#,
-        ] {
-            if socket.send(Message::Text(event.into())).await.is_err() {
-                return;
-            }
-        }
-    })
-}
-
-fn request_with(
-    url: &str,
-    origin: Option<&str>,
-    subprotocol: Option<&str>,
-) -> tokio_tungstenite::tungstenite::http::Request<()> {
-    let mut request = url
-        .into_client_request()
-        .expect("the WebSocket request builds");
-    if let Some(origin) = origin {
-        request.headers_mut().insert(
-            header::ORIGIN,
-            origin.parse().expect("the test Origin is valid"),
-        );
-    }
-    if let Some(subprotocol) = subprotocol {
-        request.headers_mut().insert(
-            "sec-websocket-protocol",
-            subprotocol.parse().expect("the test subprotocol is valid"),
-        );
-    }
-    request
-}
-
-async fn rejected_status(request: tokio_tungstenite::tungstenite::http::Request<()>) -> StatusCode {
-    let error = tokio_tungstenite::connect_async(request)
-        .await
-        .expect_err("the WebSocket handshake is rejected");
-    let SocketError::Http(response) = error else {
-        panic!("the rejection is an HTTP response, got {error:?}");
-    };
-    StatusCode::from_u16(response.status().as_u16()).expect("the status is standard")
-}
-
-mod authentication;
-mod canonical_sequence;
-mod lifecycle;
-mod overload;
-mod protocol;
-mod recovery;
diff --git a/crates/workshop/server/tests/it/realtime_relay/authentication.rs b/crates/workshop/server/tests/it/realtime_relay/authentication.rs
deleted file mode 100644
index c31e6d9f7..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/authentication.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-//! The relay's authority: the Gateway bearer replaces the browser's, the
-//! upstream target is fixed, payloads pass opaque, and the handshake
-//! enforces same-origin with no subprotocol.
-
-use super::*;
-
-#[tokio::test]
-async fn realtime_relay_is_authenticated_fixed_and_payload_opaque() {
-    let (gateway, probe) = spawn_probe().await;
-    let server = TestServer::spawn(&gateway);
-    let url = server.ws_url("/v1/realtime?ignored=browser");
-    let mut request = request_with(&url, None, None);
-    request.headers_mut().insert(
-        header::AUTHORIZATION,
-        "Bearer browser-secret"
-            .parse()
-            .expect("the browser credential is a header"),
-    );
-    let (mut socket, response) = tokio_tungstenite::connect_async(request)
-        .await
-        .expect("the Workshop Realtime socket upgrades");
-    assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
-
-    let opaque = "not JSON: \u{00e9}\u{65e5}\u{1f40d}";
-    socket
-        .send(ClientMessage::Text(opaque.into()))
-        .await
-        .expect("opaque text sends");
-    assert_eq!(recv(&mut socket).await, ClientMessage::Text(opaque.into()));
-
-    socket
-        .send(ClientMessage::Ping(vec![2, 4, 6, 8].into()))
-        .await
-        .expect("browser ping sends");
-    assert_eq!(
-        recv(&mut socket).await,
-        ClientMessage::Pong(vec![2, 4, 6, 8].into()),
-        "the Workshop hop owns exactly one matching browser pong"
-    );
-    assert_no_frame(&mut socket).await;
-
-    socket
-        .send(ClientMessage::Pong(vec![1, 3, 5, 7].into()))
-        .await
-        .expect("caller-owned pong sends");
-
-    let binary = vec![0, 255, 1, 128, 2];
-    socket
-        .send(ClientMessage::Binary(binary.clone().into()))
-        .await
-        .expect("opaque binary sends");
-    assert_eq!(
-        recv(&mut socket).await,
-        ClientMessage::Binary(binary.into())
-    );
-    tokio::time::timeout(RECV_TIMEOUT, async {
-        loop {
-            let notified = probe.control_seen.notified();
-            if !probe.pongs().is_empty() {
-                break;
-            }
-            notified.await;
-        }
-    })
-    .await
-    .expect("the Gateway hop receives its automatic pong");
-    assert_no_frame(&mut socket).await;
-    assert_eq!(
-        probe.pongs(),
-        vec![vec![9, 8, 7]],
-        "the Gateway hop owns exactly one matching pong and receives no browser pong"
-    );
-    assert!(
-        probe.pings().is_empty(),
-        "the browser ping terminates at Workshop"
-    );
-    socket.close(None).await.expect("the browser socket closes");
-
-    assert_eq!(
-        probe.request(),
-        UpstreamRequest {
-            path: "/v1/realtime".to_owned(),
-            query: "intent=transcription".to_owned(),
-            has_origin: false,
-            has_subprotocol: false,
-        },
-        "the connector fixes the upstream target and forwards no browser policy headers"
-    );
-}
-
-#[tokio::test]
-async fn realtime_relay_enforces_same_origin_authority_and_no_subprotocol() {
-    let (gateway, _probe) = spawn_probe().await;
-    let server = TestServer::spawn(&gateway);
-    let url = server.ws_url("/v1/realtime?intent=transcription");
-    let parsed = url::Url::parse(&url).expect("the Workshop URL parses");
-    let authority = parsed
-        .socket_addrs(|| None)
-        .expect("the Workshop authority resolves")
-        .into_iter()
-        .next()
-        .expect("the Workshop authority has an address");
-    let same_origin = format!("http://{authority}");
-
-    let (socket, response) =
-        tokio_tungstenite::connect_async(request_with(&url, Some(&same_origin), None))
-            .await
-            .expect("the exact same origin upgrades");
-    assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
-    drop(socket);
-
-    assert_eq!(
-        rejected_status(request_with(&url, Some("http://localhost:9"), None)).await,
-        StatusCode::FORBIDDEN
-    );
-    assert_eq!(
-        rejected_status(request_with(&url, Some(&same_origin), Some("realtime"))).await,
-        StatusCode::BAD_REQUEST
-    );
-}
diff --git a/crates/workshop/server/tests/it/realtime_relay/canonical_sequence.rs b/crates/workshop/server/tests/it/realtime_relay/canonical_sequence.rs
deleted file mode 100644
index 6c952e062..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/canonical_sequence.rs
+++ /dev/null
@@ -1,181 +0,0 @@
-//! The canonical Realtime sequences and an hour-equivalent take cross
-//! the relay unchanged.
-
-use super::*;
-
-#[derive(Clone, Default)]
-struct HourRelayProbe {
-    appends: Arc<std::sync::atomic::AtomicUsize>,
-    commits: Arc<std::sync::atomic::AtomicUsize>,
-}
-
-async fn hour_upstream(State(probe): State<HourRelayProbe>, ws: WebSocketUpgrade) -> Response {
-    ws.on_upgrade(move |mut socket| async move {
-        if socket
-            .send(Message::Text(
-                r#"{"type":"session.created","event_id":"hour_session","session":{"id":"hour","object":"realtime.transcription_session","modalities":["audio","text"],"input_audio_format":"pcm16","input_audio_transcription":{"model":"mounted"},"turn_detection":null,"input_audio_noise_reduction":null,"include":[]}}"#
-                    .into(),
-            ))
-            .await
-            .is_err()
-        {
-            return;
-        }
-        while let Some(Ok(Message::Text(text))) = socket.recv().await {
-            let Ok(event) = serde_json::from_str::<serde_json::Value>(&text) else {
-                return;
-            };
-            match event["type"].as_str() {
-                Some("session.update") => {
-                    let updated = r#"{"type":"session.updated","event_id":"hour_updated","session":{"id":"hour","object":"realtime.transcription_session","modalities":["audio","text"],"input_audio_format":"pcm16","input_audio_transcription":{"model":"mounted"},"turn_detection":null,"input_audio_noise_reduction":null,"include":[]}}"#;
-                    if socket.send(Message::Text(updated.into())).await.is_err() {
-                        return;
-                    }
-                }
-                Some("input_audio_buffer.append") => {
-                    probe.appends.fetch_add(1, Ordering::AcqRel);
-                }
-                Some("input_audio_buffer.commit") => {
-                    probe.commits.fetch_add(1, Ordering::AcqRel);
-                    for frame in [
-                        r#"{"type":"input_audio_buffer.committed","event_id":"hour_committed","item_id":"item_hour","previous_item_id":null}"#,
-                        r#"{"type":"conversation.item.created","event_id":"hour_item","previous_item_id":null,"item":{"id":"item_hour","object":"realtime.item","type":"message","status":"completed","role":"user","content":[{"type":"input_audio","transcript":null}]}}"#,
-                        r#"{"type":"conversation.item.input_audio_transcription.completed","event_id":"hour_completed","item_id":"item_hour","content_index":0,"transcript":"hour complete","usage":{"type":"duration","seconds":3600.0}}"#,
-                    ] {
-                        if socket.send(Message::Text(frame.into())).await.is_err() {
-                            return;
-                        }
-                    }
-                }
-                _ => return,
-            }
-        }
-    })
-}
-
-#[tokio::test]
-async fn canonical_sequences_cross_the_fake_upstream_unchanged_without_browser_bearer() {
-    let fixture = FixtureUpstream {
-        frames: Arc::new(canonical_server_frames()),
-        ..FixtureUpstream::default()
-    };
-    let gateway = spawn_gateway(
-        Router::new()
-            .route("/v1/realtime", get(fixture_upstream))
-            .with_state(fixture.clone()),
-    )
-    .await;
-    let server = TestServer::spawn(&gateway);
-    let url = server.ws_url("/v1/realtime?browser=query");
-    let mut request = request_with(&url, None, None);
-    request.headers_mut().insert(
-        header::AUTHORIZATION,
-        "Bearer browser-secret"
-            .parse()
-            .expect("browser bearer is a header"),
-    );
-    let (mut socket, response) = tokio_tungstenite::connect_async(request)
-        .await
-        .expect("Workshop fixture relay upgrades");
-    assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
-
-    for expected in fixture.frames.iter() {
-        let ClientMessage::Text(actual) = recv(&mut socket).await else {
-            panic!("canonical fixture remains a text payload");
-        };
-        assert_eq!(
-            serde_json::from_str::<serde_json::Value>(&actual).expect("relayed event parses"),
-            serde_json::from_str::<serde_json::Value>(expected).expect("fixture event parses")
-        );
-    }
-    let opaque = "opaque: not JSON, not speech state";
-    socket
-        .send(ClientMessage::Text(opaque.into()))
-        .await
-        .expect("opaque browser text sends");
-    assert_eq!(recv(&mut socket).await, ClientMessage::Text(opaque.into()));
-
-    assert!(fixture.gateway_bearer_seen.load(Ordering::Acquire));
-    assert!(
-        !fixture.browser_bearer_seen.load(Ordering::Acquire),
-        "the browser bearer never reaches the fake Gateway"
-    );
-    socket.close(None).await.expect("fixture socket closes");
-}
-
-#[tokio::test]
-async fn hour_equivalent_one_take_crosses_the_opaque_relay() {
-    let probe = HourRelayProbe::default();
-    let gateway = spawn_gateway(
-        Router::new()
-            .route("/v1/realtime", get(hour_upstream))
-            .with_state(probe.clone()),
-    )
-    .await;
-    let server = TestServer::spawn(&gateway);
-    let (mut socket, response) =
-        tokio_tungstenite::connect_async(server.ws_url("/v1/realtime?intent=transcription"))
-            .await
-            .expect("the Workshop hour relay upgrades");
-    assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
-    let ClientMessage::Text(created) = recv(&mut socket).await else {
-        panic!("the session event remains text");
-    };
-    assert_eq!(
-        serde_json::from_str::<serde_json::Value>(&created).expect("session parses")["type"],
-        "session.created"
-    );
-    socket
-        .send(ClientMessage::Text(
-            r#"{"type":"session.update","session":{"type":"transcription","include":[]}}"#.into(),
-        ))
-        .await
-        .expect("session update crosses the relay");
-    let ClientMessage::Text(updated) = recv(&mut socket).await else {
-        panic!("the update remains text");
-    };
-    assert_eq!(
-        serde_json::from_str::<serde_json::Value>(&updated).expect("update parses")["type"],
-        "session.updated"
-    );
-
-    let bounded_chunk =
-        ClientMessage::Text(r#"{"type":"input_audio_buffer.append","audio":"AQA="}"#.into());
-    for _ in 0..360 {
-        socket
-            .send(bounded_chunk.clone())
-            .await
-            .expect("one reused ten-second-equivalent chunk crosses");
-    }
-    socket
-        .send(ClientMessage::Text(
-            r#"{"type":"input_audio_buffer.commit","event_id":"hour_commit"}"#.into(),
-        ))
-        .await
-        .expect("the sole commit crosses");
-
-    let mut item_ids = Vec::new();
-    for expected in [
-        "input_audio_buffer.committed",
-        "conversation.item.created",
-        "conversation.item.input_audio_transcription.completed",
-    ] {
-        let ClientMessage::Text(frame) = recv(&mut socket).await else {
-            panic!("the hour result remains text");
-        };
-        let event = serde_json::from_str::<serde_json::Value>(&frame).expect("hour event parses");
-        assert_eq!(event["type"], expected);
-        let item_id = event["item_id"]
-            .as_str()
-            .or_else(|| event["item"]["id"].as_str())
-            .expect("every item event names its owner");
-        item_ids.push(item_id.to_owned());
-        if expected.ends_with("completed") {
-            assert_eq!(event["usage"]["seconds"], 3_600.0);
-        }
-    }
-    assert_eq!(item_ids, ["item_hour", "item_hour", "item_hour"]);
-    assert_eq!(probe.appends.load(Ordering::Acquire), 360);
-    assert_eq!(probe.commits.load(Ordering::Acquire), 1);
-    socket.close(None).await.expect("fixture socket closes");
-}
diff --git a/crates/workshop/server/tests/it/realtime_relay/lifecycle.rs b/crates/workshop/server/tests/it/realtime_relay/lifecycle.rs
deleted file mode 100644
index d9dfcedaa..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/lifecycle.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-//! An abrupt browser disconnect releases the Gateway hop.
-
-use super::*;
-
-#[tokio::test]
-async fn browser_disconnect_releases_the_gateway_peer() {
-    let (gateway, probe) = spawn_probe().await;
-    let server = TestServer::spawn(&gateway);
-    let (mut socket, _) =
-        tokio_tungstenite::connect_async(server.ws_url("/v1/realtime?intent=transcription"))
-            .await
-            .expect("the Workshop Realtime socket upgrades");
-    let close_seen = probe.close_seen.notified();
-    let disconnected = probe.disconnected.notified();
-    let tokio_tungstenite::MaybeTlsStream::Plain(transport) = socket.get_mut() else {
-        panic!("the loopback Workshop test uses a plain transport");
-    };
-    transport
-        .shutdown()
-        .await
-        .expect("the browser transport disconnects");
-    drop(socket);
-    tokio::time::timeout(RECV_TIMEOUT, async {
-        tokio::select! {
-            () = close_seen => {}
-            () = disconnected => {}
-        }
-    })
-    .await
-    .expect("an abrupt browser disconnect closes the Gateway hop");
-}
diff --git a/crates/workshop/server/tests/it/realtime_relay/overload.rs b/crates/workshop/server/tests/it/realtime_relay/overload.rs
deleted file mode 100644
index ce8f9058a..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/overload.rs
+++ /dev/null
@@ -1,30 +0,0 @@
-//! A stalled browser send is canceled within the bounded cleanup.
-
-use super::*;
-
-#[tokio::test]
-async fn stalled_browser_cleanup_is_bounded_after_gateway_disconnect() {
-    let probe = StalledPeerProbe::default();
-    let gateway = spawn_gateway(
-        Router::new()
-            .route("/v1/realtime", get(send_large_frame_then_disconnect))
-            .with_state(probe.clone()),
-    )
-    .await;
-    let server = TestServer::spawn(&gateway);
-    let (mut socket, _) =
-        tokio_tungstenite::connect_async(server.ws_url("/v1/realtime?intent=transcription"))
-            .await
-            .expect("the Workshop Realtime socket upgrades");
-    tokio::time::timeout(RECV_TIMEOUT, probe.wait_for_frame())
-        .await
-        .expect("the Gateway fills the relay's browser send");
-
-    let first = tokio::time::timeout(RECV_TIMEOUT, socket.next())
-        .await
-        .expect("bounded relay cleanup releases the stalled browser");
-    assert!(
-        !matches!(first, Some(Ok(ClientMessage::Binary(_)))),
-        "the stalled send is canceled before peer reads can release it"
-    );
-}
diff --git a/crates/workshop/server/tests/it/realtime_relay/protocol.rs b/crates/workshop/server/tests/it/realtime_relay/protocol.rs
deleted file mode 100644
index 57b730134..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/protocol.rs
+++ /dev/null
@@ -1,44 +0,0 @@
-//! The relay's close frames in both directions.
-
-use super::*;
-
-#[tokio::test]
-async fn gateway_close_code_and_reason_reach_the_browser() {
-    let gateway = spawn_gateway(Router::new().route("/v1/realtime", get(upstream_close))).await;
-    let server = TestServer::spawn(&gateway);
-    let (mut socket, _) =
-        tokio_tungstenite::connect_async(server.ws_url("/v1/realtime?intent=transcription"))
-            .await
-            .expect("the Workshop Realtime socket upgrades");
-    let ClientMessage::Close(Some(close)) = recv(&mut socket).await else {
-        panic!("the upstream close frame is relayed");
-    };
-    assert_eq!(u16::from(close.code), 4101);
-    assert_eq!(close.reason, "upstream finished");
-}
-
-#[tokio::test]
-async fn browser_close_code_and_reason_reach_the_gateway() {
-    let (gateway, probe) = spawn_probe().await;
-    let server = TestServer::spawn(&gateway);
-    let (mut socket, _) =
-        tokio_tungstenite::connect_async(server.ws_url("/v1/realtime?intent=transcription"))
-            .await
-            .expect("the Workshop Realtime socket upgrades");
-    socket
-        .send(ClientMessage::Close(Some(
-            tokio_tungstenite::tungstenite::protocol::CloseFrame {
-                code: 4201.into(),
-                reason: "browser finished".into(),
-            },
-        )))
-        .await
-        .expect("the browser close sends");
-    tokio::time::timeout(RECV_TIMEOUT, probe.close_seen.notified())
-        .await
-        .expect("the gateway receives the close");
-    assert_eq!(
-        probe.browser_close(),
-        Some((4201, "browser finished".to_owned()))
-    );
-}
diff --git a/crates/workshop/server/tests/it/realtime_relay/recovery.rs b/crates/workshop/server/tests/it/realtime_relay/recovery.rs
deleted file mode 100644
index 909e82fe3..000000000
--- a/crates/workshop/server/tests/it/realtime_relay/recovery.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-//! A failed Gateway connect answers 502, and the browser's retry reaches
-//! the replacement Gateway.
-
-use super::*;
-
-#[tokio::test]
-async fn browser_realtime_retry_reaches_the_new_port_and_key_without_workshop_reload() {
-    let server = TestServer::spawn("http://127.0.0.1:1");
-    let url = server.ws_url("/v1/realtime?intent=transcription");
-    assert_eq!(
-        rejected_status(request_with(&url, None, None)).await,
-        StatusCode::BAD_GATEWAY,
-        "the dead original sidecar produces the recoverable handshake failure"
-    );
-
-    let replacement =
-        spawn_gateway(Router::new().route("/v1/realtime", get(recovered_upstream))).await;
-    server.replace_gateway(&replacement, "replacement-key");
-
-    let (mut socket, response) = tokio_tungstenite::connect_async(request_with(&url, None, None))
-        .await
-        .expect("the browser retry upgrades through the same Workshop server");
-    assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
-    let ClientMessage::Text(created) = recv(&mut socket).await else {
-        panic!("the replacement readiness frame stays text");
-    };
-    assert_eq!(
-        serde_json::from_str::<serde_json::Value>(&created).expect("readiness parses")["type"],
-        "session.created"
-    );
-    let ClientMessage::Text(updated) = recv(&mut socket).await else {
-        panic!("the replacement negotiation frame stays text");
-    };
-    assert_eq!(
-        serde_json::from_str::<serde_json::Value>(&updated).expect("negotiation parses")["type"],
-        "session.updated"
-    );
-}
diff --git a/crates/workshop/server/tests/it/std_real_directory.rs b/crates/workshop/server/tests/it/std_real_directory.rs
deleted file mode 100644
index 06a37bc82..000000000
--- a/crates/workshop/server/tests/it/std_real_directory.rs
+++ /dev/null
@@ -1,177 +0,0 @@
-//! The `std` file tools over a real directory, mounted with
-//! `RealBackend::rooted`: the acceptance flow a coding agent follows. List
-//! the directory, find a word with Grep, read a window of the file, and read
-//! the next window from the offset the first window's trailer names.
-//!
-//! The tools come from the std Plugin's dynamic library, loaded from a
-//! Plugin directory as the server loads it, so each call crosses the C
-//! contract and each read goes through the loader's file functions to the
-//! real backend.
-
-use std::future::Future;
-use std::pin::pin;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::task::{Context, Poll, Waker};
-
-use runvil::effect::{ToolCallOrigin, ToolCaller};
-use runvil::harness::{PluginReport, insert_plugin_dir};
-use runvil::plugin::{Pack, PackRegistry, ToolContext};
-use runvil::vfs::{Access, Origin, RealBackend, VfsRef};
-use runvil::{OutputTrust, ToolId, ToolOutput};
-use serde_json::{Value, json};
-
-use crate::common::plugin_dir;
-
-/// The file the flow runs over.
-const FILE: &str = "big.txt";
-
-/// How many lines the file has.
-const LINES: usize = 5000;
-
-/// The line that holds the word Grep finds.
-const NEEDLE_LINE: usize = 3000;
-
-/// The word only that line holds.
-const NEEDLE: &str = "needleword";
-
-/// The first line the second window starts at, which is the line after the
-/// last one a 100,000-byte window of 48-byte numbered lines holds.
-const SECOND_OFFSET: usize = 2084;
-
-/// Counts the directories this process has made, so two tests never share
-/// one.
-static DIRECTORIES: AtomicUsize = AtomicUsize::new(0);
-
-/// A directory named from the test, the process id, and a counter, holding
-/// the file the flow reads.
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// their helpers; failing the test by panicking with the invariant named
-// is exactly what this is for.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-fn seeded_directory() -> tempfile::TempDir {
-    let name = format!(
-        "std-real-directory-{}-{}-",
-        std::process::id(),
-        DIRECTORIES.fetch_add(1, Ordering::Relaxed)
-    );
-    let directory = tempfile::Builder::new()
-        .prefix(&name)
-        .tempdir()
-        .expect("a temporary directory is made");
-    let mut text = String::new();
-    for number in 1..=LINES {
-        if number == NEEDLE_LINE {
-            text.push_str(NEEDLE);
-            text.push_str(&"x".repeat(40 - NEEDLE.len()));
-        } else {
-            text.push_str(&"x".repeat(40));
-        }
-        text.push('\n');
-    }
-    std::fs::write(directory.path().join(FILE), text).expect("the file is written");
-    directory
-}
-
-/// One run's instance of the Pack `runvil/std`, made by the std Plugin's
-/// library, loaded from the Plugin directory the tests share. The report
-/// keeps the Plugin loaded, so it comes back with the Pack.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-fn std_pack() -> (Arc<dyn Pack>, PluginReport) {
-    let mut packs = PackRegistry::new();
-    let report = insert_plugin_dir(&mut packs, &plugin_dir()).expect("the directory is read");
-    assert!(report.failures().is_empty(), "{:?}", report.failures());
-    let (_info, id, factory) = packs
-        .into_entries()
-        .find(|(info, _, _)| info.fqn == "runvil/std")
-        .expect("the std Plugin inserts its Pack");
-    let pack = factory
-        .expect("the Pack is usable")
-        .new_pack(&id)
-        .expect("the Pack instance is made");
-    (pack, report)
-}
-
-/// Drives a future to its output, polling again after each `Pending`.
-fn block_on<F: Future>(future: F) -> F::Output {
-    let mut future = pin!(future);
-    let mut cx = Context::from_waker(Waker::noop());
-    loop {
-        if let Poll::Ready(output) = future.as_mut().poll(&mut cx) {
-            return output;
-        }
-    }
-}
-
-/// Calls the tool `segment` of `pack` with `args` over `access`.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-fn call(pack: &dyn Pack, access: &Access, segment: &str, args: Value) -> ToolOutput {
-    let tool = ToolId::parse(&format!("std/{segment}")).expect("a two-segment tool id parses");
-    let origin = ToolCallOrigin::new("Test", ToolCaller::Script);
-    let context = ToolContext::new(&tool, access, &origin);
-    block_on(pack.call(context, args)).expect("the call succeeds")
-}
-
-#[test]
-fn list_find_read_a_window_and_read_the_next_one_by_the_trailer_offset() {
-    let directory = seeded_directory();
-    let backend = RealBackend::rooted(directory.path()).expect("the directory mounts");
-    let vfs = VfsRef::builder().mount("/", backend).build();
-    let access = vfs
-        .acquire(Origin::new("std real directory"))
-        .expect("the run acquires the filesystem");
-    let (pack, _report) = std_pack();
-
-    let listing = call(&*pack, &access, "dir", json!({ "target_directory": "/" }));
-    assert_eq!(listing.trust(), OutputTrust::Untrusted);
-    assert_eq!(listing.text(), format!("/\n  - {FILE}"));
-
-    let found = call(&*pack, &access, "grep", json!({ "pattern": NEEDLE }));
-    assert_eq!(found.trust(), OutputTrust::Untrusted);
-    let expected_line = format!("  {NEEDLE_LINE}:{NEEDLE}{}", "x".repeat(40 - NEEDLE.len()));
-    assert_eq!(found.text(), format!("/{FILE}\n{expected_line}"));
-
-    let path = format!("/{FILE}");
-    let first = call(&*pack, &access, "read", json!({ "path": path }));
-    assert_eq!(first.trust(), OutputTrust::Untrusted);
-    assert!(
-        first
-            .text()
-            .starts_with(&format!("     1|{}\n", "x".repeat(40))),
-        "the first window starts at line 1"
-    );
-    let trailer = first
-        .text()
-        .lines()
-        .last()
-        .expect("a first window has a last line");
-    assert!(
-        trailer.contains(&format!("Use offset={SECOND_OFFSET} to continue.")),
-        "{trailer}"
-    );
-
-    let second = call(
-        &*pack,
-        &access,
-        "read",
-        json!({ "path": path, "offset": SECOND_OFFSET }),
-    );
-    assert!(
-        second.text().starts_with(&format!("  {SECOND_OFFSET}|")),
-        "the second window starts at the offset the trailer named: {}",
-        &second.text()[..20]
-    );
-    assert!(
-        second.text().contains(&format!("  {NEEDLE_LINE}|{NEEDLE}")),
-        "the second window holds the line Grep found"
-    );
-}
diff --git a/crates/workshop/server/tests/it/user_state.rs b/crates/workshop/server/tests/it/user_state.rs
deleted file mode 100644
index 1acc29d42..000000000
--- a/crates/workshop/server/tests/it/user_state.rs
+++ /dev/null
@@ -1,118 +0,0 @@
-//! The user-state bucket end to end: `/user/state` is mounted through the
-//! registry, a fresh state directory answers all null and gains no file,
-//! and a value put into one server is served by a second server booted
-//! over the same state directory - the relaunch the bucket exists for.
-
-use axum::Router;
-use axum::http::StatusCode;
-
-use crate::common::{TestServer, spawn_gateway};
-
-/// The state file the user bucket persists to.
-const USER_STATE_FILE: &str = "ui-state.json";
-
-/// `GET /user/state` on `server`, parsed.
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// their helpers; failing the test by panicking with the invariant named
-// is exactly what this is for.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-async fn get_state(client: &reqwest::Client, server: &TestServer) -> serde_json::Value {
-    let response = client
-        .get(server.http_url("/user/state"))
-        .send()
-        .await
-        .expect("the route answers");
-    assert_eq!(response.status(), StatusCode::OK);
-    response.json().await.expect("the body is JSON")
-}
-
-#[tokio::test]
-async fn a_fresh_state_dir_answers_all_null_and_gains_no_file() {
-    let gateway = spawn_gateway(Router::new()).await;
-    let server = TestServer::spawn(&gateway);
-    let client = reqwest::Client::new();
-
-    let state = get_state(&client, &server).await;
-
-    assert_eq!(
-        state,
-        serde_json::json!({
-            "editor_settings": null,
-            "zoom": null,
-            "recent_files": null,
-            "commands_history": null,
-        }),
-        "every allow-listed key is present and null on a fresh state directory"
-    );
-    assert!(
-        !server.state_dir().join(USER_STATE_FILE).exists(),
-        "boot and a read create no state file"
-    );
-}
-
-#[tokio::test]
-async fn a_put_survives_a_relaunch_over_the_same_state_dir() {
-    let gateway = spawn_gateway(Router::new()).await;
-    let first = TestServer::spawn(&gateway);
-    let client = reqwest::Client::new();
-
-    let response = client
-        .put(first.http_url("/user/state/zoom"))
-        .header("content-type", "application/json")
-        .body("1.5")
-        .send()
-        .await
-        .expect("the route answers");
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        response
-            .json::<serde_json::Value>()
-            .await
-            .expect("the body is JSON"),
-        serde_json::json!({ "saved": true })
-    );
-    assert_eq!(
-        get_state(&client, &first).await["zoom"],
-        serde_json::json!(1.5)
-    );
-
-    let state_dir = first.shutdown_keeping_state_dir();
-    let second = TestServer::spawn_in(&gateway, state_dir);
-
-    let state = get_state(&client, &second).await;
-    assert_eq!(
-        state["zoom"],
-        serde_json::json!(1.5),
-        "the second launch reads what the first one stored"
-    );
-    assert_eq!(
-        state["editor_settings"],
-        serde_json::Value::Null,
-        "a key never put stays null across the relaunch"
-    );
-}
-
-#[tokio::test]
-async fn a_refused_put_answers_the_envelope_through_the_full_router() {
-    let gateway = spawn_gateway(Router::new()).await;
-    let server = TestServer::spawn(&gateway);
-    let client = reqwest::Client::new();
-
-    let response = client
-        .put(server.http_url("/user/state/layout"))
-        .header("content-type", "application/json")
-        .body("{}")
-        .send()
-        .await
-        .expect("the route answers");
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    let json: serde_json::Value = response.json().await.expect("the body is JSON");
-    assert_eq!(
-        json["error"]["code"], "user_state_key",
-        "the crate's own envelope reaches the wire through the server's router"
-    );
-}
diff --git a/crates/workshop/server/tests/it/workshop_socket.rs b/crates/workshop/server/tests/it/workshop_socket.rs
deleted file mode 100644
index 3e1c4466b..000000000
--- a/crates/workshop/server/tests/it/workshop_socket.rs
+++ /dev/null
@@ -1,113 +0,0 @@
-//! Characterization tests for the `/ws` workshop socket: the boot
-//! snapshots (status, catalog, workbench), the unsolicited status frames
-//! sent on the socket, and the Model-menu events, pinned end to end.
-//!
-//! The root holds the shared test fixtures - mock gateways, the server
-//! fixture, frame readers - and each child module pins one behavior area
-//! of the socket.
-
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// the helpers they share; failing a test by panicking with the invariant
-// named is exactly what these are for.
-#![expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-
-mod menu;
-mod status;
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::time::Duration;
-
-use axum::extract::State;
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use futures_util::StreamExt as _;
-use tokio_tungstenite::tungstenite;
-
-use workshop_server::AppState;
-
-use crate::common::{spawn_router, test_config};
-
-const CATALOG: &str =
-    r#"{"object":"list","data":[{"id":"test-model","object":"model","owned_by":"runvil"}]}"#;
-
-/// A mock `/health` whose answer flips under test control.
-async fn flippable_health(State(healthy): State<Arc<AtomicBool>>) -> Response {
-    if healthy.load(Ordering::Relaxed) {
-        StatusCode::OK.into_response()
-    } else {
-        StatusCode::SERVICE_UNAVAILABLE.into_response()
-    }
-}
-
-/// A static mock catalog for the reconnect push test.
-async fn mock_models() -> Response {
-    ([(header::CONTENT_TYPE, "application/json")], CATALOG).into_response()
-}
-
-/// Binds the workshop router against the gateway at `base_url` on a
-/// free loopback port and returns the `/ws` URL, the tempdir keeping
-/// the state directory alive, and a handle on the shared state (for
-/// poking the status and catalog buses directly).
-async fn spawn_session_server(base_url: &str) -> (String, tempfile::TempDir, AppState) {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let (state, base) = spawn_router(&test_config(base_url, state_dir.path())).await;
-    (format!("{base}/ws"), state_dir, state)
-}
-
-/// Reads one text frame from the client socket and parses it as JSON.
-async fn read_frame<S>(socket: &mut S) -> serde_json::Value
-where
-    S: futures_util::Stream<Item = Result<tungstenite::Message, tungstenite::Error>> + Unpin,
-{
-    let message = socket
-        .next()
-        .await
-        .expect("a frame follows")
-        .expect("the frame is not a socket error");
-    let text = message.into_text().expect("the frame is text");
-    serde_json::from_str(&text).expect("the frame is JSON")
-}
-
-/// Reads frames until one arrives that is not a status update. Status
-/// frames are unsolicited - the snapshot on connect, then bus pushes
-/// that may interleave with replies at any point - so reply assertions
-/// skip them.
-async fn read_non_status_frame<S>(socket: &mut S) -> serde_json::Value
-where
-    S: futures_util::Stream<Item = Result<tungstenite::Message, tungstenite::Error>> + Unpin,
-{
-    loop {
-        let frame = read_frame(socket).await;
-        if frame["type"] != "status" {
-            return frame;
-        }
-    }
-}
-
-/// Reads frames until `accept` holds, within a generous deadline,
-/// returning every frame read - the accepted one last.
-async fn frames_until<S>(
-    socket: &mut S,
-    accept: impl Fn(&serde_json::Value) -> bool,
-) -> Vec<serde_json::Value>
-where
-    S: futures_util::Stream<Item = Result<tungstenite::Message, tungstenite::Error>> + Unpin,
-{
-    tokio::time::timeout(Duration::from_secs(30), async {
-        let mut frames = Vec::new();
-        loop {
-            let frame = read_frame(socket).await;
-            let found = accept(&frame);
-            frames.push(frame);
-            if found {
-                return frames;
-            }
-        }
-    })
-    .await
-    .expect("the expected frame arrives within the deadline")
-}
diff --git a/crates/workshop/server/tests/it/workshop_socket/menu.rs b/crates/workshop/server/tests/it/workshop_socket/menu.rs
deleted file mode 100644
index 20ecc63d2..000000000
--- a/crates/workshop/server/tests/it/workshop_socket/menu.rs
+++ /dev/null
@@ -1,478 +0,0 @@
-//! Model-menu behavior of the `/ws` workshop socket: `select_model` and
-//! `switch_profile` orchestration, the selection sequence without a
-//! restart, the no-profile selection, and the single-flight refusal. The
-//! sidecar restart sequence sits in the `restart` child, and the
-//! selections that fail before an outcome in the `failures` child.
-
-mod failures;
-mod restart;
-
-use std::sync::{Arc, Mutex};
-
-use axum::Router;
-use axum::http::header;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use futures_util::SinkExt;
-use tokio_tungstenite::tungstenite;
-
-use crate::common::spawn_gateway;
-
-use super::{frames_until, mock_models, spawn_session_server};
-
-/// Every body a recording switch route received, in arrival order.
-type ReceivedBodies = Arc<Mutex<Vec<serde_json::Value>>>;
-
-/// A `/admin/switch-profile` route recording each request body and
-/// answering `{"profile": profile, "restart_required": restart}`.
-fn recording_switch(profile: Option<&'static str>, restart: bool) -> (Router, ReceivedBodies) {
-    let received = ReceivedBodies::default();
-    let sink = Arc::clone(&received);
-    let router = Router::new().route(
-        "/admin/switch-profile",
-        post(move |axum::Json(body): axum::Json<serde_json::Value>| {
-            let sink = Arc::clone(&sink);
-            async move {
-                sink.lock()
-                    .expect("the recorder lock is healthy")
-                    .push(body);
-                axum::Json(serde_json::json!({
-                    "profile": profile,
-                    "restart_required": restart,
-                }))
-            }
-        }),
-    );
-    (router, received)
-}
-
-/// Declines the selection with the gateway's error envelope.
-async fn mock_switch_declined() -> Response {
-    (
-        axum::http::StatusCode::BAD_REQUEST,
-        axum::Json(serde_json::json!({
-            "error": {"message": "profile \"beta\" is not defined", "code": "switch_failed"}
-        })),
-    )
-        .into_response()
-}
-
-/// The profile endpoints the switch task's refetch hits, reporting
-/// `active` (`null` for none) as the served profile.
-fn profile_routes(active: Option<&'static str>) -> Router {
-    Router::new()
-        .route(
-            "/admin/profiles",
-            get(|| async {
-                (
-                    [(header::CONTENT_TYPE, "application/json")],
-                    r#"{"profiles":["main","beta"]}"#,
-                )
-            }),
-        )
-        .route(
-            "/admin/status",
-            get(move || async move { axum::Json(serde_json::json!({"profile": active})) }),
-        )
-        .route("/v1/models", get(mock_models))
-}
-
-/// The `(label, description)` of every busy status frame in `frames`, in
-/// order: the frames that hold the status bar's barberpole up.
-fn busy_frames(frames: &[serde_json::Value]) -> Vec<(String, String)> {
-    frames
-        .iter()
-        .filter(|frame| frame["type"] == "status" && frame["busy"] == true)
-        .map(|frame| {
-            (
-                frame["label"]
-                    .as_str()
-                    .expect("a busy frame has a label")
-                    .to_string(),
-                frame["description"]
-                    .as_str()
-                    .expect("a busy frame has a description")
-                    .to_string(),
-            )
-        })
-        .collect()
-}
-
-/// The one busy frame a switch to `name` pushes at its start.
-fn switching(name: &str) -> (String, String) {
-    (
-        "Switching profile...".to_string(),
-        format!("switching to {name}"),
-    )
-}
-
-/// Connects to the `/ws` socket at `url`, sends a switch to `beta` that
-/// must fail, and returns the failure status and the restored workbench
-/// snapshot once both have arrived.
-async fn failed_switch_frames(url: &str) -> (serde_json::Value, serde_json::Value) {
-    let (mut socket, _) = tokio_tungstenite::connect_async(url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"] == "beta"
-    })
-    .await;
-    let mut frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "status" && frame["label"] == "Profile switch failed"
-    })
-    .await;
-    let failure = frames.last().expect("the failure status is last").clone();
-    assert_eq!(failure["severity"], "error");
-
-    // The restored snapshot and the failure status are sent on different
-    // buses, so their wire order is not pinned; read on if needed.
-    let is_restored =
-        |frame: &serde_json::Value| frame["type"] == "workbench" && frame["switching"].is_null();
-    if !frames.iter().any(is_restored) {
-        frames.extend(frames_until(&mut socket, is_restored).await);
-    }
-    let restored = frames
-        .iter()
-        .find(|frame| is_restored(frame))
-        .expect("the restored snapshot was pushed")
-        .clone();
-    assert_eq!(
-        restored["switch_in_flight"], false,
-        "the failed switch clears the in-flight mark: {restored}"
-    );
-    socket.close(None).await.expect("close the socket");
-    (failure, restored)
-}
-
-#[tokio::test]
-async fn a_select_model_event_round_trips_and_refusals_answer_errors() {
-    let (url, _state_dir, state) = spawn_session_server("http://127.0.0.1:1").await;
-    state
-        .catalog()
-        .publish(vec![serde_json::json!({"id": "test-model"})]);
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let select = serde_json::json!({"type": "select_model", "model": "test-model"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(select.into()))
-        .await
-        .expect("the select frame is sent");
-    let frames = frames_until(&mut socket, |frame| frame["type"] == "workbench").await;
-    let published = frames.last().expect("the accepted frame is last");
-    assert_eq!(
-        published["selected"], "test-model",
-        "the selection round-trips as a workbench push"
-    );
-
-    let unknown =
-        serde_json::json!({"type": "select_model", "model": "bogus", "id": 3}).to_string();
-    socket
-        .send(tungstenite::Message::Text(unknown.into()))
-        .await
-        .expect("the select frame is sent");
-    let frames = frames_until(&mut socket, |frame| frame["type"] == "error").await;
-    let refusal = frames.last().expect("the refusal is last");
-    assert_eq!(refusal["id"], 3, "the refusal echoes the event id");
-    assert!(
-        refusal["message"]
-            .as_str()
-            .expect("the refusal names the rule")
-            .contains("unknown model"),
-        "the refusal names the unknown-model rule: {refusal}"
-    );
-
-    let missing = serde_json::json!({"type": "select_model"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(missing.into()))
-        .await
-        .expect("the select frame is sent");
-    let frames = frames_until(&mut socket, |frame| frame["type"] == "error").await;
-    let refusal = frames.last().expect("the refusal is last");
-    assert!(
-        refusal["message"]
-            .as_str()
-            .expect("the refusal names the field")
-            .contains("model"),
-        "a field-less select is refused, not fatal: {refusal}"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_selection_served_without_a_restart_completes_after_one_step() {
-    let (switch, received) = recording_switch(Some("beta"), false);
-    let base_url = spawn_gateway(switch.merge(profile_routes(Some("beta")))).await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    // Readiness needs a non-empty catalog and reachability; seed both
-    // so the settled snapshot recomputes chat_ready to true. The seed
-    // matches the refetched catalog so the reconcile stays a no-op.
-    state.catalog().publish(vec![serde_json::json!(
-        {"id": "test-model", "object": "model", "owned_by": "runvil"}
-    )]);
-    state.menu().set_gateway_reachable(true);
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    let frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"].is_null() && frame["active"] == "beta"
-    })
-    .await;
-
-    let pending = frames
-        .iter()
-        .find(|frame| frame["type"] == "workbench" && frame["switching"] == "beta")
-        .expect("the pending snapshot was pushed before the settle");
-    assert_eq!(
-        pending["chat_ready"], false,
-        "a switch in flight blocks chat: {pending}"
-    );
-    assert_eq!(
-        pending["switch_in_flight"], true,
-        "the pending snapshot marks the switch in flight: {pending}"
-    );
-    assert_eq!(
-        busy_frames(&frames),
-        [switching("\"beta\"")],
-        "the switch holds the bar busy once, from its start until it settles"
-    );
-    assert_eq!(
-        received
-            .lock()
-            .expect("the recorder lock is healthy")
-            .as_slice(),
-        [serde_json::json!({"name": "beta"})],
-        "the selection reaches the gateway as its name"
-    );
-    assert!(
-        frames.iter().any(|frame| frame["type"] == "models"),
-        "the refetched catalog arrives as a models frame: {frames:?}"
-    );
-
-    let settled = frames.last().expect("the settled snapshot is last");
-    assert_eq!(
-        settled["selected"], "test-model",
-        "the settled snapshot selects the profile's model"
-    );
-    assert_eq!(
-        settled["chat_ready"], true,
-        "readiness recomputes once the switch settles"
-    );
-    assert_eq!(
-        settled["switch_in_flight"], false,
-        "the settled snapshot clears the in-flight mark"
-    );
-    assert_eq!(
-        settled["profiles"],
-        serde_json::json!(["main", "beta"]),
-        "the refetched profile list appears in the snapshot"
-    );
-
-    // The idle push follows the settle; it may already have arrived
-    // interleaved with the frames above.
-    if !frames
-        .iter()
-        .any(|frame| frame["type"] == "status" && frame["label"] == "Ready")
-    {
-        frames_until(&mut socket, |frame| {
-            frame["type"] == "status" && frame["label"] == "Ready"
-        })
-        .await;
-    }
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_null_name_selects_no_profile_and_converges_on_a_null_active_profile() {
-    let (switch, received) = recording_switch(None, false);
-    let base_url = spawn_gateway(switch.merge(profile_routes(None))).await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    state.catalog().publish(vec![serde_json::json!(
-        {"id": "test-model", "object": "model", "owned_by": "runvil"}
-    )]);
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": null}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    // The pending snapshot names no target for a switch to no profile;
-    // `switch_in_flight` is what marks it as running.
-    let pending = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switch_in_flight"] == true
-    })
-    .await;
-    let pending = pending.last().expect("the pending snapshot is last");
-    assert_eq!(
-        pending["switching"],
-        serde_json::Value::Null,
-        "a switch to no profile names no target: {pending}"
-    );
-    assert_eq!(
-        pending["chat_ready"], false,
-        "a switch in flight blocks chat: {pending}"
-    );
-    let frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["active"].is_null() && frame["chat_ready"] == true
-    })
-    .await;
-
-    assert_eq!(
-        received
-            .lock()
-            .expect("the recorder lock is healthy")
-            .as_slice(),
-        [serde_json::json!({"name": null})],
-        "no profile reaches the gateway as an explicit null"
-    );
-    let settled = frames.last().expect("the settled snapshot is last");
-    assert_eq!(
-        settled["selected"], "test-model",
-        "chat stays usable on the remote catalog with no profile"
-    );
-    assert_eq!(
-        settled["switch_in_flight"], false,
-        "the settled snapshot clears the in-flight mark"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_declined_selection_restores_the_menu_and_reports_the_gateway_message() {
-    let base_url = spawn_gateway(
-        Router::new()
-            .route("/admin/switch-profile", post(mock_switch_declined))
-            // The gateway still serves the previous profile after the
-            // refusal, so its status endpoint keeps naming it.
-            .merge(profile_routes(Some("main"))),
-    )
-    .await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    state.catalog().publish(vec![serde_json::json!(
-        {"id": "test-model", "object": "model", "owned_by": "runvil"}
-    )]);
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    state
-        .menu()
-        .set_selected("test-model")
-        .expect("the id is in the catalog");
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"] == "beta"
-    })
-    .await;
-    let mut frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"].is_null()
-    })
-    .await;
-
-    let restored = frames.last().expect("the restored snapshot is last");
-    assert_eq!(
-        restored["active"], "main",
-        "the previous profile still serves: {restored}"
-    );
-    assert_eq!(
-        restored["selected"], "test-model",
-        "the selection survives the refused switch"
-    );
-    assert_eq!(
-        restored["chat_ready"], true,
-        "readiness returns to its truthful pre-switch state"
-    );
-
-    // The failure status and the restored snapshot are sent on different
-    // buses, so their wire order is not pinned; read on if needed.
-    let is_failure =
-        |frame: &serde_json::Value| frame["type"] == "status" && frame["severity"] == "error";
-    if !frames.iter().any(is_failure) {
-        frames.extend(frames_until(&mut socket, is_failure).await);
-    }
-    let failure = frames
-        .iter()
-        .find(|frame| is_failure(frame))
-        .expect("the failure status was pushed");
-    assert_eq!(failure["label"], "Profile switch failed");
-    assert_eq!(
-        failure["description"], "profile \"beta\" is not defined",
-        "the gateway's own message is reported"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_switch_while_one_runs_is_refused_with_an_error_frame() {
-    let (url, _state_dir, state) = spawn_session_server("http://127.0.0.1:1").await;
-    state
-        .menu()
-        .begin_switch(Some("running"))
-        .expect("no switch is in flight");
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta", "id": 9}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    let frames = frames_until(&mut socket, |frame| frame["type"] == "error").await;
-    let refusal = frames.last().expect("the refusal is last");
-    assert_eq!(refusal["id"], 9, "the refusal echoes the event id");
-    assert!(
-        refusal["message"]
-            .as_str()
-            .expect("the refusal names the rule")
-            .contains("already in progress"),
-        "the refusal names the single-flight rule: {refusal}"
-    );
-
-    let nameless = serde_json::json!({"type": "switch_profile", "id": 10}).to_string();
-    socket
-        .send(tungstenite::Message::Text(nameless.into()))
-        .await
-        .expect("the switch frame is sent");
-    let frames = frames_until(&mut socket, |frame| frame["type"] == "error").await;
-    let refusal = frames.last().expect("the refusal is last");
-    assert_eq!(refusal["id"], 10);
-    assert!(
-        refusal["message"]
-            .as_str()
-            .expect("the refusal names the field")
-            .contains("null for no profile"),
-        "an absent name is refused and the refusal names the null form: {refusal}"
-    );
-    socket.close(None).await.expect("close the socket");
-}
diff --git a/crates/workshop/server/tests/it/workshop_socket/menu/failures.rs b/crates/workshop/server/tests/it/workshop_socket/menu/failures.rs
deleted file mode 100644
index f32f29506..000000000
--- a/crates/workshop/server/tests/it/workshop_socket/menu/failures.rs
+++ /dev/null
@@ -1,65 +0,0 @@
-//! Profile selections that fail before the gateway answers with the
-//! outcome document: a selection lost in transit, and a success answer
-//! this build cannot read. The gateway may still serve after either, so
-//! the menu refetches its state before it settles.
-
-use axum::Router;
-use axum::routing::post;
-
-use crate::common::spawn_gateway;
-
-use super::super::spawn_session_server;
-use super::{failed_switch_frames, profile_routes};
-
-/// Runs a switch from `main` to `beta` against the gateway at
-/// `base_url` and returns the failure status's description and the
-/// settled workbench snapshot.
-async fn failed_switch(base_url: &str) -> (String, serde_json::Value) {
-    let (url, _state_dir, state) = spawn_session_server(base_url).await;
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    let (failure, restored) = failed_switch_frames(&url).await;
-    let description = failure["description"]
-        .as_str()
-        .expect("the failure has a description")
-        .to_owned();
-    (description, restored)
-}
-
-#[tokio::test]
-async fn a_selection_lost_in_transit_fails_with_the_transport_error() {
-    // Nothing listens on the discard port, so the selection never lands
-    // and the refetch finds no profile to restore.
-    let (description, restored) = failed_switch("http://127.0.0.1:1").await;
-    assert_eq!(description, "gateway transport error");
-    assert_eq!(
-        restored["profiles"],
-        serde_json::json!([]),
-        "the menu shows what the refetch found, not a stale list: {restored}"
-    );
-}
-
-#[tokio::test]
-async fn an_unrecognized_success_answer_fails_the_switch() {
-    let base_url = spawn_gateway(
-        Router::new()
-            .route(
-                "/admin/switch-profile",
-                post(|| async { "switched, probably" }),
-            )
-            .merge(profile_routes(Some("main"))),
-    )
-    .await;
-    let (description, restored) = failed_switch(&base_url).await;
-    assert_eq!(
-        description,
-        "malformed gateway answer: the switch-profile answer is not the outcome document"
-    );
-    assert_eq!(
-        restored["active"], "main",
-        "the menu keeps the profile the gateway still serves: {restored}"
-    );
-}
diff --git a/crates/workshop/server/tests/it/workshop_socket/menu/restart.rs b/crates/workshop/server/tests/it/workshop_socket/menu/restart.rs
deleted file mode 100644
index 2459081b3..000000000
--- a/crates/workshop/server/tests/it/workshop_socket/menu/restart.rs
+++ /dev/null
@@ -1,453 +0,0 @@
-//! The sidecar restart sequence of a `switch_profile` event: a selection
-//! the gateway must restart to load shuts the supervised sidecar down,
-//! waits for the supervisor's replacement generation, and refreshes
-//! through it; a LAN gateway settles with the restart notice instead;
-//! a replacement that never appears fails within the bound.
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::time::Duration;
-
-use axum::Router;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use futures_util::SinkExt;
-use tokio_tungstenite::tungstenite;
-
-use workshop_server::fixtures::{
-    ValidatedGateway, gateway_updater, replace_gateway, run_validated_gateway_fixture_process,
-    state_with_gateway, state_with_gateway_and_restart_bound,
-};
-use workshop_server::{AppState, ResolvedGateway};
-
-use crate::common::{serve_router, spawn_gateway, test_config};
-
-use super::super::{frames_until, spawn_session_server};
-use super::{busy_frames, failed_switch_frames, profile_routes, recording_switch, switching};
-
-/// The bearer the sidecar fixture expects and the workshop presents.
-const SIDECAR_KEY: &str = "sidecar-key";
-
-/// How long the fixture may take to report the shutdown request.
-const SHUTDOWN_OBSERVATION: Duration = Duration::from_secs(10);
-
-/// The named child-process half of [`ValidatedGateway`]: the fixture
-/// spawns a copy of this test binary with this test's name, which
-/// `spawn_sidecar_server` derives from this module's path.
-#[test]
-#[ignore = "runs only as a named child process"]
-fn validated_gateway_fixture_process() {
-    run_validated_gateway_fixture_process();
-}
-
-/// A gateway API mock that dies with the switch: the selection answers
-/// `restart_required: true` and flips `dead`, after which every other
-/// route answers 503, so a catalog or status read against the old
-/// generation after the shutdown would fail loudly.
-fn dying_sidecar_api() -> Router {
-    let dead = Arc::new(AtomicBool::new(false));
-    let unless_dead = |dead: &Arc<AtomicBool>, body: serde_json::Value| -> Response {
-        if dead.load(Ordering::Relaxed) {
-            StatusCode::SERVICE_UNAVAILABLE.into_response()
-        } else {
-            axum::Json(body).into_response()
-        }
-    };
-    let on_switch = Arc::clone(&dead);
-    let on_status = Arc::clone(&dead);
-    let on_profiles = Arc::clone(&dead);
-    let on_models = Arc::clone(&dead);
-    Router::new()
-        .route(
-            "/admin/switch-profile",
-            post(move || {
-                let dead = Arc::clone(&on_switch);
-                async move {
-                    dead.store(true, Ordering::Relaxed);
-                    axum::Json(serde_json::json!({"profile": "beta", "restart_required": true}))
-                }
-            }),
-        )
-        .route(
-            "/admin/status",
-            get(move || {
-                let dead = Arc::clone(&on_status);
-                async move { unless_dead(&dead, serde_json::json!({"profile": "main"})) }
-            }),
-        )
-        .route(
-            "/admin/profiles",
-            get(move || {
-                let dead = Arc::clone(&on_profiles);
-                async move { unless_dead(&dead, serde_json::json!({"profiles": ["main", "beta"]})) }
-            }),
-        )
-        .route(
-            "/v1/models",
-            get(move || {
-                let dead = Arc::clone(&on_models);
-                async move {
-                    unless_dead(
-                        &dead,
-                        serde_json::json!({"object": "list", "data": [
-                            {"id": "model-before-restart", "object": "model"}
-                        ]}),
-                    )
-                }
-            }),
-        )
-}
-
-/// The relaunched sidecar's API: it serves `beta` and a catalog that
-/// only it can have produced.
-fn relaunched_sidecar_api() -> Router {
-    Router::new()
-        .route(
-            "/admin/status",
-            get(|| async { axum::Json(serde_json::json!({"profile": "beta"})) }),
-        )
-        .route(
-            "/admin/profiles",
-            get(|| async { axum::Json(serde_json::json!({"profiles": ["main", "beta"]})) }),
-        )
-        .route(
-            "/v1/models",
-            get(|| async {
-                axum::Json(serde_json::json!({"object": "list", "data": [
-                    {"id": "model-after-restart", "object": "model"}
-                ]}))
-            }),
-        )
-}
-
-/// A workshop server whose gateway snapshot is a supervised sidecar: the
-/// validated identity (shutdown authority) is the named fixture process,
-/// and the API surface is the mock at `api_url`. Returns the `/ws` URL,
-/// the state directory, the shared state, and the fixture for shutdown
-/// observation.
-async fn spawn_sidecar_server(
-    api_url: &str,
-    restart_bound: Option<Duration>,
-) -> (String, tempfile::TempDir, AppState, ValidatedGateway) {
-    // libtest names a test by its path below the crate root, so the
-    // binary's own name (`it`) is dropped from `module_path!()`.
-    let module = module_path!()
-        .split_once("::")
-        .map_or(module_path!(), |(_, rest)| rest);
-    let gateway = ValidatedGateway::spawn_in(
-        SIDECAR_KEY,
-        &format!("{module}::validated_gateway_fixture_process"),
-    );
-    let identity = gateway.validate(SIDECAR_KEY, 1_778_000_001, "2026-09-15T18:00:01Z");
-    let resolved = ResolvedGateway::from_validated(identity).with_base_url(api_url);
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let mut config = test_config(api_url, state_dir.path());
-    config.gateway.api_key = SIDECAR_KEY.to_string();
-    let state = match restart_bound {
-        Some(bound) => state_with_gateway_and_restart_bound(&config, &resolved, bound),
-        None => state_with_gateway(&config, &resolved),
-    }
-    .expect("state builds in tests");
-    let base = serve_router(&state).await;
-    (format!("{base}/ws"), state_dir, state, gateway)
-}
-
-/// Waits off the executor for the fixture to report the shutdown
-/// request, handing the fixture back.
-async fn observe_shutdown(mut gateway: ValidatedGateway) -> (ValidatedGateway, bool) {
-    tokio::task::spawn_blocking(move || {
-        let hit = gateway.received_shutdown(SHUTDOWN_OBSERVATION);
-        (gateway, hit)
-    })
-    .await
-    .expect("the observation thread completes")
-}
-
-#[tokio::test]
-async fn a_sidecar_restart_climbs_the_ladder_and_refreshes_through_the_replacement() {
-    let dying_url = spawn_gateway(dying_sidecar_api()).await;
-    let (url, _state_dir, state, gateway) = spawn_sidecar_server(&dying_url, None).await;
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    // The pending snapshot and the busy frame both precede the shutdown;
-    // the shutdown observation below is the sync point for the restart.
-    let mut frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"] == "beta"
-    })
-    .await;
-    let pending = frames.last().expect("the pending snapshot was pushed");
-    assert_eq!(
-        pending["switch_in_flight"], true,
-        "the switch is marked in flight while the sequence runs: {pending}"
-    );
-
-    let (_gateway, shutdown_hit) = observe_shutdown(gateway).await;
-    assert!(
-        shutdown_hit,
-        "the sequence posts the authenticated shutdown to the sidecar identity"
-    );
-
-    // The supervisor's relaunch: a higher generation at a different
-    // port, serving the selected profile.
-    let relaunched_url = spawn_gateway(relaunched_sidecar_api()).await;
-    assert_ne!(
-        relaunched_url, dying_url,
-        "the replacement binds a fresh port"
-    );
-    replace_gateway(&gateway_updater(&state), &relaunched_url, SIDECAR_KEY)
-        .expect("the replacement generation publishes");
-
-    frames.extend(
-        frames_until(&mut socket, |frame| {
-            frame["type"] == "workbench"
-                && frame["switching"].is_null()
-                && frame["active"] == "beta"
-        })
-        .await,
-    );
-    assert_eq!(
-        busy_frames(&frames),
-        [switching("\"beta\"")],
-        "one busy frame holds the bar up across the whole restart sequence"
-    );
-    let catalog = frames
-        .iter()
-        .find(|frame| frame["type"] == "models")
-        .expect("the refetched catalog arrives as a models frame");
-    assert_eq!(
-        catalog["models"],
-        serde_json::json!([{"id": "model-after-restart", "object": "model"}]),
-        "the catalog refresh hits the replacement port, never the dead one"
-    );
-    let settled = frames.last().expect("the settled snapshot is last");
-    assert_eq!(
-        settled["selected"], "model-after-restart",
-        "the settled snapshot selects from the replacement's catalog"
-    );
-    assert_eq!(settled["chat_ready"], true);
-    assert_eq!(
-        settled["switch_in_flight"], false,
-        "the completed switch clears the in-flight mark"
-    );
-    if !frames
-        .iter()
-        .any(|frame| frame["type"] == "status" && frame["label"] == "Ready")
-    {
-        frames_until(&mut socket, |frame| {
-            frame["type"] == "status" && frame["label"] == "Ready"
-        })
-        .await;
-    }
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_replacement_that_never_appears_fails_within_the_bound() {
-    let dying_url = spawn_gateway(dying_sidecar_api()).await;
-    let (url, _state_dir, state, gateway) =
-        spawn_sidecar_server(&dying_url, Some(Duration::from_millis(600))).await;
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    frames_until(&mut socket, |frame| {
-        frame["type"] == "status" && frame["busy"] == true
-    })
-    .await;
-    let (_gateway, shutdown_hit) = observe_shutdown(gateway).await;
-    assert!(shutdown_hit, "the shutdown went out before the wait began");
-
-    let frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "status" && frame["severity"] == "error"
-    })
-    .await;
-    let failure = frames.last().expect("the failure status is last");
-    assert_eq!(failure["label"], "Profile switch failed");
-    assert_eq!(
-        failure["description"], "gateway did not return after restart",
-        "the timeout names the missing replacement"
-    );
-    let restored = frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"].is_null()
-    })
-    .await;
-    let restored = restored.last().expect("the restored snapshot is last");
-    assert_eq!(
-        restored["active"], "main",
-        "the menu keeps the last known profile after a failed restart"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_sidecar_that_cannot_take_its_shutdown_fails_the_switch() {
-    let dying_url = spawn_gateway(dying_sidecar_api()).await;
-    let (url, _state_dir, state, gateway) = spawn_sidecar_server(&dying_url, None).await;
-    // The validated identity outlives its process, so the shutdown
-    // request has no sidecar to reach.
-    drop(gateway);
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    let (failure, restored) = failed_switch_frames(&url).await;
-    assert!(
-        failure["description"]
-            .as_str()
-            .expect("the failure has a description")
-            .starts_with("the gateway did not accept its shutdown request: "),
-        "the failure names the refused shutdown: {failure}"
-    );
-    assert_eq!(
-        restored["active"], "main",
-        "the menu keeps the last known profile after a refused shutdown"
-    );
-}
-
-#[tokio::test]
-async fn a_lan_gateway_that_needs_a_restart_settles_with_the_notice() {
-    let (switch, received) = recording_switch(Some("beta"), true);
-    let base_url = spawn_gateway(switch.merge(profile_routes(Some("main")))).await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    state.catalog().publish(vec![serde_json::json!(
-        {"id": "test-model", "object": "model", "owned_by": "runvil"}
-    )]);
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    state
-        .menu()
-        .set_selected("test-model")
-        .expect("the id is in the catalog");
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": "beta"}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    frames_until(&mut socket, |frame| {
-        frame["type"] == "workbench" && frame["switching"] == "beta"
-    })
-    .await;
-    let mut frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "status" && frame["label"] == "Profile selected"
-    })
-    .await;
-    let notice = frames.last().expect("the notice is last");
-    assert_eq!(
-        notice["description"], "profile \"beta\" selected; restart the gateway to load it",
-        "a gateway the workshop does not supervise is restarted by hand"
-    );
-    assert_eq!(notice["severity"], "info", "the notice is not a failure");
-    assert_eq!(
-        busy_frames(&frames),
-        [switching("\"beta\"")],
-        "the bar goes busy once and the deferred notice ends it"
-    );
-    assert_eq!(
-        notice["busy"], false,
-        "the notice is the non-busy frame that rests the bar"
-    );
-    assert_eq!(
-        received.lock().expect("the recorder lock is healthy").len(),
-        1,
-        "the selection was persisted exactly once"
-    );
-    // Every frame read so far follows the pending snapshot, so a settled
-    // snapshot among them is the finish, not the connect-time replay.
-    let is_settled =
-        |frame: &serde_json::Value| frame["type"] == "workbench" && frame["switching"].is_null();
-    if !frames.iter().any(is_settled) {
-        frames.extend(frames_until(&mut socket, is_settled).await);
-    }
-    let settled = frames
-        .iter()
-        .find(|frame| is_settled(frame))
-        .expect("the settled snapshot was pushed");
-    assert_eq!(
-        settled["active"], "main",
-        "the running profile is unchanged until the operator restarts"
-    );
-    assert_eq!(
-        settled["chat_ready"], true,
-        "chat stays usable on the running profile"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_lan_gateway_deferring_no_profile_settles_with_the_unload_notice() {
-    let (switch, received) = recording_switch(None, true);
-    let base_url = spawn_gateway(switch.merge(profile_routes(Some("main")))).await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    state.catalog().publish(vec![serde_json::json!(
-        {"id": "test-model", "object": "model", "owned_by": "runvil"}
-    )]);
-    state.menu().set_gateway_reachable(true);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "beta".to_string()],
-        Some("main".to_string()),
-    );
-    state
-        .menu()
-        .set_selected("test-model")
-        .expect("the id is in the catalog");
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-
-    let switch = serde_json::json!({"type": "switch_profile", "name": null}).to_string();
-    socket
-        .send(tungstenite::Message::Text(switch.into()))
-        .await
-        .expect("the switch frame is sent");
-    let frames = frames_until(&mut socket, |frame| {
-        frame["type"] == "status" && frame["label"] == "Profile selected"
-    })
-    .await;
-    let notice = frames.last().expect("the notice is last");
-    assert_eq!(
-        notice["description"],
-        "no profile selected; restart the gateway to unload the running profile",
-        "the null selection reads as its own sentence, not as a profile named \"no profile\""
-    );
-    assert_eq!(notice["severity"], "info", "the notice is not a failure");
-    assert_eq!(
-        received
-            .lock()
-            .expect("the recorder lock is healthy")
-            .as_slice(),
-        [serde_json::json!({"name": null})],
-        "the null selection reached the gateway exactly once"
-    );
-    socket.close(None).await.expect("close the socket");
-}
diff --git a/crates/workshop/server/tests/it/workshop_socket/status.rs b/crates/workshop/server/tests/it/workshop_socket/status.rs
deleted file mode 100644
index c47ad4664..000000000
--- a/crates/workshop/server/tests/it/workshop_socket/status.rs
+++ /dev/null
@@ -1,289 +0,0 @@
-//! Status and snapshot behavior of the `/ws` workshop socket: status
-//! frames sent on the socket, the retained status, catalog, and workbench
-//! snapshots on connect, the malformed- and unknown-frame refusals, and
-//! the catalog push on reconnect.
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::time::Duration;
-
-use axum::Router;
-use axum::routing::get;
-use futures_util::SinkExt;
-use serde_json::json;
-use tokio_tungstenite::tungstenite;
-
-use workshop_server::fixtures::{
-    Activity, ReconnectBackoff, Severity, StatusBarUpdate, spawn_heartbeat,
-};
-
-use crate::common::{JsonSocket, TestServer, spawn_gateway};
-
-use super::{
-    flippable_health, mock_models, read_frame, read_non_status_frame, spawn_session_server,
-};
-
-#[tokio::test]
-async fn a_new_connection_receives_the_current_status_as_its_first_frame() {
-    // Nothing listens on port 1: after the heartbeat's first probe the
-    // status settles on "Gateway unreachable" and never changes again, so
-    // the frame below is deterministic.
-    let server = TestServer::spawn("http://127.0.0.1:1");
-    let mut witness = JsonSocket::connect(&server.ws_url("/ws")).await;
-    witness
-        .recv_until(Duration::from_secs(10), |frame| {
-            frame["type"] == "status" && frame["label"] == "Gateway unreachable"
-        })
-        .await;
-
-    // The outage predates this connection, so only the retained snapshot
-    // can deliver it here - the contract's resend of the current status
-    // on reconnect.
-    let mut late = JsonSocket::connect(&server.ws_url("/ws")).await;
-    let snapshot = late.recv_json().await;
-    assert_eq!(
-        snapshot,
-        json!({
-            "type": "status",
-            "label": "Gateway unreachable",
-            "description": "the gateway does not answer its health probe",
-            "busy": false,
-            "severity": "info",
-            "activity": "general",
-        }),
-        "the retained status arrives as the connection's first frame"
-    );
-    late.close().await;
-    witness.close().await;
-}
-
-#[tokio::test]
-async fn status_updates_reach_connected_sessions_as_status_frames() {
-    let (url, _state_dir, state) = spawn_session_server("http://127.0.0.1:1").await;
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-    // A malformed frame's error reply proves the session loop is
-    // running (the connect snapshot arrives ahead of it and is skipped).
-    socket
-        .send(tungstenite::Message::Text("not json".into()))
-        .await
-        .expect("the frame is sent");
-    let reply = read_non_status_frame(&mut socket).await;
-    assert_eq!(reply["type"], "error");
-
-    state.status().emit(StatusBarUpdate {
-        label: "Downloading model".to_string(),
-        description: "ggml-large-v3.bin".to_string(),
-        busy: true,
-        severity: Severity::Info,
-        activity: Activity::Generating,
-    });
-
-    let frame = read_frame(&mut socket).await;
-    assert_eq!(
-        frame,
-        serde_json::json!({
-            "type": "status",
-            "label": "Downloading model",
-            "description": "ggml-large-v3.bin",
-            "busy": true,
-            "severity": "info",
-            "activity": "generating",
-        }),
-        "the update arrives as one status frame with the busy flag set"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn an_unknown_frame_type_is_refused_with_an_error_frame() {
-    let (url, _state_dir, _state) = spawn_session_server("http://127.0.0.1:1").await;
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-    // A `chat` frame is an unknown type: the session answers with a
-    // refusal naming the two menu events and survives.
-    let stale = serde_json::json!({
-        "type": "chat",
-        "id": 7,
-        "model": "test-model",
-        "messages": [{"role": "user", "content": "ping"}],
-    })
-    .to_string();
-    socket
-        .send(tungstenite::Message::Text(stale.into()))
-        .await
-        .expect("the frame is sent");
-    let reply = read_non_status_frame(&mut socket).await;
-    assert_eq!(reply["type"], "error");
-    assert_eq!(reply["id"], 7, "the refusal echoes the frame id");
-    let message = reply["message"]
-        .as_str()
-        .expect("the refusal names the accepted frame types");
-    assert!(
-        message.contains("select_model") && message.contains("switch_profile"),
-        "the refusal names the two menu events: {message}"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_new_session_receives_the_retained_status_and_catalog_snapshots() {
-    let (url, _state_dir, state) = spawn_session_server("http://127.0.0.1:1").await;
-    // Both pushes land on the buses while nobody is connected, so only
-    // the retained copies can deliver them to the socket below - the
-    // contract's resend-on-reconnect for ephemeral frames.
-    state.status().emit(StatusBarUpdate {
-        label: "Downloading model".to_string(),
-        description: "ggml-large-v3.bin".to_string(),
-        busy: true,
-        severity: Severity::Info,
-        activity: Activity::Generating,
-    });
-    state.catalog().publish(vec![
-        serde_json::json!({"id": "test-model", "object": "model"}),
-    ]);
-
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-    let first = tokio::time::timeout(Duration::from_secs(10), read_frame(&mut socket))
-        .await
-        .expect("the status snapshot arrives unprompted");
-    assert_eq!(
-        first,
-        serde_json::json!({
-            "type": "status",
-            "label": "Downloading model",
-            "description": "ggml-large-v3.bin",
-            "busy": true,
-            "severity": "info",
-            "activity": "generating",
-        }),
-        "the retained status is the connection's first frame"
-    );
-    let second = tokio::time::timeout(Duration::from_secs(10), read_frame(&mut socket))
-        .await
-        .expect("the catalog snapshot arrives unprompted");
-    assert_eq!(
-        second,
-        serde_json::json!({
-            "type": "models",
-            "models": [{"id": "test-model", "object": "model"}],
-        }),
-        "the retained catalog follows it"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-#[tokio::test]
-async fn a_new_session_receives_the_retained_workbench_snapshot() {
-    let (url, _state_dir, state) = spawn_session_server("http://127.0.0.1:1").await;
-    // Both retained copies exist before anyone connects, so only the
-    // connect-time sends can deliver them below - the boot-with-zero-
-    // HTTP-fetches promise.
-    state
-        .catalog()
-        .publish(vec![serde_json::json!({"id": "test-model"})]);
-    state.menu().set_profiles(
-        vec!["main".to_string(), "coding".to_string()],
-        Some("main".to_string()),
-    );
-
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-    let first = tokio::time::timeout(Duration::from_secs(10), read_frame(&mut socket))
-        .await
-        .expect("the status snapshot arrives unprompted");
-    assert_eq!(first["type"], "status", "the retained status arrives first");
-    let second = tokio::time::timeout(Duration::from_secs(10), read_frame(&mut socket))
-        .await
-        .expect("the catalog snapshot arrives unprompted");
-    assert_eq!(second["type"], "models", "the retained catalog follows");
-    let third = tokio::time::timeout(Duration::from_secs(10), read_frame(&mut socket))
-        .await
-        .expect("the workbench snapshot arrives unprompted");
-    assert_eq!(
-        third,
-        serde_json::json!({
-            "type": "workbench",
-            "profiles": ["main", "coding"],
-            "active": "main",
-            "switching": null,
-            "switch_in_flight": false,
-            "selected": null,
-            "chat_ready": false,
-        }),
-        "the retained workbench snapshot completes the boot state"
-    );
-    socket.close(None).await.expect("close the socket");
-}
-
-// The flip below waits for the heartbeat's observed outage, so the
-// recovery is always a real down-to-up transition and the catalog push
-// always happens; the session's own subscription is live before the
-// flip for the same reason.
-#[tokio::test]
-async fn a_gateway_reconnect_pushes_the_refreshed_catalog_to_sessions() {
-    let healthy = Arc::new(AtomicBool::new(false));
-    let base_url = spawn_gateway(
-        Router::new()
-            .route("/health", get(flippable_health))
-            .route("/v1/models", get(mock_models))
-            .with_state(Arc::clone(&healthy)),
-    )
-    .await;
-    let (url, _state_dir, state) = spawn_session_server(&base_url).await;
-    let heartbeat = spawn_heartbeat(
-        state.gateway_client().clone(),
-        state.push(),
-        state.health().clone(),
-        Duration::from_millis(25),
-        // A fast schedule so the down-phase retry lands within a few
-        // ticks instead of the production seconds.
-        ReconnectBackoff::with_schedule(
-            Duration::from_millis(10),
-            Duration::from_millis(40),
-            Duration::from_secs(60),
-        ),
-    );
-    let (mut socket, _) = tokio_tungstenite::connect_async(&url)
-        .await
-        .expect("connect to /ws");
-    // Hold the flip until the heartbeat's outage reaches this socket
-    // (as the connect snapshot or a live push): the catalog is pushed
-    // only on an observed down-to-up transition, so flipping before
-    // the first probe lands would leave nothing to push.
-    loop {
-        let frame = tokio::time::timeout(Duration::from_secs(30), read_frame(&mut socket))
-            .await
-            .expect("the heartbeat publishes the outage within the deadline");
-        if frame["type"] == "status" && frame["label"] == "Gateway unreachable" {
-            break;
-        }
-    }
-
-    healthy.store(true, Ordering::Relaxed);
-    // Status frames (the "Connected to gateway" transition) interleave
-    // with the push; read until the models frame arrives.
-    let frame = loop {
-        let frame = tokio::time::timeout(Duration::from_secs(30), read_frame(&mut socket))
-            .await
-            .expect("frames keep arriving within the deadline");
-        if frame["type"] == "models" {
-            break frame;
-        }
-    };
-    assert_eq!(
-        frame,
-        serde_json::json!({
-            "type": "models",
-            "models": [{"id": "test-model", "object": "model", "owned_by": "runvil"}],
-        }),
-        "the refreshed catalog arrives as one models frame"
-    );
-    socket.close(None).await.expect("close the socket");
-    heartbeat.shutdown().await;
-}
diff --git a/crates/workshop/server/tests/it/workspace_shutdown.rs b/crates/workshop/server/tests/it/workspace_shutdown.rs
deleted file mode 100644
index 3c240d6f1..000000000
--- a/crates/workshop/server/tests/it/workspace_shutdown.rs
+++ /dev/null
@@ -1,98 +0,0 @@
-//! The workspace file across a graceful shutdown: a quit folds the WAL
-//! into `Name.rvwork` and removes the sidecar, so the folder holds
-//! exactly one file at rest, and a relaunch over the same state
-//! directory reopens it with every grant that was persisted before the
-//! quit.
-
-use axum::Router;
-use axum::http::StatusCode;
-
-use crate::common::{TestServer, spawn_gateway};
-
-/// The sorted names of every entry directly inside `dir`.
-// clippy.toml's allow-expect-in-tests covers #[test] functions only, not
-// their helpers; failing the test by panicking with the invariant named
-// is exactly what these are for.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-fn names_in(dir: &std::path::Path) -> Vec<String> {
-    let mut names: Vec<String> = std::fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-/// `POST path` on `server` with a JSON `{ "path": <target> }` body,
-/// asserting success and returning the parsed answer.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-async fn post_path(
-    client: &reqwest::Client,
-    server: &TestServer,
-    route: &str,
-    target: &std::path::Path,
-) -> serde_json::Value {
-    let response = client
-        .post(server.http_url(route))
-        .json(&serde_json::json!({ "path": target }))
-        .send()
-        .await
-        .expect("the route answers");
-    assert_eq!(response.status(), StatusCode::OK, "{route} succeeds");
-    response.json().await.expect("the body is JSON")
-}
-
-#[tokio::test]
-async fn a_graceful_shutdown_leaves_one_file_that_a_relaunch_reopens() {
-    let gateway = spawn_gateway(Router::new()).await;
-    let first = TestServer::spawn(&gateway);
-    let client = reqwest::Client::new();
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("Name.rvwork");
-
-    let saved = post_path(&client, &first, "/workspace/file/save-as", &file).await;
-    assert_eq!(saved["name"], "Name", "save as switches to the new file");
-    let granted = post_path(&client, &first, "/workspace/grant", root.path()).await;
-    let granted = granted["granted"].clone();
-    assert!(granted.is_string(), "the grant answers its canonical root");
-
-    let state_dir = first.shutdown_keeping_state_dir();
-
-    assert_eq!(
-        names_in(home.path()),
-        ["Name.rvwork"],
-        "a graceful quit folds the WAL in and removes the sidecar"
-    );
-
-    let second = TestServer::spawn_in(&gateway, state_dir);
-    let response = client
-        .get(second.http_url("/workspace/file/current"))
-        .send()
-        .await
-        .expect("the route answers");
-    assert_eq!(response.status(), StatusCode::OK);
-    let current: serde_json::Value = response.json().await.expect("the body is JSON");
-    assert_eq!(
-        current["path"],
-        serde_json::json!(file),
-        "the last-workspace pointer reopens the file"
-    );
-    assert_eq!(
-        current["grants"],
-        serde_json::json!([{ "path": granted, "exists": true }]),
-        "the grant persisted before the quit is in the reopened file"
-    );
-}
diff --git a/crates/workshop/server/tests/it/workspace_timeout.rs b/crates/workshop/server/tests/it/workspace_timeout.rs
deleted file mode 100644
index 6f0e4ad56..000000000
--- a/crates/workshop/server/tests/it/workspace_timeout.rs
+++ /dev/null
@@ -1,57 +0,0 @@
-//! The workspace save deadline through the full server router: a
-//! `PUT /workspace/file` whose write outlasts the default deadline
-//! answers a 408 whose body is the JSON error envelope. The workspace
-//! crate pins the abandoned write landing on a short test deadline; this
-//! test pins that the server mounts the routes under the deadline tier.
-
-use reqwest::StatusCode;
-use workshop_support::{DEADLINE_ELAPSED_CODE, DEFAULT_DEADLINE, deadline_elapsed_message};
-use workshop_workspace::Workspace;
-
-use crate::common::{spawn_router, test_config};
-
-#[tokio::test]
-async fn a_stalled_save_answers_the_json_408_through_the_full_router() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let (state, base) = spawn_router(&test_config("http://127.0.0.1:1", state_dir.path())).await;
-    let workspace = state
-        .registry()
-        .require::<Workspace>()
-        .expect("the workspace is registered");
-    let files = tempfile::TempDir::new().expect("tempdir");
-    let file = files.path().join("note.txt");
-    workspace.grant(files.path()).expect("grant the tempdir");
-    // The write blocks on the blocking pool until released, so the
-    // production deadline elapses first and its 408 is observable.
-    let stall = workspace.stall_next_write_for_test();
-
-    let url = format!("{}/workspace/file", base.replacen("ws://", "http://", 1));
-    let response = reqwest::Client::new()
-        .put(url)
-        .header("content-type", "application/json")
-        .body(serde_json::json!({ "path": file, "text": "late write" }).to_string())
-        .send()
-        .await
-        .expect("the route answers");
-
-    assert_eq!(response.status(), StatusCode::REQUEST_TIMEOUT);
-    assert_eq!(
-        response
-            .headers()
-            .get("content-type")
-            .map(reqwest::header::HeaderValue::as_bytes),
-        Some(b"application/json".as_slice()),
-        "the deadline answers JSON"
-    );
-    let envelope: serde_json::Value = response.json().await.expect("the body is JSON");
-    let expected = serde_json::to_value(workshop_protocol::ErrorEnvelope::new(
-        deadline_elapsed_message(DEFAULT_DEADLINE),
-        DEADLINE_ELAPSED_CODE,
-    ))
-    .expect("the envelope serializes");
-    assert_eq!(envelope, expected, "the 408 body is the wire envelope");
-
-    // Let the abandoned write land before the tempdir goes.
-    stall.release();
-    stall.await_completion();
-}
diff --git a/crates/workshop/status/Cargo.toml b/crates/workshop/status/Cargo.toml
deleted file mode 100644
index 6a6774012..000000000
--- a/crates/workshop/status/Cargo.toml
+++ /dev/null
@@ -1,19 +0,0 @@
-[package]
-name = "workshop-status"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[dependencies]
-tokio.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-support.workspace = true
-
-[dev-dependencies]
-tokio = { workspace = true, features = ["macros", "rt-multi-thread", "test-util"] }
-
-[lints]
-workspace = true
diff --git a/crates/workshop/status/src/handles.rs b/crates/workshop/status/src/handles.rs
deleted file mode 100644
index 4dc5d27a1..000000000
--- a/crates/workshop/status/src/handles.rs
+++ /dev/null
@@ -1,56 +0,0 @@
-//! The status subsystem's registration and any handle types. It
-//! registers the consumer-side push channel every `/ws` session
-//! subscribes through, the producer-side sink same-tier subsystems emit
-//! through, and the bus itself as the subsystem's state handle.
-
-use std::sync::Arc;
-
-use workshop_registry::{
-    Registration, Registry, StatusChannel, StatusChannelAdapter, StatusSink, StatusSinkAdapter,
-};
-
-use crate::StatusBus;
-
-/// The status subsystem's registration guards: the consumer-side push
-/// channel, the producer-side sink, and the bus's state handle. Dropping
-/// them deregisters the subsystem.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the subsystem"]
-pub struct StatusRegistrations {
-    /// The consumer-side push channel every `/ws` session subscribes through.
-    pub channel: Registration,
-    /// The producer-side sink same-tier subsystems emit through.
-    pub sink: Registration,
-    /// The bus itself as the subsystem's state handle.
-    pub state: Registration,
-}
-
-/// Registers the status subsystem into the registry: the consumer-side
-/// push channel every `/ws` session subscribes through, the
-/// producer-side sink same-tier subsystems emit through, and the bus
-/// itself as the subsystem's state handle. The returned guards keep the
-/// registrations alive; the composition root holds them for the process
-/// lifetime.
-pub fn register(registry: &Registry, bus: &StatusBus) -> StatusRegistrations {
-    let channel =
-        registry.register_state::<dyn StatusChannel>(Arc::new(StatusChannelAdapter::new(
-            {
-                let bus = bus.clone();
-                move || bus.subscribe()
-            },
-            {
-                let bus = bus.clone();
-                move || bus.latest()
-            },
-        )));
-    let sink = registry.register_sink::<dyn StatusSink>(Arc::new(StatusSinkAdapter::new({
-        let bus = bus.clone();
-        move |update| bus.emit(update)
-    })));
-    let state = registry.register_state::<StatusBus>(Arc::new(bus.clone()));
-    StatusRegistrations {
-        channel,
-        sink,
-        state,
-    }
-}
diff --git a/crates/workshop/status/src/lib.rs b/crates/workshop/status/src/lib.rs
deleted file mode 100644
index 31858c758..000000000
--- a/crates/workshop/status/src/lib.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-//! workshop-status - the status-bar subsystem: a broadcast bus for
-//! status updates from every subsystem to every connected `/ws` session.
-//! Work in flight reaches the bar as a busy frame pushed by whichever
-//! subsystem owns the work.
-//!
-//! ## Invariants
-//!
-//! - Tier: service; may depend on: `workshop-protocol`, `workshop-registry`,
-//!   `workshop-support`. `cargo test -p build-xtask` enforces the product
-//!   and container boundaries.
-//! - Sending on the bus never blocks: a send with no subscribers is a
-//!   no-op, and a lagging subscriber skips ahead, so instrumenting a hot
-//!   path cannot stall the subsystem it observes.
-//! - The bus retains the newest update, so a session that connects later
-//!   sends the current status immediately - the delivery contract's
-//!   resend-on-reconnect for ephemeral frames.
-//! - The public API is infallible (a send with no subscribers only moves
-//!   the snapshot, and a lagging subscriber skips ahead; neither is an
-//!   error), so the crate has no error type.
-
-pub mod status;
-
-mod handles;
-
-pub use handles::{StatusRegistrations, register};
-pub use status::StatusBus;
diff --git a/crates/workshop/status/src/status.rs b/crates/workshop/status/src/status.rs
deleted file mode 100644
index d8db33b6b..000000000
--- a/crates/workshop/status/src/status.rs
+++ /dev/null
@@ -1,135 +0,0 @@
-//! The status bus: a broadcast bus for status bar updates from every
-//! subsystem to every connected `/ws` session.
-//!
-//! Anything with user-visible latency - startup phases, gateway round
-//! trips, dictation and transcription, model downloads - reports what
-//! it is doing as a [`StatusBarUpdate`]. The bus is a [`RetainedBus`]:
-//! updates fan out to all current subscribers, a send with no
-//! subscribers is a no-op, and a subscriber that falls more than
-//! `STATUS_CHANNEL_CAPACITY` updates behind is told it lagged and resumes
-//! at the oldest retained update. Sending never blocks, so instrumenting a
-//! hot path cannot stall the subsystem it observes.
-//!
-//! On the wire each update is sent on the workshop socket as an unsolicited
-//! `{"type":"status",...}` frame (see [`StatusBarUpdate::frame`]). The
-//! bus also retains the newest update, so a session that connects later
-//! sends the current status immediately - the delivery contract's
-//! resend-on-reconnect for ephemeral frames.
-
-use tokio::sync::broadcast;
-
-use workshop_protocol::StatusBarUpdate;
-use workshop_support::RetainedBus;
-
-/// Ring capacity of the status bus. Covers a startup burst plus an agent
-/// turn's phase transitions with headroom; a receiver lagging past it
-/// skips ahead rather than slowing the senders.
-const STATUS_CHANNEL_CAPACITY: usize = 64;
-
-/// The shared status bus: a cloneable handle onto the broadcast channel.
-///
-/// Clones are cheap (two `Arc` bumps) and all of them send into the same
-/// channel, so subsystems take their own copy rather than a reference.
-#[derive(Debug, Clone)]
-pub struct StatusBus {
-    bus: RetainedBus<StatusBarUpdate>,
-}
-
-impl StatusBus {
-    /// Creates a bus with no subscribers, an empty ring, and no snapshot.
-    #[must_use]
-    pub fn new() -> Self {
-        Self {
-            bus: RetainedBus::new(STATUS_CHANNEL_CAPACITY),
-        }
-    }
-
-    /// Subscribes to every update sent from this call onward.
-    #[must_use]
-    pub fn subscribe(&self) -> broadcast::Receiver<StatusBarUpdate> {
-        self.bus.subscribe()
-    }
-
-    /// The most recently emitted update, retained so a session connecting
-    /// later can send the current status as its snapshot.
-    #[must_use]
-    pub fn latest(&self) -> Option<StatusBarUpdate> {
-        self.bus.latest()
-    }
-
-    /// Broadcasts one update. With no subscribers this is a no-op; a slow
-    /// subscriber skips ahead rather than applying backpressure.
-    pub fn emit(&self, update: StatusBarUpdate) {
-        self.bus.send(update);
-    }
-}
-
-impl Default for StatusBus {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use workshop_protocol::{Activity, Severity};
-
-    /// A non-busy, info-severity update: the tests read the label back,
-    /// so the severity and activity are fixed.
-    fn update(label: &str, description: &str) -> StatusBarUpdate {
-        StatusBarUpdate {
-            label: label.to_owned(),
-            description: description.to_owned(),
-            busy: false,
-            severity: Severity::Info,
-            activity: Activity::General,
-        }
-    }
-
-    #[tokio::test]
-    async fn emitting_with_no_subscribers_is_a_no_op() {
-        let bus = StatusBus::new();
-        bus.emit(update("Ready", "idle"));
-        let mut late = bus.subscribe();
-        assert!(
-            matches!(late.try_recv(), Err(broadcast::error::TryRecvError::Empty)),
-            "an emit with no subscribers queues nothing for a later one"
-        );
-    }
-
-    #[test]
-    fn the_newest_update_is_retained_for_the_connect_snapshot() {
-        let bus = StatusBus::new();
-        assert!(bus.latest().is_none(), "an untouched bus has no snapshot");
-        bus.emit(update("one", ""));
-        bus.emit(update("two", ""));
-        let latest = bus.latest().expect("the bus retains the newest update");
-        assert_eq!(
-            latest.label, "two",
-            "a session connecting now snapshots the newest update"
-        );
-    }
-
-    #[tokio::test]
-    async fn a_lagged_receiver_skips_ahead_instead_of_blocking() {
-        let bus = StatusBus::new();
-        let mut receiver = bus.subscribe();
-        let sent = STATUS_CHANNEL_CAPACITY + 10;
-        for index in 0..sent {
-            // Sends never block, however far behind the receiver is.
-            bus.emit(update(&format!("update {index}"), ""));
-        }
-        let lag = match receiver.recv().await {
-            Err(broadcast::error::RecvError::Lagged(skipped)) => skipped,
-            Ok(got) => panic!("expected a lag report, got {got:?}"),
-            Err(broadcast::error::RecvError::Closed) => panic!("the bus is still open"),
-        };
-        assert_eq!(lag, 10, "the ring retained only its capacity");
-        let resumed = receiver.recv().await.expect("the ring still holds updates");
-        assert_eq!(
-            resumed.label, "update 10",
-            "receiving resumes at the oldest retained update"
-        );
-    }
-}
diff --git a/crates/workshop/status/tests/it/main.rs b/crates/workshop/status/tests/it/main.rs
deleted file mode 100644
index 0352d16a0..000000000
--- a/crates/workshop/status/tests/it/main.rs
+++ /dev/null
@@ -1,71 +0,0 @@
-//! Integration tests for `workshop-status`: the registration contract -
-//! the push channel, the producer sink, and the bus's state handle
-//! served through the registry's contribution collections.
-
-use workshop_protocol::{Activity, Severity, StatusBarUpdate};
-use workshop_registry::{Registry, StatusChannel, StatusSink};
-use workshop_status::{StatusBus, register};
-
-/// A non-busy, info-severity update carrying only a label.
-fn update(label: &str) -> StatusBarUpdate {
-    StatusBarUpdate {
-        label: label.to_owned(),
-        description: String::new(),
-        busy: false,
-        severity: Severity::Info,
-        activity: Activity::General,
-    }
-}
-
-#[tokio::test]
-async fn the_registered_sink_and_channel_serve_the_registered_bus() {
-    let registry = Registry::new();
-    let bus = StatusBus::new();
-    let _guards = register(&registry, &bus);
-
-    let channel = registry
-        .state::<dyn StatusChannel>()
-        .expect("the push channel is registered");
-    let mut receiver = channel.subscribe();
-    registry
-        .sink::<dyn StatusSink>()
-        .expect("the producer sink is registered")
-        .emit(update("Loading"));
-
-    let emitted = receiver.recv().await.expect("the sink emits onto the bus");
-    assert_eq!(
-        emitted.label, "Loading",
-        "the channel sees what the sink emits"
-    );
-    assert_eq!(
-        channel.latest().map(|latest| latest.label).as_deref(),
-        Some("Loading"),
-        "the channel's snapshot is the bus's retained update"
-    );
-    let state = registry
-        .state::<StatusBus>()
-        .expect("the bus is registered as the state handle");
-    assert_eq!(
-        state.latest().map(|latest| latest.label).as_deref(),
-        Some("Loading"),
-        "the state handle shares the registered bus"
-    );
-    assert_eq!(
-        bus.latest().map(|latest| latest.label).as_deref(),
-        Some("Loading"),
-        "the caller's bus is the one the registrations drive"
-    );
-}
-
-#[test]
-fn dropping_the_guards_deregisters_every_contribution() {
-    let registry = Registry::new();
-    let guards = register(&registry, &StatusBus::new());
-    assert!(registry.state::<dyn StatusChannel>().is_some());
-    assert!(registry.sink::<dyn StatusSink>().is_some());
-    assert!(registry.state::<StatusBus>().is_some());
-    drop(guards);
-    assert!(registry.state::<dyn StatusChannel>().is_none());
-    assert!(registry.sink::<dyn StatusSink>().is_none());
-    assert!(registry.state::<StatusBus>().is_none());
-}
diff --git a/crates/workshop/support/Cargo.toml b/crates/workshop/support/Cargo.toml
deleted file mode 100644
index 016f6ccca..000000000
--- a/crates/workshop/support/Cargo.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-[package]
-name = "workshop-support"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[features]
-default = []
-# Exposes test seams (`ReconnectBackoff::is_escalated_for_test` and the
-# `fixtures::serve` mock HTTP server) to the dependent crates' tests.
-test-fixtures = []
-
-[dependencies]
-axum.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-toml.workspace = true
-tracing.workspace = true
-
-[dev-dependencies]
-reqwest.workspace = true
-tempfile.workspace = true
-tokio = { workspace = true, features = ["test-util"] }
-tower.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/support/src/atomic.rs b/crates/workshop/support/src/atomic.rs
deleted file mode 100644
index dbcc942d2..000000000
--- a/crates/workshop/support/src/atomic.rs
+++ /dev/null
@@ -1,209 +0,0 @@
-//! Crash-safe file writes shared by the workspace write endpoint and
-//! pointer module, the user-state store, and the menu's model-memory
-//! persistence: each write lands in a uniquely named
-//! sibling temp file, is synced to disk, and is renamed over the target,
-//! so a crash at any moment leaves either the old contents or the new,
-//! never a truncation. The startup sweep removes temp files orphaned by
-//! a crash between the write and the rename; it covers directories the
-//! server owns at boot (the configured state directory) - workspace
-//! grants are runtime-only, so a granted directory cannot be swept
-//! before it is granted.
-
-use std::fs;
-use std::io::{self, Write as _};
-use std::path::{Path, PathBuf};
-use std::sync::atomic::{AtomicU64, Ordering};
-
-/// Suffix every atomic-write temp file ends with; the sweep recognizes
-/// orphans by it.
-const TEMP_SUFFIX: &str = ".rv-tmp";
-
-/// Process-wide counter making each temp name unique, so two concurrent
-/// writes to the same target never interleave inside one temp file: each
-/// writer fills its own temp completely and the last rename wins whole.
-static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
-
-/// The unique sibling temp path for one write to `path`, or `None` when
-/// `path` has no file name to derive it from.
-fn temp_path(path: &Path) -> Option<PathBuf> {
-    let mut name = path.file_name()?.to_os_string();
-    let counter = TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
-    name.push(format!(".{}-{counter}{TEMP_SUFFIX}", std::process::id()));
-    Some(path.with_file_name(name))
-}
-
-/// Writes `bytes` to `path` atomically: the bytes land in a unique
-/// sibling temp file, are synced to disk with `sync_data`, and the temp
-/// is renamed over `path`. On failure the temp file is removed and the
-/// target keeps its previous contents.
-///
-/// # Errors
-/// Returns [`io::ErrorKind::InvalidInput`] when `path` has no file name,
-/// and otherwise the underlying I/O error when the create, write, sync,
-/// or rename fails.
-pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
-    let Some(temp) = temp_path(path) else {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "write target has no file name",
-        ));
-    };
-    let result = fs::File::create(&temp)
-        .and_then(|mut file| {
-            file.write_all(bytes)?;
-            file.sync_data()
-        })
-        .and_then(|()| fs::rename(&temp, path));
-    if result.is_err() {
-        // Best-effort: when create itself failed there is nothing to
-        // remove, and anything remove misses here the next startup
-        // sweep catches.
-        let _ = fs::remove_file(&temp);
-    }
-    result
-}
-
-/// Removes temp files a crashed write left behind in `dir`, without
-/// recursing. A missing directory is tolerated silently: the server has
-/// simply never written there. Every other failure - an unreadable
-/// directory or entry, an unremovable file - is logged and tolerated:
-/// the sweep is cleanup and must never cost startup.
-pub fn sweep_orphaned_temps(dir: &Path) {
-    let entries = match fs::read_dir(dir) {
-        Ok(entries) => entries,
-        Err(error) => {
-            if error.kind() != io::ErrorKind::NotFound {
-                tracing::warn!(
-                    %error,
-                    dir = %dir.display(),
-                    "orphaned temp sweep skipped: directory unreadable"
-                );
-            }
-            return;
-        }
-    };
-    for entry in entries {
-        let entry = match entry {
-            Ok(entry) => entry,
-            Err(error) => {
-                tracing::warn!(
-                    %error,
-                    dir = %dir.display(),
-                    "orphaned temp sweep: entry unreadable; skipped"
-                );
-                continue;
-            }
-        };
-        let name = entry.file_name();
-        let name = name.to_string_lossy();
-        if !name.ends_with(TEMP_SUFFIX) {
-            continue;
-        }
-        match fs::remove_file(entry.path()) {
-            Ok(()) => {
-                tracing::info!(
-                    path = %entry.path().display(),
-                    "removed a temp file orphaned by a crashed write"
-                );
-            }
-            Err(error) => {
-                tracing::warn!(
-                    %error,
-                    path = %entry.path().display(),
-                    "orphaned temp file could not be removed; left in place"
-                );
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The sorted file names in `dir`.
-    fn dir_names(dir: &Path) -> Vec<String> {
-        let mut names: Vec<String> = fs::read_dir(dir)
-            .expect("the test directory is listable")
-            .map(|entry| {
-                entry
-                    .expect("the test entry is readable")
-                    .file_name()
-                    .to_string_lossy()
-                    .into_owned()
-            })
-            .collect();
-        names.sort();
-        names
-    }
-
-    #[test]
-    fn a_write_lands_whole_and_leaves_no_temp_behind() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let target = dir.path().join("state.json");
-        write_atomic(&target, b"one").expect("the first write succeeds");
-        assert_eq!(fs::read(&target).expect("readable"), b"one");
-        write_atomic(&target, b"two").expect("the overwrite succeeds");
-        assert_eq!(fs::read(&target).expect("readable"), b"two");
-        assert_eq!(dir_names(dir.path()), ["state.json"]);
-    }
-
-    #[test]
-    fn a_failed_rename_removes_the_temp_and_reports_the_error() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        // A directory in the target's place fails the rename after the
-        // temp is fully written, exercising the cleanup path.
-        let target = dir.path().join("state.json");
-        fs::create_dir(&target).expect("directory in the target's place");
-        write_atomic(&target, b"payload").expect_err("renaming over a directory must fail");
-        assert_eq!(dir_names(dir.path()), ["state.json"]);
-        assert!(target.is_dir(), "the failed write touched nothing");
-    }
-
-    #[test]
-    fn a_missing_parent_directory_fails_without_residue() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let target = dir.path().join("missing").join("state.json");
-        write_atomic(&target, b"payload").expect_err("an uncreatable temp must fail");
-        assert!(dir_names(dir.path()).is_empty(), "nothing was created");
-    }
-
-    #[test]
-    fn a_crash_orphan_spares_the_target_and_the_sweep_removes_it() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        let target = dir.path().join("state.json");
-        write_atomic(&target, b"good").expect("the seed write succeeds");
-        // A crash between the temp write and the rename leaves exactly
-        // this: a fully or partially written temp beside an intact target.
-        let orphan = dir.path().join(format!("state.json.999-0{TEMP_SUFFIX}"));
-        fs::write(&orphan, b"partial").expect("the simulated crash residue writes");
-        assert_eq!(
-            fs::read(&target).expect("readable"),
-            b"good",
-            "a crash before the rename never touches the target"
-        );
-        sweep_orphaned_temps(dir.path());
-        assert_eq!(
-            dir_names(dir.path()),
-            ["state.json"],
-            "the sweep removes the orphan and spares the real file"
-        );
-    }
-
-    #[test]
-    fn the_sweep_tolerates_a_missing_directory() {
-        let dir = tempfile::TempDir::new().expect("tempdir");
-        sweep_orphaned_temps(&dir.path().join("never-created"));
-    }
-
-    #[test]
-    fn concurrent_writers_each_get_a_distinct_temp_name() {
-        let target = Path::new("dir").join("state.json");
-        let first = temp_path(&target).expect("a named target derives a temp");
-        let second = temp_path(&target).expect("a named target derives a temp");
-        assert_ne!(
-            first, second,
-            "two writes to one target must never share a temp file"
-        );
-    }
-}
diff --git a/crates/workshop/support/src/backoff.rs b/crates/workshop/support/src/backoff.rs
deleted file mode 100644
index ceb5dc069..000000000
--- a/crates/workshop/support/src/backoff.rs
+++ /dev/null
@@ -1,240 +0,0 @@
-//! Gateway reconnect backoff: jittered exponential probe delays that
-//! reset only on useful work, never on mere connect.
-//!
-//! One [`ReconnectBackoff`] is shared between the heartbeat (which draws
-//! a delay before each probe while the gateway is unreachable) and the
-//! agent sessions (which record useful work - a completed model reply).
-//! A gateway that connects but never delivers keeps escalating:
-//! answering the health probe is not useful work, so a flapping
-//! upstream cannot use the connect/disconnect cycle to return to the fast
-//! schedule (rqbit's anti-flap discipline). The delays are jittered so
-//! workshops restarted together do not probe in phase, and a
-//! total-delay budget bounds the retry campaign as a whole: once the
-//! cumulative delay handed out since the last useful work crosses it,
-//! [`ReconnectBackoff::next_delay`] answers `None` and the caller
-//! stops reconnecting.
-
-use std::hash::{BuildHasher, Hasher};
-use std::sync::{Arc, Mutex, PoisonError};
-use std::time::Duration;
-
-/// First retry delay while the gateway is unreachable, matching the
-/// steady-state heartbeat cadence so the first retry is no slower than
-/// the probing it replaces.
-const BASE_DELAY: Duration = Duration::from_secs(5);
-
-/// Ceiling on a single retry delay. A returning gateway is noticed
-/// within a minute even after a long outage; everything in the UI hangs
-/// off the heartbeat's verdict, so the ceiling stays desktop-friendly
-/// rather than adopting rqbit's one-hour swarm value.
-const MAX_DELAY: Duration = Duration::from_secs(60);
-
-/// Total delay the backoff may hand out between two pieces of useful
-/// work before it gives up - a budget instead of an attempt cap, per
-/// rqbit. At the 60s ceiling this is more than a day of continuous
-/// outage; a workshop whose gateway has been gone that long stops
-/// probing and says so.
-const TOTAL_DELAY_BUDGET: Duration = Duration::from_hours(24);
-
-/// Shared reconnect-backoff state; clones feed one schedule.
-///
-/// The heartbeat calls [`ReconnectBackoff::next_delay`] before each
-/// probe while the gateway reads unreachable; the agent sessions call
-/// `record_useful_work` when the gateway proves
-/// itself. Nothing else mutates the schedule - in particular, a probe
-/// that merely connects leaves it untouched.
-#[derive(Debug, Clone)]
-pub struct ReconnectBackoff {
-    base: Duration,
-    max: Duration,
-    budget: Duration,
-    state: Arc<Mutex<State>>,
-}
-
-/// The mutable half: where the schedule stands since the last useful work.
-#[derive(Debug)]
-struct State {
-    /// The un-jittered delay the next `next_delay` call draws from;
-    /// doubles per call up to the ceiling.
-    current: Duration,
-    /// Cumulative delay handed out since the last useful work, judged
-    /// against the budget.
-    spent: Duration,
-    /// xorshift64 state for jitter; never zero (the generator's fixed
-    /// point).
-    rng: u64,
-}
-
-impl ReconnectBackoff {
-    /// A backoff on the production schedule.
-    #[must_use]
-    pub fn new() -> Self {
-        Self::with_schedule(BASE_DELAY, MAX_DELAY, TOTAL_DELAY_BUDGET)
-    }
-
-    /// A backoff on an explicit schedule, so tests run in milliseconds.
-    #[must_use]
-    pub fn with_schedule(base: Duration, max: Duration, budget: Duration) -> Self {
-        debug_assert!(!base.is_zero(), "a zero base would hand out zero delays");
-        // std's RandomState is randomly seeded per process, which is all
-        // the entropy jitter needs; `| 1` dodges xorshift's zero fixed
-        // point.
-        let seed = std::hash::RandomState::new().build_hasher().finish() | 1;
-        Self {
-            base,
-            max,
-            budget,
-            state: Arc::new(Mutex::new(State {
-                current: base,
-                spent: Duration::ZERO,
-                rng: seed,
-            })),
-        }
-    }
-
-    /// The next reconnect delay: the current schedule step, jittered
-    /// uniformly into its upper half (between half the step and the full
-    /// step), with the step then doubled up to the ceiling. Answers
-    /// `None` once the cumulative delay handed out since the last useful
-    /// work has crossed the budget - the signal to stop reconnecting.
-    #[must_use]
-    pub fn next_delay(&self) -> Option<Duration> {
-        let mut state = self.lock_state();
-        if state.spent >= self.budget {
-            return None;
-        }
-        let raw = state.current;
-        let floor = raw / 2;
-        // Delays are capped at the ceiling (a minute), so the span always
-        // fits; the fallback only guards the arithmetic, and the
-        // saturating add keeps even the u64::MAX fallback from overflowing.
-        let span = u64::try_from(raw.saturating_sub(floor).as_nanos()).unwrap_or(u64::MAX);
-        let jitter = if span == 0 {
-            0
-        } else {
-            xorshift(&mut state.rng) % span.saturating_add(1)
-        };
-        let delay = floor + Duration::from_nanos(jitter);
-        state.spent = state.spent.saturating_add(delay);
-        state.current = raw.saturating_mul(2).min(self.max);
-        Some(delay)
-    }
-
-    /// Resets the schedule to its base and refills the budget. Called
-    /// only when the gateway does useful work - a delivered streaming
-    /// token or a successful buffered completion - never on a probe that
-    /// merely connects.
-    pub fn record_useful_work(&self) {
-        let mut state = self.lock_state();
-        state.current = self.base;
-        state.spent = Duration::ZERO;
-    }
-
-    /// Whether the schedule has escalated past its base since the last
-    /// useful work.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    #[must_use]
-    pub fn is_escalated_for_test(&self) -> bool {
-        self.lock_state().current > self.base
-    }
-
-    /// A peer that panicked while holding the lock cannot corrupt two
-    /// plain `Duration`s, so the value is recovered rather than wedging
-    /// every reconnect.
-    fn lock_state(&self) -> std::sync::MutexGuard<'_, State> {
-        self.state.lock().unwrap_or_else(PoisonError::into_inner)
-    }
-}
-
-impl Default for ReconnectBackoff {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// xorshift64: a tiny deterministic generator; jitter needs spread, not
-/// cryptography, and this keeps the dependency tree unchanged.
-fn xorshift(state: &mut u64) -> u64 {
-    *state ^= *state << 13;
-    *state ^= *state >> 7;
-    *state ^= *state << 17;
-    *state
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A schedule small enough to exhaust inside a test: base 10ms,
-    /// ceiling 40ms, budget 200ms.
-    fn fast() -> ReconnectBackoff {
-        ReconnectBackoff::with_schedule(
-            Duration::from_millis(10),
-            Duration::from_millis(40),
-            Duration::from_millis(200),
-        )
-    }
-
-    #[test]
-    fn delays_escalate_within_jitter_bounds_and_clamp_at_the_ceiling() {
-        let backoff = fast();
-        // The un-jittered schedule is 10, 20, 40, 40, ... and each drawn
-        // delay lands in the upper half of its step.
-        for expected in [10u64, 20, 40, 40, 40] {
-            let raw = Duration::from_millis(expected);
-            let delay = backoff.next_delay().expect("the budget is not spent yet");
-            assert!(
-                delay >= raw / 2 && delay <= raw,
-                "a delay of {delay:?} left the jitter window of the {raw:?} step"
-            );
-        }
-    }
-
-    #[test]
-    fn the_budget_exhausts_to_none_and_stays_exhausted() {
-        let backoff = fast();
-        // Every delay is at least 5ms, so 200ms of budget is spent well
-        // within 40 draws; the exact count depends on jitter.
-        let exhausted_after = (0..40).find(|_| backoff.next_delay().is_none());
-        assert!(
-            exhausted_after.is_some(),
-            "the budget must exhaust within the schedule's worst case"
-        );
-        assert_eq!(
-            backoff.next_delay(),
-            None,
-            "an exhausted budget stays exhausted until useful work"
-        );
-    }
-
-    #[test]
-    fn useful_work_resets_the_schedule_and_refills_the_budget() {
-        let backoff = fast();
-        while backoff.next_delay().is_some() {}
-        backoff.record_useful_work();
-        assert!(
-            !backoff.is_escalated_for_test(),
-            "useful work returns the schedule to its base"
-        );
-        let delay = backoff
-            .next_delay()
-            .expect("useful work refills the budget");
-        assert!(
-            delay <= Duration::from_millis(10),
-            "the first delay after a reset draws from the base step, got {delay:?}"
-        );
-    }
-
-    #[test]
-    fn clones_share_one_schedule() {
-        let backoff = fast();
-        let hook = backoff.clone();
-        let _ = backoff.next_delay();
-        assert!(backoff.is_escalated_for_test());
-        hook.record_useful_work();
-        assert!(
-            !backoff.is_escalated_for_test(),
-            "a reset through one clone reaches every holder"
-        );
-    }
-}
diff --git a/crates/workshop/support/src/bus.rs b/crates/workshop/support/src/bus.rs
deleted file mode 100644
index 425df1ed2..000000000
--- a/crates/workshop/support/src/bus.rs
+++ /dev/null
@@ -1,194 +0,0 @@
-//! The retained broadcast bus: the generic transport pattern behind the
-//! workshop server's status, catalog, and menu buses.
-//!
-//! A [`RetainedBus`] is a tokio broadcast channel plus a retained copy of
-//! the newest value: sends fan out to all current subscribers, a send
-//! with no subscribers is a no-op, and a subscriber that falls more than
-//! the ring capacity behind is told it lagged and resumes at the oldest
-//! retained value. Sending never blocks, so instrumenting a hot path
-//! cannot stall the subsystem it observes. The retained newest value is
-//! the resend-on-reconnect snapshot: a session that connects later reads
-//! it directly instead of waiting for the next publish.
-//!
-//! The status, catalog, and menu buses are thin wrappers over this one
-//! type; each wrapper owns its ring capacity and its intent-named helper
-//! methods. [`recv_or_pending`] is the consumer side's shared helper for
-//! a subscription that may be absent.
-
-use std::sync::{Arc, Mutex, PoisonError};
-
-use tokio::sync::broadcast;
-
-/// A broadcast bus retaining the newest value sent: a cloneable handle
-/// onto the channel and the snapshot.
-///
-/// Clones are cheap (two `Arc` bumps) and all of them send into the same
-/// channel, so subsystems take their own copy rather than a reference.
-#[derive(Debug, Clone)]
-pub struct RetainedBus<T> {
-    sender: broadcast::Sender<T>,
-    latest: Arc<Mutex<Option<T>>>,
-}
-
-impl<T: Clone> RetainedBus<T> {
-    /// Creates a bus with the given ring capacity, no subscribers, and no
-    /// snapshot. A receiver lagging past `capacity` skips ahead rather
-    /// than slowing the senders.
-    #[must_use]
-    pub fn new(capacity: usize) -> Self {
-        Self {
-            sender: broadcast::channel(capacity).0,
-            latest: Arc::new(Mutex::new(None)),
-        }
-    }
-
-    /// Subscribes to every value sent from this call onward.
-    #[must_use]
-    pub fn subscribe(&self) -> broadcast::Receiver<T> {
-        self.sender.subscribe()
-    }
-
-    /// The most recently sent value, retained so a consumer connecting
-    /// later can take the current state as its snapshot.
-    #[must_use]
-    pub fn latest(&self) -> Option<T> {
-        // A lock poisoned by a panicking peer recovers the value rather
-        // than wedging the process.
-        self.latest
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .clone()
-    }
-
-    /// Retains `value` as the newest snapshot, then broadcasts it. With
-    /// no subscribers the broadcast is a no-op and only the snapshot
-    /// moves; a slow subscriber skips ahead rather than applying
-    /// backpressure.
-    pub fn send(&self, value: T) {
-        // The retained copy (a second owner, hence the clone) is written
-        // before the send, so a consumer that subscribes after the send
-        // still finds this value as its snapshot.
-        *self.latest.lock().unwrap_or_else(PoisonError::into_inner) = Some(value.clone());
-        // A send only fails when there are no receivers, which is the
-        // bus's resting state before the first client connects.
-        let _ = self.sender.send(value);
-    }
-}
-
-/// Receives from an optional subscription, pending forever when absent,
-/// so a `select!` branch for a detached or unregistered channel simply
-/// never fires.
-///
-/// # Errors
-/// Returns the receiver's own [`broadcast::error::RecvError`]: `Lagged`
-/// when it fell behind the ring, `Closed` once every sender is gone.
-pub async fn recv_or_pending<T: Clone>(
-    receiver: &mut Option<broadcast::Receiver<T>>,
-) -> Result<T, broadcast::error::RecvError> {
-    match receiver {
-        Some(receiver) => receiver.recv().await,
-        None => std::future::pending().await,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn sending_with_no_subscribers_is_a_no_op() {
-        let bus = RetainedBus::new(4);
-        bus.send("one".to_string());
-    }
-
-    #[test]
-    fn the_newest_value_is_retained_for_the_connect_snapshot() {
-        let bus = RetainedBus::new(4);
-        assert!(bus.latest().is_none(), "an untouched bus has no snapshot");
-        bus.send(1);
-        bus.send(2);
-        assert_eq!(
-            bus.latest(),
-            Some(2),
-            "a consumer connecting now snapshots the newest value"
-        );
-    }
-
-    #[test]
-    fn the_snapshot_moves_before_the_send_so_a_late_subscriber_sees_it() {
-        let bus = RetainedBus::new(4);
-        bus.send(7);
-        let _late = bus.subscribe();
-        assert_eq!(
-            bus.latest(),
-            Some(7),
-            "the retained copy is written even when the send has no receivers"
-        );
-    }
-
-    #[tokio::test]
-    async fn a_lagged_receiver_skips_ahead_instead_of_blocking() {
-        let capacity = 4;
-        let bus = RetainedBus::new(capacity);
-        let mut receiver = bus.subscribe();
-        for index in 0..capacity + 10 {
-            // Sends never block, however far behind the receiver is.
-            bus.send(index);
-        }
-        let lag = match receiver.recv().await {
-            Err(broadcast::error::RecvError::Lagged(skipped)) => skipped,
-            Ok(got) => panic!("expected a lag report, got {got:?}"),
-            Err(broadcast::error::RecvError::Closed) => panic!("the bus is still open"),
-        };
-        assert_eq!(lag, 10, "the ring retained only its capacity");
-        let resumed = receiver.recv().await.expect("the ring still holds values");
-        assert_eq!(
-            resumed, 10,
-            "receiving resumes at the oldest retained value"
-        );
-    }
-
-    #[tokio::test]
-    async fn clones_send_into_one_channel_and_share_one_snapshot() {
-        let bus = RetainedBus::new(4);
-        let clone = bus.clone();
-        let mut receiver = bus.subscribe();
-        clone.send("through the clone".to_string());
-        assert_eq!(
-            receiver
-                .recv()
-                .await
-                .expect("the clone's send reaches the bus"),
-            "through the clone"
-        );
-        assert_eq!(
-            bus.latest().as_deref(),
-            Some("through the clone"),
-            "the clone's send moves the shared snapshot"
-        );
-    }
-
-    #[tokio::test]
-    async fn a_present_subscription_receives_what_its_channel_sends() {
-        let (sender, receiver) = broadcast::channel(4);
-        let mut receiver = Some(receiver);
-        sender.send(3).expect("the receiver is subscribed");
-        assert_eq!(
-            recv_or_pending(&mut receiver)
-                .await
-                .expect("the value is queued"),
-            3
-        );
-    }
-
-    #[test]
-    fn an_absent_subscription_pends_forever() {
-        let mut receiver: Option<broadcast::Receiver<u32>> = None;
-        let mut wait = std::pin::pin!(recv_or_pending(&mut receiver));
-        let mut context = std::task::Context::from_waker(std::task::Waker::noop());
-        assert!(
-            wait.as_mut().poll(&mut context).is_pending(),
-            "a detached select! branch must never fire"
-        );
-    }
-}
diff --git a/crates/workshop/support/src/config.rs b/crates/workshop/support/src/config.rs
deleted file mode 100644
index 8edc4870a..000000000
--- a/crates/workshop/support/src/config.rs
+++ /dev/null
@@ -1,317 +0,0 @@
-//! `workshop.toml` loading: TOML parsing, `${VAR}` environment
-//! interpolation, and defaults.
-//!
-//! Interpolation follows the runvil convention (gateway-config CFG-007):
-//! the TOML is parsed first and only string *values* are interpolated, so
-//! `${VAR}` inside comments or keys is never expanded and an interpolated
-//! value containing a quote, backslash, or newline cannot corrupt the
-//! document. `$$` is a literal `$`. An unset variable interpolates to the
-//! empty string: an empty `gateway.base_url` leaves the endpoint to
-//! resolution (it attaches through the gateway discovery file or fails
-//! plainly), and an empty `gateway.api_key` omits the `Authorization`
-//! header.
-
-use std::fmt;
-use std::path::{Path, PathBuf};
-
-/// Address the workshop server binds to when no override is given.
-pub const DEFAULT_ADDR: &str = "127.0.0.1:7910";
-
-/// Path [`Config::load`] reads when no override is given.
-pub const DEFAULT_CONFIG_PATH: &str = "workshop.toml";
-
-/// Workshop server configuration loaded from `workshop.toml`.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct Config {
-    /// Connection settings for the Runvil gateway.
-    pub gateway: GatewayConfig,
-    /// HTTP server settings.
-    #[serde(default)]
-    pub server: ServerConfig,
-    /// Agent prompt discovery settings.
-    #[serde(default)]
-    pub agents: AgentsConfig,
-}
-
-impl Config {
-    /// Loads and parses the workshop configuration from `path`.
-    ///
-    /// # Errors
-    /// Returns [`ConfigError::NotFound`] if `path` does not exist,
-    /// [`ConfigError::Read`] if `path` exists but cannot be read,
-    /// [`ConfigError::Parse`] if the contents do not match the workshop
-    /// schema, [`ConfigError::UnresolvedVar`] if a `${VAR}` names a variable
-    /// whose value is not valid Unicode, and [`ConfigError::Interpolation`]
-    /// if a `${...}` is malformed.
-    pub fn load(path: &Path) -> Result<Self, ConfigError> {
-        let raw = std::fs::read_to_string(path).map_err(|source| {
-            if source.kind() == std::io::ErrorKind::NotFound {
-                ConfigError::NotFound {
-                    path: path.to_path_buf(),
-                }
-            } else {
-                ConfigError::Read {
-                    path: path.to_path_buf(),
-                    source,
-                }
-            }
-        })?;
-        Self::parse(&raw, Some(path))
-    }
-
-    /// Parses a workshop configuration from a TOML string.
-    ///
-    /// # Errors
-    /// Returns [`ConfigError::Parse`] if `raw` is not valid TOML or does not
-    /// match the workshop schema, [`ConfigError::UnresolvedVar`] if a
-    /// `${VAR}` names a variable whose value is not valid Unicode, and
-    /// [`ConfigError::Interpolation`] if a `${...}` is malformed.
-    pub fn from_toml_str(raw: &str) -> Result<Self, ConfigError> {
-        Self::parse(raw, None)
-    }
-
-    fn parse(raw: &str, path: Option<&Path>) -> Result<Self, ConfigError> {
-        let mut document: toml::Value =
-            toml::from_str(raw).map_err(|source| ConfigError::Parse {
-                path: path.map(Path::to_path_buf),
-                source: Box::new(source),
-            })?;
-        interpolate_value(&mut document)?;
-        let mut config: Self = document.try_into().map_err(|source| ConfigError::Parse {
-            path: path.map(Path::to_path_buf),
-            source: Box::new(source),
-        })?;
-        // An empty `gateway.base_url` is kept as-is: it is the not-explicit
-        // signal endpoint resolution reads, so no default is filled here.
-        // The path-shaped defaults anchor beside the config file. A config
-        // parsed from a string has no file, so the anchor degrades to the
-        // working directory.
-        let anchor = path
-            .and_then(Path::parent)
-            .filter(|parent| !parent.as_os_str().is_empty())
-            .unwrap_or(Path::new("."));
-        config.anchor_path_defaults(anchor);
-        Ok(config)
-    }
-
-    /// Replaces the empty path defaults with paths anchored at
-    /// `anchor`: an empty `server.state_dir` becomes `anchor` itself, and
-    /// an empty `agents.path` becomes `agents/` under it. Explicit
-    /// (non-empty) values are kept verbatim. Parsing applies this with the
-    /// config file's directory; an embedding binary that builds a [`Config`]
-    /// in code applies it with its own anchor to get the same defaults.
-    pub fn anchor_path_defaults(&mut self, anchor: &Path) {
-        if self.server.state_dir.as_os_str().is_empty() {
-            self.server.state_dir = anchor.to_path_buf();
-        }
-        if self.agents.path.as_os_str().is_empty() {
-            self.agents.path = anchor.join("agents");
-        }
-    }
-}
-
-/// Gateway connection settings: where the gateway listens and how to
-/// authenticate to it.
-#[derive(Clone, PartialEq, Eq, serde::Deserialize)]
-pub struct GatewayConfig {
-    /// Base URL of the gateway, for example `http://127.0.0.1:8081`. Empty
-    /// leaves the endpoint to resolution: it attaches through the gateway
-    /// discovery file, or fails plainly when no live file exists.
-    pub base_url: String,
-    /// Bearer key for the gateway API; supports `${VAR}` interpolation.
-    pub api_key: String,
-}
-
-// Manual so the bearer key is never written to logs.
-impl fmt::Debug for GatewayConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("GatewayConfig")
-            .field("base_url", &self.base_url)
-            .field("api_key", &"<redacted>")
-            .finish()
-    }
-}
-
-/// HTTP server settings.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Deserialize)]
-#[serde(default)]
-pub struct ServerConfig {
-    /// Address the workshop server binds to.
-    pub bind: String,
-    /// Directory holding the server's persistent state: the run log of
-    /// every agent session sits at `state_dir/harness/runs.db`, and the
-    /// per-profile model memory and boot orphan sweep anchor here.
-    /// Defaults to the config file's own directory (`Config::parse`
-    /// anchors the empty default there).
-    pub state_dir: PathBuf,
-}
-
-impl Default for ServerConfig {
-    fn default() -> Self {
-        Self {
-            bind: DEFAULT_ADDR.to_string(),
-            state_dir: PathBuf::new(),
-        }
-    }
-}
-
-/// Agent prompt discovery settings.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Deserialize)]
-#[serde(default)]
-pub struct AgentsConfig {
-    /// Directory whose `.md` files are the launchable agent prompts,
-    /// discovered by file stem. A `chat.md` in the directory shadows the
-    /// embedded built-in chat agent; an existing `chat.md` that cannot
-    /// be read surfaces an error rather than silently serving the
-    /// built-in. Defaults to `agents/` beside the config file
-    /// (`Config::parse` anchors the empty default there). A missing
-    /// directory still offers the embedded `chat` built-in - a state,
-    /// not an error.
-    pub path: PathBuf,
-    /// An `mcp.json`-format file whose `mcpServers` object Workshop hands
-    /// to its one mcp Pack, which reaches each server under its name as
-    /// written. Leaving it out means no MCP servers, and Workshop then
-    /// reads no file. `${VAR}` interpolation applies to the path, and an
-    /// unset variable expands to an empty string. The path is kept
-    /// verbatim like other explicit paths, so `anchor_path_defaults`
-    /// leaves it alone.
-    pub mcp: Option<PathBuf>,
-    /// The directory whose dynamic libraries Workshop loads as Plugins.
-    /// Leaving it out loads no directory, and a directory that does not
-    /// exist loads no Plugin. The path is interpolated and kept verbatim
-    /// as `mcp` is. The desktop app fills a setting left out with the
-    /// `plugins` directory of its own installation.
-    pub plugins: Option<PathBuf>,
-}
-
-impl Default for AgentsConfig {
-    fn default() -> Self {
-        Self {
-            path: PathBuf::new(),
-            mcp: None,
-            plugins: None,
-        }
-    }
-}
-
-/// A workshop configuration load or parse failure.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum ConfigError {
-    /// The configuration file does not exist.
-    #[non_exhaustive]
-    #[error("config file not found: {}", path.display())]
-    NotFound {
-        /// The path that was expected.
-        path: PathBuf,
-    },
-
-    /// The configuration file could not be read.
-    #[non_exhaustive]
-    #[error("read config {}", path.display())]
-    Read {
-        /// The path that could not be read.
-        path: PathBuf,
-        /// The underlying I/O error.
-        #[source]
-        source: std::io::Error,
-    },
-
-    /// The configuration was not valid TOML or did not match the schema.
-    #[non_exhaustive]
-    #[error("parse config{}", parse_location(path.as_deref()))]
-    Parse {
-        /// The file the parse failure came from, when known.
-        path: Option<PathBuf>,
-        /// The underlying TOML error, boxed to hide the dependency type.
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-
-    /// A `${VAR}` named an environment variable whose value is not valid
-    /// Unicode. An unset variable is not an error; it interpolates to the
-    /// empty string.
-    #[non_exhaustive]
-    #[error("environment variable {0} is not valid Unicode")]
-    UnresolvedVar(String),
-
-    /// A `${...}` interpolation was malformed (for example, unclosed).
-    #[non_exhaustive]
-    #[error("interpolation: {0}")]
-    Interpolation(String),
-}
-
-/// Renders the optional parse-failure path as a ` (path)` suffix or empty.
-fn parse_location(path: Option<&Path>) -> String {
-    path.map(|p| format!(" ({})", p.display()))
-        .unwrap_or_default()
-}
-
-/// Expands `${VAR}` from the environment; `$$` is a literal `$`. An unset
-/// variable expands to the empty string; a variable whose value is not
-/// valid Unicode is an error.
-fn interpolate(input: &str) -> Result<String, ConfigError> {
-    let mut out = String::with_capacity(input.len());
-    let mut chars = input.chars().peekable();
-    while let Some(c) = chars.next() {
-        if c != '$' {
-            out.push(c);
-            continue;
-        }
-        match chars.peek() {
-            Some('$') => {
-                chars.next();
-                out.push('$');
-            }
-            Some('{') => {
-                chars.next();
-                let mut name = String::new();
-                let mut closed = false;
-                for nc in chars.by_ref() {
-                    if nc == '}' {
-                        closed = true;
-                        break;
-                    }
-                    name.push(nc);
-                }
-                if !closed {
-                    return Err(ConfigError::Interpolation(
-                        "unclosed ${...} interpolation".to_string(),
-                    ));
-                }
-                match std::env::var(&name) {
-                    Ok(value) => out.push_str(&value),
-                    Err(std::env::VarError::NotPresent) => {}
-                    Err(std::env::VarError::NotUnicode(_)) => {
-                        return Err(ConfigError::UnresolvedVar(name.clone()));
-                    }
-                }
-            }
-            _ => out.push('$'),
-        }
-    }
-    Ok(out)
-}
-
-/// Recursively interpolates `${VAR}` in every string leaf of a TOML value,
-/// leaving keys and non-string scalars untouched.
-fn interpolate_value(value: &mut toml::Value) -> Result<(), ConfigError> {
-    match value {
-        toml::Value::String(text) => {
-            *text = interpolate(text)?;
-        }
-        toml::Value::Array(items) => {
-            for item in items {
-                interpolate_value(item)?;
-            }
-        }
-        toml::Value::Table(table) => {
-            for (_, entry) in table.iter_mut() {
-                interpolate_value(entry)?;
-            }
-        }
-        _ => {}
-    }
-    Ok(())
-}
diff --git a/crates/workshop/support/src/deadline.rs b/crates/workshop/support/src/deadline.rs
deleted file mode 100644
index 3a29335eb..000000000
--- a/crates/workshop/support/src/deadline.rs
+++ /dev/null
@@ -1,150 +0,0 @@
-//! Route deadlines: the wall-clock tiers HTTP route groups run under
-//! and the middleware that enforces them. The composition root applies
-//! the default tier; the gateway-relay routes take the longer tier so
-//! the gateway client's own timeout fires first.
-
-use std::time::Duration;
-
-use axum::Json;
-use axum::Router;
-use axum::extract::Request;
-use axum::http::StatusCode;
-use axum::middleware::Next;
-use axum::response::IntoResponse;
-
-/// Deadline for ordinary HTTP routes: local, fast work. A response not
-/// produced in time answers 408.
-pub const DEFAULT_DEADLINE: Duration = Duration::from_secs(10);
-
-/// Deadline for routes that relay a buffered gateway call: longer than the
-/// gateway client's own request timeout, so a stalled gateway surfaces as
-/// the relay's 502 with its failure shape rather than a blunt 408 from the
-/// route deadline.
-pub const RELAY_DEADLINE: Duration = Duration::from_secs(35);
-
-/// The machine-readable wire code of a deadline-elapsed failure. Both UIs
-/// key on this string, so it is a wire contract.
-pub const DEADLINE_ELAPSED_CODE: &str = "deadline_elapsed";
-
-/// The user-visible message a deadline-elapsed failure answers with: the
-/// elapsed deadline in seconds, and that the abandoned operation may
-/// still complete - a blocking write cannot be canceled.
-#[must_use]
-pub fn deadline_elapsed_message(limit: Duration) -> String {
-    format!(
-        "the request did not finish within its {}s deadline; the operation may still complete",
-        limit.as_secs()
-    )
-}
-
-/// Bounds every route already in `router` on `limit`: a response not
-/// produced by the deadline is abandoned and answered with 408 instead.
-///
-/// The WebSocket upgrade routes are deliberately left outside this layer
-/// by their feature modules: an upgrade answers immediately and the
-/// session then lives as long as the client stays connected.
-pub fn with_deadline<S>(router: Router<S>, limit: Duration) -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    router.layer(axum::middleware::from_fn(
-        move |request: Request, next: Next| async move {
-            let uri = request.uri().clone();
-            match tokio::time::timeout(limit, next.run(request)).await {
-                Ok(response) => response,
-                Err(_elapsed) => {
-                    tracing::warn!(%uri, ?limit, "request deadline elapsed");
-                    let body = serde_json::json!({
-                        "error": {
-                            "message": deadline_elapsed_message(limit),
-                            "code": DEADLINE_ELAPSED_CODE,
-                        }
-                    });
-                    (StatusCode::REQUEST_TIMEOUT, Json(body)).into_response()
-                }
-            }
-        },
-    ))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use axum::body::Body;
-    use axum::routing::get;
-    use tower::ServiceExt;
-
-    /// Collects a response body already buffered in memory.
-    async fn body_bytes(response: axum::response::Response) -> axum::body::Bytes {
-        axum::body::to_bytes(response.into_body(), usize::MAX)
-            .await
-            .expect("the body is in memory already")
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn a_stalled_route_answers_408_at_its_deadline() {
-        // The handler stalls far past the deadline; the layer must answer
-        // for it rather than let the caller hang. Time is paused, so the
-        // stall and the deadline advance virtually and cost no wall clock;
-        // the socketless oneshot does no real I/O that paused time would
-        // freeze.
-        let app = with_deadline(
-            Router::new().route(
-                "/stalled",
-                get(|| async {
-                    tokio::time::sleep(Duration::from_secs(30)).await;
-                    "unreachable"
-                }),
-            ),
-            Duration::from_secs(1),
-        );
-        let request = Request::builder()
-            .uri("/stalled")
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = app
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(response.status(), StatusCode::REQUEST_TIMEOUT);
-        assert_eq!(
-            response
-                .headers()
-                .get(axum::http::header::CONTENT_TYPE)
-                .map(axum::http::HeaderValue::as_bytes),
-            Some(b"application/json".as_slice()),
-            "the deadline answers JSON"
-        );
-        let body: serde_json::Value =
-            serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-        assert_eq!(
-            body,
-            serde_json::json!({
-                "error": {
-                    "message": deadline_elapsed_message(Duration::from_secs(1)),
-                    "code": DEADLINE_ELAPSED_CODE,
-                }
-            }),
-            "the 408 body is the error envelope"
-        );
-    }
-
-    #[tokio::test]
-    async fn a_quick_route_passes_through_its_deadline_untouched() {
-        let app = with_deadline(
-            Router::new().route("/quick", get(|| async { "ok" })),
-            DEFAULT_DEADLINE,
-        );
-        let request = Request::builder()
-            .uri("/quick")
-            .body(Body::empty())
-            .expect("static request parts are valid");
-        let response = app
-            .oneshot(request)
-            .await
-            .expect("the router is infallible");
-        assert_eq!(response.status(), StatusCode::OK);
-        assert_eq!(&body_bytes(response).await[..], b"ok");
-    }
-}
diff --git a/crates/workshop/support/src/error_message-tests.rs b/crates/workshop/support/src/error_message-tests.rs
deleted file mode 100644
index 0a863b582..000000000
--- a/crates/workshop/support/src/error_message-tests.rs
+++ /dev/null
@@ -1,58 +0,0 @@
-//! Tests for the shared error-message rendering: the production message
-//! stays at the error's own `Display` text, the debug message appends the
-//! source chain, the leak flag tracks debug assertions, and an envelope
-//! that cannot serialize answers the status line's text.
-
-use std::io;
-
-use super::*;
-
-/// A nested test error, so the source-chain walk has a cause to append.
-#[derive(Debug, thiserror::Error)]
-#[error("read failed")]
-struct TestError {
-    /// The injected cause.
-    #[source]
-    source: io::Error,
-}
-
-/// An envelope whose serialization always fails, so the response takes
-/// its fallback body.
-struct Unserializable;
-
-impl serde::Serialize for Unserializable {
-    fn serialize<S: serde::Serializer>(&self, _serializer: S) -> Result<S::Ok, S::Error> {
-        Err(serde::ser::Error::custom("refused"))
-    }
-}
-
-#[test]
-fn production_messages_stay_at_the_variant_text() {
-    let error = TestError {
-        source: io::Error::other("disk gone"),
-    };
-    assert_eq!(render_message(&error, false), "read failed");
-}
-
-#[test]
-fn debug_messages_append_the_source_chain() {
-    let error = TestError {
-        source: io::Error::other("disk gone"),
-    };
-    assert_eq!(render_message(&error, true), "read failed: disk gone");
-}
-
-#[test]
-fn the_leak_flag_tracks_debug_assertions() {
-    assert_eq!(LEAK_DETAIL, cfg!(debug_assertions));
-}
-
-#[tokio::test]
-async fn an_envelope_that_cannot_serialize_answers_the_status_text() {
-    let response = envelope_response(StatusCode::BAD_GATEWAY, &Unserializable);
-    assert_eq!(response.status(), StatusCode::BAD_GATEWAY);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already");
-    assert_eq!(&body[..], b"Bad Gateway");
-}
diff --git a/crates/workshop/support/src/error_message.rs b/crates/workshop/support/src/error_message.rs
deleted file mode 100644
index b1ccb59aa..000000000
--- a/crates/workshop/support/src/error_message.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-//! Error-message rendering shared by the workshop crates: the
-//! debug-only source-chain leak flag, the helper that renders an
-//! error's envelope message (its own `Display` text with the
-//! source chain appended as `: cause` segments in debug builds
-//! only), and the helper that answers an envelope as the JSON
-//! response.
-
-use std::fmt::Write as _;
-
-use axum::http::{StatusCode, header};
-use axum::response::{IntoResponse, Response};
-use serde::Serialize;
-
-/// Whether wire bodies include internal failure detail. Debug builds append
-/// the source chain to the envelope message; production bodies stay at
-/// the variant's own message.
-pub const LEAK_DETAIL: bool = cfg!(debug_assertions);
-
-/// Renders the envelope message for `error`: its own `Display` text, with
-/// the source chain appended as `: cause` segments when `leak_detail` is
-/// set.
-#[must_use]
-pub fn render_message<E>(error: &E, leak_detail: bool) -> String
-where
-    E: std::fmt::Display + std::error::Error,
-{
-    let mut message = error.to_string();
-    if leak_detail {
-        let mut source = std::error::Error::source(error);
-        while let Some(cause) = source {
-            // fmt::Write to a String cannot fail; the Result is a trait
-            // artifact.
-            let _ = write!(message, ": {cause}");
-            source = cause.source();
-        }
-    }
-    message
-}
-
-/// Answers `envelope` as the JSON body of a `status` response; an
-/// envelope that cannot serialize degrades to the status line's own text.
-/// Generic because this crate may not name `workshop-protocol`'s
-/// `ErrorEnvelope`.
-#[must_use]
-pub fn envelope_response<T: Serialize>(status: StatusCode, envelope: &T) -> Response {
-    let body = serde_json::to_string(envelope)
-        .unwrap_or_else(|_| status.canonical_reason().unwrap_or("error").to_string());
-    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()
-}
-
-#[cfg(test)]
-#[path = "error_message-tests.rs"]
-mod tests;
diff --git a/crates/workshop/support/src/fixtures.rs b/crates/workshop/support/src/fixtures.rs
deleted file mode 100644
index 44e0eb6b1..000000000
--- a/crates/workshop/support/src/fixtures.rs
+++ /dev/null
@@ -1,68 +0,0 @@
-//! A mock HTTP server for the dependent crates' tests: binds the caller's
-//! router on a free loopback port and serves it in a task.
-
-#![expect(
-    clippy::expect_used,
-    reason = "test fixtures fail by panicking with the invariant named"
-)]
-
-use std::net::SocketAddr;
-
-use axum::Router;
-use tokio::task::JoinHandle;
-
-/// Binds `router` on a free loopback port and serves it in a task,
-/// returning the bound address and the task handle. Drop the handle to
-/// leave the server running for the test's lifetime, or abort it to stop
-/// the server early.
-///
-/// # Panics
-/// Panics when the loopback bind fails or the bound address cannot be
-/// read.
-pub async fn serve(router: Router) -> (SocketAddr, JoinHandle<()>) {
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("bind mock server");
-    let addr = listener.local_addr().expect("mock server address");
-    let handle = tokio::spawn(async move {
-        axum::serve(listener, router)
-            .await
-            .expect("mock server serves");
-    });
-    (addr, handle)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use axum::routing::get;
-
-    /// Fetches the body of a GET to `url`, panicking on transport or
-    /// status errors.
-    async fn get_text(url: &str) -> String {
-        let response = reqwest::get(url)
-            .await
-            .expect("the request reaches the mock server");
-        response.text().await.expect("the response body reads")
-    }
-
-    #[tokio::test]
-    async fn a_mock_server_serves_its_router_on_the_reported_address() {
-        let (addr, _handle) = serve(Router::new().route("/probe", get(|| async { "pong" }))).await;
-        assert!(addr.ip().is_loopback(), "the bound address is loopback");
-        assert_ne!(addr.port(), 0, "the bound address has a real port");
-        let body = get_text(&format!("http://{addr}/probe")).await;
-        assert_eq!(body, "pong", "the served router answers the request");
-    }
-
-    #[tokio::test]
-    async fn the_returned_handle_stops_the_server_when_aborted() {
-        let (_addr, handle) = serve(Router::new().route("/", get(|| async { "up" }))).await;
-        handle.abort();
-        assert!(
-            handle.await.unwrap_err().is_cancelled(),
-            "the task handle stops the server when aborted"
-        );
-    }
-}
diff --git a/crates/workshop/support/src/lib.rs b/crates/workshop/support/src/lib.rs
deleted file mode 100644
index 9824e826a..000000000
--- a/crates/workshop/support/src/lib.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-//! workshop-support - the workshop server's support vocabulary:
-//! crash-safe atomic writes, the gateway reconnect backoff, route
-//! deadline tiers, `workshop.toml` configuration, the generic retained
-//! broadcast bus the status, catalog, and menu buses are thin wrappers
-//! over, the shared error-message and envelope rendering, and the
-//! JSON state-bucket validator the user-state and workspace buckets
-//! both use.
-//!
-//! ## Invariants
-//!
-//! - Tier: vocabulary; may depend on: no internal `workshop-*` crates.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - A lock poisoned by a panicking peer recovers the value rather than
-//!   wedging the process.
-
-mod atomic;
-mod backoff;
-mod bus;
-mod config;
-mod deadline;
-mod error_message;
-#[cfg(feature = "test-fixtures")]
-pub mod fixtures;
-mod state_bucket;
-
-pub use atomic::{sweep_orphaned_temps, write_atomic};
-pub use backoff::ReconnectBackoff;
-pub use bus::{RetainedBus, recv_or_pending};
-pub use config::{
-    AgentsConfig, Config, ConfigError, DEFAULT_ADDR, DEFAULT_CONFIG_PATH, GatewayConfig,
-    ServerConfig,
-};
-pub use deadline::{
-    DEADLINE_ELAPSED_CODE, DEFAULT_DEADLINE, RELAY_DEADLINE, deadline_elapsed_message,
-    with_deadline,
-};
-pub use error_message::{LEAK_DETAIL, envelope_response, render_message};
-pub use state_bucket::{STATE_BUCKET_VALUE_CAP, StateBucketError, StateBucketValue};
diff --git a/crates/workshop/support/src/state_bucket-tests.rs b/crates/workshop/support/src/state_bucket-tests.rs
deleted file mode 100644
index 9b7207875..000000000
--- a/crates/workshop/support/src/state_bucket-tests.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-//! Tests for the shared state-bucket validator: each refusal, an accepted
-//! put, and the cheapest-refusal-first order the route boundary promises.
-
-use super::*;
-
-/// A two-key allow-list for the tests.
-const KEYS: [&str; 2] = ["alpha", "beta"];
-/// A small cap so the over-cap fixtures stay short.
-const CAP: usize = 16;
-
-#[test]
-fn a_known_key_resolves_to_its_allow_list_entry() {
-    assert_eq!(
-        resolve_bucket_key("beta", &KEYS).expect("beta is allowed"),
-        "beta"
-    );
-}
-
-#[test]
-fn an_unknown_key_is_refused() {
-    assert!(matches!(
-        resolve_bucket_key("gamma", &KEYS),
-        Err(StateBucketError::Key(ref key)) if key == "gamma"
-    ));
-}
-
-#[test]
-fn a_body_at_the_cap_is_accepted() {
-    assert!(check_bucket_cap(CAP, CAP).is_ok());
-}
-
-#[test]
-fn a_body_past_the_cap_is_refused() {
-    assert!(matches!(
-        check_bucket_cap(CAP + 1, CAP),
-        Err(StateBucketError::TooLarge { actual, cap })
-            if actual == CAP + 1 && cap == CAP
-    ));
-}
-
-#[test]
-fn a_valid_body_parses_to_its_value() {
-    let put = StateBucketValue::new("alpha", &KEYS, br#"{"n":1}"#).expect("a valid body");
-    assert_eq!(put.value(), &serde_json::json!({ "n": 1 }));
-}
-
-#[test]
-fn a_valid_put_holds_its_allow_list_key_and_compact_text() {
-    let put = StateBucketValue::new("beta", &KEYS, br#"{ "n" : [1, 2] }"#).expect("a valid body");
-    assert_eq!(put.key(), "beta");
-    assert_eq!(
-        put.text(),
-        r#"{"n":[1,2]}"#,
-        "the text is the value's compact serialization, not the body"
-    );
-    assert_eq!(put.into_value(), serde_json::json!({ "n": [1, 2] }));
-}
-
-#[test]
-fn a_non_json_body_is_refused() {
-    assert!(matches!(
-        StateBucketValue::new("alpha", &KEYS, b"{"),
-        Err(StateBucketError::NotJson { .. })
-    ));
-}
-
-#[test]
-fn the_key_is_judged_before_the_body() {
-    // A foreign key wins over a body that is also invalid.
-    assert!(matches!(
-        StateBucketValue::new("gamma", &KEYS, b"{"),
-        Err(StateBucketError::Key(_))
-    ));
-}
-
-#[test]
-fn the_size_is_judged_before_the_shape() {
-    // A body past the cap is refused as too-large even though it also
-    // fails to parse.
-    let oversized = vec![b'x'; STATE_BUCKET_VALUE_CAP + 1];
-    assert!(matches!(
-        StateBucketValue::new("alpha", &KEYS, &oversized),
-        Err(StateBucketError::TooLarge { .. })
-    ));
-}
-
-#[test]
-fn a_body_whose_compact_text_passes_the_cap_is_refused() {
-    // `1e15` is four bytes of body but eighteen of compact text
-    // (`1000000000000000.0`), so this body fits while its text does not.
-    let body = format!(
-        "[{}]",
-        vec!["1e15"; STATE_BUCKET_VALUE_CAP / 18 + 1].join(",")
-    );
-    assert!(body.len() <= STATE_BUCKET_VALUE_CAP, "the body fits");
-    assert!(matches!(
-        StateBucketValue::new("alpha", &KEYS, body.as_bytes()),
-        Err(StateBucketError::TooLarge { actual, cap })
-            if actual > STATE_BUCKET_VALUE_CAP && cap == STATE_BUCKET_VALUE_CAP
-    ));
-}
diff --git a/crates/workshop/support/src/state_bucket.rs b/crates/workshop/support/src/state_bucket.rs
deleted file mode 100644
index b6f6480cb..000000000
--- a/crates/workshop/support/src/state_bucket.rs
+++ /dev/null
@@ -1,122 +0,0 @@
-//! The JSON state-bucket validator shared by the workshop's two persisted
-//! ui-state buckets (the account-scoped user-state and the workspace
-//! file): one allow-list check on the key, one size cap, and one JSON
-//! parse, run once at the route to build the [`StateBucketValue`] the
-//! buckets' lower layers accept without checking again. A refusal is a
-//! support-level error the caller maps onto its own wire error, so the
-//! wire code and message stay the caller's.
-
-use serde_json::Value;
-
-/// The largest value either state bucket accepts, in bytes of JSON text.
-pub const STATE_BUCKET_VALUE_CAP: usize = 1 << 20;
-
-/// A state-bucket refusal: one variant per way a put is refused. The
-/// bucket crates map each onto their own wire error, so the wire code
-/// and message stay the bucket's.
-#[derive(Debug, thiserror::Error)]
-pub enum StateBucketError {
-    /// The key is outside the allow-list.
-    #[error("state-bucket key {0:?} is not allowed")]
-    Key(String),
-
-    /// The value's JSON text exceeds the cap.
-    #[error("state-bucket value is {actual} bytes; at most {cap} bytes are allowed")]
-    TooLarge {
-        /// The size of the refused value.
-        actual: usize,
-        /// The cap it exceeded.
-        cap: usize,
-    },
-
-    /// The value does not parse as JSON.
-    #[error("state-bucket value is not JSON")]
-    NotJson {
-        /// The parse refusal.
-        #[source]
-        source: serde_json::Error,
-    },
-}
-
-/// One validated state-bucket put: an allow-listed key and a JSON value
-/// whose compact text fits under [`STATE_BUCKET_VALUE_CAP`].
-#[derive(Debug)]
-pub struct StateBucketValue {
-    /// The allow-list entry the key resolved to.
-    key: &'static str,
-    /// The parsed value.
-    value: Value,
-    /// The value's compact JSON text, the form the buckets store.
-    text: String,
-}
-
-impl StateBucketValue {
-    /// Validates one put, in cheapest-refusal-first order: `key` against
-    /// `allowed`, the body's size against the cap, then the body's shape.
-    /// The compact text is held to the same cap, because a body under it
-    /// can re-serialize past it (`1e15` becomes `1000000000000000.0`).
-    ///
-    /// # Errors
-    /// Returns [`StateBucketError::Key`], [`StateBucketError::TooLarge`], or
-    /// [`StateBucketError::NotJson`] for a refused input.
-    pub fn new(key: &str, allowed: &[&'static str], body: &[u8]) -> Result<Self, StateBucketError> {
-        let key = resolve_bucket_key(key, allowed)?;
-        check_bucket_cap(body.len(), STATE_BUCKET_VALUE_CAP)?;
-        let value: Value =
-            serde_json::from_slice(body).map_err(|source| StateBucketError::NotJson { source })?;
-        let text = value.to_string();
-        check_bucket_cap(text.len(), STATE_BUCKET_VALUE_CAP)?;
-        Ok(Self { key, value, text })
-    }
-
-    /// The allow-list entry the key resolved to.
-    #[must_use]
-    pub fn key(&self) -> &'static str {
-        self.key
-    }
-
-    /// The parsed value.
-    #[must_use]
-    pub fn value(&self) -> &Value {
-        &self.value
-    }
-
-    /// The value's compact JSON text.
-    #[must_use]
-    pub fn text(&self) -> &str {
-        &self.text
-    }
-
-    /// The parsed value, without the key and text.
-    #[must_use]
-    pub fn into_value(self) -> Value {
-        self.value
-    }
-}
-
-/// Resolves `key` to its allow-list entry.
-///
-/// # Errors
-/// Returns [`StateBucketError::Key`] when `key` is not in `allowed`.
-fn resolve_bucket_key<'a>(key: &str, allowed: &[&'a str]) -> Result<&'a str, StateBucketError> {
-    allowed
-        .iter()
-        .copied()
-        .find(|allowed| *allowed == key)
-        .ok_or_else(|| StateBucketError::Key(key.to_owned()))
-}
-
-/// Checks that a value whose JSON text is `actual` bytes fits under `cap`.
-///
-/// # Errors
-/// Returns [`StateBucketError::TooLarge`] past `cap`.
-fn check_bucket_cap(actual: usize, cap: usize) -> Result<(), StateBucketError> {
-    if actual > cap {
-        return Err(StateBucketError::TooLarge { actual, cap });
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-#[path = "state_bucket-tests.rs"]
-mod tests;
diff --git a/crates/workshop/support/tests/it/config.rs b/crates/workshop/support/tests/it/config.rs
deleted file mode 100644
index 5bbb539ef..000000000
--- a/crates/workshop/support/tests/it/config.rs
+++ /dev/null
@@ -1,286 +0,0 @@
-//! `workshop.toml` loading tests: parsing, interpolation, and defaults,
-//! driven through the public API.
-
-use std::path::{Path, PathBuf};
-
-use workshop_support::{Config, ConfigError};
-
-#[test]
-fn parses_fixture_and_interpolates_from_environment() {
-    let path_value = std::env::var("PATH").expect("PATH is set on every supported platform");
-    let raw = r#"
-[gateway]
-base_url = "http://127.0.0.1:8081"
-api_key = "${PATH}"
-"#;
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.gateway.base_url, "http://127.0.0.1:8081");
-    assert_eq!(config.gateway.api_key, path_value);
-}
-
-#[test]
-fn defaults_fill_server() {
-    let raw = r#"
-[gateway]
-base_url = "http://127.0.0.1:8081"
-api_key = "k"
-"#;
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.server.bind, "127.0.0.1:7910");
-}
-
-#[test]
-fn an_unknown_section_is_rejected() {
-    let raw = r#"
-[gateway]
-base_url = "http://127.0.0.1:8081"
-api_key = "k"
-
-[unknown]
-key = "x"
-"#;
-    assert!(
-        matches!(Config::from_toml_str(raw), Err(ConfigError::Parse { .. })),
-        "an unknown section is rejected instead of silently ignored"
-    );
-}
-
-#[test]
-fn explicit_sections_override_defaults() {
-    let raw = r#"
-[gateway]
-base_url = "http://127.0.0.1:8081"
-api_key = "k"
-
-[server]
-bind = "127.0.0.1:9000"
-"#;
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.server.bind, "127.0.0.1:9000");
-}
-
-#[test]
-fn path_defaults_anchor_beside_the_config_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(
-        &path,
-        "[gateway]\nbase_url = \"http://127.0.0.1:8081\"\napi_key = \"k\"\n",
-    )
-    .expect("write fixture");
-    let config = Config::load(&path).expect("fixture loads");
-    assert_eq!(
-        config.server.state_dir,
-        dir.path(),
-        "an absent state_dir is the config file's directory"
-    );
-    assert_eq!(
-        config.agents.path,
-        dir.path().join("agents"),
-        "an absent agents path is agents/ beside the config file"
-    );
-
-    // Without a file, the anchor degrades to the working directory.
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.server.state_dir, PathBuf::from("."));
-    assert_eq!(config.agents.path, Path::new(".").join("agents"));
-}
-
-#[test]
-fn explicit_state_dir_and_agents_path_are_kept_verbatim() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(
-        &path,
-        "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n\n\
-         [server]\nstate_dir = \"state\"\n\n[agents]\npath = \"my-agents\"\n",
-    )
-    .expect("write fixture");
-    let config = Config::load(&path).expect("fixture loads");
-    assert_eq!(
-        config.server.state_dir,
-        PathBuf::from("state"),
-        "an explicit state_dir is not re-anchored"
-    );
-    assert_eq!(
-        config.agents.path,
-        PathBuf::from("my-agents"),
-        "an explicit agents path is not re-anchored"
-    );
-}
-
-#[test]
-fn double_dollar_is_literal() {
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"cost $$5\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.gateway.api_key, "cost $5");
-}
-
-#[test]
-fn unset_variable_interpolates_to_empty() {
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"${RVG_WB_DEFINITELY_UNSET_XYZ}\"\n";
-    let config = Config::from_toml_str(raw).expect("unset variable resolves to empty");
-    assert_eq!(config.gateway.api_key, "");
-}
-
-#[test]
-fn an_empty_base_url_is_kept_as_the_not_explicit_signal() {
-    let raw = "[gateway]\nbase_url = \"${RVG_WB_DEFINITELY_UNSET_XYZ}\"\napi_key = \"k\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(
-        config.gateway.base_url, "",
-        "no default is filled: endpoint resolution reads empty as not explicit"
-    );
-}
-
-#[test]
-fn explicit_base_url_is_kept() {
-    let raw = "[gateway]\nbase_url = \"http://gw:9999\"\napi_key = \"k\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.gateway.base_url, "http://gw:9999");
-}
-
-#[test]
-fn unclosed_interpolation_is_an_error() {
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"${UNCLOSED\"\n";
-    let err = Config::from_toml_str(raw).expect_err("unclosed interpolation must fail");
-    assert!(
-        err.to_string().starts_with("interpolation: "),
-        "expected Interpolation, got {err:?}"
-    );
-}
-
-#[test]
-fn missing_gateway_section_is_an_error() {
-    let err = Config::from_toml_str("[server]\nbind = \"127.0.0.1:9000\"\n")
-        .expect_err("gateway section is required");
-    assert!(
-        matches!(err, ConfigError::Parse { .. }),
-        "expected Parse, got {err:?}"
-    );
-}
-
-#[test]
-fn missing_file_names_the_expected_path() {
-    let err = Config::load(Path::new("definitely-missing-workshop.toml"))
-        .expect_err("missing file must fail");
-    assert!(
-        matches!(err, ConfigError::NotFound { .. }),
-        "expected NotFound, got {err:?}"
-    );
-    assert!(
-        err.to_string().contains("definitely-missing-workshop.toml"),
-        "error names the path: {err}"
-    );
-}
-
-#[test]
-fn unreadable_existing_file_is_a_read_error() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(&path, "[gateway]\n").expect("write fixture");
-    // A directory-shaped read failure: replace the file with a
-    // directory of the same name so the read fails for a reason other
-    // than NotFound.
-    std::fs::remove_file(&path).expect("remove fixture");
-    std::fs::create_dir(&path).expect("directory in the file's place");
-    let err = Config::load(&path).expect_err("unreadable path must fail");
-    assert!(
-        matches!(err, ConfigError::Read { .. }),
-        "expected Read, got {err:?}"
-    );
-}
-
-#[test]
-fn parse_error_names_the_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("broken-workshop.toml");
-    std::fs::write(&path, "[gateway\n").expect("write fixture");
-    let err = Config::load(&path).expect_err("malformed TOML must fail");
-    assert!(
-        matches!(err, ConfigError::Parse { .. }),
-        "expected Parse, got {err:?}"
-    );
-    assert!(
-        err.to_string().contains("broken-workshop.toml"),
-        "error names the path: {err}"
-    );
-}
-
-#[test]
-fn load_reads_and_parses_a_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(
-        &path,
-        "[gateway]\nbase_url = \"http://127.0.0.1:8081\"\napi_key = \"k\"\n",
-    )
-    .expect("write fixture");
-    let config = Config::load(&path).expect("fixture loads");
-    assert_eq!(config.gateway.api_key, "k");
-}
-
-#[test]
-fn debug_redacts_the_gateway_api_key() {
-    let raw = "[gateway]\nbase_url = \"http://127.0.0.1:8081\"\napi_key = \"secret-key\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    for rendered in [format!("{:?}", config.gateway), format!("{config:?}")] {
-        assert!(!rendered.contains("secret-key"), "key leaked: {rendered}");
-        assert!(
-            rendered.contains("http://127.0.0.1:8081"),
-            "base_url is still shown: {rendered}"
-        );
-    }
-}
-
-#[test]
-fn the_agents_mcp_setting_parses_to_its_path_and_is_kept_verbatim() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(
-        &path,
-        "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n\n[agents]\nmcp = \"servers/mcp.json\"\n",
-    )
-    .expect("write fixture");
-    let config = Config::load(&path).expect("fixture loads");
-    assert_eq!(
-        config.agents.mcp,
-        Some(PathBuf::from("servers/mcp.json")),
-        "an explicit mcp path is not re-anchored beside the config file"
-    );
-}
-
-#[test]
-fn an_absent_agents_mcp_setting_is_none() {
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(config.agents.mcp, None, "no setting means no MCP servers");
-}
-
-#[test]
-fn the_agents_plugins_setting_parses_to_its_path_and_is_kept_verbatim() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("workshop.toml");
-    std::fs::write(
-        &path,
-        "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n\n[agents]\nplugins = \"my-plugins\"\n",
-    )
-    .expect("write fixture");
-    let config = Config::load(&path).expect("fixture loads");
-    assert_eq!(
-        config.agents.plugins,
-        Some(PathBuf::from("my-plugins")),
-        "an explicit Plugin directory is not re-anchored beside the config file"
-    );
-}
-
-#[test]
-fn an_absent_agents_plugins_setting_is_none() {
-    let raw = "[gateway]\nbase_url = \"http://x\"\napi_key = \"k\"\n";
-    let config = Config::from_toml_str(raw).expect("fixture parses");
-    assert_eq!(
-        config.agents.plugins, None,
-        "no setting means no Plugin directory"
-    );
-}
diff --git a/crates/workshop/support/tests/it/main.rs b/crates/workshop/support/tests/it/main.rs
deleted file mode 100644
index ddc1577df..000000000
--- a/crates/workshop/support/tests/it/main.rs
+++ /dev/null
@@ -1,3 +0,0 @@
-//! Integration tests for `workshop-support`.
-
-mod config;
diff --git a/crates/workshop/ui/AGENTS.md b/crates/workshop/ui/AGENTS.md
deleted file mode 100644
index 98460ff0e..000000000
--- a/crates/workshop/ui/AGENTS.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# workshop-ui
-
-- Copy Cursor. Cursor's IDE answers every UI question - look, layout, wording, and behavior - read from its installed `workbench.desktop.main.css` and `workbench.desktop.main.js`. The agent panel copies Cursor's workspace-sidebar agent, not the Glass Agents Window (`workbench.glass.main.*`) or the editor-tab agent.
diff --git a/crates/workshop/ui/THIRD_PARTY_NOTICES.md b/crates/workshop/ui/THIRD_PARTY_NOTICES.md
deleted file mode 100644
index cbd0bcbe1..000000000
--- a/crates/workshop/ui/THIRD_PARTY_NOTICES.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Third-Party Notices
-
-Source in this directory that derives from another project, with the notice its license requires. Packages consumed from `node_modules` carry their own license files and are not listed here.
-
-No derived source at present. The murm-ui dropdown port now lives in `crates/workshop/look/` (see its `THIRD_PARTY_NOTICES.md`); it left this package when the dropdown became a shared primitive.
diff --git a/crates/workshop/ui/build.mjs b/crates/workshop/ui/build.mjs
deleted file mode 100644
index 7567d06f6..000000000
--- a/crates/workshop/ui/build.mjs
+++ /dev/null
@@ -1,147 +0,0 @@
-// Bundles src/main.ts into dist/bundle/app-<hash>.js and copies the static
-// assets into dist/. The crate's build.rs performs the same steps into
-// OUT_DIR on `cargo build` (through the build-ui helper); this script
-// exists for the fast iteration workflow (`npm run watch` rebuilds on save
-// without a Rust recompile) and for the jsdom tests that import the built
-// bundle. `--out <dir>` redirects the output (default dist/); the build-ui
-// crate's drift test uses it to diff this script against the Rust
-// implementer without touching the working tree.
-import { copyFile, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const outFlag = process.argv.indexOf("--out");
-if (outFlag !== -1 && process.argv[outFlag + 1] === undefined) {
-  throw new Error("--out requires a directory argument");
-}
-const distDir =
-  outFlag === -1 ? path.join(uiDir, "dist") : path.resolve(uiDir, process.argv[outFlag + 1]);
-const srcDir = path.join(uiDir, "src");
-
-// The crate version (workspace [workspace.package] version), baked into the
-// bundle as __APP_VERSION__ for the About dialog. A missing or unparsable
-// workspace manifest falls back to the source's "dev" default.
-async function crateVersion() {
-  try {
-    const manifest = await readFile(path.join(uiDir, "..", "..", "..", "Cargo.toml"), "utf8");
-    return /^version\s*=\s*"([^"]+)"/m.exec(manifest)?.[1] ?? null;
-  } catch {
-    return null;
-  }
-}
-
-const version = await crateVersion();
-
-// Mirrored in the build-ui crate's WORKSHOP_STATIC_FILES.
-const STATIC_FILES = [
-  "index.html",
-  "style.css",
-  "pcm-worklet.js",
-  "icons/runvil-icon.png",
-  "icons/runvil-icon@2x.png",
-];
-
-// Always minified: the bundle is never inspected by hand, and matching the
-// release profile keeps the jsdom tests exercising what ships.
-//
-// Code splitting is on: the panel registry's import thunks (the agent
-// session's Shiki/TipTap graph, the editor's CodeMirror) become lazily
-// loaded chunks under dist/chunks/, and the initial load holds the entry
-// bundle plus the shared code it reaches. The entry bundle is the eagerly
-// loaded composition: `crates/workshop/ui/src/main.ts` and the
-// `*.contribution.ts` modules it imports. Lazy panels never import a
-// module inside it, directly or through another import. Everything else
-// that eager and lazy code both import, such as `@workshop/platform`,
-// `services/`, `base/`, and shared parts modules like
-// `parts/layout/zones.ts`, is shared code.
-// Every bundle file is content-hashed (the entry under bundle/, the chunks
-// under chunks/), so the server can mark them Cache-Control: immutable;
-// dist/manifest.json maps the logical names (app.js, app.css) to the
-// hashed files, and the dist copy of index.html is stamped with the hashed
-// URLs.
-const options = {
-  entryPoints: [path.join(srcDir, "main.ts")],
-  bundle: true,
-  format: "esm",
-  splitting: true,
-  target: "es2022",
-  minify: true,
-  entryNames: "bundle/app-[hash]",
-  chunkNames: "chunks/[name]-[hash]",
-  outdir: distDir,
-  logLevel: "info",
-  plugins: [
-    {
-      name: "stamp-hashed-assets",
-      setup(build) {
-        build.onEnd(async (result) => {
-          if (result.errors.length === 0) {
-            await stampHashedAssets();
-          }
-        });
-      },
-    },
-  ],
-  ...(version !== null && { define: { __APP_VERSION__: JSON.stringify(version) } }),
-};
-
-// dist/ is rebuilt from scratch so removed assets never linger. The index
-// page is excluded here: the stamp step writes it from the source with the
-// hashed bundle URLs on every build, watch rebuilds included.
-async function copyStatic() {
-  await mkdir(distDir, { recursive: true });
-  await Promise.all(
-    STATIC_FILES.filter((file) => file !== "index.html").map(async (file) => {
-      const target = path.join(distDir, file);
-      await mkdir(path.dirname(target), { recursive: true });
-      await copyFile(path.join(uiDir, file), target);
-    }),
-  );
-}
-
-// Finds the single hashed entry output of one kind under dist/bundle/.
-async function hashedEntry(extension) {
-  const bundleDir = path.join(distDir, "bundle");
-  const names = (await readdir(bundleDir)).filter(
-    (name) => name.startsWith("app-") && name.endsWith(extension),
-  );
-  if (names.length !== 1) {
-    throw new Error(`expected exactly one bundle/app-*${extension} output, found ${names.length}`);
-  }
-  return `bundle/${names[0]}`;
-}
-
-// Writes dist/manifest.json (the logical-to-hashed name map the server's
-// asset routes resolve through) and stamps the dist copy of index.html
-// with the hashed bundle URLs, so the page loads the immutable assets
-// directly. The stamp always reads the source index.html, so watch
-// rebuilds never double-stamp. Mirrored in the build-ui crate's finalize
-// step.
-async function stampHashedAssets() {
-  const manifest = {
-    "app.js": await hashedEntry(".js"),
-    "app.css": await hashedEntry(".css"),
-  };
-  await writeFile(path.join(distDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  const html = await readFile(path.join(uiDir, "index.html"), "utf8");
-  const stamped = html
-    .replace('href="/app.css"', `href="/${manifest["app.css"]}"`)
-    .replace('src="/app.js"', `src="/${manifest["app.js"]}"`);
-  if (stamped === html) {
-    throw new Error("index.html did not reference /app.js and /app.css; the stamp found nothing");
-  }
-  await writeFile(path.join(distDir, "index.html"), stamped);
-}
-
-if (process.argv.includes("--watch")) {
-  const context = await esbuild.context(options);
-  await copyStatic();
-  await context.watch();
-  console.log("watching ui/src for changes...");
-} else {
-  await rm(distDir, { recursive: true, force: true });
-  await esbuild.build(options);
-  await copyStatic();
-}
diff --git a/crates/workshop/ui/icons/runvil-icon.png b/crates/workshop/ui/icons/runvil-icon.png
deleted file mode 100644
index d7b7c171d..000000000
Binary files a/crates/workshop/ui/icons/runvil-icon.png and /dev/null differ
diff --git a/crates/workshop/ui/icons/runvil-icon@2x.png b/crates/workshop/ui/icons/runvil-icon@2x.png
deleted file mode 100644
index b96caedb1..000000000
Binary files a/crates/workshop/ui/icons/runvil-icon@2x.png and /dev/null differ
diff --git a/crates/workshop/ui/index.html b/crates/workshop/ui/index.html
deleted file mode 100644
index b7d4d6be5..000000000
--- a/crates/workshop/ui/index.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Runvil</title>
-<link rel="stylesheet" href="/app.css">
-<link rel="stylesheet" href="/style.css">
-</head>
-<body>
-<header class="ws-window-titlebar" hidden>
-  <div class="ws-window-titlebar__left">
-    <img class="ws-window-titlebar__icon" src="/icons/runvil-icon.png" srcset="/icons/runvil-icon.png 1x, /icons/runvil-icon@2x.png 2x" alt="" width="16" height="16">
-    <nav class="ws-window-titlebar__menus" aria-label="Application menus" role="menubar"></nav>
-  </div>
-  <div class="ws-window-titlebar__center ws-window-titlebar__drag"></div>
-  <div class="ws-window-titlebar__right">
-    <div class="ws-window-titlebar__controls">
-    <button type="button" class="ws-window-titlebar__control ws-window-titlebar__control--minimize" data-command="minimize" aria-label="Minimize">
-      <svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1" aria-hidden="true">
-        <path d="M2 6h8" />
-      </svg>
-    </button>
-    <button type="button" class="ws-window-titlebar__control ws-window-titlebar__control--maximize" data-command="toggle-maximize" aria-label="Maximize">
-      <svg class="ws-window-titlebar__glyph--maximize" width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1" aria-hidden="true">
-        <rect x="2.5" y="2.5" width="7" height="7" />
-      </svg>
-      <svg class="ws-window-titlebar__glyph--restore" width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1" aria-hidden="true" hidden>
-        <path d="M4.5 4.5v-2h6v6h-2" />
-        <rect x="1.5" y="4.5" width="6" height="6" />
-      </svg>
-    </button>
-    <button type="button" class="ws-window-titlebar__control ws-window-titlebar__control--close" data-command="close" aria-label="Close">
-      <svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1" aria-hidden="true">
-        <path d="M2.5 2.5l7 7M9.5 2.5l-7 7" />
-      </svg>
-    </button>
-    </div>
-  </div>
-</header>
-<div class="ws-desk">
-  <div class="ws-dock-column">
-    <div id="dock" class="ws-dock"></div>
-  </div>
-</div>
-<script type="module" src="/app.js"></script>
-</body>
-</html>
diff --git a/crates/workshop/ui/package.json b/crates/workshop/ui/package.json
deleted file mode 100644
index 79be68add..000000000
--- a/crates/workshop/ui/package.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  "name": "workshop-ui",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "description": "Runvil Workshop UI: TypeScript sources bundled by esbuild into dist/ and served by workshop-server.",
-  "engines": {
-    "node": ">=22"
-  },
-  "scripts": {
-    "build": "node build.mjs",
-    "watch": "node build.mjs --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "node --test \"test/**/*.mjs\" \"src/**/*.test.mjs\""
-  },
-  "dependencies": {
-    "@codemirror/autocomplete": "^6.20.3",
-    "@codemirror/commands": "^6.11.0",
-    "@codemirror/lang-javascript": "^6.2.5",
-    "@codemirror/lang-json": "^6.0.2",
-    "@codemirror/lang-markdown": "^6.5.2",
-    "@codemirror/lang-python": "^6.2.1",
-    "@codemirror/lang-rust": "^6.0.2",
-    "@codemirror/lang-yaml": "^6.1.3",
-    "@codemirror/language": "^6.12.4",
-    "@codemirror/legacy-modes": "^6.5.3",
-    "@codemirror/lint": "^6.9.7",
-    "@codemirror/search": "^6.7.1",
-    "@codemirror/state": "^6.7.1",
-    "@codemirror/view": "^6.43.9",
-    "@lezer/highlight": "^1.2.3",
-    "@tauri-apps/api": "^2.11.1",
-    "@tauri-apps/plugin-dialog": "^2.7.3",
-    "@tauri-apps/plugin-process": "^2.3.1",
-    "@tauri-apps/plugin-updater": "^2.11.0",
-    "@tiptap/core": "^3.31.0",
-    "@tiptap/extension-mention": "^3.31.0",
-    "@tiptap/extension-placeholder": "^3.31.0",
-    "@tiptap/pm": "^3.31.0",
-    "@tiptap/starter-kit": "^3.31.0",
-    "@tiptap/suggestion": "^3.31.0",
-    "@workshop/look": "*",
-    "@workshop/platform": "*",
-    "dockview": "^8.3.1",
-    "dompurify": "^3.4.14",
-    "marked": "^18.0.11",
-    "shiki": "^4.4.3"
-  },
-  "devDependencies": {
-    "@types/node": "^26.4.0"
-  }
-}
diff --git a/crates/workshop/ui/pcm-worklet.js b/crates/workshop/ui/pcm-worklet.js
deleted file mode 100644
index a4092517c..000000000
--- a/crates/workshop/ui/pcm-worklet.js
+++ /dev/null
@@ -1,65 +0,0 @@
-"use strict";
-
-const OUTPUT_SAMPLE_RATE = 24_000;
-const DEFAULT_CHUNK_SAMPLES = OUTPUT_SAMPLE_RATE / 10;
-
-// Converts the first input channel into exact little-endian mono PCM16.
-// Full 100 ms chunks cross to the page immediately. A final partial chunk
-// stays owned here until the page requests a flush before stopping.
-class Pcm16CaptureProcessor extends AudioWorkletProcessor {
-  constructor(options) {
-    super();
-    if (sampleRate !== OUTPUT_SAMPLE_RATE) {
-      throw new Error(`pcm16-capture requires a 24 kHz AudioContext, received ${sampleRate} Hz`);
-    }
-    const requested = options && options.processorOptions && options.processorOptions.chunkSamples;
-    this.chunkSamples =
-      Number.isSafeInteger(requested) && requested > 0 ? requested : DEFAULT_CHUNK_SAMPLES;
-    this.pending = new ArrayBuffer(this.chunkSamples * 2);
-    this.pendingView = new DataView(this.pending);
-    this.pendingSamples = 0;
-    this.port.onmessage = (event) => {
-      const type = event && event.data && event.data.type;
-      if (type === "clear") {
-        this.pendingSamples = 0;
-      } else if (type === "flush") {
-        this.flush();
-        this.port.postMessage({ type: "flushed" });
-      }
-    };
-  }
-
-  emit(samples) {
-    const bytes = samples * 2;
-    const output =
-      samples === this.chunkSamples ? this.pending : this.pending.slice(0, bytes);
-    this.port.postMessage(output, [output]);
-    this.pending = new ArrayBuffer(this.chunkSamples * 2);
-    this.pendingView = new DataView(this.pending);
-    this.pendingSamples = 0;
-  }
-
-  flush() {
-    if (this.pendingSamples > 0) {
-      this.emit(this.pendingSamples);
-    }
-  }
-
-  process(inputs) {
-    const channel = inputs[0] && inputs[0][0];
-    if (channel && channel.length > 0) {
-      for (let index = 0; index < channel.length; index += 1) {
-        const sample = Math.max(-1, Math.min(1, channel[index]));
-        const pcm = Math.round(sample < 0 ? sample * 0x8000 : sample * 0x7fff);
-        this.pendingView.setInt16(this.pendingSamples * 2, pcm, true);
-        this.pendingSamples += 1;
-        if (this.pendingSamples === this.chunkSamples) {
-          this.emit(this.chunkSamples);
-        }
-      }
-    }
-    return true;
-  }
-}
-
-registerProcessor("pcm16-capture", Pcm16CaptureProcessor);
diff --git a/crates/workshop/ui/src/base/paths.ts b/crates/workshop/ui/src/base/paths.ts
deleted file mode 100644
index d978c7ed3..000000000
--- a/crates/workshop/ui/src/base/paths.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-// Path string helpers shared across features. These operate on the
-// workspace's opaque path strings (forward or backslash separated);
-// they never touch a filesystem.
-
-/** The last non-empty segment after a slash or backslash, or undefined for an empty or root path. */
-export function lastSegment(path: string): string | undefined {
-  return path.split(/[\\/]/).filter(Boolean).pop();
-}
-
-/** The file's base name: the last segment after a slash or backslash. */
-export function baseName(path: string): string {
-  return lastSegment(path) ?? path;
-}
diff --git a/crates/workshop/ui/src/css.d.ts b/crates/workshop/ui/src/css.d.ts
deleted file mode 100644
index 1a8355d0d..000000000
--- a/crates/workshop/ui/src/css.d.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-// Ambient declaration for the colocated-CSS pattern: components import
-// their stylesheet for the side effect, esbuild extracts the CSS into
-// dist/app.css, and tsc needs the module shape declared to accept the
-// import. Side-effect only - no exports.
-declare module "*.css";
diff --git a/crates/workshop/ui/src/main.ts b/crates/workshop/ui/src/main.ts
deleted file mode 100644
index b8d2010f8..000000000
--- a/crates/workshop/ui/src/main.ts
+++ /dev/null
@@ -1,369 +0,0 @@
-import "@workshop/look/tokens.css";
-import "@workshop/look/controls.css";
-import "@workshop/look/shimmer.css";
-import "dockview/dist/styles/dockview.css";
-
-import "@workshop/look/sizes.css";
-import "@workshop/look/semantic.css";
-import "./tokens/component.css";
-
-import { createDockview } from "dockview";
-import { createToastStack } from "@workshop/look/toast";
-
-import { Commands } from "@workshop/platform/command-registry";
-import { DisposableStore, toDisposable } from "@workshop/platform/lifecycle";
-import { ModelService, MODEL_SERVICE } from "./services/model-service";
-import { CLOSED_EDITORS } from "./services/closed-editors";
-import { COMMANDS_HISTORY } from "./services/commands-history";
-import { EDITOR_SETTINGS_SERVICE } from "./services/editor-settings-service";
-import { LAYOUT_POLICY } from "./services/layout-policy";
-import { QUICK_INPUT_SERVICE } from "./services/quick-input-service";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { STATUS_INDICATORS } from "@workshop/platform/status-indicators";
-import { RECENT_FILES_STORE, RecentFilesStore } from "./services/recent-files-store";
-import { getService, registerService } from "@workshop/platform/service-registry";
-import { SpeechCaptureService, SPEECH_CAPTURE } from "./services/speech-capture";
-import { STT_STATUS, type SttStatus } from "./services/stt-status";
-import { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-import { TOAST_STACK } from "./services/toast-service";
-import { toastCommandFailures } from "./services/command-failure-toasts";
-import { TREE_STATE, TreeStateService } from "./services/tree-state-service";
-import { createUiStorage, UI_STORAGE } from "./services/ui-storage";
-import { UPDATES, UpdateService } from "./services/update-service";
-import { WorkbenchService } from "./services/workbench-service";
-import { WorkshopSocket } from "./services/workshop-socket";
-import { CommandCenter } from "./parts/chrome/command-center";
-import { ClosedEditors } from "./parts/editor/closed-editors";
-import { EditorSettingsService } from "./parts/editor/editor-settings-service";
-import { setupGatewayConfigBridge } from "./parts/gateway/gateway-config-bridge";
-import { ActivityIndicator } from "./parts/status/activity-indicator";
-import { MicMeter } from "./parts/status/mic-meter";
-import { StatusBar } from "./parts/status/status-bar";
-import { UpdateView } from "./parts/chrome/update-view";
-import { setupWindowChrome } from "./parts/chrome/window-chrome";
-// Panel types register through this import's contribution modules, which
-// must evaluate before the layout boots: keep it static.
-import { setupWindowMenus } from "./parts/menu/index";
-import { KeybindingDispatcher } from "./parts/layout/keybinding-dispatcher";
-import { CommandsHistory } from "./parts/quickinput/commands-history";
-import { QuickInputService } from "./parts/quickinput/quick-input";
-import { setupWorkspaceDrops } from "./parts/workspace/workspace-drops";
-import { register as registerWorkspaceDocument } from "./parts/workspace-document/index";
-import { persistZoom, restoreZoom } from "./parts/chrome/zoom";
-import { applyLayoutOrDefault } from "./parts/layout/layout-boot";
-import { startLayoutPersistence } from "./parts/layout/layout-persistence";
-import { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./parts/layout/panel-types";
-import { createAgentPaneHeader } from "./parts/agent/agent-pane-header";
-import { dockTheme } from "./parts/layout/dock-theme";
-import { dropPositionResolver } from "./parts/layout/drop-position";
-import { createWatermark } from "./parts/layout/watermark";
-import {
-  bindActiveEditorKey,
-  ensureZoneGroup,
-  initZones,
-  leftZonePreferredWidth,
-  openInZone,
-  rightZonePreferredWidth,
-} from "./parts/layout/zones";
-
-// The root of the ownership tree: every top-level binding registers here,
-// so the whole composition tears down with one dispose() call.
-const disposables = new DisposableStore();
-const disposePage = (): void => disposables.dispose();
-window.addEventListener("pagehide", disposePage, { once: true });
-disposables.add(toDisposable(() => window.removeEventListener("pagehide", disposePage)));
-const suppressNativeContextMenu = (event: MouseEvent): void => event.preventDefault();
-document.addEventListener("contextmenu", suppressNativeContextMenu, { capture: true });
-disposables.add(
-  toDisposable(() =>
-    document.removeEventListener("contextmenu", suppressNativeContextMenu, { capture: true }),
-  ),
-);
-
-// The UI-state adapter: the server-backed replacement for browser storage,
-// which the per-launch loopback port made session-scoped. Both buckets
-// (the user's ui-state.json, the open workspace file) preload here, ahead
-// of every service resolution and the dock, so each store reads its
-// initial value synchronously from the cache when it is built. The
-// preload never rejects: a bucket that fails or hangs past the timeout
-// reads as empty with one warning, and boot continues on defaults, so a
-// slow or dead server delays the page by at most the timeout.
-const storage = createUiStorage();
-await storage.preload(3000);
-registerService(UI_STORAGE, () => storage);
-
-// The user-scoped stores rebind to the live adapter here, ahead of their
-// first resolution: each is built from its user-bucket value and writes
-// every change back to the same key. The import-time default factories
-// (defaults, no-op writer) stay behind only for a consumer that resolves
-// a token before this line, which none does at boot.
-registerService(
-  EDITOR_SETTINGS_SERVICE,
-  () =>
-    new EditorSettingsService(storage.get("user", "editor_settings"), (value) =>
-      storage.set("user", "editor_settings", value),
-    ),
-);
-registerService(
-  RECENT_FILES_STORE,
-  () =>
-    new RecentFilesStore(storage.get("user", "recent_files"), (value) =>
-      storage.set("user", "recent_files", value),
-    ),
-);
-registerService(
-  COMMANDS_HISTORY,
-  () =>
-    new CommandsHistory(storage.get("user", "commands_history"), (value) =>
-      storage.set("user", "commands_history", value),
-    ),
-);
-// The tree's expanded folders belong to the workspace: they seed from
-// the open file's "tree" value and write back to the same key, debounced.
-registerService(
-  TREE_STATE,
-  () =>
-    new TreeStateService(storage.get("workspace", "tree"), (value) =>
-      storage.set("workspace", "tree", value),
-    ),
-);
-// The roots listing the tree, the window title, and the editor watermark
-// share is dropped on every workspace change, by the service itself rather
-// than by whichever panel is open: with Explorer closed (the state the empty
-// editor's watermark shows in) no tree panel is alive to do it. Followed
-// here, ahead of the first reader, so every reader on the same event reads
-// the fresh listing.
-disposables.add(getService(TREE_STATE).followWorkspaceChanges(window));
-// The closed-editor stack belongs to the workspace too: it seeds from the
-// file's "closed_editors" value and writes back on every close and
-// reopen. Bound here, ahead of the dock, so the editor chunk's tracking
-// (installed when the chunk first loads) resolves the live-bound stack.
-registerService(
-  CLOSED_EDITORS,
-  () =>
-    new ClosedEditors(storage.get("workspace", "closed_editors"), (value) =>
-      storage.set("workspace", "closed_editors", value),
-    ),
-);
-
-// One persistent socket delivers the server's downstream JSON - status
-// updates the status bar renders as they arrive, catalog pushes, and
-// workbench snapshots. Chat goes over the agent panel's own /agents/ws
-// socket, composed inside the panel. The status bar builds its own
-// view (@workshop/look) and appends it as the body's full-width footer.
-const statusBar = disposables.add(new StatusBar());
-const updates = disposables.add(new UpdateService());
-// Help > About resolves it for its update button.
-registerService(UPDATES, () => updates);
-// The shared toast stack shows the update notifications, the views'
-// confirmations (a copied message), a status-bar error, and a failed
-// command; it registers so those views reach it without importing the app.
-// It sits 25px from the bottom by default, which clears the status bar.
-const toasts = createToastStack();
-document.body.append(toasts.element);
-disposables.add(toDisposable(() => toasts.element.remove()));
-registerService(TOAST_STACK, () => toasts);
-disposables.add(toastCommandFailures(Commands, toasts));
-disposables.add(new UpdateView(updates, toasts));
-updates.startAutoCheck();
-// The custom title bar stays hidden in a plain browser; it only appears
-// when the desktop app sets its initialization flag.
-disposables.add(setupWindowChrome());
-// Native webview zoom does not persist across sessions, so the stored
-// factor is re-applied on every boot from the user bucket; the writer
-// installs after the restore so the restore never echoes the factor back.
-restoreZoom(storage.get("user", "zoom"));
-disposables.add(persistZoom((value) => storage.set("user", "zoom", value)));
-// Native Explorer drops arrive as a typed event from the desktop app;
-// each path becomes a workspace grant. Inert in a plain browser.
-disposables.add(setupWorkspaceDrops(statusBar));
-// The Gateway Config panel's postMessage bridge: API forwards go through
-// the workshop server's key-attaching proxy, and the panel's action
-// notifications (apply, revert, download-started) land on the status bar.
-disposables.add(setupGatewayConfigBridge({ statusBar }));
-const workshopSocket = disposables.add(new WorkshopSocket());
-
-// The model catalog and selection live in the ModelService, not module
-// state: the agent toolbar's picker resolves the service from the
-// registry and observes its change events. Selecting a model is a
-// command the socket sends to the server; the selection itself changes
-// only when a workbench snapshot arrives. The service subscribes itself
-// to the socket's catalog push, so a gateway returning after an outage
-// heals a boot-time empty catalog in place.
-const modelService = disposables.add(
-  new ModelService((id) => workshopSocket.selectModel(id), workshopSocket.onModels),
-);
-
-// The rest of the server-owned workbench state - profiles, switch
-// progress, chat gating - lives in the WorkbenchService, fed from the
-// same snapshots.
-const workbenchService = disposables.add(new WorkbenchService());
-const speechCapture = new SpeechCaptureService();
-
-// The composition root's services register into the service registry;
-// the lazy feature directories (the panels) resolve them from there when
-// their chunks activate, instead of receiving them through the dock's
-// createComponent seam.
-registerService(STATUS_BAR, () => statusBar);
-registerService(STATUS_INDICATORS, () => statusBar);
-// The recording LED is the product's indicator, and dictation reaches it
-// and the bar's text through one port. Both register here, before the
-// layout restores: a restored agent panel resolving no port would fall
-// back to a silent one and the LED would die without an error.
-const recording = disposables.add(
-  statusBar.register({ id: "recording", name: "Recording indicator", order: 0 }),
-);
-const sttStatus: SttStatus = {
-  showLocal: (label, severity) => statusBar.showLocal(label, severity),
-  setRecording: (on) => recording.set(on ? "red" : null),
-};
-registerService(STT_STATUS, () => sttStatus);
-registerService(MODEL_SERVICE, () => modelService);
-registerService(SPEECH_CAPTURE, () => speechCapture);
-// The mic meter stands left of the recording LED and follows the same
-// shared capture the dictation surfaces take turns owning.
-disposables.add(new MicMeter(statusBar, speechCapture));
-
-// The focus-tracking and editor-settings services resolve at boot so the
-// inputFocus/editorTextFocus/textInputFocus and config.editor.* context
-// keys exist from first paint; both self-register with default factories,
-// and the settings module stays CodeMirror-free so the lazy chunk split
-// holds.
-disposables.add(getService(TEXT_CONTROL_SERVICE));
-disposables.add(getService(EDITOR_SETTINGS_SERVICE));
-
-// The quick input widget: one instance for the page lifetime, registered
-// for the quick-access actions (Command Palette, Go to File, Go to Line)
-// to resolve at call time. Its panel anchors under the title bar.
-const quickInput = disposables.add(new QuickInputService());
-registerService(QUICK_INPUT_SERVICE, () => quickInput);
-
-// The command center: the title bar's center drag region holds the
-// folder-name button (the window title, opening quick open) as a no-drag child.
-const titleCenter = document.querySelector<HTMLElement>(".ws-window-titlebar__center");
-if (!titleCenter) {
-  throw new Error("DOM Error: .ws-window-titlebar__center not found in the page.");
-}
-disposables.add(new CommandCenter(titleCenter));
-
-// The lazy directories register through the panel registry when their
-// chunks load; every action, menu row, and keybinding registers eagerly
-// from the contribution surface the menu bootstrap imports.
-// The activity LED is the product's indicator: the status frame type is
-// product protocol, so the bar holds the slot and this part fills it.
-const activityIndicator = disposables.add(new ActivityIndicator(statusBar));
-disposables.add(
-  workshopSocket.onStatus((frame) => {
-    statusBar.render(frame);
-    activityIndicator.render(frame);
-  }),
-);
-// A dropped socket means every in-flight status is stale; the bar returns
-// to its reconnecting state until the observer speaks again.
-disposables.add(
-  workshopSocket.onDisconnect(() => {
-    statusBar.reset();
-    activityIndicator.reset();
-  }),
-);
-workshopSocket.connect();
-
-// The default layout is product policy, not layout mechanics: the tree
-// opens left and the agent session right, an empty editor group sits
-// between them from the first paint (its watermark is the empty window's
-// face), and both anchors and the editor group come back whenever a
-// restored layout lost one. Registered before the dock boots, because the
-// boot's layout apply resolves it.
-registerService(LAYOUT_POLICY, () => ({
-  anchors: ["tree", "agent"],
-  emptyZones: ["main"] as const,
-  seed: () => {
-    const tree = openInZone("tree", {});
-    const agent = openInZone("agent", {});
-    ensureZoneGroup("main");
-    // A lone group always fills the dock, so the sides take their widths only
-    // once the editor group shares the row, and the editor group keeps the
-    // rest: the tree opens at min(300px, W/4) and never under 214px, the
-    // chat pane at min(400px, W/4) and never under 300px.
-    tree.group.api.setSize({ width: leftZonePreferredWidth(dock.width) });
-    agent.group.api.setSize({ width: rightZonePreferredWidth(dock.width) });
-  },
-}));
-
-// Panels are created through the panel registry: each component name
-// maps to a lazy import thunk, and openInZone places panels by zone
-// affinity (tree left, editors main, the agent session right). The
-// workbench is always unlocked: user drags rearrange panels at any time,
-// and the zone registry records the placement overrides. Every panel
-// renders the generic chip tab (no singleTabMode: a lone tab stretched
-// full-width reads as a second title bar and hides that tabs exist at
-// all), which drops the close button and tab menu for a type registered
-// closable: false, the Workshop tree.
-const dockEl = document.getElementById("dock") as HTMLDivElement;
-const dock = createDockview(dockEl, {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  // The right zone's New Agent, More Actions, and Close buttons; the
-  // stylesheet shows them for that zone's groups only.
-  createRightHeaderActionComponent: createAgentPaneHeader,
-  // An empty editor group shows the product mark and shortcut rows.
-  createWatermarkComponent: createWatermark,
-  defaultTabComponent: PANEL_TAB,
-  // The dark theme with Cursor's thin tab-drop line (zones.css holds the palette).
-  theme: dockTheme,
-  // Drops dock by thirds of the target, so a pointer within 10% of an edge
-  // docks to that edge.
-  dropPositionResolver,
-  // Cursor draws 1px borders between its parts.
-  hideBorders: false,
-  // Cursor has no overflow list: tabs scroll in their strip.
-  disableTabsOverflowList: true,
-  disableFloatingGroups: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-disposables.add(dock);
-disposables.add(speechCapture);
-disposables.add(initZones(dock));
-disposables.add(bindActiveEditorKey(dock));
-// Dockview first sizes itself from a resize callback that lands after this
-// module runs, and the default layout's pixel widths hold only against a
-// sized dock, so the dock takes its element's size before the boot apply.
-dock.layout(dockEl.clientWidth, dockEl.clientHeight);
-
-// The dock layout belongs to the workspace: the preloaded workspace
-// bucket's "layout" value restores, or any failure falls back to the
-// layout policy's default (layout-boot.ts). The debounced saver installs after
-// the boot layout is in place, so the restore never echoes the same
-// envelope back to the file.
-applyLayoutOrDefault(dock, storage.get("workspace", "layout"));
-disposables.add(startLayoutPersistence(dock, (value) => storage.set("workspace", "layout", value)));
-// The keybinding dispatcher owns every registered chord: one
-// capture-phase listener resolving through the keybinding registry the
-// contributions populate.
-disposables.add(new KeybindingDispatcher());
-
-// The title-bar menus dispatch through the command and menu registries
-// the contribution surface populates (imported by the menu bootstrap at
-// module scope); the keyboard chords reach the same commands through the
-// dispatcher. The bar generates its buttons from the MenubarMainMenu
-// submenu rows.
-disposables.add(setupWindowMenus());
-// The workspace-document actions (Open Workspace from File...) register
-// eagerly with the contribution surface above; the feature's activation
-// hands their registrations to the ownership tree.
-disposables.add(registerWorkspaceDocument());
-
-// The server-owned selection and the rest of the workbench state arrive
-// in the same snapshot: the model service takes the selection, the
-// workbench service the whole frame.
-disposables.add(
-  workshopSocket.onWorkbench((frame) => {
-    modelService.applySelected(frame.selected);
-    workbenchService.applySnapshot(frame);
-  }),
-);
-
-// Every push handler above is wired, so release the socket's boot queue:
-// pushes that raced this module's execution now replay in arrival order.
-workshopSocket.ready();
diff --git a/crates/workshop/ui/src/parts/agent/agent-commands.ts b/crates/workshop/ui/src/parts/agent/agent-commands.ts
deleted file mode 100644
index 85d7aae6e..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-commands.ts
+++ /dev/null
@@ -1,259 +0,0 @@
-// The agent pane's commands, as plain functions over the dock: open or hide
-// the chat, start a chat (reusing an empty one), stop the running turn,
-// close and cycle the chat tabs, rename one, and open the composer's menus.
-// agent.contribution.ts registers them as actions with their keybindings;
-// the pane header's buttons and its "..." menu run the same actions.
-//
-// This module is eager and the panel is a lazy chunk, so every command
-// reaches a chat through the dock and its structural handle
-// (agent-handle.ts), never the panel class. A chat whose chunk has not
-// loaded yet has no handle, and the commands that need one wait for the
-// chunk (loadPanelType) before they act.
-
-import type { IDockviewPanel } from "dockview";
-
-import { DOCK, loadPanelType } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { closeActiveEditor, closeOtherEditors } from "../layout/panel-close";
-import { setTabName, tabNameOf } from "../layout/tab-names";
-import { groupOfZone, openInZone, setZoneVisibility, zoneOfPanel } from "../layout/zones";
-import { showPanelDialog } from "../shared/panel-dialog";
-import { agentHandleOf, type AgentPanelHandle } from "./agent-handle";
-
-/** The panel type the chat tabs are. */
-const AGENT_TYPE = "agent";
-
-/** The pane header's "..." menu. */
-export const AGENT_PANE_MENU = "workbench/agentPane/more";
-
-/** Every chat tab in the dock, in dock order. */
-export function agentPanels(): IDockviewPanel[] {
-  return getService(DOCK).panels.filter((panel) => panel.api.component === AGENT_TYPE);
-}
-
-/** The loaded handle behind a chat tab, or null while its chunk is loading. */
-function handleOf(panel: IDockviewPanel): AgentPanelHandle | null {
-  return agentHandleOf(panel.view.content);
-}
-
-/** The active panel when it is a chat tab. */
-function activeAgentPanel(): IDockviewPanel | undefined {
-  const active = getService(DOCK).activePanel;
-  return active !== undefined && active.api.component === AGENT_TYPE ? active : undefined;
-}
-
-/** The chat tab a `{ panelId }` argument names, else the active one. */
-function targetPanel(arg: unknown): IDockviewPanel | undefined {
-  if (typeof arg === "object" && arg !== null && "panelId" in arg && typeof arg.panelId === "string") {
-    const named = getService(DOCK).getPanel(arg.panelId);
-    return named !== undefined && named.api.component === AGENT_TYPE ? named : undefined;
-  }
-  return activeAgentPanel();
-}
-
-/**
- * Focuses a chat's composer, waiting for the chunk when the chat is still
- * loading. A failed chunk load is dropped on purpose: the chat's own
- * placeholder shares this load (loadPanelType memoizes the in-flight promise)
- * and already shows the error in the pane (LazyPanel in panel-types.ts), and
- * with no panel there is nothing to focus. A throw from `focusInput` is not a
- * load failure and is left to surface.
- */
-function focusChat(panel: IDockviewPanel): void {
-  void loadPanelType(AGENT_TYPE).then(
-    () => {
-      handleOf(panel)?.focusInput();
-    },
-    () => undefined,
-  );
-}
-
-/** Shows the right zone when the chat pane was hidden. */
-function revealChatPane(): void {
-  const group = groupOfZone("right");
-  if (group !== undefined && !group.api.isVisible) {
-    setZoneVisibility("right", true);
-  }
-}
-
-/** Hides the chat pane (the right zone's group stays live, with its tabs). */
-export function hideChatPane(): void {
-  setZoneVisibility("right", false);
-}
-
-/** A fresh chat tab in the right zone. */
-function openNewChat(): IDockviewPanel {
-  return openInZone(AGENT_TYPE, { instance: window.crypto.randomUUID() });
-}
-
-/**
- * Open Chat (Ctrl+L, Ctrl+I): with focus in a chat, hides the pane;
- * otherwise reveals it, makes a chat active (opening one when none
- * exists), and focuses its composer.
- */
-export function openChat(): void {
-  const chats = agentPanels();
-  if (chats.some((panel) => handleOf(panel)?.hasFocus() === true)) {
-    hideChatPane();
-    return;
-  }
-  const group = groupOfZone("right");
-  const active = group?.activePanel;
-  const target =
-    active !== undefined && active.api.component === AGENT_TYPE
-      ? active
-      : chats.find((panel) => zoneOfPanel(panel) === "right");
-  if (target === undefined) {
-    focusChat(openNewChat());
-    return;
-  }
-  revealChatPane();
-  target.api.setActive();
-  focusChat(target);
-}
-
-/**
- * New Chat and New Chat Tab (Ctrl+Shift+L, Ctrl+Shift+I, Ctrl+T, Ctrl+N,
- * and the header's +): reuses the active chat when it is empty, else the
- * first empty one, else opens a new tab. The pane is revealed and the
- * composer focused either way.
- */
-export function newChat(): void {
-  const chats = agentPanels();
-  const active = activeAgentPanel();
-  const empties = chats.filter((panel) => handleOf(panel)?.isEmpty() === true);
-  const reused = active !== undefined && empties.includes(active) ? active : empties[0];
-  if (reused === undefined) {
-    focusChat(openNewChat());
-    return;
-  }
-  revealChatPane();
-  reused.api.setActive();
-  focusChat(reused);
-}
-
-/** Stop (Ctrl+Shift+Backspace): cancels the active chat's running turn. */
-export function stopTurn(): void {
-  const active = activeAgentPanel();
-  if (active !== undefined) {
-    handleOf(active)?.cancelTurn();
-  }
-}
-
-/** Voice Input (Ctrl+Shift+Space): starts or ends a dictation take in the active chat. */
-export function toggleVoiceInput(): void {
-  const active = activeAgentPanel();
-  if (active !== undefined) {
-    handleOf(active)?.toggleVoiceInput();
-  }
-}
-
-/** Ctrl+. and Ctrl+/ : the active chat's mode and model menus. */
-export function openModeMenu(): void {
-  const active = activeAgentPanel();
-  if (active !== undefined) {
-    handleOf(active)?.openModeMenu();
-  }
-}
-
-export function openModelMenu(): void {
-  const active = activeAgentPanel();
-  if (active !== undefined) {
-    handleOf(active)?.openModelMenu();
-  }
-}
-
-/** Ctrl+[ and Ctrl+]: the next or previous chat tab in the active chat's group, wrapping. */
-export function cycleChatTab(step: 1 | -1): void {
-  const active = activeAgentPanel();
-  if (active === undefined) {
-    return;
-  }
-  const chats = active.group.panels.filter((panel) => panel.api.component === AGENT_TYPE);
-  const index = chats.indexOf(active);
-  const next = chats[(index + step + chats.length) % chats.length];
-  if (next !== undefined && next !== active) {
-    next.api.setActive();
-    focusChat(next);
-  }
-}
-
-/** Close Tab (Ctrl+W): closes the named chat tab, else the active one. */
-export async function closeChatTab(arg?: unknown): Promise<void> {
-  const target = targetPanel(arg);
-  if (target !== undefined) {
-    await closeActiveEditor({ panelId: target.id });
-  }
-}
-
-/** Close Other Tabs: closes the group's other tabs around the named chat, else the active one. */
-export async function closeOtherChatTabs(arg?: unknown): Promise<void> {
-  const target = targetPanel(arg);
-  if (target !== undefined) {
-    await closeOtherEditors({ panelId: target.id });
-  }
-}
-
-/** Close All Tabs: closes every chat tab in the active chat's group, one at a time. */
-export async function closeAllChatTabs(arg?: unknown): Promise<void> {
-  const target = targetPanel(arg);
-  if (target === undefined) {
-    return;
-  }
-  const chats = target.group.panels.filter((panel) => panel.api.component === AGENT_TYPE);
-  for (const panel of chats) {
-    if (!(await closeActiveEditor({ panelId: panel.id }))) {
-      return;
-    }
-  }
-}
-
-/**
- * Closing the last chat tab hides the right zone. The close path announces
- * each panel it closes; when a chat was the last thing in the zone, the
- * rebuilt empty group is hidden, not left as a blank strip.
- */
-export function hidePaneWhenEmpty(closed: IDockviewPanel): void {
-  if (closed.api.component !== AGENT_TYPE) {
-    return;
-  }
-  const group = groupOfZone("right");
-  if (group !== undefined && group.panels.length === 0 && group.api.isVisible) {
-    hideChatPane();
-  }
-}
-
-/**
- * Rename Chat (the tab menu): asks for a name in the form modal, prefilled
- * with the current one. The name lasts for the session only.
- */
-export function renameChat(arg?: unknown): void {
-  const target = targetPanel(arg);
-  if (target === undefined) {
-    return;
-  }
-  const panelId = target.id;
-  showPanelDialog({
-    container: document.body,
-    classPrefix: "ws-chat-rename",
-    titleId: "ws-chat-rename-title",
-    title: "Rename Chat",
-    message: "Enter new chat name",
-    skin: "form",
-    field: {
-      id: "ws-chat-rename-name",
-      label: "Chat name",
-      placeholder: "Chat name",
-      value: tabNameOf(panelId) ?? target.api.title ?? "",
-    },
-    buttons: [
-      { label: "Cancel", run: () => undefined },
-      {
-        label: "Rename",
-        primary: true,
-        requiresValue: true,
-        run: (name) => setTabName(panelId, name),
-      },
-    ],
-  });
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-handle.ts b/crates/workshop/ui/src/parts/agent/agent-handle.ts
deleted file mode 100644
index 95dd11ce7..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-handle.ts
+++ /dev/null
@@ -1,54 +0,0 @@
-// The seam between the agent contribution's commands and the agent panel.
-// The contribution is eager and the panel is a lazy chunk, so the
-// contribution cannot import the panel class (or test instanceof against
-// it); it reaches a loaded panel through this structural handle instead,
-// found by duck-typing the dock's resolved panel content. A panel whose
-// chunk has not loaded yet is simply not a handle: the commands then have
-// nothing to act on, which is the right answer for a chat that does not
-// exist yet.
-
-import type { IContentRenderer } from "dockview";
-
-import { resolvePanelContent } from "@workshop/platform/panel-registry";
-
-/** What a command can ask of one agent panel. */
-export interface AgentPanelHandle {
-  /** Focuses the composer's editor. */
-  focusInput(): void;
-  /** Whether focus sits inside the panel. */
-  hasFocus(): boolean;
-  /** Whether the chat has no turn yet and no draft: one to reuse instead of opening another. */
-  isEmpty(): boolean;
-  /** Cancels the running turn; false when none runs or the socket is down. */
-  cancelTurn(): boolean;
-  /** Starts or ends a dictation take, as the mic button does over an empty box. */
-  toggleVoiceInput(): void;
-  /** Opens the mode menu, or cycles to the next mode while it is open. */
-  openModeMenu(): void;
-  /** Opens the model menu. */
-  openModelMenu(): void;
-}
-
-const HANDLE_METHODS = [
-  "focusInput",
-  "hasFocus",
-  "isEmpty",
-  "cancelTurn",
-  "toggleVoiceInput",
-  "openModeMenu",
-  "openModelMenu",
-] as const;
-
-/** The agent panel handle behind a dock panel's content renderer, or null while its chunk is loading. */
-export function agentHandleOf(content: IContentRenderer): AgentPanelHandle | null {
-  const resolved: unknown = resolvePanelContent(content);
-  if (typeof resolved !== "object" || resolved === null) {
-    return null;
-  }
-  for (const method of HANDLE_METHODS) {
-    if (typeof (resolved as Record<string, unknown>)[method] !== "function") {
-      return null;
-    }
-  }
-  return resolved as AgentPanelHandle;
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-menu.ts b/crates/workshop/ui/src/parts/agent/agent-menu.ts
deleted file mode 100644
index 623978ccb..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-menu.ts
+++ /dev/null
@@ -1,105 +0,0 @@
-// The agent menu: the list of discovered agents an operator launches a
-// session from. It has no lead text: the empty state is the launcher's list
-// alone, with nothing above the composer the session view puts at the
-// bottom. Renders from the delegate's agent list, re-renders on
-// every push (the list is a complete snapshot per connect), and disables
-// its buttons after a launch goes out - the session acknowledgment hides
-// the whole menu, and an error frame (a refused launch) re-enables it
-// with the server's message shown. The one locally-authored message is
-// for the failure the server can never report: the socket is down and
-// the launch never left.
-
-import "./agent-session.css";
-
-import type { Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-
-/**
- * The slice of agent-session state the menu reads and dispatches
- * through; `AgentSessionService` satisfies it structurally.
- */
-export interface AgentMenuDelegate {
-  /** The discovered agent names, as last pushed by the server. */
-  readonly agents: readonly string[];
-  readonly onDidChangeAgents: Event<readonly string[]>;
-  /** Fires with every error the session surface folded, message as shown. */
-  readonly onError: Event<string>;
-  /** Asks the server to launch the agent; false when the socket is down. */
-  launch(agent: string): boolean;
-}
-
-/** The launchable-agent list, shown while the panel has no session. */
-export class AgentMenu extends Disposable {
-  readonly element: HTMLElement;
-  private readonly list: HTMLUListElement;
-  private readonly empty: HTMLParagraphElement;
-  private readonly errorLine: HTMLParagraphElement;
-  /** True from a sent launch until an error frame frees the menu. */
-  private launching = false;
-
-  constructor(private readonly delegate: AgentMenuDelegate) {
-    super();
-    this.element = document.createElement("section");
-    this.element.className = "ws-agent-menu";
-    this.element.setAttribute("aria-label", "Agents");
-
-    this.list = document.createElement("ul");
-    this.list.className = "ws-agent-menu__list";
-
-    this.empty = document.createElement("p");
-    this.empty.className = "ws-agent-menu__empty";
-    this.empty.textContent = "No agents discovered.";
-
-    this.errorLine = document.createElement("p");
-    this.errorLine.className = "ws-agent-menu__error";
-    this.errorLine.hidden = true;
-
-    this.element.append(this.list, this.empty, this.errorLine);
-
-    this._register(this.delegate.onDidChangeAgents(() => this.render()));
-    this._register(
-      this.delegate.onError((message) => {
-        // A refused launch answers with an error frame; the menu frees
-        // itself for another try and shows the server's message.
-        this.launching = false;
-        this.errorLine.textContent = message;
-        this.errorLine.hidden = false;
-        this.render();
-      }),
-    );
-    this.render();
-  }
-
-  private render(): void {
-    const agents = this.delegate.agents;
-    this.list.replaceChildren();
-    for (const agent of agents) {
-      const entry = document.createElement("li");
-      const launch = document.createElement("button");
-      launch.type = "button";
-      launch.className = "ws-agent-menu__launch";
-      launch.textContent = agent;
-      launch.disabled = this.launching;
-      launch.addEventListener("click", () => this.launch(agent));
-      entry.appendChild(launch);
-      this.list.appendChild(entry);
-    }
-    this.list.hidden = agents.length === 0;
-    this.empty.hidden = agents.length > 0;
-  }
-
-  private launch(agent: string): void {
-    if (this.launching) {
-      return;
-    }
-    this.errorLine.hidden = true;
-    if (!this.delegate.launch(agent)) {
-      this.errorLine.textContent =
-        "The agent socket is down; it reconnects by itself. Try again shortly.";
-      this.errorLine.hidden = false;
-      return;
-    }
-    this.launching = true;
-    this.render();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-pane-header.css b/crates/workshop/ui/src/parts/agent/agent-pane-header.css
deleted file mode 100644
index 7d9b6d13f..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-pane-header.css
+++ /dev/null
@@ -1,45 +0,0 @@
-/* The chat pane's header buttons (agent-pane-header.ts imports this file).
-   Dockview puts one header actions element in every group; only the right
-   zone's groups show it (data-ws-zone, stamped by zones.ts). The buttons are
-   24px with a 6px radius and 2px between them; their icons read #F0F0F084
-   and a hover washes #5A5D5E50. Themed values come from the :root tokens in
-   @workshop/look/tokens.css. */
-
-.ws-pane-header {
-  display: none;
-  align-items: center;
-  gap: var(--ws-size-2);
-  padding-inline: var(--space-1);
-}
-
-[data-ws-zone="right"] .ws-pane-header {
-  display: flex;
-}
-
-.ws-pane-header__button {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  inline-size: var(--height-sm);
-  block-size: var(--height-sm);
-  padding: 0;
-  color: var(--cursor-icon-tertiary);
-  background: transparent;
-  border: none;
-  border-radius: var(--radius);
-  cursor: pointer;
-}
-
-.ws-pane-header__button svg {
-  inline-size: var(--ws-size-16);
-  block-size: var(--ws-size-16);
-}
-
-.ws-pane-header__button:hover {
-  background: var(--cursor-toolbar-hover);
-}
-
-.ws-pane-header__button:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-pane-header.ts b/crates/workshop/ui/src/parts/agent/agent-pane-header.ts
deleted file mode 100644
index ee4d0d29c..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-pane-header.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-// The chat pane's header: three round-cornered buttons at the right end of
-// the right zone's tab strip - New Agent (+), More Actions (...), and
-// Close (x). Dockview builds one header renderer per group, so every group
-// gets the element and the stylesheet shows it for the right zone's groups
-// only (the zone stamp on the group, zones.ts). The buttons run commands
-// through the command registry, so the keybindings, the palette, and the
-// header share one behavior:
-// - + runs New Chat Tab, which reuses an empty chat.
-// - ... opens the pane menu (Toggle Chat Pane, then the three close rows)
-//   at the button, with the group's active chat as the rows' target.
-// - x runs Toggle Chat Pane, hiding the pane the header belongs to.
-//
-// The renderer owns no lifetime tree of its own: Dockview builds and
-// disposes these through its own bookkeeping (one per refresh of a group),
-// so the element and listeners are plain and dispose() drops the menu the
-// buttons may have opened.
-
-import "./agent-pane-header.css";
-
-import type { DockviewGroupPanel, IGroupHeaderProps, IHeaderActionsRenderer } from "dockview";
-
-import { ICON_ADD, ICON_CLOSE, ICON_ELLIPSIS } from "@workshop/look/icons";
-import { Commands, logCommandFailure } from "@workshop/platform/command-registry";
-import { Menu } from "../menu/menu";
-import { AGENT_PANE_MENU } from "./agent-commands";
-
-/** One header button: a codicon on a 24px square, named for assistive tech and the tooltip. */
-function headerButton(label: string, icon: string, onPress: (button: HTMLButtonElement) => void): HTMLButtonElement {
-  const button = document.createElement("button");
-  button.type = "button";
-  button.className = "ws-pane-header__button";
-  button.setAttribute("aria-label", label);
-  button.title = label;
-  // A static string from @workshop/look, never data.
-  button.innerHTML = icon;
-  button.addEventListener("click", (event) => {
-    event.stopPropagation();
-    onPress(button);
-  });
-  return button;
-}
-
-/** Runs a command from a header button; the registry reports a rejection (the toast), so only the detail is logged. */
-function run(commandId: string): void {
-  void Commands.execute(commandId).catch((error: unknown) => {
-    logCommandFailure(commandId, error);
-  });
-}
-
-/** The right-group header actions: dockview's `createRightHeaderActionComponent`. */
-class AgentPaneHeader implements IHeaderActionsRenderer {
-  readonly element = document.createElement("div");
-  private menu: Menu | null = null;
-
-  constructor(private readonly group: DockviewGroupPanel) {
-    this.element.className = "ws-pane-header";
-    this.element.append(
-      headerButton("New Agent", ICON_ADD, () => run("workbench.action.chat.newTab")),
-      headerButton("More Actions...", ICON_ELLIPSIS, (button) => this.openMenu(button)),
-      headerButton("Close", ICON_CLOSE, () => run("workbench.action.toggleAuxiliaryBar")),
-    );
-  }
-
-  init(_params: IGroupHeaderProps): void {
-    // Nothing to read from the group: the buttons act on commands.
-  }
-
-  dispose(): void {
-    this.menu?.dispose();
-    this.menu = null;
-    this.element.remove();
-  }
-
-  private openMenu(anchor: HTMLElement): void {
-    this.menu ??= new Menu();
-    const active = this.group.activePanel;
-    // The rows target this group's active tab, not whichever panel the
-    // dock has active, so the menu works from a header that was never focused.
-    this.menu.open(AGENT_PANE_MENU, anchor, active === undefined ? undefined : { panelId: active.id });
-  }
-}
-
-/** Builds the header actions for one group. */
-export function createAgentPaneHeader(group: DockviewGroupPanel): IHeaderActionsRenderer {
-  return new AgentPaneHeader(group);
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-panel.ts b/crates/workshop/ui/src/parts/agent/agent-panel.ts
deleted file mode 100644
index 6ea88225a..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-panel.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-// The agent-session surface as a Dockview panel: one socket, one
-// session, one panel - the modal design. The panel composes the wire
-// (AgentSocket), the state (AgentSessionService), and the session view.
-// Closing the panel disposes the tree and closes its socket; every new
-// panel gets a fresh socket and therefore a fresh server session. The
-// panel is also the handle the agent commands act through (agent-handle.ts):
-// focus the composer, stop the turn, open the mode and model menus, and
-// answer whether the chat is empty enough to reuse.
-
-import type { GroupPanelPartInitParameters } from "dockview";
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-import { AgentSessionService } from "../../services/agent-session";
-import { AgentSocket } from "../../services/agent-socket";
-import type { ModelService } from "../../services/model-service";
-import type { SpeechCaptureService } from "../../services/speech-capture";
-import type { SttStatus } from "../../services/stt-status";
-import type { AgentPanelHandle } from "./agent-handle";
-import { AgentSessionView } from "./agent-session-view";
-
-// Where the session view's dictation reports when the panel is built without
-// the composition root's status port (the registry tests): messages and
-// the recording LED have nowhere to land, so they land nowhere.
-const SILENT_STATUS: SttStatus = {
-  showLocal: () => undefined,
-  setRecording: () => undefined,
-};
-
-export class AgentPanel extends WorkshopPart implements AgentPanelHandle {
-  private instance: string | undefined;
-  private view: AgentSessionView | null = null;
-  // A focus asked for before the view exists lands as soon as it does.
-  private focusWhenBuilt = false;
-
-  constructor(
-    private readonly status: SttStatus = SILENT_STATUS,
-    private readonly modelService?: ModelService,
-    private readonly speechCapture?: SpeechCaptureService,
-  ) {
-    super();
-    this.element.className = "ws-agent-panel";
-  }
-
-  override init(parameters: GroupPanelPartInitParameters): void {
-    const instance = parameters.params?.instance;
-    this.instance = typeof instance === "string" ? instance : undefined;
-    super.init(parameters);
-  }
-
-  protected create(parent: HTMLElement): void {
-    const socket = this._register(new AgentSocket());
-    const service = this._register(new AgentSessionService(socket));
-    const view = this._register(
-      new AgentSessionView(service, this.status, this.modelService, this.speechCapture, {
-        instance: this.instance,
-        title: () => this.panelApi?.title,
-      }),
-    );
-    this.view = view;
-    parent.appendChild(view.element);
-    this._register(
-      service.onDidChangeAgents((agents) => {
-        if (agents.length > 0 && service.session === null) {
-          const target = agents.includes("chat") ? "chat" : agents[0]!;
-          service.launch(target);
-        }
-      }),
-    );
-    socket.connect();
-    if (this.focusWhenBuilt) {
-      this.focusWhenBuilt = false;
-      view.focusInput();
-    }
-  }
-
-  focusInput(): void {
-    if (this.view === null) {
-      this.focusWhenBuilt = true;
-      return;
-    }
-    this.view.focusInput();
-  }
-
-  hasFocus(): boolean {
-    return this.view?.hasFocus() ?? false;
-  }
-
-  isEmpty(): boolean {
-    return this.view?.isEmpty() ?? true;
-  }
-
-  cancelTurn(): boolean {
-    return this.view?.cancelTurn() ?? false;
-  }
-
-  toggleVoiceInput(): void {
-    this.view?.toggleVoiceInput();
-  }
-
-  openModeMenu(): void {
-    this.view?.openModeMenu();
-  }
-
-  openModelMenu(): void {
-    this.view?.openModelMenu();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-session-view.ts b/crates/workshop/ui/src/parts/agent/agent-session-view.ts
deleted file mode 100644
index 33dca7f32..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-session-view.ts
+++ /dev/null
@@ -1,454 +0,0 @@
-// The agent-session view: paints the service's transcript into the feed
-// and maps the agent's state onto the chat input. The transcript is
-// built the way Cursor draws it: buildTranscript turns the service's items
-// into turns of keyed rows plus a tail status, and the TranscriptView
-// reconciles them by key, so a streaming delta updates its row in place
-// and an opened thought or group stays as the operator left it. Every
-// content string is untrusted model-, tool-, or user-authored data:
-// reply and thinking markdown renders through renderMarkdown, whose
-// DOMPurify pass is the last step before the DOM; user text, tool
-// arguments, and tool output land through textContent.
-//
-// Errors don't take rows. An error opens the composer's error popup
-// (title, message, and Try again), which re-sends the last user message
-// through the service; Try again is enabled only while the run takes
-// messages.
-//
-// The composer is the ChatBox component, which this view embeds. It maps
-// service state to the box's props (the box is always editable, the
-// action follows whether the agent has started, generating, and the model
-// selection, the mic follows dictation's state, the mode follows the
-// toolbar's chip) and routes the box's events back - `send` sends the
-// operator's message, which answers the waiting agent or steers the turn
-// it works on, `stop` cancels the turn, `mic-press` drives stt.ts, which
-// splices the transcript into the box at the cursor. The one round action
-// button is the mic while the box is empty and stays pressable whatever
-// the state, so a click while blocked names the blocker on the status bar
-// instead of the control silently disappearing. Until the agent first
-// waits or works, and once its run has ended, its run takes no message,
-// so send stays disabled. A take follows the session it dictates into: a
-// send, or a new session that replaces an earlier one, discards the live
-// take. The view's first session replaces none, so a take started before
-// it goes on into that session.
-
-import "./agent-session.css";
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import type { AgentSessionService } from "../../services/agent-session";
-import type { ModelService } from "../../services/model-service";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import {
-  SpeechCaptureService,
-  type SpeechCapturePresence,
-} from "../../services/speech-capture";
-import type { SttStatus } from "../../services/stt-status";
-import { TOAST_STACK } from "../../services/toast-service";
-import { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-import { AgentToolbar } from "./agent-toolbar";
-import { buildTranscript } from "./transcript/transcript-model";
-import { TranscriptView } from "./transcript/transcript-view";
-import { ChatBox } from "../chatbox/chat-box";
-import type { ChatBoxError, ChatBoxEvent, ChatBoxProps } from "../chatbox/types";
-import { openInZone } from "../layout/zones";
-import { setupStt, type SttHandle } from "../stt/stt";
-
-const SESSION_LABEL = "Agent session";
-
-/** The toast a turn's Copy raises. */
-const COPIED_TOAST = "Message copied to clipboard";
-
-/**
- * The panel hosting a session view, as dictation's capture presence names
- * and reveals it. A view built without one reveals the boot-time
- * singleton and names itself by its section label.
- */
-export interface AgentSessionHost {
-  /** The panel's `instance` param; undefined for the boot-time singleton. */
-  readonly instance: string | undefined;
-  /** The panel's current tab title, read on every call. */
-  title(): string | undefined;
-}
-
-/** The error the popup shows: what the service folded, as the box takes it. */
-interface PopupError {
-  readonly title: string | null;
-  readonly message: string;
-}
-
-/**
- * The session surface: the transcript feed over the chat box. The
- * toolbar (mode chip, model picker, context ring) mounts into the box's
- * controls slot only when the composition root threads a ModelService
- * through; a view built without one mounts none. The box is always
- * editable; send stays disabled until the agent first waits or works and
- * again once its run ends, and a configured model service marks the send
- * action blocked until its current selection is non-empty. A send hands
- * the operator's message to the service, clears the box on success, and
- * pins the feed to the bottom.
- * The status sink receives dictation's local messages, selection
- * blockers, and recording LED state. While this view dictates, the
- * capture service names it by its session title and agent, and reveals
- * it by reopening its host panel.
- */
-export class AgentSessionView extends Disposable {
-  readonly element: HTMLElement;
-  /**
-   * The chat box under the feed. Exposed so tests can drive content and
-   * selection - the DOM alone sets neither on a ProseMirror editor.
-   */
-  readonly chatBox: ChatBox;
-  /** The transcript feed; its `element` is the scrolling region. */
-  readonly transcript: TranscriptView;
-  private readonly stt: SttHandle;
-  private readonly toolbar: AgentToolbar | null = null;
-  private popup: PopupError | null = null;
-  private sessionId: string | null = null;
-
-  constructor(
-    private readonly service: AgentSessionService,
-    private readonly status: SttStatus,
-    private readonly modelService?: ModelService,
-    speechCapture?: SpeechCaptureService,
-    host?: AgentSessionHost,
-  ) {
-    super();
-    this.element = document.createElement("section");
-    this.element.className = "ws-agent-session";
-    this.element.setAttribute("aria-label", SESSION_LABEL);
-
-    this.transcript = this._register(
-      new TranscriptView({
-        copied: () => {
-          getServiceOrNull(TOAST_STACK)?.show(COPIED_TOAST, "info");
-        },
-      }),
-    );
-
-    // The box is composed from what this view resolves: the toolbar for
-    // its controls slot and the text-control registrar; the box itself
-    // touches no registry.
-    const boxProps: {
-      -readonly [K in keyof ChatBoxProps]: ChatBoxProps[K];
-    } = {
-      placeholder: "Plan, Build, / for skills, @ for context",
-      ariaLabel: "Message",
-      mic: "idle",
-    };
-    if (modelService !== undefined) {
-      this.toolbar = this._register(new AgentToolbar(modelService));
-      boxProps.controls = this.toolbar.element;
-      boxProps.mode = this.toolbar.mode;
-    }
-    const textControls = getServiceOrNull(TEXT_CONTROL_SERVICE);
-    if (textControls !== null) {
-      boxProps.textControls = textControls.register.bind(textControls);
-    }
-    const chatBox = new ChatBox(boxProps, (event) => this.onChatBoxEvent(event));
-    const outer = document.createElement("div");
-    outer.className = "ws-agent-session__outer";
-    outer.appendChild(chatBox.element);
-    this.element.append(this.transcript.element, outer);
-
-    // Element-owned listeners die with the elements; only service
-    // subscriptions need the lifecycle.
-    this._register(this.service.onDidChangeTranscript(() => this.renderFeed()));
-    this._register(
-      this.service.onDidChangeGenerating(() => {
-        this.renderFeed();
-        // Stop follows `generating`: it shows from a send until the agent
-        // waits, the run ends, an error lands, or a cancel goes out, and
-        // again while a round newer than the cancel streams.
-        this.renderInputState();
-      }),
-    );
-    this._register(this.service.onDidChangeReconnecting(() => this.renderFeed()));
-    if (this.toolbar !== null) {
-      this._register(
-        this.toolbar.onDidChangeMode((mode) => {
-          this.chatBox.update({ mode });
-        }),
-      );
-    }
-    // Shift+Tab inside the composer opens the mode menu, and pressing it
-    // again cycles. It cannot be a registered keybinding: a claimed chord is
-    // swallowed everywhere, and Shift+Tab is every other control's way back.
-    this.element.addEventListener("keydown", this.onKeydown);
-    this._register(toDisposable(() => this.element.removeEventListener("keydown", this.onKeydown)));
-    this._register(this.service.onError(() => this.showError()));
-    this._register(
-      this.service.onDidChangeSession((frame) => {
-        // A new session replays from index zero: the old session's error
-        // and a take dictated for its agent do not belong to it. The first
-        // session replaces no agent, so a take started before it stays.
-        if (this.sessionId !== frame.session) {
-          const replaced = this.sessionId !== null;
-          this.sessionId = frame.session;
-          this.clearError();
-          if (replaced) {
-            this.stt.discardIfRecording();
-          }
-        }
-      }),
-    );
-    this._register(this.service.onDidChangeStarted(() => this.renderInputState()));
-    if (this.modelService !== undefined) {
-      this._register(this.modelService.onDidChangeCurrent(() => this.renderInputState()));
-    }
-
-    // The dictation control over the box. Registered before the box so
-    // disposal discards a live take while the editor still stands.
-    // Production injects the composition root's capture service; isolated
-    // views own a fallback for tests and previews.
-    const capture = speechCapture ?? new SpeechCaptureService();
-    const presence: SpeechCapturePresence = {
-      label: () => {
-        const title = host?.title() ?? SESSION_LABEL;
-        const agent = this.service.session?.agent;
-        return agent === undefined ? title : `${title} (${agent})`;
-      },
-      reveal: () => {
-        const instance = host?.instance;
-        openInZone("agent", instance === undefined ? {} : { instance });
-      },
-    };
-    this.stt = this._register(
-      setupStt({ input: chatBox, liveRegionHost: this.element }, status, () => null, capture, presence),
-    );
-    if (speechCapture === undefined) {
-      this._register(capture);
-    }
-    // Dictation's state is the box's mic prop: seeded once the handle
-    // exists (the box had to come first, the handle needs it as its
-    // target), then driven by every change.
-    chatBox.update({ mic: this.stt.state });
-    this._register(this.stt.onState((state) => chatBox.update({ mic: state })));
-    this.chatBox = this._register(chatBox);
-
-    this.renderFeed();
-    this.renderInputState();
-  }
-
-  /** The box's events: a send sends the operator's message, a mic press drives dictation. */
-  private onChatBoxEvent(event: ChatBoxEvent): void {
-    switch (event.type) {
-      case "send":
-        this.submit();
-        return;
-      case "mic-press":
-        this.stt.press();
-        return;
-      case "retry":
-        this.retry();
-        return;
-      case "stop":
-        this.cancelTurn();
-        return;
-      case "command":
-      case "cancel":
-      case "mic-release":
-        // Not produced by the box in this configuration; reserved.
-        return;
-      default: {
-        const exhaustive: never = event;
-        return exhaustive;
-      }
-    }
-  }
-
-  /**
-   * Repaints the transcript from the service: the model is rebuilt from
-   * the items and the transcript view reconciles it by key, so only the
-   * rows that changed repaint.
-   */
-  private renderFeed(): void {
-    const generating = this.service.generating;
-    this.transcript.render(
-      buildTranscript(this.service.items, generating, this.service.reconnecting),
-      generating,
-    );
-  }
-
-  /**
-   * Maps the agent's state onto the box: always editable, the send action
-   * idle until the agent first waits or works and again once its run
-   * ends, since its run takes no message then, and blocked (still
-   * clickable, so the press can say why) while a configured model service
-   * has no selection. While the agent generates the action is Stop, which
-   * the box shows over an empty box and turns into send for a follow-up
-   * once the box holds text.
-   */
-  private renderInputState(): void {
-    const generating = this.service.generating;
-    this.chatBox.update({
-      editable: true,
-      action: generating
-        ? "stop"
-        : this.service.started
-          ? this.modelService === undefined || this.modelService.current !== ""
-            ? "send"
-            : "send-blocked"
-          : "idle",
-    });
-    this.renderError();
-  }
-
-  // --- The composer's commands -----------------------------------------------------------
-
-  /**
-   * Stop (the round button, Ctrl+Shift+Backspace): cancels the running
-   * turn. Answers false when no turn is running or the socket is down, so
-   * a chord with nothing to stop is a no-op.
-   */
-  cancelTurn(): boolean {
-    if (!this.service.generating) {
-      return false;
-    }
-    return this.service.cancelTurn();
-  }
-
-  /** Focuses the composer's editor. */
-  focusInput(): void {
-    this.chatBox.focus();
-  }
-
-  /**
-   * Voice Input (Ctrl+Shift+Space): the mic's press from the keyboard. The
-   * round button is the mic only over an empty box, so a take that starts
-   * or ends with text already in the box goes through here.
-   */
-  toggleVoiceInput(): void {
-    this.stt.press();
-  }
-
-  /** Whether focus sits inside this view, composer or transcript. */
-  hasFocus(): boolean {
-    return this.element.contains(this.element.ownerDocument.activeElement);
-  }
-
-  /** Whether the session has no turn yet and the composer holds no draft: a chat to reuse. */
-  isEmpty(): boolean {
-    return this.service.items.length === 0 && this.chatBox.getText() === "";
-  }
-
-  /** Opens the mode menu, or cycles to the next mode while it is open. */
-  openModeMenu(): void {
-    this.toolbar?.openModeMenu();
-  }
-
-  /** Opens the model menu. */
-  openModelMenu(): void {
-    this.toolbar?.openModelMenu();
-  }
-
-  /** Shift+Tab with focus in the composer: the mode menu. */
-  private readonly onKeydown = (event: KeyboardEvent): void => {
-    if (event.key !== "Tab" || !event.shiftKey || event.ctrlKey || event.altKey || event.metaKey) {
-      return;
-    }
-    const target = event.target;
-    if (!(target instanceof Element) || target.closest(".ws-prompt-input") === null) {
-      return;
-    }
-    event.preventDefault();
-    event.stopPropagation();
-    this.openModeMenu();
-  };
-
-  // --- The error popup ---------------------------------------------------------------
-
-  /** Opens the popup with the error the service just folded. */
-  private showError(): void {
-    const last = this.service.items[this.service.items.length - 1];
-    if (last?.kind !== "error") {
-      return;
-    }
-    this.popup = { title: last.title, message: last.message };
-    this.renderError();
-  }
-
-  private clearError(): void {
-    this.popup = null;
-    this.renderError();
-  }
-
-  /** The text of the last user message, or null before the operator has sent one. */
-  private lastUserText(): string | null {
-    const items = this.service.items;
-    for (let index = items.length - 1; index >= 0; index--) {
-      const item = items[index];
-      if (item?.kind === "user") {
-        return item.text;
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Pushes the popup to the box: Try again is offered once the operator has
-   * sent a message, and enabled only while the run takes messages
-   * (`started`), so the run's end disables it.
-   */
-  private renderError(): void {
-    if (this.popup === null) {
-      this.chatBox.update({ error: null });
-      return;
-    }
-    const error: { -readonly [K in keyof ChatBoxError]: ChatBoxError[K] } = {
-      message: this.popup.message,
-    };
-    if (this.popup.title !== null) {
-      error.title = this.popup.title;
-    }
-    if (this.lastUserText() !== null) {
-      error.tryAgain = this.service.started ? "enabled" : "disabled";
-    }
-    this.chatBox.update({ error });
-  }
-
-  /**
-   * Try again: re-sends the last user message through the service. The
-   * resend adds a second user message to the agent's history; the chat
-   * agent returns to its inbox after a failed round, so the resend answers
-   * it there, or steers the turn it already went on with.
-   */
-  private retry(): void {
-    const text = this.lastUserText();
-    if (text === null) {
-      return;
-    }
-    this.stt.discardIfRecording();
-    if (this.service.respond(text)) {
-      this.transcript.forcePin();
-      this.clearError();
-    }
-  }
-
-  /**
-   * Sends the box's text as the operator's message, byte-exact - never
-   * trimmed, because the wire contract is what the operator typed. It
-   * answers the waiting agent or steers the turn the agent works on; the
-   * box offers send only once the agent has started. An empty box sends
-   * nothing; a failed send keeps the text for the retry.
-   * A send ends a live take: what the operator sees in the box, interim
-   * transcript included, is what goes; the take's polished final is
-   * discarded rather than landing in a box that already sent.
-   */
-  private submit(): void {
-    const text = this.chatBox.getText();
-    if (text === "") {
-      return;
-    }
-    if (this.modelService !== undefined && this.modelService.current === "") {
-      this.status.showLocal("Select a model before sending.", "info");
-      return;
-    }
-    // Read before discarding: the discard restores the box to its
-    // pre-take text, and the send submits what was showing.
-    this.stt.discardIfRecording();
-    if (this.service.respond(text)) {
-      this.chatBox.clear();
-      this.transcript.forcePin();
-      this.clearError();
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-session.css b/crates/workshop/ui/src/parts/agent/agent-session.css
deleted file mode 100644
index 2585ece8a..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-session.css
+++ /dev/null
@@ -1,112 +0,0 @@
-/* Styles for the agent-session surface: the agent menu and the session
-   view (agent-menu.ts and agent-session-view.ts import this file; esbuild
-   bundles it once into dist/app.css). Themed values come from the :root
-   tokens in @workshop/look/tokens.css. */
-
-/* The panel container fills its dockview leaf; whichever child is not
-   hidden owns the space. */
-.ws-agent-panel {
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-  background: var(--cursor-editor);
-  color: var(--text);
-  font-family: var(--font-prose);
-}
-
-.ws-agent-panel > [hidden] {
-  display: none;
-}
-
-/* --- The agent menu ----------------------------------------------------- */
-
-.ws-agent-menu {
-  padding: var(--space-4);
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3);
-  overflow-y: auto;
-  scrollbar-gutter: stable;
-}
-
-.ws-agent-menu__list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-1-5);
-}
-
-.ws-agent-menu__launch {
-  display: block;
-  inline-size: 100%;
-  min-height: var(--space-11);
-  padding-block: var(--space-2);
-  padding-inline: var(--space-3);
-  text-align: start;
-  font: inherit;
-  color: var(--text);
-  background: var(--bg-raised);
-  border: var(--ws-border-width) solid var(--border);
-  border-radius: var(--radius);
-  cursor: pointer;
-}
-
-.ws-agent-menu__launch:hover:not(:disabled) {
-  background: var(--bg-hover);
-}
-
-.ws-agent-menu__launch:focus-visible {
-  outline: none;
-  background: var(--bg-hover);
-}
-
-.ws-agent-menu__launch:disabled {
-  color: var(--text-muted);
-  cursor: default;
-}
-
-.ws-agent-menu__empty {
-  margin: 0;
-  color: var(--text-muted);
-}
-
-.ws-agent-menu__error {
-  margin: 0;
-  color: var(--danger-text);
-}
-
-/* --- The session view ---------------------------------------------------- */
-
-.ws-agent-session {
-  flex: 1;
-  min-height: 0;
-  display: flex;
-  flex-direction: column;
-}
-
-/* The feed is the scroller and takes the full panel width, so its
-   scrollbar sits at the panel's edge; the transcript column inside it is
-   centered (transcript.css). */
-.ws-agent-session__feed {
-  flex: 1;
-  min-height: 0;
-  overflow-y: auto;
-  scrollbar-gutter: stable;
-  background: var(--cursor-editor);
-}
-
-/* --- The input affordance ------------------------------------------------ */
-
-/* The card the chat box sits in. The bar itself, its frame, and its mic
-   and send buttons are the chat box's (chatbox/chat-box.css). */
-.ws-agent-session__outer {
-  flex: none;
-  padding-inline: var(--agent-outer-padding);
-  padding-block-end: var(--agent-outer-padding);
-  inline-size: 100%;
-  max-inline-size: var(--agent-max-width);
-  margin-inline: auto;
-  box-sizing: border-box;
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-toolbar.css b/crates/workshop/ui/src/parts/agent/agent-toolbar.css
deleted file mode 100644
index 5a418e321..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-toolbar.css
+++ /dev/null
@@ -1,18 +0,0 @@
-/* The agent toolbar (agent-toolbar.ts imports this file): a fixed 28px row
-   with 4px between its children, under the editor's 9px gap (chat-box.css).
-   The model button's trailing auto margin pushes the ring and the chat box's
-   action button, which follow it, to the trailing edge, whether or not the
-   ring is showing. */
-
-.ws-agent-toolbar {
-  display: flex;
-  align-items: center;
-  gap: var(--ws-agent-toolbar-gap);
-  block-size: var(--height-base);
-  padding: 0;
-  border-block-start: none;
-}
-
-.ws-agent-toolbar > .ws-model-picker-trigger {
-  margin-inline-end: auto;
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent-toolbar.ts b/crates/workshop/ui/src/parts/agent/agent-toolbar.ts
deleted file mode 100644
index f59109585..000000000
--- a/crates/workshop/ui/src/parts/agent/agent-toolbar.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-// The agent toolbar: a flex row composing the mode chip, the model
-// picker trigger, and the token ring. The chip and picker lead from the
-// inline-start edge; the ring is the last child so the stylesheet can
-// pin it to the trailing edge, and the chat box's round action button
-// joins the row after it. Composition only - each child owns its
-// behavior; the toolbar owns their lifetimes and the container's
-// semantics, and forwards the two menu openers the composer's keys use
-// (Ctrl+. and Shift+Tab for the mode menu, Ctrl+/ for the model menu).
-
-import "./agent-toolbar.css";
-
-import type { Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import type { ModelService } from "../../services/model-service";
-import { ModeChip, type UnifiedMode } from "./mode-chip";
-import { ModelPickerTrigger } from "../chrome/model-picker-trigger";
-import { TokenRing } from "../chrome/token-ring";
-
-/**
- * The toolbar row. Disposable: dispose() disposes all three children.
- * The model service is borrowed, not owned - the composition root
- * disposes it.
- */
-export class AgentToolbar extends Disposable {
-  /** The toolbar container; append it where the toolbar belongs. */
-  readonly element: HTMLElement;
-
-  private readonly modeChip: ModeChip;
-  private readonly modelPicker: ModelPickerTrigger;
-
-  constructor(modelService: ModelService) {
-    super();
-
-    this.element = document.createElement("div");
-    this.element.className = "ws-agent-toolbar";
-    this.element.setAttribute("role", "toolbar");
-    this.element.setAttribute("aria-label", "Agent controls");
-
-    this.modeChip = this._register(new ModeChip());
-    this.modelPicker = this._register(new ModelPickerTrigger(modelService));
-    const tokenRing = this._register(new TokenRing());
-
-    this.element.append(this.modeChip.element, this.modelPicker.element, tokenRing.element);
-  }
-
-  /** The selected agent mode. */
-  get mode(): UnifiedMode {
-    return this.modeChip.mode;
-  }
-
-  /** Fires with the new mode each time the selection changes. */
-  get onDidChangeMode(): Event<UnifiedMode> {
-    return this.modeChip.onDidChangeMode;
-  }
-
-  /** Opens the mode menu; while it is open, cycles to the next mode. */
-  openModeMenu(): void {
-    this.modeChip.openOrCycle();
-  }
-
-  /** Opens the model menu. */
-  openModelMenu(): void {
-    this.modelPicker.open();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/agent.contribution.ts b/crates/workshop/ui/src/parts/agent/agent.contribution.ts
deleted file mode 100644
index 97ca69c3b..000000000
--- a/crates/workshop/ui/src/parts/agent/agent.contribution.ts
+++ /dev/null
@@ -1,260 +0,0 @@
-// The agent contribution: the eager module registering the agent panel
-// type, its New Agents Window row, and the chat pane's commands at module
-// scope, before any service exists.
-// The run body of New Agents Window opens a fresh agent panel keyed by a
-// random instance id - each invocation is its own panel, socket, and modal
-// server session in the right zone. main.ts imports zones.ts eagerly (it
-// boots the dock through it), so the module is already loaded and the open
-// call is direct; the agent chunk itself still loads lazily through the
-// panel registry.
-//
-// The id is ours: Cursor ships a New Agents Window row but its command
-// id is not public.
-//
-// The agent panel's type registers here too. Its instances key by the
-// `instance` param; an open without one is the boot-time singleton. Its
-// default title is "New Agent", and its tabs are renamable for the session.
-//
-// The chat pane's chords. Every one registers at the BuiltinExtension
-// weight, so it beats the menu stubs that share a chord (the Go menu's Add
-// Symbol rows, Toggle Developer Tools, Select All Occurrences), which
-// register at the default WorkbenchContrib tier:
-// - Ctrl+L and Ctrl+I, Open Chat: hide the pane when the chat has focus,
-//   else reveal it and focus the composer.
-// - Ctrl+Shift+L and Ctrl+Shift+I, New Chat: reuse an empty chat or open one.
-// - Ctrl+T while a chat is active, and Ctrl+N while one is active and the
-//   editor text is not focused: New Chat Tab, which reuses an empty chat too.
-// - Ctrl+Shift+Backspace while a chat is active: composer.cancelComposerStep,
-//   the stop behavior. Escape is never bound to stop.
-// - Ctrl+Shift+Space while a chat is active: Voice Input, the mic's press.
-// - Ctrl+W closes the chat tab; closing the last one hides the right zone.
-// - Ctrl+[ and Ctrl+] cycle the chat tabs while a chat is active; with an
-//   editor active they stay Outdent and Indent (the editor's own rules).
-// - Ctrl+. opens the mode menu and Ctrl+/ the model menu (pressing the
-//   mode chord again cycles).
-// These chords are claimed everywhere - the dispatcher swallows a claimed
-// chord even where its `when` fails - which is why the ones that other
-// controls need (Shift+Tab) stay out of the registry.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { KeybindingsRegistry, KeybindingWeight } from "@workshop/platform/keybinding-registry";
-import { MenuId, Menus } from "@workshop/platform/menu-registry";
-import { registerPanelType } from "@workshop/platform/panel-registry";
-import { onDidClosePanel } from "../layout/panel-close";
-import { openInZone } from "../layout/zones";
-import {
-  AGENT_PANE_MENU,
-  closeAllChatTabs,
-  closeChatTab,
-  closeOtherChatTabs,
-  cycleChatTab,
-  hidePaneWhenEmpty,
-  newChat,
-  openChat,
-  openModeMenu,
-  openModelMenu,
-  renameChat,
-  stopTurn,
-  toggleVoiceInput,
-} from "./agent-commands";
-
-registerPanelType({
-  type: "agent",
-  title: "New Agent",
-  defaultZone: "right",
-  renamable: true,
-  load: () => import("./index"),
-});
-
-/** The chat is the active panel. */
-const AGENT_ACTIVE = "activeEditor == 'agent'";
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`agent action '${action.id}': ${result.error.message}`);
-  }
-}
-
-/** Binds a further chord to an action that already owns its first. */
-function addChord(id: string, keybinding: string, when?: string): void {
-  KeybindingsRegistry.registerKeybindingRule({
-    id,
-    keybinding,
-    ...(when === undefined ? {} : { when }),
-    weight: KeybindingWeight.BuiltinExtension,
-  });
-}
-
-addAction({
-  id: "workbench.action.newAgentsWindow",
-  title: "New Agents Window",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+alt+n" },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "1_new", order: 3 }],
-  run: () => {
-    openInZone("agent", { instance: window.crypto.randomUUID() });
-  },
-});
-
-addAction({
-  id: "workbench.action.chat.open",
-  title: "Open Chat",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+l", weight: KeybindingWeight.BuiltinExtension },
-  run: () => openChat(),
-});
-addChord("workbench.action.chat.open", "ctrlcmd+i");
-
-addAction({
-  id: "workbench.action.chat.new",
-  title: "New Chat",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+shift+l", weight: KeybindingWeight.BuiltinExtension },
-  run: () => newChat(),
-});
-addChord("workbench.action.chat.new", "ctrlcmd+shift+i");
-
-addAction({
-  id: "workbench.action.chat.newTab",
-  title: "New Chat Tab",
-  f1: true,
-  keybinding: {
-    keybinding: "ctrlcmd+t",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  run: () => newChat(),
-});
-// Ctrl+N is New Text File everywhere else, and stays that way while the
-// editor's own text holds focus.
-addChord("workbench.action.chat.newTab", "ctrlcmd+n", `${AGENT_ACTIVE} && !editorTextFocus`);
-
-addAction({
-  id: "composer.cancelComposerStep",
-  title: "Stop",
-  f1: true,
-  keybinding: {
-    keybinding: "ctrlcmd+shift+backspace",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  run: () => stopTurn(),
-});
-
-// The mic's tooltip advertises this chord: the round button is the mic only
-// over an empty box, and a take over a draft starts from the keyboard.
-addAction({
-  id: "workbench.action.chat.toggleVoiceInput",
-  title: "Voice Input",
-  f1: true,
-  keybinding: {
-    keybinding: "ctrlcmd+shift+space",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  run: () => toggleVoiceInput(),
-});
-
-addAction({
-  id: "composer.openModeMenu",
-  title: "Switch Agent Mode",
-  f1: true,
-  precondition: AGENT_ACTIVE,
-  keybinding: { keybinding: "ctrlcmd+.", weight: KeybindingWeight.BuiltinExtension },
-  run: () => openModeMenu(),
-});
-
-addAction({
-  id: "composer.openModelMenu",
-  title: "Switch Model",
-  f1: true,
-  precondition: AGENT_ACTIVE,
-  keybinding: { keybinding: "ctrlcmd+/", weight: KeybindingWeight.BuiltinExtension },
-  run: () => openModelMenu(),
-});
-
-// Ctrl+] and Ctrl+[ are CodeMirror's indent chords too. The dispatcher
-// swallows a claimed chord even where its `when` fails, so the editor owns
-// them through its own rules (editor.contribution.ts: Indent Line and Outdent
-// Line). The two sets never overlap: these need a chat as the active panel,
-// those need an editor.
-addAction({
-  id: "workbench.action.chat.nextTab",
-  title: "Next Chat Tab",
-  f1: true,
-  keybinding: {
-    keybinding: "ctrlcmd+]",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  run: () => cycleChatTab(1),
-});
-
-addAction({
-  id: "workbench.action.chat.previousTab",
-  title: "Previous Chat Tab",
-  f1: true,
-  keybinding: {
-    keybinding: "ctrlcmd+[",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  run: () => cycleChatTab(-1),
-});
-
-// The pane header's "..." menu: Toggle Chat Pane (the Secondary Side Bar's
-// own command, relabeled), then the three close rows.
-Menus.appendMenuItem(AGENT_PANE_MENU, {
-  command: "workbench.action.toggleAuxiliaryBar",
-  title: "Toggle Chat Pane",
-  group: "1_pane",
-  order: 1,
-});
-
-// The three close rows take the header's active chat as their `{ panelId }`
-// argument (agent-pane-header.ts), so they work from the "..." menu whichever
-// panel the dock has active.
-addAction({
-  id: "workbench.action.chat.closeTab",
-  title: "Close Tab",
-  keybinding: {
-    keybinding: "ctrlcmd+w",
-    when: AGENT_ACTIVE,
-    weight: KeybindingWeight.BuiltinExtension,
-  },
-  menu: [{ id: AGENT_PANE_MENU, group: "2_close", order: 1 }],
-  run: (arg?: unknown) => closeChatTab(arg),
-});
-
-addAction({
-  id: "workbench.action.chat.closeOtherTabs",
-  title: "Close Other Tabs",
-  menu: [{ id: AGENT_PANE_MENU, group: "2_close", order: 2 }],
-  run: (arg?: unknown) => closeOtherChatTabs(arg),
-});
-
-addAction({
-  id: "workbench.action.chat.closeAllTabs",
-  title: "Close All Tabs",
-  menu: [{ id: AGENT_PANE_MENU, group: "2_close", order: 3 }],
-  run: (arg?: unknown) => closeAllChatTabs(arg),
-});
-
-// The chat tab's own menu gains Rename Chat. The tab menu opens with the
-// clicked tab's type as `activeEditor`, so the row shows for chat tabs only.
-addAction({
-  id: "workbench.action.chat.rename",
-  title: "Rename Chat",
-  menu: [
-    { id: MenuId.EditorTitleContext, group: "2_chat", order: 1, when: AGENT_ACTIVE },
-  ],
-  run: (arg?: unknown) => renameChat(arg),
-});
-
-// Closing the last chat tab hides the pane.
-onDidClosePanel(hidePaneWhenEmpty);
diff --git a/crates/workshop/ui/src/parts/agent/index.ts b/crates/workshop/ui/src/parts/agent/index.ts
deleted file mode 100644
index beffbb610..000000000
--- a/crates/workshop/ui/src/parts/agent/index.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-// The agent feature's entry point: register() is the panel registry's
-// activation hook. Importers point at the source files directly; this
-// module re-exports nothing.
-
-import { registerPanelFactory } from "@workshop/platform/panel-registry";
-import { MODEL_SERVICE } from "../../services/model-service";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { SPEECH_CAPTURE } from "../../services/speech-capture";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { STT_STATUS } from "../../services/stt-status";
-import { AgentPanel } from "./agent-panel";
-import { markdownReady } from "./markdown-render";
-
-/**
- * The agent directory's activation: installs the agent-session panel
- * factory, resolving the composition root's services through the service
- * registry (absent in standalone panel tests, where the panel stays
- * silent). Called once by the panel registry when the directory's chunk
- * first loads; the returned disposable is held for the page lifetime.
- *
- * Code blocks in the agent feed highlight through Shiki, whose init is
- * async and started at module scope; register() awaits readiness (with
- * failures logged, not thrown) before answering so the panel registry
- * mounts the panel only after highlighting is settled - the first
- * painted message is never the degraded unhighlighted render. A failed
- * init must not break the panel - the renderer degrades to plain
- * <pre><code> blocks instead.
- */
-export async function register(): Promise<IDisposable> {
-  await markdownReady.catch((error: unknown) => {
-    console.error(
-      "markdown highlighting failed to initialize; code blocks render unhighlighted:",
-      error,
-    );
-  });
-  return registerPanelFactory(
-    "agent",
-    () =>
-      new AgentPanel(
-        getServiceOrNull(STT_STATUS) ?? undefined,
-        getServiceOrNull(MODEL_SERVICE) ?? undefined,
-        getServiceOrNull(SPEECH_CAPTURE) ?? undefined,
-      ),
-  );
-}
diff --git a/crates/workshop/ui/src/parts/agent/markdown-render.css b/crates/workshop/ui/src/parts/agent/markdown-render.css
deleted file mode 100644
index 107673e35..000000000
--- a/crates/workshop/ui/src/parts/agent/markdown-render.css
+++ /dev/null
@@ -1,305 +0,0 @@
-/* Rendered markdown (src/parts/agent/markdown-render.ts): styles the sanitized
-   marked + Shiki output inside a .ws-markdown-content root, on Cursor's
-   agent-panel markdown rules. Sizes come from the shared tokens and the
-   per-component slots in tokens/component.css; the em factors are scale
-   ratios of the surrounding text, not sizes. */
-
-.ws-markdown-content {
-  font-size: var(--font-size-lg);
-  line-height: var(--line-height-lg);
-  letter-spacing: normal;
-  font-weight: normal;
-  color: var(--cursor-text-primary);
-  overflow-wrap: break-word;
-
-  /* The slots Shiki's CSS-variables theme reads (markdown-render.ts), filled
-     from the skin's --syntax-* tokens the way Cursor fills them from its
-     --cursor-syntax-* ones: a slot with no token of its own takes the
-     token Cursor falls back to (a type or class reads as a constant, a tag
-     as a keyword, an attribute as a parameter, a property as the
-     foreground). The foreground and comment come from the Cursor Dark
-     editor theme: #F0F0F0, and #F0F0F099 in italics. */
-  --shiki-foreground: var(--syntax-fg);
-  --shiki-background: var(--syntax-bg);
-  --shiki-token-comment: var(--syntax-comment);
-  --shiki-token-string: var(--syntax-string);
-  --shiki-token-string-expression: var(--syntax-string-expression);
-  --shiki-token-constant: var(--syntax-constant);
-  --shiki-token-keyword: var(--syntax-keyword);
-  --shiki-token-variable: var(--syntax-fg);
-  --shiki-token-language-variable: var(--syntax-keyword);
-  --shiki-token-parameter: var(--syntax-parameter);
-  --shiki-token-constant-variable: var(--syntax-constant);
-  --shiki-token-property: var(--syntax-fg);
-  --shiki-token-function: var(--syntax-function);
-  --shiki-token-type: var(--syntax-constant);
-  --shiki-token-class: var(--syntax-constant);
-  --shiki-token-tag: var(--syntax-keyword);
-  --shiki-token-attribute: var(--syntax-parameter);
-  --shiki-token-punctuation: var(--syntax-punctuation);
-  --shiki-token-link: var(--syntax-link);
-}
-
-.ws-markdown-content > :first-child {
-  margin-block-start: 0;
-}
-
-.ws-markdown-content > :last-child {
-  margin-block-end: 0;
-}
-
-/* Blocks sit 16px apart. A paragraph before a list gets 8px, before a code
-   block or a table 12px, and inside a list item none. */
-.ws-markdown-content p {
-  margin-block: var(--space-4);
-}
-
-.ws-markdown-content p:has(+ ul),
-.ws-markdown-content p:has(+ ol) {
-  margin-block-end: var(--space-2);
-}
-
-.ws-markdown-content p:has(+ .ws-code-block),
-.ws-markdown-content p:has(+ table) {
-  margin-block-end: var(--space-3);
-}
-
-.ws-markdown-content li p {
-  margin-block: 0;
-}
-
-.ws-markdown-content strong,
-.ws-markdown-content b {
-  font-weight: var(--font-weight-semibold);
-}
-
-/* Headings: weight 590 on a 1.42 line, 20.5px above h1 to h3 and 12px above
-   h4 to h6, 4px below; h5 and h6 read in the secondary tier. */
-.ws-markdown-content h1,
-.ws-markdown-content h2,
-.ws-markdown-content h3,
-.ws-markdown-content h4,
-.ws-markdown-content h5,
-.ws-markdown-content h6 {
-  margin-block: var(--space-3) var(--space-1);
-  font-weight: var(--font-weight-semibold);
-  line-height: 1.42;
-}
-
-.ws-markdown-content h1,
-.ws-markdown-content h2,
-.ws-markdown-content h3 {
-  margin-block-start: var(--ws-markdown-heading-gap-large);
-}
-
-.ws-markdown-content h1 {
-  font-size: 1.428em;
-}
-
-.ws-markdown-content h2 {
-  font-size: 1.318em;
-}
-
-.ws-markdown-content h3 {
-  font-size: 1.214em;
-}
-
-.ws-markdown-content h4 {
-  font-size: 1em;
-}
-
-.ws-markdown-content h5 {
-  font-size: 0.866em;
-  color: var(--cursor-text-secondary);
-}
-
-.ws-markdown-content h6 {
-  font-size: 0.8em;
-  color: var(--cursor-text-secondary);
-}
-
-/* Inline code: 0.9em mono on an 8% fill, no border; the pre rule below
-   undoes the pill inside fenced blocks. */
-.ws-markdown-content code {
-  font-family: var(--code-font);
-  font-size: 0.9em;
-  background: var(--cursor-bg-tertiary);
-  border: none;
-  border-radius: var(--ws-markdown-inline-code-radius);
-  padding: var(--ws-markdown-inline-code-padding);
-}
-
-/* Fenced blocks, highlighted (Shiki's pre has inline colors from the
-   theme) or not (the degraded path's plain pre), in a holder that carries
-   the hover copy button. */
-.ws-code-block {
-  position: relative;
-  margin-block: var(--space-3);
-}
-
-.ws-markdown-content pre {
-  margin: 0;
-  padding: var(--space-1-5) var(--space-2-5);
-  background: var(--syntax-bg);
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-xl);
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-base);
-  overflow-x: auto;
-}
-
-.ws-markdown-content pre code {
-  background: transparent;
-  border-radius: 0;
-  padding: 0;
-  font-size: inherit;
-  line-height: inherit;
-}
-
-/* "Copy code" at the block's top-right, shown on hover or focus, reading
-   "Copied" in green once the copy landed. No language label. */
-.ws-code-block__copy {
-  position: absolute;
-  inset-block-start: var(--space-1);
-  inset-inline-end: var(--space-1);
-  padding: var(--ws-size-2) var(--space-1-5);
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-sm);
-  background: var(--syntax-bg);
-  color: var(--cursor-text-secondary);
-  font: inherit;
-  font-size: var(--font-size-xs);
-  line-height: var(--line-height-xs);
-  cursor: pointer;
-  opacity: 0;
-  transition: opacity var(--duration-fast);
-}
-
-.ws-code-block:hover .ws-code-block__copy,
-.ws-code-block__copy:focus-visible {
-  opacity: 1;
-}
-
-.ws-code-block__copy:hover {
-  color: var(--cursor-text-primary);
-}
-
-.ws-code-block__copy:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-code-block__copy--copied,
-.ws-code-block__copy--copied:hover {
-  color: var(--cursor-green);
-}
-
-/* Links: the link color at weight 500, never underlined; hovering adds a
-   24% blue fill with a 4px radius. */
-.ws-markdown-content a {
-  color: var(--cursor-text-link);
-  font-weight: var(--font-weight-medium);
-  text-decoration: none;
-}
-
-.ws-markdown-content a:hover {
-  padding: var(--ws-size-2);
-  border-radius: var(--radius-sm);
-  background: color-mix(in srgb, var(--cursor-blue) 24%, transparent);
-}
-
-.ws-markdown-content a:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-/* Lists: 8px above and 18px below, a 2em indent, items in a flex column
-   8px apart. */
-.ws-markdown-content ul,
-.ws-markdown-content ol {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-  margin-block: var(--space-2) var(--ws-markdown-list-gap-end);
-  padding-inline-start: 2em;
-}
-
-.ws-markdown-content li > ul,
-.ws-markdown-content li > ol {
-  margin-block: var(--space-2) 0;
-}
-
-/* A blockquote: a 3px rounded bar, 16px of left padding, secondary text. */
-.ws-markdown-content blockquote {
-  margin-block: var(--space-4);
-  margin-inline: 0;
-  padding-inline-start: var(--space-4);
-  border-inline-start: var(--ws-markdown-quote-bar-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--ws-markdown-quote-bar-width);
-  color: var(--cursor-text-secondary);
-}
-
-/* A table is a 12px-radius card with 6px 10px cells. */
-.ws-markdown-content table {
-  margin-block: var(--space-4);
-  border-collapse: separate;
-  border-spacing: 0;
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-xl);
-  overflow: hidden;
-}
-
-.ws-markdown-content th,
-.ws-markdown-content td {
-  padding: var(--space-1-5) var(--space-2-5);
-  border-block-end: var(--ws-border-width) solid var(--cursor-stroke-tertiary);
-  text-align: start;
-}
-
-.ws-markdown-content tr:last-child > td {
-  border-block-end: none;
-}
-
-.ws-markdown-content th {
-  font-weight: var(--font-weight-semibold);
-  background: var(--cursor-bg-quaternary);
-}
-
-/* height: auto keeps the =WxH attribute ratio when max-inline-size
-   clamps an image wider than the column. */
-.ws-markdown-content img {
-  max-inline-size: 100%;
-  height: auto;
-}
-
-.ws-markdown-content hr {
-  border: none;
-  border-block-start: var(--ws-border-width) solid var(--cursor-stroke-tertiary);
-  margin-block: var(--space-4);
-}
-
-/* Streaming text fades in from 0 to 1 over 150ms, linear. The JS wraps
-   only text younger than that, with a negative delay so the fade carries
-   on across renders. */
-.ws-fade-in {
-  animation: ws-markdown-fade-in var(--duration-normal) linear both;
-}
-
-@keyframes ws-markdown-fade-in {
-  from {
-    opacity: 0;
-  }
-  to {
-    opacity: 1;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .ws-fade-in {
-    animation: none;
-  }
-
-  .ws-code-block__copy {
-    transition: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/markdown-render.ts b/crates/workshop/ui/src/parts/agent/markdown-render.ts
deleted file mode 100644
index f4842106a..000000000
--- a/crates/workshop/ui/src/parts/agent/markdown-render.ts
+++ /dev/null
@@ -1,490 +0,0 @@
-// Markdown rendering for model-authored chat content. marked parses to
-// HTML with three custom renderers taken from Cursor's markdown
-// pipeline (image dimension suffixes, escaped links that are not
-// draggable, inline-only paragraphs); fenced code blocks highlight
-// through a Shiki core highlighter whose theme is Cursor's CSS-variables
-// theme (colors are var(--shiki-*) slots the stylesheet fills from the
-// skin's --syntax-* tokens); DOMPurify sanitizes the final string before it
-// touches the DOM. Sanitizing here, at the render boundary, means no
-// caller can bypass it: marked deliberately does not sanitize (it emits
-// javascript: hrefs and passes raw <script> through) and has no sanitize
-// option.
-//
-// Shiki init is async but renderMarkdown is sync, so the highlighter is
-// created at module scope and readiness is exported as markdownReady for
-// the agent directory's register() to log a failure against. That latch
-// is write-once initialization, not shared app state. Before readiness -
-// or for a language Shiki does not know - code blocks degrade to
-// unhighlighted <pre><code>.
-//
-// Streaming re-parses and re-sanitizes the whole buffer per delta: at
-// chat message sizes that stays well under a frame budget, so there is
-// no chunked renderer to keep consistent. A MarkdownStream sits on top
-// for a growing reply: it remembers what an earlier render painted and
-// fades in only the text that is new (a caret is never drawn).
-//
-// Each fenced block is wrapped with a hover "Copy code" button that is
-// added after sanitizing, so it is our markup, never the model's.
-
-import "./markdown-render.css";
-
-import DOMPurify from "dompurify";
-import { Marked, type Tokens } from "marked";
-import { createHighlighterCore, type HighlighterCore, type ThemeRegistration } from "shiki/core";
-import { createJavaScriptRegexEngine } from "shiki/engine/javascript";
-
-import langBash from "@shikijs/langs/bash";
-import langCss from "@shikijs/langs/css";
-import langHtml from "@shikijs/langs/html";
-import langJavascript from "@shikijs/langs/javascript";
-import langJson from "@shikijs/langs/json";
-import langLua from "@shikijs/langs/lua";
-import langMarkdown from "@shikijs/langs/markdown";
-import langPython from "@shikijs/langs/python";
-import langRust from "@shikijs/langs/rust";
-import langToml from "@shikijs/langs/toml";
-import langTypescript from "@shikijs/langs/typescript";
-import langYaml from "@shikijs/langs/yaml";
-
-import { copyToClipboard } from "../shared/clipboard";
-import { prefersReducedMotion } from "./transcript/motion";
-
-const THEME_NAME = "css-variables";
-
-// Cursor's CSS-variables theme, scope for scope: every color is a var()
-// reference to a --shiki-* slot, so the markup carries no hex at all and
-// the stylesheet decides the colors (markdown-render.css maps each slot to
-// the skin's --syntax-* tokens in @workshop/look/tokens.css, the way
-// Cursor's own stylesheet maps them to --cursor-syntax-*). Shiki passes the
-// var() strings through to the style attributes untouched.
-const workshopTheme: ThemeRegistration = {
-  name: THEME_NAME,
-  type: "dark",
-  fg: "var(--shiki-foreground)",
-  bg: "var(--shiki-background)",
-  settings: [
-    { scope: ["meta.embedded", "meta.template.expression"], settings: { foreground: "var(--shiki-foreground)" } },
-    {
-      scope: ["comment", "punctuation.definition.comment"],
-      settings: { foreground: "var(--shiki-token-comment)", fontStyle: "italic" },
-    },
-    {
-      scope: ["string", "string.quoted", "string.template", "string.other.link"],
-      settings: { foreground: "var(--shiki-token-string)" },
-    },
-    { scope: ["string.regexp"], settings: { foreground: "var(--shiki-token-string-expression)" } },
-    { scope: ["constant.numeric"], settings: { foreground: "var(--shiki-token-constant)" } },
-    { scope: ["constant.language"], settings: { foreground: "var(--shiki-token-keyword)" } },
-    {
-      scope: ["constant.character", "constant.character.escape"],
-      settings: { foreground: "var(--shiki-token-string-expression)" },
-    },
-    { scope: ["constant.other"], settings: { foreground: "var(--shiki-token-constant)" } },
-    { scope: ["variable"], settings: { foreground: "var(--shiki-token-variable)" } },
-    { scope: ["variable.language"], settings: { foreground: "var(--shiki-token-language-variable)" } },
-    { scope: ["variable.parameter"], settings: { foreground: "var(--shiki-token-parameter)" } },
-    { scope: ["variable.other.constant"], settings: { foreground: "var(--shiki-token-constant-variable)" } },
-    {
-      scope: ["variable.other.property", "support.variable.property"],
-      settings: { foreground: "var(--shiki-token-property)" },
-    },
-    {
-      scope: [
-        "keyword",
-        "keyword.control",
-        "keyword.operator.new",
-        "keyword.operator.expression",
-        "keyword.operator.logical",
-        "keyword.operator.delete",
-        "storage",
-        "storage.type",
-        "storage.modifier",
-      ],
-      settings: { foreground: "var(--shiki-token-keyword)" },
-    },
-    { scope: ["entity.name.function", "support.function"], settings: { foreground: "var(--shiki-token-function)" } },
-    {
-      scope: ["entity.name.type", "support.type", "entity.name.type.class"],
-      settings: { foreground: "var(--shiki-token-type)" },
-    },
-    { scope: ["entity.name.class", "support.class"], settings: { foreground: "var(--shiki-token-class)" } },
-    {
-      scope: ["entity.name.tag", "support.class.component", "punctuation.definition.tag"],
-      settings: { foreground: "var(--shiki-token-tag)" },
-    },
-    { scope: ["entity.other.attribute-name"], settings: { foreground: "var(--shiki-token-attribute)" } },
-    { scope: ["entity.name.section"], settings: { foreground: "var(--shiki-token-keyword)" } },
-    {
-      scope: ["entity.name.namespace", "entity.name.module", "entity.name.scope-resolution"],
-      settings: { foreground: "var(--shiki-token-type)" },
-    },
-    { scope: ["entity.other.inherited-class"], settings: { foreground: "var(--shiki-token-class)" } },
-    {
-      scope: ["support.type.property-name", "meta.object-literal.key"],
-      settings: { foreground: "var(--shiki-token-property)" },
-    },
-    { scope: ["support.constant"], settings: { foreground: "var(--shiki-token-constant)" } },
-    { scope: ["support.variable"], settings: { foreground: "var(--shiki-token-variable)" } },
-    {
-      scope: ["punctuation", "meta.brace", "meta.delimiter", "keyword.operator", "keyword.operator.assignment"],
-      settings: { foreground: "var(--shiki-token-punctuation)" },
-    },
-    {
-      scope: [
-        "punctuation.definition.template-expression.begin",
-        "punctuation.definition.template-expression.end",
-        "punctuation.section.embedded",
-      ],
-      settings: { foreground: "var(--shiki-token-keyword)" },
-    },
-    { scope: ["markup.heading"], settings: { foreground: "var(--shiki-token-keyword)", fontStyle: "bold" } },
-    { scope: ["markup.bold"], settings: { fontStyle: "bold" } },
-    { scope: ["markup.italic"], settings: { fontStyle: "italic" } },
-    { scope: ["markup.strikethrough"], settings: { fontStyle: "strikethrough" } },
-    { scope: ["markup.inline.raw"], settings: { foreground: "var(--shiki-token-string)" } },
-    { scope: ["markup.underline.link"], settings: { foreground: "var(--shiki-token-link)" } },
-    { scope: ["markup.inserted"], settings: { foreground: "var(--shiki-token-constant)" } },
-    { scope: ["markup.deleted"], settings: { foreground: "var(--shiki-token-string)" } },
-    { scope: ["markup.changed"], settings: { foreground: "var(--shiki-token-keyword)" } },
-    { scope: ["markup.quote"], settings: { foreground: "var(--shiki-token-comment)" } },
-  ],
-};
-
-let highlighter: HighlighterCore | undefined;
-
-/**
- * Resolves when the Shiki highlighter is ready. The agent directory's
- * register() logs a failure; until readiness, code blocks render
- * unhighlighted.
- */
-export const markdownReady: Promise<void> = createHighlighterCore({
-  themes: [workshopTheme],
-  langs: [
-    langBash,
-    langCss,
-    langHtml,
-    langJavascript,
-    langJson,
-    langLua,
-    langMarkdown,
-    langPython,
-    langRust,
-    langToml,
-    langTypescript,
-    langYaml,
-  ],
-  engine: createJavaScriptRegexEngine(),
-}).then((created) => {
-  highlighter = created;
-});
-
-function escapeHtml(text: string): string {
-  return text
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
-/** marked's default fenced-block shape, for the degraded path. */
-function plainCodeBlock(code: string, lang: string): string {
-  const languageClass = lang === "" ? "" : ` class="language-${escapeHtml(lang)}"`;
-  return `<pre><code${languageClass}>${escapeHtml(code)}</code></pre>`;
-}
-
-/**
- * Highlights one fenced code block, returning its HTML. Exported so a
- * caller can highlight code outside a markdown document. Falls back to an
- * unhighlighted block before the highlighter is ready, for an unknown
- * language, or when a grammar
- * rejects the input (the JS regex engine refuses some Oniguruma-specific
- * constructs; a block that cannot highlight still renders as plain code).
- */
-export function highlightCode(code: string, lang: string): string {
-  const active = highlighter;
-  if (active !== undefined && lang !== "" && active.getLoadedLanguages().includes(lang)) {
-    try {
-      return active.codeToHtml(code, { lang, theme: THEME_NAME });
-    } catch {
-      return plainCodeBlock(code, lang);
-    }
-  }
-  return plainCodeBlock(code, lang);
-}
-
-/** Splits a Cursor-style ` =WxH` (or ` =Wx`) dimension suffix off an image href. */
-function parseImageSource(href: string): {
-  src: string;
-  width: string | undefined;
-  height: string | undefined;
-} {
-  const match = /\s+=(\d+)x(\d*)$/.exec(href);
-  if (match === null) {
-    return { src: href, width: undefined, height: undefined };
-  }
-  const width = match[1] ?? "";
-  const height = match[2] ?? "";
-  return {
-    src: href.slice(0, match.index),
-    width: width === "" ? undefined : width,
-    height: height === "" ? undefined : height,
-  };
-}
-
-// A private Marked instance holds the custom renderers, so the global
-// marked instance is never mutated for a hypothetical other consumer.
-const markedInstance = new Marked({
-  renderer: {
-    code({ text, lang }: Tokens.Code): string {
-      return highlightCode(text, lang ?? "");
-    },
-    // Inline tokens only: a paragraph never holds block content.
-    paragraph({ tokens }: Tokens.Paragraph): string {
-      return `<p>${this.parser.parseInline(tokens)}</p>`;
-    },
-    // The href is escaped for the attribute and doubles as the title when
-    // the source gives none. draggable="false" keeps a link drag out of
-    // the window's workspace drop handlers.
-    link({ href, title, tokens }: Tokens.Link): string {
-      const text = this.parser.parseInline(tokens);
-      return `<a href="${escapeHtml(href)}" title="${escapeHtml(title ?? href)}" draggable="false">${text}</a>`;
-    },
-    image({ href, title, text }: Tokens.Image): string {
-      const { src, width, height } = parseImageSource(href);
-      const titleAttribute = title === null ? "" : ` title="${escapeHtml(title)}"`;
-      const widthAttribute = width === undefined ? "" : ` width="${width}"`;
-      const heightAttribute = height === undefined ? "" : ` height="${height}"`;
-      return `<img src="${escapeHtml(src)}" alt="${escapeHtml(text)}"${titleAttribute}${widthAttribute}${heightAttribute}>`;
-    },
-  },
-});
-
-/** Options for {@link renderMarkdown}. */
-export interface RenderMarkdownOptions {
-  /**
-   * Hints that the text is a growing stream buffer. Accepted for callers
-   * rendering deltas; rendering is a full re-parse and re-sanitize either
-   * way, so the hint currently changes nothing.
-   */
-  readonly streaming?: boolean;
-}
-
-/** How long "Copied" shows on a code block's button before it reads "Copy code" again. */
-const COPIED_MS = 2000;
-
-/**
- * Wraps each fenced block in a `ws-code-block` holder with a "Copy code"
- * button at its top-right, shown on hover (CSS). The button reads
- * "Copied" for a moment after a successful copy. Runs after sanitizing:
- * the wrapper and the button are this module's own markup.
- */
-function addCopyButtons(root: HTMLElement): void {
-  for (const pre of root.querySelectorAll("pre")) {
-    const holder = document.createElement("div");
-    holder.className = "ws-code-block";
-    const button = document.createElement("button");
-    button.type = "button";
-    button.className = "ws-code-block__copy";
-    button.textContent = "Copy code";
-    button.addEventListener("click", () => {
-      void copyToClipboard(pre.textContent ?? "").then((copied) => {
-        if (!copied) {
-          return;
-        }
-        button.textContent = "Copied";
-        button.classList.add("ws-code-block__copy--copied");
-        setTimeout(() => {
-          button.textContent = "Copy code";
-          button.classList.remove("ws-code-block__copy--copied");
-        }, COPIED_MS);
-      });
-    });
-    pre.replaceWith(holder);
-    holder.append(pre, button);
-  }
-}
-
-/**
- * Renders markdown text to a DocumentFragment whose single root element
- * has the `ws-markdown-content` class (the feed's styles target that
- * class). Synchronous; the DOMPurify pass runs before the copy buttons
- * are added, so the returned markup is safe to insert as-is.
- */
-export function renderMarkdown(text: string, options?: RenderMarkdownOptions): DocumentFragment {
-  void options;
-  const dirty = markedInstance.parse(text, { async: false });
-  const clean = DOMPurify.sanitize(dirty, {
-    USE_PROFILES: { html: true },
-    SANITIZE_NAMED_PROPS: true,
-  });
-  const template = document.createElement("template");
-  template.innerHTML = clean;
-  const root = document.createElement("div");
-  root.className = "ws-markdown-content";
-  root.append(template.content);
-  addCopyButtons(root);
-  const fragment = document.createDocumentFragment();
-  fragment.append(root);
-  return fragment;
-}
-
-// --- Streaming fade ---------------------------------------------------------------
-
-/** How long new text takes to fade in, and so how long a run counts as young. Keep in step with markdown-render.css. */
-export const FADE_MS = 150;
-
-/** The elements whose text never fades: code, images, and math draw their own way, and the copy button is chrome. */
-const FADE_SKIPPED = new Set(["PRE", "SVG", "MATH", "BUTTON"]);
-
-/** Text that arrived at one moment: a range of the rendered text and when it landed. */
-interface Run {
-  from: number;
-  to: number;
-  at: number;
-}
-
-// DOM node types, spelled out so the walk reads no browser global.
-const ELEMENT_NODE = 1;
-const TEXT_NODE = 3;
-
-/** The text nodes under `root` that can fade, in document order. */
-function fadeableTextNodes(root: Node, found: Text[] = []): Text[] {
-  for (const child of root.childNodes) {
-    if (child.nodeType === TEXT_NODE) {
-      found.push(child as Text);
-    } else if (
-      child.nodeType === ELEMENT_NODE &&
-      !FADE_SKIPPED.has((child as Element).tagName.toUpperCase())
-    ) {
-      fadeableTextNodes(child, found);
-    }
-  }
-  return found;
-}
-
-/** The length of the common prefix of two strings. */
-function commonPrefix(a: string, b: string): number {
-  const limit = Math.min(a.length, b.length);
-  let index = 0;
-  while (index < limit && a.charCodeAt(index) === b.charCodeAt(index)) {
-    index++;
-  }
-  return index;
-}
-
-/**
- * Replaces one text node's young stretches with spans that fade in. Each
- * word of a young stretch is its own `ws-fade-in` span (split at
- * whitespace), and its negative `animation-delay` is how far into the
- * fade the text already is, so the animation carries on across renders
- * instead of restarting.
- */
-function wrapYoung(node: Text, start: number, runs: readonly Run[], now: number): void {
-  const data = node.data;
-  const end = start + data.length;
-  const pieces: Array<string | HTMLSpanElement> = [];
-  let cursor = start;
-  for (const run of runs) {
-    const from = Math.max(start, run.from, cursor);
-    const to = Math.min(end, run.to);
-    if (to <= from) {
-      continue;
-    }
-    if (from > cursor) {
-      pieces.push(data.slice(cursor - start, from - start));
-    }
-    const delay = `-${Math.max(0, now - run.at)}ms`;
-    for (const token of data.slice(from - start, to - start).split(/(\s+)/)) {
-      if (token === "") {
-        continue;
-      }
-      if (/^\s+$/.test(token)) {
-        pieces.push(token);
-        continue;
-      }
-      const span = document.createElement("span");
-      span.className = "ws-fade-in";
-      span.style.animationDelay = delay;
-      span.textContent = token;
-      pieces.push(span);
-    }
-    cursor = to;
-  }
-  if (pieces.length === 0) {
-    return;
-  }
-  if (cursor < end) {
-    pieces.push(data.slice(cursor - start));
-  }
-  node.replaceWith(...pieces);
-}
-
-/** Options for {@link MarkdownStream.render}. */
-export interface MarkdownStreamOptions {
-  /** True while the text is still growing. A stream that has streamed keeps fading the tail after it settles. */
-  readonly streaming: boolean;
-  /** A millisecond clock reading; defaults to `performance.now()`. Tests pass exact times. */
-  readonly now?: number;
-}
-
-/**
- * Renders one growing reply. Each render is a full re-parse (see the
- * header), but the stream remembers the rendered text of the render
- * before: whatever follows their common prefix is new, and only text
- * that is under {@link FADE_MS} old is wrapped to fade in - so a delta
- * fades its own words, earlier words stay put, and a delta landing mid-fade
- * carries the older words' fade on. Code, images, and math are never
- * wrapped. Under reduced motion nothing is wrapped. A reply that never
- * streamed (settled history) renders plain, with no fade.
- */
-export class MarkdownStream {
-  private previous = "";
-  private runs: Run[] = [];
-  private streamed = false;
-
-  render(text: string, options: MarkdownStreamOptions): DocumentFragment {
-    const fragment = renderMarkdown(text, { streaming: options.streaming });
-    const root = fragment.firstElementChild;
-    if (root === null) {
-      return fragment;
-    }
-    const nodes = fadeableTextNodes(root);
-    const rendered = nodes.map((node) => node.data).join("");
-    const animate = (options.streaming || this.streamed) && !prefersReducedMotion();
-    if (options.streaming) {
-      this.streamed = true;
-    }
-    if (!animate) {
-      this.previous = rendered;
-      this.runs = [];
-      return fragment;
-    }
-
-    const now = options.now ?? performance.now();
-    const shared = commonPrefix(this.previous, rendered);
-    this.previous = rendered;
-    // Text past the shared prefix is new; runs that reached into the
-    // part that changed are cut back to it.
-    const runs: Run[] = [];
-    for (const run of this.runs) {
-      const to = Math.min(run.to, shared);
-      if (to > run.from && now - run.at < FADE_MS) {
-        runs.push({ from: run.from, to, at: run.at });
-      }
-    }
-    if (rendered.length > shared) {
-      runs.push({ from: shared, to: rendered.length, at: now });
-    }
-    this.runs = runs;
-
-    let offset = 0;
-    for (const node of nodes) {
-      const length = node.data.length;
-      if (runs.some((run) => run.from < offset + length && run.to > offset)) {
-        wrapYoung(node, offset, runs, now);
-      }
-      offset += length;
-    }
-    return fragment;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/mode-chip.css b/crates/workshop/ui/src/parts/agent/mode-chip.css
deleted file mode 100644
index dc429d2e3..000000000
--- a/crates/workshop/ui/src/parts/agent/mode-chip.css
+++ /dev/null
@@ -1,92 +0,0 @@
-/* The mode selector chip trigger (mode-chip.ts imports this file;
-   esbuild bundles it into dist/app.css). The menu it opens is the
-   composer's shared surface (look's dropdown.css, .menu-composer); these
-   rules cover the trigger and that menu's width. The chip is 20px tall with
-   padding 2px 4px 2px 8px, a 16px icon at 0.5 opacity, the label at 0.8, and
-   a 14px chevron at 0.5. Plan, Ask, Debug, and Multitask tint it: a 24% fill
-   under text of the same color. Themed values come from the :root tokens in
-   @workshop/look/tokens.css. */
-
-.ws-mode-chip {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--ws-size-2);
-  block-size: var(--height-xs);
-  padding: var(--ws-size-2) var(--space-1) var(--ws-size-2) var(--space-2);
-  font: inherit;
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-sm);
-  color: var(--cursor-text-primary);
-  background: transparent;
-  border: none;
-  border-radius: var(--radius-sm);
-  cursor: pointer;
-  white-space: nowrap;
-}
-
-.ws-mode-chip__icon,
-.ws-mode-chip__chevron {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  opacity: 0.5;
-}
-
-.ws-mode-chip__icon svg {
-  inline-size: var(--ws-size-16);
-  block-size: var(--ws-size-16);
-}
-
-.ws-mode-chip__chevron svg {
-  inline-size: var(--ws-size-14);
-  block-size: var(--ws-size-14);
-}
-
-.ws-mode-chip__label {
-  opacity: 0.8;
-}
-
-/* Hover and the open menu wash the plain chip; DropdownMenu sets
-   aria-expanded on the trigger while its menu is up. */
-.ws-mode-chip:hover,
-.ws-mode-chip[aria-expanded="true"] {
-  background: var(--cursor-bg-tertiary);
-}
-
-.ws-mode-chip:focus-visible {
-  outline: none;
-  background: var(--cursor-bg-tertiary);
-}
-
-/* The mode tints: a 24% fill and text of the same color. */
-.ws-mode-chip[data-mode="plan"] {
-  color: var(--cursor-yellow);
-  background: color-mix(in srgb, var(--cursor-yellow) 24%, transparent);
-}
-
-.ws-mode-chip[data-mode="ask"] {
-  color: var(--cursor-green);
-  background: color-mix(in srgb, var(--cursor-green) 24%, transparent);
-}
-
-.ws-mode-chip[data-mode="debug"] {
-  color: var(--cursor-red);
-  background: color-mix(in srgb, var(--cursor-red) 24%, transparent);
-}
-
-.ws-mode-chip[data-mode="multitask"] {
-  color: var(--cursor-multitask);
-  background: color-mix(in srgb, var(--cursor-multitask) 24%, transparent);
-}
-
-/* Below 300px of composer the label gives way to the icon and chevron. */
-@container ws-composer (width < 300px) {
-  .ws-mode-chip__label {
-    display: none;
-  }
-}
-
-/* The menu: at least 170px wide. */
-.ws-mode-menu {
-  min-inline-size: var(--ws-mode-menu-min-width);
-}
diff --git a/crates/workshop/ui/src/parts/agent/mode-chip.ts b/crates/workshop/ui/src/parts/agent/mode-chip.ts
deleted file mode 100644
index ed76179db..000000000
--- a/crates/workshop/ui/src/parts/agent/mode-chip.ts
+++ /dev/null
@@ -1,202 +0,0 @@
-// The mode selector chip: a toolbar button showing the current agent
-// mode's icon and label. Clicking it (or Ctrl+. and Shift+Tab, through
-// openOrCycle) opens a DropdownMenu of the five modes on the composer's
-// menu surface: check-only selection, a description on each row, opening
-// upward at the chip's left edge minus 6px. Picking one updates the chip
-// and fires "agent-mode-changed" on document and onDidChangeMode.
-// UI-only by design - nothing here talks to the backend; the event is the
-// seam for wiring the mode to the backend, and the session view listens
-// to onDidChangeMode to color its action button.
-
-import "./mode-chip.css";
-
-import {
-  ICON_AGENT,
-  ICON_ASK,
-  ICON_BUG,
-  ICON_CHECKLIST,
-  ICON_CHEVRON_DOWN,
-  ICON_LAYERS,
-} from "@workshop/look/icons";
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { DropdownMenu } from "@workshop/look/dropdown";
-import type { DropdownItem } from "@workshop/look/dropdown";
-
-/** The agent interaction modes, keyed by display label. */
-export const UNIFIED_MODES = {
-  Agent: "agent",
-  Plan: "plan",
-  Debug: "debug",
-  Multitask: "multitask",
-  Ask: "ask",
-} as const;
-
-/** An agent interaction mode. */
-export type UnifiedMode = (typeof UNIFIED_MODES)[keyof typeof UNIFIED_MODES];
-
-/** The document-level event a mode selection fires; `detail` names the mode. */
-export const AGENT_MODE_CHANGED_EVENT = "agent-mode-changed";
-
-// The labels in menu order, derived from UNIFIED_MODES so the dropdown
-// can never drift from the mode set. Object.keys hides the literal key
-// type; the cast restores it.
-const MODE_LABELS = ["Agent", "Plan", "Debug", "Multitask", "Ask"] as const;
-
-/** Display labels by mode value: the inverse of UNIFIED_MODES. */
-const MODE_LABEL_BY_MODE: Record<UnifiedMode, string> = {
-  [UNIFIED_MODES.Agent]: "Agent",
-  [UNIFIED_MODES.Plan]: "Plan",
-  [UNIFIED_MODES.Debug]: "Debug",
-  [UNIFIED_MODES.Multitask]: "Multitask",
-  [UNIFIED_MODES.Ask]: "Ask",
-};
-
-/** The line under each label in the menu, in Cursor's own words. */
-const MODE_DESCRIPTION: Record<UnifiedMode, string> = {
-  [UNIFIED_MODES.Agent]: "Plan, search, build anything",
-  [UNIFIED_MODES.Plan]: "Create detailed plans for accomplishing tasks",
-  [UNIFIED_MODES.Debug]: "Systematically diagnose and fix bugs using runtime traces",
-  [UNIFIED_MODES.Multitask]: "Run and coordinate multiple tasks in parallel",
-  [UNIFIED_MODES.Ask]: "Ask Cursor questions about your codebase",
-};
-
-/** Mode glyphs: static codicon strings from @workshop/look, never data. */
-const MODE_ICON_HTML: Record<UnifiedMode, string> = {
-  [UNIFIED_MODES.Agent]: ICON_AGENT,
-  [UNIFIED_MODES.Plan]: ICON_CHECKLIST,
-  [UNIFIED_MODES.Debug]: ICON_BUG,
-  [UNIFIED_MODES.Multitask]: ICON_LAYERS,
-  [UNIFIED_MODES.Ask]: ICON_ASK,
-};
-
-/** The chip's tooltip. */
-const CHIP_TITLE = "Switch Agent Mode (Ctrl+.)";
-
-/** The menu opens above the chip, its left edge 6px left of the chip's. */
-const MENU_OFFSET_X = -6;
-
-/**
- * The chip trigger plus its dropdown. Disposable: dispose() closes an
- * open menu and removes the trigger's click listener.
- */
-export class ModeChip extends Disposable {
-  /** The chip button; append it where the chip belongs. */
-  readonly element: HTMLButtonElement;
-
-  private readonly dropdown: DropdownMenu;
-  private readonly iconSlot: HTMLSpanElement;
-  private readonly labelSlot: HTMLSpanElement;
-  private readonly modeEmitter = this._register(new Emitter<UnifiedMode>());
-  private current: UnifiedMode = UNIFIED_MODES.Agent;
-
-  /** Fires with the new mode each time the selection changes. */
-  readonly onDidChangeMode: Event<UnifiedMode> = this.modeEmitter.event;
-
-  constructor() {
-    super();
-    this.element = document.createElement("button");
-    this.element.type = "button";
-    this.element.className = "ws-mode-chip";
-    this.element.title = CHIP_TITLE;
-
-    this.iconSlot = document.createElement("span");
-    this.iconSlot.className = "ws-mode-chip__icon";
-    this.iconSlot.setAttribute("aria-hidden", "true");
-    this.labelSlot = document.createElement("span");
-    this.labelSlot.className = "ws-mode-chip__label";
-    const chevron = document.createElement("span");
-    chevron.className = "ws-mode-chip__chevron";
-    chevron.setAttribute("aria-hidden", "true");
-    chevron.innerHTML = ICON_CHEVRON_DOWN;
-    this.element.append(this.iconSlot, this.labelSlot, chevron);
-
-    this.dropdown = this._register(new DropdownMenu());
-
-    const onClick = (): void => this.showMenu();
-    this.element.addEventListener("click", onClick);
-    this._register(
-      toDisposable(() => this.element.removeEventListener("click", onClick)),
-    );
-
-    // Shift+Tab again, with the menu open and focus in it, cycles the mode:
-    // the menu would otherwise treat Tab as its dismissal. Ctrl+. is a
-    // registered keybinding, so it reaches openOrCycle through its command.
-    const onShiftTab = (event: KeyboardEvent): void => {
-      if (this.dropdown.isOpen && event.key === "Tab" && event.shiftKey) {
-        event.preventDefault();
-        event.stopPropagation();
-        this.openOrCycle();
-      }
-    };
-    document.addEventListener("keydown", onShiftTab, true);
-    this._register(
-      toDisposable(() => document.removeEventListener("keydown", onShiftTab, true)),
-    );
-
-    this.renderMode();
-  }
-
-  /** The selected mode. */
-  get mode(): UnifiedMode {
-    return this.current;
-  }
-
-  /**
-   * Ctrl+. and Shift+Tab: opens the menu, and while it is open selects the
-   * next mode in menu order (wrapping), leaving the menu open on the new
-   * choice so the next press keeps cycling.
-   */
-  openOrCycle(): void {
-    if (!this.dropdown.isOpen) {
-      this.showMenu();
-      return;
-    }
-    const index = MODE_LABELS.findIndex((label) => UNIFIED_MODES[label] === this.current);
-    const next = MODE_LABELS[(index + 1) % MODE_LABELS.length];
-    this.dropdown.close();
-    if (next !== undefined) {
-      this.select(UNIFIED_MODES[next]);
-    }
-    this.showMenu();
-  }
-
-  private showMenu(): void {
-    const items: DropdownItem[] = MODE_LABELS.map((label) => {
-      const mode = UNIFIED_MODES[label];
-      return {
-        label,
-        description: MODE_DESCRIPTION[mode],
-        iconHtml: MODE_ICON_HTML[mode],
-        selected: mode === this.current,
-        onClick: () => this.select(mode),
-      };
-    });
-    this.dropdown.show(this.element, items, undefined, {
-      skin: "composer",
-      className: "ws-mode-menu",
-      placement: "above",
-      offsetX: MENU_OFFSET_X,
-    });
-  }
-
-  private select(mode: UnifiedMode): void {
-    // The event is "changed": re-picking the current mode stays silent.
-    if (mode === this.current) {
-      return;
-    }
-    this.current = mode;
-    this.renderMode();
-    this.modeEmitter.fire(mode);
-    document.dispatchEvent(
-      new CustomEvent<UnifiedMode>(AGENT_MODE_CHANGED_EVENT, { detail: mode }),
-    );
-  }
-
-  private renderMode(): void {
-    // The icon HTML is this module's own static string, never input.
-    this.iconSlot.innerHTML = MODE_ICON_HTML[this.current];
-    this.labelSlot.textContent = MODE_LABEL_BY_MODE[this.current];
-    this.element.dataset["mode"] = this.current;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/collapsible.css b/crates/workshop/ui/src/parts/agent/transcript/collapsible.css
deleted file mode 100644
index c8189b4f8..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/collapsible.css
+++ /dev/null
@@ -1,122 +0,0 @@
-/* The transcript's shared collapsible (collapsible.ts): a header line over
-   a body that opens its height from zero. The tone variables are the
-   transcript's (transcript.css); a muted scope shifts them down a tier. */
-
-.ws-collapsible {
-  min-inline-size: 0;
-}
-
-/* The header: a flex row, 4px apart, 14px/22px at weight 400. The action
-   reads in the tertiary tier and the details in the quaternary one, in
-   tabular figures; hovering doesn't brighten either. */
-.ws-collapsible__header {
-  display: flex;
-  align-items: baseline;
-  gap: var(--space-1);
-  min-inline-size: 0;
-  font-size: var(--font-size-lg);
-  line-height: var(--line-height-lg);
-  font-weight: normal;
-  white-space: nowrap;
-  cursor: pointer;
-}
-
-.ws-collapsible[data-expandable="false"] > .ws-collapsible__header {
-  cursor: default;
-}
-
-.ws-collapsible__header:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-collapsible__action {
-  flex: none;
-  color: var(--ws-tone-tertiary, var(--cursor-text-tertiary));
-}
-
-.ws-collapsible__details {
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  color: var(--ws-tone-quaternary, var(--cursor-text-quaternary));
-  font-variant-numeric: tabular-nums;
-}
-
-.ws-collapsible__details[hidden] {
-  display: none;
-}
-
-/* The trailing chevron: hidden until the header is hovered, and kept
-   visible while the body is open, where it turns down. */
-.ws-collapsible__chevron {
-  flex: none;
-  align-self: center;
-  display: inline-flex;
-  inline-size: var(--ws-collapsible-chevron-size);
-  block-size: var(--ws-collapsible-chevron-size);
-  margin-inline-start: var(--ws-collapsible-chevron-gap);
-  color: var(--cursor-icon-tertiary);
-  opacity: 0;
-  transition:
-    opacity var(--duration-fast),
-    color var(--duration-fast),
-    transform var(--duration-normal);
-}
-
-.ws-collapsible__chevron svg {
-  inline-size: 100%;
-  block-size: 100%;
-}
-
-.ws-collapsible[data-expandable="false"] > .ws-collapsible__header > .ws-collapsible__chevron {
-  display: none;
-}
-
-.ws-collapsible__header:hover > .ws-collapsible__chevron,
-.ws-collapsible[data-open="true"] > .ws-collapsible__header > .ws-collapsible__chevron {
-  opacity: 1;
-  color: var(--cursor-icon-secondary);
-}
-
-.ws-collapsible[data-open="true"] > .ws-collapsible__header > .ws-collapsible__chevron {
-  transform: rotate(90deg);
-}
-
-/* The body: a one-row grid whose row animates between 0fr and 1fr, which
-   opens the height from zero without measuring it. Closed, it is hidden
-   from the page once the collapse has finished. */
-.ws-collapsible__clip {
-  display: grid;
-  grid-template-rows: 0fr;
-  visibility: hidden;
-  transition:
-    grid-template-rows var(--duration-normal) var(--ease-out-cubic),
-    visibility 0s linear var(--duration-normal);
-}
-
-.ws-collapsible[data-open="true"] > .ws-collapsible__clip {
-  grid-template-rows: 1fr;
-  visibility: visible;
-  transition: grid-template-rows var(--duration-normal) var(--ease-out-cubic);
-}
-
-.ws-collapsible__body {
-  min-block-size: 0;
-  overflow: hidden;
-}
-
-/* The body starts 14px below the header; the space is content, so the
-   collapsed row clips it away. */
-.ws-collapsible__body::before {
-  content: "";
-  display: block;
-  block-size: var(--feed-row-gap);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .ws-collapsible__clip,
-  .ws-collapsible__chevron {
-    transition: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/collapsible.ts b/crates/workshop/ui/src/parts/agent/transcript/collapsible.ts
deleted file mode 100644
index 6a6deb7bf..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/collapsible.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-// The transcript's shared collapsible: one header line (an action in the
-// row's tone, details after it, a trailing chevron) over a body that
-// animates its height open. Thought rows, group rows, a group's thinking
-// lines, and generic tool lines all build on it.
-//
-// The open state lives here, not in the model: a row's `update(row)` calls
-// the header setters again on every delta and settle, and none of them
-// touches the state. The state has two layers - a default the owner sets
-// (a streaming thinking line opens by default, a settled one doesn't) and
-// the operator's own choice, which wins once made, so a click survives
-// every later update. Default closed.
-//
-// The body is clipped to zero height while closed (CSS animates it) and
-// marked `inert`, so its links and focusable children leave the tab order.
-// Header text is untrusted model-era data and always lands through
-// textContent.
-
-import "./collapsible.css";
-
-import { ICON_CHEVRON_RIGHT } from "@workshop/look/icons";
-import { setShimmer } from "@workshop/look/shimmer";
-
-/** The shimmer tones a header's action can run in (shimmer.css). */
-export type ShimmerTone = "status" | "thinking" | "tool";
-
-const TONES: readonly ShimmerTone[] = ["status", "thinking", "tool"];
-
-/** Runs, or stops, the shared shimmer on `element` in the given tone. */
-export function applyShimmer(element: HTMLElement, tone: ShimmerTone | null): void {
-  for (const candidate of TONES) {
-    element.classList.toggle(`ws-shimmer-text--${candidate}`, candidate === tone);
-  }
-  setShimmer(element, tone !== null);
-}
-
-/** What a header reads. */
-export interface CollapsibleHeader {
-  /** The verb or title, in the row's tone. */
-  readonly action: string;
-  /** The text after it, or null for none. */
-  readonly details: string | null;
-  /** The call name leading `details`, rendered in the verb's color; null when `details` is plain. */
-  readonly callName?: string | null;
-  /** The tone the action shimmers in, or null for a still action. */
-  readonly shimmer?: ShimmerTone | null;
-}
-
-export interface CollapsibleOptions {
-  /** Called with the effective open state each time it changes. */
-  readonly onToggle?: (open: boolean) => void;
-}
-
-/** One collapsible: header, chevron, and an animated body. */
-export class Collapsible {
-  /** The root; append it where the row belongs. */
-  readonly element: HTMLDivElement;
-  /** The header line. */
-  readonly header: HTMLDivElement;
-  /** The body the owner fills. */
-  readonly body: HTMLDivElement;
-
-  private readonly action: HTMLSpanElement;
-  private readonly details: HTMLSpanElement;
-  private readonly clip: HTMLDivElement;
-  private readonly onToggle: ((open: boolean) => void) | undefined;
-  private detailsKey: string | null = null;
-  private expandable = true;
-  private defaultOpen = false;
-  private choice: boolean | null = null;
-  private shown = false;
-  private state = "";
-
-  constructor(options: CollapsibleOptions = {}) {
-    this.onToggle = options.onToggle;
-
-    this.element = document.createElement("div");
-    this.element.className = "ws-collapsible";
-
-    this.header = document.createElement("div");
-    this.header.className = "ws-collapsible__header";
-    this.action = document.createElement("span");
-    this.action.className = "ws-collapsible__action";
-    this.details = document.createElement("span");
-    this.details.className = "ws-collapsible__details";
-    const chevron = document.createElement("span");
-    chevron.className = "ws-collapsible__chevron";
-    chevron.setAttribute("aria-hidden", "true");
-    // A static string from @workshop/look, never data.
-    chevron.innerHTML = ICON_CHEVRON_RIGHT;
-    this.header.append(this.action, this.details, chevron);
-
-    this.clip = document.createElement("div");
-    this.clip.className = "ws-collapsible__clip";
-    this.body = document.createElement("div");
-    this.body.className = "ws-collapsible__body";
-    this.clip.appendChild(this.body);
-    this.element.append(this.header, this.clip);
-
-    this.header.addEventListener("click", () => this.toggle());
-    this.header.addEventListener("keydown", (event) => {
-      if (event.key === "Enter" || event.key === " ") {
-        event.preventDefault();
-        this.toggle();
-      }
-    });
-    this.refresh();
-  }
-
-  /** The effective open state: the operator's choice when made, else the default. */
-  get open(): boolean {
-    return this.expandable && (this.choice ?? this.defaultOpen);
-  }
-
-  /** The operator's own choice (true open, false closed), or null while they've made none. */
-  get operatorChoice(): boolean | null {
-    return this.choice;
-  }
-
-  /**
-   * Takes over the operator's choice from the component this one replaces,
-   * so a row that turns into another kind under the same key (a thought
-   * that becomes a group) keeps what the operator opened or closed.
-   */
-  adoptChoice(choice: boolean | null): void {
-    this.choice = choice;
-    this.refresh();
-  }
-
-  /**
-   * Sets what the open state is until the operator chooses: a streaming
-   * thinking line opens by default and closes by default once settled. A
-   * choice the operator already made is left alone.
-   */
-  setDefaultOpen(open: boolean): void {
-    this.defaultOpen = open;
-    this.refresh();
-  }
-
-  /**
-   * Whether the line has anything to open. A line without a body shows no
-   * chevron, takes no clicks, and is not a button.
-   */
-  setExpandable(expandable: boolean): void {
-    this.expandable = expandable;
-    this.refresh();
-  }
-
-  /** Paints the header, touching the DOM only where the text changed. */
-  setHeader(header: CollapsibleHeader): void {
-    if (this.action.textContent !== header.action) {
-      this.action.textContent = header.action;
-    }
-    const callName = header.callName ?? null;
-    const details = header.details ?? "";
-    const key = `${callName ?? ""}\u0000${details}`;
-    if (key !== this.detailsKey) {
-      this.detailsKey = key;
-      this.details.replaceChildren();
-      if (callName !== null && callName !== "" && details.startsWith(callName)) {
-        const call = document.createElement("span");
-        call.className = "ws-collapsible__call";
-        call.textContent = callName;
-        this.details.append(call, details.slice(callName.length));
-      } else {
-        this.details.textContent = details;
-      }
-      this.details.hidden = details === "";
-    }
-    applyShimmer(this.action, header.shimmer ?? null);
-  }
-
-  private toggle(): void {
-    if (!this.expandable) {
-      return;
-    }
-    this.choice = !this.open;
-    this.refresh();
-  }
-
-  private refresh(): void {
-    const open = this.open;
-    // An update that changes neither flag writes nothing to the DOM.
-    const state = `${open}|${this.expandable}`;
-    if (state === this.state) {
-      return;
-    }
-    this.state = state;
-    this.element.dataset["open"] = String(open);
-    this.element.dataset["expandable"] = String(this.expandable);
-    this.clip.toggleAttribute("inert", !open);
-    this.clip.setAttribute("aria-hidden", String(!open));
-    if (this.expandable) {
-      this.header.setAttribute("role", "button");
-      this.header.tabIndex = 0;
-      this.header.setAttribute("aria-expanded", String(open));
-    } else {
-      this.header.removeAttribute("role");
-      this.header.removeAttribute("tabindex");
-      this.header.removeAttribute("aria-expanded");
-    }
-    if (open !== this.shown) {
-      this.shown = open;
-      this.onToggle?.(open);
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/feed-scroll.ts b/crates/workshop/ui/src/parts/agent/transcript/feed-scroll.ts
deleted file mode 100644
index 5f8a778bf..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/feed-scroll.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-// The transcript feed's scroll behavior: it follows the bottom while the
-// operator is at the bottom, lets go the moment the operator scrolls up,
-// and picks up again on reaching the bottom.
-//
-// - Pinned: within 4px of the bottom. A feed starts pinned.
-// - Release: scrolling up within 250ms of a wheel, touch, pointer, or key
-//   input unpins. Scroll events with no recent input (our own follow, a
-//   layout shift) never do.
-// - Re-pin: reaching the bottom pins again.
-// - Follow: while pinned, growth is detected by a ResizeObserver on the
-//   content. If the new bottom is no more than one viewport away the feed
-//   eases toward it at most 3.6px/ms and snaps there after 250ms; a bigger
-//   jump, or reduced motion, goes straight there.
-// - A send forces an instant pin.
-//
-// The trailing spacer under the last row is sized here too: 14px plus a
-// fifth of the feed's height clamped to 80-240px, so the last message can
-// scroll up out from under the composer.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { prefersReducedMotion } from "./motion";
-
-/** Within this many px of the bottom counts as at the bottom. */
-export const PIN_THRESHOLD_PX = 4;
-
-/** A scroll up this soon after an input event is the operator's. */
-export const INPUT_WINDOW_MS = 250;
-
-/** The follow's top speed. */
-export const FOLLOW_SPEED_PX_PER_MS = 3.6;
-
-/** The follow snaps to the bottom once it has run this long. */
-export const FOLLOW_SNAP_MS = 250;
-
-const SPACER_BASE_PX = 14;
-const SPACER_MIN_PX = 80;
-const SPACER_MAX_PX = 240;
-const SPACER_SHARE = 0.2;
-
-/** The trailing spacer's height for a feed `viewportHeight` tall. */
-export function spacerHeight(viewportHeight: number): number {
-  const share = Math.round(viewportHeight * SPACER_SHARE);
-  return SPACER_BASE_PX + Math.min(SPACER_MAX_PX, Math.max(SPACER_MIN_PX, share));
-}
-
-/** The inputs that open the release window. */
-const INPUT_EVENTS = ["wheel", "touchstart", "touchmove", "pointerdown", "keydown"] as const;
-
-export interface FeedScrollOptions {
-  /** The element under the content that takes the trailing spacer's height. */
-  readonly spacer?: HTMLElement;
-  /** A millisecond clock for the input window; defaults to `performance.now()`. */
-  readonly now?: () => number;
-  /** Called after the scroll position (`scroll`) or the feed's or content's size (`resize`) changed. */
-  readonly onLayout?: (reason: "scroll" | "resize") => void;
-}
-
-/** The scroll controller for one feed. */
-export class FeedScroll implements IDisposable {
-  private isPinned = true;
-  private lastInputAt = Number.NEGATIVE_INFINITY;
-  private lastScrollTop = 0;
-  private lastScrollHeight = 0;
-  private lastClientHeight = -1;
-  private frame: number | undefined;
-  private followStartedAt: number | null = null;
-  private followLastAt: number | null = null;
-  private jumpNext = false;
-  private readonly now: () => number;
-  private readonly observer: ResizeObserver | undefined;
-
-  private readonly onInput = (): void => {
-    this.lastInputAt = this.now();
-  };
-  private readonly onScroll = (): void => {
-    const top = this.scroller.scrollTop;
-    if (this.distanceFromBottom() <= PIN_THRESHOLD_PX) {
-      this.isPinned = true;
-    } else if (top < this.lastScrollTop && this.now() - this.lastInputAt <= INPUT_WINDOW_MS) {
-      this.isPinned = false;
-      this.stopFollow();
-    }
-    this.lastScrollTop = top;
-    this.options.onLayout?.("scroll");
-  };
-
-  constructor(
-    private readonly scroller: HTMLElement,
-    private readonly content: HTMLElement,
-    private readonly options: FeedScrollOptions = {},
-  ) {
-    this.now = options.now ?? (() => performance.now());
-    for (const type of INPUT_EVENTS) {
-      scroller.addEventListener(type, this.onInput, { passive: true });
-    }
-    scroller.addEventListener("scroll", this.onScroll, { passive: true });
-    this.lastScrollHeight = scroller.scrollHeight;
-    this.lastScrollTop = scroller.scrollTop;
-    if (typeof ResizeObserver !== "undefined") {
-      this.observer = new ResizeObserver(() => this.onResize());
-      this.observer.observe(content);
-      this.observer.observe(scroller);
-    }
-    this.syncSpacer();
-  }
-
-  /** Whether the feed is following the bottom. */
-  get pinned(): boolean {
-    return this.isPinned;
-  }
-
-  /** Pins and jumps to the bottom at once: what a send does. */
-  forcePin(): void {
-    this.isPinned = true;
-    this.jumpNext = true;
-    this.stopFollow();
-    this.jumpToBottom();
-  }
-
-  dispose(): void {
-    for (const type of INPUT_EVENTS) {
-      this.scroller.removeEventListener(type, this.onInput);
-    }
-    this.scroller.removeEventListener("scroll", this.onScroll);
-    this.observer?.disconnect();
-    this.stopFollow();
-  }
-
-  private distanceFromBottom(): number {
-    const { scrollHeight, clientHeight, scrollTop } = this.scroller;
-    return scrollHeight - clientHeight - scrollTop;
-  }
-
-  private maxScrollTop(): number {
-    return Math.max(0, this.scroller.scrollHeight - this.scroller.clientHeight);
-  }
-
-  private jumpToBottom(): void {
-    this.scroller.scrollTop = this.maxScrollTop();
-    this.lastScrollTop = this.scroller.scrollTop;
-  }
-
-  private syncSpacer(): void {
-    const spacer = this.options.spacer;
-    const height = this.scroller.clientHeight;
-    if (spacer !== undefined && height !== this.lastClientHeight) {
-      this.lastClientHeight = height;
-      spacer.style.height = `${spacerHeight(height)}px`;
-    }
-  }
-
-  /** The content or the feed changed size. */
-  private onResize(): void {
-    this.syncSpacer();
-    const height = this.scroller.scrollHeight;
-    const grew = height > this.lastScrollHeight;
-    this.lastScrollHeight = height;
-    if (this.isPinned) {
-      this.follow(grew);
-    }
-    this.options.onLayout?.("resize");
-  }
-
-  private follow(grew: boolean): void {
-    const gap = this.maxScrollTop() - this.scroller.scrollTop;
-    if (gap <= 0) {
-      return;
-    }
-    if (this.jumpNext || !grew || prefersReducedMotion() || gap > this.scroller.clientHeight) {
-      this.jumpNext = false;
-      this.stopFollow();
-      this.jumpToBottom();
-      return;
-    }
-    if (this.frame === undefined) {
-      this.followStartedAt = null;
-      this.followLastAt = null;
-      this.frame = requestAnimationFrame((time) => this.step(time));
-    }
-  }
-
-  private step(time: number): void {
-    this.frame = undefined;
-    const startedAt = this.followStartedAt ?? time;
-    const lastAt = this.followLastAt ?? time;
-    this.followStartedAt = startedAt;
-    this.followLastAt = time;
-
-    const target = this.maxScrollTop();
-    const remaining = target - this.scroller.scrollTop;
-    if (remaining <= 0) {
-      this.stopFollow();
-      return;
-    }
-    if (time - startedAt >= FOLLOW_SNAP_MS) {
-      this.stopFollow();
-      this.jumpToBottom();
-      return;
-    }
-    // The first frame has no elapsed time yet; take one 60Hz frame's worth.
-    const elapsed = time === lastAt ? 16 : time - lastAt;
-    const distance = Math.min(remaining, FOLLOW_SPEED_PX_PER_MS * elapsed);
-    this.scroller.scrollTop += distance;
-    this.lastScrollTop = this.scroller.scrollTop;
-    if (remaining - distance > 0) {
-      this.frame = requestAnimationFrame((next) => this.step(next));
-    } else {
-      this.stopFollow();
-    }
-  }
-
-  private stopFollow(): void {
-    if (this.frame !== undefined) {
-      cancelAnimationFrame(this.frame);
-      this.frame = undefined;
-    }
-    this.followStartedAt = null;
-    this.followLastAt = null;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/human-message.css b/crates/workshop/ui/src/parts/agent/transcript/human-message.css
deleted file mode 100644
index f48c8798c..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/human-message.css
+++ /dev/null
@@ -1,79 +0,0 @@
-/* The operator's message row (human-message.ts): a bordered card of plain
-   text, clipped to three and a half lines with a fade, and sticky at the
-   top of the feed inside its turn. */
-
-.ws-human-message {
-  --ws-human-fill: color-mix(in srgb, var(--bg-input) 90%, var(--bg-raised));
-  position: sticky;
-  inset-block-start: 0;
-  z-index: 101;
-  box-sizing: border-box;
-  min-inline-size: var(--ws-human-min-width);
-  margin-block-end: var(--space-1);
-  padding: var(--space-2) var(--space-2-5);
-  /* A solid panel color under the translucent fill, so rows scrolling
-     beneath the stuck card never show through it. */
-  background: linear-gradient(var(--ws-human-fill), var(--ws-human-fill)), var(--cursor-editor);
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-xl);
-  transition:
-    border-color var(--duration-fast),
-    background var(--duration-fast);
-}
-
-.ws-human-message:hover {
-  --ws-human-fill: var(--bg-input);
-  border-color: var(--cursor-stroke-primary);
-}
-
-/* A message taller than the feed doesn't stick. */
-.ws-human-message[data-tall="true"] {
-  position: static;
-}
-
-/* The fade under a stuck card, so the rows passing beneath it dissolve. */
-.ws-human-message::after {
-  content: "";
-  position: absolute;
-  inset-inline: 0;
-  inset-block-start: 100%;
-  block-size: var(--ws-human-stuck-fade-height);
-  background: linear-gradient(var(--cursor-editor), transparent);
-  pointer-events: none;
-  opacity: 0;
-}
-
-.ws-human-message[data-stuck="true"]::after {
-  opacity: 1;
-}
-
-.ws-human-message__text {
-  font-size: var(--font-size-lg);
-  line-height: var(--line-height-lg);
-  color: var(--cursor-text-primary);
-  white-space: pre-wrap;
-  overflow-wrap: break-word;
-  /* The bleed gives glyphs that overhang the line box room inside the clip's mask. */
-  padding-block: var(--ws-human-bleed-top) var(--ws-human-bleed-bottom);
-  margin-block: calc(-1 * var(--ws-human-bleed-top)) calc(-1 * var(--ws-human-bleed-bottom));
-}
-
-.ws-human-message__text:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-/* Only a message that overflows reads as clickable. */
-.ws-human-message[data-overflowing="true"] .ws-human-message__text {
-  cursor: pointer;
-}
-
-.ws-human-message__text[data-clipped="true"] {
-  max-block-size: var(--ws-human-clip-height);
-  overflow: hidden;
-  mask-image: linear-gradient(
-    to bottom,
-    var(--cursor-text-primary) calc(100% - var(--ws-human-fade-height)),
-    transparent
-  );
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/human-message.ts b/crates/workshop/ui/src/parts/agent/transcript/human-message.ts
deleted file mode 100644
index d281967ef..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/human-message.ts
+++ /dev/null
@@ -1,127 +0,0 @@
-// The operator's message row: no label, full column width, a bordered
-// card of plain text. A long message is clipped to three and a half lines
-// with a fade over the last of them; clicking toggles it between clipped
-// and expanded, and only a message that overflows reads as clickable.
-// While its turn is on screen the card sticks to the top of the feed so
-// the question stays in view over the answer (CSS `position: sticky`
-// inside the turn wrapper); a message taller than the feed doesn't stick,
-// and a fade below the stuck card shows only while it is stuck.
-//
-// The text is user-authored and lands through textContent, whitespace
-// preserved by CSS. Expanded state lives here and survives `update`.
-
-import "./human-message.css";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import type { HumanRow } from "./transcript-model";
-
-/** The height the clipped text shows: three and a half 22px lines. Keep in step with human-message.css. */
-export const HUMAN_CLIP_PX = 77;
-
-/** The padding the clip box adds around its text (2px above, 8px below), which scrollHeight counts. */
-const HUMAN_BLEED_PX = 10;
-
-/** One human message row. */
-export class HumanMessage implements IDisposable {
-  readonly kind = "human";
-  readonly element: HTMLDivElement;
-
-  private readonly text: HTMLDivElement;
-  private source = "";
-  private expanded = false;
-  private overflowing = false;
-  private dirty = true;
-
-  constructor() {
-    this.element = document.createElement("div");
-    this.element.className = "ws-human-message";
-    this.text = document.createElement("div");
-    this.text.className = "ws-human-message__text";
-    this.element.appendChild(this.text);
-
-    this.text.addEventListener("click", () => {
-      // A drag-selection ends in a click; leave the card as it is then.
-      if (this.overflowing && (window.getSelection()?.toString() ?? "") === "") {
-        this.toggle();
-      }
-    });
-    this.text.addEventListener("keydown", (event) => {
-      if (this.overflowing && (event.key === "Enter" || event.key === " ")) {
-        event.preventDefault();
-        this.toggle();
-      }
-    });
-    this.render();
-  }
-
-  /** Sets the message text; the expanded state is left alone. */
-  update(row: HumanRow): void {
-    if (row.text !== this.source) {
-      this.source = row.text;
-      this.text.textContent = row.text;
-      this.dirty = true;
-    }
-  }
-
-  /** The message text, for the transcript's Copy Message. */
-  copyText(): string {
-    return this.source;
-  }
-
-  /**
-   * Re-reads whether the text overflows the clip. The view calls it once
-   * the element is in the document and on every resize of the feed
-   * (`force`), because a width change rewraps the text; an unchanged
-   * message otherwise skips the layout read.
-   */
-  measure(force = false): void {
-    if (!this.dirty && !force) {
-      return;
-    }
-    this.dirty = false;
-    const overflowing = this.text.scrollHeight - HUMAN_BLEED_PX > HUMAN_CLIP_PX;
-    if (overflowing !== this.overflowing) {
-      this.overflowing = overflowing;
-      this.render();
-    }
-  }
-
-  /**
-   * Updates the sticky state against the feed: a message taller than the
-   * feed doesn't stick, and one pinned at the feed's top edge is stuck
-   * (which shows the fade below it).
-   */
-  layout(scroller: HTMLElement): void {
-    const rect = this.element.getBoundingClientRect();
-    const viewport = scroller.clientHeight;
-    const tall = viewport > 0 && rect.height > viewport;
-    const stuck =
-      !tall && scroller.scrollTop > 0 && rect.top <= scroller.getBoundingClientRect().top + 1;
-    this.element.dataset["tall"] = String(tall);
-    this.element.dataset["stuck"] = String(stuck);
-  }
-
-  dispose(): void {
-    // Element-owned listeners die with the element.
-  }
-
-  private toggle(): void {
-    this.expanded = !this.expanded;
-    this.render();
-  }
-
-  private render(): void {
-    this.element.dataset["overflowing"] = String(this.overflowing);
-    this.element.dataset["expanded"] = String(this.expanded);
-    this.text.dataset["clipped"] = String(this.overflowing && !this.expanded);
-    if (this.overflowing) {
-      this.text.setAttribute("role", "button");
-      this.text.tabIndex = 0;
-      this.text.setAttribute("aria-expanded", String(this.expanded));
-    } else {
-      this.text.removeAttribute("role");
-      this.text.removeAttribute("tabindex");
-      this.text.removeAttribute("aria-expanded");
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/motion.ts b/crates/workshop/ui/src/parts/agent/transcript/motion.ts
deleted file mode 100644
index 33a72cd80..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/motion.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// The motion preference shared by the transcript's row components. It
-// reads the browser global at call time, so a test (or a window without
-// the API) degrades instead of throwing at import.
-
-/** True when the operator asked the system to reduce motion. */
-export function prefersReducedMotion(): boolean {
-  return (
-    typeof window !== "undefined" &&
-    typeof window.matchMedia === "function" &&
-    window.matchMedia("(prefers-reduced-motion: reduce)").matches
-  );
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/reconcile.ts b/crates/workshop/ui/src/parts/agent/transcript/reconcile.ts
deleted file mode 100644
index 18d5ea4f2..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/reconcile.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-// The keyed reconcile the transcript uses at every level (turns, a turn's
-// rows, a group's steps). Given the next list of keyed entries it reuses
-// the component for a key, creates the ones that are new, removes the ones
-// that are gone, and puts the elements in order. A component is reused
-// only while its `kind` still matches - a lone thought that becomes a
-// group keeps its key but is a different component - so a kind change
-// replaces the component. The replaced component stays alive until the
-// new one is built and has been offered to `carry`, so a caller can hand
-// over what the operator chose (an open row) before the old one is
-// disposed.
-//
-// Elements that live after the managed ones (a turn's footer, the tail
-// status) are not touched: new components land before the first
-// unmanaged child, so those extras stay where the caller put them.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-
-/** A component the reconcile manages. */
-export interface KeyedComponent extends IDisposable {
-  readonly kind: string;
-  readonly element: HTMLElement;
-}
-
-/** The slice of an entry the reconcile reads. */
-export interface Keyed {
-  readonly key: string;
-  readonly kind: string;
-}
-
-/**
- * Reconciles `parent`'s managed children against `next`. `components` is
- * the caller's key-to-component map for this parent, updated in place.
- * `carry`, when given, runs for a component that replaced one of another
- * kind under the same key - after the new one's first `update`, before
- * the old one is disposed.
- * Returns the components in order.
- */
-export function reconcile<T extends Keyed, C extends KeyedComponent>(
-  parent: HTMLElement,
-  components: Map<string, C>,
-  next: readonly T[],
-  create: (entry: T) => C,
-  update: (component: C, entry: T) => void,
-  carry?: (component: C, replaced: C, entry: T) => void,
-): C[] {
-  const nextByKey = new Map(next.map((entry) => [entry.key, entry]));
-  const replaced = new Map<string, C>();
-  for (const [key, component] of [...components]) {
-    const entry = nextByKey.get(key);
-    if (entry?.kind === component.kind) {
-      continue;
-    }
-    component.element.remove();
-    components.delete(key);
-    if (entry === undefined) {
-      component.dispose();
-    } else {
-      replaced.set(key, component);
-    }
-  }
-
-  const ordered: C[] = [];
-  let previous: HTMLElement | null = null;
-  for (const entry of next) {
-    let component = components.get(entry.key);
-    let carried: C | undefined;
-    if (component === undefined) {
-      component = create(entry);
-      components.set(entry.key, component);
-      carried = replaced.get(entry.key);
-    }
-    update(component, entry);
-    if (carried !== undefined) {
-      carry?.(component, carried, entry);
-    }
-    const element = component.element;
-    const expected: ChildNode | null = previous === null ? parent.firstChild : previous.nextSibling;
-    if (element !== expected) {
-      parent.insertBefore(element, expected);
-    }
-    previous = element;
-    ordered.push(component);
-  }
-  for (const component of replaced.values()) {
-    component.dispose();
-  }
-  return ordered;
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/rows.ts b/crates/workshop/ui/src/parts/agent/transcript/rows.ts
deleted file mode 100644
index 58e5edf30..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/rows.ts
+++ /dev/null
@@ -1,436 +0,0 @@
-// The transcript's row components: one class per row kind of the model
-// (transcript-model.ts), each keeping its own DOM and its own open or
-// expanded state between `update(row)` calls. The view reconciles rows by
-// key, reusing the component for a key and calling `update` with the
-// freshly built row, so a streaming delta changes the text in place and
-// never rebuilds a row the operator is reading or has opened.
-//
-// - MarkdownRowView: an assistant reply, no label and no bubble.
-// - ThoughtRowView: thinking and nothing else, a collapsible.
-// - GroupRowView: thinking and tool steps that ran together, a
-//   collapsible whose steps sit in a muted scope; the tail status can
-//   render inside it.
-// - ToolRowView: one standalone tool line.
-// - HumanMessage (human-message.ts) is the operator's row.
-//
-// Reply and thinking text is model-authored markdown and goes through
-// renderMarkdown (DOMPurify is its last step); everything else lands as
-// text.
-
-import { renderMarkdown, MarkdownStream } from "../markdown-render";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { Collapsible, type ShimmerTone } from "./collapsible";
-import { HumanMessage } from "./human-message";
-import { reconcile, type KeyedComponent } from "./reconcile";
-import { ToolLine } from "./tool-line";
-import type {
-  GroupRow,
-  GroupStep,
-  MarkdownRow,
-  ThoughtLabel,
-  ThoughtRow,
-  ThoughtStep,
-  ToolRow,
-  ToolStep,
-  TranscriptRow,
-} from "./transcript-model";
-
-// --- Assistant reply ------------------------------------------------------------------
-
-/** An assistant reply: markdown, fading new text in while it streams. */
-export class MarkdownRowView implements IDisposable {
-  readonly kind = "markdown";
-  readonly element: HTMLDivElement;
-
-  private readonly stream = new MarkdownStream();
-  private source: string | null = null;
-  private streaming = false;
-
-  /** `animateIn` fades a new row in and lifts it 8px; the first paint of a feed skips it. */
-  constructor(animateIn: boolean) {
-    this.element = document.createElement("div");
-    this.element.className = "ws-markdown-row";
-    if (animateIn) {
-      this.element.classList.add("ws-markdown-row--enter");
-    }
-  }
-
-  update(row: MarkdownRow): void {
-    if (row.text === this.source && row.streaming === this.streaming) {
-      return;
-    }
-    this.source = row.text;
-    this.streaming = row.streaming;
-    this.element.dataset["streaming"] = String(row.streaming);
-    this.element.replaceChildren(this.stream.render(row.text, { streaming: row.streaming }));
-  }
-
-  copyText(): string {
-    return this.source ?? "";
-  }
-
-  dispose(): void {
-    // Nothing is held beyond the element.
-  }
-}
-
-// --- Thinking -------------------------------------------------------------------------
-
-/** What a thinking line reads. */
-interface ThinkingInput {
-  readonly label: ThoughtLabel;
-  readonly text: string;
-  readonly streaming: boolean;
-}
-
-/**
- * Thinking as a collapsible: the label in the header (shimmering while it
- * streams) over the thinking markdown at half opacity. `openWhileStreaming`
- * is the group's rule - its thinking lines open while they stream and close
- * once settled - where a thought row stays closed unless the operator opens
- * it. Either way the operator's own click wins and survives every update.
- * The body renders only while open: a closed line keeps its latest text and
- * paints it when opened.
- */
-class ThinkingLine implements IDisposable {
-  readonly element: HTMLElement;
-
-  private readonly collapsible: Collapsible;
-  private readonly content: HTMLDivElement;
-  private text = "";
-  private painted: string | null = null;
-
-  constructor(private readonly openWhileStreaming: boolean, className: string) {
-    this.collapsible = new Collapsible({
-      onToggle: (open) => {
-        if (open) {
-          this.paint();
-        }
-      },
-    });
-    this.element = this.collapsible.element;
-    this.element.classList.add(className);
-    this.content = document.createElement("div");
-    this.content.className = "ws-thinking-body";
-    this.collapsible.body.appendChild(this.content);
-  }
-
-  update(input: ThinkingInput): void {
-    this.text = input.text;
-    const tone: ShimmerTone | null = input.streaming ? "thinking" : null;
-    this.collapsible.setHeader({
-      action: input.label.action,
-      details: input.label.details,
-      shimmer: tone,
-    });
-    this.collapsible.setExpandable(input.text.trim() !== "");
-    this.collapsible.setDefaultOpen(this.openWhileStreaming && input.streaming);
-    if (this.collapsible.open) {
-      this.paint();
-    }
-  }
-
-  copyText(): string {
-    return this.text;
-  }
-
-  get operatorChoice(): boolean | null {
-    return this.collapsible.operatorChoice;
-  }
-
-  adoptChoice(choice: boolean | null): void {
-    this.collapsible.adoptChoice(choice);
-  }
-
-  dispose(): void {
-    // Nothing is held beyond the element.
-  }
-
-  private paint(): void {
-    if (this.painted === this.text) {
-      return;
-    }
-    this.painted = this.text;
-    this.content.replaceChildren(renderMarkdown(this.text));
-  }
-}
-
-/** Thinking and nothing else: a closed-by-default collapsible. */
-export class ThoughtRowView implements IDisposable {
-  readonly kind = "thought";
-  readonly element: HTMLElement;
-
-  private readonly line = new ThinkingLine(false, "ws-thought-row");
-
-  constructor() {
-    this.element = this.line.element;
-  }
-
-  update(row: ThoughtRow): void {
-    this.line.update({ label: row.label, text: row.text, streaming: row.streaming });
-  }
-
-  copyText(): string {
-    return this.line.copyText();
-  }
-
-  /** The operator's own open or closed choice, or null while they've made none. */
-  get operatorChoice(): boolean | null {
-    return this.line.operatorChoice;
-  }
-
-  dispose(): void {
-    this.line.dispose();
-  }
-}
-
-// --- Tools ----------------------------------------------------------------------------
-
-/** One standalone tool line. */
-export class ToolRowView implements IDisposable {
-  readonly kind = "tool";
-  readonly element: HTMLElement;
-
-  private readonly line = new ToolLine();
-
-  constructor() {
-    this.element = this.line.element;
-  }
-
-  update(row: ToolRow): void {
-    this.line.update(row.step);
-  }
-
-  copyText(): string {
-    return this.line.copyText();
-  }
-
-  /** The operator's own open or closed choice, or null while they've made none. */
-  get operatorChoice(): boolean | null {
-    return this.line.operatorChoice;
-  }
-
-  dispose(): void {
-    this.line.dispose();
-  }
-}
-
-// --- Group ----------------------------------------------------------------------------
-
-/** A group's thinking step: an inner thinking line that opens while it streams. */
-class ThinkingStepView implements KeyedComponent {
-  readonly kind = "thought";
-  readonly element: HTMLElement;
-
-  private readonly line = new ThinkingLine(true, "ws-thinking-line");
-
-  constructor() {
-    this.element = this.line.element;
-  }
-
-  update(step: ThoughtStep): void {
-    this.line.update({ label: step.label, text: step.text, streaming: step.streaming });
-  }
-
-  adoptChoice(choice: boolean | null): void {
-    this.line.adoptChoice(choice);
-  }
-
-  dispose(): void {
-    this.line.dispose();
-  }
-}
-
-/** A group's tool step. */
-class ToolStepView implements KeyedComponent {
-  readonly kind = "tool";
-  readonly element: HTMLElement;
-
-  private readonly line = new ToolLine();
-
-  constructor() {
-    this.element = this.line.element;
-  }
-
-  update(step: ToolStep): void {
-    this.line.update(step);
-  }
-
-  adoptChoice(choice: boolean | null): void {
-    this.line.adoptChoice(choice);
-  }
-
-  dispose(): void {
-    this.line.dispose();
-  }
-}
-
-/** A step component inside a group. */
-type StepComponent = ThinkingStepView | ToolStepView;
-
-/** The group's steps as reconcile entries. */
-interface StepEntry {
-  readonly key: string;
-  readonly kind: "thought" | "tool";
-  readonly step: GroupStep;
-}
-
-/** Thinking and tool steps that ran together. */
-export class GroupRowView implements IDisposable {
-  readonly kind = "group";
-  readonly element: HTMLDivElement;
-
-  private readonly collapsible = new Collapsible();
-  private readonly steps = new Map<string, StepComponent>();
-  private readonly list: HTMLDivElement;
-  private text = "";
-
-  constructor() {
-    this.element = document.createElement("div");
-    this.element.className = "ws-group-row";
-    this.element.appendChild(this.collapsible.element);
-    this.list = document.createElement("div");
-    this.list.className = "ws-group-row__steps ws-muted-scope";
-    this.collapsible.body.appendChild(this.list);
-  }
-
-  update(row: GroupRow): void {
-    this.collapsible.setHeader({ action: row.summary.action, details: row.summary.details });
-    const entries: StepEntry[] = row.steps.map((step) => ({
-      key: step.key,
-      kind: step.step,
-      step,
-    }));
-    reconcile(
-      this.list,
-      this.steps,
-      entries,
-      (entry) => (entry.kind === "tool" ? new ToolStepView() : new ThinkingStepView()),
-      (component, entry) => {
-        if (component.kind === "tool" && entry.step.step === "tool") {
-          component.update(entry.step);
-        } else if (component.kind === "thought" && entry.step.step === "thought") {
-          component.update(entry.step);
-        }
-      },
-    );
-    this.text = row.steps
-      .map((step) => (step.step === "tool" ? `${step.label.action} ${step.label.details}`.trim() : step.text))
-      .join("\n\n");
-  }
-
-  copyText(): string {
-    return this.text;
-  }
-
-  /**
-   * Takes over the operator's choice from the thought row or tool row this
-   * group replaced. That row's step is the group's first, under the same
-   * key, so its open or closed choice moves to the matching step. A row the
-   * operator had open also opens the group, so what they were reading stays
-   * on screen instead of folding away inside a closed group.
-   */
-  carryChoice(kind: "thought" | "tool", key: string, choice: boolean | null): void {
-    if (choice === null) {
-      return;
-    }
-    const step = this.steps.get(key);
-    if (step === undefined || step.kind !== kind) {
-      return;
-    }
-    step.adoptChoice(choice);
-    if (choice) {
-      this.collapsible.adoptChoice(true);
-    }
-  }
-
-  dispose(): void {
-    for (const step of this.steps.values()) {
-      step.dispose();
-    }
-    this.steps.clear();
-  }
-}
-
-// --- Row components -----------------------------------------------------------------
-
-/** Any row component the view reconciles. */
-export type RowComponent =
-  | HumanMessage
-  | MarkdownRowView
-  | ThoughtRowView
-  | GroupRowView
-  | ToolRowView;
-
-/** Builds the component for a row's kind. */
-export function createRowComponent(row: TranscriptRow, animateIn: boolean): RowComponent {
-  let component: RowComponent;
-  switch (row.kind) {
-    case "human":
-      component = new HumanMessage();
-      break;
-    case "markdown":
-      component = new MarkdownRowView(animateIn);
-      break;
-    case "thought":
-      component = new ThoughtRowView();
-      break;
-    case "group":
-      component = new GroupRowView();
-      break;
-    case "tool":
-      component = new ToolRowView();
-      break;
-  }
-  component.element.classList.add("ws-transcript-row");
-  component.element.dataset["rowKey"] = row.key;
-  return component;
-}
-
-/**
- * Hands what the operator chose from a row component the reconcile just
- * replaced to the one that took its key. Only a thought row or a lone tool
- * row grows into a group under the same key (a group takes its first
- * step's key); the group's matching step inherits the choice.
- */
-export function carryRowState(component: RowComponent, replaced: RowComponent, key: string): void {
-  if (!(component instanceof GroupRowView)) {
-    return;
-  }
-  if (replaced instanceof ThoughtRowView) {
-    component.carryChoice("thought", key, replaced.operatorChoice);
-  } else if (replaced instanceof ToolRowView) {
-    component.carryChoice("tool", key, replaced.operatorChoice);
-  }
-}
-
-/** Updates a component with its row; a kind mismatch is a no-op (the reconcile replaces those). */
-export function updateRowComponent(component: RowComponent, row: TranscriptRow): void {
-  switch (component.kind) {
-    case "human":
-      if (row.kind === "human") {
-        component.update(row);
-      }
-      return;
-    case "markdown":
-      if (row.kind === "markdown") {
-        component.update(row);
-      }
-      return;
-    case "thought":
-      if (row.kind === "thought") {
-        component.update(row);
-      }
-      return;
-    case "group":
-      if (row.kind === "group") {
-        component.update(row);
-      }
-      return;
-    case "tool":
-      if (row.kind === "tool") {
-        component.update(row);
-      }
-      return;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/tail-status.ts b/crates/workshop/ui/src/parts/agent/transcript/tail-status.ts
deleted file mode 100644
index 1c4f1499e..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/tail-status.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-// The tail status: the shimmering line under the last row while the agent
-// works - "Planning next moves", "Thinking", a running tool's verb, or
-// "Reconnecting...". The model decides which (transcript-model.ts); this
-// paints it. The status has no Cancel action: stopping a turn belongs to
-// the composer's action button.
-//
-// The status renders at the end of the last turn, or inside the open
-// group that is the active tail (the view moves the element). The verb
-// shimmers in the tone for its kind; details are untrusted model-era text
-// and land through textContent.
-
-import "./transcript.css";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { applyShimmer } from "./collapsible";
-import type { TailStatus } from "./transcript-model";
-
-/** The tail status line. */
-export class TailView implements IDisposable {
-  readonly element: HTMLDivElement;
-
-  private readonly action: HTMLSpanElement;
-  private readonly details: HTMLSpanElement;
-  private detailsKey: string | null = null;
-
-  constructor() {
-    this.element = document.createElement("div");
-    this.element.className = "ws-tail";
-    this.action = document.createElement("span");
-    this.action.className = "ws-tail__action";
-    this.details = document.createElement("span");
-    this.details.className = "ws-tail__details";
-    this.element.append(this.action, this.details);
-  }
-
-  /** Paints the status, touching the DOM only where the text changed. */
-  update(tail: TailStatus): void {
-    this.element.dataset["kind"] = tail.kind;
-    if (this.action.textContent !== tail.action) {
-      this.action.textContent = tail.action;
-    }
-    const key = `${tail.callName ?? ""}\u0000${tail.details}`;
-    if (key !== this.detailsKey) {
-      this.detailsKey = key;
-      this.details.replaceChildren();
-      if (tail.callName !== null && tail.callName !== "" && tail.details.startsWith(tail.callName)) {
-        const call = document.createElement("span");
-        call.className = "ws-tail__call";
-        call.textContent = tail.callName;
-        this.details.append(call, tail.details.slice(tail.callName.length));
-      } else {
-        this.details.textContent = tail.details;
-      }
-      this.details.hidden = tail.details === "";
-    }
-    applyShimmer(this.action, tail.kind === "tool" ? "tool" : "status");
-  }
-
-  dispose(): void {
-    applyShimmer(this.action, null);
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/tool-labels.ts b/crates/workshop/ui/src/parts/agent/transcript/tool-labels.ts
deleted file mode 100644
index 32d236e9e..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/tool-labels.ts
+++ /dev/null
@@ -1,170 +0,0 @@
-// Tool labels for the agent transcript: the verb and details a tool call
-// shows, the loading rule, and the grammar of a group's summary. Pure and
-// DOM-free; the transcript model composes these into rows, and the view
-// only paints what they return. The tool id and the call arguments are
-// untrusted model-era data, so every parse here degrades to "no details"
-// rather than throwing.
-
-import type { ToolCallRow } from "../../../services/agent-session";
-
-/** The families of tool the transcript words differently. */
-export type ToolKind = "search" | "fetch" | "ask" | "other";
-
-/** What a tool line reads: a verb, details after it, and the call name's span. */
-export interface ToolLabel {
-  /** The verb: "Searching web" while loading, "Searched web" once done. */
-  readonly action: string;
-  /** The text after the verb; "" when the call has none. */
-  readonly details: string;
-  /**
-   * The call name when it leads `details` and renders in the verb's
-   * color (a generic tool's `read in fs`), or null when `details` is
-   * plain.
-   */
-  readonly callName: string | null;
-}
-
-/** How many calls of each family a group holds. */
-export interface ToolCounts {
-  readonly searches: number;
-  readonly fetches: number;
-  readonly tools: number;
-}
-
-/** A group's header: the verb and the parts that follow it. */
-export interface GroupSummary {
-  readonly action: string;
-  readonly details: string;
-}
-
-/** The turn a tool call sits in, as the loading rule reads it. */
-export interface TurnState {
-  /** True for the transcript's last turn. */
-  readonly last: boolean;
-  /** True while the service is generating. */
-  readonly generating: boolean;
-}
-
-/**
- * The family of a vendor-qualified tool name (`vendor/tool`, such as
- * `runvil/web/search`). Only the fixed names of runvil's ask, search,
- * and fetch tools are special, so the same tool id from another vendor's
- * Pack is generic. A null name, a call without a vendor, is generic.
- */
-export function toolKind(qualified: string | null): ToolKind {
-  switch (qualified) {
-    case "runvil/web/search":
-      return "search";
-    case "runvil/web/fetch":
-      return "fetch";
-    case "runvil/user-input/ask":
-      return "ask";
-    default:
-      return "other";
-  }
-}
-
-/** A call's vendor-qualified tool name, or null when the call names no vendor or no tool. */
-export function qualifiedTool(call: ToolCallRow): string | null {
-  return call.vendor === null || call.tool === null ? null : `${call.vendor}/${call.tool}`;
-}
-
-/**
- * Whether a call is loading. A call is loading while it has no result
- * and its turn is generating. An ask call is also loading while it waits
- * for the operator's answer, because `generating` is off during a wait;
- * that wait can only be in the last turn, so an ask left unanswered in an
- * earlier turn (a canceled wait) is not loading.
- */
-export function isToolLoading(kind: ToolKind, hasResult: boolean, turn: TurnState): boolean {
-  if (hasResult) {
-    return false;
-  }
-  if (kind === "ask") {
-    return turn.last;
-  }
-  return turn.last && turn.generating;
-}
-
-/** One string argument of a call's compact-JSON arguments, or "". */
-function stringArg(args: string, key: string): string {
-  if (args === "") {
-    return "";
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(args);
-  } catch {
-    return "";
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return "";
-  }
-  const value = (parsed as Record<string, unknown>)[key];
-  return typeof value === "string" ? value : "";
-}
-
-/**
- * The verb and details of one tool call. runvil's `web/search` and
- * `web/fetch` read their query and url arguments; runvil's ask tool has
- * no details; any other tool reads `<call name> in <tool id namespace>`,
- * with the call name flagged for the verb's color.
- */
-export function toolLabel(call: ToolCallRow, loading: boolean): ToolLabel {
-  switch (toolKind(qualifiedTool(call))) {
-    case "search":
-      return {
-        action: loading ? "Searching web" : "Searched web",
-        details: stringArg(call.args, "query"),
-        callName: null,
-      };
-    case "fetch":
-      return {
-        action: loading ? "Fetching page" : "Fetched page",
-        details: stringArg(call.args, "url"),
-        callName: null,
-      };
-    case "ask":
-      return {
-        action: loading ? "Asking questions" : "Asked questions",
-        details: "",
-        callName: null,
-      };
-    case "other": {
-      const action = loading ? "Running" : "Ran";
-      if (call.name === "") {
-        return { action, details: call.tool ?? "", callName: null };
-      }
-      const namespace = call.tool === null ? "" : call.tool.split("/")[0] ?? "";
-      return {
-        action,
-        details: namespace === "" ? call.name : `${call.name} in ${namespace}`,
-        callName: call.name,
-      };
-    }
-  }
-}
-
-function plural(count: number, one: string, many: string): string {
-  return `${count} ${count === 1 ? one : many}`;
-}
-
-/**
- * A group's header. The verb is Exploring while the group is the last row
- * of a generating turn and Explored otherwise. The parts come in a fixed
- * order - searches, fetches, other tools - and are joined with ", ": there
- * is no "and". A family with no calls is left out.
- */
-export function groupSummary(counts: ToolCounts, active: boolean): GroupSummary {
-  const parts: string[] = [];
-  if (counts.searches > 0) {
-    parts.push(plural(counts.searches, "search", "searches"));
-  }
-  if (counts.fetches > 0) {
-    parts.push(plural(counts.fetches, "fetch", "fetches"));
-  }
-  if (counts.tools > 0) {
-    parts.push(plural(counts.tools, "tool", "tools"));
-  }
-  return { action: active ? "Exploring" : "Explored", details: parts.join(", ") };
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/tool-line.css b/crates/workshop/ui/src/parts/agent/transcript/tool-line.css
deleted file mode 100644
index 31f4985b9..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/tool-line.css
+++ /dev/null
@@ -1,98 +0,0 @@
-/* A tool line (tool-line.ts) and its hover card (web-hover-card.ts). A
-   tool line is the shared collapsible header with the verb never
-   shrinking and the details truncating, no icons, dots, or badges. */
-
-.ws-tool-line > .ws-collapsible__header {
-  user-select: none;
-}
-
-/* The verb reads in the secondary tier and the details in the tertiary
-   one; a muted scope (a group's steps) shifts both down a tier, which
-   gives the verb 60% and the details 36%. */
-.ws-tool-line .ws-collapsible__action {
-  color: var(--ws-tone-secondary, var(--cursor-text-secondary));
-}
-
-.ws-tool-line .ws-collapsible__details {
-  color: var(--ws-tone-tertiary, var(--cursor-text-tertiary));
-}
-
-/* A generic tool's call name leads the details in the verb's color. */
-.ws-tool-line .ws-collapsible__call {
-  color: var(--ws-tone-secondary, var(--cursor-text-secondary));
-}
-
-/* The generic tool's block opens 4px under the line, not 14. */
-.ws-tool-line .ws-collapsible__body::before {
-  block-size: var(--space-1);
-}
-
-.ws-tool-block {
-  background: var(--cursor-bg-elevated);
-  border: var(--ws-border-width) solid var(--cursor-stroke-tertiary);
-  border-radius: var(--radius-lg);
-  overflow: hidden;
-}
-
-.ws-tool-block__pre {
-  margin: 0;
-  padding: var(--space-1-5) var(--space-2-5);
-  max-block-size: var(--ws-tool-block-max-height);
-  overflow: auto;
-  font-family: var(--code-font);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  color: var(--ws-tone-secondary, var(--cursor-text-secondary));
-  white-space: pre-wrap;
-  overflow-wrap: anywhere;
-}
-
-/* The web hover card: below the line's start edge, over the feed. */
-.ws-web-card {
-  position: fixed;
-  z-index: 9999;
-  box-sizing: border-box;
-  inline-size: var(--ws-web-card-width);
-  max-block-size: var(--ws-web-card-max-height);
-  overflow-y: auto;
-  padding: var(--space-1);
-  background: var(--cursor-bg-elevated);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--cursor-box-shadow-base);
-  font-family: var(--font-prose);
-}
-
-.ws-web-card__entry {
-  display: flex;
-  flex-direction: column;
-  min-inline-size: 0;
-  padding: var(--space-1) var(--space-2);
-  border-radius: var(--radius-sm);
-}
-
-.ws-web-card__entry:hover {
-  background: var(--cursor-bg-active);
-}
-
-.ws-web-card__title {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-sm);
-  color: var(--cursor-text-primary);
-  text-decoration: none;
-}
-
-a.ws-web-card__title {
-  color: var(--cursor-text-link);
-}
-
-.ws-web-card__url {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--font-size-xs);
-  line-height: var(--line-height-xs);
-  color: var(--cursor-text-tertiary);
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/tool-line.ts b/crates/workshop/ui/src/parts/agent/transcript/tool-line.ts
deleted file mode 100644
index ea0f7166a..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/tool-line.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-// A tool call as the transcript shows it: one line, "Ran read in fs" or
-// "Searched web <query>", used both as a standalone tool row and as a
-// step inside a group. The verb and details come from the model's tool
-// label; the line adds the behavior.
-//
-// - Search and fetch lines are not expandable. They open a hover card
-//   (web-hover-card.ts) listing the result titles and URLs, disabled
-//   while the call is loading.
-// - An ask line is plain text; it waits on the operator, not on a result.
-// - Any other tool expands into one block - its arguments as indented
-//   JSON, a blank line, then its result - when it has either.
-//
-// While the call is loading only the verb shimmers; there are no icons,
-// dots, or badges. Arguments and results are untrusted tool data and land
-// through textContent. Open state lives in the line's Collapsible, so it
-// survives every `update`.
-
-import "./tool-line.css";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { Collapsible } from "./collapsible";
-import type { ToolStep } from "./transcript-model";
-import { WebHoverCard, webCardEntries } from "./web-hover-card";
-
-/** The arguments as indented JSON, the raw text when they don't parse, or "" for none. */
-function prettyArguments(args: string): string {
-  if (args === "") {
-    return "";
-  }
-  try {
-    return JSON.stringify(JSON.parse(args) as unknown, null, 2);
-  } catch {
-    return args;
-  }
-}
-
-/** The generic block's text: the arguments, a blank line, then the result. */
-export function toolBlockText(step: ToolStep): string {
-  const parts: string[] = [];
-  const args = prettyArguments(step.call.args);
-  if (args !== "") {
-    parts.push(args);
-  }
-  if (step.result !== null && step.result !== "") {
-    parts.push(step.result);
-  }
-  return parts.join("\n\n");
-}
-
-/** One tool line. */
-export class ToolLine implements IDisposable {
-  readonly kind = "tool";
-  readonly element: HTMLElement;
-
-  private readonly collapsible: Collapsible;
-  private readonly pre: HTMLPreElement;
-  private readonly card: WebHoverCard;
-  private text = "";
-  private label = "";
-
-  constructor() {
-    this.collapsible = new Collapsible();
-    this.element = this.collapsible.element;
-    this.element.classList.add("ws-tool-line");
-
-    const block = document.createElement("div");
-    block.className = "ws-tool-block";
-    this.pre = document.createElement("pre");
-    this.pre.className = "ws-tool-block__pre";
-    block.appendChild(this.pre);
-    this.collapsible.body.appendChild(block);
-
-    // The card hangs off the header line, not the whole element, so an
-    // opened block never keeps it alive.
-    this.card = new WebHoverCard(this.collapsible.header);
-  }
-
-  /** Paints the step, leaving the open state and the card's timers alone. */
-  update(step: ToolStep): void {
-    this.collapsible.setHeader({
-      action: step.label.action,
-      details: step.label.details,
-      callName: step.label.callName,
-      shimmer: step.loading ? "tool" : null,
-    });
-    this.element.dataset["toolKind"] = step.toolKind;
-    this.element.dataset["loading"] = String(step.loading);
-    this.label = `${step.label.action} ${step.label.details}`.trim();
-
-    if (step.toolKind === "other") {
-      const text = toolBlockText(step);
-      if (text !== this.text) {
-        this.text = text;
-        this.pre.textContent = text;
-      }
-      this.collapsible.setExpandable(text !== "");
-      this.card.setEntries(null);
-      return;
-    }
-
-    this.text = "";
-    this.pre.textContent = "";
-    this.collapsible.setExpandable(false);
-    if (step.toolKind === "search" || step.toolKind === "fetch") {
-      this.card.setEntries(webCardEntries(step.toolKind, step.call.args, step.result));
-      this.card.setDisabled(step.loading);
-    } else {
-      this.card.setEntries(null);
-    }
-  }
-
-  /** The operator's own open or closed choice for the block, or null while they've made none. */
-  get operatorChoice(): boolean | null {
-    return this.collapsible.operatorChoice;
-  }
-
-  /** Takes over the operator's choice from the line this one replaces. */
-  adoptChoice(choice: boolean | null): void {
-    this.collapsible.adoptChoice(choice);
-  }
-
-  /** The line's visible text, for the transcript's Copy Message. */
-  copyText(): string {
-    return this.label;
-  }
-
-  dispose(): void {
-    this.card.dispose();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/transcript-model.ts b/crates/workshop/ui/src/parts/agent/transcript/transcript-model.ts
deleted file mode 100644
index 79b66fcc6..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/transcript-model.ts
+++ /dev/null
@@ -1,638 +0,0 @@
-// The agent transcript model: a pure, DOM-free function from the
-// session's items to what the view paints - turns of keyed rows, and a
-// tail status. `buildTranscript(items, generating, reconnecting)` is
-// recomputed on every change; every row carries a stable key so the view
-// can reconcile by key and update rows in place instead of rebuilding
-// them. Keys are stable because they derive from ids the wire already
-// stamped (the reply id, the call id, the item index), never from
-// position among rows, and because items only ever append.
-//
-// The rules live here, in this order:
-//
-// - Turns: a user item starts a turn; a tool result joins the turn that
-//   holds its call, even when a steering message started a later turn,
-//   attaches to that call by id, and never becomes a row. The open batch,
-//   the latest tool-call item unless it has ended, loads as the last
-//   turn's calls do, whichever turn holds it, and an ended batch's calls
-//   never load.
-// - Grouping: reasoning items and tool calls gather into an open group; a
-//   reply, a user item, or an error closes it; ask-tool calls always
-//   stand alone. A closed group with one tool call and nothing else is a
-//   `tool` row, thinking only is a `thought` row, anything else a `group`.
-// - Thought labels, group summaries, tool verbs, and loading (tool-labels.ts).
-// - The tail status under the last row of a generating turn.
-//
-// Item text is untrusted model-era data; the model only carries it.
-
-import type { ReasoningItem, ToolCallRow, TranscriptItem } from "../../../services/agent-session";
-import {
-  groupSummary,
-  isToolLoading,
-  qualifiedTool,
-  toolKind,
-  toolLabel,
-  type GroupSummary,
-  type ToolKind,
-  type ToolLabel,
-  type TurnState,
-} from "./tool-labels";
-
-// --- Types --------------------------------------------------------------------
-
-/** A thought's header: the verb, and the details after it when there are any. */
-export interface ThoughtLabel {
-  readonly action: string;
-  readonly details: string | null;
-}
-
-/** The slice of a thought a label reads. */
-export interface ThoughtInput {
-  readonly text: string;
-  /** How long the thinking ran, or null when unknown. */
-  readonly durationMs: number | null;
-  /** True while the thinking is still running. */
-  readonly streaming: boolean;
-}
-
-/** One reasoning item as a step: a thought row's entry or a group's thinking line. */
-export interface ThoughtStep extends ThoughtInput {
-  readonly step: "thought";
-  readonly key: string;
-  readonly label: ThoughtLabel;
-}
-
-/** One tool call as a step: a tool row's body or a group's tool line. */
-export interface ToolStep {
-  readonly step: "tool";
-  readonly key: string;
-  readonly call: ToolCallRow;
-  readonly toolKind: ToolKind;
-  /** The result text once the call's result landed, else null. */
-  readonly result: string | null;
-  readonly loading: boolean;
-  readonly label: ToolLabel;
-}
-
-/** A step inside a group. */
-export type GroupStep = ThoughtStep | ToolStep;
-
-/** The operator's message. */
-export interface HumanRow {
-  readonly kind: "human";
-  readonly key: string;
-  readonly text: string;
-}
-
-/** An assistant reply, as markdown source. */
-export interface MarkdownRow {
-  readonly kind: "markdown";
-  readonly key: string;
-  readonly text: string;
-  /** True while the reply is still streaming. */
-  readonly streaming: boolean;
-}
-
-/** Thinking and nothing else: one or more consecutive thoughts. */
-export interface ThoughtRow {
-  readonly kind: "thought";
-  readonly key: string;
-  readonly thoughts: readonly ThoughtStep[];
-  /** The thoughts' text, joined by a blank line: the row's body. */
-  readonly text: string;
-  readonly streaming: boolean;
-  /** The sum of the thoughts' durations, or null when none is known. */
-  readonly durationMs: number | null;
-  readonly label: ThoughtLabel;
-}
-
-/** Thinking and tool steps that ran together. */
-export interface GroupRow {
-  readonly kind: "group";
-  readonly key: string;
-  readonly steps: readonly GroupStep[];
-  readonly summary: GroupSummary;
-  /** True while the group is the last row of the generating turn. */
-  readonly active: boolean;
-}
-
-/** A standalone tool call: a lone call, or an ask. */
-export interface ToolRow {
-  readonly kind: "tool";
-  readonly key: string;
-  readonly step: ToolStep;
-}
-
-export type TranscriptRow = HumanRow | MarkdownRow | ThoughtRow | GroupRow | ToolRow;
-
-/** One turn: a human row and what the agent did about it. */
-export interface TranscriptTurn {
-  readonly key: string;
-  readonly rows: readonly TranscriptRow[];
-}
-
-/** What the tail status is about. */
-export type TailKind = "reconnecting" | "tool" | "thinking" | "planning";
-
-/** The status line under the last row while the agent works. */
-export interface TailStatus {
-  readonly kind: TailKind;
-  /** The verb, shimmering. */
-  readonly action: string;
-  readonly details: string;
-  /** The call name leading `details`, for the verb's color; see `ToolLabel`. */
-  readonly callName: string | null;
-  /** True when the last row is a group: the tail renders inside it. */
-  readonly inGroup: boolean;
-}
-
-export interface TranscriptModel {
-  readonly turns: readonly TranscriptTurn[];
-  /** The tail status, or null when there is none to show. */
-  readonly tail: TailStatus | null;
-}
-
-// --- Thought labels --------------------------------------------------------------
-
-// No `*` inside the capture: a line like `**A** vs **B**` is body text, not one title.
-const BOLD_TITLE = /^\*\*([^*]+)\*\*$/;
-const HEADING_TITLE = /^#{1,6}\s+(.+)$/;
-
-/** The title a line holds when it is `**title**` or `# title`, else null. */
-function headerTitle(line: string): string | null {
-  const match = BOLD_TITLE.exec(line) ?? HEADING_TITLE.exec(line);
-  return match?.[1]?.trim() ?? null;
-}
-
-/**
- * Reads thinking text for title-only form: every non-blank line is a
- * title. `title` is the last one; `titleOnly` is false when any line is
- * body text or there is no title at all.
- */
-function parseTitles(text: string): { title: string; titleOnly: boolean } {
-  let title = "";
-  let body = false;
-  for (const raw of text.trim().split("\n")) {
-    const line = raw.trim();
-    if (line === "") {
-      continue;
-    }
-    const found = headerTitle(line);
-    if (found === null) {
-      body = true;
-    } else {
-      title = found;
-    }
-  }
-  return { title, titleOnly: title !== "" && !body };
-}
-
-/**
- * The details after a thought's verb, or null for none.
- *
- * - Unknown or under 500ms: "briefly", or none for title-only thinking.
- * - Title-only thinking from 500ms up to a second shows one decimal
- *   truncated to tenths (`0.6s`, never a rounded-up `1.0s`).
- * - Otherwise whole seconds rounded to the nearest (`4s`, `300s`).
- */
-function thoughtDetails(durationMs: number | null, titleOnly: boolean): string | null {
-  if (durationMs === null || durationMs < 500) {
-    return titleOnly ? null : "briefly";
-  }
-  if (titleOnly && durationMs < 1000) {
-    return `${(Math.floor(durationMs / 100) / 10).toFixed(1)}s`;
-  }
-  return `${Math.round(durationMs / 1000)}s`;
-}
-
-/** The summed duration of some thoughts, or null when none has a known one. */
-function sumDurations(parts: readonly ThoughtInput[]): number | null {
-  let total: number | null = null;
-  for (const part of parts) {
-    if (part.durationMs !== null) {
-      total = (total ?? 0) + part.durationMs;
-    }
-  }
-  return total;
-}
-
-/**
- * The header of one thought or several consecutive ones. Streaming
- * thinking is "Thinking" with no details. Settled thinking is "Thought"
- * with details - "briefly" when the duration is unknown or under 500ms,
- * else whole seconds ("4s", "300s": never "for", never minutes). When
- * every non-blank line is a title, the last title replaces "Thought" and
- * its details follow `thoughtDetails`' title-only rules. The duration is
- * the sum of the thoughts' durations.
- */
-export function thoughtLabel(parts: readonly ThoughtInput[]): ThoughtLabel {
-  if (parts.some((part) => part.streaming)) {
-    return { action: "Thinking", details: null };
-  }
-  const { title, titleOnly } = parseTitles(parts.map((part) => part.text).join("\n"));
-  return {
-    action: titleOnly ? title : "Thought",
-    details: thoughtDetails(sumDurations(parts), titleOnly),
-  };
-}
-
-// --- Building ------------------------------------------------------------------------
-
-/** One item with its index in the session's items. */
-interface Entry {
-  readonly item: TranscriptItem;
-  readonly index: number;
-}
-
-/** A tool call as it is gathered, before loading and labels are known. */
-interface ToolDraft {
-  readonly key: string;
-  readonly call: ToolCallRow;
-  readonly family: ToolKind;
-  /** True for a call of the open batch, the transcript's latest tool-call item unless it has ended. */
-  readonly open: boolean;
-  /** True for a call of an ended batch, which gets no more results. */
-  readonly ended: boolean;
-  result: string | null;
-}
-
-type StepDraft =
-  | { readonly step: "thought"; readonly key: string; readonly item: ReasoningItem }
-  | { readonly step: "tool"; readonly draft: ToolDraft };
-
-type RowDraft =
-  | { readonly row: "human"; readonly key: string; readonly text: string }
-  | { readonly row: "markdown"; readonly key: string; readonly text: string; readonly streaming: boolean }
-  | { readonly row: "flow"; readonly steps: readonly StepDraft[] }
-  | { readonly row: "ask"; readonly draft: ToolDraft };
-
-/**
- * Splits items into turns: a user item starts each, and the items before
- * the first form their own. A tool result joins the turn holding the
- * latest call with its id, since a steering message can start a turn
- * while the call runs.
- */
-function splitTurns(items: readonly TranscriptItem[]): Entry[][] {
-  const turns: Entry[][] = [];
-  // The turn holding the latest call per id.
-  const holders = new Map<string, Entry[]>();
-  let current: Entry[] | null = null;
-  for (const [index, item] of items.entries()) {
-    if (item.kind === "user" || current === null) {
-      current = [];
-      turns.push(current);
-    }
-    if (item.kind === "tool-call") {
-      for (const call of item.calls) {
-        if (call.id !== "") {
-          holders.set(call.id, current);
-        }
-      }
-    }
-    const holder =
-      item.kind === "tool-result" && item.toolCallId !== null ? holders.get(item.toolCallId) : undefined;
-    (holder ?? current).push({ item, index });
-  }
-  return turns;
-}
-
-/**
- * The index of the open batch, the latest tool-call item unless it has
- * ended, or -1 when there is none.
- */
-function openBatchIndex(items: readonly TranscriptItem[]): number {
-  for (let index = items.length - 1; index >= 0; index--) {
-    const item = items[index];
-    if (item?.kind === "tool-call") {
-      return item.ended ? -1 : index;
-    }
-  }
-  return -1;
-}
-
-/**
- * Gathers one turn's entries into row drafts, attaching results to calls
- * and marking the calls of the item at `openBatch`.
- */
-function draftTurn(turn: number, entries: readonly Entry[], openBatch: number): RowDraft[] {
-  const drafts: RowDraft[] = [];
-  let open: StepDraft[] = [];
-  const used = new Set<string>();
-  // The latest call per id still waiting for its result.
-  const waiting = new Map<string, ToolDraft>();
-
-  const flush = (): void => {
-    if (open.length > 0) {
-      drafts.push({ row: "flow", steps: open });
-      open = [];
-    }
-  };
-  // A key not yet used in this turn: a recycled id or reply id keeps its
-  // first occurrence's plain key and gives the later ones a suffix.
-  const claim = (key: string, suffix: string): string => {
-    const unique = used.has(key) ? `${key}:${suffix}` : key;
-    used.add(unique);
-    return unique;
-  };
-
-  for (const { item, index } of entries) {
-    switch (item.kind) {
-      case "user": {
-        drafts.push({ row: "human", key: `h:${index}`, text: item.text });
-        break;
-      }
-      case "reply": {
-        // Nothing to show for blank text: no row, and the group stays open.
-        if (item.text.trim() === "") {
-          break;
-        }
-        flush();
-        drafts.push({
-          row: "markdown",
-          key: claim(item.reply === null ? `r:i${index}` : `r:${item.reply}`, `${index}`),
-          text: item.text,
-          streaming: item.pending,
-        });
-        break;
-      }
-      case "reasoning": {
-        // A settled thought with no text has nothing to open; a pending
-        // one is still "Thinking" and shows.
-        if (!item.pending && item.text.trim() === "") {
-          break;
-        }
-        open.push({
-          step: "thought",
-          key: claim(item.reply === null ? `t:i${index}` : `t:${item.reply}`, `${index}`),
-          item,
-        });
-        break;
-      }
-      case "tool-call": {
-        item.calls.forEach((call, position) => {
-          const slot = `${index}.${position}`;
-          const draft: ToolDraft = {
-            key: claim(call.id === "" ? `c:${turn}:${slot}` : `c:${turn}:${call.id}`, slot),
-            call,
-            family: toolKind(qualifiedTool(call)),
-            open: index === openBatch,
-            ended: item.ended,
-            result: null,
-          };
-          if (call.id !== "") {
-            waiting.set(call.id, draft);
-          }
-          if (draft.family === "ask") {
-            // An ask stands alone, after the group it splits.
-            flush();
-            drafts.push({ row: "ask", draft });
-          } else {
-            open.push({ step: "tool", draft });
-          }
-        });
-        break;
-      }
-      case "tool-result": {
-        const id = item.toolCallId;
-        const draft = id === null || id === "" ? undefined : waiting.get(id);
-        if (id !== null && draft !== undefined) {
-          draft.result = item.text;
-          waiting.delete(id);
-        }
-        break;
-      }
-      case "error": {
-        flush();
-        break;
-      }
-    }
-  }
-  flush();
-  return drafts;
-}
-
-function toolStep(draft: ToolDraft, state: TurnState): ToolStep {
-  // A steering message can start a later turn while the open batch runs,
-  // and an ended batch's calls get no more results.
-  const turn: TurnState = draft.open ? { last: true, generating: state.generating } : state;
-  const loading = !draft.ended && isToolLoading(draft.family, draft.result !== null, turn);
-  return {
-    step: "tool",
-    key: draft.key,
-    call: draft.call,
-    toolKind: draft.family,
-    result: draft.result,
-    loading,
-    label: toolLabel(draft.call, loading),
-  };
-}
-
-function thoughtStep(key: string, item: ReasoningItem): ThoughtStep {
-  const part: ThoughtInput = {
-    text: item.text,
-    // Streaming follows the clock, not `pending`: a thought whose round
-    // already streamed text has ended while its durable event is in flight.
-    streaming: item.pending && item.endedAt === null,
-    durationMs:
-      item.startedAt !== null && item.endedAt !== null
-        ? Math.max(0, item.endedAt - item.startedAt)
-        : null,
-  };
-  return {
-    step: "thought",
-    key,
-    ...part,
-    label: thoughtLabel([part]),
-  };
-}
-
-function thoughtRow(thoughts: readonly ThoughtStep[]): ThoughtRow {
-  return {
-    kind: "thought",
-    key: thoughts[0]?.key ?? "",
-    thoughts,
-    text: thoughts.map((thought) => thought.text).join("\n\n"),
-    streaming: thoughts.some((thought) => thought.streaming),
-    durationMs: sumDurations(thoughts),
-    label: thoughtLabel(thoughts),
-  };
-}
-
-/** Classifies drafts into rows once every result has attached. */
-function finishTurn(
-  drafts: readonly RowDraft[],
-  state: TurnState,
-): TranscriptRow[] {
-  const rows: TranscriptRow[] = [];
-  drafts.forEach((draft, position) => {
-    switch (draft.row) {
-      case "human":
-        rows.push({ kind: "human", key: draft.key, text: draft.text });
-        return;
-      case "markdown":
-        rows.push({ kind: "markdown", key: draft.key, text: draft.text, streaming: draft.streaming });
-        return;
-      case "ask":
-        rows.push({ kind: "tool", key: draft.draft.key, step: toolStep(draft.draft, state) });
-        return;
-      case "flow": {
-        const steps: GroupStep[] = draft.steps.map((step) =>
-          step.step === "thought" ? thoughtStep(step.key, step.item) : toolStep(step.draft, state),
-        );
-        const tools = steps.filter((step): step is ToolStep => step.step === "tool");
-        const thoughts = steps.filter((step): step is ThoughtStep => step.step === "thought");
-        if (tools.length === 0) {
-          rows.push(thoughtRow(thoughts));
-        } else if (tools.length === 1 && thoughts.length === 0) {
-          const only = tools[0];
-          if (only !== undefined) {
-            rows.push({ kind: "tool", key: only.key, step: only });
-          }
-        } else {
-          const active = state.last && state.generating && position === drafts.length - 1;
-          rows.push({
-            kind: "group",
-            key: steps[0]?.key ?? "",
-            steps,
-            summary: groupSummary(
-              {
-                searches: tools.filter((step) => step.toolKind === "search").length,
-                fetches: tools.filter((step) => step.toolKind === "fetch").length,
-                tools: tools.filter((step) => step.toolKind === "other").length,
-              },
-              active,
-            ),
-            active,
-          });
-        }
-        return;
-      }
-    }
-  });
-  return rows;
-}
-
-// --- Tail status ------------------------------------------------------------------------
-
-function makeTail(kind: TailKind, action: string, inGroup: boolean, rest: Partial<TailStatus> = {}): TailStatus {
-  return {
-    kind,
-    action,
-    details: "",
-    callName: null,
-    inGroup,
-    ...rest,
-  };
-}
-
-function toolTail(step: ToolStep, inGroup: boolean): TailStatus {
-  return makeTail("tool", step.label.action, inGroup, {
-    details: step.label.details,
-    callName: step.label.callName,
-  });
-}
-
-/**
- * The newest loading call in the turns before the last. Only the open
- * batch's calls load outside the last turn, so this is the open batch's
- * running call when a steering message started a turn after it.
- */
-function runningBefore(turns: readonly TranscriptTurn[]): ToolStep | null {
-  for (let number = turns.length - 2; number >= 0; number--) {
-    const rows = turns[number]?.rows ?? [];
-    for (let index = rows.length - 1; index >= 0; index--) {
-      const row = rows[index];
-      const steps: readonly GroupStep[] =
-        row?.kind === "group" ? row.steps : row?.kind === "tool" ? [row.step] : [];
-      for (let at = steps.length - 1; at >= 0; at--) {
-        const step = steps[at];
-        if (step?.step === "tool" && step.loading) {
-          return step;
-        }
-      }
-    }
-  }
-  return null;
-}
-
-/**
- * The status line under the last turn. None when nothing is generating
- * or the last row is streaming assistant text (the text is the status).
- * Reconnecting while the socket is down. Otherwise the newest activity
- * the rows don't already show: a running tool inside a group gives its
- * loading verb and details, streaming thinking inside a group gives
- * "Thinking" - and a standalone tool row or a thought row already
- * shimmers on its own, so the tail stays out of its way. When the last
- * turn has no loading call, the open batch's running call in an earlier
- * turn gives its loading verb and details. With no activity at all it
- * plans.
- */
-function tailStatus(
-  turns: readonly TranscriptTurn[],
-  generating: boolean,
-  reconnecting: boolean,
-): TailStatus | null {
-  const turn = turns[turns.length - 1];
-  if (!generating || turn === undefined) {
-    return null;
-  }
-  const rows = turn.rows;
-  const lastRow = rows[rows.length - 1];
-  if (lastRow?.kind === "markdown" && lastRow.streaming) {
-    return null;
-  }
-  const inGroup = lastRow?.kind === "group";
-  if (reconnecting) {
-    return makeTail("reconnecting", "Reconnecting...", inGroup);
-  }
-  for (let index = rows.length - 1; index >= 0; index--) {
-    const row = rows[index];
-    if (row === undefined) {
-      continue;
-    }
-    if (row.kind === "thought" && row.streaming) {
-      return null;
-    }
-    if (row.kind === "tool" && row.step.loading) {
-      return null;
-    }
-    if (row.kind === "group") {
-      for (let at = row.steps.length - 1; at >= 0; at--) {
-        const step = row.steps[at];
-        if (step?.step === "tool" && step.loading) {
-          return toolTail(step, inGroup);
-        }
-        if (step?.step === "thought" && step.streaming) {
-          return makeTail("thinking", "Thinking", inGroup);
-        }
-      }
-    }
-  }
-  const running = runningBefore(turns);
-  if (running !== null) {
-    return toolTail(running, inGroup);
-  }
-  return makeTail("planning", "Planning next moves", inGroup);
-}
-
-/**
- * Turns the session's items into turns of keyed rows and a tail status.
- * Pure: the items are never mutated, and the same inputs give the same
- * model.
- */
-export function buildTranscript(
-  items: readonly TranscriptItem[],
-  generating: boolean,
-  reconnecting: boolean,
-): TranscriptModel {
-  const split = splitTurns(items);
-  const openBatch = openBatchIndex(items);
-  const turns = split.map((entries, number): TranscriptTurn => {
-    const first = entries[0];
-    const state: TurnState = { last: number === split.length - 1, generating };
-    return {
-      key: first?.item.kind === "user" ? `u:${first.index}` : "u:start",
-      rows: finishTurn(draftTurn(number, entries, openBatch), state),
-    };
-  });
-  return { turns, tail: tailStatus(turns, generating, reconnecting) };
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/transcript-view.ts b/crates/workshop/ui/src/parts/agent/transcript/transcript-view.ts
deleted file mode 100644
index 70b425e9a..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/transcript-view.ts
+++ /dev/null
@@ -1,265 +0,0 @@
-// The transcript view: paints the model's turns, rows, and tail status
-// into the scrolling feed. Every level reconciles by key (reconcile.ts):
-// a turn's wrapper, a turn's rows, a group's steps. A key's component is
-// reused and told `update(row)`, new keys get new components, gone keys
-// lose theirs, and the tail goes last - or inside the open group that is
-// the active tail - so a streaming delta changes text in place and never
-// rebuilds a settled row. Open and expanded state lives in the row
-// components and survives every delta and the settle.
-//
-// The view owns the feed's chrome: the centered column, the trailing
-// spacer, the scroll behavior (feed-scroll.ts), the sticky human
-// messages, each finished turn's Copy footer, and the transcript context
-// menu (Copy Message, or Copy over a selection; Select All). Nothing
-// here reads the service; the owner hands in the model.
-//
-// Every string painted here is untrusted data (user text, model markdown,
-// tool arguments and output) and reaches the DOM through the row
-// components: textContent, or renderMarkdown's DOMPurify pass.
-
-import "./transcript.css";
-
-import { DropdownMenu, type DropdownItem } from "@workshop/look/dropdown";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { copyToClipboard } from "../../shared/clipboard";
-import { FeedScroll } from "./feed-scroll";
-import { HumanMessage } from "./human-message";
-import { reconcile, type KeyedComponent } from "./reconcile";
-import {
-  carryRowState,
-  createRowComponent,
-  updateRowComponent,
-  GroupRowView,
-  type RowComponent,
-} from "./rows";
-import { TailView } from "./tail-status";
-import { TurnFooter } from "./turn-footer";
-import type { TranscriptModel, TranscriptTurn } from "./transcript-model";
-
-/** What the view asks of its owner. */
-export interface TranscriptHost {
-  /** A turn's Copy landed: raise the confirmation. */
-  copied(): void;
-}
-
-/** One turn: its wrapper, its rows, and its footer. */
-class TurnView implements KeyedComponent {
-  readonly kind = "turn";
-  readonly element: HTMLDivElement;
-  readonly rows = new Map<string, RowComponent & KeyedComponent>();
-
-  private footer: TurnFooter | null = null;
-
-  constructor(
-    private readonly host: TranscriptHost,
-    private readonly createRow: (row: TranscriptTurn["rows"][number]) => RowComponent & KeyedComponent,
-  ) {
-    this.element = document.createElement("div");
-    this.element.className = "ws-turn";
-  }
-
-  /** Reconciles the turn's rows and its footer; `finished` shows the Copy footer. */
-  update(turn: TranscriptTurn, finished: boolean): void {
-    reconcile(
-      this.element,
-      this.rows,
-      turn.rows,
-      (row) => this.createRow(row),
-      (component, row) => updateRowComponent(component, row),
-      (component, replaced, row) => carryRowState(component, replaced, row.key),
-    );
-    const replies = turn.rows.flatMap((row) => (row.kind === "markdown" ? [row.text] : []));
-    if (finished && replies.length > 0) {
-      if (this.footer === null) {
-        this.footer = new TurnFooter(() => this.host.copied());
-      }
-      this.footer.update(replies);
-      if (this.element.lastElementChild !== this.footer.element) {
-        this.element.appendChild(this.footer.element);
-      }
-    } else if (this.footer !== null) {
-      this.footer.element.remove();
-      this.footer.dispose();
-      this.footer = null;
-    }
-  }
-
-  dispose(): void {
-    for (const row of this.rows.values()) {
-      row.dispose();
-    }
-    this.rows.clear();
-    this.footer?.dispose();
-  }
-}
-
-/** The scrolling transcript. */
-export class TranscriptView implements IDisposable {
-  /** The scroller: the feed element the owner places in the session. */
-  readonly element: HTMLDivElement;
-
-  private readonly column: HTMLDivElement;
-  private readonly turns = new Map<string, TurnView>();
-  private readonly rowByElement = new WeakMap<Element, RowComponent>();
-  private readonly tail: TailView;
-  private readonly scroll: FeedScroll;
-  private readonly menu = new DropdownMenu();
-  private animateIn = false;
-
-  private readonly onContextMenu = (event: MouseEvent): void => {
-    this.openContextMenu(event);
-  };
-
-  constructor(private readonly host: TranscriptHost) {
-    this.element = document.createElement("div");
-    this.element.className = "ws-agent-session__feed";
-    // A live region: the rows appended while the agent works are announced.
-    this.element.setAttribute("role", "log");
-    this.element.setAttribute("aria-live", "polite");
-    this.element.setAttribute("aria-relevant", "additions");
-    this.element.setAttribute("aria-atomic", "false");
-
-    this.column = document.createElement("div");
-    this.column.className = "ws-transcript";
-    const spacer = document.createElement("div");
-    spacer.className = "ws-transcript__spacer";
-    spacer.setAttribute("aria-hidden", "true");
-    this.column.appendChild(spacer);
-    this.element.appendChild(this.column);
-
-    this.tail = new TailView();
-    this.scroll = new FeedScroll(this.element, this.column, {
-      spacer,
-      onLayout: (reason) => this.layoutHumans(reason === "resize"),
-    });
-    this.element.addEventListener("contextmenu", this.onContextMenu);
-  }
-
-  /** Pins to the bottom at once: what a send does. */
-  forcePin(): void {
-    this.scroll.forcePin();
-  }
-
-  /**
-   * Paints the model. `generating` decides which turns are finished: every
-   * turn but the last, and the last once the agent stops.
-   */
-  render(model: TranscriptModel, generating: boolean): void {
-    const lastIndex = model.turns.length - 1;
-    reconcile(
-      this.column,
-      this.turns,
-      model.turns.map((turn) => ({ key: turn.key, kind: "turn", turn })),
-      () => new TurnView(this.host, (row) => this.makeRow(row)),
-      (view, entry) => {
-        const finished = entry.turn !== model.turns[lastIndex] || !generating;
-        view.update(entry.turn, finished);
-      },
-    );
-    this.placeTail(model);
-    // Rows that exist at the first paint appear in place; later ones fade in.
-    this.animateIn = this.animateIn || model.turns.length > 0;
-    for (const human of this.humans()) {
-      human.measure();
-    }
-    this.layoutHumans(false);
-  }
-
-  dispose(): void {
-    this.element.removeEventListener("contextmenu", this.onContextMenu);
-    this.menu.dispose();
-    this.scroll.dispose();
-    this.tail.dispose();
-    for (const turn of this.turns.values()) {
-      turn.dispose();
-    }
-    this.turns.clear();
-  }
-
-  private makeRow(row: TranscriptTurn["rows"][number]): RowComponent & KeyedComponent {
-    const component = createRowComponent(row, this.animateIn);
-    this.rowByElement.set(component.element, component);
-    return component;
-  }
-
-  /** The tail goes last in the last turn, or inside the group that is the active tail. */
-  private placeTail(model: TranscriptModel): void {
-    const status = model.tail;
-    if (status === null) {
-      this.tail.element.remove();
-      return;
-    }
-    this.tail.update(status);
-    const lastTurn = this.turns.get(model.turns[model.turns.length - 1]?.key ?? "");
-    if (lastTurn === undefined) {
-      this.tail.element.remove();
-      return;
-    }
-    let host: HTMLElement = lastTurn.element;
-    if (status.inGroup) {
-      const lastRow = model.turns[model.turns.length - 1]?.rows.at(-1);
-      const group = lastRow === undefined ? undefined : lastTurn.rows.get(lastRow.key);
-      if (group instanceof GroupRowView) {
-        host = group.element;
-      }
-    }
-    if (this.tail.element.parentElement !== host || host.lastElementChild !== this.tail.element) {
-      host.appendChild(this.tail.element);
-    }
-  }
-
-  private humans(): HumanMessage[] {
-    const found: HumanMessage[] = [];
-    for (const turn of this.turns.values()) {
-      for (const row of turn.rows.values()) {
-        if (row instanceof HumanMessage) {
-          found.push(row);
-        }
-      }
-    }
-    return found;
-  }
-
-  private layoutHumans(remeasure: boolean): void {
-    for (const human of this.humans()) {
-      if (remeasure) {
-        human.measure(true);
-      }
-      human.layout(this.element);
-    }
-  }
-
-  // --- Context menu -----------------------------------------------------------------
-
-  private openContextMenu(event: MouseEvent): void {
-    event.preventDefault();
-    const selected = window.getSelection()?.toString() ?? "";
-    const target = event.target instanceof Element ? event.target : null;
-    const rowElement = target?.closest(".ws-transcript-row") ?? null;
-    const component = rowElement === null ? undefined : this.rowByElement.get(rowElement);
-    const message = component?.copyText() ?? "";
-    const subject = selected !== "" ? selected : message;
-    const items: DropdownItem[] = [];
-    // A right-click outside any row (the tail, a turn footer, the spacer,
-    // the column's padding) has no message and no selection to copy;
-    // offering Copy there would overwrite the clipboard with nothing.
-    if (subject !== "") {
-      items.push({
-        label: selected !== "" ? "Copy" : "Copy Message",
-        onClick: () => {
-          void copyToClipboard(subject);
-        },
-      });
-    }
-    items.push({
-      label: "Select All",
-      onClick: () => {
-        window.getSelection()?.selectAllChildren(this.column);
-      },
-    });
-    // Closed first so a second right-click on the feed opens a new menu
-    // instead of toggling the open one shut.
-    this.menu.close();
-    this.menu.show(this.element, items, { x: event.clientX, y: event.clientY });
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/transcript.css b/crates/workshop/ui/src/parts/agent/transcript/transcript.css
deleted file mode 100644
index a9376741c..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/transcript.css
+++ /dev/null
@@ -1,174 +0,0 @@
-/* The agent transcript (transcript-view.ts): the centered feed column,
-   turn wrappers, row spacing, thought and group rows, the tail status, a
-   finished turn's footer, and the trailing spacer. The feed's own box is
-   .ws-agent-session__feed in agent-session.css. */
-
-/* The column: at most 840px wide, centered, with 16px of side padding. The
-   three tone variables are the text tiers rows read; a muted scope below
-   shifts them down. */
-.ws-transcript {
-  --ws-tone-secondary: var(--cursor-text-secondary);
-  --ws-tone-tertiary: var(--cursor-text-tertiary);
-  --ws-tone-quaternary: var(--cursor-text-quaternary);
-  box-sizing: border-box;
-  inline-size: 100%;
-  max-inline-size: var(--agent-max-width);
-  margin-inline: auto;
-  padding-inline: var(--space-4);
-  padding-block-start: var(--space-3);
-}
-
-/* Each user item starts a turn wrapper; rows sit 14px apart inside it and
-   turns 14px apart in the column. The wrapper is the sticky human
-   message's containing block. */
-.ws-turn {
-  display: flex;
-  flex-direction: column;
-  gap: var(--feed-row-gap);
-  min-inline-size: 0;
-}
-
-.ws-turn + .ws-turn {
-  margin-block-start: var(--feed-row-gap);
-}
-
-/* Every row but the human message takes the 11px inline inset. */
-.ws-transcript-row:not(.ws-human-message),
-.ws-turn > .ws-tail,
-.ws-turn > .ws-turn-footer {
-  margin-inline: var(--ws-transcript-row-inset);
-}
-
-/* The spacer's height is set from JS (feed-scroll.ts). */
-.ws-transcript__spacer {
-  flex: none;
-}
-
-/* A muted scope: secondary text maps to tertiary and tertiary to
-   quaternary, and a running tool's verb shimmers from the tertiary tier. */
-.ws-muted-scope {
-  --ws-tone-secondary: var(--cursor-text-tertiary);
-  --ws-tone-tertiary: var(--cursor-text-quaternary);
-}
-
-.ws-muted-scope .ws-shimmer-text--tool {
-  --shimmer-base: color-mix(in srgb, var(--cursor-text-tertiary) 60%, transparent);
-}
-
-/* --- Rows ---------------------------------------------------------------------- */
-
-.ws-markdown-row {
-  min-inline-size: 0;
-}
-
-/* A new reply row fades in and rises 8px. */
-.ws-markdown-row--enter {
-  animation: ws-markdown-row-enter var(--ws-transcript-row-enter) var(--ease-out-cubic) both;
-}
-
-@keyframes ws-markdown-row-enter {
-  from {
-    opacity: 0;
-    transform: translateY(var(--space-2));
-  }
-  to {
-    opacity: 1;
-    transform: none;
-  }
-}
-
-/* The thinking body: the thinking markdown at half opacity, no max height. */
-.ws-thinking-body {
-  opacity: 0.5;
-}
-
-/* A group's steps sit 4px apart inside its muted scope. */
-.ws-group-row__steps {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-1);
-  min-inline-size: 0;
-}
-
-/* --- Tail status --------------------------------------------------------------- */
-
-.ws-tail {
-  display: flex;
-  align-items: baseline;
-  gap: var(--space-1);
-  min-inline-size: 0;
-  font-size: var(--font-size-lg);
-  line-height: var(--line-height-lg);
-  white-space: nowrap;
-}
-
-/* Inside a group the tail sits under the steps, 14px below. */
-.ws-group-row > .ws-tail {
-  margin-block-start: var(--feed-row-gap);
-}
-
-.ws-tail[hidden] {
-  display: none;
-}
-
-.ws-tail__action {
-  flex: none;
-  color: var(--ws-tone-secondary, var(--cursor-text-secondary));
-}
-
-.ws-tail__details {
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  color: var(--ws-tone-tertiary, var(--cursor-text-tertiary));
-}
-
-.ws-tail__details[hidden] {
-  display: none;
-}
-
-.ws-tail__call {
-  color: var(--ws-tone-secondary, var(--cursor-text-secondary));
-}
-
-/* --- Turn footer --------------------------------------------------------------- */
-
-.ws-turn-footer {
-  display: flex;
-  align-items: center;
-  block-size: var(--ws-transcript-footer-height);
-}
-
-.ws-turn-footer__copy {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  inline-size: var(--height-xs);
-  block-size: var(--height-xs);
-  padding: 0;
-  border: none;
-  border-radius: var(--radius-sm);
-  background: none;
-  color: var(--cursor-icon-tertiary);
-  cursor: pointer;
-}
-
-.ws-turn-footer__copy:hover {
-  background: var(--cursor-bg-tertiary);
-  color: var(--cursor-icon-secondary);
-}
-
-.ws-turn-footer__copy:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-turn-footer__copy[data-copied="true"] {
-  color: var(--cursor-green);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .ws-markdown-row--enter {
-    animation: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/turn-footer.ts b/crates/workshop/ui/src/parts/agent/transcript/turn-footer.ts
deleted file mode 100644
index 63a74d8c4..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/turn-footer.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-// The footer under a finished turn: a 28px row with Copy, which puts the
-// turn's replies on the clipboard - the markdown source of each reply,
-// joined by a blank line. The icon swaps to a check for a moment once the
-// copy landed, and the owner raises its confirmation (the toast "Message
-// copied to clipboard") through `onCopied`.
-
-import "./transcript.css";
-
-import { ICON_CHECK, ICON_COPY } from "@workshop/look/icons";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { copyToClipboard } from "../../shared/clipboard";
-
-/** How long the check shows before the copy icon returns. */
-const CHECK_MS = 2000;
-
-/** The Copy footer of one turn. */
-export class TurnFooter implements IDisposable {
-  readonly element: HTMLDivElement;
-
-  private readonly button: HTMLButtonElement;
-  private text = "";
-  private timer: ReturnType<typeof setTimeout> | undefined;
-
-  constructor(private readonly onCopied: () => void) {
-    this.element = document.createElement("div");
-    this.element.className = "ws-turn-footer";
-    this.button = document.createElement("button");
-    this.button.type = "button";
-    this.button.className = "ws-turn-footer__copy";
-    this.button.title = "Copy";
-    this.button.setAttribute("aria-label", "Copy");
-    // Static strings from @workshop/look, never data.
-    this.button.innerHTML = ICON_COPY;
-    this.button.addEventListener("click", () => {
-      void this.copy();
-    });
-    this.element.appendChild(this.button);
-  }
-
-  /** Sets the reply texts the button copies. */
-  update(replies: readonly string[]): void {
-    this.text = replies.join("\n\n");
-  }
-
-  dispose(): void {
-    clearTimeout(this.timer);
-  }
-
-  private async copy(): Promise<void> {
-    if (!(await copyToClipboard(this.text))) {
-      return;
-    }
-    this.button.innerHTML = ICON_CHECK;
-    this.button.dataset["copied"] = "true";
-    clearTimeout(this.timer);
-    this.timer = setTimeout(() => {
-      this.button.innerHTML = ICON_COPY;
-      delete this.button.dataset["copied"];
-    }, CHECK_MS);
-    this.onCopied();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/agent/transcript/web-hover-card.ts b/crates/workshop/ui/src/parts/agent/transcript/web-hover-card.ts
deleted file mode 100644
index 179a19984..000000000
--- a/crates/workshop/ui/src/parts/agent/transcript/web-hover-card.ts
+++ /dev/null
@@ -1,235 +0,0 @@
-// The hover card a web search or fetch line opens: the result titles and
-// URLs behind "Searched web" / "Fetched page". It opens 600ms after the
-// pointer settles on the line, never while the call is still loading,
-// sits below the line's start edge, and closes when the pointer leaves
-// both, on Escape, or when a link is clicked.
-//
-// Everything in a card is untrusted tool output or model-authored
-// arguments. Text lands through textContent, and only `http:` and `https:`
-// URLs become anchors - built like the markdown renderer's `link` method
-// (escaped by the DOM, not draggable, the URL as its own title) - so a
-// `javascript:` or `file:` URL shows as plain text and is never clickable.
-
-import "./tool-line.css";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-
-/** One line of a card: a title over its URL. */
-export interface WebCardEntry {
-  readonly title: string;
-  readonly url: string;
-}
-
-/** The pointer must rest this long on a line before its card opens. */
-export const WEB_CARD_OPEN_DELAY_MS = 600;
-
-/** Leaving a line gives the pointer this long to reach the card before it closes. */
-const CLOSE_GRACE_MS = 120;
-
-/** The gap between a line and its card. */
-const CARD_GAP_PX = 4;
-
-/** The space kept clear of the viewport edge. */
-const EDGE_PX = 8;
-
-function parseJson(text: string): unknown {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return undefined;
-  }
-}
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null;
-}
-
-/**
- * The entries a card lists, or null when there is no card. A search reads
- * its result, `{query, results: [{title, url, description}]}` - one entry
- * per result that carries a URL - and a result that doesn't parse as that
- * shape (or lists nothing) gives no card. A fetch lists the URL it was
- * asked for.
- */
-export function webCardEntries(
-  kind: "search" | "fetch",
-  args: string,
-  result: string | null,
-): WebCardEntry[] | null {
-  if (kind === "fetch") {
-    const url = asRecord(parseJson(args))?.["url"];
-    return typeof url === "string" && url !== "" ? [{ title: url, url }] : null;
-  }
-  if (result === null) {
-    return null;
-  }
-  const results = asRecord(parseJson(result))?.["results"];
-  if (!Array.isArray(results)) {
-    return null;
-  }
-  const entries: WebCardEntry[] = [];
-  for (const candidate of results) {
-    const record = asRecord(candidate);
-    const url = record?.["url"];
-    if (record === null || typeof url !== "string" || url === "") {
-      continue;
-    }
-    const title = record["title"];
-    entries.push({ title: typeof title === "string" && title !== "" ? title : url, url });
-  }
-  return entries.length > 0 ? entries : null;
-}
-
-/** The URL as an anchor target when it is http(s), else null. */
-function webHref(raw: string): string | null {
-  try {
-    const parsed = new URL(raw);
-    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.href : null;
-  } catch {
-    return null;
-  }
-}
-
-/** One card, attached to the line that opens it. */
-export class WebHoverCard implements IDisposable {
-  private entries: readonly WebCardEntry[] | null = null;
-  private disabled = false;
-  private card: HTMLDivElement | null = null;
-  private openTimer: ReturnType<typeof setTimeout> | undefined;
-  private closeTimer: ReturnType<typeof setTimeout> | undefined;
-
-  private readonly onEnter = (): void => {
-    this.clearTimers();
-    if (this.card === null && this.canOpen()) {
-      this.openTimer = setTimeout(() => this.open(), WEB_CARD_OPEN_DELAY_MS);
-    }
-  };
-  private readonly onLeave = (): void => {
-    clearTimeout(this.openTimer);
-    this.scheduleClose();
-  };
-  private readonly onKeydown = (event: KeyboardEvent): void => {
-    if (event.key === "Escape") {
-      this.close();
-    }
-  };
-
-  constructor(private readonly anchor: HTMLElement) {
-    anchor.addEventListener("mouseenter", this.onEnter);
-    anchor.addEventListener("mouseleave", this.onLeave);
-  }
-
-  /** Sets what the card lists; null (or an empty list) means no card. */
-  setEntries(entries: readonly WebCardEntry[] | null): void {
-    this.entries = entries !== null && entries.length > 0 ? entries : null;
-    if (this.entries === null) {
-      this.close();
-    }
-  }
-
-  /** Disables the card while the call is loading. */
-  setDisabled(disabled: boolean): void {
-    this.disabled = disabled;
-    if (disabled) {
-      this.close();
-    }
-  }
-
-  /** Closes the card and cancels a pending open. */
-  close(): void {
-    this.clearTimers();
-    if (this.card === null) {
-      return;
-    }
-    this.card.remove();
-    this.card = null;
-    document.removeEventListener("keydown", this.onKeydown);
-  }
-
-  dispose(): void {
-    this.close();
-    this.anchor.removeEventListener("mouseenter", this.onEnter);
-    this.anchor.removeEventListener("mouseleave", this.onLeave);
-  }
-
-  private canOpen(): boolean {
-    return !this.disabled && this.entries !== null;
-  }
-
-  private clearTimers(): void {
-    clearTimeout(this.openTimer);
-    clearTimeout(this.closeTimer);
-  }
-
-  private scheduleClose(): void {
-    clearTimeout(this.closeTimer);
-    if (this.card !== null) {
-      this.closeTimer = setTimeout(() => this.close(), CLOSE_GRACE_MS);
-    }
-  }
-
-  private open(): void {
-    if (this.card !== null || !this.canOpen() || this.entries === null) {
-      return;
-    }
-    const card = document.createElement("div");
-    card.className = "ws-web-card";
-    card.setAttribute("role", "group");
-    card.setAttribute("aria-label", "Web results");
-    for (const entry of this.entries) {
-      card.appendChild(this.renderEntry(entry));
-    }
-    card.addEventListener("mouseenter", () => clearTimeout(this.closeTimer));
-    card.addEventListener("mouseleave", () => this.scheduleClose());
-    document.body.appendChild(card);
-    this.card = card;
-    document.addEventListener("keydown", this.onKeydown);
-    this.place(card);
-  }
-
-  private renderEntry(entry: WebCardEntry): HTMLElement {
-    const row = document.createElement("div");
-    row.className = "ws-web-card__entry";
-    const href = webHref(entry.url);
-    let title: HTMLElement;
-    if (href === null) {
-      title = document.createElement("span");
-    } else {
-      const link = document.createElement("a");
-      link.href = href;
-      link.title = entry.url;
-      link.draggable = false;
-      // Opening a link ends the card: the system browser takes the click.
-      link.addEventListener("click", () => this.close());
-      title = link;
-    }
-    title.className = "ws-web-card__title";
-    title.textContent = entry.title;
-    const url = document.createElement("span");
-    url.className = "ws-web-card__url";
-    url.textContent = entry.url;
-    row.append(title, url);
-    return row;
-  }
-
-  /** Places the card below the line's start edge, flipped or nudged to stay on screen. */
-  private place(card: HTMLElement): void {
-    const anchor = this.anchor.getBoundingClientRect();
-    const width = card.offsetWidth;
-    const height = card.offsetHeight;
-    const viewportWidth = window.innerWidth;
-    const viewportHeight = window.innerHeight;
-    let left = anchor.left;
-    if (width > 0 && left + width > viewportWidth - EDGE_PX) {
-      left = Math.max(EDGE_PX, viewportWidth - width - EDGE_PX);
-    }
-    let top = anchor.bottom + CARD_GAP_PX;
-    if (height > 0 && top + height > viewportHeight - EDGE_PX && anchor.top - CARD_GAP_PX - height >= EDGE_PX) {
-      top = anchor.top - CARD_GAP_PX - height;
-    }
-    card.style.left = `${left}px`;
-    card.style.top = `${top}px`;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/chat-box-view.ts b/crates/workshop/ui/src/parts/chatbox/chat-box-view.ts
deleted file mode 100644
index 477eb97bd..000000000
--- a/crates/workshop/ui/src/parts/chatbox/chat-box-view.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-// The static draft renderer: a SerializedDraft drawn as read-only DOM
-// with no editor behind it. The feed shows a sent turn through this, so
-// what the operator sees after sending matches what the box showed
-// before - the same pill function, the same paragraph and hard-break
-// structure - at the cost of one DocumentFragment instead of a
-// ProseMirror view. Only the plain-text schema the box produces is
-// rendered: paragraphs, text, hard breaks, and mention chips; anything
-// else in the document is skipped rather than guessed at.
-
-import type { JSONContent } from "@tiptap/core";
-import { renderChip } from "./chip-view";
-import { type ChipNodeAttrs, chipFromAttrs } from "./mention-chip";
-import type { ChipRef, SerializedDraft } from "./types";
-
-/** A pill for read-only display: no remove button, there is nothing to remove. */
-function renderStaticChip(chip: ChipRef): HTMLElement {
-  return renderChip(chip, { removable: false });
-}
-
-/** Appends one inline node's rendering to `paragraph`; unknown node types render nothing. */
-function renderInline(paragraph: HTMLElement, node: JSONContent): void {
-  switch (node.type) {
-    case "text":
-      paragraph.appendChild(document.createTextNode(node.text ?? ""));
-      return;
-    case "hardBreak":
-      paragraph.appendChild(document.createElement("br"));
-      return;
-    case "mentionNode":
-      paragraph.appendChild(renderStaticChip(chipFromAttrs((node.attrs ?? {}) as ChipNodeAttrs)));
-      return;
-    default:
-      return;
-  }
-}
-
-/**
- * Renders a draft as `ws-draft-view`: the attachments strip
- * (`ws-draft-view__strip`, one pill per attachment, present even when
- * empty so the skin can collapse it), then one `ws-draft-view__paragraph`
- * per paragraph node with its text, hard breaks, and inline chips in
- * document order. The fragment holds exactly that one root element.
- */
-export function renderDraft(draft: SerializedDraft): DocumentFragment {
-  const fragment = document.createDocumentFragment();
-  const root = document.createElement("div");
-  root.className = "ws-draft-view";
-
-  const strip = document.createElement("div");
-  strip.className = "ws-draft-view__strip";
-  for (const attachment of draft.attachments) {
-    strip.appendChild(renderStaticChip(attachment));
-  }
-  root.appendChild(strip);
-
-  for (const block of draft.doc.content ?? []) {
-    if (block.type !== "paragraph") {
-      continue;
-    }
-    const paragraph = document.createElement("p");
-    paragraph.className = "ws-draft-view__paragraph";
-    for (const inline of block.content ?? []) {
-      renderInline(paragraph, inline);
-    }
-    root.appendChild(paragraph);
-  }
-
-  fragment.appendChild(root);
-  return fragment;
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/chat-box.css b/crates/workshop/ui/src/parts/chatbox/chat-box.css
deleted file mode 100644
index b9e50f428..000000000
--- a/crates/workshop/ui/src/parts/chatbox/chat-box.css
+++ /dev/null
@@ -1,318 +0,0 @@
-/* ChatBox (src/parts/chatbox/chat-box.ts): the bar, the framed rich-text
-   prompt box, and the box's one round action button. The bar is the card;
-   the frame sits in it; the inner ProseMirror contenteditable takes the
-   type and the JS-driven height, clamped between the min/max tokens. The
-   card copies Cursor's older input box: a 12px radius, 8/10/6 padding, and
-   the fill of the input color at 90%. */
-
-.ws-agent-session__bar {
-  display: flex;
-  flex-direction: column;
-  align-items: stretch;
-  /* 9px between the editor and the toolbar row under it. */
-  gap: var(--ws-composer-toolbar-gap);
-  padding: var(--space-2) var(--space-2-5) var(--space-1-5);
-  background: var(--prompt-input-bg);
-  border: var(--ws-border-width) solid var(--prompt-input-border);
-  border-radius: var(--agent-card-radius);
-  /* Border and shadow ease over 100ms. */
-  transition:
-    border-color var(--duration-fast) ease-in-out,
-    box-shadow var(--duration-fast) ease-in-out;
-  /* The error popup docks on the card's top edge, outside its box. */
-  position: relative;
-  /* The toolbar's breakpoints (mode label, context ring) follow the
-     card's own width, not the viewport's. */
-  container: ws-composer / inline-size;
-}
-
-.ws-agent-session__bar:focus-within {
-  border-color: var(--prompt-input-border-focus);
-}
-
-/* The error popup, docked on the card's top edge: the warning glyph and
-   the title over the message, and a right-aligned Try again below. */
-.ws-chat-error {
-  position: absolute;
-  inset-inline: calc(-1 * var(--ws-border-width));
-  inset-block-end: calc(100% - var(--ws-border-width));
-  display: grid;
-  grid-template-columns: auto 1fr;
-  column-gap: var(--space-2);
-  padding: var(--space-3);
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-lg) var(--radius-lg) 0 0;
-  background: color-mix(in srgb, var(--cursor-base) 2.5%, var(--cursor-bg-elevated));
-  color: var(--cursor-text-primary);
-}
-
-.ws-chat-error__icon {
-  grid-column: 1;
-  grid-row: 1;
-  display: inline-flex;
-  color: var(--cursor-yellow);
-}
-
-.ws-chat-error__title {
-  grid-column: 2;
-  grid-row: 1;
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-sm);
-  font-weight: var(--font-weight-medium);
-}
-
-.ws-chat-error__message {
-  grid-column: 2;
-  grid-row: 2;
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-sm);
-  color: var(--cursor-text-secondary);
-  overflow-wrap: anywhere;
-}
-
-.ws-chat-error__retry {
-  grid-column: 2;
-  grid-row: 3;
-  justify-self: end;
-  margin-block-start: var(--space-1-5);
-}
-
-.ws-chat-error__retry[hidden] {
-  display: none;
-}
-
-/* The prompt box owns the row's remaining width. */
-.ws-agent-session__bar > .ws-prompt-input {
-  flex: 1;
-  min-inline-size: 0;
-}
-
-.ws-prompt-input {
-  transition: border-color var(--duration-fast) var(--ease-out-cubic);
-}
-
-/* The attachments strip above the text: empty in this plan, so it costs
-   no height until the paste feature fills it. */
-.ws-prompt-input__attachments {
-  display: flex;
-  flex-wrap: wrap;
-  gap: var(--space-1);
-  margin-block-end: var(--space-1);
-}
-
-.ws-prompt-input__attachments:empty {
-  display: none;
-}
-
-.ws-prompt-input__editor {
-  min-block-size: var(--prompt-input-min-height);
-  max-block-size: var(--prompt-input-max-height);
-  overflow-y: auto;
-  padding: 0;
-  /* 14px/22px with no letter-spacing, like the transcript's own text. */
-  font-size: var(--font-size-lg);
-  line-height: var(--line-height-lg);
-  letter-spacing: normal;
-  color: var(--text);
-}
-
-.ws-prompt-input__editor:focus-visible {
-  outline: none;
-}
-
-/* Non-editable is the contenteditable equivalent of disabled. */
-.ws-prompt-input__editor[contenteditable="false"] {
-  color: var(--text);
-}
-
-/* The global reset does not zero paragraph margins; inside the editor a
-   paragraph per newline must not add leading. */
-.ws-prompt-input__editor p {
-  margin: 0;
-}
-
-/* The Placeholder extension marks an empty document's paragraph with
-   is-editor-empty and a data-placeholder attribute; the text is CSS-only. */
-.ws-prompt-input__editor p.is-editor-empty:first-child::before {
-  content: attr(data-placeholder);
-  float: inline-start;
-  block-size: 0;
-  pointer-events: none;
-  color: var(--input-placeholder);
-  opacity: 0.5;
-}
-
-/* TentativeMark (src/parts/chatbox/tentative-mark.ts): a live dictation
-   take's tentative words, which the next hypothesis may still rewrite. */
-.ws-stt-tentative {
-  color: var(--text-muted);
-  opacity: 0.5;
-}
-
-/* The action button: one round control, the mic, the send arrow, or Stop
-   (data-state). The send arrow and Stop take their fill from the agent
-   mode (data-mode) and a #141414 glyph; the mic is a 66% fill under a
-   #181818 glyph. The glyph is 14px. */
-.ws-agent-session__action {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  inline-size: var(--height-xs);
-  block-size: var(--height-xs);
-  padding: 0;
-  color: var(--cursor-chrome);
-  background: var(--cursor-base);
-  border: none;
-  border-radius: var(--radius-full);
-  cursor: pointer;
-}
-
-.ws-agent-session__action svg {
-  inline-size: var(--ws-composer-action-glyph);
-  block-size: var(--ws-composer-action-glyph);
-}
-
-.ws-agent-session__action:focus-visible {
-  outline: none;
-  opacity: 0.85;
-}
-
-/* The mic. */
-.ws-agent-session__action[data-state="mic"] {
-  color: var(--cursor-editor);
-  background: var(--cursor-icon-secondary);
-}
-
-/* The mode fills, for the send arrow and Stop. Agent is the base above. */
-.ws-agent-session__action[data-state="send"][data-mode="plan"],
-.ws-agent-session__action[data-state="stop"][data-mode="plan"] {
-  background: var(--cursor-yellow);
-}
-
-.ws-agent-session__action[data-state="send"][data-mode="ask"],
-.ws-agent-session__action[data-state="stop"][data-mode="ask"] {
-  background: var(--cursor-green);
-}
-
-.ws-agent-session__action[data-state="send"][data-mode="debug"],
-.ws-agent-session__action[data-state="stop"][data-mode="debug"],
-.ws-agent-session__action[data-state="send"][data-mode="multitask"],
-.ws-agent-session__action[data-state="stop"][data-mode="multitask"] {
-  background: color-mix(in srgb, var(--cursor-base) 80%, transparent);
-}
-
-/* Disabled keeps the fill and drops to 30%. */
-.ws-agent-session__action:disabled {
-  opacity: 0.3;
-  cursor: default;
-}
-
-/* Recording mic: a steady danger fill with a matching ring and bloom. The
-   ring and bloom keep recording visible without changing normal hover. The
-   compound selector outranks the mic's own fill above. */
-.ws-agent-session__action.ws-stt-mic--recording {
-  color: var(--on-danger);
-  background: var(--danger);
-  border-radius: 50%;
-  box-shadow: var(--ws-stt-mic-shadow);
-}
-
-.ws-agent-session__action.ws-stt-mic--recording:hover:not(:disabled) {
-  box-shadow: var(--ws-stt-mic-shadow-recording);
-}
-
-/* MentionChip (src/parts/chatbox/mention-chip.ts): the inline pill for an
-   @-referenced file: a 6px radius, padding 1px 4px, a 24% blue fill, and a
-   label of at most 200px. The icon and the remove button share the pill's
-   first grid cell, so the close X can take the icon's place without
-   moving anything: only while the editor holds focus and the pill is
-   hovered (or the X itself has keyboard focus). */
-.ws-mention-chip {
-  display: inline-grid;
-  grid-template-columns: auto minmax(0, 1fr);
-  align-items: center;
-  column-gap: var(--space-1);
-  padding: var(--ws-size-1) var(--space-1);
-  border-radius: var(--radius);
-  background: var(--mention-bg);
-  color: var(--mention-text);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  white-space: nowrap;
-}
-
-.ws-mention-chip__icon {
-  grid-area: 1 / 1;
-  display: inline-flex;
-}
-
-.ws-mention-chip__label {
-  grid-area: 1 / 2;
-  min-inline-size: 0;
-  max-inline-size: var(--ws-prompt-chip-label-max-width);
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.ws-mention-chip__remove {
-  grid-area: 1 / 1;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  padding: 0;
-  border: 0;
-  border-radius: var(--radius-sm);
-  background: transparent;
-  color: inherit;
-  /* Hidden and inert until revealed: the button sits over the icon, so a
-     click on the icon of a pill in an unfocused editor must not reach it. */
-  cursor: default;
-  opacity: 0;
-  pointer-events: none;
-}
-
-.ws-prompt-input__editor.ProseMirror-focused .ws-mention-chip:hover .ws-mention-chip__icon {
-  opacity: 0;
-}
-
-.ws-prompt-input__editor.ProseMirror-focused .ws-mention-chip:hover .ws-mention-chip__remove,
-.ws-mention-chip__remove:focus-visible {
-  cursor: pointer;
-  opacity: 1;
-  pointer-events: auto;
-}
-
-.ws-mention-chip__remove:focus-visible {
-  outline: none;
-  background: var(--bg-hover);
-}
-
-/* renderDraft (src/parts/chatbox/chat-box-view.ts): the read-only
-   rendering of a serialized draft - the attachments strip, then one
-   paragraph per paragraph node. Minimal rules so the fragment stands
-   alone; the feed's own styling arrives with the feature that uses it. */
-.ws-draft-view {
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  letter-spacing: var(--letter-spacing-base);
-  color: var(--text);
-  white-space: pre-wrap;
-  overflow-wrap: anywhere;
-}
-
-.ws-draft-view__strip {
-  display: flex;
-  flex-wrap: wrap;
-  gap: var(--space-1);
-  margin-block-end: var(--space-1);
-}
-
-/* An empty strip costs no height. */
-.ws-draft-view__strip:empty {
-  display: none;
-}
-
-.ws-draft-view__paragraph {
-  margin: 0;
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/chat-box.ts b/crates/workshop/ui/src/parts/chatbox/chat-box.ts
deleted file mode 100644
index db5674524..000000000
--- a/crates/workshop/ui/src/parts/chatbox/chat-box.ts
+++ /dev/null
@@ -1,863 +0,0 @@
-// The chat box: a Tiptap/ProseMirror editor framed on a bar with one round
-// action button. The schema is deliberately minimal - paragraphs,
-// text, and hard breaks - so what the operator types is plain text with
-// newlines; richer nodes (mention chips) join as extensions on top of
-// this base. Enter emits `send`, and so does Ctrl+Enter; an Enter that
-// commits an IME composition never does, and neither does an auto-repeat
-// Enter; Shift+Enter inserts a hard break. The box grows with its
-// content: every edit re-measures scrollHeight and clamps it between the
-// skin's min/max height tokens.
-//
-// The action button is the mic while the box is empty and the agent idle,
-// the send arrow once there is text, and Stop over an empty box while the
-// agent generates (`action: "stop"`), where text in the box turns it back
-// into the send arrow for a follow-up; a recording mic keeps the button on
-// the mic so a second press can end the take. The agent mode picks the
-// fill of the send and stop states. While generating, the placeholder
-// reads "Add a follow-up".
-//
-// The component is isolated: props in (every one defaulted), events out
-// through one sink, an imperative handle for the owning part and for
-// dictation. It reaches no service registry - the text-control registrar is
-// injected - and imports nothing from the embedding layers. Every prop-driven
-// state is mirrored onto the DOM as a data attribute beside the classes
-// the skin already relies on. The `@` typeahead's items come from the
-// injected mentionSource (a three-item stub by default) through the
-// ProseMirror suggestion plugin, which owns the debounce, the abort, and
-// the stale-result guard; the box only forwards the plugin's signal.
-// An `error` prop opens a popup docked on the card's top edge - a warning
-// glyph, a title over a message, and an optional Try again, whose press the
-// box reports as a `retry` event for the owning part to act on.
-
-import "./chat-box.css";
-
-import { Editor, type JSONContent } from "@tiptap/core";
-import { Placeholder } from "@tiptap/extension-placeholder";
-import { closeHistory, redoDepth, undoDepth } from "@tiptap/pm/history";
-import { Slice } from "@tiptap/pm/model";
-import { StarterKit } from "@tiptap/starter-kit";
-import type { EditorState } from "@tiptap/pm/state";
-import { Disposable, type IDisposable, toDisposable } from "@workshop/platform/lifecycle";
-import { ICON_MIC, ICON_SEND, ICON_STOP_CIRCLE, ICON_WARNING } from "@workshop/look/icons";
-import { renderChip } from "./chip-view";
-import {
-  attrsFromChip,
-  type ChipNodeAttrs,
-  chipFromAttrs,
-  MentionChip,
-  MentionSuggestionPluginKey,
-} from "./mention-chip";
-import { setTentativeMark, TentativeMark } from "./tentative-mark";
-import { renderMentionTypeahead } from "./typeahead-popup";
-import type {
-  ChatBoxDynamicProps,
-  ChatBoxError,
-  ChatBoxEventSink,
-  ChatBoxHandle,
-  ChatBoxProps,
-  ChipRef,
-  ChipSource,
-  SerializedDraft,
-} from "./types";
-
-// The fallbacks mirror the token defaults in @workshop/look/tokens.css; they
-// apply when the skin is absent (tests) or the token is deleted. The editor
-// grows from one 22px line to 240px.
-const DEFAULT_MIN_HEIGHT_PX = 22;
-const DEFAULT_MAX_HEIGHT_PX = 240;
-
-/** The placeholder while the agent generates; otherwise the owning part's. */
-const FOLLOW_UP_PLACEHOLDER = "Add a follow-up";
-
-// The ProseMirror suggestion plugin waits this long after the last
-// keystroke before asking the source, and aborts the in-flight query when
-// a newer one arrives; the box adds no timing logic of its own.
-const MENTION_DEBOUNCE_MS = 60;
-
-// STUB for the future workspace file index: three canned entries keep
-// the popup's open/filter/select cycle working until the owning part
-// supplies a mentionSource.
-const STUB_CHIPS: readonly ChipRef[] = [
-  { id: "README.md", label: "README.md", kind: "file", data: null },
-  { id: "src/main.ts", label: "src/main.ts", kind: "file", data: null },
-  { id: "Cargo.toml", label: "Cargo.toml", kind: "file", data: null },
-];
-
-/**
- * The default `@` source: the stub entries filtered by case-insensitive
- * substring match on the label. Exported so the stub's shape is pinned
- * by a test rather than by the popup it happens to fill.
- */
-export const stubMentionSource: ChipSource = (query) => {
-  const needle = query.toLowerCase();
-  return Promise.resolve(STUB_CHIPS.filter((chip) => chip.label.toLowerCase().includes(needle)));
-};
-
-/** The `/` source until commands arrive: nothing, so a typed `/` stays text. */
-const NO_COMMANDS: ChipSource = () => Promise.resolve([]);
-
-/**
- * Whether a typeahead session owns the keyboard: editorProps handlers
- * run before the ProseMirror suggestion state plugin's, so the box's
- * Enter and Tab handling must yield while a trigger's session is active
- * or the send would fire instead of the selection. One key today (`@`);
- * the `/` trigger joins this list when it is wired.
- */
-function suggestionActive(state: EditorState): boolean {
-  return MentionSuggestionPluginKey.getState(state)?.active === true;
-}
-
-/**
- * Clamps a measured content height into the input's height band.
- * Exported so tests can pin the band logic directly: jsdom reports a
- * scrollHeight of 0, so the measurement itself cannot be exercised there.
- */
-export function clampPromptInputHeight(
-  contentHeight: number,
-  minHeight: number,
-  maxHeight: number,
-): number {
-  return Math.min(Math.max(contentHeight, minHeight), maxHeight);
-}
-
-/** Reads a pixel-valued skin token, falling back when unset or unparseable. */
-function readPixelToken(element: HTMLElement, token: string, fallback: number): number {
-  // Read at the document root: the tokens are global (:root), and
-  // reading a custom property off a deep element hits jsdom's uncached,
-  // ancestor-recursing custom-property resolution - exponential in DOM
-  // depth (https://github.com/jsdom/jsdom/issues/3234).
-  const parsed = Number.parseFloat(
-    getComputedStyle(element.ownerDocument.documentElement).getPropertyValue(token),
-  );
-  return Number.isFinite(parsed) ? parsed : fallback;
-}
-
-/** The resolved dynamic props: what `update()` drives and `props` reads back. */
-type ResolvedDynamicProps = {
-  -readonly [K in keyof ChatBoxDynamicProps]-?: ChatBoxDynamicProps[K];
-};
-
-/** What the one round button is right now. */
-type ActionState = "mic" | "send" | "stop";
-
-// The button's tooltip per state. A blocked mic reads as an idle one,
-// because the press is what names the blocker.
-const SEND_TITLE = "Send";
-const STOP_TITLE = "Stop (Ctrl+Shift+Backspace)";
-const MIC_TITLE = "Voice Input (Ctrl+Shift+Space)";
-const MIC_RECORDING_TITLE = "Stop recording";
-
-/** The glyph per state: static strings from @workshop/look, never data. */
-const ACTION_ICON: Readonly<Record<ActionState, string>> = {
-  mic: ICON_MIC,
-  send: ICON_SEND,
-  stop: ICON_STOP_CIRCLE,
-};
-
-/** The popup's title when the owning part gives none. */
-const DEFAULT_ERROR_TITLE = "Connection Error";
-
-/** Whether two error props paint the same popup. */
-function sameError(a: ChatBoxError | null, b: ChatBoxError | null): boolean {
-  if (a === null || b === null) {
-    return a === b;
-  }
-  return a.title === b.title && a.message === b.message && a.tryAgain === b.tryAgain;
-}
-
-/** The popup's parts, kept so an update touches only what changed. */
-interface ErrorPopup {
-  readonly element: HTMLDivElement;
-  readonly title: HTMLDivElement;
-  readonly message: HTMLDivElement;
-  readonly retry: HTMLButtonElement;
-}
-
-/**
- * The chat box: the bar (`ws-agent-session__bar`) holding the framed
- * editor, an optional controls element the owning part supplies, and
- * the box's own round action button. Disposable: dispose() destroys
- * the editor, releases the text-control registration, and takes its
- * button back out of the controls element it was handed.
- *
- * The handle is a structural superset of dictation's input target:
- * dictation splices the transcript in through insertionContext and
- * replaceRange, puts a take's captured selection back through
- * restoreRange, parks the cursor at a take's end through setSelection,
- * styles a take's tentative words through setTentativeRange, and holds
- * the box with setReadOnly. Offsets are ProseMirror positions.
- */
-export class ChatBox extends Disposable implements ChatBoxHandle {
-  /** The bar; append it where the composer belongs. */
-  readonly element: HTMLDivElement;
-
-  private readonly frame: HTMLDivElement;
-  private readonly strip: HTMLDivElement;
-  private readonly button: HTMLButtonElement;
-  private readonly editor: Editor;
-  private readonly onEvent: ChatBoxEventSink;
-  private readonly variant: NonNullable<ChatBoxProps["variant"]>;
-  private readonly dynamic: ResolvedDynamicProps;
-  private errorPopup: ErrorPopup | null = null;
-  private attachments: ChipRef[] = [];
-  // Held for the `/` trigger, which is not wired to a ProseMirror plugin
-  // in this plan: a typed `/` stays text. The seam exists so the owning
-  // part's source is in place when the command chip arrives.
-  private readonly commandSource: ChipSource;
-
-  // Two locks, one property: the owning part's gate (the editable prop)
-  // and a dictation take (setReadOnly) both map onto contenteditable,
-  // because ProseMirror has no separate readOnly. Each side keeps its own
-  // flag so one lock lifting never reopens the other - a take that
-  // outlives the owner's gate must not leave the box editable against it.
-  private takeReadOnly = false;
-
-  // Whether the editor holds no text and no pill: an empty box shows the
-  // mic on the action button. Kept current by every transaction once the
-  // editor is mounted.
-  private empty = true;
-  private mounted = false;
-  // The state the button currently draws, so a render swaps the glyph
-  // only when the state changes.
-  private drawnState: ActionState | null = null;
-
-  constructor(props: ChatBoxProps = {}, onEvent: ChatBoxEventSink = () => {}) {
-    super();
-    this.onEvent = onEvent;
-    this.variant = props.variant ?? "expanded";
-    this.dynamic = {
-      editable: props.editable ?? true,
-      action: props.action ?? "send",
-      mic: props.mic ?? "idle",
-      mode: props.mode ?? "agent",
-      error: props.error ?? null,
-    };
-    const idlePlaceholder = props.placeholder ?? "";
-    this.commandSource = props.commandSource ?? NO_COMMANDS;
-    const mentionSource = props.mentionSource ?? stubMentionSource;
-
-    this.element = document.createElement("div");
-    this.element.className = "ws-agent-session__bar";
-    this.element.dataset["variant"] = this.variant;
-
-    this.frame = document.createElement("div");
-    this.frame.className = "ws-prompt-input";
-    // The strip goes in before the editor mounts, so the ProseMirror
-    // content element lands after it: attachments above the text.
-    this.strip = document.createElement("div");
-    this.strip.className = "ws-prompt-input__attachments";
-    this.frame.appendChild(this.strip);
-
-    // One round button is the mic, the send arrow, or Stop; renderAction
-    // paints whichever the state calls for.
-    this.button = document.createElement("button");
-    this.button.type = "button";
-    this.button.className = "ws-agent-session__action";
-    this.button.addEventListener("click", () => this.pressAction());
-
-    // Two bar shapes, one owner: with a controls element the button
-    // trails the owning part's toolbar; without one it sits on the bar. The
-    // button is the box's in both cases.
-    if (props.controls !== undefined) {
-      props.controls.append(this.button);
-      this.element.append(this.frame, props.controls);
-      const controls = props.controls;
-      this._register(
-        toDisposable(() => {
-          if (this.button.parentElement === controls) {
-            this.button.remove();
-          }
-        }),
-      );
-    } else {
-      this.element.append(this.frame, this.button);
-    }
-
-    this.editor = new Editor({
-      element: this.frame,
-      extensions: [
-        // Plain-text schema: everything in StarterKit is off except the
-        // document scaffolding (document, paragraph, text, gapcursor),
-        // hardBreak, whose Shift-Enter binding supplies newlines, and
-        // undoRedo, whose ProseMirror history plugin backs the text-control
-        // adapter's undo/redo (its Mod-z keymap never fires in the app:
-        // the keybinding dispatcher claims the chord in the capture
-        // phase).
-        StarterKit.configure({
-          blockquote: false,
-          bold: false,
-          bulletList: false,
-          code: false,
-          codeBlock: false,
-          dropcursor: false,
-          heading: false,
-          horizontalRule: false,
-          italic: false,
-          link: false,
-          listItem: false,
-          listKeymap: false,
-          orderedList: false,
-          strike: false,
-          trailingNode: false,
-          underline: false,
-        }),
-        Placeholder.configure({
-          // Re-read on every state update: the follow-up text while the
-          // agent generates, the owning part's text otherwise.
-          placeholder: () => {
-            if (this.dynamic.action === "stop") {
-              return FOLLOW_UP_PLACEHOLDER;
-            }
-            return typeof idlePlaceholder === "function" ? idlePlaceholder() : idlePlaceholder;
-          },
-          // The gated (non-editable) box still shows its placeholder,
-          // same as a disabled textarea: the gate's "the agent is
-          // working" message IS the non-editable state.
-          showOnlyWhenEditable: false,
-        }),
-        // Inline mention pills (@-referenced chips) with this box's
-        // source and the typeahead popup wired into the extension's
-        // suggestion seam. The ProseMirror plugin owns the async handling: it
-        // debounces, hands the source an AbortSignal it fires on a
-        // newer keystroke, discards a stale resolution, and reports
-        // `loading` to the popup. minQueryLength 0 means a bare `@`
-        // shows results.
-        MentionChip.configure({
-          suggestion: {
-            items: ({ query, signal }) => mentionSource(query, signal),
-            render: renderMentionTypeahead,
-            debounce: MENTION_DEBOUNCE_MS,
-            minQueryLength: 0,
-          },
-        }),
-        TentativeMark,
-      ],
-      content: props.content ?? "",
-      editable: this.dynamic.editable,
-      editorProps: {
-        attributes: {
-          class: "ws-prompt-input__editor",
-          role: "textbox",
-          "aria-label": props.ariaLabel ?? "Message",
-          "aria-multiline": "true",
-          // The prompt is not prose to be corrected or capitalized.
-          spellcheck: "false",
-          autocapitalize: "off",
-        },
-        handleKeyDown: (view, event) => {
-          // An open typeahead owns Enter and Tab - both insert the highlighted
-          // item - so the box yields them to the ProseMirror plugin.
-          if ((event.key === "Enter" || event.key === "Tab") && suggestionActive(view.state)) {
-            return false;
-          }
-          if (event.key !== "Enter" || event.shiftKey) {
-            return false;
-          }
-          // An Enter that commits an IME composition is not a send:
-          // without the isComposing guard the box would submit
-          // half-composed text. Claimed, not passed on: the keymap would
-          // otherwise split the paragraph under the composition. A held
-          // Enter is claimed the same way - only its first press sends, so
-          // a held key never sends twice or splits the paragraph.
-          if (event.isComposing || event.repeat) {
-            return true;
-          }
-          // Enter and Ctrl+Enter both send; only Shift+Enter, above, is a newline.
-          this.emitSend();
-          return true;
-        },
-      },
-      onUpdate: () => {
-        this.syncHeight();
-      },
-      // Every transaction, including a whole-content replace that onUpdate
-      // skips, can empty or fill the box, which flips the button's state.
-      onTransaction: () => {
-        this.syncEmpty();
-      },
-    });
-    // prosemirror-view drops keydown events for a non-editable editor
-    // before any handleKeyDown prop runs (its editHandlers gate), so the
-    // submit above never fires while a dictation take holds the box
-    // read-only - yet an Enter there is still a send, submitting what the
-    // box shows. Listen at the frame for exactly that case; the editable
-    // case belongs to the editorProps handler.
-    this.frame.addEventListener("keydown", (event) => {
-      if (this.editor.isEditable) {
-        return;
-      }
-      if (event.key === "Enter" && !event.shiftKey && !event.isComposing) {
-        event.preventDefault();
-        if (!event.repeat) {
-          this.emitSend();
-        }
-      }
-    });
-    this._register(
-      toDisposable(() => {
-        this.editor.destroy();
-      }),
-    );
-    // The box is its own text-control adapter: the Edit menu's
-    // undo/redo/select-all route here whenever the box holds focus. The
-    // adapter registers only when the owning part supplied a registrar
-    // and the ProseMirror history plugin is present - without it the
-    // commands would no-op, and the native execCommand fallback is the
-    // better path. canUndo/canRedo read the history depth so an empty
-    // stack falls back instead of swallowing the command.
-    const hasHistory = this.editor.extensionManager.extensions.some(
-      (extension) => extension.name === "undoRedo",
-    );
-    if (hasHistory && props.textControls !== undefined) {
-      const registration: IDisposable = props.textControls(this.frame, {
-        kind: "prosemirror",
-        undo: () => {
-          this.editor.commands.undo();
-        },
-        redo: () => {
-          this.editor.commands.redo();
-        },
-        selectAll: () => {
-          this.editor.commands.selectAll();
-        },
-        canUndo: () => undoDepth(this.editor.state) > 0,
-        canRedo: () => redoDepth(this.editor.state) > 0,
-      });
-      this._register(registration);
-    }
-    this.mounted = true;
-    this.empty = this.getText() === "";
-    this.renderEditable();
-    this.renderAction();
-    this.renderError();
-    const initialMeasure = window.requestAnimationFrame(() => this.syncHeight());
-    this._register(toDisposable(() => window.cancelAnimationFrame(initialMeasure)));
-  }
-
-  /** The resolved dynamic props plus the variant, defaults applied. */
-  get props(): Readonly<ResolvedDynamicProps & Pick<ChatBoxProps, "variant">> {
-    return { ...this.dynamic, variant: this.variant };
-  }
-
-  /**
-   * Merges a partial set of dynamic props and re-renders only what
-   * changed: an unchanged value touches no DOM. Construction-only props
-   * are not accepted here by type.
-   */
-  update(props: Partial<ChatBoxDynamicProps>): void {
-    if (props.editable !== undefined && props.editable !== this.dynamic.editable) {
-      this.dynamic.editable = props.editable;
-      this.renderEditable();
-    }
-    let actionChanged = false;
-    if (props.action !== undefined && props.action !== this.dynamic.action) {
-      const wasStop = this.dynamic.action === "stop";
-      this.dynamic.action = props.action;
-      actionChanged = true;
-      if (wasStop !== (props.action === "stop")) {
-        // The placeholder follows the generating state, and ProseMirror
-        // redraws it only on a state update: an empty transaction is one.
-        this.editor.view.dispatch(this.editor.state.tr);
-      }
-    }
-    if (props.mic !== undefined && props.mic !== this.dynamic.mic) {
-      this.dynamic.mic = props.mic;
-      actionChanged = true;
-    }
-    if (props.mode !== undefined && props.mode !== this.dynamic.mode) {
-      this.dynamic.mode = props.mode;
-      actionChanged = true;
-    }
-    if (actionChanged) {
-      this.renderAction();
-    }
-    if (props.error !== undefined && !sameError(props.error, this.dynamic.error)) {
-      this.dynamic.error = props.error;
-      this.renderError();
-    }
-  }
-
-  /**
-   * What the one round button is: the mic while the box is empty, the send
-   * arrow once it has text, and Stop over an empty box while the agent
-   * generates. A recording mic stays the mic whatever the box holds, so its
-   * second press can end the take.
-   */
-  private actionState(): ActionState {
-    if (this.dynamic.mic === "recording") {
-      return "mic";
-    }
-    if (this.empty) {
-      return this.dynamic.action === "stop" ? "stop" : "mic";
-    }
-    return "send";
-  }
-
-  /** The button's press: the mic presses, Stop stops, the send arrow sends. */
-  private pressAction(): void {
-    const state = this.actionState();
-    switch (state) {
-      case "mic":
-        this.onEvent({ type: "mic-press" });
-        return;
-      case "stop":
-        this.onEvent({ type: "stop" });
-        return;
-      case "send":
-        this.emitSend();
-        return;
-      default: {
-        const exhaustive: never = state;
-        return exhaustive;
-      }
-    }
-  }
-
-  /**
-   * The send button's press and the submitting Enter share this path:
-   * `idle` is silent, `stop` is silent over an empty box (Stop is the
-   * button's alone) and sends a follow-up once the box holds text, and
-   * both send states emit `send`, `send-blocked` included, so the owning
-   * part can name the blocker.
-   */
-  private emitSend(): void {
-    switch (this.dynamic.action) {
-      case "idle":
-        return;
-      case "stop":
-        if (!this.empty) {
-          this.sendContents();
-        }
-        return;
-      case "send":
-      case "send-blocked":
-        this.sendContents();
-        return;
-      default: {
-        const exhaustive: never = this.dynamic.action;
-        return exhaustive;
-      }
-    }
-  }
-
-  /** Emits `send` with the box's text, pills, and attachments. */
-  private sendContents(): void {
-    this.onEvent({
-      type: "send",
-      text: this.getText(),
-      mentions: this.mentions(),
-      attachments: [...this.attachments],
-    });
-  }
-
-  /** Re-reads whether the box is empty; a change repaints the button. */
-  private syncEmpty(): void {
-    if (!this.mounted) {
-      return;
-    }
-    const empty = this.getText() === "";
-    if (empty !== this.empty) {
-      this.empty = empty;
-      this.renderAction();
-    }
-  }
-
-  /** The pills in the document, in order, as the chips they were inserted from. */
-  private mentions(): ChipRef[] {
-    const chips: ChipRef[] = [];
-    this.editor.state.doc.descendants((node) => {
-      if (node.type.name === "mentionNode") {
-        // The schema's own attribute definitions are the only writers,
-        // so the open record narrows to what the extension declares.
-        chips.push(chipFromAttrs(node.attrs as ChipNodeAttrs));
-      }
-      return true;
-    });
-    return chips;
-  }
-
-  /** Applies both locks to the editor and mirrors the effective state onto the frame. */
-  private renderEditable(): void {
-    const effective = this.dynamic.editable && !this.takeReadOnly;
-    if (this.editor.isEditable !== effective) {
-      this.editor.setEditable(effective);
-    }
-    this.frame.dataset["editable"] = String(effective);
-  }
-
-  /**
-   * Paints the round button for its current state. `data-state` names it
-   * (mic, send, or stop), `data-action`, `data-mic`, and `data-mode`
-   * mirror the props, and the glyph, name, and tooltip follow the state.
-   * Only the send arrow can be disabled: an idle agent with text in the
-   * box dims it, while the mic and Stop always answer a press.
-   */
-  private renderAction(): void {
-    const state = this.actionState();
-    const { action, mic, mode } = this.dynamic;
-    const recording = mic === "recording";
-    const button = this.button;
-    button.dataset["state"] = state;
-    button.dataset["action"] = action;
-    button.dataset["mic"] = mic;
-    button.dataset["mode"] = mode;
-    button.classList.toggle("ws-stt-mic--recording", recording);
-    button.disabled = state === "send" && action === "idle";
-    button.setAttribute("aria-disabled", String(state === "send" && action === "send-blocked"));
-    if (state === "mic") {
-      button.setAttribute("aria-label", "Push to talk");
-      button.setAttribute("aria-pressed", String(recording));
-      button.title = recording ? MIC_RECORDING_TITLE : MIC_TITLE;
-    } else {
-      button.removeAttribute("aria-pressed");
-      button.setAttribute("aria-label", state === "stop" ? "Stop" : "Send");
-      button.title = state === "stop" ? STOP_TITLE : SEND_TITLE;
-    }
-    if (this.drawnState !== state) {
-      this.drawnState = state;
-      button.innerHTML = ACTION_ICON[state];
-    }
-  }
-
-  /**
-   * Paints the error popup docked on the card's top edge: the warning
-   * glyph, the title (default "Connection Error") over the message, and,
-   * when offered, a right-aligned Try again that is disabled until the
-   * owning part enables it. The text is the owning part's and lands
-   * through textContent.
-   */
-  private renderError(): void {
-    const error = this.dynamic.error;
-    if (error === null) {
-      this.errorPopup?.element.remove();
-      this.errorPopup = null;
-      return;
-    }
-    if (this.errorPopup === null) {
-      this.errorPopup = this.buildErrorPopup();
-      this.element.prepend(this.errorPopup.element);
-    }
-    const popup = this.errorPopup;
-    popup.title.textContent = error.title ?? DEFAULT_ERROR_TITLE;
-    popup.message.textContent = error.message;
-    popup.retry.hidden = error.tryAgain === undefined;
-    popup.retry.disabled = error.tryAgain !== "enabled";
-  }
-
-  private buildErrorPopup(): ErrorPopup {
-    const element = document.createElement("div");
-    element.className = "ws-chat-error";
-    element.setAttribute("role", "alert");
-    const icon = document.createElement("span");
-    icon.className = "ws-chat-error__icon";
-    icon.setAttribute("aria-hidden", "true");
-    // A static string from @workshop/look, never data.
-    icon.innerHTML = ICON_WARNING;
-    const title = document.createElement("div");
-    title.className = "ws-chat-error__title";
-    const message = document.createElement("div");
-    message.className = "ws-chat-error__message";
-    const retry = document.createElement("button");
-    retry.type = "button";
-    retry.className = "button button-secondary button-sm ws-chat-error__retry";
-    retry.textContent = "Try again";
-    retry.addEventListener("click", () => this.onEvent({ type: "retry" }));
-    element.append(icon, title, message, retry);
-    return { element, title, message, retry };
-  }
-
-  /** The prompt as plain text: paragraphs and hard breaks as single newlines. */
-  getText(): string {
-    return this.editor.getText({ blockSeparator: "\n" });
-  }
-
-  /** Empties the editor; the update hook re-clamps the height. */
-  clear(): void {
-    this.editor.commands.clearContent();
-  }
-
-  /**
-   * Replaces the content with plain text (one paragraph per newline) and
-   * leaves the cursor at the end. Built as JSON, never HTML-parsed, so
-   * the text lands verbatim.
-   */
-  setText(text: string): void {
-    const content: JSONContent = {
-      type: "doc",
-      content: text.split("\n").map((line) => ({
-        type: "paragraph",
-        content: line === "" ? undefined : [{ type: "text", text: line }],
-      })),
-    };
-    this.editor.commands.setContent(content);
-    this.editor.commands.setTextSelection(this.editor.state.doc.content.size - 1);
-  }
-
-  /**
-   * Captures the ProseMirror selection, its content as slice JSON for
-   * restoreRange, and its target-owned insertion policy.
-   */
-  insertionContext(): ReturnType<ChatBoxHandle["insertionContext"]> {
-    const { from, to } = this.editor.state.selection;
-    const document = this.editor.state.doc;
-    return {
-      range: { start: from, end: to },
-      original: document.textBetween(from, to, "\n", "\n"),
-      content: document.slice(from, to).toJSON(),
-      compositionPrefix:
-        from === to &&
-        to === document.content.size - 1 &&
-        /\S$/.test(document.textBetween(0, from, "\n", "\n"))
-          ? " "
-          : "",
-    };
-  }
-
-  /** Places the cursor or selection at ProseMirror positions. */
-  setSelection(from: number, to: number): void {
-    this.editor.commands.setTextSelection({ from, to });
-  }
-
-  /**
-   * Replaces [from, to] with plain text and leaves the cursor after the
-   * inserted text. Newlines insert hard breaks, so the inserted text
-   * occupies exactly text.length positions. A transient replace stays out
-   * of the undo history; any other replace is its own undo step, never
-   * merged with an adjacent edit made just before or after it.
-   */
-  replaceRange(
-    from: number,
-    to: number,
-    text: string,
-    options: { readonly transient?: boolean } = {},
-  ): void {
-    const transient = options.transient === true;
-    const chain = this.editor.chain().command(({ tr }) => {
-      if (transient) {
-        tr.setMeta("addToHistory", false);
-      } else {
-        closeHistory(tr);
-      }
-      return true;
-    });
-    if (text === "") {
-      chain.deleteRange({ from, to }).setTextSelection(from).run();
-    } else {
-      const content: JSONContent[] = [];
-      const lines = text.split("\n");
-      for (let index = 0; index < lines.length; index++) {
-        if (index > 0) {
-          content.push({ type: "hardBreak" });
-        }
-        const line = lines[index];
-        if (line !== undefined && line !== "") {
-          content.push({ type: "text", text: line });
-        }
-      }
-      chain
-        .insertContentAt({ from, to }, content)
-        .setTextSelection(from + text.length)
-        .run();
-    }
-    if (!transient) {
-      this.editor.view.dispatch(closeHistory(this.editor.state.tr));
-    }
-  }
-
-  /**
-   * Replaces [from, to] with slice JSON an earlier insertionContext
-   * captured, outside the undo history, and leaves the cursor after it,
-   * so paragraph breaks and pills return exactly.
-   */
-  restoreRange(from: number, to: number, content: unknown): void {
-    const slice = Slice.fromJSON(this.editor.schema, content);
-    this.editor
-      .chain()
-      .command(({ tr }) => {
-        tr.setMeta("addToHistory", false).replace(from, to, slice);
-        return true;
-      })
-      .setTextSelection(from + slice.size)
-      .run();
-  }
-
-  /**
-   * Styles one dictation take's tentative words at ProseMirror positions,
-   * or clears that take's styling when range is null. The text and the
-   * undo history are untouched.
-   */
-  setTentativeRange(
-    takeId: number,
-    range: { readonly from: number; readonly to: number } | null,
-  ): void {
-    this.editor.view.dispatch(setTentativeMark(this.editor.state.tr, takeId, range));
-  }
-
-  /**
-   * The dictation take's lock: non-editable plus the recording ring on
-   * the frame (`.ws-stt-input--recording`). Composes with the editable
-   * prop through the two flag fields.
-   */
-  setReadOnly(readOnly: boolean): void {
-    this.takeReadOnly = readOnly;
-    this.renderEditable();
-    this.frame.classList.toggle("ws-stt-input--recording", readOnly);
-  }
-
-  /** Focuses the editor; a landed dictation final calls it. */
-  focus(): void {
-    this.editor.commands.focus();
-  }
-
-  /** Inserts a pill for `chip` at the cursor, followed by one space. */
-  insertMention(chip: ChipRef): void {
-    this.editor
-      .chain()
-      .insertContent([
-        {
-          type: "mentionNode",
-          attrs: { ...attrsFromChip(chip), mentionSuggestionChar: "@" },
-        },
-        { type: "text", text: " " },
-      ])
-      .run();
-  }
-
-  /** The persisted form: the document plus the strip's attachments. */
-  serialize(): SerializedDraft {
-    return { v: 1, doc: this.editor.getJSON(), attachments: [...this.attachments] };
-  }
-
-  /**
-   * Replaces the box with a serialized draft. A draft whose version is
-   * missing or unknown is rejected and the box stands unchanged.
-   */
-  restore(draft: SerializedDraft): void {
-    // Persisted data is only typed as far as the reader trusts it.
-    const version: unknown = draft.v;
-    if (version !== 1) {
-      return;
-    }
-    this.editor.commands.setContent(draft.doc);
-    this.attachments = [...draft.attachments];
-    this.strip.replaceChildren(
-      ...this.attachments.map((chip) => renderChip(chip, { removable: false })),
-    );
-  }
-
-  /**
-   * Re-measures the content and re-clamps the box height. Runs on every
-   * edit; exposed so an outside layout change (panel resize, zoom) can
-   * force a re-measure.
-   */
-  syncHeight(): void {
-    const dom = this.editor.view.dom;
-    // scrollHeight never drops below the client height, so the box must
-    // be released to its natural height before measuring, or it could
-    // never shrink.
-    dom.style.height = "auto";
-    const min = readPixelToken(dom, "--prompt-input-min-height", DEFAULT_MIN_HEIGHT_PX);
-    const max = readPixelToken(dom, "--prompt-input-max-height", DEFAULT_MAX_HEIGHT_PX);
-    dom.style.height = `${clampPromptInputHeight(dom.scrollHeight, min, max)}px`;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/chip-view.ts b/crates/workshop/ui/src/parts/chatbox/chip-view.ts
deleted file mode 100644
index f29bc204d..000000000
--- a/crates/workshop/ui/src/parts/chatbox/chip-view.ts
+++ /dev/null
@@ -1,162 +0,0 @@
-// The one pill-drawing function. The live editor's NodeView
-// (mention-chip.ts), the live attachments strip (chat-box.ts), and the
-// static draft renderer (chat-box-view.ts) build a chip's DOM here, so a
-// pill looks the same wherever it appears: an icon slot, a truncated
-// label, and optionally a remove button. The NodeView asks for the
-// button and wires it; the strip and the read-only renderer pass
-// `removable: false` and get a pill without one. The remove button sits
-// over the icon slot in the pill's own grid, so the stylesheet can swap
-// the icon for the X while the editor is focused and the pill is hovered.
-// The pill renders the chip's kind and tone as data attributes for the
-// skin; icons are codicons, picked by the chip's named icon, then the
-// label's extension, then a generic glyph.
-
-import {
-  ICON_CLOSE,
-  ICON_FILE,
-  ICON_FILE_CODE,
-  ICON_FILE_MEDIA,
-  ICON_FILE_TEXT,
-  ICON_FOLDER,
-  ICON_GLOBE,
-  ICON_LINK,
-  ICON_SYMBOL_KEYWORD,
-} from "@workshop/look/icons";
-import type { ChipRef } from "./types";
-
-/** The glyph size on a pill. */
-const PILL_ICON_SIZE_PX = 12;
-
-/** The icons the owning part may name on a chip. Unknown names fall through to the extension map. */
-const NAMED_ICONS: Readonly<Record<string, string>> = {
-  file: ICON_FILE,
-  "file-code": ICON_FILE_CODE,
-  "file-image": ICON_FILE_MEDIA,
-  "file-text": ICON_FILE_TEXT,
-  folder: ICON_FOLDER,
-  globe: ICON_GLOBE,
-  image: ICON_FILE_MEDIA,
-  link: ICON_LINK,
-  command: ICON_SYMBOL_KEYWORD,
-  terminal: ICON_SYMBOL_KEYWORD,
-};
-
-/** Label extensions (lower-case, no dot) to the icon drawn when no icon is named. */
-const EXTENSION_ICONS: Readonly<Record<string, string>> = {
-  md: ICON_FILE_TEXT,
-  markdown: ICON_FILE_TEXT,
-  txt: ICON_FILE_TEXT,
-  rst: ICON_FILE_TEXT,
-  ts: ICON_FILE_CODE,
-  tsx: ICON_FILE_CODE,
-  js: ICON_FILE_CODE,
-  mjs: ICON_FILE_CODE,
-  cjs: ICON_FILE_CODE,
-  jsx: ICON_FILE_CODE,
-  rs: ICON_FILE_CODE,
-  py: ICON_FILE_CODE,
-  lua: ICON_FILE_CODE,
-  sh: ICON_FILE_CODE,
-  ps1: ICON_FILE_CODE,
-  css: ICON_FILE_CODE,
-  html: ICON_FILE_CODE,
-  json: ICON_FILE_CODE,
-  toml: ICON_FILE_CODE,
-  yaml: ICON_FILE_CODE,
-  yml: ICON_FILE_CODE,
-  png: ICON_FILE_MEDIA,
-  jpg: ICON_FILE_MEDIA,
-  jpeg: ICON_FILE_MEDIA,
-  gif: ICON_FILE_MEDIA,
-  webp: ICON_FILE_MEDIA,
-  svg: ICON_FILE_MEDIA,
-};
-
-/** The named icon, else the label's extension, else the generic file glyph. */
-function iconFor(chip: ChipRef): string {
-  if (chip.icon !== undefined) {
-    const named = NAMED_ICONS[chip.icon];
-    if (named !== undefined) {
-      return named;
-    }
-  }
-  const dot = chip.label.lastIndexOf(".");
-  if (dot > 0 && dot < chip.label.length - 1) {
-    const byExtension = EXTENSION_ICONS[chip.label.slice(dot + 1).toLowerCase()];
-    if (byExtension !== undefined) {
-      return byExtension;
-    }
-  }
-  return ICON_FILE;
-}
-
-/**
- * Parses one codicon string into a decorative `<svg>` at `size` pixels.
- * The markup is a static string from `@workshop/look/icons`, never data.
- */
-function glyph(markup: string, size: number): SVGElement {
-  const template = document.createElement("template");
-  template.innerHTML = markup;
-  const svg = template.content.firstElementChild as SVGElement;
-  svg.setAttribute("width", String(size));
-  svg.setAttribute("height", String(size));
-  svg.setAttribute("aria-hidden", "true");
-  return svg;
-}
-
-/**
- * Draws a chip's icon alone, as a decorative `<svg>`: the same glyph
- * the pill shows, for the typeahead row that offers the chip. The
- * default size is the pill's; the typeahead asks for its own.
- */
-export function renderChipIcon(chip: ChipRef, size: number = PILL_ICON_SIZE_PX): SVGElement {
-  return glyph(iconFor(chip), size);
-}
-
-/** How `renderChip` draws a pill. */
-export interface RenderChipOptions {
-  /** Draw the unwired remove button; default `true`. `false` omits it entirely. */
-  readonly removable?: boolean;
-}
-
-/**
- * Draws a chip as a `ws-mention-chip` pill: icon slot, label, and, when
- * `removable` (the default), an unwired remove button. `data-kind` and
- * `data-tone` mirror the chip's fields and are absent when the fields
- * are. The element is non-editable so it behaves as an atom inside a
- * contenteditable.
- */
-export function renderChip(chip: ChipRef, options?: RenderChipOptions): HTMLElement {
-  const dom = document.createElement("span");
-  dom.className = "ws-mention-chip";
-  // setAttribute, not the contentEditable property: jsdom does not
-  // reflect the property onto the attribute.
-  dom.setAttribute("contenteditable", "false");
-  if (chip.kind !== undefined) {
-    dom.setAttribute("data-kind", chip.kind);
-  }
-  if (chip.tone !== undefined) {
-    dom.setAttribute("data-tone", chip.tone);
-  }
-
-  const icon = document.createElement("span");
-  icon.className = "ws-mention-chip__icon";
-  icon.setAttribute("aria-hidden", "true");
-  icon.appendChild(renderChipIcon(chip));
-
-  const label = document.createElement("span");
-  label.className = "ws-mention-chip__label";
-  label.textContent = chip.label;
-
-  dom.append(icon, label);
-
-  if (options?.removable !== false) {
-    const remove = document.createElement("button");
-    remove.type = "button";
-    remove.className = "ws-mention-chip__remove";
-    remove.setAttribute("aria-label", "Remove");
-    remove.appendChild(glyph(ICON_CLOSE, PILL_ICON_SIZE_PX));
-    dom.appendChild(remove);
-  }
-  return dom;
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/mention-chip.ts b/crates/workshop/ui/src/parts/chatbox/mention-chip.ts
deleted file mode 100644
index 0ac9eaf30..000000000
--- a/crates/workshop/ui/src/parts/chatbox/mention-chip.ts
+++ /dev/null
@@ -1,228 +0,0 @@
-// The mention chip: an inline pill for an @-referenced workspace file,
-// rendered inside the prompt editor. Built by extending the official
-// Mention extension - the schema, attributes, parse rules, and suggestion
-// command stay upstream's; only the NodeView (the live DOM) is ours.
-// extend({ name: "mentionNode" }) renames the registered node type to
-// match Cursor's ProseMirror JSON schema, so serialized docs compare
-// cleanly against Cursor's; the suggestion command, parse rule, and
-// Backspace shortcut all read this.name, so they follow the rename
-// automatically. (The rename must happen in extend: configure() merges
-// its argument into the options and explicitly keeps the parent name.)
-// The node holds the chip model beyond upstream's id and label: kind,
-// icon, preview, tone, and the owning part's opaque payload `data`, each
-// written to and read from a data attribute so the pill survives the
-// clipboard (copy renders HTML, paste parses it) and JSON persistence alike.
-// The suggestion here is configured only as far as the schema cares
-// (trigger, ProseMirror plugin key, no spaces); the item source, the popup
-// renderer, and the fetch timing are the chat box's to configure per
-// instance (chat-box.ts), so this module stays free of the popup.
-
-import { Mention } from "@tiptap/extension-mention";
-import type { MentionNodeAttrs } from "@tiptap/extension-mention";
-import { PluginKey } from "@tiptap/pm/state";
-import { renderChip } from "./chip-view";
-import type { ChipRef, JsonValue } from "./types";
-
-/** The node's attribute set: upstream's three plus the chip model. Absent fields are null. */
-export interface ChipNodeAttrs extends MentionNodeAttrs {
-  readonly kind?: string | null;
-  readonly icon?: string | null;
-  readonly preview?: string | null;
-  readonly tone?: ChipRef["tone"] | null;
-  readonly data?: JsonValue | null;
-}
-
-const TONES: ReadonlySet<string> = new Set(["default", "expired", "uploading"]);
-
-/** A tone attribute, or null for anything outside the model's vocabulary. */
-function parseTone(value: string | null): ChipRef["tone"] | null {
-  return value !== null && TONES.has(value) ? (value as ChipRef["tone"]) : null;
-}
-
-/**
- * The JSON payload attribute, or null when absent or unparseable: a
- * pasted pill with a mangled payload becomes a chip without one rather
- * than a paste that throws.
- */
-function parsePayload(value: string | null): JsonValue | null {
-  if (value === null) {
-    return null;
-  }
-  try {
-    return JSON.parse(value) as JsonValue;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * The chip a node's attributes describe. The label falls back to the id,
- * and null attributes read as absent fields.
- */
-export function chipFromAttrs(attrs: ChipNodeAttrs): ChipRef {
-  const chip: {
-    id: string;
-    label: string;
-    kind?: string;
-    icon?: string;
-    preview?: string;
-    tone?: ChipRef["tone"];
-    data: JsonValue;
-  } = {
-    id: attrs.id ?? "",
-    label: attrs.label ?? attrs.id ?? "",
-    data: attrs.data ?? null,
-  };
-  if (attrs.kind != null) {
-    chip.kind = attrs.kind;
-  }
-  if (attrs.icon != null) {
-    chip.icon = attrs.icon;
-  }
-  if (attrs.preview != null) {
-    chip.preview = attrs.preview;
-  }
-  if (attrs.tone != null) {
-    chip.tone = attrs.tone;
-  }
-  return chip;
-}
-
-/**
- * The node attributes a chip is inserted with. Only the stored subset
- * crosses: `description` and `group` are typeahead-only and never land
- * on the node. Absent fields become null, the schema's default.
- */
-export function attrsFromChip(chip: ChipRef): ChipNodeAttrs {
-  return {
-    id: chip.id,
-    label: chip.label,
-    kind: chip.kind ?? null,
-    icon: chip.icon ?? null,
-    preview: chip.preview ?? null,
-    tone: chip.tone ?? null,
-    data: chip.data,
-  };
-}
-
-/** One optional string attribute mirrored onto `data-<name>`, absent when null. */
-function stringAttribute(name: string) {
-  return {
-    default: null,
-    parseHTML: (element: HTMLElement) => element.getAttribute(`data-${name}`),
-    renderHTML: (attributes: Record<string, unknown>) => {
-      const value = attributes[name];
-      return typeof value === "string" ? { [`data-${name}`]: value } : {};
-    },
-  };
-}
-
-/** The slice of the suggestion session state read outside the popup. */
-interface MentionSuggestionState {
-  readonly active: boolean;
-}
-
-/**
- * The ProseMirror plugin key of the mention suggestion session. The
- * prompt input's Enter handling reads it to yield while the typeahead is
- * open: editorProps handlers run before ProseMirror state plugins, so
- * without the state check a submitting Enter would fire instead of the
- * typeahead's selection.
- */
-export const MentionSuggestionPluginKey = new PluginKey<MentionSuggestionState>(
-  "mentionNodeSuggestion",
-);
-
-/**
- * The configured mention extension: upstream Mention renamed to
- * `mentionNode`, with a vanilla-DOM NodeView rendering the pill (icon
- * slot, truncated label, remove button). The chat box registers it
- * after configuring the suggestion's `items`, `render`, and timing on
- * top of what is set here. Upstream's insertion command is kept: it
- * replaces the trigger-plus-query range with the node and one trailing
- * space, extending the range by one when a space already follows so
- * two never stack; with `deleteTriggerWithBackspace` off, Backspace
- * directly after a pill restores the literal `@`.
- */
-export const MentionChip = Mention.extend({
-  name: "mentionNode",
-
-  addAttributes() {
-    return {
-      ...this.parent?.(),
-      kind: stringAttribute("kind"),
-      icon: stringAttribute("icon"),
-      preview: stringAttribute("preview"),
-      tone: {
-        default: null,
-        parseHTML: (element: HTMLElement) => parseTone(element.getAttribute("data-tone")),
-        renderHTML: (attributes: Record<string, unknown>) => {
-          const value = attributes["tone"];
-          return typeof value === "string" && TONES.has(value) ? { "data-tone": value } : {};
-        },
-      },
-      // The owning part's opaque payload travels as one JSON-encoded
-      // attribute, so whatever that part put in comes back byte-for-byte.
-      data: {
-        default: null,
-        parseHTML: (element: HTMLElement) => parsePayload(element.getAttribute("data-payload")),
-        renderHTML: (attributes: Record<string, unknown>) => {
-          const value = attributes["data"];
-          return value === null || value === undefined
-            ? {}
-            : { "data-payload": JSON.stringify(value) };
-        },
-      },
-    };
-  },
-
-  addNodeView() {
-    return ({ node, editor, getPos, HTMLAttributes }) => {
-      // The library types attrs as an open record; the extension's own
-      // attribute definitions are the only writers, so the cast narrows
-      // to what the schema holds.
-      const dom = renderChip(chipFromAttrs(node.attrs as ChipNodeAttrs));
-      for (const [name, value] of Object.entries(HTMLAttributes)) {
-        // The chip owns its class; the remaining rendered attributes
-        // (data-id, data-label, data-mention-suggestion-char, and the
-        // chip model's data-*) copy over.
-        if (name === "class") {
-          continue;
-        }
-        dom.setAttribute(name, String(value));
-      }
-
-      const remove = dom.querySelector(".ws-mention-chip__remove");
-      remove?.addEventListener("click", () => {
-        const pos = getPos();
-        if (pos === undefined) {
-          return;
-        }
-        editor.chain().deleteRange({ from: pos, to: pos + node.nodeSize }).run();
-      });
-
-      return {
-        dom,
-        // Pointer activity on the remove button belongs to the chip:
-        // without this ProseMirror reads the mousedown as the start of a
-        // selection or drag on the atom node.
-        stopEvent(event) {
-          const target = event.target as HTMLElement | null;
-          return target !== null && remove !== null && remove.contains(target);
-        },
-      };
-    };
-  },
-}).configure({
-  deleteTriggerWithBackspace: false,
-  suggestion: {
-    char: "@",
-    // A named key instead of the extension's anonymous default, so the
-    // chat box can read the session state through it.
-    pluginKey: MentionSuggestionPluginKey,
-    // A space ends the query (the session closes, the text stays), and
-    // the default allowedPrefixes (a space or the start of a text node)
-    // keep an `@` inside a word from triggering.
-    allowSpaces: false,
-  },
-});
diff --git a/crates/workshop/ui/src/parts/chatbox/tentative-mark.ts b/crates/workshop/ui/src/parts/chatbox/tentative-mark.ts
deleted file mode 100644
index 136e3cdaf..000000000
--- a/crates/workshop/ui/src/parts/chatbox/tentative-mark.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-// The dictation tentative mark: a ProseMirror decoration plugin, registered
-// as a Tiptap extension, that styles each live take's tentative words
-// without touching the document. Each take owns at most one range, keyed
-// by its take id; a range maps through later edits until the take's next
-// range replaces it or a null range clears it.
-
-import { Extension } from "@tiptap/core";
-import { Plugin, PluginKey, type Transaction } from "@tiptap/pm/state";
-import { Decoration, DecorationSet } from "@tiptap/pm/view";
-
-/** The class the skin paints tentative dictation words with. */
-export const TENTATIVE_CLASS = "ws-stt-tentative";
-
-/** One take's tentative range, or null to clear that take's mark. */
-interface TentativeMarkUpdate {
-  readonly takeId: number;
-  readonly range: { readonly from: number; readonly to: number } | null;
-}
-
-const tentativeMarkKey = new PluginKey<DecorationSet>("dictationTentativeMark");
-
-/** The extension the chat box registers to show tentative marks. */
-export const TentativeMark = Extension.create({
-  name: "dictationTentativeMark",
-  addProseMirrorPlugins() {
-    return [
-      new Plugin<DecorationSet>({
-        key: tentativeMarkKey,
-        state: {
-          init: () => DecorationSet.empty,
-          apply: (tr, marks) => {
-            const mapped = marks.map(tr.mapping, tr.doc);
-            // Only setTentativeMark writes this meta, always with this shape.
-            const update = tr.getMeta(tentativeMarkKey) as TentativeMarkUpdate | undefined;
-            if (update === undefined) {
-              return mapped;
-            }
-            const kept = mapped.remove(
-              mapped.find(
-                undefined,
-                undefined,
-                (spec: { readonly takeId?: number }) => spec.takeId === update.takeId,
-              ),
-            );
-            const { range } = update;
-            if (
-              range === null ||
-              range.from < 0 ||
-              range.from >= range.to ||
-              range.to > tr.doc.content.size
-            ) {
-              return kept;
-            }
-            return kept.add(tr.doc, [
-              Decoration.inline(
-                range.from,
-                range.to,
-                { class: TENTATIVE_CLASS },
-                { takeId: update.takeId },
-              ),
-            ]);
-          },
-        },
-        props: {
-          decorations: (state) => tentativeMarkKey.getState(state),
-        },
-      }),
-    ];
-  },
-});
-
-/** Sets or clears one take's tentative range on a transaction that changes no text. */
-export function setTentativeMark(
-  tr: Transaction,
-  takeId: number,
-  range: TentativeMarkUpdate["range"],
-): Transaction {
-  const update: TentativeMarkUpdate = { takeId, range };
-  return tr.setMeta(tentativeMarkKey, update);
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/typeahead-popup.css b/crates/workshop/ui/src/parts/chatbox/typeahead-popup.css
deleted file mode 100644
index 71a34e5dd..000000000
--- a/crates/workshop/ui/src/parts/chatbox/typeahead-popup.css
+++ /dev/null
@@ -1,97 +0,0 @@
-/* TypeaheadPopup (src/parts/chatbox/typeahead-popup.ts): the floating
-   @-mention menu. It wears the composer's shared menu surface (look's
-   .menu-composer: #181818, a 15% border, a 6px radius, 2px padding, 12px
-   rows, a #F0F0F011 highlight), which the popup's classes ask for; this
-   file adds what only the @ menu has: its size, the right-aligned path
-   subtitle, and the group headers. The ProseMirror suggestion plugin's
-   managed mount appends the popup to document.body and writes position,
-   left, and top inline from the cursor rect (Floating UI), so this file
-   owns only the size and the list. */
-
-.ws-typeahead-popup {
-  position: absolute; /* a pre-mount default; mount() overwrites it inline */
-  z-index: 9999;
-  box-sizing: border-box;
-  inline-size: var(--ws-typeahead-width);
-  max-block-size: var(--ws-typeahead-max-height);
-  letter-spacing: normal;
-  color: var(--text);
-}
-
-/* A no-match query hides the popup while the session stays alive. */
-.ws-typeahead-popup[hidden] {
-  display: none;
-}
-
-.ws-typeahead-popup__list {
-  margin: 0;
-  padding: 0;
-  list-style: none;
-}
-
-.ws-typeahead-popup__item {
-  white-space: nowrap;
-  overflow: hidden;
-}
-
-/* The chip's glyph, sized by the icon itself; kept from shrinking so a
-   long label truncates instead of the icon. */
-.ws-typeahead-popup__icon {
-  flex: none;
-  color: var(--cursor-text-tertiary);
-}
-
-/* Shrinkable (flex-basis auto, min-inline-size 0) so the ellipsis is
-   reachable; a flex item's default min-inline-size is its content width,
-   which would hard-clip the label at the item edge instead. */
-.ws-typeahead-popup__label {
-  flex: 0 1 auto;
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-/* The row's path: an 11px subtitle at the row's right edge, at 0.4 opacity
-   (0.6 on the highlighted row), and the first thing to give way when space
-   is short. It truncates from the left: the span runs right to left, so the
-   ellipsis lands at its start, and the inner bdi keeps the path's own
-   left-to-right order. */
-.ws-typeahead-popup__description {
-  flex: 1 8 auto;
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  direction: rtl;
-  text-align: end;
-  opacity: 0.4;
-  font-size: var(--font-size-xs);
-}
-
-.ws-typeahead-popup__item--selected .ws-typeahead-popup__description {
-  opacity: 0.6;
-}
-
-/* A group boundary: not an option, not selectable, not highlighted. It is
-   plain text in the tertiary tier - not uppercase, and with no rule above. */
-.ws-typeahead-popup__header {
-  padding-block: var(--space-1);
-  padding-inline: var(--space-1-5);
-  color: var(--cursor-text-tertiary);
-  font-size: var(--font-size-xs);
-  user-select: none;
-}
-
-/* The source is still working: shown in place of an empty list so the
-   popup does not blink shut between keystrokes. */
-.ws-typeahead-popup__loading {
-  padding-block: var(--space-1);
-  padding-inline: var(--space-1-5);
-  color: var(--cursor-text-tertiary);
-  font-style: italic;
-}
-
-/* The keyboard highlight; the rows are not focusable (the editor keeps
-   focus), so aria-selected on the option is the state of record. */
-.ws-typeahead-popup__item--selected {
-  background: var(--bg-hover);
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/typeahead-popup.ts b/crates/workshop/ui/src/parts/chatbox/typeahead-popup.ts
deleted file mode 100644
index 02dbd9211..000000000
--- a/crates/workshop/ui/src/parts/chatbox/typeahead-popup.ts
+++ /dev/null
@@ -1,268 +0,0 @@
-// The mention typeahead: the floating list of chips that opens while
-// the operator types a mention in the chat box. One instance lives for
-// one suggestion session - the render lifecycle's onStart constructs it
-// and onExit disposes it, a pair the ProseMirror suggestion plugin always
-// closes (the stopped transition, or the view destroy mid-session) - so
-// the DOM and listeners never outlive the session. Positioning is owned
-// by the plugin's managed mount(): it appends the popup to document.body,
-// anchors it to the live cursor rect, and repositions on scroll and
-// resize through Floating UI's autoUpdate; the unmount it returns tears
-// all of that down.
-//
-// The popup wears the composer's shared menu surface (look's
-// `.menu-composer`, the skin the mode and model menus use) and its rows
-// are `.menu-item` rows. The rows are chips: each draws the chip's icon,
-// its label, and its `description` as a right-aligned subtitle that
-// truncates from the left, so a long path keeps its file name. Items with
-// a `group` are ordered by group with a non-selectable header at each boundary; keyboard
-// navigation indexes the items only. The ProseMirror plugin's `loading`
-// flag renders a loading row while the source is pending. The popup
-// writes no fetch, debounce, or staleness logic of its own: the plugin
-// supplies the items, the abort, and the flag; the popup only draws.
-
-import "@workshop/look/dropdown.css";
-import "./typeahead-popup.css";
-
-import type { SuggestionKeyDownProps, SuggestionOptions, SuggestionProps } from "@tiptap/suggestion";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { renderChipIcon } from "./chip-view";
-import { type ChipNodeAttrs, attrsFromChip } from "./mention-chip";
-import type { ChipRef } from "./types";
-
-/** The glyph size on a row; the shared menu surface's icon size. */
-const ROW_ICON_SIZE_PX = 14;
-
-// The ProseMirror plugin hands the popup ChipRef items and takes the node's
-// attributes back through command(): the popup converts at that edge,
-// so typeahead-only fields (description, group) never reach the node.
-type TypeaheadProps = SuggestionProps<ChipRef, ChipNodeAttrs>;
-type TypeaheadRenderer = NonNullable<
-  ReturnType<NonNullable<SuggestionOptions<ChipRef, ChipNodeAttrs>["render"]>>
->;
-
-/** One rendered row: a header at a group boundary or a selectable item. */
-type Row =
-  | { readonly kind: "header"; readonly group: string }
-  | { readonly kind: "item"; readonly chip: ChipRef; readonly index: number };
-
-/**
- * Orders the items for display: ungrouped items first in source order,
- * then each group in order of first appearance with its items in source
- * order and a header row ahead of them. `index` counts items only, so
- * it is the selection index.
- */
-function layoutRows(items: readonly ChipRef[]): Row[] {
-  const rows: Row[] = [];
-  let index = 0;
-  for (const chip of items) {
-    if (chip.group === undefined) {
-      rows.push({ kind: "item", chip, index: index++ });
-    }
-  }
-  const groups: string[] = [];
-  for (const chip of items) {
-    if (chip.group !== undefined && !groups.includes(chip.group)) {
-      groups.push(chip.group);
-    }
-  }
-  for (const group of groups) {
-    rows.push({ kind: "header", group });
-    for (const chip of items) {
-      if (chip.group === group) {
-        rows.push({ kind: "item", chip, index: index++ });
-      }
-    }
-  }
-  return rows;
-}
-
-/**
- * The floating suggestion list: a keyboard-navigable <ul> inside a
- * popup <div>. ArrowUp/ArrowDown cycle the highlight over the items
- * with wraparound (headers are skipped), Enter and Tab command the
- * highlighted item, and every other key falls through to the editor.
- * Escape needs no handling here: the ProseMirror plugin dismisses the
- * session on Escape itself, which fires onExit.
- */
-export class TypeaheadPopup extends Disposable {
-  private readonly element: HTMLDivElement;
-  private readonly list: HTMLUListElement;
-  /** The selectable items in display order; `selectedIndex` indexes this. */
-  private ordered: readonly ChipRef[] = [];
-  private loading = false;
-  private selectedIndex = 0;
-  private command: (chip: ChipRef) => void;
-
-  constructor(props: TypeaheadProps) {
-    super();
-    this.element = document.createElement("div");
-    this.element.className = "menu menu-composer scrollbar-menu ws-typeahead-popup";
-    this.list = document.createElement("ul");
-    this.list.className = "ws-typeahead-popup__list";
-    this.list.setAttribute("role", "listbox");
-    this.element.appendChild(this.list);
-    // Swallowing the mousedown default keeps the editor's focus and
-    // selection when a popup row is clicked.
-    this.element.addEventListener("mousedown", (event) => {
-      event.preventDefault();
-    });
-    this.command = (chip) => props.command(attrsFromChip(chip));
-    this.applyProps(props);
-    // mount() anchors the popup to the cursor rect and repositions it on
-    // scroll and resize; the unmount it returns removes the element and
-    // every listener mount attached.
-    this._register(toDisposable(props.mount(this.element)));
-  }
-
-  /**
-   * Re-renders for a new props generation: a new query's items, or the
-   * loading flag flipping while the source works. No re-anchoring: the
-   * mount's rect reader is live, and autoUpdate repositions on scroll
-   * and resize.
-   */
-  update(props: TypeaheadProps): void {
-    // command closes over the session's range, so it must be refreshed
-    // with every props generation or a stale range would be replaced.
-    this.command = (chip) => props.command(attrsFromChip(chip));
-    this.applyProps(props);
-  }
-
-  /**
-   * Handles a keypress while the popup is open. Returns true when the
-   * key was consumed; false lets the editor handle it.
-   */
-  handleKeyDown(props: SuggestionKeyDownProps): boolean {
-    const { event } = props;
-    if (event.key === "ArrowDown") {
-      this.moveSelection(1);
-      return true;
-    }
-    if (event.key === "ArrowUp") {
-      this.moveSelection(-1);
-      return true;
-    }
-    if (event.key === "Enter" || event.key === "Tab") {
-      const chip = this.ordered[this.selectedIndex];
-      if (chip !== undefined) {
-        this.command(chip);
-      }
-      return true;
-    }
-    if (event.key === "Escape") {
-      return true;
-    }
-    return false;
-  }
-
-  private applyProps(props: TypeaheadProps): void {
-    const rows = layoutRows(props.items);
-    this.ordered = rows.flatMap((row) => (row.kind === "item" ? [row.chip] : []));
-    this.loading = props.loading;
-    if (this.selectedIndex >= this.ordered.length) {
-      this.selectedIndex = 0;
-    }
-    this.renderRows(rows);
-  }
-
-  private moveSelection(delta: number): void {
-    const count = this.ordered.length;
-    if (count === 0) {
-      return;
-    }
-    this.selectedIndex = (this.selectedIndex + delta + count) % count;
-    this.applySelection();
-  }
-
-  private renderRows(rows: readonly Row[]): void {
-    this.list.textContent = "";
-    // A settled query with no matches shows nothing; the session stays
-    // alive until the ProseMirror plugin dismisses it. A pending query shows
-    // the loading row instead, so the popup does not blink shut mid-search.
-    this.element.hidden = rows.length === 0 && !this.loading;
-    if (rows.length === 0 && this.loading) {
-      const pending = document.createElement("li");
-      pending.className = "ws-typeahead-popup__loading";
-      pending.setAttribute("role", "presentation");
-      pending.textContent = "Searching...";
-      this.list.appendChild(pending);
-      return;
-    }
-    for (const row of rows) {
-      this.list.appendChild(row.kind === "header" ? renderHeader(row.group) : this.renderItem(row.chip));
-    }
-    this.applySelection();
-  }
-
-  private renderItem(chip: ChipRef): HTMLLIElement {
-    const option = document.createElement("li");
-    option.className = "menu-item ws-typeahead-popup__item";
-    option.setAttribute("role", "option");
-    if (chip.kind !== undefined) {
-      option.setAttribute("data-kind", chip.kind);
-    }
-    const icon = document.createElement("span");
-    icon.className = "menu-item__icon ws-typeahead-popup__icon";
-    icon.setAttribute("aria-hidden", "true");
-    icon.appendChild(renderChipIcon(chip, ROW_ICON_SIZE_PX));
-    const label = document.createElement("span");
-    label.className = "ws-typeahead-popup__label";
-    label.textContent = chip.label;
-    option.append(icon, label);
-    if (chip.description !== undefined) {
-      // The subtitle truncates from the left: the span is right-to-left so
-      // the ellipsis lands at the start, and the inner bdi keeps the path's
-      // own left-to-right order.
-      const description = document.createElement("span");
-      description.className = "ws-typeahead-popup__description";
-      const text = document.createElement("bdi");
-      text.setAttribute("dir", "ltr");
-      text.textContent = chip.description;
-      description.appendChild(text);
-      option.appendChild(description);
-    }
-    option.addEventListener("click", () => {
-      this.command(chip);
-    });
-    return option;
-  }
-
-  private applySelection(): void {
-    const options = this.list.querySelectorAll<HTMLLIElement>(".ws-typeahead-popup__item");
-    for (let index = 0; index < options.length; index++) {
-      const option = options.item(index);
-      const selected = index === this.selectedIndex;
-      option.classList.toggle("ws-typeahead-popup__item--selected", selected);
-      option.setAttribute("aria-selected", selected ? "true" : "false");
-    }
-  }
-}
-
-/** A group boundary: a non-selectable, non-option row naming the group. */
-function renderHeader(group: string): HTMLLIElement {
-  const header = document.createElement("li");
-  header.className = "ws-typeahead-popup__header";
-  header.setAttribute("role", "presentation");
-  header.textContent = group;
-  return header;
-}
-
-/**
- * The suggestion render lifecycle: one TypeaheadPopup per session,
- * constructed on onStart and disposed on onExit.
- */
-export function renderMentionTypeahead(): TypeaheadRenderer {
-  let popup: TypeaheadPopup | undefined;
-  return {
-    onStart: (props) => {
-      popup = new TypeaheadPopup(props);
-    },
-    onUpdate: (props) => {
-      popup?.update(props);
-    },
-    onKeyDown: (props) => popup?.handleKeyDown(props) ?? false,
-    onExit: () => {
-      popup?.dispose();
-      popup = undefined;
-    },
-  };
-}
diff --git a/crates/workshop/ui/src/parts/chatbox/types.ts b/crates/workshop/ui/src/parts/chatbox/types.ts
deleted file mode 100644
index 3038bbb1e..000000000
--- a/crates/workshop/ui/src/parts/chatbox/types.ts
+++ /dev/null
@@ -1,217 +0,0 @@
-// The chat box contract: what the isolated component takes in (props),
-// gives out (events), and exposes (the handle), plus the chip model and
-// the persisted draft shape. Everything the owning part and the component
-// share is declared here and nowhere else. `chatbox/` imports only
-// `@workshop/platform/lifecycle`, `@workshop/look/icons`, the shared menu surface
-// `@workshop/look/dropdown.css`, and `@tiptap/*`; the two outside types
-// this file mirrors - the text-control adapter and dictation's input
-// target - are declared structurally so neither side imports the other.
-
-import type { JSONContent } from "@tiptap/core";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-
-/** Any JSON value: the shape of the opaque payload the owning part puts on a chip. */
-export type JsonValue =
-  | string
-  | number
-  | boolean
-  | null
-  | JsonValue[]
-  | { [key: string]: JsonValue };
-
-/**
- * One chip: an inline mention pill, a typeahead row, or an attachment.
- * The owning part owns the vocabulary of `kind` and everything inside
- * `data`; the component draws from the rest and round-trips `data` untouched.
- */
-export interface ChipRef {
-  readonly id: string;
-  readonly label: string;
-  /**
-   * What the chip is (file, folder, command, image, url, ...). The pill
-   * renders it as `data-kind` so the skin can style by kind; absent
-   * means a generic pill.
-   */
-  readonly kind?: string;
-  /** Dimmed row detail in the typeahead (for files, the parent path); never rendered on the pill. */
-  readonly description?: string;
-  /** Typeahead section; items sort by group with a header at each boundary. */
-  readonly group?: string;
-  /** A named icon; the component falls back to an extension map, then a generic glyph. */
-  readonly icon?: string;
-  /** A thumbnail URL the owning part issues (deferred). */
-  readonly preview?: string;
-  /** Display state (expired and uploading are deferred). */
-  readonly tone?: "default" | "expired" | "uploading";
-  /** The owning part's opaque payload, round-tripped untouched. */
-  readonly data: JsonValue;
-}
-
-/** An async chip provider for a typeahead trigger; `signal` aborts a superseded query. */
-export type ChipSource = (query: string, signal: AbortSignal) => Promise<ChipRef[]>;
-
-/**
- * The persisted form of the box. `v` is the schema version: a future
- * change bumps it, and `restore` must read every prior version or
- * reject with the box unchanged.
- */
-export interface SerializedDraft {
-  readonly v: 1;
-  /** The document: text plus inline chips (mentions, later commands). */
-  readonly doc: JSONContent;
-  /** The strip above the text (empty in this plan). */
-  readonly attachments: ChipRef[];
-}
-
-/** The agent modes the action button's fill follows. */
-export type ChatBoxMode = "agent" | "plan" | "ask" | "debug" | "multitask";
-
-/**
- * The error popup docked on the card's top edge: a warning glyph, a title
- * over a message, and an optional Try again. The owning part decides what
- * Try again does; the box only reports the press.
- */
-export interface ChatBoxError {
-  /** The popup title; default "Connection Error". */
-  readonly title?: string;
-  readonly message: string;
-  /** Offers Try again, enabled or shown disabled; absent: no button. */
-  readonly tryAgain?: "enabled" | "disabled";
-}
-
-/**
- * Construction props. Every prop is optional with a stated default, so
- * `new ChatBox()` constructs a working box. The first group is dynamic
- * and may change through `update()`; the rest is construction-only and
- * read once.
- */
-export interface ChatBoxProps {
-  // dynamic
-  /** The error popup's content, or null for no popup; default null. */
-  readonly error?: ChatBoxError | null;
-  /** Whether the operator can type; default true. */
-  readonly editable?: boolean;
-  /**
-   * What the round action button does once the box holds text; default
-   * "send". `send`: enabled. `send-blocked`: aria-disabled but still
-   * clickable and still emits `send`, so the owning part can name the
-   * blocker. `idle`: disabled. `stop`: the agent is generating - over an
-   * empty box the button becomes Stop and emits `stop`, once the box holds
-   * text it is the send arrow and emits `send`, as Enter does, and the
-   * placeholder reads "Add a follow-up". With an empty box and no `stop`,
-   * the same button is the mic.
-   */
-  readonly action?: "send" | "send-blocked" | "stop" | "idle";
-  /**
-   * The mic's state, shown on the action button while the box is empty (or
-   * recording); default "idle".
-   */
-  readonly mic?: "idle" | "recording" | "blocked";
-  /** The agent mode that picks the action button's fill; default "agent". */
-  readonly mode?: ChatBoxMode;
-  // construction-only
-  /**
-   * The layout variant, rendered as `data-variant` on the root; default
-   * "expanded". Reserved so later editors add values, not props.
-   */
-  readonly variant?: "expanded";
-  /**
-   * Placeholder while the editor is empty; default "". The function
-   * form is re-evaluated on every state update.
-   */
-  readonly placeholder?: string | (() => string);
-  /** Accessible label on the editable region; default "Message". */
-  readonly ariaLabel?: string;
-  /** Initial content, parsed as HTML (`<p>` per paragraph). */
-  readonly content?: string;
-  /**
-   * A toolbar element the owning part supplies, placed after the editor;
-   * the box appends its round action button to its end. Absent, the
-   * button goes directly on the bar.
-   */
-  readonly controls?: HTMLElement;
-  /** The `@` provider; default: the built-in three-item stub. */
-  readonly mentionSource?: ChipSource;
-  /**
-   * The `/` provider; default: `async () => []`. Reserved: declared but
-   * not read in this release; a typed `/` stays text.
-   */
-  readonly commandSource?: ChipSource;
-  /**
-   * Turns pasted files into attachment chips; absent: ProseMirror's
-   * default paste. Reserved: declared but not read in this release;
-   * paste is ProseMirror's default.
-   */
-  readonly onPasteFiles?: (files: File[]) => Promise<ChipRef[]>;
-  /** The owning part's text-control registrar; absent, the box registers no text control. */
-  readonly textControls?: TextControlRegistrar;
-}
-
-/**
- * The edit surface the box registers with the owning part's text-control
- * service. Declared structurally: it mirrors `TextControl` in
- * `@workshop/platform/text-control-service` field for field so the
- * owning part's bound `register` type-checks here without an import
- * across the boundary.
- */
-export interface ChatBoxTextControl {
-  readonly kind: string;
-  undo(): void;
-  redo(): void;
-  selectAll(): void;
-  canUndo?(): boolean;
-  canRedo?(): boolean;
-}
-
-/** Registers `control` for `root`'s subtree; disposing unregisters it. */
-export type TextControlRegistrar = (root: HTMLElement, control: ChatBoxTextControl) => IDisposable;
-
-/** Everything the box tells its owning part. */
-export type ChatBoxEvent =
-  | { readonly type: "send"; readonly text: string; readonly mentions: ChipRef[]; readonly attachments: ChipRef[] }
-  | { readonly type: "command"; readonly command: ChipRef; readonly args: string }
-  | { readonly type: "stop" }
-  | { readonly type: "retry" }
-  | { readonly type: "cancel" }
-  | { readonly type: "mic-press" }
-  | { readonly type: "mic-release" };
-
-/** The owning part's event sink. */
-export type ChatBoxEventSink = (event: ChatBoxEvent) => void;
-
-/**
- * The imperative surface. A structural superset of dictation's
- * `SttInputTarget` (insertionContext, replaceRange, restoreRange,
- * setSelection, setTentativeRange, setReadOnly, focus), so
- * `setupStt({ input: handle })` type-checks with no import in either
- * direction.
- */
-export interface ChatBoxHandle {
-  clear(): void;
-  focus(): void;
-  getText(): string;
-  setText(text: string): void;
-  insertMention(chip: ChipRef): void;
-  replaceRange(
-    from: number,
-    to: number,
-    text: string,
-    options?: { readonly transient?: boolean },
-  ): void;
-  restoreRange(from: number, to: number, content: unknown): void;
-  setSelection(from: number, to: number): void;
-  setTentativeRange(takeId: number, range: { readonly from: number; readonly to: number } | null): void;
-  insertionContext(): {
-    readonly range: { readonly start: number; readonly end: number };
-    readonly original: string;
-    readonly content: unknown;
-    readonly compositionPrefix: "" | " ";
-  };
-  setReadOnly(readOnly: boolean): void;
-  syncHeight(): void;
-  serialize(): SerializedDraft;
-  restore(draft: SerializedDraft): void;
-}
-
-/** The dynamic subset: the only props `update()` accepts. */
-export type ChatBoxDynamicProps = Pick<ChatBoxProps, "editable" | "action" | "mic" | "mode" | "error">;
diff --git a/crates/workshop/ui/src/parts/chrome/about-dialog.css b/crates/workshop/ui/src/parts/chrome/about-dialog.css
deleted file mode 100644
index b6d412fef..000000000
--- a/crates/workshop/ui/src/parts/chrome/about-dialog.css
+++ /dev/null
@@ -1,105 +0,0 @@
-/* Styles for about-dialog.ts, which imports this file; esbuild bundles it
-   into dist/app.css. Themed values come from the :root tokens in @workshop/look/tokens.css. */
-
-/* About dialog: a centered 380px card over a dimmed backdrop, in the form
-   modal's skin (a 12px radius and a 12% stroke, no shadow). */
-.ws-about-dialog-overlay {
-  position: fixed;
-  inset: 0;
-  z-index: 200;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  background: var(--ws-overlay-scrim);
-}
-
-.ws-about-dialog {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-  box-sizing: border-box;
-  inline-size: min(var(--ws-about-width), calc(100vw - 2 * var(--space-4)));
-  padding: var(--space-4);
-  color: var(--cursor-text-primary);
-  background: var(--bg-elevated);
-  border: var(--ws-border-width) solid var(--cursor-stroke-secondary);
-  border-radius: var(--radius-xl);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-}
-
-.ws-about-dialog__icon {
-  inline-size: var(--ws-about-icon-size);
-  block-size: var(--ws-about-icon-size);
-  align-self: flex-start;
-}
-
-.ws-about-dialog__title,
-.ws-about-dialog__line {
-  margin: 0;
-}
-
-.ws-about-dialog__title {
-  font-size: var(--font-size-lg);
-  font-weight: var(--font-weight-medium);
-}
-
-.ws-about-dialog__line {
-  color: var(--cursor-text-secondary);
-}
-
-/* Version and Date: a label, the value, and a copy button pushed to the right. */
-.ws-about-dialog__row {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-  min-block-size: var(--height-sm);
-}
-
-.ws-about-dialog__label {
-  flex: none;
-  inline-size: var(--ws-about-label-width);
-  color: var(--cursor-text-tertiary);
-}
-
-.ws-about-dialog__value {
-  flex: 1;
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  user-select: text;
-}
-
-.ws-about-dialog__copy {
-  flex: none;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  inline-size: var(--height-sm);
-  block-size: var(--height-sm);
-  padding: 0;
-  color: var(--cursor-icon-secondary);
-  background: none;
-  border: 0;
-  border-radius: var(--radius);
-  cursor: pointer;
-}
-
-.ws-about-dialog__copy:hover {
-  color: var(--cursor-icon-primary);
-  background: var(--cursor-toolbar-hover);
-}
-
-/* The action row: Copy version info (the primary button) sits last, at the right. */
-.ws-about-dialog__actions {
-  display: flex;
-  flex-wrap: wrap;
-  justify-content: flex-end;
-  gap: var(--space-1);
-  margin-block-start: var(--space-2);
-}
-
-.ws-about-dialog__check:disabled {
-  color: var(--cursor-control-disabled-text);
-}
diff --git a/crates/workshop/ui/src/parts/chrome/about-dialog.ts b/crates/workshop/ui/src/parts/chrome/about-dialog.ts
deleted file mode 100644
index 2b1036f53..000000000
--- a/crates/workshop/ui/src/parts/chrome/about-dialog.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-// The Help menu's About dialog: a 380px card with the product icon, the
-// application version - and the build date, when the build defines one -
-// each with its own copy button, the license, and the update button.
-// "Copy version info" is the primary button: it holds focus on open and
-// Enter runs it, putting the version (and date) on the clipboard the way
-// Cursor's About dialog does. Every copy confirmation - a row's check
-// icon, the primary button's "Copied" - shows only once the clipboard
-// write landed. Focus is trapped inside the dialog while it is open,
-// Escape and the Close button dismiss it, and focus returns to the element
-// that opened it.
-
-import "./about-dialog.css";
-
-import { ICON_CHECK, ICON_COPY } from "@workshop/look/icons";
-import { DisposableStore, toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import type { UpdateService } from "../../services/update-service";
-import { copyToClipboard } from "../shared/clipboard";
-
-// The crate version, substituted by the esbuild define in build.mjs and
-// the crate's build.rs; a bundle built without the define shows the "dev"
-// fallback instead of breaking on a free identifier. The build date has no
-// define yet (build.mjs and the build-ui crate must emit identical bundles,
-// and a clock-stamped date would break that), so APP_DATE is null and the
-// date row stays out of the card until a build defines the date; a row that
-// always read "Unknown" would only offer to copy that word.
-declare const __APP_VERSION__: string | undefined;
-declare const __APP_BUILD_DATE__: string | undefined;
-const APP_VERSION = typeof __APP_VERSION__ === "string" ? __APP_VERSION__ : "dev";
-const APP_DATE =
-  typeof __APP_BUILD_DATE__ === "string" && __APP_BUILD_DATE__ !== "" ? __APP_BUILD_DATE__ : null;
-const LICENSE = "BSL-1.0";
-
-const FOCUSABLE_SELECTOR =
-  'button, a[href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-
-/**
- * One labelled value with a copy button; `value` is replaced as the snapshot
- * changes. `onCopy` resolves true once the copy landed; the button's check
- * icon shows only then.
- */
-function buildRow(
-  field: string,
-  label: string,
-  copyLabel: string,
-  onCopy: () => Promise<boolean>,
-): { readonly row: HTMLElement; readonly value: HTMLElement } {
-  const row = document.createElement("div");
-  row.className = "ws-about-dialog__row";
-  row.dataset["field"] = field;
-  const name = document.createElement("span");
-  name.className = "ws-about-dialog__label";
-  name.textContent = label;
-  const value = document.createElement("span");
-  value.className = "ws-about-dialog__value";
-  const copy = document.createElement("button");
-  copy.type = "button";
-  copy.className = "ws-about-dialog__copy";
-  copy.setAttribute("aria-label", copyLabel);
-  copy.innerHTML = ICON_COPY;
-  copy.addEventListener("click", () => {
-    void onCopy().then((copied) => {
-      if (copied) {
-        copy.innerHTML = ICON_CHECK;
-      }
-    });
-  });
-  row.append(name, value, copy);
-  return { row, value };
-}
-
-/**
- * Opens the About modal; a no-op while one is already open. Returns the
- * disposable that dismisses the dialog - Escape and the Close button
- * dispose it too.
- */
-export function showAboutDialog(updates?: UpdateService): IDisposable {
-  if (document.querySelector(".ws-about-dialog")) {
-    // The open dialog owns its own teardown; there is nothing to release.
-    return toDisposable(() => {});
-  }
-  const invoker = document.activeElement instanceof HTMLElement ? document.activeElement : null;
-
-  const overlay = document.createElement("div");
-  overlay.className = "ws-about-dialog-overlay";
-
-  const dialog = document.createElement("section");
-  dialog.className = "ws-about-dialog";
-  dialog.setAttribute("role", "dialog");
-  dialog.setAttribute("aria-modal", "true");
-  dialog.setAttribute("aria-labelledby", "about-dialog-title");
-
-  const icon = document.createElement("img");
-  icon.className = "ws-about-dialog__icon";
-  icon.src = "/icons/runvil-icon.png";
-  icon.srcset = "/icons/runvil-icon.png 1x, /icons/runvil-icon@2x.png 2x";
-  icon.alt = "";
-
-  const title = document.createElement("h2");
-  title.id = "about-dialog-title";
-  title.className = "ws-about-dialog__title";
-  title.textContent = "Runvil";
-
-  let currentVersion = APP_VERSION;
-  const versionRow = buildRow("version", "Version", "Copy version", () =>
-    copyToClipboard(currentVersion),
-  );
-  // The date row exists only when the build defines a date.
-  const dateRow =
-    APP_DATE === null
-      ? null
-      : buildRow("date", "Date", "Copy date", () => copyToClipboard(APP_DATE));
-  if (dateRow !== null) {
-    dateRow.value.textContent = APP_DATE;
-  }
-
-  const license = document.createElement("p");
-  license.className = "ws-about-dialog__line";
-  license.textContent = `License: ${LICENSE}`;
-
-  const check = document.createElement("button");
-  check.type = "button";
-  check.className = "ws-about-dialog__check button button-secondary";
-
-  const primary = document.createElement("button");
-  primary.type = "button";
-  primary.className = "ws-about-dialog__primary button button-primary";
-  primary.textContent = "Copy version info";
-
-  const close = document.createElement("button");
-  close.type = "button";
-  close.className = "ws-about-dialog__close button button-secondary";
-  close.textContent = "Close";
-
-  const actions = document.createElement("div");
-  actions.className = "ws-about-dialog__actions";
-  actions.append(check, close, primary);
-
-  // Cursor's update-button labels, one per update phase.
-  const renderUpdate = (): void => {
-    const snapshot = updates?.snapshot;
-    currentVersion = snapshot?.currentVersion || APP_VERSION;
-    versionRow.value.textContent = currentVersion;
-    if (!snapshot || snapshot.phase === "browser") {
-      check.textContent = "Desktop updates unavailable";
-      check.disabled = true;
-    } else if (snapshot.phase === "unsupported") {
-      check.textContent = "Updates are managed by your package manager";
-      check.disabled = true;
-    } else if (snapshot.phase === "checking") {
-      check.textContent = "Checking for Updates...";
-      check.disabled = true;
-    } else if (
-      snapshot.phase === "downloading" ||
-      snapshot.phase === "installing" ||
-      snapshot.phase === "restarting"
-    ) {
-      // A new check would close the update handle the install is using.
-      check.textContent = "Installing Update...";
-      check.disabled = true;
-    } else if (snapshot.phase === "available" || snapshot.phase === "dismissed") {
-      check.textContent = "Download Update";
-      check.disabled = false;
-    } else if (snapshot.phase === "error") {
-      check.textContent = "Retry update check";
-      check.disabled = false;
-    } else {
-      check.textContent = "Check for Updates...";
-      check.disabled = false;
-    }
-  };
-
-  dialog.append(icon, title, versionRow.row);
-  if (dateRow !== null) {
-    dialog.append(dateRow.row);
-  }
-  dialog.append(license, actions);
-  overlay.appendChild(dialog);
-
-  const store = new DisposableStore();
-  if (updates) {
-    store.add(updates.onDidChange(renderUpdate));
-  }
-
-  function dismiss(): void {
-    store.dispose();
-  }
-
-  /**
-   * Copies the version (and the date, when there is one) as the dialog's
-   * primary action. The button says "Copied" only when the write landed.
-   */
-  async function copyVersionInfo(): Promise<void> {
-    const info =
-      APP_DATE === null
-        ? `Version: ${currentVersion}`
-        : `Version: ${currentVersion}\nDate: ${APP_DATE}`;
-    if (await copyToClipboard(info)) {
-      primary.textContent = "Copied";
-    }
-  }
-
-  function onKeydown(event: KeyboardEvent): void {
-    if (event.key === "Escape") {
-      event.preventDefault();
-      dismiss();
-      return;
-    }
-    if (event.key === "Enter") {
-      // Enter belongs to whichever other button holds focus (Close, the
-      // update button, a copy button); anywhere else it is the primary
-      // action, Copy version info.
-      const active = document.activeElement;
-      const onOtherButton =
-        active instanceof HTMLElement &&
-        active !== primary &&
-        dialog.contains(active) &&
-        active.tagName === "BUTTON";
-      if (!onOtherButton) {
-        event.preventDefault();
-        void copyVersionInfo();
-      }
-      return;
-    }
-    if (event.key !== "Tab") {
-      return;
-    }
-    const focusable = [...dialog.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR)];
-    const first = focusable[0];
-    const last = focusable[focusable.length - 1];
-    if (!first || !last) {
-      event.preventDefault();
-      return;
-    }
-    const active = document.activeElement;
-    const outside = !active || !dialog.contains(active);
-    if (event.shiftKey && (outside || active === first)) {
-      event.preventDefault();
-      last.focus();
-    } else if (!event.shiftKey && (outside || active === last)) {
-      event.preventDefault();
-      first.focus();
-    }
-  }
-
-  // Teardown order matters: the trap listener detaches first, then the
-  // overlay leaves the DOM and focus returns to the invoker.
-  store.add(toDisposable(() => document.removeEventListener("keydown", onKeydown, true)));
-  store.add(
-    toDisposable(() => {
-      overlay.remove();
-      invoker?.focus();
-    }),
-  );
-
-  // The buttons' listeners are element-owned: they go away with the
-  // overlay and need no registration.
-  close.addEventListener("click", dismiss);
-  primary.addEventListener("click", () => {
-    void copyVersionInfo();
-  });
-  check.addEventListener("click", () => {
-    const snapshot = updates?.snapshot;
-    if (snapshot?.phase === "available" || snapshot?.phase === "dismissed") {
-      updates?.showAvailable();
-      dismiss();
-    } else {
-      void updates?.checkNow();
-    }
-  });
-  renderUpdate();
-  document.addEventListener("keydown", onKeydown, true);
-  document.body.appendChild(overlay);
-  primary.focus();
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/chrome/chrome.contribution.ts b/crates/workshop/ui/src/parts/chrome/chrome.contribution.ts
deleted file mode 100644
index fdc0299bb..000000000
--- a/crates/workshop/ui/src/parts/chrome/chrome.contribution.ts
+++ /dev/null
@@ -1,142 +0,0 @@
-// The chrome contribution: the eager module registering the window-level
-// catalog rows at module scope, before any service exists.
-// Chrome is a light eager feature - main.ts already loads window-chrome
-// and zoom eagerly - so the run bodies are direct calls.
-//
-// Placements follow the catalog: the zoom triple sits in Appearance's
-// 5_zoom group with ctrlcmd chords (Cmd on macOS), Full Screen and Close
-// Window are desktop-only (precondition !isWeb), and About lands at the
-// Help menu's z_about. Reset Zoom's second chord (ctrlcmd+0) and the two
-// per-OS overrides (Full Screen's ctrl+meta+f on macOS, Close Window's
-// meta+shift+w) are separate registerKeybindingRule calls: the action
-// descriptor's keybinding omits the mac field, so those rules register
-// directly with the precondition ANDed in by hand. Zoom In also binds
-// ctrlcmd+shift+= - the shifted plus is the same physical key, and both
-// are the conventional zoom-in chord - and ctrlcmd+numpad_add, with
-// Zoom Out on ctrlcmd+numpad_subtract. The first rule registered for a
-// command becomes its menu label, so Reset Zoom shows Ctrl+NumPad0.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { invoke } from "@tauri-apps/api/core";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { UPDATES } from "../../services/update-service";
-import { showAboutDialog } from "./about-dialog";
-import { closeWindow, toggleFullScreen } from "./window-chrome";
-import { resetZoom, zoomIn, zoomOut } from "./zoom";
-
-/** The Appearance flyout's id; the menubar contribution declares the submenu. */
-const APPEARANCE_MENU: MenuId = "menubar/view/appearance";
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`chrome action '${action.id}': ${result.error.message}`);
-  }
-}
-
-addAction({
-  id: "workbench.action.toggleFullScreen",
-  title: "Full Screen",
-  f1: true,
-  precondition: "!isWeb",
-  toggled: "isFullscreen",
-  menu: [{ id: APPEARANCE_MENU, group: "1_toggle_view", order: 1 }],
-  run: toggleFullScreen,
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.toggleFullScreen",
-  keybinding: "f11",
-  mac: "ctrl+meta+f",
-  when: "!isWeb",
-});
-
-addAction({
-  id: "workbench.action.closeWindow",
-  title: "Close Window",
-  f1: true,
-  precondition: "!isWeb",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "6_close", order: 4 }],
-  run: closeWindow,
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.closeWindow",
-  keybinding: "alt+f4",
-  mac: "meta+shift+w",
-  when: "!isWeb",
-});
-
-addAction({
-  id: "workbench.action.zoomIn",
-  title: "Zoom In",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+=" },
-  menu: [{ id: APPEARANCE_MENU, group: "5_zoom", order: 1 }],
-  run: zoomIn,
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.zoomIn",
-  keybinding: "ctrlcmd+shift+=",
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.zoomIn",
-  keybinding: "ctrlcmd+numpad_add",
-});
-
-addAction({
-  id: "workbench.action.zoomOut",
-  title: "Zoom Out",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+-" },
-  menu: [{ id: APPEARANCE_MENU, group: "5_zoom", order: 2 }],
-  run: zoomOut,
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.zoomOut",
-  keybinding: "ctrlcmd+numpad_subtract",
-});
-
-addAction({
-  id: "workbench.action.zoomReset",
-  title: "Reset Zoom",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+numpad0" },
-  menu: [{ id: APPEARANCE_MENU, group: "5_zoom", order: 3 }],
-  run: resetZoom,
-});
-KeybindingsRegistry.registerKeybindingRule({
-  id: "workbench.action.zoomReset",
-  keybinding: "ctrlcmd+0",
-});
-
-addAction({
-  id: "workbench.action.showAboutDialog",
-  title: "About",
-  f1: true,
-  menu: [{ id: MenuId.MenubarHelpMenu, group: "z_about" }],
-  run: () => {
-    showAboutDialog(getServiceOrNull(UPDATES) ?? undefined);
-  },
-});
-
-// File > Exit, the catalog's chrome row. The run body invokes the
-// desktop app's quit command - the same path the native menu's quit
-// item runs: stop the gateway supervisor, request the local gateway's
-// shutdown, then exit. Never call the Tauri process plugin's exit(0) here
-// instead; it would strand the sidecar gateway. Desktop-only: the
-// !isWeb precondition disables the row in a browser.
-addAction({
-  id: "workbench.action.quit",
-  title: "Exit",
-  f1: true,
-  precondition: "!isWeb",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "z_Exit", order: 1 }],
-  run: async () => {
-    await invoke("quit");
-  },
-});
diff --git a/crates/workshop/ui/src/parts/chrome/command-center.css b/crates/workshop/ui/src/parts/chrome/command-center.css
deleted file mode 100644
index d6ae00793..000000000
--- a/crates/workshop/ui/src/parts/chrome/command-center.css
+++ /dev/null
@@ -1,67 +0,0 @@
-/* Styles for command-center.ts, which imports this file; esbuild bundles it
-   into dist/app.css. Themed values come from the :root tokens in @workshop/look/tokens.css. */
-
-/* The no-drag marker: the center region initiates a native drag only when
-   the pointer lands on the region itself (window-chrome.ts), so this class
-   is the styling hook that makes the exemption explicit. */
-.ws-window-titlebar__no-drag {
-  user-select: none;
-}
-
-/* The command center centers itself in the drag region and never drags. */
-.ws-command-center {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: var(--space-1);
-  block-size: 100%;
-  min-inline-size: 0;
-}
-
-/* The folder-name button: the window title as a quiet 12px label that
-   washes on hover. Inline size is clamped so a long folder name truncates
-   instead of crowding the bar. */
-.ws-command-center__folder,
-.ws-command-center__item {
-  display: inline-flex;
-  align-items: center;
-  padding: var(--ws-size-1) var(--ws-size-6);
-  color: inherit;
-  background: none;
-  border: none;
-  border-radius: var(--radius);
-  font: inherit;
-  font-size: var(--font-size-sm);
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-command-center__folder {
-  max-inline-size: 38vw;
-  min-inline-size: 0;
-}
-
-/* Extra MenuId.CommandCenter rows: plain toolbar buttons beside the folder-name button. */
-.ws-command-center__item {
-  flex: none;
-}
-
-.ws-command-center__folder:hover,
-.ws-command-center__item:hover {
-  background: var(--titlebar-folder-hover);
-}
-
-/* Focus takes the hover state, like the window controls: no ring. */
-.ws-command-center__folder:focus-visible,
-.ws-command-center__item:focus-visible {
-  outline: none;
-  background: var(--titlebar-folder-hover);
-}
-
-/* The window title truncates with an ellipsis inside the clamped button. */
-.ws-command-center__title {
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
diff --git a/crates/workshop/ui/src/parts/chrome/command-center.ts b/crates/workshop/ui/src/parts/chrome/command-center.ts
deleted file mode 100644
index 78ef08868..000000000
--- a/crates/workshop/ui/src/parts/chrome/command-center.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-// The command center: a small toolbar over MenuId.CommandCenter, mounted
-// inside the title bar's center drag region with the no-drag marker
-// (window-chrome.ts starts a native drag only when the pointer lands on
-// the region itself, so any child element is already exempt; the class
-// documents the intent and is the styling hook). The toolbar's
-// built-in item is the folder-name button: the window title as a quiet
-// label, with no search icon and no ? chevron. A mouse press on it
-// dispatches the menu's first command row
-// (workbench.action.quickOpenWithModes, registered by the quickinput
-// contribution) on mousedown, the way Cursor's title bar opens quick
-// open; a click with no preceding press (detail 0, the keyboard's Enter
-// or Space) does the same, and the click that ends a mouse press is
-// ignored so one gesture never opens it twice. Any further command rows
-// render as plain toolbar buttons beside it. Neither names the quick
-// input widget; both dispatch through the command registry like every
-// other surface.
-//
-// The WindowTitle helper owns the title text: the first granted root's
-// folder name, or "Runvil" when no root is granted or the listing
-// cannot be read. It reads the roots through the tree-state service's
-// shared roots() load - the same load the tree panel renders from, so a
-// boot costs one GET /workspace/tree - re-reads them on the
-// workspace-changed event (fired by workspace-drops.ts and the tree
-// panel's Add/Remove Folder) and mirrors the text into document.title.
-
-import "./command-center.css";
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { CommandRegistry, Commands, logCommandFailure } from "@workshop/platform/command-registry";
-import { MenuId, Menus, type MenuItem, type MenuRegistry } from "@workshop/platform/menu-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { TREE_STATE } from "../../services/tree-state-service";
-import { WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-
-/** The title shown when no workspace folder is granted. */
-const FALLBACK_TITLE = "Runvil";
-
-/** One granted root, narrowed to the field the title reads. */
-interface GrantedRoot {
-  readonly name: string;
-}
-
-/** Reads the granted roots; defaults to the tree-state service's shared load. */
-export type ListRoots = () => Promise<readonly GrantedRoot[]>;
-
-const defaultListRoots: ListRoots = async () => (await getService(TREE_STATE).roots()).entries;
-
-/** Registry and roots overrides; tests inject their own. */
-export interface CommandCenterDependencies {
-  readonly commands?: CommandRegistry;
-  readonly menus?: MenuRegistry;
-  readonly listRoots?: ListRoots;
-}
-
-/**
- * The window title label. Shows the first granted root's folder name,
- * falling back to "Runvil", and keeps document.title in step. A
- * failed listing renders the fallback rather than throwing at boot.
- */
-export class WindowTitle extends Disposable {
-  /** The label element; the command center appends it inside the folder-name button. */
-  readonly element: HTMLSpanElement;
-
-  private readonly listRoots: ListRoots;
-  // A slow refetch must not overwrite a newer one: only the latest
-  // generation may write the title.
-  private generation = 0;
-
-  constructor(deps: { readonly listRoots?: ListRoots } = {}) {
-    super();
-    this.listRoots = deps.listRoots ?? defaultListRoots;
-    this.element = document.createElement("span");
-    this.element.className = "ws-command-center__title";
-    this.element.textContent = FALLBACK_TITLE;
-    const onWorkspaceChanged = (): void => {
-      void this.refresh();
-    };
-    window.addEventListener(WORKSPACE_CHANGED_EVENT, onWorkspaceChanged);
-    this._register(toDisposable(() => window.removeEventListener(WORKSPACE_CHANGED_EVENT, onWorkspaceChanged)));
-    void this.refresh();
-  }
-
-  private async refresh(): Promise<void> {
-    const generation = ++this.generation;
-    let title = FALLBACK_TITLE;
-    try {
-      const first = (await this.listRoots())[0];
-      if (first !== undefined && first.name !== "") {
-        title = first.name;
-      }
-    } catch {
-      // The roots listing is unreadable (server down, bad shape): the
-      // fallback title stands until the next workspace change.
-    }
-    if (generation !== this.generation) {
-      return;
-    }
-    this.element.textContent = title;
-    document.title = title;
-  }
-}
-
-/**
- * The command center toolbar over MenuId.CommandCenter. Mounts into the
- * title bar's center drag region; the menu's first command row is the
- * folder-name button's dispatch, and any further command rows render as
- * toolbar buttons beside it.
- */
-export class CommandCenter extends Disposable {
-  private readonly commands: CommandRegistry;
-  private readonly menus: MenuRegistry;
-
-  constructor(center: HTMLElement, deps: CommandCenterDependencies = {}) {
-    super();
-    this.commands = deps.commands ?? Commands;
-    this.menus = deps.menus ?? Menus;
-
-    const container = document.createElement("div");
-    container.className = "ws-command-center ws-window-titlebar__no-drag";
-
-    const rows = this.menus
-      .getMenuItems(MenuId.CommandCenter)
-      .filter((row): row is MenuItem => !("submenu" in row));
-    const folderRow = rows[0];
-
-    // The tooltip, not an aria-label: the visible folder name is the
-    // accessible name, and a label that dropped it would fail label-in-name.
-    const folder = document.createElement("button");
-    folder.type = "button";
-    folder.className = "ws-command-center__folder";
-    folder.title = "Search files, commands, and more";
-
-    const title = this._register(new WindowTitle({ listRoots: deps.listRoots }));
-    folder.appendChild(title.element);
-
-    const open = (): void => {
-      if (folderRow !== undefined) {
-        this.run(folderRow.command, ...(folderRow.args ?? []));
-      }
-    };
-    folder.addEventListener("mousedown", (event) => {
-      if (event.button === 0) {
-        // The press's default action moves focus to this button, and it
-        // lands after open() has already focused the quick input's box;
-        // canceling it keeps the panel's keyboard focus.
-        event.preventDefault();
-        open();
-      }
-    });
-    folder.addEventListener("click", (event) => {
-      // A mouse press already opened quick open on mousedown and carries
-      // a click count of 1 or more; only a keyboard-synthesized click
-      // (Enter or Space, detail 0) still needs to open it.
-      if (event.detail === 0) {
-        open();
-      }
-    });
-
-    container.appendChild(folder);
-    for (const row of rows.slice(1)) {
-      container.appendChild(this.renderRow(row));
-    }
-    center.appendChild(container);
-    this._register(toDisposable(() => container.remove()));
-  }
-
-  /** Renders one extra menu row as a toolbar button beside the folder-name button. */
-  private renderRow(row: MenuItem): HTMLButtonElement {
-    const item = document.createElement("button");
-    item.type = "button";
-    item.className = "ws-command-center__item";
-    item.textContent = row.title ?? this.commands.lookup(row.command)?.title ?? row.command;
-    item.addEventListener("click", () => this.run(row.command, ...(row.args ?? [])));
-    return item;
-  }
-
-  /** Dispatches a command; the registry reports a failure (the toast), so only the detail is logged. */
-  private run(id: string, ...args: readonly unknown[]): void {
-    void this.commands.execute(id, ...args).catch((error: unknown) => {
-      logCommandFailure(id, error);
-    });
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chrome/model-picker-trigger.css b/crates/workshop/ui/src/parts/chrome/model-picker-trigger.css
deleted file mode 100644
index 2a82ed890..000000000
--- a/crates/workshop/ui/src/parts/chrome/model-picker-trigger.css
+++ /dev/null
@@ -1,62 +0,0 @@
-/* The model picker trigger (model-picker-trigger.ts imports this file;
-   esbuild bundles it into dist/app.css). The menu it opens is the
-   composer's shared surface (look's dropdown.css, .menu-composer); these
-   rules cover the trigger and that menu's size. The button is 20px tall
-   with a 4px radius and 6px side padding, its text 13px/18px in the
-   secondary tier, an 8% fill on hover, and a 9px chevron at 0.7 opacity.
-   Themed values come from the :root tokens in @workshop/look/tokens.css. */
-
-.ws-model-picker-trigger {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--space-1);
-  block-size: var(--model-trigger-height);
-  padding-block: 0;
-  padding-inline: var(--space-1-5);
-  font: inherit;
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  color: var(--cursor-text-secondary);
-  background: transparent;
-  border: none;
-  border-radius: var(--model-trigger-radius);
-  cursor: pointer;
-  white-space: nowrap;
-}
-
-/* The open state keeps the hover wash: DropdownMenu sets aria-expanded
-   on the trigger while its menu is up. */
-.ws-model-picker-trigger:hover,
-.ws-model-picker-trigger[aria-expanded="true"],
-.ws-model-picker-trigger:focus-visible {
-  background: var(--cursor-bg-tertiary);
-}
-
-.ws-model-picker-trigger:focus-visible {
-  outline: none;
-}
-
-/* Long model ids truncate instead of stretching the toolbar. */
-.ws-model-picker-trigger__label {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  max-inline-size: var(--ws-model-trigger-max-width);
-}
-
-.ws-model-picker-trigger__icon {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  opacity: 0.7;
-}
-
-.ws-model-picker-trigger__icon svg {
-  inline-size: var(--ws-model-chevron-size);
-  block-size: var(--ws-model-chevron-size);
-}
-
-/* The menu: 230px wide and at most 320px tall. */
-.ws-model-menu {
-  inline-size: var(--ws-model-menu-width);
-  max-block-size: var(--ws-model-menu-max-height);
-}
diff --git a/crates/workshop/ui/src/parts/chrome/model-picker-trigger.ts b/crates/workshop/ui/src/parts/chrome/model-picker-trigger.ts
deleted file mode 100644
index 645be52db..000000000
--- a/crates/workshop/ui/src/parts/chrome/model-picker-trigger.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-// The model picker trigger: a toolbar button showing the selected
-// model's id, with a 9px chevron. Clicking it (or Ctrl+/, through open)
-// opens a DropdownMenu of the ModelService catalog on the composer's menu
-// surface - check-only selection, 230px wide, at most 320px tall - and
-// picking one sends the select command through the service. The label
-// never updates optimistically - the server owns the selection, so the
-// trigger re-renders only when the service's selection changes. The label
-// shows the selected id alone, so a catalog change leaves it as it is; the
-// menu reads the catalog each time it opens.
-
-import "./model-picker-trigger.css";
-
-import { ICON_CHEVRON_DOWN } from "@workshop/look/icons";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import type { ModelService } from "../../services/model-service";
-import { DropdownMenu } from "@workshop/look/dropdown";
-import type { DropdownItem } from "@workshop/look/dropdown";
-
-/** The trigger label when no model is selected. */
-const NO_SELECTION_LABEL = "Select model";
-
-/** The single menu row shown when the catalog is empty. */
-const EMPTY_CATALOG_LABEL = "No models found";
-
-/** The trigger's tooltip. */
-const TRIGGER_TITLE = "Switch Model (Ctrl+/)";
-
-/**
- * The trigger button plus its dropdown. Disposable: dispose() closes an
- * open menu, removes the click listener, and unsubscribes from the
- * service. The service is borrowed, not owned - the composition root
- * disposes it.
- */
-export class ModelPickerTrigger extends Disposable {
-  /** The trigger button; append it where the picker belongs. */
-  readonly element: HTMLButtonElement;
-
-  private readonly dropdown: DropdownMenu;
-  private readonly labelSlot: HTMLSpanElement;
-
-  constructor(private readonly modelService: ModelService) {
-    super();
-
-    this.element = document.createElement("button");
-    this.element.type = "button";
-    this.element.className = "ws-model-picker-trigger";
-    this.element.title = TRIGGER_TITLE;
-
-    this.labelSlot = document.createElement("span");
-    this.labelSlot.className = "ws-model-picker-trigger__label";
-
-    const iconSlot = document.createElement("span");
-    iconSlot.className = "ws-model-picker-trigger__icon";
-    iconSlot.setAttribute("aria-hidden", "true");
-    // The chevron is a static string from @workshop/look, never input.
-    iconSlot.innerHTML = ICON_CHEVRON_DOWN;
-
-    this.element.append(this.labelSlot, iconSlot);
-
-    this.dropdown = this._register(new DropdownMenu());
-
-    const onClick = (): void => this.showMenu();
-    this.element.addEventListener("click", onClick);
-    this._register(
-      toDisposable(() => this.element.removeEventListener("click", onClick)),
-    );
-
-    this._register(this.modelService.onDidChangeCurrent(() => this.renderCurrent()));
-
-    this.renderCurrent();
-  }
-
-  /** Opens the model menu (Ctrl+/); a menu already open stays open. */
-  open(): void {
-    if (!this.dropdown.isOpen) {
-      this.showMenu();
-    }
-  }
-
-  private showMenu(): void {
-    const models = this.modelService.models;
-    const current = this.modelService.current;
-    const items: DropdownItem[] =
-      models.length === 0
-        ? [{ label: EMPTY_CATALOG_LABEL, onClick: () => {} }]
-        : models.map((model) => ({
-            label: model.id,
-            selected: model.id === current,
-            onClick: () => this.select(model.id),
-          }));
-    this.dropdown.show(this.element, items, undefined, {
-      skin: "composer",
-      className: "ws-model-menu",
-      placement: "above",
-    });
-  }
-
-  private select(id: string): void {
-    // The send result needs no local handling: the selection changes only
-    // when the server's snapshot arrives, so a failed send simply leaves
-    // the label unchanged.
-    this.modelService.setCurrent(id);
-  }
-
-  private renderCurrent(): void {
-    const current = this.modelService.current;
-    this.labelSlot.textContent = current === "" ? NO_SELECTION_LABEL : current;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chrome/token-ring.css b/crates/workshop/ui/src/parts/chrome/token-ring.css
deleted file mode 100644
index d04f4b1e8..000000000
--- a/crates/workshop/ui/src/parts/chrome/token-ring.css
+++ /dev/null
@@ -1,43 +0,0 @@
-/* The token ring gauge (token-ring.ts imports this file; esbuild
-   bundles it into dist/app.css). Geometry (radius 5.5, stroke 2, dash
-   math) lives in the TS; these rules cover paint and size: a 15px gauge in
-   a 20px box (the 2.5px margin around it), round line caps, and an 8%
-   track. It is hidden while there is no usage data, and below 260px of
-   composer. Themed values come from the :root tokens in
-   @workshop/look/tokens.css. */
-
-.ws-token-ring {
-  display: block;
-  flex: none;
-  inline-size: var(--token-ring-size);
-  block-size: var(--token-ring-size);
-  margin: var(--ws-token-ring-margin);
-}
-
-/* The hidden attribute does not hide an SVG element by itself. */
-.ws-token-ring[hidden] {
-  display: none;
-}
-
-.ws-token-ring-background,
-.ws-token-ring-progress {
-  fill: none;
-}
-
-.ws-token-ring-background {
-  stroke: var(--token-ring-track);
-}
-
-.ws-token-ring-progress {
-  stroke: var(--token-ring-fill);
-  stroke-linecap: round;
-  /* SVG arcs start at three o'clock; rotate so the fill grows from twelve. */
-  transform: rotate(-90deg);
-  transform-origin: center;
-}
-
-@container ws-composer (width < 260px) {
-  .ws-token-ring {
-    display: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chrome/token-ring.ts b/crates/workshop/ui/src/parts/chrome/token-ring.ts
deleted file mode 100644
index c4466f6de..000000000
--- a/crates/workshop/ui/src/parts/chrome/token-ring.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-// The token ring: a 15px SVG gauge showing how much of the model's
-// context window the session has used. Two concentric circles - a track
-// and a progress arc driven by stroke-dashoffset - with stroke 2, radius
-// 5.5, and round line caps, sitting in a 20px box. The percentage comes
-// from a constructor-injected provider; the default stub reports no usage
-// data (null) until a real context-usage service replaces it, and the ring
-// stays hidden while it has none. setPercentage is the push path that
-// service (and tests) use.
-
-import "./token-ring.css";
-
-import { Disposable } from "@workshop/platform/lifecycle";
-
-/**
- * Supplies the context-usage percentage (0-100) the ring displays, or
- * null while there is no usage data, which hides the ring.
- */
-export type TokenRingPercentageProvider = () => number | null;
-
-/** The stub source: no context-usage service exists yet, so no data. */
-const stubProvider: TokenRingPercentageProvider = () => null;
-
-const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
-const VIEW_BOX_SIZE = 15;
-const STROKE_WIDTH = 2;
-const CENTER = VIEW_BOX_SIZE / 2;
-const RADIUS = 5.5;
-const CIRCUMFERENCE = 2 * Math.PI * RADIUS;
-
-/** Clamps an incoming percentage into 0-100; a non-finite value reads as empty. */
-function clampPercentage(percentage: number): number {
-  if (!Number.isFinite(percentage)) {
-    return 0;
-  }
-  return Math.min(100, Math.max(0, percentage));
-}
-
-/**
- * The ring gauge. The role is progressbar rather than img because the
- * ring reports a live scalar value: aria-valuenow keeps the percentage
- * available to assistive tech where an image role would hide it. With no
- * usage data the ring is hidden and carries no value. Disposable for
- * uniform toolbar lifetime; it owns no listeners.
- */
-export class TokenRing extends Disposable {
-  /** The SVG element; append it where the ring belongs. */
-  readonly element: SVGSVGElement;
-
-  private readonly provider: TokenRingPercentageProvider;
-  private readonly progressCircle: SVGCircleElement;
-  private current: number | null;
-
-  constructor(provider: TokenRingPercentageProvider = stubProvider) {
-    super();
-    this.provider = provider;
-
-    this.element = document.createElementNS(SVG_NAMESPACE, "svg");
-    this.element.setAttribute("class", "ws-token-ring");
-    this.element.setAttribute("viewBox", `0 0 ${VIEW_BOX_SIZE} ${VIEW_BOX_SIZE}`);
-    this.element.setAttribute("role", "progressbar");
-    this.element.setAttribute("aria-label", "Context usage");
-    this.element.setAttribute("aria-valuemin", "0");
-    this.element.setAttribute("aria-valuemax", "100");
-
-    const background = document.createElementNS(SVG_NAMESPACE, "circle");
-    background.setAttribute("class", "ws-token-ring-background");
-    background.setAttribute("cx", String(CENTER));
-    background.setAttribute("cy", String(CENTER));
-    background.setAttribute("r", String(RADIUS));
-    background.setAttribute("stroke-width", String(STROKE_WIDTH));
-
-    this.progressCircle = document.createElementNS(SVG_NAMESPACE, "circle");
-    this.progressCircle.setAttribute("class", "ws-token-ring-progress");
-    this.progressCircle.setAttribute("cx", String(CENTER));
-    this.progressCircle.setAttribute("cy", String(CENTER));
-    this.progressCircle.setAttribute("r", String(RADIUS));
-    this.progressCircle.setAttribute("stroke-width", String(STROKE_WIDTH));
-    this.progressCircle.setAttribute("stroke-linecap", "round");
-    this.progressCircle.setAttribute("stroke-dasharray", String(CIRCUMFERENCE));
-
-    this.element.append(background, this.progressCircle);
-
-    const initial = this.provider();
-    this.current = initial === null ? null : clampPercentage(initial);
-    this.renderPercentage();
-  }
-
-  /** The displayed percentage, clamped to 0-100, or null while there is no usage data. */
-  get percentage(): number | null {
-    return this.current;
-  }
-
-  /** Pushes a new percentage (null for no data) and re-renders the arc. */
-  setPercentage(percentage: number | null): void {
-    this.current = percentage === null ? null : clampPercentage(percentage);
-    this.renderPercentage();
-  }
-
-  private renderPercentage(): void {
-    if (this.current === null) {
-      // No usage data: the ring is hidden and reports no value.
-      this.element.setAttribute("hidden", "");
-      this.element.removeAttribute("aria-valuenow");
-      this.progressCircle.setAttribute("stroke-dashoffset", String(CIRCUMFERENCE));
-      return;
-    }
-    this.element.removeAttribute("hidden");
-    const offset = CIRCUMFERENCE * (1 - this.current / 100);
-    this.progressCircle.setAttribute("stroke-dashoffset", String(offset));
-    this.element.setAttribute("aria-valuenow", String(this.current));
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chrome/update-view.css b/crates/workshop/ui/src/parts/chrome/update-view.css
deleted file mode 100644
index 766cbd3c0..000000000
--- a/crates/workshop/ui/src/parts/chrome/update-view.css
+++ /dev/null
@@ -1,71 +0,0 @@
-.ws-update-banner {
-  position: fixed;
-  right: var(--space-3);
-  bottom: calc(var(--ws-update-banner-offset) + var(--space-3));
-  z-index: 190;
-  width: min(var(--ws-update-banner-width), calc(100vw - 2 * var(--space-3)));
-  padding: var(--space-3);
-  color: var(--text);
-  background: var(--bg-raised);
-  border: var(--ws-border-width) solid var(--border);
-  border-radius: var(--radius);
-  box-shadow: var(--ws-popup-shadow);
-}
-
-.ws-update-banner[hidden],
-.ws-update-screen[hidden] {
-  display: none;
-}
-
-.ws-update-banner p {
-  margin: var(--space-1-5) 0 var(--space-3);
-  color: var(--text-muted);
-}
-
-.ws-update-banner__actions {
-  display: flex;
-  justify-content: flex-end;
-  gap: var(--space-1-5);
-}
-
-/* The banner's and overlay's buttons wear the shared look controls
-   (.button-primary for Download Update, .button-secondary for the rest). */
-
-.ws-update-screen {
-  position: fixed;
-  inset: 0;
-  z-index: 210;
-  display: grid;
-  place-items: center;
-  background: var(--bg);
-}
-
-.ws-update-screen__panel {
-  width: min(var(--ws-update-screen-width), calc(100vw - 2 * var(--space-4)));
-  padding: var(--space-4);
-  color: var(--text);
-  background: var(--bg-raised);
-  border: var(--ws-border-width) solid var(--border);
-  border-radius: var(--radius);
-}
-
-.ws-update-screen__panel h2 {
-  margin: 0 0 var(--space-2);
-  font-size: var(--ws-title-font-size);
-  font-weight: 500;
-}
-
-.ws-update-screen__panel .progress {
-  margin: var(--space-2) 0;
-}
-
-.ws-update-screen__panel details {
-  margin: var(--space-2) 0;
-  color: var(--text-muted);
-}
-
-.ws-update-screen__panel pre {
-  max-height: var(--ws-update-log-max-height);
-  overflow: auto;
-  white-space: pre-wrap;
-}
diff --git a/crates/workshop/ui/src/parts/chrome/update-view.ts b/crates/workshop/ui/src/parts/chrome/update-view.ts
deleted file mode 100644
index fddabdbf8..000000000
--- a/crates/workshop/ui/src/parts/chrome/update-view.ts
+++ /dev/null
@@ -1,147 +0,0 @@
-// Update banner and installation overlay. Native I/O and state stay in the
-// service; this view only translates snapshots into DOM. Transient update
-// notifications feed the shared toast stack (@workshop/look/toast); the banner
-// keeps the actionable "available" state and the overlay the install
-// progress (the shared inline progress bar).
-
-import "./update-view.css";
-
-import { createProgressBar } from "@workshop/look/progress";
-import type { ToastStack } from "@workshop/look/toast";
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { UpdateService, type UpdateSnapshot } from "../../services/update-service";
-
-function percentage(snapshot: UpdateSnapshot): number | null {
-  if (snapshot.total === null || snapshot.total <= 0) {
-    return null;
-  }
-  return Math.min(100, Math.round((snapshot.downloaded / snapshot.total) * 100));
-}
-
-export class UpdateView extends Disposable {
-  private readonly banner = document.createElement("aside");
-  private readonly overlay = document.createElement("div");
-  private installing = false;
-  private notifiedPhase: UpdateSnapshot["phase"] | null = null;
-
-  constructor(
-    private readonly service: UpdateService,
-    private readonly toasts: ToastStack,
-  ) {
-    super();
-    this.banner.className = "ws-update-banner";
-    this.overlay.className = "ws-update-screen";
-    document.body.append(this.banner, this.overlay);
-    this._register(toDisposable(() => this.banner.remove()));
-    this._register(toDisposable(() => this.overlay.remove()));
-    this._register(service.onDidChange((snapshot) => this.render(snapshot)));
-    this.render(service.snapshot);
-  }
-
-  private render(snapshot: UpdateSnapshot): void {
-    this.notify(snapshot);
-    this.renderBanner(snapshot);
-    this.renderScreen(snapshot);
-  }
-
-  /**
-   * Toasts the phase transitions a user must notice without watching. A
-   * failed startup check stays quiet; the About dialog offers the retry.
-   */
-  private notify(snapshot: UpdateSnapshot): void {
-    if (snapshot.phase === this.notifiedPhase) {
-      return;
-    }
-    this.notifiedPhase = snapshot.phase;
-    if (snapshot.phase === "available") {
-      this.toasts.show(`Runvil ${snapshot.version} is available`, "info");
-    } else if (snapshot.phase === "error" && !snapshot.background) {
-      this.toasts.show(`Update failed: ${snapshot.error}`, "error");
-    }
-  }
-
-  private renderBanner(snapshot: UpdateSnapshot): void {
-    this.banner.replaceChildren();
-    this.banner.hidden = snapshot.phase !== "available" || this.installing;
-    if (this.banner.hidden) {
-      return;
-    }
-    const title = document.createElement("strong");
-    title.textContent = `Runvil ${snapshot.version} is available`;
-    const notes = document.createElement("p");
-    notes.textContent = snapshot.notes || "A new desktop release is ready.";
-    const actions = document.createElement("div");
-    actions.className = "ws-update-banner__actions";
-    const later = document.createElement("button");
-    later.type = "button";
-    later.className = "button button-secondary";
-    later.textContent = "Remind me later";
-    later.addEventListener("click", () => this.service.remindLater());
-    const install = document.createElement("button");
-    install.type = "button";
-    install.className = "ws-update-banner__primary button button-primary";
-    // Cursor's label for an update that is available for download: the
-    // click starts the download, then installs and restarts on its own.
-    install.textContent = "Download Update";
-    install.addEventListener("click", () => {
-      this.installing = true;
-      this.render(this.service.snapshot);
-      void this.service.install();
-    });
-    actions.append(later, install);
-    this.banner.append(title, notes, actions);
-  }
-
-  private renderScreen(snapshot: UpdateSnapshot): void {
-    const active =
-      this.installing &&
-      ["downloading", "installing", "restarting", "error"].includes(snapshot.phase);
-    this.overlay.hidden = !active;
-    this.overlay.replaceChildren();
-    if (!active) {
-      return;
-    }
-    const panel = document.createElement("section");
-    panel.className = "ws-update-screen__panel";
-    panel.setAttribute("role", "dialog");
-    panel.setAttribute("aria-modal", "true");
-    panel.setAttribute("aria-labelledby", "update-screen-title");
-    const title = document.createElement("h2");
-    title.id = "update-screen-title";
-    title.textContent = `Updating to Runvil ${snapshot.version}`;
-    const status = document.createElement("p");
-    const progressValue = percentage(snapshot);
-    if (snapshot.phase === "downloading") {
-      status.textContent =
-        progressValue === null ? "Downloading Update..." : `Downloading Update... ${progressValue}%`;
-    } else if (snapshot.phase === "installing") {
-      status.textContent = "Installing Update...";
-    } else if (snapshot.phase === "restarting") {
-      status.textContent = "Restarting Runvil...";
-    } else {
-      status.textContent = `Update failed: ${snapshot.error}`;
-    }
-    const progress = createProgressBar("Update download progress");
-    progress.setFraction(progressValue === null ? null : progressValue / 100);
-    const details = document.createElement("details");
-    const summary = document.createElement("summary");
-    summary.textContent = "Update log";
-    const log = document.createElement("pre");
-    log.textContent = snapshot.log.join("\n");
-    details.append(summary, log);
-    panel.append(title, status, progress.element, details);
-    if (snapshot.phase === "error") {
-      const close = document.createElement("button");
-      close.type = "button";
-      close.className = "button button-secondary";
-      close.textContent = "Close";
-      close.addEventListener("click", () => {
-        this.installing = false;
-        this.render(this.service.snapshot);
-      });
-      panel.appendChild(close);
-    }
-    this.overlay.appendChild(panel);
-  }
-}
diff --git a/crates/workshop/ui/src/parts/chrome/window-chrome.css b/crates/workshop/ui/src/parts/chrome/window-chrome.css
deleted file mode 100644
index 7c446141f..000000000
--- a/crates/workshop/ui/src/parts/chrome/window-chrome.css
+++ /dev/null
@@ -1,156 +0,0 @@
-/* Styles for window-chrome.ts, which imports this file; esbuild bundles it
-   into dist/app.css. Themed values come from the :root tokens in @workshop/look/tokens.css. */
-
-/* --------------------------------------------------------------------------
-   Custom window title bar (Windows desktop chrome). Hidden by default and
-   revealed by window-chrome.ts only under the wry initialization flag; the
-   [hidden] rule must keep winning over the base rule's display:flex, which
-   the attribute selector's extra specificity guarantees. The bar is a
-   fixed-height row in the body's column flex layout - icon, menus, drag
-   region, then the three window controls in Windows order - and the desk
-   below absorbs it without overlap. Hover states flip instantly like native
-   chrome, so nothing here animates.
-   -------------------------------------------------------------------------- */
-.ws-window-titlebar {
-  flex: none;
-  display: flex;
-  align-items: stretch;
-  height: var(--titlebar-height);
-  background: var(--titlebar-bg);
-  border-bottom: var(--ws-border-width) solid var(--titlebar-divider);
-  color: var(--titlebar-foreground);
-  font-size: var(--titlebar-font-size);
-  line-height: 1;
-  user-select: none;
-}
-
-.ws-window-titlebar[hidden] {
-  display: none;
-}
-
-/* A blurred window dims the bar to its inactive text color
-   (window-chrome.ts toggles the class from the window's blur and focus). */
-.ws-window-titlebar--inactive {
-  color: var(--titlebar-foreground-inactive);
-}
-
-/* The program icon is decorative and noninteractive: 16px, centered in a
-   box as tall as the bar, flush to the left edge. */
-.ws-window-titlebar__icon {
-  flex: none;
-  align-self: center;
-  box-sizing: content-box;
-  width: var(--titlebar-icon-size);
-  height: var(--titlebar-icon-size);
-  padding: calc((var(--titlebar-icon-box) - var(--titlebar-icon-size)) / 2);
-  margin: 0;
-}
-
-/* macOS overlay chrome (the desktop app's titleBarStyle Overlay + hiddenTitle):
-   the native traffic lights float over the bar's left edge, so the icon
-   and menus shift right clear of them - VS Code's hiddenInset spacing.
-   window-chrome.ts adds the modifier class only in the desktop app. */
-.ws-window-titlebar--macos .ws-window-titlebar__left {
-  padding-inline-start: var(--titlebar-macos-inset);
-}
-
-/* The empty center: the only surface that initiates a native drag. */
-.ws-window-titlebar__drag {
-  flex: 1;
-  min-width: 0;
-  user-select: none;
-}
-
-/* Window controls: three equal-width buttons with centered glyphs. Hit
-   areas fill the bar's height; the min-height floor keeps them reachable
-   even if a skin shrinks the bar. */
-.ws-window-titlebar__controls {
-  flex: none;
-  display: flex;
-  align-items: stretch;
-  /* The controls keep their physical size when the window is zoomed:
-     zoom.ts publishes the factor, and dividing it out cancels the zoom
-     the rest of the page (and the native webview) applies. */
-  zoom: calc(1 / var(--ws-zoom-factor, 1));
-}
-
-/* The toolbars: icon buttons, a left one after the menus and a right one
-   before the window controls. They are the title bar's own toolbars, so
-   they take the IDE's toolbar-button hover wash. */
-.ws-window-titlebar__toolbar {
-  flex: none;
-  display: flex;
-  align-items: center;
-  gap: var(--space-1);
-  padding-inline: var(--space-1);
-}
-
-.ws-window-titlebar__tool {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: var(--titlebar-tool-size);
-  height: var(--titlebar-tool-size);
-  padding: 0;
-  color: var(--titlebar-glyph);
-  background: none;
-  border: none;
-  border-radius: var(--radius);
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-window-titlebar__tool:hover {
-  color: var(--cursor-icon-primary);
-  background: var(--cursor-toolbar-hover);
-}
-
-/* Focus takes the hover state, like the window controls: no ring. */
-.ws-window-titlebar__tool:focus-visible {
-  outline: none;
-  color: var(--cursor-icon-primary);
-  background: var(--cursor-toolbar-hover);
-}
-
-/* Browser mode hides the cluster via the hidden attribute; the flex
-   display above would otherwise beat the UA [hidden] rule. */
-.ws-window-titlebar__controls[hidden] {
-  display: none;
-}
-
-.ws-window-titlebar__control {
-  width: var(--titlebar-control-width);
-  min-height: var(--ws-control-height);
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  padding: 0;
-  background: none;
-  border: none;
-  color: var(--titlebar-glyph);
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-window-titlebar__control:focus-visible {
-  outline: none;
-  background: var(--titlebar-control-hover);
-}
-
-.ws-window-titlebar__control--minimize:hover,
-.ws-window-titlebar__control--maximize:hover {
-  background: var(--titlebar-control-hover);
-}
-
-.ws-window-titlebar__control--close:hover {
-  background: var(--titlebar-close-hover);
-  color: var(--titlebar-close-glyph-hover);
-}
-
-/* The maximize control swaps its two SVG glyphs via the hidden attribute;
-   the UA [hidden] rule covers only HTML-namespace elements, so SVG needs
-   an explicit rule. */
-.ws-window-titlebar__glyph--maximize[hidden],
-.ws-window-titlebar__glyph--restore[hidden] {
-  display: none;
-}
diff --git a/crates/workshop/ui/src/parts/chrome/window-chrome.ts b/crates/workshop/ui/src/parts/chrome/window-chrome.ts
deleted file mode 100644
index 2ecaa2eb9..000000000
--- a/crates/workshop/ui/src/parts/chrome/window-chrome.ts
+++ /dev/null
@@ -1,303 +0,0 @@
-// Custom window title bar. The bar is always shown, in the desktop app
-// and in a plain browser, because it holds the application menus; only
-// the native window controls (drag region, minimize/maximize/close) are
-// desktop-only, since they need the Tauri window API. Every control calls
-// the current window through @tauri-apps/api, which esbuild bundles the
-// same way as the rest of the UI.
-//
-// The bar also carries two toolbars of icon buttons, built here from a
-// fixed list of commands: Toggle Primary Side Bar after the menus on the
-// left, and Toggle Agents and the settings gear before the window controls
-// on the right. A press runs the command through the command registry, and
-// the tooltip names its chord. The bar follows the window's focus too: while
-// the window is blurred it wears the inactive modifier, which dims its text.
-
-import "./window-chrome.css";
-
-import { getCurrentWindow, type Window as TauriWindow } from "@tauri-apps/api/window";
-
-import { ICON_GEAR, ICON_LAYOUT_SIDEBAR_LEFT, ICON_LAYOUT_SIDEBAR_RIGHT } from "@workshop/look/icons";
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import { DisposableStore, toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import { detectPlatform } from "@workshop/platform/keybinding-parser";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { getService } from "@workshop/platform/service-registry";
-
-declare global {
-  interface Window {
-    // Injected by the Tauri runtime in the desktop app; absent in a plain
-    // browser, where the native window controls stay hidden.
-    __TAURI_INTERNALS__?: unknown;
-  }
-}
-
-/** The native window, or null in a plain browser where no window exists. */
-function currentWindow(): TauriWindow | null {
-  return window.__TAURI_INTERNALS__ === undefined ? null : getCurrentWindow();
-}
-
-/**
- * Runs one native window command. In a plain browser the command has no
- * window to act on; dropping it beats throwing from a click. A rejected
- * call in the desktop app is a packaging defect (a missing capability), so
- * it is logged rather than swallowed.
- */
-function runWindowCommand(run: (window: TauriWindow) => Promise<void>): void {
-  const win = currentWindow();
-  if (win === null) {
-    return;
-  }
-  void run(win).catch((error: unknown) => {
-    console.error("a native window command failed:", error);
-  });
-}
-
-/** Minimizes the window. Shared by the visible control and the Window menu. */
-export function minimizeWindow(): void {
-  runWindowCommand((win) => win.minimize());
-}
-
-/** Toggles between maximized and restored. Shared by the visible control, the drag region double-click, and the Window menu. */
-export function toggleWindowMaximize(): void {
-  runWindowCommand((win) => win.toggleMaximize());
-}
-
-/** Closes the window. Shared by the visible control and the File menu. */
-export function closeWindow(): void {
-  runWindowCommand((win) => win.close());
-}
-
-/** Toggles native fullscreen. The Appearance menu's Full Screen row and F11 dispatch here. */
-export function toggleFullScreen(): void {
-  runWindowCommand(async (win) => {
-    await win.setFullscreen(!(await win.isFullscreen()));
-  });
-}
-
-/** Registry overrides; tests inject their own. */
-export interface WindowChromeDependencies {
-  readonly commands?: CommandRegistry;
-  readonly keybindings?: KeybindingsRegistry;
-}
-
-/** One toolbar icon button: the command it runs, its accessible name, and its glyph. */
-interface ToolButtonSpec {
-  readonly commandId: string;
-  readonly label: string;
-  readonly icon: string;
-}
-
-/** The left toolbar, after the menubar. */
-const LEFT_TOOLS: readonly ToolButtonSpec[] = [
-  { commandId: "workbench.action.toggleSidebarVisibility", label: "Toggle Primary Side Bar", icon: ICON_LAYOUT_SIDEBAR_LEFT },
-];
-
-/** The right toolbar, before the window controls: Toggle Agents (the right zone) and the settings gear. */
-const RIGHT_TOOLS: readonly ToolButtonSpec[] = [
-  { commandId: "workbench.action.toggleAuxiliaryBar", label: "Toggle Agents", icon: ICON_LAYOUT_SIDEBAR_RIGHT },
-  { commandId: "workbench.action.openSettings", label: "Settings", icon: ICON_GEAR },
-];
-
-/** The active-window state's modifier class on the bar. */
-const INACTIVE_CLASS = "ws-window-titlebar--inactive";
-
-/**
- * Builds one toolbar of icon buttons. A press runs the command; a failure
- * posts to the status bar, the way every other surface reports one. The
- * tooltip is the label plus the command's chord, re-read on hover and focus
- * because the contributions that bind chords may register after boot.
- */
-function buildToolbar(
-  tools: readonly ToolButtonSpec[],
-  commands: CommandRegistry,
-  keybindings: KeybindingsRegistry,
-): HTMLElement {
-  const toolbar = document.createElement("div");
-  toolbar.className = "ws-window-titlebar__toolbar";
-  for (const tool of tools) {
-    const button = document.createElement("button");
-    button.type = "button";
-    button.className = "ws-window-titlebar__tool";
-    button.dataset["commandId"] = tool.commandId;
-    button.setAttribute("aria-label", tool.label);
-    button.innerHTML = tool.icon;
-    const refreshTooltip = (): void => {
-      const chord = keybindings.lookupKeybinding(tool.commandId)?.getLabel();
-      button.title = chord === undefined ? tool.label : `${tool.label} (${chord})`;
-    };
-    refreshTooltip();
-    button.addEventListener("pointerenter", refreshTooltip);
-    button.addEventListener("focus", refreshTooltip);
-    button.addEventListener("click", () => {
-      // The registry reports a failure (the toast); keep the detail.
-      void commands.execute(tool.commandId).catch((error: unknown) => {
-        logCommandFailure(tool.commandId, error);
-      });
-    });
-    toolbar.appendChild(button);
-  }
-  return toolbar;
-}
-
-/**
- * Reveals the custom title bar in every mode: the bar holds the
- * application menus, so it must show in a plain browser too. The drag
- * region, the window controls, and the maximized-state sync are wired
- * only inside the desktop app; in a browser the control cluster is
- * hidden instead, since the commands would have no window to reach.
- * The toolbars and the inactive-window mark are wired in every mode.
- * The menu buttons are wired to their popovers by `setupWindowMenus` in
- * parts/menu/index.ts. Returns the disposable owning every listener wired here.
- */
-export function setupWindowChrome(deps: WindowChromeDependencies = {}): IDisposable {
-  const store = new DisposableStore();
-  const bar = document.querySelector<HTMLElement>(".ws-window-titlebar");
-  if (!bar) {
-    throw new Error("DOM Error: .ws-window-titlebar not found in the page.");
-  }
-  const controls = bar.querySelector<HTMLElement>(".ws-window-titlebar__controls");
-  if (!controls) {
-    throw new Error("DOM Error: the title bar is missing its window-control cluster.");
-  }
-  const leftRegion = bar.querySelector<HTMLElement>(".ws-window-titlebar__left");
-  const rightRegion = bar.querySelector<HTMLElement>(".ws-window-titlebar__right");
-  if (!leftRegion || !rightRegion) {
-    throw new Error("DOM Error: the title bar is missing its left or right region.");
-  }
-
-  bar.hidden = false;
-
-  const commands = deps.commands ?? Commands;
-  const keybindings = deps.keybindings ?? KeybindingsRegistry;
-  const leftToolbar = buildToolbar(LEFT_TOOLS, commands, keybindings);
-  const rightToolbar = buildToolbar(RIGHT_TOOLS, commands, keybindings);
-  leftRegion.appendChild(leftToolbar);
-  rightRegion.insertBefore(rightToolbar, controls);
-  store.add(
-    toDisposable(() => {
-      leftToolbar.remove();
-      rightToolbar.remove();
-    }),
-  );
-
-  // Inactive window: the bar dims while the window is blurred. The bar
-  // starts active; the first blur or focus event is the first signal.
-  const onBlur = (): void => {
-    bar.classList.add(INACTIVE_CLASS);
-  };
-  const onFocus = (): void => {
-    bar.classList.remove(INACTIVE_CLASS);
-  };
-  window.addEventListener("blur", onBlur);
-  window.addEventListener("focus", onFocus);
-  store.add(
-    toDisposable(() => {
-      window.removeEventListener("blur", onBlur);
-      window.removeEventListener("focus", onFocus);
-    }),
-  );
-
-  const win = currentWindow();
-  // The platform context keys the menu rows read: isWeb gates the
-  // desktop-only rows (Full Screen, Close Window), isFullscreen drives
-  // the Full Screen checkbox. Both bind at boot, before any menu opens.
-  const contextKeys = getService(CONTEXT_KEY_SERVICE);
-  const fullscreenKey = contextKeys.createKey("isFullscreen", false);
-  contextKeys.createKey("isWeb", win === null);
-  if (win === null) {
-    // No native window exists for the buttons to act on; showing them
-    // would present dead controls.
-    controls.hidden = true;
-    return store;
-  }
-  // macOS overlay chrome: the desktop app runs the window with titleBarStyle
-  // Overlay and a hidden title, so the native traffic lights float over
-  // the bar's left edge and cover close/minimize/zoom. The custom
-  // Windows-style cluster would double them, so it hides, and the bar
-  // takes the class whose CSS insets the left region clear of the lights.
-  // The drag region and the state syncs stay: the empty center still
-  // drags, and the green light's native fullscreen is what isFullscreen
-  // tracks.
-  if (detectPlatform() === "mac") {
-    controls.hidden = true;
-    bar.classList.add("ws-window-titlebar--macos");
-  }
-  const drag = bar.querySelector<HTMLElement>(".ws-window-titlebar__drag");
-  const minimize = bar.querySelector<HTMLButtonElement>('[data-command="minimize"]');
-  const maximize = bar.querySelector<HTMLButtonElement>('[data-command="toggle-maximize"]');
-  const close = bar.querySelector<HTMLButtonElement>('[data-command="close"]');
-  if (!drag || !minimize || !maximize || !close) {
-    throw new Error("DOM Error: the title bar is missing a drag region or a window control.");
-  }
-  // The glyphs are <svg>, which has no `hidden` IDL attribute, so visibility
-  // is toggled through the content attribute (with a matching [hidden] rule
-  // in window-chrome.css, since the UA rule covers only HTML elements).
-  const maximizeGlyph = maximize.querySelector<SVGSVGElement>(".ws-window-titlebar__glyph--maximize");
-  const restoreGlyph = maximize.querySelector<SVGSVGElement>(".ws-window-titlebar__glyph--restore");
-  if (!maximizeGlyph || !restoreGlyph) {
-    throw new Error("DOM Error: the maximize control is missing its glyphs.");
-  }
-
-  minimize.addEventListener("click", minimizeWindow);
-  store.add(toDisposable(() => minimize.removeEventListener("click", minimizeWindow)));
-  maximize.addEventListener("click", toggleWindowMaximize);
-  store.add(toDisposable(() => maximize.removeEventListener("click", toggleWindowMaximize)));
-  close.addEventListener("click", closeWindow);
-  store.add(toDisposable(() => close.removeEventListener("click", closeWindow)));
-
-  // Only the empty center drags; the buttons handle their own presses.
-  // `startDragging` hands the mouse to the OS move loop, so the webview
-  // never sees the release and a `dblclick` can never be synthesized.
-  // The double-click is therefore read from the press itself: `mousedown`
-  // sets the click count in `detail` (a `pointerdown` always reports
-  // 0), and the second press toggles maximize instead of starting a drag.
-  // This mirrors the drag-region script Tauri injects for
-  // `data-tauri-drag-region`.
-  const onDragMouseDown = (event: MouseEvent): void => {
-    if (event.button !== 0 || event.target !== drag) {
-      return;
-    }
-    if (event.detail === 2) {
-      toggleWindowMaximize();
-    } else {
-      runWindowCommand((win) => win.startDragging());
-    }
-  };
-  drag.addEventListener("mousedown", onDragMouseDown);
-  store.add(toDisposable(() => drag.removeEventListener("mousedown", onDragMouseDown)));
-
-  // The maximize/restore glyph follows the window's maximized state, read
-  // back after every resize (every maximize path - button, double-click,
-  // Windows Snap, restore - surfaces as a resize). The DOM is touched only
-  // on transitions: a drag-resize streams resize events while the flag
-  // almost never changes.
-  let lastMaximized: boolean | null = null;
-  const syncMaximized = async (): Promise<void> => {
-    const maximized = await win.isMaximized();
-    if (maximized === lastMaximized) {
-      return;
-    }
-    lastMaximized = maximized;
-    maximize.setAttribute("aria-label", maximized ? "Restore" : "Maximize");
-    maximizeGlyph.toggleAttribute("hidden", maximized);
-    restoreGlyph.toggleAttribute("hidden", !maximized);
-  };
-  void syncMaximized();
-  // The fullscreen checkbox follows the window the same way: every
-  // transition (F11, the macOS green light, the menu row) is a resize.
-  const syncFullscreen = async (): Promise<void> => {
-    fullscreenKey.set(await win.isFullscreen());
-  };
-  void syncFullscreen();
-  const unlisten = win.onResized(() => {
-    void syncMaximized();
-    void syncFullscreen();
-  });
-  store.add(
-    toDisposable(() => {
-      void unlisten.then((off) => off());
-    }),
-  );
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/chrome/zoom.ts b/crates/workshop/ui/src/parts/chrome/zoom.ts
deleted file mode 100644
index b2ede3a65..000000000
--- a/crates/workshop/ui/src/parts/chrome/zoom.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-// Global window zoom: the Ctrl+= / Ctrl+- / Ctrl+0 keybindings and the
-// Window menu's zoom entries all dispatch through these functions, so
-// every surface shares one factor. Zoom is a level from -8 to 8, and each
-// level multiplies the factor by 1.2 (VS Code's zoomLevelToZoomFactor),
-// so level 1 is 120% and level -1 is 83.33%. Desktop uses WebView2's
-// viewport-aware zoom; Dockview's resize animation is disabled in
-// zones.css so its dividers settle in the same paint. Browser mode uses
-// CSS zoom. Both modes publish the factor as the --ws-zoom-factor custom
-// property on the root, which the title bar's window controls divide by
-// (window-chrome.css) so they keep their physical size.
-//
-// The factor persists as a bare number in the UI-state adapter's user
-// bucket: the composition root restores it with restoreZoom(initial) at
-// boot and installs the writer with persistZoom, and every later change
-// goes through that writer. A stored factor maps back to the nearest
-// level, which absorbs the four-decimal rounding levelToFactor applies.
-// The contribution's run bodies call zoomIn and
-// friends directly, so the writer lives in this module rather than on an
-// instance.
-
-import { getCurrentWebviewWindow } from "@tauri-apps/api/webviewWindow";
-
-import { toDisposable } from "@workshop/platform/lifecycle";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-
-/** The writer each zoom change hands the new factor to. */
-export type ZoomWriter = (value: unknown) => void;
-
-const ZOOM_LEVEL_MIN = -8;
-const ZOOM_LEVEL_MAX = 8;
-const ZOOM_BASE = 1.2;
-const ZOOM_DEFAULT_LEVEL = 0;
-const ZOOM_FACTOR_PROPERTY = "--ws-zoom-factor";
-
-// The last applied level is tracked here and restored from the user
-// bucket at boot.
-let currentLevel = ZOOM_DEFAULT_LEVEL;
-
-// The installed writer; a no-op until the composition root binds one.
-const noWriter: ZoomWriter = () => {};
-let write: ZoomWriter = noWriter;
-
-/** The factor a level maps to, rounded to four decimals so it stays readable and persists cleanly. */
-function levelToFactor(level: number): number {
-  return Math.round(ZOOM_BASE ** level * 10000) / 10000;
-}
-
-/** The current zoom factor; 1.0 is 100%. */
-export function getZoom(): number {
-  return levelToFactor(currentLevel);
-}
-
-/** The current zoom level, an integer from -8 to 8; 0 is 100%. */
-export function getZoomLevel(): number {
-  return currentLevel;
-}
-
-function applyToWindow(factor: number): void {
-  document.documentElement.style.setProperty(ZOOM_FACTOR_PROPERTY, String(factor));
-  if (window.__TAURI_INTERNALS__ !== undefined) {
-    void getCurrentWebviewWindow()
-      .setZoom(factor)
-      .catch((error: unknown) => {
-        console.error("native zoom failed:", error);
-      });
-    return;
-  }
-  document.body.style.position = "relative";
-  document.documentElement.style.zoom = String(factor);
-}
-
-/** Clamps and applies a level without persisting it. */
-function applyLevel(level: number): void {
-  currentLevel = Math.min(ZOOM_LEVEL_MAX, Math.max(ZOOM_LEVEL_MIN, level));
-  applyToWindow(levelToFactor(currentLevel));
-}
-
-/** Applies a level and writes the resulting factor through the installed writer. */
-function setLevel(level: number): void {
-  applyLevel(level);
-  try {
-    write(levelToFactor(currentLevel));
-  } catch (error: unknown) {
-    // The adapter reports its own failures; a throwing writer must not
-    // undo a zoom that already applied.
-    console.error("zoom persistence failed:", error);
-  }
-}
-
-/** Ctrl+=: zoom one level larger, clamped at level 8. */
-export function zoomIn(): void {
-  setLevel(currentLevel + 1);
-}
-
-/** Ctrl+-: zoom one level smaller, clamped at level -8. */
-export function zoomOut(): void {
-  setLevel(currentLevel - 1);
-}
-
-/** Ctrl+NumPad0: back to 100%. */
-export function resetZoom(): void {
-  setLevel(ZOOM_DEFAULT_LEVEL);
-}
-
-/**
- * Installs the writer every later zoom change goes through, replacing the
- * previous one. Disposing restores the no-op writer.
- */
-export function persistZoom(writer: ZoomWriter): IDisposable {
-  write = writer;
-  return toDisposable(() => {
-    if (write === writer) {
-      write = noWriter;
-    }
-  });
-}
-
-/**
- * Re-applies the persisted zoom factor at boot from the value the user
- * bucket held. The factor maps to the nearest level; anything but a
- * positive finite number whose level lands within -8 to 8 - null, a
- * string, an object, zero, an out-of-range factor - leaves the default
- * 100% in place. The restore applies without writing: the value came from
- * the store, so echoing it back would be a wasted request.
- */
-export function restoreZoom(initial: unknown): void {
-  if (typeof initial !== "number" || !Number.isFinite(initial) || initial <= 0) {
-    return;
-  }
-  const level = Math.round(Math.log(initial) / Math.log(ZOOM_BASE));
-  if (level < ZOOM_LEVEL_MIN || level > ZOOM_LEVEL_MAX) {
-    return;
-  }
-  applyLevel(level);
-}
diff --git a/crates/workshop/ui/src/parts/editor/closed-editors.ts b/crates/workshop/ui/src/parts/editor/closed-editors.ts
deleted file mode 100644
index 2233780a7..000000000
--- a/crates/workshop/ui/src/parts/editor/closed-editors.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-// The closed-editor stack behind Reopen Closed Editor. The stack belongs
-// to the workspace: it seeds from the workspace bucket's
-// "closed_editors" value at construction and writes the same shape,
-// `{ "paths": [...] }` most recent first, back through its writer on
-// every push and pop, so the files a user closed come back on relaunch.
-//
-// Only file closes persist. An untitled buffer's close keeps its text on
-// the in-memory stack for the session (reopening restores the draft) but
-// never reaches the writer: unsaved text is not persisted by design.
-//
-// The initial value arrives as unknown and passes a hand-written shape
-// check - a malformed or hostile payload reads as an empty stack, never
-// as a cast. The writer is fire-and-forget: a write that throws is
-// swallowed and the in-memory stack stays authoritative.
-//
-// The stack self-registers with a default factory (empty, no-op writer),
-// so any bundle that touches it gets a working singleton; the composition
-// root re-registers it bound to the live adapter before the editor chunk
-// installs its dock tracking. This module stays CodeMirror-free, apart
-// from editor-lifecycle.ts, so main.ts can bind the token without pulling
-// the editor chunk into the initial bundle.
-
-import {
-  CLOSED_EDITORS,
-  type ClosedEditor,
-  type ClosedEditors as ClosedEditorsContract,
-  type ClosedEditorsSnapshot,
-} from "../../services/closed-editors";
-import { registerService } from "@workshop/platform/service-registry";
-
-/** The most closed editors the stack retains; older entries drop. */
-const MAX_CLOSED_EDITORS = 50;
-
-/** The writer the stack hands `{ paths: [...] }` to after a change. */
-export type ClosedEditorsWriter = (value: unknown) => void;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/**
- * Narrows a most-recent-first path list into the in-memory stack order
- * (oldest first, so the reopen is a pop): non-string and empty entries
- * drop out, and only the most recent MAX_CLOSED_EDITORS survive.
- */
-function stackFromPaths(value: unknown): ClosedEditor[] {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  const recentFirst: ClosedEditor[] = [];
-  for (const item of value as readonly unknown[]) {
-    if (typeof item === "string" && item !== "") {
-      recentFirst.push({ kind: "file", path: item });
-    }
-    if (recentFirst.length === MAX_CLOSED_EDITORS) {
-      break;
-    }
-  }
-  return recentFirst.reverse();
-}
-
-/**
- * Narrows the persisted payload to the stack: it must be an object
- * with a `paths` array. Anything else reads as an empty stack.
- */
-function readInitial(initial: unknown): ClosedEditor[] {
-  return isRecord(initial) ? stackFromPaths(initial.paths) : [];
-}
-
-/**
- * The closed-editor stack. Push records a close, pop yields the most
- * recent one for reopening; both write the file-path snapshot through
- * the injected writer.
- */
-export class ClosedEditors implements ClosedEditorsContract {
-  // Oldest first: the most recent close is last, so the reopen is a pop.
-  private stack: ClosedEditor[];
-
-  /**
-   * `initial` is the value the workspace bucket held at boot (any shape;
-   * see readInitial); `write` receives `{ paths: [...] }` after each push
-   * or pop.
-   */
-  constructor(
-    initial: unknown = null,
-    private readonly write: ClosedEditorsWriter = () => {},
-  ) {
-    this.stack = readInitial(initial);
-  }
-
-  /** Records a closing editor; the oldest entry drops past the cap. */
-  push(entry: ClosedEditor): void {
-    this.stack.push(entry);
-    if (this.stack.length > MAX_CLOSED_EDITORS) {
-      this.stack.shift();
-    }
-    this.persist();
-  }
-
-  /** Removes and returns the most recently closed editor; undefined when none. */
-  pop(): ClosedEditor | undefined {
-    const entry = this.stack.pop();
-    if (entry !== undefined) {
-      this.persist();
-    }
-    return entry;
-  }
-
-  /** The persisted view: file paths, most recent first; Save As writes it. */
-  snapshot(): ClosedEditorsSnapshot {
-    const paths: string[] = [];
-    for (let i = this.stack.length - 1; i >= 0; i -= 1) {
-      const entry = this.stack[i];
-      if (entry !== undefined && entry.kind === "file") {
-        paths.push(entry.path);
-      }
-    }
-    return { paths };
-  }
-
-  /**
-   * Replaces the stack wholesale with a workspace's stored paths (Open
-   * Workspace from File), most recent first. Writes nothing: the paths
-   * came from the file, so echoing them back would be a second writer.
-   */
-  replaceClosedEditors(paths: readonly string[]): void {
-    this.stack = stackFromPaths(paths);
-  }
-
-  private persist(): void {
-    try {
-      this.write(this.snapshot());
-    } catch {
-      // The adapter reports its own failures; a throwing writer leaves
-      // the in-memory stack authoritative.
-    }
-  }
-}
-
-// Self-registration with an empty stack and a no-op writer: a consumer
-// that resolves the token before the composition root re-registers it
-// bound to the live adapter gets a working, unpersisted stack rather than
-// a wrong instance cached for the page lifetime.
-registerService(CLOSED_EDITORS, () => new ClosedEditors());
diff --git a/crates/workshop/ui/src/parts/editor/editor-commands.ts b/crates/workshop/ui/src/parts/editor/editor-commands.ts
deleted file mode 100644
index fc8e1fcfc..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-commands.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-// The editor's command layer, in two halves.
-//
-// Workshop-level commands - save the active editor and cycle the open
-// editors - resolve the dock through the service registry (the DOCK
-// token, registered by initZones) instead of capturing it.
-//
-// The CodeMirror-backed catalog rows: runInActiveEditor
-// and withActiveEditor resolve the active editor through the dock, the
-// built-in CodeMirror commands are re-exported so the contribution file
-// has exactly one lazy import site, and the custom StateCommands
-// (duplicate selection, cursor add rows, previous occurrence) plus the
-// smart-select selection stack live here beside save and cycle.
-// Keeping every CodeMirror import in this module is what lets
-// editor.contribution.ts stay out of the initial bundle.
-
-import type { IDockviewPanel } from "dockview";
-import { EditorSelection, type StateCommand } from "@codemirror/state";
-import type { Command, EditorView } from "@codemirror/view";
-import {
-  copyLineDown,
-  copyLineUp,
-  cursorMatchingBracket,
-  indentLess,
-  indentMore,
-  moveLineDown,
-  moveLineUp,
-  selectParentSyntax,
-  toggleBlockComment,
-  toggleLineComment,
-} from "@codemirror/commands";
-import { nextDiagnostic, previousDiagnostic } from "@codemirror/lint";
-import { openSearchPanel, SearchCursor, selectNextOccurrence, selectSelectionMatches } from "@codemirror/search";
-
-import { DOCK, resolvePanelContent } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { EditorPanel } from "./editor-panel";
-import { revealReplace } from "./find-widget";
-
-// The built-in CodeMirror commands behind the catalog rows, re-exported
-// so editor.contribution.ts lazy-imports this module and nothing else.
-export {
-  copyLineDown,
-  copyLineUp,
-  cursorMatchingBracket,
-  indentLess,
-  indentMore,
-  moveLineDown,
-  moveLineUp,
-  nextDiagnostic,
-  openSearchPanel,
-  previousDiagnostic,
-  selectNextOccurrence,
-  selectSelectionMatches,
-  toggleBlockComment,
-  toggleLineComment,
-};
-
-/** The panel's content as an EditorPanel, or null for other panel kinds. */
-export function asEditor(panel: IDockviewPanel | undefined): EditorPanel | null {
-  if (panel === undefined) {
-    return null;
-  }
-  // view.content may be the lazy wrapper while the chunk loads; unwrap
-  // to the real panel before the instanceof check.
-  const content = resolvePanelContent(panel.view.content);
-  return content instanceof EditorPanel ? content : null;
-}
-
-/** Every open editor panel, in dock order. */
-function editorPanels(): IDockviewPanel[] {
-  return getService(DOCK).panels.filter((panel) => asEditor(panel) !== null);
-}
-
-/** Ctrl+S: save the active editor. A no-op when no editor is active. */
-export function saveActiveEditor(): void {
-  const editor = asEditor(getService(DOCK).activePanel);
-  if (editor !== null) {
-    // save() handles its own failures (error bar, conflict dialog).
-    void editor.save();
-  }
-}
-
-/** The dockview direction behind each Split row. */
-const SPLIT_DIRECTIONS = {
-  up: "above",
-  down: "below",
-  left: "left",
-  right: "right",
-} as const;
-
-/** The direction a Split row moves the active editor. */
-export type SplitDirection = keyof typeof SPLIT_DIRECTIONS;
-
-/**
- * Split Up/Down/Left/Right: opens a fresh dock group beside the active
- * editor in the direction and moves the editor into it. Moving the only
- * panel out of a group dissolves the empty group, so splitting a lone
- * editor just repositions it. A no-op when no editor is active.
- */
-export function splitActiveEditor(direction: SplitDirection): void {
-  const dock = getService(DOCK);
-  const panel = dock.activePanel;
-  if (panel === undefined || asEditor(panel) === null) {
-    return;
-  }
-  const group = dock.addGroup({ referencePanel: panel, direction: SPLIT_DIRECTIONS[direction] });
-  panel.api.moveTo({ group });
-}
-
-/** Ctrl+Tab / Ctrl+Shift+Tab: cycle the open editors, wrapping around. */
-export function cycleEditor(direction: 1 | -1): void {
-  const dock = getService(DOCK);
-  const editors = editorPanels();
-  if (editors.length === 0) {
-    return;
-  }
-  const current = editors.findIndex((panel) => panel === dock.activePanel);
-  const index =
-    current === -1
-      ? direction === 1
-        ? 0
-        : editors.length - 1
-      : (current + direction + editors.length) % editors.length;
-  const panel = editors[index];
-  if (panel === undefined) {
-    return;
-  }
-  panel.api.setActive();
-  asEditor(panel)?.focus();
-}
-
-/**
- * Runs a CodeMirror command against the active editor's view. Returns
- * false when no editor is active or the command declines.
- */
-export function runInActiveEditor(command: Command | StateCommand): boolean {
-  const view = asEditor(getService(DOCK).activePanel)?.editorView() ?? null;
-  if (view === null) {
-    return false;
-  }
-  return command(view);
-}
-
-/** Runs `fn` with the active editor panel; a no-op when none is active. */
-export function withActiveEditor(fn: (panel: EditorPanel) => void): void {
-  const editor = asEditor(getService(DOCK).activePanel);
-  if (editor !== null) {
-    fn(editor);
-  }
-}
-
-/**
- * Go to Line/Column: moves the cursor to the 1-based line (and column)
- * in the active editor, clamped into the document, and focuses the view.
- */
-export function goToLine(line: number, column?: number): void {
-  const view = asEditor(getService(DOCK).activePanel)?.editorView() ?? null;
-  if (view === null) {
-    return;
-  }
-  const docLine = view.state.doc.line(Math.max(1, Math.min(line, view.state.doc.lines)));
-  const head = column === undefined ? docLine.from : Math.min(docLine.from + column - 1, docLine.to);
-  view.dispatch({
-    selection: EditorSelection.cursor(head),
-    scrollIntoView: true,
-    userEvent: "select",
-  });
-  view.focus();
-}
-
-/**
- * Replace: opens the search panel, shows the find widget's replace row
- * (a hidden field cannot take focus), and moves focus to the replace field.
- */
-export const startFindReplace: Command = (view) => {
-  if (!openSearchPanel(view)) {
-    return false;
-  }
-  revealReplace(view);
-  const replace = view.dom.querySelector("input[name=replace]");
-  if (replace instanceof HTMLInputElement) {
-    replace.focus();
-    replace.select();
-  }
-  return true;
-};
-
-// The expand/shrink selection stack, per view: expand pushes the
-// pre-expansion selection, shrink pops and restores it. A WeakMap so the
-// stack dies with the view.
-const selectionStacks = new WeakMap<EditorView, EditorSelection[]>();
-
-/** Expand Selection: selects the parent syntax node, pushing the prior selection. */
-export const smartSelectExpand: Command = (view) => {
-  const before = view.state.selection;
-  if (!selectParentSyntax({ state: view.state, dispatch: (tr) => view.dispatch(tr) })) {
-    return false;
-  }
-  const stack = selectionStacks.get(view) ?? [];
-  stack.push(before);
-  selectionStacks.set(view, stack);
-  return true;
-};
-
-/** Shrink Selection: restores the selection the last expand pushed; an empty stack is a no-op. */
-export const smartSelectShrink: Command = (view) => {
-  const previous = selectionStacks.get(view)?.pop();
-  if (previous === undefined) {
-    return false;
-  }
-  // The document may have changed since the push; clamp into range.
-  const length = view.state.doc.length;
-  view.dispatch({
-    selection: EditorSelection.create(
-      previous.ranges.map((range) =>
-        EditorSelection.range(Math.min(range.anchor, length), Math.min(range.head, length)),
-      ),
-    ),
-    userEvent: "select",
-  });
-  return true;
-};
-
-/**
- * Duplicate Selection: an all-empty selection copies the line down;
- * otherwise the selected text is inserted after each range and the
- * copies become the selection.
- */
-export const duplicateSelection: StateCommand = ({ state, dispatch }) => {
-  if (state.selection.ranges.every((range) => range.empty)) {
-    return copyLineDown({ state, dispatch });
-  }
-  const changes = state.selection.ranges.map((range) => ({
-    from: range.to,
-    insert: state.sliceDoc(range.from, range.to),
-  }));
-  const changeSet = state.changes(changes);
-  const ranges = state.selection.ranges.map((range) => {
-    const from = changeSet.mapPos(range.to, -1);
-    return EditorSelection.range(from, from + (range.to - range.from));
-  });
-  dispatch(
-    state.update({
-      changes: changeSet,
-      selection: EditorSelection.create(ranges),
-      scrollIntoView: true,
-      userEvent: "input",
-    }),
-  );
-  return true;
-};
-
-/** Builds Add Cursor Above/Below: one new cursor per head, one line over, same column. */
-function addCursorLine(direction: -1 | 1): StateCommand {
-  return ({ state, dispatch }) => {
-    const ranges = [...state.selection.ranges];
-    let added = false;
-    for (const range of state.selection.ranges) {
-      const line = state.doc.lineAt(range.head);
-      const target = line.number + direction;
-      if (target < 1 || target > state.doc.lines) {
-        continue;
-      }
-      const targetLine = state.doc.line(target);
-      const head = Math.min(targetLine.from + (range.head - line.from), targetLine.to);
-      ranges.push(EditorSelection.cursor(head));
-      added = true;
-    }
-    if (!added) {
-      return false;
-    }
-    dispatch(state.update({ selection: EditorSelection.create(ranges), userEvent: "select" }));
-    return true;
-  };
-}
-
-/** Add Cursor Above: a cursor one line up at the same column for each head. */
-export const insertCursorAbove: StateCommand = addCursorLine(-1);
-
-/** Add Cursor Below: a cursor one line down at the same column for each head. */
-export const insertCursorBelow: StateCommand = addCursorLine(1);
-
-/** Add Cursors to Line Ends: one cursor at the end of every line the selection touches. */
-export const insertCursorAtLineEnds: StateCommand = ({ state, dispatch }) => {
-  const cursors: number[] = [];
-  for (const range of state.selection.ranges) {
-    const firstLine = state.doc.lineAt(range.from).number;
-    let lastLine = state.doc.lineAt(range.to).number;
-    // A selection ending exactly at a line start does not touch that line.
-    if (!range.empty && lastLine > firstLine && range.to === state.doc.line(lastLine).from) {
-      lastLine -= 1;
-    }
-    for (let n = firstLine; n <= lastLine; n++) {
-      const end = state.doc.line(n).to;
-      if (!cursors.includes(end)) {
-        cursors.push(end);
-      }
-    }
-  }
-  dispatch(
-    state.update({
-      selection: EditorSelection.create(cursors.map((pos) => EditorSelection.cursor(pos))),
-      userEvent: "select",
-    }),
-  );
-  return true;
-};
-
-/**
- * Add Previous Occurrence: the mirror of selectNextOccurrence - adds the
- * closest match before the first range, wrapping to the document's last
- * match. All ranges must select the same text, as selectNextOccurrence
- * requires; a single already-selected match is a no-op.
- */
-export const selectPreviousOccurrence: StateCommand = ({ state, dispatch }) => {
-  const { ranges } = state.selection;
-  if (ranges.length === 0 || ranges.some((range) => range.empty)) {
-    return false;
-  }
-  const first = ranges[0];
-  if (first === undefined) {
-    return false;
-  }
-  const searched = state.sliceDoc(first.from, first.to);
-  if (ranges.some((range) => state.sliceDoc(range.from, range.to) !== searched)) {
-    return false;
-  }
-  const cursor = new SearchCursor(state.doc, searched);
-  let before: { from: number; to: number } | null = null;
-  let last: { from: number; to: number } | null = null;
-  for (let match = cursor.next(); !match.done; match = cursor.next()) {
-    const found = { from: match.value.from, to: match.value.to };
-    if (found.from < first.from) {
-      before = found;
-    }
-    last = found;
-  }
-  const target = before ?? last;
-  if (target === null || ranges.some((range) => range.from === target.from && range.to === target.to)) {
-    return false;
-  }
-  dispatch(
-    state.update({
-      selection: EditorSelection.create([...ranges, EditorSelection.range(target.from, target.to)]),
-      userEvent: "select.search",
-    }),
-  );
-  return true;
-};
diff --git a/crates/workshop/ui/src/parts/editor/editor-lifecycle.ts b/crates/workshop/ui/src/parts/editor/editor-lifecycle.ts
deleted file mode 100644
index 8bc7e6450..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-lifecycle.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-// The editor lifecycle: untitled-buffer allocation, the closed-editor
-// tracking behind Reopen Closed Editor, and the editor-sourced context
-// key (editorLangId) that menus and keybindings evaluate. activeEditor
-// is the layout's: zones.ts binds it to the active panel's type id.
-//
-// The tracking and the key follow the dock; the directory's register()
-// installs both when the editor chunk loads. The tracking records at
-// onDidRemovePanel, where the panel's content is still resolved
-// (dockview fires the event before disposing the renderer), onto the
-// ClosedEditors service (closed-editors.ts, workspace-persisted and
-// resolved through its token so the composition root can bind it to the
-// live adapter). A reopened untitled buffer allocates a fresh serial so
-// it never collides with a live one.
-
-import type { DockviewApi, IDockviewPanel } from "dockview";
-
-import { DisposableStore, type IDisposable } from "@workshop/platform/lifecycle";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import { getService } from "@workshop/platform/service-registry";
-import { openInZone } from "../layout/zones";
-import { CLOSED_EDITORS } from "../../services/closed-editors";
-import { asEditor } from "./editor-commands";
-import { onDidInitEditorPanel } from "./editor-panel";
-
-let nextUntitledSerial = 1;
-
-/** Allocates the serial behind an Untitled-N title and its panel id. */
-export function allocateUntitledSerial(): number {
-  const serial = nextUntitledSerial;
-  nextUntitledSerial += 1;
-  return serial;
-}
-
-/** Ctrl+N: opens a fresh untitled editor buffer. */
-export function newUntitledFile(): void {
-  openInZone("editor", { untitled: allocateUntitledSerial() });
-}
-
-/**
- * Records every closing editor on the closed-editor stack. Untitled
- * buffers keep their text for the session: reopening one restores the
- * content, still unsaved, though only file paths persist to the
- * workspace. The stack resolves per event, so a rebinding of the token
- * (a workspace switch) takes effect without reinstalling.
- */
-export function installClosedEditorTracking(dock: DockviewApi): IDisposable {
-  return dock.onDidRemovePanel((panel: IDockviewPanel) => {
-    const editor = asEditor(panel);
-    if (editor === null) {
-      return;
-    }
-    const path = editor.filePath();
-    getService(CLOSED_EDITORS).push(
-      path !== null ? { kind: "file", path } : { kind: "untitled", text: editor.currentText() },
-    );
-  });
-}
-
-/** Ctrl+Shift+T: reopens the most recently closed editor; a no-op when none. */
-export function reopenClosedEditor(): void {
-  const closed = getService(CLOSED_EDITORS).pop();
-  if (closed === undefined) {
-    return;
-  }
-  if (closed.kind === "file") {
-    openInZone("editor", { path: closed.path });
-  } else {
-    openInZone("editor", { untitled: allocateUntitledSerial(), text: closed.text });
-  }
-}
-
-/**
- * Binds the editor-sourced context key to the dock: editorLangId is the
- * active editor's language, unset while no editor is active. Dock events
- * cover activation changes; the panel-init hook covers the lazy chunk
- * swap, which fires no dock event.
- */
-export function bindEditorContextKeys(dock: DockviewApi): IDisposable {
-  const context = getService(CONTEXT_KEY_SERVICE);
-  const editorLangId = context.createKey<string | undefined>("editorLangId", undefined);
-  const update = (): void => {
-    const editor = asEditor(dock.activePanel);
-    editorLangId.set(editor === null ? undefined : editor.languageId());
-  };
-  const store = new DisposableStore();
-  store.add(dock.onDidActivePanelChange(update));
-  store.add(dock.onDidAddPanel(update));
-  store.add(onDidInitEditorPanel(update));
-  update();
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/editor/editor-menus.ts b/crates/workshop/ui/src/parts/editor/editor-menus.ts
deleted file mode 100644
index 9b484f8d2..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-menus.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-// The editor's own menu id. It lives in a file of its own so the eager
-// editor.contribution.ts (which fills the menu) and the lazy
-// editor-panel.ts (which opens it at the pointer) share one id without
-// either importing the other. MenuId is a plain string, so the id needs no
-// entry in the platform's list.
-
-/** The menu a right-click on the editor opens: Cut, Copy, Paste, Command Palette.... */
-export const EDITOR_CONTEXT_MENU = "editor/context";
diff --git a/crates/workshop/ui/src/parts/editor/editor-panel.css b/crates/workshop/ui/src/parts/editor/editor-panel.css
deleted file mode 100644
index c90d5f8e5..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-panel.css
+++ /dev/null
@@ -1,206 +0,0 @@
-/* Styles for editor-panel.ts, which imports this file; esbuild bundles it
-   into dist/app.css. Covers the editor surface, its scrollbars, and the
-   floating find widget. The panel's save, revert, and overwrite prompts
-   (shared/panel-dialog.ts) have no rules here: they open the confirmation
-   skin from @workshop/look/modal. Themed values come from the :root tokens
-   in @workshop/look/tokens.css; the --editor-* block there holds Cursor's
-   editor values. */
-
-/* The editor panel: the CodeMirror surface fills the panel; the editor's
-   own theme (colors, gutters, selection, highlights) is applied from JS
-   in editor-surface.ts, skinned from the same :root tokens. */
-.ws-editor-panel {
-  position: relative;
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-}
-
-.ws-editor-surface {
-  flex: 1;
-  min-height: 0;
-}
-
-.ws-editor-surface .cm-editor {
-  height: 100%;
-}
-
-.ws-editor-panel__error {
-  margin: 0;
-  padding: var(--space-1-5) var(--space-3);
-  font-size: var(--font-size-sm);
-  color: var(--danger-text);
-  background: var(--bg-raised);
-  border-bottom: var(--ws-border-width) solid var(--border);
-}
-
-/* Scrollbars: 14px vertical and 12px horizontal, square, in the editor's
-   own thumb colors. */
-.ws-editor-surface .cm-scroller::-webkit-scrollbar {
-  width: var(--editor-scrollbar-width);
-  height: var(--editor-scrollbar-height);
-}
-
-.ws-editor-surface .cm-scroller::-webkit-scrollbar-track,
-.ws-editor-surface .cm-scroller::-webkit-scrollbar-corner {
-  background: transparent;
-}
-
-.ws-editor-surface .cm-scroller::-webkit-scrollbar-thumb {
-  background-color: var(--editor-scrollbar-thumb);
-  border-radius: 0;
-}
-
-.ws-editor-surface .cm-scroller::-webkit-scrollbar-thumb:hover {
-  background-color: var(--editor-scrollbar-thumb-hover);
-}
-
-/* The find widget floats over the editor's top right (find-widget.ts). The
-   panel container takes no room and passes pointer events through to the
-   text; the widget itself is 419px wide with 33px rows, 28px from the right. */
-.ws-editor-surface .cm-panels {
-  position: absolute;
-  inset-block-start: 0;
-  inset-inline: 0;
-  block-size: 0;
-  border: none;
-  pointer-events: none;
-}
-
-.ws-find-widget {
-  position: absolute;
-  inset-block-start: 0;
-  inset-inline-end: var(--editor-find-right);
-  inline-size: var(--editor-find-width);
-  box-sizing: border-box;
-  display: flex;
-  align-items: flex-start;
-  background: var(--editor-widget-bg);
-  color: var(--editor-fg);
-  font-family: var(--font-prose);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  box-shadow: var(--shadow-popup);
-  border-end-start-radius: var(--radius);
-  border-end-end-radius: var(--radius);
-  pointer-events: auto;
-}
-
-.ws-find-rows {
-  flex: 1;
-  min-inline-size: 0;
-}
-
-.ws-find-row {
-  display: flex;
-  align-items: center;
-  gap: var(--space-1);
-  block-size: var(--editor-find-row-height);
-  padding-inline: var(--space-1);
-  box-sizing: border-box;
-}
-
-.ws-find-widget[data-replace="false"] .ws-find-row--replace {
-  display: none;
-}
-
-.ws-find-field {
-  flex: 1;
-  min-inline-size: 0;
-  display: flex;
-  align-items: center;
-  block-size: var(--editor-find-field-height);
-  background: var(--bg-input);
-  border: var(--ws-border-width) solid var(--border);
-  border-radius: var(--radius-xs);
-}
-
-.ws-find-field:focus-within {
-  border-color: var(--cursor-stroke-primary);
-}
-
-.ws-find-input {
-  flex: 1;
-  min-inline-size: 0;
-  padding-inline: var(--space-1);
-  background: transparent;
-  border: none;
-  outline: none;
-  color: inherit;
-  font: inherit;
-}
-
-.ws-find-input::placeholder {
-  color: var(--input-placeholder);
-}
-
-.ws-find-options {
-  display: flex;
-  gap: var(--ws-size-2);
-  padding-inline-end: var(--ws-size-2);
-}
-
-.ws-find-count {
-  inline-size: var(--editor-find-count-width);
-  flex: none;
-  text-align: center;
-  font-size: var(--font-size-sm);
-  color: var(--text-muted);
-  white-space: nowrap;
-}
-
-.ws-find-button {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  min-inline-size: var(--editor-find-button-size);
-  block-size: var(--editor-find-button-size);
-  padding-inline: var(--ws-size-2);
-  background: transparent;
-  border: var(--ws-border-width) solid transparent;
-  border-radius: var(--radius-sm);
-  color: var(--text-muted);
-  font: inherit;
-  font-size: var(--font-size-sm);
-  cursor: pointer;
-}
-
-.ws-find-button:hover {
-  background: var(--cursor-toolbar-hover);
-  color: var(--text);
-}
-
-.ws-find-button:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-find-option[aria-pressed="true"] {
-  background: var(--editor-find-match);
-  border-color: var(--cursor-cyan);
-  color: var(--text);
-}
-
-/* The replace toggle: a chevron that turns down while the replace row is shown. */
-.ws-find-toggle {
-  align-self: stretch;
-  min-inline-size: var(--space-4);
-  padding-inline: 0;
-  border-radius: 0;
-}
-
-.ws-find-toggle svg {
-  transition: transform var(--duration-fast);
-}
-
-.ws-find-widget[data-replace="true"] .ws-find-toggle svg {
-  transform: rotate(90deg);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .ws-find-toggle svg {
-    transition: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/editor/editor-panel.ts b/crates/workshop/ui/src/parts/editor/editor-panel.ts
deleted file mode 100644
index bc30b7ea7..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-panel.ts
+++ /dev/null
@@ -1,594 +0,0 @@
-// The editor panel: one open document per Dockview panel, written against
-// the EditorSurface contract. The panel owns the document lifecycle -
-// loading through the workspace API, dirty state on the tab (a dot in
-// place of its close button, through setTabDirty), and
-// saving with the server's opaque conflict token - and never
-// touches the concrete editor. A save that loses the token race opens a
-// themed conflict dialog (reload the on-disk text, or overwrite it)
-// instead of silently clobbering the file.
-
-import "./editor-panel.css";
-
-import type { GroupPanelPartInitParameters } from "dockview";
-import type { EditorView } from "@codemirror/view";
-
-import { Emitter } from "@workshop/platform/event";
-import { baseName } from "../../base/paths";
-import { toDisposable } from "@workshop/platform/lifecycle";
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-import { Commands } from "@workshop/platform/command-registry";
-import { errorText } from "../../services/error-catalog";
-import { RECENT_FILES_STORE } from "../../services/recent-files-store";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { setTabDirty } from "../layout/panel-tab";
-import { Menu } from "../menu/menu";
-import { showPanelDialog } from "../shared/panel-dialog";
-import { EDITOR_CONTEXT_MENU } from "./editor-menus";
-import { CodeMirrorSurface, languageIdForPath, type EditorSurface } from "./editor-surface";
-import {
-  fetchFile,
-  isDeadlineElapsed,
-  isModifiedConflict,
-  writeFile,
-  type WorkspaceFile,
-} from "../../services/workspace-api";
-
-/** Injectable seams for tests; production uses the real surface and API. */
-export interface EditorPanelDeps {
-  readonly createSurface?: () => EditorSurface;
-  readonly readFile?: (path: string) => Promise<WorkspaceFile>;
-  readonly writeFile?: (
-    path: string,
-    text: string,
-    expectedToken: string | null,
-  ) => Promise<WorkspaceFile>;
-}
-
-/** Reads the file path out of panel params, which arrive as unknown fields. */
-function filePathParam(params: Record<string, unknown>): string | null {
-  const path = params.path;
-  return typeof path === "string" && path.length > 0 ? path : null;
-}
-
-/**
- * Reads the untitled serial out of panel params: a positive integer
- * marks the panel as an untitled buffer and numbers its Untitled-N
- * title and its panel id.
- */
-function untitledSerialParam(params: Record<string, unknown>): number | null {
-  const untitled = params.untitled;
-  return typeof untitled === "number" && Number.isInteger(untitled) && untitled > 0 ? untitled : null;
-}
-
-const SAVE_TIMEOUT_MESSAGE = "The save timed out; the file may or may not have been written.";
-
-const didInitEmitter = new Emitter<EditorPanel>();
-
-/**
- * Fires as each EditorPanel finishes init. The lifecycle module's
- * context-key binder hooks it: the lazy chunk swap that mounts the real
- * panel fires no dock event, so dock subscriptions alone would miss it.
- */
-export const onDidInitEditorPanel = didInitEmitter.event;
-
-export class EditorPanel extends WorkshopPart {
-  private readonly surface: EditorSurface;
-  /** The context menu, built on the first right-click. */
-  private menu: Menu | null = null;
-  private path: string | null = null;
-  private untitled = false;
-  private title = "Editor";
-  private token: string | null = null;
-  /** True while a timed-out save leaves the token unknown. */
-  private tokenUnknown = false;
-  /** The text of the last write attempt, for reconciling an unknown token. */
-  private lastSentText: string | null = null;
-  private saving = false;
-  /** True from the unsaved-changes prompt opening until it answers. */
-  private closePending = false;
-
-  constructor(private readonly deps: EditorPanelDeps = {}) {
-    super();
-    this.element.className = "ws-editor-panel";
-    this.element.addEventListener("contextmenu", (event) => {
-      this.openContextMenu(event);
-    });
-    // The surface is the panel's child: dockview disposes the panel when
-    // its tab closes, and the inherited dispose() releases the surface and
-    // the dirty subscription with it.
-    this.surface = this._register(deps.createSurface?.() ?? new CodeMirrorSurface());
-    this._register(
-      toDisposable(
-        this.surface.onDirtyChange(() => {
-          this.syncDirty();
-        }),
-      ),
-    );
-    // The tab's dot belongs to the panel: closing the panel clears it, so a
-    // panel reopened under the same id starts clean.
-    this._register(
-      toDisposable(() => {
-        if (this.panelApi !== null) {
-          setTabDirty(this.panelApi.id, false);
-        }
-      }),
-    );
-  }
-
-  protected create(parent: HTMLElement): void {
-    parent.appendChild(this.surface.element);
-  }
-
-  override init(parameters: GroupPanelPartInitParameters): void {
-    super.init(parameters);
-    const path = filePathParam(parameters.params);
-    if (path !== null) {
-      this.path = path;
-      this.title = baseName(path);
-      this.updateTitle();
-      void this.load(path)
-        .then(() => {
-          // Every opened path feeds File > Open Recent and quick open.
-          getServiceOrNull(RECENT_FILES_STORE)?.add(path);
-        })
-        .catch((error: unknown) => {
-          this.showError(error);
-        });
-    } else {
-      const serial = untitledSerialParam(parameters.params);
-      if (serial === null) {
-        this.showError("No file path was provided for this editor.");
-        return;
-      }
-      // An untitled buffer: no read, no write target - save runs Save As.
-      this.untitled = true;
-      this.title = `Untitled-${serial}`;
-      this.updateTitle();
-      const text = typeof parameters.params.text === "string" ? parameters.params.text : "";
-      this.surface.open({ path: "", text });
-      if (text !== "") {
-        // A restored untitled buffer (Reopen Closed Editor) is dirty
-        // against the empty baseline: its content was never persisted.
-        this.surface.markSaved("");
-      }
-    }
-    didInitEmitter.fire(this);
-  }
-
-  /**
-   * A right-click opens the editor's context menu (Cut, Copy, Paste,
-   * Command Palette...) at the pointer. The rows are commands whose
-   * preconditions ask for a focused text input, which a right-click on
-   * the editor is, so the open names that context.
-   */
-  private openContextMenu(event: MouseEvent): void {
-    event.preventDefault();
-    this.menu ??= this._register(new Menu());
-    this.menu.open(EDITOR_CONTEXT_MENU, { x: event.clientX, y: event.clientY }, undefined, {
-      activeEditor: "editor",
-      editorTextFocus: true,
-      textInputFocus: true,
-    });
-  }
-
-  /** The panel's file path, or null for an untitled buffer. */
-  filePath(): string | null {
-    return this.path;
-  }
-
-  /** Whether the panel is an untitled buffer (no path; save runs Save As). */
-  isUntitled(): boolean {
-    return this.untitled;
-  }
-
-  /** The live editor text - what a save or an untitled reopen writes. */
-  currentText(): string {
-    return this.surface.text();
-  }
-
-  /** The document's language id, for the editorLangId context key. */
-  languageId(): string {
-    return this.path === null ? "plaintext" : languageIdForPath(this.path);
-  }
-
-  /** The panel's dirty state, for close prompts and save shortcuts. */
-  override isDirty(): boolean {
-    return this.surface.isDirty();
-  }
-
-  /** The surface's live EditorView, for the editor command layer. */
-  editorView(): EditorView | null {
-    return this.surface.editorView();
-  }
-
-  focus(): void {
-    this.surface.focus();
-  }
-
-  /**
-   * Saves through the workspace API with the token from the last read.
-   * A stale token means the file changed on disk: rather than overwriting
-   * silently, the conflict dialog offers reload or overwrite. A timed-out
-   * save (a 408) leaves the token unknown - the write may or may not have
-   * landed - so the next save re-reads the file before sending any token,
-   * adopting the fresh token when the disk still holds what was last sent,
-   * and falling back to the conflict dialog otherwise. The write itself
-   * routes through writeCurrent, the same path overwrite() uses, so both
-   * record the 408 and 409 outcomes identically. An untitled buffer has no
-   * write target, so its save runs Save As, which resolves this panel
-   * through the dock's active panel.
-   */
-  async save(): Promise<void> {
-    if (this.path === null) {
-      if (this.untitled) {
-        await Commands.execute("workbench.action.files.saveAs");
-      }
-      return;
-    }
-    if (this.saving) {
-      return;
-    }
-    this.saving = true;
-    // The text is captured once: the write and the saved baseline must
-    // agree, or keystrokes typed while the PUT is in flight would be
-    // baselined as saved and silently lost.
-    const text = this.surface.text();
-    try {
-      // A timed-out save left the token unknown: reconcile with the file
-      // on disk before sending any token, so a stale token never reaches
-      // the write boundary.
-      let expectedToken = this.token;
-      if (this.tokenUnknown) {
-        const onDisk = await this.reader()(this.path);
-        if (onDisk.text !== this.lastSentText) {
-          // The write may not have landed, or the file changed again:
-          // resolve through the conflict dialog instead of overwriting.
-          this.showConflictDialog(
-            `${this.title} may hold an earlier timed-out save or an outside edit. Reload the on-disk text, or overwrite the file with your changes.`,
-          );
-          return;
-        }
-        this.token = onDisk.token;
-        expectedToken = onDisk.token;
-        this.tokenUnknown = false;
-      }
-      await this.writeCurrent(this.path, text, expectedToken);
-    } catch (error: unknown) {
-      if (isDeadlineElapsed(error)) {
-        this.tokenUnknown = true;
-        this.showError(SAVE_TIMEOUT_MESSAGE);
-      } else if (isModifiedConflict(error)) {
-        this.showConflictDialog();
-      } else {
-        this.showError(error);
-      }
-    } finally {
-      this.saving = false;
-    }
-  }
-
-  /**
-   * Save As: writes the live text to a new path and retargets the panel
-   * onto it - the tab title, the conflict token, and the saved baseline
-   * all move to the new file, and an untitled buffer becomes a file
-   * editor. The picker and the parent-directory grant are the caller's
-   * job (the workspace contribution). Every failure, a 408 included,
-   * paints the error bar and leaves the panel on its old path; the
-   * conflict dialog never opens, because it acts on that old path.
-   */
-  async saveAs(path: string): Promise<void> {
-    if (this.saving) {
-      return;
-    }
-    this.saving = true;
-    try {
-      // The text is captured once, as in save(): the write and the saved
-      // baseline must agree.
-      const text = this.surface.text();
-      const written = await this.writeTarget(path, text);
-      if (written === null) {
-        return;
-      }
-      this.path = path;
-      this.untitled = false;
-      this.title = baseName(path);
-      this.token = written.token;
-      this.tokenUnknown = false;
-      this.surface.markSaved(text);
-      this.updateTitle();
-      getServiceOrNull(RECENT_FILES_STORE)?.add(path);
-    } catch (error: unknown) {
-      this.showError(isDeadlineElapsed(error) ? SAVE_TIMEOUT_MESSAGE : error);
-    } finally {
-      this.saving = false;
-    }
-  }
-
-  /**
-   * Revert File: reloads the on-disk text. A dirty panel prompts first -
-   * reverting discards its unsaved changes; a clean panel reloads
-   * immediately; an untitled buffer has no on-disk text and ignores the
-   * command.
-   */
-  requestRevert(): void {
-    const path = this.path;
-    if (path === null) {
-      return;
-    }
-    if (!this.surface.isDirty()) {
-      void this.load(path).catch((error: unknown) => {
-        this.showError(error);
-      });
-      return;
-    }
-    this._register(
-      showPanelDialog({
-        container: this.element,
-        classPrefix: "ws-editor-revert",
-        titleId: "editor-revert-title",
-        title: "Revert file",
-        message: `${this.title} has unsaved changes. Reverting to the on-disk text discards them.`,
-        skin: "confirmation",
-        buttons: [
-          {
-            label: "Revert",
-            danger: true,
-            run: () => {
-              void this.load(path).catch((error: unknown) => {
-                this.showError(error);
-              });
-            },
-          },
-          { label: "Cancel", run: () => undefined },
-        ],
-      }),
-    );
-  }
-
-  private reader(): (path: string) => Promise<WorkspaceFile> {
-    return this.deps.readFile ?? fetchFile;
-  }
-  private writer(): (
-    path: string,
-    text: string,
-    expectedToken: string | null,
-  ) => Promise<WorkspaceFile> {
-    return this.deps.writeFile ?? writeFile;
-  }
-
-  /**
-   * Writes a Save As target. The picker's replace confirmation is the
-   * user's consent, so a 409 on an existing target re-reads its token and
-   * retries once. An unreadable target or a second conflict paints an
-   * error naming the target and returns null; a 408 or any other failure
-   * is rethrown. The writes bypass writeCurrent: a 408 here leaves the
-   * open file's token untouched.
-   */
-  private async writeTarget(path: string, text: string): Promise<WorkspaceFile | null> {
-    try {
-      return await this.writer()(path, text, null);
-    } catch (error: unknown) {
-      if (!isModifiedConflict(error)) {
-        throw error;
-      }
-    }
-    let target: WorkspaceFile;
-    try {
-      target = await this.reader()(path);
-    } catch (error: unknown) {
-      this.showError(`Save As could not replace ${path}: ${errorText(error)}`);
-      return null;
-    }
-    try {
-      return await this.writer()(path, text, target.token);
-    } catch (error: unknown) {
-      if (isModifiedConflict(error)) {
-        this.showError(`Save As could not replace ${path}: it changed on disk again before the write.`);
-        return null;
-      }
-      throw error;
-    }
-  }
-
-  /**
-   * Writes this panel's own file and records the outcome: the token, the
-   * saved baseline, the text a timed-out write may have landed, the 408
-   * message, and the 409 conflict dialog. Any other error is rethrown. A
-   * 408 marks `this.path`'s token unknown, so a write to any other path
-   * (Save As) must not route through here.
-   */
-  private async writeCurrent(path: string, text: string, expectedToken: string | null): Promise<void> {
-    this.lastSentText = text;
-    try {
-      const written = await this.writer()(path, text, expectedToken);
-      this.token = written.token;
-      this.tokenUnknown = false;
-      this.surface.markSaved(text);
-    } catch (error: unknown) {
-      if (isDeadlineElapsed(error)) {
-        this.tokenUnknown = true;
-        this.showError(SAVE_TIMEOUT_MESSAGE);
-      } else if (isModifiedConflict(error)) {
-        this.showConflictDialog();
-      } else {
-        throw error;
-      }
-    }
-  }
-
-  /** Loads the document into the surface and records its conflict token. */
-  private async load(path: string): Promise<void> {
-    const file = await this.reader()(path);
-    this.token = file.token;
-    this.tokenUnknown = false;
-    this.surface.open({ path, text: file.text });
-  }
-
-  private updateTitle(): void {
-    this.panelApi?.setTitle(this.title);
-  }
-
-  /** Tells the panel's tab whether the document holds unsaved changes. */
-  private syncDirty(): void {
-    if (this.panelApi !== null) {
-      setTabDirty(this.panelApi.id, this.surface.isDirty());
-    }
-  }
-
-  /** Paints a failure as a bar above the editor; the next error replaces it. */
-  private showError(error: unknown): void {
-    const message = error instanceof Error ? error.message : String(error);
-    this.element.querySelector(".ws-editor-panel__error")?.remove();
-    const bar = document.createElement("p");
-    bar.className = "ws-editor-panel__error";
-    bar.setAttribute("role", "alert");
-    bar.textContent = message;
-    this.element.prepend(bar);
-  }
-
-  /**
-   * The write-conflict modal. Reload discards the editor's text
-   * for the on-disk text; Overwrite re-reads the fresh token and writes
-   * the editor's text over the file.
-   */
-  private showConflictDialog(
-    message = `${this.title} was modified outside the editor. Reload the on-disk text, or overwrite the file with your changes.`,
-  ): void {
-    this._register(showPanelDialog({
-      container: this.element,
-      classPrefix: "ws-editor-conflict",
-      titleId: "editor-conflict-title",
-      title: "File changed on disk",
-      message,
-      skin: "confirmation",
-      buttons: [
-        {
-          label: "Reload",
-          run: () => {
-            if (this.path !== null) {
-              void this.load(this.path).catch((error: unknown) => {
-                this.showError(error);
-              });
-            }
-          },
-        },
-        {
-          label: "Overwrite",
-          danger: true,
-          run: () => {
-            void this.overwrite().catch((error: unknown) => {
-              this.showError(error);
-            });
-          },
-        },
-      ],
-    }));
-  }
-
-  /**
-   * Whether the panel may close. A clean panel answers true at once; a
-   * dirty one opens the unsaved-changes dialog, answering true after a
-   * successful Save or after Don't Save and false on Cancel, Escape, a
-   * failed save, or the panel's disposal before any of those. A request
-   * made while the dialog's answer is pending answers false instead of
-   * opening a second dialog.
-   */
-  override confirmClose(): Promise<boolean> {
-    return new Promise((resolve) => {
-      if (!this.surface.isDirty()) {
-        resolve(true);
-        return;
-      }
-      if (this.closePending) {
-        resolve(false);
-        return;
-      }
-      this.closePending = true;
-      this.showCloseDialog((confirmed) => {
-        this.closePending = false;
-        resolve(confirmed);
-      });
-    });
-  }
-
-  /**
-   * The unsaved-changes modal, Cursor's save prompt. Save answers once the
-   * write settles, true only when it left the panel clean; Don't Save
-   * answers true without writing; Cancel and Escape answer false, as does
-   * disposing the panel before any answer. `answer` runs once.
-   */
-  private showCloseDialog(answer: (confirmed: boolean) => void): void {
-    let answered = false;
-    const reply = (confirmed: boolean): void => {
-      if (!answered) {
-        answered = true;
-        answer(confirmed);
-      }
-    };
-    const dialog = showPanelDialog({
-      container: this.element,
-      classPrefix: "ws-editor-close",
-      titleId: "editor-close-title",
-      title: `Do you want to save the changes you made to ${this.title}?`,
-      message: "Your changes will be lost if you don't save them.",
-      skin: "confirmation",
-      onDismiss: () => reply(false),
-      buttons: [
-        {
-          label: "Save",
-          primary: true,
-          run: () => {
-            void this.save()
-              // A failed or conflicted save, or a keystroke typed during
-              // the write, leaves the panel dirty.
-              .then(() => reply(!this.surface.isDirty()))
-              .catch((error: unknown) => {
-                this.showError(error);
-                reply(false);
-              });
-          },
-        },
-        { label: "Don't Save", run: () => reply(true) },
-        { label: "Cancel", run: () => reply(false) },
-      ],
-    });
-    // Tearing the dialog down with the panel fires no button and no
-    // onDismiss; answer here, or an awaiting close command never settles.
-    this._register(
-      toDisposable(() => {
-        dialog.dispose();
-        reply(false);
-      }),
-    );
-  }
-
-  /**
-   * Overwrite path of the conflict dialog: re-read the file for its fresh
-   * token, then write the editor's text against it through writeCurrent,
-   * the same path save() uses. A second conflict (the file changed again
-   * in between) reopens the dialog, and a 408 leaves the token unknown
-   * for the next save to reconcile.
-   */
-  private async overwrite(): Promise<void> {
-    // The saving guard cannot wedge the conflict flow: the dialog's
-    // Overwrite button runs on a later click, after save()'s finally
-    // block has already cleared the flag.
-    if (this.path === null || this.saving) {
-      return;
-    }
-    this.saving = true;
-    try {
-      const fresh = await this.reader()(this.path);
-      const text = this.surface.text();
-      await this.writeCurrent(this.path, text, fresh.token);
-    } catch (error: unknown) {
-      if (isModifiedConflict(error)) {
-        this.showConflictDialog();
-      } else {
-        this.showError(error);
-      }
-    } finally {
-      this.saving = false;
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/editor/editor-settings-service.ts b/crates/workshop/ui/src/parts/editor/editor-settings-service.ts
deleted file mode 100644
index a4c8af94d..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-settings-service.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-// The editor settings service: the four user-facing editor settings
-// (word wrap, render whitespace, render control characters, column
-// selection), seeded from the UI-state adapter's user bucket at
-// construction and written back through it on every change so they
-// survive a relaunch, and published as the config.editor.* context keys
-// so the menus' `toggled` expressions follow them. EditorSurface
-// subscribes to onDidChange and reconfigures one Compartment per setting;
-// the toggle actions in editor.contribution.ts call toggle().
-//
-// Render Whitespace is a three-way mode (none, selection, all). Its
-// context key stays boolean: true unless the mode is none, which is what
-// the menu's check shows.
-//
-// The persisted value arrives as unknown and passes a hand-written shape
-// check - a malformed or hostile payload reads as the defaults, never
-// as a cast. The writer is fire-and-forget: a write that throws is
-// swallowed and the in-memory values stay authoritative.
-//
-// The service self-registers with a default factory (empty initial,
-// no-op writer), so any bundle that touches it gets a working singleton;
-// the composition root re-registers it bound to the live adapter before
-// the first consumer resolves it.
-//
-// DOM-free: the initial value and the writer are injected.
-
-import { Emitter } from "@workshop/platform/event";
-import type { Event } from "@workshop/platform/event";
-import { ContextKeyService, CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import type { ContextKey } from "@workshop/platform/context-key-service";
-import {
-  contextKeyValue,
-  DEFAULT_EDITOR_SETTINGS,
-  EDITOR_SETTING_CONTEXT_KEYS,
-  EDITOR_SETTINGS_SERVICE,
-  RENDER_WHITESPACE_MODES,
-  type EditorSettingName,
-  type EditorSettings,
-  type EditorSettingsService as EditorSettingsServiceContract,
-  type RenderWhitespace,
-} from "../../services/editor-settings-service";
-import { getServiceOrNull, registerService } from "@workshop/platform/service-registry";
-
-/** The setting names, in declaration order. */
-const SETTING_NAMES = [
-  "wordWrap",
-  "renderWhitespace",
-  "renderControlCharacters",
-  "columnSelection",
-] as const satisfies readonly EditorSettingName[];
-
-/** The settings that are plain on/off toggles. */
-type BooleanSettingName = Exclude<EditorSettingName, "renderWhitespace">;
-
-const BOOLEAN_SETTING_NAMES: readonly BooleanSettingName[] = ["wordWrap", "renderControlCharacters", "columnSelection"];
-
-/** The writer the service hands each new settings object to. */
-export type EditorSettingsWriter = (value: unknown) => void;
-
-/**
- * Reads a stored Render Whitespace value: a mode string. Anything else is
- * the default.
- */
-function readRenderWhitespace(value: unknown): RenderWhitespace {
-  return RENDER_WHITESPACE_MODES.find((mode) => mode === value) ?? DEFAULT_EDITOR_SETTINGS.renderWhitespace;
-}
-
-/**
- * Narrows a persisted payload to EditorSettings: it must be a plain
- * object, each boolean key keeps its value only when it is a boolean,
- * Render Whitespace reads through readRenderWhitespace, and missing or
- * mistyped keys fall back to the defaults. Anything else (null, an
- * array, a string, a number) reads as the defaults.
- */
-function readSettings(initial: unknown): EditorSettings {
-  if (typeof initial !== "object" || initial === null || Array.isArray(initial)) {
-    return DEFAULT_EDITOR_SETTINGS;
-  }
-  const record: Record<string, unknown> = initial as Record<string, unknown>;
-  const settings: { -readonly [K in EditorSettingName]: EditorSettings[K] } = { ...DEFAULT_EDITOR_SETTINGS };
-  for (const name of BOOLEAN_SETTING_NAMES) {
-    const value: unknown = record[name];
-    if (typeof value === "boolean") {
-      settings[name] = value;
-    }
-  }
-  settings.renderWhitespace = readRenderWhitespace(record.renderWhitespace);
-  return settings;
-}
-
-/**
- * The editor settings. Mutations write through eagerly, update the
- * config.editor.* context keys, and fire onDidChange with the new
- * settings; a writer failure leaves the in-memory values authoritative
- * for the rest of the page lifetime.
- */
-export class EditorSettingsService implements EditorSettingsServiceContract {
-  private current: EditorSettings;
-  private readonly changeEmitter = new Emitter<EditorSettings>();
-  private readonly keys: { [K in EditorSettingName]?: ContextKey<boolean> } = {};
-
-  /** Fires when a setting changes; the editor surfaces hook it. */
-  readonly onDidChange: Event<EditorSettings> = this.changeEmitter.event;
-
-  /**
-   * `initial` is the value the user bucket held at boot (any shape; see
-   * readSettings); `write` receives the whole settings object after each
-   * change.
-   */
-  constructor(
-    initial: unknown = null,
-    private readonly write: EditorSettingsWriter = () => {},
-    contextKeys: ContextKeyService | null = getServiceOrNull(CONTEXT_KEY_SERVICE),
-  ) {
-    this.current = readSettings(initial);
-    if (contextKeys !== null) {
-      for (const name of SETTING_NAMES) {
-        const declared = contextKeyValue(name, DEFAULT_EDITOR_SETTINGS[name]);
-        const key = contextKeys.createKey<boolean>(EDITOR_SETTING_CONTEXT_KEYS[name], declared);
-        this.keys[name] = key;
-        // The declared default is already visible through getValue; only
-        // a persisted override needs a write (and its change event).
-        const persisted = contextKeyValue(name, this.current[name]);
-        if (persisted !== declared) {
-          key.set(persisted);
-        }
-      }
-    }
-  }
-
-  /** The current settings. */
-  get settings(): EditorSettings {
-    return this.current;
-  }
-
-  /** Writes one setting; a write of the current value is a no-op. */
-  set<K extends EditorSettingName>(name: K, value: EditorSettings[K]): void {
-    if (this.current[name] === value) {
-      return;
-    }
-    this.current = { ...this.current, [name]: value };
-    this.persist();
-    this.keys[name]?.set(contextKeyValue(name, value));
-    this.changeEmitter.fire(this.current);
-  }
-
-  /**
-   * Flips one setting - the toggle actions' entire run body. A boolean
-   * flips; Render Whitespace flips between none and all, so from the
-   * default selection (shown checked) the first flip turns it off.
-   */
-  toggle(name: EditorSettingName): void {
-    if (name === "renderWhitespace") {
-      this.set("renderWhitespace", this.current.renderWhitespace === "none" ? "all" : "none");
-      return;
-    }
-    this.set(name, !this.current[name]);
-  }
-
-  private persist(): void {
-    try {
-      this.write(this.current);
-    } catch {
-      // The adapter reports its own failures; a throwing writer leaves
-      // the in-memory values authoritative.
-    }
-  }
-
-  dispose(): void {
-    this.changeEmitter.dispose();
-  }
-}
-
-// Self-registration with the defaults and a no-op writer: a consumer that
-// resolves the token before the composition root re-registers it bound to
-// the live adapter gets working, unpersisted settings rather than a wrong
-// instance cached for the page lifetime.
-registerService(EDITOR_SETTINGS_SERVICE, () => new EditorSettingsService());
diff --git a/crates/workshop/ui/src/parts/editor/editor-surface.ts b/crates/workshop/ui/src/parts/editor/editor-surface.ts
deleted file mode 100644
index 10dc0043d..000000000
--- a/crates/workshop/ui/src/parts/editor/editor-surface.ts
+++ /dev/null
@@ -1,691 +0,0 @@
-// The EditorSurface contract and its CodeMirror 6 implementation. The
-// surface owns everything editor-concrete: the EditorView, the extension
-// set, the theme, lazy language modes, and dirty tracking. Panels, zones,
-// and the save flow are written against EditorSurface only - nothing else
-// in the app imports @codemirror/* directly. Dirty tracking is an
-// updateListener comparing the live document against the last opened or
-// saved text; markSaved takes the exact text a write persisted, so
-// keystrokes that land while the write is in flight stay dirty.
-// Runtime-reconfigurables (language, readOnly, and the four editor
-// settings) sit behind Compartments on the surface; the externalUpdate
-// annotation marks server-originated reloads so listeners can tell them
-// from local typing. The base extension set is basicSetup spelled out,
-// because three of its members - highlightSpecialChars,
-// rectangularSelection, and highlightWhitespace - move into settings
-// compartments, and a bundle cannot be picked apart.
-//
-// The look and the gestures copy Cursor's editor (Monaco's stock
-// defaults with the minimap off): the theme reads the --editor-* tokens
-// from @workshop/look, the highlight style reads --editor-token-*, the
-// cursor is a 2px bar blinking once a second, a plain Alt+click adds a
-// cursor and Shift+Alt+drag selects a column (no crosshair), the indent
-// unit is four spaces, the document scrolls past its last line, and the
-// find widget floats at the top right (find-widget.ts).
-
-import {
-  Decoration,
-  type DecorationSet,
-  drawSelection,
-  dropCursor,
-  EditorView,
-  gutter,
-  highlightActiveLine,
-  highlightActiveLineGutter,
-  highlightSpecialChars,
-  highlightWhitespace,
-  keymap,
-  lineNumbers,
-  rectangularSelection,
-  scrollPastEnd,
-  ViewPlugin,
-  type ViewUpdate,
-} from "@codemirror/view";
-import {
-  Annotation,
-  Compartment,
-  EditorState,
-  type Extension,
-  type Range,
-  type Transaction,
-} from "@codemirror/state";
-import { defaultKeymap, history, historyKeymap, redo, redoDepth, selectAll, undo, undoDepth } from "@codemirror/commands";
-import {
-  bracketMatching,
-  codeFolding,
-  defaultHighlightStyle,
-  foldGutter,
-  foldKeymap,
-  HighlightStyle,
-  indentOnInput,
-  indentUnit,
-  StreamLanguage,
-  syntaxHighlighting,
-} from "@codemirror/language";
-import { autocompletion, closeBrackets, closeBracketsKeymap, completionKeymap } from "@codemirror/autocomplete";
-import { search, searchKeymap, highlightSelectionMatches } from "@codemirror/search";
-import { lintKeymap } from "@codemirror/lint";
-import { tags } from "@lezer/highlight";
-
-import { ICON_CHEVRON_DOWN, ICON_CHEVRON_RIGHT } from "@workshop/look/icons";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-import {
-  DEFAULT_EDITOR_SETTINGS,
-  EDITOR_SETTINGS_SERVICE,
-  type EditorSettings,
-  type EditorSettingsService,
-  type RenderWhitespace,
-} from "../../services/editor-settings-service";
-import { createFindWidget } from "./find-widget";
-
-/** A document handed to the surface: the path it came from and its text. */
-export interface EditorDocument {
-  readonly path: string;
-  readonly text: string;
-}
-
-/**
- * Tags transactions whose content came from the server - workspace file
- * loads and reloads - rather than from local typing, so autosave-like
- * listeners can avoid writing back text the server just sent. Check it
- * with {@link isExternalUpdate}.
- */
-export const externalUpdate = Annotation.define<boolean>();
-
-/** Whether a transaction holds server-originated content (see {@link externalUpdate}). */
-export function isExternalUpdate(tr: Transaction): boolean {
-  return tr.annotation(externalUpdate) === true;
-}
-
-/**
- * The editor abstraction the rest of the workshop is written against.
- * Implementations own one document at a time; open replaces it.
- */
-export interface EditorSurface {
-  /** The root element the panel mounts. */
-  readonly element: HTMLElement;
-  /** Loads a document, replacing any current one and resetting dirty state. */
-  open(document: EditorDocument): void;
-  /** The current editor text - what a save would write. */
-  text(): string;
-  /**
-   * Records the text a successful write persisted as the saved baseline
-   * and recomputes dirty against the live document, so edits made while
-   * the write was in flight stay dirty.
-   */
-  markSaved(text: string): void;
-  /** Whether the text differs from the last open or markSaved baseline. */
-  isDirty(): boolean;
-  /** Toggles read-only mode; document, history, and view state survive. */
-  setReadOnly(readOnly: boolean): void;
-  /** Registers a listener fired on dirty-state transitions; returns an unsubscribe. */
-  onDirtyChange(listener: (dirty: boolean) => void): () => void;
-  /**
-   * The live EditorView, or null before the first open(). Exposed for
-   * the editor directory's command layer (editor-commands.ts); nothing
-   * outside the editor directory should consume it.
-   */
-  editorView(): EditorView | null;
-  focus(): void;
-  dispose(): void;
-}
-
-// The dark theme skins from the --editor-* tokens in @workshop/look/tokens.css,
-// Cursor Dark's editor values. Text is 14px on a 19px line, set on the
-// scroller so the line numbers share it. CodeMirror's own dark theme is
-// overridden where it is more specific than a short selector: the focused
-// selection needs the long .cm-selectionLayer path to win, and the bracket
-// match must show with the editor unfocused, which the built-in rule does
-// not.
-const runvilTheme = EditorView.theme(
-  {
-    "&": {
-      backgroundColor: "var(--editor-bg)",
-      color: "var(--editor-fg)",
-      height: "100%",
-    },
-    "&.cm-focused": {
-      outline: "none",
-    },
-    ".cm-scroller": {
-      fontFamily: "var(--code-font)",
-      fontSize: "var(--editor-font-size)",
-      lineHeight: "var(--editor-line-height)",
-    },
-    ".cm-content": {
-      caretColor: "var(--editor-cursor)",
-      padding: "0",
-    },
-    ".cm-line": {
-      padding: "0",
-    },
-    // A 2px bar, shifted 1px left so it sits between the characters.
-    ".cm-cursor, .cm-dropCursor": {
-      borderLeftWidth: "var(--editor-cursor-width)",
-      borderLeftColor: "var(--editor-cursor)",
-      marginLeft: "var(--editor-cursor-shift)",
-    },
-    // The gutter reads glyph lane, line numbers, fold lane. No right border
-    // and no tint on the active line's gutter; only its number brightens.
-    ".cm-gutters": {
-      backgroundColor: "var(--editor-gutter-bg)",
-      color: "var(--editor-line-number)",
-      border: "none",
-      borderRight: "none",
-    },
-    ".cm-glyphMargin": {
-      minWidth: "var(--editor-glyph-margin)",
-    },
-    ".cm-lineNumbers .cm-gutterElement": {
-      minWidth: "var(--editor-line-number-min-width)",
-      padding: "0",
-    },
-    ".cm-foldGutter": {
-      minWidth: "var(--editor-fold-lane)",
-    },
-    ".cm-activeLineGutter": {
-      backgroundColor: "transparent",
-      color: "var(--editor-line-number-active)",
-    },
-    // The current line's wash gives way to a selection (the has-selection
-    // class rides on the editor through editorAttributes).
-    ".cm-activeLine": {
-      backgroundColor: "var(--editor-current-line)",
-    },
-    "&.ws-has-selection .cm-activeLine": {
-      backgroundColor: "transparent",
-    },
-    ".cm-selectionBackground": {
-      background: "var(--editor-selection-inactive)",
-      borderRadius: "var(--editor-selection-radius)",
-    },
-    "& > .cm-scroller > .cm-selectionLayer .cm-selectionBackground": {
-      background: "var(--editor-selection-inactive)",
-      borderRadius: "var(--editor-selection-radius)",
-    },
-    "&.cm-focused > .cm-scroller > .cm-selectionLayer .cm-selectionBackground": {
-      background: "var(--editor-selection)",
-      borderRadius: "var(--editor-selection-radius)",
-    },
-    ".cm-searchMatch": {
-      backgroundColor: "var(--editor-find-match)",
-      outline: "none",
-    },
-    ".cm-searchMatch.cm-searchMatch-selected": {
-      backgroundColor: "var(--editor-find-match-current)",
-    },
-    // The word under the cursor, and the other occurrences of a selection.
-    ".cm-selectionMatch": {
-      backgroundColor: "var(--editor-selection-highlight)",
-    },
-    ".cm-selectionMatch.cm-selectionMatch-main": {
-      backgroundColor: "var(--editor-word-highlight)",
-    },
-    ".cm-matchingBracket, &.cm-focused .cm-matchingBracket": {
-      backgroundColor: "var(--editor-bracket-match)",
-      border: "var(--ws-border-width) solid transparent",
-    },
-    // Fold chevrons fade in while the pointer is over the gutter; a folded
-    // range's chevron stays. The folded range itself reads as a bare ellipsis.
-    ".cm-foldGutter .ws-fold-marker": {
-      display: "inline-flex",
-      color: "var(--editor-fold-chevron)",
-      opacity: "0",
-      transition: "opacity var(--editor-fold-fade)",
-    },
-    ".cm-gutters:hover .ws-fold-marker, .cm-foldGutter .ws-fold-marker[data-state=folded]": {
-      opacity: "1",
-    },
-    "@media (prefers-reduced-motion: reduce)": {
-      ".cm-foldGutter .ws-fold-marker": {
-        transition: "none",
-      },
-    },
-    ".cm-foldPlaceholder": {
-      backgroundColor: "transparent",
-      border: "none",
-      color: "var(--editor-fold-placeholder)",
-    },
-    ".cm-highlightSpace": {
-      backgroundImage: "radial-gradient(circle at 50% 55%, var(--editor-whitespace) 20%, transparent 5%)",
-    },
-    ".cm-panels": {
-      backgroundColor: "transparent",
-      color: "var(--editor-fg)",
-    },
-  },
-  { dark: true },
-);
-
-// Syntax colors are Cursor Dark's tokenColors, by lezer tag, read from the
-// --editor-token-* values in @workshop/look/tokens.css. A tag falls back
-// to its parent's rule (controlKeyword to keyword, integer to number), so
-// each rule names the family.
-const runvilHighlight = HighlightStyle.define([
-  { tag: [tags.keyword, tags.modifier], color: "var(--editor-token-keyword)" },
-  { tag: tags.operator, color: "var(--editor-token-operator)" },
-  { tag: tags.punctuation, color: "var(--editor-token-punctuation)" },
-  { tag: tags.angleBracket, color: "var(--editor-token-tag-punctuation)" },
-  { tag: [tags.string, tags.special(tags.string)], color: "var(--editor-token-string)" },
-  { tag: [tags.regexp, tags.escape], color: "var(--editor-token-punctuation)" },
-  { tag: tags.number, color: "var(--editor-token-number)" },
-  { tag: [tags.bool, tags.null, tags.atom, tags.self], color: "var(--editor-token-constant)" },
-  { tag: tags.comment, color: "var(--editor-token-comment)", fontStyle: "italic" },
-  { tag: [tags.typeName, tags.className, tags.namespace], color: "var(--editor-token-type)" },
-  {
-    tag: [tags.function(tags.variableName), tags.function(tags.propertyName), tags.macroName],
-    color: "var(--editor-token-function)",
-  },
-  { tag: [tags.variableName, tags.definition(tags.variableName)], color: "var(--editor-token-variable)" },
-  { tag: tags.constant(tags.variableName), color: "var(--editor-token-constant-variable)" },
-  { tag: tags.propertyName, color: "var(--editor-token-property)" },
-  { tag: tags.attributeName, color: "var(--editor-token-attribute)" },
-  { tag: tags.tagName, color: "var(--editor-token-tag)" },
-  { tag: tags.heading, color: "var(--editor-token-heading)", fontWeight: "bold" },
-  { tag: [tags.link, tags.url], color: "var(--editor-token-link)", textDecoration: "underline" },
-  { tag: tags.emphasis, color: "var(--editor-token-emphasis)", fontStyle: "italic" },
-  { tag: tags.strong, color: "var(--editor-token-strong)", fontWeight: "bold" },
-  { tag: tags.strikethrough, textDecoration: "line-through" },
-  { tag: tags.invalid, color: "var(--editor-token-invalid)" },
-]);
-
-// The has-selection class: on the editor while any range is non-empty, so
-// the stylesheet can hide the current-line wash under a selection.
-const hasSelectionClass = EditorView.editorAttributes.compute(
-  ["selection"],
-  (state): Record<string, string> => (state.selection.ranges.some((range) => !range.empty) ? { class: "ws-has-selection" } : {}),
-);
-
-/** A fold lane chevron: down while the range is open, right once folded. */
-function foldMarker(open: boolean): HTMLElement {
-  const marker = document.createElement("span");
-  marker.className = "ws-fold-marker";
-  marker.dataset.state = open ? "open" : "folded";
-  marker.innerHTML = open ? ICON_CHEVRON_DOWN : ICON_CHEVRON_RIGHT;
-  return marker;
-}
-
-/** The lowercase file extension of a path, or null when it has none. */
-function extensionOf(path: string): string | null {
-  const name = path.split(/[\\/]/).filter(Boolean).pop();
-  if (name === undefined) {
-    return null;
-  }
-  const dot = name.lastIndexOf(".");
-  return dot <= 0 ? null : name.slice(dot + 1).toLowerCase();
-}
-
-/** One language mode: its editorLangId and its lazy extension loader. */
-interface LanguageMode {
-  readonly id: string;
-  readonly load: () => Promise<Extension>;
-}
-
-async function javascriptMode(typescript: boolean, jsx: boolean): Promise<Extension> {
-  const { javascript } = await import("@codemirror/lang-javascript");
-  return javascript({ typescript, jsx });
-}
-
-/**
- * The language modes by file extension. First-party packs cover
- * JavaScript/TypeScript, Python, Rust, JSON, Markdown, and YAML; TOML
- * comes through the legacy-modes stream parser. Unknown extensions get
- * plain text. (The single-file esbuild bundle inlines these dynamic
- * imports; the structure keeps the load boundary explicit.) The id is
- * the value the editorLangId context key publishes.
- */
-const LANGUAGE_MODES: Record<string, LanguageMode> = {
-  js: { id: "javascript", load: () => javascriptMode(false, true) },
-  mjs: { id: "javascript", load: () => javascriptMode(false, true) },
-  cjs: { id: "javascript", load: () => javascriptMode(false, true) },
-  jsx: { id: "javascriptreact", load: () => javascriptMode(false, true) },
-  ts: { id: "typescript", load: () => javascriptMode(true, false) },
-  mts: { id: "typescript", load: () => javascriptMode(true, false) },
-  cts: { id: "typescript", load: () => javascriptMode(true, false) },
-  tsx: { id: "typescriptreact", load: () => javascriptMode(true, true) },
-  py: { id: "python", load: async () => (await import("@codemirror/lang-python")).python() },
-  rs: { id: "rust", load: async () => (await import("@codemirror/lang-rust")).rust() },
-  json: { id: "json", load: async () => (await import("@codemirror/lang-json")).json() },
-  md: { id: "markdown", load: async () => (await import("@codemirror/lang-markdown")).markdown() },
-  markdown: { id: "markdown", load: async () => (await import("@codemirror/lang-markdown")).markdown() },
-  yaml: { id: "yaml", load: async () => (await import("@codemirror/lang-yaml")).yaml() },
-  yml: { id: "yaml", load: async () => (await import("@codemirror/lang-yaml")).yaml() },
-  toml: {
-    id: "toml",
-    load: async () => StreamLanguage.define((await import("@codemirror/legacy-modes/mode/toml")).toml),
-  },
-};
-
-/** The editorLangId for a path's extension; "plaintext" when it has no mode. */
-export function languageIdForPath(path: string): string {
-  const extension = extensionOf(path);
-  if (extension === null) {
-    return "plaintext";
-  }
-  return LANGUAGE_MODES[extension]?.id ?? "plaintext";
-}
-
-/** The language mode for a path, loaded on demand; null for plain text. */
-async function languageFor(path: string): Promise<Extension | null> {
-  const extension = extensionOf(path);
-  if (extension === null) {
-    return null;
-  }
-  return (await LANGUAGE_MODES[extension]?.load()) ?? null;
-}
-
-// EditorState.readOnly gates commands and transaction filters;
-// EditorView.editable controls the DOM contenteditable attribute. A
-// user-facing read-only toggle needs both.
-function readOnlyExtension(readOnly: boolean): Extension {
-  return [EditorState.readOnly.of(readOnly), EditorView.editable.of(!readOnly)];
-}
-
-/** Word wrap: lineWrapping when on, nothing when off. */
-function wordWrapExtension(on: boolean): Extension {
-  return on ? EditorView.lineWrapping : [];
-}
-
-const tabMark = Decoration.mark({ class: "cm-highlightTab" });
-const spaceMark = Decoration.mark({ class: "cm-highlightSpace" });
-
-/** Marks the spaces and tabs inside every non-empty selection range, within the visible text. */
-function markSelectedWhitespace(view: EditorView): DecorationSet {
-  const marks: Range<Decoration>[] = [];
-  for (const range of view.state.selection.ranges) {
-    if (range.empty) {
-      continue;
-    }
-    for (const visible of view.visibleRanges) {
-      const from = Math.max(range.from, visible.from);
-      const to = Math.min(range.to, visible.to);
-      if (from >= to) {
-        continue;
-      }
-      const text = view.state.sliceDoc(from, to);
-      for (let index = 0; index < text.length; index += 1) {
-        const char = text[index];
-        if (char === "\t") {
-          marks.push(tabMark.range(from + index, from + index + 1));
-        } else if (char === " ") {
-          marks.push(spaceMark.range(from + index, from + index + 1));
-        }
-      }
-    }
-  }
-  return Decoration.set(marks, true);
-}
-
-/** The selection mode's decorator: the same marks highlightWhitespace uses, scoped to the selection. */
-const selectionWhitespace = ViewPlugin.fromClass(
-  class {
-    decorations: DecorationSet;
-
-    constructor(view: EditorView) {
-      this.decorations = markSelectedWhitespace(view);
-    }
-
-    update(update: ViewUpdate): void {
-      if (update.docChanged || update.selectionSet || update.viewportChanged) {
-        this.decorations = markSelectedWhitespace(update.view);
-      }
-    }
-  },
-  { decorations: (plugin) => plugin.decorations },
-);
-
-/**
- * Render Whitespace: nothing for none, the cm-highlightSpace and
- * cm-highlightTab marks inside the selection only for selection, and
- * the stock decorator over the whole document for all.
- */
-function whitespaceExtension(mode: RenderWhitespace): Extension {
-  switch (mode) {
-    case "none":
-      return [];
-    case "selection":
-      return selectionWhitespace;
-    case "all":
-      return highlightWhitespace();
-  }
-}
-
-/** Render Control Characters: the cm-specialChar decorator when on. */
-function controlCharactersExtension(on: boolean): Extension {
-  return on ? highlightSpecialChars() : [];
-}
-
-/**
- * Column Selection Mode: on makes every left drag rectangular; off keeps
- * Cursor's gesture, Shift+Alt+drag, because a plain Alt+click adds a
- * cursor instead.
- */
-function columnSelectionExtension(on: boolean): Extension {
-  return rectangularSelection({
-    eventFilter: on ? () => true : (event) => event.altKey && event.shiftKey && event.button === 0,
-  });
-}
-
-/** The CodeMirror 6 EditorSurface. */
-export class CodeMirrorSurface extends Disposable implements EditorSurface {
-  readonly element = document.createElement("div");
-  private view: EditorView | null = null;
-  private savedText = "";
-  private dirty = false;
-  private readonly listeners = new Set<(dirty: boolean) => void>();
-  // Everything reconfigurable at runtime sits behind a Compartment on the
-  // surface: a change is one reconfigure dispatch, never a state rebuild
-  // that would drop history, selection, and scroll position.
-  private readonly language = new Compartment();
-  private readonly readOnly = new Compartment();
-  private readonly wordWrap = new Compartment();
-  private readonly whitespace = new Compartment();
-  private readonly controlCharacters = new Compartment();
-  private readonly columnSelection = new Compartment();
-  private readOnlyState = false;
-  private settings: EditorSettings;
-  // Discards a lazy language load that resolves after a newer open().
-  private openGeneration = 0;
-
-  constructor(settingsService: EditorSettingsService | null = getServiceOrNull(EDITOR_SETTINGS_SERVICE)) {
-    super();
-    this.element.className = "ws-editor-surface";
-    // The surface follows the editor settings service: the current values
-    // seed the first state, and every change reconfigures the live view.
-    this.settings = settingsService?.settings ?? DEFAULT_EDITOR_SETTINGS;
-    if (settingsService !== null) {
-      this._register(
-        settingsService.onDidChange((next) => {
-          this.applySettings(next);
-        }),
-      );
-    }
-    // The surface is its own text-control adapter: the Edit menu's
-    // undo/redo/select-all route here whenever this subtree holds focus.
-    // The view is lazy, so the adapter guards against a pre-open state.
-    const textControls = getServiceOrNull(TEXT_CONTROL_SERVICE);
-    if (textControls !== null) {
-      this._register(
-        textControls.register(this.element, {
-          kind: "codemirror",
-          undo: () => {
-            if (this.view !== null) {
-              undo(this.view);
-            }
-          },
-          redo: () => {
-            if (this.view !== null) {
-              redo(this.view);
-            }
-          },
-          selectAll: () => {
-            if (this.view !== null) {
-              selectAll(this.view);
-            }
-          },
-          canUndo: () => this.view !== null && undoDepth(this.view.state) > 0,
-          canRedo: () => this.view !== null && redoDepth(this.view.state) > 0,
-        }),
-      );
-    }
-    // The view is created lazily by open(), so its teardown is registered
-    // here once, against whichever view is live at dispose time.
-    this._register(
-      toDisposable(() => {
-        this.view?.destroy();
-        this.view = null;
-        this.listeners.clear();
-      }),
-    );
-  }
-
-  open(document: EditorDocument): void {
-    this.openGeneration += 1;
-    const generation = this.openGeneration;
-    this.savedText = document.text;
-    if (this.view === null) {
-      this.view = new EditorView({
-        parent: this.element,
-        state: EditorState.create({
-          doc: document.text,
-          extensions: [
-            // basicSetup spelled out, minus highlightSpecialChars,
-            // rectangularSelection, and highlightWhitespace, which live in
-            // settings compartments, and minus crosshairCursor, which Cursor
-            // does not draw. The glyph lane comes before the line numbers.
-            gutter({ class: "cm-glyphMargin" }),
-            lineNumbers(),
-            highlightActiveLineGutter(),
-            history(),
-            codeFolding({ placeholderText: "\u22EF" }),
-            foldGutter({ markerDOM: foldMarker }),
-            drawSelection({ cursorBlinkRate: 1000 }),
-            dropCursor(),
-            EditorState.allowMultipleSelections.of(true),
-            // Alt+click adds a cursor.
-            EditorView.clickAddsSelectionRange.of((event) => event.altKey && !event.shiftKey),
-            indentUnit.of("    "),
-            scrollPastEnd(),
-            indentOnInput(),
-            syntaxHighlighting(defaultHighlightStyle, { fallback: true }),
-            bracketMatching(),
-            closeBrackets(),
-            autocompletion(),
-            highlightActiveLine(),
-            highlightSelectionMatches({ highlightWordAroundCursor: true }),
-            keymap.of([
-              ...closeBracketsKeymap,
-              ...defaultKeymap,
-              ...searchKeymap,
-              ...historyKeymap,
-              ...foldKeymap,
-              ...completionKeymap,
-              ...lintKeymap,
-            ]),
-            search({ createPanel: createFindWidget }),
-            hasSelectionClass,
-            runvilTheme,
-            syntaxHighlighting(runvilHighlight),
-            this.language.of([]),
-            this.readOnly.of(readOnlyExtension(this.readOnlyState)),
-            this.wordWrap.of(wordWrapExtension(this.settings.wordWrap)),
-            this.whitespace.of(whitespaceExtension(this.settings.renderWhitespace)),
-            this.controlCharacters.of(controlCharactersExtension(this.settings.renderControlCharacters)),
-            this.columnSelection.of(columnSelectionExtension(this.settings.columnSelection)),
-            EditorView.updateListener.of((update) => {
-              if (update.docChanged) {
-                this.setDirty(update.state.doc.toString() !== this.savedText);
-              }
-            }),
-          ],
-        }),
-      });
-    } else {
-      // A reload lands in the live view as one annotated transaction, not
-      // a state rebuild: compartments and history survive, and listeners
-      // (a future autosave) can tell the server-originated replacement
-      // from local typing by the annotation.
-      this.view.dispatch({
-        changes: { from: 0, to: this.view.state.doc.length, insert: document.text },
-        annotations: externalUpdate.of(true),
-      });
-    }
-    this.setDirty(false);
-    void languageFor(document.path)
-      .then((mode) => {
-        if (generation === this.openGeneration && this.view !== null) {
-          // A null mode still reconfigures - to empty - because a reload
-          // keeps the view alive, so the previous document's mode must be
-          // cleared rather than left in the compartment.
-          this.view.dispatch({ effects: this.language.reconfigure(mode ?? []) });
-        }
-      })
-      .catch(() => {
-        // A failed language load leaves the document as plain text.
-      });
-  }
-
-  setReadOnly(readOnly: boolean): void {
-    if (readOnly === this.readOnlyState) {
-      return;
-    }
-    this.readOnlyState = readOnly;
-    this.view?.dispatch({ effects: this.readOnly.reconfigure(readOnlyExtension(readOnly)) });
-  }
-
-  /**
-   * Applies new editor settings: one reconfigure dispatch across the
-   * four settings compartments, so history, selection, and scroll
-   * position survive. Stored for the first open() when no view exists.
-   */
-  private applySettings(settings: EditorSettings): void {
-    this.settings = settings;
-    this.view?.dispatch({
-      effects: [
-        this.wordWrap.reconfigure(wordWrapExtension(settings.wordWrap)),
-        this.whitespace.reconfigure(whitespaceExtension(settings.renderWhitespace)),
-        this.controlCharacters.reconfigure(controlCharactersExtension(settings.renderControlCharacters)),
-        this.columnSelection.reconfigure(columnSelectionExtension(settings.columnSelection)),
-      ],
-    });
-  }
-
-  text(): string {
-    return this.view?.state.doc.toString() ?? "";
-  }
-
-  editorView(): EditorView | null {
-    return this.view;
-  }
-
-  markSaved(text: string): void {
-    this.savedText = text;
-    this.setDirty(this.text() !== text);
-  }
-
-  isDirty(): boolean {
-    return this.dirty;
-  }
-
-  onDirtyChange(listener: (dirty: boolean) => void): () => void {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
-  }
-
-  focus(): void {
-    this.view?.focus();
-  }
-
-  private setDirty(dirty: boolean): void {
-    if (dirty === this.dirty) {
-      return;
-    }
-    this.dirty = dirty;
-    for (const listener of this.listeners) {
-      listener(dirty);
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/editor/editor.contribution.ts b/crates/workshop/ui/src/parts/editor/editor.contribution.ts
deleted file mode 100644
index 72cc21b88..000000000
--- a/crates/workshop/ui/src/parts/editor/editor.contribution.ts
+++ /dev/null
@@ -1,336 +0,0 @@
-// The editor contribution: the eager module registering the editor's
-// CodeMirror-backed catalog rows at module scope, before any service
-// exists. Every run body lazy-imports editor-commands, so this file
-// pulls no CodeMirror or dockview into the initial bundle; the
-// type-only `typeof import` below is erased at compile time.
-//
-// Placements follow the catalog: ctrl-based chords bind ctrlcmd so
-// macOS gets Cmd, every keybinding rule sets when: "editorTextFocus"
-// with the menu precondition "activeEditor == 'editor'" ANDed in by the
-// action registry, and editor actions register at EditorContrib so
-// workbench chords outrank them. Rows the catalog shows without a
-// keybinding (Duplicate Selection, Add Previous Occurrence, Select All
-// Occurrences) register none.
-//
-// The editor's panel type registers here too: editors key by path, and
-// untitled buffers by their allocated serial, so each new buffer is its
-// own panel instead of reactivating the previous one.
-//
-// The editor's context menu is filled here as well: Cut, Copy, Paste, and
-// Command Palette..., the rows Cursor's editor shows, each a command the
-// edit and quick-input contributions already own. The panel opens it at
-// the pointer on a right-click.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { KeybindingsRegistry, KeybindingWeight } from "@workshop/platform/keybinding-registry";
-import { MenuId, Menus } from "@workshop/platform/menu-registry";
-import { registerPanelType } from "@workshop/platform/panel-registry";
-import { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { lastSegment } from "../../base/paths";
-import { QUICK_INPUT_SERVICE } from "../../services/quick-input-service";
-import { EDITOR_SETTINGS_SERVICE, type EditorSettingName } from "../../services/editor-settings-service";
-import { EDITOR_CONTEXT_MENU } from "./editor-menus";
-import { createGotoLineProvider } from "./goto-line";
-
-registerPanelType({
-  type: "editor",
-  title: (params) => (typeof params.path === "string" ? lastSegment(params.path) : undefined) ?? "Editor",
-  defaultZone: "main",
-  panelId: (params) => {
-    if (typeof params.path === "string") {
-      return `editor:${params.path}`;
-    }
-    if (typeof params.untitled === "number") {
-      return `editor:untitled-${params.untitled}`;
-    }
-    return "editor:";
-  },
-  load: () => import("./index"),
-});
-
-/** The editor-commands module as a type only; the runtime import stays lazy. */
-type EditorCommands = typeof import("./editor-commands");
-
-/** One catalog row: an editor command with its menu and keybinding placement. */
-interface EditorActionRow {
-  readonly id: string;
-  readonly title: string;
-  readonly menu: MenuId;
-  readonly group: string;
-  /** The position within the group, matching the spec's row order. */
-  readonly order: number;
-  readonly keybinding?: string;
-  readonly pick: (commands: EditorCommands) => Parameters<EditorCommands["runInActiveEditor"]>[0];
-}
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`editor action '${action.id}': ${result.error.message}`);
-  }
-}
-
-/** Builds a run body that loads the editor chunk on demand and runs one command. */
-function runEditorCommand(pick: EditorActionRow["pick"]): () => Promise<void> {
-  return () =>
-    import("./editor-commands").then((commands) => {
-      commands.runInActiveEditor(pick(commands));
-    });
-}
-
-/**
- * Builds a run body that loads the editor chunk on demand and calls one
- * command-layer function with the command's arguments.
- */
-function runEditorTask(
-  pick: (commands: EditorCommands) => (...args: readonly unknown[]) => void | Promise<void>,
-): (...args: readonly unknown[]) => Promise<void> {
-  return (...args) => import("./editor-commands").then((commands) => pick(commands)(...args));
-}
-
-const editorActions = [
-  { id: "actions.find", title: "Find", menu: MenuId.MenubarEditMenu, group: "3_find", order: 1, keybinding: "ctrlcmd+f", pick: (c) => c.openSearchPanel },
-  { id: "editor.action.startFindReplaceAction", title: "Replace", menu: MenuId.MenubarEditMenu, group: "3_find", order: 2, keybinding: "ctrlcmd+h", pick: (c) => c.startFindReplace },
-  { id: "editor.action.commentLine", title: "Toggle Line Comment", menu: MenuId.MenubarEditMenu, group: "5_insert", order: 1, keybinding: "ctrlcmd+/", pick: (c) => c.toggleLineComment },
-  { id: "editor.action.blockComment", title: "Toggle Block Comment", menu: MenuId.MenubarEditMenu, group: "5_insert", order: 2, keybinding: "shift+alt+a", pick: (c) => c.toggleBlockComment },
-  { id: "editor.action.smartSelect.expand", title: "Expand Selection", menu: MenuId.MenubarSelectionMenu, group: "1_basic", order: 2, keybinding: "shift+alt+right", pick: (c) => c.smartSelectExpand },
-  { id: "editor.action.smartSelect.shrink", title: "Shrink Selection", menu: MenuId.MenubarSelectionMenu, group: "1_basic", order: 3, keybinding: "shift+alt+left", pick: (c) => c.smartSelectShrink },
-  { id: "editor.action.copyLinesUpAction", title: "Copy Line Up", menu: MenuId.MenubarSelectionMenu, group: "2_line", order: 1, keybinding: "shift+alt+up", pick: (c) => c.copyLineUp },
-  { id: "editor.action.copyLinesDownAction", title: "Copy Line Down", menu: MenuId.MenubarSelectionMenu, group: "2_line", order: 2, keybinding: "shift+alt+down", pick: (c) => c.copyLineDown },
-  { id: "editor.action.moveLinesUpAction", title: "Move Line Up", menu: MenuId.MenubarSelectionMenu, group: "2_line", order: 3, keybinding: "alt+up", pick: (c) => c.moveLineUp },
-  { id: "editor.action.moveLinesDownAction", title: "Move Line Down", menu: MenuId.MenubarSelectionMenu, group: "2_line", order: 4, keybinding: "alt+down", pick: (c) => c.moveLineDown },
-  { id: "editor.action.duplicateSelection", title: "Duplicate Selection", menu: MenuId.MenubarSelectionMenu, group: "2_line", order: 5, pick: (c) => c.duplicateSelection },
-  { id: "editor.action.insertCursorAbove", title: "Add Cursor Above", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 1, keybinding: "ctrlcmd+alt+up", pick: (c) => c.insertCursorAbove },
-  { id: "editor.action.insertCursorBelow", title: "Add Cursor Below", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 2, keybinding: "ctrlcmd+alt+down", pick: (c) => c.insertCursorBelow },
-  { id: "editor.action.insertCursorAtEndOfEachLineSelected", title: "Add Cursors to Line Ends", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 3, keybinding: "shift+alt+i", pick: (c) => c.insertCursorAtLineEnds },
-  { id: "editor.action.addSelectionToNextFindMatch", title: "Add Next Occurrence", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 4, keybinding: "ctrlcmd+d", pick: (c) => c.selectNextOccurrence },
-  { id: "editor.action.addSelectionToPreviousFindMatch", title: "Add Previous Occurrence", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 5, pick: (c) => c.selectPreviousOccurrence },
-  // Ctrl+Shift+L is the row's label, as in Cursor's menu; the chat pane's New Chat (BuiltinExtension weight) wins the chord at dispatch.
-  { id: "editor.action.selectHighlights", title: "Select All Occurrences", menu: MenuId.MenubarSelectionMenu, group: "3_multi", order: 6, keybinding: "ctrlcmd+shift+l", pick: (c) => c.selectSelectionMatches },
-  { id: "editor.action.jumpToBracket", title: "Go to Bracket", menu: MenuId.MenubarGoMenu, group: "5_infile_nav", order: 2, keybinding: "ctrlcmd+shift+\\", pick: (c) => c.cursorMatchingBracket },
-  { id: "editor.action.marker.nextInFiles", title: "Next Problem", menu: MenuId.MenubarGoMenu, group: "6_problem_nav", order: 1, keybinding: "f8", pick: (c) => c.nextDiagnostic },
-  { id: "editor.action.marker.prevInFiles", title: "Previous Problem", menu: MenuId.MenubarGoMenu, group: "6_problem_nav", order: 2, keybinding: "shift+f8", pick: (c) => c.previousDiagnostic },
-] satisfies readonly EditorActionRow[];
-
-for (const row of editorActions) {
-  addAction({
-    id: row.id,
-    title: row.title,
-    f1: true,
-    precondition: "activeEditor == 'editor'",
-    keybinding:
-      row.keybinding === undefined
-        ? undefined
-        : { keybinding: row.keybinding, when: "editorTextFocus", weight: KeybindingWeight.EditorContrib },
-    menu: [{ id: row.menu, group: row.group, order: row.order }],
-    run: runEditorCommand(row.pick),
-  });
-}
-
-// Indent and Outdent: CodeMirror's own Mod-] and Mod-[ (indentMore and
-// indentLess). They sit outside the catalog - no menu row, no palette row -
-// but they must be registry rules: the keybinding dispatcher swallows every
-// claimed chord, and the chat pane claims Ctrl+] and Ctrl+[ for its tab
-// cycle, so without these rules the editor's own indent chords would never
-// reach CodeMirror. The chat's rules need a chat as the active panel and
-// these need an editor, so the two sets never claim the same press
-// (agent.contribution.ts).
-const indentActions = [
-  { id: "editor.action.indentLines", title: "Indent Line", keybinding: "ctrlcmd+]", pick: (c) => c.indentMore },
-  { id: "editor.action.outdentLines", title: "Outdent Line", keybinding: "ctrlcmd+[", pick: (c) => c.indentLess },
-] satisfies readonly Pick<EditorActionRow, "id" | "title" | "keybinding" | "pick">[];
-
-for (const row of indentActions) {
-  addAction({
-    id: row.id,
-    title: row.title,
-    precondition: "activeEditor == 'editor'",
-    keybinding: { keybinding: row.keybinding, when: "editorTextFocus", weight: KeybindingWeight.EditorContrib },
-    run: runEditorCommand(row.pick),
-  });
-}
-
-/** One settings toggle row: the action flips a setting on the editor settings service. */
-interface EditorToggleRow {
-  readonly id: string;
-  readonly title: string;
-  readonly menu: MenuId;
-  readonly group: string;
-  /** The position within the group, matching the spec's row order. */
-  readonly order: number;
-  readonly setting: EditorSettingName;
-  readonly keybinding?: string;
-  readonly precondition?: string;
-}
-
-// The four editor settings toggles. Each declares its
-// `toggled` expression naming the config.editor.* key the settings
-// service publishes, and its run body flips the setting - the surfaces
-// follow through their compartments. The Appearance rows target the
-// submenu id the menubar contribution declares; MenuId is a plain
-// string, so the literal is the id. Word Wrap and the render toggles
-// skip the precondition (they toggle global state, no editor needed);
-// Column Selection Mode keeps the editor default, activeEditor == 'editor'.
-const editorToggles = [
-  { id: "editor.action.toggleColumnSelection", title: "Column Selection Mode", menu: MenuId.MenubarSelectionMenu, group: "4_config", order: 2, setting: "columnSelection", precondition: "activeEditor == 'editor'" },
-  { id: "editor.action.toggleWordWrap", title: "Word Wrap", menu: MenuId.MenubarViewMenu, group: "5_editor", order: 1, setting: "wordWrap", keybinding: "alt+z" },
-  { id: "editor.action.toggleRenderWhitespace", title: "Render Whitespace", menu: "menubar/view/appearance", group: "4_editor", order: 4, setting: "renderWhitespace" },
-  { id: "editor.action.toggleRenderControlCharacter", title: "Render Control Characters", menu: "menubar/view/appearance", group: "4_editor", order: 5, setting: "renderControlCharacters" },
-] satisfies readonly EditorToggleRow[];
-
-for (const row of editorToggles) {
-  addAction({
-    id: row.id,
-    title: row.title,
-    f1: true,
-    precondition: row.precondition,
-    toggled: `config.editor.${row.setting}`,
-    keybinding:
-      row.keybinding === undefined
-        ? undefined
-        : { keybinding: row.keybinding, when: "editorTextFocus", weight: KeybindingWeight.EditorContrib },
-    menu: [{ id: row.menu, group: row.group, order: row.order }],
-    run: () => {
-      getService(EDITOR_SETTINGS_SERVICE).toggle(row.setting);
-    },
-  });
-}
-
-// The lifecycle rows. New Text File and Reopen Closed
-// Editor bind no `when`: both must work with no editor open. Go to
-// Line keeps the editor-owned default - keybinding when
-// editorTextFocus, menu precondition activeEditor == 'editor' - and
-// opens quick input at the ":" prefix. The run bodies lazy-import the
-// lifecycle module, so this file stays out of the editor chunk's graph.
-addAction({
-  id: "workbench.action.files.newUntitledFile",
-  title: "New Text File",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+n", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "1_new", order: 1 }],
-  run: () => import("./editor-lifecycle").then((lifecycle) => lifecycle.newUntitledFile()),
-});
-
-addAction({
-  id: "workbench.action.reopenClosedEditor",
-  title: "Reopen Closed Editor",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+shift+t", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarRecentMenu, group: "1_editor" }],
-  run: () => import("./editor-lifecycle").then((lifecycle) => lifecycle.reopenClosedEditor()),
-});
-
-addAction({
-  id: "workbench.action.gotoLine",
-  title: "Go to Line/Column...",
-  f1: true,
-  precondition: "activeEditor == 'editor'",
-  keybinding: { keybinding: "ctrlcmd+g", when: "editorTextFocus", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarGoMenu, group: "5_infile_nav", order: 1 }],
-  run: () => {
-    getService(QUICK_INPUT_SERVICE).quickAccess.show(":");
-  },
-});
-
-// The workbench-level editor rows: Save, the four directional splits,
-// and editor cycling. The menu-spec test assembles the full tree, so
-// these register here with the rest of the editor's rows. Save and the
-// splits follow the editor-owned default - keybinding when
-// editorTextFocus, menu precondition activeEditor == 'editor' - while
-// Next/Previous Editor bind no when (the catalog's "-" cell): Ctrl+Tab
-// cycles from anywhere, as in VS Code. The splits move the active panel
-// into a fresh dockview group in the direction. Close and Close Others
-// register from the layout contribution.
-addAction({
-  id: "workbench.action.files.save",
-  title: "Save",
-  f1: true,
-  precondition: "activeEditor == 'editor'",
-  keybinding: { keybinding: "ctrlcmd+s", when: "editorTextFocus", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "4_save", order: 1 }],
-  run: runEditorTask((commands) => commands.saveActiveEditor),
-});
-
-/** One split row: a direction and its Editor Layout placement. */
-interface SplitRow {
-  readonly id: string;
-  readonly title: string;
-  readonly direction: Parameters<EditorCommands["splitActiveEditor"]>[0];
-  readonly order: number;
-  readonly keybinding?: string;
-}
-
-const splitRows = [
-  { id: "workbench.action.splitEditorUp", title: "Split Up", direction: "up", order: 1, keybinding: "ctrlcmd+m ctrlcmd+\\" },
-  { id: "workbench.action.splitEditorDown", title: "Split Down", direction: "down", order: 2 },
-  { id: "workbench.action.splitEditorLeft", title: "Split Left", direction: "left", order: 3 },
-  { id: "workbench.action.splitEditorRight", title: "Split Right", direction: "right", order: 4 },
-] satisfies readonly SplitRow[];
-
-for (const row of splitRows) {
-  addAction({
-    id: row.id,
-    title: row.title,
-    f1: true,
-    precondition: "activeEditor == 'editor'",
-    keybinding:
-      row.keybinding === undefined
-        ? undefined
-        : { keybinding: row.keybinding, when: "editorTextFocus", weight: KeybindingWeight.WorkbenchContrib },
-    menu: [{ id: "menubar/view/editorLayout", group: "1_split", order: row.order }],
-    run: runEditorTask((commands) => () => commands.splitActiveEditor(row.direction)),
-  });
-}
-
-// Next/Previous Editor register two rules each; the first registered owns
-// the menu label, so Ctrl+PageDown/Ctrl+PageUp show and Ctrl+Tab and
-// Ctrl+Shift+Tab keep working beside them.
-addAction({
-  id: "workbench.action.nextEditor",
-  title: "Next Editor",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+pagedown", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: "menubar/go/switchEditor", group: "1_sideBySide", order: 1 }],
-  run: runEditorTask((commands) => () => commands.cycleEditor(1)),
-});
-KeybindingsRegistry.registerKeybindingRule({ id: "workbench.action.nextEditor", keybinding: "ctrlcmd+tab" });
-
-addAction({
-  id: "workbench.action.previousEditor",
-  title: "Previous Editor",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+pageup", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: "menubar/go/switchEditor", group: "1_sideBySide", order: 2 }],
-  run: runEditorTask((commands) => () => commands.cycleEditor(-1)),
-});
-KeybindingsRegistry.registerKeybindingRule({ id: "workbench.action.previousEditor", keybinding: "ctrlcmd+shift+tab" });
-
-// The editor's context menu rows. The commands belong to the edit and
-// quick-input contributions (their titles come from the command registry);
-// only the placement is declared here, in VS Code's group names.
-const contextMenuRows = [
-  { command: "editor.action.clipboardCutAction", group: "9_cutcopypaste", order: 1 },
-  { command: "editor.action.clipboardCopyAction", group: "9_cutcopypaste", order: 2 },
-  { command: "editor.action.clipboardPasteAction", group: "9_cutcopypaste", order: 3 },
-  { command: "workbench.action.showCommands", group: "z_commands", order: 1 },
-] as const;
-
-for (const row of contextMenuRows) {
-  Menus.appendMenuItem(EDITOR_CONTEXT_MENU, row);
-}
-
-// The ":" go-to-line provider, in Cursor's own text. The factory is
-// CodeMirror-free; only the row's accept path lazy-imports the command
-// layer. The entry has no command-center order, as Cursor's has none, so it
-// shows under ? but not in the modes list.
-QuickAccessRegistry.registerQuickAccessProvider({
-  prefix: ":",
-  placeholder: "Type the line number and optional column to go to (e.g. 42:5 for line 42 and column 5).",
-  helpEntries: [{ description: "Go to Line/Column", commandId: "workbench.action.gotoLine" }],
-  factory: () => createGotoLineProvider(),
-});
diff --git a/crates/workshop/ui/src/parts/editor/find-widget.ts b/crates/workshop/ui/src/parts/editor/find-widget.ts
deleted file mode 100644
index 2964d32e4..000000000
--- a/crates/workshop/ui/src/parts/editor/find-widget.ts
+++ /dev/null
@@ -1,281 +0,0 @@
-// The editor's find widget: a floating panel at the top right of the
-// editor, in place of CodeMirror's stock search panel, built for
-// search({ createPanel }). It copies Cursor's widget - a find row with
-// the three option toggles, the match count, previous and next, and
-// close, and a replace row behind a toggle - with Cursor's labels. It
-// drives the stock search state (SearchQuery, findNext, replaceAll, and
-// the rest), so the keymap, the Edit menu's Find and Replace rows, and
-// the match highlighting all keep working. The look (419px wide, 33px
-// rows, 28px from the right) lives in editor-panel.css.
-//
-// Glyphs: close and the replace toggle are codicons from @workshop/look;
-// the rest of the buttons carry plain text, because the look package
-// ships only the codicons the surface specifications use.
-
-import { EditorView, runScopeHandlers, type Panel, type ViewUpdate } from "@codemirror/view";
-import {
-  closeSearchPanel,
-  findNext,
-  findPrevious,
-  getSearchQuery,
-  replaceAll,
-  replaceNext,
-  SearchQuery,
-  setSearchQuery,
-} from "@codemirror/search";
-
-import { ICON_CHEVRON_RIGHT, ICON_CLOSE } from "@workshop/look/icons";
-
-/** The widget's root class, which the stylesheet and revealReplace key on. */
-const WIDGET_CLASS = "ws-find-widget";
-
-/** Matches counted before the count reads "1000+" instead of a total. */
-const COUNT_LIMIT = 1000;
-
-/** The option toggles, as the query's own flag names. */
-type Flag = "caseSensitive" | "wholeWord" | "regexp";
-
-interface FlagToggle {
-  readonly flag: Flag;
-  readonly label: string;
-  readonly glyph: string;
-  /** The Alt+letter that flips it from either field. */
-  readonly key: string;
-}
-
-const FLAG_TOGGLES: readonly FlagToggle[] = [
-  { flag: "caseSensitive", label: "Match Case (Alt+C)", glyph: "Aa", key: "c" },
-  { flag: "wholeWord", label: "Match Whole Word (Alt+W)", glyph: "ab", key: "w" },
-  { flag: "regexp", label: "Use Regular Expression (Alt+R)", glyph: ".*", key: "r" },
-];
-
-/** Builds an element with a class. */
-function element<K extends keyof HTMLElementTagNameMap>(tag: K, className: string): HTMLElementTagNameMap[K] {
-  const node = document.createElement(tag);
-  node.className = className;
-  return node;
-}
-
-/** A text field with Cursor's placeholder doubling as its accessible name. */
-function textField(name: string, label: string): HTMLInputElement {
-  const input = element("input", "ws-find-input");
-  input.type = "text";
-  input.name = name;
-  input.placeholder = label;
-  input.setAttribute("aria-label", label);
-  input.spellcheck = false;
-  input.autocomplete = "off";
-  return input;
-}
-
-/** A button whose tooltip and accessible name are one label. */
-function labelledButton(className: string, label: string): HTMLButtonElement {
-  const button = element("button", className);
-  button.type = "button";
-  button.title = label;
-  button.setAttribute("aria-label", label);
-  return button;
-}
-
-class FindWidget implements Panel {
-  readonly dom: HTMLElement;
-  readonly top = true;
-
-  private readonly searchField = textField("search", "Find");
-  private readonly replaceField = textField("replace", "Replace");
-  private readonly count = element("span", "ws-find-count");
-  private readonly toggles = new Map<Flag, HTMLButtonElement>();
-  private query: SearchQuery;
-
-  constructor(private readonly view: EditorView) {
-    this.query = getSearchQuery(view.state);
-    this.searchField.setAttribute("main-field", "true");
-
-    const dom = element("div", WIDGET_CLASS);
-    dom.dataset.replace = "false";
-    this.dom = dom;
-
-    const reveal = labelledButton("ws-find-button ws-find-toggle", "Toggle Replace");
-    reveal.innerHTML = ICON_CHEVRON_RIGHT;
-    reveal.addEventListener("click", () => {
-      dom.dataset.replace = dom.dataset.replace === "true" ? "false" : "true";
-    });
-
-    const options = element("div", "ws-find-options");
-    for (const toggle of FLAG_TOGGLES) {
-      const button = labelledButton("ws-find-button ws-find-option", toggle.label);
-      button.textContent = toggle.glyph;
-      button.addEventListener("click", () => this.flip(toggle.flag));
-      this.toggles.set(toggle.flag, button);
-      options.append(button);
-    }
-    const findRow = element("div", "ws-find-row");
-    const findBox = element("div", "ws-find-field");
-    findBox.append(this.searchField, options);
-    this.count.setAttribute("aria-live", "polite");
-    findRow.append(
-      findBox,
-      this.count,
-      this.action("Previous Match (Shift+Enter)", "\u2191", () => findPrevious(view)),
-      this.action("Next Match (Enter)", "\u2193", () => findNext(view)),
-      this.action("Close (Escape)", "", () => closeSearchPanel(view), ICON_CLOSE),
-    );
-
-    const replaceRow = element("div", "ws-find-row ws-find-row--replace");
-    const replaceBox = element("div", "ws-find-field");
-    replaceBox.append(this.replaceField);
-    replaceRow.append(
-      replaceBox,
-      this.action("Replace (Enter)", "Replace", () => replaceNext(view)),
-      this.action("Replace All (Ctrl+Alt+Enter)", "All", () => replaceAll(view)),
-    );
-
-    const rows = element("div", "ws-find-rows");
-    rows.append(findRow, replaceRow);
-    dom.append(reveal, rows);
-
-    dom.addEventListener("keydown", (event) => this.onKeydown(event));
-    for (const field of [this.searchField, this.replaceField]) {
-      field.addEventListener("input", () => this.commit());
-      field.addEventListener("change", () => this.commit());
-    }
-    this.sync(this.query);
-    this.refreshCount();
-  }
-
-  mount(): void {
-    this.searchField.select();
-  }
-
-  update(update: ViewUpdate): void {
-    let queryChanged = false;
-    for (const transaction of update.transactions) {
-      for (const effect of transaction.effects) {
-        if (effect.is(setSearchQuery)) {
-          queryChanged = true;
-          if (!effect.value.eq(this.query)) {
-            this.sync(effect.value);
-          }
-        }
-      }
-    }
-    // The count scans the document, and this runs for every view update
-    // (scroll, focus, geometry), so recount only when the answer can change:
-    // a new query, an edit, or a moved selection.
-    if (queryChanged || update.docChanged || update.selectionSet) {
-      this.refreshCount();
-    }
-  }
-
-  /** A button that runs `run`, with its label as tooltip and accessible name. */
-  private action(label: string, glyph: string, run: () => void, icon?: string): HTMLButtonElement {
-    const button = labelledButton("ws-find-button", label);
-    if (icon === undefined) {
-      button.textContent = glyph;
-    } else {
-      button.innerHTML = icon;
-    }
-    button.addEventListener("click", run);
-    return button;
-  }
-
-  /** Shows `query` in the fields and the option toggles. */
-  private sync(query: SearchQuery): void {
-    this.query = query;
-    this.searchField.value = query.search;
-    this.replaceField.value = query.replace;
-    for (const toggle of FLAG_TOGGLES) {
-      this.toggles.get(toggle.flag)?.setAttribute("aria-pressed", String(query[toggle.flag]));
-    }
-  }
-
-  /** Reads the fields and toggles back into the search state. */
-  private commit(): void {
-    const flag = (name: Flag): boolean => this.toggles.get(name)?.getAttribute("aria-pressed") === "true";
-    const query = new SearchQuery({
-      search: this.searchField.value,
-      replace: this.replaceField.value,
-      caseSensitive: flag("caseSensitive"),
-      wholeWord: flag("wholeWord"),
-      regexp: flag("regexp"),
-      literal: this.query.literal,
-    });
-    if (!query.eq(this.query)) {
-      this.query = query;
-      this.view.dispatch({ effects: setSearchQuery.of(query) });
-    }
-  }
-
-  private flip(flag: Flag): void {
-    const button = this.toggles.get(flag);
-    button?.setAttribute("aria-pressed", String(button.getAttribute("aria-pressed") !== "true"));
-    this.commit();
-  }
-
-  /** "No results", or the current match's place among them ("?" while the selection is not on one). */
-  private refreshCount(): void {
-    const query = getSearchQuery(this.view.state);
-    let total = 0;
-    let current = 0;
-    if (query.valid) {
-      const { from, to } = this.view.state.selection.main;
-      const cursor = query.getCursor(this.view.state);
-      for (let match = cursor.next(); !match.done; match = cursor.next()) {
-        total += 1;
-        if (match.value.from === from && match.value.to === to) {
-          current = total;
-        }
-        if (total >= COUNT_LIMIT) {
-          break;
-        }
-      }
-    }
-    this.count.textContent =
-      total === 0 ? "No results" : `${current === 0 ? "?" : current} of ${total >= COUNT_LIMIT ? `${COUNT_LIMIT}+` : total}`;
-  }
-
-  private onKeydown(event: KeyboardEvent): void {
-    if (runScopeHandlers(this.view, event, "search-panel")) {
-      event.preventDefault();
-      return;
-    }
-    if (event.key === "Enter" && (event.ctrlKey || event.metaKey) && event.altKey) {
-      event.preventDefault();
-      replaceAll(this.view);
-      return;
-    }
-    if (event.key === "Enter" && event.target === this.searchField) {
-      event.preventDefault();
-      (event.shiftKey ? findPrevious : findNext)(this.view);
-      return;
-    }
-    if (event.key === "Enter" && event.target === this.replaceField) {
-      event.preventDefault();
-      replaceNext(this.view);
-      return;
-    }
-    if (event.altKey && !event.ctrlKey && !event.metaKey && !event.shiftKey) {
-      const toggle = FLAG_TOGGLES.find((candidate) => candidate.key === event.key.toLowerCase());
-      if (toggle !== undefined) {
-        event.preventDefault();
-        this.flip(toggle.flag);
-      }
-    }
-  }
-}
-
-/** The search({ createPanel }) factory. */
-export function createFindWidget(view: EditorView): Panel {
-  return new FindWidget(view);
-}
-
-/**
- * Shows the widget's replace row, for Replace (Ctrl+H). A no-op when the
- * editor has no find widget open.
- */
-export function revealReplace(view: EditorView): void {
-  const widget = view.dom.querySelector<HTMLElement>(`.${WIDGET_CLASS}`);
-  if (widget !== null) {
-    widget.dataset.replace = "true";
-  }
-}
diff --git a/crates/workshop/ui/src/parts/editor/goto-line.ts b/crates/workshop/ui/src/parts/editor/goto-line.ts
deleted file mode 100644
index c3f11505f..000000000
--- a/crates/workshop/ui/src/parts/editor/goto-line.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-// The ":" go-to-line quick-access provider. The provider itself is
-// CodeMirror-free so the editor contribution can register it at module
-// scope without pulling the editor chunk into the initial bundle; only
-// the accept path lazy-imports the command layer. The filter syntax is
-// VS Code's: a 1-based line number with an optional column after a
-// colon or comma (":12", ":12:5", ":12,5").
-
-import type { QuickAccessProvider, QuickInputItem } from "../../services/quick-input-service";
-
-/** A parsed go-to target: a 1-based line and an optional 1-based column. */
-export interface LineColumnTarget {
-  readonly line: number;
-  readonly column: number | undefined;
-}
-
-/** Parses a go-to-line filter, or null when it names no valid target. */
-export function parseLineColumn(filter: string): LineColumnTarget | null {
-  const match = /^\s*(\d+)(?:\s*[:,]\s*(\d+))?\s*$/.exec(filter);
-  if (match === null || match[1] === undefined) {
-    return null;
-  }
-  const line = Number(match[1]);
-  const column = match[2] === undefined ? undefined : Number(match[2]);
-  if (line < 1 || (column !== undefined && column < 1)) {
-    return null;
-  }
-  return { line, column };
-}
-
-/**
- * The ":" provider: one go-to row for a valid target, one inert
- * guidance row otherwise. Accepting dispatches goToLine against the
- * active editor through the lazy command-layer import.
- */
-export function createGotoLineProvider(): QuickAccessProvider {
-  return {
-    getItems(filter: string): readonly QuickInputItem[] {
-      const target = parseLineColumn(filter);
-      if (target === null) {
-        return [{ label: "Type a line number to go to", accept: () => {} }];
-      }
-      // Cursor's wording: "Go to line {0}." and "Go to line {0} and character {1}."
-      const label =
-        target.column === undefined
-          ? `Go to line ${target.line}.`
-          : `Go to line ${target.line} and character ${target.column}.`;
-      return [
-        {
-          label,
-          accept: () => {
-            void import("./editor-commands").then((commands) => {
-              commands.goToLine(target.line, target.column);
-            });
-          },
-        },
-      ];
-    },
-  };
-}
diff --git a/crates/workshop/ui/src/parts/editor/index.ts b/crates/workshop/ui/src/parts/editor/index.ts
deleted file mode 100644
index 0fb4cf4d2..000000000
--- a/crates/workshop/ui/src/parts/editor/index.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-// The editor feature's entry point: register() is the panel registry's
-// activation hook. Importers point at the source files directly; this
-// module re-exports nothing.
-
-import { DisposableStore, type IDisposable } from "@workshop/platform/lifecycle";
-import { DOCK, registerPanelFactory } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { bindEditorContextKeys, installClosedEditorTracking } from "./editor-lifecycle";
-import { EditorPanel } from "./editor-panel";
-
-/**
- * The editor directory's activation: installs the editor panel factory
- * and the chunk-sourced lifecycle - the closed-editor stack and the
- * editorLangId context key, both following the dock. The
- * editor's actions and keybindings register eagerly from
- * editor.contribution.ts. Called once by the panel registry when the
- * directory's chunk first loads; the returned disposable is held for
- * the page lifetime.
- */
-export function register(): IDisposable {
-  const store = new DisposableStore();
-  store.add(registerPanelFactory("editor", () => new EditorPanel()));
-  const dock = getService(DOCK);
-  store.add(installClosedEditorTracking(dock));
-  store.add(bindEditorContextKeys(dock));
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/gateway/gateway-config-bridge.ts b/crates/workshop/ui/src/parts/gateway/gateway-config-bridge.ts
deleted file mode 100644
index 91e39e260..000000000
--- a/crates/workshop/ui/src/parts/gateway/gateway-config-bridge.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-// The workshop side of the config panel's postMessage bridge. The
-// gateway config UI runs in an iframe proxied through the workshop
-// server at /gateway/config/, so the frame shares the workshop's own
-// origin; this window-level listener is its only path to the workshop:
-// API-forward requests go through the workshop server's key-attaching
-// proxy, action notifications land on the status bar, and the ready
-// announcement is answered with a context message (theme and initial
-// route). Origins are pinned in both directions: a message is handled
-// only when event.origin equals the workshop's own origin, and every
-// reply is posted with that exact origin as its targetOrigin - never "*".
-
-import { toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import { forwardGatewayRequest, type FetchLike } from "../../services/gateway-config-api";
-
-/** The status surface the panel's action notifications land on. */
-export interface BridgeStatusSink {
-  /** Shows a local (client-originated) status line. */
-  showLocal(label: string, severity: "info" | "error"): void;
-}
-
-/** Construction seams for {@link setupGatewayConfigBridge}. */
-export interface GatewayConfigBridgeOptions {
-  /** Where action notifications (apply, revert, download-started) land. */
-  readonly statusBar: BridgeStatusSink;
-  /** Transport for the API-forward proxy; the global fetch in production. */
-  readonly fetchFn?: FetchLike;
-  /** The window whose message events feed the bridge; the global one in production. */
-  readonly win?: Pick<Window, "addEventListener" | "removeEventListener">;
-  /**
-   * Reply seam: posts `message` back to the event's source window at
-   * `targetOrigin`. Tests substitute a recorder; production posts to
-   * event.source with the pinned workshop origin.
-   */
-  readonly reply?: (event: MessageEvent, message: unknown, targetOrigin: string) => void;
-}
-
-/** Status bar lines for the actions the config UI announces. */
-const ACTION_LABELS: Readonly<Record<string, string>> = {
-  apply: "Gateway configuration applied",
-  revert: "Gateway configuration changes reverted",
-  "download-started": "Gateway download started",
-};
-
-/** The context handed to the iframe once it announces itself. */
-const PANEL_CONTEXT = { type: "rv-context", theme: "dark", route: "#/local" } as const;
-
-/**
- * Installs the window-level message listener that serves the config
- * panel's iframe. The iframe is proxied same-origin through the
- * workshop server, so messages are accepted from - and replies pinned
- * to - the workshop's own origin. The returned dispose() detaches the
- * listener.
- */
-export function setupGatewayConfigBridge(options: GatewayConfigBridgeOptions): IDisposable {
-  const win = options.win ?? window;
-  const reply =
-    options.reply ??
-    ((event: MessageEvent, message: unknown, targetOrigin: string): void => {
-      (event.source as Window | null)?.postMessage(message, targetOrigin);
-    });
-  // The panel iframe is served through the workshop's own proxy, so the
-  // one legitimate sender shares this window's origin; anything else -
-  // the gateway's own port included - is foreign.
-  const origin = window.location.origin;
-
-  const onMessage = (event: MessageEvent): void => {
-    void (async () => {
-      if (event.origin !== origin) {
-        return; // Not the config panel; every foreign message is dropped.
-      }
-      const data = event.data as Record<string, unknown> | null;
-      if (data === null || typeof data !== "object") {
-        return;
-      }
-      switch (data["type"]) {
-        case "rv-bridge-ready": {
-          reply(event, PANEL_CONTEXT, origin);
-          return;
-        }
-        case "rv-api": {
-          const id = data["id"];
-          const method = data["method"];
-          const path = data["path"];
-          const body = data["body"];
-          if (typeof id !== "string" || typeof method !== "string" || typeof path !== "string") {
-            return; // A malformed request has no id to answer under.
-          }
-          const result = await forwardGatewayRequest(
-            { id, method, path, body: typeof body === "string" ? body : null },
-            options.fetchFn,
-          );
-          reply(event, { type: "rv-api-result", id, ...result }, origin);
-          return;
-        }
-        case "rv-action": {
-          const action = data["action"];
-          const label = typeof action === "string" ? ACTION_LABELS[action] : undefined;
-          if (label !== undefined) {
-            options.statusBar.showLocal(label, "info");
-          }
-          return;
-        }
-        default:
-          return; // Unknown message kinds are dropped, never answered.
-      }
-    })();
-  };
-
-  win.addEventListener("message", onMessage);
-  return toDisposable(() => win.removeEventListener("message", onMessage));
-}
diff --git a/crates/workshop/ui/src/parts/gateway/gateway-config-panel.css b/crates/workshop/ui/src/parts/gateway/gateway-config-panel.css
deleted file mode 100644
index 243a30958..000000000
--- a/crates/workshop/ui/src/parts/gateway/gateway-config-panel.css
+++ /dev/null
@@ -1,17 +0,0 @@
-/* Styles for gateway-config-panel.ts, which imports this file; esbuild
-   bundles it into dist/app.css. The iframe fills the panel; the config
-   SPA inside brings its own chrome and theme. */
-
-.ws-gateway-config-panel {
-  position: relative;
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-}
-
-.ws-gateway-config-panel__frame {
-  flex: 1;
-  width: 100%;
-  border: 0;
-}
diff --git a/crates/workshop/ui/src/parts/gateway/gateway-config-panel.ts b/crates/workshop/ui/src/parts/gateway/gateway-config-panel.ts
deleted file mode 100644
index 949ab8599..000000000
--- a/crates/workshop/ui/src/parts/gateway/gateway-config-panel.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-// The Gateway Config panel: a Dockview panel embedding the gateway's
-// config SPA in an iframe at /gateway/config/?mode=panel, proxied
-// same-origin through the workshop server. The panel holds the iframe; all
-// traffic between the iframe and the workshop flows through the
-// window-level bridge in gateway-config-bridge.ts. The workshop's own
-// origin is passed in the iframe URL's `bridge` parameter, so the
-// iframe can pin its postMessage targetOrigin to the real parent
-// instead of "*".
-
-import "./gateway-config-panel.css";
-
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-
-/** Injectable seams for tests. */
-export interface GatewayConfigPanelDeps {
-  /** The workshop's own origin; window.location.origin in production. */
-  readonly workshopOrigin?: string;
-}
-
-export class GatewayConfigPanel extends WorkshopPart {
-  constructor(private readonly deps: GatewayConfigPanelDeps = {}) {
-    super();
-    this.element.className = "ws-gateway-config-panel";
-  }
-
-  protected create(parent: HTMLElement): void {
-    const iframe = document.createElement("iframe");
-    iframe.className = "ws-gateway-config-panel__frame";
-    iframe.title = "Gateway Config";
-    // The config SPA is proxied through the workshop server at
-    // /gateway/config/ so the iframe is same-origin (a cross-origin
-    // iframe to the gateway's port made Chromium spawn renderer
-    // processes that flashed a console window on Windows). allow-scripts
-    // runs the SPA; allow-same-origin keeps it on the workshop origin.
-    iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
-    const workshopOrigin = this.deps.workshopOrigin ?? window.location.origin;
-    iframe.src = `/gateway/config/?mode=panel&bridge=${encodeURIComponent(workshopOrigin)}`;
-    parent.replaceChildren(iframe);
-  }
-}
diff --git a/crates/workshop/ui/src/parts/gateway/gateway.contribution.ts b/crates/workshop/ui/src/parts/gateway/gateway.contribution.ts
deleted file mode 100644
index 332c60666..000000000
--- a/crates/workshop/ui/src/parts/gateway/gateway.contribution.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-// The gateway contribution: the eager module registering the Settings
-// row at module scope, before any service exists.
-// Settings is the workshop's one settings surface - the Gateway Config
-// panel - so the row lives at File > Preferences > Settings with the
-// ctrlcmd+, chord (Cmd+, on macOS), where Cursor keeps its settings
-// rows. The run body opens the config panel through the zone registry;
-// the panel's chunk loads lazily through the panel registry, and a
-// second activation focuses the existing panel because the config panel
-// is a singleton. The config panel's type registers here too.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { registerPanelType } from "@workshop/platform/panel-registry";
-import { openInZone } from "../layout/zones";
-
-registerPanelType({
-  type: "config",
-  title: "Gateway Config",
-  defaultZone: "main",
-  load: () => import("./index"),
-});
-
-/** The Preferences flyout's id; the menubar contribution declares the submenu. */
-const PREFERENCES_MENU: MenuId = "menubar/file/preferences";
-
-const action: ActionDescriptor = {
-  id: "workbench.action.openSettings",
-  title: "Settings",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+," },
-  menu: [{ id: PREFERENCES_MENU, group: "1_settings", order: 2 }],
-  run: () => {
-    openInZone("config", {});
-  },
-};
-const result: Result<IDisposable, ParseError> = registerAction(action);
-if (!result.ok) {
-  console.error(`gateway action '${action.id}': ${result.error.message}`);
-}
diff --git a/crates/workshop/ui/src/parts/gateway/index.ts b/crates/workshop/ui/src/parts/gateway/index.ts
deleted file mode 100644
index 7f78c2d74..000000000
--- a/crates/workshop/ui/src/parts/gateway/index.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-// The gateway feature's entry point: register() is the panel registry's
-// activation hook. Importers point at the source files directly; this
-// module re-exports nothing.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerPanelFactory } from "@workshop/platform/panel-registry";
-import { GatewayConfigPanel } from "./gateway-config-panel";
-
-/**
- * The gateway directory's activation: installs the Gateway Config panel
- * factory. Called once by the panel registry when the directory's chunk
- * first loads; the returned disposable is held for the page lifetime.
- */
-export function register(): IDisposable {
-  return registerPanelFactory("config", () => new GatewayConfigPanel());
-}
diff --git a/crates/workshop/ui/src/parts/layout/dock-theme.ts b/crates/workshop/ui/src/parts/layout/dock-theme.ts
deleted file mode 100644
index 4180895ec..000000000
--- a/crates/workshop/ui/src/parts/layout/dock-theme.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-// The dock's Dockview theme: the dark theme with the thin insertion line
-// Cursor draws when a tab is dragged between tabs, in place of the filled
-// half-tab highlight. The palette itself is the stylesheet's (zones.css
-// overrides the theme's variables); only the options that live in the theme
-// object, not the CSS, are set here. Tied to dockview 8.3.1's theme shape.
-
-import { themeDark, type DockviewTheme } from "dockview";
-
-export const dockTheme: DockviewTheme = { ...themeDark, dndTabIndicator: "line" };
diff --git a/crates/workshop/ui/src/parts/layout/drop-position.ts b/crates/workshop/ui/src/parts/layout/drop-position.ts
deleted file mode 100644
index e6556fc39..000000000
--- a/crates/workshop/ui/src/parts/layout/drop-position.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-// The dock's drop-position resolver: where a dragged tab docks over a
-// group or the whole layout, the way Cursor's workbench cuts a drop target.
-// The target is cut in thirds - left, right, top, or bottom when the pointer
-// is in that third alone, the center when it is in the middle ninth. A corner
-// cell, where two thirds claim the pointer, goes to the nearer edge, measured
-// against the target's own size so a wide target is not biased toward its
-// long sides.
-//
-// A pointer within 10% of an edge docks against that edge, but that needs no
-// rule of its own: such a pointer is inside that edge's third and nearer it
-// than any other edge, so the thirds already answer with that edge. A band
-// branch ahead of the thirds could never change an answer. What a band could
-// add is Dockview's `edge` marker (a whole-layout dock), which this resolver
-// leaves unused because Dockview draws no overlay for an edge cell and leaves
-// the commit to the consumer.
-//
-// A target accepts only some positions (a tab strip takes just the center),
-// so a position it refuses falls back to the center, and a target that takes
-// nothing answers null: no drop. main.ts passes the resolver to Dockview's
-// `dropPositionResolver` option, which reads it live for every group and for
-// the whole-layout edges.
-
-import type { Position, PositionResolver, PositionResolverArgs, PositionResolverResult } from "dockview";
-
-/** The point where the left third ends and the middle third begins. */
-const THIRD = 1 / 3;
-
-/** What the resolver reads of Dockview's arguments; the pointer's own event is not needed. */
-type DropPoint = Pick<PositionResolverArgs, "x" | "y" | "width" | "height" | "zones">;
-
-/** The four edges, with the pointer's distance to each as a fraction of that axis. */
-interface EdgeDistances {
-  readonly left: number;
-  readonly right: number;
-  readonly top: number;
-  readonly bottom: number;
-}
-
-/** The nearest of two edges on one axis, with its distance. */
-function nearer(first: [Position, number], second: [Position, number]): [Position, number] {
-  return first[1] <= second[1] ? first : second;
-}
-
-/** The edge that claims the pointer: the one whose third it is in, else the center. */
-function edgeFor(distance: EdgeDistances): Position {
-  const horizontal = nearer(["left", distance.left], ["right", distance.right]);
-  const vertical = nearer(["top", distance.top], ["bottom", distance.bottom]);
-
-  // An edge's third is the part of the target within a third of it. Two thirds
-  // overlap at a corner, where the nearer edge wins.
-  const inHorizontalThird = horizontal[1] < THIRD;
-  const inVerticalThird = vertical[1] < THIRD;
-  if (inHorizontalThird && inVerticalThird) {
-    return nearer(horizontal, vertical)[0];
-  }
-  if (inHorizontalThird) {
-    return horizontal[0];
-  }
-  if (inVerticalThird) {
-    return vertical[0];
-  }
-  return "center";
-}
-
-/**
- * Resolves a pointer location within a drop target to the position it docks
- * at, or null when the target accepts no drop.
- */
-export function resolveDropPosition(point: DropPoint): PositionResolverResult | null {
-  const { x, y, width, height, zones } = point;
-  const accept = (position: Position): PositionResolverResult | null => {
-    if (zones.has(position)) {
-      return { position };
-    }
-    return zones.has("center") ? { position: "center" } : null;
-  };
-  if (!(width > 0) || !(height > 0)) {
-    return accept("center");
-  }
-  const fractionX = Math.min(Math.max(x / width, 0), 1);
-  const fractionY = Math.min(Math.max(y / height, 0), 1);
-  return accept(
-    edgeFor({
-      left: fractionX,
-      right: 1 - fractionX,
-      top: fractionY,
-      bottom: 1 - fractionY,
-    }),
-  );
-}
-
-/** The resolver main.ts hands Dockview. */
-export const dropPositionResolver: PositionResolver = {
-  resolve: (args) => resolveDropPosition(args),
-};
diff --git a/crates/workshop/ui/src/parts/layout/keybinding-dispatcher.ts b/crates/workshop/ui/src/parts/layout/keybinding-dispatcher.ts
deleted file mode 100644
index ac5c44ec7..000000000
--- a/crates/workshop/ui/src/parts/layout/keybinding-dispatcher.ts
+++ /dev/null
@@ -1,228 +0,0 @@
-// The keybinding dispatcher: the single document-level listener that
-// turns keydown events into command dispatches. It listens in the
-// capture phase because CodeMirror's keymap runs on its content element
-// and a bubbling listener would fire after it (Alt+Up would move the
-// line twice); on a handled result it preventDefaults and
-// stopPropagations, so a chord claimed by any rule is swallowed even
-// when its `when` fails - Ctrl+F with no editor focused never reaches
-// CodeMirror's panel and Ctrl+S never reaches the webview default.
-// Unbound keys fall through untouched, so CodeMirror's defaultKeymap
-// and searchKeymap keep every binding the registry does not claim.
-//
-// Multi-key chords: a press that is a strict prefix of some rule sets
-// the chordPending context key, posts the waiting status, and arms a
-// five-second timer; the next press either completes the chord (the
-// command runs), mismatches (the not-a-command status shows for three
-// seconds), or never comes (the timer or a window blur abandons the
-// chord). A rejected command is caught and never thrown out of the
-// listener: the registry has already reported it (the toast's source), so
-// the dispatcher only logs the error object.
-//
-// The composition root constructs one dispatcher at boot; tests inject
-// their own registries and a recording status sink.
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import { CONTEXT_KEY_SERVICE, type ContextKey, type ContextKeyService } from "@workshop/platform/context-key-service";
-import { chordFromKeyboardEvent, formatChord, formatKeybinding, type Chord } from "@workshop/platform/keybinding-parser";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { getService, getServiceOrNull } from "@workshop/platform/service-registry";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-
-/** How long a chord prefix waits for its second key. */
-const CHORD_TIMEOUT_MS = 5000;
-
-/** How long the not-a-command status stays on the bar. */
-const TRANSIENT_STATUS_MS = 3000;
-
-/**
- * Where the dispatcher's transient messages go. The default sink paints
- * onto the status bar; tests inject a recording sink.
- */
-export interface KeybindingStatusSink {
-  /** Shows an informational message (the chord prompts). */
-  show(message: string): void;
-  /** Clears a message whose lifetime ended, back to the empty idle text. */
-  clear(): void;
-}
-
-/** Registry and service overrides; tests inject their own instances. */
-export interface KeybindingDispatcherDependencies {
-  readonly commands?: CommandRegistry;
-  readonly contextKeys?: ContextKeyService;
-  readonly keybindings?: KeybindingsRegistry;
-  readonly status?: KeybindingStatusSink;
-}
-
-/**
- * The status-bar-backed sink. Local messages go through showLocal, which the
- * next observer frame overwrites; clear sets the bar's idle text, which is
- * empty - Cursor's status bar shows nothing when idle. With no composition
- * root (a widget test) the prompts go to the console.
- */
-function createStatusBarSink(): KeybindingStatusSink {
-  return {
-    show(message: string): void {
-      const statusBar = getServiceOrNull(STATUS_BAR);
-      if (statusBar === null) {
-        console.info(message);
-        return;
-      }
-      statusBar.showLocal(message, "info");
-    },
-    clear(): void {
-      getServiceOrNull(STATUS_BAR)?.showLocal("", "info");
-    },
-  };
-}
-
-/** Consumes the event: no browser default, no further listeners. */
-function swallow(event: KeyboardEvent): void {
-  event.preventDefault();
-  event.stopPropagation();
-}
-
-/**
- * The capture-phase keydown listener. Resolves the chords pressed so
- * far through a fresh resolver snapshot (rules register as feature
- * chunks load), dispatches KbFound through the command registry, and
- * owns the chord state: pending chords, the waiting and not-a-command
- * statuses, the five-second timer, and the window-blur exit.
- */
-export class KeybindingDispatcher extends Disposable {
-  private readonly commands: CommandRegistry;
-  private readonly contextKeys: ContextKeyService;
-  private readonly keybindings: KeybindingsRegistry;
-  private readonly status: KeybindingStatusSink;
-  private readonly chordPendingKey: ContextKey<boolean>;
-  private pending: Chord[] = [];
-  private chordTimer: ReturnType<typeof setTimeout> | null = null;
-  private statusTimer: ReturnType<typeof setTimeout> | null = null;
-  private statusActive = false;
-
-  constructor(deps: KeybindingDispatcherDependencies = {}) {
-    super();
-    this.commands = deps.commands ?? Commands;
-    this.contextKeys = deps.contextKeys ?? getService(CONTEXT_KEY_SERVICE);
-    this.keybindings = deps.keybindings ?? KeybindingsRegistry;
-    this.status = deps.status ?? createStatusBarSink();
-    this.chordPendingKey = this.contextKeys.createKey("chordPending", false);
-    const onKeydown = (event: KeyboardEvent): void => this.onKeydown(event);
-    document.addEventListener("keydown", onKeydown, true);
-    this._register(toDisposable(() => document.removeEventListener("keydown", onKeydown, true)));
-    const onBlur = (): void => this.clearPending();
-    window.addEventListener("blur", onBlur);
-    this._register(toDisposable(() => window.removeEventListener("blur", onBlur)));
-    this._register(
-      toDisposable(() => {
-        this.clearChordTimer();
-        this.clearStatusTimer();
-      }),
-    );
-  }
-
-  private onKeydown(event: KeyboardEvent): void {
-    const chord = chordFromKeyboardEvent(event);
-    if (chord === undefined) {
-      // A modifier-only press or an unmapped code is not a chord.
-      return;
-    }
-    const pressed = [...this.pending, chord];
-    const resolver = this.keybindings.getResolver();
-    const result = resolver.resolve(this.contextKeys, pressed);
-    if (result.kind === "KbFound") {
-      swallow(event);
-      this.clearPending();
-      const commandId = result.commandId;
-      void this.commands.execute(commandId).catch((error: unknown) => {
-        // The registry has already reported the failure; keep the detail.
-        logCommandFailure(commandId, error);
-      });
-      return;
-    }
-    if (result.kind === "MoreChordsNeeded") {
-      swallow(event);
-      this.pending = pressed;
-      this.chordPendingKey.set(true);
-      this.showStatus(`(${formatKeybinding(pressed)}) was pressed. Waiting for second key of chord...`);
-      this.armChordTimer();
-      return;
-    }
-    if (this.pending.length > 0) {
-      // The pending prefix plus this key match nothing: abandon the
-      // chord, say so for three seconds, and swallow the stray key.
-      const rejected = pressed;
-      this.pending = [];
-      this.chordPendingKey.set(false);
-      this.clearChordTimer();
-      this.clearStatusTimer();
-      swallow(event);
-      this.showStatus(`The key combination (${rejected.map((entry) => formatChord(entry)).join(", ")}) is not a command.`);
-      this.armStatusTimer();
-      return;
-    }
-    if (resolver.hasRuleForChord(chord)) {
-      // Claimed by a rule whose when fails: swallow so the chord never
-      // reaches CodeMirror or the webview default.
-      swallow(event);
-    }
-  }
-
-  /** Shows a dispatcher message, replacing any still on the bar. */
-  private showStatus(message: string): void {
-    this.clearStatusTimer();
-    this.status.show(message);
-    this.statusActive = true;
-  }
-
-  /** Clears the bar only when the dispatcher's message is still up. */
-  private clearStatus(): void {
-    this.clearStatusTimer();
-    if (!this.statusActive) {
-      return;
-    }
-    this.statusActive = false;
-    this.status.clear();
-  }
-
-  /** Abandons the pending chord: state, context key, timer, status. */
-  private clearPending(): void {
-    this.clearChordTimer();
-    if (this.pending.length === 0) {
-      return;
-    }
-    this.pending = [];
-    this.chordPendingKey.set(false);
-    this.clearStatus();
-  }
-
-  private armChordTimer(): void {
-    this.clearChordTimer();
-    this.chordTimer = setTimeout(() => {
-      this.chordTimer = null;
-      this.clearPending();
-    }, CHORD_TIMEOUT_MS);
-  }
-
-  private clearChordTimer(): void {
-    if (this.chordTimer !== null) {
-      clearTimeout(this.chordTimer);
-      this.chordTimer = null;
-    }
-  }
-
-  private armStatusTimer(): void {
-    this.clearStatusTimer();
-    this.statusTimer = setTimeout(() => {
-      this.statusTimer = null;
-      this.clearStatus();
-    }, TRANSIENT_STATUS_MS);
-  }
-
-  private clearStatusTimer(): void {
-    if (this.statusTimer !== null) {
-      clearTimeout(this.statusTimer);
-      this.statusTimer = null;
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/layout/layout-boot.ts b/crates/workshop/ui/src/parts/layout/layout-boot.ts
deleted file mode 100644
index 0a2150816..000000000
--- a/crates/workshop/ui/src/parts/layout/layout-boot.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-// The layout boot decision, shared by the composition root (the preloaded
-// workspace value at page load) and the Open Workspace action (the value
-// re-read from the newly opened file): restore the stored envelope, or
-// seed the default layout, then make sure the anchor panels are present
-// either way. The default layout and its anchors are product policy,
-// resolved from LAYOUT_POLICY; this module names no panel type.
-
-import type { DockviewApi } from "dockview";
-
-import { getService } from "@workshop/platform/service-registry";
-import { LAYOUT_POLICY } from "../../services/layout-policy";
-import { restoreLayout } from "./layout-persistence";
-import { ensureZoneGroup, openInZone, resetZones } from "./zones";
-
-/**
- * Applies `envelope` to the dock, falling back to the registered policy's
- * default layout when there is nothing valid to restore. Panels
- * re-create through their registered factories - only identity is
- * stored.
- *
- * The fallback starts from a blank dock. At boot the dock is already
- * empty; on Open Workspace it holds the previous workspace's panels, and
- * a file with no stored layout must still replace them with the default,
- * so boot and Open share one behavior.
- *
- * The workbench never boots without the policy's anchors: a restored
- * layout that lost one (a stale snapshot, or an anchor closed away before
- * the save) gets it back. Anchors are singletons, so re-opening an
- * existing one only focuses it. The policy's empty zones get the same
- * guarantee: a zone with no live group gets an empty one, so the editor
- * area exists whether the layout was seeded or restored.
- */
-export function applyLayoutOrDefault(dock: DockviewApi, envelope: unknown): void {
-  const policy = getService(LAYOUT_POLICY);
-  if (!restoreLayout(dock, envelope)) {
-    resetZones();
-    dock.clear();
-    policy.seed();
-  }
-  for (const anchor of policy.anchors) {
-    openInZone(anchor, {});
-  }
-  for (const zone of policy.emptyZones ?? []) {
-    ensureZoneGroup(zone);
-  }
-}
diff --git a/crates/workshop/ui/src/parts/layout/layout-persistence.ts b/crates/workshop/ui/src/parts/layout/layout-persistence.ts
deleted file mode 100644
index fc2f69b16..000000000
--- a/crates/workshop/ui/src/parts/layout/layout-persistence.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-// Layout persistence: the dock's serialized layout plus the zone
-// registry's placement memory, stored as one versioned envelope under
-// the workspace bucket's "layout" key (the open .rvwork file, through the
-// UI-state adapter). This module never touches storage itself: the
-// composition root hands restoreLayout the preloaded value and
-// startLayoutPersistence a writer, so the same code serves boot, the
-// debounced live saves, and the Open and Save As paths that apply or
-// write a workspace's layout. Writes are debounced off onDidLayoutChange;
-// the change a mid-session fromJSON produces is dropped, not written.
-// Only identity is stored - panels re-create through their registered
-// factories on load. A restore that fails for any reason (a value that is
-// not an envelope, another schema version, a fromJSON throw) clears the
-// dock and reports failure so the caller boots the known-good default
-// layout.
-
-import type { DockviewApi, SerializedDockview } from "dockview";
-
-import { DisposableStore, toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import { resetZones, restoreZoneState, serializeZoneState, withZoneRestore } from "./zones";
-
-// A snapshot of any other version falls back to the default layout.
-export const LAYOUT_SCHEMA_VERSION = 5;
-
-const SAVE_DEBOUNCE_MS = 250;
-
-/**
- * The stored envelope: the dock layout plus the zone registry's fields.
- * `zones` and `overrides` stay opaque here; the zone registry validates
- * them on restore.
- */
-export interface PersistedLayout {
-  readonly version: typeof LAYOUT_SCHEMA_VERSION;
-  readonly zones: unknown;
-  readonly overrides: unknown;
-  readonly layout: SerializedDockview;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/**
- * Structural check only: fromJSON performs the deep validation, inside
- * the caller's try/catch, so a corrupt layout can never half-load.
- */
-function isSerializedLayout(value: unknown): value is SerializedDockview {
-  return isRecord(value) && isRecord(value.grid);
-}
-
-/** Validates a stored value as the envelope; null means fall back. */
-function parsePersisted(value: unknown): PersistedLayout | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  if (value.version !== LAYOUT_SCHEMA_VERSION) {
-    return null;
-  }
-  if (!isSerializedLayout(value.layout)) {
-    return null;
-  }
-  return {
-    version: LAYOUT_SCHEMA_VERSION,
-    zones: value.zones,
-    overrides: value.overrides,
-    layout: value.layout,
-  };
-}
-
-/**
- * Snapshots the live layout as the envelope the workspace bucket stores:
- * the debounced saver writes it, and Save As writes it once so the new
- * file gets the current arrangement.
- */
-export function buildLayoutEnvelope(dock: DockviewApi): PersistedLayout {
-  const state = serializeZoneState();
-  return {
-    version: LAYOUT_SCHEMA_VERSION,
-    zones: state.zones,
-    overrides: state.overrides,
-    layout: dock.toJSON(),
-  };
-}
-
-/**
- * Restores a stored envelope into the dock: panels re-create through
- * their registered factories, and the zone map and overrides come back
- * with them. Returns false when there is nothing to restore (null, or a
- * value that is not a current-version envelope) or anything fails - the
- * caller then builds the default layout onto a clean dock.
- */
-export function restoreLayout(dock: DockviewApi, envelope: unknown): boolean {
-  const persisted = parsePersisted(envelope);
-  if (persisted === null) {
-    return false;
-  }
-  try {
-    // fromJSON tears every live group down before rebuilding; those
-    // removals are a restore, not closes, so resurrection stays off.
-    withZoneRestore(() => dock.fromJSON(persisted.layout));
-  } catch (error: unknown) {
-    console.error("layout persistence: restore failed, falling back to defaults:", error);
-    resetZones();
-    try {
-      dock.clear();
-    } catch {
-      // Dockview already cleaned up after the failed fromJSON.
-    }
-    return false;
-  }
-  restoreZoneState(persisted.zones, persisted.overrides);
-  return true;
-}
-
-/**
- * Starts persistence for the running session: layout changes save
- * debounced through `write`, which receives the fresh envelope. A throw
- * from the snapshot or the writer is logged, never propagated - the
- * in-memory layout stands and the next change tries again. Call once,
- * after the boot layout (restored or default) is in place. Returns the
- * disposable that stops persisting.
- *
- * A mid-session `fromJSON` (Open Workspace applying the opened file's
- * layout) is not a change to save: the values came from the file, and
- * writing them back would echo them into it. Dockview delivers the
- * resulting onDidLayoutChange on a microtask (AsapEvent in dockview-core),
- * after any synchronous write suppression around the apply has lifted,
- * so the saver drops that echo itself rather than relying on the caller.
- */
-export function startLayoutPersistence(
-  dock: DockviewApi,
-  write: (envelope: PersistedLayout) => void,
-): IDisposable {
-  let timer: ReturnType<typeof setTimeout> | null = null;
-  // Set while a restore's own layout-change event is in flight.
-  let restoring = false;
-  const store = new DisposableStore();
-  const cancel = (): void => {
-    if (timer !== null) {
-      clearTimeout(timer);
-      timer = null;
-    }
-  };
-  // fromJSON fires onDidLayoutFromJSON synchronously at its end, after the
-  // panel removes and adds inside it have queued Dockview's one coalesced
-  // onDidLayoutChange microtask. Cancel any save armed by an earlier change
-  // (its snapshot would now be the restored layout) and drop the restore's
-  // own event, which runs before the microtask queued here. The flag clears
-  // there as well, so a restore that produced no event cannot swallow the
-  // next real change.
-  store.add(
-    dock.onDidLayoutFromJSON(() => {
-      cancel();
-      restoring = true;
-      queueMicrotask(() => {
-        restoring = false;
-      });
-    }),
-  );
-  store.add(
-    dock.onDidLayoutChange(() => {
-      if (restoring) {
-        restoring = false;
-        return;
-      }
-      cancel();
-      timer = setTimeout(() => {
-        timer = null;
-        try {
-          write(buildLayoutEnvelope(dock));
-        } catch (error: unknown) {
-          console.error("layout persistence: save failed:", error);
-        }
-      }, SAVE_DEBOUNCE_MS);
-    }),
-  );
-  // Teardown order matters: the subscriptions die first so no layout
-  // change can re-arm the timer between the two steps; then any armed
-  // save is canceled unsaved.
-  store.add(toDisposable(cancel));
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/layout/layout.contribution.ts b/crates/workshop/ui/src/parts/layout/layout.contribution.ts
deleted file mode 100644
index 156b1c118..000000000
--- a/crates/workshop/ui/src/parts/layout/layout.contribution.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-// The layout contribution: the module loaded eagerly to register the
-// Secondary Side Bar catalog row at module scope, before any service
-// exists. Layout is a light feature - main.ts already loads zones
-// eagerly - so the run body is a direct call.
-//
-// Secondary Side Bar hides and shows the right zone's dockview group
-// through group.api.setVisible, so its panels and their live connections
-// survive - nothing is removed - and mirrors the outcome into
-// auxiliaryBarVisible. The key binds with a visible-by-default value on
-// first toggle; the workspace directory's register() binds it at chunk
-// load so the Appearance checkbox reads true from first paint.
-//
-// Close and Close Others run the layout core's close path in
-// panel-close.ts over every panel type, so Close keeps the bare
-// activeEditor precondition. Both take an optional { panelId } argument
-// naming the panel to act on, else the active one; the generic tab menu
-// passes the clicked tab's. Its Close row is appended directly so it
-// reads Close, not the command's Close Editor.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { LAYOUT_POLICY } from "../../services/layout-policy";
-import { KeybindingWeight } from "@workshop/platform/keybinding-registry";
-import { MenuId, Menus } from "@workshop/platform/menu-registry";
-import { panelTypeEntry } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { closeActiveEditor, closeOtherEditors } from "./panel-close";
-import { openInZone, toggleZoneVisibility } from "./zones";
-
-/** The Appearance flyout's id; the menubar contribution declares the submenu. */
-const APPEARANCE_MENU: MenuId = "menubar/view/appearance";
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`layout action '${action.id}': ${result.error.message}`);
-  }
-}
-
-/** Mirrors a visibility outcome into its context key (default visible). */
-function setVisibilityKey(name: string, visible: boolean): void {
-  getService(CONTEXT_KEY_SERVICE).createKey(name, true).set(visible);
-}
-
-addAction({
-  id: "workbench.action.toggleAuxiliaryBar",
-  title: "Secondary Side Bar",
-  f1: true,
-  toggled: "auxiliaryBarVisible",
-  keybinding: { keybinding: "ctrlcmd+alt+b" },
-  menu: [{ id: APPEARANCE_MENU, group: "2_workbench_layout", order: 3 }],
-  run: () => {
-    // A hidden group stays live, so the toggle always finds it, and it
-    // writes the auxiliaryBarVisible key itself; a zone whose group was
-    // never built opens the layout policy's right-zone anchors instead.
-    if (toggleZoneVisibility("right") !== undefined) {
-      return;
-    }
-    for (const anchor of getService(LAYOUT_POLICY).anchors) {
-      if (panelTypeEntry(anchor)?.defaultZone === "right") {
-        openInZone(anchor, {});
-      }
-    }
-    setVisibilityKey("auxiliaryBarVisible", true);
-  },
-});
-
-addAction({
-  id: "workbench.action.closeActiveEditor",
-  title: "Close Editor",
-  f1: true,
-  precondition: "activeEditor",
-  keybinding: { keybinding: "ctrlcmd+f4", when: "editorTextFocus", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "6_close", order: 2 }],
-  run: async (arg?: unknown) => {
-    await closeActiveEditor(arg);
-  },
-});
-Menus.appendMenuItem(MenuId.EditorTitleContext, {
-  command: "workbench.action.closeActiveEditor",
-  title: "Close",
-  group: "1_close",
-  order: 1,
-});
-
-addAction({
-  id: "workbench.action.closeOtherEditors",
-  title: "Close Others",
-  menu: [{ id: MenuId.EditorTitleContext, group: "1_close", order: 2 }],
-  run: (arg?: unknown) => closeOtherEditors(arg),
-});
diff --git a/crates/workshop/ui/src/parts/layout/panel-close.ts b/crates/workshop/ui/src/parts/layout/panel-close.ts
deleted file mode 100644
index 492fc1990..000000000
--- a/crates/workshop/ui/src/parts/layout/panel-close.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-// The layout core's close path: Close and Close Others over any dock
-// panel, each part confirming through confirmClose() and answering
-// isDirty() for the unsaved checks. The generic tab's X and Delete call
-// it directly; layout.contribution.ts registers the two commands over it.
-// It resolves the dock through the service registry (the DOCK token,
-// registered by initZones) instead of capturing it.
-//
-// Imports only @workshop/platform and type-only dockview: lazy panels
-// import panel-tab.ts for setTabLoading, and panel-tab.ts imports this
-// module, so a contribution, the parts/menu barrel or a feature module
-// here would pull the entry bundle into every lazy chunk.
-
-import type { IDockviewPanel } from "dockview";
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { DOCK, panelTypeEntry, resolvePanelContent } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-
-// The panels this module closed, announced after each one is gone, so a
-// feature can follow its own panels' closes (the agent contribution hides
-// the chat pane when its last chat tab closes) without the close path
-// naming any panel type. A close that does not go through this path - a
-// layout restore, a workspace switch - announces nothing.
-const closedEmitter = new Emitter<IDockviewPanel>();
-
-/** Fires with each panel the close path closed, after it left the dock. */
-export const onDidClosePanel: Event<IDockviewPanel> = closedEmitter.event;
-
-/**
- * The panel a close command acts on: the one a `{ panelId }` argument
- * names, else the active panel. An argument naming no open panel targets
- * nothing.
- */
-function closeTarget(arg: unknown): IDockviewPanel | undefined {
-  const dock = getService(DOCK);
-  if (typeof arg === "object" && arg !== null && "panelId" in arg) {
-    return typeof arg.panelId === "string" ? dock.getPanel(arg.panelId) : undefined;
-  }
-  return dock.activePanel;
-}
-
-/** False for a panel whose type registered `closable: false`. */
-function isClosable(panel: IDockviewPanel): boolean {
-  return panelTypeEntry(panel.api.component)?.closable !== false;
-}
-
-/**
- * Whether the panel is still in the dock. A confirmation can outlive it,
- * and Dockview removes by id: closing a panel that already left throws,
- * or removes one reopened under its id.
- */
-function isInDock(panel: IDockviewPanel): boolean {
-  return getService(DOCK).getPanel(panel.id) === panel;
-}
-
-/** Whether the panel's part holds unsaved changes. */
-function isUnsaved(panel: IDockviewPanel): boolean {
-  // view.content may be the lazy wrapper while the chunk loads; unwrap
-  // to the real part before the instanceof check.
-  const content = resolvePanelContent(panel.view.content);
-  return content instanceof WorkshopPart && content.isDirty();
-}
-
-/**
- * The panel part's confirmClose() answer. An unsaved part is activated
- * first: its prompt renders inside the panel, and Save As saves the
- * active panel. Content that is not a WorkshopPart needs no confirmation.
- */
-function confirmPanelClose(panel: IDockviewPanel): Promise<boolean> {
-  const content = resolvePanelContent(panel.view.content);
-  if (!(content instanceof WorkshopPart)) {
-    return Promise.resolve(true);
-  }
-  if (isUnsaved(panel)) {
-    panel.api.setActive();
-  }
-  return content.confirmClose();
-}
-
-/**
- * Close (Ctrl+F4): closes the `{ panelId }` argument's panel, else the
- * active one, once its part confirms. A non-closable panel is left alone.
- * Resolves true only when it closed the panel.
- */
-export async function closeActiveEditor(arg?: unknown): Promise<boolean> {
-  const panel = closeTarget(arg);
-  if (panel === undefined || !isClosable(panel)) {
-    return false;
-  }
-  if ((await confirmPanelClose(panel)) && isInDock(panel)) {
-    panel.api.close();
-    closedEmitter.fire(panel);
-    return true;
-  }
-  return false;
-}
-
-/**
- * Close Others: closes the other closable panels in the group of the
- * `{ panelId }` argument's panel, else the active one's. Every panel
- * confirms first, one at a time; the first refusal aborts the batch with
- * nothing closed, though saves and discards already made stand. A part
- * confirmed clean that gains unsaved changes while a later prompt is up
- * voids the batch too. Otherwise the whole batch closes, clean panels
- * included.
- */
-export async function closeOtherEditors(arg?: unknown): Promise<void> {
-  const target = closeTarget(arg);
-  if (target === undefined) {
-    return;
-  }
-  const batch = target.group.panels.filter((panel) => panel !== target && isClosable(panel));
-  const confirmedClean: IDockviewPanel[] = [];
-  for (const panel of batch) {
-    if (!isInDock(panel)) {
-      continue;
-    }
-    if (!(await confirmPanelClose(panel))) {
-      return;
-    }
-    if (!isUnsaved(panel)) {
-      confirmedClean.push(panel);
-    }
-  }
-  if (confirmedClean.some((panel) => isInDock(panel) && isUnsaved(panel))) {
-    return;
-  }
-  for (const panel of batch) {
-    if (isInDock(panel)) {
-      panel.api.close();
-      closedEmitter.fire(panel);
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/layout/panel-tab.ts b/crates/workshop/ui/src/parts/layout/panel-tab.ts
deleted file mode 100644
index 7bb061678..000000000
--- a/crates/workshop/ui/src/parts/layout/panel-tab.ts
+++ /dev/null
@@ -1,325 +0,0 @@
-// The one tab renderer every dock panel uses: the default chip's structure
-// (same classes, so the theme styles it identically) driven by the panel
-// type's registry entry. A closable type gets the close action, which calls
-// the layout core's close path (panel-close.ts) with the tab's { panelId }
-// so the part confirms first, and a right-click menu over
-// MenuId.EditorTitleContext at the pointer, whose rows run against the
-// clicked tab and read activeEditor as its type; a `closable: false` type
-// gets neither. Delete and Backspace on the focused tab make the same
-// call, then focus the neighbouring tab once the panel closes, and do
-// nothing on a `closable: false` type. A middle click on a closable tab
-// closes it the same way.
-//
-// A `renamable` type (the chat tabs) also renames in place: a double-click
-// swaps the title for a text field that commits on Enter or blur and
-// cancels on Escape. The name is the session's own (tab-names.ts); the
-// panel's title is untouched.
-//
-// The loading shimmer: while its panel is loading, the title span shimmers
-// through @workshop/look's setShimmer, whose shared phase keeps the sweep
-// continuous across the re-renders a tab title goes through and in step
-// with every other shimmering element. Header
-// tabs register themselves by panel id in the module map below on init
-// and remove themselves on dispose; a panel drives its shimmer through
-// setTabLoading without holding a reference to the tab. Dockview's
-// overflow list inits a second renderer per overflowed panel under the
-// same id and never disposes it, so only the "header" renderer holds the
-// panel's slot.
-//
-// The dirty dot: a panel with unsaved work calls setTabDirty, which marks the
-// tab (`ws-tab--dirty`) so the stylesheet draws a dot in the close button's
-// place until the tab is hovered. The mark lives on the tab, not in its
-// title, so renaming or restyling the title never has to know about it. A
-// tab that mounts after its panel went dirty picks the mark up at init. A tab
-// with no close button is marked too (`ws-tab--no-close`), which is what gives
-// it the right padding the missing button would have filled.
-
-import type { ITabRenderer, TabPartInitParameters } from "dockview";
-
-import { setShimmer } from "@workshop/look/shimmer";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { DOCK, panelTypeEntry } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-// The widget module, never the parts/menu barrel: the barrel imports the
-// contribution surface, and lazy panels import this module for
-// setTabLoading.
-import { Menu } from "../menu/menu";
-import { toastCommandFailure } from "../../services/command-failure-toasts";
-import { closeActiveEditor } from "./panel-close";
-import { onDidChangeTabName, setTabName, tabNameOf } from "./tab-names";
-
-/**
- * Closes one panel through the layout core, so its part confirms before it
- * goes. The call bypasses the command registry, so a failure raises the
- * command-failure toast by hand.
- */
-function closePanel(panelId: string): void {
-  void closeActiveEditor({ panelId }).catch((error: unknown) => {
-    toastCommandFailure("workbench.action.closeActiveEditor", error);
-  });
-}
-
-/**
- * Closes one panel as closePanel does, then keeps keyboard focus in its
- * tab strip, as dockview-core 8.3.1's Tabs._closeTab does for its own
- * Delete: the header tab of the panel now at the closed one's index, else
- * the one before it. A refused close, or a group left empty, moves nothing.
- */
-function closeAndRefocus(panelId: string): void {
-  const group = getService(DOCK).getPanel(panelId)?.group;
-  const index = group?.panels.findIndex((panel) => panel.id === panelId) ?? -1;
-  void closeActiveEditor({ panelId })
-    .then((closed) => {
-      if (!closed || group === undefined || index < 0) {
-        return;
-      }
-      const neighbour = group.panels[index] ?? group.panels[index - 1];
-      if (neighbour !== undefined) {
-        tabs.get(neighbour.id)?.element.parentElement?.focus();
-      }
-    })
-    .catch((error: unknown) => {
-      toastCommandFailure("workbench.action.closeActiveEditor", error);
-    });
-}
-
-/** The live tabs, by panel id. */
-const tabs = new Map<string, PanelTab>();
-// The desired shimmer state per panel id, so a tab that mounts after
-// its panel started loading still picks the shimmer up; entries die
-// with their tab.
-const loadingByPanel = new Map<string, boolean>();
-// The panels with unsaved work, by id, for the same reason: a tab that
-// mounts later reads it at init. Only dirty panels are held.
-const dirtyPanels = new Set<string>();
-
-/**
- * Drives one tab's shimmer. A panel calls this on every state
- * transition; a tab that has not mounted yet picks the state up at
- * init, and one already gone is a no-op.
- */
-export function setTabLoading(panelId: string, loading: boolean): void {
-  loadingByPanel.set(panelId, loading);
-  tabs.get(panelId)?.setLoading(loading);
-}
-
-/**
- * Marks one tab dirty or clean: a dot in place of its close button until
- * the tab is hovered. A panel calls this whenever its unsaved state
- * changes; a tab that has not mounted yet picks the state up at init, and
- * one already gone is a no-op.
- */
-export function setTabDirty(panelId: string, dirty: boolean): void {
-  if (dirty) {
-    dirtyPanels.add(panelId);
-  } else {
-    dirtyPanels.delete(panelId);
-  }
-  tabs.get(panelId)?.setDirty(dirty);
-}
-
-export class PanelTab extends Disposable implements ITabRenderer {
-  public readonly element = document.createElement("div");
-  private readonly content = document.createElement("div");
-  private menu: Menu | null = null;
-  private panelId: string | null = null;
-  private loading = false;
-  // The panel's own title, and the open inline editor while one is up.
-  private title = "";
-  private renameInput: HTMLInputElement | null = null;
-
-  constructor() {
-    super();
-    this.element.className = "dv-default-tab";
-    this.content.className = "dv-default-tab-content";
-    this.element.appendChild(this.content);
-  }
-
-  public init(parameters: TabPartInitParameters): void {
-    const { api } = parameters;
-    const entry = panelTypeEntry(api.component);
-    const closable = entry?.closable !== false;
-    if (parameters.tabLocation === "header") {
-      this.panelId = api.id;
-      tabs.set(api.id, this);
-      this.interceptCloseKeys(api.id, closable);
-    }
-    // The panel may have entered loading, or gone dirty, before the tab mounted.
-    this.loading = loadingByPanel.get(api.id) ?? false;
-    this.setDirty(dirtyPanels.has(api.id));
-    this.element.classList.toggle("ws-tab--no-close", !closable);
-    this.title = parameters.title;
-    this.renderTitle(api.id);
-    this._register(
-      api.onDidTitleChange((event) => {
-        this.title = event.title;
-        this.renderTitle(api.id);
-      }),
-    );
-    if (entry?.renamable === true) {
-      this._register(
-        onDidChangeTabName((changed) => {
-          if (changed === api.id) {
-            this.renderTitle(api.id);
-          }
-        }),
-      );
-      this.element.addEventListener("dblclick", (event) => {
-        event.preventDefault();
-        event.stopPropagation();
-        this.beginRename(api.id);
-      });
-    }
-    this.applyLoading();
-    if (!closable) {
-      return;
-    }
-    // A middle click closes the tab, as in every tabbed editor.
-    this.element.addEventListener("auxclick", (event) => {
-      if (event.button === 1) {
-        event.preventDefault();
-        event.stopPropagation();
-        closePanel(api.id);
-      }
-    });
-    const close = document.createElement("button");
-    close.type = "button";
-    close.className = "dv-default-tab-action";
-    close.setAttribute("aria-label", "Close");
-    close.textContent = "×";
-    close.tabIndex = -1;
-    // Dockview's tab wrapper activates the panel and its group on
-    // pointerdown unless the event is default-prevented, as its own
-    // DefaultTab action does.
-    close.addEventListener("pointerdown", (event) => {
-      event.preventDefault();
-    });
-    close.addEventListener("click", (event) => {
-      event.stopPropagation();
-      closePanel(api.id);
-    });
-    this.element.appendChild(close);
-    this.element.addEventListener("contextmenu", (event) => {
-      event.preventDefault();
-      event.stopPropagation();
-      this.menu ??= this._register(new Menu());
-      this.menu.open(
-        MenuId.EditorTitleContext,
-        { x: event.clientX, y: event.clientY },
-        { panelId: api.id },
-        { activeEditor: api.component },
-      );
-    });
-  }
-
-  /**
-   * Takes Delete and Backspace on the focused tab away from Dockview.
-   * dockview-core 8.3.1's tab strip (Tabs._onKeyDown in
-   * dist/package/main.esm.mjs) closes the focused tab on either key
-   * through panel.api.close(), without checking `closable` and without
-   * the part's confirmClose. The focused element is the Dockview wrapper
-   * this renderer is appended into, which Dockview replaces when the
-   * panel moves groups and never hands to the renderer, so the keys are
-   * caught in the document's capture phase and only while that wrapper
-   * is the target, and call the layout core's close path directly. A
-   * close that goes through moves focus to the neighbouring tab, as
-   * Dockview's own handler does, so the next key stays in the strip.
-   */
-  private interceptCloseKeys(panelId: string, closable: boolean): void {
-    const onKeydown = (event: KeyboardEvent): void => {
-      const wrapper = this.element.parentElement;
-      if ((event.key !== "Delete" && event.key !== "Backspace") || wrapper === null || event.target !== wrapper) {
-        return;
-      }
-      event.preventDefault();
-      event.stopPropagation();
-      if (closable) {
-        closeAndRefocus(panelId);
-      }
-    };
-    document.addEventListener("keydown", onKeydown, true);
-    this._register(toDisposable(() => document.removeEventListener("keydown", onKeydown, true)));
-  }
-
-  /** Paints the tab's text: the operator's name when it has one, else the panel's title. */
-  private renderTitle(panelId: string): void {
-    if (this.renameInput !== null) {
-      return;
-    }
-    this.content.textContent = tabNameOf(panelId) ?? this.title;
-  }
-
-  /**
-   * Swaps the title for a text field. Enter or leaving the field commits
-   * (a blank name clears the rename), Escape cancels. The field keeps its
-   * pointer, key, and drag events from Dockview, whose tab would
-   * otherwise start a drag or close the panel under the typing.
-   */
-  private beginRename(panelId: string): void {
-    if (this.renameInput !== null) {
-      return;
-    }
-    const input = document.createElement("input");
-    input.type = "text";
-    input.className = "ws-tab-rename";
-    input.value = tabNameOf(panelId) ?? this.title;
-    input.setAttribute("aria-label", "Chat name");
-    input.spellcheck = false;
-    this.renameInput = input;
-    this.content.replaceChildren(input);
-    let finished = false;
-    const finish = (commit: boolean): void => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      this.renameInput = null;
-      if (commit) {
-        setTabName(panelId, input.value);
-      }
-      this.renderTitle(panelId);
-    };
-    for (const type of ["pointerdown", "mousedown", "click", "dblclick", "dragstart", "keyup"]) {
-      input.addEventListener(type, (event) => event.stopPropagation());
-    }
-    input.setAttribute("draggable", "false");
-    input.addEventListener("keydown", (event) => {
-      event.stopPropagation();
-      if (event.key === "Enter") {
-        event.preventDefault();
-        finish(true);
-      } else if (event.key === "Escape") {
-        event.preventDefault();
-        finish(false);
-      }
-    });
-    input.addEventListener("blur", () => finish(true));
-    input.focus();
-    input.select();
-  }
-
-  /** Toggles the shimmer on the title span. */
-  public setLoading(loading: boolean): void {
-    this.loading = loading;
-    this.applyLoading();
-  }
-
-  /** Marks the tab dirty or clean; the stylesheet draws the dot. */
-  public setDirty(dirty: boolean): void {
-    this.element.classList.toggle("ws-tab--dirty", dirty);
-  }
-
-  private applyLoading(): void {
-    setShimmer(this.content, this.loading);
-  }
-
-  public override dispose(): void {
-    if (this.panelId !== null) {
-      tabs.delete(this.panelId);
-      loadingByPanel.delete(this.panelId);
-      this.panelId = null;
-    }
-    super.dispose();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/layout/panel-types.ts b/crates/workshop/ui/src/parts/layout/panel-types.ts
deleted file mode 100644
index 7c4081601..000000000
--- a/crates/workshop/ui/src/parts/layout/panel-types.ts
+++ /dev/null
@@ -1,133 +0,0 @@
-// The dockview renderer seam for the panel registry. The panel kinds
-// themselves - zone affinity, title, closability, and the import thunk
-// that lazy-loads the feature directory - are registered by each feature
-// into @workshop/platform/panel-registry; this file holds the DOM side:
-// the LazyPanel that stands in for a panel while its chunk loads (Home
-// Assistant's partial-panel-resolver pattern) and Dockview's
-// createComponent / createTabComponent dispatch. main.ts and the tests
-// build the dock's dispatch from here.
-
-import type {
-  CreateComponentOptions,
-  GroupPanelPartInitParameters,
-  IContentRenderer,
-  ITabRenderer,
-} from "dockview";
-
-import { Disposable } from "@workshop/platform/lifecycle";
-import { loadPanelType, panelTypeEntry } from "@workshop/platform/panel-registry";
-import { PanelTab } from "./panel-tab";
-
-export {
-  isPanelType,
-  panelTypeEntry,
-  registerPanelFactory,
-  registerPanelType,
-} from "@workshop/platform/panel-registry";
-export type { PanelFeatureModule, PanelType, PanelTypeEntry } from "@workshop/platform/panel-registry";
-
-/** The registered name of the generic tab; the dock's default tab component. */
-export const PANEL_TAB = "panel-tab";
-
-/**
- * A dockview content renderer standing in for a panel whose feature
- * chunk is still loading. The element mounts into the dock immediately
- * (a placeholder keeps the layout stable); when the thunk resolves, the
- * directory's register() has run and the real panel's element swaps in,
- * receiving the init parameters dockview delivered at mount, plus the
- * last dimensions the dock laid the placeholder out at. Disposing before the
- * load resolves cancels the swap. The placeholder's sizing (a full-height flex
- * column, .ws-panel-lazy in zones.css) is what lets the real panel's
- * `height: 100%` resolve against the dock's content container.
- */
-class LazyPanel extends Disposable implements IContentRenderer {
-  readonly element = document.createElement("div");
-  private inner: (IContentRenderer & { dispose?: () => void }) | null = null;
-  private dimension: readonly [width: number, height: number] | null = null;
-  private unloaded = false;
-
-  constructor(private readonly type: string) {
-    super();
-    this.element.className = "ws-panel-lazy";
-    this.element.dataset["panelType"] = type;
-  }
-
-  init(parameters: GroupPanelPartInitParameters): void {
-    void loadPanelType(this.type)
-      .then((factory) => {
-        if (this.unloaded) {
-          return;
-        }
-        if (factory === undefined) {
-          this.showError(`Unknown panel: ${this.type}`);
-          return;
-        }
-        const renderer = factory();
-        this.inner = renderer;
-        this.element.appendChild(renderer.element);
-        renderer.init(parameters);
-        if (this.dimension !== null) {
-          renderer.layout?.(...this.dimension);
-        }
-      })
-      .catch((error: unknown) => {
-        if (!this.unloaded) {
-          this.showError(error instanceof Error ? error.message : String(error));
-        }
-      });
-  }
-
-  /** The real panel once the feature chunk has resolved; null before. */
-  get resolvedPanel(): IContentRenderer | null {
-    return this.inner;
-  }
-
-  /**
-   * Forwards the dock's resize to the real panel; a resize that lands
-   * before the chunk resolves is replayed at the swap.
-   */
-  layout(width: number, height: number): void {
-    this.dimension = [width, height];
-    this.inner?.layout?.(width, height);
-  }
-
-  private showError(message: string): void {
-    const element = document.createElement("div");
-    element.className = "ws-panel-error";
-    element.setAttribute("role", "alert");
-    element.textContent = message;
-    this.element.replaceChildren(element);
-  }
-
-  override dispose(): void {
-    this.unloaded = true;
-    this.inner?.dispose?.();
-    this.inner = null;
-    super.dispose();
-  }
-}
-
-/**
- * Dockview's createComponent dispatch: component name -> a lazy renderer
- * for the registered panel kind. Unknown names should never arrive -
- * every addPanel call goes through openInZone with a registered type -
- * but an unknown name must not break the dock, so it renders a labelled
- * placeholder instead of throwing.
- */
-export function createPanelComponent(options: CreateComponentOptions): IContentRenderer {
-  if (panelTypeEntry(options.name) !== undefined) {
-    return new LazyPanel(options.name);
-  }
-  const element = document.createElement("div");
-  element.className = "ws-panel-unknown";
-  element.textContent = `Unknown panel: ${options.name}`;
-  return { element, init: () => undefined };
-}
-
-/**
- * Dockview's createTabComponent dispatch. Returning undefined for any
- * other name makes Dockview fall back to its default closable tab.
- */
-export function createPanelTabComponent(options: CreateComponentOptions): ITabRenderer | undefined {
-  return options.name === PANEL_TAB ? new PanelTab() : undefined;
-}
diff --git a/crates/workshop/ui/src/parts/layout/tab-names.ts b/crates/workshop/ui/src/parts/layout/tab-names.ts
deleted file mode 100644
index 963ea8b8f..000000000
--- a/crates/workshop/ui/src/parts/layout/tab-names.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-// Tab names: the operator's own names for the tabs of renamable panel
-// types (the chat tabs), kept for the session only. A rename never touches
-// the panel's own title, which is what the layout persists and what a
-// relaunch brings back, so a rename ends with the session by construction.
-// The tab renderer shows the name in place of the title and listens for
-// changes; the panel's close path forgets its name.
-//
-// Imports only @workshop/platform and the close path's event, so the
-// lazy panel chunks that import the tab renderer stay light.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { onDidClosePanel } from "./panel-close";
-
-const names = new Map<string, string>();
-const changeEmitter = new Emitter<string>();
-
-/** Fires with the panel id whose tab name was set or cleared. */
-export const onDidChangeTabName: Event<string> = changeEmitter.event;
-
-/** The operator's name for a panel's tab, or undefined when the title stands. */
-export function tabNameOf(panelId: string): string | undefined {
-  return names.get(panelId);
-}
-
-/**
- * Names a panel's tab. The name is trimmed; a blank one clears the name
- * and the tab goes back to the panel's title.
- */
-export function setTabName(panelId: string, name: string): void {
-  const trimmed = name.trim();
-  if (trimmed === "") {
-    clearTabName(panelId);
-    return;
-  }
-  if (names.get(panelId) === trimmed) {
-    return;
-  }
-  names.set(panelId, trimmed);
-  changeEmitter.fire(panelId);
-}
-
-/** Drops a panel's tab name, if it has one. */
-export function clearTabName(panelId: string): void {
-  if (names.delete(panelId)) {
-    changeEmitter.fire(panelId);
-  }
-}
-
-// A closed panel's name goes with it.
-onDidClosePanel((panel) => clearTabName(panel.id));
diff --git a/crates/workshop/ui/src/parts/layout/watermark.css b/crates/workshop/ui/src/parts/layout/watermark.css
deleted file mode 100644
index d7e44e219..000000000
--- a/crates/workshop/ui/src/parts/layout/watermark.css
+++ /dev/null
@@ -1,90 +0,0 @@
-/* Styles for watermark.ts, which imports this file; esbuild bundles it into
-   dist/app.css. The empty editor group's watermark, as in Cursor: centered,
-   at most 500px wide, at half opacity in #F0F0F099, a 100px product mark over
-   shortcut rows. A row is padded 4px 4px 4px 8px with a 4px radius and ends in
-   key caps. The rows drop out of a group narrower than 478px; the watermark
-   measures its own width (an inline-size container) so the cutoff follows the
-   group, not the window. An emptied side zone shows no watermark. Themed
-   values come from the :root tokens in @workshop/look/tokens.css. */
-
-.ws-watermark {
-  container-type: inline-size;
-  box-sizing: border-box;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  gap: var(--space-6);
-  inline-size: 100%;
-  block-size: 100%;
-  max-inline-size: var(--ws-size-500);
-  margin-inline: auto;
-  color: var(--input-placeholder);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  opacity: 0.5;
-  user-select: none;
-}
-
-.ws-watermark__mark {
-  flex: none;
-  inline-size: var(--ws-size-100);
-  block-size: var(--ws-size-100);
-  object-fit: contain;
-}
-
-.ws-watermark__rows {
-  display: flex;
-  flex-direction: column;
-  gap: var(--ws-size-2);
-  inline-size: 100%;
-}
-
-.ws-watermark__row {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--space-4);
-  padding: var(--ws-size-4) var(--ws-size-4) var(--ws-size-4) var(--ws-size-8);
-  border-radius: var(--ws-size-4);
-}
-
-.ws-watermark__keys,
-.ws-watermark__chord {
-  display: inline-flex;
-  align-items: center;
-}
-
-.ws-watermark__keys {
-  gap: var(--ws-size-8);
-}
-
-.ws-watermark__chord {
-  gap: var(--ws-size-2);
-}
-
-.ws-watermark__key {
-  display: inline-block;
-  min-inline-size: var(--ws-size-18);
-  padding: 0 var(--ws-size-4);
-  border: var(--ws-border-width) solid var(--border);
-  border-radius: var(--ws-size-4);
-  background: var(--cursor-bg-quinary);
-  font: inherit;
-  font-size: var(--font-size-sm);
-  line-height: var(--line-height-sm);
-  text-align: center;
-}
-
-/* Below 478px the rows would crowd the mark: only the mark stays. */
-@container (width < 478px) {
-  .ws-watermark__rows {
-    display: none;
-  }
-}
-
-/* Only the editor area carries a watermark; an emptied side zone stays blank. */
-[data-ws-zone="left"] .ws-watermark,
-[data-ws-zone="right"] .ws-watermark {
-  display: none;
-}
diff --git a/crates/workshop/ui/src/parts/layout/watermark.ts b/crates/workshop/ui/src/parts/layout/watermark.ts
deleted file mode 100644
index cc664a534..000000000
--- a/crates/workshop/ui/src/parts/layout/watermark.ts
+++ /dev/null
@@ -1,185 +0,0 @@
-// The empty editor group's watermark: the product mark over a short list of
-// shortcut rows, as Cursor shows in an editor area with nothing open. Dockview
-// builds one per empty group through `createWatermarkComponent` (main.ts); the
-// stylesheet shows it only in the main zone's groups, so an emptied side zone
-// stays blank.
-//
-// The rows run New Agent, Show Files, Search Files, then Add Folder. A row
-// names a command and reads its key caps from the keybinding registry, so a
-// rebound chord shows as it is; a command with no keybinding gets no row,
-// because a row with nothing to press has nothing to say. Add Folder is the
-// Workshop's one conditional row: it shows only while exactly one root is
-// granted, which the shared roots load answers (the tree panel and the window
-// title read the same load, so the watermark costs no extra request). The
-// count is re-read when the workspace changes; the tree-state service drops
-// the shared load on that same event whether or not a tree panel is open
-// (the composition root has it follow the event), which matters here because
-// the empty editor's watermark is on screen exactly when Explorer is closed.
-// The rows themselves hide in a group narrower than 478px (watermark.css),
-// where they would not fit.
-
-import "./watermark.css";
-
-import type { IWatermarkRenderer, WatermarkRendererInitParameters } from "dockview";
-
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { TREE_STATE } from "../../services/tree-state-service";
-import { WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-
-/** One watermark row: its label, the command whose keybinding it shows, and when it appears. */
-export interface WatermarkRowSpec {
-  readonly label: string;
-  readonly commandId: string;
-  /** Shows the row only while exactly this many roots are granted. */
-  readonly whenRoots?: number;
-}
-
-/**
- * The rows, in order. Add Folder runs the Workshop's multi-root Add Folder
- * flow, which is what Open Folder does here, so it shows Open Folder's chord.
- */
-export const WATERMARK_ROWS: readonly WatermarkRowSpec[] = [
-  { label: "New Agent", commandId: "workbench.action.chat.new" },
-  { label: "Show Files", commandId: "workbench.view.explorer" },
-  { label: "Search Files", commandId: "workbench.action.quickOpen" },
-  { label: "Add Folder", commandId: "workbench.action.files.openFolder", whenRoots: 1 },
-];
-
-/** The registry and the root count the watermark reads; tests inject their own. */
-export interface WatermarkDeps {
-  readonly keybindings?: Pick<KeybindingsRegistry, "lookupKeybinding">;
-  /** How many roots are granted. Rejects when the listing cannot be read. */
-  readonly rootCount?: () => Promise<number>;
-}
-
-const defaultRootCount = async (): Promise<number> => (await getService(TREE_STATE).roots()).entries.length;
-
-/** The modifier names a formatted chord starts with, before its key. */
-const MODIFIER_PREFIX = /^(?:(?:Ctrl|Shift|Alt|Meta|Cmd)\+)*/;
-
-/**
- * Splits a formatted keybinding ("Ctrl+M Ctrl+O") into chords, each a list
- * of key names. The key is whatever follows the modifiers, so a "+" key
- * survives the split.
- */
-export function keyCapsOf(label: string): string[][] {
-  return label
-    .split(" ")
-    .filter((chord) => chord !== "")
-    .map((chord) => {
-      const modifiers = MODIFIER_PREFIX.exec(chord)?.[0] ?? "";
-      const key = chord.slice(modifiers.length);
-      return [...modifiers.split("+").filter((part) => part !== ""), key];
-    });
-}
-
-class Watermark implements IWatermarkRenderer {
-  readonly element = document.createElement("div");
-  private readonly rows = document.createElement("div");
-  private readonly keybindings: Pick<KeybindingsRegistry, "lookupKeybinding">;
-  private readonly rootCount: () => Promise<number>;
-  // The latest root count, or null while it is not known (before the first
-  // read lands, or after one failed); a row that needs a count hides on null.
-  private roots: number | null = null;
-  // A slow read must not overwrite a newer one.
-  private generation = 0;
-  private disposed = false;
-
-  private readonly onWorkspaceChanged = (): void => {
-    // After every listener has run, so the tree-state service's invalidation
-    // of the shared roots load lands before this read whatever the listener
-    // order is.
-    queueMicrotask(() => {
-      if (!this.disposed) {
-        void this.refresh();
-      }
-    });
-  };
-
-  constructor(deps: WatermarkDeps) {
-    this.keybindings = deps.keybindings ?? KeybindingsRegistry;
-    this.rootCount = deps.rootCount ?? defaultRootCount;
-    this.element.className = "ws-watermark";
-    const mark = document.createElement("img");
-    mark.className = "ws-watermark__mark";
-    mark.src = "/icons/runvil-icon.png";
-    mark.srcset = "/icons/runvil-icon.png 1x, /icons/runvil-icon@2x.png 2x";
-    mark.alt = "";
-    mark.draggable = false;
-    this.rows.className = "ws-watermark__rows";
-    this.element.append(mark, this.rows);
-  }
-
-  init(_parameters: WatermarkRendererInitParameters): void {
-    this.render();
-    window.addEventListener(WORKSPACE_CHANGED_EVENT, this.onWorkspaceChanged);
-    void this.refresh();
-  }
-
-  dispose(): void {
-    this.disposed = true;
-    window.removeEventListener(WORKSPACE_CHANGED_EVENT, this.onWorkspaceChanged);
-  }
-
-  /** Re-reads the root count and repaints the rows. */
-  private async refresh(): Promise<void> {
-    const generation = ++this.generation;
-    let count: number | null;
-    try {
-      count = await this.rootCount();
-    } catch {
-      // An unreadable listing leaves the count-gated row out until the next change.
-      count = null;
-    }
-    if (this.disposed || generation !== this.generation) {
-      return;
-    }
-    this.roots = count;
-    this.render();
-  }
-
-  private render(): void {
-    const rows: HTMLElement[] = [];
-    for (const spec of WATERMARK_ROWS) {
-      if (spec.whenRoots !== undefined && spec.whenRoots !== this.roots) {
-        continue;
-      }
-      const label = this.keybindings.lookupKeybinding(spec.commandId)?.getLabel();
-      if (label === undefined) {
-        continue;
-      }
-      rows.push(this.buildRow(spec, label));
-    }
-    this.rows.replaceChildren(...rows);
-  }
-
-  private buildRow(spec: WatermarkRowSpec, keybinding: string): HTMLElement {
-    const row = document.createElement("div");
-    row.className = "ws-watermark__row";
-    row.dataset["commandId"] = spec.commandId;
-    const name = document.createElement("span");
-    name.className = "ws-watermark__label";
-    name.textContent = spec.label;
-    const keys = document.createElement("span");
-    keys.className = "ws-watermark__keys";
-    for (const chord of keyCapsOf(keybinding)) {
-      const group = document.createElement("span");
-      group.className = "ws-watermark__chord";
-      for (const key of chord) {
-        const cap = document.createElement("kbd");
-        cap.className = "ws-watermark__key";
-        cap.textContent = key;
-        group.append(cap);
-      }
-      keys.append(group);
-    }
-    row.append(name, keys);
-    return row;
-  }
-}
-
-/** Dockview's `createWatermarkComponent` seam: one watermark per empty group. */
-export function createWatermark(deps: WatermarkDeps = {}): IWatermarkRenderer {
-  return new Watermark(deps);
-}
diff --git a/crates/workshop/ui/src/parts/layout/zones.css b/crates/workshop/ui/src/parts/layout/zones.css
deleted file mode 100644
index 30e930904..000000000
--- a/crates/workshop/ui/src/parts/layout/zones.css
+++ /dev/null
@@ -1,335 +0,0 @@
-/* Styles for zones.ts, which imports this file; esbuild bundles it into
-   dist/app.css. Covers the dock scaffolding the zones place panels into,
-   Cursor's dockview palette, the editor tabs of the main zone's groups,
-   the left zone's pill header, the right zone's chat tabs, plus the shared
-   panel plumbing rules (.ws-panel-lazy, .ws-panel-error, .ws-panel-unknown
-   from panel-types.ts). The tree's Add Folder dialog has no rules here: it
-   opens the form modal from @workshop/look/modal.
-   Themed values come from the :root tokens in @workshop/look/tokens.css.
-
-   Every group carries the marks zones.ts stamps: data-ws-zone (left, right,
-   or main - a split the user dragged out is main too), data-ws-empty on a
-   group with no panel, and data-ws-active-group on the Workshop's active
-   editor group. Dockview's own active-group class follows focus into the tree
-   and the agent; the Workshop's mark does not, so an editor's tabs stay lit
-   while the tree or the chat has focus. The rules below key on the marks,
-   and each zone's rules stay inside its own data-ws-zone. */
-
-.ws-desk {
-  display: flex;
-  flex: 1;
-  min-height: 0;
-}
-
-/* The dockview column fills the desk: the dock fills it. */
-.ws-dock-column {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  min-width: 0;
-}
-
-.ws-dock {
-  flex: 1;
-  min-height: 0;
-}
-
-.dv-split-view-container.dv-animation .dv-view,
-.dv-split-view-container.dv-animation .dv-sash {
-  transition: none;
-}
-
-/* The placeholder sits between dockview's content container and the
-   real panel, so it must hand the container's height straight through:
-   every panel root sizes itself with `height: 100%` and needs a
-   definite-height parent, or its feed grows with content instead of
-   scrolling and pushes the input below the window. */
-.ws-panel-lazy {
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-  min-height: 0;
-}
-
-/* The dockview palette, Cursor Dark: groups #181818 and the tab strip #141414;
-   the active tab #181818 and an inactive one #141414, in every group state
-   (the Workshop's own mark below decides focus, not Dockview's); tab text
-   #F0F0F0BD in a group that is not the active one, #F0F0F05C for an inactive
-   tab; separators #F0F0F013; the drop overlay #F0F0F011 and the tab-drop line
-   #F0F0F0 (the theme draws it 1px); a hovered sash lights #F0F0F026 after
-   300ms, fading in over 100ms; icon hovers #5A5D5E50. An editor tab in a
-   group that is not the active one washes #2A2A2AB3 on hover. */
-.ws-dock .dockview-theme-dark {
-  --dv-group-view-background-color: var(--cursor-editor);
-  --dv-tabs-and-actions-container-background-color: var(--cursor-chrome);
-  --dv-tabs-and-actions-container-height: var(--ws-size-35);
-  --dv-tabs-and-actions-container-font-size: var(--font-size-base);
-  --dv-tab-font-size: var(--font-size-base);
-  --dv-activegroup-visiblepanel-tab-background-color: var(--cursor-editor);
-  --dv-activegroup-hiddenpanel-tab-background-color: var(--cursor-chrome);
-  --dv-inactivegroup-visiblepanel-tab-background-color: var(--cursor-editor);
-  --dv-inactivegroup-hiddenpanel-tab-background-color: var(--cursor-chrome);
-  --dv-activegroup-visiblepanel-tab-color: var(--text-muted);
-  --dv-inactivegroup-visiblepanel-tab-color: var(--text-muted);
-  --dv-activegroup-hiddenpanel-tab-color: var(--text-faint);
-  --dv-inactivegroup-hiddenpanel-tab-color: var(--text-faint);
-  --dv-tab-divider-color: var(--border);
-  --dv-separator-border: var(--border);
-  --dv-sash-color: transparent;
-  --dv-active-sash-color: var(--cursor-stroke-focused);
-  --dv-active-sash-transition-delay: var(--duration-slower);
-  --dv-active-sash-transition-duration: var(--duration-fast);
-  --dv-drag-over-background-color: var(--bg-hover);
-  --dv-drag-over-border-color: var(--cursor-base);
-  --dv-icon-hover-background-color: var(--cursor-toolbar-hover);
-  --ws-tab-hover-wash: var(--tab-unfocused-hover);
-}
-
-/* The Workshop's active editor group reads #F0F0F0 whatever Dockview thinks is
-   active; it and the side zones take no hover wash. */
-.ws-dock [data-ws-active-group] {
-  --dv-activegroup-visiblepanel-tab-color: var(--text);
-  --dv-inactivegroup-visiblepanel-tab-color: var(--text);
-}
-
-.ws-dock [data-ws-active-group],
-.ws-dock [data-ws-zone="left"],
-.ws-dock [data-ws-zone="right"] {
-  --ws-tab-hover-wash: transparent;
-}
-
-/* An empty editor group is #141414 with no tab strip: its watermark is all it
-   shows. */
-[data-ws-zone="main"][data-ws-empty] {
-  --dv-group-view-background-color: var(--cursor-chrome);
-}
-
-[data-ws-zone="main"][data-ws-empty] .dv-tabs-and-actions-container {
-  display: none;
-}
-
-/* The editor tabs (the main zone's groups). The strip is 35px with a 1px
-   #F0F0F013 underline; a tab is at least 120px wide with a 1px #F0F0F013
-   right border and a 10px left padding, and the active tab's own #181818
-   underline covers the strip's, so it merges into the editor. Dockview's
-   dividers before each tab are dropped for the border. A tab with no close
-   button takes the 10px on its right. An editor tab in a group that is not
-   the Workshop's active one washes on hover. */
-[data-ws-zone="main"] .dv-tabs-and-actions-container {
-  box-shadow: inset 0 calc(-1 * var(--ws-border-width)) 0 var(--border);
-}
-
-.ws-dock [data-ws-zone="main"] .dv-tabs-container .dv-tab:not(:first-child)::before {
-  display: none;
-}
-
-[data-ws-zone="main"] .dv-tab {
-  padding: 0;
-  min-inline-size: var(--ws-size-120);
-  border-inline-end: var(--ws-border-width) solid var(--border);
-}
-
-[data-ws-zone="main"] .dv-tab.dv-active-tab {
-  box-shadow: inset 0 calc(-1 * var(--ws-border-width)) 0 var(--cursor-editor);
-}
-
-[data-ws-zone="main"] .dv-tab:hover {
-  background-image: linear-gradient(var(--ws-tab-hover-wash), var(--ws-tab-hover-wash));
-}
-
-[data-ws-zone="main"] .dv-tab .dv-default-tab {
-  padding-inline-start: var(--ws-size-10);
-}
-
-[data-ws-zone="main"] .dv-tab .dv-default-tab.ws-tab--no-close {
-  padding-inline-end: var(--ws-size-10);
-}
-
-[data-ws-zone="main"] .dv-tab .dv-default-tab-content {
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-/* The close button: 20x20 with a 5px radius in a 28px slot, #5A5D5E50 on hover.
-   It is out of sight until its tab is hovered or active; then it is fully
-   visible in the Workshop's active group and half visible in any other. */
-[data-ws-zone="main"] .dv-tab .dv-default-tab .dv-default-tab-action,
-[data-ws-zone="main"] .dv-tab.dv-inactive-tab .dv-default-tab .dv-default-tab-action,
-[data-ws-zone="main"] .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action {
-  box-sizing: border-box;
-  inline-size: var(--ws-size-20);
-  block-size: var(--ws-size-20);
-  margin-inline: var(--ws-size-4);
-  padding: 0;
-  border-radius: var(--ws-size-5);
-  visibility: visible;
-  opacity: 0;
-}
-
-[data-ws-zone="main"] .dv-tab .dv-default-tab .dv-default-tab-action:hover {
-  background-color: var(--cursor-toolbar-hover);
-  border-radius: var(--ws-size-5);
-}
-
-[data-ws-active-group] .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action,
-[data-ws-active-group] .dv-tab:hover .dv-default-tab .dv-default-tab-action {
-  opacity: 1;
-}
-
-[data-ws-zone="main"]:not([data-ws-active-group]) .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action,
-[data-ws-zone="main"]:not([data-ws-active-group]) .dv-tab:hover .dv-default-tab .dv-default-tab-action {
-  opacity: 0.5;
-}
-
-/* A dirty tab (ws-tab--dirty, from setTabDirty) shows an 8px dot where the
-   close button's centre is - 10px from the tab's edge - and keeps the button
-   out of sight until the tab is hovered; hovering swaps the dot for the X. */
-[data-ws-zone="main"] .dv-default-tab.ws-tab--dirty::after {
-  content: "";
-  position: absolute;
-  inset-inline-end: var(--ws-size-10);
-  inset-block-start: 50%;
-  inline-size: var(--ws-size-8);
-  block-size: var(--ws-size-8);
-  margin-block-start: calc(var(--ws-size-8) / -2);
-  border-radius: var(--radius-full);
-  background: currentcolor;
-  pointer-events: none;
-}
-
-[data-ws-zone="main"] .dv-default-tab.ws-tab--dirty:hover::after {
-  display: none;
-}
-
-[data-ws-zone="main"] .dv-tab .dv-default-tab.ws-tab--dirty:not(:hover) .dv-default-tab-action {
-  visibility: hidden;
-}
-
-/* The left zone's header: its tabs are centered pills 2px apart - 22px tall
-   with a 4px radius, 12px at weight 500 in #F0F0F0BD, #F0F0F011 on hover - on
-   the strip's #141414. */
-[data-ws-zone="left"] {
-  --dv-activegroup-visiblepanel-tab-background-color: transparent;
-  --dv-activegroup-hiddenpanel-tab-background-color: transparent;
-  --dv-inactivegroup-visiblepanel-tab-background-color: transparent;
-  --dv-inactivegroup-hiddenpanel-tab-background-color: transparent;
-}
-
-[data-ws-zone="left"] .dv-tabs-and-actions-container {
-  justify-content: center;
-}
-
-[data-ws-zone="left"] .dv-void-container {
-  flex-grow: 0;
-}
-
-[data-ws-zone="left"] .dv-tabs-container {
-  justify-content: center;
-  align-items: center;
-  gap: var(--ws-size-2);
-}
-
-[data-ws-zone="left"] .dv-tab {
-  padding: 0;
-  min-inline-size: 0;
-}
-
-[data-ws-zone="left"] .dv-tab .dv-default-tab {
-  block-size: var(--ws-size-22);
-  padding: 0 var(--ws-size-6);
-  border-radius: var(--ws-size-4);
-  font-size: var(--font-size-sm);
-  font-weight: var(--font-weight-medium);
-  color: var(--text-muted);
-}
-
-[data-ws-zone="left"] .dv-tab .dv-default-tab:hover {
-  background-color: var(--bg-hover);
-}
-
-/* The right zone's group (data-ws-zone="right", stamped by zones.ts): the
-   chat pane. Its header is a 35px row on #181818 holding the chat tabs and
-   the header buttons (agent-pane-header.css). A chat tab is padded 3px 6px
-   with a 6px radius and 13px/18px weight-400 text; tabs run 60 to 120px wide
-   and the active one can grow to 200px, on about #252525 (a 6% wash on the
-   #181818 header); inactive labels read #F0F0F0BD. The close X shows on hover
-   only. Its tab wrappers show the header, not the editor palette. */
-[data-ws-zone="right"] {
-  --dv-activegroup-visiblepanel-tab-background-color: transparent;
-  --dv-activegroup-hiddenpanel-tab-background-color: transparent;
-  --dv-inactivegroup-visiblepanel-tab-background-color: transparent;
-  --dv-inactivegroup-hiddenpanel-tab-background-color: transparent;
-}
-
-[data-ws-zone="right"] .dv-tabs-and-actions-container {
-  block-size: var(--ws-pane-header-height);
-  background: var(--cursor-editor);
-}
-
-[data-ws-zone="right"] .dv-tab {
-  flex: 0 1 auto;
-  min-inline-size: var(--ws-chat-tab-min-width);
-  max-inline-size: var(--ws-chat-tab-max-width);
-  padding: 0;
-  background: transparent;
-}
-
-[data-ws-zone="right"] .dv-tab.dv-active-tab {
-  max-inline-size: var(--ws-chat-tab-active-max-width);
-}
-
-[data-ws-zone="right"] .dv-tab .dv-default-tab {
-  padding: var(--ws-chat-tab-padding);
-  border-radius: var(--radius);
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  font-weight: normal;
-}
-
-[data-ws-zone="right"] .dv-tab.dv-active-tab .dv-default-tab {
-  background: var(--cursor-bg-quaternary);
-  color: var(--text);
-}
-
-[data-ws-zone="right"] .dv-tab.dv-inactive-tab .dv-default-tab {
-  color: var(--text-muted);
-}
-
-[data-ws-zone="right"] .dv-tab .dv-default-tab-content {
-  min-inline-size: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-/* The close X: hidden until the tab is hovered, active or not. */
-[data-ws-zone="right"] .dv-tab .dv-default-tab .dv-default-tab-action,
-[data-ws-zone="right"] .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action {
-  visibility: hidden;
-}
-
-[data-ws-zone="right"] .dv-tab .dv-default-tab:hover .dv-default-tab-action {
-  visibility: visible;
-}
-
-/* The inline rename field replaces the tab's text. */
-.ws-tab-rename {
-  inline-size: 100%;
-  min-inline-size: 0;
-  padding: 0;
-  font: inherit;
-  color: inherit;
-  background: transparent;
-  border: none;
-  outline: none;
-}
-
-.ws-panel-unknown,
-.ws-panel-error {
-  height: 100%;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  color: var(--danger-text);
-  font-size: var(--font-size-sm);
-}
diff --git a/crates/workshop/ui/src/parts/layout/zones.ts b/crates/workshop/ui/src/parts/layout/zones.ts
deleted file mode 100644
index 03d0be83f..000000000
--- a/crates/workshop/ui/src/parts/layout/zones.ts
+++ /dev/null
@@ -1,690 +0,0 @@
-// The zone registry: the only module that talks to Dockview placement
-// APIs. Zones are named tab banks - "left" and "right" are the side bars,
-// "main" is the document area between them ("bottom" is reserved for
-// later). Placement for a new panel resolves as
-// the per-panel override recorded when the user last moved that panel,
-// then the panel type's declared affinity from the panel registry.
-//
-// Zones never die from panel closes or drags. Dockview's removePanel
-// defaults removeEmptyGroup: true, so a group's last panel leaving (a tab
-// close, a drag onto another group) dissolves the group and the zone's
-// space with it. This module keeps each zone's last known size, and when
-// a zone's group dies inside a layout mutation, it re-creates the group
-// as an empty dockview group at the zone's rebuilt position before the
-// mutation is reported as settled, then restores the recorded sizes. An
-// empty group is dockview's own idea of "nothing here": a blank tab strip
-// over the default watermark. The next panel opened into the zone lands
-// in that group. Restores and resets suppress the rebuild through
-// withZoneRestore and the mutation kind.
-//
-// Dockview facts relied on, verified against dockview-core 8.3.1 (per
-// package-lock.json) in dist/package/main.esm.mjs; test/zone-stability.mjs
-// is the detecting test when an upgrade breaks one of them:
-// - onWillMutateLayout / onDidMutateLayout bracket each top-level
-//   structural change exactly once (nested calls join the outermost
-//   transaction), so a compound drag that removes a group and adds a
-//   panel elsewhere reports once, after it settled. A rebuild performed
-//   inside onDidMutateLayout runs at depth zero and opens its own "add"
-//   bracket, whose snapshot already sees the zone dead and rebuilds
-//   nothing.
-// - addGroup({ referenceGroup, direction }) creates a panel-less group
-//   beside the reference group and answers it; fromJSON creates each grid
-//   leaf's group before opening its views, so a leaf with views: [] comes
-//   back as an empty group at its saved size, and toJSON serializes empty
-//   leaves. Nothing beyond dockview's own layout needs to be persisted.
-// - The default watermark is an empty div.dv-watermark: no text, no
-//   controls.
-// - noPanelsOverlay: "emptyGroup" (set in main.ts) keeps the dock's sole
-//   remaining group when its last panel closes from the tab strip; the
-//   dock-empty guard below covers the API removal path.
-//
-// The zone state itself (the group map and the placement overrides) lives
-// in the ZoneStateService, resolved through the service registry; this
-// module is the placement behavior over that state.
-
-import "./zones.css";
-
-import type {
-  Direction,
-  DockviewApi,
-  DockviewGroupPanel,
-  IDockviewGroupPanel,
-  IDockviewPanel,
-} from "dockview";
-
-import { DisposableStore, type IDisposable } from "@workshop/platform/lifecycle";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import {
-  DOCK,
-  ZONE_NAMES,
-  isPanelType,
-  panelTypeEntry,
-  type PanelParams,
-  type PanelType,
-  type ZoneName,
-} from "@workshop/platform/panel-registry";
-import { getService, registerService } from "@workshop/platform/service-registry";
-import { ZoneStateService, ZONE_STATE, type ZoneState } from "../../services/zone-state-service";
-
-export { ZONE_NAMES } from "@workshop/platform/panel-registry";
-export type { PanelParams, PanelType, ZoneName } from "@workshop/platform/panel-registry";
-export type { ZoneState } from "../../services/zone-state-service";
-
-/** The left zone's preference floor: the tree opens at least this wide. */
-const LEFT_ZONE_MIN_WIDTH = 214;
-
-/** The widest the left zone prefers to open at, before the quarter-of-the-window rule. */
-const LEFT_ZONE_PREFERRED_MAX_WIDTH = 300;
-
-/**
- * The left zone's preferred width in a dock `totalWidth` wide:
- * `min(300px, W/4)`, never under 214px. It is where the tree opens, not a
- * floor the sash is held to.
- */
-export function leftZonePreferredWidth(totalWidth: number): number {
-  return Math.max(
-    LEFT_ZONE_MIN_WIDTH,
-    Math.min(LEFT_ZONE_PREFERRED_MAX_WIDTH, Math.round(totalWidth / 4)),
-  );
-}
-
-/** The right zone's floor: the chat pane never narrows below this. */
-export const RIGHT_ZONE_MIN_WIDTH = 300;
-
-/** The widest the right zone prefers to open at, before the quarter-of-the-window rule. */
-const RIGHT_ZONE_PREFERRED_MAX_WIDTH = 400;
-
-/**
- * The right zone's preferred width in a dock `totalWidth` wide:
- * `min(400px, W/4)`, never under the zone's 300px floor.
- */
-export function rightZonePreferredWidth(totalWidth: number): number {
-  return Math.max(
-    RIGHT_ZONE_MIN_WIDTH,
-    Math.min(RIGHT_ZONE_PREFERRED_MAX_WIDTH, Math.round(totalWidth / 4)),
-  );
-}
-
-let dock: DockviewApi | null = null;
-
-// The right-zone groups whose width floor is already applied, so the
-// constraint is set once per group and not on every layout change.
-const constrainedGroups = new WeakSet<IDockviewGroupPanel>();
-
-/** The shared zone state: the group map and the placement overrides. */
-function zoneState(): ZoneStateService {
-  return getService(ZONE_STATE);
-}
-
-/** One zone group's last known dimensions, kept for resurrection. */
-interface ZoneSize {
-  readonly width: number;
-  readonly height: number;
-}
-
-// The size memory: each zone group's last known dimensions, refreshed on
-// every layout change. Session-scoped placement behavior (like the dock
-// reference above), not application state; across a relaunch the sizes
-// come back through dockview's own serialized grid.
-const zoneSizes = new Map<ZoneName, ZoneSize>();
-
-// The mutation snapshot: the zones that had a live group when the current
-// top-level layout mutation opened, taken in onWillMutateLayout and
-// consumed in onDidMutateLayout. Null outside a bracket and while a
-// restore runs.
-let liveBefore: readonly ZoneName[] | null = null;
-
-// Set while a layout restore or reset runs: fromJSON and clear() remove
-// every live group, and those removals must never rebuild anything.
-let restoring = false;
-
-/**
- * Runs `run` with the zone rebuild suppressed. Wraps the fromJSON in
- * layout-persistence's restoreLayout (the one caller) so layout reloads
- * and workspace switches never create groups.
- */
-export function withZoneRestore<T>(run: () => T): T {
-  restoring = true;
-  try {
-    return run();
-  } finally {
-    restoring = false;
-  }
-}
-
-// The id of the editor group the Workshop last saw active, which stays the
-// Workshop's active group while the tree or the agent holds Dockview's focus.
-let activeEditorGroupId: string | null = null;
-
-/**
- * Sets or clears one `data-ws-*` mark on a group's element, writing only
- * when the value changes so the stamping pass costs the DOM nothing at rest.
- */
-function mark(element: HTMLElement, key: string, value: string | undefined): void {
-  if (value === undefined) {
-    if (element.dataset[key] !== undefined) {
-      delete element.dataset[key];
-    }
-  } else if (element.dataset[key] !== value) {
-    element.dataset[key] = value;
-  }
-}
-
-/** Whether a group is the left or right zone's: those are not editor groups. */
-function isSideGroup(group: IDockviewGroupPanel): boolean {
-  const zone = zoneState().zoneForGroupId(group.id);
-  return zone === "left" || zone === "right";
-}
-
-/**
- * Marks every group in the dock, so the stylesheets can skin one kind of
- * group without knowing group ids:
- * - `data-ws-zone` names the group's zone. The main zone is the document
- *   area, so every group that is not the left or right zone's - a split
- *   the user dragged out - reads as main too.
- * - `data-ws-empty` marks a group holding no panel, whose tab strip the
- *   editor area hides.
- * - `data-ws-active-group` marks the Workshop's active editor group. Dockview
- *   moves its own active group to the tree or the agent when either takes
- *   focus, which would dim the editor tabs; the Workshop's notion keeps the
- *   last active editor group lit through that, and only another editor
- *   group taking focus moves it.
- * The interface hides the element a group class carries, and a dock double
- * has no groups to walk, so each step tolerates their absence.
- */
-function stampGroups(): void {
-  if (dock === null) {
-    return;
-  }
-  const groups: readonly IDockviewGroupPanel[] | undefined = dock.groups;
-  if (!Array.isArray(groups)) {
-    return;
-  }
-  const active: IDockviewGroupPanel | undefined = dock.activeGroup;
-  if (active !== undefined && !isSideGroup(active)) {
-    activeEditorGroupId = active.id;
-  }
-  // The remembered group may have closed, or turned out to be a side zone's
-  // (a group is stamped before the zone map learns it); fall back to the main
-  // zone's group, else any editor group.
-  let activeEditor: IDockviewGroupPanel | undefined =
-    activeEditorGroupId === null ? undefined : groups.find((group) => group.id === activeEditorGroupId);
-  if (activeEditor === undefined || isSideGroup(activeEditor)) {
-    activeEditor = liveGroup("main") ?? groups.find((group) => !isSideGroup(group));
-    activeEditorGroupId = activeEditor?.id ?? null;
-  }
-  for (const group of groups) {
-    const element: HTMLElement | undefined = (group as DockviewGroupPanel).element;
-    if (element === undefined) {
-      continue;
-    }
-    const side = isSideGroup(group);
-    mark(element, "wsZone", zoneState().zoneForGroupId(group.id) ?? "main");
-    const panels: readonly unknown[] | undefined = group.panels;
-    mark(element, "wsEmpty", panels !== undefined && panels.length === 0 ? "true" : undefined);
-    mark(element, "wsActiveGroup", !side && group === activeEditor ? "true" : undefined);
-  }
-}
-
-/**
- * Marks every live zone group with its zone name (`data-ws-zone` on the
- * group's element), so the stylesheets can skin one zone's groups - the
- * right zone's header and chat tabs - without knowing group ids, and the
- * rest of the dock's groups with the main zone's marks (stampGroups). Runs
- * after every change that creates, rebuilds, or restores a group, and
- * with each layout change as the net under them. The right zone's groups
- * also get their width floor here, once each.
- */
-function stampZones(): void {
-  if (dock === null) {
-    return;
-  }
-  for (const zone of ZONE_NAMES) {
-    const group = liveGroup(zone);
-    if (group === undefined) {
-      continue;
-    }
-    // The floor goes on once the dock is laid out wide enough to hold the
-    // right zone beside something else; an unsized dock (Dockview's 100px
-    // default) still has placeholder widths, and a floor set then would
-    // overwrite the proportions a restore is about to apply.
-    if (
-      zone === "right" &&
-      dock.width >= RIGHT_ZONE_MIN_WIDTH * 2 &&
-      !constrainedGroups.has(group)
-    ) {
-      constrainedGroups.add(group);
-      applyRightFloor(group);
-    }
-  }
-  stampGroups();
-}
-
-/**
- * A right group created beside others opens at the chat pane's preferred
- * width, `min(400px, W/4)` and never under 300px. Only a laid-out dock is
- * sized: an unsized one (Dockview's 100px default) has nothing to prefer.
- */
-function sizeNewRightGroup(group: IDockviewGroupPanel): void {
-  const width: unknown = dock?.width;
-  if (typeof width !== "number" || width < RIGHT_ZONE_MIN_WIDTH * 2) {
-    return;
-  }
-  group.api?.setSize?.({ width: rightZonePreferredWidth(width) });
-}
-
-/**
- * Sets the right zone's width floor. Dockview redistributes the dock's
- * widths when a constraint changes, even when nothing violates it, so a
- * group already at or over the floor has every zone's width put back
- * afterwards; one under the floor is lifted to it and the others give way.
- */
-function applyRightFloor(group: IDockviewGroupPanel): void {
-  if (group.api?.setConstraints === undefined) {
-    return;
-  }
-  const widths: { readonly group: IDockviewGroupPanel; readonly width: number; readonly height: number }[] = [];
-  for (const zone of ZONE_NAMES) {
-    const live = liveGroup(zone);
-    if (live !== undefined) {
-      widths.push({ group: live, width: live.api.width, height: live.api.height });
-    }
-  }
-  group.api.setConstraints({ minimumWidth: RIGHT_ZONE_MIN_WIDTH });
-  if (group.api.width < RIGHT_ZONE_MIN_WIDTH && group.api.width !== 0) {
-    return;
-  }
-  const wasWide = widths.find((entry) => entry.group === group)?.width ?? 0;
-  if (wasWide < RIGHT_ZONE_MIN_WIDTH) {
-    return;
-  }
-  for (const entry of widths) {
-    if (entry.group.api.width !== entry.width) {
-      entry.group.api.setSize({ width: entry.width, height: entry.height });
-    }
-  }
-}
-
-/** Records every zone group's current dimensions. */
-function recordZoneSizes(): void {
-  if (dock === null) {
-    return;
-  }
-  for (const zone of ZONE_NAMES) {
-    const group = liveGroup(zone);
-    if (group !== undefined) {
-      zoneSizes.set(zone, { width: group.api.width, height: group.api.height });
-    }
-  }
-}
-
-/**
- * Re-creates a zone's group after its last panel left: a fresh, empty
- * group at the zone's rebuilt position, sized back to the recorded
- * dimensions. The surviving zones' recorded sizes are re-asserted as
- * well - the splitview redistributes space on the removal and the
- * re-add, and the side zones must stay pixel-identical.
- */
-function rebuildZone(zone: ZoneName): void {
-  if (dock === null) {
-    return;
-  }
-  const position = rebuildPosition(zone);
-  if (position === undefined) {
-    return;
-  }
-  const group = dock.addGroup(position);
-  zoneState().setGroup(zone, group.id);
-  stampZones();
-  const size = zoneSizes.get(zone);
-  if (size !== undefined) {
-    group.api.setSize(size);
-  } else if (zone === "right") {
-    sizeNewRightGroup(group);
-  }
-  for (const other of ZONE_NAMES) {
-    if (other === zone) {
-      continue;
-    }
-    const recorded = zoneSizes.get(other);
-    const group = liveGroup(other);
-    if (recorded !== undefined && group !== undefined) {
-      group.api.setSize(recorded);
-    }
-  }
-}
-
-/**
- * The panel id for one open: the type's own panelId rule when it declares
- * one, else `type:instance` when the params carry a string instance, else
- * the bare type, making the kind a singleton.
- */
-export function panelIdFor(type: PanelType, params: PanelParams): string {
-  const panelId = panelTypeEntry(type)?.panelId;
-  if (panelId !== undefined) {
-    return panelId(params);
-  }
-  if (typeof params.instance === "string") {
-    return `${type}:${params.instance}`;
-  }
-  return type;
-}
-
-/**
- * Recovers the panel type from a panel id built by panelIdFor. Splits at
- * the first colon: path-keyed ids like `type:C:\...` carry more colons.
- */
-function panelTypeFromId(id: string): PanelType | null {
-  const separator = id.indexOf(":");
-  const name = separator === -1 ? id : id.slice(0, separator);
-  return isPanelType(name) ? name : null;
-}
-
-/** The zone a panel currently lives in, by reverse group lookup. */
-export function zoneOfPanel(panel: IDockviewPanel): ZoneName | undefined {
-  return zoneState().zoneForGroupId(panel.group.id);
-}
-
-/**
- * Records where a panel now lives. Moving a panel writes an override;
- * moving it back to its type's affinity zone deletes the override.
- */
-export function setZoneOverride(panelId: string, zone: ZoneName): void {
-  const type = panelTypeFromId(panelId);
-  const state = zoneState();
-  if (type !== null && panelTypeEntry(type)?.defaultZone === zone) {
-    state.clearOverride(panelId);
-  } else {
-    state.setOverride(panelId, zone);
-  }
-}
-
-/**
- * Binds the registry to the dock. User drags (always possible: the
- * workbench is never locked) flow back into the override map through
- * onDidMovePanel. The dock itself registers as the DOCK service, so the
- * commands the feature directories register (save, close, toggle) resolve
- * the dock from the service registry instead of capturing it. Returns
- * the disposable owning that subscription.
- */
-export function initZones(dockview: DockviewApi): IDisposable {
-  dock = dockview;
-  activeEditorGroupId = null;
-  registerService(DOCK, () => dockview);
-  const store = new DisposableStore();
-  store.add(
-    dockview.onDidMovePanel(({ panel, to }) => {
-      const zone = zoneState().zoneForGroupId(to.id);
-      if (zone !== undefined) {
-        setZoneOverride(panel.id, zone);
-      }
-    }),
-  );
-  // The size memory refreshes on every layout change, so a rebuild
-  // restores the dimensions the zone last had, not the ones it booted
-  // with.
-  store.add(
-    dockview.onDidLayoutChange(() => {
-      stampZones();
-      recordZoneSizes();
-    }),
-  );
-  // Focus moving between groups changes no layout, so the Workshop's active
-  // editor group is re-stamped on its own event. A dock double has no focus
-  // to follow and no such event.
-  if (typeof dockview.onDidActiveGroupChange === "function") {
-    store.add(dockview.onDidActiveGroupChange(() => stampGroups()));
-  }
-  // The rebuild boundary: snapshot which zones are live when a top-level
-  // mutation opens, and once it has settled rebuild every zone that lost
-  // its group in it. A zone that was not live before is never created
-  // here - its first panel creates it through openInZone.
-  store.add(
-    dockview.onWillMutateLayout(() => {
-      liveBefore = restoring ? null : ZONE_NAMES.filter((zone) => liveGroup(zone) !== undefined);
-    }),
-  );
-  store.add(
-    dockview.onDidMutateLayout((event) => {
-      const before = liveBefore;
-      liveBefore = null;
-      // Restores and clears tear every group down on purpose. The
-      // dock's last group standing is never rebuilt either: with no
-      // survivors there is no zone layout left to preserve.
-      if (
-        before === null ||
-        restoring ||
-        event.kind === "load" ||
-        event.kind === "clear" ||
-        dock === null ||
-        dock.groups.length === 0
-      ) {
-        return;
-      }
-      for (const zone of before) {
-        if (liveGroup(zone) === undefined) {
-          rebuildZone(zone);
-        }
-      }
-    }),
-  );
-  return store;
-}
-
-/**
- * Binds the activeEditor context key to the dock: the active panel's
- * type id, unset while no panel is active. The id is the panel's
- * dockview component, which openInZone sets to the entry type at
- * addPanel, so the key is right before a lazy chunk loads and nothing
- * the chunk does can change it.
- */
-export function bindActiveEditorKey(dockview: DockviewApi): IDisposable {
-  const activeEditor = getService(CONTEXT_KEY_SERVICE).createKey<string | undefined>("activeEditor", undefined);
-  const update = (): void => {
-    activeEditor.set(dockview.activePanel?.api.component);
-  };
-  const store = new DisposableStore();
-  store.add(dockview.onDidActivePanelChange(update));
-  update();
-  return store;
-}
-
-/** The zone's group while it is alive; undefined once it has closed away. */
-function liveGroup(zone: ZoneName): IDockviewGroupPanel | undefined {
-  if (dock === null) {
-    return undefined;
-  }
-  const id = zoneState().groupFor(zone);
-  return id === undefined ? undefined : dock.getGroup(id);
-}
-
-/**
- * Hides or shows a zone's live group and answers the new visibility.
- * Hiding goes through the group's own setVisible, so its panels and
- * their live connections survive; nothing is removed. The flip itself is
- * setZoneVisibility's, so the right zone's auxiliaryBarVisible key follows
- * here too. Answers undefined when the zone has no live group, leaving
- * the caller to open the zone's anchor panel instead.
- */
-export function toggleZoneVisibility(zone: ZoneName): boolean | undefined {
-  const group = liveGroup(zone);
-  if (group === undefined) {
-    return undefined;
-  }
-  const visible = !group.api.isVisible;
-  setZoneVisibility(zone, visible);
-  return visible;
-}
-
-/**
- * A rebuilt zone's placement: a surviving group and the side to grow on.
- * The one shape both addGroup (AddGroupOptions) and addPanel's position
- * (AddPanelPositionOptions) accept; dockview spells the two direction
- * types differently, so neither alias fits both call sites.
- */
-interface ZonePosition {
-  readonly referenceGroup: string;
-  readonly direction: Exclude<Direction, "within">;
-}
-
-/**
- * Placement for rebuilding a zone whose group is gone: the zone's own
- * side of the dock, anchored to a surviving group. "main" regrows beside
- * the left zone when it can, else beside the right zone. Returns undefined
- * when the dock has no groups at all - the first panel creates the first
- * group and becomes the zone by itself.
- */
-function rebuildPosition(zone: ZoneName): ZonePosition | undefined {
-  if (dock === null) {
-    return undefined;
-  }
-  const groups = dock.groups;
-  const first = groups[0];
-  if (first === undefined) {
-    return undefined;
-  }
-  if (zone === "main") {
-    const left = liveGroup("left");
-    if (left) {
-      return { referenceGroup: left.id, direction: "right" };
-    }
-    const right = liveGroup("right");
-    if (right) {
-      return { referenceGroup: right.id, direction: "left" };
-    }
-    return { referenceGroup: first.id, direction: "right" };
-  }
-  return { referenceGroup: first.id, direction: zone };
-}
-
-/** The tab title for one open: the type's title, computed when it is a function. */
-function titleFor(type: PanelType, params: PanelParams): string {
-  const title = panelTypeEntry(type)?.title;
-  if (title === undefined) {
-    return type;
-  }
-  return typeof title === "function" ? title(params) : title;
-}
-
-/**
- * Opens a panel in its zone: the user's recorded override first, then the
- * type's affinity. Reopening an already-open panel activates it. A live
- * zone group - empty or not - receives the panel; a zone whose group was
- * closed away is rebuilt on its side of the dock.
- */
-export function openInZone(type: PanelType, params: PanelParams): IDockviewPanel {
-  if (dock === null) {
-    throw new Error("openInZone called before initZones.");
-  }
-  const entry = panelTypeEntry(type);
-  if (entry === undefined) {
-    throw new Error(`openInZone called with the unregistered panel type "${type}".`);
-  }
-  const id = panelIdFor(type, params);
-  const existing = dock.getPanel(id);
-  if (existing) {
-    // Activating an open panel leaves its zone as it is: the boot re-opens
-    // every anchor, and a pane hidden last session must stay hidden.
-    existing.api.setActive();
-    return existing;
-  }
-  const state = zoneState();
-  const zone = state.overrideFor(id) ?? entry.defaultZone;
-  const group = liveGroup(zone);
-  const panel = dock.addPanel({
-    id,
-    component: entry.type,
-    title: titleFor(type, params),
-    params,
-    position: group ? { referenceGroup: group.id } : rebuildPosition(zone),
-  });
-  state.setGroup(zone, panel.group.id);
-  stampZones();
-  if (group === undefined && zone === "right") {
-    sizeNewRightGroup(panel.group);
-  }
-  revealGroupOf(panel);
-  return panel;
-}
-
-/** A newly opened panel shows its zone: a hidden group (the toggled-off chat pane) comes back. */
-function revealGroupOf(panel: IDockviewPanel): void {
-  // Only a group that says it is hidden is revealed; a dock double that
-  // reports nothing is left alone.
-  if (panel.group?.api?.isVisible !== false) {
-    return;
-  }
-  const zone = zoneState().zoneForGroupId(panel.group.id);
-  if (zone !== undefined) {
-    setZoneVisibility(zone, true);
-  }
-}
-
-/** The zone's live group, or undefined once it has closed away. */
-export function groupOfZone(zone: ZoneName): IDockviewGroupPanel | undefined {
-  return liveGroup(zone);
-}
-
-/**
- * Makes sure a zone has a live group, creating an empty one at the zone's
- * place in the dock when it has none. The default layout opens the main
- * zone this way, so the editor area - and the watermark an empty one shows -
- * exists before any document does. The group is recorded as the zone's, so
- * the first panel opened into the zone fills it rather than building
- * another. In a dock with no group at all there is nothing to place one
- * beside, so nothing is created; the first panel opened makes the first
- * group and becomes the zone by itself.
- */
-export function ensureZoneGroup(zone: ZoneName): void {
-  if (dock === null) {
-    throw new Error("ensureZoneGroup called before initZones.");
-  }
-  if (liveGroup(zone) !== undefined) {
-    return;
-  }
-  const position = rebuildPosition(zone);
-  if (position === undefined) {
-    return;
-  }
-  const group = dock.addGroup(position);
-  zoneState().setGroup(zone, group.id);
-  stampZones();
-}
-
-/**
- * Shows or hides a zone's live group and answers whether it was found.
- * The right zone's outcome also lands in the auxiliaryBarVisible key, the
- * one the Secondary Side Bar toggle and its menu row read.
- */
-export function setZoneVisibility(zone: ZoneName, visible: boolean): boolean {
-  const group = liveGroup(zone);
-  if (group === undefined) {
-    return false;
-  }
-  group.api.setVisible(visible);
-  if (zone === "right") {
-    getService(CONTEXT_KEY_SERVICE).createKey("auxiliaryBarVisible", true).set(visible);
-  }
-  return true;
-}
-
-/** Snapshots the zone map and placement overrides for layout persistence. */
-export function serializeZoneState(): ZoneState {
-  return zoneState().serialize();
-}
-
-/**
- * Replaces the zone map and overrides from persisted state. Entries
- * naming unknown zones or holding non-string values are dropped; stale
- * group ids self-heal because openInZone rebuilds a zone whose group no
- * longer exists.
- */
-export function restoreZoneState(zones: unknown, overrides: unknown): void {
-  zoneState().restore(zones, overrides);
-  stampZones();
-}
-
-/** Clears all zone state; the default-layout fallback starts from blank. */
-export function resetZones(): void {
-  zoneState().reset();
-}
diff --git a/crates/workshop/ui/src/parts/menu/edit.contribution.ts b/crates/workshop/ui/src/parts/menu/edit.contribution.ts
deleted file mode 100644
index 424fa3c79..000000000
--- a/crates/workshop/ui/src/parts/menu/edit.contribution.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-// The edit contribution: the six text-editing rows every text surface
-// shares, registered eagerly at module scope. Undo,
-// redo, and select-all route through the text-control service - the
-// focused widget's adapter when it reports history depth, the native
-// execCommand fallback otherwise; cut, copy, and paste are always the
-// native path, refocused onto the remembered editable so CodeMirror
-// and ProseMirror serve them through their clipboard events. Every
-// row declares the textInputFocus precondition, which the action
-// registry also ANDs into the keybinding rule, so the chords fire only
-// while a text control holds focus. The rows are workbench-level: no
-// weight, so the WorkbenchContrib default applies.
-//
-// The run bodies resolve the service at call time; this module pulls
-// no widget code into the initial bundle.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`edit action '${action.id}': ${result.error.message}`);
-  }
-}
-
-/** One catalog row: a text-control command with its menu and chord placement. */
-interface EditActionRow {
-  readonly id: string;
-  readonly title: string;
-  readonly menu: MenuId;
-  readonly group: string;
-  /** The position within the group, matching the spec's row order. */
-  readonly order: number;
-  readonly keybinding: string;
-  readonly run: () => void;
-}
-
-const editActions = [
-  { id: "undo", title: "Undo", menu: MenuId.MenubarEditMenu, group: "1_do", order: 1, keybinding: "ctrlcmd+z", run: () => getService(TEXT_CONTROL_SERVICE).undo() },
-  { id: "redo", title: "Redo", menu: MenuId.MenubarEditMenu, group: "1_do", order: 2, keybinding: "ctrlcmd+y", run: () => getService(TEXT_CONTROL_SERVICE).redo() },
-  { id: "editor.action.clipboardCutAction", title: "Cut", menu: MenuId.MenubarEditMenu, group: "2_ccp", order: 1, keybinding: "ctrlcmd+x", run: () => getService(TEXT_CONTROL_SERVICE).execCommand("cut") },
-  { id: "editor.action.clipboardCopyAction", title: "Copy", menu: MenuId.MenubarEditMenu, group: "2_ccp", order: 2, keybinding: "ctrlcmd+c", run: () => getService(TEXT_CONTROL_SERVICE).execCommand("copy") },
-  { id: "editor.action.clipboardPasteAction", title: "Paste", menu: MenuId.MenubarEditMenu, group: "2_ccp", order: 3, keybinding: "ctrlcmd+v", run: () => getService(TEXT_CONTROL_SERVICE).execCommand("paste") },
-  { id: "editor.action.selectAll", title: "Select All", menu: MenuId.MenubarSelectionMenu, group: "1_basic", order: 1, keybinding: "ctrlcmd+a", run: () => getService(TEXT_CONTROL_SERVICE).selectAll() },
-] satisfies readonly EditActionRow[];
-
-for (const row of editActions) {
-  addAction({
-    id: row.id,
-    title: row.title,
-    f1: true,
-    precondition: "textInputFocus",
-    keybinding: { keybinding: row.keybinding },
-    menu: [{ id: row.menu, group: row.group, order: row.order }],
-    run: row.run,
-  });
-}
diff --git a/crates/workshop/ui/src/parts/menu/index.ts b/crates/workshop/ui/src/parts/menu/index.ts
deleted file mode 100644
index 53cd33ac6..000000000
--- a/crates/workshop/ui/src/parts/menu/index.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-// The menu feature's entry point and the workbench menu's bootstrap.
-// setupWindowMenus imports the contribution surface - every action,
-// menu row, keybinding rule, and quick-access provider registers into
-// the shared registries at module scope - then starts the menubar on
-// the title bar's shipped-empty nav. The bar generates its buttons from
-// MenubarMainMenu's submenu rows in registry sort order, so the import
-// must settle before the bar mounts; module evaluation order guarantees
-// it. Tests and main.ts share this one entry point.
-
-import "../workbench.contributions";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { Menubar } from "./menubar";
-
-/**
- * Starts the title-bar menubar over the shipped empty nav. Throws if
- * the markup is missing. The returned disposable releases the bar: the
- * generated buttons, the shared popover, and every listener.
- */
-export function setupWindowMenus(): IDisposable {
-  const nav = document.querySelector<HTMLElement>(".ws-window-titlebar__menus");
-  if (!nav) {
-    throw new Error("DOM Error: .ws-window-titlebar__menus not found in the page.");
-  }
-  return new Menubar(nav);
-}
diff --git a/crates/workshop/ui/src/parts/menu/menu.ts b/crates/workshop/ui/src/parts/menu/menu.ts
deleted file mode 100644
index 4f394e677..000000000
--- a/crates/workshop/ui/src/parts/menu/menu.ts
+++ /dev/null
@@ -1,664 +0,0 @@
-// The menu popover widget: one self-sufficient popover that renders a
-// menu id from the registries and owns its own dismissal (Escape,
-// outside pointer, window blur). It takes only a MenuId, an anchor (an
-// element or a point), an optional context value passed as the first
-// run argument to every row, and an optional overlay of context keys, so
-// the menubar and the tab's context menu at a pointer position drive the
-// same widget. The overlay describes the menu's target (the clicked tab,
-// not the active one): its keys are read before the global context-key
-// service for every row's when, precondition and toggled, for submenus,
-// and for the keybinding labels.
-//
-// Rows are rebuilt from getMenuItems at every open: command rows versus
-// submenu rows, group boundaries render separators (there is no
-// separator row kind), and empty submenus are dropped. Per row: the
-// label is the item title else the command title, the shortcut comes
-// from the keybinding registry, a failing when hides the row, a failing
-// precondition renders aria-disabled, and a toggled expression renders
-// role=menuitemcheckbox with aria-checked. A submenu row owns the single
-// child-flyout slot - one child Menu at a time, opened 250ms after a hover
-// (at once on a click or ArrowRight), closed on ArrowLeft or 750ms after the
-// pointer moves to another row, recursive for nested flyouts. The delays
-// let the pointer cross a neighboring row on its way into the flyout.
-//
-// Rows fire on mouseup, so one gesture can press on the menubar button, drag
-// onto a row, and release to run it. The click that ends a mouse press
-// carries a click count and is ignored; a click with none (the keyboard's
-// Enter or Space, or a programmatic click) still activates the row.
-//
-// The popover stays on screen: a flyout flips to its parent row's left when
-// the right has no room, a context menu flips left and up, and a menubar
-// dropdown slides left. Its max height is the window height minus its top
-// minus 35px, and it scrolls under the 7px menu scrollbar past that.
-//
-// While open the widget subscribes to context-key changes and rebuilds
-// only when a key its rows reference changes, restoring focus by row key
-// so a rebuild mid-navigation never strands a keyboard user.
-
-import "./window-menu.css";
-
-import { ICON_CHECK, ICON_CHEVRON_RIGHT } from "@workshop/look/icons";
-import { Emitter } from "@workshop/platform/event";
-import { Disposable, DisposableStore, toDisposable } from "@workshop/platform/lifecycle";
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import { CONTEXT_KEY_SERVICE, type ContextKeyService } from "@workshop/platform/context-key-service";
-import { ContextKeyExpr } from "@workshop/platform/context-key-expr";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { Menus, type MenuId, type MenuItem, type MenuRegistry, type MenuRow, type SubmenuItem } from "@workshop/platform/menu-registry";
-import { getService } from "@workshop/platform/service-registry";
-
-/** Where the popover opens: below an element, or at a pointer position. */
-export type MenuAnchor = HTMLElement | { readonly x: number; readonly y: number };
-
-/** How long a hover rests on a submenu row before its flyout opens. */
-export const SUBMENU_SHOW_DELAY_MS = 250;
-/** How long an open flyout lingers after the pointer moves to another row. */
-export const SUBMENU_HIDE_DELAY_MS = 750;
-/** The gap a menu leaves under itself: its max height is the window's, minus its top, minus this. */
-const MENU_BOTTOM_MARGIN = 35;
-/** A floor for the max height, so a menu opened near the bottom edge never collapses to nothing. */
-const MIN_MENU_HEIGHT = 10;
-
-/** Context keys one open evaluates before the global context-key service. */
-export type MenuContextOverlay = Readonly<Record<string, unknown>>;
-
-/** Registry and service overrides; tests inject their own instances. */
-export interface MenuDependencies {
-  readonly menus?: MenuRegistry;
-  readonly commands?: CommandRegistry;
-  readonly contextKeys?: ContextKeyService;
-  readonly keybindings?: KeybindingsRegistry;
-}
-
-/** One rendered row: its stable key, element, and source registry row. */
-interface RowHandle {
-  readonly key: string;
-  readonly element: HTMLButtonElement;
-  readonly row: MenuRow;
-}
-
-/**
- * A menu popover bound to the registries. open() shows the menu anchored
- * to an element or point; close() dismisses the popover and any flyout.
- * The widget owns every dismissal path - Escape, outside pointer, window
- * blur - so composing widgets (the menubar) never track them.
- */
-export class Menu extends Disposable {
-  private readonly closeEmitter = new Emitter<void>();
-  /** Fires after the popover closes, however it was dismissed. */
-  readonly onDidClose = this.closeEmitter.event;
-  private readonly menus: MenuRegistry;
-  private readonly commands: CommandRegistry;
-  private readonly contextKeys: ContextKeyService;
-  private readonly keybindings: KeybindingsRegistry;
-
-  private popover: HTMLElement | null = null;
-  private rows: RowHandle[] = [];
-  private openMenuId: MenuId | null = null;
-  private anchor: MenuAnchor | null = null;
-  private context: unknown;
-  private overlay: MenuContextOverlay | undefined;
-  private watchedKeys: ReadonlySet<string> = new Set();
-  private openStore: DisposableStore | null = null;
-  private child: Menu | null = null;
-  private childRow: HTMLButtonElement | null = null;
-  private parent: Menu | null = null;
-  private parentRow: HTMLButtonElement | null = null;
-  // The hover timers: a pending flyout open and a pending flyout close.
-  private showTimer: ReturnType<typeof setTimeout> | null = null;
-  private hideTimer: ReturnType<typeof setTimeout> | null = null;
-
-  constructor(deps: MenuDependencies = {}) {
-    super();
-    this.menus = deps.menus ?? Menus;
-    this.commands = deps.commands ?? Commands;
-    this.contextKeys = deps.contextKeys ?? getService(CONTEXT_KEY_SERVICE);
-    this.keybindings = deps.keybindings ?? KeybindingsRegistry;
-    this._register(this.closeEmitter);
-    this._register(toDisposable(() => this.close()));
-    this._register(
-      toDisposable(() => {
-        this.popover?.remove();
-        this.popover = null;
-      }),
-    );
-  }
-
-  /** True while the popover is shown. */
-  get isOpen(): boolean {
-    return this.openMenuId !== null;
-  }
-
-  /** True while a submenu flyout is open; the flyout holds the keyboard. */
-  get hasOpenFlyout(): boolean {
-    return this.child !== null;
-  }
-
-  /** True when focus sits on one of this menu's own submenu rows. */
-  get focusIsOnSubmenuRow(): boolean {
-    const handle = this.focusedHandle();
-    return handle !== null && "submenu" in handle.row;
-  }
-
-  /** Moves focus to the first row, after a keyboard-driven open. */
-  focusFirstRow(): void {
-    this.focusRow(0);
-  }
-
-  /**
-   * Shows the menu's popover anchored to `anchor`, rebuilding its rows
-   * from the registry. `context` becomes the first run argument of every
-   * command row, and `overlay` answers its keys ahead of the global
-   * context for this open and its flyouts. Opening while open replaces
-   * the current menu.
-   */
-  open(menuId: MenuId, anchor: MenuAnchor, context?: unknown, overlay?: MenuContextOverlay): void {
-    this.close();
-    this.openMenuId = menuId;
-    this.anchor = anchor;
-    this.context = context;
-    this.overlay = overlay;
-    const popover = this.ensurePopover();
-    // A menu opened at a point is a context menu; one under an element is a
-    // dropdown. Only the context menu and the flyouts fade in.
-    popover.classList.toggle("ws-window-titlebar__popover--context", !(anchor instanceof HTMLElement));
-    this.rebuildRows();
-    // Shown before it is placed: a hidden element has no size to flip against.
-    popover.hidden = false;
-    this.positionPopover(anchor);
-
-    const store = new DisposableStore();
-    this.openStore = store;
-    store.add(
-      this.contextKeys.onDidChangeContext((change) => {
-        if (change.affectsSome(this.watchedKeys)) {
-          this.rebuildRows();
-        }
-      }),
-    );
-    const onKeydown = (event: KeyboardEvent): void => this.onKeydown(event);
-    document.addEventListener("keydown", onKeydown);
-    store.add(toDisposable(() => document.removeEventListener("keydown", onKeydown)));
-    const onPointerDown = (event: Event): void => {
-      const target = event.target;
-      if (target instanceof Node && this.containsInChain(target)) {
-        return;
-      }
-      this.close();
-    };
-    document.addEventListener("pointerdown", onPointerDown);
-    store.add(toDisposable(() => document.removeEventListener("pointerdown", onPointerDown)));
-    // A window losing focus (Alt+Tab, taskbar click) must not leave a
-    // stale popover covering the returned window.
-    const onWindowBlur = (): void => this.close();
-    window.addEventListener("blur", onWindowBlur);
-    store.add(toDisposable(() => window.removeEventListener("blur", onWindowBlur)));
-  }
-
-  /** Dismisses the popover and any open flyout. Safe when closed. */
-  close(): void {
-    this.clearShowTimer();
-    this.clearHideTimer();
-    if (this.openMenuId === null) {
-      return;
-    }
-    this.closeChild();
-    this.openStore?.dispose();
-    this.openStore = null;
-    this.openMenuId = null;
-    if (this.popover !== null) {
-      this.popover.hidden = true;
-    }
-    this.closeEmitter.fire();
-  }
-
-  private ensurePopover(): HTMLElement {
-    if (this.popover === null) {
-      const popover = document.createElement("div");
-      // scrollbar-menu is the look sheet's 7px menu bar, for a menu taller than the window.
-      popover.className = "ws-window-titlebar__popover scrollbar-menu";
-      if (this.parentRow !== null) {
-        // A flyout opens beside its parent row; the class sets the
-        // alignment offset (window-menu.css).
-        popover.classList.add("ws-window-titlebar__popover--flyout");
-        // The pointer reaching the flyout cancels the close its parent
-        // scheduled when the pointer left the submenu row.
-        popover.addEventListener("pointerenter", () => this.parent?.cancelHide());
-      }
-      popover.setAttribute("role", "menu");
-      popover.hidden = true;
-      document.body.appendChild(popover);
-      this.popover = popover;
-    }
-    return this.popover;
-  }
-
-  /**
-   * Places the shown popover so it stays on screen. A flyout opens beside
-   * its parent row and flips to the row's left when the right has no room,
-   * shifting up when it would run off the bottom; a context menu opens at
-   * the pointer and flips left and up; a dropdown opens under its element
-   * and slides left. The max height is then what the window leaves under
-   * the menu's top, less a 35px margin.
-   */
-  private positionPopover(anchor: MenuAnchor): void {
-    const popover = this.ensurePopover();
-    const viewportWidth = window.innerWidth;
-    const viewportHeight = window.innerHeight;
-    // Measure the natural size, so a stale max height never shrinks it.
-    popover.style.maxHeight = "";
-    const size = popover.getBoundingClientRect();
-    let left: number;
-    let top: number;
-    if (anchor instanceof HTMLElement) {
-      const rect = anchor.getBoundingClientRect();
-      if (this.parentRow !== null) {
-        left = rect.right + size.width > viewportWidth ? rect.left - size.width : rect.right;
-        top = Math.min(rect.top, viewportHeight - size.height);
-      } else {
-        left = Math.min(rect.left, viewportWidth - size.width);
-        top = rect.bottom;
-      }
-    } else {
-      left = anchor.x + size.width > viewportWidth ? anchor.x - size.width : anchor.x;
-      top = anchor.y + size.height > viewportHeight ? anchor.y - size.height : anchor.y;
-    }
-    left = Math.max(0, left);
-    top = Math.max(0, top);
-    popover.style.left = `${left}px`;
-    popover.style.top = `${top}px`;
-    popover.style.maxHeight = `${Math.max(MIN_MENU_HEIGHT, viewportHeight - top - MENU_BOTTOM_MARGIN)}px`;
-  }
-
-  /**
-   * Rebuilds the popover's rows from the registry. Wiping the popover
-   * destroys the focused row, so the focused row is remembered by its
-   * stable key (the command or submenu id, never the index) and focus
-   * lands on the equivalent new row - or the first row when it vanished.
-   */
-  private rebuildRows(): void {
-    const menuId = this.openMenuId;
-    if (menuId === null) {
-      return;
-    }
-    const popover = this.ensurePopover();
-    const focusedKey = this.rows.find((row) => row.element === document.activeElement)?.key;
-    // The flyout's rows derive from the old row set; it reopens on the
-    // next hover or ArrowRight. A pending hover open belongs to a row about
-    // to be replaced, so it goes too.
-    this.clearShowTimer();
-    this.closeChild();
-    popover.textContent = "";
-    this.rows = [];
-    const watched = new Set<string>();
-    let lastGroup: string | null = null;
-    for (const row of this.menus.getMenuItems(menuId)) {
-      if (!this.matches(row.when, watched)) {
-        continue;
-      }
-      if ("submenu" in row && !this.hasVisibleRows(row.submenu, new Set([menuId]), watched)) {
-        continue;
-      }
-      const group = row.group ?? "navigation";
-      if (lastGroup !== null && group !== lastGroup) {
-        const separator = document.createElement("div");
-        separator.className = "ws-window-titlebar__separator";
-        separator.setAttribute("role", "separator");
-        popover.appendChild(separator);
-      }
-      lastGroup = group;
-      const handle = "submenu" in row ? this.buildSubmenuRow(row) : this.buildCommandRow(row, watched);
-      this.rows.push(handle);
-      popover.appendChild(handle.element);
-    }
-    this.watchedKeys = watched;
-    if (focusedKey !== undefined) {
-      const restored = this.rows.find((row) => row.key === focusedKey) ?? this.rows[0];
-      restored?.element.focus();
-    }
-  }
-
-  /**
-   * True when the menu has at least one row that would render: a command
-   * whose when passes, or a submenu with visible rows of its own. The
-   * seen set breaks submenu cycles, which render as empty.
-   */
-  private hasVisibleRows(menuId: MenuId, seen: ReadonlySet<string>, watched: Set<string>): boolean {
-    if (seen.has(menuId)) {
-      return false;
-    }
-    const nextSeen = new Set(seen).add(menuId);
-    for (const row of this.menus.getMenuItems(menuId)) {
-      if (!this.matches(row.when, watched)) {
-        continue;
-      }
-      if ("submenu" in row) {
-        if (this.hasVisibleRows(row.submenu, nextSeen, watched)) {
-          return true;
-        }
-      } else {
-        return true;
-      }
-    }
-    return false;
-  }
-
-  /**
-   * Evaluates a when/precondition/toggled string against the context
-   * keys, recording the referenced keys for change filtering. Undefined
-   * always matches; a malformed string never matches - registration is
-   * where malformed strings are reported, so the row hides or disables
-   * rather than throwing at render.
-   */
-  private matches(text: string | undefined, watched: Set<string>): boolean {
-    if (text === undefined) {
-      return true;
-    }
-    const result = ContextKeyExpr.deserialize(text);
-    if (!result.ok) {
-      return false;
-    }
-    for (const key of result.value.keys()) {
-      watched.add(key);
-    }
-    return result.value.evaluate((key) => this.lookupKey(key));
-  }
-
-  /** A context key's value: the open's overlay first, then the global service. */
-  private lookupKey(key: string): unknown {
-    if (this.overlay !== undefined && Object.hasOwn(this.overlay, key)) {
-      return this.overlay[key];
-    }
-    return this.contextKeys.getValue(key);
-  }
-
-  private buildCommandRow(item: MenuItem, watched: Set<string>): RowHandle {
-    const action = this.commands.lookup(item.command);
-    // A placement without its command is a registration-order bug;
-    // render it disabled and labelled rather than dropping it silently.
-    const enabled = action !== undefined && this.matches(action.precondition, watched);
-    const element = document.createElement("button");
-    element.type = "button";
-    element.className = "ws-window-titlebar__item";
-    element.dataset["menuRowKey"] = item.command;
-    element.setAttribute("aria-disabled", enabled ? "false" : "true");
-    if (action?.toggled !== undefined) {
-      element.classList.add("ws-window-titlebar__item--checkable");
-      element.setAttribute("role", "menuitemcheckbox");
-      const checked = this.matches(action.toggled, watched);
-      element.setAttribute("aria-checked", checked ? "true" : "false");
-      const check = document.createElement("span");
-      check.className = "ws-window-titlebar__item-check";
-      check.setAttribute("aria-hidden", "true");
-      check.innerHTML = checked ? ICON_CHECK : "";
-      element.appendChild(check);
-    } else {
-      element.setAttribute("role", "menuitem");
-    }
-    const label = document.createElement("span");
-    label.className = "ws-window-titlebar__item-label";
-    label.textContent = item.title ?? action?.title ?? item.command;
-    element.appendChild(label);
-    const shortcut = this.keybindings.lookupKeybinding(item.command, (key) => this.lookupKey(key))?.getLabel();
-    if (shortcut !== undefined) {
-      const hint = document.createElement("span");
-      hint.className = "ws-window-titlebar__shortcut";
-      hint.textContent = shortcut;
-      element.appendChild(hint);
-    }
-    const handle: RowHandle = { key: item.command, element, row: item };
-    // A command fires on a primary-button release, so a press can start on
-    // the menubar button and end on the row. The click a mouse press ends
-    // carries a click count and is skipped; a keyboard or programmatic
-    // click has none and activates here.
-    element.addEventListener("mouseup", (event) => {
-      if (event.button === 0) {
-        this.activateCommand(handle);
-      }
-    });
-    element.addEventListener("click", (event) => {
-      if (!(event.detail > 0)) {
-        this.activateCommand(handle);
-      }
-    });
-    element.addEventListener("pointerenter", () => this.onRowEnter(handle));
-    return handle;
-  }
-
-  private buildSubmenuRow(item: SubmenuItem): RowHandle {
-    const element = document.createElement("button");
-    element.type = "button";
-    element.className = "ws-window-titlebar__item";
-    element.dataset["menuRowKey"] = item.submenu;
-    element.setAttribute("role", "menuitem");
-    element.setAttribute("aria-haspopup", "menu");
-    element.setAttribute("aria-expanded", "false");
-    const label = document.createElement("span");
-    label.className = "ws-window-titlebar__item-label";
-    label.textContent = item.title;
-    element.appendChild(label);
-    const chevron = document.createElement("span");
-    chevron.className = "ws-window-titlebar__chevron";
-    chevron.setAttribute("aria-hidden", "true");
-    chevron.innerHTML = ICON_CHEVRON_RIGHT;
-    element.appendChild(chevron);
-    const handle: RowHandle = { key: item.submenu, element, row: item };
-    element.addEventListener("pointerenter", () => this.onRowEnter(handle));
-    element.addEventListener("click", () => this.openChild(handle, true));
-    return handle;
-  }
-
-  /**
-   * The pointer entered a row. A submenu row schedules its flyout 250ms out
-   * (replacing a pending open for another row; an already open flyout for
-   * this row just cancels any pending close). A command row cancels a
-   * pending open and, when a flyout is open, schedules its close 750ms out.
-   */
-  private onRowEnter(handle: RowHandle): void {
-    this.clearShowTimer();
-    if ("submenu" in handle.row) {
-      this.clearHideTimer();
-      if (this.child !== null && this.childRow === handle.element) {
-        return;
-      }
-      this.showTimer = setTimeout(() => {
-        this.showTimer = null;
-        this.openChild(handle, false);
-      }, SUBMENU_SHOW_DELAY_MS);
-      return;
-    }
-    if (this.child !== null && this.hideTimer === null) {
-      // The earliest departure wins: moving between command rows does not
-      // push the close back.
-      this.hideTimer = setTimeout(() => {
-        this.hideTimer = null;
-        this.closeChild();
-      }, SUBMENU_HIDE_DELAY_MS);
-    }
-  }
-
-  private clearShowTimer(): void {
-    if (this.showTimer !== null) {
-      clearTimeout(this.showTimer);
-      this.showTimer = null;
-    }
-  }
-
-  private clearHideTimer(): void {
-    if (this.hideTimer !== null) {
-      clearTimeout(this.hideTimer);
-      this.hideTimer = null;
-    }
-  }
-
-  /** The pointer reached this menu's flyout: cancel the pending close, up the chain. */
-  private cancelHide(): void {
-    this.clearHideTimer();
-    this.parent?.cancelHide();
-  }
-
-  private activateCommand(handle: RowHandle): void {
-    const row = handle.row;
-    if ("submenu" in row || handle.element.getAttribute("aria-disabled") === "true") {
-      return;
-    }
-    const args: readonly unknown[] =
-      this.context === undefined ? (row.args ?? []) : [this.context, ...(row.args ?? [])];
-    // Close the whole chain first, so a command that opens a surface
-    // never stacks it under a stale popover.
-    this.closeRoot();
-    // The registry reports the failure (the toast); keep the detail.
-    void this.commands.execute(row.command, ...args).catch((error: unknown) => {
-      logCommandFailure(row.command, error);
-    });
-  }
-
-  private openChild(handle: RowHandle, focusFirst: boolean): void {
-    const row = handle.row;
-    if (!("submenu" in row)) {
-      return;
-    }
-    if (this.child !== null && this.childRow === handle.element) {
-      return;
-    }
-    this.clearShowTimer();
-    this.closeChild();
-    const child = new Menu({
-      menus: this.menus,
-      commands: this.commands,
-      contextKeys: this.contextKeys,
-      keybindings: this.keybindings,
-    });
-    child.parent = this;
-    child.parentRow = handle.element;
-    this.child = child;
-    this.childRow = handle.element;
-    handle.element.setAttribute("aria-expanded", "true");
-    child.open(row.submenu, handle.element, this.context, this.overlay);
-    if (focusFirst) {
-      child.focusRow(0);
-    }
-  }
-
-  private closeChild(): void {
-    this.clearHideTimer();
-    const child = this.child;
-    this.child = null;
-    if (child !== null) {
-      child.parent = null;
-      child.close();
-      child.dispose();
-    }
-    this.childRow?.setAttribute("aria-expanded", "false");
-    this.childRow = null;
-  }
-
-  /** Detaches a flyout that closed itself (Escape, ArrowLeft). */
-  private releaseChild(child: Menu): void {
-    if (this.child !== child) {
-      return;
-    }
-    this.clearHideTimer();
-    this.child = null;
-    child.dispose();
-    this.childRow?.setAttribute("aria-expanded", "false");
-    this.childRow = null;
-  }
-
-  private closeRoot(): void {
-    let root: Menu = this;
-    while (root.parent !== null) {
-      root = root.parent;
-    }
-    root.close();
-  }
-
-  /** Closes this popover, returning focus to the parent row or anchor. */
-  private closeSelf(): void {
-    const parent = this.parent;
-    const returnFocus = this.parentRow ?? (this.anchor instanceof HTMLElement ? this.anchor : null);
-    this.close();
-    parent?.releaseChild(this);
-    returnFocus?.focus();
-  }
-
-  private containsInChain(target: Node): boolean {
-    if (this.popover?.contains(target) === true) {
-      return true;
-    }
-    // The anchor is the menu's own chrome: pressing it toggles the menu
-    // (the menubar's click handler), so it must not read as an outside
-    // press that dismisses the popover first.
-    if (this.anchor instanceof HTMLElement && this.anchor.contains(target)) {
-      return true;
-    }
-    return this.child?.containsInChain(target) ?? false;
-  }
-
-  private focusedHandle(): RowHandle | null {
-    return this.rows.find((row) => row.element === document.activeElement) ?? null;
-  }
-
-  private focusRow(index: number): void {
-    this.rows[index]?.element.focus();
-  }
-
-  private moveFocus(delta: number): void {
-    const count = this.rows.length;
-    if (count === 0) {
-      return;
-    }
-    const current = this.rows.findIndex((row) => row.element === document.activeElement);
-    const next = current === -1 ? (delta > 0 ? 0 : count - 1) : (current + delta + count) % count;
-    this.focusRow(next);
-  }
-
-  private onKeydown(event: KeyboardEvent): void {
-    // While a flyout is open it holds the keyboard; this menu's turn
-    // resumes when the flyout closes.
-    if (this.child !== null) {
-      return;
-    }
-    switch (event.key) {
-      case "Escape":
-        event.preventDefault();
-        this.closeSelf();
-        break;
-      case "ArrowDown":
-        event.preventDefault();
-        this.moveFocus(1);
-        break;
-      case "ArrowUp":
-        event.preventDefault();
-        this.moveFocus(-1);
-        break;
-      case "ArrowRight": {
-        const handle = this.focusedHandle();
-        if (handle !== null && "submenu" in handle.row) {
-          event.preventDefault();
-          this.openChild(handle, true);
-        }
-        break;
-      }
-      case "ArrowLeft":
-        if (this.parentRow !== null) {
-          event.preventDefault();
-          this.closeSelf();
-        }
-        break;
-      case "Enter": {
-        const handle = this.focusedHandle();
-        if (handle !== null) {
-          // preventDefault also suppresses the button's native click.
-          event.preventDefault();
-          if ("submenu" in handle.row) {
-            this.openChild(handle, true);
-          } else {
-            this.activateCommand(handle);
-          }
-        }
-        break;
-      }
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/menu/menubar.contribution.ts b/crates/workshop/ui/src/parts/menu/menubar.contribution.ts
deleted file mode 100644
index 625fb45c4..000000000
--- a/crates/workshop/ui/src/parts/menu/menubar.contribution.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-// The menubar contribution: the menu tree's skeleton,
-// registered eagerly at module scope, before any service exists. The
-// eight top-level rows on MenubarMainMenu - File, Edit, Selection,
-// View, Go, Run, Terminal, Help - plus the fourteen nested submenu
-// declarations: a top-level menu is a SubmenuItem on the root menu and
-// a flyout is a SubmenuItem on another menu, so the whole tree is rows
-// in the one registry and the menubar widget generates its buttons from
-// the root's sort order.
-//
-// Only the skeleton lives here: every command row arrives with its
-// action from the feature contributions (or the stub table). File > New
-// Window with Profile's dynamic profile rows have no backing store -
-// the workshop has no window profiles - so that flyout holds only its
-// static New Profile... stub. Open Recent's dynamic rows come from the
-// workspace contribution's provider, not from this table.
-//
-// Placements follow the spec's row order: the root menu's rows stay
-// groupless (the navigation default) with explicit orders, and each
-// nested row names its parent menu's group so the separators fall where
-// the spec has them.
-
-import { appendMenuItem, MenuId } from "@workshop/platform/menu-registry";
-
-/** One submenu declaration: the parent menu, the flyout it opens, and the row's placement. */
-interface SubmenuRow {
-  /** The menu the row lands in. */
-  readonly menu: MenuId;
-  /** The menu id the row opens. */
-  readonly submenu: MenuId;
-  /** The row label. */
-  readonly title: string;
-  /** The sort group; the root menu's rows stay groupless. */
-  readonly group?: string;
-  /** The position within the group, matching the spec's row order. */
-  readonly order?: number;
-}
-
-const submenuRows = [
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarFileMenu, title: "File", order: 1 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarEditMenu, title: "Edit", order: 2 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarSelectionMenu, title: "Selection", order: 3 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarViewMenu, title: "View", order: 4 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarGoMenu, title: "Go", order: 5 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarRunMenu, title: "Run", order: 6 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarTerminalMenu, title: "Terminal", order: 7 },
-  { menu: MenuId.MenubarMainMenu, submenu: MenuId.MenubarHelpMenu, title: "Help", order: 8 },
-  { menu: MenuId.MenubarFileMenu, submenu: "menubar/file/newWindowWithProfile", title: "New Window with Profile", group: "1_new", order: 4 },
-  { menu: MenuId.MenubarFileMenu, submenu: MenuId.MenubarRecentMenu, title: "Open Recent", group: "2_open", order: 4 },
-  { menu: MenuId.MenubarFileMenu, submenu: "menubar/file/share", title: "Share", group: "4_share", order: 1 },
-  { menu: MenuId.MenubarFileMenu, submenu: "menubar/file/preferences", title: "Preferences", group: "5_settings", order: 3 },
-  { menu: "menubar/file/preferences", submenu: "menubar/file/preferences/themes", title: "Themes", group: "1_settings", order: 7 },
-  { menu: MenuId.MenubarViewMenu, submenu: "menubar/view/appearance", title: "Appearance", group: "2_submenus", order: 1 },
-  { menu: MenuId.MenubarViewMenu, submenu: "menubar/view/editorLayout", title: "Editor Layout", group: "2_submenus", order: 2 },
-  { menu: "menubar/view/appearance", submenu: "menubar/view/appearance/panelPosition", title: "Panel Position", group: "3_panel_layout", order: 2 },
-  { menu: "menubar/view/appearance", submenu: "menubar/view/appearance/alignPanel", title: "Align Panel", group: "3_panel_layout", order: 3 },
-  { menu: "menubar/view/appearance", submenu: "menubar/view/appearance/tabBar", title: "Tab Bar", group: "3_panel_layout", order: 4 },
-  { menu: "menubar/view/appearance", submenu: "menubar/view/appearance/editorActionsPosition", title: "Editor Actions Position", group: "3_panel_layout", order: 5 },
-  { menu: MenuId.MenubarGoMenu, submenu: "menubar/go/switchEditor", title: "Switch Editor", group: "2_switch", order: 1 },
-  { menu: MenuId.MenubarGoMenu, submenu: "menubar/go/switchGroup", title: "Switch Group", group: "2_switch", order: 2 },
-  { menu: MenuId.MenubarRunMenu, submenu: "menubar/run/newBreakpoint", title: "New Breakpoint", group: "4_breakpoints", order: 2 },
-] satisfies readonly SubmenuRow[];
-
-for (const row of submenuRows) {
-  appendMenuItem(row.menu, { submenu: row.submenu, title: row.title, group: row.group, order: row.order });
-}
diff --git a/crates/workshop/ui/src/parts/menu/menubar.ts b/crates/workshop/ui/src/parts/menu/menubar.ts
deleted file mode 100644
index 6e94ff655..000000000
--- a/crates/workshop/ui/src/parts/menu/menubar.ts
+++ /dev/null
@@ -1,178 +0,0 @@
-// The menubar: the title bar's top-level menu buttons, generated from
-// the MenubarMainMenu submenu rows in registry sort order, plus the
-// bar-level interaction - click toggles a menu, rollover switches while
-// one is open (a press opens a menu on mousedown, a keyboard click on the
-// focused button toggles it), ArrowLeft/ArrowRight move between menus. The popovers
-// belong to the Menu widget (menu.ts); the bar composes one Menu and
-// never tracks dismissal, which the widget owns (Escape, outside
-// pointer, window blur).
-//
-// data-menu holds the menu id's last segment, so the selectors the
-// tests key on ("file", "edit", ...) survive the move from static markup
-// to generated buttons. The shipped nav is empty; the menu feature's
-// bootstrap (parts/menu/index.ts) fills it through this generator at boot.
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { MenuId, Menus, type SubmenuItem } from "@workshop/platform/menu-registry";
-import { Menu, type MenuDependencies } from "./menu";
-
-/** The menu id's last segment: "menubar/file" -> "file". */
-function lastSegment(id: MenuId): string {
-  return id.slice(id.lastIndexOf("/") + 1);
-}
-
-/**
- * Generates one menubar button per submenu row, in the order given.
- * Buttons are <button type="button"> with the shared menu class,
- * data-menu set to the menu id's last segment, and the collapsed
- * aria-haspopup state. The caller owns the returned buttons.
- */
-export function appendMenubarButtons(
-  nav: HTMLElement,
-  items: readonly SubmenuItem[],
-): readonly HTMLButtonElement[] {
-  const buttons: HTMLButtonElement[] = [];
-  for (const item of items) {
-    const button = document.createElement("button");
-    button.type = "button";
-    button.className = "ws-window-titlebar__menu";
-    button.dataset["menu"] = lastSegment(item.submenu);
-    button.setAttribute("aria-haspopup", "menu");
-    button.setAttribute("aria-expanded", "false");
-    button.textContent = item.title;
-    nav.appendChild(button);
-    buttons.push(button);
-  }
-  return buttons;
-}
-
-/** One generated button and the menu it opens. */
-interface BarEntry {
-  readonly button: HTMLButtonElement;
-  readonly menuId: MenuId;
-}
-
-/**
- * The title-bar menubar. The buttons come from MenubarMainMenu's
- * submenu rows at construction time: contributions register at module
- * scope, before the bar mounts. One shared Menu widget shows the open
- * menu's popover anchored to its button; the bar tracks only which
- * button is open, for aria-expanded, rollover, and arrow-key stepping.
- */
-export class Menubar extends Disposable {
-  private readonly menu: Menu;
-  private readonly entries: readonly BarEntry[];
-  private openEntry: BarEntry | null = null;
-
-  constructor(nav: HTMLElement, deps: MenuDependencies = {}) {
-    super();
-    const menus = deps.menus ?? Menus;
-    const items = menus
-      .getMenuItems(MenuId.MenubarMainMenu)
-      .filter((row): row is SubmenuItem => "submenu" in row);
-    const buttons = appendMenubarButtons(nav, items);
-    this.entries = items.map((item, index) => {
-      const button = buttons[index];
-      if (button === undefined) {
-        throw new Error("DOM Error: menubar button generation lost a row.");
-      }
-      return { button, menuId: item.submenu };
-    });
-    this.menu = this._register(new Menu(deps));
-    this._register(
-      toDisposable(() => {
-        for (const button of buttons) {
-          button.remove();
-        }
-      }),
-    );
-    this._register(
-      this.menu.onDidClose(() => {
-        this.openEntry?.button.setAttribute("aria-expanded", "false");
-        this.openEntry = null;
-      }),
-    );
-    for (const entry of this.entries) {
-      const toggle = (): void => {
-        if (this.openEntry === entry && this.menu.isOpen) {
-          this.menu.close();
-        } else {
-          this.openMenu(entry, false);
-        }
-      };
-      // A menu opens on mousedown, so the same press can drag onto a row
-      // and release to run it. The click that ends a mouse press carries a
-      // click count and is skipped; a click with none (Enter or Space on
-      // the focused button) still toggles.
-      const onMouseDown = (event: MouseEvent): void => {
-        if (event.button === 0) {
-          toggle();
-        }
-      };
-      const onClick = (event: MouseEvent): void => {
-        if (!(event.detail > 0)) {
-          toggle();
-        }
-      };
-      entry.button.addEventListener("mousedown", onMouseDown);
-      this._register(toDisposable(() => entry.button.removeEventListener("mousedown", onMouseDown)));
-      entry.button.addEventListener("click", onClick);
-      this._register(toDisposable(() => entry.button.removeEventListener("click", onClick)));
-      // Menubar rollover: while any menu is open, hovering another
-      // button switches the open menu to it. With no menu open, hover
-      // alone opens nothing.
-      const onEnter = (): void => {
-        if (this.menu.isOpen && this.openEntry !== entry) {
-          this.openMenu(entry, false);
-        }
-      };
-      entry.button.addEventListener("pointerenter", onEnter);
-      this._register(toDisposable(() => entry.button.removeEventListener("pointerenter", onEnter)));
-    }
-    const onKeydown = (event: KeyboardEvent): void => this.onKeydown(event);
-    document.addEventListener("keydown", onKeydown);
-    this._register(toDisposable(() => document.removeEventListener("keydown", onKeydown)));
-  }
-
-  private openMenu(entry: BarEntry, focusFirst: boolean): void {
-    if (this.openEntry === entry && this.menu.isOpen) {
-      return;
-    }
-    // open() closes any current menu first, which fires onDidClose and
-    // collapses the previous button before this one expands.
-    this.menu.open(entry.menuId, entry.button);
-    this.openEntry = entry;
-    entry.button.setAttribute("aria-expanded", "true");
-    if (focusFirst) {
-      this.menu.focusFirstRow();
-    }
-  }
-
-  /**
-   * ArrowLeft/ArrowRight step between menus. The bar yields to the
-   * widget whenever the key belongs to flyout navigation: while a
-   * flyout is open it owns both arrows, and ArrowRight on a submenu row
-   * opens the flyout instead of switching menus.
-   */
-  private onKeydown(event: KeyboardEvent): void {
-    if (!this.menu.isOpen || this.openEntry === null) {
-      return;
-    }
-    if (event.key !== "ArrowLeft" && event.key !== "ArrowRight") {
-      return;
-    }
-    if (this.menu.hasOpenFlyout) {
-      return;
-    }
-    if (event.key === "ArrowRight" && this.menu.focusIsOnSubmenuRow) {
-      return;
-    }
-    event.preventDefault();
-    const current = this.entries.indexOf(this.openEntry);
-    const delta = event.key === "ArrowRight" ? 1 : -1;
-    const next = this.entries[(current + delta + this.entries.length) % this.entries.length];
-    if (next !== undefined) {
-      this.openMenu(next, true);
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/menu/stubs.contribution.ts b/crates/workshop/ui/src/parts/menu/stubs.contribution.ts
deleted file mode 100644
index 08fc66b2a..000000000
--- a/crates/workshop/ui/src/parts/menu/stubs.contribution.ts
+++ /dev/null
@@ -1,251 +0,0 @@
-// The stub table: every menu row Cursor shows that the
-// workshop cannot back yet, registered eagerly at module scope under its
-// VS Code command id with precondition "false" and a no-op run, so the
-// row renders disabled with its final name and shortcut and implementing
-// it later means deleting the row here and adding a registerAction in
-// the owning feature - no menu, test, or keybinding changes. The
-// precondition is also ANDed into the keybinding rule's when, so a
-// stub's chord never dispatches; it exists so the disabled row renders
-// its shortcut label.
-//
-// Rows Cursor shows checked that cannot be backed (Menu Bar, Panel)
-// declare a constant-true toggled; the other checkable stubs (Auto Save,
-// Minimap, Sticky Scroll, and the radio flyouts) declare constant
-// expressions with one default checked per radio group. Cursor-only
-// rows with no public id (Open Browser, the Add Symbol rows, Give
-// Feedback, Online Services Settings) use ids under the
-// workbench.action.* namespace.
-//
-// Emmet: Expand Abbreviation is the one row whose spec chord (Tab) is
-// not registered: the dispatcher swallows any claimed chord even when
-// its when fails, so a Tab rule would eat Tab in every editor. The row
-// renders without a shortcut label until it is implemented.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { appendMenuItem, MenuId } from "@workshop/platform/menu-registry";
-
-/** One stub row: a disabled command with its menu placement and shortcut label. */
-interface StubRow {
-  /** The command id, VS Code's where one is public. */
-  readonly id: string;
-  /** The row label. */
-  readonly title: string;
-  /** The menu the row lands in. */
-  readonly menu: MenuId;
-  /** The sort group, so separators fall where the spec has them. */
-  readonly group: string;
-  /** The position within the group, matching the spec's row order. */
-  readonly order: number;
-  /** The spec's chord, bound so the disabled row renders its label. */
-  readonly keybinding?: string;
-  /** The constant toggled expression on checkable rows. */
-  readonly toggled?: string;
-}
-
-const stubRows = [
-  // File
-  { id: "workbench.action.newWindow", title: "New Window", menu: MenuId.MenubarFileMenu, group: "1_new", order: 2, keybinding: "ctrlcmd+shift+n" },
-  // Open Workspace from File..., Save Workspace As..., and Duplicate Workspace are wired by the workspace-document contribution.
-  { id: "workbench.action.toggleAutoSave", title: "Auto Save", menu: MenuId.MenubarFileMenu, group: "5_settings", order: 2, toggled: "false" },
-  { id: "workbench.action.closeFolder", title: "Close Folder", menu: MenuId.MenubarFileMenu, group: "6_close", order: 3, keybinding: "ctrlcmd+m f" },
-  // File > New Window with Profile (the dynamic profile rows have no backing store)
-  { id: "workbench.profiles.actions.createProfile", title: "New Profile...", menu: "menubar/file/newWindowWithProfile", group: "2_new", order: 1 },
-  // File > Share (Cursor offers only the export, labeled for the Default profile)
-  { id: "workbench.profiles.actions.exportProfile", title: "Export Profile (Default)...", menu: "menubar/file/share", group: "1_profiles", order: 1 },
-  // File > Preferences (Settings is wired by the gateway contribution; Extensions and Tasks land here as second placements below)
-  { id: "workbench.profiles.actions.manageProfiles", title: "Profiles", menu: "menubar/file/preferences", group: "1_settings", order: 1 },
-  { id: "workbench.action.openGlobalKeybindings", title: "Keyboard Shortcuts", menu: "menubar/file/preferences", group: "1_settings", order: 4, keybinding: "ctrlcmd+m ctrlcmd+s" },
-  { id: "workbench.action.openSnippets", title: "Configure Snippets", menu: "menubar/file/preferences", group: "1_settings", order: 5 },
-  { id: "workbench.action.openOnlineServicesSettings", title: "Online Services Settings", menu: "menubar/file/preferences", group: "2_online", order: 1 },
-  // File > Preferences > Themes
-  { id: "workbench.action.selectTheme", title: "Color Theme", menu: "menubar/file/preferences/themes", group: "1_themes", order: 1, keybinding: "ctrlcmd+m ctrlcmd+t" },
-  { id: "workbench.action.selectIconTheme", title: "File Icon Theme", menu: "menubar/file/preferences/themes", group: "1_themes", order: 2 },
-  { id: "workbench.action.selectProductIconTheme", title: "Product Icon Theme", menu: "menubar/file/preferences/themes", group: "1_themes", order: 3 },
-  // Edit
-  { id: "workbench.action.findInFiles", title: "Find in Files", menu: MenuId.MenubarEditMenu, group: "4_findInFiles", order: 1, keybinding: "ctrlcmd+shift+f" },
-  { id: "workbench.action.replaceInFiles", title: "Replace in Files", menu: MenuId.MenubarEditMenu, group: "4_findInFiles", order: 2, keybinding: "ctrlcmd+shift+h" },
-  { id: "editor.emmet.action.expandAbbreviation", title: "Emmet: Expand Abbreviation", menu: MenuId.MenubarEditMenu, group: "5_insert", order: 3 },
-  // Selection
-  { id: "editor.action.toggleMultiCursorModifier", title: "Switch to Ctrl+Click for Multi-Cursor", menu: MenuId.MenubarSelectionMenu, group: "4_config", order: 1 },
-  // View
-  // Ctrl+Q, not the quit chord: the native menu's quit accelerator is macOS-only, so Open View claims it elsewhere.
-  { id: "workbench.action.quickOpenView", title: "Open View...", menu: MenuId.MenubarViewMenu, group: "1_open", order: 2, keybinding: "ctrl+q" },
-  { id: "workbench.view.search", title: "Search", menu: MenuId.MenubarViewMenu, group: "3_views", order: 2, keybinding: "ctrlcmd+shift+f" },
-  { id: "workbench.view.scm", title: "Source Control", menu: MenuId.MenubarViewMenu, group: "3_views", order: 3, keybinding: "ctrlcmd+shift+g" },
-  { id: "workbench.view.debug", title: "Run", menu: MenuId.MenubarViewMenu, group: "3_views", order: 4, keybinding: "ctrlcmd+shift+d" },
-  { id: "workbench.view.extensions", title: "Extensions", menu: MenuId.MenubarViewMenu, group: "3_views", order: 5, keybinding: "ctrlcmd+shift+x" },
-  { id: "workbench.actions.view.problems", title: "Problems", menu: MenuId.MenubarViewMenu, group: "4_panels", order: 1, keybinding: "ctrlcmd+shift+m" },
-  { id: "workbench.action.output.toggleOutput", title: "Output", menu: MenuId.MenubarViewMenu, group: "4_panels", order: 2, keybinding: "ctrlcmd+shift+u" },
-  { id: "workbench.debug.action.toggleRepl", title: "Debug Console", menu: MenuId.MenubarViewMenu, group: "4_panels", order: 3, keybinding: "ctrlcmd+shift+alt+y" },
-  { id: "workbench.action.terminal.toggleTerminal", title: "Terminal", menu: MenuId.MenubarViewMenu, group: "4_panels", order: 4, keybinding: "ctrlcmd+`" },
-  // View > Appearance
-  { id: "workbench.action.toggleZenMode", title: "Zen Mode", menu: "menubar/view/appearance", group: "1_toggle_view", order: 2, keybinding: "ctrlcmd+m z" },
-  { id: "workbench.action.toggleCenteredLayout", title: "Centered Layout", menu: "menubar/view/appearance", group: "1_toggle_view", order: 3 },
-  { id: "workbench.action.openBrowser", title: "Open Browser", menu: "menubar/view/appearance", group: "1_toggle_view", order: 4 },
-  { id: "workbench.action.toggleMenuBar", title: "Menu Bar", menu: "menubar/view/appearance", group: "2_workbench_layout", order: 1, toggled: "true" },
-  { id: "workbench.action.togglePanel", title: "Panel", menu: "menubar/view/appearance", group: "2_workbench_layout", order: 5, keybinding: "ctrlcmd+j", toggled: "true" },
-  { id: "workbench.action.toggleSidebarPosition", title: "Move Primary Side Bar Right", menu: "menubar/view/appearance", group: "3_panel_layout", order: 1 },
-  { id: "editor.action.toggleMinimap", title: "Minimap", menu: "menubar/view/appearance", group: "4_editor", order: 1, toggled: "false" },
-  { id: "breadcrumbs.toggle", title: "Toggle Breadcrumbs", menu: "menubar/view/appearance", group: "4_editor", order: 2 },
-  { id: "editor.action.toggleStickyScroll", title: "Sticky Scroll", menu: "menubar/view/appearance", group: "4_editor", order: 3, toggled: "false" },
-  // View > Appearance > Panel Position (radio; Bottom is the default)
-  { id: "workbench.action.positionPanelTop", title: "Top", menu: "menubar/view/appearance/panelPosition", group: "1_position", order: 1, toggled: "false" },
-  { id: "workbench.action.positionPanelLeft", title: "Left", menu: "menubar/view/appearance/panelPosition", group: "1_position", order: 2, toggled: "false" },
-  { id: "workbench.action.positionPanelRight", title: "Right", menu: "menubar/view/appearance/panelPosition", group: "1_position", order: 3, toggled: "false" },
-  { id: "workbench.action.positionPanelBottom", title: "Bottom", menu: "menubar/view/appearance/panelPosition", group: "1_position", order: 4, toggled: "true" },
-  // View > Appearance > Align Panel (radio; Center is the default)
-  { id: "workbench.action.alignPanelCenter", title: "Center", menu: "menubar/view/appearance/alignPanel", group: "1_align", order: 1, toggled: "true" },
-  { id: "workbench.action.alignPanelJustify", title: "Justify", menu: "menubar/view/appearance/alignPanel", group: "1_align", order: 2, toggled: "false" },
-  { id: "workbench.action.alignPanelLeft", title: "Left", menu: "menubar/view/appearance/alignPanel", group: "1_align", order: 3, toggled: "false" },
-  { id: "workbench.action.alignPanelRight", title: "Right", menu: "menubar/view/appearance/alignPanel", group: "1_align", order: 4, toggled: "false" },
-  // View > Appearance > Tab Bar (radio; Multiple Tabs is the default)
-  { id: "workbench.action.showMultipleEditorTabs", title: "Multiple Tabs", menu: "menubar/view/appearance/tabBar", group: "1_tabs", order: 1, toggled: "true" },
-  { id: "workbench.action.showSingleEditorTab", title: "Single Tab", menu: "menubar/view/appearance/tabBar", group: "1_tabs", order: 2, toggled: "false" },
-  { id: "workbench.action.hideEditorTabs", title: "Hidden", menu: "menubar/view/appearance/tabBar", group: "1_tabs", order: 3, toggled: "false" },
-  // View > Appearance > Editor Actions Position (radio; Tab Bar is the default)
-  { id: "workbench.action.editorActionsPositionTabBar", title: "Tab Bar", menu: "menubar/view/appearance/editorActionsPosition", group: "1_position", order: 1, toggled: "true" },
-  { id: "workbench.action.editorActionsPositionTitleBar", title: "Title Bar", menu: "menubar/view/appearance/editorActionsPosition", group: "1_position", order: 2, toggled: "false" },
-  { id: "workbench.action.editorActionsPositionHidden", title: "Hidden", menu: "menubar/view/appearance/editorActionsPosition", group: "1_position", order: 3, toggled: "false" },
-  // View > Editor Layout (Move Editor into New Window is in the editor tab menu too, as a second placement below)
-  { id: "workbench.action.splitEditorInGroup", title: "Split in Group", menu: "menubar/view/editorLayout", group: "1_split_in_group", order: 1 },
-  { id: "workbench.action.moveEditorToNewWindow", title: "Move Editor into New Window", menu: "menubar/view/editorLayout", group: "2_new_window", order: 1 },
-  { id: "workbench.action.copyEditorToNewWindow", title: "Copy Editor into New Window", menu: "menubar/view/editorLayout", group: "2_new_window", order: 2, keybinding: "ctrlcmd+m o" },
-  { id: "workbench.action.editorLayoutSingle", title: "Single", menu: "menubar/view/editorLayout", group: "3_layout", order: 1 },
-  { id: "workbench.action.editorLayoutTwoColumns", title: "Two Columns", menu: "menubar/view/editorLayout", group: "3_layout", order: 2 },
-  { id: "workbench.action.editorLayoutThreeColumns", title: "Three Columns", menu: "menubar/view/editorLayout", group: "3_layout", order: 3 },
-  { id: "workbench.action.editorLayoutTwoRows", title: "Two Rows", menu: "menubar/view/editorLayout", group: "3_layout", order: 4 },
-  { id: "workbench.action.editorLayoutThreeRows", title: "Three Rows", menu: "menubar/view/editorLayout", group: "3_layout", order: 5 },
-  { id: "workbench.action.editorLayoutTwoByTwoGrid", title: "Grid (2x2)", menu: "menubar/view/editorLayout", group: "3_layout", order: 6 },
-  { id: "workbench.action.editorLayoutTwoRowsRight", title: "Two Rows Right", menu: "menubar/view/editorLayout", group: "3_layout", order: 7 },
-  { id: "workbench.action.editorLayoutTwoColumnsBottom", title: "Two Columns Bottom", menu: "menubar/view/editorLayout", group: "3_layout", order: 8 },
-  { id: "workbench.action.toggleEditorGroupLayout", title: "Flip Layout", menu: "menubar/view/editorLayout", group: "4_flip", order: 1, keybinding: "shift+alt+0" },
-  // Go
-  { id: "workbench.action.navigateBack", title: "Back", menu: MenuId.MenubarGoMenu, group: "1_back", order: 1, keybinding: "alt+left" },
-  { id: "workbench.action.navigateForward", title: "Forward", menu: MenuId.MenubarGoMenu, group: "1_back", order: 2, keybinding: "alt+right" },
-  { id: "workbench.action.navigateToLastEditLocation", title: "Last Edit Location", menu: MenuId.MenubarGoMenu, group: "1_back", order: 3, keybinding: "ctrlcmd+m ctrlcmd+q" },
-  { id: "workbench.action.showAllSymbols", title: "Go to Symbol in Workspace...", menu: MenuId.MenubarGoMenu, group: "3_global_nav", order: 2, keybinding: "ctrlcmd+t" },
-  { id: "workbench.action.gotoSymbol", title: "Go to Symbol in Editor...", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 1, keybinding: "ctrlcmd+shift+o" },
-  { id: "editor.action.revealDefinition", title: "Go to Definition", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 2, keybinding: "f12" },
-  { id: "editor.action.revealDeclaration", title: "Go to Declaration", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 3 },
-  { id: "editor.action.goToTypeDefinition", title: "Go to Type Definition", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 4 },
-  { id: "editor.action.goToImplementation", title: "Go to Implementations", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 5, keybinding: "ctrlcmd+f12" },
-  // The Add Symbol rows carry no chord: Ctrl+L and Ctrl+Shift+L are the chat pane's Open Chat and New Chat.
-  { id: "workbench.action.addSymbolToCurrentChat", title: "Add Symbol to Current Chat", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 6 },
-  { id: "editor.action.goToReferences", title: "Go to References", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 7, keybinding: "shift+f12" },
-  { id: "workbench.action.addSymbolToNewChat", title: "Add Symbol to New Chat", menu: MenuId.MenubarGoMenu, group: "4_symbol_nav", order: 8 },
-  { id: "workbench.action.editor.nextChange", title: "Next Change", menu: MenuId.MenubarGoMenu, group: "7_change_nav", order: 1, keybinding: "alt+f3" },
-  { id: "workbench.action.editor.previousChange", title: "Previous Change", menu: MenuId.MenubarGoMenu, group: "7_change_nav", order: 2, keybinding: "shift+alt+f3" },
-  // Go > Switch Editor (Next/Previous Editor are wired by the editor contribution)
-  { id: "workbench.action.openNextRecentlyUsedEditor", title: "Next Used Editor", menu: "menubar/go/switchEditor", group: "2_used", order: 1 },
-  { id: "workbench.action.openPreviousRecentlyUsedEditor", title: "Previous Used Editor", menu: "menubar/go/switchEditor", group: "2_used", order: 2 },
-  { id: "workbench.action.nextEditorInGroup", title: "Next Editor in Group", menu: "menubar/go/switchEditor", group: "3_group", order: 1, keybinding: "ctrlcmd+m ctrlcmd+pagedown" },
-  { id: "workbench.action.previousEditorInGroup", title: "Previous Editor in Group", menu: "menubar/go/switchEditor", group: "3_group", order: 2, keybinding: "ctrlcmd+m ctrlcmd+pageup" },
-  { id: "workbench.action.openNextRecentlyUsedEditorInGroup", title: "Next Used Editor in Group", menu: "menubar/go/switchEditor", group: "4_used_group", order: 1 },
-  { id: "workbench.action.openPreviousRecentlyUsedEditorInGroup", title: "Previous Used Editor in Group", menu: "menubar/go/switchEditor", group: "4_used_group", order: 2 },
-  // Go > Switch Group
-  { id: "workbench.action.focusFirstEditorGroup", title: "Group 1", menu: "menubar/go/switchGroup", group: "1_by_index", order: 1, keybinding: "ctrlcmd+1" },
-  { id: "workbench.action.focusSecondEditorGroup", title: "Group 2", menu: "menubar/go/switchGroup", group: "1_by_index", order: 2, keybinding: "ctrlcmd+2" },
-  { id: "workbench.action.focusThirdEditorGroup", title: "Group 3", menu: "menubar/go/switchGroup", group: "1_by_index", order: 3, keybinding: "ctrlcmd+3" },
-  { id: "workbench.action.focusFourthEditorGroup", title: "Group 4", menu: "menubar/go/switchGroup", group: "1_by_index", order: 4 },
-  { id: "workbench.action.focusFifthEditorGroup", title: "Group 5", menu: "menubar/go/switchGroup", group: "1_by_index", order: 5 },
-  { id: "workbench.action.focusNextGroup", title: "Next Group", menu: "menubar/go/switchGroup", group: "2_nav", order: 1 },
-  { id: "workbench.action.focusPreviousGroup", title: "Previous Group", menu: "menubar/go/switchGroup", group: "2_nav", order: 2 },
-  { id: "workbench.action.focusLeftGroup", title: "Group Left", menu: "menubar/go/switchGroup", group: "3_directional", order: 1, keybinding: "ctrlcmd+m ctrlcmd+left" },
-  { id: "workbench.action.focusRightGroup", title: "Group Right", menu: "menubar/go/switchGroup", group: "3_directional", order: 2, keybinding: "ctrlcmd+m ctrlcmd+right" },
-  { id: "workbench.action.focusAboveGroup", title: "Group Above", menu: "menubar/go/switchGroup", group: "3_directional", order: 3, keybinding: "ctrlcmd+m ctrlcmd+up" },
-  { id: "workbench.action.focusBelowGroup", title: "Group Below", menu: "menubar/go/switchGroup", group: "3_directional", order: 4, keybinding: "ctrlcmd+m ctrlcmd+down" },
-  // Run
-  { id: "workbench.action.debug.start", title: "Start Debugging", menu: MenuId.MenubarRunMenu, group: "1_debug", order: 1, keybinding: "f5" },
-  { id: "workbench.action.debug.run", title: "Run Without Debugging", menu: MenuId.MenubarRunMenu, group: "1_debug", order: 2, keybinding: "ctrlcmd+f5" },
-  { id: "workbench.action.debug.stop", title: "Stop Debugging", menu: MenuId.MenubarRunMenu, group: "1_debug", order: 3, keybinding: "shift+f5" },
-  { id: "workbench.action.debug.restart", title: "Restart Debugging", menu: MenuId.MenubarRunMenu, group: "1_debug", order: 4, keybinding: "ctrlcmd+shift+f5" },
-  { id: "workbench.action.debug.configure", title: "Open Configurations", menu: MenuId.MenubarRunMenu, group: "2_configurations", order: 1 },
-  { id: "workbench.action.debug.addConfiguration", title: "Add Configuration...", menu: MenuId.MenubarRunMenu, group: "2_configurations", order: 2 },
-  { id: "workbench.action.debug.stepOver", title: "Step Over", menu: MenuId.MenubarRunMenu, group: "3_step", order: 1, keybinding: "f10" },
-  { id: "workbench.action.debug.stepInto", title: "Step Into", menu: MenuId.MenubarRunMenu, group: "3_step", order: 2, keybinding: "f11" },
-  { id: "workbench.action.debug.stepOut", title: "Step Out", menu: MenuId.MenubarRunMenu, group: "3_step", order: 3, keybinding: "shift+f11" },
-  { id: "workbench.action.debug.continue", title: "Continue", menu: MenuId.MenubarRunMenu, group: "3_step", order: 4, keybinding: "f5" },
-  { id: "editor.debug.action.toggleBreakpoint", title: "Toggle Breakpoint", menu: MenuId.MenubarRunMenu, group: "4_breakpoints", order: 1, keybinding: "f9" },
-  { id: "editor.debug.action.enableAllBreakpoints", title: "Enable All Breakpoints", menu: MenuId.MenubarRunMenu, group: "5_breakpoints", order: 1 },
-  { id: "editor.debug.action.disableAllBreakpoints", title: "Disable All Breakpoints", menu: MenuId.MenubarRunMenu, group: "5_breakpoints", order: 2 },
-  { id: "editor.debug.action.removeAllBreakpoints", title: "Remove All Breakpoints", menu: MenuId.MenubarRunMenu, group: "5_breakpoints", order: 3 },
-  { id: "workbench.action.debug.installAdditionalDebuggers", title: "Install Additional Debuggers...", menu: MenuId.MenubarRunMenu, group: "6_install", order: 1 },
-  // Run > New Breakpoint
-  { id: "editor.debug.action.conditionalBreakpoint", title: "Conditional Breakpoint...", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 1 },
-  { id: "editor.debug.action.editBreakpoint", title: "Edit Breakpoint", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 2 },
-  { id: "editor.debug.action.toggleInlineBreakpoint", title: "Inline Breakpoint", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 3, keybinding: "shift+f9" },
-  { id: "editor.debug.action.addFunctionBreakpoint", title: "Function Breakpoint...", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 4 },
-  { id: "editor.debug.action.addLogpoint", title: "Logpoint...", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 5 },
-  { id: "editor.debug.action.addTriggeredBreakpoint", title: "Triggered Breakpoint...", menu: "menubar/run/newBreakpoint", group: "1_breakpoints", order: 6 },
-  // Terminal
-  { id: "workbench.action.terminal.new", title: "New Terminal", menu: MenuId.MenubarTerminalMenu, group: "1_terminal", order: 1, keybinding: "ctrlcmd+shift+`" },
-  { id: "workbench.action.terminal.split", title: "Split Terminal", menu: MenuId.MenubarTerminalMenu, group: "1_terminal", order: 2, keybinding: "ctrlcmd+shift+5" },
-  { id: "workbench.action.tasks.runTask", title: "Run Task...", menu: MenuId.MenubarTerminalMenu, group: "2_tasks", order: 1 },
-  { id: "workbench.action.tasks.build", title: "Run Build Task...", menu: MenuId.MenubarTerminalMenu, group: "2_tasks", order: 2, keybinding: "ctrlcmd+shift+b" },
-  { id: "workbench.action.terminal.runActiveFile", title: "Run Active File", menu: MenuId.MenubarTerminalMenu, group: "2_tasks", order: 3 },
-  { id: "workbench.action.terminal.runSelectedText", title: "Run Selected Text", menu: MenuId.MenubarTerminalMenu, group: "2_tasks", order: 4 },
-  { id: "workbench.action.tasks.showTasks", title: "Show Running Tasks...", menu: MenuId.MenubarTerminalMenu, group: "3_running", order: 1 },
-  { id: "workbench.action.tasks.restartTask", title: "Restart Running Task...", menu: MenuId.MenubarTerminalMenu, group: "3_running", order: 2 },
-  { id: "workbench.action.tasks.terminateTask", title: "Terminate Task...", menu: MenuId.MenubarTerminalMenu, group: "3_running", order: 3 },
-  { id: "workbench.action.tasks.configureTaskRunner", title: "Configure Tasks...", menu: MenuId.MenubarTerminalMenu, group: "4_configure", order: 1 },
-  { id: "workbench.action.tasks.configureDefaultBuildTask", title: "Configure Default Build Task...", menu: MenuId.MenubarTerminalMenu, group: "4_configure", order: 2 },
-  // Help (Show All Commands is the wired showCommands' second placement, registered by the quickinput contribution)
-  { id: "update.showCurrentReleaseNotes", title: "Show Release Notes", menu: MenuId.MenubarHelpMenu, group: "1_welcome", order: 2 },
-  { id: "workbench.action.openIssueReporter", title: "Report Issue", menu: MenuId.MenubarHelpMenu, group: "3_feedback", order: 1, keybinding: "ctrlcmd+m ctrlcmd+g" },
-  { id: "workbench.action.giveFeedback", title: "Give Feedback...", menu: MenuId.MenubarHelpMenu, group: "3_feedback", order: 2 },
-  { id: "workbench.action.openLicenseUrl", title: "View License", menu: MenuId.MenubarHelpMenu, group: "4_license", order: 1 },
-  // The chat pane's Ctrl+Shift+I (New Chat) wins this chord at dispatch; the row still shows it, as Cursor's menu does.
-  { id: "workbench.action.toggleDevTools", title: "Toggle Developer Tools", menu: MenuId.MenubarHelpMenu, group: "5_devtools", order: 1, keybinding: "ctrlcmd+shift+i" },
-  { id: "workbench.action.openProcessExplorer", title: "Open Process Explorer", menu: MenuId.MenubarHelpMenu, group: "5_devtools", order: 2 },
-  { id: "workbench.action.openExtensionMonitor", title: "Open Extension Monitor", menu: MenuId.MenubarHelpMenu, group: "5_devtools", order: 3 },
-  // Editor tab menu (Close and Close Others are wired by the editor contribution; the split rows wait for commands that take a target)
-  { id: "workbench.action.closeEditorsToTheRight", title: "Close to the Right", menu: MenuId.EditorTitleContext, group: "1_close", order: 3 },
-  { id: "workbench.action.closeUnmodifiedEditors", title: "Close Saved", menu: MenuId.EditorTitleContext, group: "1_close", order: 4, keybinding: "ctrlcmd+m u" },
-  { id: "workbench.action.closeAllEditors", title: "Close All", menu: MenuId.EditorTitleContext, group: "1_close", order: 5, keybinding: "ctrlcmd+m w" },
-  { id: "workbench.action.reopenWithEditor", title: "Reopen Editor With...", menu: MenuId.EditorTitleContext, group: "1_open", order: 1 },
-  { id: "workbench.action.keepEditor", title: "Keep Open", menu: MenuId.EditorTitleContext, group: "3_preview", order: 1, keybinding: "ctrlcmd+m enter" },
-  { id: "workbench.action.pinEditor", title: "Pin", menu: MenuId.EditorTitleContext, group: "3_preview", order: 2, keybinding: "ctrlcmd+m shift+enter" },
-] satisfies readonly StubRow[];
-
-for (const row of stubRows) {
-  const result: Result<IDisposable, ParseError> = registerAction({
-    id: row.id,
-    title: row.title,
-    precondition: "false",
-    toggled: row.toggled,
-    keybinding: row.keybinding === undefined ? undefined : { keybinding: row.keybinding },
-    menu: [{ id: row.menu, group: row.group, order: row.order }],
-    run: () => {},
-  });
-  if (!result.ok) {
-    console.error(`stub action '${row.id}': ${result.error.message}`);
-  }
-}
-
-// Second placements: one command, two menus. Appended directly so each
-// row keeps its own label - the action registry's menu entries omit the
-// title, and the two placements' labels differ (Tasks, and Move into New
-// Window, VS Code's tab-menu label) or the row sorts under another menu's
-// group (Extensions). Same pattern as the quickinput contribution's Show
-// All Commands row.
-appendMenuItem("menubar/file/preferences", {
-  command: "workbench.view.extensions",
-  title: "Extensions",
-  group: "1_settings",
-  order: 3,
-});
-appendMenuItem("menubar/file/preferences", {
-  command: "workbench.action.tasks.configureTaskRunner",
-  title: "Tasks",
-  group: "1_settings",
-  order: 6,
-});
-appendMenuItem(MenuId.EditorTitleContext, {
-  command: "workbench.action.moveEditorToNewWindow",
-  title: "Move into New Window",
-  group: "7_new_window",
-  order: 1,
-});
diff --git a/crates/workshop/ui/src/parts/menu/window-menu.css b/crates/workshop/ui/src/parts/menu/window-menu.css
deleted file mode 100644
index e5b6a6efd..000000000
--- a/crates/workshop/ui/src/parts/menu/window-menu.css
+++ /dev/null
@@ -1,219 +0,0 @@
-/* Styles for the menu widgets (menu.ts imports this file); esbuild bundles
-   it into dist/app.css. Themed values come from the :root tokens in @workshop/look/tokens.css. */
-
-/* Menu buttons: text items flush with the bar's left edge. */
-.ws-window-titlebar__menus {
-  position: relative; /* popover positioning context */
-  flex: none;
-  display: flex;
-  align-items: center;
-}
-
-.ws-window-titlebar__menu {
-  display: flex;
-  align-items: center;
-  height: var(--ws-control-height-compact);
-  padding: 0 var(--space-2);
-  background: none;
-  border: none;
-  border-radius: var(--ws-menu-item-radius);
-  /* The bar owns the label color (--titlebar-foreground, and the inactive
-     override in window-chrome.css), so a blurred window dims the menu
-     labels with the rest of the bar. */
-  color: inherit;
-  font: inherit;
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-window-titlebar__menu:hover,
-.ws-window-titlebar__menu[aria-expanded="true"] {
-  background: var(--titlebar-hover);
-}
-
-.ws-window-titlebar__menu:focus-visible {
-  outline: none;
-  background: var(--titlebar-hover);
-}
-
-/* Menu popovers: raised near-black surfaces below the bar, absolutely
-   positioned so they never participate in layout. A 5px radius and an
-   outline instead of a border; a menu taller than the window scrolls
-   (menu.ts sets its max height) under the 7px .scrollbar-menu bar. Rows
-   carry no padding: the label and the shortcut pad themselves, and the
-   check mark and the submenu chevron sit in absolute columns. */
-@keyframes fadeIn {
-  from { opacity: 0; }
-  to { opacity: 1; }
-}
-
-.ws-window-titlebar__popover {
-  position: absolute;
-  top: 100%;
-  z-index: 100;
-  display: flex;
-  flex-direction: column;
-  min-width: var(--titlebar-popover-min-width);
-  padding: var(--space-1) 0;
-  overflow-x: hidden;
-  overflow-y: auto;
-  background: var(--bg-raised);
-  outline: var(--ws-border-width) solid var(--cursor-stroke-focused);
-  border-radius: var(--ws-menu-radius);
-  box-shadow: var(--titlebar-popover-shadow);
-}
-
-/* A top-level dropdown opens without a fade; flyouts and context menus fade in. */
-.ws-window-titlebar__popover--flyout,
-.ws-window-titlebar__popover--context {
-  animation: fadeIn 0.083s linear;
-}
-
-.ws-window-titlebar__popover[hidden] {
-  display: none;
-}
-
-.ws-window-titlebar__item {
-  position: relative;
-  display: flex;
-  align-items: center;
-  height: 2em;
-  padding: 0;
-  margin: 0 var(--ws-size-4);
-  border-radius: var(--ws-size-4);
-  background: none;
-  border: none;
-  color: var(--text);
-  font: inherit;
-  text-align: left;
-  white-space: nowrap;
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-window-titlebar__item:hover {
-  background: var(--cursor-bg-active);
-}
-
-/* Focus takes the same wash as hover, plus the menu-row outline. */
-.ws-window-titlebar__item:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-  background: var(--cursor-bg-active);
-}
-
-/* The label's 2em side padding leaves the left column to the check mark
-   and keeps the label clear of the shortcut and the chevron. */
-.ws-window-titlebar__item-label {
-  flex: 1;
-  padding: 0 2em;
-}
-
-/* The shortcut is right-aligned at 70% and rises to full on hover. */
-.ws-window-titlebar__shortcut {
-  margin-inline-start: auto;
-  padding: 0 2em;
-  font-size: var(--font-size-base);
-  opacity: 0.7;
-  text-align: right;
-}
-
-.ws-window-titlebar__item:hover .ws-window-titlebar__shortcut,
-.ws-window-titlebar__item:focus-visible .ws-window-titlebar__shortcut {
-  opacity: 1;
-}
-
-/* Disabled rows are half opaque with a dimmer label and an even dimmer
-   shortcut; they keep the default cursor and take no hover wash. */
-.ws-window-titlebar__item[aria-disabled="true"] {
-  opacity: 0.5;
-  cursor: default;
-}
-
-.ws-window-titlebar__item[aria-disabled="true"] .ws-window-titlebar__item-label {
-  color: var(--menu-disabled-label);
-}
-
-.ws-window-titlebar__item[aria-disabled="true"] .ws-window-titlebar__shortcut {
-  opacity: 0.4;
-}
-
-.ws-window-titlebar__item[aria-disabled="true"]:hover {
-  background: none;
-}
-
-/* Checked rows (the Model menu, the stub toggles): the check mark sits in
-   an absolute 2em column at the row's left edge, in the text color. */
-.ws-window-titlebar__item-check {
-  position: absolute;
-  inset-inline-start: 0;
-  inset-block: 0;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 2em;
-  color: var(--text);
-}
-
-/* The pending mark: an ellipsis on the profile a switch is loading,
-   muted where the settled check is not. */
-.ws-window-titlebar__item-check--pending {
-  color: var(--text-muted);
-}
-
-.ws-window-titlebar__separator {
-  height: var(--ws-size-1);
-  margin: var(--ws-size-5) 0;
-  background: var(--border);
-}
-
-/* Title-bar regions: the bar splits into left (icon + menubar), center
-   (the drag surface, which the command center mounts into), and right
-   (the window controls). The center keeps the __drag class, whose
-   flex: 1 in window-chrome.css makes it absorb the spare width. */
-.ws-window-titlebar__left {
-  flex: none;
-  display: flex;
-  align-items: center;
-  min-width: 0;
-}
-
-.ws-window-titlebar__center {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  min-width: 0;
-}
-
-.ws-window-titlebar__right {
-  flex: none;
-  display: flex;
-  align-items: stretch;
-}
-
-/* Submenu rows: a 16px chevron marks the flyout, 9px from the row's right
-   edge at 70% like a shortcut hint. */
-.ws-window-titlebar__chevron {
-  position: absolute;
-  inset-inline-end: var(--ws-size-9);
-  inset-block: 0;
-  display: flex;
-  align-items: center;
-  opacity: 0.7;
-}
-
-/* A flyout opens beside its parent row; the negative top margin cancels
-   the popover's vertical padding so the flyout's first row aligns with
-   the parent row. */
-.ws-window-titlebar__popover--flyout {
-  margin-top: calc(-1 * var(--space-1));
-}
-
-/* The popover fade-in is decorative; users asking for reduced motion
-   get instant surfaces. */
-@media (prefers-reduced-motion: reduce) {
-  .ws-window-titlebar__popover--flyout,
-  .ws-window-titlebar__popover--context {
-    animation: none;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/quickinput/commands-history.ts b/crates/workshop/ui/src/parts/quickinput/commands-history.ts
deleted file mode 100644
index b06524496..000000000
--- a/crates/workshop/ui/src/parts/quickinput/commands-history.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-// The commands history: the ids of the most recently accepted palette
-// commands, most-recent-first, seeded from the UI-state adapter's user
-// bucket at construction and written back through it on every change so
-// the command palette's recency ordering survives a relaunch. The
-// palette provider reads the list at every open and records each
-// accepted command.
-//
-// The initial value arrives as unknown and passes a hand-written shape
-// check - a malformed or hostile payload reads as an empty list, never
-// as a cast. The writer is fire-and-forget: a write that throws is
-// swallowed and the in-memory list stays authoritative.
-//
-// The history is a registry service: it self-registers under
-// COMMANDS_HISTORY with a default factory (empty initial, no-op writer),
-// and the composition root re-registers it bound to the live adapter
-// before the palette first resolves it.
-//
-// Generic and DOM-free: the initial value and the writer are injected.
-
-import {
-  COMMANDS_HISTORY,
-  type CommandsHistory as CommandsHistoryContract,
-} from "../../services/commands-history";
-import { registerService } from "@workshop/platform/service-registry";
-
-/** The most ids the store keeps; adding past the cap drops the oldest. */
-const MAX_ENTRIES = 50;
-
-/** The writer the history hands the whole id list to after each change. */
-export type CommandsHistoryWriter = (value: unknown) => void;
-
-/**
- * Narrows a persisted payload to a command id list: it must be an array,
- * non-string and empty entries drop out, and duplicates collapse keeping
- * the first (most recent) occurrence. Anything else reads as no history.
- */
-function readIds(initial: unknown): readonly string[] {
-  if (!Array.isArray(initial)) {
-    return [];
-  }
-  const ids: string[] = [];
-  for (const item of initial as readonly unknown[]) {
-    if (typeof item === "string" && item !== "" && !ids.includes(item)) {
-      ids.push(item);
-    }
-  }
-  return ids;
-}
-
-/**
- * The palette recency list. Mutations write through eagerly; a writer
- * failure leaves the in-memory list authoritative for the rest of the
- * page lifetime.
- */
-export class CommandsHistory implements CommandsHistoryContract {
-  private ids: readonly string[];
-
-  /**
-   * `initial` is the value the user bucket held at boot (any shape; see
-   * readIds); `write` receives the whole list after each change.
-   */
-  constructor(
-    initial: unknown = null,
-    private readonly write: CommandsHistoryWriter = () => {},
-  ) {
-    this.ids = readIds(initial);
-  }
-
-  /** The recorded command ids, most recent first. */
-  get list(): readonly string[] {
-    return this.ids;
-  }
-
-  /**
-   * Records `id` as just run: it moves to the front, a duplicate
-   * collapses, and the oldest entries drop past the cap. Empty ids are
-   * ignored.
-   */
-  add(id: string): void {
-    if (id === "") {
-      return;
-    }
-    this.ids = [id, ...this.ids.filter((entry) => entry !== id)].slice(0, MAX_ENTRIES);
-    this.persist();
-  }
-
-  private persist(): void {
-    try {
-      this.write(this.ids);
-    } catch {
-      // The adapter reports its own failures; a throwing writer leaves
-      // the in-memory list authoritative.
-    }
-  }
-}
-
-// Self-registration with an empty list and a no-op writer: a consumer
-// that resolves the token before the composition root re-registers it
-// bound to the live adapter gets a working, unpersisted history rather
-// than a wrong instance cached for the page lifetime.
-registerService(COMMANDS_HISTORY, () => new CommandsHistory());
diff --git a/crates/workshop/ui/src/parts/quickinput/quick-access-providers.ts b/crates/workshop/ui/src/parts/quickinput/quick-access-providers.ts
deleted file mode 100644
index c721f48bf..000000000
--- a/crates/workshop/ui/src/parts/quickinput/quick-access-providers.ts
+++ /dev/null
@@ -1,288 +0,0 @@
-// The quick-access providers the quickinput component owns: the ">"
-// command palette, the "?" help list, the not-available placeholders
-// for "@", "%", "debug ", and "task ", and the descriptor table that
-// registers them all in modes-list order. The "" file provider and the
-// ":" go-to-line provider belong to the workspace and editor features
-// and register from their own contribution files; their wording follows
-// the same rule as the table's. Every placeholder and help string is
-// Cursor's own, and each help entry carries the command-center order,
-// label, and command id Cursor gives it.
-//
-// The palette reads the CommandPalette menu at every open: a row whose
-// command is unregistered or whose precondition fails is absent, labels
-// are "Category: Title" with the filter's match highlighted, each row
-// shows the command's keybinding label, and recently used commands (the
-// COMMANDS_HISTORY service) sort first in recency order with the rest in
-// menu order, under the "recently used" and "other commands" group
-// labels. Accepting a row records the command in the history and
-// dispatches it; a rejected run is reported by the registry (the toast)
-// and logged here. With no match the list reads "No matching commands".
-//
-// The help provider renders one row per registered provider's help
-// entries, as Cursor does: the prefix (an ellipsis for the default mode)
-// as the label, the help text as the description, sorted by prefix with
-// "?" itself left out, and each command's keybinding. Accepting a row
-// enters that mode, and typing a mode's prefix after "?" jumps there. A
-// placeholder provider renders a single inert "not available" row so the
-// modes list matches Cursor's while the mode is unimplemented.
-//
-// Every factory takes its registries as optional deps defaulting to the
-// shared singletons or the service registry; tests inject their own.
-
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import { COMMANDS_HISTORY, type CommandsHistory } from "../../services/commands-history";
-import { CONTEXT_KEY_SERVICE, type ContextKeyService } from "@workshop/platform/context-key-service";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { MenuId, Menus, type MenuRegistry } from "@workshop/platform/menu-registry";
-import { QuickAccessRegistry, type QuickAccessProviderDescriptor } from "@workshop/platform/quick-access-registry";
-import { getService } from "@workshop/platform/service-registry";
-import {
-  QUICK_INPUT_SERVICE,
-  substringHighlights,
-  type QuickAccessProvider,
-  type QuickInputItem,
-} from "../../services/quick-input-service";
-
-/** The prefix that opens the help list. */
-const HELP_PREFIX = "?";
-
-/** What the help list labels the default mode, whose prefix is empty. */
-const DEFAULT_MODE_LABEL = "\u2026";
-
-/** The registries the palette provider reads; tests inject their own. */
-export interface CommandPaletteProviderDeps {
-  readonly commands?: CommandRegistry;
-  readonly menus?: MenuRegistry;
-  readonly keybindings?: KeybindingsRegistry;
-  readonly context?: ContextKeyService;
-  readonly history?: CommandsHistory;
-}
-
-/**
- * The ">" command palette provider. Rows come from the CommandPalette
- * menu, re-read at every getItems so late registrations appear; the
- * filter is a case-insensitive substring match on the rendered label.
- */
-export function createCommandPaletteProvider(deps: CommandPaletteProviderDeps = {}): QuickAccessProvider {
-  const commands = deps.commands ?? Commands;
-  const menus = deps.menus ?? Menus;
-  const keybindings = deps.keybindings ?? KeybindingsRegistry;
-  const context = deps.context ?? getService(CONTEXT_KEY_SERVICE);
-  const history = deps.history ?? getService(COMMANDS_HISTORY);
-  return {
-    noResultsMessage: "No matching commands",
-    getItems(filter: string): readonly QuickInputItem[] {
-      const needle = filter.trim().toLowerCase();
-      const recent = new Map(history.list.map((id, index) => [id, index]));
-      const rows: { readonly commandId: string; readonly item: QuickInputItem }[] = [];
-      for (const row of menus.getMenuItems(MenuId.CommandPalette)) {
-        if ("submenu" in row) {
-          continue;
-        }
-        const command = commands.lookup(row.command);
-        if (command === undefined) {
-          continue;
-        }
-        if (!context.contextMatchesRules(command.precondition)) {
-          continue;
-        }
-        const title = row.title ?? command.title ?? row.command;
-        const label = command.category === undefined ? title : `${command.category}: ${title}`;
-        if (needle !== "" && !label.toLowerCase().includes(needle)) {
-          continue;
-        }
-        const keybinding = keybindings.lookupKeybinding(row.command)?.getLabel();
-        const args = row.args ?? [];
-        rows.push({
-          commandId: row.command,
-          item: {
-            label,
-            labelHighlights: substringHighlights(label, needle),
-            keybinding,
-            accept: () => {
-              history.add(row.command);
-              // The registry reports a failure (the toast); keep the detail.
-              void commands.execute(row.command, ...args).catch((error: unknown) => {
-                logCommandFailure(row.command, error);
-              });
-            },
-          },
-        });
-      }
-      // Recently used first in recency order; the sort is stable, so the
-      // rest keep their menu order.
-      rows.sort(
-        (a, b) =>
-          (recent.get(a.commandId) ?? Number.MAX_SAFE_INTEGER) - (recent.get(b.commandId) ?? Number.MAX_SAFE_INTEGER),
-      );
-      // The recent run opens under "recently used"; the first command after
-      // it opens "other commands".
-      return rows.map((row, index) => {
-        const isRecent = recent.has(row.commandId);
-        if (index === 0 && isRecent) {
-          return { ...row.item, separator: "recently used" };
-        }
-        if (!isRecent && index > 0 && recent.has(rows[index - 1]?.commandId ?? "")) {
-          return { ...row.item, separator: "other commands" };
-        }
-        return row.item;
-      });
-    },
-  };
-}
-
-/** The registries and mode-switch sink the help provider reads. */
-export interface HelpProviderDeps {
-  readonly registry?: QuickAccessRegistry;
-  readonly keybindings?: KeybindingsRegistry;
-  readonly show?: (value: string) => void;
-}
-
-/**
- * The "?" help provider: one row per registered provider's help
- * entries, re-read at every getItems, sorted by the provider's prefix.
- * A row's label is the entry's prefix (the provider's own when the entry
- * has none, an ellipsis for the default mode) and its description is the
- * help text; the "?" entry itself is left out. Accepting a row enters
- * that mode, and the redirect sends "?" followed by another mode's
- * prefix straight into that mode.
- */
-export function createHelpProvider(deps: HelpProviderDeps = {}): QuickAccessProvider {
-  const registry = deps.registry ?? QuickAccessRegistry;
-  const keybindings = deps.keybindings ?? KeybindingsRegistry;
-  const show =
-    deps.show ??
-    ((value: string): void => {
-      getService(QUICK_INPUT_SERVICE).quickAccess.show(value);
-    });
-  return {
-    getItems(): readonly QuickInputItem[] {
-      const providers = [...registry.getQuickAccessProviders()].sort((a, b) => a.prefix.localeCompare(b.prefix));
-      const rows: QuickInputItem[] = [];
-      for (const descriptor of providers) {
-        for (const entry of descriptor.helpEntries) {
-          const prefix = entry.prefix || descriptor.prefix;
-          if (prefix === HELP_PREFIX) {
-            continue;
-          }
-          rows.push({
-            label: prefix === "" ? DEFAULT_MODE_LABEL : prefix,
-            description: entry.description,
-            keybinding:
-              entry.commandId === undefined ? undefined : keybindings.lookupKeybinding(entry.commandId)?.getLabel(),
-            accept: () => show(prefix),
-          });
-        }
-      }
-      return rows;
-    },
-    redirect(filter: string): string | undefined {
-      const target = registry.getQuickAccessProvider(filter);
-      return target !== undefined && target.prefix !== "" && target.prefix !== HELP_PREFIX ? target.prefix : undefined;
-    },
-  };
-}
-
-/**
- * A placeholder provider for a mode Cursor lists but this build does
- * not implement: one inert row telling the truth about availability.
- */
-export function createPlaceholderProvider(message: string): QuickAccessProvider {
-  return {
-    getItems(): readonly QuickInputItem[] {
-      return [{ label: message, accept: () => {} }];
-    },
-  };
-}
-
-/** The deps the descriptor table threads into the palette and help providers. */
-export interface QuickAccessProviderDeps extends CommandPaletteProviderDeps {
-  /** The registry the help provider reads; defaults to the shared one. */
-  readonly quickAccess?: QuickAccessRegistry;
-  /** The mode-switch sink the help provider's rows accept into. */
-  readonly show?: (value: string) => void;
-}
-
-/**
- * The quickinput-owned provider descriptors in modes-list order: ">"
- * Show and Run Commands, "%" Search for Text, "@" Go to Symbol in
- * Editor, "debug " Start Debugging, "task " Run Task, "?" More. The ""
- * Go to File provider registers from the workspace contribution and the
- * ":" provider from the editor contribution. Every string is Cursor's;
- * the command ids are the ones Cursor's help entries name, so the lists
- * show a keybinding for whichever of them this build binds.
- */
-export function createQuickAccessProviderDescriptors(
-  deps: QuickAccessProviderDeps = {},
-): readonly QuickAccessProviderDescriptor[] {
-  return [
-    {
-      prefix: ">",
-      placeholder: "Type the name of a command to run.",
-      helpEntries: [
-        {
-          description: "Show and Run Commands",
-          prefix: ">",
-          commandId: "workbench.action.showCommands",
-          commandCenterOrder: 20,
-        },
-      ],
-      factory: () => createCommandPaletteProvider(deps),
-    },
-    {
-      prefix: "%",
-      placeholder: "Search for text in your workspace files.",
-      helpEntries: [
-        {
-          description: "Search for Text",
-          prefix: "%",
-          commandId: "workbench.action.quickTextSearch",
-          commandCenterOrder: 25,
-        },
-      ],
-      factory: () => createPlaceholderProvider("Text search is not available"),
-    },
-    {
-      prefix: "@",
-      placeholder: "Type the name of a symbol to go to.",
-      helpEntries: [
-        {
-          description: "Go to Symbol in Editor",
-          prefix: "@",
-          commandId: "workbench.action.gotoSymbol",
-          commandCenterOrder: 40,
-        },
-        { description: "Go to Symbol in Editor by Category", prefix: "@:" },
-      ],
-      factory: () => createPlaceholderProvider("Go to symbol in editor is not available"),
-    },
-    {
-      prefix: "debug ",
-      placeholder: "Type the name of a launch configuration to run.",
-      helpEntries: [
-        {
-          description: "Start Debugging",
-          prefix: "debug ",
-          commandId: "workbench.action.debug.selectandstart",
-          commandCenterOrder: 50,
-        },
-      ],
-      factory: () => createPlaceholderProvider("Debugging is not available"),
-    },
-    {
-      prefix: "task ",
-      placeholder: "Type the name of a task to run.",
-      helpEntries: [{ description: "Run Task", prefix: "task ", commandCenterOrder: 60 }],
-      factory: () => createPlaceholderProvider("Tasks are not available"),
-    },
-    {
-      prefix: HELP_PREFIX,
-      placeholder: `Type '${HELP_PREFIX}' to get help on the actions you can take from here.`,
-      helpEntries: [
-        { description: "Show all Quick Access Providers", commandCenterOrder: 70, commandCenterLabel: "More" },
-      ],
-      factory: () =>
-        createHelpProvider({ registry: deps.quickAccess, keybindings: deps.keybindings, show: deps.show }),
-    },
-  ];
-}
diff --git a/crates/workshop/ui/src/parts/quickinput/quick-input.css b/crates/workshop/ui/src/parts/quickinput/quick-input.css
deleted file mode 100644
index 98ab6452e..000000000
--- a/crates/workshop/ui/src/parts/quickinput/quick-input.css
+++ /dev/null
@@ -1,197 +0,0 @@
-/* Styles for quick-input.ts, which imports this file; esbuild bundles it
-   into dist/app.css. Themed values come from the :root tokens in
-   @workshop/look/tokens.css and the quick-input slots in
-   src/tokens/component.css. The values are Cursor's own: a frame
-   min(62vw, 820px) wide with an 8px radius, the xl shadow, and no border;
-   22px rows; a 26px box in a 4px 6px header with no divider; filter matches
-   in #88C0D0 at weight 700; key chips; and group labels with a #F0F0F01C top
-   line. */
-
-/* The panel floats under the title bar, horizontally centered, above every
-   other surface. It clips its rounded corners, so a row's selection never
-   squares them off. */
-.ws-quick-input {
-  position: fixed;
-  top: var(--ws-quick-input-top);
-  left: 50%;
-  transform: translateX(-50%);
-  z-index: 200;
-  display: flex;
-  flex-direction: column;
-  gap: 0;
-  width: var(--ws-quick-input-width);
-  max-width: var(--ws-quick-input-max-width);
-  padding: 0;
-  overflow: hidden;
-  background: var(--bg-raised);
-  border: none;
-  border-radius: var(--radius-lg);
-  box-shadow: var(--cursor-box-shadow-xl);
-}
-
-.ws-quick-input[hidden] {
-  display: none;
-}
-
-/* The accessible name: present for assistive tech, invisible on screen. */
-.ws-quick-input__label {
-  position: absolute;
-  width: var(--ws-size-1);
-  height: var(--ws-size-1);
-  overflow: hidden;
-  clip: rect(0 0 0 0);
-  clip-path: inset(50%);
-  white-space: nowrap;
-}
-
-/* The box sits in a header of its own, with no divider under it. */
-.ws-quick-input__header {
-  padding: var(--ws-quick-input-header-padding);
-}
-
-.ws-quick-input__input {
-  box-sizing: border-box;
-  width: 100%;
-  height: var(--ws-quick-input-box-height);
-  padding: var(--ws-quick-input-box-padding);
-  background: none;
-  border: none;
-  border-radius: var(--radius);
-  color: var(--text);
-  font: inherit;
-  outline: none;
-}
-
-.ws-quick-input__input::placeholder {
-  color: var(--input-placeholder);
-  opacity: 0.5;
-}
-
-.ws-quick-input__list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0;
-  max-height: var(--ws-quick-input-list-max-height);
-  overflow-y: auto;
-}
-
-/* Rows: label left, muted description filling the middle, key chips pinned
-   to the right edge. */
-.ws-quick-input__option {
-  display: flex;
-  align-items: center;
-  gap: 0;
-  box-sizing: border-box;
-  flex: none;
-  height: var(--ws-quick-input-row-height);
-  padding: var(--ws-quick-input-row-padding);
-  margin: var(--ws-quick-input-row-margin);
-  border-radius: var(--radius);
-  color: var(--text);
-  cursor: pointer;
-  user-select: none;
-}
-
-.ws-quick-input__option:hover {
-  background: var(--bg-hover);
-}
-
-.ws-quick-input__option[aria-selected="true"] {
-  background: var(--cursor-bg-active);
-}
-
-.ws-quick-input__option-label {
-  flex: none;
-  white-space: pre;
-}
-
-/* The filter's match inside a label. */
-.ws-quick-input__highlight {
-  color: var(--list-highlight);
-  font-weight: 700;
-}
-
-.ws-quick-input__option-description {
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  margin-left: var(--ws-size-6);
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--ws-quick-input-description-size);
-  opacity: 0.6;
-}
-
-/* Key chips: one box per key, a plus between the keys of a chord, a gap
-   between chords. The selected row shows them plain. */
-.ws-quick-input__option-keybinding {
-  display: flex;
-  flex: none;
-  align-items: center;
-  margin-left: var(--ws-size-6);
-  line-height: var(--ws-size-10);
-}
-
-.ws-quick-input__key {
-  display: inline-block;
-  padding: var(--ws-quick-input-key-padding);
-  background: var(--keybinding-label-bg);
-  border: var(--ws-border-width) solid var(--keybinding-label-border);
-  border-bottom-color: var(--keybinding-label-border-bottom);
-  border-radius: var(--ws-quick-input-key-radius);
-  box-shadow: inset 0 calc(-1 * var(--ws-border-width)) 0 var(--cursor-shadow-primary);
-  color: var(--keybinding-label-text);
-  font-size: var(--font-size-xs);
-  vertical-align: middle;
-}
-
-.ws-quick-input__key-separator {
-  display: inline-block;
-  margin: 0 var(--ws-size-2);
-  font-size: var(--font-size-xs);
-}
-
-.ws-quick-input__chord-separator {
-  width: var(--ws-quick-input-chord-gap);
-}
-
-.ws-quick-input__option[aria-selected="true"] .ws-quick-input__key {
-  background: none;
-  color: inherit;
-}
-
-/* A group label: a line above the row it opens, its text at the right with
-   a top line - except the first, which has nothing above it to divide from. */
-.ws-quick-input__separator {
-  display: flex;
-  flex: none;
-  justify-content: flex-end;
-  align-items: center;
-  box-sizing: border-box;
-  height: var(--ws-quick-input-row-height);
-  padding: var(--ws-quick-input-row-padding);
-  margin: var(--ws-quick-input-row-margin);
-  border-top: var(--ws-border-width) solid var(--quick-input-separator);
-  font-size: var(--ws-quick-input-description-size);
-  opacity: 0.6;
-  user-select: none;
-}
-
-.ws-quick-input__separator:first-child {
-  border-top: none;
-}
-
-/* The line a provider with no rows says, dimmed like the IDE's message. */
-.ws-quick-input__empty {
-  display: flex;
-  align-items: center;
-  box-sizing: border-box;
-  height: var(--ws-quick-input-row-height);
-  padding: var(--ws-quick-input-row-padding);
-  margin: var(--ws-quick-input-row-margin);
-  opacity: 0.6;
-  user-select: none;
-}
diff --git a/crates/workshop/ui/src/parts/quickinput/quick-input.ts b/crates/workshop/ui/src/parts/quickinput/quick-input.ts
deleted file mode 100644
index 9d394d2c2..000000000
--- a/crates/workshop/ui/src/parts/quickinput/quick-input.ts
+++ /dev/null
@@ -1,405 +0,0 @@
-// The quick input widget: one floating panel under the title bar that
-// routes its input to the quick-access registry's providers by longest
-// prefix and renders the active provider's items as a WAI-ARIA combobox
-// (an input role=combobox with aria-autocomplete=list, aria-expanded,
-// aria-controls, and aria-activedescendant, a visually-hidden label, and
-// a ul role=listbox of li role=option rows). ArrowUp/ArrowDown move the
-// active row, Enter accepts it, Escape dismisses the panel and returns
-// focus to whatever held it before the panel opened.
-//
-// Routing is in place: typing a character that changes the longest
-// matching prefix swaps the provider, the placeholder, and the rows
-// without closing the panel, so "debug foo" reaches the debug provider
-// while "" still owns every unprefixed value. The filter handed to a
-// provider is the input value minus the prefix. A provider may redirect
-// the value to another mode (the help provider does, for "?>").
-//
-// Rows draw Cursor's pieces: the label with its filter match
-// highlighted, the muted description, and the keybinding as key chips (one
-// per key, "+" between, a gap between chords). A group label (a row's
-// `separator`) is a presentational line above the row it opens and never
-// takes the active row. A provider that answers no rows and has a
-// noResultsMessage shows it as an inert line.
-//
-// The modes list (includeHelp, shown while the input is empty) is the
-// help entries that carry a commandCenterOrder, in that order, labelled
-// by commandCenterLabel when they have one, each with its prefix as the
-// description and its command's keybinding.
-//
-// Providers are narrowed, never cast: the registry stores factories
-// returning unknown, and a factory whose product lacks getItems renders
-// an empty list rather than throwing at open.
-
-import "./quick-input.css";
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-import {
-  type LabelHighlight,
-  type QuickAccessProvider,
-  type QuickInputItem,
-  type QuickInputService as QuickInputServiceContract,
-  type QuickInputShowOptions,
-} from "../../services/quick-input-service";
-
-/** Narrows a factory's unknown product to the provider shape. */
-function asProvider(value: unknown): QuickAccessProvider | undefined {
-  if (typeof value !== "object" || value === null) {
-    return undefined;
-  }
-  if (typeof (value as { getItems?: unknown }).getItems !== "function") {
-    return undefined;
-  }
-  return value as QuickAccessProvider;
-}
-
-/** Registry overrides; tests inject their own instances. */
-export interface QuickInputDependencies {
-  readonly registry?: QuickAccessRegistry;
-  /** Where the modes list looks up each command's keybinding. */
-  readonly keybindings?: KeybindingsRegistry;
-}
-
-/** One rendered row: its element and its accept behavior. */
-interface Row {
-  readonly element: HTMLLIElement;
-  readonly accept: () => void;
-}
-
-/** How many times one input value may be redirected before routing gives up. */
-const MAX_REDIRECTS = 8;
-
-let nextInstanceId = 0;
-
-/** A text node, or the label's matched span wrapped for the highlight color. */
-function appendLabel(into: HTMLElement, label: string, highlights: readonly LabelHighlight[] | undefined): void {
-  let cursor = 0;
-  for (const { start, end } of [...(highlights ?? [])].sort((a, b) => a.start - b.start)) {
-    // Ignore a span that overlaps the last one or runs off the label.
-    if (start < cursor || end > label.length || end <= start) {
-      continue;
-    }
-    if (start > cursor) {
-      into.append(label.slice(cursor, start));
-    }
-    const mark = document.createElement("span");
-    mark.className = "ws-quick-input__highlight";
-    mark.textContent = label.slice(start, end);
-    into.append(mark);
-    cursor = end;
-  }
-  if (cursor < label.length) {
-    into.append(label.slice(cursor));
-  }
-}
-
-/**
- * The key chips of a keybinding label such as "Ctrl+Shift+P" or
- * "Ctrl+K Ctrl+S": a chip per key with a "+" between the keys of one
- * chord and a gap between chords. The label's text is unchanged, so it
- * still reads as the label to a screen reader.
- */
-function renderKeybinding(label: string): HTMLElement {
-  const keybinding = document.createElement("span");
-  keybinding.className = "ws-quick-input__option-keybinding";
-  label
-    .split(" ")
-    .filter((chord) => chord !== "")
-    .forEach((chord, chordIndex) => {
-      if (chordIndex > 0) {
-        const gap = document.createElement("span");
-        gap.className = "ws-quick-input__chord-separator";
-        keybinding.append(gap);
-      }
-      chord.split("+").forEach((key, keyIndex) => {
-        if (keyIndex > 0) {
-          const plus = document.createElement("span");
-          plus.className = "ws-quick-input__key-separator";
-          plus.textContent = "+";
-          keybinding.append(plus);
-        }
-        const chip = document.createElement("span");
-        chip.className = "ws-quick-input__key";
-        chip.textContent = key;
-        keybinding.append(chip);
-      });
-    });
-  return keybinding;
-}
-
-/**
- * The quick input service. `quickAccess.show(value, options)` opens the
- * panel with `value` routed to its provider; the composition root
- * registers one instance under QUICK_INPUT_SERVICE and the quick-access
- * actions (showCommands, quickOpen, and friends) call it.
- */
-export class QuickInputService extends Disposable implements QuickInputServiceContract {
-  /** The quick-access surface the menu actions and command center call. */
-  readonly quickAccess = {
-    show: (value: string, options?: QuickInputShowOptions): void => {
-      this.show(value, options);
-    },
-  };
-
-  private readonly registry: QuickAccessRegistry;
-  private readonly keybindings: KeybindingsRegistry;
-  private readonly container: HTMLDivElement;
-  private readonly input: HTMLInputElement;
-  private readonly list: HTMLUListElement;
-  private readonly listId: string;
-  private rows: Row[] = [];
-  private activeIndex = -1;
-  private includeHelp = false;
-  private isOpen = false;
-  private restoreFocusTo: HTMLElement | null = null;
-  private readonly onOutsidePointerDown = (event: Event): void => {
-    const target = event.target;
-    if (target instanceof Node && this.container.contains(target)) {
-      return;
-    }
-    this.close(true);
-  };
-
-  constructor(deps: QuickInputDependencies = {}) {
-    super();
-    this.registry = deps.registry ?? QuickAccessRegistry;
-    this.keybindings = deps.keybindings ?? KeybindingsRegistry;
-    this.listId = `ws-quick-input-${++nextInstanceId}-list`;
-
-    const label = document.createElement("label");
-    label.className = "ws-quick-input__label";
-    label.htmlFor = `${this.listId}-input`;
-    label.textContent = "Search files, commands, and more";
-
-    this.input = document.createElement("input");
-    this.input.id = `${this.listId}-input`;
-    this.input.className = "ws-quick-input__input";
-    this.input.type = "text";
-    this.input.setAttribute("role", "combobox");
-    this.input.setAttribute("aria-autocomplete", "list");
-    this.input.setAttribute("aria-expanded", "false");
-    this.input.setAttribute("aria-controls", this.listId);
-    this.input.addEventListener("input", () => this.route());
-    this.input.addEventListener("keydown", (event) => this.onKeydown(event));
-
-    // The box sits in a header of its own, with no divider under it.
-    const header = document.createElement("div");
-    header.className = "ws-quick-input__header";
-    header.appendChild(this.input);
-
-    this.list = document.createElement("ul");
-    this.list.id = this.listId;
-    this.list.className = "ws-quick-input__list";
-    this.list.setAttribute("role", "listbox");
-
-    this.container = document.createElement("div");
-    this.container.className = "ws-quick-input";
-    this.container.hidden = true;
-    this.container.appendChild(label);
-    this.container.appendChild(header);
-    this.container.appendChild(this.list);
-    document.body.appendChild(this.container);
-    this._register(toDisposable(() => this.container.remove()));
-  }
-
-  /** Shows the panel with `value` routed to its provider. */
-  show(value: string, options: QuickInputShowOptions = {}): void {
-    if (!this.isOpen) {
-      const active = document.activeElement;
-      this.restoreFocusTo = active instanceof HTMLElement ? active : null;
-      document.addEventListener("pointerdown", this.onOutsidePointerDown);
-      this.isOpen = true;
-    }
-    this.includeHelp = options.includeHelp === true;
-    this.input.value = value;
-    this.container.hidden = false;
-    this.input.setAttribute("aria-expanded", "true");
-    this.route();
-    this.input.focus();
-  }
-
-  /** Dismisses the panel. Safe when closed. */
-  close(restoreFocus = false): void {
-    if (!this.isOpen) {
-      return;
-    }
-    this.isOpen = false;
-    document.removeEventListener("pointerdown", this.onOutsidePointerDown);
-    this.container.hidden = true;
-    this.input.setAttribute("aria-expanded", "false");
-    if (restoreFocus) {
-      this.restoreFocusTo?.focus();
-    }
-    this.restoreFocusTo = null;
-  }
-
-  /**
-   * Re-routes the current input value and rebuilds the rows. A provider
-   * may send the input to another mode first; the value is rewritten and
-   * routed again, a few hops at most.
-   */
-  private route(): void {
-    let provider: QuickAccessProvider | undefined;
-    let filter = "";
-    for (let hops = 0; ; hops += 1) {
-      const value = this.input.value;
-      const descriptor = this.registry.getQuickAccessProvider(value);
-      this.input.placeholder = descriptor?.placeholder ?? "";
-      provider = descriptor === undefined ? undefined : asProvider(descriptor.factory());
-      filter = descriptor === undefined ? value : value.slice(descriptor.prefix.length);
-      const redirected = provider?.redirect?.(filter);
-      if (redirected === undefined || redirected === value || hops >= MAX_REDIRECTS) {
-        break;
-      }
-      this.input.value = redirected;
-    }
-    this.rebuildRows(provider?.getItems(filter) ?? [], provider?.noResultsMessage);
-  }
-
-  private rebuildRows(items: readonly QuickInputItem[], noResultsMessage: string | undefined): void {
-    this.list.textContent = "";
-    this.rows = [];
-    const entries: QuickInputItem[] = [];
-    if (this.includeHelp && this.input.value === "") {
-      entries.push(...this.modeItems());
-    }
-    entries.push(
-      ...items.map((item) => ({
-        ...item,
-        accept: () => {
-          // Close first, so an accept that reopens quick input never has
-          // its fresh panel dismissed by a stale close.
-          this.close();
-          item.accept();
-        },
-      })),
-    );
-    for (const entry of entries) {
-      if (entry.separator !== undefined) {
-        this.list.appendChild(this.buildSeparator(entry.separator));
-      }
-      const row = this.buildRow(entry);
-      this.rows.push(row);
-      this.list.appendChild(row.element);
-    }
-    if (entries.length === 0 && noResultsMessage !== undefined) {
-      const empty = document.createElement("li");
-      empty.className = "ws-quick-input__empty";
-      empty.setAttribute("role", "presentation");
-      empty.textContent = noResultsMessage;
-      this.list.appendChild(empty);
-    }
-    this.setActiveIndex(this.rows.length === 0 ? -1 : 0);
-  }
-
-  /**
-   * The modes list: the help entries with a commandCenterOrder, in that
-   * order. A row's label is its commandCenterLabel or description, its
-   * description the entry's prefix (the provider's own when it has none),
-   * and its keybinding the command's. Accepting a row enters the mode in
-   * place, never closing the panel.
-   */
-  private modeItems(): QuickInputItem[] {
-    const modes = this.registry
-      .getQuickAccessProviders()
-      .flatMap((descriptor) =>
-        descriptor.helpEntries
-          .filter((entry) => entry.commandCenterOrder !== undefined)
-          .map((entry) => ({ descriptor, entry, order: entry.commandCenterOrder ?? 0 })),
-      )
-      .sort((a, b) => a.order - b.order);
-    return modes.map(({ descriptor, entry }) => ({
-      label: entry.commandCenterLabel ?? entry.description,
-      description: entry.prefix ?? descriptor.prefix,
-      keybinding:
-        entry.commandId === undefined ? undefined : this.keybindings.lookupKeybinding(entry.commandId)?.getLabel(),
-      accept: () => {
-        this.input.value = descriptor.prefix;
-        this.route();
-        this.input.focus();
-      },
-    }));
-  }
-
-  /** A group label: a presentational line above the row it opens. */
-  private buildSeparator(text: string): HTMLLIElement {
-    const element = document.createElement("li");
-    element.className = "ws-quick-input__separator";
-    element.setAttribute("role", "presentation");
-    element.textContent = text;
-    return element;
-  }
-
-  private buildRow(item: QuickInputItem): Row {
-    const element = document.createElement("li");
-    element.className = "ws-quick-input__option";
-    element.id = `${this.listId}-option-${this.rows.length}`;
-    element.setAttribute("role", "option");
-    element.setAttribute("aria-selected", "false");
-    const label = document.createElement("span");
-    label.className = "ws-quick-input__option-label";
-    appendLabel(label, item.label, item.labelHighlights);
-    element.appendChild(label);
-    if (item.description !== undefined && item.description !== "") {
-      const description = document.createElement("span");
-      description.className = "ws-quick-input__option-description";
-      description.textContent = item.description;
-      element.appendChild(description);
-    }
-    if (item.keybinding !== undefined && item.keybinding !== "") {
-      element.appendChild(renderKeybinding(item.keybinding));
-    }
-    const row: Row = { element, accept: item.accept };
-    element.addEventListener("pointerdown", (event) => {
-      // Keep the input's focus; the click accepts the row.
-      event.preventDefault();
-    });
-    element.addEventListener("click", () => row.accept());
-    return row;
-  }
-
-  private setActiveIndex(index: number): void {
-    this.activeIndex = index;
-    for (const [rowIndex, row] of this.rows.entries()) {
-      row.element.setAttribute("aria-selected", rowIndex === index ? "true" : "false");
-    }
-    const active = index === -1 ? undefined : this.rows[index];
-    if (active === undefined) {
-      this.input.removeAttribute("aria-activedescendant");
-    } else {
-      this.input.setAttribute("aria-activedescendant", active.element.id);
-    }
-  }
-
-  private moveActive(delta: number): void {
-    const count = this.rows.length;
-    if (count === 0) {
-      return;
-    }
-    this.setActiveIndex((this.activeIndex + delta + count) % count);
-  }
-
-  private onKeydown(event: KeyboardEvent): void {
-    switch (event.key) {
-      case "ArrowDown":
-        event.preventDefault();
-        this.moveActive(1);
-        break;
-      case "ArrowUp":
-        event.preventDefault();
-        this.moveActive(-1);
-        break;
-      case "Enter": {
-        event.preventDefault();
-        const row = this.activeIndex === -1 ? undefined : this.rows[this.activeIndex];
-        row?.accept();
-        break;
-      }
-      case "Escape":
-        event.preventDefault();
-        this.close(true);
-        break;
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/quickinput/quickinput.contribution.ts b/crates/workshop/ui/src/parts/quickinput/quickinput.contribution.ts
deleted file mode 100644
index 6ce731b37..000000000
--- a/crates/workshop/ui/src/parts/quickinput/quickinput.contribution.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-// The quickinput contribution: the eager module that registers the
-// quick-access providers (the ">" palette, the "?" help list, and the
-// "@", "%", "debug ", "task " placeholders, in modes-list order) and
-// the four quick-access actions at module scope, before any service
-// exists. The run bodies resolve the quick input service at call time,
-// so the actions work regardless of when the composition root builds
-// the widget.
-//
-// Menu placements follow the catalog: showCommands sits in View (as
-// "Command Palette...") and Help (as "Show All Commands", a second
-// placement with its own title), quickOpen in Go; quickOpenWithModes is
-// the command center's folder-name button row, and quickOpenHelp the ?
-// help (the title bar's ? chevron is gone, the command stays), so
-// neither is f1. The ctrl-based chords bind ctrlcmd so macOS gets
-// Cmd+Shift+P and Cmd+P; showCommands' second chord (F1) is a separate
-// rule, and the first registered rule owns the palette's keybinding
-// label.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-import { appendMenuItem, MenuId } from "@workshop/platform/menu-registry";
-import { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { createQuickAccessProviderDescriptors } from "./quick-access-providers";
-import { QUICK_INPUT_SERVICE, type QuickInputShowOptions } from "../../services/quick-input-service";
-
-/** Opens quick input at `value`; resolves the widget at call time. */
-function showQuickInput(value: string, options?: QuickInputShowOptions): void {
-  getService(QUICK_INPUT_SERVICE).quickAccess.show(value, options);
-}
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`quickinput action '${action.id}': ${result.error.message}`);
-  }
-}
-
-for (const descriptor of createQuickAccessProviderDescriptors()) {
-  QuickAccessRegistry.registerQuickAccessProvider(descriptor);
-}
-
-addAction({
-  id: "workbench.action.showCommands",
-  title: "Command Palette...",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+shift+p" },
-  menu: [{ id: MenuId.MenubarViewMenu, group: "1_open", order: 1 }],
-  run: () => showQuickInput(">"),
-});
-KeybindingsRegistry.registerKeybindingRule({ id: "workbench.action.showCommands", keybinding: "f1" });
-appendMenuItem(MenuId.MenubarHelpMenu, {
-  command: "workbench.action.showCommands",
-  title: "Show All Commands",
-  group: "1_welcome",
-  order: 1,
-});
-
-addAction({
-  id: "workbench.action.quickOpen",
-  title: "Go to File...",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+p" },
-  menu: [{ id: MenuId.MenubarGoMenu, group: "3_global_nav", order: 1 }],
-  run: () => showQuickInput(""),
-});
-
-addAction({
-  id: "workbench.action.quickOpenWithModes",
-  title: "Quick Open With Modes",
-  menu: [{ id: MenuId.CommandCenter }],
-  run: () => showQuickInput("", { includeHelp: true }),
-});
-
-addAction({
-  id: "workbench.action.quickOpenHelp",
-  title: "Quick Open Help",
-  run: () => showQuickInput("?"),
-});
diff --git a/crates/workshop/ui/src/parts/run/index.ts b/crates/workshop/ui/src/parts/run/index.ts
deleted file mode 100644
index a3b2b79f4..000000000
--- a/crates/workshop/ui/src/parts/run/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-// The run feature's entry point: register() is the panel registry's
-// activation hook. Importers point at the source files directly; this
-// module re-exports nothing.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerPanelFactory } from "@workshop/platform/panel-registry";
-import { RunPanel } from "./run-panel";
-
-/**
- * The run directory's activation: installs the Run window's panel
- * factory. The window's menu action registers eagerly from
- * run.contribution.ts. Called once by the panel registry when the
- * directory's chunk first loads; the returned disposable is held for
- * the page lifetime.
- */
-export function register(): IDisposable {
-  return registerPanelFactory("run", () => new RunPanel());
-}
diff --git a/crates/workshop/ui/src/parts/run/run-panel.css b/crates/workshop/ui/src/parts/run/run-panel.css
deleted file mode 100644
index bbef8d27d..000000000
--- a/crates/workshop/ui/src/parts/run/run-panel.css
+++ /dev/null
@@ -1,258 +0,0 @@
-/* Styles for the Run window panel (run-panel.ts, run-rows.ts), which
-   imports this file; esbuild bundles it into dist/app.css. The layout copies
-   Cursor Settings: a 35px toolbar, the contract as a 4% tinted card of
-   rows (12px radius, rows padded 12px with a 20px gap and inset dividers at
-   4%), text-line empty and error states with inline links, and a right-aligned
-   footer. Themed values come from the :root tokens in @workshop/look/tokens.css
-   and src/tokens/component.css; the controls (buttons, inputs, the switch)
-   use the @workshop/look/controls.css classes. */
-
-.ws-run-panel {
-  position: relative;
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-  min-height: 0;
-  font-family: var(--font-prose);
-  font-size: var(--font-size-base);
-  color: var(--text);
-}
-
-/* A droppable drag over the panel (a tree path or OS files) washes it with
-   the hover color. The overlay lets the drop through to the panel. */
-.ws-run-panel--drag-over::after {
-  content: "";
-  position: absolute;
-  inset: 0;
-  z-index: 1;
-  background: var(--bg-hover);
-  pointer-events: none;
-}
-
-/* The toolbar is a 35px strip padded 8px on each side, holding the path
-   field and its Browse button. */
-.ws-run-panel__toolbar {
-  box-sizing: border-box;
-  display: flex;
-  flex: none;
-  align-items: center;
-  gap: var(--space-2);
-  height: var(--ws-run-toolbar-height);
-  padding: 0 var(--space-2);
-  border-bottom: var(--ws-border-width) solid var(--border);
-}
-
-/* The label names the field for screen readers; the toolbar shows the field. */
-.ws-run-panel__prompt-label {
-  position: absolute;
-  width: var(--ws-size-1);
-  height: var(--ws-size-1);
-  overflow: hidden;
-  clip: rect(0 0 0 0);
-  clip-path: inset(50%);
-  white-space: nowrap;
-}
-
-/* The path field takes the workbench field's border and radius over the
-   IDE's 4% input fill: 24px tall, 12px text. */
-.ws-run-panel__prompt-path {
-  flex: 1;
-  min-width: 0;
-  height: var(--height-sm);
-  border: var(--ws-workbench-input-border);
-  border-radius: var(--ws-workbench-input-radius);
-  background: var(--bg-input);
-  font-size: var(--font-size-sm);
-}
-
-.ws-run-panel__browse {
-  flex: none;
-}
-
-/* The content column is the width container for the stacked rows (the
-   container query at the end of this sheet). It is not the scroller, so its
-   width is the panel's, with no scrollbar gutter taken out: a panel 500px
-   wide keeps its rows side by side. It sits inside the panel, not on it, so
-   the dialogs mounted in the panel keep their overlay over the window:
-   container-type applies layout containment, which makes the element the
-   containing block for fixed descendants. */
-.ws-run-panel__content {
-  container-type: inline-size;
-  display: flex;
-  flex: 1;
-  flex-direction: column;
-  min-height: 0;
-}
-
-.ws-run-panel__body {
-  flex: 1;
-  min-height: 0;
-  overflow: auto;
-  scrollbar-gutter: stable;
-}
-
-/* The empty and error states: a 22px line of text with 20px on the left. */
-.ws-run-panel__message {
-  margin: 0;
-  padding-block: var(--space-3);
-  padding-left: var(--space-5);
-  padding-inline-end: var(--space-3);
-  line-height: var(--line-height-lg);
-  color: var(--text-muted);
-}
-
-.ws-run-panel__error {
-  color: var(--danger-text);
-  white-space: pre-wrap;
-}
-
-/* An inline link: a button that reads as underlined text in the link color. */
-.ws-run-panel__link {
-  display: inline;
-  margin: 0;
-  padding: 0;
-  border: 0;
-  background: none;
-  color: var(--cursor-text-link);
-  font: inherit;
-  text-decoration: underline;
-  cursor: pointer;
-}
-
-.ws-run-panel__link:hover {
-  color: var(--cursor-accent-hover);
-}
-
-.ws-run-panel__link:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-/* The contract is one card; each row is a Settings row, with an inset
-   divider above every row after the first. */
-.ws-run-panel__rows {
-  display: flex;
-  flex-direction: column;
-  margin: var(--space-3);
-  border-radius: var(--radius-xl);
-  background: var(--cursor-bg-quinary);
-}
-
-.ws-run-panel__row {
-  position: relative;
-  display: flex;
-  align-items: center;
-  gap: var(--space-5);
-  padding: var(--space-3);
-}
-
-.ws-run-panel__row + .ws-run-panel__row::before {
-  content: "";
-  position: absolute;
-  top: 0;
-  left: var(--space-3);
-  right: var(--space-3);
-  height: var(--ws-border-width);
-  background: var(--cursor-stroke-quaternary);
-}
-
-/* The text column: the label (with the required marker) over the optional
-   description line. */
-.ws-run-panel__row-text {
-  display: flex;
-  flex: 1 1 0;
-  flex-direction: column;
-  gap: var(--ws-size-2);
-  min-width: 0;
-}
-
-.ws-run-panel__row-title {
-  display: flex;
-  align-items: baseline;
-  gap: var(--ws-size-4);
-  min-width: 0;
-}
-
-.ws-run-panel__row-label {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--font-size-base);
-  font-weight: 400;
-  line-height: var(--line-height-base);
-  color: var(--cursor-text-primary);
-}
-
-.ws-run-panel__row-description {
-  font-size: var(--font-size-base);
-  line-height: var(--line-height-base);
-  color: var(--cursor-text-secondary);
-}
-
-.ws-run-panel__required {
-  flex: none;
-  color: var(--danger-text);
-}
-
-/* The controls column sits on the other side of the row. */
-.ws-run-panel__row-controls {
-  display: flex;
-  flex: 0 1 var(--ws-run-control-width);
-  align-items: center;
-  justify-content: flex-end;
-  gap: var(--space-2);
-  min-width: 0;
-}
-
-.ws-run-panel__value {
-  min-width: 0;
-  overflow: hidden;
-  text-align: end;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.ws-run-panel__field {
-  flex: 1;
-  min-width: 0;
-}
-
-.ws-run-panel__prose {
-  flex: 1;
-  min-width: 0;
-  min-height: var(--ws-run-prose-min-height);
-  resize: vertical;
-}
-
-.ws-run-panel__footer {
-  display: flex;
-  flex: none;
-  justify-content: flex-end;
-  gap: var(--space-2);
-  padding: var(--ws-run-footer-padding);
-  border-top: var(--ws-border-width) solid var(--cursor-stroke-tertiary);
-}
-
-/* Under 500px the rows stack: the text column over the controls, which take
-   the full width. The width is a literal because a custom property can't
-   stand in a container query; it is the 500px of --ws-size-500. */
-@container (width < 500px) {
-  .ws-run-panel__row {
-    flex-direction: column;
-    align-items: stretch;
-    gap: var(--space-2);
-  }
-
-  .ws-run-panel__row-text {
-    flex: none;
-  }
-
-  .ws-run-panel__row-controls {
-    flex: none;
-    justify-content: flex-start;
-  }
-
-  .ws-run-panel__value {
-    text-align: start;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/run/run-panel.ts b/crates/workshop/ui/src/parts/run/run-panel.ts
deleted file mode 100644
index 387b88f0b..000000000
--- a/crates/workshop/ui/src/parts/run/run-panel.ts
+++ /dev/null
@@ -1,406 +0,0 @@
-// The Run window panel: one window per instance, in the main zone. The
-// state machine is empty (no prompt chosen: the prompt field, Browse,
-// and the drop target), loading (the tab title shimmers through
-// setTabLoading; the body stays blank), ready (the contract rows and the
-// enabled Run button, whose click handler is deliberately empty in this
-// slice), and error (the parser's or transport's message as one row,
-// with Choose Prompt). A generation counter discards a superseded load,
-// so a fast Choose-Prompt-then-drop sequence never renders stale rows.
-//
-// The layout copies Cursor Settings: the toolbar is a 35px strip whose
-// "Prompt" label is for screen readers only, the empty and error states
-// are text lines with Browse... and Choose Prompt as inline links, a
-// droppable drag marks the panel with a drag-over overlay class, and the
-// typed-path dialogs (Choose Prompt, Choose Input) are Cursor's form
-// modal, Cancel first.
-//
-// The panel never reads disk: prompt text arrives through the confined
-// GET /workspace/file and is posted to POST /prompts/contract. Prompts
-// arrive three ways: Browse (the native picker filtered to .md in the
-// desktop app, a typed-path dialog in a plain browser, then the
-// existing grant flow), a drag from the workspace tree (the
-// application/x-workshop-path payload; the tree only hands out granted
-// paths), and an OS drop (granted by workspace-drops before the
-// workshop:file-drop dispatch reaches this panel; the first .md wins).
-
-import { open } from "@tauri-apps/plugin-dialog";
-import type { GroupPanelPartInitParameters } from "dockview";
-
-import { toDisposable } from "@workshop/platform/lifecycle";
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-import { errorText } from "../../services/error-catalog";
-import { fetchPromptContract, type RunContract } from "../../services/run-api";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { fetchFile } from "../../services/workspace-api";
-import { showPanelDialog } from "../shared/panel-dialog";
-import { setTabLoading } from "../layout/panel-tab";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { grantPath, WORKSPACE_FILE_DROP_EVENT } from "../workspace/workspace-drops";
-import { renderContractRows } from "./run-rows";
-import "./run-panel.css";
-
-/** The dataTransfer type the workspace tree's drag-out sets. */
-const WORKSHOP_PATH_MIME = "application/x-workshop-path";
-
-/** The class a droppable drag puts on the panel while it hovers; the overlay is its ::after. */
-const DRAG_OVER_CLASS = "ws-run-panel--drag-over";
-
-/** The path field's id counter: each window's label needs an id of its own. */
-let promptFieldCount = 0;
-
-/** True when the drag holds a workspace-tree path or OS files, the two things the panel accepts. */
-function isDroppableDrag(event: DragEvent): boolean {
-  const types = event.dataTransfer?.types;
-  if (types === undefined) {
-    return false;
-  }
-  const held = Array.from(types);
-  return held.includes(WORKSHOP_PATH_MIME) || held.includes("Files");
-}
-
-/** An inline text-link button: the Cursor-style link that sits in a line of text. */
-function linkButton(text: string, extraClass: string, onClick: () => void): HTMLButtonElement {
-  const link = document.createElement("button");
-  link.type = "button";
-  link.className = `ws-run-panel__link ${extraClass}`;
-  link.textContent = text;
-  link.addEventListener("click", onClick);
-  return link;
-}
-
-/** The panel's states. */
-type RunState = "empty" | "loading" | "ready" | "error";
-
-/** The file's base name, for the contract request and the tab title. */
-function baseName(path: string): string {
-  return path.split(/[\\/]/).filter(Boolean).pop() ?? path;
-}
-
-export class RunPanel extends WorkshopPart {
-  private state: RunState = "empty";
-  private generation = 0;
-  private panelId: string | null = null;
-  private contract: RunContract | null = null;
-  private failure: string | null = null;
-  private promptPath: string | null = null;
-  // The open Choose Prompt / input Browse dialog, dismissed with the panel.
-  private dialog: { dispose(): void } | null = null;
-
-  // Holds the toolbar, body, and footer. It is the width container the rows
-  // stack against, so its width is the panel's. The panel's dialogs mount in
-  // the panel element beside it, outside the container, which would
-  // otherwise be the containing block for their fixed overlay.
-  private readonly content = document.createElement("div");
-  private readonly toolbar = document.createElement("div");
-  private readonly promptField = document.createElement("input");
-  private readonly body = document.createElement("div");
-  private readonly footer = document.createElement("div");
-  private readonly runButton = document.createElement("button");
-
-  constructor() {
-    super();
-    this.element.className = "ws-run-panel";
-    // The whole panel is the OS-drop target; workspace-drops dispatches
-    // workshop:file-drop here after granting the dropped paths.
-    this.element.setAttribute("data-ws-file-drop", "");
-  }
-
-  override init(parameters: GroupPanelPartInitParameters): void {
-    this.panelId = parameters.api.id;
-    super.init(parameters);
-    const path = parameters.params?.path;
-    if (typeof path === "string" && path.length > 0) {
-      void this.load(path);
-    }
-  }
-
-  protected create(parent: HTMLElement): void {
-    this.toolbar.className = "ws-run-panel__toolbar";
-    // The label is read by screen readers only; the toolbar shows the field.
-    const promptLabel = document.createElement("label");
-    promptLabel.className = "ws-run-panel__prompt-label";
-    promptLabel.textContent = "Prompt";
-    promptFieldCount += 1;
-    this.promptField.id = `ws-run-prompt-path-${promptFieldCount}`;
-    promptLabel.htmlFor = this.promptField.id;
-    this.promptField.type = "text";
-    this.promptField.className = "input ws-run-panel__prompt-path";
-    this.promptField.placeholder = "No prompt chosen";
-    this.promptField.addEventListener("keydown", (event) => {
-      if (event.key === "Enter" && this.promptField.value.trim().length > 0) {
-        void this.grantAndLoad(this.promptField.value.trim());
-      }
-    });
-    const browse = document.createElement("button");
-    browse.type = "button";
-    browse.className = "button button-outline button-sm ws-run-panel__browse";
-    browse.textContent = "Browse...";
-    browse.addEventListener("click", () => this.browsePrompt());
-    this.toolbar.append(promptLabel, this.promptField, browse);
-
-    this.body.className = "ws-run-panel__body";
-
-    this.footer.className = "ws-run-panel__footer";
-    this.runButton.type = "button";
-    this.runButton.className = "button button-primary ws-run-panel__run";
-    this.runButton.textContent = "Run";
-    this.runButton.disabled = true;
-    // Execution is out of scope for this slice: the button exists so the
-    // window's shape is final, and does nothing when clicked.
-    this.runButton.addEventListener("click", () => undefined);
-    this.footer.appendChild(this.runButton);
-
-    this.content.className = "ws-run-panel__content";
-    this.content.append(this.toolbar, this.body, this.footer);
-    parent.appendChild(this.content);
-
-    // Tree drags: accept the workshop-path payload anywhere on the panel.
-    const onDragOver = (event: DragEvent): void => {
-      if (event.dataTransfer?.types.includes(WORKSHOP_PATH_MIME) === true) {
-        event.preventDefault();
-      }
-    };
-    this.element.addEventListener("dragover", onDragOver);
-    // The drag-over mark: dragenter and dragleave fire for every child the
-    // pointer crosses, so a depth count keeps the class up until the drag
-    // has left the panel. A drop, or a drag that ends anywhere, resets it.
-    let dragDepth = 0;
-    const clearDragOver = (): void => {
-      dragDepth = 0;
-      this.element.classList.remove(DRAG_OVER_CLASS);
-    };
-    const onDragEnter = (event: DragEvent): void => {
-      if (isDroppableDrag(event)) {
-        dragDepth += 1;
-        this.element.classList.add(DRAG_OVER_CLASS);
-      }
-    };
-    const onDragLeave = (event: DragEvent): void => {
-      if (isDroppableDrag(event)) {
-        dragDepth = Math.max(0, dragDepth - 1);
-        if (dragDepth === 0) {
-          this.element.classList.remove(DRAG_OVER_CLASS);
-        }
-      }
-    };
-    this.element.addEventListener("dragenter", onDragEnter);
-    this.element.addEventListener("dragleave", onDragLeave);
-    window.addEventListener("dragend", clearDragOver);
-    const onDrop = (event: DragEvent): void => {
-      clearDragOver();
-      if (event.dataTransfer?.types.includes(WORKSHOP_PATH_MIME) !== true) {
-        return;
-      }
-      event.preventDefault();
-      const path = event.dataTransfer.getData(WORKSHOP_PATH_MIME);
-      if (path.length > 0) {
-        void this.load(path);
-      }
-    };
-    this.element.addEventListener("drop", onDrop);
-    // OS drops arrive granted; the first .md path wins.
-    const onFileDrop = (event: Event): void => {
-      const detail: unknown = event instanceof CustomEvent ? event.detail : null;
-      if (typeof detail !== "object" || detail === null || !("paths" in detail)) {
-        return;
-      }
-      const { paths } = detail;
-      if (!Array.isArray(paths)) {
-        return;
-      }
-      const prompt = paths.find(
-        (path): path is string => typeof path === "string" && path.toLowerCase().endsWith(".md"),
-      );
-      if (prompt !== undefined) {
-        void this.load(prompt);
-      }
-    };
-    this.element.addEventListener(WORKSPACE_FILE_DROP_EVENT, onFileDrop);
-    this._register(
-      toDisposable(() => {
-        this.element.removeEventListener("dragover", onDragOver);
-        this.element.removeEventListener("dragenter", onDragEnter);
-        this.element.removeEventListener("dragleave", onDragLeave);
-        window.removeEventListener("dragend", clearDragOver);
-        this.element.removeEventListener("drop", onDrop);
-        this.element.removeEventListener(WORKSPACE_FILE_DROP_EVENT, onFileDrop);
-      }),
-    );
-    this.render();
-  }
-
-  override dispose(): void {
-    this.dialog?.dispose();
-    this.dialog = null;
-    super.dispose();
-  }
-
-  /** Transitions the state machine, driving the tab's shimmer. */
-  private setState(state: RunState): void {
-    this.state = state;
-    if (this.panelId !== null) {
-      setTabLoading(this.panelId, state === "loading");
-    }
-    this.render();
-  }
-
-  /**
-   * Loads one prompt file: reads its text through the confined file
-   * route, posts the text to the parse route, and renders the contract.
-   * A load that settles after a newer load started is discarded.
-   */
-  private async load(path: string): Promise<void> {
-    const generation = ++this.generation;
-    this.promptPath = path;
-    this.setState("loading");
-    const name = baseName(path);
-    try {
-      const file = await fetchFile(path);
-      const contract = await fetchPromptContract(name, file.text);
-      if (generation !== this.generation) {
-        return;
-      }
-      this.contract = contract;
-      this.failure = null;
-      this.panelApi?.setTitle(`Run: ${name}`);
-      this.setState("ready");
-    } catch (error) {
-      if (generation !== this.generation) {
-        return;
-      }
-      this.contract = null;
-      this.failure = errorText(error);
-      this.setState("error");
-    }
-  }
-
-  /**
-   * The Browse flow: the native picker filtered to .md in the desktop
-   * app, a typed-path dialog in a plain browser. The chosen path is
-   * granted through the existing grant flow before it is read.
-   */
-  private browsePrompt(): void {
-    if (window.__TAURI_INTERNALS__ !== undefined) {
-      void open({
-        directory: false,
-        title: "Choose Prompt",
-        filters: [{ name: "Prompt", extensions: ["md"] }],
-      }).then((picked) => {
-        if (typeof picked === "string") {
-          void this.grantAndLoad(picked);
-        }
-      });
-      return;
-    }
-    this.dialog?.dispose();
-    this.dialog = showPanelDialog({
-      container: this.element,
-      classPrefix: "ws-run-choose",
-      titleId: "run-choose-title",
-      title: "Choose Prompt",
-      message: "Enter the full path of a prompt file.",
-      skin: "form",
-      field: { id: "run-choose-path", label: "Prompt path" },
-      buttons: [
-        { label: "Cancel", run: () => undefined },
-        {
-          label: "Choose",
-          primary: true,
-          requiresValue: true,
-          run: (value) => {
-            void this.grantAndLoad(value);
-          },
-        },
-      ],
-    });
-  }
-
-  /** Grants a chosen or typed path, then loads it. */
-  private async grantAndLoad(path: string): Promise<void> {
-    const result = await grantPath(path);
-    if (!result.ok) {
-      getServiceOrNull(STATUS_BAR)?.showLocal(
-        `Could not open ${path}: ${result.error.message}`,
-        "error",
-      );
-      return;
-    }
-    await this.load(path);
-  }
-
-  /** The input row's Browse: fills the field, reading nothing. */
-  private browseInput(field: HTMLInputElement): void {
-    if (window.__TAURI_INTERNALS__ !== undefined) {
-      void open({ directory: false, title: "Choose Input" }).then((picked) => {
-        if (typeof picked === "string") {
-          field.value = picked;
-        }
-      });
-      return;
-    }
-    this.dialog?.dispose();
-    this.dialog = showPanelDialog({
-      container: this.element,
-      classPrefix: "ws-run-input",
-      titleId: "run-input-title",
-      title: "Choose Input",
-      message: "Enter the full path of the input file.",
-      skin: "form",
-      field: { id: "run-input-path", label: "Input path" },
-      buttons: [
-        { label: "Cancel", run: () => undefined },
-        {
-          label: "Choose",
-          primary: true,
-          requiresValue: true,
-          run: (value) => {
-            field.value = value;
-          },
-        },
-      ],
-    });
-  }
-
-  /** Paints the body's state-dependent content and the Run button. */
-  private render(): void {
-    this.promptField.value = this.promptPath ?? "";
-    this.runButton.disabled = this.state !== "ready";
-    this.body.textContent = "";
-    if (this.state === "empty") {
-      // One line of text that ends in the Browse... link.
-      const hint = document.createElement("p");
-      hint.className = "ws-run-panel__message ws-run-panel__hint";
-      hint.append(
-        "Drop a prompt file here, or ",
-        linkButton("Browse...", "ws-run-panel__browse-link", () => this.browsePrompt()),
-      );
-      this.body.appendChild(hint);
-      return;
-    }
-    if (this.state === "loading") {
-      // The loading signal is the tab title's shimmer; the body stays blank.
-      return;
-    }
-    if (this.state === "error") {
-      // The alert holds only the message; Choose Prompt follows it inline.
-      const message = document.createElement("div");
-      message.className = "ws-run-panel__message";
-      const error = document.createElement("span");
-      error.className = "ws-run-panel__error";
-      error.setAttribute("role", "alert");
-      error.textContent = this.failure ?? "The prompt could not be parsed.";
-      message.append(
-        error,
-        " ",
-        linkButton("Choose Prompt", "ws-run-panel__choose", () => this.browsePrompt()),
-      );
-      this.body.appendChild(message);
-      return;
-    }
-    if (this.contract !== null) {
-      renderContractRows(this.body, this.contract, {
-        browseInput: (field) => this.browseInput(field),
-      });
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/run/run-rows.ts b/crates/workshop/ui/src/parts/run/run-rows.ts
deleted file mode 100644
index 0c4c05f38..000000000
--- a/crates/workshop/ui/src/parts/run/run-rows.ts
+++ /dev/null
@@ -1,210 +0,0 @@
-// The Run window's contract rows: one renderer per contract section,
-// pure DOM building over the narrowed RunContract. Every frontmatter
-// key present in the prompt except `uses`, which has nothing to
-// bind, appears as exactly one row: name, description, and runvil
-// read-only; input a text field plus Browse; output a text field; one
-// control per arg by type with required markers and defaults (the
-// implicit declaration is the single prose box); model roles
-// read-only; max_tool_iterations numeric with the runtime-default
-// placeholder. No bind-time validation runs here - validation is the
-// parser's alone.
-//
-// The rows are Cursor Settings rows: a text column holding the label (with
-// the required marker beside it) and, for an arg that has one, its
-// description as a visible second line, and a controls column on the other
-// side. A boolean arg is a `.switch` button, as Cursor's settings toggles
-// are.
-
-import type { RunContract, RunContractArg } from "../../services/run-api";
-
-/** The panel's hooks the rows need. */
-export interface RunRowsOptions {
-  /** Fills the input row's field through the panel's file-pick flow. */
-  readonly browseInput: (field: HTMLInputElement) => void;
-}
-
-/** What a row shows beside its label. */
-interface RowDetails {
-  /** The second line under the label; blank or absent draws none. */
-  readonly description?: string | null;
-  /** Draws the required marker beside the label. */
-  readonly required?: boolean;
-}
-
-/**
- * One Settings row: a text column (the label, its required marker, and the
- * optional description line) beside a controls column holding the given nodes.
- */
-function row(label: string, controls: readonly Node[], details: RowDetails = {}): HTMLElement {
-  const element = document.createElement("div");
-  element.className = "ws-run-panel__row";
-
-  const text = document.createElement("div");
-  text.className = "ws-run-panel__row-text";
-  const title = document.createElement("div");
-  title.className = "ws-run-panel__row-title";
-  const labelElement = document.createElement("span");
-  labelElement.className = "ws-run-panel__row-label";
-  labelElement.textContent = label;
-  title.appendChild(labelElement);
-  if (details.required === true) {
-    title.appendChild(requiredMarker());
-  }
-  text.appendChild(title);
-  if (details.description !== undefined && details.description !== null && details.description.length > 0) {
-    const description = document.createElement("div");
-    description.className = "ws-run-panel__row-description";
-    description.textContent = details.description;
-    text.appendChild(description);
-  }
-
-  const controlColumn = document.createElement("div");
-  controlColumn.className = "ws-run-panel__row-controls";
-  controlColumn.append(...controls);
-  element.append(text, controlColumn);
-  return element;
-}
-
-/** A read-only value span. */
-function readOnly(text: string): HTMLElement {
-  const value = document.createElement("span");
-  value.className = "ws-run-panel__value";
-  value.textContent = text;
-  return value;
-}
-
-/** A text field with the shared control skin. */
-function textField(value: string, placeholder = ""): HTMLInputElement {
-  const field = document.createElement("input");
-  field.type = "text";
-  field.className = "input ws-run-panel__field";
-  field.value = value;
-  field.placeholder = placeholder;
-  return field;
-}
-
-/** The required marker on a non-optional arg. */
-function requiredMarker(): HTMLElement {
-  const marker = document.createElement("span");
-  marker.className = "ws-run-panel__required";
-  marker.textContent = "*";
-  marker.title = "required";
-  return marker;
-}
-
-/**
- * A boolean arg's control: Cursor's switch, a `<button role="switch">` whose
- * `aria-checked` is the value. A click or Space/Enter flips it.
- */
-function booleanSwitch(arg: RunContractArg): HTMLButtonElement {
-  const toggle = document.createElement("button");
-  toggle.type = "button";
-  toggle.className = "switch ws-run-panel__switch";
-  toggle.setAttribute("role", "switch");
-  toggle.setAttribute("aria-label", arg.name);
-  toggle.setAttribute("aria-checked", String(arg.default === true));
-  toggle.addEventListener("click", () => {
-    toggle.setAttribute("aria-checked", String(toggle.getAttribute("aria-checked") !== "true"));
-  });
-  return toggle;
-}
-
-/** One arg's control by its declared type, prefilled from its default. */
-function argControl(arg: RunContractArg): HTMLElement {
-  if (arg.type === "boolean") {
-    return booleanSwitch(arg);
-  }
-  if (arg.type === "integer" || arg.type === "number") {
-    const field = document.createElement("input");
-    field.type = "number";
-    field.className = "input ws-run-panel__field";
-    if (arg.type === "integer") {
-      field.step = "1";
-    }
-    if (typeof arg.default === "number") {
-      field.value = String(arg.default);
-    }
-    return field;
-  }
-  return textField(typeof arg.default === "string" ? arg.default : "");
-}
-
-/**
- * Renders every contract section into `container`. The caller clears
- * the container first; rows append in contract order.
- */
-export function renderContractRows(
-  container: HTMLElement,
-  contract: RunContract,
-  options: RunRowsOptions,
-): void {
-  const rows = document.createElement("div");
-  rows.className = "ws-run-panel__rows";
-
-  rows.appendChild(row("name", [readOnly(contract.name)]));
-  if (contract.description.length > 0) {
-    rows.appendChild(row("description", [readOnly(contract.description)]));
-  }
-  if (contract.runvil !== null) {
-    rows.appendChild(row("runvil", [readOnly(String(contract.runvil))]));
-  }
-
-  const inputField = textField(contract.input?.path ?? "", contract.input?.description ?? "");
-  const inputBrowse = document.createElement("button");
-  inputBrowse.type = "button";
-  inputBrowse.className = "button button-outline button-sm ws-run-panel__input-browse";
-  inputBrowse.textContent = "Browse...";
-  inputBrowse.addEventListener("click", () => options.browseInput(inputField));
-  rows.appendChild(row("input", [inputField, inputBrowse]));
-
-  rows.appendChild(
-    row("output", [textField(contract.output?.path ?? "", contract.output?.description ?? "")]),
-  );
-
-  if (contract.args.implicit) {
-    // The implicit declaration is the single prose field, a multiline box.
-    const prose = document.createElement("textarea");
-    prose.className = "input ws-run-panel__prose";
-    const proseField = contract.args.fields[0];
-    if (proseField !== undefined && typeof proseField.default === "string") {
-      prose.value = proseField.default;
-    }
-    rows.appendChild(
-      row(proseField?.name ?? "prose", [prose], { description: proseField?.description ?? null }),
-    );
-  } else {
-    for (const arg of contract.args.fields) {
-      // The description is a visible second line under the label, not a tooltip.
-      rows.appendChild(
-        row(arg.name, [argControl(arg)], { description: arg.description, required: !arg.optional }),
-      );
-    }
-  }
-
-  for (const model of contract.models) {
-    const parts: string[] = [];
-    if (model.minContext !== null) {
-      parts.push(`min context ${model.minContext}`);
-    }
-    if (model.thinking !== null) {
-      parts.push(model.thinking ? "thinking" : "no thinking");
-    }
-    const details = parts.join(", ");
-    const modelRow = row(model.label, [readOnly(details)]);
-    modelRow.classList.add("ws-run-panel__row--model");
-    rows.appendChild(modelRow);
-  }
-
-  const iterations = document.createElement("input");
-  iterations.type = "number";
-  iterations.className = "input ws-run-panel__field";
-  iterations.step = "1";
-  if (contract.maxToolIterations === null) {
-    iterations.placeholder = "runtime default";
-  } else {
-    iterations.value = String(contract.maxToolIterations);
-  }
-  rows.appendChild(row("max_tool_iterations", [iterations]));
-
-  container.appendChild(rows);
-}
diff --git a/crates/workshop/ui/src/parts/run/run.contribution.ts b/crates/workshop/ui/src/parts/run/run.contribution.ts
deleted file mode 100644
index 80180e634..000000000
--- a/crates/workshop/ui/src/parts/run/run.contribution.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-// The run contribution: the eager module registering the New Run Window
-// row at module scope, before any service exists. The run body opens a
-// fresh Run panel keyed by a random instance id - each invocation is its
-// own window in the main zone - seeded with the focused editor's file
-// when there is one. main.ts imports zones.ts eagerly (it boots the
-// dock through it), so the module is already loaded and the open call
-// is direct; the editor command layer pulls CodeMirror, so it is
-// lazy-imported here, and the run chunk itself still loads lazily
-// through the panel registry.
-//
-// The id is ours: no VS Code or Cursor row backs this window. One menu
-// item, no keybinding - F5 belongs to the full plan's Run Prompt
-// command. The disabled debug stubs in stubs.contribution.ts stay
-// untouched; this row lands in its own group above them.
-//
-// The Run panel's type registers here too, keyed by the `instance`
-// param and titled after the seeded file.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { DOCK, registerPanelType } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { lastSegment } from "../../base/paths";
-import { openInZone } from "../layout/zones";
-
-registerPanelType({
-  type: "run",
-  title: (params) => {
-    const name = typeof params.path === "string" ? lastSegment(params.path) : undefined;
-    return name === undefined ? "Run" : `Run: ${name}`;
-  },
-  defaultZone: "main",
-  load: () => import("./index"),
-});
-
-const action: ActionDescriptor = {
-  id: "workbench.action.newRunWindow",
-  title: "New Run Window",
-  menu: [{ id: MenuId.MenubarRunMenu, group: "0_run", order: 1 }],
-  run: () => {
-    void import("../editor/editor-commands").then(({ asEditor }) => {
-      openInZone("run", {
-        instance: window.crypto.randomUUID(),
-        path: asEditor(getService(DOCK).activePanel)?.filePath() ?? undefined,
-      });
-    });
-  },
-};
-const result: Result<IDisposable, ParseError> = registerAction(action);
-if (!result.ok) {
-  console.error(`run action '${action.id}': ${result.error.message}`);
-}
diff --git a/crates/workshop/ui/src/parts/shared/clipboard.ts b/crates/workshop/ui/src/parts/shared/clipboard.ts
deleted file mode 100644
index 13d5d8693..000000000
--- a/crates/workshop/ui/src/parts/shared/clipboard.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-// The one clipboard write the Workshop's copy buttons share (the
-// transcript's code blocks and turn footer, the About dialog's version
-// rows). It reads the browser global at call time, so a test (or a window
-// without the API) degrades instead of throwing at import.
-
-/**
- * Puts `text` on the system clipboard. Resolves true once it landed, false
- * when the page has no clipboard or the write was refused; callers show
- * their confirmation only on true.
- */
-export async function copyToClipboard(text: string): Promise<boolean> {
-  const clipboard = typeof navigator === "undefined" ? undefined : navigator.clipboard;
-  if (clipboard === undefined || typeof clipboard.writeText !== "function") {
-    return false;
-  }
-  try {
-    await clipboard.writeText(text);
-    return true;
-  } catch {
-    return false;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/shared/panel-dialog.ts b/crates/workshop/ui/src/parts/shared/panel-dialog.ts
deleted file mode 100644
index 66c357a01..000000000
--- a/crates/workshop/ui/src/parts/shared/panel-dialog.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-// Themed modal dialogs for the workshop panels, built on the shared
-// focus-trapped modal (@workshop/look/modal): an overlay inside the panel
-// element, a role="dialog" surface, an optional labeled text field, a
-// Tab focus trap, Escape dismissal, and focus return to the invoker.
-// The editor's conflict, revert, and close prompts and the workshop tree's
-// Add Folder prompt are built through this one helper so their behavior
-// never diverges. The `skin` picks Cursor's confirmation prompt (save,
-// revert, overwrite) or its form modal (Add Folder); the skin owns the
-// dialog's look, so a caller carries no per-dialog stylesheet.
-
-import { openModal, type ModalSkin } from "@workshop/look/modal";
-
-import { toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-
-/**
- * One dialog action. `run` executes after the dialog dismisses, receiving
- * the field's trimmed value (the empty string when the dialog has none).
- */
-export interface PanelDialogButton {
-  readonly label: string;
-  readonly danger?: boolean;
-  /** The dialog's main action: it takes first focus, and the skin places it. */
-  readonly primary?: boolean;
-  /** Disables the button while the field's trimmed value is empty. */
-  readonly requiresValue?: boolean;
-  readonly run: (value: string) => void;
-}
-
-/** An optional single-line text field between the message and the actions. */
-export interface PanelDialogField {
-  /** The input's id, unique per dialog kind for the label association. */
-  readonly id: string;
-  readonly label: string;
-  /** Placeholder text shown while the field is empty. */
-  readonly placeholder?: string;
-  /** The field's initial text, selected on open so typing replaces it. */
-  readonly value?: string;
-}
-
-export interface PanelDialogOptions {
-  /** The panel element the overlay mounts into. */
-  readonly container: HTMLElement;
-  /** BEM-style class prefix, e.g. "ws-editor-conflict" or "ws-editor-close". */
-  readonly classPrefix: string;
-  /** The title element's id, unique per dialog kind for aria-labelledby. */
-  readonly titleId: string;
-  readonly title: string;
-  readonly message: string;
-  /** Cursor's confirmation or form skin; without one the dialog is unskinned. */
-  readonly skin?: ModalSkin;
-  readonly field?: PanelDialogField;
-  readonly buttons: readonly PanelDialogButton[];
-  /** Called when Escape dismisses the dialog; no button's run fires then. */
-  readonly onDismiss?: () => void;
-}
-
-/**
- * Opens the dialog and focuses its field when it has one, its first
- * button otherwise. A second call while the same dialog kind is open is
- * a no-op. Escape dismissal returns focus to the element that was
- * focused when the dialog opened.
- *
- * Returns a disposable that dismisses the dialog if it is still open, so
- * the invoking panel owns the document-level focus trap: a panel disposed
- * while its dialog is up tears the trap down with it.
- */
-export function showPanelDialog(options: PanelDialogOptions): IDisposable {
-  const handle = openModal(options);
-  return toDisposable(() => handle.close());
-}
diff --git a/crates/workshop/ui/src/parts/status/activity-indicator.ts b/crates/workshop/ui/src/parts/status/activity-indicator.ts
deleted file mode 100644
index 8332ca484..000000000
--- a/crates/workshop/ui/src/parts/status/activity-indicator.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-// The activity LED: an indicator slot the status bar holds, driven by the
-// observer's status frames. Thinking lights it amber and generating
-// green, with green winning while both coincide. Every thinking or
-// generating frame - debug frames included - pulses it; info and error
-// frames also set or clear the sustained state that the pulse decays to.
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import type { StatusIndicatorHandle, StatusIndicators } from "@workshop/platform/status-indicators";
-import type { StatusFrame } from "../../services/protocol";
-
-type PulseActivity = "thinking" | "generating";
-
-// Used when the stylesheet's --led-pulse-ms cannot be read (jsdom, or a
-// skin that dropped the variable).
-const DEFAULT_LED_PULSE_MS = 250;
-
-export class ActivityIndicator extends Disposable {
-  private readonly led: StatusIndicatorHandle;
-  private readonly lit = new Set<PulseActivity>();
-  private sustained: PulseActivity | null = null;
-  private ledTimer: ReturnType<typeof setTimeout> | null = null;
-
-  constructor(indicators: StatusIndicators) {
-    super();
-    this.led = this._register(
-      indicators.register({ id: "activity", name: "Activity indicator", order: 1, decorative: true }),
-    );
-    // The pulse decay timer is the indicator's only other owned resource.
-    this._register(
-      toDisposable(() => {
-        if (this.ledTimer !== null) {
-          clearTimeout(this.ledTimer);
-          this.ledTimer = null;
-        }
-      }),
-    );
-  }
-
-  /** Applies one observer update. Debug frames pulse the LED only. */
-  render(frame: StatusFrame): void {
-    if (frame.activity === "thinking" || frame.activity === "generating") {
-      this.pulse(frame.activity);
-    }
-    if (frame.severity === "debug") {
-      return;
-    }
-    // Info/error frames set or clear the sustained LED state. Thinking
-    // keeps the amber LED lit until something else takes over; any other
-    // activity clears it so the LED returns to idle after the pulse decays.
-    this.sustained = frame.activity === "thinking" ? "thinking" : null;
-    // With no pulse pending, nothing else will ever repaint the LED - an
-    // earlier pulse's decay may have re-added the old sustained state to
-    // the lit set and cleared the timer, orphaning that glow. Land the lit
-    // set on the new sustained value here. A pending pulse needs no help:
-    // its decay already lands on the updated sustained state.
-    if (this.ledTimer === null) {
-      this.lit.clear();
-      if (this.sustained) this.lit.add(this.sustained);
-      this.applyLed();
-    }
-  }
-
-  /**
-   * Turns the LED dark after the persistent socket drops: the sustained
-   * state, any pending pulse, and the lit set all clear at once.
-   */
-  reset(): void {
-    this.sustained = null;
-    if (this.ledTimer !== null) {
-      clearTimeout(this.ledTimer);
-      this.ledTimer = null;
-    }
-    this.lit.clear();
-    this.applyLed();
-  }
-
-  /**
-   * Lights the LED for one pulse window. JS only toggles a modifier class;
-   * the glow and its fades are pure CSS (the modifier's transition is a
-   * fast fade-in, the idle rule's transition is the ~--led-pulse-ms
-   * ease-out decay). One shared hold timer: any pulse re-arms the window,
-   * so a stream of pulses reads as one continuous glow that fades when the
-   * activity stops.
-   */
-  private pulse(activity: PulseActivity): void {
-    this.lit.add(activity);
-    this.applyLed();
-    if (this.ledTimer !== null) {
-      clearTimeout(this.ledTimer);
-    }
-    this.ledTimer = setTimeout(() => {
-      this.lit.clear();
-      if (this.sustained) this.lit.add(this.sustained);
-      this.applyLed();
-      this.ledTimer = null;
-    }, this.pulseMs());
-  }
-
-  /** Applies the lit set: green wins while generating and thinking coincide. */
-  private applyLed(): void {
-    if (this.lit.has("generating")) {
-      this.led.set("green");
-    } else if (this.lit.has("thinking")) {
-      this.led.set("amber");
-    } else {
-      this.led.set(null);
-    }
-  }
-
-  /** The hold window, tunable from the stylesheet as --led-pulse-ms. */
-  private pulseMs(): number {
-    const raw = getComputedStyle(document.documentElement).getPropertyValue("--led-pulse-ms").trim();
-    const match = /^(\d+(?:\.\d+)?)(ms|s)$/.exec(raw);
-    if (match === null || match[1] === undefined) {
-      return DEFAULT_LED_PULSE_MS;
-    }
-    const value = Number.parseFloat(match[1]);
-    return match[2] === "s" ? value * 1000 : value;
-  }
-}
diff --git a/crates/workshop/ui/src/parts/status/mic-meter.ts b/crates/workshop/ui/src/parts/status/mic-meter.ts
deleted file mode 100644
index 34e93ac65..000000000
--- a/crates/workshop/ui/src/parts/status/mic-meter.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-// The mic meter: a status bar slot left of the record LED showing the
-// shared microphone's loudness while someone dictates. It keeps the last
-// METER_BARS chunk levels and draws them newest on the right, one
-// animation frame per batch of new levels, only while capture has an
-// owner; idle, the bars rest as dots and no frame is requested. The
-// tooltip and accessible label name the owner, and a click reveals it.
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import type { StatusIndicators, StatusSlotHandle } from "@workshop/platform/status-indicators";
-import type { SpeechCaptureService } from "../../services/speech-capture";
-
-/** How many recent levels the meter shows. */
-export const METER_BARS = 9;
-
-export class MicMeter extends Disposable {
-  private readonly slot: StatusSlotHandle;
-  private readonly bars: HTMLElement[];
-  private readonly levels: number[] = new Array<number>(METER_BARS).fill(0);
-  private frame: number | null = null;
-  private tooltip: string | undefined;
-
-  constructor(
-    indicators: StatusIndicators,
-    private readonly capture: SpeechCaptureService,
-  ) {
-    super();
-    this.slot = this._register(
-      indicators.registerSlot({
-        id: "mic-meter",
-        name: "Microphone",
-        order: -1,
-        activate: () => this.capture.presence?.reveal(),
-      }),
-    );
-    this.slot.element.classList.add("status-bar__meter");
-    this.bars = Array.from({ length: METER_BARS }, () => {
-      const bar = document.createElement("span");
-      bar.className = "status-bar__meter-bar";
-      return bar;
-    });
-    this.slot.element.append(...this.bars);
-    this._register(toDisposable(() => this.cancelFrame()));
-    this._register(capture.onLevel((level) => this.push(level)));
-    this._register(capture.onOwnerChange(() => this.sync()));
-    this.sync();
-  }
-
-  /** Scrolls in one owned level and asks for a frame unless one is pending. */
-  private push(level: number): void {
-    if (this.capture.presence === null) {
-      return;
-    }
-    this.levels.shift();
-    this.levels.push(level);
-    this.frame ??= window.requestAnimationFrame(() => {
-      this.frame = null;
-      this.draw();
-    });
-  }
-
-  /** Restarts from silence for a new owner, or rests as idle dots without one. */
-  private sync(): void {
-    this.cancelFrame();
-    this.levels.fill(0);
-    this.slot.element.classList.toggle("status-bar__meter--idle", this.capture.presence === null);
-    this.draw();
-  }
-
-  /** Paints every bar's level and refreshes the tooltip, so a renamed owner shows. */
-  private draw(): void {
-    this.bars.forEach((bar, index) => {
-      bar.style.setProperty("--level", String(this.levels[index] ?? 0));
-    });
-    const presence = this.capture.presence;
-    const tooltip = presence === null ? undefined : `Dictating to ${presence.label()}`;
-    if (tooltip !== this.tooltip) {
-      this.tooltip = tooltip;
-      this.slot.setTooltip(tooltip);
-    }
-  }
-
-  private cancelFrame(): void {
-    if (this.frame !== null) {
-      window.cancelAnimationFrame(this.frame);
-      this.frame = null;
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/parts/status/status-bar.ts b/crates/workshop/ui/src/parts/status/status-bar.ts
deleted file mode 100644
index 5880943bf..000000000
--- a/crates/workshop/ui/src/parts/status/status-bar.ts
+++ /dev/null
@@ -1,190 +0,0 @@
-// The status bar renderer: consumes the observer's status frames off the
-// persistent socket and paints them into the shared status bar view
-// (@workshop/look/status-bar), which owns the bar, the text region, and the
-// busy barberpole beside the indicators. Info and error frames set the
-// text (the description shows as the tooltip) and drive the barberpole;
-// debug frames are internal instrumentation that never touch either. The
-// bar holds the indicator slots: features register their LEDs and their
-// button slots into the indicators group through StatusIndicators; the
-// view's extras region stays empty.
-
-import { createStatusBarView, type StatusBarView } from "@workshop/look/status-bar";
-
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { CONTEXT_KEY_SERVICE, type ContextKey } from "@workshop/platform/context-key-service";
-import type { StatusFrame } from "../../services/protocol";
-import { TOAST_STACK } from "../../services/toast-service";
-import { getService, getServiceOrNull } from "@workshop/platform/service-registry";
-import type { StatusBar as StatusBarContract } from "@workshop/platform/status-bar";
-import type {
-  IndicatorState,
-  StatusIndicatorHandle,
-  StatusIndicatorOptions,
-  StatusIndicators,
-  StatusSlotHandle,
-  StatusSlotOptions,
-} from "@workshop/platform/status-indicators";
-
-const LED_COLORS = ["green", "amber", "red"] as const;
-
-interface Slot {
-  readonly element: HTMLElement;
-  readonly order: number;
-}
-
-export class StatusBar extends Disposable implements StatusBarContract, StatusIndicators {
-  private readonly view: StatusBarView;
-  private readonly slots = new Map<string, Slot>();
-  // The bar's own visibility key: the Appearance menu's Status Bar row
-  // reads it for its checkbox. Bound here because the bar owns the
-  // element; visible by default, matching the boot layout.
-  private readonly visibleKey: ContextKey<boolean>;
-
-  constructor() {
-    super();
-    this.visibleKey = getService(CONTEXT_KEY_SERVICE).createKey("statusBarVisible", true);
-    // The view starts with empty text: the bar has no idle placeholder, as
-    // Cursor's has none.
-    this.view = createStatusBarView();
-    // The bar is the body's full-width footer, below the desk.
-    document.body.append(this.view.element);
-    this._register(toDisposable(() => this.view.element.remove()));
-  }
-
-  /** Paints one observer update's text, tooltip, and barberpole. */
-  render(frame: StatusFrame): void {
-    if (frame.severity === "debug") {
-      return;
-    }
-    this.view.setText(frame.label, {
-      tooltip: frame.description,
-      error: frame.severity === "error",
-    });
-    this.view.setBusy(frame.busy);
-  }
-
-  /** Adds one LED to the indicators group in `order`. */
-  register(options: StatusIndicatorOptions): StatusIndicatorHandle {
-    const { id, name } = options;
-    const element = document.createElement("span");
-    element.className = "status-bar__led";
-    const label = (tooltip: string | undefined): void => {
-      if (options.decorative === true) {
-        element.setAttribute("aria-hidden", "true");
-      } else {
-        element.setAttribute("aria-label", tooltip ? `${name}: ${tooltip}` : name);
-      }
-    };
-    label(undefined);
-    const remove = this.insert(id, options.order, element);
-    return {
-      set: (state: IndicatorState, tooltip?: string): void => {
-        for (const color of LED_COLORS) {
-          element.classList.remove(`status-bar__led--${color}`);
-        }
-        if (state !== null) {
-          element.classList.add(`status-bar__led--${state}`);
-        }
-        element.title = tooltip ?? "";
-        label(tooltip);
-      },
-      dispose: remove,
-    };
-  }
-
-  /** Adds one button slot to the indicators group in `order`, among the LEDs. */
-  registerSlot(options: StatusSlotOptions): StatusSlotHandle {
-    const { id, name, activate } = options;
-    const element = document.createElement("button");
-    element.type = "button";
-    element.className = "status-bar__item";
-    const label = (tooltip: string | undefined): void => {
-      element.setAttribute("aria-label", tooltip ? `${name}: ${tooltip}` : name);
-    };
-    label(undefined);
-    const remove = this.insert(id, options.order, element);
-    const onClick = (): void => activate();
-    element.addEventListener("click", onClick);
-    return {
-      element,
-      setTooltip: (tooltip?: string): void => {
-        element.title = tooltip ?? "";
-        label(tooltip);
-      },
-      dispose: (): void => {
-        element.removeEventListener("click", onClick);
-        remove();
-      },
-    };
-  }
-
-  /**
-   * Places one slot's element in the indicators group, before the leftmost
-   * slot with a higher order, so equal orders keep registration order.
-   * Returns the removal; a stale handle's call leaves a re-registered id
-   * in place.
-   */
-  private insert(id: string, order: number, element: HTMLElement): () => void {
-    if (this.slots.has(id)) {
-      throw new Error(`status indicator '${id}' is already registered; ids must be unique`);
-    }
-    element.dataset.indicator = id;
-    const higher = new Set<Element>(
-      [...this.slots.values()].filter((slot) => slot.order > order).map((slot) => slot.element),
-    );
-    const next = [...this.view.indicators.children].find((child) => higher.has(child)) ?? null;
-    this.view.indicators.insertBefore(element, next);
-    const slot: Slot = { element, order };
-    this.slots.set(id, slot);
-    return () => {
-      if (this.slots.get(id) === slot) {
-        this.slots.delete(id);
-        element.remove();
-      }
-    };
-  }
-
-  /**
-   * Shows a locally-originated message. An info message paints the bar's
-   * text, and the next observer frame overwrites it. An error raises an
-   * error toast on the shared stack instead of painting the bar red, so its
-   * callers do not change and the message outlives the next frame. With no
-   * stack registered (a bare bar in a widget test) the error paints the
-   * bar's text in the error color, so a failure is never silent.
-   */
-  showLocal(label: string, severity: "info" | "error"): void {
-    if (severity === "error") {
-      const toasts = getServiceOrNull(TOAST_STACK);
-      if (toasts !== null) {
-        toasts.show(label, "error");
-        return;
-      }
-    }
-    this.view.setText(label, { error: severity === "error" });
-  }
-
-  /** Whether the bar is currently shown. */
-  get isVisible(): boolean {
-    return !this.view.element.hidden;
-  }
-
-  /**
-   * Shows or hides the bar (the Appearance menu's Status Bar row),
-   * mirroring the state into the statusBarVisible context key so the
-   * row's checkbox follows.
-   */
-  setVisible(visible: boolean): void {
-    this.view.element.hidden = !visible;
-    this.visibleKey.set(visible);
-  }
-
-  /**
-   * Returns the bar to its reconnecting state after the persistent socket
-   * drops: neutral text, no tooltip, no error styling, and the barberpole
-   * hidden. Indicators belong to their owners and stay as they are.
-   */
-  reset(): void {
-    this.view.setText("Reconnecting...");
-    this.view.setBusy(false);
-  }
-}
diff --git a/crates/workshop/ui/src/parts/status/status.contribution.ts b/crates/workshop/ui/src/parts/status/status.contribution.ts
deleted file mode 100644
index a0c101236..000000000
--- a/crates/workshop/ui/src/parts/status/status.contribution.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-// The status contribution: the eager module registering the Status Bar
-// visibility row at module scope, before any service exists. The run
-// body resolves the composition root's StatusBar at call time and
-// flips it; the bar itself mirrors the outcome into the
-// statusBarVisible context key, which the Appearance row reads for its
-// checkbox. With no composition root (a standalone widget test) there is
-// no bar to flip and the row is inert.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-
-/** The Appearance flyout's id; the menubar contribution declares the submenu. */
-const APPEARANCE_MENU: MenuId = "menubar/view/appearance";
-
-const result: Result<IDisposable, ParseError> = registerAction({
-  id: "workbench.action.toggleStatusbarVisibility",
-  title: "Status Bar",
-  f1: true,
-  toggled: "statusBarVisible",
-  menu: [{ id: APPEARANCE_MENU, group: "2_workbench_layout", order: 4 }],
-  run: () => {
-    const bar = getServiceOrNull(STATUS_BAR);
-    if (bar !== null) {
-      bar.setVisible(!bar.isVisible);
-    }
-  },
-});
-if (!result.ok) {
-  console.error(`status action 'workbench.action.toggleStatusbarVisibility': ${result.error.message}`);
-}
diff --git a/crates/workshop/ui/src/parts/stt/realtime-stt.ts b/crates/workshop/ui/src/parts/stt/realtime-stt.ts
deleted file mode 100644
index 82446d2d1..000000000
--- a/crates/workshop/ui/src/parts/stt/realtime-stt.ts
+++ /dev/null
@@ -1,377 +0,0 @@
-import { Emitter } from "@workshop/platform/event";
-import { DisposableStore, toDisposable } from "@workshop/platform/lifecycle";
-import { RealtimeTranscriptionService } from "../../services/realtime-transcription";
-import {
-  SpeechCaptureService,
-  type SpeechCaptureFailure,
-  type SpeechCaptureOutcome,
-  type SpeechCapturePresence,
-} from "../../services/speech-capture";
-import type { SttStatus } from "../../services/stt-status";
-import type {
-  SttBlocker,
-  SttElements,
-  SttHandle,
-  SttMicState,
-} from "./stt";
-import {
-  createTakeRegistry,
-  reduceTakeRegistry,
-  type TakeRegistry,
-  type TakeRegistryEffect,
-  type TakeRegistryInput,
-} from "../take/take-registry";
-
-const BUSY_LABEL = "Dictation is active in another window";
-
-function captureFailureLabel(failure: SpeechCaptureFailure): string {
-  if (failure.kind === "permission-denied") {
-    return "Microphone permission was denied.";
-  }
-  if (failure.kind === "device-unavailable") {
-    return "No microphone is available.";
-  }
-  if (failure.kind === "busy") {
-    return BUSY_LABEL;
-  }
-  if (failure.kind === "stop-failed") {
-    return "Dictation could not finish capturing audio. Try again.";
-  }
-  return "Dictation could not start. Try again.";
-}
-
-/** Mounts a visually hidden polite live region at the end of the host. */
-function mountLiveRegion(host: HTMLElement): HTMLElement {
-  const region = host.ownerDocument.createElement("div");
-  region.className = "ws-stt-live";
-  region.setAttribute("aria-live", "polite");
-  region.setAttribute("aria-atomic", "true");
-  host.append(region);
-  return region;
-}
-
-/**
- * Wires push-to-talk to production PCM16 capture and the additive Realtime
- * relay. The registry exclusively owns take state; this layer interprets its
- * typed editor, capture, status, and wire effects, and publishes the mic
- * state the owning part paints. Announcements go to a hidden polite live
- * region mounted on the elements' host, so a screen reader hears finished
- * sentences without leaving the editor. Each instance holds its own owner
- * token for the shared capture service: it streams only audio it owns,
- * and a press while another instance owns the microphone is refused with
- * a reason rather than stealing the take. Its creator's `presence` goes
- * with each start, naming and revealing the surface that holds the
- * microphone.
- */
-export function setupStt(
-  elements: SttElements,
-  status: SttStatus,
-  blocked: SttBlocker,
-  capture: SpeechCaptureService,
-  presence: SpeechCapturePresence,
-  providedRealtime?: RealtimeTranscriptionService,
-): SttHandle {
-  const { input, liveRegionHost } = elements;
-  const owner = Symbol("stt-owner");
-  const store = new DisposableStore();
-  const realtime = providedRealtime ?? store.add(new RealtimeTranscriptionService());
-  const liveRegion = liveRegionHost === undefined ? null : mountLiveRegion(liveRegionHost);
-  if (liveRegion !== null) {
-    store.add(toDisposable(() => liveRegion.remove()));
-  }
-  let registry: TakeRegistry = createTakeRegistry();
-  if (realtime.state === "ready") {
-    registry = reduceTakeRegistry(registry, {
-      type: "connection.ready",
-      generation: realtime.generation,
-    }).state;
-  }
-  let pendingCaptureStop: Promise<SpeechCaptureOutcome> | null = null;
-  let captureGeneration = realtime.generation;
-  let disposed = false;
-
-  // Mic state is derived from two sources with fixed precedence: the
-  // registry's recording effect (this surface's take) wins over the capture
-  // service's ownership (another surface's take); otherwise idle.
-  const stateChange = store.add(new Emitter<SttMicState>());
-  let recording = false;
-  const ownedElsewhere = (): boolean => capture.owner !== null && capture.owner !== owner;
-  let state: SttMicState = ownedElsewhere() ? "blocked" : "idle";
-
-  function publishState(): void {
-    const next: SttMicState = recording ? "recording" : ownedElsewhere() ? "blocked" : "idle";
-    if (next !== state) {
-      state = next;
-      stateChange.fire(next);
-    }
-  }
-
-  function setRecording(on: boolean): void {
-    recording = on;
-    status.setRecording(on);
-    publishState();
-  }
-
-  function releaseCapture(): Promise<SpeechCaptureOutcome> {
-    if (pendingCaptureStop !== null) {
-      return pendingCaptureStop;
-    }
-    const stoppingCapture = capture.stop(owner);
-    pendingCaptureStop = stoppingCapture;
-    void stoppingCapture.finally(() => {
-      if (pendingCaptureStop === stoppingCapture) {
-        pendingCaptureStop = null;
-      }
-    });
-    return stoppingCapture;
-  }
-
-  function interpretEffect(effect: TakeRegistryEffect): void {
-    switch (effect.domain) {
-      case "editor":
-        switch (effect.command) {
-          case "replace":
-            input.replaceRange(effect.from, effect.to, effect.text, {
-              transient: effect.transient,
-            });
-            return;
-          case "restore":
-            input.restoreRange?.(effect.from, effect.to, effect.content);
-            return;
-          case "caret":
-            input.setSelection(effect.at, effect.at);
-            return;
-          case "tentative":
-            input.setTentativeRange?.(effect.takeId, effect.range);
-            return;
-          case "read-only":
-            input.setReadOnly(effect.readOnly);
-            return;
-          case "focus":
-            input.focus();
-            return;
-          default: {
-            const exhaustive: never = effect;
-            return exhaustive;
-          }
-        }
-      case "capture":
-        switch (effect.command) {
-          case "clear":
-            capture.clear(owner);
-            return;
-          case "stop": {
-            const stoppingCapture = releaseCapture();
-            void stoppingCapture.then((outcome) => {
-              if (!disposed) {
-                dispatch({
-                  type: "capture.stopped",
-                  generation: effect.generation,
-                  takeId: effect.takeId,
-                  ok: outcome.ok,
-                });
-              }
-            });
-            return;
-          }
-          default: {
-            const exhaustive: never = effect;
-            return exhaustive;
-          }
-        }
-      case "status":
-        switch (effect.command) {
-          case "recording":
-            setRecording(effect.recording);
-            return;
-          case "local":
-            status.showLocal(effect.label, effect.severity);
-            return;
-          case "announce":
-            if (liveRegion !== null) {
-              liveRegion.textContent = effect.text;
-            }
-            return;
-          default: {
-            const exhaustive: never = effect;
-            return exhaustive;
-          }
-        }
-      case "wire":
-        switch (effect.command) {
-          case "append":
-            {
-              const result = realtime.append(effect.chunk);
-            dispatch({
-              type: "wire.result",
-              generation: result.generation,
-              requestId: effect.requestId,
-              eventId: result.eventId,
-            });
-            return;
-            }
-          case "commit":
-            {
-              const result = realtime.commit();
-            dispatch({
-              type: "wire.result",
-              generation: result.generation,
-              requestId: effect.requestId,
-              eventId: result.eventId,
-            });
-            return;
-            }
-          case "clear":
-            realtime.clear();
-            return;
-          default: {
-            const exhaustive: never = effect;
-            return exhaustive;
-          }
-        }
-      default: {
-        const exhaustive: never = effect;
-        return exhaustive;
-      }
-    }
-  }
-
-  function dispatch(inputEvent: TakeRegistryInput): void {
-    const transition = reduceTakeRegistry(registry, inputEvent);
-    registry = transition.state;
-    for (const effect of transition.effects) {
-      interpretEffect(effect);
-    }
-  }
-
-  store.add(
-    realtime.onEvent(({ event, generation }) => {
-      dispatch({ type: "server.event", event, generation });
-    }),
-  );
-  store.add(
-    realtime.onState(({ state, generation }) => {
-      if (state === "ready") {
-        dispatch({ type: "connection.ready", generation });
-      }
-    }),
-  );
-  store.add(
-    realtime.onError((error) => {
-      if (error.scope === "connection") {
-        dispatch({
-          type: "connection.lost",
-          generation: error.generation,
-        });
-      } else if (error.scope === "session") {
-        dispatch({
-          type: "service.error",
-          generation: error.generation,
-          eventId: error.eventId,
-        });
-      }
-    }),
-  );
-  store.add(
-    capture.onAudio((chunk) => {
-      // The service's audio event is shared by every surface; only the
-      // owner's registry may see the owner's chunks.
-      if (capture.owner !== owner) {
-        return;
-      }
-      dispatch({
-        type: "capture.audio",
-        generation: captureGeneration,
-        chunk,
-      });
-    }),
-  );
-  store.add(capture.onOwnerChange(() => publishState()));
-
-  async function start(): Promise<void> {
-    // Ownership first: a microphone held by another window is the reason
-    // even when the owning part's own blocker would also refuse.
-    if (ownedElsewhere()) {
-      status.showLocal(BUSY_LABEL, "info");
-      return;
-    }
-    const reason = blocked();
-    if (reason !== null) {
-      status.showLocal(reason, "info");
-      return;
-    }
-    if (pendingCaptureStop !== null) {
-      await pendingCaptureStop;
-      if (
-        disposed ||
-        registry.activeTakeId !== null ||
-        registry.capture !== "idle"
-      ) {
-        return;
-      }
-    }
-    if (realtime.state !== "ready") {
-      realtime.connect();
-      status.showLocal("Dictation is connecting. Try again in a moment.", "info");
-      return;
-    }
-    const generation = realtime.generation;
-    captureGeneration = generation;
-    const outcome = await capture.start(owner, presence);
-    if (!outcome.ok) {
-      status.showLocal(captureFailureLabel(outcome), "error");
-      return;
-    }
-    if (disposed) {
-      void releaseCapture();
-      return;
-    }
-    dispatch({
-      type: "user.start",
-      generation,
-      context: input.insertionContext(),
-    });
-    if (
-      registry.activeTakeId === null ||
-      registry.capture !== "recording"
-    ) {
-      void releaseCapture();
-    }
-  }
-
-  function stop(): void {
-    dispatch({ type: "user.stop", generation: realtime.generation });
-  }
-
-  function discardIfRecording(): void {
-    dispatch({ type: "user.discard", generation: realtime.generation });
-  }
-
-  function press(): void {
-    if (disposed) {
-      return;
-    }
-    if (registry.activeTakeId !== null) {
-      stop();
-    } else {
-      void start();
-    }
-  }
-
-  return {
-    press,
-    get state(): SttMicState {
-      return state;
-    },
-    onState: stateChange.event,
-    discardIfRecording,
-    dispose(): void {
-      if (disposed) {
-        return;
-      }
-      disposed = true;
-      discardIfRecording();
-      store.dispose();
-    },
-  };
-}
diff --git a/crates/workshop/ui/src/parts/stt/stt.css b/crates/workshop/ui/src/parts/stt/stt.css
deleted file mode 100644
index 3e76623c2..000000000
--- a/crates/workshop/ui/src/parts/stt/stt.css
+++ /dev/null
@@ -1,18 +0,0 @@
-/* Styles for stt.ts, which imports this file; esbuild bundles it into
-   dist/app.css. The mic button and its recording fill belong to the chat
-   box (chatbox/chat-box.css), which paints them from its mic prop, and so
-   does the .ws-stt-tentative mark on a take's tentative words. The
-   .ws-stt-input--recording mark that a take leaves on its target is
-   unstyled today: the chat box frame's border tracks :focus-within, and
-   a textarea target (textareaSttTarget) is unstyled. */
-
-/* The dictation live region: read by assistive tech, invisible on screen. */
-.ws-stt-live {
-  position: absolute;
-  width: var(--ws-size-1);
-  height: var(--ws-size-1);
-  overflow: hidden;
-  clip: rect(0 0 0 0);
-  clip-path: inset(50%);
-  white-space: nowrap;
-}
diff --git a/crates/workshop/ui/src/parts/stt/stt.ts b/crates/workshop/ui/src/parts/stt/stt.ts
deleted file mode 100644
index 3ac0ba5bf..000000000
--- a/crates/workshop/ui/src/parts/stt/stt.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-// Shared UI contracts and text-target adapters for Realtime dictation.
-
-import "./stt.css";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import type { SttInsertionContext, SttTargetRange } from "../take/take-registry-types";
-export { setupStt } from "./realtime-stt";
-
-/**
- * What dictation needs from its input: a text target the take can
- * splice the transcript into. Offsets are the target's own text
- * coordinates - a textarea's string offsets, the prompt editor's
- * ProseMirror positions. A take preserves both captured endpoints for
- * its first splice, then combines `start` with the length of the text it
- * inserted there, which is valid in both spaces.
- */
-export interface SttInputTarget {
-  /** Captures the selected range, rollback text, and target-owned insertion policy. */
-  insertionContext(): SttInsertionContext;
-  /**
-   * Replaces [from, to] with text, leaving the cursor after the inserted
-   * text. A transient replace (an interim write or a rollback) stays out
-   * of the target's undo history; any other replace is its own undo step.
-   * A target without undo history ignores the option.
-   */
-  replaceRange(
-    from: number,
-    to: number,
-    text: string,
-    options?: { readonly transient?: boolean },
-  ): void;
-  /**
-   * Replaces [from, to] with the `content` an earlier insertionContext
-   * captured, outside the undo history, leaving the cursor after it. A
-   * target whose insertionContext supplies content implements it.
-   */
-  restoreRange?(from: number, to: number, content: unknown): void;
-  /** Selects [from, to]; a take collapses the cursor to its end after a patch that ends short of it. */
-  setSelection(from: number, to: number): void;
-  /**
-   * Styles one take's tentative words, or clears that take's styling when
-   * range is null, without changing the text. A target without it shows
-   * tentative words unstyled.
-   */
-  setTentativeRange?(takeId: number, range: SttTargetRange | null): void;
-  /** Locks the input against typing while a take splices, or releases it. */
-  setReadOnly(readOnly: boolean): void;
-  /** Returns focus to the input; a landed final calls it. */
-  focus(): void;
-}
-
-/**
- * What dictation is wired to. The mic control is the owning part's: it
- * calls `SttHandle.press()` and paints `SttHandle.state`, so dictation
- * touches no button element of its own.
- */
-export interface SttElements {
-  input: SttInputTarget;
-  /**
-   * Where dictation mounts its hidden polite live region, which hears
-   * each finished sentence and a landed take's rest. Absent, dictation
-   * announces nothing.
-   */
-  liveRegionHost?: HTMLElement;
-}
-
-/**
- * The textarea target: one-line wrappers over the native selection API,
- * behavior unchanged from when setupStt held the textarea directly.
- */
-export function textareaSttTarget(input: HTMLTextAreaElement): SttInputTarget {
-  return {
-    insertionContext: () => {
-      const start = input.selectionStart ?? input.value.length;
-      const end = input.selectionEnd ?? input.value.length;
-      return {
-        range: { start, end },
-        original: input.value.slice(start, end),
-        compositionPrefix:
-          start === end && end === input.value.length && /\S$/.test(input.value.slice(0, start))
-            ? " "
-            : "",
-      };
-    },
-    replaceRange: (from, to, text) => {
-      input.setRangeText(text, from, to, "end");
-      // Programmatic value sets don't fire the textarea's "input" event,
-      // so every dictation-driven rewrite dispatches it: dictation
-      // behaves like typing to whatever listens on the input.
-      input.dispatchEvent(new Event("input", { bubbles: true }));
-    },
-    setSelection: (from, to) => input.setSelectionRange(from, to),
-    setReadOnly: (readOnly) => {
-      input.readOnly = readOnly;
-      input.classList.toggle("ws-stt-input--recording", readOnly);
-    },
-    focus: () => input.focus(),
-  };
-}
-
-/**
- * What blocks starting a take right now, as a user-readable reason, or
- * null when a take may start. Consulted on every mic press: the mic stays
- * visible and clickable even when blocked, so the press can name the
- * blocker on the status bar instead of the control silently disappearing.
- * Microphone ownership is checked before this blocker runs.
- */
-export type SttBlocker = () => string | null;
-
-/**
- * The mic's state as the owning part paints it. `recording` is this
- * surface's live take; `blocked` means another surface over the same
- * capture service holds the microphone; `idle` otherwise. Local recording
- * wins when both would hold.
- */
-export type SttMicState = "idle" | "recording" | "blocked";
-
-/** The per-tab dictation control; dispose() discards a live take. */
-export interface SttHandle extends IDisposable {
-  /**
-   * The mic toggle: starts a take when idle, stops the live one when
-   * recording, and names the blocker on the status bar when refused.
-   */
-  press(): void;
-  /** The current mic state, for seeding the owning part's control. */
-  readonly state: SttMicState;
-  /** Fires on each change of `state`, never on a repeat. */
-  onState(listener: (state: SttMicState) => void): IDisposable;
-  discardIfRecording(): void;
-}
diff --git a/crates/workshop/ui/src/parts/take/take-registry-events.ts b/crates/workshop/ui/src/parts/take/take-registry-events.ts
deleted file mode 100644
index 9753b88c3..000000000
--- a/crates/workshop/ui/src/parts/take/take-registry-events.ts
+++ /dev/null
@@ -1,529 +0,0 @@
-// Server-event and failure handling for the take registry. A decoded
-// Realtime event reaches its take through the server's item id, which
-// binds when the server acknowledges a commit - commits are matched to
-// takes first in, first out - or, for a transcript under an unknown id,
-// only when exactly one take is unbound. A hypothesis at or below the
-// last revision applied for its item is dropped, so a repeated or
-// reordered snapshot never replaces newer text. A hypothesis renders its
-// finalized and agreed parts whole and its tentative part less the last
-// whole word, which waits for the next update or `completed`; what shows
-// of the tentative part is marked as the take's tentative tail. Each
-// newly finished stable sentence is announced once, and `completed`
-// announces whatever of the final transcript was not. A failed
-// transcription keeps the visible text; connection loss lands each take's
-// shown text less its tentative tail; service errors roll takes back.
-// Status labels are local wording: server error text never reaches the
-// status bar.
-
-import type { RealtimeEvent } from "../../services/realtime-event-decoder";
-import {
-  activeTake,
-  bindItem,
-  composeTranscript,
-  isRetiredItem,
-  keepAll,
-  landTake,
-  recordAnnouncedSentences,
-  recordHypothesisRevision,
-  removeTake,
-  replaceTake,
-  reserveWireRequest,
-  retireItem,
-  rollbackTake,
-  takeById,
-  takeByItem,
-} from "./take-registry-state";
-import type { Reduction } from "./take-registry-types";
-
-/** Tentative words hidden from the end of each hypothesis. */
-const HELD_BACK_TENTATIVE_WORDS = 1;
-
-const LAST_WORD = /\s*\S+\s*$/u;
-
-/** A sentence end: a run of `.`, `?`, or `!` that whitespace or the end of the text follows. */
-const SENTENCE_END = /[.?!]+(?=\s|$)/gu;
-
-type SnapshotEvent = Extract<
-  RealtimeEvent,
-  {
-    type:
-      | "conversation.item.input_audio_transcription.hypothesis"
-      | "conversation.item.input_audio_transcription.delta";
-  }
->;
-
-const UNAVAILABLE_LABEL = "Dictation is temporarily unavailable. Try again.";
-const PRESERVED_TRANSCRIPTION_FAILED_LABEL =
-  "Dictation could not be fully transcribed. Visible text was kept and can be edited.";
-const PRECOMMIT_FAILED_LABEL =
-  "Dictation stopped because transcription failed. Captured audio is being finalized.";
-
-/** Applies one trusted decoded server event to the registry. */
-export function serverEvent(reduction: Reduction, event: RealtimeEvent): void {
-  switch (event.type) {
-    case "session.created":
-      return;
-    case "session.updated":
-      reduction.state.connection = "ready";
-      return;
-    case "input_audio_buffer.committed":
-      acknowledgeCommit(reduction, event.item_id);
-      return;
-    case "input_audio_buffer.cleared":
-    case "conversation.item.created":
-      return;
-    case "conversation.item.input_audio_transcription.hypothesis":
-    case "conversation.item.input_audio_transcription.delta":
-      applySnapshot(reduction, event);
-      return;
-    case "conversation.item.input_audio_transcription.completed":
-      completeTake(reduction, event.item_id, event.transcript);
-      return;
-    case "conversation.item.input_audio_transcription.failed": {
-      const take = takeByItem(reduction.state, event.item_id);
-      if (take === null) {
-        return;
-      }
-      preserveFailedTake(reduction, take.id);
-      reduction.effects.push({
-        domain: "status",
-        command: "local",
-        label: PRESERVED_TRANSCRIPTION_FAILED_LABEL,
-        severity: "error",
-      });
-      return;
-    }
-    case "error":
-      if (event.error.code === "too_much_unfinalized_audio") {
-        retainedAudioOverload(reduction, event.error.event_id ?? null);
-      } else if (event.error.code === "precommit_transcription_failed") {
-        precommitTranscriptionFailure(reduction, event.error.event_id ?? null);
-      } else {
-        serviceError(reduction, event.error.event_id ?? null);
-      }
-      return;
-    default: {
-      const exhaustive: never = event;
-      return exhaustive;
-    }
-  }
-}
-
-function precommitTranscriptionFailure(
-  reduction: Reduction,
-  eventId: string | null,
-): void {
-  if (eventId === null) {
-    return;
-  }
-  const binding = reduction.state.clientEvents.find(
-    (candidate) =>
-      candidate.eventId === eventId && candidate.command === "append",
-  );
-  const take =
-    binding === undefined ? null : takeById(reduction.state, binding.takeId);
-  if (
-    take === null ||
-    reduction.state.activeTakeId !== take.id ||
-    reduction.state.capture !== "recording"
-  ) {
-    return;
-  }
-  reduction.state.capture = "stopping";
-  reduction.state.stoppingTakeId = take.id;
-  reduction.effects.push(
-    {
-      domain: "capture",
-      command: "stop",
-      takeId: take.id,
-      generation: reduction.state.activeGeneration,
-    },
-    { domain: "status", command: "recording", recording: false },
-    {
-      domain: "status",
-      command: "local",
-      label: PRECOMMIT_FAILED_LABEL,
-      severity: "error",
-    },
-  );
-}
-
-function retainedAudioOverload(
-  reduction: Reduction,
-  eventId: string | null,
-): void {
-  const takeId =
-    eventId === null
-      ? reduction.state.activeTakeId
-      : reduction.state.clientEvents.find((binding) => binding.eventId === eventId)
-          ?.takeId ?? null;
-  const take = takeId === null ? null : takeById(reduction.state, takeId);
-  if (
-    take !== null &&
-    reduction.state.activeTakeId === take.id &&
-    reduction.state.capture === "recording"
-  ) {
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = take.id;
-    reduction.effects.push(
-      {
-        domain: "capture",
-        command: "stop",
-        takeId: take.id,
-        generation: reduction.state.activeGeneration,
-      },
-      { domain: "status", command: "recording", recording: false },
-      {
-        domain: "status",
-        command: "local",
-        label:
-          "Dictation stopped because transcription could not keep up. Captured audio is being finalized.",
-        severity: "error",
-      },
-    );
-    return;
-  }
-  if (take === null) {
-    reduction.effects.push({
-      domain: "status",
-      command: "local",
-      label:
-        "Dictation stopped because transcription could not keep up. Captured audio is being finalized.",
-      severity: "error",
-    });
-  }
-}
-
-function preserveFailedTake(reduction: Reduction, takeId: number): void {
-  if (
-    reduction.state.activeTakeId === takeId &&
-    reduction.state.capture === "recording"
-  ) {
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = takeId;
-    reduction.effects.push(
-      {
-        domain: "capture",
-        command: "stop",
-        takeId,
-        generation: reduction.state.activeGeneration,
-      },
-      { domain: "status", command: "recording", recording: false },
-    );
-  }
-  removeTake(reduction, takeId);
-}
-
-function acknowledgeCommit(reduction: Reduction, itemId: string): void {
-  const boundTake = takeByItem(reduction.state, itemId);
-  if (boundTake !== null) {
-    const ownerIndex = reduction.state.awaitingCommit.findIndex(
-      (expectation) =>
-        expectation.generation === reduction.state.activeGeneration &&
-        expectation.takeId === boundTake.id,
-    );
-    if (ownerIndex >= 0) {
-      reduction.state.awaitingCommit.splice(ownerIndex, 1);
-    }
-    return;
-  }
-  const tombstoneIndex = reduction.state.awaitingCommit.findIndex(
-    (expectation) =>
-      expectation.generation === reduction.state.activeGeneration &&
-      expectation.takeId === null &&
-      expectation.itemId === itemId,
-  );
-  if (tombstoneIndex >= 0) {
-    reduction.state.awaitingCommit.splice(tombstoneIndex, 1);
-    return;
-  }
-  if (isRetiredItem(reduction.state, reduction.state.activeGeneration, itemId)) {
-    return;
-  }
-  if (reduction.state.awaitingCommit.length === 0) {
-    const active = activeTake(reduction.state);
-    if (active !== null && active.itemId === null) {
-      bindItem(reduction.state, active.id, itemId);
-      return;
-    }
-    retireItem(reduction.state, reduction.state.activeGeneration, itemId);
-    reduction.effects.push({
-      domain: "status",
-      command: "local",
-      label: UNAVAILABLE_LABEL,
-      severity: "error",
-    });
-    return;
-  }
-
-  const expectation = reduction.state.awaitingCommit.shift();
-  if (expectation === undefined) {
-    retireItem(reduction.state, reduction.state.activeGeneration, itemId);
-    return;
-  }
-  if (expectation.takeId === null) {
-    retireItem(reduction.state, expectation.generation, itemId);
-    return;
-  }
-  const take = takeById(reduction.state, expectation.takeId);
-  if (take === null) {
-    retireItem(reduction.state, expectation.generation, itemId);
-    return;
-  }
-  if (take.itemId === null) {
-    bindItem(reduction.state, take.id, itemId);
-    return;
-  }
-  if (take.itemId === itemId) {
-    return;
-  }
-  retireItem(reduction.state, reduction.state.activeGeneration, itemId);
-  rollbackTake(reduction, take.id);
-  reduction.effects.push({
-    domain: "status",
-    command: "local",
-    label: UNAVAILABLE_LABEL,
-    severity: "error",
-  });
-}
-
-/** Applies a hypothesis snapshot, or appends a delta. */
-function applySnapshot(reduction: Reduction, event: SnapshotEvent): void {
-  const itemId = event.item_id;
-  let take = takeByItem(reduction.state, itemId);
-  if (take === null) {
-    if (
-      isRetiredItem(reduction.state, reduction.state.activeGeneration, itemId) ||
-      reduction.state.awaitingCommit.some(
-        (expectation) =>
-          expectation.generation === reduction.state.activeGeneration &&
-          expectation.takeId === null &&
-          expectation.itemId === null,
-      )
-    ) {
-      return;
-    }
-    const unbound = reduction.state.takes.filter(
-      (candidate) => candidate.itemId === null,
-    );
-    const candidate = unbound[0];
-    if (unbound.length !== 1 || candidate === undefined) {
-      return;
-    }
-    bindItem(reduction.state, candidate.id, itemId);
-    take = takeById(reduction.state, candidate.id);
-  }
-  if (take === null) {
-    return;
-  }
-  if (event.type === "conversation.item.input_audio_transcription.delta") {
-    const transcript = take.deltaText + event.delta;
-    replaceTake(reduction, take.id, composeTranscript(take, transcript), transcript);
-    announceSentences(reduction, take.id, transcript);
-    return;
-  }
-  if (take.hypothesisRevision !== null && event.revision <= take.hypothesisRevision) {
-    return;
-  }
-  recordHypothesisRevision(reduction.state, take.id, event.revision);
-  const stable = event.finalized + event.agreed;
-  const tentative = shownTentative(stable, event.tentative);
-  replaceTake(
-    reduction,
-    take.id,
-    composeTranscript(take, stable + tentative),
-    event.transcript,
-    tentative.length,
-  );
-  announceSentences(reduction, take.id, stable);
-}
-
-/** The offset just past each sentence end in a transcript. */
-function sentenceEnds(transcript: string): number[] {
-  return [...transcript.matchAll(SENTENCE_END)].map((end) => end.index + end[0].length);
-}
-
-/** Announces the finished sentences of a take's stable text it has not yet announced. */
-function announceSentences(reduction: Reduction, takeId: number, stable: string): void {
-  const take = takeById(reduction.state, takeId);
-  const ends = sentenceEnds(stable);
-  if (take === null || ends.length <= take.announcedSentences) {
-    return;
-  }
-  const text = stable
-    .slice(ends[take.announcedSentences - 1] ?? 0, ends[ends.length - 1])
-    .trim();
-  recordAnnouncedSentences(reduction.state, takeId, ends.length);
-  if (text !== "") {
-    reduction.effects.push({ domain: "status", command: "announce", text });
-  }
-}
-
-/**
- * The tentative part less its last whole words. A word starts after
- * whitespace or at the start of the transcript; a fragment glued to the
- * stable text stays shown, since hiding it would cut a word in half.
- */
-function shownTentative(stable: string, tentative: string): string {
-  let shown = tentative;
-  for (let held = 0; held < HELD_BACK_TENTATIVE_WORDS; held += 1) {
-    const last = LAST_WORD.exec(shown);
-    if (
-      last === null ||
-      (last.index === 0 && !/^\s/u.test(last[0]) && /\S$/u.test(stable))
-    ) {
-      break;
-    }
-    shown = shown.slice(0, last.index);
-  }
-  return shown;
-}
-
-function completeTake(
-  reduction: Reduction,
-  itemId: string,
-  transcript: string,
-): void {
-  const take = takeByItem(reduction.state, itemId);
-  if (take === null) {
-    return;
-  }
-  if (
-    reduction.state.activeTakeId === take.id &&
-    reduction.state.capture === "recording"
-  ) {
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = take.id;
-    reduction.effects.push(
-      {
-        domain: "capture",
-        command: "stop",
-        takeId: take.id,
-        generation: reduction.state.activeGeneration,
-      },
-      { domain: "status", command: "recording", recording: false },
-    );
-    reduction.state.activeTakeId = null;
-  }
-  const authoritative = transcript.trimEnd();
-  const text = composeTranscript(take, authoritative);
-  landTake(reduction, take.id, text, authoritative);
-  // A final with fewer sentence ends than were announced resumes after its last one.
-  const ends = sentenceEnds(authoritative);
-  const unannounced = authoritative
-    .slice(ends[Math.min(take.announcedSentences, ends.length) - 1] ?? 0)
-    .trim();
-  if (unannounced !== "") {
-    reduction.effects.push({ domain: "status", command: "announce", text: unannounced });
-  }
-  removeTake(reduction, take.id);
-  if (text === "") {
-    reduction.effects.push({
-      domain: "status",
-      command: "local",
-      label: "No speech was detected.",
-      severity: "info",
-    });
-  } else {
-    reduction.effects.push(
-      { domain: "editor", command: "focus" },
-      {
-        domain: "status",
-        command: "local",
-        label: "Dictation ready.",
-        severity: "info",
-      },
-    );
-  }
-}
-
-/** Applies a locally classified service failure without trusting remote wording. */
-export function serviceError(
-  reduction: Reduction,
-  eventId: string | null,
-): void {
-  const takeId =
-    eventId === null
-      ? reduction.state.activeTakeId
-      : reduction.state.clientEvents.find((binding) => binding.eventId === eventId)
-          ?.takeId ?? null;
-  if (takeId !== null && takeById(reduction.state, takeId) !== null) {
-    failTake(reduction, takeId);
-    return;
-  }
-  reduction.effects.push({
-    domain: "status",
-    command: "local",
-    label: UNAVAILABLE_LABEL,
-    severity: "error",
-  });
-}
-
-/**
- * Ends every take when the Realtime connection is lost: each keeps its
- * shown text less the tentative tail, lands it, and releases the editor.
- */
-export function connectionLost(reduction: Reduction): void {
-  reduction.state.connection = "unavailable";
-  const activeTakeId = reduction.state.activeTakeId;
-  if (activeTakeId !== null && reduction.state.capture !== "idle") {
-    reduction.effects.push(
-      { domain: "capture", command: "clear" },
-      {
-        domain: "capture",
-        command: "stop",
-        takeId: activeTakeId,
-        generation: reduction.state.activeGeneration,
-      },
-    );
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = activeTakeId;
-  }
-  keepAll(reduction);
-  reduction.state.awaitingCommit = [];
-  reduction.state.pendingWire = [];
-  reduction.state.clientEvents = [];
-  reduction.state.retiredItems = [];
-  reduction.effects.push(
-    { domain: "status", command: "recording", recording: false },
-    {
-      domain: "status",
-      command: "local",
-      label: UNAVAILABLE_LABEL,
-      severity: "error",
-    },
-  );
-}
-
-/** Rolls one failed take back through typed capture, wire, editor, and status effects. */
-export function failTake(reduction: Reduction, takeId: number): void {
-  if (
-    reduction.state.activeTakeId === takeId &&
-    reduction.state.capture !== "idle"
-  ) {
-    reduction.effects.push(
-      { domain: "capture", command: "clear" },
-      {
-        domain: "capture",
-        command: "stop",
-        takeId,
-        generation: reduction.state.activeGeneration,
-      },
-      {
-        domain: "wire",
-        command: "clear",
-        generation: reduction.state.activeGeneration,
-      },
-      { domain: "status", command: "recording", recording: false },
-    );
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = takeId;
-  }
-  rollbackTake(reduction, takeId);
-  reduction.effects.push({
-    domain: "status",
-    command: "local",
-    label: UNAVAILABLE_LABEL,
-    severity: "error",
-  });
-}
diff --git a/crates/workshop/ui/src/parts/take/take-registry-patches.ts b/crates/workshop/ui/src/parts/take/take-registry-patches.ts
deleted file mode 100644
index 77d2bd8b8..000000000
--- a/crates/workshop/ui/src/parts/take/take-registry-patches.ts
+++ /dev/null
@@ -1,140 +0,0 @@
-// Word-level minimal patches from a take's shown text to its next text.
-// Both texts split into alternating word and whitespace runs; the common
-// leading and trailing runs are kept, the middle is aligned by longest
-// common subsequence, and changed spans separated only by unchanged
-// whitespace merge into one patch. A middle past the cell budget becomes
-// one patch, so every update costs bounded time.
-
-/** One edit in the earlier text's offsets. */
-export interface WordPatch {
-  readonly from: number;
-  readonly to: number;
-  readonly text: string;
-}
-
-/** Changed runs: old[oldStart, oldEnd) becomes next[newStart, newEnd). */
-interface RunSpan {
-  readonly oldStart: number;
-  readonly oldEnd: number;
-  readonly newStart: number;
-  readonly newEnd: number;
-}
-
-const RUNS = /\s+|\S+/gu;
-const WHITESPACE_RUN = /^\s/u;
-
-// About 128 words a side; a longer changed middle is replaced whole.
-const MAX_ALIGNMENT_CELLS = 65_536;
-
-/** The patches that turn `before` into `after`, in document order. */
-export function wordPatches(before: string, after: string): WordPatch[] {
-  if (before === after) {
-    return [];
-  }
-  const old = before.match(RUNS) ?? [];
-  const next = after.match(RUNS) ?? [];
-  let head = 0;
-  while (head < old.length && head < next.length && old[head] === next[head]) {
-    head += 1;
-  }
-  let oldEnd = old.length;
-  let newEnd = next.length;
-  while (oldEnd > head && newEnd > head && old[oldEnd - 1] === next[newEnd - 1]) {
-    oldEnd -= 1;
-    newEnd -= 1;
-  }
-  const oldOffsets = runOffsets(old);
-  const newOffsets = runOffsets(next);
-  const spans = changedSpans(old, next, head, oldEnd, newEnd);
-  return mergeAcrossWhitespace(spans, old).map((span) => ({
-    from: oldOffsets[span.oldStart] ?? before.length,
-    to: oldOffsets[span.oldEnd] ?? before.length,
-    text: after.slice(
-      newOffsets[span.newStart] ?? after.length,
-      newOffsets[span.newEnd] ?? after.length,
-    ),
-  }));
-}
-
-/** Each run's start offset, then the text's length. */
-function runOffsets(runs: readonly string[]): number[] {
-  const offsets = [0];
-  let offset = 0;
-  for (const run of runs) {
-    offset += run.length;
-    offsets.push(offset);
-  }
-  return offsets;
-}
-
-/** The changed spans of old[start, oldEnd) against next[start, newEnd). */
-function changedSpans(
-  old: readonly string[],
-  next: readonly string[],
-  start: number,
-  oldEnd: number,
-  newEnd: number,
-): RunSpan[] {
-  const rows = oldEnd - start;
-  const columns = newEnd - start;
-  if (rows === 0 && columns === 0) {
-    return [];
-  }
-  if (rows === 0 || columns === 0 || rows * columns > MAX_ALIGNMENT_CELLS) {
-    return [{ oldStart: start, oldEnd, newStart: start, newEnd }];
-  }
-  // common(i, j): the longest common subsequence of the runs after i and j.
-  const width = columns + 1;
-  const table = new Uint32Array((rows + 1) * width);
-  const common = (i: number, j: number): number => table[i * width + j] ?? 0;
-  for (let i = rows - 1; i >= 0; i -= 1) {
-    for (let j = columns - 1; j >= 0; j -= 1) {
-      table[i * width + j] =
-        old[start + i] === next[start + j]
-          ? common(i + 1, j + 1) + 1
-          : Math.max(common(i + 1, j), common(i, j + 1));
-    }
-  }
-  const spans: RunSpan[] = [];
-  let open: { readonly oldStart: number; readonly newStart: number } | null = null;
-  let i = 0;
-  let j = 0;
-  while (i < rows || j < columns) {
-    if (i < rows && j < columns && old[start + i] === next[start + j]) {
-      if (open !== null) {
-        spans.push({ ...open, oldEnd: start + i, newEnd: start + j });
-        open = null;
-      }
-      i += 1;
-      j += 1;
-      continue;
-    }
-    open ??= { oldStart: start + i, newStart: start + j };
-    if (j === columns || (i < rows && common(i + 1, j) >= common(i, j + 1))) {
-      i += 1;
-    } else {
-      j += 1;
-    }
-  }
-  if (open !== null) {
-    spans.push({ ...open, oldEnd, newEnd });
-  }
-  return spans;
-}
-
-/** Joins changed spans whose unchanged gap holds only whitespace runs. */
-function mergeAcrossWhitespace(spans: readonly RunSpan[], old: readonly string[]): RunSpan[] {
-  const merged: RunSpan[] = [];
-  for (const span of spans) {
-    const previous = merged.at(-1);
-    if (
-      previous !== undefined &&
-      old.slice(previous.oldEnd, span.oldStart).every((run) => WHITESPACE_RUN.test(run))
-    ) {
-      merged[merged.length - 1] = { ...previous, oldEnd: span.oldEnd, newEnd: span.newEnd };
-    } else {
-      merged.push(span);
-    }
-  }
-  return merged;
-}
diff --git a/crates/workshop/ui/src/parts/take/take-registry-state.ts b/crates/workshop/ui/src/parts/take/take-registry-state.ts
deleted file mode 100644
index 5ac05ca38..000000000
--- a/crates/workshop/ui/src/parts/take/take-registry-state.ts
+++ /dev/null
@@ -1,404 +0,0 @@
-// Take registry state helpers, called on the writable clone inside one
-// reduction: cloning, lookup, item binding, and region edits.
-// replaceTake replaces a take's captured range whole on its first write,
-// since the selection may span structure its text does not show, then
-// patches only the changed word runs, leaves the caret at the take's end
-// as a whole-range write would, and shifts every later region by the
-// edit's length delta so document offsets stay exact. Those writes are
-// transient, outside the target's undo history; landing or rolling back
-// first returns the region to its captured selection, in the target's own
-// form when it supplied one, and landTake then writes a take's final text
-// as the one edit that enters history. removeTake
-// clears the take's tentative mark, leaves a tombstone for any commit the
-// server has not yet acknowledged, and retires the take's item id, so
-// late server events for it change nothing.
-
-import { type WordPatch, wordPatches } from "./take-registry-patches";
-import type {
-  MutableRegistry,
-  PendingWireRequest,
-  Reduction,
-  RegistryTake,
-  TakeRegistry,
-} from "./take-registry-types";
-
-/** Clones every registry collection for one immutable transition. */
-export function cloneRegistry(state: TakeRegistry): MutableRegistry {
-  return {
-    takes: state.takes.map((take) => ({ ...take })),
-    awaitingCommit: state.awaitingCommit.map((expectation) => ({ ...expectation })),
-    retiredItems: state.retiredItems.map((item) => ({ ...item })),
-    clientEvents: state.clientEvents.map((binding) => ({ ...binding })),
-    pendingWire: state.pendingWire.map((request) => ({ ...request })),
-    activeTakeId: state.activeTakeId,
-    capture: state.capture,
-    stoppingTakeId: state.stoppingTakeId,
-    connection: state.connection,
-    activeGeneration: state.activeGeneration,
-    nextTakeId: state.nextTakeId,
-    nextRequestId: state.nextRequestId,
-  };
-}
-
-/** Reserves one typed request correlation identifier. */
-export function reserveWireRequest(
-  state: MutableRegistry,
-  command: PendingWireRequest["command"],
-  takeId: number,
-): number {
-  const id = state.nextRequestId;
-  state.nextRequestId += 1;
-  state.pendingWire.push({
-    id,
-    generation: state.activeGeneration,
-    command,
-    takeId,
-  });
-  return id;
-}
-
-/** Restores all owned regions in reverse document order. */
-export function rollbackAll(reduction: Reduction): void {
-  const takeIds = reduction.state.takes.map((take) => take.id).reverse();
-  for (const takeId of takeIds) {
-    rollbackTake(reduction, takeId);
-  }
-}
-
-/** Restores and retires one owned region. */
-export function rollbackTake(reduction: Reduction, takeId: number): void {
-  restoreTake(reduction, takeId);
-  removeTake(reduction, takeId);
-}
-
-/**
- * Lands every owned region's shown text less its tentative tail, in
- * reverse document order, and retires it; a region left with no text
- * is restored instead.
- */
-export function keepAll(reduction: Reduction): void {
-  const takeIds = reduction.state.takes.map((take) => take.id).reverse();
-  for (const takeId of takeIds) {
-    const take = takeById(reduction.state, takeId);
-    if (take === null) {
-      continue;
-    }
-    const kept = take.written
-      ? take.text.slice(0, take.text.length - take.tentativeLength).trimEnd()
-      : "";
-    if (kept === "") {
-      rollbackTake(reduction, takeId);
-      continue;
-    }
-    landTake(reduction, takeId, kept, take.deltaText);
-    removeTake(reduction, takeId);
-  }
-}
-
-/**
- * Writes one region whose last `tentativeLength` characters are tentative,
- * outside the target's undo history, and shifts every later region by the
- * exact coordinate delta.
- */
-export function replaceTake(
-  reduction: Reduction,
-  takeId: number,
-  text: string,
-  deltaText: string,
-  tentativeLength = 0,
-): void {
-  const take = takeById(reduction.state, takeId);
-  if (take === null) {
-    return;
-  }
-  const patches = take.written
-    ? wordPatches(take.text, text)
-    : [{ from: 0, to: take.to - take.from, text }];
-  writeTake(reduction, take, text, deltaText, tentativeLength, patches, true);
-}
-
-/**
- * Lands a take's final text as the one edit that enters the target's
- * undo history. Interim writes stayed out of it, so a written region first
- * returns to its captured selection outside history; the final text then
- * replaces that selection whole, and undoing it brings the selection back
- * as the target held it.
- */
-export function landTake(
-  reduction: Reduction,
-  takeId: number,
-  text: string,
-  deltaText: string,
-): void {
-  restoreTake(reduction, takeId);
-  const take = takeById(reduction.state, takeId);
-  if (take === null || text === take.original) {
-    return;
-  }
-  const whole = [{ from: 0, to: take.to - take.from, text }];
-  writeTake(reduction, take, text, deltaText, 0, whole, false);
-}
-
-/**
- * Returns a written region to the selection its take captured, outside
- * the target's undo history, and shifts every later region by the exact
- * coordinate delta. The target restores its own form of the selection
- * when it captured one, since the text alone flattens paragraph breaks
- * and mention chips. The region is then unwritten, so the next write
- * replaces it whole.
- */
-function restoreTake(reduction: Reduction, takeId: number): void {
-  const take = takeById(reduction.state, takeId);
-  if (take === null || !take.written) {
-    return;
-  }
-  const content = take.originalContent;
-  if (content !== undefined) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "restore",
-      from: take.from,
-      to: take.to,
-      content,
-    });
-  } else if (take.text !== take.original) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "replace",
-      from: take.from,
-      to: take.to,
-      text: take.original,
-      transient: true,
-    });
-  }
-  if (take.tentativeLength > 0) {
-    reduction.effects.push({ domain: "editor", command: "tentative", takeId, range: null });
-  }
-  const width = content === undefined ? take.original.length : take.originalWidth;
-  settleTake(reduction, take, {
-    ...take,
-    to: take.from + width,
-    text: take.original,
-    written: false,
-    tentativeLength: 0,
-  });
-}
-
-function writeTake(
-  reduction: Reduction,
-  take: RegistryTake,
-  text: string,
-  deltaText: string,
-  tentativeLength: number,
-  patches: readonly WordPatch[],
-  transient: boolean,
-): void {
-  const nextEnd = take.from + text.length;
-  let shift = 0;
-  let caret = nextEnd;
-  for (const patch of patches) {
-    const from = take.from + patch.from + shift;
-    reduction.effects.push({
-      domain: "editor",
-      command: "replace",
-      from,
-      to: take.from + patch.to + shift,
-      text: patch.text,
-      transient,
-    });
-    shift += patch.text.length - (patch.to - patch.from);
-    caret = from + patch.text.length;
-  }
-  // The next take's insertion context reads the caret, which each replace leaves after its insert.
-  if (caret !== nextEnd) {
-    reduction.effects.push({ domain: "editor", command: "caret", at: nextEnd });
-  }
-  // A patch under the mark can drop it in the target, so any patch resends it.
-  if (
-    (patches.length > 0 || tentativeLength !== take.tentativeLength) &&
-    (tentativeLength > 0 || take.tentativeLength > 0)
-  ) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "tentative",
-      takeId: take.id,
-      range: tentativeLength > 0 ? { from: nextEnd - tentativeLength, to: nextEnd } : null,
-    });
-  }
-  settleTake(reduction, take, {
-    ...take,
-    to: nextEnd,
-    text,
-    deltaText,
-    written: true,
-    tentativeLength,
-  });
-}
-
-/** Stores a take's next state and shifts every region past its old end by the change in its end. */
-function settleTake(reduction: Reduction, take: RegistryTake, next: RegistryTake): void {
-  const delta = next.to - take.to;
-  reduction.state.takes = reduction.state.takes.map((other) => {
-    if (other.id === take.id) {
-      return next;
-    }
-    return delta !== 0 && other.from >= take.to
-      ? { ...other, from: other.from + delta, to: other.to + delta }
-      : other;
-  });
-}
-
-/** Removes one take while retaining any outstanding acknowledgment owner. */
-export function removeTake(reduction: Reduction, takeId: number): void {
-  const take = takeById(reduction.state, takeId);
-  if (take === null) {
-    return;
-  }
-  if (take.tentativeLength > 0) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "tentative",
-      takeId,
-      range: null,
-    });
-  }
-  reduction.state.takes = reduction.state.takes.filter(
-    (candidate) => candidate.id !== takeId,
-  );
-  reduction.state.awaitingCommit = reduction.state.awaitingCommit.map(
-    (expectation) =>
-      expectation.takeId === takeId
-        ? {
-            generation: expectation.generation,
-            takeId: null,
-            itemId: take.itemId,
-          }
-        : expectation,
-  );
-  if (take.itemId !== null) {
-    retireItem(reduction.state, take.itemGeneration ?? take.generation, take.itemId);
-  }
-  if (reduction.state.activeTakeId === takeId) {
-    reduction.state.activeTakeId = null;
-  }
-  reduction.state.clientEvents = reduction.state.clientEvents.filter(
-    (binding) => binding.takeId !== takeId,
-  );
-  if (reduction.state.takes.length === 0) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "read-only",
-      readOnly: false,
-    });
-  }
-}
-
-/** Applies the target-owned separator once to a transcript. */
-export function composeTranscript(take: RegistryTake, transcript: string): string {
-  return take.compositionPrefix !== "" &&
-    transcript !== "" &&
-    !/^\s/.test(transcript)
-    ? take.compositionPrefix + transcript
-    : transcript;
-}
-
-/** Binds one trusted server item identifier to its take. */
-export function bindItem(
-  state: MutableRegistry,
-  takeId: number,
-  itemId: string,
-): void {
-  const index = state.takes.findIndex((take) => take.id === takeId);
-  const take = state.takes[index];
-  if (
-    index < 0 ||
-    take === undefined ||
-    isRetiredItem(state, state.activeGeneration, itemId)
-  ) {
-    return;
-  }
-  state.takes[index] = {
-    ...take,
-    itemId,
-    itemGeneration: state.activeGeneration,
-  };
-}
-
-/** Records the newest hypothesis revision applied to one take. */
-export function recordHypothesisRevision(
-  state: MutableRegistry,
-  takeId: number,
-  revision: number,
-): void {
-  const index = state.takes.findIndex((take) => take.id === takeId);
-  const take = state.takes[index];
-  if (index < 0 || take === undefined) {
-    return;
-  }
-  state.takes[index] = { ...take, hypothesisRevision: revision };
-}
-
-/** Records how many of one take's finished stable sentences have been announced. */
-export function recordAnnouncedSentences(
-  state: MutableRegistry,
-  takeId: number,
-  announcedSentences: number,
-): void {
-  const index = state.takes.findIndex((take) => take.id === takeId);
-  const take = state.takes[index];
-  if (index < 0 || take === undefined) {
-    return;
-  }
-  state.takes[index] = { ...take, announcedSentences };
-}
-
-/** Records one item identifier as permanently unable to mutate a take. */
-export function retireItem(
-  state: MutableRegistry,
-  generation: number,
-  itemId: string,
-): void {
-  if (!isRetiredItem(state, generation, itemId)) {
-    state.retiredItems.push({ generation, itemId });
-  }
-}
-
-/** Whether one item identity is retired in its originating generation. */
-export function isRetiredItem(
-  state: MutableRegistry,
-  generation: number,
-  itemId: string,
-): boolean {
-  return state.retiredItems.some(
-    (item) => item.generation === generation && item.itemId === itemId,
-  );
-}
-
-/** Returns the active take when its owner still exists. */
-export function activeTake(state: MutableRegistry): RegistryTake | null {
-  return state.activeTakeId === null
-    ? null
-    : takeById(state, state.activeTakeId);
-}
-
-/** Finds one take by local identifier. */
-export function takeById(
-  state: MutableRegistry,
-  takeId: number,
-): RegistryTake | null {
-  return state.takes.find((take) => take.id === takeId) ?? null;
-}
-
-/** Finds one take by trusted server item identifier. */
-export function takeByItem(
-  state: MutableRegistry,
-  itemId: string,
-): RegistryTake | null {
-  return (
-    state.takes.find(
-      (take) =>
-        take.itemId === itemId &&
-        take.itemGeneration === state.activeGeneration,
-    ) ?? null
-  );
-}
diff --git a/crates/workshop/ui/src/parts/take/take-registry-types.ts b/crates/workshop/ui/src/parts/take/take-registry-types.ts
deleted file mode 100644
index 2ac108ed1..000000000
--- a/crates/workshop/ui/src/parts/take/take-registry-types.ts
+++ /dev/null
@@ -1,252 +0,0 @@
-// The take registry's types: the immutable state, the inputs the reducer
-// accepts, and the typed effects it hands its owner. MutableRegistry and
-// Reduction live only inside one reduction; take-registry.ts re-exports
-// the public subset.
-
-import type { RealtimeEvent } from "../../services/realtime-event-decoder";
-
-/** One immutable snapshot of the target-owned transcript insertion policy. */
-export interface SttInsertionContext {
-  /** The selected range in the target's coordinate space. */
-  readonly range: {
-    readonly start: number;
-    readonly end: number;
-  };
-  /** The selected text, which a take restores when the target captured no `content`. */
-  readonly original: string;
-  /**
-   * The selection in the target's own form, as plain data opaque to the
-   * registry. A take restores it through the target's `restoreRange`, so
-   * structure the text does not show, such as paragraph breaks and
-   * mention chips, comes back intact.
-   */
-  readonly content?: unknown;
-  /** The separator owned by this take, if appending requires one. */
-  readonly compositionPrefix: "" | " ";
-}
-
-/** One transcript region owned by a Realtime audio take. */
-export interface RegistryTake {
-  readonly id: number;
-  readonly generation: number;
-  readonly from: number;
-  readonly to: number;
-  readonly original: string;
-  /** The target's own form of the captured selection; undefined when it captured only text. */
-  readonly originalContent: unknown;
-  /** How many target positions the captured selection spans. */
-  readonly originalWidth: number;
-  readonly compositionPrefix: "" | " ";
-  readonly itemId: string | null;
-  readonly itemGeneration: number | null;
-  readonly text: string;
-  readonly deltaText: string;
-  readonly hypothesisRevision: number | null;
-  /** Whether the region holds text this take wrote, so later writes may patch it word by word. */
-  readonly written: boolean;
-  /** The length of the tentative tail that ends `text`; 0 when none is shown. */
-  readonly tentativeLength: number;
-  /** How many of the take's finished stable sentences have been announced. */
-  readonly announcedSentences: number;
-}
-
-/** A span in the target's coordinate space. */
-export interface SttTargetRange {
-  readonly from: number;
-  readonly to: number;
-}
-
-/** One wire request waiting for its client event identifier. */
-export interface PendingWireRequest {
-  readonly id: number;
-  readonly generation: number;
-  readonly command: "append" | "commit";
-  readonly takeId: number;
-}
-
-/** One client event identifier bound to its owning take. */
-export interface ClientEventBinding {
-  readonly eventId: string;
-  readonly generation: number;
-  readonly takeId: number;
-  readonly command: PendingWireRequest["command"];
-}
-
-/** One FIFO commit owner or a retired owner's acknowledgment tombstone. */
-export interface CommitExpectation {
-  readonly generation: number;
-  readonly takeId: number | null;
-  readonly itemId: string | null;
-}
-
-/** One generation-scoped item identifier that can no longer mutate state. */
-export interface RetiredItem {
-  readonly generation: number;
-  readonly itemId: string;
-}
-
-/** All immutable state needed to assign and replace transcript regions. */
-export interface TakeRegistry {
-  readonly takes: readonly RegistryTake[];
-  readonly awaitingCommit: readonly CommitExpectation[];
-  readonly retiredItems: readonly RetiredItem[];
-  readonly clientEvents: readonly ClientEventBinding[];
-  readonly pendingWire: readonly PendingWireRequest[];
-  readonly activeTakeId: number | null;
-  readonly capture: "idle" | "recording" | "stopping";
-  readonly stoppingTakeId: number | null;
-  readonly connection: "ready" | "unavailable";
-  readonly activeGeneration: number;
-  readonly nextTakeId: number;
-  readonly nextRequestId: number;
-}
-
-/** A user, capture, connection, or decoded server input to the registry. */
-export type TakeRegistryInput =
-  | { readonly type: "user.start"; readonly generation: number; readonly context: SttInsertionContext }
-  | { readonly type: "user.stop"; readonly generation: number }
-  | { readonly type: "user.discard"; readonly generation: number }
-  | { readonly type: "capture.audio"; readonly generation: number; readonly chunk: ArrayBuffer }
-  | {
-      readonly type: "capture.stopped";
-      readonly generation: number;
-      readonly takeId: number;
-      readonly ok: boolean;
-    }
-  | {
-      readonly type: "wire.result";
-      readonly generation: number;
-      readonly requestId: number;
-      readonly eventId: string | null;
-    }
-  | { readonly type: "server.event"; readonly generation: number; readonly event: RealtimeEvent }
-  | { readonly type: "service.error"; readonly generation: number; readonly eventId: string | null }
-  | { readonly type: "connection.lost"; readonly generation: number }
-  | { readonly type: "connection.ready"; readonly generation: number };
-
-/** A target edit the registry asks its UI owner to perform. */
-export type TakeRegistryEditorEffect =
-  | {
-      readonly domain: "editor";
-      readonly command: "replace";
-      readonly from: number;
-      readonly to: number;
-      readonly text: string;
-      /**
-       * Whether the edit stays out of the target's undo history. Interim
-       * writes and rollbacks are transient; only the write that lands a
-       * take's text is not, so one dictation is one undo step.
-       */
-      readonly transient: boolean;
-    }
-  | {
-      readonly domain: "editor";
-      readonly command: "restore";
-      readonly from: number;
-      readonly to: number;
-      /** The take's captured selection in the target's own form, written outside undo history. */
-      readonly content: unknown;
-    }
-  | {
-      readonly domain: "editor";
-      readonly command: "caret";
-      /** Where the collapsed caret goes: the end of the take just written. */
-      readonly at: number;
-    }
-  | {
-      readonly domain: "editor";
-      readonly command: "tentative";
-      readonly takeId: number;
-      /** The take's shown tentative words, or null to clear its mark. */
-      readonly range: SttTargetRange | null;
-    }
-  | {
-      readonly domain: "editor";
-      readonly command: "read-only";
-      readonly readOnly: boolean;
-    }
-  | { readonly domain: "editor"; readonly command: "focus" };
-
-/** A capture operation the registry asks its service owner to perform. */
-export type TakeRegistryCaptureEffect =
-  | {
-      readonly domain: "capture";
-      readonly command: "stop";
-      readonly takeId: number;
-      readonly generation: number;
-    }
-  | { readonly domain: "capture"; readonly command: "clear" };
-
-/** A local status update emitted without server-authored wording. */
-export type TakeRegistryStatusEffect =
-  | {
-      readonly domain: "status";
-      readonly command: "recording";
-      readonly recording: boolean;
-    }
-  | {
-      readonly domain: "status";
-      readonly command: "local";
-      readonly label: string;
-      readonly severity: "info" | "error";
-    }
-  | {
-      readonly domain: "status";
-      readonly command: "announce";
-      /** Newly finished stable sentences, or the unannounced rest of a completed take. */
-      readonly text: string;
-    };
-
-/** A wire operation the registry asks the Realtime owner to perform. */
-export type TakeRegistryWireEffect =
-  | {
-      readonly domain: "wire";
-      readonly command: "append";
-      readonly generation: number;
-      readonly requestId: number;
-      readonly takeId: number;
-      readonly chunk: ArrayBuffer;
-    }
-  | {
-      readonly domain: "wire";
-      readonly command: "commit";
-      readonly generation: number;
-      readonly requestId: number;
-      readonly takeId: number;
-    }
-  | { readonly domain: "wire"; readonly command: "clear"; readonly generation: number };
-
-/** A typed operation produced by a pure registry transition. */
-export type TakeRegistryEffect =
-  | TakeRegistryEditorEffect
-  | TakeRegistryCaptureEffect
-  | TakeRegistryStatusEffect
-  | TakeRegistryWireEffect;
-
-/** The next immutable registry state and operations for its owners. */
-export interface TakeRegistryTransition {
-  readonly state: TakeRegistry;
-  readonly effects: readonly TakeRegistryEffect[];
-}
-
-/** A private writable clone used only during one pure reduction. */
-export interface MutableRegistry {
-  takes: RegistryTake[];
-  awaitingCommit: CommitExpectation[];
-  retiredItems: RetiredItem[];
-  clientEvents: ClientEventBinding[];
-  pendingWire: PendingWireRequest[];
-  activeTakeId: number | null;
-  capture: TakeRegistry["capture"];
-  stoppingTakeId: number | null;
-  connection: TakeRegistry["connection"];
-  activeGeneration: number;
-  nextTakeId: number;
-  nextRequestId: number;
-}
-
-/** A private transition accumulator used only during one reduction. */
-export interface Reduction {
-  readonly state: MutableRegistry;
-  readonly effects: TakeRegistryEffect[];
-}
diff --git a/crates/workshop/ui/src/parts/take/take-registry.ts b/crates/workshop/ui/src/parts/take/take-registry.ts
deleted file mode 100644
index 977196e6e..000000000
--- a/crates/workshop/ui/src/parts/take/take-registry.ts
+++ /dev/null
@@ -1,351 +0,0 @@
-// The dictation take registry: a pure reducer over push-to-talk takes,
-// each one a transcript region in the target text. Every user, capture,
-// wire, server, or connection input yields the next state plus typed
-// effects; realtime-stt.ts performs the editor, capture, status, and
-// wire work those effects name. Only connection.ready advances the
-// Realtime connection generation, and advancing it drops the old
-// connection's wire, commit, and capture bookkeeping. Any other input
-// stamped with a different generation is ignored.
-
-import {
-  connectionLost,
-  failTake,
-  serverEvent,
-  serviceError,
-} from "./take-registry-events";
-import {
-  activeTake,
-  cloneRegistry,
-  reserveWireRequest,
-  rollbackAll,
-  rollbackTake,
-  takeById,
-} from "./take-registry-state";
-import type {
-  Reduction,
-  RegistryTake,
-  SttInsertionContext,
-  TakeRegistry,
-  TakeRegistryInput,
-  TakeRegistryTransition,
-} from "./take-registry-types";
-
-export type {
-  RegistryTake,
-  TakeRegistry,
-  TakeRegistryCaptureEffect,
-  TakeRegistryEditorEffect,
-  TakeRegistryEffect,
-  TakeRegistryInput,
-  TakeRegistryStatusEffect,
-  TakeRegistryTransition,
-  TakeRegistryWireEffect,
-} from "./take-registry-types";
-
-/** Creates an empty registry ready for its first take. */
-export function createTakeRegistry(): TakeRegistry {
-  return {
-    takes: [],
-    awaitingCommit: [],
-    retiredItems: [],
-    clientEvents: [],
-    pendingWire: [],
-    activeTakeId: null,
-    capture: "idle",
-    stoppingTakeId: null,
-    connection: "ready",
-    activeGeneration: 0,
-    nextTakeId: 1,
-    nextRequestId: 1,
-  };
-}
-
-/** Applies one input without performing editor, capture, status, or wire work. */
-export function reduceTakeRegistry(
-  current: TakeRegistry,
-  input: TakeRegistryInput,
-): TakeRegistryTransition {
-  const reduction: Reduction = {
-    state: cloneRegistry(current),
-    effects: [],
-  };
-  const generation = input.generation ?? 0;
-  if (input.type === "connection.ready") {
-    if (generation < reduction.state.activeGeneration) {
-      return reduction;
-    }
-    if (
-      generation === reduction.state.activeGeneration &&
-      reduction.state.connection === "ready"
-    ) {
-      return reduction;
-    }
-    if (generation > reduction.state.activeGeneration) {
-      reduction.state.activeGeneration = generation;
-      reduction.state.awaitingCommit = [];
-      reduction.state.clientEvents = [];
-      reduction.state.pendingWire = [];
-      reduction.state.retiredItems = [];
-      reduction.state.capture = "idle";
-      reduction.state.stoppingTakeId = null;
-      reduction.state.activeTakeId = null;
-    }
-    reduction.state.connection = "ready";
-    return reduction;
-  }
-  if (generation !== reduction.state.activeGeneration) {
-    return reduction;
-  }
-  switch (input.type) {
-    case "user.start":
-      startTake(reduction, input.context);
-      break;
-    case "user.stop":
-      stopTake(reduction);
-      break;
-    case "user.discard":
-      discardTakes(reduction);
-      break;
-    case "capture.audio":
-      appendAudio(reduction, input.chunk);
-      break;
-    case "capture.stopped":
-      captureStopped(reduction, input.takeId, input.ok);
-      break;
-    case "wire.result":
-      wireResult(reduction, input.requestId, input.eventId);
-      break;
-    case "server.event":
-      serverEvent(reduction, input.event);
-      break;
-    case "service.error":
-      serviceError(reduction, input.eventId);
-      break;
-    case "connection.lost":
-      if (reduction.state.connection === "ready") {
-        connectionLost(reduction);
-      }
-      break;
-    default: {
-      const exhaustive: never = input;
-      return exhaustive;
-    }
-  }
-  return reduction;
-}
-
-function startTake(reduction: Reduction, context: SttInsertionContext): void {
-  if (
-    reduction.state.activeTakeId !== null ||
-    reduction.state.capture !== "idle" ||
-    reduction.state.connection !== "ready"
-  ) {
-    return;
-  }
-  const id = reduction.state.nextTakeId;
-  reduction.state.nextTakeId += 1;
-  const take: RegistryTake = {
-    id,
-    generation: reduction.state.activeGeneration,
-    from: context.range.start,
-    to: context.range.end,
-    original: context.original,
-    originalContent: context.content,
-    originalWidth: context.range.end - context.range.start,
-    compositionPrefix: context.compositionPrefix,
-    itemId: null,
-    itemGeneration: null,
-    text: context.original,
-    deltaText: "",
-    hypothesisRevision: null,
-    written: false,
-    tentativeLength: 0,
-    announcedSentences: 0,
-  };
-  const wasEmpty = reduction.state.takes.length === 0;
-  reduction.state.takes.push(take);
-  reduction.state.takes.sort((left, right) => left.from - right.from || left.id - right.id);
-  reduction.state.activeTakeId = id;
-  reduction.state.capture = "recording";
-  if (wasEmpty) {
-    reduction.effects.push({
-      domain: "editor",
-      command: "read-only",
-      readOnly: true,
-    });
-  }
-  reduction.effects.push(
-    { domain: "status", command: "recording", recording: true },
-    {
-      domain: "status",
-      command: "local",
-      label: "Listening...",
-      severity: "info",
-    },
-  );
-}
-
-function stopTake(reduction: Reduction): void {
-  const take = activeTake(reduction.state);
-  if (take === null || reduction.state.capture !== "recording") {
-    return;
-  }
-  reduction.state.capture = "stopping";
-  reduction.state.stoppingTakeId = take.id;
-  reduction.effects.push(
-    {
-      domain: "capture",
-      command: "stop",
-      takeId: take.id,
-      generation: reduction.state.activeGeneration,
-    },
-    { domain: "status", command: "recording", recording: false },
-    {
-      domain: "status",
-      command: "local",
-      label: "Transcribing...",
-      severity: "info",
-    },
-  );
-}
-
-function appendAudio(reduction: Reduction, chunk: ArrayBuffer): void {
-  const take = activeTake(reduction.state);
-  if (take === null || reduction.state.capture === "idle") {
-    return;
-  }
-  const requestId = reserveWireRequest(reduction.state, "append", take.id);
-  reduction.effects.push({
-    domain: "wire",
-    command: "append",
-    generation: reduction.state.activeGeneration,
-    requestId,
-    takeId: take.id,
-    chunk,
-  });
-}
-
-function captureStopped(reduction: Reduction, takeId: number, ok: boolean): void {
-  if (
-    reduction.state.capture !== "stopping" ||
-    reduction.state.stoppingTakeId !== takeId
-  ) {
-    return;
-  }
-  reduction.state.capture = "idle";
-  reduction.state.stoppingTakeId = null;
-  if (reduction.state.activeTakeId === takeId) {
-    reduction.state.activeTakeId = null;
-  }
-  const take = takeById(reduction.state, takeId);
-  if (take === null) {
-    return;
-  }
-  if (!ok) {
-    reduction.effects.push({
-      domain: "wire",
-      command: "clear",
-      generation: reduction.state.activeGeneration,
-    });
-    rollbackTake(reduction, takeId);
-    reduction.effects.push({
-      domain: "status",
-      command: "local",
-      label: "Dictation could not finish capturing audio. Try again.",
-      severity: "error",
-    });
-    return;
-  }
-  const requestId = reserveWireRequest(reduction.state, "commit", takeId);
-  reduction.effects.push({
-    domain: "wire",
-    command: "commit",
-    generation: reduction.state.activeGeneration,
-    requestId,
-    takeId,
-  });
-}
-
-function discardTakes(reduction: Reduction): void {
-  if (reduction.state.takes.length === 0) {
-    return;
-  }
-  const activeTakeId = reduction.state.activeTakeId;
-  if (activeTakeId !== null && reduction.state.capture !== "idle") {
-    reduction.effects.push(
-      { domain: "capture", command: "clear" },
-      {
-        domain: "capture",
-        command: "stop",
-        takeId: activeTakeId,
-        generation: reduction.state.activeGeneration,
-      },
-      {
-        domain: "wire",
-        command: "clear",
-        generation: reduction.state.activeGeneration,
-      },
-    );
-    reduction.state.capture = "stopping";
-    reduction.state.stoppingTakeId = activeTakeId;
-  }
-  rollbackAll(reduction);
-  reduction.effects.push({
-    domain: "status",
-    command: "recording",
-    recording: false,
-  });
-}
-
-function wireResult(
-  reduction: Reduction,
-  requestId: number,
-  eventId: string | null,
-): void {
-  const index = reduction.state.pendingWire.findIndex(
-    (request) => request.id === requestId,
-  );
-  if (index < 0) {
-    return;
-  }
-  const [request] = reduction.state.pendingWire.splice(index, 1);
-  if (request === undefined || request.generation !== reduction.state.activeGeneration) {
-    return;
-  }
-  const take = takeById(reduction.state, request.takeId);
-  if (eventId === null) {
-    if (take !== null) {
-      failTake(reduction, take.id);
-    }
-    return;
-  }
-  if (take === null) {
-    if (request.command === "commit") {
-      reduction.state.awaitingCommit.push({
-        generation: request.generation,
-        takeId: null,
-        itemId: null,
-      });
-    }
-    return;
-  }
-  if (request.command === "append") {
-    reduction.state.clientEvents = reduction.state.clientEvents.filter(
-      (binding) =>
-        binding.takeId !== take.id || binding.command !== "append",
-    );
-  }
-  reduction.state.clientEvents.push({
-    eventId,
-    generation: request.generation,
-    takeId: take.id,
-    command: request.command,
-  });
-  if (request.command === "commit") {
-    reduction.state.awaitingCommit.push({
-      generation: request.generation,
-      takeId: take.id,
-      itemId: take.itemId,
-    });
-  }
-}
diff --git a/crates/workshop/ui/src/parts/workbench.contributions.ts b/crates/workshop/ui/src/parts/workbench.contributions.ts
deleted file mode 100644
index 76ed2ef66..000000000
--- a/crates/workshop/ui/src/parts/workbench.contributions.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-// The workbench's contribution surface: one flat list of side-effect
-// imports, one per feature contribution module. Each module registers
-// its actions, menu rows, keybinding rules, and quick-access providers
-// into the shared registries at module scope, before any service
-// exists; run bodies resolve services at call time and lazy-import
-// anything that pulls CodeMirror or dockview, so this list stays in the
-// entry bundle without dragging the feature chunks with it. The menu
-// feature's bootstrap (parts/menu/index.ts) imports this module once;
-// no other app module imports the contribution files directly; tests
-// bundle them to assert their registrations.
-//
-// Order is registration order, not sort order: the menu registry sorts
-// rows by group, order, and title at read time, and the first
-// keybinding rule registered for a command owns its menu label.
-
-import "./menu/menubar.contribution";
-import "./menu/stubs.contribution";
-import "./menu/edit.contribution";
-import "./editor/editor.contribution";
-import "./workspace/workspace.contribution";
-import "./workspace-document/workspace-document.contribution";
-import "./chrome/chrome.contribution";
-import "./layout/layout.contribution";
-import "./status/status.contribution";
-import "./agent/agent.contribution";
-import "./gateway/gateway.contribution";
-import "./run/run.contribution";
-import "./quickinput/quickinput.contribution";
diff --git a/crates/workshop/ui/src/parts/workspace-document/index.ts b/crates/workshop/ui/src/parts/workspace-document/index.ts
deleted file mode 100644
index 8c6e3243d..000000000
--- a/crates/workshop/ui/src/parts/workspace-document/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-// The workspace-document feature's entry point: register() is the
-// composition root's activation hook. Importers point at the source
-// files directly; this module re-exports nothing.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registrations } from "./workspace-document.contribution";
-
-/**
- * The workspace-document directory's activation. The actions register
- * eagerly from workspace-document.contribution.ts (imported by the
- * contribution surface); this hands their registrations to the caller
- * as one disposable, so the composition root's ownership tree tears the
- * feature down with the rest of the page. Called once from main.ts; the
- * returned disposable is held for the page lifetime.
- */
-export function register(): IDisposable {
-  return registrations;
-}
diff --git a/crates/workshop/ui/src/parts/workspace-document/workspace-document.contribution.ts b/crates/workshop/ui/src/parts/workspace-document/workspace-document.contribution.ts
deleted file mode 100644
index 8dad582db..000000000
--- a/crates/workshop/ui/src/parts/workspace-document/workspace-document.contribution.ts
+++ /dev/null
@@ -1,376 +0,0 @@
-// The workspace-document contribution: the eager module registering the
-// File menu's workspace-document rows at module scope, before any
-// service exists. Open Workspace from File..., Save
-// Workspace As..., and Duplicate Workspace take over the stub table's
-// rows under the same command ids and labels (Duplicate without an
-// ellipsis, Cursor's own label despite its save picker), so no menu, test,
-// or keybinding wiring changes; the rows are desktop-only (precondition !isWeb)
-// because their pickers are the native Tauri dialogs.
-//
-// The run bodies lazy-import the Tauri dialog plugin and the Tauri event API,
-// so this module pulls neither into the initial bundle. Every action is
-// a switch: the server replaces the grants wholesale (open) or writes a
-// new file and moves onto it (save as, duplicate); the page then fires
-// the existing runvil:workspace-changed event (marked roots-current:
-// open dropped the roots before re-creating the tree, save as and
-// duplicate keep the grants) so the window title and the tree refresh
-// without a second roots fetch, emits the runvil:workspace-opened
-// Tauri event so the desktop app can fetch and apply the file's window
-// geometry (native geometry is the desktop app's to apply, never the page's),
-// and records the file in the recent-files store. Failures paint the
-// status bar, exactly as the other file actions do; success is silent,
-// the refreshed tree being its own confirmation; a canceled picker is
-// a no-op. A 408 paints too, but the route deadline abandons only the
-// answer, not a switch that already committed, so the page then asks the
-// server where it stands and follows it (resyncAfterTimeout).
-//
-// The workspace-scoped UI state follows the switch too. The
-// .rvwork file holds the dock layout, the tree's expanded folders, and
-// the closed-editor stack in its workspace bucket. Open pulls the file's
-// bucket through the UI-state adapter and applies all three to the live
-// stores with writes suppressed, so a store that writes synchronously on
-// replace never echoes the values straight back to the file they came
-// from; the layout saver, whose change event arrives on a microtask and
-// whose write is debounced, drops a restore's echo itself. Save As writes the three live
-// values once each into the new file, which the server created with
-// grants only; the page is the single writer of that fact. Duplicate
-// copies the file wholesale, state included, and touches nothing here.
-
-import { DisposableStore, type IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import { errorText, isCatalogError, type Result } from "../../services/error-catalog";
-import { isRecord } from "../../services/json-request";
-import { MenuId } from "@workshop/platform/menu-registry";
-import { DOCK } from "@workshop/platform/panel-registry";
-import { RECENT_FILES_STORE } from "../../services/recent-files-store";
-import { getService, getServiceOrNull } from "@workshop/platform/service-registry";
-import { TREE_STATE } from "../../services/tree-state-service";
-import { UI_STORAGE } from "../../services/ui-storage";
-import {
-  currentWorkspaceFile,
-  duplicateWorkspaceFile,
-  openWorkspaceFile,
-  saveWorkspaceFileAs,
-  type WorkspaceFileResponse,
-} from "../../services/workspace-file-client";
-import { CLOSED_EDITORS } from "../../services/closed-editors";
-import { applyLayoutOrDefault } from "../layout/layout-boot";
-import { buildLayoutEnvelope } from "../layout/layout-persistence";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { WORKSPACE_CHANGED_EVENT, type WorkspaceChangedDetail } from "../../services/workspace-events";
-
-/** The Tauri event the desktop app listens for to re-apply window geometry. */
-export const WORKSPACE_OPENED_EVENT = "runvil:workspace-opened";
-
-/** The workspace file extension, as the pickers filter and the save paths end. */
-const WORKSPACE_EXTENSION = ".rvwork";
-
-/** The name the server reports while the workspace is ephemeral; the picker's fallback seed. */
-const UNTITLED = "Untitled";
-
-/**
- * The feature's action registrations, owned as one disposable so the
- * barrel's register() can hand them to the composition root's
- * ownership tree; the other contributions leave theirs to the page.
- */
-export const registrations = new DisposableStore();
-
-/** The picker filter: workspace files only. */
-const WORKSPACE_FILTERS = [{ name: "Runvil Workspace", extensions: ["rvwork"] }];
-
-/** Paints an action failure onto the status bar, when one is up. */
-function reportError(label: string): void {
-  getServiceOrNull(STATUS_BAR)?.showLocal(label, "error");
-}
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`workspace-document action '${action.id}': ${result.error.message}`);
-    return;
-  }
-  registrations.add(result.value);
-}
-
-/**
- * Tells the desktop app a workspace file is now current. The event only
- * matters for geometry, which the open already committed, so a failed
- * emit is logged and never undoes the open.
- */
-async function announceOpened(path: string): Promise<void> {
-  try {
-    const { emit } = await import("@tauri-apps/api/event");
-    await emit(WORKSPACE_OPENED_EVENT, { path });
-  } catch (error) {
-    console.warn(`${WORKSPACE_OPENED_EVENT}: ${errorText(error)}`);
-  }
-}
-
-/**
- * The page's side of a committed switch, shared by every action: the
- * workspace-changed event for its other listeners (the window title,
- * the tree panel), the desktop app event, and the recent entry. Runs only
- * after the server has answered success, so nothing here can undo it.
- * The tree invalidation is not its job: Open drops the roots before it
- * applies the file's state (applyOpenedWorkspaceState), and Save As and
- * Duplicate keep the grants, so the event says the roots are current
- * and the tree keeps the listing it holds or the load it started.
- */
-async function announceSwitched(path: string): Promise<void> {
-  const detail: WorkspaceChangedDetail = { rootsCurrent: true };
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail }));
-  await announceOpened(path);
-  getService(RECENT_FILES_STORE).add(path);
-}
-
-/** Whether a switch failed on the server's route deadline (a 408). */
-function timedOut(error: unknown): boolean {
-  return isCatalogError(error) && error.status === 408;
-}
-
-/**
- * The page's follow-up to a switch that answered 408, after the error is
- * painted. The server may have committed the switch before its deadline
- * abandoned the answer, so the workspace as it stands decides: when it is
- * `target`, `finish` runs the page's side exactly as a success would;
- * otherwise a plain workspace-changed event makes the tree and the title
- * re-list whatever grants the server holds. A failed re-read is logged
- * and leaves the page as it was; the painted error already says the
- * outcome is unknown.
- */
-async function resyncAfterTimeout(target: string, finish: () => Promise<void>): Promise<void> {
-  let current: WorkspaceFileResponse;
-  try {
-    current = await currentWorkspaceFile();
-  } catch (error) {
-    console.warn(`workspace resync after a timed-out switch: ${errorText(error)}`);
-    return;
-  }
-  if (current.path === target) {
-    await finish();
-    return;
-  }
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-}
-
-/** The string entries of `value[key]` when it is an array; empty otherwise. */
-function stringsUnder(value: unknown, key: string): string[] {
-  if (!isRecord(value)) {
-    return [];
-  }
-  const items: unknown = value[key];
-  return Array.isArray(items) ? items.filter((item): item is string => typeof item === "string") : [];
-}
-
-/** The expanded paths of a stored `tree` value, `{ expanded: [...] }`. */
-function expandedFrom(value: unknown): string[] {
-  return stringsUnder(value, "expanded");
-}
-
-/** The paths of a stored `closed_editors` value, `{ paths: [...] }`. */
-function pathsFrom(value: unknown): string[] {
-  return stringsUnder(value, "paths");
-}
-
-/**
- * Pulls the newly opened file's workspace bucket and applies it to the
- * live stores: the dock layout (or the default when the file has none),
- * the tree's expanded folders, and the closed-editor stack. The roots
- * listing goes first: it belongs to the previous workspace, and the
- * layout apply re-creates the tree panel, whose init loads the roots
- * from the service; dropped beforehand, that load fetches the new
- * workspace's roots once and the tree never paints the old ones, and
- * replaceExpanded then re-renders from the same load. Writes stay
- * suppressed throughout, so no store's synchronous reaction to its
- * replace echoes the file's own values back into it; the layout saver's
- * deferred reaction is dropped by the saver (see startLayoutPersistence),
- * because Dockview delivers it after this span ends. Runs after the server
- * has committed the open; a failure inside the apply is logged and the
- * page continues on whatever applied, because the open already happened.
- */
-async function applyOpenedWorkspaceState(): Promise<void> {
-  const storage = getService(UI_STORAGE);
-  await storage.reloadWorkspace();
-  try {
-    const dock = getService(DOCK);
-    const tree = getService(TREE_STATE);
-    const closed = getService(CLOSED_EDITORS);
-    storage.suppressWrites(() => {
-      tree.invalidateRoots();
-      applyLayoutOrDefault(dock, storage.get("workspace", "layout"));
-      tree.replaceExpanded(expandedFrom(storage.get("workspace", "tree")));
-      closed.replaceClosedEditors(pathsFrom(storage.get("workspace", "closed_editors")));
-    });
-  } catch (error) {
-    console.error(`workspace state apply: ${errorText(error)}`);
-  }
-}
-
-/**
- * Writes the live arrangement into the workspace bucket once each, so a
- * file the server just created from the grants alone gets the
- * current layout, expanded folders, and closed stack too.
- */
-function writeLiveWorkspaceState(): void {
-  const storage = getService(UI_STORAGE);
-  storage.set("workspace", "layout", buildLayoutEnvelope(getService(DOCK)));
-  storage.set("workspace", "tree", { expanded: [...getService(TREE_STATE).expandedPaths] });
-  storage.set("workspace", "closed_editors", getService(CLOSED_EDITORS).snapshot());
-}
-
-/**
- * The native picker filtered to .rvwork. Answers the picked path, or
- * null when the picker was canceled (it answers a non-string then).
- */
-async function pickWorkspaceFile(): Promise<string | null> {
-  const { open } = await import("@tauri-apps/plugin-dialog");
-  const picked = await open({ title: "Open Workspace from File", filters: WORKSPACE_FILTERS });
-  return typeof picked === "string" ? picked : null;
-}
-
-/**
- * Open Workspace from File...: the open on the server, the file's UI
- * state applied to the live stores, then the invalidation, the desktop app
- * event, and the recent entry. With a string `path` argument (an Open
- * Recent row or a Ctrl+P hit) the picker is skipped and the argument is
- * the file; otherwise the native picker filtered to .rvwork supplies it.
- * A canceled picker is a no-op; a refusal reports and changes nothing
- * on the page; a timeout reports and then resyncs.
- */
-async function openWorkspaceFromFile(path?: unknown): Promise<void> {
-  const target = typeof path === "string" ? path : await pickWorkspaceFile();
-  if (target === null) {
-    return;
-  }
-  const finish = async (): Promise<void> => {
-    await applyOpenedWorkspaceState();
-    await announceSwitched(target);
-  };
-  try {
-    await openWorkspaceFile(target);
-  } catch (error) {
-    reportError(`Could not open ${target}: ${errorText(error)}`);
-    if (timedOut(error)) {
-      await resyncAfterTimeout(target, finish);
-    }
-    return;
-  }
-  await finish();
-}
-
-/**
- * Appends .rvwork to a picked path that lacks it. Case-insensitive so a
- * Windows pick of `Name.RVWORK` is not doubled into `Name.RVWORK.rvwork`;
- * the extension is appended at most once.
- */
-function withWorkspaceExtension(path: string): string {
-  return path.toLowerCase().endsWith(WORKSPACE_EXTENSION) ? path : `${path}${WORKSPACE_EXTENSION}`;
-}
-
-/**
- * The current workspace's display name, seeding the save picker. A
- * failed lookup falls back to the ephemeral name rather than blocking
- * the picker: the write that follows reports its own failure if the
- * server is truly unreachable.
- */
-async function currentWorkspaceName(): Promise<string> {
-  try {
-    return (await currentWorkspaceFile()).name;
-  } catch (error) {
-    console.warn(`workspace name lookup: ${errorText(error)}`);
-    return UNTITLED;
-  }
-}
-
-/**
- * One save-picker switch, shared by Save As and Duplicate: the native
- * save dialog seeded with the current name, the extension normalized,
- * the switch posted, `afterSwitch` run against the new file, then the
- * page's announcement. A canceled picker answers null and is a no-op;
- * a refusal reports and changes nothing; a timeout reports and then
- * resyncs.
- */
-async function switchThroughSavePicker(
-  title: string,
-  verb: string,
-  post: (path: string) => Promise<WorkspaceFileResponse>,
-  afterSwitch: () => void = () => {},
-): Promise<void> {
-  const name = await currentWorkspaceName();
-  const { save } = await import("@tauri-apps/plugin-dialog");
-  const picked = await save({
-    title,
-    defaultPath: `${name}${WORKSPACE_EXTENSION}`,
-    filters: WORKSPACE_FILTERS,
-  });
-  if (typeof picked !== "string") {
-    return;
-  }
-  const target = withWorkspaceExtension(picked);
-  const finish = async (): Promise<void> => {
-    afterSwitch();
-    await announceSwitched(target);
-  };
-  try {
-    await post(target);
-  } catch (error) {
-    reportError(`Could not ${verb} ${target}: ${errorText(error)}`);
-    if (timedOut(error)) {
-      await resyncAfterTimeout(target, finish);
-    }
-    return;
-  }
-  await finish();
-}
-
-/**
- * Save Workspace As...: a new file holding the current grants, the switch
- * onto it, then the live UI state written into it (the server's save_as
- * writes grants only).
- */
-function saveWorkspaceAs(): Promise<void> {
-  return switchThroughSavePicker(
-    "Save Workspace As",
-    "save workspace as",
-    saveWorkspaceFileAs,
-    writeLiveWorkspaceState,
-  );
-}
-
-/**
- * Duplicate Workspace: a copy of the current file and its siblings,
- * then the switch onto it. The copy already holds the file's UI state,
- * so nothing is written here.
- */
-function duplicateWorkspace(): Promise<void> {
-  return switchThroughSavePicker("Duplicate Workspace", "duplicate workspace to", duplicateWorkspaceFile);
-}
-
-addAction({
-  id: "workbench.action.openWorkspace",
-  title: "Open Workspace from File...",
-  f1: true,
-  precondition: "!isWeb",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "2_open", order: 3 }],
-  run: openWorkspaceFromFile,
-});
-
-addAction({
-  id: "workbench.action.saveWorkspaceAs",
-  title: "Save Workspace As...",
-  f1: true,
-  precondition: "!isWeb",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "3_workspace", order: 2 }],
-  run: saveWorkspaceAs,
-});
-
-addAction({
-  id: "workbench.action.duplicateWorkspace",
-  title: "Duplicate Workspace",
-  f1: true,
-  precondition: "!isWeb",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "3_workspace", order: 3 }],
-  run: duplicateWorkspace,
-});
diff --git a/crates/workshop/ui/src/parts/workspace/add-folder.ts b/crates/workshop/ui/src/parts/workspace/add-folder.ts
deleted file mode 100644
index 427d48e4e..000000000
--- a/crates/workshop/ui/src/parts/workspace/add-folder.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-// The Add Folder to Workspace flow, shared by the Workshop tree panel's
-// header button and empty-space context menu and by the File menu's
-// Open Folder and Add Folder to Workspace rows; the workshop is
-// multi-root, so both rows run this one flow. In the
-// desktop app the native folder picker answers with the chosen path and
-// a cancel answers nothing; in a plain browser, where no picker and no
-// OS paths exist, a dialog asks for the path as text. A granted folder
-// announces the workspace change so the tree refreshes, and the outcome
-// paints the status bar, exactly as a native drop does.
-
-import { open } from "@tauri-apps/plugin-dialog";
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { showPanelDialog } from "../shared/panel-dialog";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-import { grantPath } from "./workspace-drops";
-
-/** The status-bar surface the flow paints action outcomes onto. */
-export interface AddFolderStatusSink {
-  showLocal(label: string, severity: "info" | "error"): void;
-}
-
-/**
- * Starts the flow over `container`, the dialog's overlay parent in browser
- * mode. Returns the dialog's disposable in browser mode - the caller
- * owns dismissal when its own lifetime ends - and null in the desktop
- * app, where the native picker needs no parent. Outcomes paint `statusBar`
- * when given, else the status-bar service when one is registered.
- */
-export function addFolderToWorkspace(
-  container: HTMLElement,
-  statusBar?: AddFolderStatusSink | null,
-): IDisposable | null {
-  if (window.__TAURI_INTERNALS__ !== undefined) {
-    void pickFolder(statusBar);
-    return null;
-  }
-  return showPanelDialog({
-    container,
-    classPrefix: "ws-workspace-add",
-    titleId: "workspace-add-title",
-    title: "Add Folder to Workspace",
-    message: "Enter the full path of a folder to browse in the Workshop.",
-    skin: "form",
-    field: { id: "workspace-add-path", label: "Folder path" },
-    buttons: [
-      {
-        label: "Add",
-        primary: true,
-        requiresValue: true,
-        run: (value) => {
-          void grantFolder(value, statusBar);
-        },
-      },
-      { label: "Cancel", run: () => undefined },
-    ],
-  });
-}
-
-/** The desktop pick: the native dialog; a cancel resolves null. */
-async function pickFolder(statusBar: AddFolderStatusSink | null | undefined): Promise<void> {
-  const picked = await open({ directory: true, title: "Add Folder to Workspace" });
-  if (picked === null) {
-    return;
-  }
-  await grantFolder(picked, statusBar);
-}
-
-/** Grants one folder and announces the outcome, like the drop flow. */
-async function grantFolder(
-  path: string,
-  sink: AddFolderStatusSink | null | undefined,
-): Promise<void> {
-  const statusBar = sink ?? getServiceOrNull(STATUS_BAR);
-  const result = await grantPath(path);
-  if (!result.ok) {
-    statusBar?.showLocal(`Could not add ${path}: ${result.error.message}`, "error");
-    return;
-  }
-  statusBar?.showLocal(`Added ${path} to the Workshop`, "info");
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-}
diff --git a/crates/workshop/ui/src/parts/workspace/file-actions.ts b/crates/workshop/ui/src/parts/workspace/file-actions.ts
deleted file mode 100644
index ddf335516..000000000
--- a/crates/workshop/ui/src/parts/workspace/file-actions.ts
+++ /dev/null
@@ -1,142 +0,0 @@
-// The File menu's picker and file-action run bodies, lazy-loaded by
-// workspace.contribution.ts so the contribution module stays out of
-// the dockview and CodeMirror import graph. Open File and Save As
-// are desktop-only rows (precondition !isWeb): their pickers are the
-// native Tauri dialogs. Open Folder and Add Folder to Workspace share
-// the tree's Add Folder flow, which falls back to a typed-path dialog in
-// a plain browser. A canceled picker is always a no-op.
-
-import { open, save } from "@tauri-apps/plugin-dialog";
-
-import { errorText } from "../../services/error-catalog";
-import { DOCK } from "@workshop/platform/panel-registry";
-import { getService, getServiceOrNull } from "@workshop/platform/service-registry";
-import { TREE_STATE } from "../../services/tree-state-service";
-import { fetchTree } from "../../services/workspace-api";
-import { WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-import { asEditor } from "../editor/editor-commands";
-import { openInZone } from "../layout/zones";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { addFolderToWorkspace } from "./add-folder";
-import { grantPath } from "./workspace-drops";
-import { focusWorkshopTree } from "./workshop-panel";
-
-/** Paints an action outcome onto the status bar, when one is up. */
-function report(label: string, severity: "info" | "error"): void {
-  getServiceOrNull(STATUS_BAR)?.showLocal(label, severity);
-}
-
-/** The directory portion of a path, or null when it has no separator. */
-function parentDir(path: string): string | null {
-  const match = /^(.*)[\\/][^\\/]+$/.exec(path);
-  return match?.[1] ?? null;
-}
-
-/**
- * Open File...: the native file picker, a grant so the confined
- * workspace API can read the pick, then an editor on the path. A cancel
- * answers a non-string and is a no-op.
- */
-export async function openFile(): Promise<void> {
-  const picked = await open({ multiple: false, title: "Open File" });
-  if (typeof picked !== "string") {
-    return;
-  }
-  const granted = await grantPath(picked);
-  if (!granted.ok) {
-    report(`Could not open ${picked}: ${granted.error.message}`, "error");
-    return;
-  }
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  openInZone("editor", { path: picked });
-}
-
-/** Open Folder...: the shared Add Folder flow. */
-export function openFolder(): void {
-  addFolderToWorkspace(document.body);
-}
-
-/** Add Folder to Workspace...: the workshop is multi-root, so this is Open Folder's flow. */
-export function addRootFolder(): void {
-  openFolder();
-}
-
-/**
- * Save As...: the native save dialog seeded with the current path, a
- * grant of the target's parent so the confined write reaches it, then
- * the active editor retargets onto the new path. A cancel is a no-op.
- */
-export async function saveActiveEditorAs(): Promise<void> {
-  const editor = asEditor(getService(DOCK).activePanel);
-  if (editor === null) {
-    return;
-  }
-  const current = editor.filePath();
-  const picked = await save({
-    title: "Save As",
-    ...(current === null ? {} : { defaultPath: current }),
-  });
-  if (picked === null) {
-    return;
-  }
-  const parent = parentDir(picked);
-  if (parent !== null) {
-    const granted = await grantPath(parent);
-    if (!granted.ok) {
-      report(`Could not save to ${picked}: ${granted.error.message}`, "error");
-      return;
-    }
-  }
-  await editor.saveAs(picked);
-}
-
-/**
- * Save All: every dirty editor panel, saved sequentially with for...of -
- * never Promise.all or an async forEach: the save path is race-pinned
- * by editor-save-race.mjs.
- */
-export async function saveAllEditors(): Promise<void> {
-  for (const panel of getService(DOCK).panels) {
-    const editor = asEditor(panel);
-    if (editor !== null && editor.isDirty()) {
-      await editor.save();
-    }
-  }
-}
-
-/** Revert File: reload the active editor from disk, prompting on unsaved changes. */
-export function revertActiveEditor(): void {
-  asEditor(getService(DOCK).activePanel)?.requestRevert();
-}
-
-/**
- * vscode.open: an editor on an already-granted path. The path comes from
- * an Open Recent row or the "" quick-access list, so unlike openFile
- * there is no picker and no grant.
- */
-export function openPath(path: string): void {
-  openInZone("editor", { path });
-}
-
-/**
- * vscode.openFolder: re-focus the Workshop tree on one granted root. The
- * root's listing is fetched and cached when missing, so the expanded row
- * has children to render; the workspace-changed event makes an open tree
- * re-render with the root expanded, and the tree panel opens or
- * activates with focus. A fetch failure reports and leaves the tree as
- * it is.
- */
-export async function focusWorkspaceRoot(path: string): Promise<void> {
-  const state = getService(TREE_STATE);
-  if (state.listing(path) === undefined) {
-    try {
-      state.cacheListing(path, await fetchTree(path));
-    } catch (error) {
-      report(`Could not open ${path}: ${errorText(error)}`, "error");
-      return;
-    }
-  }
-  state.expand(path);
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  focusWorkshopTree();
-}
diff --git a/crates/workshop/ui/src/parts/workspace/index.ts b/crates/workshop/ui/src/parts/workspace/index.ts
deleted file mode 100644
index d81444d49..000000000
--- a/crates/workshop/ui/src/parts/workspace/index.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-// The workspace feature's entry point: register() is the panel registry's
-// activation hook. Importers point at the source files directly; this
-// module re-exports nothing.
-
-import { DisposableStore, type IDisposable } from "@workshop/platform/lifecycle";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import { registerPanelFactory } from "@workshop/platform/panel-registry";
-import { getService, getServiceOrNull } from "@workshop/platform/service-registry";
-import { STATUS_BAR } from "@workshop/platform/status-bar";
-import { WorkshopTreePanel } from "./workshop-panel";
-
-/**
- * The workspace directory's activation: installs the Workshop tree's panel
- * factory and binds the sidebar visibility context keys the Appearance
- * menu's checkboxes read - both bars are visible in the boot layout, so
- * the defaults are true. The tree's actions and keybindings (the
- * Ctrl+B toggle, the Ctrl+Shift+E focus) register eagerly from
- * workspace.contribution.ts. Called once by the panel registry when the
- * directory's chunk first loads; the returned disposable is held for
- * the page lifetime.
- */
-export function register(): IDisposable {
-  const contextKeys = getService(CONTEXT_KEY_SERVICE);
-  contextKeys.createKey("sideBarVisible", true);
-  contextKeys.createKey("auxiliaryBarVisible", true);
-  const store = new DisposableStore();
-  store.add(
-    registerPanelFactory("tree", () => new WorkshopTreePanel(getServiceOrNull(STATUS_BAR))),
-  );
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/workspace/open-recent.ts b/crates/workshop/ui/src/parts/workspace/open-recent.ts
deleted file mode 100644
index 1d02da413..000000000
--- a/crates/workshop/ui/src/parts/workspace/open-recent.ts
+++ /dev/null
@@ -1,149 +0,0 @@
-// The Open Recent menu provider and the "" quick-access file provider.
-// Both read the same two sources - the tree-state
-// service's fetched listings (the granted roots cache under ROOTS_KEY)
-// and the recent-files store - so File > Open Recent and Ctrl+P never
-// disagree, and both cover only what is already there: no server route,
-// no index. The menu provider is re-read at every open; the quick-access
-// provider re-reads the stores at every getItems.
-//
-// The dynamic rows declare their own groups so they sort with the static
-// Reopen Closed Editor (1_editor), More... (y_more), and Clear Recently
-// Opened... (z_clear) rows: recent workspace files (a .rvwork suffix,
-// any case) land in 1_workspaces and dispatch
-// workbench.action.openWorkspace with the file path, roots land in
-// 2_roots and dispatch vscode.openFolder with the root path, the other
-// recent files land in 3_files and dispatch vscode.open. The recent
-// store records one flat path list; a row's kind is inferred from its
-// extension at render time, so no store shape changes. When roots and
-// history are both empty the provider answers no rows, which is what
-// lets the menu widget drop the empty submenu.
-//
-// Every factory takes its stores as optional deps defaulting to the
-// shared singletons, resolved at call time; tests inject their own.
-
-import { baseName } from "../../base/paths";
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import type { MenuItem, MenuItemsProvider } from "@workshop/platform/menu-registry";
-import { RECENT_FILES_STORE, type RecentFilesStore } from "../../services/recent-files-store";
-import { getService } from "@workshop/platform/service-registry";
-import { ROOTS_KEY, TREE_STATE, type TreeStateService } from "../../services/tree-state-service";
-import { substringHighlights, type QuickAccessProvider, type QuickInputItem } from "../../services/quick-input-service";
-
-/** The stores the providers read; tests inject their own. */
-export interface RecentProviderDeps {
-  readonly treeState?: TreeStateService;
-  readonly recentFiles?: RecentFilesStore;
-  readonly commands?: CommandRegistry;
-}
-
-/** The workspace file extension; the same suffix the workspace-document pickers filter on. */
-const WORKSPACE_EXTENSION = ".rvwork";
-
-/** The command an Open Recent workspace row and a Ctrl+P workspace hit dispatch. */
-const OPEN_WORKSPACE_COMMAND = "workbench.action.openWorkspace";
-
-/** Whether a recorded path is a workspace file: a `.rvwork` suffix, any case. */
-export function isWorkspaceFilePath(path: string): boolean {
-  return path.toLowerCase().endsWith(WORKSPACE_EXTENSION);
-}
-
-/** The command a recent path dispatches: the workspace open for a .rvwork, the editor otherwise. */
-function openCommandFor(path: string): string {
-  return isWorkspaceFilePath(path) ? OPEN_WORKSPACE_COMMAND : "vscode.open";
-}
-
-/**
- * The dynamic rows of File > Open Recent: one row per recent workspace
- * file, most recent first (1_workspaces; switches onto it), one per
- * granted root (2_roots; re-focuses the tree on it), and one per other
- * recent file, most recent first (3_files; opens an editor). Empty when
- * both sources are empty.
- */
-export function createRecentMenuProvider(deps: RecentProviderDeps = {}): MenuItemsProvider {
-  return (): readonly MenuItem[] => {
-    const treeState = deps.treeState ?? getService(TREE_STATE);
-    const recentFiles = deps.recentFiles ?? getService(RECENT_FILES_STORE);
-    const rows: MenuItem[] = [];
-    const roots = treeState.listing(ROOTS_KEY)?.entries ?? [];
-    let order = 0;
-    for (const root of roots) {
-      if (root.kind !== "directory") {
-        continue;
-      }
-      rows.push({ command: "vscode.openFolder", args: [root.path], title: root.name, group: "2_roots", order });
-      order += 1;
-    }
-    let workspaceOrder = 0;
-    let fileOrder = 0;
-    for (const path of recentFiles.list) {
-      if (isWorkspaceFilePath(path)) {
-        rows.push({
-          command: OPEN_WORKSPACE_COMMAND,
-          args: [path],
-          title: baseName(path),
-          group: "1_workspaces",
-          order: workspaceOrder,
-        });
-        workspaceOrder += 1;
-        continue;
-      }
-      rows.push({ command: "vscode.open", args: [path], title: baseName(path), group: "3_files", order: fileOrder });
-      fileOrder += 1;
-    }
-    return rows;
-  };
-}
-
-/**
- * The "" quick-access provider: recent files first in recency order,
- * then every file in the tree's fetched listings, deduped by path. The
- * filter is a case-insensitive substring match on the base name or the
- * full path. Accepting dispatches the same command the matching Open
- * Recent row dispatches: workbench.action.openWorkspace for a .rvwork hit,
- * vscode.open otherwise.
- */
-export function createFileQuickAccessProvider(deps: RecentProviderDeps = {}): QuickAccessProvider {
-  return {
-    getItems(filter: string): readonly QuickInputItem[] {
-      const treeState = deps.treeState ?? getService(TREE_STATE);
-      const recentFiles = deps.recentFiles ?? getService(RECENT_FILES_STORE);
-      const commands = deps.commands ?? Commands;
-      const needle = filter.trim().toLowerCase();
-      const seen = new Set<string>();
-      const rows: QuickInputItem[] = [];
-      const addFile = (path: string): void => {
-        if (seen.has(path)) {
-          return;
-        }
-        const name = baseName(path);
-        if (needle !== "" && !name.toLowerCase().includes(needle) && !path.toLowerCase().includes(needle)) {
-          return;
-        }
-        seen.add(path);
-        rows.push({
-          label: name,
-          labelHighlights: substringHighlights(name, needle),
-          description: path,
-          accept: () => {
-            const command = openCommandFor(path);
-            // The registry reports a failure (the toast); keep the detail.
-            void commands.execute(command, path).catch((error: unknown) => {
-              logCommandFailure(command, error);
-            });
-          },
-        });
-      };
-      for (const path of recentFiles.list) {
-        addFile(path);
-      }
-      for (const listing of treeState.cachedListings()) {
-        for (const entry of listing.entries) {
-          if (entry.kind === "file") {
-            addFile(entry.path);
-          }
-        }
-      }
-      return rows;
-    },
-  };
-}
diff --git a/crates/workshop/ui/src/parts/workspace/workshop-panel.css b/crates/workshop/ui/src/parts/workspace/workshop-panel.css
deleted file mode 100644
index bc4d377b3..000000000
--- a/crates/workshop/ui/src/parts/workspace/workshop-panel.css
+++ /dev/null
@@ -1,265 +0,0 @@
-/* Styles for workshop-panel.ts, which imports this file; esbuild bundles
-   it into dist/app.css. Covers the Workshop tree panel, as Cursor's file
-   list draws it. Themed values come from the :root tokens in
-   @workshop/look/tokens.css.
-
-   Rows are full-width buttons in text #F0F0F0BD: #F0F0F011 on hover, #F0F0F01E
-   with a 1px #F0F0F026 outline inside the row when focused. Each carries its
-   depth in --ws-tree-depth (the roots are 1). A row opens with its twistie
-   box, 8px per depth plus 16px plus 6px wide, which holds a folder's 16px
-   chevron (turned -90deg while the folder is collapsed) and sits empty on a
-   file, so every name starts at 34 + 8 x (depth - 1) px. An expanded list
-   draws one 1px indent guide at 20 + 8 x (k - 1) px, k being the depth of its
-   parent row: #F0F0F013 while the tree is hovered, #F0F0F030 for the list
-   holding the focused row. */
-
-/* The Workshop file tree panel: one directory per level, folders before
-   files. Rows are real buttons. Positioned so the Add Folder dialog overlay
-   can cover the panel. No padding and no reserved scrollbar gutter. */
-.ws-workshop-tree {
-  position: relative;
-  height: 100%;
-  overflow: auto;
-  padding: 0;
-  font-family: var(--font-prose);
-  font-size: var(--font-size-base);
-  color: var(--text-muted);
-}
-
-.ws-workshop-tree:hover {
-  --ws-tree-guide: var(--tree-indent-guide);
-}
-
-/* The section header, on #141414 with no bottom border: a 16px chevron, then
-   the title in #F0F0F05C. Its actions show while the header is hovered or has
-   focus inside; each is a 20px button with a 5px radius. */
-.ws-workshop-tree__header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  box-sizing: border-box;
-  block-size: var(--ws-control-height-compact);
-  padding-inline: var(--ws-size-4);
-  background-color: var(--cursor-chrome);
-}
-
-.ws-workshop-tree__section {
-  display: flex;
-  align-items: center;
-  flex: 1;
-  min-inline-size: 0;
-  block-size: 100%;
-  padding: 0;
-  border: none;
-  background: none;
-  font: inherit;
-  text-align: start;
-  cursor: pointer;
-}
-
-.ws-workshop-tree__section:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-workshop-tree__section-chevron {
-  display: inline-flex;
-  flex: none;
-  inline-size: var(--ws-size-16);
-  block-size: var(--ws-size-16);
-  color: var(--text-faint);
-}
-
-.ws-workshop-tree__section[aria-expanded="false"] .ws-workshop-tree__section-chevron {
-  transform: rotate(-90deg);
-}
-
-.ws-workshop-tree__section-title {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--font-size-sm);
-  font-weight: var(--font-weight-medium);
-  color: var(--text-faint);
-}
-
-.ws-workshop-tree__actions {
-  display: flex;
-  flex: none;
-  opacity: 0;
-}
-
-.ws-workshop-tree__header:hover .ws-workshop-tree__actions,
-.ws-workshop-tree__header:focus-within .ws-workshop-tree__actions {
-  opacity: 1;
-}
-
-.ws-workshop-tree__add {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  padding: 0;
-  inline-size: var(--ws-size-20);
-  block-size: var(--ws-size-20);
-  border: none;
-  border-radius: var(--ws-size-5);
-  background: none;
-  color: var(--text-muted);
-  cursor: pointer;
-}
-
-.ws-workshop-tree__add:hover {
-  background-color: var(--cursor-toolbar-hover);
-  color: var(--text);
-}
-
-.ws-workshop-tree__add:focus-visible {
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-  background-color: var(--cursor-toolbar-hover);
-  color: var(--text);
-}
-
-.ws-workshop-tree__list,
-.ws-workshop-tree__children {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-}
-
-/* One indent guide per expanded list, under its parent row's chevron. */
-.ws-workshop-tree__children {
-  position: relative;
-}
-
-.ws-workshop-tree__children::before {
-  content: "";
-  position: absolute;
-  inset-block: 0;
-  inset-inline-start: calc(var(--ws-size-20) + (var(--ws-tree-depth) - 1) * var(--ws-tree-indent));
-  inline-size: var(--ws-size-1);
-  background-color: var(--ws-tree-guide, transparent);
-  pointer-events: none;
-}
-
-/* The lit color goes on the focused list's own guide, not on a custom
-   property: a custom property inherits, so every expanded list nested inside
-   the focused one would draw it too, and only the list holding the focused
-   row is lit. */
-.ws-workshop-tree__children--focused::before {
-  background-color: var(--tree-indent-guide-active);
-}
-
-.ws-workshop-tree__row {
-  display: flex;
-  align-items: center;
-  box-sizing: border-box;
-  inline-size: 100%;
-  block-size: var(--ws-control-height-compact);
-  line-height: var(--ws-control-height-compact);
-  padding-block: 0;
-  padding-inline-start: var(--ws-size-4);
-  padding-inline-end: var(--space-2);
-  border: none;
-  background: none;
-  color: var(--text-muted);
-  font: inherit;
-  text-align: start;
-  cursor: pointer;
-}
-
-.ws-workshop-tree__row:hover {
-  background-color: var(--bg-hover);
-}
-
-.ws-workshop-tree__row:focus-visible {
-  background-color: var(--cursor-bg-focused);
-  outline: var(--focus-outline);
-  outline-offset: var(--focus-outline-offset);
-}
-
-.ws-workshop-tree__row:disabled {
-  opacity: 0.6;
-  cursor: default;
-}
-
-.ws-workshop-tree__twistie {
-  display: inline-flex;
-  align-items: center;
-  flex: none;
-  box-sizing: border-box;
-  inline-size: calc(var(--ws-tree-depth) * var(--ws-tree-indent) + var(--ws-size-16) + var(--ws-size-6));
-  padding-inline-start: calc(var(--ws-tree-depth) * var(--ws-tree-indent));
-}
-
-.ws-workshop-tree__twistie svg {
-  flex: none;
-}
-
-.ws-workshop-tree__row[aria-expanded="false"] .ws-workshop-tree__twistie svg {
-  transform: rotate(-90deg);
-}
-
-.ws-workshop-tree__name {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-/* A granted root deleted from disk: strikethrough plus the danger color
-   on the name, and the "missing" text label beside it - three signals,
-   never color alone. */
-.ws-workshop-tree__row--missing .ws-workshop-tree__name {
-  text-decoration: line-through;
-  color: var(--danger-text);
-}
-
-.ws-workshop-tree__missing {
-  flex: none;
-  margin-inline-start: var(--space-1-5);
-  font-size: var(--font-size-xs);
-  color: var(--danger-text);
-}
-
-/* The empty tree: Cursor's sentence over an Open Folder button. */
-.ws-workshop-tree__empty {
-  display: flex;
-  flex-direction: column;
-  align-items: flex-start;
-  gap: var(--space-3);
-  padding: var(--space-3) var(--space-4);
-  font-size: var(--font-size-base);
-  color: var(--text-muted);
-}
-
-.ws-workshop-tree__empty[hidden] {
-  display: none;
-}
-
-.ws-workshop-tree__empty-text {
-  margin: 0;
-  line-height: var(--line-height-base);
-}
-
-.ws-workshop-tree__error {
-  margin: var(--space-2);
-  list-style: none;
-  font-size: var(--font-size-sm);
-  color: var(--danger-text);
-}
-
-/* The pill a dragged file carries: #F0F0F01E, a 10px radius, 12px text. The
-   browser snapshots it during dragstart, so it waits out of sight. */
-.ws-workshop-tree__drag-pill {
-  position: fixed;
-  inset-block-start: calc(-1 * var(--ws-size-100));
-  inset-inline-start: 0;
-  padding: var(--ws-size-2) var(--ws-size-8);
-  border-radius: var(--ws-size-10);
-  background-color: var(--cursor-bg-active);
-  color: var(--text);
-  font-family: var(--font-prose);
-  font-size: var(--font-size-sm);
-  white-space: nowrap;
-  pointer-events: none;
-}
diff --git a/crates/workshop/ui/src/parts/workspace/workshop-panel.ts b/crates/workshop/ui/src/parts/workspace/workshop-panel.ts
deleted file mode 100644
index 55fe0f319..000000000
--- a/crates/workshop/ui/src/parts/workspace/workshop-panel.ts
+++ /dev/null
@@ -1,579 +0,0 @@
-// The Workshop file tree panel. Lists the granted workspace roots and
-// browses one directory at a time through GET /workspace/tree; activating
-// a file opens it in the editor zone through openInZone. Browsing is
-// paths only - the tree never reads file contents. Listings arrive
-// through the validated workspace-api boundary. Expansion state and
-// fetched listings live in the TreeStateService (resolved through the
-// service registry), so closing and reopening the Workshop panel restores
-// the tree as the user left it; the expansion also comes back from the
-// workspace file on relaunch, without listings, so a folder that renders
-// expanded with nothing cached fetches its listing then and there. The
-// roots themselves come from the service's shared roots() load, which
-// the window title reads too, so a boot or a workspace change fetches
-// them once. A wholesale replacement of the expanded set (a workspace
-// switch) fires the service's change event and the panel re-renders; on
-// that switch the roots were invalidated before this panel was
-// re-created, so its init's load is the new workspace's and the
-// workspace-changed event that follows says so rather than dropping it.
-// The panel also manages the grants themselves: a root row's context
-// menu revokes it, and a header "+" button (or the empty-space context
-// menu, or the empty tree's Open Folder button) adds a folder - through the
-// native folder picker in the desktop app, through a typed-path dialog in a
-// plain browser.
-//
-// The layout is Cursor's file list. A section header (a chevron, then the
-// title) collapses the rows and shows its actions - the "+" - on hover. Every
-// row is full width and carries its depth in `--ws-tree-depth`; the stylesheet
-// places the twistie box and the name from it, and draws one indent guide per
-// expanded list from the list's own `--ws-tree-depth` (its parent row's). The
-// list holding the focused row lights its guide. A file row dragged out
-// carries a small pill with its name.
-
-import type { GroupPanelPartInitParameters } from "dockview";
-
-import { toDisposable } from "@workshop/platform/lifecycle";
-import { WorkshopPart } from "@workshop/platform/workshop-part";
-import { DOCK, resolvePanelContent } from "@workshop/platform/panel-registry";
-import { getService } from "@workshop/platform/service-registry";
-import { ROOTS_KEY, TREE_STATE, type TreeStateService } from "../../services/tree-state-service";
-import { fetchTree, revokeRoot, type TreeEntry, type TreeListing } from "../../services/workspace-api";
-import { rootsCurrentIn, WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-import { addFolderToWorkspace } from "./add-folder";
-import { DropdownMenu } from "@workshop/look/dropdown";
-import { ICON_CHEVRON_DOWN, ICON_FOLDER_PLUS, ICON_TRASH_2 } from "@workshop/look/icons";
-import { openInZone, panelIdFor } from "../layout/zones";
-import "./workshop-panel.css";
-
-/** The status-bar surface the panel paints action outcomes onto. */
-export interface TreeStatusSink {
-  showLocal(label: string, severity: "info" | "error"): void;
-}
-
-/** The section header's title: the one section the tree has, every granted root. */
-const SECTION_TITLE = "Workspace";
-
-/** The empty tree's sentence, Cursor's. */
-const EMPTY_TEXT = "You have not yet added a folder to the workspace.";
-
-/** The class on the children list that holds the focused row, which lights its indent guide. */
-const FOCUSED_GUIDE_CLASS = "ws-workshop-tree__children--focused";
-
-export class WorkshopTreePanel extends WorkshopPart {
-  private readonly list = document.createElement("ul");
-  // The empty tree's text and Open Folder button, while no root is granted.
-  private emptyState: HTMLElement | null = null;
-  // The section header's toggle, and whether the section's rows show.
-  private sectionToggle: HTMLButtonElement | null = null;
-  private sectionExpanded = true;
-  // The children list whose indent guide is lit for the focused row.
-  private litGuide: Element | null = null;
-  // The panel's context menus, at most one open at a time.
-  private readonly dropdown = this._register(new DropdownMenu());
-  // The current menu's 0x0 fixed-position anchor under the cursor, so
-  // the dropdown can anchor a context menu at the pointer.
-  private pointerAnchor: HTMLElement | null = null;
-  // The open Add Folder dialog, dismissed with the panel.
-  private dialog: { dispose(): void } | null = null;
-  // A dropped folder grants a new root after this panel rendered; the
-  // change event re-renders the roots so the drop is visible immediately.
-  // The tree-state service has already dropped the roots listing by now:
-  // the composition root has it follow this event (followWorkspaceChanges)
-  // ahead of every reader, so the load this starts is the fresh one and
-  // joins any other reader's on the same event. An event whose detail says
-  // the roots are already current (Open Workspace from File invalidated
-  // them before re-creating this panel, whose init started the new load;
-  // Save As kept the grants) leaves the load and the listing alone, so the
-  // switch fetches the roots once.
-  private readonly onWorkspaceChanged = (event: Event): void => {
-    if (rootsCurrentIn(event)) {
-      return;
-    }
-    this.reload();
-  };
-
-  constructor(private readonly statusBar: TreeStatusSink | null = null) {
-    super();
-    this.element.className = "ws-workshop-tree";
-    // Focusable so Ctrl+Shift+F can land on the tree even while it is empty.
-    this.element.tabIndex = -1;
-    this.list.className = "ws-workshop-tree__list";
-  }
-
-  /** The session state: expansion and fetched listings survive a reopen. */
-  private get state(): TreeStateService {
-    return getService(TREE_STATE);
-  }
-
-  override init(parameters: GroupPanelPartInitParameters): void {
-    super.init(parameters);
-    window.addEventListener(WORKSPACE_CHANGED_EVENT, this.onWorkspaceChanged);
-    this._register(
-      toDisposable(() => window.removeEventListener(WORKSPACE_CHANGED_EVENT, this.onWorkspaceChanged)),
-    );
-    // A replaced expanded set (Open Workspace from File) re-renders from
-    // the cache; folders newly expanded with no listing fetch on render.
-    this._register(this.state.onDidChange(() => this.reload()));
-    void this.loadRoots().catch((error: unknown) => {
-      this.showRootsError(error);
-    });
-  }
-
-  protected create(parent: HTMLElement): void {
-    parent.appendChild(this.buildHeader());
-    parent.appendChild(this.list);
-    // The list holding the focused row lights its indent guide; focus leaving
-    // the tree puts it out. Focus moving row to row passes through both.
-    parent.addEventListener("focusin", (event) => {
-      const row = event.target instanceof Element ? event.target.closest(".ws-workshop-tree__row") : null;
-      this.lightGuide(row?.closest(".ws-workshop-tree__children") ?? null);
-    });
-    parent.addEventListener("focusout", () => {
-      this.lightGuide(null);
-    });
-    // Right-clicking the panel's empty space offers Add Folder; root rows
-    // stop propagation, and other rows fall through to the browser menu.
-    parent.addEventListener("contextmenu", (event) => {
-      const target = event.target;
-      if (target instanceof Element && target.closest(".ws-workshop-tree__row") !== null) {
-        return;
-      }
-      event.preventDefault();
-      this.dropdown.show(this.menuAnchor(event, this.element), [
-        {
-          label: "Add Folder to Workspace...",
-          iconHtml: ICON_FOLDER_PLUS,
-          onClick: () => {
-            this.addFolder();
-          },
-        },
-      ]);
-    });
-  }
-
-  override dispose(): void {
-    this.dialog?.dispose();
-    this.dialog = null;
-    this.pointerAnchor?.remove();
-    this.pointerAnchor = null;
-    super.dispose();
-  }
-
-  /**
-   * The section header: a toggle (a chevron, then the title) that collapses
-   * the rows, and the hover actions beside it - the "+" that starts the
-   * Add Folder flow.
-   */
-  private buildHeader(): HTMLElement {
-    const header = document.createElement("div");
-    header.className = "ws-workshop-tree__header";
-    const toggle = document.createElement("button");
-    toggle.type = "button";
-    toggle.className = "ws-workshop-tree__section";
-    toggle.setAttribute("aria-expanded", "true");
-    const chevron = document.createElement("span");
-    chevron.className = "ws-workshop-tree__section-chevron";
-    chevron.setAttribute("aria-hidden", "true");
-    chevron.innerHTML = ICON_CHEVRON_DOWN;
-    const title = document.createElement("span");
-    title.className = "ws-workshop-tree__section-title";
-    title.textContent = SECTION_TITLE;
-    toggle.append(chevron, title);
-    toggle.addEventListener("click", () => {
-      this.setSectionExpanded(!this.sectionExpanded);
-    });
-    this.sectionToggle = toggle;
-    const actions = document.createElement("div");
-    actions.className = "ws-workshop-tree__actions";
-    const add = document.createElement("button");
-    add.type = "button";
-    add.className = "ws-workshop-tree__add";
-    add.title = "Add Folder to Workspace...";
-    add.setAttribute("aria-label", "Add Folder to Workspace");
-    add.innerHTML = ICON_FOLDER_PLUS;
-    add.addEventListener("click", () => {
-      this.addFolder();
-    });
-    actions.appendChild(add);
-    header.append(toggle, actions);
-    return header;
-  }
-
-  /** Shows or hides the section's rows (and the empty tree's text); the header stays. */
-  private setSectionExpanded(expanded: boolean): void {
-    this.sectionExpanded = expanded;
-    this.sectionToggle?.setAttribute("aria-expanded", String(expanded));
-    this.list.hidden = !expanded;
-    if (this.emptyState !== null) {
-      this.emptyState.hidden = !expanded;
-    }
-  }
-
-  /** Lights one children list's indent guide, putting out the one lit before. */
-  private lightGuide(list: Element | null): void {
-    if (this.litGuide === list) {
-      return;
-    }
-    this.litGuide?.classList.remove(FOCUSED_GUIDE_CLASS);
-    list?.classList.add(FOCUSED_GUIDE_CLASS);
-    this.litGuide = list;
-  }
-
-  /** Clears the rendered roots (and the empty hint) and renders afresh. */
-  private reload(): void {
-    this.clearRoots();
-    void this.loadRoots().catch((error: unknown) => {
-      this.showRootsError(error);
-    });
-  }
-
-  /** Focuses the first tree row, or the tree itself while it is empty. */
-  focus(): void {
-    const row = this.element.querySelector<HTMLElement>(".ws-workshop-tree__row");
-    (row ?? this.element).focus();
-  }
-
-  /**
-   * Renders the granted roots from the service's shared load (cached,
-   * in flight, or started here). Two loads can overlap - a workspace
-   * change and a replaceExpanded a round-trip later, with the cache
-   * empty - and both settle on the same listing, so each paints the
-   * whole list afresh rather than appending: one copy of each root
-   * however many loads settle. A listing the service did not cache is
-   * stale (invalidateRoots ran while it was in flight) and is dropped;
-   * so is a failure that a later load has since superseded with a
-   * cached listing.
-   */
-  private async loadRoots(): Promise<void> {
-    let listing: TreeListing;
-    try {
-      listing = await this.state.roots();
-    } catch (error) {
-      if (this.state.listing(ROOTS_KEY) !== undefined) {
-        return;
-      }
-      throw error;
-    }
-    if (this.state.listing(ROOTS_KEY) !== listing) {
-      return;
-    }
-    this.clearRoots();
-    this.renderListing(this.list, listing, 1);
-    if (listing.entries.length === 0) {
-      this.emptyState = this.buildEmptyState();
-      this.emptyState.hidden = !this.sectionExpanded;
-      this.element.appendChild(this.emptyState);
-    }
-  }
-
-  /** The empty tree: Cursor's sentence and an Open Folder button that starts the Add Folder flow. */
-  private buildEmptyState(): HTMLElement {
-    const empty = document.createElement("div");
-    empty.className = "ws-workshop-tree__empty";
-    const text = document.createElement("p");
-    text.className = "ws-workshop-tree__empty-text";
-    text.textContent = EMPTY_TEXT;
-    const open = document.createElement("button");
-    open.type = "button";
-    open.className = "button button-primary ws-workshop-tree__open";
-    open.textContent = "Open Folder";
-    open.addEventListener("click", () => {
-      this.addFolder();
-    });
-    empty.append(text, open);
-    return empty;
-  }
-
-  /** Empties the roots list and removes the empty state. */
-  private clearRoots(): void {
-    this.list.textContent = "";
-    this.litGuide = null;
-    this.emptyState?.remove();
-    this.emptyState = null;
-  }
-
-  /**
-   * Paints a roots load failure as the list's only row: overlapping loads
-   * that failed together report once, not once per load.
-   */
-  private showRootsError(error: unknown): void {
-    this.clearRoots();
-    this.showError(this.list, error);
-  }
-
-  /**
-   * Appends one row per entry, `depth` levels down (the roots are depth 1);
-   * the server orders directories first.
-   */
-  private renderListing(list: HTMLUListElement, listing: TreeListing, depth: number): void {
-    for (const entry of listing.entries) {
-      list.appendChild(this.renderEntry(entry, depth));
-    }
-  }
-
-  /**
-   * One row: the twistie box (holding the folder's chevron, empty for a
-   * file so names line up), then the name. The depth rides on the row as
-   * `--ws-tree-depth`, which the stylesheet turns into the box's width.
-   */
-  private renderEntry(entry: TreeEntry, depth: number): HTMLLIElement {
-    const isRoot = depth === 1;
-    const item = document.createElement("li");
-    item.className = "ws-workshop-tree__item";
-    const row = document.createElement("button");
-    row.type = "button";
-    row.className = `ws-workshop-tree__row ws-workshop-tree__row--${entry.kind}`;
-    row.style.setProperty("--ws-tree-depth", String(depth));
-    row.title = entry.path;
-    const twistie = document.createElement("span");
-    twistie.className = "ws-workshop-tree__twistie";
-    twistie.setAttribute("aria-hidden", "true");
-    row.appendChild(twistie);
-    const name = document.createElement("span");
-    name.className = "ws-workshop-tree__name";
-    name.textContent = entry.name;
-    if (isRoot) {
-      row.addEventListener("contextmenu", (event) => {
-        event.preventDefault();
-        event.stopPropagation();
-        this.dropdown.show(this.menuAnchor(event, row), [
-          {
-            label: "Remove from Workspace",
-            iconHtml: ICON_TRASH_2,
-            danger: true,
-            onClick: () => {
-              void this.removeRoot(entry.path);
-            },
-          },
-        ]);
-      });
-    }
-    if (entry.kind === "directory") {
-      twistie.innerHTML = ICON_CHEVRON_DOWN;
-      row.appendChild(name);
-      if (isRoot && !entry.exists) {
-        // Not color alone: strikethrough (CSS), the danger color (CSS),
-        // and this text label together mark a root deleted from disk.
-        row.classList.add("ws-workshop-tree__row--missing");
-        const missing = document.createElement("span");
-        missing.className = "ws-workshop-tree__missing";
-        missing.textContent = "missing";
-        row.appendChild(missing);
-      }
-      const expanded = this.state.isExpanded(entry.path);
-      row.setAttribute("aria-expanded", String(expanded));
-      const children = document.createElement("ul");
-      children.className = "ws-workshop-tree__children";
-      // The list's own depth is its parent row's: its indent guide sits under that row's chevron.
-      children.style.setProperty("--ws-tree-depth", String(depth));
-      children.hidden = !expanded;
-      item.appendChild(row);
-      item.appendChild(children);
-      row.addEventListener("click", () => {
-        void this.toggle(entry, row, children, depth).catch((error: unknown) => {
-          // The children list is hidden while collapsed; reveal it so the
-          // error row is visible.
-          children.hidden = false;
-          this.showError(children, error);
-        });
-      });
-      // An interactively expanded directory always has a cached listing:
-      // expansion and caching happen together in toggle(). One restored
-      // from the workspace file (or replaced on a workspace switch) has
-      // none yet, so it fetches here and fills in when the listing lands.
-      if (expanded) {
-        const cached = this.state.listing(entry.path);
-        if (cached !== undefined) {
-          this.renderListing(children, cached, depth + 1);
-        } else {
-          void this.fillRestored(entry, row, children, depth).catch((error: unknown) => {
-            this.showError(children, error);
-          });
-        }
-      }
-    } else {
-      row.appendChild(name);
-      item.appendChild(row);
-      row.addEventListener("click", () => {
-        openInZone("editor", { path: entry.path });
-      });
-      // Files drag out of the tree: the Run window's drop zone accepts
-      // the workshop-path payload and loads the file as its prompt. The
-      // drag carries a pill with the file's name.
-      row.draggable = true;
-      row.addEventListener("dragstart", (event) => {
-        // A scripted event may carry no transfer at all.
-        const transfer: DataTransfer | null | undefined = event.dataTransfer;
-        if (!transfer) {
-          return;
-        }
-        transfer.setData("application/x-workshop-path", entry.path);
-        this.showDragPill(transfer, entry.name);
-      });
-    }
-    return item;
-  }
-
-  /**
-   * Gives a drag Cursor's pill: the browser snapshots the element during
-   * dragstart, so it lives in the page only until the next task. A transfer
-   * with no drag image to set (a scripted one) keeps the browser's default.
-   */
-  private showDragPill(transfer: DataTransfer, label: string): void {
-    if (typeof transfer.setDragImage !== "function") {
-      return;
-    }
-    const pill = document.createElement("div");
-    pill.className = "ws-workshop-tree__drag-pill";
-    pill.textContent = label;
-    document.body.appendChild(pill);
-    transfer.setDragImage(pill, 0, 0);
-    window.setTimeout(() => {
-      pill.remove();
-    }, 0);
-  }
-
-  /** Expands a collapsed directory or collapses an expanded one. */
-  private async toggle(
-    entry: TreeEntry,
-    row: HTMLButtonElement,
-    children: HTMLUListElement,
-    depth: number,
-  ): Promise<void> {
-    if (this.state.isExpanded(entry.path)) {
-      this.state.collapse(entry.path);
-      children.hidden = true;
-      row.setAttribute("aria-expanded", "false");
-      return;
-    }
-    let listing = this.state.listing(entry.path);
-    let fresh = false;
-    if (listing === undefined) {
-      row.disabled = true;
-      try {
-        listing = await fetchTree(entry.path);
-        fresh = true;
-      } finally {
-        row.disabled = false;
-      }
-      this.state.cacheListing(entry.path, listing);
-    }
-    // A fresh fetch follows a failed attempt whose error row is still in
-    // the list; clear before rendering. A cached listing re-renders only
-    // into an empty list (collapse keeps the rows, just hidden).
-    if (fresh || children.childElementCount === 0) {
-      children.textContent = "";
-      this.renderListing(children, listing, depth + 1);
-    }
-    this.state.expand(entry.path);
-    children.hidden = false;
-    row.setAttribute("aria-expanded", "true");
-  }
-
-  /**
-   * Fetches and renders the listing of a directory that renders expanded
-   * with nothing cached (a restored expansion). The row is disabled
-   * while the fetch is in flight, as toggle() does, so a click cannot
-   * race it into a second fetch; the children list is already visible.
-   */
-  private async fillRestored(
-    entry: TreeEntry,
-    row: HTMLButtonElement,
-    children: HTMLUListElement,
-    depth: number,
-  ): Promise<void> {
-    row.disabled = true;
-    let listing: TreeListing;
-    try {
-      listing = await fetchTree(entry.path);
-    } finally {
-      row.disabled = false;
-    }
-    this.state.cacheListing(entry.path, listing);
-    // The user may have collapsed the folder, or a reload may have
-    // replaced the rows, while the fetch was in flight; render only into
-    // a still-attached, still-expanded, still-empty list.
-    if (!row.isConnected || !this.state.isExpanded(entry.path) || children.childElementCount !== 0) {
-      return;
-    }
-    this.renderListing(children, listing, depth + 1);
-  }
-
-  /** Paints a load failure as a row in the affected list. */
-  private showError(list: HTMLUListElement, error: unknown): void {
-    const message = error instanceof Error ? error.message : String(error);
-    const row = document.createElement("li");
-    row.className = "ws-workshop-tree__error";
-    row.setAttribute("role", "alert");
-    row.textContent = message;
-    list.appendChild(row);
-  }
-
-  /**
-   * The dropdown anchor for a context menu: the pointer position for a
-   * mouse invocation, the row (or panel) itself for a keyboard one,
-   * whose contextmenu event reports zero coordinates.
-   */
-  private menuAnchor(event: MouseEvent, fallback: HTMLElement): HTMLElement {
-    if (event.clientX === 0 && event.clientY === 0) {
-      return fallback;
-    }
-    // A fresh anchor per menu: reusing one element would make the
-    // dropdown read the next right-click as a same-trigger toggle and
-    // close the menu it should be opening.
-    this.pointerAnchor?.remove();
-    const anchor = document.createElement("span");
-    anchor.style.cssText =
-      `position: fixed; width: 0; height: 0; pointer-events: none; ` +
-      `left: ${event.clientX}px; top: ${event.clientY}px;`;
-    document.body.appendChild(anchor);
-    this.pointerAnchor = anchor;
-    return anchor;
-  }
-
-  /**
-   * Starts the Add Folder flow: the native picker in the desktop app, a
-   * typed-path dialog in a plain browser. The flow lives in the
-   * workspace feature's add-folder module, shared with the File menu's
-   * Open Folder and Add Folder to Workspace rows; the panel owns the
-   * dialog's dismissal with its own lifetime.
-   */
-  private addFolder(): void {
-    this.dialog?.dispose();
-    this.dialog = addFolderToWorkspace(this.element, this.statusBar);
-  }
-
-  /** Revokes one granted root and announces the outcome. */
-  private async removeRoot(path: string): Promise<void> {
-    try {
-      await revokeRoot(path);
-    } catch (error) {
-      this.statusBar?.showLocal(`Could not remove ${path}: ${(error as Error).message}`, "error");
-      return;
-    }
-    this.statusBar?.showLocal(`Removed ${path} from the Workshop`, "info");
-    window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  }
-}
-
-/** Ctrl+B: toggle the Workshop tree panel; answers the new visibility. */
-export function toggleWorkshopPanel(): boolean {
-  const dock = getService(DOCK);
-  const existing = dock.getPanel(panelIdFor("tree", {}));
-  if (existing) {
-    dock.removePanel(existing);
-    return false;
-  }
-  openInZone("tree", {});
-  return true;
-}
-
-/** Ctrl+Shift+F: open or activate the Workshop tree and focus it. */
-export function focusWorkshopTree(): void {
-  const panel = openInZone("tree", {});
-  // view.content may be the lazy wrapper while the chunk loads; unwrap
-  // to the real panel before the instanceof check.
-  const content = resolvePanelContent(panel.view.content);
-  if (content instanceof WorkshopTreePanel) {
-    content.focus();
-  }
-}
diff --git a/crates/workshop/ui/src/parts/workspace/workspace-drops.ts b/crates/workshop/ui/src/parts/workspace/workspace-drops.ts
deleted file mode 100644
index e835c140e..000000000
--- a/crates/workshop/ui/src/parts/workspace/workspace-drops.ts
+++ /dev/null
@@ -1,212 +0,0 @@
-// Native file drops in the desktop app. The page cannot read real OS
-// paths from an HTML5 drop (Chromium hides them), so on Windows the page
-// posts the DOM File objects over the WebView2 web-message channel
-// (postMessageWithAdditionalObjects) and the app reads each file's real
-// path; off Windows the app's own drag-drop event supplies the paths.
-// Both paths answer with a `runvil:file-drop` event, which this
-// module validates and grants through the workspace HTTP API. Desktop
-// mode never reads file bytes merely because a file was dragged onto the
-// window. In a plain browser neither the bridge nor the event exists and
-// normal HTML drag/drop of file contents keeps working untouched.
-//
-// The desktop app never touches the OS drop itself (WebView2's own drop target
-// is what keeps HTML5 drag-and-drop alive for Dockview), so the page must
-// suppress the browser's default file-drop action - navigating away to
-// the dropped file - itself. Only drags of OS files are suppressed;
-// in-page drags (Dockview tabs) are untouched.
-
-import { err, ok } from "@workshop/platform/result";
-
-import { DisposableStore, toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import { CatalogError, ErrorCatalog, errorText, type Result } from "../../services/error-catalog";
-import type { StatusBar } from "@workshop/platform/status-bar";
-import { WORKSPACE_CHANGED_EVENT } from "../../services/workspace-events";
-
-/** The native event the app dispatches when files land on the window. */
-const FILE_DROP_EVENT = "runvil:file-drop";
-
-/**
- * Fired on a drop target element (one marked data-ws-file-drop) after
- * the dropped paths have been granted, so the owning panel can load
- * them. Dispatched only when the HTML5 drop landed on the target; a
- * drop anywhere else grants without dispatching, as before.
- */
-export const WORKSPACE_FILE_DROP_EVENT = "workshop:file-drop";
-
-/** The web message the app's file-drop bridge listens for. */
-const DROP_MESSAGE = "workspace-drop";
-
-/** The WebView2 script bridge, present only in the Windows desktop app. */
-interface WebView2Bridge {
-  readonly postMessageWithAdditionalObjects?: (message: string, objects: readonly File[]) => void;
-}
-
-/**
- * Posts a drop's File objects to the app, which reads their real OS
- * paths (something the page itself is never allowed to see) and answers
- * with the `runvil:file-drop` event. Where the bridge does not exist
- * (a plain browser, or the non-Windows platforms whose drops arrive as
- * the app's own drag-drop event) the drop ends here.
- */
-function postDroppedFiles(event: DragEvent): void {
-  const files = event.dataTransfer?.files;
-  if (files === undefined || files.length === 0) {
-    return;
-  }
-  const bridge = (window as { chrome?: { webview?: WebView2Bridge } }).chrome?.webview;
-  bridge?.postMessageWithAdditionalObjects?.(DROP_MESSAGE, Array.from(files));
-}
-
-/**
- * Reads the dropped paths out of the native event. The detail arrives as
- * `unknown` and is validated field by field; anything that is not an
- * object with a `paths` array of plain strings is rejected.
- */
-function readDroppedPaths(event: Event): readonly string[] | null {
-  if (!(event instanceof CustomEvent)) {
-    return null;
-  }
-  const detail: unknown = event.detail;
-  if (typeof detail !== "object" || detail === null || !("paths" in detail)) {
-    return null;
-  }
-  const { paths } = detail;
-  if (!Array.isArray(paths) || !paths.every((path) => typeof path === "string")) {
-    return null;
-  }
-  return paths;
-}
-
-/** Extracts the server's error message from a failed grant response. */
-function grantErrorMessage(body: unknown, status: number): string {
-  if (typeof body === "object" && body !== null && "error" in body) {
-    const { error } = body;
-    if (
-      typeof error === "object" &&
-      error !== null &&
-      "message" in error &&
-      typeof error.message === "string"
-    ) {
-      return error.message;
-    }
-  }
-  return `POST /workspace/grant answered ${status}`;
-}
-
-/**
- * Grants one path through the workspace API. Shared with the Workshop
- * tree's Add Folder flow, which grants picked and typed paths the same
- * way a drop does. Never throws: the outcome is a typed Result, with
- * transport failures and refusals distinguished by their catalog code.
- */
-export async function grantPath(path: string): Promise<Result<void>> {
-  let response: Response;
-  try {
-    response = await fetch("/workspace/grant", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path }),
-    });
-  } catch (error) {
-    return err(
-      new CatalogError(ErrorCatalog.Transport, `POST /workspace/grant: ${errorText(error)}`, {
-        cause: error,
-      }),
-    );
-  }
-  const body: unknown = await response.json();
-  if (!response.ok) {
-    return err(
-      new CatalogError(ErrorCatalog.GrantRefused, grantErrorMessage(body, response.status), {
-        status: response.status,
-      }),
-    );
-  }
-  return ok(undefined);
-}
-
-/**
- * Grants every dropped path in order. Per-path failures paint the status
- * bar and do not stop the remaining grants. Successful grants confirm on
- * the status bar and announce the change so the Workshop tree refreshes -
- * without this the drop works but nothing visible happens.
- */
-async function grantDroppedPaths(
-  paths: readonly string[],
-  statusBar: StatusBar,
-): Promise<void> {
-  let granted = 0;
-  for (const path of paths) {
-    const result = await grantPath(path);
-    if (result.ok) {
-      granted += 1;
-      statusBar.showLocal(`Added ${path} to the Workshop`, "info");
-    } else {
-      statusBar.showLocal(`Could not open ${path}: ${result.error.message}`, "error");
-    }
-  }
-  if (granted > 0) {
-    window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  }
-}
-
-/** True when a drag holds OS files rather than an in-page payload. */
-function isFileDrag(event: DragEvent): boolean {
-  const types = event.dataTransfer?.types;
-  return types !== undefined && Array.from(types).includes("Files");
-}
-
-/**
- * Listens for the app's native drop event and grants each dropped path
- * through the workspace API. Active only in the desktop app; in a plain
- * browser there is no native drop source and the grant listener is never
- * installed. The file-drag default suppression is installed everywhere:
- * dropping a file must never navigate the page away, desktop or browser.
- * Returns the disposable owning every window listener wired here.
- */
-export function setupWorkspaceDrops(statusBar: StatusBar): IDisposable {
-  const store = new DisposableStore();
-  const onDragOver = (event: DragEvent): void => {
-    if (isFileDrag(event)) event.preventDefault();
-  };
-  window.addEventListener("dragover", onDragOver);
-  store.add(toDisposable(() => window.removeEventListener("dragover", onDragOver)));
-  // The element under an OS drop, when it is (or is inside) a marked
-  // drop target; the matching runvil:file-drop answers with the
-  // paths, and the target gets them after the grants complete.
-  let pendingDropTarget: Element | null = null;
-  const onDrop = (event: DragEvent): void => {
-    if (isFileDrag(event)) {
-      event.preventDefault();
-      const target = event.target;
-      pendingDropTarget =
-        target instanceof Element ? target.closest("[data-ws-file-drop]") : null;
-      postDroppedFiles(event);
-    }
-  };
-  window.addEventListener("drop", onDrop);
-  store.add(toDisposable(() => window.removeEventListener("drop", onDrop)));
-  if (window.__TAURI_INTERNALS__ === undefined) {
-    return store;
-  }
-  const onFileDrop = (event: Event): void => {
-    const paths = readDroppedPaths(event);
-    if (paths === null || paths.length === 0) {
-      return;
-    }
-    const target = pendingDropTarget;
-    pendingDropTarget = null;
-    void grantDroppedPaths(paths, statusBar)
-      .then(() => {
-        target?.dispatchEvent(
-          new CustomEvent(WORKSPACE_FILE_DROP_EVENT, { detail: { paths } }),
-        );
-      })
-      .catch((error: unknown) => {
-        statusBar.showLocal(`Could not open the dropped files: ${(error as Error).message}`, "error");
-      });
-  };
-  window.addEventListener(FILE_DROP_EVENT, onFileDrop);
-  store.add(toDisposable(() => window.removeEventListener(FILE_DROP_EVENT, onFileDrop)));
-  return store;
-}
diff --git a/crates/workshop/ui/src/parts/workspace/workspace.contribution.ts b/crates/workshop/ui/src/parts/workspace/workspace.contribution.ts
deleted file mode 100644
index 8b7bbc4ec..000000000
--- a/crates/workshop/ui/src/parts/workspace/workspace.contribution.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-// The workspace contribution: the eager module registering the File
-// menu's picker and file-action rows, the Workshop tree's Explorer and
-// Primary Side Bar rows, and the Open Recent and quick-open file
-// providers at module scope, before any service exists. Every file
-// action's run body lazy-imports file-actions, so this file pulls no
-// CodeMirror into the initial bundle; the type-only import below is
-// erased at compile time. The tree rows call workshop-panel directly,
-// which imports dockview as a type only.
-//
-// Explorer shows and focuses the Workshop tree. Primary Side Bar toggles
-// the tree panel and mirrors the outcome into the sideBarVisible context
-// key, which binds with a visible-by-default value on first toggle; this
-// directory's register() binds it at chunk load so the Appearance
-// checkbox reads true from first paint.
-//
-// Placements follow the catalog: ctrl-based chords bind ctrlcmd so
-// macOS gets Cmd, Open File and Save As are desktop-only (precondition
-// !isWeb), Save As and Revert File need an active editor, and Open
-// Folder / Add Folder to Workspace share the tree's Add Folder flow.
-// vscode.open and vscode.openFolder are the provider-backed commands:
-// the Open Recent dynamic rows and the "" quick-access rows set their
-// own titles and pass the path as args[0], which the run bodies narrow
-// to string, never cast. Neither is f1 - a palette row cannot supply a
-// path argument, and Go to File... already owns that surface.
-//
-// The tree's panel type registers here too: the Workshop tree anchors
-// the left zone and its tab has no close button.
-
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { registerAction, type ActionDescriptor } from "@workshop/platform/action-registry";
-import { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-import type { ParseError } from "@workshop/platform/context-key-expr";
-import type { Result } from "../../services/error-catalog";
-import { KeybindingWeight } from "@workshop/platform/keybinding-registry";
-import { MenuId, Menus } from "@workshop/platform/menu-registry";
-import { registerPanelType } from "@workshop/platform/panel-registry";
-import { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-import { RECENT_FILES_STORE } from "../../services/recent-files-store";
-import { getService } from "@workshop/platform/service-registry";
-import { QUICK_INPUT_SERVICE } from "../../services/quick-input-service";
-import { createFileQuickAccessProvider, createRecentMenuProvider } from "./open-recent";
-import { focusWorkshopTree, toggleWorkshopPanel } from "./workshop-panel";
-
-registerPanelType({
-  type: "tree",
-  title: "Workshop",
-  defaultZone: "left",
-  closable: false,
-  load: () => import("./index"),
-});
-
-/** The file-actions module as a type only; the runtime import stays lazy. */
-type FileActions = typeof import("./file-actions");
-
-/** The Appearance flyout's id; the menubar contribution declares the submenu. */
-const APPEARANCE_MENU: MenuId = "menubar/view/appearance";
-
-/** Registers one action, reporting a malformed descriptor instead of throwing. */
-function addAction(action: ActionDescriptor): void {
-  const result: Result<IDisposable, ParseError> = registerAction(action);
-  if (!result.ok) {
-    console.error(`files action '${action.id}': ${result.error.message}`);
-  }
-}
-
-/** Builds a run body that loads the file-actions module on demand. */
-function runFileAction(pick: (actions: FileActions) => () => void | Promise<void>): () => Promise<void> {
-  return () => import("./file-actions").then((actions) => pick(actions)());
-}
-
-/**
- * Builds a run body that narrows args[0] to a path string - never a
- * cast - and loads the file-actions module on demand. A missing or
- * non-string argument is a no-op.
- */
-function runPathAction(
-  pick: (actions: FileActions) => (path: string) => void | Promise<void>,
-): (...args: readonly unknown[]) => Promise<void> {
-  return (...args) => {
-    const path = args[0];
-    if (typeof path !== "string") {
-      return Promise.resolve();
-    }
-    return import("./file-actions").then((actions) => pick(actions)(path));
-  };
-}
-
-addAction({
-  id: "workbench.action.files.openFile",
-  title: "Open File...",
-  f1: true,
-  precondition: "!isWeb",
-  keybinding: { keybinding: "ctrlcmd+o", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "2_open", order: 1 }],
-  run: runFileAction((actions) => actions.openFile),
-});
-
-addAction({
-  id: "workbench.action.files.openFolder",
-  title: "Open Folder...",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+m ctrlcmd+o", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "2_open", order: 2 }],
-  run: runFileAction((actions) => actions.openFolder),
-});
-
-addAction({
-  id: "workbench.action.addRootFolder",
-  title: "Add Folder to Workspace...",
-  f1: true,
-  menu: [{ id: MenuId.MenubarFileMenu, group: "3_workspace", order: 1 }],
-  run: runFileAction((actions) => actions.addRootFolder),
-});
-
-addAction({
-  id: "workbench.action.files.saveAs",
-  title: "Save As...",
-  f1: true,
-  precondition: "!isWeb && activeEditor == 'editor'",
-  keybinding: { keybinding: "ctrlcmd+shift+s", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "4_save", order: 2 }],
-  run: runFileAction((actions) => actions.saveActiveEditorAs),
-});
-
-addAction({
-  id: "workbench.action.files.saveAll",
-  title: "Save All",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+m s", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarFileMenu, group: "4_save", order: 3 }],
-  run: runFileAction((actions) => actions.saveAllEditors),
-});
-
-addAction({
-  id: "workbench.action.files.revert",
-  title: "Revert File",
-  f1: true,
-  precondition: "activeEditor == 'editor'",
-  menu: [{ id: MenuId.MenubarFileMenu, group: "6_close", order: 1 }],
-  run: runFileAction((actions) => actions.revertActiveEditor),
-});
-
-// Open Recent: the two path commands its dynamic rows and the ""
-// quick-access rows dispatch, then its More... and Clear rows.
-addAction({
-  id: "vscode.open",
-  title: "Open File",
-  run: runPathAction((actions) => actions.openPath),
-});
-
-addAction({
-  id: "vscode.openFolder",
-  title: "Open Folder",
-  run: runPathAction((actions) => actions.focusWorkspaceRoot),
-});
-
-addAction({
-  id: "workbench.action.openRecent",
-  title: "More...",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+r", weight: KeybindingWeight.WorkbenchContrib },
-  menu: [{ id: MenuId.MenubarRecentMenu, group: "y_more" }],
-  run: () => {
-    getService(QUICK_INPUT_SERVICE).quickAccess.show("");
-  },
-});
-
-addAction({
-  id: "workbench.action.clearRecentFiles",
-  title: "Clear Recently Opened...",
-  f1: true,
-  menu: [{ id: MenuId.MenubarRecentMenu, group: "z_clear" }],
-  run: () => {
-    getService(RECENT_FILES_STORE).clear();
-  },
-});
-
-addAction({
-  id: "workbench.view.explorer",
-  title: "Explorer",
-  f1: true,
-  keybinding: { keybinding: "ctrlcmd+shift+e" },
-  menu: [{ id: MenuId.MenubarViewMenu, group: "3_views", order: 1 }],
-  run: focusWorkshopTree,
-});
-
-addAction({
-  id: "workbench.action.toggleSidebarVisibility",
-  title: "Primary Side Bar",
-  f1: true,
-  toggled: "sideBarVisible",
-  keybinding: { keybinding: "ctrlcmd+b" },
-  menu: [{ id: APPEARANCE_MENU, group: "2_workbench_layout", order: 2 }],
-  run: () => {
-    getService(CONTEXT_KEY_SERVICE).createKey("sideBarVisible", true).set(toggleWorkshopPanel());
-  },
-});
-
-// The dynamic halves: Open Recent's root and recent-file rows, re-read
-// at every open, and the "" quick-access provider over the same stores.
-Menus.setProvider(MenuId.MenubarRecentMenu, createRecentMenuProvider());
-// Cursor's own text for the default mode, which opens first in the command
-// center's modes list and names the Go to File command for its keybinding.
-QuickAccessRegistry.registerQuickAccessProvider({
-  prefix: "",
-  placeholder: "Search files, content, and symbols (append : to go to line or @ to go to symbol)",
-  helpEntries: [{ description: "Go to File", commandId: "workbench.action.quickOpen", commandCenterOrder: 10 }],
-  factory: () => createFileQuickAccessProvider(),
-});
diff --git a/crates/workshop/ui/src/services/agent-session.ts b/crates/workshop/ui/src/services/agent-session.ts
deleted file mode 100644
index 64ad16798..000000000
--- a/crates/workshop/ui/src/services/agent-session.ts
+++ /dev/null
@@ -1,828 +0,0 @@
-// The agent-session view model: DOM-free state over one /agents/ws
-// socket. The service subscribes to the socket's frame events and keeps
-// what the views render: the discovered agent list, the acknowledged
-// session, and the transcript. The transcript is
-// derived from the durable event stream plus the ephemeral deltas:
-// deltas coalesce into pending items keyed by the reply id stamped on
-// every chunk, and the durable event stamped with that id replaces them (the
-// ACP chunk-vs-upsert rule the wire layer documents). A round that never
-// gets that event, one the operator's message withdrew or a stop cut
-// short, loses its pending items at that message or once a later round
-// settles. Views subscribe to the change events and read the snapshots;
-// nothing here touches the DOM.
-//
-// Beyond the items, the service keeps the turn's liveness: `generating`
-// (the agent is working, so the composer offers stop over an empty box and
-// the transcript shows a tail status), `started` (the session's run has
-// reported and not ended, so it takes the operator's messages),
-// `reconnecting` (the socket dropped and the reattach has not been
-// acknowledged), and the reasoning clock that times each thought. The
-// agent waiting on its inbox ends the working state and the operator's
-// message starts it again, both read from the durable log, so a replayed
-// log ends in the right state; the run's end (`run_ended`) turns off both
-// the working state and `started`. After a sent cancel, a frame from a
-// round newer than any seen before it means the agent went on with a
-// message already queued, so the working state comes back. The wait, the
-// run's end, and that newer round also end the latest tool-call batch,
-// since a stop can leave a call without a result for good. The clock is
-// injectable so tests stamp exact durations.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import type {
-  AgentDeltaFrame,
-  AgentEventFrame,
-  AgentSessionFrame,
-} from "./protocol";
-
-/**
- * The slice of the agent socket this service consumes; `AgentSocket`
- * satisfies it structurally, and tests hand in a scripted fake. The
- * service never owns the wire: connect, reconnect, and disposal belong
- * to the caller that constructed the socket.
- */
-export interface AgentSessionWire {
-  readonly onAgents: Event<string[]>;
-  readonly onSession: Event<AgentSessionFrame>;
-  readonly onEvent: Event<AgentEventFrame>;
-  readonly onDelta: Event<AgentDeltaFrame>;
-  readonly onError: Event<string>;
-  /** Fires when the socket drops; the socket reconnects on its own. */
-  readonly onDisconnect: Event<void>;
-  launch(agent: string): boolean;
-  /** Sends the operator's message; false when the socket is down. */
-  respond(text: string): boolean;
-  /** Fires the turn-cancel; false when the socket is down and nothing was sent. */
-  cancelTurn(): boolean;
-}
-
-/** One call of a tool-call batch: its id, name, rendered arguments, bound tool, and vendor. */
-export interface ToolCallRow {
-  readonly id: string;
-  readonly name: string;
-  /** The call arguments as compact JSON, or "" when the call had none. */
-  readonly args: string;
-  /**
-   * The tool id the call resolved to, as the wire's one slash-separated
-   * string (`web/search`, or `adhoc/grab` for an adhoc tool), or null
-   * for an entry the wire did not stamp. Views render a null tool as a
-   * generic tool.
-   */
-  readonly tool: string | null;
-  /**
-   * The vendor of the Pack that answers `tool` (`runvil`), or null for an
-   * adhoc tool or an entry the wire did not stamp. `vendor/tool` is the
-   * vendor-qualified name (`runvil/web/search`), and a call without a
-   * vendor is never special.
-   */
-  readonly vendor: string | null;
-}
-
-/** Text the operator sent, as the durable `user_message` event recorded it. */
-export interface UserItem {
-  readonly kind: "user";
-  readonly text: string;
-}
-
-/**
- * An assistant reply: pending while it is coalesced deltas, settled once
- * the durable `agent_message` event replaces them.
- */
-export interface ReplyItem {
-  readonly kind: "reply";
-  readonly text: string;
-  /** The producing model, when the event named the attribution. */
-  readonly model: string | null;
-  /** True while the item is coalesced deltas awaiting the durable event. */
-  readonly pending: boolean;
-  /** The reply id coalescing this item's deltas away, if one is known. */
-  readonly reply: number | null;
-}
-
-/**
- * A model reasoning block, streamed and settled exactly as a reply is.
- * `startedAt` and `endedAt` are readings of the service's clock: the
- * round's first reasoning delta, and the moment the thinking stopped.
- * Both are null for a thought the service never watched stream (a replay
- * after a reattach), whose duration is therefore unknown.
- */
-export interface ReasoningItem {
-  readonly kind: "reasoning";
-  readonly text: string;
-  readonly model: string | null;
-  readonly pending: boolean;
-  readonly reply: number | null;
-  readonly startedAt: number | null;
-  readonly endedAt: number | null;
-}
-
-/** A batch of tool calls the model requested, one row per call. */
-export interface ToolCallItem {
-  readonly kind: "tool-call";
-  readonly calls: readonly ToolCallRow[];
-  /** The raw batch content: the fallback when the JSON did not parse. */
-  readonly text: string;
-  readonly model: string | null;
-  /**
-   * False as the batch lands, and true once its work is over: the agent
-   * waited on its inbox, its run ended, or a round newer than a sent
-   * cancel began. The service sets it by replacing the latest batch's
-   * item. An ended batch is not the open batch, so its calls without a
-   * result stop loading.
-   */
-  readonly ended: boolean;
-}
-
-/** The result of one dispatched tool call. */
-export interface ToolResultItem {
-  readonly kind: "tool-result";
-  /** The provider-issued call id, scoped by turn (providers recycle ids). */
-  readonly toolCallId: string | null;
-  readonly text: string;
-}
-
-/** A server error frame, or a local send failure the server cannot report. */
-export interface ErrorItem {
-  readonly kind: "error";
-  readonly message: string;
-  /**
-   * The popup title a local failure carries ("Connection failed"), or
-   * null for a server error, which the popup titles "Connection Error".
-   */
-  readonly title: string | null;
-}
-
-/** One renderable entry of the session transcript, in display order. */
-export type TranscriptItem =
-  | UserItem
-  | ReplyItem
-  | ReasoningItem
-  | ToolCallItem
-  | ToolResultItem
-  | ErrorItem;
-
-/** The two delta channels a round streams, as transcript item kinds. */
-type StreamKind = "reply" | "reasoning";
-
-/** The title and message of the local failure a send on a down socket folds. */
-const CONNECTION_FAILED_TITLE = "Connection failed";
-const CONNECTION_FAILED_MESSAGE =
-  "The connection was lost. Please check your network connection and try again.";
-
-/**
- * Parses a `tool_call` event's content - the JSON array of the batch's
- * calls - into display rows. Anything but a well-formed array degrades to
- * an empty row list so the view falls back to the raw text: the content
- * is model-era data crossing a trust boundary, and a batch the server
- * failed to serialize must still render rather than vanish.
- */
-function parseToolCalls(content: string): readonly ToolCallRow[] {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return [];
-  }
-  if (!Array.isArray(parsed)) {
-    return [];
-  }
-  const rows: ToolCallRow[] = [];
-  for (const entry of parsed) {
-    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-      continue;
-    }
-    const record = entry as Record<string, unknown>;
-    rows.push({
-      id: typeof record.id === "string" ? record.id : "",
-      name: typeof record.name === "string" ? record.name : "",
-      args: "arguments" in record ? JSON.stringify(record.arguments) : "",
-      // A tool id or vendor is never empty, so an empty string is as
-      // malformed as a number: both read as absent.
-      tool: typeof record.tool === "string" && record.tool !== "" ? record.tool : null,
-      vendor: typeof record.vendor === "string" && record.vendor !== "" ? record.vendor : null,
-    });
-  }
-  return rows;
-}
-
-/**
- * The state behind one agent session surface. Reads arrive as socket
- * events; the service folds them into snapshots and fires the matching
- * change event after every fold, so a view repaints from `agents`,
- * `session`, `items`, `started`, `generating`, and `reconnecting` alone.
- */
-export class AgentSessionService extends Disposable {
-  private agentList: readonly string[] = [];
-  private acknowledged: AgentSessionFrame | null = null;
-  private transcript: TranscriptItem[] = [];
-  /**
-   * The highest reply id settled: by its durable `agent_message` or
-   * `tool_call` event, or by the operator's message, which withdraws the
-   * round that streams as it lands. Deltas at or below it are late chunks
-   * (the cancel grace window's among them); folding them in would open a
-   * pending item nothing will ever supersede.
-   */
-  private settled = -1;
-  /**
-   * True from a sent cancel until the turn's work restarts or ends (a
-   * message, a frame from a round newer than `stopRound`, the agent
-   * waiting on its inbox, the run's end, or a session acknowledgment). A
-   * reasoning chunk that arrives in that window is a late straggler from
-   * the cancel grace period; it opens already ended, so the thought never
-   * reads as streaming under an idle composer.
-   */
-  private stopped = false;
-  /** The newest round a delta or a model-round event has named. */
-  private newest = -1;
-  /** `newest` when the last cancel was sent. */
-  private stopRound = -1;
-  /**
-   * True from a sent cancel until the latest batch ends. The stop drops a
-   * running call, which then never gets a result, so the first frame from
-   * a round newer than `stopRound` ends the batch, even after a message
-   * cleared `stopped`.
-   */
-  private batchStopped = false;
-  private begun = false;
-  private working = false;
-  /**
-   * The working state the durable log alone leaves: what a same-session
-   * reattach returns to while a sent message has no echo yet.
-   */
-  private logWorking = false;
-  /**
-   * True from a sent message until a `user_message` echoes it. A socket
-   * drop in between may have lost the message, so only the log can say
-   * whether the agent works on it.
-   */
-  private unechoed = false;
-  private dropped = false;
-
-  private readonly _onDidChangeAgents = this._register(new Emitter<readonly string[]>());
-  /** Fires with every pushed agent list - a complete snapshot per connect. */
-  readonly onDidChangeAgents: Event<readonly string[]> = this._onDidChangeAgents.event;
-
-  private readonly _onDidChangeSession = this._register(new Emitter<AgentSessionFrame>());
-  /** Fires on every session acknowledgment, launch and reattach alike. */
-  readonly onDidChangeSession: Event<AgentSessionFrame> = this._onDidChangeSession.event;
-
-  private readonly _onDidChangeTranscript = this._register(new Emitter<void>());
-  /** Fires after every transcript fold; read `items` for the snapshot. */
-  readonly onDidChangeTranscript: Event<void> = this._onDidChangeTranscript.event;
-
-  private readonly _onDidChangeStarted = this._register(new Emitter<boolean>());
-  /** Fires with the new value whenever `started` really changes. */
-  readonly onDidChangeStarted: Event<boolean> = this._onDidChangeStarted.event;
-
-  private readonly _onDidChangeGenerating = this._register(new Emitter<boolean>());
-  /** Fires with the new value whenever `generating` really changes. */
-  readonly onDidChangeGenerating: Event<boolean> = this._onDidChangeGenerating.event;
-
-  private readonly _onDidChangeReconnecting = this._register(new Emitter<boolean>());
-  /** Fires with the new value whenever `reconnecting` really changes. */
-  readonly onDidChangeReconnecting: Event<boolean> = this._onDidChangeReconnecting.event;
-
-  private readonly _onError = this._register(new Emitter<string>());
-  /** Fires for every error folded into the transcript, message as shown. */
-  readonly onError: Event<string> = this._onError.event;
-
-  /**
-   * `now` is the clock the reasoning stamps read; it defaults to
-   * `performance.now()`, and tests inject their own so durations are exact.
-   */
-  constructor(
-    private readonly wire: AgentSessionWire,
-    private readonly now: () => number = () => performance.now(),
-  ) {
-    super();
-    this._register(
-      wire.onAgents((agents) => {
-        this.agentList = agents;
-        this._onDidChangeAgents.fire(this.agentList);
-      }),
-    );
-    this._register(wire.onSession((frame) => this.acknowledge(frame)));
-    this._register(wire.onEvent((frame) => this.foldEvent(frame)));
-    this._register(wire.onDelta((frame) => this.foldDelta(frame)));
-    this._register(wire.onError((message) => this.foldError(message, null)));
-    this._register(wire.onDisconnect(() => this.setReconnecting(true)));
-  }
-
-  /** The discovered agent names, as last pushed by the server. */
-  get agents(): readonly string[] {
-    return this.agentList;
-  }
-
-  /** The acknowledged session, or null before a launch is answered. */
-  get session(): AgentSessionFrame | null {
-    return this.acknowledged;
-  }
-
-  /** The transcript, in display order. */
-  get items(): readonly TranscriptItem[] {
-    return this.transcript;
-  }
-
-  /**
-   * True once the acknowledged session's run has reported anything - a
-   * durable event or a live chunk - so the agent has first waited on its
-   * inbox or worked, and its run takes the operator's messages. Off until
-   * then, from `run_ended` on, since an ended run takes no more messages,
-   * and again when a new session is acknowledged.
-   */
-  get started(): boolean {
-    return this.begun;
-  }
-
-  /**
-   * True while the agent is working: on after a send, at the operator's
-   * message in the log, at an answered model tool call, and after a
-   * cancel at a frame from a round newer than any seen before it; off
-   * when the agent waits on its inbox, its run ends, an error arrives, or
-   * a cancel is sent. A reply alone leaves it on, since a message that
-   * lands as the reply does makes the agent go on. A same-session reattach
-   * before a send's echo returns it to what the log left.
-   */
-  get generating(): boolean {
-    return this.working;
-  }
-
-  /**
-   * True from a socket drop until the reattach is acknowledged; the
-   * transcript can't advance meanwhile.
-   */
-  get reconnecting(): boolean {
-    return this.dropped;
-  }
-
-  /**
-   * Asks the server to launch the named agent; the acknowledgment (or an
-   * error frame for a refused launch) arrives on the wire. False when
-   * the socket is down and nothing was sent.
-   */
-  launch(agent: string): boolean {
-    return this.wire.launch(agent);
-  }
-
-  /**
-   * Sends the operator's message, byte-exact: it answers the agent while
-   * the agent waits on its inbox, and steers the turn while it works. The
-   * text never enters the transcript here: the server records it and the
-   * durable `user_message` event renders it, so the view shows exactly
-   * what the log holds. False when the socket is down; a failed send folds
-   * a local error item, because a downed socket is the one failure the
-   * server can never report, while a message the run refuses comes back
-   * as the server's error frame. A sent message turns `generating` on; a
-   * same-session reattach before its echo returns to the state the log
-   * left, since the drop may have lost the message.
-   */
-  respond(text: string): boolean {
-    if (!this.wire.respond(text)) {
-      this.foldError(CONNECTION_FAILED_MESSAGE, CONNECTION_FAILED_TITLE);
-      return false;
-    }
-    // The message restarts the turn's work, so a stop no longer applies.
-    this.stopped = false;
-    this.unechoed = true;
-    this.setGenerating(true);
-    return true;
-  }
-
-  /**
-   * Cancels the running turn. The server answers a cancel with nothing -
-   * cancellation is a stop reason, not an error - so after a successful
-   * send the service settles its own view: `generating` turns off and any
-   * open thinking ends. The agent goes on with a message already queued,
-   * so a frame from a round newer than any seen before the cancel turns
-   * `generating` back on; so does the first frame of a round issued just
-   * before the cancel, which reads the same. The first such frame also
-   * ends the latest batch, whose running calls the stop dropped, even
-   * when a message sent since already turned `generating` on. False when
-   * the socket is down, with nothing changed.
-   */
-  cancelTurn(): boolean {
-    if (!this.wire.cancelTurn()) {
-      return false;
-    }
-    this.stopped = true;
-    this.stopRound = this.newest;
-    this.batchStopped = true;
-    const closed = this.closeThinking(null);
-    this.setGenerating(false);
-    if (closed) {
-      this._onDidChangeTranscript.fire();
-    }
-    return true;
-  }
-
-  /**
-   * Folds a session acknowledgment. A different session id means a
-   * different event log replaying from index zero, so the transcript
-   * resets with it and the new session has not started; a same-session
-   * reattach keeps the transcript (the socket's cursor already
-   * deduplicates the replay). When the last send has no `user_message`
-   * echo yet, a same-session reattach returns to the working state the
-   * last durable event left: the drop may have lost the message, and an
-   * echo the replay brings turns working on again. The acknowledgment
-   * also ends a reconnect.
-   */
-  private acknowledge(frame: AgentSessionFrame): void {
-    const changedSession =
-      this.acknowledged === null || this.acknowledged.session !== frame.session;
-    this.acknowledged = frame;
-    this.stopped = false;
-    if (changedSession) {
-      this.transcript = [];
-      this.settled = -1;
-      this.newest = -1;
-      this.batchStopped = false;
-      this.unechoed = false;
-      this.setLogWorking(false);
-      this.setStarted(false);
-      this._onDidChangeTranscript.fire();
-    } else if (this.unechoed) {
-      this.setGenerating(this.logWorking);
-    }
-    this.setReconnecting(false);
-    this._onDidChangeSession.fire(frame);
-  }
-
-  /** Folds one durable event into the transcript. */
-  private foldEvent(frame: AgentEventFrame): void {
-    const event = frame.event;
-    const reply = frame.reply ?? null;
-    // Every durable entry is the session's run reporting, so it has begun,
-    // except the entry reporting its end.
-    if (event.kind !== "run_ended") {
-      this.setStarted(true);
-    }
-    switch (event.kind) {
-      case "awaiting_input": {
-        // The agent waits on its empty inbox for the operator: no thinking
-        // is still running, the latest batch's work is over, nothing is
-        // generating until a message lands, and the cancel grace window is
-        // over.
-        const closed = this.closeThinking(null);
-        const ended = this.endBatch();
-        this.stopped = false;
-        this.batchStopped = false;
-        this.setLogWorking(false);
-        if (closed || ended) {
-          this._onDidChangeTranscript.fire();
-        }
-        return;
-      }
-      case "run_ended": {
-        // The run ended and takes no more messages: no thinking is still
-        // running, the latest batch's work is over, nothing is generating,
-        // and the cancel grace window is over.
-        const closed = this.closeThinking(null);
-        const ended = this.endBatch();
-        this.stopped = false;
-        this.batchStopped = false;
-        this.setLogWorking(false);
-        this.setStarted(false);
-        if (closed || ended) {
-          this._onDidChangeTranscript.fire();
-        }
-        return;
-      }
-      case "user_message": {
-        // The message withdraws the round that streams as it lands, and
-        // the reissue streams under a new id, so nothing else settles the
-        // withdrawn round.
-        this.settle(this.highestPending());
-        this.transcript.push({ kind: "user", text: event.content });
-        // The operator's message sets the agent working, live or replayed,
-        // and echoes a sent one.
-        this.stopped = false;
-        this.unechoed = false;
-        this.setLogWorking(true);
-        break;
-      }
-      case "agent_message": {
-        this.noteRound(reply);
-        this.settle(reply);
-        this.transcript.push({
-          kind: "reply",
-          text: event.content,
-          model: event.model ?? null,
-          pending: false,
-          reply,
-        });
-        // A reply does not end the turn: a message that lands as the
-        // reply does makes the agent go on, so only its next wait on its
-        // inbox ends the working state.
-        break;
-      }
-      case "agent_thought": {
-        // A thought settles only its own channel: the round stays open
-        // and its text deltas keep streaming toward the reply. The
-        // durable item inherits the pending item's clock; a round that
-        // never streamed text (a tool-call round) has no text delta to
-        // end its thinking, so the durable thought ends it.
-        this.noteRound(reply);
-        const pending = this.pendingReasoning(reply);
-        const startedAt = pending?.startedAt ?? null;
-        const endedAt = pending?.endedAt ?? (startedAt === null ? null : this.now());
-        this.dropPending(reply, "reasoning");
-        this.transcript.push({
-          kind: "reasoning",
-          text: event.content,
-          model: event.model ?? null,
-          pending: false,
-          reply,
-          startedAt,
-          endedAt,
-        });
-        break;
-      }
-      case "tool_call": {
-        this.noteRound(reply);
-        this.settle(reply);
-        this.transcript.push({
-          kind: "tool-call",
-          calls: parseToolCalls(event.content),
-          text: event.content,
-          model: event.model ?? null,
-          ended: false,
-        });
-        break;
-      }
-      case "tool_call_update": {
-        // An answered model call means the agent has its result and is
-        // working again. Checked before the result lands, so only earlier
-        // results count as a call's answer.
-        const toolCallId = event.tool_call_id ?? null;
-        if (toolCallId !== null && this.answersModelCall(toolCallId)) {
-          this.setLogWorking(true);
-        }
-        this.transcript.push({
-          kind: "tool-result",
-          toolCallId,
-          text: event.content,
-        });
-        break;
-      }
-      default: {
-        // The Rust kind enum is non-exhaustive: future kinds arrive as
-        // labels outside the union and render nothing rather than
-        // breaking the feed.
-        return;
-      }
-    }
-    this._onDidChangeTranscript.fire();
-  }
-
-  /**
-   * Folds one ephemeral chunk: appended to its round's pending item on
-   * the matching channel, or opening that item when the chunk is the
-   * round's first. A reasoning chunk that opens its item starts the
-   * round's clock; a text chunk ends the same round's thinking.
-   */
-  private foldDelta(frame: AgentDeltaFrame): void {
-    // A live chunk is the session's run reporting, so it has begun.
-    this.setStarted(true);
-    if (frame.reply <= this.settled) {
-      // A late chunk of a round already settled or withdrawn.
-      return;
-    }
-    this.noteRound(frame.reply);
-    const kind: StreamKind = frame.kind === "reasoning" ? "reasoning" : "reply";
-    if (kind === "reply") {
-      this.closeThinking(frame.reply);
-    }
-    const index = this.findPending(frame.reply, kind);
-    if (index === -1) {
-      this.transcript.push(
-        kind === "reasoning"
-          ? {
-              kind: "reasoning",
-              text: frame.content,
-              model: null,
-              pending: true,
-              reply: frame.reply,
-              // After Stop the chunk is a late straggler: it opens ended,
-              // with no start, so it reads as a finished thought.
-              startedAt: this.stopped ? null : this.now(),
-              endedAt: this.stopped ? this.now() : null,
-            }
-          : { kind: "reply", text: frame.content, model: null, pending: true, reply: frame.reply },
-      );
-    } else {
-      const existing = this.transcript[index];
-      if (existing !== undefined && (existing.kind === "reply" || existing.kind === "reasoning")) {
-        // Replaced, not mutated: the view diffs items by identity.
-        this.transcript[index] = { ...existing, text: existing.text + frame.content };
-      }
-    }
-    this._onDidChangeTranscript.fire();
-  }
-
-  /**
-   * Folds an error into the transcript and announces it. An error ends
-   * the turn, so open thinking ends and `generating` turns off.
-   */
-  private foldError(message: string, title: string | null): void {
-    this.closeThinking(null);
-    this.setGenerating(false);
-    this.transcript.push({ kind: "error", message, title });
-    this._onDidChangeTranscript.fire();
-    this._onError.fire(message);
-  }
-
-  /**
-   * Marks a round settled by its durable reply or tool-call event: both
-   * channels' pending items die, superseded by the event that follows.
-   * So do every earlier round's, such as a round a stop cut short, which
-   * nothing else settles.
-   */
-  private settle(reply: number | null): void {
-    if (reply === null) {
-      return;
-    }
-    this.settled = Math.max(this.settled, reply);
-    for (let index = this.transcript.length - 1; index >= 0; index--) {
-      const item = this.transcript[index];
-      if (
-        (item?.kind === "reply" || item?.kind === "reasoning") &&
-        item.pending &&
-        item.reply !== null &&
-        item.reply <= reply
-      ) {
-        this.transcript.splice(index, 1);
-      }
-    }
-  }
-
-  /** The highest round with a pending item, or null when none is pending. */
-  private highestPending(): number | null {
-    let highest: number | null = null;
-    for (const item of this.transcript) {
-      if ((item.kind === "reply" || item.kind === "reasoning") && item.pending && item.reply !== null) {
-        highest = highest === null ? item.reply : Math.max(highest, item.reply);
-      }
-    }
-    return highest;
-  }
-
-  /**
-   * Notes a frame from round `reply`. A round newer than any seen before
-   * the last cancel means the agent went on with a message: its first
-   * frame ends the latest batch, whose running calls the stop dropped,
-   * and while the cancel stands the stop ends and the agent is working
-   * again. The caller owns announcing the transcript change.
-   */
-  private noteRound(reply: number | null): void {
-    if (reply === null) {
-      return;
-    }
-    if (reply > this.stopRound) {
-      if (this.batchStopped) {
-        this.batchStopped = false;
-        this.endBatch();
-      }
-      if (this.stopped) {
-        this.stopped = false;
-        this.setGenerating(true);
-      }
-    }
-    this.newest = Math.max(this.newest, reply);
-  }
-
-  /**
-   * Ends the latest batch by replacing its item, unless it has already
-   * ended. Returns whether anything changed; the caller owns announcing
-   * it.
-   */
-  private endBatch(): boolean {
-    for (let index = this.transcript.length - 1; index >= 0; index--) {
-      const item = this.transcript[index];
-      if (item?.kind === "tool-call") {
-        if (item.ended) {
-          return false;
-        }
-        this.transcript[index] = { ...item, ended: true };
-        return true;
-      }
-    }
-    return false;
-  }
-
-  /** Removes the pending item for one round's channel, if it is open. */
-  private dropPending(reply: number | null, kind: StreamKind): void {
-    if (reply === null) {
-      return;
-    }
-    const index = this.findPending(reply, kind);
-    if (index !== -1) {
-      this.transcript.splice(index, 1);
-    }
-  }
-
-  /** The pending reasoning item of one round, or undefined. */
-  private pendingReasoning(reply: number | null): ReasoningItem | undefined {
-    if (reply === null) {
-      return undefined;
-    }
-    const item = this.transcript[this.findPending(reply, "reasoning")];
-    return item?.kind === "reasoning" ? item : undefined;
-  }
-
-  /**
-   * Ends every open thinking - the pending reasoning items that have no
-   * end yet - for one round, or for every round when `reply` is null.
-   * Items are replaced, not mutated. Returns whether anything changed;
-   * the caller owns announcing it.
-   */
-  private closeThinking(reply: number | null): boolean {
-    let changed = false;
-    let at: number | null = null;
-    for (let index = 0; index < this.transcript.length; index++) {
-      const item = this.transcript[index];
-      if (
-        item !== undefined &&
-        item.kind === "reasoning" &&
-        item.pending &&
-        item.endedAt === null &&
-        (reply === null || item.reply === reply)
-      ) {
-        at ??= this.now();
-        this.transcript[index] = { ...item, endedAt: at };
-        changed = true;
-      }
-    }
-    return changed;
-  }
-
-  /**
-   * True when `toolCallId` names a call of a model tool-call batch. The
-   * scan runs back from the tail through the current turn, and past its
-   * user items only to a call that has no result yet: a steering message
-   * can land while the batch runs, and providers recycle ids like
-   * `call_1` across turns.
-   */
-  private answersModelCall(toolCallId: string): boolean {
-    let pastUser = false;
-    let answered = false;
-    for (let index = this.transcript.length - 1; index >= 0 && !(pastUser && answered); index--) {
-      const item = this.transcript[index];
-      if (item?.kind === "user") {
-        pastUser = true;
-      } else if (item?.kind === "tool-result" && item.toolCallId === toolCallId) {
-        answered = true;
-      } else if (item?.kind === "tool-call" && item.calls.some((call) => call.id === toolCallId)) {
-        return true;
-      }
-    }
-    return false;
-  }
-
-  /**
-   * The index of the pending item for one round's channel, or -1. Scans
-   * from the tail: pending items always sit near it, because rounds are
-   * sequential.
-   */
-  private findPending(reply: number, kind: StreamKind): number {
-    for (let index = this.transcript.length - 1; index >= 0; index--) {
-      const item = this.transcript[index];
-      if (item !== undefined && item.kind === kind && item.pending && item.reply === reply) {
-        return index;
-      }
-    }
-    return -1;
-  }
-
-  /** Sets `started`, firing only on a real change. */
-  private setStarted(value: boolean): void {
-    if (this.begun === value) {
-      return;
-    }
-    this.begun = value;
-    this._onDidChangeStarted.fire(value);
-  }
-
-  /** Sets `generating` from a durable event, as the working state the log leaves. */
-  private setLogWorking(value: boolean): void {
-    this.logWorking = value;
-    this.setGenerating(value);
-  }
-
-  /** Sets `generating`, firing only on a real change. */
-  private setGenerating(value: boolean): void {
-    if (this.working === value) {
-      return;
-    }
-    this.working = value;
-    this._onDidChangeGenerating.fire(value);
-  }
-
-  /** Sets `reconnecting`, firing only on a real change. */
-  private setReconnecting(value: boolean): void {
-    if (this.dropped === value) {
-      return;
-    }
-    this.dropped = value;
-    this._onDidChangeReconnecting.fire(value);
-  }
-}
diff --git a/crates/workshop/ui/src/services/agent-socket.ts b/crates/workshop/ui/src/services/agent-socket.ts
deleted file mode 100644
index f77f24924..000000000
--- a/crates/workshop/ui/src/services/agent-socket.ts
+++ /dev/null
@@ -1,243 +0,0 @@
-// The agent-session socket: one WebSocket to /agents/ws serving one agent
-// session - agent windows are modal, so the socket's whole life is one
-// session plus the agent list that precedes it. The frame shapes live in
-// protocol.ts; the Rust half of the routing is
-// crates/workshop/server/src/agents/socket.rs.
-//
-// Routing follows the SPA's delivery discipline, one class per frame:
-//
-// - The `agents` list is an ephemeral complete snapshot, resent by the
-//   server on every connect: the newest push supersedes every older one.
-// - `agent_session` is the durable direct reply to a launch or attach; the
-//   acknowledged session id is retained here so a reconnect reattaches.
-// - `agent_event` frames are durable: the server drains them in log order,
-//   and an attach replays the log from index zero, so this socket keeps a
-//   per-session cursor and drops already-delivered indices - the client
-//   half of the durable cursor-and-replay promise, which is also how a
-//   reattach's replay stays duplicate-free for consumers.
-// - `agent_delta` frames are ephemeral: they may drop under lag and are
-//   never buffered here; each names the `reply` id of the durable event
-//   that will supersede it, so the renderer coalesces chunks by that id
-//   and the completed-reply event is the repair path.
-//
-// When the agent waits for the operator is a durable `agent_event` of kind
-// `awaiting_input`, so it rides the event cursor like every other entry.
-//
-// This socket skips the boot queue: WorkshopSocket's queue guards the app-boot
-// race where the server's first pushes beat handler wiring, but this
-// socket is constructed and subscribed by its owning view before
-// `connect()` is called, so no push can precede its handlers.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import {
-  AGENT_FRAME_GUARDS,
-  type AgentCancelFrame,
-  type AgentDeltaFrame,
-  type AgentEventFrame,
-  type AgentSessionFrame,
-  type AttachFrame,
-  type InputResponseFrame,
-  type LaunchFrame,
-  narrowFrame,
-} from "./protocol";
-import { ReconnectBackoff } from "@workshop/platform/reconnect-backoff";
-
-function defaultUrl(): string {
-  return `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}/agents/ws`;
-}
-
-/**
- * The client of one /agents/ws socket. Sessions outlive sockets: after a
- * dropout the socket reconnects with backoff and, when a session was
- * acknowledged, reattaches to it - the server replays the event log from
- * index zero, deduplicated here by the event cursor. A reattach refused
- * because the session ended while disconnected surfaces as an `onError`
- * message, exactly as the server sent it.
- */
-export class AgentSocket extends Disposable {
-  private socket: WebSocket | null = null;
-  private readonly backoff = new ReconnectBackoff();
-  /** The acknowledged session, retained so a reconnect reattaches. */
-  private acknowledged: AgentSessionFrame | null = null;
-  /** The next event-log index to deliver; everything below it already was. */
-  private nextIndex = 0;
-
-  private readonly _onAgents = this._register(new Emitter<string[]>());
-  /** Fires for every pushed agent list - a complete snapshot per connect. */
-  readonly onAgents: Event<string[]> = this._onAgents.event;
-
-  private readonly _onSession = this._register(new Emitter<AgentSessionFrame>());
-  /**
-   * Fires for every session acknowledgment, including the one a reconnect's
-   * reattach earns.
-   */
-  readonly onSession: Event<AgentSessionFrame> = this._onSession.event;
-
-  private readonly _onEvent = this._register(new Emitter<AgentEventFrame>());
-  /** Fires once per event-log entry, in log order, replay-deduplicated. */
-  readonly onEvent: Event<AgentEventFrame> = this._onEvent.event;
-
-  private readonly _onDelta = this._register(new Emitter<AgentDeltaFrame>());
-  /**
-   * Fires for every live streaming chunk. Ephemeral: chunks may drop under
-   * lag; coalesce them by their `reply` id and replace them with the
-   * superseding durable event when it arrives on `onEvent`.
-   */
-  readonly onDelta: Event<AgentDeltaFrame> = this._onDelta.event;
-
-  private readonly _onError = this._register(new Emitter<string>());
-  /** Fires for every server error frame, message as sent. */
-  readonly onError: Event<string> = this._onError.event;
-
-  private readonly _onDisconnect = this._register(new Emitter<void>());
-  /** Fires when the socket disconnects; a reconnect is already scheduled. */
-  readonly onDisconnect: Event<void> = this._onDisconnect.event;
-
-  constructor(private readonly url: string = defaultUrl()) {
-    super();
-    // Disposal silences the socket before closing it (onclose detached
-    // first), so teardown is never mistaken for a dropout: no disconnect
-    // fan-out, no reconnect backoff.
-    this._register(
-      toDisposable(() => {
-        this.backoff.cancel();
-        const socket = this.socket;
-        if (socket) {
-          socket.onclose = null;
-          socket.close();
-          this.socket = null;
-        }
-      }),
-    );
-  }
-
-  /** Opens the socket unless it is already open or opening. */
-  connect(): void {
-    if (this.socket) {
-      return;
-    }
-    const socket = new WebSocket(this.url);
-    this.socket = socket;
-    socket.onopen = () => {
-      this.backoff.reset();
-      // Sessions outlive sockets: a fresh connection reattaches to the
-      // acknowledged session. The replay from index zero that follows is
-      // deduplicated by the event cursor.
-      if (this.acknowledged) {
-        this.sendFrame({
-          type: "attach",
-          session: this.acknowledged.session,
-        } satisfies AttachFrame);
-      }
-    };
-    socket.onerror = () => {
-      if (this.socket === socket) this.socket = null;
-    };
-    socket.onmessage = (event: MessageEvent) => this.route(event);
-    socket.onclose = () => {
-      if (this.socket === socket) this.socket = null;
-      this._onDisconnect.fire(undefined);
-      this.scheduleReconnect();
-    };
-  }
-
-  /**
-   * Sends one `launch` frame starting a session of the named agent. False
-   * when the socket is down, nothing sent; the server answers with an
-   * `agent_session` acknowledgment, or an error frame for an unknown name.
-   */
-  launch(agent: string): boolean {
-    return this.sendFrame({ type: "launch", agent } satisfies LaunchFrame);
-  }
-
-  /**
-   * Sends one `attach` frame joining the running session with this id.
-   * The failure contract matches `launch`: false when the socket is down.
-   */
-  attach(session: string): boolean {
-    return this.sendFrame({ type: "attach", session } satisfies AttachFrame);
-  }
-
-  /**
-   * Sends the operator's message; false when the socket is not open. The
-   * text goes byte-exact, at any time: it answers the waiting agent or
-   * steers its running turn.
-   */
-  respond(text: string): boolean {
-    return this.sendFrame({ type: "input_response", text } satisfies InputResponseFrame);
-  }
-
-  /**
-   * Fires the session's turn-cancel. The server answers with nothing -
-   * cancellation is a stop reason, not an error - so the caller settles
-   * its own view. False when the socket is down.
-   */
-  cancelTurn(): boolean {
-    return this.sendFrame({ type: "cancel" } satisfies AgentCancelFrame);
-  }
-
-  /** Sends one JSON frame; false when the socket is down or the send threw. */
-  private sendFrame(frame: Record<string, unknown>): boolean {
-    const socket = this.socket;
-    if (!socket || socket.readyState !== WebSocket.OPEN) {
-      return false;
-    }
-    try {
-      socket.send(JSON.stringify(frame));
-      return true;
-    } catch {
-      // A send that throws mid-close is the same failure as a closed
-      // socket; the close handler runs the cleanup.
-      return false;
-    }
-  }
-
-  /** Schedules the next reconnect attempt with exponential backoff. */
-  private scheduleReconnect(): void {
-    this.backoff.schedule(() => this.connect());
-  }
-
-  private route(event: MessageEvent): void {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(String(event.data));
-    } catch {
-      // A non-JSON frame is ignored; keep reading.
-      return;
-    }
-    const frame = narrowFrame(AGENT_FRAME_GUARDS, parsed, "/agents/ws");
-    switch (frame?.type) {
-      case "agents":
-        this._onAgents.fire(frame.agents);
-        return;
-      case "agent_session":
-        // A different session's log starts over at index zero, so the cursor
-        // resets with it - otherwise a launch after a refused reattach (the
-        // session died while disconnected) would silently swallow the new
-        // log's head. A reattach to the same session keeps the cursor: that
-        // dedup is the replay contract.
-        if (this.acknowledged !== null && this.acknowledged.session !== frame.session) {
-          this.nextIndex = 0;
-        }
-        this.acknowledged = frame;
-        this._onSession.fire(frame);
-        return;
-      case "agent_event":
-        // The durable cursor: an attach replays the log from index zero, so
-        // everything below the cursor was already delivered and drops here.
-        if (frame.index < this.nextIndex) {
-          return;
-        }
-        this.nextIndex = frame.index + 1;
-        this._onEvent.fire(frame);
-        return;
-      case "agent_delta":
-        this._onDelta.fire(frame);
-        return;
-      case "error":
-        this._onError.fire(frame.message !== "" ? frame.message : "the agent session failed");
-        return;
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/services/closed-editors.ts b/crates/workshop/ui/src/services/closed-editors.ts
deleted file mode 100644
index 29c262fdd..000000000
--- a/crates/workshop/ui/src/services/closed-editors.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-// The closed-editor service contract behind Reopen Closed Editor. The
-// implementation (parts/editor/closed-editors.ts) is workspace-persisted
-// and self-registers with a default factory, but it stays in parts because
-// the composition root binds it to the live adapter beside the other
-// workspace-scoped stores; only the token and the stack's public shapes
-// live here, in the DOM-free services layer.
-
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/** One closed editor: a file to reopen by path, or an untitled buffer's text. */
-export type ClosedEditor =
-  | { readonly kind: "file"; readonly path: string }
-  | { readonly kind: "untitled"; readonly text: string };
-
-/** The persisted shape: file paths only, most recent first. */
-export interface ClosedEditorsSnapshot {
-  readonly paths: string[];
-}
-
-/** The closed-editor stack consumers resolve from the registry. */
-export interface ClosedEditors {
-  /** Records a closing editor; the oldest entry drops past the cap. */
-  push(entry: ClosedEditor): void;
-  /** Removes and returns the most recently closed editor; undefined when none. */
-  pop(): ClosedEditor | undefined;
-  /** The persisted view: file paths, most recent first; Save As writes it. */
-  snapshot(): ClosedEditorsSnapshot;
-  /**
-   * Replaces the stack wholesale with a workspace's stored paths (Open
-   * Workspace from File), most recent first, without a write.
-   */
-  replaceClosedEditors(paths: readonly string[]): void;
-}
-
-/** The registry token for the closed-editor stack singleton. */
-export const CLOSED_EDITORS = createServiceToken<ClosedEditors>("workshop.closedEditors");
diff --git a/crates/workshop/ui/src/services/command-failure-toasts.ts b/crates/workshop/ui/src/services/command-failure-toasts.ts
deleted file mode 100644
index f35b5251f..000000000
--- a/crates/workshop/ui/src/services/command-failure-toasts.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-// Cursor's toast for a failed command: "Command '{0}' resulted in an error",
-// with {0} the command's palette label (Category: Title, as the palette row
-// reads, so the toast names what the operator picked). The platform registry
-// reports each failure (onDidFailCommand) because @workshop/platform never
-// imports the app; this module is the app's half, turning the report into an
-// error toast on the shared stack. The toast carries no error text, as
-// Cursor's carries none; the callers that dispatch a command log the error
-// object on the console, so the detail is not lost.
-
-import type { ToastStack } from "@workshop/look/toast";
-import { Commands, logCommandFailure, type CommandRegistry } from "@workshop/platform/command-registry";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { getServiceOrNull } from "@workshop/platform/service-registry";
-import { TOAST_STACK } from "./toast-service";
-
-/** The toast text for a failed command whose palette label is `label`. */
-function failureMessage(label: string): string {
-  return `Command '${label}' resulted in an error`;
-}
-
-/** Raises an error toast for every command `commands` reports as failed. */
-export function toastCommandFailures(commands: CommandRegistry, toasts: ToastStack): IDisposable {
-  return commands.onDidFailCommand(({ label }) => {
-    toasts.show(failureMessage(label), "error");
-  });
-}
-
-/**
- * Reports a failure of a command run that bypassed the registry (a direct
- * call into the layout core), which the registry's report cannot see: the
- * same toast on the shared stack, when one is registered, and the error
- * object on the console. A bare widget with no stack leaves the console.
- */
-export function toastCommandFailure(commandId: string, error: unknown, commands: CommandRegistry = Commands): void {
-  logCommandFailure(commandId, error);
-  getServiceOrNull(TOAST_STACK)?.show(failureMessage(commands.labelOf(commandId)), "error");
-}
diff --git a/crates/workshop/ui/src/services/commands-history.ts b/crates/workshop/ui/src/services/commands-history.ts
deleted file mode 100644
index 27cae4139..000000000
--- a/crates/workshop/ui/src/services/commands-history.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-// The commands-history service contract behind the command palette's
-// recency ordering. The implementation (parts/quickinput/commands-history.ts)
-// is user-persisted and self-registers with a default factory, but it stays
-// in parts because the composition root binds it to the live adapter beside
-// the other user-scoped stores; only the interface and the token live here,
-// in the DOM-free services layer.
-
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/** The palette recency list consumers resolve from the registry. */
-export interface CommandsHistory {
-  /** The recorded command ids, most recent first. */
-  readonly list: readonly string[];
-  /**
-   * Records `id` as just run: it moves to the front, a duplicate
-   * collapses, and the oldest entries drop past the cap. Empty ids are
-   * ignored.
-   */
-  add(id: string): void;
-}
-
-/** The registry token for the commands-history singleton. */
-export const COMMANDS_HISTORY: ServiceToken<CommandsHistory> =
-  createServiceToken<CommandsHistory>("workshop.commandsHistory");
diff --git a/crates/workshop/ui/src/services/editor-settings-service.ts b/crates/workshop/ui/src/services/editor-settings-service.ts
deleted file mode 100644
index b48027502..000000000
--- a/crates/workshop/ui/src/services/editor-settings-service.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-// The editor settings vocabulary and service contract. The implementation
-// (parts/editor/editor-settings-service.ts) stays CodeMirror-free and
-// self-registers with a default factory, but it lives in parts beside the
-// surfaces that consume it; the settings shape, the context-key mapping,
-// the defaults, the service interface, and the token live here, in the
-// DOM-free services layer.
-
-import type { Event } from "@workshop/platform/event";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/**
- * What Render Whitespace draws: nothing, the whitespace inside the
- * selection only (Cursor's default), or every space and tab.
- */
-export type RenderWhitespace = "none" | "selection" | "all";
-
-/** The render-whitespace modes, in menu order. */
-export const RENDER_WHITESPACE_MODES: readonly RenderWhitespace[] = ["none", "selection", "all"];
-
-/**
- * The editor settings: three on/off toggles and the render-whitespace
- * mode. The toggle actions flip the booleans; Render Whitespace's toggle
- * flips between none and all.
- */
-export interface EditorSettings {
-  readonly wordWrap: boolean;
-  readonly renderWhitespace: RenderWhitespace;
-  readonly renderControlCharacters: boolean;
-  readonly columnSelection: boolean;
-}
-
-/** One setting's name. */
-export type EditorSettingName = keyof EditorSettings;
-
-/**
- * The stock values. Render Control Characters is on by default, as in
- * Cursor; Render Whitespace defaults to the selection mode, as in
- * Cursor; the other two start off.
- */
-export const DEFAULT_EDITOR_SETTINGS: EditorSettings = {
-  wordWrap: false,
-  renderWhitespace: "selection",
-  renderControlCharacters: true,
-  columnSelection: false,
-};
-
-/** The context key each setting publishes to (the menus' `toggled` sources). */
-export const EDITOR_SETTING_CONTEXT_KEYS: { readonly [K in EditorSettingName]: `config.editor.${K}` } = {
-  wordWrap: "config.editor.wordWrap",
-  renderWhitespace: "config.editor.renderWhitespace",
-  renderControlCharacters: "config.editor.renderControlCharacters",
-  columnSelection: "config.editor.columnSelection",
-};
-
-/**
- * The boolean a setting publishes to its context key. Every key is
- * boolean, so the Render Whitespace menu row can show a check: the mode
- * publishes true unless it is none.
- */
-export function contextKeyValue<K extends EditorSettingName>(name: K, value: EditorSettings[K]): boolean {
-  return name === "renderWhitespace" ? value !== "none" : value === true;
-}
-
-/** The editor-settings service consumers resolve from the registry. */
-export interface EditorSettingsService extends IDisposable {
-  /** The current settings. */
-  readonly settings: EditorSettings;
-  /** Fires when a setting changes; the editor surfaces hook it. */
-  readonly onDidChange: Event<EditorSettings>;
-  /** Writes one setting; a write of the current value is a no-op. */
-  set<K extends EditorSettingName>(name: K, value: EditorSettings[K]): void;
-  /**
-   * Flips one setting - the toggle actions' entire run body. A boolean
-   * flips; Render Whitespace flips between none and all.
-   */
-  toggle(name: EditorSettingName): void;
-}
-
-/** The registry token for the editor-settings singleton. */
-export const EDITOR_SETTINGS_SERVICE = createServiceToken<EditorSettingsService>("workshop.editorSettings");
diff --git a/crates/workshop/ui/src/services/error-catalog.ts b/crates/workshop/ui/src/services/error-catalog.ts
deleted file mode 100644
index 20ad3f910..000000000
--- a/crates/workshop/ui/src/services/error-catalog.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-// The typed error vocabulary shared by every service and view. Two shapes:
-// Result for operations whose callers branch on the outcome (grantPath),
-// and CatalogError for the throw-based HTTP boundaries (workspace-api),
-// where the ErrorCatalog code - never the message text - is what callers
-// match on. Both share the same stable codes, so a failure's meaning
-// survives the trip from the fetch boundary to the status bar.
-
-import type { Result as PlatformResult } from "@workshop/platform/result";
-
-/** The outcome of one fallible operation: a value, or a typed error. */
-export type Result<T, E = CatalogError> = PlatformResult<T, E>;
-
-/**
- * The stable machine-readable failure codes. Callers match on these;
- * messages are for humans and may be reworded freely.
- */
-export enum ErrorCatalog {
-  /** The request never reached a response: DNS, refusal, abort. */
-  Transport = "transport",
-  /** The server answered with a non-2xx status. */
-  HttpStatus = "http_status",
-  /** A 2xx answer did not match the wire contract's shape. */
-  UnexpectedShape = "unexpected_shape",
-  /** The server refused a write because the file changed on disk. */
-  ModifiedConflict = "modified_conflict",
-  /** The server answered a write past its deadline: it may still land. */
-  DeadlineElapsed = "deadline_elapsed",
-  /** The server refused to grant a workspace root. */
-  GrantRefused = "grant_refused",
-}
-
-/** One typed failure: a catalog code, a human message, the HTTP status. */
-export class CatalogError extends Error {
-  /** The stable code callers match on. */
-  readonly code: ErrorCatalog;
-  /** The HTTP status, when a response was received; null on transport. */
-  readonly status: number | null;
-
-  constructor(
-    code: ErrorCatalog,
-    message: string,
-    options?: { readonly status?: number; readonly cause?: unknown },
-  ) {
-    super(message, { cause: options?.cause });
-    this.name = "CatalogError";
-    this.code = code;
-    this.status = options?.status ?? null;
-  }
-}
-
-/** Narrows an unknown catch to a CatalogError, optionally of one code. */
-export function isCatalogError(error: unknown, code?: ErrorCatalog): error is CatalogError {
-  return (
-    error instanceof CatalogError && (code === undefined || error.code === code)
-  );
-}
-
-/**
- * Renders any caught value as display text: an Error's message, a foreign
- * object's string `message` property (cross-realm errors, WebView bridge
- * failures), or String() as the last resort.
- */
-export function errorText(error: unknown): string {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === "object" && error !== null) {
-    const message = Reflect.get(error, "message");
-    if (typeof message === "string") {
-      return message;
-    }
-  }
-  return String(error);
-}
diff --git a/crates/workshop/ui/src/services/gateway-config-api.ts b/crates/workshop/ui/src/services/gateway-config-api.ts
deleted file mode 100644
index 6c3015302..000000000
--- a/crates/workshop/ui/src/services/gateway-config-api.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-// The workshop server's gateway-config surface: the narrow server-side
-// proxy (/gateway/api/{path}) that forwards the config UI's API calls
-// with the gateway bearer key attached. The key lives only in the
-// workshop server's process; neither the workshop page nor the iframe
-// ever sees it.
-
-/** The fetch signature the helpers use; tests substitute a stub. */
-export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
-
-/** One API-forward request, as the config panel posts it over the bridge. */
-export interface BridgeApiRequest {
-  /** Correlation id; echoed on the result message. */
-  readonly id: string;
-  /** The HTTP method to forward. */
-  readonly method: string;
-  /** The gateway path (plus query), always starting with "/". */
-  readonly path: string;
-  /** The JSON request body, or null for a bodyless request. */
-  readonly body: string | null;
-}
-
-/** The proxy's answer, relayed back to the iframe over the bridge. */
-export interface BridgeApiResult {
-  /** The gateway's status; 0 means the workshop server was unreachable. */
-  readonly status: number;
-  /** The gateway's Content-Type, or null when it sent none. */
-  readonly contentType: string | null;
-  /** The gateway's response body as text. */
-  readonly body: string;
-}
-
-const defaultFetch: FetchLike = (input, init) => fetch(input, init);
-
-/**
- * Forwards one bridged API request through the workshop server's
- * /gateway/api proxy, which attaches the bearer key and applies the
- * path allowlist. A transport failure answers status 0, so the iframe's
- * bridge client can surface it as an unreachable gateway rather than
- * hang.
- */
-export async function forwardGatewayRequest(
-  request: BridgeApiRequest,
-  fetchFn: FetchLike = defaultFetch,
-): Promise<BridgeApiResult> {
-  if (!request.path.startsWith("/")) {
-    // Absolute or malformed targets never leave the browser; the server
-    // would refuse them anyway, but refusing here keeps the failure local.
-    return { status: 403, contentType: null, body: "" };
-  }
-  const method = request.method.toUpperCase();
-  const init: RequestInit = { method };
-  if (["POST", "PUT", "PATCH"].includes(method)) {
-    // The workshop server's cross-site guard requires body-bearing
-    // methods to declare JSON - the bodyless POSTs of the config
-    // surface (config-apply, config-revert) included.
-    init.headers = { "Content-Type": "application/json" };
-  }
-  if (request.body !== null) {
-    init.body = request.body;
-  }
-  try {
-    const response = await fetchFn(`/gateway/api${request.path}`, init);
-    return {
-      status: response.status,
-      contentType: response.headers.get("content-type"),
-      body: await response.text(),
-    };
-  } catch {
-    return { status: 0, contentType: null, body: "" };
-  }
-}
diff --git a/crates/workshop/ui/src/services/json-request.ts b/crates/workshop/ui/src/services/json-request.ts
deleted file mode 100644
index d0c622f68..000000000
--- a/crates/workshop/ui/src/services/json-request.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-// The shared transport floor under the validated HTTP boundaries
-// (workspace-api.ts, workspace-file-client.ts): one fetch wrapper, one
-// JSON reader, and the readers of the server's error envelope
-// `{ error: { code, message } }`. Each client keeps its own field-by-
-// field body parsers and its own non-OK policy on top of these; only the
-// mechanics that every same-origin JSON client repeats live here.
-// Failures throw typed CatalogError variants (services/error-catalog.ts).
-
-import { CatalogError, ErrorCatalog, errorText } from "./error-catalog";
-
-/** Narrows an unknown value to a plain object whose fields can be read. */
-export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
-}
-
-/** Extracts the server's error message from a failed response body. */
-export function errorMessage(body: unknown, status: number, route: string): string {
-  if (isRecord(body) && isRecord(body.error) && typeof body.error.message === "string") {
-    return body.error.message;
-  }
-  if (status === 408) {
-    return `${route} timed out`;
-  }
-  return `${route} answered ${status}`;
-}
-
-/** The server's machine-readable error code, when the body includes one. */
-export function errorCode(body: unknown): string | null {
-  if (isRecord(body) && isRecord(body.error) && typeof body.error.code === "string") {
-    return body.error.code;
-  }
-  return null;
-}
-
-/**
- * Performs one fetch, wrapping a transport failure as a typed error.
- * `route` labels the failure (for example "GET /workspace/tree") and may
- * differ from `url` when the URL ends in a query string.
- */
-export async function request(url: string, route: string, init?: RequestInit): Promise<Response> {
-  try {
-    return await fetch(url, init);
-  } catch (error) {
-    throw new CatalogError(ErrorCatalog.Transport, `${route}: ${errorText(error)}`, {
-      cause: error,
-    });
-  }
-}
-
-/**
- * Parses one response body; a non-JSON answer is a shape failure. A 408
- * timeout is the exception: its body may be empty or non-JSON, and reads
- * as `null` so the caller's non-OK handler renders a readable timeout
- * instead of a shape failure.
- */
-export async function readJson(response: Response, route: string): Promise<unknown> {
-  try {
-    return await response.json();
-  } catch (error) {
-    if (response.status === 408) {
-      return null;
-    }
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `${route} returned a non-JSON answer`, {
-      status: response.status,
-      cause: error,
-    });
-  }
-}
diff --git a/crates/workshop/ui/src/services/layout-policy.ts b/crates/workshop/ui/src/services/layout-policy.ts
deleted file mode 100644
index 3c0d8cb64..000000000
--- a/crates/workshop/ui/src/services/layout-policy.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-// The layout policy contract: the product's default arrangement, which
-// the layout core applies without naming a feature. The composition root
-// registers the product's policy before the dock boots; the boot decision
-// (parts/layout/layout-boot.ts) and the Secondary Side Bar toggle resolve
-// it. No default is registered, so a bundle that applies a layout without
-// binding a policy fails naming the token.
-
-import type { ZoneName } from "@workshop/platform/panel-registry";
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/** The product's default layout and the panels the workbench never boots without. */
-export interface LayoutPolicy {
-  /**
-   * Panel types re-opened after every layout apply, so a restored layout
-   * that lost one gets it back. Each opens with empty params, so it is a
-   * singleton and re-opening an open one only focuses it.
-   */
-  readonly anchors: readonly string[];
-  /**
-   * Zones that always have a group, even with no panel in it: after every
-   * layout apply, a zone with no live group gets an empty one. A restored
-   * layout without one gains it.
-   */
-  readonly emptyZones?: readonly ZoneName[];
-  /** Opens the default layout into a blank dock. */
-  seed(): void;
-}
-
-/** The registry token for the product's layout policy. */
-export const LAYOUT_POLICY: ServiceToken<LayoutPolicy> = createServiceToken<LayoutPolicy>("workshop.layoutPolicy");
diff --git a/crates/workshop/ui/src/services/model-service.ts b/crates/workshop/ui/src/services/model-service.ts
deleted file mode 100644
index ad8519d5a..000000000
--- a/crates/workshop/ui/src/services/model-service.ts
+++ /dev/null
@@ -1,108 +0,0 @@
-// The shared model-selection state. App-aware and DOM-free: the
-// composition root constructs one instance, injecting the socket's
-// select command and catalog push, and the agent toolbar's model picker
-// reads it through the service registry; consumers read the state
-// directly or subscribe to the change events.
-//
-// The server owns the selection. setCurrent is a command: it sends a
-// select_model event through the injected send function and mutates
-// nothing. State changes only when the server's workbench snapshot
-// arrives - whoever handles the socket's onWorkbench calls
-// applySelected(frame.selected), which never sends, so a snapshot can
-// never echo back onto the wire. The catalog follows the injected
-// onModels push, so a gateway returning after an outage heals a
-// boot-time empty catalog in place.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import type { CatalogModel } from "./protocol";
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/**
- * Owns the model catalog and the current model selection shared by every
- * Agent tab's toolbar picker.
- */
-export class ModelService extends Disposable {
-  private _models: readonly CatalogModel[] = [];
-  private _current = "";
-
-  private readonly _onDidChangeModels = this._register(
-    new Emitter<readonly CatalogModel[]>(),
-  );
-  /** Fires with the new catalog after every setModels call. */
-  readonly onDidChangeModels: Event<readonly CatalogModel[]> = this._onDidChangeModels.event;
-
-  private readonly _onDidChangeCurrent = this._register(new Emitter<string>());
-  /** Fires with the new id whenever the current selection changes. */
-  readonly onDidChangeCurrent: Event<string> = this._onDidChangeCurrent.event;
-
-  /**
-   * @param sendSelect Puts one select_model event on the wire (the
-   * composition root injects WorkshopSocket.selectModel); returns false
-   * when nothing was sent so the caller can surface the failure.
-   * @param onModels The socket's catalog push (WorkshopSocket.onModels);
-   * when given, the service subscribes itself, so a pushed catalog
-   * refreshes the state without composition-root wiring.
-   */
-  constructor(
-    private readonly sendSelect: (id: string) => boolean,
-    onModels?: Event<readonly CatalogModel[]>,
-  ) {
-    super();
-    if (onModels !== undefined) {
-      this._register(onModels((models) => this.setModels(models)));
-    }
-  }
-
-  /** The model catalog, as fetched at boot or pushed by the server. */
-  get models(): readonly CatalogModel[] {
-    return this._models;
-  }
-
-  /** The selected model's id, or "" when no model is selected. */
-  get current(): string {
-    return this._current;
-  }
-
-  /**
-   * Records a catalog. The selection is untouched: the server owns it and
-   * reconciles it against the new catalog in its next workbench snapshot.
-   */
-  setModels(entries: readonly CatalogModel[]): void {
-    this._models = entries;
-    this._onDidChangeModels.fire(entries);
-  }
-
-  /**
-   * Asks the server to select `id`. A command, not a mutation: the
-   * selection changes only when the workbench snapshot confirming it
-   * arrives through applySelected. Returns false when the send failed.
-   */
-  setCurrent(id: string): boolean {
-    return this.sendSelect(id);
-  }
-
-  /**
-   * Applies the server-owned selection from a workbench snapshot; null
-   * means no model is selected. Fires onDidChangeCurrent only on a real
-   * change, and never sends, so applying a snapshot cannot echo.
-   */
-  applySelected(id: string | null): void {
-    const next = id ?? "";
-    if (next === this._current) {
-      return;
-    }
-    this._current = next;
-    this._onDidChangeCurrent.fire(next);
-  }
-}
-
-/**
- * The registry token for the composition root's ModelService. Panels
- * resolve the shared catalog and selection through the service registry
- * instead of receiving them through the dock's createComponent seam.
- * Registered by the composition root at boot; unregistered in tests that
- * drive panels standalone.
- */
-export const MODEL_SERVICE: ServiceToken<ModelService> =
-  createServiceToken<ModelService>("workshop.model");
diff --git a/crates/workshop/ui/src/services/protocol.ts b/crates/workshop/ui/src/services/protocol.ts
deleted file mode 100644
index 5a7aace0a..000000000
--- a/crates/workshop/ui/src/services/protocol.ts
+++ /dev/null
@@ -1,448 +0,0 @@
-// The pure wire types of the workshop protocol: the JSON frame and payload
-// shapes exchanged with the server over /ws, /agents/ws, and /v1/models,
-// plus the guards that narrow parsed inbound frames to them. The socket
-// logic that sends and routes these frames stays in workshop-socket.ts and
-// agent-socket.ts. The
-// Rust half of this contract is
-// crates/workshop/protocol/src plus, for the agent-session frame family,
-// crates/workshop/server/src/agents/wire.rs; the files
-// cross-cite each other so a shape change touches both or neither. The
-// agent-session frame family is additionally pinned by the shared fixture
-// crates/workshop/server/tests/fixtures/agent-frames.json,
-// asserted as the same JSON by both suites (test/agent-wire-fixtures.mjs
-// here, the workshop-server wire tests there), so drift on either side fails
-// that side's tests. The workshop-socket frame family is pinned the same
-// way by crates/workshop/protocol/tests/fixtures/workshop-frames.json,
-// asserted by test/workshop-wire-fixtures.mjs here and the workshop_frames
-// fixture test there.
-
-/** One status bar update, as sent by the server. */
-export interface StatusFrame {
-  type: "status";
-  label: string;
-  description: string;
-  severity: "info" | "debug" | "error";
-  activity: "general" | "thinking" | "generating";
-  /**
-   * Whether work is in flight: the status bar shows its barberpole while
-   * set. The label says what the work is; there is no fraction on the wire.
-   */
-  busy: boolean;
-}
-
-/** One entry of the gateway's model catalog, as fetched or pushed. */
-export interface CatalogModel {
-  id: string;
-  description?: string;
-}
-
-/** A pushed model catalog, sent when the gateway comes back after an outage. */
-export interface ModelsFrame {
-  type: "models";
-  models: CatalogModel[];
-}
-
-/**
- * One pushed workbench snapshot: the server-owned Model-menu state.
- * Absent options are `null`, never omitted keys - every push is the
- * complete menu state. The server computes `chat_ready` (catalog
- * non-empty, a model selected, no switch in flight, gateway reachable);
- * the UI never derives it. `switching` names the target when it is a
- * profile; `switch_in_flight` is true for any in-flight target,
- * including no profile.
- */
-export interface WorkbenchFrame {
-  type: "workbench";
-  profiles: string[];
-  active: string | null;
-  /**
-   * The profile a switch is loading, or null both when no switch runs
-   * and when the in-flight switch selects no profile.
-   */
-  switching: string | null;
-  /** Whether a switch is in flight, whatever its target. */
-  switch_in_flight: boolean;
-  selected: string | null;
-  chat_ready: boolean;
-}
-
-/**
- * The client frame selecting the chat model:
- * `{"type":"select_model","model":"..."}`. The server validates the id
- * against the retained catalog and publishes a fresh workbench snapshot
- * on success; an unknown model is refused with an `error` frame.
- */
-export interface SelectModelFrame {
-  type: "select_model";
-  model: string;
-}
-
-/**
- * The client frame selecting a gateway profile:
- * `{"type":"switch_profile","name":"..."}`, with an explicit `null` name
- * selecting no profile. The key is required; an absent `name` is refused.
- */
-export interface SwitchProfileFrame {
-  type: "switch_profile";
-  name: string | null;
-}
-
-/**
- * A failure report answered to one inbound frame: `message` plus the
- * request's `id`, echoed verbatim when the request had one. The
- * agent-session socket also pushes id-less error frames for session-level
- * failures.
- */
-export interface ErrorFrame {
-  type: "error";
-  message: string;
-  id?: unknown;
-}
-
-// --- Agent-session frames (/agents/ws) --------------------------------------
-// The Rust half of this family is the session frame structs in
-// crates/workshop/server/src/agents/wire.rs, the operator's input frame in
-// crates/workshop/protocol/src/input.rs, and the routing in
-// crates/workshop/server/src/agents/socket.rs. Delivery classes mirror the Rust docs:
-// durable frames deliver exactly (the event log's per-client cursor and its
-// replay on attach are the repair path), ephemeral frames may drop under lag
-// and repair from a complete snapshot or a superseding durable event.
-
-/**
- * The kind of one agent event. `awaiting_input`: the agent waits for the
- * operator's message. `run_ended`: the run's end, after which it takes no
- * more messages. Follows the Agent Client Protocol `sessionUpdate`
- * names and mirrors `AgentEventKind` in workshop-server
- * (src/agents/wire.rs). Future kinds (`plan`, tool-status updates) may
- * arrive as labels outside this union, so renderers matching on kinds
- * tolerate unknown labels through a wildcard arm.
- */
-export type AgentEventKind =
-  | "agent_message"
-  | "tool_call"
-  | "tool_call_update"
-  | "agent_thought"
-  | "user_message"
-  | "awaiting_input"
-  | "run_ended";
-
-/** Token accounting for one model call, as the backend reported it. */
-export interface Usage {
-  prompt_tokens: number;
-  completion_tokens: number;
-  total_tokens: number;
-  cached_tokens?: number;
-  reasoning_tokens?: number;
-}
-
-/** llama.cpp `timings` for one call, as the server reported them. */
-export interface LlamaTimings {
-  prompt_n: number;
-  prompt_ms: number;
-  prompt_per_second: number;
-  predicted_n: number;
-  predicted_ms: number;
-  predicted_per_second: number;
-  draft_n: number;
-  draft_n_accepted: number;
-}
-
-/** vLLM per-request metrics; vLLM omits what it did not measure. */
-export interface VllmMetrics {
-  time_to_first_token_ms?: number;
-  generation_time_ms?: number;
-  queue_time_ms?: number;
-  mean_itl_ms?: number;
-  tokens_per_second?: number;
-}
-
-/** Timing one call end to end, measured by the calling client's clock. */
-export interface ClientTiming {
-  ttft_ms?: number;
-  mean_itl_ms?: number;
-  e2e_ms: number;
-}
-
-/** Everything measured about one model call, from every reporting source. */
-export interface CallMetrics {
-  usage?: Usage;
-  llama?: LlamaTimings;
-  vllm?: VllmMetrics;
-  client?: ClientTiming;
-}
-
-/**
- * One durable record of something that happened during an agent run,
- * mirroring `AgentEvent` in workshop-server (src/agents/wire.rs): the
- * Engine's content event projected onto the wire. `content` and every other
- * free-text field is untrusted model-, tool-, or user-authored data. Absent
- * optional fields are omitted keys on the wire, never `null`.
- */
-export interface AgentEvent {
-  kind: AgentEventKind;
-  /** The reporting scope: for agent sessions, the agent's name. */
-  section: string;
-  turn: number;
-  /** The kind-specific untrusted payload. */
-  content: string;
-  /** The producing model, on model-attributed kinds. */
-  model?: string;
-  /**
-   * The provider-issued tool-call id, on tool kinds. Providers recycle ids
-   * like `call_1` across rounds, so consumers scope the id by turn.
-   */
-  tool_call_id?: string;
-  finish_reason?: string;
-  metrics?: CallMetrics;
-}
-
-/**
- * The agent list pushed when an /agents/ws socket connects. Ephemeral:
- * every push is the complete discovered list, resent on every connect;
- * there is no incremental form to lose.
- */
-export interface AgentsFrame {
-  type: "agents";
-  agents: string[];
-}
-
-/**
- * The direct reply to a `launch` or `attach` frame. Durable: a per-request
- * reply sent by the loop that owns the socket. The client keeps the session
- * id to reattach after a disconnect - sessions outlive sockets.
- */
-export interface AgentSessionFrame {
-  type: "agent_session";
-  session: string;
-  agent: string;
-}
-
-/**
- * One durable entry of an agent session's event log. `index` is the
- * entry's position in the log; attach replays the log from index zero, so
- * a per-client cursor over `index` recovers everything past it and drops
- * duplicates. `reply` is present on the model-round content kinds
- * (`agent_thought`, `agent_message`, `tool_call`): the id that coalesces
- * the round's ephemeral deltas away.
- */
-export interface AgentEventFrame {
-  type: "agent_event";
-  index: number;
-  reply?: number;
-  event: AgentEvent;
-}
-
-/** Which streaming side channel one agent delta belongs to. */
-export type AgentDeltaKind = "text" | "reasoning";
-
-/**
- * One live streaming chunk of an agent's model round. Ephemeral: deltas
- * go out on a bounded broadcast and may drop under lag; the completed-reply
- * event is the repair path. Every delta is stamped with the `reply` id of
- * its round, the id the round's durable event carries, so the SPA
- * coalesces chunks by that id and replaces them when the event arrives
- * (the ACP messageId chunk-vs-upsert rule). A withdrawn round ends with no
- * superseding event; the `user_message` that withdrew it drops its chunks.
- */
-export interface AgentDeltaFrame {
-  type: "agent_delta";
-  kind: AgentDeltaKind;
-  content: string;
-  reply: number;
-}
-
-/** The client frame opening a session running the named agent. */
-export interface LaunchFrame {
-  type: "launch";
-  agent: string;
-}
-
-/** The client frame reattaching to a running session after a disconnect. */
-export interface AttachFrame {
-  type: "attach";
-  session: string;
-}
-
-/**
- * The operator's message, sent at any time. It answers the agent while
- * the agent waits, and steers the turn while it works; the text is
- * byte-exact as typed.
- */
-export interface InputResponseFrame {
-  type: "input_response";
-  text: string;
-}
-
-/**
- * The client frame firing the session's turn-cancel. Cancellation is a
- * stop reason, never an error: the server answers with nothing, and the
- * agent returns to its inbox. A message already queued there stays, so
- * the agent goes on with it; with none queued, the agent waits.
- */
-export interface AgentCancelFrame {
-  type: "cancel";
-}
-
-// --- Inbound frame guards ---------------------------------------------------
-// Each guard checks every field its type declares: required fields must be
-// present, and optional fields, when present, must hold their type (absent
-// optionals are omitted keys, never `null`). Extra fields pass, so a
-// frame may hold fields the UI does not read.
-
-type Check = (value: unknown) => boolean;
-type Guard<T> = (value: unknown) => value is T;
-type Checks<T> = { readonly [K in keyof T]-?: Check };
-
-const isString: Check = (value) => typeof value === "string";
-const isNumber: Check = (value) => typeof value === "number";
-const isBoolean: Check = (value) => typeof value === "boolean";
-const isAnything: Check = () => true;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function optional(check: Check): Check {
-  return (value) => value === undefined || check(value);
-}
-
-function nullable(check: Check): Check {
-  return (value) => value === null || check(value);
-}
-
-function oneOf(...labels: readonly string[]): Check {
-  return (value) => typeof value === "string" && labels.includes(value);
-}
-
-function arrayOf(check: Check): Check {
-  return (value) => Array.isArray(value) && value.every(check);
-}
-
-function shape<T>(checks: Checks<T>): Guard<T> {
-  const entries: [string, Check][] = Object.entries(checks);
-  return (value): value is T =>
-    isRecord(value) && entries.every(([key, check]) => check(value[key]));
-}
-
-function frame<T extends { type: string }>(
-  type: T["type"],
-  checks: Omit<Checks<T>, "type">,
-): Guard<T> {
-  return shape<T>({ ...checks, type: (value: unknown) => value === type } as Checks<T>);
-}
-
-const isCatalogModel = shape<CatalogModel>({ id: isString, description: optional(isString) });
-
-const isUsage = shape<Usage>({
-  prompt_tokens: isNumber,
-  completion_tokens: isNumber,
-  total_tokens: isNumber,
-  cached_tokens: optional(isNumber),
-  reasoning_tokens: optional(isNumber),
-});
-
-const isLlamaTimings = shape<LlamaTimings>({
-  prompt_n: isNumber,
-  prompt_ms: isNumber,
-  prompt_per_second: isNumber,
-  predicted_n: isNumber,
-  predicted_ms: isNumber,
-  predicted_per_second: isNumber,
-  draft_n: isNumber,
-  draft_n_accepted: isNumber,
-});
-
-const isVllmMetrics = shape<VllmMetrics>({
-  time_to_first_token_ms: optional(isNumber),
-  generation_time_ms: optional(isNumber),
-  queue_time_ms: optional(isNumber),
-  mean_itl_ms: optional(isNumber),
-  tokens_per_second: optional(isNumber),
-});
-
-const isClientTiming = shape<ClientTiming>({
-  ttft_ms: optional(isNumber),
-  mean_itl_ms: optional(isNumber),
-  e2e_ms: isNumber,
-});
-
-const isCallMetrics = shape<CallMetrics>({
-  usage: optional(isUsage),
-  llama: optional(isLlamaTimings),
-  vllm: optional(isVllmMetrics),
-  client: optional(isClientTiming),
-});
-
-// `kind` stays an open string: future event kinds arrive as labels outside
-// `AgentEventKind`, and renderers tolerate them.
-const isAgentEvent = shape<AgentEvent>({
-  kind: isString,
-  section: isString,
-  turn: isNumber,
-  content: isString,
-  model: optional(isString),
-  tool_call_id: optional(isString),
-  finish_reason: optional(isString),
-  metrics: optional(isCallMetrics),
-});
-
-/** Guards for the frames /ws delivers, keyed by `type`. */
-export const WORKSHOP_FRAME_GUARDS = {
-  status: frame<StatusFrame>("status", {
-    label: isString,
-    description: isString,
-    severity: oneOf("info", "debug", "error"),
-    activity: oneOf("general", "thinking", "generating"),
-    busy: isBoolean,
-  }),
-  models: frame<ModelsFrame>("models", { models: arrayOf(isCatalogModel) }),
-  workbench: frame<WorkbenchFrame>("workbench", {
-    profiles: arrayOf(isString),
-    active: nullable(isString),
-    switching: nullable(isString),
-    switch_in_flight: isBoolean,
-    selected: nullable(isString),
-    chat_ready: isBoolean,
-  }),
-};
-
-/** Guards for the frames /agents/ws delivers, keyed by `type`. */
-export const AGENT_FRAME_GUARDS = {
-  agents: frame<AgentsFrame>("agents", { agents: arrayOf(isString) }),
-  agent_session: frame<AgentSessionFrame>("agent_session", { session: isString, agent: isString }),
-  agent_event: frame<AgentEventFrame>("agent_event", {
-    index: isNumber,
-    reply: optional(isNumber),
-    event: isAgentEvent,
-  }),
-  agent_delta: frame<AgentDeltaFrame>("agent_delta", {
-    kind: oneOf("text", "reasoning"),
-    content: isString,
-    reply: isNumber,
-  }),
-  error: frame<ErrorFrame>("error", { message: isString, id: isAnything }),
-};
-
-type GuardedFrame<G> = { [K in keyof G]: G[K] extends Guard<infer T> ? T : never }[keyof G];
-
-/**
- * Narrows one parsed inbound frame through the guard its `type` selects.
- * A frame of a guarded type that fails its guard is dropped with one
- * console warning naming the type; a frame of any other type, or JSON that
- * is no frame at all, is dropped silently.
- */
-export function narrowFrame<G extends Record<string, Guard<{ type: string }>>>(
-  guards: G,
-  value: unknown,
-  socket: string,
-): GuardedFrame<G> | null {
-  if (!isRecord(value) || typeof value.type !== "string" || !Object.hasOwn(guards, value.type)) {
-    return null;
-  }
-  const guard = guards[value.type];
-  if (guard?.(value)) {
-    return value as GuardedFrame<G>;
-  }
-  console.warn(`${socket}: dropped a malformed ${value.type} frame`);
-  return null;
-}
diff --git a/crates/workshop/ui/src/services/quick-input-service.ts b/crates/workshop/ui/src/services/quick-input-service.ts
deleted file mode 100644
index 25a8e321b..000000000
--- a/crates/workshop/ui/src/services/quick-input-service.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-// The quick input service contract and its provider vocabulary. The
-// implementation (parts/quickinput/quick-input.ts) is a DOM widget - the
-// floating panel under the title bar - so it stays in parts; the row,
-// provider, and show-options shapes, the service interface, the token, and
-// the substring highlighter the providers share live here, in the DOM-free
-// services layer, so menu and quick-access contributions can name the
-// contract without pulling the widget chunk.
-
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/** A span of a row's label drawn as a filter match: `[start, end)` character offsets. */
-export interface LabelHighlight {
-  readonly start: number;
-  readonly end: number;
-}
-
-/**
- * The highlight a case-insensitive substring filter leaves on `text`: its
- * first occurrence. Answers undefined for an empty needle or no match, so a
- * row carries a highlight only when there is something to draw.
- */
-export function substringHighlights(text: string, needle: string): readonly LabelHighlight[] | undefined {
-  if (needle === "") {
-    return undefined;
-  }
-  const lowered = text.toLowerCase();
-  // A lowercase form of another length would shift every offset after it.
-  if (lowered.length !== text.length) {
-    return undefined;
-  }
-  const start = lowered.indexOf(needle.toLowerCase());
-  return start === -1 ? undefined : [{ start, end: start + needle.length }];
-}
-
-/** One row in the quick input list. */
-export interface QuickInputItem {
-  /** The row's primary text. */
-  readonly label: string;
-  /** Spans of the label drawn as filter matches. */
-  readonly labelHighlights?: readonly LabelHighlight[];
-  /** Secondary muted text, e.g. a path or a category. */
-  readonly description?: string;
-  /** The keybinding hint shown at the row's right edge, e.g. "Ctrl+Shift+P". */
-  readonly keybinding?: string;
-  /** A group label drawn above this row, e.g. "recently used". */
-  readonly separator?: string;
-  /** Runs the row's action. The panel has already closed. */
-  accept(): void;
-}
-
-/**
- * The provider shape the widget expects a descriptor's factory to
- * produce. The registry never calls the factory; this interface is the
- * widget's side of the contract.
- */
-export interface QuickAccessProvider {
-  /** The rows for `filter` (the input value minus the prefix). */
-  getItems(filter: string): readonly QuickInputItem[];
-  /** What the list says when getItems answers no rows; without it the list stays blank. */
-  readonly noResultsMessage?: string;
-  /**
-   * Sends the input to another mode: answers the value to put in the input
-   * in place of the current one, or undefined to stay. The help provider
-   * uses it so typing a mode's prefix after ? enters that mode.
-   */
-  redirect?(filter: string): string | undefined;
-}
-
-/** Options for one quick input showing. */
-export interface QuickInputShowOptions {
-  /**
-   * Render every provider's help entries above the active provider's
-   * rows while the input is empty - the modes list.
-   */
-  readonly includeHelp?: boolean;
-}
-
-/** The quick input service consumers resolve from the registry. */
-export interface QuickInputService {
-  /** The quick-access surface the menu actions and command center call. */
-  readonly quickAccess: {
-    show(value: string, options?: QuickInputShowOptions): void;
-  };
-}
-
-/** The service token the composition root registers the widget under. */
-export const QUICK_INPUT_SERVICE: ServiceToken<QuickInputService> =
-  createServiceToken<QuickInputService>("workshop.quickInput");
diff --git a/crates/workshop/ui/src/services/realtime-event-decoder.ts b/crates/workshop/ui/src/services/realtime-event-decoder.ts
deleted file mode 100644
index 7dda02fe7..000000000
--- a/crates/workshop/ui/src/services/realtime-event-decoder.ts
+++ /dev/null
@@ -1,397 +0,0 @@
-/** The include token that asks for hypothesis snapshot events. */
-export const HYPOTHESIS_INCLUDE = "item.input_audio_transcription.hypothesis";
-
-interface RealtimeAudioFormat {
-  readonly type: "audio/pcm";
-  readonly rate: 24000;
-}
-
-interface RealtimeTranscriptionConfiguration {
-  readonly model: "realtime-transcribe";
-  readonly prompt: string;
-}
-
-interface RealtimeEffectiveSession {
-  readonly id: string;
-  readonly object: "realtime.transcription_session";
-  readonly type: "transcription";
-  readonly audio: {
-    readonly input: {
-      readonly format: RealtimeAudioFormat;
-      readonly noise_reduction: null;
-      readonly transcription: RealtimeTranscriptionConfiguration;
-      readonly turn_detection: null;
-    };
-  };
-  readonly include: readonly [] | readonly [typeof HYPOTHESIS_INCLUDE];
-}
-
-interface RealtimeWireError {
-  readonly type: string;
-  readonly code: string;
-  readonly message: string;
-  readonly param?: string | null;
-  readonly event_id?: string | null;
-}
-
-interface RealtimeConversationItem {
-  readonly id: string;
-  readonly type: "message";
-  readonly status: "completed";
-  readonly role: "user";
-  readonly content: readonly [
-    {
-      readonly type: "input_audio";
-      readonly transcript: null;
-    },
-  ];
-}
-
-interface RealtimeDurationUsage {
-  readonly type: "duration";
-  readonly seconds: number;
-}
-
-/** A fully validated server event from the Realtime transcription wire. */
-export type RealtimeEvent =
-  | {
-      readonly type: "session.created";
-      readonly event_id: string;
-      readonly session: RealtimeEffectiveSession;
-    }
-  | {
-      readonly type: "session.updated";
-      readonly event_id: string;
-      readonly session: RealtimeEffectiveSession;
-    }
-  | {
-      readonly type: "input_audio_buffer.committed";
-      readonly event_id: string;
-      readonly item_id: string;
-      readonly previous_item_id: string | null;
-    }
-  | {
-      readonly type: "input_audio_buffer.cleared";
-      readonly event_id: string;
-    }
-  | {
-      readonly type: "conversation.item.created";
-      readonly event_id: string;
-      readonly previous_item_id: string | null;
-      readonly item: RealtimeConversationItem;
-    }
-  | {
-      readonly type: "conversation.item.input_audio_transcription.delta";
-      readonly event_id: string;
-      readonly item_id: string;
-      readonly content_index: 0;
-      readonly delta: string;
-    }
-  | {
-      readonly type: "conversation.item.input_audio_transcription.completed";
-      readonly event_id: string;
-      readonly item_id: string;
-      readonly content_index: 0;
-      readonly transcript: string;
-      readonly usage: RealtimeDurationUsage;
-    }
-  | {
-      readonly type: "conversation.item.input_audio_transcription.failed";
-      readonly event_id: string;
-      readonly item_id: string;
-      readonly content_index: 0;
-      readonly error: Omit<RealtimeWireError, "event_id">;
-    }
-  | {
-      readonly type: "conversation.item.input_audio_transcription.hypothesis";
-      readonly event_id: string;
-      readonly item_id: string;
-      readonly content_index: 0;
-      readonly revision: number;
-      readonly transcript: string;
-      readonly finalized: string;
-      readonly agreed: string;
-      readonly tentative: string;
-      readonly audio_start_ms: number;
-      readonly audio_end_ms: number;
-    }
-  | {
-      readonly type: "error";
-      readonly event_id: string;
-      readonly error: RealtimeWireError;
-    };
-
-function exactRecord(
-  value: unknown,
-  required: readonly string[],
-  optional: readonly string[] = [],
-): value is Record<string, unknown> {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const allowed = new Set([...required, ...optional]);
-  const keys = Reflect.ownKeys(value);
-  return (
-    required.every((field) => Object.hasOwn(value, field)) &&
-    keys.every((field) => typeof field === "string" && allowed.has(field))
-  );
-}
-
-function nonemptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
-}
-
-function nullableId(value: unknown): value is string | null {
-  return value === null || nonemptyString(value);
-}
-
-function unsignedSafeInteger(value: unknown): value is number {
-  return Number.isSafeInteger(value) && (value as number) >= 0;
-}
-
-function negotiableInclude(include: unknown): boolean {
-  if (!Array.isArray(include)) {
-    return false;
-  }
-  return (
-    include.length === 0 ||
-    (include.length === 1 && include[0] === HYPOTHESIS_INCLUDE)
-  );
-}
-
-function effectiveSession(value: unknown): value is RealtimeEffectiveSession {
-  if (
-    !exactRecord(value, ["id", "object", "type", "audio", "include"]) ||
-    !nonemptyString(value.id) ||
-    value.object !== "realtime.transcription_session" ||
-    value.type !== "transcription" ||
-    !negotiableInclude(value.include) ||
-    !exactRecord(value.audio, ["input"])
-  ) {
-    return false;
-  }
-  const input = value.audio.input;
-  if (
-    !exactRecord(input, [
-      "format",
-      "noise_reduction",
-      "transcription",
-      "turn_detection",
-    ]) ||
-    input.noise_reduction !== null ||
-    input.turn_detection !== null ||
-    !exactRecord(input.format, ["type", "rate"]) ||
-    input.format.type !== "audio/pcm" ||
-    input.format.rate !== 24000 ||
-    !exactRecord(input.transcription, ["model", "prompt"]) ||
-    input.transcription.model !== "realtime-transcribe" ||
-    typeof input.transcription.prompt !== "string"
-  ) {
-    return false;
-  }
-  return true;
-}
-
-function wireError(value: unknown, allowEventId: boolean): value is RealtimeWireError {
-  const optional = allowEventId ? ["param", "event_id"] : ["param"];
-  if (
-    !exactRecord(value, ["type", "code", "message"], optional) ||
-    !nonemptyString(value.type) ||
-    !nonemptyString(value.code) ||
-    !nonemptyString(value.message)
-  ) {
-    return false;
-  }
-  if (Object.hasOwn(value, "param") && !nullableId(value.param)) {
-    return false;
-  }
-  return !Object.hasOwn(value, "event_id") || nullableId(value.event_id);
-}
-
-function conversationItem(value: unknown): value is RealtimeConversationItem {
-  if (
-    !exactRecord(value, ["id", "type", "status", "role", "content"]) ||
-    !nonemptyString(value.id) ||
-    value.type !== "message" ||
-    value.status !== "completed" ||
-    value.role !== "user" ||
-    !Array.isArray(value.content) ||
-    value.content.length !== 1
-  ) {
-    return false;
-  }
-  const content = value.content[0];
-  return (
-    exactRecord(content, ["type", "transcript"]) &&
-    content.type === "input_audio" &&
-    content.transcript === null
-  );
-}
-
-function durationUsage(value: unknown): value is RealtimeDurationUsage {
-  return (
-    exactRecord(value, ["type", "seconds"]) &&
-    value.type === "duration" &&
-    typeof value.seconds === "number" &&
-    Number.isFinite(value.seconds) &&
-    value.seconds >= 0
-  );
-}
-
-function transcriptionBase(value: Record<string, unknown>, fields: readonly string[]): boolean {
-  return (
-    exactRecord(value, fields) &&
-    nonemptyString(value.event_id) &&
-    nonemptyString(value.item_id) &&
-    value.content_index === 0
-  );
-}
-
-/**
- * Validates an unknown Realtime server value without side effects.
- * Unsupported types and malformed event shapes return null.
- */
-export function decodeRealtimeEvent(value: unknown): RealtimeEvent | null {
-  if (
-    typeof value !== "object" ||
-    value === null ||
-    Array.isArray(value) ||
-    typeof (value as Record<string, unknown>).type !== "string"
-  ) {
-    return null;
-  }
-  const event = value as Record<string, unknown>;
-  switch (event.type) {
-    case "session.created":
-    case "session.updated":
-      if (
-        exactRecord(event, ["event_id", "type", "session"]) &&
-        nonemptyString(event.event_id) &&
-        effectiveSession(event.session)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "input_audio_buffer.committed":
-      if (
-        exactRecord(event, [
-          "event_id",
-          "type",
-          "item_id",
-          "previous_item_id",
-        ]) &&
-        nonemptyString(event.event_id) &&
-        nonemptyString(event.item_id) &&
-        nullableId(event.previous_item_id)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "input_audio_buffer.cleared":
-      if (
-        exactRecord(event, ["event_id", "type"]) &&
-        nonemptyString(event.event_id)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "conversation.item.created":
-      if (
-        exactRecord(event, [
-          "event_id",
-          "type",
-          "previous_item_id",
-          "item",
-        ]) &&
-        nonemptyString(event.event_id) &&
-        nullableId(event.previous_item_id) &&
-        conversationItem(event.item)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "conversation.item.input_audio_transcription.delta":
-      if (
-        transcriptionBase(event, [
-          "event_id",
-          "type",
-          "item_id",
-          "content_index",
-          "delta",
-        ]) &&
-        typeof event.delta === "string"
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "conversation.item.input_audio_transcription.completed":
-      if (
-        transcriptionBase(event, [
-          "event_id",
-          "type",
-          "item_id",
-          "content_index",
-          "transcript",
-          "usage",
-        ]) &&
-        typeof event.transcript === "string" &&
-        durationUsage(event.usage)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "conversation.item.input_audio_transcription.failed":
-      if (
-        transcriptionBase(event, [
-          "event_id",
-          "type",
-          "item_id",
-          "content_index",
-          "error",
-        ]) &&
-        wireError(event.error, false)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "conversation.item.input_audio_transcription.hypothesis":
-      if (
-        transcriptionBase(event, [
-          "event_id",
-          "type",
-          "item_id",
-          "content_index",
-          "revision",
-          "transcript",
-          "finalized",
-          "agreed",
-          "tentative",
-          "audio_start_ms",
-          "audio_end_ms",
-        ]) &&
-        unsignedSafeInteger(event.revision) &&
-        typeof event.transcript === "string" &&
-        typeof event.finalized === "string" &&
-        typeof event.agreed === "string" &&
-        typeof event.tentative === "string" &&
-        event.transcript === `${event.finalized}${event.agreed}${event.tentative}` &&
-        unsignedSafeInteger(event.audio_start_ms) &&
-        unsignedSafeInteger(event.audio_end_ms) &&
-        event.audio_start_ms <= event.audio_end_ms
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    case "error":
-      if (
-        exactRecord(event, ["event_id", "type", "error"]) &&
-        nonemptyString(event.event_id) &&
-        wireError(event.error, true)
-      ) {
-        return event as RealtimeEvent;
-      }
-      return null;
-    default:
-      return null;
-  }
-}
diff --git a/crates/workshop/ui/src/services/realtime-transcription.ts b/crates/workshop/ui/src/services/realtime-transcription.ts
deleted file mode 100644
index e9aaea9d1..000000000
--- a/crates/workshop/ui/src/services/realtime-transcription.ts
+++ /dev/null
@@ -1,342 +0,0 @@
-import { Emitter, type Event as ServiceEvent } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import {
-  decodeRealtimeEvent,
-  HYPOTHESIS_INCLUDE,
-  type RealtimeEvent,
-} from "./realtime-event-decoder";
-import { ReconnectBackoff } from "@workshop/platform/reconnect-backoff";
-
-/** Readiness of the browser's Realtime transcription connection. */
-export type RealtimeTranscriptionState = "connecting" | "ready" | "unavailable";
-
-/** One immutable WebSocket identity assigned in construction order. */
-export type RealtimeSocketGeneration = number;
-
-/** A connection-state change retaining its originating socket generation. */
-export interface RealtimeTranscriptionStateEvent {
-  readonly state: RealtimeTranscriptionState;
-  readonly generation: RealtimeSocketGeneration;
-}
-
-/** A decoded event retaining its originating socket generation. */
-export interface RealtimeTranscriptionEvent {
-  readonly event: RealtimeEvent;
-  readonly generation: RealtimeSocketGeneration;
-}
-
-/** A recoverable transport or server-event decoding failure. */
-export interface RealtimeTranscriptionError {
-  readonly code: string;
-  readonly scope: "connection" | "session";
-  readonly eventId: string | null;
-  readonly recoverable: true;
-  readonly generation: RealtimeSocketGeneration;
-}
-
-/** A client send result retaining the socket generation used for the attempt. */
-export interface RealtimeTranscriptionResult {
-  readonly generation: RealtimeSocketGeneration;
-  readonly eventId: string | null;
-}
-
-/** The WebSocket surface used by the DOM-free Realtime service. */
-export interface RealtimeSocket {
-  readonly readyState: number;
-  addEventListener?(
-    type: "open" | "message" | "error" | "close",
-    listener: (event: unknown) => void,
-    options?: AddEventListenerOptions,
-  ): void;
-  onmessage?: ((event: MessageEvent<unknown>) => void) | null;
-  onerror?: ((event: globalThis.Event) => void) | null;
-  onclose?: ((event: CloseEvent) => void) | null;
-  send(data: string): void;
-  close(): void;
-}
-
-/** Injectable construction options for Realtime transcription. */
-export interface RealtimeTranscriptionOptions {
-  readonly prompt?: string;
-  readonly eventId?: () => string;
-  readonly socket?: (url: string) => RealtimeSocket;
-}
-
-function defaultEventId(): string {
-  return `client_${crypto.randomUUID()}`;
-}
-
-function defaultSocket(url: string): RealtimeSocket {
-  return new WebSocket(url);
-}
-
-function socketUrl(): string {
-  if (typeof location === "undefined") {
-    return "ws://127.0.0.1/v1/realtime";
-  }
-  const scheme = location.protocol === "https:" ? "wss" : "ws";
-  return `${scheme}://${location.host}/v1/realtime`;
-}
-
-function base64(buffer: ArrayBuffer): string {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let offset = 0; offset < bytes.length; offset += 0x8000) {
-    binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
-  }
-  return btoa(binary);
-}
-
-/**
- * Owns one OpenAI-compatible Realtime transcription socket. It sends only
- * canonical client events and publishes only strictly decoded server events.
- */
-export class RealtimeTranscriptionService extends Disposable {
-  private readonly stateEmitter = this._register(new Emitter<RealtimeTranscriptionStateEvent>());
-  private readonly eventEmitter = this._register(new Emitter<RealtimeTranscriptionEvent>());
-  private readonly errorEmitter = this._register(new Emitter<RealtimeTranscriptionError>());
-  private socket: RealtimeSocket | null = null;
-  private disposed = false;
-  private negotiatedHypotheses = false;
-  private currentState: RealtimeTranscriptionState = "connecting";
-  private currentGeneration: RealtimeSocketGeneration = 0;
-  private readonly backoff = new ReconnectBackoff();
-
-  /** Fires when connection readiness changes. */
-  readonly onState: ServiceEvent<RealtimeTranscriptionStateEvent> = this.stateEmitter.event;
-  /** Fires each server event after strict decoding succeeds. */
-  readonly onEvent: ServiceEvent<RealtimeTranscriptionEvent> = this.eventEmitter.event;
-  /** Fires a recoverable transport or server-event decoding failure. */
-  readonly onError: ServiceEvent<RealtimeTranscriptionError> = this.errorEmitter.event;
-
-  constructor(private readonly options: RealtimeTranscriptionOptions = {}) {
-    super();
-    this.connect();
-  }
-
-  /** Current connection readiness. */
-  get state(): RealtimeTranscriptionState {
-    return this.currentState;
-  }
-
-  /** Generation of the current socket or most recent connection attempt. */
-  get generation(): RealtimeSocketGeneration {
-    return this.currentGeneration;
-  }
-
-  /** Opens a fresh relay connection after a recoverable outage. */
-  connect(): void {
-    if (this.disposed || this.socket !== null) {
-      return;
-    }
-    const generation = this.currentGeneration + 1;
-    this.setState("connecting", generation);
-    const socketFactory = this.options.socket ?? defaultSocket;
-    let socket: RealtimeSocket;
-    try {
-      socket = socketFactory(socketUrl());
-    } catch {
-      this.setState("unavailable", generation);
-      this.reportError("connection_failed", "connection", null, generation);
-      this.scheduleReconnect();
-      return;
-    }
-    this.socket = socket;
-    const onMessage = (event: MessageEvent<unknown>): void => {
-      if (this.socket === socket) {
-        this.handleMessage(event.data, generation);
-      }
-    };
-    const onError = (): void => {
-      if (this.socket === socket) {
-        this.socket = null;
-        this.resetConnectionState();
-        this.setState("unavailable", generation);
-        this.reportError("connection_failed", "connection", null, generation);
-        socket.close();
-        this.scheduleReconnect();
-      }
-    };
-    const onClose = (): void => {
-      if (this.socket !== socket) {
-        return;
-      }
-      this.socket = null;
-      this.resetConnectionState();
-      if (!this.disposed) {
-        this.setState("unavailable", generation);
-        this.reportError("connection_closed", "connection", null, generation);
-        this.scheduleReconnect();
-      }
-    };
-    if (socket.addEventListener !== undefined) {
-      socket.addEventListener("message", (event) => onMessage(event as MessageEvent<unknown>));
-      socket.addEventListener("error", onError);
-      socket.addEventListener("close", onClose);
-    } else {
-      socket.onmessage = onMessage;
-      socket.onerror = onError;
-      socket.onclose = onClose;
-    }
-  }
-
-  /** Appends one exact 24 kHz mono PCM16 block and returns its client event ID. */
-  append(audio: ArrayBuffer): RealtimeTranscriptionResult {
-    return this.sendClientEvent({
-      type: "input_audio_buffer.append",
-      audio: base64(audio),
-    });
-  }
-
-  /** Commits the current input buffer and returns its client event ID. */
-  commit(): RealtimeTranscriptionResult {
-    return this.sendClientEvent({ type: "input_audio_buffer.commit" });
-  }
-
-  /** Clears the current input buffer and returns its client event ID. */
-  clear(): RealtimeTranscriptionResult {
-    return this.sendClientEvent({ type: "input_audio_buffer.clear" });
-  }
-
-  override dispose(): void {
-    if (this.disposed) {
-      return;
-    }
-    this.disposed = true;
-    this.backoff.cancel();
-    const socket = this.socket;
-    this.socket = null;
-    socket?.close();
-    super.dispose();
-  }
-
-  private handleMessage(data: unknown, generation: RealtimeSocketGeneration): void {
-    if (typeof data !== "string") {
-      this.reportError("invalid_server_event", "session", null, generation);
-      return;
-    }
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(data);
-    } catch {
-      this.reportError("invalid_server_event", "session", null, generation);
-      return;
-    }
-    const event = decodeRealtimeEvent(parsed);
-    if (event === null) {
-      this.reportError("invalid_server_event", "session", null, generation);
-      return;
-    }
-    if (
-      event.type === "conversation.item.input_audio_transcription.delta" &&
-      this.negotiatedHypotheses
-    ) {
-      return;
-    }
-    this.eventEmitter.fire({ event, generation });
-
-    switch (event.type) {
-      case "session.created":
-        this.send({
-          type: "session.update",
-          session: {
-            type: "transcription",
-            audio: {
-              input: {
-                format: { type: "audio/pcm", rate: 24_000 },
-                noise_reduction: null,
-                transcription: {
-                  model: "realtime-transcribe",
-                  prompt: this.options.prompt ?? "",
-                },
-                turn_detection: null,
-              },
-            },
-            include: [HYPOTHESIS_INCLUDE],
-          },
-          event_id: (this.options.eventId ?? defaultEventId)(),
-        });
-        return;
-      case "session.updated":
-        this.negotiatedHypotheses = event.session.include[0] === HYPOTHESIS_INCLUDE;
-        this.backoff.reset();
-        this.setState("ready", generation);
-        return;
-      case "input_audio_buffer.committed":
-      case "input_audio_buffer.cleared":
-      case "conversation.item.created":
-      case "conversation.item.input_audio_transcription.hypothesis":
-      case "conversation.item.input_audio_transcription.delta":
-      case "conversation.item.input_audio_transcription.completed":
-      case "conversation.item.input_audio_transcription.failed":
-        return;
-      case "error":
-        return;
-      default: {
-        const exhaustive: never = event;
-        return exhaustive;
-      }
-    }
-  }
-
-  private sendClientEvent(event: Record<string, unknown>): RealtimeTranscriptionResult {
-    const eventId = (this.options.eventId ?? defaultEventId)();
-    return {
-      generation: this.currentGeneration,
-      eventId: this.send({ ...event, event_id: eventId }) ? eventId : null,
-    };
-  }
-
-  private send(event: Record<string, unknown>): boolean {
-    const socket = this.socket;
-    if (socket === null || socket.readyState !== 1) {
-      this.reportError("connection_unavailable");
-      return false;
-    }
-    try {
-      socket.send(JSON.stringify(event));
-      return true;
-    } catch {
-      this.reportError("connection_failed");
-      return false;
-    }
-  }
-
-  private setState(
-    state: RealtimeTranscriptionState,
-    generation: RealtimeSocketGeneration,
-  ): void {
-    if (this.currentState === state && this.currentGeneration === generation) {
-      return;
-    }
-    this.currentState = state;
-    this.currentGeneration = generation;
-    this.stateEmitter.fire({ state, generation });
-  }
-
-  private resetConnectionState(): void {
-    this.negotiatedHypotheses = false;
-  }
-
-  private scheduleReconnect(): void {
-    if (this.disposed || this.socket !== null) {
-      return;
-    }
-    this.backoff.schedule(() => this.connect());
-  }
-
-  private reportError(
-    code: string,
-    scope: RealtimeTranscriptionError["scope"] = "connection",
-    eventId: string | null = null,
-    generation: RealtimeSocketGeneration = this.currentGeneration,
-  ): void {
-    this.errorEmitter.fire({
-      code,
-      scope,
-      eventId,
-      recoverable: true,
-      generation,
-    });
-  }
-}
diff --git a/crates/workshop/ui/src/services/recent-files-store.ts b/crates/workshop/ui/src/services/recent-files-store.ts
deleted file mode 100644
index f97834f99..000000000
--- a/crates/workshop/ui/src/services/recent-files-store.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-// The recent-files store: the paths of the most recently opened files,
-// most-recent-first, seeded from the UI-state adapter's user bucket at
-// construction and written back through it on every change so the
-// File > Open Recent menu and the quick-access "" provider survive a
-// relaunch. The editor feature records every opened path; the workspace
-// contribution reads the list for its dynamic menu rows and clears it
-// from the Clear Recently Opened command.
-//
-// The initial value arrives as unknown and passes a hand-written shape
-// check - a malformed or hostile payload reads as an empty list, never
-// as a cast. The writer is fire-and-forget: a write that throws is
-// swallowed and the in-memory list stays authoritative.
-//
-// The service self-registers with a default factory (empty initial,
-// no-op writer), so any bundle that touches it gets a working singleton;
-// the composition root re-registers it bound to the live adapter before
-// the first consumer resolves it.
-//
-// Generic and DOM-free: the initial value and the writer are injected,
-// and nothing here may import from the app layers.
-
-import { Emitter } from "@workshop/platform/event";
-import type { Event } from "@workshop/platform/event";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { createServiceToken, registerService } from "@workshop/platform/service-registry";
-
-/** The most paths the store keeps; adding past the cap drops the oldest. */
-const MAX_ENTRIES = 50;
-
-/** The writer the store hands the whole path list to after each change. */
-export type RecentFilesWriter = (value: unknown) => void;
-
-/**
- * Narrows a persisted payload to a path list: it must be an array,
- * non-string and empty entries drop out, and duplicates collapse keeping
- * the first (most recent) occurrence. Anything else reads as no history.
- */
-function readEntries(initial: unknown): readonly string[] {
-  if (!Array.isArray(initial)) {
-    return [];
-  }
-  const entries: string[] = [];
-  for (const item of initial as readonly unknown[]) {
-    if (typeof item === "string" && item !== "" && !entries.includes(item)) {
-      entries.push(item);
-    }
-  }
-  return entries;
-}
-
-/**
- * The recent-files list. Mutations write through eagerly and fire
- * onDidChange; a writer failure leaves the in-memory list authoritative
- * for the rest of the page lifetime.
- */
-export class RecentFilesStore implements IDisposable {
-  private entries: readonly string[];
-  private readonly changeEmitter = new Emitter<void>();
-
-  /** Fires when the list changes; the Open Recent provider hooks it. */
-  readonly onDidChange: Event<void> = this.changeEmitter.event;
-
-  /**
-   * `initial` is the value the user bucket held at boot (any shape; see
-   * readEntries); `write` receives the whole list after each change.
-   */
-  constructor(
-    initial: unknown = null,
-    private readonly write: RecentFilesWriter = () => {},
-  ) {
-    this.entries = readEntries(initial);
-  }
-
-  /** The recorded paths, most recent first. */
-  get list(): readonly string[] {
-    return this.entries;
-  }
-
-  /**
-   * Records `path` as just opened: it moves to the front, a duplicate
-   * collapses, and the oldest entries drop past the cap. Empty paths are
-   * ignored.
-   */
-  add(path: string): void {
-    if (path === "") {
-      return;
-    }
-    this.entries = [path, ...this.entries.filter((entry) => entry !== path)].slice(0, MAX_ENTRIES);
-    this.persist();
-    this.changeEmitter.fire();
-  }
-
-  /** Empties the list and writes the empty state. */
-  clear(): void {
-    if (this.entries.length === 0) {
-      return;
-    }
-    this.entries = [];
-    this.persist();
-    this.changeEmitter.fire();
-  }
-
-  private persist(): void {
-    try {
-      this.write(this.entries);
-    } catch {
-      // The adapter reports its own failures; a throwing writer leaves
-      // the in-memory list authoritative.
-    }
-  }
-
-  dispose(): void {
-    this.changeEmitter.dispose();
-  }
-}
-
-/** The registry token for the recent-files singleton. */
-export const RECENT_FILES_STORE = createServiceToken<RecentFilesStore>("workshop.recentFiles");
-
-// Self-registration with an empty list and a no-op writer: a consumer
-// that resolves the token before the composition root re-registers it
-// bound to the live adapter gets a working, unpersisted list rather than
-// a wrong instance cached for the page lifetime.
-registerService(RECENT_FILES_STORE, () => new RecentFilesStore());
diff --git a/crates/workshop/ui/src/services/run-api.ts b/crates/workshop/ui/src/services/run-api.ts
deleted file mode 100644
index 814fa10d4..000000000
--- a/crates/workshop/ui/src/services/run-api.ts
+++ /dev/null
@@ -1,262 +0,0 @@
-// Validated HTTP boundary for the prompt-contract API. POST
-// /prompts/contract turns prompt markdown into the Run window's
-// contract DTO; every response arrives as unknown and is parsed field
-// by field into the narrow types below before any consumer touches it,
-// no casts. Failures throw typed CatalogError variants
-// (services/error-catalog.ts); a 422 parse failure surfaces the
-// server's parse_<kind> code and line-numbered message in the thrown
-// error's message. The fetch and JSON mechanics are the shared floor
-// in json-request.ts.
-
-import { CatalogError, ErrorCatalog } from "./error-catalog";
-import { errorCode, errorMessage, isRecord, readJson, request } from "./json-request";
-
-/** A declared input or output file. */
-export interface RunContractFile {
-  readonly path: string;
-  readonly description: string;
-}
-
-/** A declared Pack: its one-segment name, such as `web`. */
-export interface RunContractPack {
-  readonly id: string;
-}
-
-/** The declared arg types the wire format allows. */
-export type RunContractArgType = "string" | "boolean" | "integer" | "number";
-
-/** One declared arg. */
-export interface RunContractArg {
-  readonly name: string;
-  readonly type: RunContractArgType;
-  readonly optional: boolean;
-  /** The declared default; null when absent. */
-  readonly default: string | number | boolean | null;
-  /** The human-readable description; null when absent. */
-  readonly description: string | null;
-}
-
-/** The typed args declaration; implicit names the single prose field. */
-export interface RunContractArgs {
-  readonly implicit: boolean;
-  readonly fields: readonly RunContractArg[];
-}
-
-/** The requirements a prompt declares for one model role. */
-export interface RunContractModel {
-  /** The role name. */
-  readonly label: string;
-  /** The minimum context window in tokens; null when absent. */
-  readonly minContext: number | null;
-  /** The thinking requirement; null when absent. */
-  readonly thinking: boolean | null;
-}
-
-/** The Run-window contract: everything the panel renders. */
-export interface RunContract {
-  readonly name: string;
-  readonly description: string;
-  /** The Engine major the `runvil:` key declares; null when absent. */
-  readonly runvil: number | null;
-  /** The declared tool-loop cap; null for the runtime default. */
-  readonly maxToolIterations: number | null;
-  readonly input: RunContractFile | null;
-  readonly output: RunContractFile | null;
-  readonly uses: readonly RunContractPack[];
-  readonly args: RunContractArgs;
-  readonly models: readonly RunContractModel[];
-}
-
-function parseFile(value: unknown): RunContractFile | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { path, description } = value;
-  if (typeof path !== "string" || typeof description !== "string") {
-    return null;
-  }
-  return { path, description };
-}
-
-function parsePack(value: unknown): RunContractPack | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { id } = value;
-  if (typeof id !== "string") {
-    return null;
-  }
-  return { id };
-}
-
-const ARG_TYPES: readonly string[] = ["string", "boolean", "integer", "number"];
-
-function parseArg(value: unknown): RunContractArg | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { name, type, optional } = value;
-  if (typeof name !== "string" || typeof type !== "string" || !ARG_TYPES.includes(type)) {
-    return null;
-  }
-  if (typeof optional !== "boolean") {
-    return null;
-  }
-  const defaultValue = value.default;
-  if (
-    defaultValue !== null &&
-    typeof defaultValue !== "string" &&
-    typeof defaultValue !== "number" &&
-    typeof defaultValue !== "boolean"
-  ) {
-    return null;
-  }
-  const description = value.description;
-  if (description !== null && typeof description !== "string") {
-    return null;
-  }
-  return {
-    name,
-    type: type as RunContractArgType,
-    optional,
-    default: defaultValue,
-    description: description ?? null,
-  };
-}
-
-function parseArgs(value: unknown): RunContractArgs | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { implicit, fields } = value;
-  if (typeof implicit !== "boolean" || !Array.isArray(fields)) {
-    return null;
-  }
-  const parsed: RunContractArg[] = [];
-  for (const field of fields) {
-    const arg = parseArg(field);
-    if (arg === null) {
-      return null;
-    }
-    parsed.push(arg);
-  }
-  return { implicit, fields: parsed };
-}
-
-function parseModel(value: unknown): RunContractModel | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { label, min_context, thinking } = value;
-  if (typeof label !== "string") {
-    return null;
-  }
-  if (min_context !== null && typeof min_context !== "number") {
-    return null;
-  }
-  if (thinking !== null && typeof thinking !== "boolean") {
-    return null;
-  }
-  return {
-    label,
-    minContext: min_context ?? null,
-    thinking: thinking ?? null,
-  };
-}
-
-function parseContract(body: unknown): RunContract | null {
-  if (!isRecord(body)) {
-    return null;
-  }
-  const { name, description, runvil, max_tool_iterations, uses, models } = body;
-  if (typeof name !== "string" || typeof description !== "string") {
-    return null;
-  }
-  if (runvil !== null && typeof runvil !== "number") {
-    return null;
-  }
-  if (max_tool_iterations !== null && typeof max_tool_iterations !== "number") {
-    return null;
-  }
-  const input = body.input === null ? null : parseFile(body.input);
-  const output = body.output === null ? null : parseFile(body.output);
-  if (body.input !== null && input === null) {
-    return null;
-  }
-  if (body.output !== null && output === null) {
-    return null;
-  }
-  if (!Array.isArray(uses) || !Array.isArray(models)) {
-    return null;
-  }
-  const parsedPacks: RunContractPack[] = [];
-  for (const pack of uses) {
-    const parsed = parsePack(pack);
-    if (parsed === null) {
-      return null;
-    }
-    parsedPacks.push(parsed);
-  }
-  const args = parseArgs(body.args);
-  if (args === null) {
-    return null;
-  }
-  const parsedModels: RunContractModel[] = [];
-  for (const model of models) {
-    const parsed = parseModel(model);
-    if (parsed === null) {
-      return null;
-    }
-    parsedModels.push(parsed);
-  }
-  return {
-    name,
-    description,
-    runvil: runvil ?? null,
-    maxToolIterations: max_tool_iterations ?? null,
-    input,
-    output,
-    uses: parsedPacks,
-    args,
-    models: parsedModels,
-  };
-}
-
-/**
- * Throws the typed failure for one non-OK response. A 422 parse failure
- * reports the server's parse_<kind> code ahead of its line-numbered
- * message, so the panel's error row shows both.
- */
-function httpFailure(body: unknown, status: number, route: string): never {
-  const message = errorMessage(body, status, route);
-  const code = errorCode(body);
-  throw new CatalogError(ErrorCatalog.HttpStatus, code === null ? message : `[${code}] ${message}`, {
-    status,
-  });
-}
-
-/**
- * Parses prompt markdown into the Run window's contract. `name` is the
- * prompt's display name (the file's, when it came from one). Throws
- * typed CatalogError variants on transport, HTTP, and shape failures.
- */
-export async function fetchPromptContract(name: string, text: string): Promise<RunContract> {
-  const route = "/prompts/contract";
-  const response = await request(route, `POST ${route}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ name, text }),
-  });
-  const body = await readJson(response, `POST ${route}`);
-  if (!response.ok) {
-    httpFailure(body, response.status, `POST ${route}`);
-  }
-  const contract = parseContract(body);
-  if (contract === null) {
-    throw new CatalogError(
-      ErrorCatalog.UnexpectedShape,
-      `POST ${route} returned an unexpected shape`,
-    );
-  }
-  return contract;
-}
diff --git a/crates/workshop/ui/src/services/speech-capture.ts b/crates/workshop/ui/src/services/speech-capture.ts
deleted file mode 100644
index 22dc84f58..000000000
--- a/crates/workshop/ui/src/services/speech-capture.ts
+++ /dev/null
@@ -1,420 +0,0 @@
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import { errorText } from "./error-catalog";
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-import { chunkLevel } from "./speech-level";
-
-const OUTPUT_SAMPLE_RATE = 24_000;
-const FLUSH_TIMEOUT_MS = 1_000;
-
-/** A successful microphone lifecycle operation. */
-export type SpeechCaptureSuccess =
-  | { readonly ok: true; readonly kind: "started" }
-  | { readonly ok: true; readonly kind: "stopped" }
-  | { readonly ok: true; readonly kind: "cleared" };
-
-/**
- * A microphone failure that leaves capture available for another attempt.
- * `busy` means another owner token holds the microphone right now; the
- * caller's own retry succeeds once that owner's take ends.
- */
-export type SpeechCaptureFailure = {
-  readonly ok: false;
-  readonly kind:
-    | "permission-denied"
-    | "device-unavailable"
-    | "busy"
-    | "start-failed"
-    | "stop-failed"
-    | "clear-failed";
-  readonly message: string;
-  readonly recoverable: true;
-};
-
-/** The result of a capture lifecycle operation. */
-export type SpeechCaptureOutcome = SpeechCaptureSuccess | SpeechCaptureFailure;
-
-/** How the surface that owns the microphone is named and brought into view. */
-export interface SpeechCapturePresence {
-  /** The owner's display label, read on every call so a rename shows. */
-  label(): string;
-  /** Brings the owner's surface into view. */
-  reveal(): void;
-}
-
-/** One opened microphone graph owned by a capture service. */
-export interface SpeechCaptureSession {
-  /** Drops buffered audio without stopping capture. */
-  clear(): void;
-  /** Flushes buffered audio, then stops the graph. */
-  stop(): Promise<void>;
-  /** Immediately releases every graph resource. */
-  dispose(): void;
-}
-
-/** Injectable browser-audio boundary used by the DOM-free capture service. */
-export interface SpeechCaptureBackend {
-  /** Opens a 24 kHz mono PCM16 capture graph. */
-  open(emitAudio: (chunk: ArrayBuffer) => void): Promise<SpeechCaptureSession>;
-}
-
-type OpenFailureKind = "permission" | "device" | "start";
-
-interface OpenFailure {
-  readonly kind: OpenFailureKind;
-  readonly message: string;
-}
-
-function openFailure(kind: OpenFailureKind, error: unknown): OpenFailure {
-  return { kind, message: errorText(error) };
-}
-
-function classifyMediaFailure(error: unknown): OpenFailure {
-  const name =
-    typeof error === "object" && error !== null && typeof Reflect.get(error, "name") === "string"
-      ? (Reflect.get(error, "name") as string)
-      : "";
-  if (name === "NotAllowedError" || name === "SecurityError") {
-    return openFailure("permission", error);
-  }
-  return openFailure("device", error);
-}
-
-class BrowserSpeechCaptureSession implements SpeechCaptureSession {
-  private disposed = false;
-  private flush:
-    | {
-        readonly resolve: () => void;
-        readonly reject: (error: Error) => void;
-        readonly timer: ReturnType<typeof setTimeout>;
-      }
-    | null = null;
-
-  constructor(
-    private readonly context: AudioContext,
-    private readonly stream: MediaStream,
-    private readonly source: MediaStreamAudioSourceNode,
-    private readonly node: AudioWorkletNode,
-    emitAudio: (chunk: ArrayBuffer) => void,
-  ) {
-    this.node.port.onmessage = (event: MessageEvent<unknown>) => {
-      if (event.data instanceof ArrayBuffer) {
-        emitAudio(event.data);
-      } else if (
-        typeof event.data === "object" &&
-        event.data !== null &&
-        Reflect.get(event.data, "type") === "flushed"
-      ) {
-        this.finishFlush();
-      }
-    };
-  }
-
-  clear(): void {
-    if (!this.disposed) {
-      this.node.port.postMessage({ type: "clear" });
-    }
-  }
-
-  async stop(): Promise<void> {
-    if (this.disposed) {
-      return;
-    }
-    await new Promise<void>((resolve, reject) => {
-      const timer = setTimeout(() => {
-        this.flush = null;
-        reject(new Error("audio worklet flush timed out"));
-      }, FLUSH_TIMEOUT_MS);
-      this.flush = { resolve, reject, timer };
-      this.node.port.postMessage({ type: "flush" });
-    });
-    this.releaseGraph();
-    await this.context.close();
-  }
-
-  dispose(): void {
-    if (this.disposed) {
-      return;
-    }
-    this.cancelFlush();
-    this.releaseGraph();
-    // dispose() is synchronous, so context shutdown completes in the background.
-    void this.context.close().catch(() => {});
-  }
-
-  private finishFlush(): void {
-    const flush = this.flush;
-    if (flush === null) {
-      return;
-    }
-    this.flush = null;
-    clearTimeout(flush.timer);
-    flush.resolve();
-  }
-
-  private cancelFlush(): void {
-    const flush = this.flush;
-    if (flush === null) {
-      return;
-    }
-    this.flush = null;
-    clearTimeout(flush.timer);
-    flush.reject(new Error("speech capture was disposed while flushing"));
-  }
-
-  private releaseGraph(): void {
-    if (this.disposed) {
-      return;
-    }
-    this.disposed = true;
-    this.node.port.onmessage = null;
-    this.source.disconnect();
-    this.node.disconnect();
-    for (const track of this.stream.getTracks()) {
-      track.stop();
-    }
-  }
-}
-
-function browserBackend(): SpeechCaptureBackend {
-  return {
-    async open(emitAudio): Promise<SpeechCaptureSession> {
-      if (
-        typeof navigator === "undefined" ||
-        !navigator.mediaDevices?.getUserMedia ||
-        typeof AudioContext === "undefined" ||
-        typeof AudioWorkletNode === "undefined"
-      ) {
-        throw openFailure("device", new Error("microphone capture is unavailable"));
-      }
-
-      let stream: MediaStream;
-      try {
-        stream = await navigator.mediaDevices.getUserMedia({
-          audio: {
-            channelCount: 1,
-            sampleRate: OUTPUT_SAMPLE_RATE,
-            echoCancellation: true,
-            noiseSuppression: true,
-          },
-        });
-      } catch (error) {
-        throw classifyMediaFailure(error);
-      }
-
-      let context: AudioContext | null = null;
-      let source: MediaStreamAudioSourceNode | null = null;
-      let node: AudioWorkletNode | null = null;
-      try {
-        context = new AudioContext({ sampleRate: OUTPUT_SAMPLE_RATE });
-        if (context.sampleRate !== OUTPUT_SAMPLE_RATE) {
-          throw new Error(
-            `browser opened audio at ${context.sampleRate} Hz instead of ${OUTPUT_SAMPLE_RATE} Hz`,
-          );
-        }
-        await context.audioWorklet.addModule("/pcm-worklet.js");
-        source = context.createMediaStreamSource(stream);
-        node = new AudioWorkletNode(context, "pcm16-capture");
-        const session = new BrowserSpeechCaptureSession(
-          context,
-          stream,
-          source,
-          node,
-          emitAudio,
-        );
-        source.connect(node);
-        node.connect(context.destination);
-        await context.resume();
-        return session;
-      } catch (error) {
-        node?.disconnect();
-        source?.disconnect();
-        for (const track of stream.getTracks()) {
-          track.stop();
-        }
-        if (context !== null) {
-          // Preserve the graph-start error even when best-effort cleanup also fails.
-          await context.close().catch(() => {});
-        }
-        throw openFailure("start", error);
-      }
-    },
-  };
-}
-
-function failure(kind: SpeechCaptureFailure["kind"], error: unknown): SpeechCaptureFailure {
-  return { ok: false, kind, message: errorText(error), recoverable: true };
-}
-
-function startFailure(error: unknown): SpeechCaptureFailure {
-  const kind =
-    typeof error === "object" && error !== null ? Reflect.get(error, "kind") : undefined;
-  if (kind === "permission") {
-    return failure("permission-denied", error);
-  }
-  if (kind === "device") {
-    return failure("device-unavailable", error);
-  }
-  return failure("start-failed", error);
-}
-
-/**
- * Owns browser microphone capture without touching the DOM. Audio and every
- * lifecycle failure are values so a view can recover without rebuilding it.
- *
- * One service is shared by every dictation surface in a window, so the
- * microphone has an owner: the opaque token handed to the `start()` that
- * opened it. Only that token can stop or clear the take; any other token's
- * start is refused with `busy`, and its stop and clear are no-op successes.
- * Ownership is held from a successful start through the end of its stop
- * (the flush still belongs to the owner), then released. The owner's
- * presence is held and released with it.
- */
-export class SpeechCaptureService extends Disposable {
-  private readonly audio = this._register(new Emitter<ArrayBuffer>());
-  private readonly level = this._register(new Emitter<number>());
-  private readonly ownerChange = this._register(new Emitter<symbol | null>());
-  private session: SpeechCaptureSession | null = null;
-  private phase: "idle" | "starting" | "recording" | "stopping" = "idle";
-  private currentOwner: symbol | null = null;
-  private currentPresence: SpeechCapturePresence | null = null;
-  private disposed = false;
-
-  /** Fires for each owned little-endian mono PCM16 block at 24 kHz. */
-  readonly onAudio: Event<ArrayBuffer> = this.audio.event;
-
-  /** Fires once per `onAudio` block with its loudness from 0 to 1. */
-  readonly onLevel: Event<number> = this.level.event;
-
-  /**
-   * Fires with the new owner when the microphone is taken, `null` when
-   * released; `presence` already matches it.
-   */
-  readonly onOwnerChange: Event<symbol | null> = this.ownerChange.event;
-
-  constructor(private readonly backend: SpeechCaptureBackend = browserBackend()) {
-    super();
-  }
-
-  /** Whether a microphone graph is currently recording. */
-  get recording(): boolean {
-    return this.phase === "recording";
-  }
-
-  /** The token whose start opened the live take, or `null` when free. */
-  get owner(): symbol | null {
-    return this.currentOwner;
-  }
-
-  /** The presence the owner's start supplied, or `null` when free. */
-  get presence(): SpeechCapturePresence | null {
-    return this.currentPresence;
-  }
-
-  /**
-   * Opens capture for `owner`, returning a recoverable outcome instead of
-   * throwing. `busy` when another owner holds the microphone; the existing
-   * `start-failed` for a same-owner double start or a start while the
-   * graph is still opening or closing, whoever asks: the owner keeps the
-   * flush, but the closing window is a transient, not another window's take.
-   * Only a successful start records `presence`.
-   */
-  async start(owner: symbol, presence: SpeechCapturePresence): Promise<SpeechCaptureOutcome> {
-    if (this.phase === "recording" && this.currentOwner !== owner) {
-      return failure("busy", new Error("speech capture is held by another owner"));
-    }
-    if (this.disposed || this.phase !== "idle") {
-      return failure("start-failed", new Error("speech capture is already active"));
-    }
-    this.phase = "starting";
-    try {
-      const session = await this.backend.open((chunk) => {
-        this.audio.fire(chunk);
-        this.level.fire(chunkLevel(chunk));
-      });
-      if (this.disposed) {
-        session.dispose();
-        return failure("start-failed", new Error("speech capture was disposed while starting"));
-      }
-      this.session = session;
-      this.phase = "recording";
-      this.setOwner(owner, presence);
-      return { ok: true, kind: "started" };
-    } catch (error) {
-      this.phase = "idle";
-      return startFailure(error);
-    }
-  }
-
-  /**
-   * Flushes and closes the owner's capture, returning any close failure as
-   * recoverable. A non-owner's stop is a no-op success: the take runs on.
-   */
-  async stop(owner: symbol): Promise<SpeechCaptureOutcome> {
-    const session = this.session;
-    if (session === null || this.currentOwner !== owner) {
-      return { ok: true, kind: "stopped" };
-    }
-    this.phase = "stopping";
-    try {
-      await session.stop();
-      return { ok: true, kind: "stopped" };
-    } catch (error) {
-      return failure("stop-failed", error);
-    } finally {
-      session.dispose();
-      if (this.session === session) {
-        this.session = null;
-      }
-      this.phase = "idle";
-      this.setOwner(null, null);
-    }
-  }
-
-  /**
-   * Drops buffered worklet audio while leaving the owner's microphone open.
-   * A non-owner's clear is a no-op success.
-   */
-  clear(owner: symbol): SpeechCaptureOutcome {
-    if (this.currentOwner !== owner) {
-      return { ok: true, kind: "cleared" };
-    }
-    try {
-      this.session?.clear();
-      return { ok: true, kind: "cleared" };
-    } catch (error) {
-      return failure("clear-failed", error);
-    }
-  }
-
-  override dispose(): void {
-    if (this.disposed) {
-      return;
-    }
-    this.disposed = true;
-    this.session?.dispose();
-    this.session = null;
-    this.phase = "idle";
-    this.setOwner(null, null);
-    super.dispose();
-  }
-
-  private setOwner(owner: symbol | null, presence: SpeechCapturePresence | null): void {
-    if (this.currentOwner === owner) {
-      return;
-    }
-    this.currentOwner = owner;
-    this.currentPresence = presence;
-    this.ownerChange.fire(owner);
-  }
-}
-
-/**
- * The registry token for the composition root's SpeechCaptureService.
- * The agent session's dictation resolves it through the service registry
- * instead of the dock's createComponent seam. Registered by the
- * composition root at boot; unregistered in tests that drive panels
- * standalone.
- */
-export const SPEECH_CAPTURE: ServiceToken<SpeechCaptureService> =
-  createServiceToken<SpeechCaptureService>("workshop.speechCapture");
diff --git a/crates/workshop/ui/src/services/speech-level.ts b/crates/workshop/ui/src/services/speech-level.ts
deleted file mode 100644
index de5f83b22..000000000
--- a/crates/workshop/ui/src/services/speech-level.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/** The loudness, in dBFS, that reads 0; quieter chunks clamp to it. */
-const FLOOR_DBFS = -60;
-/** The loudness, in dBFS, that reads 1: full scale. */
-const CEILING_DBFS = 0;
-const FULL_SCALE = 32_768;
-
-/**
- * One capture chunk's loudness for a level meter: the RMS of its
- * little-endian PCM16 samples in dBFS, mapped linearly from FLOOR_DBFS to
- * CEILING_DBFS onto 0 to 1 and clamped. A trailing odd byte is ignored,
- * and an empty or silent chunk reads 0.
- */
-export function chunkLevel(pcm16: ArrayBuffer): number {
-  const view = new DataView(pcm16);
-  const samples = Math.floor(pcm16.byteLength / 2);
-  let sum = 0;
-  for (let index = 0; index < samples; index++) {
-    const sample = view.getInt16(index * 2, true) / FULL_SCALE;
-    sum += sample * sample;
-  }
-  if (sum === 0) {
-    return 0;
-  }
-  const dbfs = 10 * Math.log10(sum / samples);
-  return Math.min(1, Math.max(0, (dbfs - FLOOR_DBFS) / (CEILING_DBFS - FLOOR_DBFS)));
-}
diff --git a/crates/workshop/ui/src/services/stt-status.ts b/crates/workshop/ui/src/services/stt-status.ts
deleted file mode 100644
index 4bd2ae71e..000000000
--- a/crates/workshop/ui/src/services/stt-status.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-// Dictation's status port: where a take reports what the user should see.
-// The composition root builds it over the status bar and the recording
-// indicator it owns, and registers it before the layout boots, so every
-// agent panel - restored, seeded, or opened later - resolves the live port.
-
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/**
- * The slice dictation paints: local messages (blockers, capture failures,
- * an empty take) and the recording LED. Tests hand in a recording fake.
- */
-export interface SttStatus {
-  showLocal(label: string, severity: "info" | "error"): void;
-  setRecording(on: boolean): void;
-}
-
-/**
- * The registry token for dictation's status port. Unregistered in tests
- * that drive panels standalone, where the panels stay silent.
- */
-export const STT_STATUS: ServiceToken<SttStatus> = createServiceToken<SttStatus>("workshop.sttStatus");
diff --git a/crates/workshop/ui/src/services/toast-service.ts b/crates/workshop/ui/src/services/toast-service.ts
deleted file mode 100644
index 36f9d7dc3..000000000
--- a/crates/workshop/ui/src/services/toast-service.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-// The toast stack's service token. The composition root builds the one
-// shared stack (main.ts) and registers it here, so a view that raises a
-// toast - the agent transcript's "Message copied to clipboard", the
-// status bar, a failed command - resolves it through the service registry
-// instead of importing the app. Unregistered in tests that drive a panel
-// standalone, where the caller stays silent.
-
-import type { ToastStack } from "@workshop/look/toast";
-import { createServiceToken, type ServiceToken } from "@workshop/platform/service-registry";
-
-/** The registry token for the shared toast stack. */
-export const TOAST_STACK: ServiceToken<ToastStack> =
-  createServiceToken<ToastStack>("workshop.toastStack");
diff --git a/crates/workshop/ui/src/services/tree-state-service.ts b/crates/workshop/ui/src/services/tree-state-service.ts
deleted file mode 100644
index 40a57f64b..000000000
--- a/crates/workshop/ui/src/services/tree-state-service.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-// The tree-state service: the Workshop file tree's expanded directory
-// paths and the listings already fetched from /workspace/tree. The
-// expansion belongs to the workspace: it seeds from the workspace
-// bucket's "tree" value at construction and writes the same shape,
-// `{ "expanded": [...] }`, back through a debounced writer on every
-// change, so the folders the user left open come back on relaunch. The
-// listing cache is session-only - a restored folder has no listing until
-// the tree panel fetches one on render. The granted-roots listing is the
-// exception: roots() loads it here, once, so the tree panel and the
-// window title share a single GET /workspace/tree per boot and per
-// workspace change instead of each fetching their own.
-//
-// The initial value arrives as unknown and passes a hand-written shape
-// check - a malformed or hostile payload reads as nothing expanded, never
-// as a cast. The writer is fire-and-forget: a write that throws is
-// swallowed and the in-memory set stays authoritative.
-//
-// The service self-registers with a default factory (nothing expanded,
-// no-op writer), so any bundle that touches it gets a working singleton;
-// the composition root re-registers it bound to the live adapter before
-// the first consumer resolves it. The composition root also has the
-// service follow the workspace-changed event (followWorkspaceChanges),
-// so the roots listing is dropped on every grant change whether or not
-// the tree panel is open: the window title and the editor watermark read
-// the same listing and have no panel to do it for them.
-//
-// Generic and DOM-free: the initial value, the writer, and the event
-// target are injected, and nothing here may import from the app layers.
-
-import { Emitter } from "@workshop/platform/event";
-import type { Event } from "@workshop/platform/event";
-import { toDisposable, type IDisposable } from "@workshop/platform/lifecycle";
-import { createServiceToken, registerService } from "@workshop/platform/service-registry";
-import { fetchTree, type TreeListing } from "./workspace-api";
-import { rootsCurrentIn, WORKSPACE_CHANGED_EVENT } from "./workspace-events";
-
-/** Cache key for the synthetic granted-roots listing, which has no path. */
-export const ROOTS_KEY = "";
-
-/** The roots fetch roots() runs; tests inject a counting one. */
-export type RootsFetch = (path: null) => Promise<TreeListing>;
-
-// Matches the layout saver: a click-through of several folders lands as
-// one write.
-const SAVE_DEBOUNCE_MS = 250;
-
-/** The writer the service hands `{ expanded: [...] }` to after a change. */
-export type TreeStateWriter = (value: unknown) => void;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/**
- * Narrows a path list: non-string and empty entries drop out, duplicates
- * collapse. Shared by the persisted shape and replaceExpanded.
- */
-function readPaths(value: unknown): Set<string> {
-  const paths = new Set<string>();
-  if (!Array.isArray(value)) {
-    return paths;
-  }
-  for (const item of value as readonly unknown[]) {
-    if (typeof item === "string" && item !== "") {
-      paths.add(item);
-    }
-  }
-  return paths;
-}
-
-/**
- * Narrows the persisted payload to the expanded set: it must be an object
- * with an `expanded` array. Anything else reads as nothing expanded.
- */
-function readExpanded(initial: unknown): Set<string> {
-  return isRecord(initial) ? readPaths(initial.expanded) : new Set();
-}
-
-/**
- * The Workshop tree's expansion and listing state. The synthetic
- * granted-roots listing has no path; it caches under the empty-string
- * key, roots() loads it once for every consumer (a second caller during
- * the load joins the same promise), and invalidateRoots drops exactly
- * that entry, plus any load in flight, when the workspace grants change.
- */
-export class TreeStateService implements IDisposable {
-  private expanded: Set<string>;
-  private readonly listingCache = new Map<string, TreeListing>();
-  // The roots load consumers are waiting on, while the cache is empty.
-  private rootsInFlight: Promise<TreeListing> | null = null;
-  private timer: ReturnType<typeof setTimeout> | null = null;
-  private readonly changeEmitter = new Emitter<void>();
-
-  /**
-   * Fires when the whole expanded set is replaced (a workspace switch);
-   * the tree panel re-renders from it. Interactive expand and collapse
-   * do not fire: the panel that made the change already painted it.
-   */
-  readonly onDidChange: Event<void> = this.changeEmitter.event;
-
-  /**
-   * `initial` is the value the workspace bucket held at boot (any shape;
-   * see readExpanded); `write` receives `{ expanded: [...] }` after each
-   * change, debounced.
-   */
-  constructor(
-    initial: unknown = null,
-    private readonly write: TreeStateWriter = () => {},
-  ) {
-    this.expanded = readExpanded(initial);
-  }
-
-  /** The live expanded set, read-only; Save As snapshots it. */
-  get expandedPaths(): ReadonlySet<string> {
-    return this.expanded;
-  }
-
-  /** Whether a directory row renders expanded. */
-  isExpanded(path: string): boolean {
-    return this.expanded.has(path);
-  }
-
-  /** Marks a directory expanded. */
-  expand(path: string): void {
-    if (this.expanded.has(path)) {
-      return;
-    }
-    this.expanded.add(path);
-    this.scheduleWrite();
-  }
-
-  /** Marks a directory collapsed. */
-  collapse(path: string): void {
-    if (!this.expanded.delete(path)) {
-      return;
-    }
-    this.scheduleWrite();
-  }
-
-  /**
-   * Replaces the expanded set wholesale with a workspace's stored value
-   * (Open Workspace from File) and fires onDidChange. Writes nothing: the
-   * paths came from the file, and a write armed by an earlier interactive
-   * change is canceled so the previous workspace's set never lands in
-   * the newly opened file.
-   */
-  replaceExpanded(paths: readonly string[]): void {
-    this.cancelWrite();
-    this.expanded = readPaths(paths);
-    this.changeEmitter.fire();
-  }
-
-  /** The cached listing for a path, if one was fetched this session. */
-  listing(path: string): TreeListing | undefined {
-    return this.listingCache.get(path);
-  }
-
-  /** Every listing fetched this session; the quick-open file provider reads them. */
-  cachedListings(): readonly TreeListing[] {
-    return [...this.listingCache.values()];
-  }
-
-  /** Caches one fetched listing. */
-  cacheListing(path: string, listing: TreeListing): void {
-    this.listingCache.set(path, listing);
-  }
-
-  /**
-   * The granted roots: the cached listing when present, else the load
-   * already in flight, else a new one. Every consumer that needs the roots
-   * (the tree panel, the window title) reads them here so a boot or a
-   * workspace change costs one GET /workspace/tree. A successful load
-   * caches only if no invalidateRoots ran while it was in flight; a stale
-   * load still resolves for its own caller but never lands in the cache.
-   * A rejected load clears the slot so the next call retries. `fetch`
-   * defaults to the workspace API; tests inject a counting one.
-   */
-  roots(fetch: RootsFetch = fetchTree): Promise<TreeListing> {
-    const cached = this.listingCache.get(ROOTS_KEY);
-    if (cached !== undefined) {
-      return Promise.resolve(cached);
-    }
-    if (this.rootsInFlight !== null) {
-      return this.rootsInFlight;
-    }
-    const load: Promise<TreeListing> = fetch(null).then(
-      (listing) => {
-        if (this.rootsInFlight === load) {
-          this.listingCache.set(ROOTS_KEY, listing);
-          this.rootsInFlight = null;
-        }
-        return listing;
-      },
-      (error: unknown) => {
-        if (this.rootsInFlight === load) {
-          this.rootsInFlight = null;
-        }
-        throw error;
-      },
-    );
-    this.rootsInFlight = load;
-    return load;
-  }
-
-  /**
-   * Drops the synthetic roots listing after the workspace grants changed
-   * (a drop, an Add/Remove Folder, an Open), so the next roots() fetches
-   * again. A load in flight is dropped too: it started against the old
-   * grants, so it neither caches nor answers later callers. Directory
-   * listings survive: the folders themselves did not change.
-   */
-  invalidateRoots(): void {
-    this.listingCache.delete(ROOTS_KEY);
-    this.rootsInFlight = null;
-  }
-
-  /**
-   * Drops the roots listing on every workspace-changed event `target`
-   * receives, so the next reader (the tree panel, the window title, the
-   * editor watermark) fetches the new grants. An event whose detail says
-   * the roots are already current (`rootsCurrent`: Open Workspace from
-   * File invalidated them itself and a load is under way, Save As kept
-   * the grants) is left alone, so a switch still fetches once. The
-   * composition root installs this once, ahead of every reader, so it
-   * needs no panel to be alive and a reader running on the same event
-   * reads the fresh listing. The returned handle stops following.
-   */
-  followWorkspaceChanges(target: EventTarget): IDisposable {
-    const onChanged: EventListener = (event) => {
-      if (!rootsCurrentIn(event)) {
-        this.invalidateRoots();
-      }
-    };
-    target.addEventListener(WORKSPACE_CHANGED_EVENT, onChanged);
-    return toDisposable(() => target.removeEventListener(WORKSPACE_CHANGED_EVENT, onChanged));
-  }
-
-  private scheduleWrite(): void {
-    this.cancelWrite();
-    this.timer = setTimeout(() => {
-      this.timer = null;
-      try {
-        this.write({ expanded: [...this.expanded] });
-      } catch {
-        // The adapter reports its own failures; a throwing writer leaves
-        // the in-memory set authoritative.
-      }
-    }, SAVE_DEBOUNCE_MS);
-  }
-
-  private cancelWrite(): void {
-    if (this.timer !== null) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-  }
-
-  /** Drops the state and any armed write; a disposed service persists nothing. */
-  dispose(): void {
-    this.cancelWrite();
-    this.expanded = new Set();
-    this.listingCache.clear();
-    this.rootsInFlight = null;
-    this.changeEmitter.dispose();
-  }
-}
-
-/** The registry token for the tree-state singleton. */
-export const TREE_STATE = createServiceToken<TreeStateService>("workshop.treeState");
-
-// Self-registration with nothing expanded and a no-op writer: a consumer
-// that resolves the token before the composition root re-registers it
-// bound to the live adapter gets a working, unpersisted tree state rather
-// than a wrong instance cached for the page lifetime.
-registerService(TREE_STATE, () => new TreeStateService());
diff --git a/crates/workshop/ui/src/services/ui-storage.ts b/crates/workshop/ui/src/services/ui-storage.ts
deleted file mode 100644
index 15d578429..000000000
--- a/crates/workshop/ui/src/services/ui-storage.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-// The UI-state adapter: browser storage over HTTP. The desktop app binds the
-// server to an OS-assigned loopback port, so the page origin - and with it
-// every origin-scoped storage entry - changes on each launch. This module
-// replaces that storage with two server-backed buckets of opaque JSON
-// values: the "workspace" bucket lives in the open .rvwork file (GET and
-// PUT under /workspace/file/state), the "user" bucket in the per-user
-// ui-state.json (GET and PUT under /user/state). The composition root
-// preloads both once before any store is built; stores then read
-// synchronously from the cache and write through `set`. Values are opaque
-// to this module and to the server: each store owns its own shape,
-// versioning, and validation.
-//
-// Failure posture is degradation, never blocking: a bucket that fails or
-// hangs past the preload timeout reads as all-null (every store falls
-// back to its defaults) with one console warning; a failed write warns
-// once and the in-memory value stands. `suppressWrites` exists for the
-// moment a pulled workspace bucket is applied on Open, when a store's
-// synchronous reaction would otherwise echo the same values straight back
-// to the file; it covers only the synchronous span of the callback.
-//
-// Stores never import fetch; they take the adapter (or a fake) and tests
-// inject `fetchImpl` here.
-
-import { errorText } from "./error-catalog";
-import { isRecord } from "./json-request";
-import { createServiceToken, registerService } from "@workshop/platform/service-registry";
-
-/** Which bucket a value belongs to: the user, or the open workspace file. */
-export type Bucket = "user" | "workspace";
-
-/** The SPA's key-value storage over the two server buckets. */
-export interface UiStorage {
-  /**
-   * Fetches both buckets in parallel, each raced against `timeoutMs`, and
-   * caches the results. A bucket that fails or times out caches as empty
-   * with one warning. Always resolves; never rejects.
-   */
-  preload(timeoutMs: number): Promise<void>;
-  /** The cached value for `key`, or null when absent, null, or never loaded. */
-  get(bucket: Bucket, key: string): unknown;
-  /**
-   * Caches `value` and PUTs it to the bucket's route. Fire-and-forget: a
-   * failed write warns once and never throws. Workspace-bucket writes are
-   * dropped while `suppressWrites` is active.
-   */
-  set(bucket: Bucket, key: string, value: unknown): void;
-  /** Re-fetches the workspace bucket, replacing its cached values. */
-  reloadWorkspace(): Promise<void>;
-  /**
-   * Runs `fn` with workspace-bucket `set` turned into a no-op, for applying
-   * a pulled layout without echoing it back. Nesting is safe; suppression
-   * lifts when the outermost call returns or throws.
-   */
-  suppressWrites<T>(fn: () => T): T;
-}
-
-const ROUTES: Readonly<Record<Bucket, string>> = {
-  user: "/user/state",
-  workspace: "/workspace/file/state",
-};
-
-/** Resolves to `null` after `ms`; the loser of a race against a fetch. */
-function timeout(ms: number): { promise: Promise<null>; cancel: () => void } {
-  let handle: ReturnType<typeof setTimeout> | undefined;
-  const promise = new Promise<null>((resolve) => {
-    handle = setTimeout(() => resolve(null), ms);
-  });
-  return {
-    promise,
-    cancel: () => {
-      if (handle !== undefined) {
-        clearTimeout(handle);
-      }
-    },
-  };
-}
-
-function warn(label: string, detail: string): void {
-  console.warn(`ui-storage: ${label} failed: ${detail}`);
-}
-
-/**
- * Builds the live adapter. `fetchImpl` defaults to the global fetch; tests
- * pass a scripted one.
- */
-export function createUiStorage(fetchImpl: typeof fetch = fetch): UiStorage {
-  const cache: Record<Bucket, Map<string, unknown>> = {
-    user: new Map(),
-    workspace: new Map(),
-  };
-  let suppressDepth = 0;
-
-  // Fetches one bucket and answers its key-value map, or null after one
-  // warning when the transport, the status, or the body shape fails. The
-  // warning is skipped once `abandoned()` reports true: the caller has
-  // already given up on this fetch (and warned about that), so a late
-  // failure is not a second event.
-  async function fetchBucket(
-    bucket: Bucket,
-    abandoned: () => boolean = () => false,
-  ): Promise<Map<string, unknown> | null> {
-    const label = `GET ${ROUTES[bucket]}`;
-    const warnUnlessAbandoned = (detail: string): void => {
-      if (!abandoned()) {
-        warn(label, detail);
-      }
-    };
-    try {
-      const response = await fetchImpl(ROUTES[bucket]);
-      if (!response.ok) {
-        warnUnlessAbandoned(`answered ${response.status}`);
-        return null;
-      }
-      const body: unknown = await response.json();
-      if (!isRecord(body) || Array.isArray(body)) {
-        warnUnlessAbandoned("returned a non-object body");
-        return null;
-      }
-      return new Map(Object.entries(body));
-    } catch (error) {
-      warnUnlessAbandoned(errorText(error));
-      return null;
-    }
-  }
-
-  // Loads one bucket within `timeoutMs`; a late answer after the timeout
-  // is dropped, because the stores have already been built from defaults,
-  // and the timeout is the bucket's one warning.
-  async function loadBucket(bucket: Bucket, timeoutMs: number): Promise<void> {
-    const timer = timeout(timeoutMs);
-    let settled = false;
-    let timedOut = false;
-    const guarded = fetchBucket(bucket, () => timedOut).then((result) => {
-      settled = true;
-      return result;
-    });
-    const result = await Promise.race([guarded, timer.promise]);
-    timer.cancel();
-    if (!settled) {
-      timedOut = true;
-      warn(`GET ${ROUTES[bucket]}`, `no answer within ${timeoutMs} ms`);
-    }
-    cache[bucket] = result ?? new Map();
-  }
-
-  return {
-    async preload(timeoutMs: number): Promise<void> {
-      await Promise.all([loadBucket("user", timeoutMs), loadBucket("workspace", timeoutMs)]);
-    },
-
-    get(bucket: Bucket, key: string): unknown {
-      return cache[bucket].get(key) ?? null;
-    },
-
-    set(bucket: Bucket, key: string, value: unknown): void {
-      if (bucket === "workspace" && suppressDepth > 0) {
-        return;
-      }
-      cache[bucket].set(key, value);
-      const route = `${ROUTES[bucket]}/${encodeURIComponent(key)}`;
-      const label = `PUT ${route}`;
-      let request: Promise<Response>;
-      try {
-        request = fetchImpl(route, {
-          method: "PUT",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify(value),
-        });
-      } catch (error) {
-        warn(label, errorText(error));
-        return;
-      }
-      void request
-        .then((response) => {
-          if (!response.ok) {
-            warn(label, `answered ${response.status}`);
-          }
-        })
-        .catch((error: unknown) => {
-          warn(label, errorText(error));
-        });
-    },
-
-    async reloadWorkspace(): Promise<void> {
-      cache.workspace = (await fetchBucket("workspace")) ?? new Map();
-    },
-
-    suppressWrites<T>(fn: () => T): T {
-      suppressDepth += 1;
-      try {
-        return fn();
-      } finally {
-        suppressDepth -= 1;
-      }
-    },
-  };
-}
-
-/**
- * The adapter with nothing behind it: reads null, writes nowhere, loads
- * instantly. The default under UI_STORAGE, so a consumer that resolves the
- * token before the composition root re-registers the live adapter
- * degrades to defaults instead of caching a wrong instance.
- */
-function createEmptyUiStorage(): UiStorage {
-  return {
-    preload: () => Promise.resolve(),
-    get: () => null,
-    set: () => {},
-    reloadWorkspace: () => Promise.resolve(),
-    suppressWrites: (fn) => fn(),
-  };
-}
-
-/** The registry token for the UI-state adapter. */
-export const UI_STORAGE = createServiceToken<UiStorage>("workshop.uiStorage");
-
-// Self-registration with the empty adapter; the composition root
-// re-registers the live one after preload.
-registerService(UI_STORAGE, () => createEmptyUiStorage());
diff --git a/crates/workshop/ui/src/services/update-service.ts b/crates/workshop/ui/src/services/update-service.ts
deleted file mode 100644
index 3519f1248..000000000
--- a/crates/workshop/ui/src/services/update-service.ts
+++ /dev/null
@@ -1,258 +0,0 @@
-// Desktop update state and I/O. The service is DOM-free: views subscribe to
-// snapshots and the composition root owns its lifetime.
-
-import { getVersion } from "@tauri-apps/api/app";
-import { invoke } from "@tauri-apps/api/core";
-import { relaunch } from "@tauri-apps/plugin-process";
-import { check, type DownloadEvent, type Update } from "@tauri-apps/plugin-updater";
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import { createServiceToken } from "@workshop/platform/service-registry";
-import { errorText } from "./error-catalog";
-
-export type UpdatePhase =
-  | "idle"
-  | "checking"
-  | "current"
-  | "available"
-  | "dismissed"
-  | "downloading"
-  | "installing"
-  | "restarting"
-  | "error"
-  | "unsupported"
-  | "browser";
-
-export interface UpdateSnapshot {
-  readonly phase: UpdatePhase;
-  readonly currentVersion: string;
-  readonly version: string;
-  readonly notes: string;
-  readonly downloaded: number;
-  readonly total: number | null;
-  readonly error: string;
-  readonly log: readonly string[];
-  /** The startup check produced this state, not a check or install the user asked for. */
-  readonly background: boolean;
-}
-
-interface DesktopUpdate {
-  readonly currentVersion: string;
-  readonly version: string;
-  readonly body?: string;
-  downloadAndInstall(onEvent?: (event: DownloadEvent) => void): Promise<void>;
-  close(): Promise<void>;
-}
-
-export interface UpdateBackend {
-  readonly desktop: boolean;
-  supported(): Promise<boolean>;
-  currentVersion(): Promise<string>;
-  check(): Promise<DesktopUpdate | null>;
-  relaunch(): Promise<void>;
-}
-
-function defaultBackend(): UpdateBackend {
-  return {
-    desktop: typeof window !== "undefined" && window.__TAURI_INTERNALS__ !== undefined,
-    supported: async (): Promise<boolean> => invoke<boolean>("desktop_update_supported"),
-    currentVersion: getVersion,
-    check: async (): Promise<Update | null> => check({ timeout: 30_000 }),
-    relaunch,
-  };
-}
-
-const EMPTY: UpdateSnapshot = {
-  phase: "idle",
-  currentVersion: "",
-  version: "",
-  notes: "",
-  downloaded: 0,
-  total: null,
-  error: "",
-  log: [],
-  background: false,
-};
-
-function oneLine(text: string | undefined): string {
-  return (text ?? "").split(/\r?\n/, 1)[0]?.trim() ?? "";
-}
-
-/** The app's one update service, registered by the composition root. */
-export const UPDATES = createServiceToken<UpdateService>("workshop.updates");
-
-export class UpdateService extends Disposable {
-  private readonly changes = this._register(new Emitter<UpdateSnapshot>());
-  private state: UpdateSnapshot = EMPTY;
-  private update: DesktopUpdate | null = null;
-  private checking: Promise<void> | null = null;
-  private disposed = false;
-
-  readonly onDidChange: Event<UpdateSnapshot> = this.changes.event;
-
-  constructor(private readonly backend: UpdateBackend = defaultBackend()) {
-    super();
-    if (!backend.desktop) {
-      this.state = { ...EMPTY, phase: "browser" };
-    }
-  }
-
-  get snapshot(): UpdateSnapshot {
-    return this.state;
-  }
-
-  startAutoCheck(delayMs = 5_000): void {
-    if (!this.backend.desktop) {
-      return;
-    }
-    const timer = window.setTimeout(() => void this.checkOnce(true), delayMs);
-    this._register(toDisposable(() => window.clearTimeout(timer)));
-  }
-
-  async checkNow(): Promise<void> {
-    return this.checkOnce(false);
-  }
-
-  private async checkOnce(background: boolean): Promise<void> {
-    if (this.disposed) {
-      return;
-    }
-    if (!this.backend.desktop) {
-      this.publish({ phase: "browser", error: "" });
-      return;
-    }
-    if (this.checking !== null) {
-      return this.checking;
-    }
-    this.checking = this.runCheck(background);
-    try {
-      await this.checking;
-    } finally {
-      this.checking = null;
-    }
-  }
-
-  remindLater(): void {
-    if (this.update !== null) {
-      this.publish({ phase: "dismissed" });
-    }
-  }
-
-  showAvailable(): void {
-    if (this.update !== null) {
-      this.publish({ phase: "available" });
-    }
-  }
-
-  async install(): Promise<void> {
-    const update = this.update;
-    if (update === null) {
-      return;
-    }
-    let downloaded = 0;
-    this.publish({
-      phase: "downloading",
-      downloaded,
-      total: null,
-      error: "",
-      log: [...this.state.log, `Downloading Runvil ${update.version}`],
-      background: false,
-    });
-    try {
-      await update.downloadAndInstall((event) => {
-        if (event.event === "Started") {
-          this.publish({
-            phase: "downloading",
-            total: event.data.contentLength ?? null,
-          });
-        } else if (event.event === "Progress") {
-          downloaded += event.data.chunkLength;
-          this.publish({ phase: "downloading", downloaded });
-        } else {
-          this.publish({
-            phase: "installing",
-            log: [...this.state.log, "Download complete. Installing update."],
-          });
-        }
-      });
-      this.publish({
-        phase: "restarting",
-        log: [...this.state.log, "Update installed. Restarting Runvil."],
-      });
-      await this.backend.relaunch();
-    } catch (error) {
-      const message = errorText(error);
-      this.publish({
-        phase: "error",
-        error: message,
-        log: [...this.state.log, `Update failed: ${message}`],
-      });
-    }
-  }
-
-  override dispose(): void {
-    this.disposed = true;
-    if (this.update !== null) {
-      void this.update.close();
-      this.update = null;
-    }
-    super.dispose();
-  }
-
-  private async runCheck(background: boolean): Promise<void> {
-    this.publish({ phase: "checking", error: "", background });
-    try {
-      const currentVersion = await this.backend.currentVersion();
-      if (!(await this.backend.supported())) {
-        this.publish({ phase: "unsupported", currentVersion, error: "" });
-        return;
-      }
-      const update = await this.backend.check();
-      if (this.disposed) {
-        await update?.close();
-        return;
-      }
-      if (this.update !== null && this.update !== update) {
-        await this.update.close();
-      }
-      this.update = update;
-      if (update === null) {
-        this.publish({
-          phase: "current",
-          currentVersion,
-          version: "",
-          notes: "",
-          downloaded: 0,
-          total: null,
-          log: [],
-        });
-        return;
-      }
-      this.publish({
-        phase: "available",
-        currentVersion: update.currentVersion || currentVersion,
-        version: update.version,
-        notes: oneLine(update.body),
-        downloaded: 0,
-        total: null,
-        log: [`Runvil ${update.version} is available.`],
-      });
-    } catch (error) {
-      const message = errorText(error);
-      this.publish({
-        phase: "error",
-        error: message,
-        log: [`Update check failed: ${message}`],
-      });
-    }
-  }
-
-  private publish(change: Partial<UpdateSnapshot>): void {
-    if (this.disposed) {
-      return;
-    }
-    this.state = { ...this.state, ...change };
-    this.changes.fire(this.state);
-  }
-}
diff --git a/crates/workshop/ui/src/services/workbench-service.ts b/crates/workshop/ui/src/services/workbench-service.ts
deleted file mode 100644
index 7ccf0eb36..000000000
--- a/crates/workshop/ui/src/services/workbench-service.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-// The server-owned workbench state. The server pushes complete snapshots
-// over the socket; this service holds the last one and fans out changes.
-// App-aware and DOM-free: the composition root constructs one instance,
-// feeds it from the socket's onWorkbench handler, and hands it to the
-// Model menu and the chat-gating hook through their constructors.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable } from "@workshop/platform/lifecycle";
-import type { WorkbenchFrame } from "./protocol";
-
-/**
- * One held workbench snapshot: the wire frame's fields under UI naming.
- * Absent options are `null`, never missing fields - every snapshot is the
- * complete menu state, exactly as the server pushed it.
- */
-export interface WorkbenchSnapshot {
-  /** Every profile the gateway can load, by name. */
-  readonly profiles: readonly string[];
-  /** The active profile's name, or null when unknown. */
-  readonly active: string | null;
-  /**
-   * The profile a switch is loading, or null both when no switch runs
-   * and when the in-flight switch selects no profile.
-   */
-  readonly switching: string | null;
-  /** Whether a switch is in flight, whatever its target. */
-  readonly switchInFlight: boolean;
-  /** The selected model's id, or null when no model is selected. */
-  readonly selected: string | null;
-  /** Whether the server considers chat usable; the UI never derives it. */
-  readonly chatReady: boolean;
-}
-
-// The state before the first push: nothing known, chat gated off.
-const EMPTY_SNAPSHOT: WorkbenchSnapshot = {
-  profiles: [],
-  active: null,
-  switching: null,
-  switchInFlight: false,
-  selected: null,
-  chatReady: false,
-};
-
-/**
- * Holds the last workbench snapshot the server pushed and notifies
- * subscribers on every new one. Pure state: applying a snapshot never
- * sends anything back on the socket, so a push can never echo.
- */
-export class WorkbenchService extends Disposable {
-  private _snapshot: WorkbenchSnapshot = EMPTY_SNAPSHOT;
-
-  private readonly _onDidChangeSnapshot = this._register(new Emitter<WorkbenchSnapshot>());
-  /** Fires with the new snapshot after every applySnapshot call. */
-  readonly onDidChangeSnapshot: Event<WorkbenchSnapshot> = this._onDidChangeSnapshot.event;
-
-  /** The last snapshot applied, or the empty pre-boot state. */
-  get snapshot(): WorkbenchSnapshot {
-    return this._snapshot;
-  }
-
-  /**
-   * Records one pushed workbench frame and notifies subscribers. Every
-   * push is fanned out even when the fields are unchanged: snapshots are
-   * complete and authoritative, so subscribers re-render rather than diff.
-   */
-  applySnapshot(frame: WorkbenchFrame): void {
-    this._snapshot = {
-      profiles: frame.profiles,
-      active: frame.active,
-      switching: frame.switching,
-      switchInFlight: frame.switch_in_flight,
-      selected: frame.selected,
-      chatReady: frame.chat_ready,
-    };
-    this._onDidChangeSnapshot.fire(this._snapshot);
-  }
-}
diff --git a/crates/workshop/ui/src/services/workshop-socket.ts b/crates/workshop/ui/src/services/workshop-socket.ts
deleted file mode 100644
index 75388ccac..000000000
--- a/crates/workshop/ui/src/services/workshop-socket.ts
+++ /dev/null
@@ -1,235 +0,0 @@
-// The persistent workshop socket: one WebSocket to /ws delivers the
-// server's downstream JSON - unsolicited status, catalog, and workbench
-// pushes - and the inbound selection events (select_model,
-// switch_profile) the agent toolbar's picker and future profile surfaces
-// send. Chat goes over the /agents/ws socket (agent-socket.ts). The
-// frame shapes themselves live in protocol.ts.
-
-import { Emitter, type Event } from "@workshop/platform/event";
-import { Disposable, toDisposable } from "@workshop/platform/lifecycle";
-import {
-  type CatalogModel,
-  narrowFrame,
-  type SelectModelFrame,
-  type StatusFrame,
-  type SwitchProfileFrame,
-  WORKSHOP_FRAME_GUARDS,
-  type WorkbenchFrame,
-} from "./protocol";
-import { ReconnectBackoff } from "@workshop/platform/reconnect-backoff";
-
-function defaultUrl(): string {
-  return `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}/ws`;
-}
-
-/**
- * Most pushes a boot queue will ever hold before `ready()` releases it.
- * When full, the oldest push is dropped: a newer status or catalog frame
- * supersedes an older one, and an unbounded queue on a socket whose owner
- * never declares readiness is a leak.
- */
-export const BOOT_QUEUE_CAP = 32;
-
-type QueuedPush =
-  | { kind: "status"; frame: StatusFrame }
-  | { kind: "models"; models: CatalogModel[] }
-  | { kind: "workbench"; frame: WorkbenchFrame };
-
-/**
- * Unsolicited server pushes (status, models, workbench) that arrive before `ready()`
- * is called are held in a queue bounded at `BOOT_QUEUE_CAP` (drop-oldest)
- * and replayed in arrival order when the composition root declares itself
- * ready - handlers attached at different points of boot would otherwise
- * race the server's first pushes.
- * After `ready()`, pushes deliver immediately.
- */
-export class WorkshopSocket extends Disposable {
-  private socket: WebSocket | null = null;
-  private opening: { socket: WebSocket; promise: Promise<void> } | null = null;
-  private readonly backoff = new ReconnectBackoff();
-  private isReady = false;
-  private readonly bootQueue: QueuedPush[] = [];
-
-  private readonly _onStatus = this._register(new Emitter<StatusFrame>());
-  /** Fires for every unsolicited status frame; subscribing returns the severing disposable. */
-  readonly onStatus: Event<StatusFrame> = this._onStatus.event;
-
-  private readonly _onModels = this._register(new Emitter<CatalogModel[]>());
-  /** Fires for every pushed model catalog. */
-  readonly onModels: Event<CatalogModel[]> = this._onModels.event;
-
-  private readonly _onWorkbench = this._register(new Emitter<WorkbenchFrame>());
-  /** Fires for every pushed workbench snapshot. */
-  readonly onWorkbench: Event<WorkbenchFrame> = this._onWorkbench.event;
-
-  private readonly _onDisconnect = this._register(new Emitter<void>());
-  /** Fires when the socket disconnects. */
-  readonly onDisconnect: Event<void> = this._onDisconnect.event;
-
-  constructor(private readonly url: string = defaultUrl()) {
-    super();
-    // Disposal silences the socket before closing it (onclose detached
-    // first), so teardown is never mistaken for a dropout: no disconnect
-    // fan-out, no reconnect backoff.
-    this._register(
-      toDisposable(() => {
-        this.backoff.cancel();
-        const socket = this.socket;
-        if (socket) {
-          socket.onclose = null;
-          socket.close();
-          this.socket = null;
-        }
-        this.bootQueue.length = 0;
-      }),
-    );
-  }
-
-  /** Opens the socket unless it is already open or opening. */
-  connect(): void {
-    // A failed open is ignored here: `onerror` has already reset the state,
-    // and the reconnect backoff retries through `ensureOpen`.
-    void this.ensureOpen().catch(() => {});
-  }
-
-  /**
-   * Declares the app ready for pushes: replays every queued status/models
-   * push in arrival order, then delivers later pushes immediately.
-   * Idempotent. The composition root calls this once its handlers and
-   * panels are wired.
-   */
-  ready(): void {
-    if (this.isReady) return;
-    // Readiness flips before the flush: a push a handler delivers
-    // re-entrantly must emit immediately, not land in a queue that has
-    // already drained and will never flush again.
-    this.isReady = true;
-    for (const push of this.bootQueue.splice(0)) {
-      this.emitPush(push);
-    }
-  }
-
-  private ensureOpen(): Promise<void> {
-    if (this.socket?.readyState === WebSocket.OPEN) {
-      return Promise.resolve();
-    }
-    if (this.opening) {
-      return this.opening.promise;
-    }
-    const socket = new WebSocket(this.url);
-    this.socket = socket;
-    const entry = { socket, promise: Promise.resolve() };
-    entry.promise = new Promise<void>((resolve, reject) => {
-      socket.onopen = () => {
-        if (this.opening === entry) this.opening = null;
-        this.backoff.reset();
-        resolve();
-      };
-      // A failure while opening rejects the waiters; a failure on an
-      // established socket is followed by close, which reconnects.
-      socket.onerror = () => {
-        if (this.socket === socket) this.socket = null;
-        if (this.opening === entry) this.opening = null;
-        reject(new Error("the workshop socket failed to open"));
-      };
-    });
-    this.opening = entry;
-    socket.onmessage = (event: MessageEvent) => this.route(event);
-    socket.onclose = () => {
-      if (this.socket === socket) this.socket = null;
-      if (this.opening === entry) this.opening = null;
-      // A dropped connection invalidates its queued pushes: replaying them
-      // after the onDisconnect reset would render state from a dead socket.
-      this.bootQueue.length = 0;
-      this._onDisconnect.fire(undefined);
-      this.scheduleReconnect();
-    };
-    return entry.promise;
-  }
-
-  /** Schedules the next reconnect attempt with exponential backoff. */
-  private scheduleReconnect(): void {
-    this.backoff.schedule(() => {
-      // A failed attempt ends in onclose, which schedules the next one.
-      void this.ensureOpen().catch(() => {});
-    });
-  }
-
-  /**
-   * Sends one `select_model` event frame naming the chat model. Returns
-   * false without sending when the socket is down, so the caller can show
-   * a status-bar error instead of the request vanishing silently; a
-   * refusal from the server arrives as an error frame, not here.
-   */
-  selectModel(id: string): boolean {
-    return this.sendFrame({ type: "select_model", model: id } satisfies SelectModelFrame);
-  }
-
-  /**
-   * Sends one `switch_profile` event frame selecting a gateway profile,
-   * or no profile for `null` (an explicit `null` name on the wire). The
-   * failure contract matches `selectModel`: false when the socket is
-   * down, nothing sent.
-   */
-  switchProfile(name: string | null): boolean {
-    return this.sendFrame({ type: "switch_profile", name } satisfies SwitchProfileFrame);
-  }
-
-  /** Sends one JSON frame; false when the socket is down or the send threw. */
-  private sendFrame(frame: Record<string, unknown>): boolean {
-    const socket = this.socket;
-    if (!socket || socket.readyState !== WebSocket.OPEN) {
-      return false;
-    }
-    try {
-      socket.send(JSON.stringify(frame));
-      return true;
-    } catch {
-      // A send that throws mid-close is the same failure as a closed
-      // socket; the close handler runs the cleanup.
-      return false;
-    }
-  }
-
-  private route(event: MessageEvent): void {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(String(event.data));
-    } catch {
-      // A non-JSON frame is ignored; keep reading.
-      return;
-    }
-    // Error frames answer menu events; the server's status frames report
-    // the user-visible outcome, so they have no guard and drop silently.
-    const frame = narrowFrame(WORKSHOP_FRAME_GUARDS, parsed, "/ws");
-    if (frame?.type === "status") {
-      this.deliverPush({ kind: "status", frame });
-    } else if (frame?.type === "models") {
-      this.deliverPush({ kind: "models", models: frame.models });
-    } else if (frame?.type === "workbench") {
-      this.deliverPush({ kind: "workbench", frame });
-    }
-  }
-
-  /** Queues a push before `ready()`, dropping the oldest at the cap. */
-  private deliverPush(push: QueuedPush): void {
-    if (this.isReady) {
-      this.emitPush(push);
-      return;
-    }
-    if (this.bootQueue.length >= BOOT_QUEUE_CAP) {
-      this.bootQueue.shift();
-    }
-    this.bootQueue.push(push);
-  }
-
-  private emitPush(push: QueuedPush): void {
-    if (push.kind === "status") {
-      this._onStatus.fire(push.frame);
-    } else if (push.kind === "models") {
-      this._onModels.fire(push.models);
-    } else {
-      this._onWorkbench.fire(push.frame);
-    }
-  }
-}
diff --git a/crates/workshop/ui/src/services/workspace-api.ts b/crates/workshop/ui/src/services/workspace-api.ts
deleted file mode 100644
index db355ad06..000000000
--- a/crates/workshop/ui/src/services/workspace-api.ts
+++ /dev/null
@@ -1,208 +0,0 @@
-// Validated HTTP boundary for the workspace APIs. Every response arrives
-// as unknown and is parsed field by field into a narrow type before any
-// consumer touches it; no casts. The tree panel lists directories through
-// fetchTree; the editor panel reads and writes files through fetchFile
-// and writeFile, which pass the server's opaque conflict token. Failures
-// throw typed CatalogError variants (services/error-catalog.ts); callers
-// match on the ErrorCatalog code, never on message text. The fetch and
-// JSON mechanics are the shared floor in json-request.ts.
-
-import { CatalogError, ErrorCatalog, isCatalogError } from "./error-catalog";
-import { errorCode, errorMessage, isRecord, readJson, request } from "./json-request";
-
-/** One entry in a directory listing. */
-export interface TreeEntry {
-  readonly name: string;
-  /** The entry's full path, ready to pass back to the API. */
-  readonly path: string;
-  readonly kind: "directory" | "file";
-  readonly size: number;
-  /** Modification time in milliseconds since the Unix epoch. */
-  readonly modifiedMs: number;
-  /** False only for a granted root that no longer exists on disk. */
-  readonly exists: boolean;
-}
-
-/** One level of a workspace directory tree. */
-export interface TreeListing {
-  /** The listed directory; null when the listing is the granted roots. */
-  readonly path: string | null;
-  /** Directories before files, each group ordered by name. */
-  readonly entries: readonly TreeEntry[];
-}
-
-/** A file's text plus the metadata a writer needs to detect conflicts. */
-export interface WorkspaceFile {
-  readonly path: string;
-  readonly size: number;
-  /** The server's opaque conflict token; echoed back verbatim on write. */
-  readonly token: string | null;
-  readonly text: string;
-}
-
-/** Narrows a caught error to a modified-time conflict from writeFile. */
-export function isModifiedConflict(error: unknown): error is CatalogError {
-  return isCatalogError(error, ErrorCatalog.ModifiedConflict);
-}
-
-/** Narrows a caught error to a route deadline (408) from writeFile. */
-export function isDeadlineElapsed(error: unknown): error is CatalogError {
-  return isCatalogError(error, ErrorCatalog.DeadlineElapsed);
-}
-
-function parseEntry(value: unknown): TreeEntry | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { name, path, kind, size, modified_ms, exists } = value;
-  if (typeof name !== "string" || typeof path !== "string") {
-    return null;
-  }
-  if (kind !== "directory" && kind !== "file") {
-    return null;
-  }
-  if (typeof size !== "number" || typeof modified_ms !== "number") {
-    return null;
-  }
-  if (typeof exists !== "boolean") {
-    return null;
-  }
-  return { name, path, kind, size, modifiedMs: modified_ms, exists };
-}
-
-function parseListing(body: unknown): TreeListing | null {
-  if (!isRecord(body)) {
-    return null;
-  }
-  const { path, entries } = body;
-  if (path !== null && typeof path !== "string") {
-    return null;
-  }
-  if (!Array.isArray(entries)) {
-    return null;
-  }
-  const parsed: TreeEntry[] = [];
-  for (const entry of entries) {
-    const parsedEntry = parseEntry(entry);
-    if (parsedEntry === null) {
-      return null;
-    }
-    parsed.push(parsedEntry);
-  }
-  return { path: path ?? null, entries: parsed };
-}
-
-/** Throws the typed failure for one non-OK response. */
-function httpFailure(body: unknown, status: number, route: string): never {
-  const message = errorMessage(body, status, route);
-  if (status === 409 && errorCode(body) === "modified_conflict") {
-    throw new CatalogError(ErrorCatalog.ModifiedConflict, message, { status });
-  }
-  if (status === 408) {
-    throw new CatalogError(ErrorCatalog.DeadlineElapsed, message, { status });
-  }
-  throw new CatalogError(ErrorCatalog.HttpStatus, message, { status });
-}
-
-/**
- * Lists one level of a workspace directory, or the granted roots when
- * `path` is null. Throws typed CatalogError variants on transport, HTTP,
- * and shape failures.
- */
-export async function fetchTree(path: string | null): Promise<TreeListing> {
-  const route = "/workspace/tree";
-  const url = path === null ? route : `${route}?path=${encodeURIComponent(path)}`;
-  const response = await request(url, `GET ${route}`);
-  const body = await readJson(response, `GET ${route}`);
-  if (!response.ok) {
-    httpFailure(body, response.status, `GET ${route}`);
-  }
-  const listing = parseListing(body);
-  if (listing === null) {
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `GET ${route} returned an unexpected shape`);
-  }
-  return listing;
-}
-
-/**
- * Removes a granted root by its listed path. The server refuses unknown
- * roots with a 404; a root deleted from disk stays revocable. Throws
- * typed CatalogError variants on transport and HTTP failures.
- */
-export async function revokeRoot(path: string): Promise<void> {
-  const route = "/workspace/revoke";
-  const response = await request(route, `POST ${route}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ path }),
-  });
-  const body = await readJson(response, `POST ${route}`);
-  if (!response.ok) {
-    httpFailure(body, response.status, `POST ${route}`);
-  }
-}
-
-function parseFile(body: unknown): WorkspaceFile | null {
-  if (!isRecord(body)) {
-    return null;
-  }
-  const { path, size, token, text } = body;
-  if (typeof path !== "string" || typeof text !== "string") {
-    return null;
-  }
-  if (typeof size !== "number") {
-    return null;
-  }
-  if (token !== null && typeof token !== "string") {
-    return null;
-  }
-  return { path, size, token, text };
-}
-
-/**
- * Reads a confined workspace file's text with its size and conflict
- * token. Throws typed CatalogError variants on transport, HTTP, and
- * shape failures.
- */
-export async function fetchFile(path: string): Promise<WorkspaceFile> {
-  const route = "/workspace/file";
-  const response = await request(`${route}?path=${encodeURIComponent(path)}`, `GET ${route}`);
-  const body = await readJson(response, `GET ${route}`);
-  if (!response.ok) {
-    httpFailure(body, response.status, `GET ${route}`);
-  }
-  const file = parseFile(body);
-  if (file === null) {
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `GET ${route} returned an unexpected shape`);
-  }
-  return file;
-}
-
-/**
- * Writes a confined workspace file. `expectedToken` is the token the
- * caller last read, passed back verbatim; the server refuses the write
- * with a 409 when the file changed on disk since, surfaced here as a
- * CatalogError with the ModifiedConflict code (see isModifiedConflict).
- * Returns the post-write metadata, including the fresh token.
- */
-export async function writeFile(
-  path: string,
-  text: string,
-  expectedToken: string | null,
-): Promise<WorkspaceFile> {
-  const route = "/workspace/file";
-  const response = await request(route, `PUT ${route}`, {
-    method: "PUT",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ path, text, expected_token: expectedToken }),
-  });
-  const body = await readJson(response, `PUT ${route}`);
-  if (!response.ok) {
-    httpFailure(body, response.status, `PUT ${route}`);
-  }
-  const file = parseFile(body);
-  if (file === null) {
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `PUT ${route} returned an unexpected shape`);
-  }
-  return file;
-}
diff --git a/crates/workshop/ui/src/services/workspace-events.ts b/crates/workshop/ui/src/services/workspace-events.ts
deleted file mode 100644
index 27c6003c9..000000000
--- a/crates/workshop/ui/src/services/workspace-events.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-// The workspace window events shared across parts: the grant sources
-// (drops, the Add Folder flow, the file and workspace-document actions)
-// fire them, and the tree-state service, the tree, the window title, and
-// the editor watermark listen.
-
-import { isRecord } from "./json-request";
-
-/** Fired on window after grants change, so open panels can refresh. */
-export const WORKSPACE_CHANGED_EVENT = "runvil:workspace-changed";
-
-/**
- * The optional detail of a workspace-changed event. A plain event means
- * the grants changed since any roots load in flight started, and the
- * tree-state service drops its roots listing so the next read fetches
- * again. `rootsCurrent` says the listing the service holds or is loading
- * already describes the new grants: Open Workspace from File invalidates
- * the roots before it re-creates the tree panel, whose init starts the one
- * load, and Save As and Duplicate keep the grants. The service keeps that
- * load instead of dropping it, so a switch fetches the roots once.
- */
-export interface WorkspaceChangedDetail {
-  readonly rootsCurrent: boolean;
-}
-
-/** Whether a workspace-changed event says the roots listing is already current. */
-export function rootsCurrentIn(event: Event): boolean {
-  const detail: unknown = event instanceof CustomEvent ? event.detail : null;
-  return isRecord(detail) && detail.rootsCurrent === true;
-}
diff --git a/crates/workshop/ui/src/services/workspace-file-client.ts b/crates/workshop/ui/src/services/workspace-file-client.ts
deleted file mode 100644
index aea1bbfd1..000000000
--- a/crates/workshop/ui/src/services/workspace-file-client.ts
+++ /dev/null
@@ -1,182 +0,0 @@
-// Validated HTTP boundary for the workspace-file APIs: the workspace as
-// a document. GET current, POST open / save-as /
-// duplicate, and PUT window-state, every one same-origin. Every switch
-// answers with the workspace as it now stands, so the caller never needs
-// a second round trip to learn what it switched to. Responses arrive as
-// unknown and are parsed field by field into narrow types before any
-// consumer touches them; no casts. Failures throw typed CatalogError
-// variants (services/error-catalog.ts); callers match on the code, never
-// on message text. Same discipline as workspace-api.ts, over the same
-// fetch and JSON floor in json-request.ts.
-
-import { CatalogError, ErrorCatalog } from "./error-catalog";
-import { errorMessage, isRecord, readJson, request } from "./json-request";
-
-/** One granted root as the workspace file lists it. */
-export interface WorkspaceGrant {
-  /** The canonical granted root. */
-  readonly path: string;
-  /** False only for a granted root that no longer exists on disk. */
-  readonly exists: boolean;
-}
-
-/** The desktop app's saved window geometry, in logical pixels. */
-export interface WindowState {
-  readonly width: number;
-  readonly height: number;
-  readonly x: number;
-  readonly y: number;
-  readonly maximized: boolean;
-}
-
-/**
- * The workspace as it stands: `GET /workspace/file/current` and the
- * answer to every successful switch. Mirrors the server's
- * WorkspaceFileResponse; the wire's `window_state` lands on windowState.
- */
-export interface WorkspaceFileResponse {
-  /** The backing file; null while the workspace is ephemeral. */
-  readonly path: string | null;
-  /** The display name: the file's own, or "Untitled" while ephemeral. */
-  readonly name: string;
-  /** The granted roots in canonical order. */
-  readonly grants: readonly WorkspaceGrant[];
-  /** The saved geometry; null while ephemeral or never saved. */
-  readonly windowState: WindowState | null;
-}
-
-function parseGrant(value: unknown): WorkspaceGrant | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { path, exists } = value;
-  if (typeof path !== "string" || typeof exists !== "boolean") {
-    return null;
-  }
-  return { path, exists };
-}
-
-function parseWindowState(value: unknown): WindowState | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const { width, height, x, y, maximized } = value;
-  if (typeof width !== "number" || typeof height !== "number") {
-    return null;
-  }
-  if (typeof x !== "number" || typeof y !== "number" || typeof maximized !== "boolean") {
-    return null;
-  }
-  return { width, height, x, y, maximized };
-}
-
-function parseWorkspaceFile(body: unknown): WorkspaceFileResponse | null {
-  if (!isRecord(body)) {
-    return null;
-  }
-  const { path, name, grants, window_state } = body;
-  if (path !== null && typeof path !== "string") {
-    return null;
-  }
-  if (typeof name !== "string" || !Array.isArray(grants)) {
-    return null;
-  }
-  const parsedGrants: WorkspaceGrant[] = [];
-  for (const grant of grants) {
-    const parsed = parseGrant(grant);
-    if (parsed === null) {
-      return null;
-    }
-    parsedGrants.push(parsed);
-  }
-  let windowState: WindowState | null = null;
-  if (window_state !== null && window_state !== undefined) {
-    windowState = parseWindowState(window_state);
-    if (windowState === null) {
-      return null;
-    }
-  }
-  return { path: path ?? null, name, grants: parsedGrants, windowState };
-}
-
-/**
- * Performs one request and reads its JSON body, wrapping transport
- * failures, non-JSON answers, and non-OK statuses as typed errors. Every
- * route here answers a plain HttpStatus on refusal; none reports a
- * distinguished code the way the write route's modified_conflict does.
- */
-async function requestJson(route: string, init?: RequestInit): Promise<unknown> {
-  const label = `${init?.method ?? "GET"} ${route}`;
-  const response = await request(route, label, init);
-  const body = await readJson(response, label);
-  if (!response.ok) {
-    throw new CatalogError(ErrorCatalog.HttpStatus, errorMessage(body, response.status, label), {
-      status: response.status,
-    });
-  }
-  return body;
-}
-
-/** Parses one workspace answer, refusing an unexpected shape. */
-function workspaceFrom(body: unknown, label: string): WorkspaceFileResponse {
-  const parsed = parseWorkspaceFile(body);
-  if (parsed === null) {
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `${label} returned an unexpected shape`);
-  }
-  return parsed;
-}
-
-/** Posts one path to a switch route and answers the workspace as switched. */
-async function switchTo(route: string, path: string): Promise<WorkspaceFileResponse> {
-  const body = await requestJson(route, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ path }),
-  });
-  return workspaceFrom(body, `POST ${route}`);
-}
-
-/** The workspace as it stands: its file, name, grants, and saved geometry. */
-export async function currentWorkspaceFile(): Promise<WorkspaceFileResponse> {
-  const route = "/workspace/file/current";
-  return workspaceFrom(await requestJson(route), `GET ${route}`);
-}
-
-/**
- * Opens a workspace file, replacing every grant with its contents. The
- * server refuses an alien or unsupported file and changes nothing.
- */
-export function openWorkspaceFile(path: string): Promise<WorkspaceFileResponse> {
-  return switchTo("/workspace/file/open", path);
-}
-
-/**
- * Creates a new workspace file at `path` holding the current grants and
- * switches to it; a taken path is refused as a conflict.
- */
-export function saveWorkspaceFileAs(path: string): Promise<WorkspaceFileResponse> {
-  return switchTo("/workspace/file/save-as", path);
-}
-
-/** Copies the current workspace file to `path` and switches to the copy. */
-export function duplicateWorkspaceFile(path: string): Promise<WorkspaceFileResponse> {
-  return switchTo("/workspace/file/duplicate", path);
-}
-
-/**
- * Saves the desktop app's window geometry into the open workspace file.
- * Answers whether it was written: false when the workspace is ephemeral
- * and has nowhere to keep it.
- */
-export async function putWindowState(state: WindowState): Promise<boolean> {
-  const route = "/workspace/file/window-state";
-  const body = await requestJson(route, {
-    method: "PUT",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(state),
-  });
-  if (!isRecord(body) || typeof body.saved !== "boolean") {
-    throw new CatalogError(ErrorCatalog.UnexpectedShape, `PUT ${route} returned an unexpected shape`);
-  }
-  return body.saved;
-}
diff --git a/crates/workshop/ui/src/services/zone-state-service.ts b/crates/workshop/ui/src/services/zone-state-service.ts
deleted file mode 100644
index ff2bfef24..000000000
--- a/crates/workshop/ui/src/services/zone-state-service.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-// The zone-state service: the workbench's zone group map (which Dockview
-// group currently holds each named zone) and the per-panel placement
-// overrides recorded when the user drags a panel to another zone. The
-// state lives in a registry-held service so it is named, observable
-// through onDidChange, and shared by every consumer through the service
-// registry rather than through imports of one module's internals. The
-// service self-registers with a default factory, so any bundle that
-// touches it gets the singleton without composition-root wiring.
-//
-// The service owns state only: Dockview placement APIs stay in zones.ts.
-
-import { Emitter } from "@workshop/platform/event";
-import type { Event } from "@workshop/platform/event";
-import type { IDisposable } from "@workshop/platform/lifecycle";
-import { ZONE_NAMES, type ZoneName } from "@workshop/platform/panel-registry";
-import { createServiceToken, registerService } from "@workshop/platform/service-registry";
-
-/** The persisted placement state: live zone groups and user overrides. */
-export interface ZoneState {
-  readonly zones: Record<string, string>;
-  readonly overrides: Record<string, string>;
-}
-
-/** Narrows a string to a declared zone name. */
-export function isZoneName(name: string): name is ZoneName {
-  return (ZONE_NAMES as readonly string[]).includes(name);
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/**
- * The zone group map and placement overrides. Zone name -> live Dockview
- * group id entries go stale when the user closes a zone's last panel;
- * zones.ts rebuilds the group on demand. Panel id -> zone overrides
- * survive panel close, so a reopened panel returns to the user's chosen
- * zone.
- */
-export class ZoneStateService implements IDisposable {
-  private readonly groups = new Map<ZoneName, string>();
-  private readonly overrides = new Map<string, ZoneName>();
-  private readonly changeEmitter = new Emitter<void>();
-
-  /** Fires when the placement overrides change; layout persistence hooks it. */
-  readonly onDidChange: Event<void> = this.changeEmitter.event;
-
-  /** The zone's live group id, or undefined once the group has closed away. */
-  groupFor(zone: ZoneName): string | undefined {
-    return this.groups.get(zone);
-  }
-
-  /** Records which group currently holds a zone. */
-  setGroup(zone: ZoneName, groupId: string): void {
-    this.groups.set(zone, groupId);
-  }
-
-  /** The zone owning a live group id, if the group is a known zone. */
-  zoneForGroupId(groupId: string): ZoneName | undefined {
-    for (const [zone, id] of this.groups) {
-      if (id === groupId) {
-        return zone;
-      }
-    }
-    return undefined;
-  }
-
-  /** The zone the user last moved a panel to, if overridden. */
-  overrideFor(panelId: string): ZoneName | undefined {
-    return this.overrides.get(panelId);
-  }
-
-  /** Records a panel's user-chosen zone. */
-  setOverride(panelId: string, zone: ZoneName): void {
-    this.overrides.set(panelId, zone);
-    this.changeEmitter.fire();
-  }
-
-  /** Drops a panel's override, returning it to its type's affinity zone. */
-  clearOverride(panelId: string): void {
-    if (this.overrides.delete(panelId)) {
-      this.changeEmitter.fire();
-    }
-  }
-
-  /** Snapshots the zone map and placement overrides for layout persistence. */
-  serialize(): ZoneState {
-    return {
-      zones: Object.fromEntries(this.groups),
-      overrides: Object.fromEntries(this.overrides),
-    };
-  }
-
-  /**
-   * Replaces the zone map and overrides from persisted state. Entries
-   * naming unknown zones or holding non-string values are dropped; stale
-   * group ids self-heal because zones.ts rebuilds a zone whose group no
-   * longer exists.
-   */
-  restore(zones: unknown, overrides: unknown): void {
-    this.groups.clear();
-    this.overrides.clear();
-    if (isRecord(zones)) {
-      for (const [name, groupId] of Object.entries(zones)) {
-        if (isZoneName(name) && typeof groupId === "string") {
-          this.groups.set(name, groupId);
-        }
-      }
-    }
-    if (isRecord(overrides)) {
-      for (const [panelId, zone] of Object.entries(overrides)) {
-        if (typeof zone === "string" && isZoneName(zone)) {
-          this.overrides.set(panelId, zone);
-        }
-      }
-    }
-  }
-
-  /** Clears all zone state; the default-layout fallback starts from blank. */
-  reset(): void {
-    this.groups.clear();
-    this.overrides.clear();
-  }
-
-  dispose(): void {
-    this.changeEmitter.dispose();
-  }
-}
-
-/** The registry token for the zone-state singleton. */
-export const ZONE_STATE = createServiceToken<ZoneStateService>("workshop.zoneState");
-
-// Self-registration: the default instance is shared by every consumer in
-// the process. The composition root may re-register to rebind.
-registerService(ZONE_STATE, () => new ZoneStateService());
diff --git a/crates/workshop/ui/src/tokens/component.css b/crates/workshop/ui/src/tokens/component.css
deleted file mode 100644
index 44fbb3c33..000000000
--- a/crates/workshop/ui/src/tokens/component.css
+++ /dev/null
@@ -1,118 +0,0 @@
-/* Tier 3 - per-component tokens: one named slot per component sizing
-   decision, mapped to semantic aliases or base primitives. A component's
-   CSS references only its own slots and the semantic tier. */
-:root {
-  /* Agent session feed */
-  --ws-agent-toolbar-gap: var(--ws-size-4);
-
-  /* Composer controls: the mode menu is at least 170px wide; the model menu is
-     230px wide and at most 320px tall; the model button's chevron is 9px */
-  --ws-mode-menu-min-width: var(--ws-size-170);
-  --ws-model-menu-width: var(--ws-size-230);
-  --ws-model-menu-max-height: var(--ws-size-320);
-  --ws-model-chevron-size: var(--ws-size-9);
-  --ws-token-ring-margin: var(--ws-size-2-5);
-
-  /* Chat pane chrome: a 35px header row; chat tabs 60 to 120px wide, and the
-     active one can grow to 200px */
-  --ws-pane-header-height: var(--ws-size-35);
-  --ws-chat-tab-min-width: var(--ws-size-60);
-  --ws-chat-tab-max-width: var(--ws-size-120);
-  --ws-chat-tab-active-max-width: var(--ws-size-200);
-  --ws-chat-tab-padding: var(--ws-size-3) var(--ws-size-6);
-
-  /* Agent transcript */
-  --ws-transcript-row-inset: var(--ws-size-11);
-  --ws-transcript-row-enter: var(--ws-duration-160);
-  --ws-transcript-footer-height: var(--height-base);
-  --ws-collapsible-chevron-size: var(--ws-size-12);
-  --ws-collapsible-chevron-gap: var(--ws-size-3);
-  --ws-human-min-width: var(--ws-size-150);
-  --ws-human-clip-height: var(--ws-size-77);
-  --ws-human-fade-height: var(--ws-size-41);
-  --ws-human-bleed-top: var(--ws-size-2);
-  --ws-human-bleed-bottom: var(--ws-size-8);
-  --ws-human-stuck-fade-height: var(--space-5);
-  --ws-tool-block-max-height: var(--ws-size-240);
-  --ws-web-card-width: var(--ws-size-360);
-  --ws-web-card-max-height: var(--ws-size-280);
-
-  /* Agent markdown */
-  --ws-markdown-heading-gap-large: var(--ws-size-20-5);
-  --ws-markdown-list-gap-end: var(--ws-size-18);
-  --ws-markdown-inline-code-padding: var(--ws-size-1-5) var(--ws-size-2);
-  --ws-markdown-inline-code-radius: var(--ws-size-5);
-  --ws-markdown-quote-bar-width: var(--ws-size-3);
-
-  /* Prompt input */
-  --ws-prompt-chip-label-max-width: var(--ws-size-200);
-
-  /* Composer: the toolbar sits 9px under the editor; the action glyph is 14px */
-  --ws-composer-toolbar-gap: var(--ws-size-9);
-  --ws-composer-action-glyph: var(--ws-size-14);
-
-  /* Mention typeahead: the @ menu is 240px wide and at most 280px tall */
-  --ws-typeahead-width: var(--ws-size-240);
-  --ws-typeahead-max-height: var(--ws-size-280);
-
-  /* Chrome: about dialog (a 380px card), model picker, update view */
-  --ws-about-width: var(--ws-size-380);
-  --ws-about-icon-size: var(--ws-size-48);
-  --ws-about-label-width: var(--ws-size-60);
-  --ws-model-trigger-max-width: var(--ws-size-200);
-  --ws-update-banner-offset: var(--ws-size-22);
-  --ws-update-banner-width: var(--ws-size-360);
-  --ws-update-screen-width: var(--ws-size-560);
-  --ws-update-log-max-height: var(--ws-size-180);
-
-  /* Quick input: a frame min(62vw, 820px) wide and at most 80vw, 35px under
-     the top; 22px rows padded 0 7px with a 0 5px margin; the box 26px tall
-     inside a 4px 6px header; the list at most min(440px, 40vh) tall */
-  --ws-quick-input-width: min(var(--ws-size-vw-62), var(--ws-size-820));
-  --ws-quick-input-max-width: var(--ws-size-vw-80);
-  --ws-quick-input-top: var(--ws-size-35);
-  --ws-quick-input-header-padding: var(--ws-size-4) var(--ws-size-6);
-  --ws-quick-input-box-height: var(--ws-size-26);
-  --ws-quick-input-box-padding: 0 var(--ws-size-7);
-  --ws-quick-input-list-max-height: min(var(--ws-size-440), var(--ws-size-vh-40));
-  --ws-quick-input-row-height: var(--ws-size-22);
-  --ws-quick-input-row-padding: 0 var(--ws-size-7);
-  --ws-quick-input-row-margin: 0 var(--ws-size-5);
-  --ws-quick-input-description-size: var(--ws-size-em-0-9);
-  --ws-quick-input-key-padding: var(--ws-size-3);
-  --ws-quick-input-key-radius: var(--ws-size-3);
-  --ws-quick-input-chord-gap: var(--ws-size-6);
-
-  /* Workbench inputs and selects: the IDE's own fields, which the run
-     panel's toolbar and arguments take. 26px tall, a 2px radius, a 1px
-     border; a select pads 2px 23px 2px 8px and draws a 16px caret 6px from
-     the right */
-  --ws-workbench-input-height: var(--ws-size-26);
-  --ws-workbench-input-radius: var(--ws-size-2);
-  --ws-workbench-input-border: var(--ws-border-width) solid var(--border);
-  --ws-workbench-select-padding: var(--ws-size-2) var(--ws-size-23) var(--ws-size-2) var(--ws-size-8);
-  --ws-workbench-select-caret-size: var(--ws-size-16);
-  --ws-workbench-select-caret-inset: var(--ws-size-6);
-
-  /* Run panel: a 35px toolbar, a footer padded 10px, and controls 240px wide
-     in a Settings row; the prose box is at least 100px tall */
-  --ws-run-toolbar-height: var(--ws-size-35);
-  --ws-run-footer-padding: var(--ws-size-10);
-  --ws-run-control-width: var(--ws-size-240);
-  --ws-run-prose-min-height: var(--ws-size-100);
-
-  /* Layout: workshop tree */
-  --ws-tree-indent: var(--ws-size-8);
-
-  /* Menus: bar buttons and popovers share a 5px radius */
-  --ws-menu-item-radius: var(--ws-size-5);
-  --ws-menu-radius: var(--ws-size-5);
-
-  /* STT mic recording ring and bloom */
-  --ws-stt-mic-shadow:
-    0 0 0 var(--ws-size-1) var(--danger),
-    0 0 var(--ws-size-6) color-mix(in oklab, var(--danger) 55%, transparent);
-  --ws-stt-mic-shadow-recording:
-    0 0 0 var(--ws-size-1) var(--danger),
-    0 0 var(--ws-size-8) color-mix(in oklab, var(--danger) 70%, transparent);
-}
diff --git a/crates/workshop/ui/style.css b/crates/workshop/ui/style.css
deleted file mode 100644
index dca00de31..000000000
--- a/crates/workshop/ui/style.css
+++ /dev/null
@@ -1,82 +0,0 @@
-/* ==========================================================================
-   Runvil workshop skin
-
-   The design tokens live in @workshop/look/tokens.css - the Workshop
-   family's Cursor Dark sheet - bundled into dist/app.css from main.ts's
-   import. Reskinning the UI means editing that one block (or overriding
-   it from a stylesheet loaded after); no rule below hardcodes a color or
-   a themed length.
-
-   This file has only the resets and the global scrollbars. Component
-   rules live in per-component CSS files colocated with their owning TS
-   modules under src/, which esbuild bundles into dist/app.css.
-   ========================================================================== */
-
-* {
-  box-sizing: border-box;
-}
-
-/* --------------------------------------------------------------------------
-   Custom scrollbars, applied globally: Cursor's view bars - a square
-   translucent thumb on a transparent track that shows while the scroller
-   is hovered, so the bar reads as an overlay on whatever surface scrolls.
-   WebView2 is Chromium, so the ::-webkit-scrollbar pseudoelements are the
-   styled surface. Chromium ignores them on any element that sets
-   `scrollbar-width` or `scrollbar-color`, so that standard pair applies
-   the same intent only to engines without the pseudoelements. Widths and
-   colors are variables so a skin can retune them from the token sheet;
-   menus take the narrower bar from .scrollbar-menu in @workshop/look.
-   -------------------------------------------------------------------------- */
-@supports not selector(::-webkit-scrollbar) {
-  * {
-    scrollbar-width: thin;
-    scrollbar-color: var(--scrollbar-thumb) transparent;
-  }
-}
-
-::-webkit-scrollbar {
-  width: var(--scrollbar-width);
-  height: var(--scrollbar-width);
-}
-
-::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-::-webkit-scrollbar-thumb {
-  background: transparent;
-  border-radius: 0;
-}
-
-:hover::-webkit-scrollbar-thumb {
-  background: var(--scrollbar-thumb);
-}
-
-::-webkit-scrollbar-thumb:hover {
-  background: var(--scrollbar-thumb-hover);
-}
-
-::-webkit-scrollbar-corner {
-  background: transparent;
-}
-
-html,
-body {
-  margin: 0;
-  height: 100%;
-  background: var(--bg);
-  color: var(--text);
-  font-family: var(--font-prose);
-  font-size: 13px;
-  line-height: 1.55;
-}
-
-/* The window is one column: the desk fills it above the full-width
-   status bar. */
-body {
-  display: flex;
-  flex-direction: column;
-  height: 100vh;
-  overflow: hidden;
-  margin: 0;
-}
diff --git a/crates/workshop/ui/test/about-dialog.mjs b/crates/workshop/ui/test/about-dialog.mjs
deleted file mode 100644
index 074fa9275..000000000
--- a/crates/workshop/ui/test/about-dialog.mjs
+++ /dev/null
@@ -1,193 +0,0 @@
-// Unit test for Help > About (src/parts/chrome/chrome.contribution.ts and
-// src/parts/chrome/about-dialog.ts): the action resolves the registered
-// update service, so the desktop dialog offers the update check instead of
-// "Desktop updates unavailable", follows the service's phases while open,
-// and without a registered service it still opens with the button
-// disabled. Bundles the modules with esbuild and
-// drives them against jsdom with a stub-backend UpdateService.
-// Run: node test/about-dialog.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-globalThis.KeyboardEvent = window.KeyboardEvent;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/chrome/chrome.contribution.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { UPDATES, UpdateService } from "./src/services/update-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const { Commands, registerService, UPDATES, UpdateService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const ABOUT = "workbench.action.showAboutDialog";
-
-function updateButton() {
-  return window.document.querySelector(".ws-about-dialog__check");
-}
-
-// Dismisses through the Close button, as a user does, so the dialog's
-// teardown runs and the next open is not a no-op.
-function closeDialog(name) {
-  window.document.querySelector(".ws-about-dialog__close")?.click();
-  check(name, window.document.querySelector(".ws-about-dialog-overlay") === null);
-}
-
-// No service registered: the dialog still opens, with updates unavailable.
-check("the About action is registered", await Commands.execute(ABOUT));
-check(
-  "without an update service the button reads unavailable",
-  updateButton()?.textContent === "Desktop updates unavailable" && updateButton()?.disabled === true,
-);
-closeDialog("Close dismisses the dialog without an update service");
-
-// Lets the service's awaits and the dialog's re-render run.
-function settle() {
-  return new Promise((resolve) => setTimeout(resolve, 0));
-}
-
-function buttonReads(text, enabled) {
-  const button = updateButton();
-  return button?.textContent === text && button.disabled === !enabled;
-}
-
-// The desktop app's registered service, with each answer scripted per case.
-let checks = 0;
-let supported = true;
-let answer = async () => null;
-const updates = new UpdateService({
-  desktop: true,
-  supported: async () => supported,
-  currentVersion: async () => "0.3.0",
-  check: () => {
-    checks += 1;
-    return answer();
-  },
-  relaunch: async () => undefined,
-});
-const registration = registerService(UPDATES, () => updates);
-
-await Commands.execute(ABOUT);
-check(
-  "with the desktop update service the button offers the check",
-  buttonReads("Check for Updates...", true),
-);
-
-// A click runs one check; the dialog follows its phases while open.
-let finishCheck;
-answer = () =>
-  new Promise((resolve) => {
-    finishCheck = resolve;
-  });
-updateButton()?.click();
-await settle();
-check("the button runs the update check", checks === 1);
-check("a running check disables the button", buttonReads("Checking for Updates...", false));
-finishCheck(null);
-await settle();
-check("a finished check offers the check again", buttonReads("Check for Updates...", true));
-
-// A failed check offers the retry, which runs the check again.
-answer = async () => {
-  throw new Error("offline");
-};
-updateButton()?.click();
-await settle();
-check("a failed check offers the retry", buttonReads("Retry update check", true));
-answer = async () => null;
-updateButton()?.click();
-await settle();
-check("the retry runs the check", checks === 3);
-check("a passing retry offers the check", buttonReads("Check for Updates...", true));
-
-// An available update, dismissed elsewhere, is offered again from About,
-// and choosing it closes the dialog.
-answer = async () => ({
-  currentVersion: "0.3.0",
-  version: "0.4.0",
-  body: "",
-  downloadAndInstall: async () => undefined,
-  close: async () => undefined,
-});
-updateButton()?.click();
-await settle();
-check("an available update is offered", buttonReads("Download Update", true));
-updates.remindLater();
-check("a dismissed update is still offered", buttonReads("Download Update", true));
-updateButton()?.click();
-check("showing the update makes it available", updates.snapshot.phase === "available");
-check(
-  "showing the update closes the dialog",
-  window.document.querySelector(".ws-about-dialog-overlay") === null,
-);
-
-// While an update downloads and installs, the button offers no new check:
-// a check would close the update handle the install is using.
-let finishInstall;
-answer = async () => ({
-  currentVersion: "0.3.0",
-  version: "0.4.0",
-  body: "",
-  downloadAndInstall: () =>
-    new Promise((resolve) => {
-      finishInstall = resolve;
-    }),
-  close: async () => undefined,
-});
-await updates.checkNow();
-const installing = updates.install();
-await settle();
-await Commands.execute(ABOUT);
-check("a running install disables the button", buttonReads("Installing Update...", false));
-closeDialog("Close dismisses the dialog during an install");
-finishInstall();
-await installing;
-
-// A package-managed install leaves updates to the package manager.
-supported = false;
-await updates.checkNow();
-await Commands.execute(ABOUT);
-check(
-  "a package-managed install disables the button",
-  buttonReads("Updates are managed by your package manager", false),
-);
-closeDialog("Close dismisses the dialog with the update service");
-registration.dispose();
-updates.dispose();
-
-if (failures.length > 0) {
-  console.error(`about-dialog: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("about-dialog: all assertions passed");
diff --git a/crates/workshop/ui/test/active-editor-key.mjs b/crates/workshop/ui/test/active-editor-key.mjs
deleted file mode 100644
index deb3d1471..000000000
--- a/crates/workshop/ui/test/active-editor-key.mjs
+++ /dev/null
@@ -1,272 +0,0 @@
-// Integration test for the activeEditor context key
-// (src/parts/layout/zones.ts, bindActiveEditorKey) against the panel
-// types the editor, agent, workspace, run, and gateway contributions
-// register, plus a synthetic "probe" type. Mounts a real Dockview dock in
-// jsdom. The editor and probe panels render through the registry's lazy
-// renderer (src/parts/layout/panel-types.ts), so the real editor chunk
-// loads and runs its register(), and the probe's chunk resolves only
-// when the test releases it; the agent, tree, run, and config panels
-// render through an inert stand-in, so their chunks never load.
-// Covers: activeEditor holds each active panel's type id - editor,
-// agent, tree, run, config, and probe - before its chunk loads; it stays
-// the type once the editor chunk and the probe chunk load; it follows
-// activation between panels; and it is unset while no panel is active.
-// Run: node --test test/active-editor-key.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      // The editor chunk's closed-editor tracking reads the stack through
-      // its token; the implementation's module scope self-registers it.
-      import "./src/parts/editor/closed-editors.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/run/run.contribution.ts";
-      import "./src/parts/gateway/gateway.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export {
-        registerPanelFactory,
-        registerPanelType,
-        resolvePanelContent,
-      } from "@workshop/platform/panel-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { getService } from "@workshop/platform/service-registry";
-      export { bindActiveEditorKey, initZones, openInZone, resetZones } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent } from "./src/parts/layout/panel-types.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; strip it - jsdom applies
-  // no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM('<!doctype html><html><body><div id="dock"></div></body></html>', {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-// CodeMirror measures text through Range, which jsdom does not lay out;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-
-globalThis.fetch = async (url) => {
-  throw new Error(`unexpected fetch in the active-editor-key test: ${url}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLTextAreaElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "Range",
-  "KeyboardEvent",
-  "MutationObserver",
-  "ResizeObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-active-editor-key-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  registerPanelFactory,
-  registerPanelType,
-  resolvePanelContent,
-  CONTEXT_KEY_SERVICE,
-  getService,
-  bindActiveEditorKey,
-  initZones,
-  openInZone,
-  resetZones,
-  createPanelComponent,
-  createPanelTabComponent,
-  EditorPanel,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// The probe's feature directory resolves only once the test releases it,
-// so the key is observable while the chunk is still loading.
-let releaseProbe = () => {};
-const probeReleased = new Promise((resolve) => {
-  releaseProbe = resolve;
-});
-const probeFeature = {
-  register() {
-    registerPanelFactory("probe", () => ({
-      element: Object.assign(window.document.createElement("div"), { className: "probe-panel" }),
-      init() {},
-    }));
-  },
-};
-registerPanelType({
-  type: "probe",
-  title: "Probe",
-  defaultZone: "main",
-  load: () => probeReleased.then(() => probeFeature),
-});
-
-// The real types whose chunks stay unloaded: an inert renderer stands in
-// for the registry's lazy one, so no agent socket, tree fetch, or config
-// frame starts in jsdom.
-const STAND_INS = ["tree", "agent", "run", "config"];
-function createComponent(options) {
-  if (STAND_INS.includes(options.name)) {
-    return { element: window.document.createElement("div"), init() {} };
-  }
-  return createPanelComponent(options);
-}
-
-const element = window.document.getElementById("dock");
-element.className = "ws-dock";
-const dock = createDockview(element, {
-  createComponent,
-  createTabComponent: createPanelTabComponent,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-resetZones();
-const binding = bindActiveEditorKey(dock);
-const context = getService(CONTEXT_KEY_SERVICE);
-const activeEditor = () => context.getValue("activeEditor");
-
-check("activeEditor is unset before any panel opens", activeEditor() === undefined);
-
-// --- Each type's own id, before its chunk loads ---------------------------------
-
-const opened = {};
-for (const type of STAND_INS) {
-  opened[type] = openInZone(type, {});
-  check(`activeEditor holds '${type}' while its panel is active`, activeEditor() === type);
-}
-
-const editor = openInZone("editor", { untitled: 1 });
-check(
-  "activeEditor holds 'editor' before the editor chunk loads",
-  activeEditor() === "editor" && !(resolvePanelContent(editor.view.content) instanceof EditorPanel),
-);
-await flush();
-check(
-  "the real editor chunk loaded and mounted its panel",
-  resolvePanelContent(editor.view.content) instanceof EditorPanel,
-);
-check("activeEditor stays 'editor' once the editor chunk loads", activeEditor() === "editor");
-
-// --- Activation moves the key --------------------------------------------------
-
-opened.tree.api.setActive();
-check("activeEditor follows activation to the tree", activeEditor() === "tree");
-opened.agent.api.setActive();
-check("activeEditor follows activation to the agent session", activeEditor() === "agent");
-editor.api.setActive();
-check("activeEditor follows activation back to the editor", activeEditor() === "editor");
-
-// --- A synthetic type, before and after its chunk loads -------------------------
-
-const probe = openInZone("probe", {});
-const probeMounted = () => probe.view.content.element.querySelector(".probe-panel") !== null;
-check("activeEditor holds 'probe' before its chunk loads", activeEditor() === "probe" && !probeMounted());
-releaseProbe();
-await flush();
-check("the probe chunk loaded and mounted its panel", probeMounted());
-check("activeEditor stays 'probe' once its chunk loads", activeEditor() === "probe");
-
-// --- No active panel -------------------------------------------------------------
-
-for (const panel of [...dock.panels]) {
-  dock.removePanel(panel);
-}
-await flush();
-check(
-  "activeEditor is unset with no active panel",
-  dock.activePanel === undefined && activeEditor() === undefined,
-);
-binding.dispose();
-
-if (failures.length > 0) {
-  console.error(`active-editor-key: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("active-editor-key: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/activity-led.mjs b/crates/workshop/ui/test/activity-led.mjs
deleted file mode 100644
index 7d9d2e09c..000000000
--- a/crates/workshop/ui/test/activity-led.mjs
+++ /dev/null
@@ -1,50 +0,0 @@
-// The activity LED: generating pulses light it green, thinking pulses
-// amber, and green wins while both are lit inside one pulse window. Debug
-// frames pulse it too. After the window the LED returns to its idle lens,
-// and a dropped socket turns a sustained glow dark.
-// The pulse window defaults to 250ms here (jsdom loads no stylesheet), so
-// 400ms of silence guarantees decay.
-// Run: node test/activity-led.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("the activity LED pulses and decays", async ({ emitStatus, wsSocket, ledEl, sleep, failures }) => {
-  const ledLit = () =>
-    ledEl.classList.contains("status-bar__led--green") ||
-    ledEl.classList.contains("status-bar__led--amber");
-
-  // Let any pulse from boot-time frames decay before asserting idle.
-  await sleep(400);
-  if (ledLit()) failures.push("the LED did not start idle after the pulse window");
-  emitStatus({ label: "delta", severity: "debug", activity: "generating" });
-  if (!ledEl.classList.contains("status-bar__led--green")) {
-    failures.push("generating activity did not light the LED green");
-  }
-  emitStatus({ label: "thinking", severity: "debug", activity: "thinking" });
-  if (!ledEl.classList.contains("status-bar__led--green")) {
-    failures.push("green did not win while generating and thinking were both lit");
-  }
-  if (ledEl.classList.contains("status-bar__led--amber")) {
-    failures.push("the thinking modifier applied while generating was lit");
-  }
-  await sleep(400);
-  if (ledLit()) failures.push("the LED stayed lit past the pulse window");
-  emitStatus({ label: "thinking", severity: "debug", activity: "thinking" });
-  if (!ledEl.classList.contains("status-bar__led--amber")) {
-    failures.push("thinking activity did not light the LED amber");
-  }
-  await sleep(400);
-  if (ledLit()) failures.push("the LED stayed lit past the pulse window");
-
-  // A sustained thinking glow goes dark when the persistent socket drops.
-  emitStatus({ label: "thinking", severity: "info", activity: "thinking" });
-  await sleep(400);
-  if (!ledEl.classList.contains("status-bar__led--amber")) {
-    failures.push("sustained thinking did not hold the LED amber past the pulse window");
-  }
-  wsSocket().onclose?.();
-  for (const lens of ["green", "amber", "red"]) {
-    if (ledEl.classList.contains(`status-bar__led--${lens}`)) {
-      failures.push(`the LED kept status-bar__led--${lens} after the socket dropped`);
-    }
-  }
-});
diff --git a/crates/workshop/ui/test/agent-keybindings.mjs b/crates/workshop/ui/test/agent-keybindings.mjs
deleted file mode 100644
index 7b3749b23..000000000
--- a/crates/workshop/ui/test/agent-keybindings.mjs
+++ /dev/null
@@ -1,491 +0,0 @@
-// The chat pane's chords and commands (src/parts/agent/agent.contribution.ts and
-// agent-commands.ts) against the real registries, the real keybinding
-// dispatcher, and a real Dockview dock in jsdom. Two layers:
-// - The chords: each key press goes through the dispatcher with a recording
-//   command registry, so the test reads which command a chord reaches under
-//   which context (activeEditor, editorTextFocus) without running it.
-//   Ctrl+Shift+Backspace stops and Escape does not; Ctrl+L and Ctrl+I open
-//   the chat and Ctrl+Shift+L and Ctrl+Shift+I start one, beating the Go
-//   menu's Add Symbol stubs, which carry no chord any more; Ctrl+T and Ctrl+N
-//   open a chat tab while a chat is active, and Ctrl+N stays New Text File
-//   while the editor's own text is focused; Ctrl+[ and Ctrl+] cycle chat
-//   tabs, and while the editor's text is focused they stay Indent Line and
-//   Outdent Line instead of being swallowed; Ctrl+W closes one;
-//   Ctrl+. and Ctrl+/ open the composer's menus
-//   (Ctrl+/ beating Toggle Line Comment); Ctrl+Shift+Space is Voice Input;
-//   and Shift+Tab is no chord at all, so it keeps moving focus backwards
-//   everywhere else.
-// - The commands: Open Chat hides the pane when the chat has focus and
-//   otherwise reveals it and focuses the composer; New Chat reuses an empty
-//   chat or opens one; Stop reaches the active chat; the tab cycle walks the
-//   group's chats; Close Tab hides the pane when it closes the last chat.
-// Run: node test/agent-keybindings.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/editor/closed-editors.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      import "./src/parts/menu/stubs.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { resolvePanelContent } from "@workshop/platform/panel-registry";
-      export { getService } from "@workshop/platform/service-registry";
-      export { KeybindingDispatcher } from "./src/parts/layout/keybinding-dispatcher.ts";
-      export { bindActiveEditorKey, groupOfZone, initZones, openInZone } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM('<!doctype html><html><body><div id="dock"></div></body></html>', {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-
-globalThis.fetch = async (url) => {
-  throw new Error(`unexpected fetch in the agent-keybindings test: ${url}`);
-};
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "Window",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-// The agent panel composes an AgentSocket on init; a socket that never
-// opens keeps it inert - this test drives the commands, not the wire.
-globalThis.WebSocket = class {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  readyState = 0;
-  send() {}
-  close() {}
-};
-if (typeof window.crypto?.randomUUID !== "function") {
-  let serial = 0;
-  Object.defineProperty(window, "crypto", {
-    configurable: true,
-    value: { randomUUID: () => `uuid-${(serial += 1)}` },
-  });
-}
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-keybindings-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  Commands,
-  CONTEXT_KEY_SERVICE,
-  KeybindingsRegistry,
-  resolvePanelContent,
-  getService,
-  KeybindingDispatcher,
-  bindActiveEditorKey,
-  groupOfZone,
-  initZones,
-  openInZone,
-  createPanelComponent,
-  createPanelTabComponent,
-  PANEL_TAB,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 6; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const contextKeys = getService(CONTEXT_KEY_SERVICE);
-const activeEditorKey = contextKeys.createKey("activeEditor", undefined);
-const editorTextFocusKey = contextKeys.createKey("editorTextFocus", false);
-
-// --- The chords: which command each press reaches ---------------------------------------
-
-const executed = [];
-const dispatcher = new KeybindingDispatcher({
-  commands: {
-    execute: (id) => {
-      executed.push(id);
-      return Promise.resolve();
-    },
-  },
-  status: { show() {}, clear() {} },
-});
-
-const CODES = {
-  l: "KeyL",
-  i: "KeyI",
-  t: "KeyT",
-  n: "KeyN",
-  q: "KeyQ",
-  w: "KeyW",
-  ".": "Period",
-  "/": "Slash",
-  "[": "BracketLeft",
-  "]": "BracketRight",
-  backspace: "Backspace",
-  space: "Space",
-  escape: "Escape",
-  tab: "Tab",
-};
-
-/** Presses a chord and answers the command it reached, or null. */
-async function press(key, { activeEditor, textFocus = false, shift = false, ctrl = true } = {}) {
-  activeEditorKey.set(activeEditor);
-  editorTextFocusKey.set(textFocus);
-  executed.length = 0;
-  const event = new window.KeyboardEvent("keydown", {
-    key,
-    code: CODES[key],
-    ctrlKey: ctrl,
-    shiftKey: shift,
-    bubbles: true,
-    cancelable: true,
-  });
-  window.document.dispatchEvent(event);
-  await flush();
-  return { command: executed[0] ?? null, consumed: event.defaultPrevented };
-}
-
-{
-  const stop = await press("backspace", { activeEditor: "agent", shift: true });
-  check("Ctrl+Shift+Backspace in a chat is composer.cancelComposerStep", stop.command === "composer.cancelComposerStep");
-  const elsewhere = await press("backspace", { activeEditor: "editor", shift: true });
-  check("Ctrl+Shift+Backspace outside a chat reaches nothing", elsewhere.command === null);
-  const escape = await press("escape", { activeEditor: "agent", ctrl: false });
-  check("Escape in a chat stops nothing and reaches no command", escape.command === null && escape.consumed === false);
-  check(
-    "no keybinding rule binds Escape to the stop command",
-    !KeybindingsRegistry.getResolver().hasRuleForChord({ ctrl: false, shift: false, alt: false, meta: false, key: "escape" }),
-  );
-
-  check("Ctrl+L opens the chat from anywhere", (await press("l", { activeEditor: "editor" })).command === "workbench.action.chat.open");
-  check("Ctrl+I opens the chat from anywhere", (await press("i", { activeEditor: "editor" })).command === "workbench.action.chat.open");
-  check(
-    "Ctrl+Shift+L starts a chat from anywhere",
-    (await press("l", { activeEditor: "editor", shift: true })).command === "workbench.action.chat.new",
-  );
-  check(
-    "Ctrl+Shift+I starts a chat from anywhere",
-    (await press("i", { activeEditor: "editor", shift: true })).command === "workbench.action.chat.new",
-  );
-  check(
-    "Ctrl+Shift+L with the editor's text focused still starts a chat, not Select All Occurrences",
-    (await press("l", { activeEditor: "editor", shift: true, textFocus: true })).command === "workbench.action.chat.new",
-  );
-  const ctrlQ = await press("q", { activeEditor: "editor" });
-  check(
-    "Ctrl+Q reaches no command (Open View is a disabled stub) but is swallowed, so nothing quits",
-    ctrlQ.command === null && ctrlQ.consumed === true,
-  );
-  check(
-    "Toggle Developer Tools and Select All Occurrences still show the chords the chat wins",
-    KeybindingsRegistry.lookupKeybinding("workbench.action.toggleDevTools")?.getLabel() === "Ctrl+Shift+I" &&
-      KeybindingsRegistry.lookupKeybinding("editor.action.selectHighlights")?.getLabel() === "Ctrl+Shift+L",
-  );
-  check(
-    "the Go menu's Add Symbol rows carry none of the chords the chat holds",
-    KeybindingsRegistry.lookupKeybinding("workbench.action.addSymbolToCurrentChat") === undefined &&
-      KeybindingsRegistry.lookupKeybinding("workbench.action.addSymbolToNewChat") === undefined,
-  );
-  check(
-    "Open Chat and New Chat show their first chords as labels",
-    KeybindingsRegistry.lookupKeybinding("workbench.action.chat.open")?.getLabel() === "Ctrl+L" &&
-      KeybindingsRegistry.lookupKeybinding("workbench.action.chat.new")?.getLabel() === "Ctrl+Shift+L",
-  );
-
-  check(
-    "Ctrl+T in a chat is New Chat Tab",
-    (await press("t", { activeEditor: "agent" })).command === "workbench.action.chat.newTab",
-  );
-  check(
-    "Ctrl+T outside a chat reaches no command (the Go to Symbol stub is disabled)",
-    (await press("t", { activeEditor: "editor" })).command === null,
-  );
-  check(
-    "Ctrl+N in a chat is New Chat Tab",
-    (await press("n", { activeEditor: "agent" })).command === "workbench.action.chat.newTab",
-  );
-  check(
-    "Ctrl+N stays New Text File while the editor's text is focused",
-    (await press("n", { activeEditor: "agent", textFocus: true })).command === "workbench.action.files.newUntitledFile",
-  );
-  check(
-    "Ctrl+N outside a chat is New Text File",
-    (await press("n", { activeEditor: "editor" })).command === "workbench.action.files.newUntitledFile",
-  );
-
-  check("Ctrl+] in a chat cycles to the next tab", (await press("]", { activeEditor: "agent" })).command === "workbench.action.chat.nextTab");
-  check("Ctrl+[ in a chat cycles to the previous tab", (await press("[", { activeEditor: "agent" })).command === "workbench.action.chat.previousTab");
-  // The editor's indent chords: the dispatcher swallows a claimed chord even
-  // where its `when` fails, so the editor must own Ctrl+] and Ctrl+[ through
-  // rules of its own or CodeMirror's indentMore and indentLess never see them.
-  const indent = await press("]", { activeEditor: "editor", textFocus: true });
-  check(
-    "Ctrl+] with the editor's text focused is Indent Line, not swallowed with no command",
-    indent.command === "editor.action.indentLines" && indent.consumed === true,
-  );
-  const outdent = await press("[", { activeEditor: "editor", textFocus: true });
-  check(
-    "Ctrl+[ with the editor's text focused is Outdent Line, not swallowed with no command",
-    outdent.command === "editor.action.outdentLines" && outdent.consumed === true,
-  );
-  check(
-    "Ctrl+] and Ctrl+[ with an editor active but its text not focused reach no command",
-    (await press("]", { activeEditor: "editor" })).command === null &&
-      (await press("[", { activeEditor: "editor" })).command === null,
-  );
-  check("Ctrl+W in a chat closes the tab", (await press("w", { activeEditor: "agent" })).command === "workbench.action.chat.closeTab");
-  check("Ctrl+. in a chat opens the mode menu", (await press(".", { activeEditor: "agent" })).command === "composer.openModeMenu");
-  check("Ctrl+/ in a chat opens the model menu", (await press("/", { activeEditor: "agent" })).command === "composer.openModelMenu");
-  check(
-    "Ctrl+/ in the editor is still Toggle Line Comment",
-    (await press("/", { activeEditor: "editor", textFocus: true })).command === "editor.action.commentLine",
-  );
-  check(
-    "Ctrl+Shift+Space in a chat is Voice Input",
-    (await press("space", { activeEditor: "agent", shift: true })).command === "workbench.action.chat.toggleVoiceInput",
-  );
-  check(
-    "Shift+Tab is no registered chord, so no control loses its way backwards",
-    !KeybindingsRegistry.getResolver().hasRuleForChord({ ctrl: false, shift: true, alt: false, meta: false, key: "tab" }),
-  );
-  const shiftTab = await press("tab", { activeEditor: "agent", shift: true, ctrl: false });
-  check("Shift+Tab reaches no command and is not consumed", shiftTab.command === null && shiftTab.consumed === false);
-}
-dispatcher.dispose();
-
-// --- The commands against a real dock --------------------------------------------------
-
-const dock = createDockview(window.document.getElementById("dock"), {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  defaultTabComponent: PANEL_TAB,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-bindActiveEditorKey(dock);
-dock.layout(1200, 800);
-
-/** The real panel behind a dock panel, its handle methods replaceable by spies. */
-const realPanelOf = (panel) => resolvePanelContent(panel.view.content);
-
-const first = openInZone("agent", { instance: "one" });
-await flush();
-const firstPanel = realPanelOf(first);
-check("the first chat's panel mounted, so its handle is live", typeof firstPanel.focusInput === "function");
-
-// Spies stand in for what a live session reports.
-const spies = new Map();
-function spyOn(panel, state) {
-  const record = { focus: 0, cancels: 0, voice: 0, modeMenus: 0, modelMenus: 0, ...state };
-  spies.set(panel, record);
-  panel.focusInput = () => {
-    record.focus += 1;
-  };
-  panel.hasFocus = () => record.hasFocus;
-  panel.isEmpty = () => record.empty;
-  panel.cancelTurn = () => {
-    record.cancels += 1;
-    return true;
-  };
-  panel.toggleVoiceInput = () => {
-    record.voice += 1;
-  };
-  panel.openModeMenu = () => {
-    record.modeMenus += 1;
-  };
-  panel.openModelMenu = () => {
-    record.modelMenus += 1;
-  };
-  return record;
-}
-const firstSpy = spyOn(firstPanel, { hasFocus: false, empty: false });
-
-// Stop, voice, and the menus reach the active chat only.
-first.api.setActive();
-await Commands.execute("composer.cancelComposerStep");
-await Commands.execute("workbench.action.chat.toggleVoiceInput");
-await Commands.execute("composer.openModeMenu");
-await Commands.execute("composer.openModelMenu");
-check(
-  "Stop, Voice Input, and both menus reach the active chat",
-  firstSpy.cancels === 1 && firstSpy.voice === 1 && firstSpy.modeMenus === 1 && firstSpy.modelMenus === 1,
-);
-
-// Open Chat: focus in the chat hides the pane; without focus it reveals the pane and focuses the composer.
-firstSpy.hasFocus = true;
-await Commands.execute("workbench.action.chat.open");
-check("Open Chat with the chat focused hides the pane", groupOfZone("right")?.api.isVisible === false);
-check("hiding the pane clears the Secondary Side Bar key", contextKeys.getValue("auxiliaryBarVisible") === false);
-firstSpy.hasFocus = false;
-await Commands.execute("workbench.action.chat.open");
-await flush();
-check("Open Chat without focus reveals the pane", groupOfZone("right")?.api.isVisible === true);
-check("Open Chat without focus sets the Secondary Side Bar key", contextKeys.getValue("auxiliaryBarVisible") === true);
-check("Open Chat focuses the composer", firstSpy.focus >= 1);
-
-// New Chat reuses an empty chat; a busy chat means a new tab.
-const panelsBefore = dock.panels.length;
-firstSpy.empty = true;
-const focusBefore = firstSpy.focus;
-await Commands.execute("workbench.action.chat.new");
-await flush();
-check("New Chat reuses an empty chat instead of opening a tab", dock.panels.length === panelsBefore);
-check("the reused chat takes focus", firstSpy.focus === focusBefore + 1);
-firstSpy.empty = false;
-await Commands.execute("workbench.action.chat.newTab");
-await flush();
-const agents = dock.panels.filter((panel) => panel.api.component === "agent");
-check("with no empty chat, New Chat Tab opens a second one", agents.length === 2);
-const second = agents.find((panel) => panel !== first);
-check("the new tab lands in the same right group", second?.group.id === first.group.id);
-
-// The tab cycle.
-const secondPanel = realPanelOf(second);
-await flush();
-spyOn(secondPanel, { hasFocus: false, empty: false });
-second.api.setActive();
-await Commands.execute("workbench.action.chat.nextTab");
-check("Next Chat Tab wraps from the last tab to the first", dock.activePanel?.id === first.id);
-await Commands.execute("workbench.action.chat.previousTab");
-check("Previous Chat Tab wraps back from the first to the last", dock.activePanel?.id === second.id);
-await Commands.execute("workbench.action.chat.previousTab");
-check("Previous Chat Tab steps back one", dock.activePanel?.id === first.id);
-
-// The close rows.
-await Commands.execute("workbench.action.chat.closeTab", { panelId: second.id });
-await flush();
-check("Close Tab closes the named chat", dock.getPanel(second.id) === undefined);
-check("closing one of two chats leaves the pane showing", groupOfZone("right")?.api.isVisible === true);
-const third = openInZone("agent", { instance: "three" });
-await flush();
-await Commands.execute("workbench.action.chat.closeOtherTabs", { panelId: third.id });
-await flush();
-check("Close Other Tabs closes the group's other chats", dock.getPanel(first.id) === undefined && dock.getPanel(third.id) !== undefined);
-const fourth = openInZone("agent", { instance: "four" });
-await flush();
-await Commands.execute("workbench.action.chat.closeAllTabs", { panelId: fourth.id });
-await flush();
-check(
-  "Close All Tabs closes every chat in the group",
-  dock.panels.filter((panel) => panel.api.component === "agent").length === 0,
-);
-check(
-  "closing the last chat hides the right zone, which stays alive and empty",
-  groupOfZone("right") !== undefined &&
-    groupOfZone("right").panels.length === 0 &&
-    groupOfZone("right").api.isVisible === false &&
-    contextKeys.getValue("auxiliaryBarVisible") === false,
-);
-
-// With no chat open, Open Chat opens one, reveals the zone, and focuses its composer.
-await Commands.execute("workbench.action.chat.open");
-await flush();
-const reopened = dock.panels.filter((panel) => panel.api.component === "agent");
-check("Open Chat with no chat opens one", reopened.length === 1);
-check("the new chat's zone is showing", groupOfZone("right")?.api.isVisible === true);
-
-if (failures.length > 0) {
-  console.error(`agent-keybindings: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-keybindings: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-menu.mjs b/crates/workshop/ui/test/agent-menu.mjs
deleted file mode 100644
index 3ad161d1f..000000000
--- a/crates/workshop/ui/test/agent-menu.mjs
+++ /dev/null
@@ -1,183 +0,0 @@
-// The agent menu (src/parts/agent/agent-menu.ts) in jsdom against a scripted
-// delegate: discovered agents render as launch buttons; an empty
-// discovery shows the empty note; clicking launches through the
-// delegate and disables the buttons until an error frees them; a launch
-// while the socket is down shows the local failure note; the list
-// re-renders on every discovery push. Run: node test/agent-menu.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { Emitter } from "@workshop/platform/event";
-      export { AgentMenu } from "./src/parts/agent/agent-menu.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-const { window } = dom;
-for (const key of ["document", "HTMLElement", "Node", "Element", "Event"]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-menu-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, Emitter, AgentMenu } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The scripted delegate: the AgentSessionService slice the menu reads.
-function makeDelegate(agents = []) {
-  const changed = new Emitter();
-  const errors = new Emitter();
-  return {
-    agents,
-    onDidChangeAgents: changed.event,
-    onError: errors.event,
-    launched: [],
-    launchResult: true,
-    launch(agent) {
-      this.launched.push(agent);
-      return this.launchResult;
-    },
-    push(list) {
-      this.agents = list;
-      changed.fire(list);
-    },
-    fail(message) {
-      errors.fire(message);
-    },
-  };
-}
-
-const buttonsOf = (menu) => [...menu.element.querySelectorAll(".ws-agent-menu__launch")];
-const emptyOf = (menu) => menu.element.querySelector(".ws-agent-menu__empty");
-const errorOf = (menu) => menu.element.querySelector(".ws-agent-menu__error");
-
-await assertNoLeaks(lifecycle, () => {
-  // --- Discovery renders as launch buttons; empty shows the note -----------
-
-  {
-    const delegate = makeDelegate([]);
-    const menu = new AgentMenu(delegate);
-    check("an empty discovery shows the empty note", emptyOf(menu).hidden === false);
-    check("an empty discovery renders no buttons", buttonsOf(menu).length === 0);
-    check(
-      "the empty state has no lead text: the list opens the menu",
-      menu.element.querySelector(".ws-agent-menu__lead") === null &&
-        menu.element.firstElementChild?.classList.contains("ws-agent-menu__list") === true &&
-        !menu.element.textContent.includes("Launch an agent"),
-    );
-    delegate.push(["chat", "research"]);
-    check(
-      "every discovered agent renders as a launch button, in order",
-      isDeepStrictEqual(buttonsOf(menu).map((button) => button.textContent), [
-        "chat",
-        "research",
-      ]),
-    );
-    check("a non-empty discovery hides the empty note", emptyOf(menu).hidden === true);
-    delegate.push(["solo"]);
-    check(
-      "a later push re-renders the complete snapshot",
-      isDeepStrictEqual(buttonsOf(menu).map((button) => button.textContent), ["solo"]),
-    );
-    menu.dispose();
-  }
-
-  // --- Launching dispatches, disables, and an error frees the menu ---------
-
-  {
-    const delegate = makeDelegate(["chat", "research"]);
-    const menu = new AgentMenu(delegate);
-    buttonsOf(menu)[0].click();
-    check("clicking a button launches its agent", isDeepStrictEqual(delegate.launched, ["chat"]));
-    check(
-      "a sent launch disables the buttons until the server answers",
-      buttonsOf(menu).every((button) => button.disabled),
-    );
-    buttonsOf(menu)[1].click();
-    check("a disabled menu launches nothing more", isDeepStrictEqual(delegate.launched, ["chat"]));
-    delegate.fail("unknown agent: chat");
-    check("a refused launch shows the server's message", errorOf(menu).textContent === "unknown agent: chat");
-    check("the error is visible", errorOf(menu).hidden === false);
-    check(
-      "the error frees the menu for another launch",
-      buttonsOf(menu).every((button) => !button.disabled),
-    );
-    buttonsOf(menu)[1].click();
-    check(
-      "the freed menu launches again",
-      isDeepStrictEqual(delegate.launched, ["chat", "research"]),
-    );
-    check("a new launch clears the stale error", errorOf(menu).hidden === true);
-    menu.dispose();
-  }
-
-  // --- A launch while the socket is down shows the local note --------------
-
-  {
-    const delegate = makeDelegate(["chat"]);
-    delegate.launchResult = false;
-    const menu = new AgentMenu(delegate);
-    buttonsOf(menu)[0].click();
-    check("the failed send shows the local socket-down note", errorOf(menu).hidden === false);
-    check(
-      "a failed send leaves the menu enabled for the retry",
-      buttonsOf(menu).every((button) => !button.disabled),
-    );
-    menu.dispose();
-  }
-
-  // --- Disposal severs the delegate subscriptions ---------------------------
-
-  {
-    const delegate = makeDelegate(["chat"]);
-    const menu = new AgentMenu(delegate);
-    menu.dispose();
-    delegate.push(["chat", "late"]);
-    check(
-      "a disposed menu stops re-rendering",
-      buttonsOf(menu).length === 1,
-    );
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`ws-agent-menu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-agent-menu: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-session-service.mjs b/crates/workshop/ui/test/agent-session-service.mjs
deleted file mode 100644
index 3189a4b05..000000000
--- a/crates/workshop/ui/test/agent-session-service.mjs
+++ /dev/null
@@ -1,1155 +0,0 @@
-// The agent-session view model (src/services/agent-session.ts) against a
-// scripted wire, no DOM: durable events fold into transcript items in
-// log order; ephemeral deltas coalesce into pending items by their
-// superseding reply id, per channel, and the durable event replaces
-// them; late deltas after their round settled are dropped, a settle drops
-// every earlier round's pending items, and the operator's message drops
-// those of the round it withdrew; respond sends the operator's text alone,
-// at any time; a new session id resets the transcript; errors fold as
-// items. The turn's liveness rides along: an injected clock stamps each
-// thought's start and end, `generating` turns off at `awaiting_input` and
-// on at the next `user_message`, so a replayed log ends in the right
-// state, `started` turns on with the session's first report, `run_ended`
-// turns both off, a same-session reattach before a send's echo returns to
-// the state the log left, `reconnecting` follows its rule, a result still
-// counts across a steering message, `cancelTurn` settles the service's own
-// view until a newer round shows the agent went on, the latest batch ends
-// at the agent's wait, at the run's end, and at that newer round, tool
-// rows carry their bound tool id, and errors carry their popup title.
-// Run: node test/agent-session-service.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { Emitter } from "@workshop/platform/event";
-      export { AgentSessionService } from "./src/services/agent-session.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-session-service-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, Emitter, AgentSessionService } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The scripted wire: the AgentSocket surface the service consumes, with
-// test-side fire methods and send recorders.
-function makeWire() {
-  const emitters = {
-    agents: new Emitter(),
-    session: new Emitter(),
-    event: new Emitter(),
-    delta: new Emitter(),
-    error: new Emitter(),
-    disconnect: new Emitter(),
-  };
-  return {
-    onAgents: emitters.agents.event,
-    onSession: emitters.session.event,
-    onEvent: emitters.event.event,
-    onDelta: emitters.delta.event,
-    onError: emitters.error.event,
-    onDisconnect: emitters.disconnect.event,
-    launched: [],
-    responses: [],
-    cancels: 0,
-    launchResult: true,
-    respondResult: true,
-    cancelResult: true,
-    launch(agent) {
-      this.launched.push(agent);
-      return this.launchResult;
-    },
-    respond(...args) {
-      this.responses.push(args);
-      return this.respondResult;
-    },
-    cancelTurn() {
-      this.cancels++;
-      return this.cancelResult;
-    },
-    fire: {
-      disconnect: () => emitters.disconnect.fire(undefined),
-      agents: (list) => emitters.agents.fire(list),
-      session: (session, agent = "chat") =>
-        emitters.session.fire({ type: "agent_session", session, agent }),
-      event: (kind, content, extra = {}) => {
-        const { reply, ...eventFields } = extra;
-        const frame = {
-          type: "agent_event",
-          index: 0,
-          event: { kind, section: "chat", turn: 0, content, ...eventFields },
-        };
-        if (reply !== undefined) frame.reply = reply;
-        emitters.event.fire(frame);
-      },
-      delta: (kind, content, reply) =>
-        emitters.delta.fire({ type: "agent_delta", kind, content, reply }),
-      // The agent parks on its empty inbox, as the durable log says.
-      awaiting: () =>
-        emitters.event.fire({
-          type: "agent_event",
-          index: 0,
-          event: { kind: "awaiting_input", section: "chat", turn: 0, content: "" },
-        }),
-      error: (message) => emitters.error.fire(message),
-    },
-    disposeEmitters: () => {
-      for (const emitter of Object.values(emitters)) emitter.dispose();
-    },
-  };
-}
-
-await assertNoLeaks(lifecycle, () => {
-  // --- Durable events fold into transcript items in log order --------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    let transcriptFires = 0;
-    service.onDidChangeTranscript(() => transcriptFires++);
-    wire.fire.event("user_message", "hi there");
-    wire.fire.event("agent_thought", "let me see", { model: "llama-3", reply: 0 });
-    wire.fire.event("agent_message", "hello", { model: "llama-3", reply: 0 });
-    wire.fire.event("tool_call", '[{"id":"call_1","name":"read","arguments":{"path":"a"}}]', {
-      model: "llama-3",
-      reply: 1,
-    });
-    wire.fire.event("tool_call_update", "file body", { tool_call_id: "call_1" });
-    const kinds = service.items.map((item) => item.kind);
-    check(
-      "durable events fold in log order",
-      isDeepStrictEqual(kinds, ["user", "reasoning", "reply", "tool-call", "tool-result"]),
-    );
-    check(
-      "the user item holds the byte-exact text",
-      service.items[0].text === "hi there",
-    );
-    check(
-      "reply and reasoning items record their model label",
-      service.items[1].model === "llama-3" && service.items[2].model === "llama-3",
-    );
-    check(
-      "a settled durable item is not pending",
-      service.items[1].pending === false && service.items[2].pending === false,
-    );
-    check(
-      "the tool-call batch parses into one row per call",
-      isDeepStrictEqual(service.items[3].calls, [
-        { id: "call_1", name: "read", args: '{"path":"a"}', tool: null, vendor: null },
-      ]),
-    );
-    check(
-      "the tool result keeps its call id and content",
-      service.items[4].toolCallId === "call_1" && service.items[4].text === "file body",
-    );
-    check("every fold fired the transcript change", transcriptFires === 5);
-    service.dispose();
-  }
-
-  // --- Deltas coalesce by reply id and the durable event replaces them -----
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.delta("text", "Hel", 0);
-    wire.fire.delta("text", "lo", 0);
-    check(
-      "text deltas coalesce into one pending reply",
-      service.items.length === 1 &&
-        service.items[0].kind === "reply" &&
-        service.items[0].pending === true &&
-        service.items[0].text === "Hello",
-    );
-    wire.fire.delta("reasoning", "hmm", 0);
-    wire.fire.delta("reasoning", " ok", 0);
-    check(
-      "reasoning deltas coalesce into their own pending item",
-      service.items.length === 2 &&
-        service.items[1].kind === "reasoning" &&
-        service.items[1].text === "hmm ok",
-    );
-    wire.fire.event("agent_thought", "hmm ok settled", { model: "m", reply: 0 });
-    check(
-      "the thought event replaces only the reasoning channel",
-      service.items.length === 2 &&
-        service.items[0].kind === "reply" &&
-        service.items[0].pending === true &&
-        service.items[1].kind === "reasoning" &&
-        service.items[1].pending === false &&
-        service.items[1].text === "hmm ok settled",
-    );
-    wire.fire.event("agent_message", "Hello there", { model: "m", reply: 0 });
-    check(
-      "the reply event replaces the coalesced text deltas",
-      service.items.length === 2 &&
-        service.items[1].kind === "reply" &&
-        service.items[1].pending === false &&
-        service.items[1].text === "Hello there",
-    );
-    wire.fire.delta("text", "late", 0);
-    check(
-      "a late delta after its round settled is dropped",
-      service.items.length === 2,
-    );
-    wire.fire.delta("text", "next", 1);
-    check(
-      "the next round's deltas open a fresh pending reply",
-      service.items.length === 3 && service.items[2].pending === true,
-    );
-    service.dispose();
-  }
-
-  // --- A tool-call batch settles its round's pending deltas ----------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.delta("reasoning", "planning", 0);
-    wire.fire.event("tool_call", '[{"id":"c1","name":"search","arguments":{}}]', {
-      model: "m",
-      reply: 0,
-    });
-    check(
-      "a tool-call batch supersedes its round's pending deltas",
-      service.items.length === 1 && service.items[0].kind === "tool-call",
-    );
-    check(
-      "the batch keeps its model label",
-      service.items[0].model === "m",
-    );
-    service.dispose();
-  }
-
-  // --- A settle drops every earlier round's pending items -------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.delta("text", "cut off", 0);
-    wire.fire.delta("reasoning", "half a thought", 0);
-    wire.fire.event("agent_message", "the next round", { reply: 1 });
-    check(
-      "a round's settle drops the pending items of every earlier round",
-      service.items.length === 1 && service.items[0].reply === 1 && service.items[0].pending === false,
-    );
-    service.dispose();
-  }
-
-  // --- A steering message withdraws the round streaming as it lands ----------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const log = [];
-    const event = (kind, content, extra = {}) => {
-      log.push([kind, content, extra]);
-      wire.fire.event(kind, content, extra);
-    };
-    wire.fire.session("s1");
-    event("user_message", "go");
-    wire.fire.delta("reasoning", "first thoughts", 1);
-    wire.fire.delta("text", "first answ", 1);
-    check("round 1 streams two pending items", service.items.filter((item) => item.pending).length === 2);
-    event("user_message", "steer");
-    check(
-      "the steering message drops the withdrawn round's pending items",
-      !service.items.some((item) => item.pending),
-    );
-    wire.fire.delta("text", "second ", 2);
-    wire.fire.delta("text", "late", 1);
-    wire.fire.delta("reasoning", "late", 1);
-    check(
-      "a late chunk of the withdrawn round opens nothing",
-      !service.items.some((item) => item.reply === 1),
-    );
-    wire.fire.delta("text", "answer", 2);
-    event("agent_message", "second answer", { reply: 2 });
-    check("no pending item remains", !service.items.some((item) => item.pending));
-    const replayWire = makeWire();
-    const replayed = new AgentSessionService(replayWire);
-    replayWire.fire.session("s1");
-    for (const [kind, content, extra] of log) {
-      replayWire.fire.event(kind, content, extra);
-    }
-    check(
-      "a replay of the durable log gives the same items",
-      isDeepStrictEqual(replayed.items, service.items),
-    );
-    replayed.dispose();
-    service.dispose();
-  }
-
-  // --- Malformed batch content degrades to the raw text --------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.event("tool_call", "not json", { model: "m" });
-    check(
-      "an unparsable tool-call batch keeps the raw text with no rows",
-      service.items[0].calls.length === 0 && service.items[0].text === "not json",
-    );
-    service.dispose();
-  }
-
-  // --- Unknown event kinds are tolerated and render nothing ----------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    let fires = 0;
-    service.onDidChangeTranscript(() => fires++);
-    wire.fire.event("plan", "a future kind");
-    check(
-      "an unknown event kind folds nothing and fires nothing",
-      service.items.length === 0 && fires === 0,
-    );
-    service.dispose();
-  }
-
-  // --- respond sends the operator's text alone, at any time -----------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    check("respond answers the waiting agent", service.respond("hi  ") === true);
-    wire.fire.event("user_message", "hi  ");
-    check("respond steers the working agent too", service.respond("and more") === true);
-    check(
-      "each message went out as its text alone, byte-exact, with no wait token",
-      isDeepStrictEqual(wire.responses, [["hi  "], ["and more"]]),
-    );
-    check(
-      "the text never enters the transcript until the server records it",
-      service.items.length === 1 && service.items[0].kind === "user",
-    );
-    service.dispose();
-  }
-
-  // --- A failed respond folds a local error ----------------------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.awaiting();
-    wire.respondResult = false;
-    check("a failed send reports false", service.respond("hi") === false);
-    check(
-      "the failure folds as an error item",
-      service.items.length === 1 && service.items[0].kind === "error",
-    );
-    check("a failed send leaves generating off", service.generating === false);
-    service.dispose();
-  }
-
-  // --- started: the session's first report, until a new session ---------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const seen = [];
-    service.onDidChangeStarted((value) => seen.push(value));
-    check("no session has started at construction", service.started === false);
-    wire.fire.session("s1");
-    check(
-      "an acknowledged session has not started until its run reports",
-      service.started === false,
-    );
-    wire.fire.error("the run has no model yet");
-    check("an error is no report of the run's", service.started === false);
-    wire.fire.awaiting();
-    check("the agent's first wait on its inbox starts it", service.started === true);
-    wire.fire.session("s1");
-    check("a same-session reattach keeps it started", service.started === true);
-    wire.fire.session("s2");
-    check("a new session has not started", service.started === false);
-    wire.fire.delta("text", "already working", 0);
-    check("a working agent's first chunk starts it", service.started === true);
-    wire.fire.session("s3");
-    wire.fire.event("tool_call", "[]", { reply: 0 });
-    check("any durable event of the run starts it", service.started === true);
-    check("only real changes fired", isDeepStrictEqual(seen, [true, false, true, false, true]));
-    service.dispose();
-  }
-
-  // --- run_ended: the run takes no more messages ------------------------------
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("bye");
-    wire.fire.event("user_message", "bye");
-    wire.fire.delta("reasoning", "wrapping up", 0);
-    const started = [];
-    const generating = [];
-    let transcriptFires = 0;
-    service.onDidChangeStarted((value) => started.push(value));
-    service.onDidChangeGenerating((value) => generating.push(value));
-    service.onDidChangeTranscript(() => transcriptFires++);
-    clock.now = 40;
-    wire.fire.event("run_ended", "");
-    check(
-      "run_ended turns generating off",
-      service.generating === false && isDeepStrictEqual(generating, [false]),
-    );
-    check(
-      "run_ended turns started off: the run takes no more messages",
-      service.started === false && isDeepStrictEqual(started, [false]),
-    );
-    check("run_ended ends the open thinking", service.items[1].endedAt === 40);
-    check(
-      "run_ended renders no item, and announces the ended thinking once",
-      service.items.length === 2 && transcriptFires === 1,
-    );
-    service.dispose();
-  }
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    const started = [];
-    service.onDidChangeStarted((value) => started.push(value));
-    wire.fire.session("s1");
-    wire.fire.event("run_ended", "");
-    check(
-      "a run whose end is its first report never reads as started",
-      service.started === false && isDeepStrictEqual(started, []),
-    );
-    wire.fire.awaiting();
-    service.respond("go");
-    service.cancelTurn();
-    wire.fire.event("run_ended", "");
-    clock.now = 20;
-    wire.fire.delta("reasoning", "after the end", 0);
-    check(
-      "run_ended clears the stop, so a first chunk after it streams",
-      service.items[0].startedAt === 20 && service.items[0].endedAt === null,
-    );
-    service.dispose();
-  }
-
-  // --- Session acknowledgments: transcript reset on a new id -----------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const sessions = [];
-    service.onDidChangeSession((frame) => sessions.push(frame.session));
-    // A refused launch folds a pre-session error; the session that then
-    // starts leaves it out of its feed.
-    wire.fire.error("unknown agent: bad");
-    wire.fire.session("s1");
-    check(
-      "the first acknowledgment starts the session's transcript clean",
-      service.items.length === 0 && service.session?.session === "s1",
-    );
-    wire.fire.event("user_message", "one");
-    wire.fire.session("s1");
-    check("a same-session reattach keeps the transcript", service.items.length === 1);
-    wire.fire.session("s2");
-    check("a new session id resets the transcript", service.items.length === 0);
-    check("every acknowledgment fired", isDeepStrictEqual(sessions, ["s1", "s1", "s2"]));
-    service.dispose();
-  }
-
-  // --- Errors fold as items and re-fire; agents list snapshots --------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const heard = [];
-    service.onError((message) => heard.push(message));
-    wire.fire.error("unknown agent");
-    check(
-      "an error frame folds as an error item and re-fires",
-      service.items[0]?.kind === "error" &&
-        service.items[0].message === "unknown agent" &&
-        isDeepStrictEqual(heard, ["unknown agent"]),
-    );
-    wire.fire.agents(["chat", "research"]);
-    check(
-      "the agents snapshot updates",
-      isDeepStrictEqual([...service.agents], ["chat", "research"]),
-    );
-    check("launch forwards to the wire", service.launch("chat") === true);
-    check("the launch named its agent", isDeepStrictEqual(wire.launched, ["chat"]));
-    service.dispose();
-  }
-
-  // --- Reasoning timing: stamps come from the injected clock -----------------
-
-  {
-    const wire = makeWire();
-    const clock = { now: 100 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.delta("reasoning", "hmm", 0);
-    check(
-      "the first reasoning delta stamps startedAt and leaves endedAt open",
-      service.items[0].startedAt === 100 && service.items[0].endedAt === null,
-    );
-    clock.now = 150;
-    wire.fire.delta("reasoning", " ok", 0);
-    check(
-      "a later reasoning delta keeps the round's startedAt",
-      service.items[0].text === "hmm ok" &&
-        service.items[0].startedAt === 100 &&
-        service.items[0].endedAt === null,
-    );
-    clock.now = 250;
-    wire.fire.delta("text", "other round", 1);
-    check(
-      "a text delta of another reply leaves the thinking open",
-      service.items[0].endedAt === null,
-    );
-    clock.now = 400;
-    wire.fire.delta("text", "Hel", 0);
-    check(
-      "the same reply's first text delta ends the thinking",
-      service.items[0].endedAt === 400 && service.items[0].startedAt === 100,
-    );
-    clock.now = 600;
-    wire.fire.delta("text", "lo", 0);
-    check("a later text delta does not move endedAt", service.items[0].endedAt === 400);
-    clock.now = 700;
-    wire.fire.event("agent_thought", "hmm ok settled", { model: "m", reply: 0 });
-    const durable = service.items.find((item) => item.kind === "reasoning" && !item.pending);
-    check(
-      "the durable thought copies both stamps from the pending item",
-      durable !== undefined && durable.startedAt === 100 && durable.endedAt === 400,
-    );
-    wire.fire.event("agent_thought", "replayed", { model: "m", reply: 7 });
-    const replayed = service.items[service.items.length - 1];
-    check(
-      "a durable thought with no pending item has no stamps",
-      replayed.startedAt === null && replayed.endedAt === null,
-    );
-    service.dispose();
-  }
-
-  {
-    const wire = makeWire();
-    const clock = { now: 1000 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.delta("reasoning", "planning", 0);
-    clock.now = 1300;
-    wire.fire.event("agent_thought", "planning", { model: "m", reply: 0 });
-    check(
-      "a round that never streamed text ends its thinking at the durable thought",
-      service.items[0].startedAt === 1000 && service.items[0].endedAt === 1300,
-    );
-
-    clock.now = 2000;
-    wire.fire.delta("reasoning", "thinking about an error", 1);
-    clock.now = 2500;
-    wire.fire.error("boom");
-    const afterError = service.items.find((item) => item.kind === "reasoning" && item.reply === 1);
-    check("an error ends the open thinking", afterError.endedAt === 2500);
-
-    clock.now = 3000;
-    wire.fire.delta("reasoning", "waiting on input", 2);
-    clock.now = 3400;
-    wire.fire.awaiting();
-    const afterInput = service.items.find((item) => item.kind === "reasoning" && item.reply === 2);
-    check("awaiting_input ends the open thinking", afterInput.endedAt === 3400);
-    clock.now = 9000;
-    wire.fire.error("again");
-    check(
-      "an error does not move an already-ended thinking",
-      afterInput === service.items.find((item) => item.kind === "reasoning" && item.reply === 2) &&
-        service.items.find((item) => item.kind === "reasoning" && item.reply === 1).endedAt === 2500,
-    );
-    service.dispose();
-  }
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.delta("reasoning", "default clock", 0);
-    check(
-      "without an injected clock the stamp is a finite performance.now() value",
-      Number.isFinite(service.items[0].startedAt) && service.items[0].startedAt >= 0,
-    );
-    service.dispose();
-  }
-
-  // --- generating: on at a send and the operator's message, off at a wait ---
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const seen = [];
-    service.onDidChangeGenerating((value) => seen.push(value));
-    check("generating is off at construction", service.generating === false);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    check("the agent waiting on its inbox leaves generating off", service.generating === false);
-    wire.respondResult = false;
-    service.respond("fails");
-    check("a failed respond does not turn generating on", service.generating === false);
-    wire.respondResult = true;
-    service.respond("go");
-    check("a successful respond turns generating on", service.generating === true);
-    wire.fire.event("user_message", "go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"fetch","arguments":{},"tool":"web/fetch"}]', {
-      reply: 0,
-    });
-    check("a tool-call batch alone leaves generating as it was", service.generating === true);
-    wire.fire.event("agent_message", "done", { reply: 1 });
-    check(
-      "an agent_message keeps generating on: a message that lands as the reply does goes on",
-      service.generating === true,
-    );
-    wire.fire.awaiting();
-    check("awaiting_input turns generating off", service.generating === false);
-    check("only real changes fired", isDeepStrictEqual(seen, [true, false]));
-    service.dispose();
-  }
-
-  {
-    // A replayed log, delivered with no send: each user_message turns
-    // generating on and each awaiting_input turns it off, so the replay
-    // ends in the state its last entry gives.
-    const replay = (kinds) => {
-      const wire = makeWire();
-      const service = new AgentSessionService(wire);
-      wire.fire.session("s1");
-      for (const kind of kinds) {
-        if (kind === "awaiting_input") wire.fire.awaiting();
-        else wire.fire.event(kind, kind, { reply: 0 });
-      }
-      const generating = service.generating;
-      service.dispose();
-      return generating;
-    };
-    check(
-      "a replay that ends on the agent's wait ends idle",
-      replay(["awaiting_input", "user_message", "agent_message", "awaiting_input"]) === false,
-    );
-    check(
-      "a replay that ends mid-turn ends working",
-      replay(["awaiting_input", "user_message", "agent_message", "awaiting_input", "user_message"]) === true,
-    );
-    check(
-      "the next user_message after a wait shows the agent working again",
-      replay(["awaiting_input", "user_message", "agent_message"]) === true,
-    );
-  }
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.event("user_message", "first turn");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"fetch","arguments":{},"tool":"web/fetch"}]', {
-      reply: 0,
-    });
-    // A sent cancel turns generating off; the result of a call it spared
-    // shows the agent working again.
-    service.cancelTurn();
-    check("a sent cancel turns generating off", service.generating === false);
-    wire.fire.event("tool_call_update", "page body", { tool_call_id: "c1" });
-    check(
-      "a tool_call_update answering a model batch call turns generating on",
-      service.generating === true,
-    );
-    wire.fire.awaiting();
-    wire.fire.event("user_message", "second turn");
-    service.cancelTurn();
-    wire.fire.event("tool_call_update", "stray", { tool_call_id: "c1" });
-    check(
-      "a tool_call_update whose call is in an earlier turn does not turn generating on",
-      service.generating === false,
-    );
-    wire.fire.event("tool_call_update", "no id");
-    check("a tool_call_update with no call id does not turn generating on", service.generating === false);
-    wire.fire.event("tool_call", '[{"id":"c2","name":"read","arguments":{}}]', { reply: 1 });
-    wire.fire.event("tool_call_update", "body", { tool_call_id: "c2" });
-    check("a result for the current turn's call turns generating on", service.generating === true);
-    wire.fire.error("server said no");
-    check("an error turns generating off", service.generating === false);
-    wire.fire.event("tool_call_update", "body", { tool_call_id: "c2" });
-    check("an answered call turns it back on", service.generating === true);
-    wire.fire.session("s1");
-    check("a same-session acknowledgment leaves generating alone", service.generating === true);
-    wire.fire.session("s2");
-    check("an acknowledgment with a new session id turns generating off", service.generating === false);
-    service.dispose();
-  }
-
-  {
-    // A steering message lands while a batch runs and one call fails: the
-    // rest of the batch still answers model calls.
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.fire.event("user_message", "go");
-    wire.fire.event(
-      "tool_call",
-      '[{"id":"c1","name":"read","arguments":{}},{"id":"c2","name":"fetch","arguments":{}}]',
-      { reply: 0 },
-    );
-    service.respond("steer");
-    wire.fire.event("user_message", "steer");
-    wire.fire.error("Tool call failed in agent `chat`");
-    check("the failed call's error frame turns generating off", service.generating === false);
-    wire.fire.event("tool_call_update", "page body", { tool_call_id: "c2" });
-    check("a later result of the steered batch turns generating back on", service.generating === true);
-    service.dispose();
-  }
-
-  // --- reconnecting: disconnect on, next acknowledgment off ------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const seen = [];
-    service.onDidChangeReconnecting((value) => seen.push(value));
-    check("reconnecting is off at construction", service.reconnecting === false);
-    wire.fire.disconnect();
-    check("a disconnect turns reconnecting on", service.reconnecting === true);
-    wire.fire.disconnect();
-    wire.fire.session("s1");
-    check("the next acknowledgment turns reconnecting off", service.reconnecting === false);
-    wire.fire.disconnect();
-    wire.fire.session("s1");
-    check(
-      "a same-session reattach acknowledgment also clears it",
-      service.reconnecting === false && isDeepStrictEqual(seen, [true, false, true, false]),
-    );
-    service.dispose();
-  }
-
-  // --- A same-session reattach before a send's echo -----------------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("maybe lost");
-    check("the send turns generating on", service.generating === true);
-    wire.fire.disconnect();
-    wire.fire.session("s1");
-    check(
-      "a reattach with the send unechoed returns to waiting, the state awaiting_input left",
-      service.generating === false,
-    );
-    wire.fire.event("user_message", "maybe lost");
-    check("an echo the replay brings turns working on again", service.generating === true);
-    service.dispose();
-  }
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("echoed");
-    wire.fire.event("user_message", "echoed");
-    wire.fire.disconnect();
-    wire.fire.session("s1");
-    check(
-      "a reattach after the send's echo keeps the agent working",
-      service.generating === true,
-    );
-    service.respond("steer");
-    wire.fire.disconnect();
-    wire.fire.session("s1");
-    check(
-      "a reattach before a steering message's echo keeps working, the state the log left",
-      service.generating === true,
-    );
-    // A new session's log echoes none of the old session's sends: after a
-    // cancel there, a reattach keeps the stop instead of restoring the
-    // working state its log left.
-    wire.fire.awaiting();
-    service.respond("then lost");
-    wire.fire.session("s2");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","arguments":{}}]', { reply: 0 });
-    wire.fire.event("tool_call_update", "body", { tool_call_id: "c1" });
-    service.cancelTurn();
-    wire.fire.session("s2");
-    check(
-      "a new session forgets the old session's unechoed send",
-      service.generating === false,
-    );
-    service.dispose();
-  }
-
-  // --- ToolCallRow.tool and vendor: the batch entry's strings, or null --------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.event(
-      "tool_call",
-      JSON.stringify([
-        { id: "a", name: "search", arguments: { query: "x" }, tool: "web/search", vendor: "runvil" },
-        { id: "b", name: "grab", arguments: {}, tool: "adhoc/grab" },
-        { id: "c", name: "odd", arguments: {}, tool: 5, vendor: 5 },
-        { id: "d", name: "empty", arguments: {}, tool: "", vendor: "" },
-        { id: "e", name: "nul", arguments: {}, tool: null, vendor: null },
-        { id: "f", name: "bare", arguments: {}, tool: "runvil/user-input/ask" },
-        { id: "g", name: "unstamped", arguments: {} },
-      ]),
-      { reply: 0 },
-    );
-    check(
-      "a batch entry's tool string parses onto its row, an adhoc id included",
-      isDeepStrictEqual(
-        service.items[0].calls.map((row) => row.tool),
-        ["web/search", "adhoc/grab", null, null, null, "runvil/user-input/ask", null],
-      ),
-    );
-    check(
-      "a batch entry's vendor string parses onto its row",
-      isDeepStrictEqual(
-        service.items[0].calls.map((row) => row.vendor),
-        ["runvil", null, null, null, null, null, null],
-      ),
-    );
-    wire.fire.event("tool_call", "[1, null, [], \"x\"]", { reply: 1 });
-    check("malformed entries produce no rows", service.items[1].calls.length === 0);
-    service.dispose();
-  }
-
-  // --- cancelTurn: forwards, then settles the service's own view --------------
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.fire.delta("reasoning", "thinking", 0);
-    clock.now = 90;
-    wire.respondResult = true;
-    wire.cancelResult = false;
-    check("a cancel on a down socket reports false", service.cancelTurn() === false);
-    check(
-      "a failed cancel leaves generating and the thinking open",
-      service.generating === true && service.items[0].endedAt === null,
-    );
-    wire.cancelResult = true;
-    let transcriptFires = 0;
-    service.onDidChangeTranscript(() => transcriptFires++);
-    check("a sent cancel reports true", service.cancelTurn() === true);
-    check("the cancel frame went to the wire", wire.cancels === 2);
-    check("a sent cancel turns generating off", service.generating === false);
-    check("a sent cancel ends the open thinking", service.items[0].endedAt === 90);
-    check("closing the thinking announced a transcript change", transcriptFires === 1);
-    clock.now = 500;
-    service.cancelTurn();
-    check(
-      "a second cancel does not move the ended thinking or announce a change",
-      service.items[0].endedAt === 90 && transcriptFires === 1,
-    );
-    service.dispose();
-  }
-
-  // --- A reasoning chunk after Stop opens as an ended thought ------------------
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    const last = () => service.items[service.items.length - 1];
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    wire.respondResult = true;
-    wire.cancelResult = true;
-    service.respond("go");
-    // Round 0 streamed before the Stop, so its later chunks are stragglers.
-    wire.fire.delta("text", "par", 0);
-    service.cancelTurn();
-    clock.now = 40;
-    wire.fire.delta("reasoning", "late", 0);
-    check(
-      "a first reasoning chunk after Stop opens an ended thought with no start",
-      last().kind === "reasoning" &&
-        last().pending === true &&
-        last().startedAt === null &&
-        last().endedAt === 40,
-    );
-
-    // The agent waiting on its inbox again ends the grace window.
-    clock.now = 50;
-    wire.fire.awaiting();
-    wire.fire.delta("reasoning", "after the wait", 1);
-    check(
-      "a wait on the inbox after Stop makes the next first chunk stream",
-      last().startedAt === 50 && last().endedAt === null,
-    );
-
-    // The operator's message restarts the turn's work.
-    service.cancelTurn();
-    service.respond("again");
-    clock.now = 60;
-    wire.fire.delta("reasoning", "fresh", 2);
-    check(
-      "a message after Stop makes the next first chunk stream",
-      last().startedAt === 60 && last().endedAt === null,
-    );
-
-    // So does the message's durable record, replayed or live.
-    service.cancelTurn();
-    wire.fire.event("user_message", "replayed");
-    clock.now = 65;
-    wire.fire.delta("reasoning", "recorded", 7);
-    check(
-      "a user_message after Stop makes the next first chunk stream",
-      last().startedAt === 65 && last().endedAt === null,
-    );
-
-    // A same-session reattach acknowledgment ends the grace window too.
-    service.cancelTurn();
-    wire.fire.session("s1");
-    clock.now = 70;
-    wire.fire.delta("reasoning", "reattached", 3);
-    check(
-      "a reattach acknowledgment after Stop makes the next first chunk stream",
-      last().startedAt === 70 && last().endedAt === null,
-    );
-
-    // Deltas that append to an existing item never restamp it.
-    clock.now = 80;
-    wire.fire.delta("reasoning", " more", 3);
-    check(
-      "a later chunk appends without moving the clock stamps",
-      last().text === "reattached more" && last().startedAt === 70 && last().endedAt === null,
-    );
-    service.dispose();
-  }
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.cancelResult = false;
-    check("a cancel that fails to send reports false", service.cancelTurn() === false);
-    clock.now = 20;
-    wire.fire.delta("reasoning", "still thinking", 0);
-    check(
-      "a failed cancel does not end a new thought: the turn is not stopped",
-      service.items[0].startedAt === 20 && service.items[0].endedAt === null,
-    );
-    service.dispose();
-  }
-
-  // --- After Stop, a newer round means the agent went on with a queued message ---
-
-  {
-    const wire = makeWire();
-    const clock = { now: 10 };
-    const service = new AgentSessionService(wire, () => clock.now);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.fire.event("user_message", "go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","arguments":{}}]', { reply: 0 });
-    service.respond("then this");
-    wire.fire.event("user_message", "then this");
-    service.cancelTurn();
-    check("the cancel turns generating off", service.generating === false);
-    const seen = [];
-    service.onDidChangeGenerating((value) => seen.push(value));
-    const thought = () => service.items.find((item) => item.kind === "reasoning" && item.reply === 1);
-    clock.now = 100;
-    wire.fire.delta("reasoning", "on to the queued message", 1);
-    check("a newer round's chunk after the cancel turns generating on", service.generating === true);
-    check(
-      "its thought opens with its start, streaming",
-      thought()?.startedAt === 100 && thought()?.endedAt === null,
-    );
-    clock.now = 160;
-    wire.fire.event("agent_thought", "on to the queued message", { reply: 1 });
-    check(
-      "the durable thought keeps the round's start",
-      thought()?.pending === false && thought()?.startedAt === 100 && thought()?.endedAt === 160,
-    );
-    wire.fire.event("agent_message", "done", { reply: 1 });
-    check("the round's reply keeps the agent working", service.generating === true);
-    wire.fire.awaiting();
-    check(
-      "the next awaiting_input ends it",
-      service.generating === false && isDeepStrictEqual(seen, [true, false]),
-    );
-    service.dispose();
-  }
-
-  for (const kind of ["agent_thought", "agent_message", "tool_call"]) {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.event("user_message", "go");
-    wire.fire.delta("text", "partial", 0);
-    service.cancelTurn();
-    wire.fire.event(kind, kind === "tool_call" ? "[]" : "late", { reply: 0 });
-    const afterOwn = service.generating;
-    wire.fire.event(kind, kind === "tool_call" ? "[]" : "next", { reply: 1 });
-    check(
-      `after Stop the stopped round's own ${kind} leaves generating off, and a newer round's turns it on`,
-      afterOwn === false && service.generating === true,
-    );
-    service.dispose();
-  }
-
-  {
-    // A round issued just before the Stop whose first chunk lands after it
-    // reads as a newer round: Stop comes back until the agent waits again.
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.fire.event("user_message", "go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","arguments":{}}]', { reply: 0 });
-    wire.fire.event("tool_call_update", "body", { tool_call_id: "c1" });
-    service.cancelTurn();
-    wire.fire.delta("text", "late", 1);
-    check(
-      "a late first chunk of a round issued just before the Stop turns generating back on",
-      service.generating === true,
-    );
-    wire.fire.awaiting();
-    check("the agent waiting on its inbox ends it", service.generating === false);
-    service.dispose();
-  }
-
-  // --- The latest batch ends once its work is over ------------------------------
-
-  for (const end of ["awaiting_input", "run_ended"]) {
-    // A Stop drops the running search, which never gets a result.
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.event("user_message", "go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","arguments":{}}]', { reply: 0 });
-    wire.fire.event("tool_call_update", "body", { tool_call_id: "c1" });
-    wire.fire.event("tool_call", '[{"id":"c2","name":"search","arguments":{}}]', { reply: 1 });
-    const batches = () => service.items.filter((item) => item.kind === "tool-call");
-    const [earlier, latest] = batches();
-    check("a batch lands open, and a newer round alone ends none", earlier.ended === false && latest.ended === false);
-    service.cancelTurn();
-    let transcriptFires = 0;
-    service.onDidChangeTranscript(() => transcriptFires++);
-    wire.fire.event(end, "");
-    check(
-      `${end} after a Stop ends the latest batch by replacing its item, and announces it once`,
-      batches()[1].ended === true && batches()[1] !== latest && transcriptFires === 1,
-    );
-    check(`${end} leaves an earlier batch as it was`, batches()[0] === earlier);
-    wire.fire.event(end, "");
-    check(`a second ${end} finds the batch already ended`, transcriptFires === 1);
-    service.dispose();
-  }
-
-  {
-    // A message sent after Stop clears the stop, but the batch the stop cut
-    // still ends once the agent goes on with that message in a newer round.
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    wire.fire.session("s1");
-    wire.fire.awaiting();
-    service.respond("go");
-    wire.fire.event("user_message", "go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"search","arguments":{}}]', { reply: 0 });
-    const batches = () => service.items.filter((item) => item.kind === "tool-call");
-    service.cancelTurn();
-    service.respond("then this");
-    wire.fire.event("user_message", "then this");
-    wire.fire.event("agent_thought", "late", { reply: 0 });
-    check("the stopped round's own late frame leaves its batch open", batches()[0].ended === false);
-    wire.fire.delta("text", "on it", 1);
-    check("the newer round's first chunk ends the stopped batch", batches()[0].ended === true);
-    wire.fire.event("tool_call", '[{"id":"c2","name":"read","arguments":{}}]', { reply: 1 });
-    check("the newer round's own batch lands open", batches()[1].ended === false);
-    service.dispose();
-  }
-
-  // --- Error titles: server errors have none; a downed socket is titled -------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const heard = [];
-    service.onError((message) => heard.push(message));
-    wire.fire.error("unknown agent: bad");
-    check("a server error carries no title", service.items[0].title === null);
-    wire.fire.awaiting();
-    wire.respondResult = false;
-    service.respond("hello");
-    const local = service.items[service.items.length - 1];
-    check(
-      "a send on a down socket folds the titled connection error",
-      local.kind === "error" &&
-        local.title === "Connection failed" &&
-        local.message ===
-          "The connection was lost. Please check your network connection and try again.",
-    );
-    check(
-      "the local failure announces the message as shown",
-      heard[1] ===
-        "The connection was lost. Please check your network connection and try again.",
-    );
-    service.dispose();
-  }
-
-  // --- Disposal severs the wire subscriptions -------------------------------
-
-  {
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    service.dispose();
-    wire.fire.event("user_message", "after disposal");
-    wire.fire.awaiting();
-    check(
-      "a disposed service folds nothing",
-      service.items.length === 0 && service.started === false && service.generating === false,
-    );
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`agent-session-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-session-service: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-session-view.mjs b/crates/workshop/ui/test/agent-session-view.mjs
deleted file mode 100644
index b4f67ac8a..000000000
--- a/crates/workshop/ui/test/agent-session-view.mjs
+++ /dev/null
@@ -1,1654 +0,0 @@
-// The agent-session view (src/parts/agent/agent-session-view.ts) in jsdom,
-// driven through the real AgentSessionService over a scripted wire. The
-// transcript paints the way Cursor draws it: turn wrappers holding a
-// sticky human message (no "You" label) and keyed rows - replies as
-// sanitized markdown with no model label, thinking as a collapsible that
-// stays closed while it streams, tool calls as one-line rows with their
-// results folded in, and groups of steps with a summary. Streaming deltas
-// update their rows in place: settled history keeps its nodes, and an
-// opened thought, group, or tool line stays as the operator left it. The
-// tail status names the agent's phase (Planning next moves, a running
-// tool, Reconnecting...), a finished turn's footer copies its replies and
-// raises the toast, the context menu offers Copy Message / Select All,
-// and an error opens the composer's popup instead of
-// a row. Reduced motion drops the height and fade animations. The input
-// stays editable: send stays disabled until the agent first waits or
-// works, answers the waiting agent byte-exact, and while the agent works
-// an empty box shows Stop and a box with text shows send, which steers
-// the turn; Stop comes back while a round newer than the stop streams, and
-// a call the Stop dropped stops loading once the agent waits or goes on; a
-// view built with a ModelService mounts the toolbar (mode
-// chip, model picker, context ring) between the feed and the input bar.
-// Run: node test/agent-session-view.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { mock } from "node:test";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { Emitter } from "@workshop/platform/event";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { ICON_CHECK, ICON_COPY } from "@workshop/look/icons";
-      export { AgentSessionService } from "./src/services/agent-session.ts";
-      export { ModelService } from "./src/services/model-service.ts";
-      export { TOAST_STACK } from "./src/services/toast-service.ts";
-      export { AgentSessionView } from "./src/parts/agent/agent-session-view.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// pretendToBeVisual supplies the requestAnimationFrame ProseMirror
-// schedules with; the prompt input's editor mounts in every setup.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-for (const key of ["document", "HTMLElement", "Node", "Element", "Event", "KeyboardEvent"]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Event = window.Event;
-globalThis.KeyboardEvent = window.KeyboardEvent;
-// The toolbar's mode chip dispatches a CustomEvent on the document;
-// jsdom's dispatchEvent rejects Node's realm, so the bundle needs
-// jsdom's constructor.
-globalThis.CustomEvent = window.CustomEvent;
-// The prompt input reads skin tokens through getComputedStyle; jsdom's
-// copies must be bound to their window.
-globalThis.getComputedStyle = window.getComputedStyle.bind(window);
-globalThis.requestAnimationFrame = window.requestAnimationFrame.bind(window);
-globalThis.cancelAnimationFrame = window.cancelAnimationFrame.bind(window);
-// The view probes STT capability on mount; this suite is not about
-// dictation (test/agent-stt.mjs is), so the probe fails and the mic stays
-// gated. Any other fetch is a regression.
-globalThis.fetch = (url) =>
-  Promise.reject(new Error(`unexpected fetch in the agent-session-view test: ${url}`));
-
-// The clipboard the copy paths write to, recorded.
-const clipboard = [];
-Object.defineProperty(globalThis, "navigator", {
-  configurable: true,
-  value: {
-    // The editor's keyboard shortcuts probe the platform.
-    platform: "Win32",
-    userAgent: "jsdom",
-    clipboard: {
-      writeText: async (text) => {
-        clipboard.push(text);
-      },
-    },
-  },
-});
-
-// jsdom has no layout: a human message overflows its clip when its text is
-// longer than 60 characters, which the scripted scrollHeight reports.
-Object.defineProperty(window.Element.prototype, "scrollHeight", {
-  configurable: true,
-  get() {
-    return this.classList?.contains("ws-human-message__text") && this.textContent.length > 60 ? 100 : 20;
-  },
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-session-view-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  lifecycle,
-  Emitter,
-  registerService,
-  ICON_CHECK,
-  ICON_COPY,
-  AgentSessionService,
-  AgentSessionView,
-  ModelService,
-  TOAST_STACK,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The shared toast stack the composition root registers, recorded.
-const toasts = [];
-registerService(TOAST_STACK, () => ({
-  element: document.createElement("div"),
-  show: (message, kind) => toasts.push({ message, kind }),
-}));
-
-// The scripted wire behind the real service, so the test drives the same
-// frames the socket would deliver.
-function makeWire() {
-  const emitters = {
-    agents: new Emitter(),
-    session: new Emitter(),
-    event: new Emitter(),
-    delta: new Emitter(),
-    error: new Emitter(),
-    disconnect: new Emitter(),
-  };
-  return {
-    onAgents: emitters.agents.event,
-    onSession: emitters.session.event,
-    onEvent: emitters.event.event,
-    onDelta: emitters.delta.event,
-    onError: emitters.error.event,
-    onDisconnect: emitters.disconnect.event,
-    responses: [],
-    cancels: 0,
-    up: true,
-    launch() {
-      return true;
-    },
-    respond(text) {
-      if (!this.up) return false;
-      this.responses.push(text);
-      return true;
-    },
-    cancelTurn() {
-      this.cancels += 1;
-      return true;
-    },
-    fire: {
-      event: (kind, content, extra = {}) => {
-        const { reply, ...eventFields } = extra;
-        const frame = {
-          type: "agent_event",
-          index: 0,
-          event: { kind, section: "chat", turn: 0, content, ...eventFields },
-        };
-        if (reply !== undefined) frame.reply = reply;
-        emitters.event.fire(frame);
-      },
-      delta: (kind, content, reply) =>
-        emitters.delta.fire({ type: "agent_delta", kind, content, reply }),
-      // The agent parks on its empty inbox, as the durable log says.
-      awaiting: () =>
-        emitters.event.fire({
-          type: "agent_event",
-          index: 0,
-          event: { kind: "awaiting_input", section: "chat", turn: 0, content: "" },
-        }),
-      error: (message) => emitters.error.fire(message),
-      disconnect: () => emitters.disconnect.fire(),
-      session: (session) => emitters.session.fire({ type: "agent_session", session, agent: "chat" }),
-    },
-  };
-}
-
-// Dictation's status sink: this suite never records, so nothing lands here.
-const silentStatus = { showLocal() {}, setRecording() {} };
-
-function setup() {
-  const wire = makeWire();
-  const service = new AgentSessionService(wire);
-  const view = new AgentSessionView(service, silentStatus);
-  window.document.body.appendChild(view.element);
-  const rows = () => [...view.element.querySelectorAll(".ws-transcript-row")];
-  const turns = () => [...view.element.querySelectorAll(".ws-turn")];
-  const tail = () => view.element.querySelector(".ws-tail");
-  // The chat box: content and selection are driven through the component
-  // (the DOM alone sets neither on a ProseMirror editor), and whether the
-  // box takes typing shows on the editor's contenteditable attribute.
-  const input = view.chatBox;
-  const editorEl = view.element.querySelector(".ws-prompt-input__editor");
-  const editable = () => editorEl.getAttribute("contenteditable") === "true";
-  // The one round action button: the mic over an empty box, the send arrow
-  // once there is text, Stop over an empty box while the agent generates.
-  const send = view.element.querySelector(".ws-agent-session__action");
-  // The operator's turn: the agent waits, the text goes, and the server
-  // records it as a user message - which also leaves the agent generating.
-  const ask = (text) => {
-    wire.fire.awaiting();
-    input.setText(text);
-    send.click();
-    wire.fire.event("user_message", text);
-  };
-  const dispose = () => {
-    view.dispose();
-    service.dispose();
-    view.element.remove();
-    for (const leftover of document.querySelectorAll(".menu-popup")) leftover.remove();
-  };
-  return { wire, service, view, rows, turns, tail, input, editorEl, editable, send, ask, dispose };
-}
-
-// A header's action and details text, for a collapsible-shaped element.
-const actionOf = (element) => element?.querySelector(".ws-collapsible__action")?.textContent ?? null;
-const detailsOf = (element) => element?.querySelector(".ws-collapsible__details")?.textContent ?? null;
-const headerOf = (element) => element?.querySelector(".ws-collapsible__header") ?? null;
-const isOpen = (element) => element?.dataset.open === "true";
-const shimmering = (element) => element?.classList.contains("ws-shimmer-text") === true;
-const settleMicrotasks = () => new Promise((resolve) => setTimeout(resolve, 0));
-// Drains the promise queue without a timer, for the steps that fake setTimeout.
-const flushMicrotasks = async () => {
-  for (let i = 0; i < 20; i += 1) await Promise.resolve();
-};
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Durable events paint turns of keyed rows ---------------------------------
-
-  {
-    const { wire, view, rows, turns, dispose } = setup();
-    wire.fire.event("user_message", "hi <b>there</b>");
-    wire.fire.event("agent_message", "hello back", { model: "llama-3", reply: 0 });
-    wire.fire.event("agent_thought", "step one", { model: "llama-3", reply: 1 });
-    wire.fire.event(
-      "tool_call",
-      '[{"id":"call_1","name":"read","arguments":{"path":"<script>a</script>"}}]',
-      { model: "llama-3", reply: 1 },
-    );
-    wire.fire.event("tool_call_update", "<b>the file body</b>", { tool_call_id: "call_1" });
-    wire.fire.event("agent_message", "**bold** `code` <script>alert(1)</script>", {
-      model: "llama-3",
-      reply: 2,
-    });
-
-    const [human, hello, group, last] = rows();
-    check("one turn holds the human row, two replies, and a group; the result is no row", turns().length === 1 && rows().length === 4);
-    check(
-      "the human row is a card with no label",
-      human?.classList.contains("ws-human-message") === true &&
-        human.querySelector(".ws-human-message__text")?.textContent === "hi <b>there</b>",
-    );
-    check(
-      "no row carries a You label or a model label",
-      !view.element.textContent.includes("You") && !view.element.textContent.includes("llama-3"),
-    );
-    check(
-      "untrusted user text lands as text, never markup",
-      human?.querySelector("b") === null,
-    );
-    check(
-      "the turn wrapper starts with its human row",
-      turns()[0]?.firstElementChild === human,
-    );
-    check(
-      "a reply is a markdown row with no bubble",
-      hello?.classList.contains("ws-markdown-row") === true &&
-        hello.querySelector(".ws-markdown-content")?.textContent === "hello back",
-    );
-    check(
-      "a thought and a call that ran together are one group row",
-      group?.classList.contains("ws-group-row") === true,
-    );
-    const groupCollapsible = group?.firstElementChild;
-    check(
-      "the group's header is its summary, Explored with the tool count",
-      actionOf(groupCollapsible) === "Explored" && detailsOf(groupCollapsible) === "1 tool",
-    );
-    check("a group starts closed", !isOpen(groupCollapsible) && groupCollapsible?.querySelector(".ws-collapsible__clip")?.hasAttribute("inert") === true);
-    headerOf(groupCollapsible)?.click();
-    check("clicking a group's header opens it", isOpen(groupCollapsible));
-    const steps = [...group.querySelectorAll(".ws-group-row__steps > .ws-collapsible")];
-    check(
-      "the group's steps are an inner thinking line and a tool line in a muted scope",
-      steps.length === 2 &&
-        steps[0]?.classList.contains("ws-thinking-line") &&
-        steps[1]?.classList.contains("ws-tool-line") &&
-        group.querySelector(".ws-group-row__steps")?.classList.contains("ws-muted-scope") === true,
-    );
-    check(
-      "a settled thought reads Thought briefly",
-      actionOf(steps[0]) === "Thought" && detailsOf(steps[0]) === "briefly",
-    );
-    check(
-      "a finished tool reads Ran with its call name",
-      actionOf(steps[1]) === "Ran" && detailsOf(steps[1]) === "read",
-    );
-    headerOf(steps[1])?.click();
-    check(
-      "the result folds into the tool line's block after the arguments and a blank line",
-      steps[1]?.querySelector(".ws-tool-block__pre")?.textContent ===
-        '{\n  "path": "<script>a</script>"\n}\n\n<b>the file body</b>',
-    );
-    check(
-      "tool arguments and output are inert text",
-      group.querySelector("script") === null && group.querySelector("b") === null,
-    );
-    check(
-      "a reply renders its markdown formatting, not the raw source",
-      last?.querySelector(".ws-markdown-content strong")?.textContent === "bold" &&
-        last?.querySelector(".ws-markdown-content code")?.textContent === "code",
-    );
-    check("model-authored markup is sanitized before it lands", last?.querySelector("script") === null);
-    dispose();
-  }
-
-  // --- Streaming: rows update in place, history keeps its nodes -------------------
-
-  {
-    const { wire, rows, tail, ask, dispose } = setup();
-    ask("question");
-    const humanRow = rows()[0];
-    wire.fire.delta("reasoning", "let me ", 0);
-    wire.fire.delta("reasoning", "think", 0);
-    const thought = rows()[1];
-    check(
-      "reasoning deltas paint one thought row reading Thinking",
-      rows().length === 2 &&
-        thought?.classList.contains("ws-thought-row") &&
-        actionOf(thought) === "Thinking" &&
-        detailsOf(thought) === "",
-    );
-    check("a streaming thought stays closed", !isOpen(thought));
-    check(
-      "the thinking header shimmers in the thinking tone",
-      shimmering(thought?.querySelector(".ws-collapsible__action")) &&
-        thought.querySelector(".ws-collapsible__action").classList.contains("ws-shimmer-text--thinking"),
-    );
-    check("a thought row that shimmers on its own leaves no tail status", tail() === null);
-
-    headerOf(thought)?.click();
-    check(
-      "the operator opens a streaming thought and reads the thinking so far",
-      isOpen(thought) && thought.querySelector(".ws-thinking-body")?.textContent === "let me think",
-    );
-    wire.fire.delta("reasoning", "!", 0);
-    check(
-      "a delta updates the open thought in place",
-      rows()[1] === thought &&
-        isOpen(thought) &&
-        thought.querySelector(".ws-thinking-body")?.textContent === "let me think!",
-    );
-    wire.fire.event("agent_thought", "let me think!", { model: "m", reply: 0 });
-    check(
-      "the settled thought is the same node, still open, no longer shimmering",
-      rows()[1] === thought &&
-        isOpen(thought) &&
-        actionOf(thought) === "Thought" &&
-        detailsOf(thought) === "briefly" &&
-        !shimmering(thought.querySelector(".ws-collapsible__action")),
-    );
-
-    wire.fire.delta("text", "the ans", 0);
-    const streamingReply = rows()[2];
-    wire.fire.delta("text", "wer", 0);
-    check(
-      "text deltas paint one markdown row that updates in place",
-      rows().length === 3 &&
-        rows()[2] === streamingReply &&
-        streamingReply?.dataset.streaming === "true" &&
-        streamingReply.querySelector(".ws-markdown-content")?.textContent === "the answer",
-    );
-    check("the streaming reply row is the tail: no status under it", tail() === null);
-    wire.fire.event("agent_message", "the answer", { model: "m", reply: 0 });
-    check(
-      "the durable reply settles the same node",
-      rows().length === 3 &&
-        rows()[2] === streamingReply &&
-        streamingReply?.dataset.streaming === "false",
-    );
-    check(
-      "settled history keeps its nodes across every delta",
-      rows()[0] === humanRow && rows()[1] === thought,
-    );
-    dispose();
-  }
-
-  // --- Tool lines: the verb shimmers while loading; the result folds in -------------
-
-  {
-    const { wire, rows, ask, dispose } = setup();
-    ask("go");
-    wire.fire.event(
-      "tool_call",
-      '[{"id":"call_9","name":"read","tool":"fs/read","arguments":{"path":"a"}}]',
-      { reply: 0 },
-    );
-    const line = rows()[1];
-    check(
-      "a lone call is a tool row, no group",
-      rows().length === 2 && line?.classList.contains("ws-tool-line"),
-    );
-    check(
-      "a running call reads Running with the call name in the verb's color",
-      actionOf(line) === "Running" &&
-        detailsOf(line) === "read in fs" &&
-        line.querySelector(".ws-collapsible__call")?.textContent === "read",
-    );
-    check(
-      "only the verb shimmers while the call loads",
-      shimmering(line?.querySelector(".ws-collapsible__action")) &&
-        line.querySelector(".ws-collapsible__action").classList.contains("ws-shimmer-text--tool") &&
-        !shimmering(line.querySelector(".ws-collapsible__details")),
-    );
-    check("a standalone running tool row leaves no tail status", view_tail(line) === null);
-    headerOf(line)?.click();
-    check(
-      "the operator opens the block while the call runs",
-      isOpen(line) && line.querySelector(".ws-tool-block__pre")?.textContent === '{\n  "path": "a"\n}',
-    );
-    wire.fire.event("tool_call_update", "the body", { tool_call_id: "call_9" });
-    check(
-      "the landing result updates the same row: Ran, still open, no shimmer",
-      rows()[1] === line &&
-        rows().length === 2 &&
-        actionOf(line) === "Ran" &&
-        isOpen(line) &&
-        !shimmering(line.querySelector(".ws-collapsible__action")),
-    );
-    check(
-      "the block now ends with the result",
-      line.querySelector(".ws-tool-block__pre")?.textContent === '{\n  "path": "a"\n}\n\nthe body',
-    );
-    dispose();
-  }
-
-  // A standalone tool row hides the tail by itself; this stays a helper so
-  // the assertion above reads as the rule it checks.
-  function view_tail(line) {
-    return line.closest(".ws-turn")?.querySelector(":scope > .ws-tail") ?? null;
-  }
-
-  // --- An unparsed tool batch paints nothing ----------------------------------------
-
-  {
-    const { wire, rows, dispose } = setup();
-    wire.fire.event("tool_call", "not json at all", { model: "m", reply: 0 });
-    check("a batch that does not parse has no calls and no rows", rows().length === 0);
-    dispose();
-  }
-
-  // --- Groups: the summary tracks the steps, open state survives ---------------------
-
-  {
-    const { wire, rows, ask, dispose } = setup();
-    ask("explore");
-    const callOf = (id) => `[{"id":"${id}","name":"read","tool":"fs/read","arguments":{}}]`;
-    wire.fire.event("tool_call", callOf("a"), { reply: 0 });
-    wire.fire.event("tool_call", callOf("b"), { reply: 1 });
-    const group = rows()[1];
-    const collapsible = group?.firstElementChild;
-    const steps = () => [...group.querySelectorAll(".ws-group-row__steps > .ws-collapsible")];
-    check(
-      "two calls that ran together are a group reading Exploring while the turn runs",
-      group?.classList.contains("ws-group-row") &&
-        actionOf(collapsible) === "Exploring" &&
-        detailsOf(collapsible) === "2 tools",
-    );
-    headerOf(collapsible)?.click();
-    wire.fire.event("tool_call", callOf("c"), { reply: 2 });
-    check(
-      "a new step joins the open group in place: same node, still open, a new count",
-      rows()[1] === group && isOpen(collapsible) && detailsOf(collapsible) === "3 tools" && steps().length === 3,
-    );
-
-    wire.fire.delta("reasoning", "pondering", 3);
-    let thinking = steps().find((step) => step.classList.contains("ws-thinking-line"));
-    check(
-      "a streaming thinking step in a group is open by default",
-      thinking !== undefined && isOpen(thinking) && actionOf(thinking) === "Thinking",
-    );
-    wire.fire.event("agent_thought", "pondering", { reply: 3 });
-    check(
-      "the same thinking step closes once settled",
-      steps().find((step) => step.classList.contains("ws-thinking-line")) === thinking && !isOpen(thinking),
-    );
-    headerOf(thinking)?.click();
-    wire.fire.event("tool_call", callOf("d"), { reply: 4 });
-    check("a thinking step the operator opened stays open", isOpen(thinking) && isOpen(collapsible));
-
-    wire.fire.delta("reasoning", "again", 5);
-    thinking = steps().filter((step) => step.classList.contains("ws-thinking-line")).at(-1);
-    headerOf(thinking)?.click();
-    check("the operator closes a streaming thinking step", !isOpen(thinking));
-    wire.fire.event("agent_thought", "again", { reply: 5 });
-    check("a thinking step the operator closed stays closed through the settle", !isOpen(thinking));
-
-    wire.fire.event("agent_message", "done", { reply: 6 });
-    wire.fire.awaiting();
-    check(
-      "the group reads Explored once the turn ends at the agent's next wait, in the same node",
-      rows()[1] === group && actionOf(collapsible) === "Explored" && isOpen(collapsible),
-    );
-    dispose();
-  }
-
-  // --- A row that grows into a group keeps what the operator opened -----------------------
-
-  {
-    // A thought the operator opened, then a tool call joins it: the row becomes a
-    // group under the same key, and the thinking they were reading stays open.
-    const { wire, rows, ask, dispose } = setup();
-    ask("think then act");
-    wire.fire.delta("reasoning", "weighing options", 0);
-    const thought = rows()[1];
-    headerOf(thought)?.click();
-    wire.fire.event("agent_thought", "weighing options", { reply: 0 });
-    wire.fire.event("tool_call", '[{"id":"a","name":"read","tool":"fs/read","arguments":{}}]', { reply: 0 });
-    const group = rows()[1];
-    const collapsible = group?.firstElementChild;
-    const thinking = group?.querySelector(".ws-thinking-line");
-    check(
-      "a tool call joining an opened thought makes a group in the thought's place",
-      rows().length === 2 &&
-        group !== thought &&
-        group?.classList.contains("ws-group-row") === true &&
-        group.dataset.rowKey === thought?.dataset.rowKey &&
-        !thought?.isConnected,
-    );
-    check(
-      "the group's thinking step keeps the open state the operator gave the thought",
-      thinking !== null && isOpen(thinking) && thinking.querySelector(".ws-thinking-body")?.textContent === "weighing options",
-    );
-    check("the group opens too, so the thinking stays on screen", isOpen(collapsible));
-    dispose();
-  }
-
-  {
-    // The same for a thought the operator never touched: the group stays closed.
-    const { wire, rows, ask, dispose } = setup();
-    ask("think then act");
-    wire.fire.delta("reasoning", "weighing options", 0);
-    wire.fire.event("agent_thought", "weighing options", { reply: 0 });
-    wire.fire.event("tool_call", '[{"id":"a","name":"read","tool":"fs/read","arguments":{}}]', { reply: 0 });
-    const group = rows()[1];
-    check(
-      "a thought nobody opened becomes a closed group with a closed thinking step",
-      group?.classList.contains("ws-group-row") === true &&
-        !isOpen(group.firstElementChild) &&
-        !isOpen(group.querySelector(".ws-thinking-line")),
-    );
-    dispose();
-  }
-
-  {
-    // A lone tool row whose block the operator opened, then a second call joins it.
-    const { wire, rows, ask, dispose } = setup();
-    ask("two reads");
-    const callOf = (id, path) => `[{"id":"${id}","name":"read","tool":"fs/read","arguments":{"path":"${path}"}}]`;
-    wire.fire.event("tool_call", callOf("a", "one"), { reply: 0 });
-    const line = rows()[1];
-    headerOf(line)?.click();
-    wire.fire.event("tool_call_update", "first body", { tool_call_id: "a" });
-    wire.fire.event("tool_call", callOf("b", "two"), { reply: 1 });
-    const group = rows()[1];
-    const steps = [...(group?.querySelectorAll(".ws-group-row__steps > .ws-collapsible") ?? [])];
-    check(
-      "a second call joining an opened tool row makes a group in the row's place",
-      rows().length === 2 &&
-        group !== line &&
-        group?.classList.contains("ws-group-row") === true &&
-        group.dataset.rowKey === line?.dataset.rowKey &&
-        steps.length === 2 &&
-        !line?.isConnected,
-    );
-    check(
-      "the first tool step keeps the block the operator opened, with its result",
-      isOpen(steps[0]) &&
-        steps[0].querySelector(".ws-tool-block__pre")?.textContent === '{\n  "path": "one"\n}\n\nfirst body',
-    );
-    check("the second tool step is untouched and closed", !isOpen(steps[1]));
-    check("the group opens too, so the opened block stays on screen", isOpen(group?.firstElementChild));
-    dispose();
-  }
-
-  {
-    // A lone tool row nobody opened stays closed as a group.
-    const { wire, rows, ask, dispose } = setup();
-    ask("two reads");
-    const callOf = (id) => `[{"id":"${id}","name":"read","tool":"fs/read","arguments":{}}]`;
-    wire.fire.event("tool_call", callOf("a"), { reply: 0 });
-    wire.fire.event("tool_call", callOf("b"), { reply: 1 });
-    const group = rows()[1];
-    check(
-      "a tool row nobody opened becomes a closed group",
-      group?.classList.contains("ws-group-row") === true && !isOpen(group.firstElementChild),
-    );
-    dispose();
-  }
-
-  // --- The tail status names the agent's phase -------------------------------------------
-
-  {
-    const { wire, rows, turns, tail, service, ask, dispose } = setup();
-    ask("hi");
-    const planning = tail();
-    check(
-      "a running turn with nothing else reads Planning next moves, last in its turn",
-      planning?.querySelector(".ws-tail__action")?.textContent === "Planning next moves" &&
-        planning.parentElement === turns()[0] &&
-        turns()[0].lastElementChild === planning,
-    );
-    check(
-      "the tail's verb shimmers in the status tone",
-      shimmering(planning?.querySelector(".ws-tail__action")) &&
-        planning.querySelector(".ws-tail__action").classList.contains("ws-shimmer-text--status"),
-    );
-    check("the tail has no Cancel button: stopping belongs to the composer", planning?.querySelector("button") === null);
-
-    wire.fire.delta("reasoning", "x", 0);
-    check("streaming thinking is the status: no tail", tail() === null);
-
-    wire.fire.event("agent_thought", "x", { reply: 0 });
-    wire.fire.event("tool_call", '[{"id":"a","name":"read","tool":"fs/read","arguments":{"p":1}}]', { reply: 0 });
-    const group = rows()[1];
-    const inGroup = tail();
-    check(
-      "a running tool in a group shows its verb and details in the tail inside the group",
-      group?.classList.contains("ws-group-row") &&
-        inGroup?.parentElement === group &&
-        inGroup.querySelector(".ws-tail__action")?.textContent === "Running" &&
-        inGroup.querySelector(".ws-tail__details")?.textContent === "read in fs" &&
-        inGroup.querySelector(".ws-tail__call")?.textContent === "read" &&
-        inGroup.querySelector(".ws-tail__action").classList.contains("ws-shimmer-text--tool"),
-    );
-    check("the group's tail stays visible whether or not the group is open", !isOpen(group.firstElementChild) && inGroup?.isConnected);
-
-    wire.fire.event("tool_call_update", "ok", { tool_call_id: "a" });
-    check(
-      "once the call finishes the tail plans again, still inside the group",
-      tail()?.parentElement === group &&
-        tail().querySelector(".ws-tail__action")?.textContent === "Planning next moves",
-    );
-
-    wire.fire.delta("text", "answering", 1);
-    check("streaming reply text is the status: no tail", tail() === null);
-    wire.fire.event("agent_message", "answering", { reply: 1 });
-    wire.fire.awaiting();
-    check(
-      "a turn ended by the agent's next wait has no tail",
-      tail() === null && service.generating === false,
-    );
-    dispose();
-  }
-
-  {
-    const { wire, tail, service, ask, dispose } = setup();
-    wire.fire.session("s1");
-    ask("hi");
-    wire.fire.disconnect();
-    const status = tail();
-    check(
-      "a dropped socket reads Reconnecting... with three ASCII dots",
-      service.reconnecting === true && status?.querySelector(".ws-tail__action")?.textContent === "Reconnecting...",
-    );
-    check("reconnecting has no Cancel action", status?.querySelector("button") === null);
-    wire.fire.session("s1");
-    check(
-      "the acknowledged reattach returns the status to planning, still with no Cancel",
-      service.reconnecting === false &&
-        tail()?.querySelector(".ws-tail__action")?.textContent === "Planning next moves" &&
-        tail().querySelector("button") === null,
-    );
-    dispose();
-  }
-
-  // --- A finished turn's footer copies its replies and raises the toast ----------------
-
-  {
-    const { wire, turns, ask, dispose } = setup();
-    ask("first");
-    wire.fire.event("agent_message", "reply **one**", { reply: 0 });
-    const footerOf = (turn) => turn?.querySelector(":scope > .ws-turn-footer") ?? null;
-    check(
-      "a reply alone leaves the turn running, with no footer yet",
-      footerOf(turns()[0]) === null,
-    );
-    wire.fire.awaiting();
-    check("a turn the agent's wait finished shows a footer with Copy", footerOf(turns()[0]) !== null);
-    ask("second");
-    wire.fire.delta("text", "reply t", 1);
-    check(
-      "every turn but the last keeps its footer; the running last turn has none, even with reply text",
-      turns().length === 2 &&
-        footerOf(turns()[0]) !== null &&
-        footerOf(turns()[1]) === null &&
-        turns()[1].querySelector(".ws-markdown-row") !== null,
-    );
-    wire.fire.event("agent_message", "reply two", { reply: 1 });
-    wire.fire.event("agent_message", "and more", { reply: 2 });
-    wire.fire.awaiting();
-    const copy = footerOf(turns()[1])?.querySelector(".ws-turn-footer__copy");
-    check("the last turn gets its footer once the agent waits again", copy !== null && copy !== undefined);
-    const copyPath = /d="([^"]+)"/.exec(ICON_COPY)?.[1];
-    const earlierCopy = footerOf(turns()[0])?.querySelector(".ws-turn-footer__copy");
-    check(
-      "before any copy, each footer shows the codicon copy glyph",
-      copyPath !== undefined &&
-        copy?.querySelector("path")?.getAttribute("d") === copyPath &&
-        earlierCopy?.querySelector("path")?.getAttribute("d") === copyPath &&
-        copy?.dataset.copied === undefined,
-    );
-    // The check shows for two seconds, then the copy glyph returns: drive the timer by hand.
-    mock.timers.enable({ apis: ["setTimeout"] });
-    copy?.click();
-    await flushMicrotasks();
-    check(
-      "Copy puts the turn's reply sources on the clipboard, joined by a blank line",
-      clipboard.at(-1) === "reply two\n\nand more",
-    );
-    check(
-      "the toast reads Message copied to clipboard",
-      toasts.at(-1)?.message === "Message copied to clipboard",
-    );
-    const checkPath = /d="([^"]+)"/.exec(ICON_CHECK)?.[1];
-    check(
-      "the icon swaps to a check",
-      checkPath !== undefined &&
-        checkPath !== copyPath &&
-        copy?.querySelector("path")?.getAttribute("d") === checkPath &&
-        copy?.dataset.copied === "true",
-    );
-    mock.timers.tick(1999);
-    check(
-      "the check holds until two seconds have passed",
-      copy?.querySelector("path")?.getAttribute("d") === checkPath && copy?.dataset.copied === "true",
-    );
-    mock.timers.tick(1);
-    check(
-      "two seconds after the copy the copy glyph returns",
-      copy?.querySelector("path")?.getAttribute("d") === copyPath && copy?.dataset.copied === undefined,
-    );
-    footerOf(turns()[0])?.querySelector(".ws-turn-footer__copy")?.click();
-    await flushMicrotasks();
-    check("an earlier turn copies its own reply", clipboard.at(-1) === "reply **one**");
-    // Disposed while the timers are still faked, so the footer's pending timer clears with its own clock.
-    dispose();
-    mock.timers.reset();
-  }
-
-  // --- The transcript context menu ----------------------------------------------------
-
-  {
-    const { wire, rows, ask, dispose } = setup();
-    ask("question text");
-    wire.fire.event("agent_message", "answer **md**", { reply: 0 });
-    const reply = rows()[1];
-    const fire = (target) =>
-      target.dispatchEvent(
-        new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: 20, clientY: 30 }),
-      );
-    const items = () => [...document.querySelectorAll(".menu-popup .menu-item")];
-    const labels = () => items().map((item) => item.querySelector(".menu-item__label")?.textContent);
-    window.getSelection().removeAllRanges();
-
-    fire(reply.querySelector(".ws-markdown-content"));
-    check(
-      "right-clicking a message offers Copy Message and Select All",
-      isDeepStrictEqual(labels(), ["Copy Message", "Select All"]),
-    );
-    items()[0]?.click();
-    await settleMicrotasks();
-    check(
-      "Copy Message copies the message's markdown source and closes the menu",
-      clipboard.at(-1) === "answer **md**" && items().length === 0,
-    );
-
-    const range = document.createRange();
-    range.selectNodeContents(reply.querySelector("p"));
-    window.getSelection().removeAllRanges();
-    window.getSelection().addRange(range);
-    fire(reply.querySelector(".ws-markdown-content"));
-    check("over a selection the first item reads Copy", labels()[0] === "Copy");
-    items()[0]?.click();
-    await settleMicrotasks();
-    check("Copy copies the selected text", clipboard.at(-1) === "answer md");
-
-    window.getSelection().removeAllRanges();
-    fire(reply.querySelector(".ws-markdown-content"));
-    items()[1]?.click();
-    const everything = window.getSelection().toString();
-    check(
-      "Select All selects the whole transcript",
-      everything.includes("question text") && everything.includes("answer md"),
-    );
-    window.getSelection().removeAllRanges();
-    dispose();
-  }
-
-  // A right-click outside every row has nothing to copy: no Copy item, and the clipboard is left alone.
-
-  {
-    const { wire, turns, tail, ask, dispose } = setup();
-    ask("question text");
-    window.getSelection().removeAllRanges();
-    const fire = (target) =>
-      target.dispatchEvent(
-        new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: 20, clientY: 30 }),
-      );
-    const items = () => [...document.querySelectorAll(".menu-popup .menu-item")];
-    const labels = () => items().map((item) => item.querySelector(".menu-item__label")?.textContent);
-    clipboard.length = 0;
-
-    fire(tail());
-    check(
-      "right-clicking the tail offers no Copy Message",
-      isDeepStrictEqual(labels(), ["Select All"]),
-    );
-    items()[0]?.click();
-    await settleMicrotasks();
-    check("choosing from the tail's menu leaves the clipboard alone", clipboard.length === 0);
-    // Select All left the transcript selected; the next right-click starts clean.
-    window.getSelection().removeAllRanges();
-
-    wire.fire.event("agent_message", "an answer", { reply: 0 });
-    wire.fire.awaiting();
-    const footer = turns()[0]?.querySelector(":scope > .ws-turn-footer");
-    check("the finished turn has its footer", footer !== null && footer !== undefined);
-    fire(footer);
-    check(
-      "right-clicking a turn footer offers no Copy Message",
-      isDeepStrictEqual(labels(), ["Select All"]),
-    );
-    items()[0]?.click();
-    await settleMicrotasks();
-    window.getSelection().removeAllRanges();
-
-    fire(turns()[0]?.querySelector(".ws-markdown-content"));
-    check(
-      "a row in the same turn still offers Copy Message",
-      isDeepStrictEqual(labels(), ["Copy Message", "Select All"]),
-    );
-    items()[0]?.click();
-    await settleMicrotasks();
-    check("and copies its text", isDeepStrictEqual(clipboard, ["an answer"]));
-    window.getSelection().removeAllRanges();
-    dispose();
-  }
-
-  // --- Errors open the composer's popup, not rows ----------------------------------------
-
-  {
-    const { wire, view, rows, input, send, dispose } = setup();
-    const popup = () => view.element.querySelector(".ws-chat-error");
-    const retry = () => popup()?.querySelector(".ws-chat-error__retry");
-    wire.fire.error("the model call failed");
-    check(
-      "an error paints no row and no Error: text in the feed",
-      rows().length === 0 && !view.transcript.element.textContent.includes("Error"),
-    );
-    check(
-      "the error opens the popup titled Connection Error with its message",
-      popup() !== null &&
-        popup().getAttribute("role") === "alert" &&
-        popup().querySelector(".ws-chat-error__title")?.textContent === "Connection Error" &&
-        popup().querySelector(".ws-chat-error__message")?.textContent === "the model call failed",
-    );
-    check("with no message sent there is nothing to try again", retry()?.hidden === true);
-
-    wire.fire.event("user_message", "ask me");
-    wire.fire.error("the round failed");
-    check(
-      "after a send, Try again is offered and enabled, with no wait to pin it to",
-      retry()?.hidden === false && retry().disabled === false,
-    );
-    retry().click();
-    check(
-      "Try again re-sends the last user message through respond",
-      wire.responses.at(-1) === "ask me" && popup() === null,
-    );
-
-    wire.up = false;
-    input.setText("hello");
-    send.click();
-    check(
-      "a send on a downed socket opens the popup titled Connection failed",
-      popup()?.querySelector(".ws-chat-error__title")?.textContent === "Connection failed" &&
-        popup().querySelector(".ws-chat-error__message")?.textContent ===
-          "The connection was lost. Please check your network connection and try again." &&
-        input.getText() === "hello",
-    );
-    wire.fire.session("fresh");
-    check("a new session clears the popup", popup() === null);
-    dispose();
-  }
-
-  {
-    // A run that ends in error: the error opens the popup, and the run's
-    // end leaves nothing to try again or send to.
-    const { wire, view, input, send, ask, dispose } = setup();
-    const retry = () => view.element.querySelector(".ws-chat-error .ws-chat-error__retry");
-    ask("go");
-    wire.fire.error("agent run failed: kaboom");
-    check(
-      "while the run still takes messages, Try again is enabled",
-      retry()?.hidden === false && retry().disabled === false,
-    );
-    wire.fire.event("run_ended", "");
-    check(
-      "after a run-ending error and run_ended, Try again stays offered but disabled",
-      retry()?.hidden === false && retry().disabled === true,
-    );
-    input.setText("too late");
-    check(
-      "after run_ended, send is idle",
-      send.getAttribute("data-state") === "send" &&
-        send.getAttribute("data-action") === "idle" &&
-        send.disabled === true,
-    );
-    send.click();
-    retry()?.click();
-    check("nothing goes to the ended run", isDeepStrictEqual(wire.responses, ["go"]));
-    dispose();
-  }
-
-  {
-    // The run's end may reach the socket ahead of its error frame.
-    const { wire, view, ask, dispose } = setup();
-    const retry = () => view.element.querySelector(".ws-chat-error .ws-chat-error__retry");
-    ask("go");
-    wire.fire.event("run_ended", "");
-    wire.fire.error("agent run failed: kaboom");
-    check(
-      "an error after run_ended offers Try again disabled",
-      retry()?.hidden === false && retry().disabled === true,
-    );
-    dispose();
-  }
-
-  // --- The human message: clip, expand, sticky ---------------------------------------------
-
-  {
-    const { wire, view, ask, dispose } = setup();
-    ask("short one");
-    ask("x".repeat(80));
-    window.getSelection().removeAllRanges();
-    const [short, long] = [...view.element.querySelectorAll(".ws-human-message")];
-    const textOf = (card) => card.querySelector(".ws-human-message__text");
-    check(
-      "a message within the clip doesn't overflow and isn't a button",
-      short?.dataset.overflowing === "false" &&
-        textOf(short).dataset.clipped === "false" &&
-        textOf(short).getAttribute("role") === null,
-    );
-    check(
-      "a long message is clipped and reads as clickable",
-      long?.dataset.overflowing === "true" &&
-        textOf(long).dataset.clipped === "true" &&
-        textOf(long).getAttribute("role") === "button" &&
-        textOf(long).getAttribute("aria-expanded") === "false",
-    );
-    textOf(long).click();
-    check(
-      "clicking a long message expands it",
-      long.dataset.expanded === "true" &&
-        textOf(long).dataset.clipped === "false" &&
-        textOf(long).getAttribute("aria-expanded") === "true",
-    );
-    textOf(long).click();
-    check("clicking again clips it", textOf(long).dataset.clipped === "true");
-    textOf(short).click();
-    check("a click on a short message does nothing", short.dataset.expanded === "false");
-    textOf(long).click();
-    wire.fire.event("agent_message", "reply", { reply: 0 });
-    check("an expanded message stays expanded across later updates", long.dataset.expanded === "true");
-
-    const feed = view.transcript.element;
-    let scrollTop = 40;
-    Object.defineProperty(feed, "scrollTop", {
-      configurable: true,
-      get: () => scrollTop,
-      set: (value) => {
-        scrollTop = value;
-      },
-    });
-    Object.defineProperty(feed, "clientHeight", { configurable: true, get: () => 300 });
-    const rect = (top, height) => ({ top, height, left: 0, width: 400, bottom: top + height, right: 400 });
-    feed.getBoundingClientRect = () => rect(100, 300);
-    short.getBoundingClientRect = () => rect(100, 50);
-    feed.dispatchEvent(new window.Event("scroll"));
-    check(
-      "a message at the feed's top edge is stuck, which shows the fade",
-      short.dataset.stuck === "true" && short.dataset.tall === "false",
-    );
-    short.getBoundingClientRect = () => rect(160, 50);
-    feed.dispatchEvent(new window.Event("scroll"));
-    check("a message below the top edge is not stuck", short.dataset.stuck === "false");
-    short.getBoundingClientRect = () => rect(100, 400);
-    feed.dispatchEvent(new window.Event("scroll"));
-    check(
-      "a message taller than the feed doesn't stick",
-      short.dataset.tall === "true" && short.dataset.stuck === "false",
-    );
-    dispose();
-  }
-
-  // --- Motion: new text fades in, and reduced motion drops it ---------------------------------
-
-  {
-    const { wire, rows, ask, dispose } = setup();
-    ask("go");
-    wire.fire.delta("text", "alpha ", 0);
-    wire.fire.delta("text", "beta", 0);
-    const fades = () => [...(rows()[1]?.querySelectorAll(".ws-fade-in") ?? [])];
-    check(
-      "streaming text fades in word by word, and a word already fading carries on with a negative delay",
-      fades().length === 2 &&
-        fades()[0].textContent === "alpha" &&
-        Number.parseFloat(fades()[0].style.animationDelay) < 0 &&
-        Number.parseFloat(fades()[1].style.animationDelay) <= 0,
-    );
-    wire.fire.event("agent_message", "alpha beta", { reply: 0 });
-    dispose();
-  }
-
-  {
-    window.matchMedia = (query) => ({ matches: true, media: query });
-    const { wire, rows, ask, dispose } = setup();
-    ask("go");
-    wire.fire.delta("reasoning", "thinking", 0);
-    wire.fire.delta("text", "alpha beta", 1);
-    check(
-      "under reduced motion streamed text is not wrapped to fade",
-      rows()[2]?.querySelector(".ws-markdown-content")?.textContent === "alpha beta" &&
-        rows()[2].querySelectorAll(".ws-fade-in").length === 0,
-    );
-    dispose();
-    delete window.matchMedia;
-  }
-
-  // The stylesheets carry the rest: the height and fade animations are
-  // dropped under reduced motion, and the sticky card follows the spec.
-  {
-    const css = async (name) => (await readFile(path.join(testDir, "..", "src", "parts", "agent", name), "utf8")).replace(/\/\*[\s\S]*?\*\//g, "");
-    const reduced = (text) => text.split("@media (prefers-reduced-motion: reduce)").slice(1).join("\n");
-    const collapsible = await css("transcript/collapsible.css");
-    const transcript = await css("transcript/transcript.css");
-    const markdown = await css("markdown-render.css");
-    const human = await css("transcript/human-message.css");
-    check(
-      "the collapsible's height and chevron transitions are dropped under reduced motion",
-      /ws-collapsible__clip[\s\S]*ws-collapsible__chevron[^{]*\{[^}]*transition:\s*none/.test(reduced(collapsible)),
-    );
-    check(
-      "the collapsible opens its height over 150ms on an ease-out cubic",
-      /\.ws-collapsible__clip\s*\{[^}]*grid-template-rows:\s*0fr[^}]*transition:[^;]*var\(--duration-normal\) var\(--ease-out-cubic\)/.test(collapsible),
-    );
-    check(
-      "a new reply row's fade and rise are dropped under reduced motion",
-      /animation:\s*none/.test(reduced(transcript)),
-    );
-    check("the streaming fade is dropped under reduced motion", /\.ws-fade-in\s*\{[^}]*animation:\s*none/.test(reduced(markdown)));
-    check(
-      "the human message sticks at the top with z-index 101, except when taller than the feed",
-      /\.ws-human-message\s*\{[^}]*position:\s*sticky[^}]*inset-block-start:\s*0[^}]*z-index:\s*101/.test(human) &&
-        /\.ws-human-message\[data-tall="true"\]\s*\{[^}]*position:\s*static/.test(human),
-    );
-  }
-
-  // --- Every content string is inert ----------------------------------------------------
-
-  {
-    const { wire, view, rows, dispose } = setup();
-    wire.fire.event("user_message", "<img src=x onerror=alert(1)>");
-    wire.fire.delta("reasoning", "**shown**\n\n<script>alert(1)</script>", 0);
-    const thought = rows()[1];
-    headerOf(thought)?.click();
-    check(
-      "user text is text: no element comes out of it",
-      view.element.querySelector(".ws-human-message img") === null &&
-        rows()[0].querySelector(".ws-human-message__text").textContent === "<img src=x onerror=alert(1)>",
-    );
-    check(
-      "thinking markdown is sanitized when opened",
-      thought.querySelector("script") === null &&
-        thought.querySelector(".ws-thinking-body strong")?.textContent === "shown",
-    );
-    check("no element in the transcript carries an event handler", view.element.querySelector("[onerror], [onclick]") === null);
-    dispose();
-  }
-
-  // --- The input stays editable; send waits for the agent to start ---------------------
-
-  {
-    const { wire, input, editorEl, editable, send, dispose } = setup();
-    const enter = () =>
-      editorEl.dispatchEvent(
-        new window.KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true }),
-      );
-    check("the box is editable before the agent starts", editable());
-    input.setText("too early");
-    check(
-      "until the agent first waits or works, send stays disabled",
-      send.getAttribute("data-state") === "send" &&
-        send.getAttribute("data-action") === "idle" &&
-        send.disabled === true,
-    );
-    send.click();
-    enter();
-    check(
-      "a disabled send sends nothing, by click or Enter, and keeps the draft",
-      wire.responses.length === 0 && input.getText() === "too early",
-    );
-    wire.fire.awaiting();
-    check(
-      "the agent's first wait enables send",
-      send.getAttribute("data-action") === "send" && send.disabled === false,
-    );
-    input.setText("two  spaces ");
-    send.click();
-    check(
-      "submitting answers the wait byte-exact, untrimmed",
-      isDeepStrictEqual(wire.responses, ["two  spaces "]),
-    );
-    check("a successful send clears the box", input.getText() === "");
-    check("the box stays editable while the agent works", editable());
-    check(
-      "while the agent works an empty box shows Stop",
-      send.getAttribute("data-action") === "stop" && send.getAttribute("data-state") === "stop",
-    );
-    input.setText("steer it");
-    check(
-      "while the agent works a box with text shows send",
-      send.getAttribute("data-state") === "send" &&
-        send.disabled === false &&
-        send.getAttribute("aria-label") === "Send",
-    );
-    enter();
-    check(
-      "the message steers the working agent and clears the box",
-      isDeepStrictEqual(wire.responses, ["two  spaces ", "steer it"]) && input.getText() === "",
-    );
-    check("the emptied box shows Stop again", send.getAttribute("data-state") === "stop");
-    enter();
-    check("Enter over an empty box while the agent works sends nothing", wire.responses.length === 2);
-    wire.fire.awaiting();
-    send.click();
-    check("an empty box sends nothing", wire.responses.length === 2);
-    input.setText("enter sends");
-    enter();
-    check("Enter submits without a button click", wire.responses[2] === "enter sends");
-    wire.fire.awaiting();
-    input.setText("変換中");
-    editorEl.dispatchEvent(
-      new window.KeyboardEvent("keydown", {
-        key: "Enter",
-        isComposing: true,
-        bubbles: true,
-        cancelable: true,
-      }),
-    );
-    check(
-      "Enter that commits an IME composition does not submit",
-      wire.responses.length === 3 && input.getText() === "変換中",
-    );
-    dispose();
-  }
-
-  {
-    // An agent that works before it ever waits takes a message too.
-    const { wire, input, send, dispose } = setup();
-    input.setText("steer");
-    wire.fire.delta("text", "already working", 0);
-    check(
-      "the run's first report enables send",
-      send.getAttribute("data-action") === "send" && send.disabled === false,
-    );
-    send.click();
-    check("the message goes to the working agent", isDeepStrictEqual(wire.responses, ["steer"]));
-    dispose();
-  }
-
-  // --- A model selection gates every submission path ------------------------------------
-
-  {
-    const status = {
-      local: [],
-      showLocal(label, severity) {
-        this.local.push({ label, severity });
-      },
-      setRecording() {},
-    };
-    const modelService = new ModelService(() => true);
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const view = new AgentSessionView(service, status, modelService);
-    window.document.body.appendChild(view.element);
-    const input = view.chatBox;
-    const editorEl = view.element.querySelector(".ws-prompt-input__editor");
-    const send = view.element.querySelector(".ws-agent-session__action");
-    check(
-      "before the agent starts the action is idle whatever the model state, and the empty box's mic stays pressable",
-      send.getAttribute("data-action") === "idle" &&
-        send.getAttribute("data-state") === "mic" &&
-        send.disabled === false,
-    );
-    wire.fire.awaiting();
-    input.setText("keep this draft");
-    check(
-      "the send control exposes the absent-selection gate",
-      send.getAttribute("aria-disabled") === "true",
-    );
-    check(
-      "the absent selection maps to the send-blocked action, still clickable",
-      send.getAttribute("data-action") === "send-blocked" && send.disabled === false,
-    );
-
-    send.click();
-    check(
-      "click submission without a model is rejected and keeps the draft",
-      wire.responses.length === 0 && input.getText() === "keep this draft",
-    );
-    check(
-      "click submission without a model shows the exact local selection status",
-      isDeepStrictEqual(status.local.at(-1), {
-        label: "Select a model before sending.",
-        severity: "info",
-      }),
-    );
-
-    editorEl.dispatchEvent(
-      new window.KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true }),
-    );
-    check(
-      "keyboard submission without a model is rejected and keeps the draft",
-      wire.responses.length === 0 && input.getText() === "keep this draft",
-    );
-    check(
-      "keyboard submission without a model shows the exact local selection status",
-      status.local.length === 2 &&
-        status.local[1]?.label === "Select a model before sending." &&
-        status.local[1]?.severity === "info",
-    );
-
-    modelService.applySelected("alpha");
-    check(
-      "selection arrival immediately lifts the send control gate",
-      send.getAttribute("aria-disabled") === "false" && send.getAttribute("data-action") === "send",
-    );
-    send.click();
-    check(
-      "a later model selection makes the pending draft immediately submittable",
-      isDeepStrictEqual(wire.responses, ["keep this draft"]) && input.getText() === "",
-    );
-
-    view.dispose();
-    service.dispose();
-    modelService.dispose();
-    view.element.remove();
-  }
-
-  // --- The placeholder matches Cursor's agent input ---------------------------------------
-
-  {
-    const { wire, editorEl, ask, dispose } = setup();
-    const placeholder = () => editorEl.querySelector("p")?.getAttribute("data-placeholder");
-    check(
-      "the input shows Cursor's agent placeholder",
-      placeholder() === "Plan, Build, / for skills, @ for context",
-    );
-    wire.fire.awaiting();
-    check(
-      "the placeholder stays stable when the agent waits",
-      placeholder() === "Plan, Build, / for skills, @ for context",
-    );
-    ask("go");
-    check(
-      "while the agent works the placeholder invites a follow-up, which steers the turn",
-      placeholder() === "Add a follow-up",
-    );
-    wire.fire.awaiting();
-    check(
-      "the next wait brings Cursor's placeholder back",
-      placeholder() === "Plan, Build, / for skills, @ for context",
-    );
-    dispose();
-  }
-
-  // --- The toolbar mounts between the feed and the input bar -----------------------------
-
-  {
-    const { view, dispose } = setup();
-    check(
-      "a view built without a model service mounts no toolbar",
-      view.element.querySelector(".ws-agent-toolbar") === null,
-    );
-    dispose();
-  }
-
-  {
-    const sent = [];
-    const modelService = new ModelService((id) => {
-      sent.push(id);
-      return true;
-    });
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const view = new AgentSessionView(service, silentStatus, modelService);
-    window.document.body.appendChild(view.element);
-    const toolbar = view.element.querySelector(".ws-agent-toolbar");
-    const bar = view.element.querySelector(".ws-agent-session__bar");
-    check(
-      "the toolbar mounts inside the input card after the prompt",
-      toolbar !== null &&
-        bar !== null &&
-        toolbar.parentElement === bar &&
-        toolbar.previousElementSibling?.classList.contains("ws-prompt-input") === true,
-    );
-    check(
-      "the box's one round action button trails the toolbar's own controls, after the ring",
-      toolbar?.lastElementChild?.classList.contains("ws-agent-session__action") === true &&
-        toolbar?.lastElementChild?.previousElementSibling?.classList.contains("ws-token-ring") === true &&
-        bar?.querySelector(":scope > .ws-agent-session__action") === null,
-    );
-    check(
-      "the toolbar composes the mode chip, the model picker, and the context ring, hidden until there is usage data",
-      toolbar?.querySelector(".ws-mode-chip__label")?.textContent === "Agent" &&
-        toolbar?.querySelector(".ws-model-picker-trigger__label")?.textContent === "Select model" &&
-        toolbar?.querySelector(".ws-token-ring")?.hasAttribute("hidden") === true,
-    );
-    modelService.setModels([
-      { id: "alpha", description: "first" },
-      { id: "beta", description: "second" },
-    ]);
-    modelService.applySelected("alpha");
-    check(
-      "the picker shows the service's current model",
-      toolbar?.querySelector(".ws-model-picker-trigger__label")?.textContent === "alpha",
-    );
-    toolbar?.querySelector(".ws-model-picker-trigger")?.click();
-    const modelItems = [...document.querySelectorAll(".menu-item")];
-    check(
-      "the picker dropdown lists the catalog",
-      modelItems.length === 2 &&
-        modelItems[1]?.querySelector(".menu-item__label")?.textContent === "beta",
-    );
-    modelItems[1]?.click();
-    check(
-      "picking a model sends the selection through the service",
-      isDeepStrictEqual(sent, ["beta"]),
-    );
-    let modeEvent = null;
-    const onMode = (event) => {
-      modeEvent = event.detail;
-    };
-    document.addEventListener("agent-mode-changed", onMode);
-    toolbar?.querySelector(".ws-mode-chip")?.click();
-    const planItem = [...document.querySelectorAll(".menu-item")].find(
-      (item) => item.querySelector(".menu-item__label")?.textContent === "Plan",
-    );
-    planItem?.click();
-    document.removeEventListener("agent-mode-changed", onMode);
-    check(
-      "picking a mode fires agent-mode-changed and updates the chip",
-      modeEvent === "plan" &&
-        toolbar?.querySelector(".ws-mode-chip__label")?.textContent === "Plan",
-    );
-    view.dispose();
-    service.dispose();
-    modelService.dispose();
-    view.element.remove();
-  }
-
-  // --- Stop: the round button cancels the running turn --------------------------------------
-
-  {
-    const { wire, service, view, send, ask, dispose } = setup();
-    wire.fire.session("s-stop");
-    check(
-      "before any turn there is nothing to stop",
-      view.cancelTurn() === false && wire.cancels === 0,
-    );
-    ask("go");
-    check(
-      "the turn the operator started leaves the button as Stop",
-      service.generating === true && send.getAttribute("data-state") === "stop" && send.disabled === false,
-    );
-    send.click();
-    check("a click on Stop cancels the turn through the wire", wire.cancels === 1);
-    check(
-      "the service settles its own view of the canceled turn: generating is off",
-      service.generating === false && send.getAttribute("data-state") !== "stop",
-    );
-    check(
-      "with generating off the started agent's action is send again, the mic over the empty box",
-      send.getAttribute("data-action") === "send" && send.getAttribute("data-state") === "mic",
-    );
-    check("a turn that is not running cannot be stopped again", view.cancelTurn() === false && wire.cancels === 1);
-    dispose();
-  }
-
-  {
-    // The agent finishing its own turn (a reply, then a new wait) takes Stop away too.
-    const { wire, service, send, ask, dispose } = setup();
-    wire.fire.session("s-done");
-    ask("go");
-    check("generating shows Stop", send.getAttribute("data-state") === "stop");
-    wire.fire.event("agent_message", "done", { reply: 0 });
-    check(
-      "a reply alone keeps Stop: a message that lands as the reply does makes the turn go on",
-      service.generating === true && send.getAttribute("data-state") === "stop",
-    );
-    wire.fire.awaiting();
-    check(
-      "the next wait ends the turn: Stop gives way to the mic over the empty box",
-      service.generating === false && send.getAttribute("data-state") === "mic" && send.getAttribute("data-action") === "send",
-    );
-    dispose();
-  }
-
-  {
-    // A stop with a message already queued: the agent goes on with it, so
-    // Stop shows again while that newer round streams.
-    const { wire, service, send, ask, dispose } = setup();
-    wire.fire.session("s-queued");
-    ask("go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","arguments":{}}]', { reply: 0 });
-    wire.fire.event("user_message", "then this");
-    send.click();
-    check(
-      "Stop cancels the turn and gives way",
-      wire.cancels === 1 && send.getAttribute("data-state") !== "stop",
-    );
-    wire.fire.delta("text", "on it", 1);
-    check(
-      "Stop shows while the newer round streams",
-      service.generating === true && send.getAttribute("data-state") === "stop",
-    );
-    wire.fire.awaiting();
-    check("the next wait takes Stop away", send.getAttribute("data-state") !== "stop");
-    dispose();
-  }
-
-  // --- A call a Stop dropped stops loading once its batch ends ---------------------------------
-
-  {
-    // The dropped call never gets a result. The agent's next wait ends its
-    // batch, so the following turn neither shows it loading nor names it.
-    const { wire, rows, tail, input, send, ask, dispose } = setup();
-    wire.fire.session("s-dropped");
-    ask("go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","tool":"fs/read","arguments":{"path":"a"}}]', {
-      reply: 0,
-    });
-    const loading = () => shimmering(rows()[1]?.querySelector(".ws-collapsible__action"));
-    check("the call loads while it runs", actionOf(rows()[1]) === "Running" && loading());
-    send.click();
-    wire.fire.awaiting();
-    input.setText("next");
-    send.click();
-    check("sending the next message leaves the dropped call idle before its echo", !loading());
-    wire.fire.event("user_message", "next");
-    check(
-      "on the following turn the dropped call no longer loads",
-      actionOf(rows()[1]) === "Ran" && !loading(),
-    );
-    check(
-      "the tail plans instead of naming the dropped call",
-      tail()?.querySelector(".ws-tail__action")?.textContent === "Planning next moves",
-    );
-    dispose();
-  }
-
-  {
-    // The next message goes out before the agent waits, so the agent goes
-    // on with it: the newer round's first frame ends the dropped call's batch.
-    const { wire, rows, tail, input, send, ask, dispose } = setup();
-    wire.fire.session("s-dropped-steer");
-    ask("go");
-    wire.fire.event("tool_call", '[{"id":"c1","name":"read","tool":"fs/read","arguments":{"path":"a"}}]', {
-      reply: 0,
-    });
-    send.click();
-    input.setText("then this");
-    send.click();
-    wire.fire.event("user_message", "then this");
-    wire.fire.event("agent_thought", "on to the next message", { reply: 1 });
-    check(
-      "once the newer round begins the dropped call no longer loads",
-      actionOf(rows()[1]) === "Ran" && !shimmering(rows()[1]?.querySelector(".ws-collapsible__action")),
-    );
-    check(
-      "the tail plans instead of naming the dropped call",
-      tail()?.querySelector(".ws-tail__action")?.textContent === "Planning next moves",
-    );
-    dispose();
-  }
-
-  // --- The mode follows the toolbar's chip onto the action button ------------------------------
-
-  {
-    const modelService = new ModelService(() => true);
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const view = new AgentSessionView(service, silentStatus, modelService);
-    window.document.body.appendChild(view.element);
-    const button = view.element.querySelector(".ws-agent-session__action");
-    check("the action button starts in Agent mode", button.getAttribute("data-mode") === "agent");
-    view.element.querySelector(".ws-mode-chip")?.click();
-    [...document.querySelectorAll(".menu-item")]
-      .find((item) => item.querySelector(".menu-item__label")?.textContent === "Ask")
-      ?.click();
-    check("picking Ask in the chip colors the action button for Ask", button.getAttribute("data-mode") === "ask");
-    view.dispose();
-    service.dispose();
-    modelService.dispose();
-    view.element.remove();
-  }
-
-  // --- The commands' handle: focus, emptiness, menus, Shift+Tab ------------------------------
-
-  {
-    const modelService = new ModelService(() => true);
-    modelService.setModels([{ id: "alpha" }]);
-    const wire = makeWire();
-    const service = new AgentSessionService(wire);
-    const view = new AgentSessionView(service, silentStatus, modelService);
-    window.document.body.appendChild(view.element);
-    check("a fresh view is empty: a chat to reuse", view.isEmpty() === true);
-    view.chatBox.setText("a draft");
-    check("a draft makes the chat non-empty", view.isEmpty() === false);
-    view.chatBox.clear();
-    wire.fire.session("s-handle");
-    wire.fire.event("user_message", "hello");
-    check("a turn makes the chat non-empty", view.isEmpty() === false);
-
-    check("focus starts outside the view", view.hasFocus() === false);
-    // jsdom does not focus a contenteditable, so the composer's focus request is
-    // observed on the box, and hasFocus on a control jsdom can focus.
-    let focusRequests = 0;
-    const realFocus = view.chatBox.focus.bind(view.chatBox);
-    view.chatBox.focus = () => {
-      focusRequests += 1;
-      realFocus();
-    };
-    view.focusInput();
-    check("focusInput asks the composer for focus", focusRequests === 1);
-    const probe = document.createElement("button");
-    view.element.appendChild(probe);
-    probe.focus();
-    check("hasFocus sees focus anywhere inside the view", view.hasFocus() === true);
-    probe.remove();
-    check("hasFocus is false again once focus leaves the view", view.hasFocus() === false);
-
-    // Escape is how a person dismisses an open menu; it also frees the chip's own state.
-    const dismissMenus = () =>
-      document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }));
-    view.openModeMenu();
-    check(
-      "openModeMenu opens the mode menu",
-      document.querySelector(".menu-popup.ws-mode-menu") !== null,
-    );
-    view.openModeMenu();
-    check(
-      "pressing again cycles the mode",
-      view.element.querySelector(".ws-mode-chip__label")?.textContent === "Plan",
-    );
-    dismissMenus();
-    view.openModelMenu();
-    check("openModelMenu opens the model menu", document.querySelector(".menu-popup.ws-model-menu") !== null);
-    dismissMenus();
-
-    // Shift+Tab in the composer opens the mode menu; it is not a registered
-    // chord, so the dispatcher never claims it from the other controls.
-    const editorElement = view.element.querySelector(".ws-prompt-input__editor");
-    const press = (init) => {
-      const event = new window.KeyboardEvent("keydown", { key: "Tab", bubbles: true, cancelable: true, ...init });
-      editorElement.dispatchEvent(event);
-      return event;
-    };
-    const plain = press({});
-    check("a plain Tab in the composer is left alone", plain.defaultPrevented === false && document.querySelector(".menu-popup") === null);
-    const shifted = press({ shiftKey: true });
-    check(
-      "Shift+Tab in the composer opens the mode menu and is consumed",
-      shifted.defaultPrevented === true && document.querySelector(".menu-popup.ws-mode-menu") !== null,
-    );
-    dismissMenus();
-    const outside = new window.KeyboardEvent("keydown", { key: "Tab", shiftKey: true, bubbles: true, cancelable: true });
-    view.element.querySelector(".ws-chat-error, .ws-agent-session__bar")?.dispatchEvent(outside);
-    check(
-      "Shift+Tab outside the editor (on the bar) opens nothing",
-      outside.defaultPrevented === false && document.querySelector(".menu-popup") === null,
-    );
-    view.dispose();
-    service.dispose();
-    modelService.dispose();
-    view.element.remove();
-  }
-
-  {
-    // Without a model service there is no toolbar, so the menu commands have nothing to open.
-    const { view, dispose } = setup();
-    view.openModeMenu();
-    view.openModelMenu();
-    check("a view without a toolbar opens no menu", document.querySelector(".menu-popup") === null);
-    dispose();
-  }
-
-  // --- A new session clears the feed -----------------------------------------------------------
-
-  {
-    const { wire, rows, dispose } = setup();
-    wire.fire.session("s1");
-    wire.fire.event("user_message", "old");
-    check("the first session's events paint", rows().length === 1);
-    wire.fire.session("s2");
-    check("a new session id clears the feed", rows().length === 0);
-    dispose();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`agent-session-view: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-session-view: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-socket.mjs b/crates/workshop/ui/test/agent-socket.mjs
deleted file mode 100644
index 1293ce38e..000000000
--- a/crates/workshop/ui/test/agent-socket.mjs
+++ /dev/null
@@ -1,251 +0,0 @@
-// Routing discipline of AgentSocket against a scripted fake WebSocket, no
-// DOM needed: durable agent_event frames are cursor-deduplicated so an
-// attach's replay from index zero delivers nothing twice; a reconnect
-// reattaches to the acknowledged session automatically; sends report false
-// when the socket is down; malformed frames are skipped without a throw;
-// error frames deliver their message; disposal is never mistaken for a
-// dropout. The frame shapes themselves are pinned by
-// test/agent-wire-fixtures.mjs against the shared Rust fixture.
-// Run: node test/agent-socket.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { AgentSocket } from "./src/services/agent-socket.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-socket-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, AgentSocket } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  sent = [];
-  closed = false;
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send(data) {
-    this.sent.push(JSON.parse(data));
-  }
-  close() {
-    this.closed = true;
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-  raw(data) {
-    this.onmessage?.({ data });
-  }
-  drop() {
-    this.readyState = 3;
-    this.onclose?.();
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-function event(index, content) {
-  return {
-    type: "agent_event",
-    index,
-    event: {
-      kind: "user_message",
-      section: "chat",
-      turn: 0,
-      content,
-    },
-  };
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- The event cursor and the reattach replay ----------------------------
-
-  const socket = new AgentSocket("ws://fake/agents/ws");
-  const delivered = [];
-  const sessions = [];
-  let disconnects = 0;
-  socket.onEvent((frame) => delivered.push(frame.index));
-  socket.onSession((frame) => sessions.push(frame.session));
-  socket.onDisconnect(() => disconnects++);
-  socket.connect();
-  fakeSockets[0].open();
-
-  check("launch reports true on an open socket", socket.launch("chat") === true);
-  fakeSockets[0].message({ type: "agent_session", session: "s1", agent: "chat" });
-  fakeSockets[0].message(event(0, "one"));
-  fakeSockets[0].message(event(1, "two"));
-  check(
-    "durable events deliver once each, in log order",
-    isDeepStrictEqual(delivered, [0, 1]),
-  );
-  fakeSockets[0].message(event(0, "one"));
-  check(
-    "a duplicate index below the cursor is dropped, not re-delivered",
-    isDeepStrictEqual(delivered, [0, 1]),
-  );
-
-  fakeSockets[0].drop();
-  check("a dropout fires onDisconnect", disconnects === 1);
-
-  // The dropout scheduled a backoff retry; connecting by hand stands in
-  // for that timer so the test never waits on a real clock.
-  socket.connect();
-  const rewire = fakeSockets[1];
-  rewire.open();
-  check(
-    "a reconnect reattaches to the acknowledged session by itself",
-    isDeepStrictEqual(rewire.sent, [{ type: "attach", session: "s1" }]),
-  );
-  rewire.message({ type: "agent_session", session: "s1", agent: "chat" });
-  check(
-    "the reattach acknowledgment fires onSession again",
-    isDeepStrictEqual(sessions, ["s1", "s1"]),
-  );
-  rewire.message(event(0, "one"));
-  rewire.message(event(1, "two"));
-  rewire.message(event(2, "three"));
-  check(
-    "the replay from index zero delivers only what the cursor has not seen",
-    isDeepStrictEqual(delivered, [0, 1, 2]),
-  );
-  socket.dispose();
-  check("disposal closes the live socket", rewire.closed === true);
-
-  // --- A new session on the same socket resets the durable cursor ----------
-  // The reachable path: the session dies while disconnected, the automatic
-  // reattach is refused, and a fresh launch on the same socket starts a new
-  // log at index zero - which must deliver, not fall below the old cursor.
-
-  const relaunch = new AgentSocket("ws://fake/agents/ws");
-  const relaunchDelivered = [];
-  const refusals = [];
-  relaunch.onEvent((frame) => relaunchDelivered.push(frame.index));
-  relaunch.onError((message) => refusals.push(message));
-  relaunch.connect();
-  const doomed = fakeSockets[fakeSockets.length - 1];
-  doomed.open();
-  relaunch.launch("chat");
-  doomed.message({ type: "agent_session", session: "old", agent: "chat" });
-  doomed.message(event(0, "one"));
-  doomed.message(event(1, "two"));
-  doomed.drop();
-  relaunch.connect();
-  const fresh = fakeSockets[fakeSockets.length - 1];
-  fresh.open();
-  fresh.message({ type: "error", message: "unknown agent session" });
-  check(
-    "a refused reattach surfaces as the server's error",
-    isDeepStrictEqual(refusals, ["unknown agent session"]),
-  );
-  relaunch.launch("chat");
-  fresh.message({ type: "agent_session", session: "new", agent: "chat" });
-  fresh.message(event(0, "fresh start"));
-  check(
-    "a new session's acknowledgment resets the cursor, so its log head delivers",
-    isDeepStrictEqual(relaunchDelivered, [0, 1, 0]),
-  );
-  relaunch.dispose();
-
-  // --- Sends report false when the socket is down --------------------------
-
-  const down = new AgentSocket("ws://fake/agents/ws");
-  check("launch reports false before a connect", down.launch("chat") === false);
-  check("attach reports false before a connect", down.attach("s1") === false);
-  check("respond reports false before a connect", down.respond("hi") === false);
-  check("cancelTurn reports false before a connect", down.cancelTurn() === false);
-  down.dispose();
-
-  // --- Malformed and unknown frames are skipped without a throw ------------
-
-  const tolerant = new AgentSocket("ws://fake/agents/ws");
-  const heard = [];
-  tolerant.onAgents((list) => heard.push(["agents", list]));
-  tolerant.onEvent((frame) => heard.push(["event", frame.index]));
-  tolerant.onError((message) => heard.push(["error", message]));
-  tolerant.connect();
-  const noisy = fakeSockets[fakeSockets.length - 1];
-  noisy.open();
-  noisy.raw("not json");
-  noisy.message({ type: "mystery" });
-  noisy.message({ type: "agent_event", event: {} });
-  noisy.message({ type: "input_required", token: "tok" });
-  noisy.message({ type: "agents", agents: "not a list" });
-  check(
-    "malformed frames are skipped, a listless agents push and a retired wait frame included",
-    heard.length === 0,
-  );
-
-  // --- Error frames deliver their message, with a fallback -----------------
-
-  noisy.message({ type: "error", message: "unknown agent session" });
-  noisy.message({ type: "error", message: "" });
-  check(
-    "error frames deliver the server's message, or the fallback when empty",
-    isDeepStrictEqual(heard, [
-      ["error", "unknown agent session"],
-      ["error", "the agent session failed"],
-    ]),
-  );
-  tolerant.dispose();
-
-  // --- Disposal is never mistaken for a dropout -----------------------------
-
-  const torn = new AgentSocket("ws://fake/agents/ws");
-  let tornDisconnects = 0;
-  torn.onDisconnect(() => tornDisconnects++);
-  torn.connect();
-  const last = fakeSockets[fakeSockets.length - 1];
-  last.open();
-  torn.dispose();
-  last.drop();
-  check(
-    "a close after disposal fires no disconnect and schedules no reconnect",
-    tornDisconnects === 0,
-  );
-});
-
-if (failures.length > 0) {
-  console.error(`agent-socket: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-socket: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-stt-boot.mjs b/crates/workshop/ui/test/agent-stt-boot.mjs
deleted file mode 100644
index e3cddf9a4..000000000
--- a/crates/workshop/ui/test/agent-stt-boot.mjs
+++ /dev/null
@@ -1,388 +0,0 @@
-// Dictation on the booted workbench: the mic mounts on the agent session's
-// input, negotiates the Realtime hypothesis extension, names a missing
-// wait on the real status bar, lights the real recording LED for a live
-// take, and dims it when the Realtime socket drops. The composition root
-// owns the recording LED and hands it to dictation through STT_STATUS
-// (src/services/stt-status.ts), registered before the layout boots: an
-// agent panel restored from a saved layout lights the LED too, and so
-// does a second agent panel opened beside the first. A dictating panel's
-// capture presence reads its own dock panel: the live tab title for its
-// label, and its `agent` or `agent:<instance>` id for its reveal. The behaviors
-// themselves are pinned by test/agent-stt.mjs against the view; this
-// proves the composition root wires the view to the bar.
-//
-// bootWorkbench exits the process, so each scenario boots in its own child
-// process; run without arguments this file drives them all and fails if
-// any does. Run: node test/agent-stt-boot.mjs (after `npm run build`).
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-const LIT = "status-bar__led--red";
-
-// A v5 layout envelope as buildLayoutEnvelope writes it (tree left, agent
-// right) under distinctive group ids, so a restore is told from the
-// default layout by the zone map alone.
-const RESTORED_LAYOUT = {
-  version: 5,
-  zones: { left: "restored-left", right: "restored-right" },
-  overrides: {},
-  layout: {
-    grid: {
-      root: {
-        type: "branch",
-        data: [
-          { type: "leaf", data: { views: ["tree"], activeView: "tree", id: "restored-left" }, size: 100 },
-          { type: "leaf", data: { views: ["agent"], activeView: "agent", id: "restored-right" }, size: 100 },
-        ],
-        size: 100,
-      },
-      width: 100,
-      height: 100,
-      orientation: "HORIZONTAL",
-    },
-    panels: {
-      tree: { id: "tree", contentComponent: "tree", tabComponent: "panel-tab", title: "Workshop" },
-      agent: { id: "agent", contentComponent: "agent", tabComponent: "panel-tab", title: "Agent Session" },
-    },
-    activeGroup: "restored-right",
-  },
-};
-
-// Polls `probe` every 10 ms until it answers truthy or two seconds pass,
-// answering the last value.
-async function poll(sleep, probe) {
-  const deadline = Date.now() + 2000;
-  let value = probe();
-  while (!value && Date.now() < deadline) {
-    await sleep(10);
-    value = probe();
-  }
-  return value;
-}
-
-// Clicks `mic` and waits for the shared production capture service to
-// report recording on the already-negotiated Realtime socket: answers
-// that socket once the recording LED is lit, or null when it never lights.
-async function startTake({ recEl, sttSockets, sleep }, mic) {
-  mic.click();
-  return poll(sleep, () => {
-    const socket = sttSockets().at(-1);
-    return socket && typeof socket.onmessage === "function" && recEl.classList.contains(LIT)
-      ? socket
-      : null;
-  });
-}
-
-// Starts a take from `mic`, which needs no wait from the agent, and drops
-// its Realtime socket, recording whether the LED lit for the take and
-// dimmed on the drop.
-async function recordOnce(ctx, mic, where) {
-  const { recEl, failures } = ctx;
-  const socket = await startTake(ctx, mic);
-  if (!socket) {
-    failures.push(`a take on ${where} did not light the recording LED`);
-    return;
-  }
-  socket.onclose?.();
-  if (recEl.classList.contains(LIT)) {
-    failures.push(`a dropped Realtime socket on ${where} did not dim the recording LED`);
-  }
-}
-
-// Closes `panel` through its Dockview api and waits for `mic` to leave
-// the document, so the stores the take built dispose inside the run.
-async function closePanel({ document, sleep, failures }, panel, mic, where) {
-  panel.api.close();
-  if (!(await poll(sleep, () => !document.contains(mic)))) {
-    failures.push(`closing ${where} did not unmount its mic`);
-  }
-}
-
-const scenarios = {
-  // The default layout's agent session: the full dictation path.
-  wired: () =>
-    bootWorkbench("dictation is wired into the booted agent session", async (ctx) => {
-      const { document, recEl, statusText, emitAgent, sleep, failures } = ctx;
-
-      // The session view (and its mic) shows once a session is acknowledged.
-      emitAgent({ type: "agent_session", session: "s1", agent: "chat" });
-      const mic = document.querySelector("#dock .ws-agent-session__action");
-      const input = document.querySelector("#dock .ws-prompt-input__editor");
-      if (!mic || !input) {
-        failures.push("the agent session mounted no mic beside its input");
-        return;
-      }
-      if (recEl.classList.contains(LIT)) {
-        failures.push("the recording LED must start dark");
-      }
-      // Realtime negotiation resolves a tick after mount.
-      await sleep(20);
-
-      // The mic needs no wait from the agent; the take lights the real
-      // recording LED.
-      const sttSocket = await startTake(ctx, mic);
-      if (!sttSocket) {
-        failures.push("the mic click did not start capture before the agent waited");
-        return;
-      }
-      if (statusText.textContent.includes("isn't asking for input")) {
-        failures.push(`the mic click named a wait it no longer needs (got "${statusText.textContent}")`);
-      }
-      if (
-        !sttSocket.sent
-          .map((event) => JSON.parse(event))
-          .some((event) => event.type === "session.update")
-      ) {
-        failures.push("the Realtime socket did not negotiate the hypothesis extension");
-      }
-      if (!recEl.classList.contains(LIT)) {
-        failures.push("starting dictation did not light the recording LED");
-      }
-      sttSocket.onmessage({
-        data: JSON.stringify({
-          type: "input_audio_buffer.committed",
-          event_id: "boot_committed",
-          item_id: "boot_item",
-          previous_item_id: null,
-        }),
-      });
-      sttSocket.onmessage({
-        data: JSON.stringify({
-          type: "conversation.item.input_audio_transcription.hypothesis",
-          event_id: "boot_hypothesis",
-          item_id: "boot_item",
-          content_index: 0,
-          revision: 1,
-          transcript: "hello",
-          finalized: "hel",
-          agreed: "l",
-          tentative: "o",
-          audio_start_ms: 0,
-          audio_end_ms: 100,
-        }),
-      });
-      if (input.textContent !== "hello" || input.getAttribute("contenteditable") !== "false") {
-        failures.push(`the interim did not land in the read-only agent input (got "${input.textContent}")`);
-      }
-
-      // The scripted socket never fires onclose on its own; a drop dims the LED.
-      sttSocket.onclose?.();
-      if (recEl.classList.contains(LIT)) {
-        failures.push("a dropped Realtime socket did not dim the recording LED");
-      }
-      if (input.getAttribute("contenteditable") !== "true") {
-        failures.push("a dropped Realtime socket did not lift the input's read-only lock");
-      }
-
-      // Closing the Agent tab from its tab chip disposes the panel, the view,
-      // and the stt handle: a click on the detached mic starts nothing.
-      const agentTab = [...document.querySelectorAll("#dock .dv-default-tab")].find(
-        (tab) => tab.querySelector(".dv-default-tab-content")?.textContent === "New Agent",
-      );
-      const closeAction = agentTab?.querySelector(".dv-default-tab-action");
-      if (!closeAction) {
-        failures.push("no closable tab action found for the New Agent tab");
-        return;
-      }
-      closeAction.click();
-      if (!(await poll(sleep, () => !document.contains(mic)))) {
-        failures.push("closing the New Agent tab did not unmount its input form");
-        return;
-      }
-      if (await startTake(ctx, mic)) {
-        failures.push("a click on the closed tab's detached mic started a take");
-      }
-    }),
-
-  // An agent panel restored from the workspace's saved layout: its
-  // factory resolves the dictation port the composition root registered
-  // before the dock (and the layout restore) existed.
-  restored: () =>
-    bootWorkbench(
-      "a restored agent panel lights the recording LED",
-      async (ctx) => {
-        const { document, emitAgent, recEl, registeredServiceIds, resolveService, sleep, failures } = ctx;
-        const zones = resolveService("workshop.zoneState");
-        if (zones.groupFor("right") !== "restored-right") {
-          failures.push(`the boot did not restore the saved layout (right zone is ${zones.groupFor("right")})`);
-          return;
-        }
-        const ids = registeredServiceIds();
-        const sttAt = ids.indexOf("workshop.sttStatus");
-        const dockAt = ids.indexOf("workshop.dock");
-        if (sttAt === -1 || dockAt === -1 || sttAt > dockAt) {
-          failures.push(
-            `STT_STATUS must register before the dock boots; registration order: ${JSON.stringify(ids)}`,
-          );
-        }
-        if (recEl.classList.contains(LIT)) {
-          failures.push("the recording LED must start dark");
-        }
-        emitAgent({ type: "agent_session", session: "s1", agent: "chat" });
-        const mic = document.querySelector("#dock .ws-agent-session__action");
-        if (!mic) {
-          failures.push("the restored agent session mounted no mic");
-          return;
-        }
-        await sleep(20);
-        await recordOnce(ctx, mic, "the restored agent panel");
-        await closePanel(ctx, resolveService("workshop.dock").getPanel("agent"), mic, "the restored agent panel");
-      },
-      { uiState: { workspace: { layout: RESTORED_LAYOUT } } },
-    ),
-
-  // A second agent panel beside the boot's: both resolve the one port, so
-  // the second panel's take lights the same LED.
-  twoAgents: () =>
-    bootWorkbench("a second agent panel lights the recording LED", async (ctx) => {
-      const { agentPanel, document, emitAgent, sockets, resolveService, sleep, failures } = ctx;
-      const dock = resolveService("workshop.dock");
-      const first = dock.getPanel("agent");
-      const second = dock.addPanel({
-        id: "agent:second",
-        component: "agent",
-        title: "Agent Session",
-        params: { instance: "second" },
-        position: { referenceGroup: first.group.id },
-      });
-      const agentSockets = () => sockets.filter((socket) => socket.url.endsWith("/agents/ws"));
-      const opened = await poll(
-        sleep,
-        () => agentSockets().length === 2 && agentSockets()[1].readyState === 1,
-      );
-      if (!opened) {
-        failures.push("the second agent panel opened no session socket of its own");
-        return;
-      }
-      emitAgent({ type: "agent_session", session: "s2", agent: "chat" });
-      const mic = [...document.querySelectorAll("#dock .ws-agent-session__action")].find(
-        (candidate) => !agentPanel.contains(candidate),
-      );
-      if (!mic) {
-        failures.push("the second agent session mounted no mic");
-        return;
-      }
-      if (dock.panels.filter((panel) => panel.id.startsWith("agent")).length !== 2) {
-        failures.push("the dock does not hold two agent panels");
-      }
-      await sleep(20);
-      await recordOnce(ctx, mic, "the second agent panel");
-      await closePanel(ctx, second, mic, "the second agent panel");
-    }),
-
-  // The dictating panel's capture presence reads the dock panel that hosts
-  // it: the label follows the live tab title, and reveal reactivates that
-  // panel - `agent` for the boot-time singleton, which carries no instance
-  // param, and `agent:<instance>` for an opened one - without opening another.
-  presence: () =>
-    bootWorkbench("a dictating agent panel's presence names its tab and reveals its own panel", async (ctx) => {
-      const { agentPanel, document, emitAgent, sockets, resolveService, sleep, failures } = ctx;
-      const dock = resolveService("workshop.dock");
-      const capture = resolveService("workshop.speechCapture");
-      const first = dock.getPanel("agent");
-
-      emitAgent({ type: "agent_session", session: "s1", agent: "chat" });
-      const firstMic = agentPanel.querySelector(".ws-agent-session__action");
-      if (!firstMic) {
-        failures.push("the boot agent session mounted no mic");
-        return;
-      }
-      await sleep(20);
-      const firstTake = await startTake(ctx, firstMic);
-      if (!firstTake) {
-        failures.push("a take on the boot agent panel did not light the recording LED");
-        return;
-      }
-      first.api.setTitle("Boot session");
-      if (capture.presence?.label() !== "Boot session (chat)") {
-        failures.push(`the boot panel's presence did not read its tab title (got "${capture.presence?.label()}")`);
-      }
-
-      const second = dock.addPanel({
-        id: "agent:a",
-        component: "agent",
-        title: "Agent Session",
-        params: { instance: "a" },
-        position: { referenceGroup: first.group.id },
-      });
-      const agentSockets = () => sockets.filter((socket) => socket.url.endsWith("/agents/ws"));
-      if (!(await poll(sleep, () => agentSockets().length === 2 && agentSockets()[1].readyState === 1))) {
-        failures.push("the instance panel opened no session socket of its own");
-        return;
-      }
-      const panelCount = dock.panels.length;
-      if (dock.activePanel?.id !== "agent:a") {
-        failures.push(`the opened instance panel was not active before the reveal (got ${dock.activePanel?.id})`);
-      }
-      capture.presence?.reveal();
-      if (dock.activePanel?.id !== "agent" || dock.panels.length !== panelCount) {
-        failures.push(
-          `the boot panel's reveal did not reactivate the singleton (active ${dock.activePanel?.id}, ${dock.panels.length} panels)`,
-        );
-      }
-      firstTake.onclose?.();
-      if (!(await poll(sleep, () => capture.presence === null))) {
-        failures.push("ending the boot panel's take did not clear the presence");
-      }
-
-      emitAgent({ type: "agent_session", session: "s2", agent: "chat" });
-      second.api.setActive();
-      const secondMic = [...document.querySelectorAll("#dock .ws-agent-session__action")].find(
-        (candidate) => !agentPanel.contains(candidate),
-      );
-      if (!secondMic) {
-        failures.push("the instance agent session mounted no mic");
-        return;
-      }
-      await sleep(20);
-      if (!(await startTake(ctx, secondMic))) {
-        failures.push("a take on the instance panel did not light the recording LED");
-        return;
-      }
-      second.api.setTitle("Session A");
-      if (capture.presence?.label() !== "Session A (chat)") {
-        failures.push(`the instance panel's presence did not read its tab title (got "${capture.presence?.label()}")`);
-      }
-      first.api.setActive();
-      if (dock.activePanel?.id !== "agent") {
-        failures.push(`the boot panel was not active before the instance reveal (got ${dock.activePanel?.id})`);
-      }
-      capture.presence?.reveal();
-      if (dock.activePanel?.id !== "agent:a" || dock.panels.length !== panelCount) {
-        failures.push(
-          `the instance panel's reveal did not reactivate agent:a (active ${dock.activePanel?.id}, ${dock.panels.length} panels)`,
-        );
-      }
-
-      await closePanel(ctx, second, secondMic, "the instance agent panel");
-      if (!(await poll(sleep, () => capture.presence === null))) {
-        failures.push("closing the dictating instance panel did not clear the presence");
-      }
-      await closePanel(ctx, first, firstMic, "the boot agent panel");
-    }),
-};
-
-const scenarioFlag = process.argv.find((arg) => arg.startsWith("--scenario="));
-if (scenarioFlag) {
-  const scenario = scenarios[scenarioFlag.slice("--scenario=".length)];
-  if (!scenario) {
-    console.error(`unknown scenario ${scenarioFlag}; known: ${Object.keys(scenarios).join(", ")}`);
-    process.exit(1);
-  }
-  await scenario();
-} else {
-  // Driver: one child per scenario, output forwarded, any failure fails
-  // the file.
-  const self = fileURLToPath(import.meta.url);
-  let failed = 0;
-  for (const name of Object.keys(scenarios)) {
-    const code = await new Promise((resolve) => {
-      const child = spawn(process.execPath, [self, `--scenario=${name}`], { stdio: "inherit" });
-      child.on("exit", (exitCode) => resolve(exitCode ?? 1));
-      child.on("error", () => resolve(1));
-    });
-    if (code !== 0) failed += 1;
-  }
-  process.exit(failed === 0 ? 0 : 1);
-}
diff --git a/crates/workshop/ui/test/agent-stt.mjs b/crates/workshop/ui/test/agent-stt.mjs
deleted file mode 100644
index c61e49340..000000000
--- a/crates/workshop/ui/test/agent-stt.mjs
+++ /dev/null
@@ -1,1850 +0,0 @@
-// Dictation on the agent session's chat box (src/parts/agent/agent-session-view.ts
-// embedding src/parts/chatbox/chat-box.ts and mounting src/parts/stt/stt.ts),
-// driven through the real AgentSessionService over a scripted wire,
-// canonical Realtime events, production capture, and a recording status
-// sink in jsdom. The mic button is the box's: its click reaches
-// setupStt's press() through the box's mic-press event, and dictation's
-// state comes back as the box's mic prop. It pins local gating and
-// status, replacement snapshots, authoritative completion, overlapping
-// items, clear, second take, recoverable failure, socket loss keeping
-// finalized text, the live region's sentence announcements, a dictation
-// undoing as one step that brings back a pill it replaced, disposal, and
-// - over one shared capture service with two views - microphone
-// exclusivity.
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-// The canonical Realtime fixtures Workshop owns, under the server's test
-// fixtures. The Gateway keeps its own copies.
-const fixtureDir = path.join(
-  testDir,
-  "..",
-  "..",
-  "server",
-  "tests",
-  "fixtures",
-  "realtime",
-);
-const canonicalSequences = JSON.parse(
-  await readFile(path.join(fixtureDir, "valid-sequences.json"), "utf8"),
-);
-
-function canonicalMessage(sequence, direction, type, occurrence = 0) {
-  return structuredClone(
-    canonicalSequences[sequence].events.filter(
-      (entry) => entry.direction === direction && entry.message.type === type,
-    )[occurrence].message,
-  );
-}
-
-function producerHypothesis(itemId, transcript, revision = 1) {
-  return {
-    type: "conversation.item.input_audio_transcription.hypothesis",
-    event_id: `${itemId}_hypothesis_${revision}`,
-    item_id: itemId,
-    content_index: 0,
-    revision,
-    transcript,
-    finalized: transcript,
-    agreed: "",
-    tentative: "",
-    audio_start_ms: 0,
-    audio_end_ms: 100,
-  };
-}
-
-function producerCommitted(itemId) {
-  return {
-    type: "input_audio_buffer.committed",
-    event_id: `${itemId}_committed`,
-    item_id: itemId,
-    previous_item_id: null,
-  };
-}
-
-function producerCompletion(itemId, transcript) {
-  return {
-    type: "conversation.item.input_audio_transcription.completed",
-    event_id: `${itemId}_completed`,
-    item_id: itemId,
-    content_index: 0,
-    transcript,
-    usage: { type: "duration", seconds: 0.1 },
-  };
-}
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { Emitter } from "@workshop/platform/event";
-      export { AgentSessionService } from "./src/services/agent-session.ts";
-      export { SpeechCaptureService } from "./src/services/speech-capture.ts";
-      export { AgentSessionView } from "./src/parts/agent/agent-session-view.ts";
-      // The agent panel type, so a presence's reveal resolves the real panel id.
-      import "./src/parts/agent/agent.contribution.ts";
-      export { initZones } from "./src/parts/layout/zones.ts";
-      export { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-// pretendToBeVisual supplies the requestAnimationFrame ProseMirror
-// schedules with; the prompt input's editor mounts in every test setup.
-const { window } = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-for (const key of ["document", "HTMLElement", "Node", "Element", "KeyboardEvent"]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.location = window.location;
-globalThis.Event = window.Event;
-globalThis.KeyboardEvent = window.KeyboardEvent;
-// The prompt input reads skin tokens through getComputedStyle; jsdom's
-// copies must be bound to their window.
-globalThis.getComputedStyle = window.getComputedStyle.bind(window);
-globalThis.requestAnimationFrame = window.requestAnimationFrame.bind(window);
-globalThis.cancelAnimationFrame = window.cancelAnimationFrame.bind(window);
-// jsdom's Range has no layout rects; ProseMirror's scroll-to-selection
-// reads them when a landed final focuses the editor.
-window.Range.prototype.getClientRects = () => [];
-window.Range.prototype.getBoundingClientRect = () => new window.DOMRect();
-
-// Audio stubs: jsdom has no audio stack, so the getUserMedia/AudioContext
-// path is scripted to succeed.
-const fakeAudioStream = { getTracks: () => [{ stop() {} }] };
-let delayedMediaStart = null;
-globalThis.navigator.mediaDevices = {
-  getUserMedia: () => {
-    if (delayedMediaStart === null) {
-      return Promise.resolve(fakeAudioStream);
-    }
-    delayedMediaStart.markRequested();
-    return delayedMediaStart.stream;
-  },
-};
-function delayNextMediaStart() {
-  let resolveStream;
-  let markRequested;
-  const requested = new Promise((resolve) => {
-    markRequested = resolve;
-  });
-  const stream = new Promise((resolve) => {
-    resolveStream = resolve;
-  });
-  const delayed = {
-    markRequested,
-    requested,
-    stream,
-    release() {
-      if (delayedMediaStart === delayed) {
-        delayedMediaStart = null;
-      }
-      resolveStream(fakeAudioStream);
-    },
-  };
-  delayedMediaStart = delayed;
-  return delayed;
-}
-class FakeAudioContext {
-  constructor() {
-    this.sampleRate = 24_000;
-    this.destination = {};
-    this.audioWorklet = { addModule: () => Promise.resolve() };
-  }
-  createMediaStreamSource() {
-    return { connect() {}, disconnect() {} };
-  }
-  close() {
-    return Promise.resolve();
-  }
-  resume() {
-    return Promise.resolve();
-  }
-}
-let nextFlushAudio = null;
-class FakeAudioWorkletNode {
-  constructor() {
-    this.port = {
-      onmessage: null,
-      postMessage: (message) => {
-        if (message?.type === "flush") {
-          const audio = nextFlushAudio;
-          nextFlushAudio = null;
-          queueMicrotask(() => {
-            if (audio !== null) {
-              this.port.onmessage?.({ data: audio });
-            }
-            this.port.onmessage?.({ data: { type: "flushed" } });
-          });
-        }
-      },
-    };
-  }
-  connect() {}
-  disconnect() {}
-}
-window.AudioContext = FakeAudioContext;
-globalThis.AudioContext = FakeAudioContext;
-globalThis.AudioWorkletNode = FakeAudioWorkletNode;
-
-// A scripted Realtime socket: opens asynchronously like a real one, records
-// what the client sends, and lets the test push server frames.
-const sockets = [];
-let nextItem = 0;
-class FakeWebSocket {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  constructor(url) {
-    this.url = url;
-    this.readyState = FakeWebSocket.CONNECTING;
-    this.closed = false;
-    this.sent = [];
-    this.listeners = new Map();
-    sockets.push(this);
-    setTimeout(() => {
-      this.readyState = FakeWebSocket.OPEN;
-      this.dispatch("open", {});
-    }, 0);
-  }
-  addEventListener(type, listener, options) {
-    if (!this.listeners.has(type)) this.listeners.set(type, []);
-    this.listeners.get(type).push({ listener, once: options?.once === true });
-  }
-  dispatch(type, event) {
-    const entries = this.listeners.get(type) ?? [];
-    this.listeners.set(
-      type,
-      entries.filter((entry) => !entry.once),
-    );
-    for (const entry of entries) entry.listener(event);
-  }
-  send(data) {
-    this.sent.push(JSON.parse(data));
-  }
-  close() {
-    if (this.closed) return;
-    this.closed = true;
-    this.readyState = FakeWebSocket.CLOSED;
-    this.dispatch("close", {});
-  }
-  // Test-side control, not part of the WebSocket surface.
-  message(frame) {
-    if (frame.type === "interim") {
-      if (!this.itemId) {
-        this.itemId = `item_${++nextItem}`;
-        this.revision = 0;
-      }
-      const finalized = frame.committed ?? "";
-      const tentative = `${finalized && frame.tentative && !/\s$/.test(finalized) ? " " : ""}${frame.tentative ?? ""}`;
-      frame = {
-        type: "conversation.item.input_audio_transcription.hypothesis",
-        event_id: `hypothesis_${nextItem}`,
-        item_id: this.itemId,
-        content_index: 0,
-        revision: ++this.revision,
-        transcript: `${finalized}${tentative}`,
-        finalized,
-        agreed: "",
-        tentative,
-        audio_start_ms: 0,
-        audio_end_ms: 100,
-      };
-    } else if (frame.type === "final") {
-      if (!this.itemId) {
-        this.itemId = `item_${++nextItem}`;
-      }
-      this.dispatch("message", {
-        data: JSON.stringify({
-          type: "input_audio_buffer.committed",
-          event_id: `committed_${nextItem}`,
-          item_id: this.itemId,
-          previous_item_id: null,
-        }),
-      });
-      frame = {
-        type: "conversation.item.input_audio_transcription.completed",
-        event_id: `completed_${nextItem}`,
-        item_id: this.itemId,
-        content_index: 0,
-        transcript: frame.text,
-        usage: { type: "duration", seconds: 0.1 },
-      };
-    }
-    this.dispatch("message", { data: JSON.stringify(frame) });
-    if (frame.type === "conversation.item.input_audio_transcription.completed") {
-      this.itemId = null;
-    }
-  }
-}
-window.WebSocket = FakeWebSocket;
-globalThis.WebSocket = FakeWebSocket;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-stt-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  lifecycle,
-  Emitter,
-  AgentSessionService,
-  AgentSessionView,
-  SpeechCaptureService,
-  initZones,
-  TEXT_CONTROL_SERVICE,
-  getService,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-// Capture crosses several await points before the take is live.
-async function waitFor(condition) {
-  for (let attempt = 0; attempt < 50; attempt++) {
-    if (condition()) return true;
-    await sleep(5);
-  }
-  return false;
-}
-
-// The scripted wire behind the real service: only the frames dictation cares
-// about are driven (the agent's wait on its inbox, agent_session).
-function makeWire() {
-  const emitters = {
-    agents: new Emitter(),
-    session: new Emitter(),
-    event: new Emitter(),
-    delta: new Emitter(),
-    error: new Emitter(),
-    disconnect: new Emitter(),
-  };
-  return {
-    onAgents: emitters.agents.event,
-    onSession: emitters.session.event,
-    onEvent: emitters.event.event,
-    onDelta: emitters.delta.event,
-    onError: emitters.error.event,
-    onDisconnect: emitters.disconnect.event,
-    responses: [],
-    launch() {
-      return true;
-    },
-    respond(text) {
-      this.responses.push(text);
-      return true;
-    },
-    cancelTurn() {
-      return true;
-    },
-    fire: {
-      awaiting: () =>
-        emitters.event.fire({
-          type: "agent_event",
-          index: 0,
-          event: { kind: "awaiting_input", section: "chat", turn: 0, content: "" },
-        }),
-      session: (session) => emitters.session.fire({ type: "agent_session", session, agent: "chat" }),
-    },
-  };
-}
-
-// Negotiates the newest Realtime socket the view opened.
-async function negotiateLatestRealtime() {
-  await waitFor(() =>
-    sockets.some(
-      (socket) =>
-        socket.url.endsWith("/v1/realtime") && socket.readyState === FakeWebSocket.OPEN,
-    ),
-  );
-  const realtime = sockets.filter((socket) => socket.url.endsWith("/v1/realtime")).at(-1);
-  realtime.message(
-    canonicalMessage("first_event_readiness", "server", "session.created"),
-  );
-  await waitFor(() => realtime.sent.some((event) => event.type === "session.update"));
-  realtime.message(
-    canonicalMessage("hypothesis_negotiation", "server", "session.updated"),
-  );
-  return realtime;
-}
-
-function makeStatus() {
-  return {
-    local: [],
-    recording: false,
-    showLocal(label, severity) {
-      this.local.push({ label, severity });
-    },
-    setRecording(on) {
-      this.recording = on;
-    },
-  };
-}
-
-// Mounts a view over a fresh service and negotiated Realtime socket.
-async function setup(speechCapture, host) {
-  const status = makeStatus();
-  const wire = makeWire();
-  const service = new AgentSessionService(wire);
-  const view = new AgentSessionView(service, status, undefined, speechCapture, host);
-  window.document.body.appendChild(view.element);
-  const realtime = await negotiateLatestRealtime();
-  // The one round button is the mic over an empty box (or while a take records)
-  // and the send arrow once there is text, so a take that starts over a draft
-  // - a second take, a take after typing - presses the mic from the keyboard,
-  // Ctrl+Shift+Space. This handle clicks the real button wherever it is the mic
-  // and takes the keyboard path elsewhere; everything else reads the button.
-  const button = view.element.querySelector(".ws-agent-session__action");
-  const mic = {
-    element: button,
-    click: () => (button.getAttribute("data-state") === "mic" ? button.click() : view.toggleVoiceInput()),
-    getAttribute: (name) => button.getAttribute(name),
-    get classList() {
-      return button.classList;
-    },
-    get disabled() {
-      return button.disabled;
-    },
-    get title() {
-      return button.title;
-    },
-    get type() {
-      return button.type;
-    },
-    querySelector: (selector) => button.querySelector(selector),
-  };
-  // The chat box: content and selection are driven through the component
-  // (the DOM alone sets neither on a ProseMirror editor). A take's
-  // read-only shows on the editor's contenteditable attribute, and the take
-  // marks the frame with ws-stt-input--recording.
-  const input = view.chatBox;
-  const frame = view.element.querySelector(".ws-prompt-input");
-  const editorEl = view.element.querySelector(".ws-prompt-input__editor");
-  const editable = () => editorEl.getAttribute("contenteditable") === "true";
-  const recording = () => frame.classList.contains("ws-stt-input--recording");
-  const send = button;
-  // Clicks the mic and waits for the take's Realtime socket to open and
-  // send "start"; null when no take began within the wait.
-  async function startTake() {
-    mic.click();
-    const started = await waitFor(() => status.recording);
-    return started
-      ? sockets.filter((socket) => socket.url.endsWith("/v1/realtime")).at(-1)
-      : null;
-  }
-  const dispose = () => {
-    view.dispose();
-    service.dispose();
-    view.element.remove();
-  };
-  return {
-    wire,
-    service,
-    view,
-    status,
-    realtime,
-    mic,
-    input,
-    editorEl,
-    editable,
-    recording,
-    send,
-    startTake,
-    dispose,
-  };
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // The shared canonical sequence drives fake media through UI replacement,
-  // completion, second-take clear, local status, and capture cleanup.
-
-  {
-    const { wire, status, mic, input, editable, startTake, dispose } = await setup();
-    // A first session, so the later acknowledgment replaces it.
-    wire.fire.session("replaced");
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("canonical fixture: the first take did not start");
-      dispose();
-      return;
-    }
-    const canonicalAppend = canonicalMessage(
-      "immediate_commit_and_provisional_promotion",
-      "client",
-      "input_audio_buffer.append",
-    );
-    nextFlushAudio = Uint8Array.from(
-      Buffer.from(canonicalAppend.audio, "base64"),
-    ).buffer;
-    mic.click();
-    await waitFor(() =>
-      socket.sent.some((event) => event.type === "input_audio_buffer.commit"),
-    );
-    const append = socket.sent.find(
-      (event) => event.type === "input_audio_buffer.append",
-    );
-    check(
-      "canonical fixture emits the shared valid-sized audio append",
-      append?.audio === canonicalAppend.audio,
-    );
-    const firstHypothesis = canonicalMessage(
-      "hypothesis_negotiation",
-      "server",
-      "conversation.item.input_audio_transcription.hypothesis",
-    );
-    socket.message(firstHypothesis);
-    check(
-      "the first precommit hypothesis binds and replaces the active take",
-      input.getText() === "Hello",
-    );
-    socket.message(
-      canonicalMessage(
-        "hypothesis_negotiation",
-        "server",
-        "conversation.item.input_audio_transcription.hypothesis",
-        1,
-      ),
-    );
-    check(
-      "every precommit revision replaces rather than appends",
-      input.getText() === "Hello!",
-    );
-    const committed = canonicalMessage(
-      "immediate_commit_and_provisional_promotion",
-      "server",
-      "input_audio_buffer.committed",
-    );
-    committed.item_id = firstHypothesis.item_id;
-    socket.message(committed);
-    const beforeUnknown = input.getText();
-    check(
-      "the matching acknowledgment confirms without changing provisional text",
-      input.getText() === "Hello!",
-    );
-    socket.message(
-      {
-        ...firstHypothesis,
-        event_id: "unknown_hypothesis_after_binding",
-        item_id: "unknown_item",
-        transcript: "MUST NOT LAND",
-      },
-    );
-    check(
-      "an unknown hypothesis cannot replace a bound take",
-      input.getText() === beforeUnknown,
-    );
-    socket.message(
-      canonicalMessage(
-        "hypothesis_negotiation",
-        "server",
-        "conversation.item.input_audio_transcription.completed",
-      ),
-    );
-    check(
-      "canonical completion is authoritative and restores ready UI state",
-      input.getText() === "Hello" &&
-        editable() &&
-        status.local.at(-1).label === "Dictation ready.",
-    );
-    socket.message({
-      ...firstHypothesis,
-      event_id: "unknown_hypothesis_without_active_take",
-      item_id: "orphan_item",
-      transcript: "ORPHAN",
-    });
-    check(
-      "an unknown hypothesis with no active take changes no text",
-      input.getText() === "Hello",
-    );
-
-    const second = await startTake();
-    check("a second take starts on the reusable fixture socket", second === socket);
-    wire.fire.session("s-next");
-    const clear = socket.sent
-      .filter((event) => event.type === "input_audio_buffer.clear")
-      .at(-1);
-    check(
-      "second-take cleanup sends the canonical clear event",
-      clear?.type ===
-        canonicalMessage(
-          "clear_retires_only_uncommitted_input",
-          "client",
-          "input_audio_buffer.clear",
-        ).type,
-    );
-    check("second-take cleanup stops recording", !status.recording);
-    check("second-take cleanup preserves completed text", input.getText() === "Hello");
-    check("second-take cleanup leaves the box editable", editable());
-    dispose();
-  }
-
-  // A mismatched acknowledgment retires its provisional take and unblocks FIFO.
-
-  {
-    const { wire, status, mic, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("mismatch recovery: the first take did not start");
-      dispose();
-      return;
-    }
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "mismatch_hypothesis",
-      item_id: "provisional_item",
-      content_index: 0,
-      revision: 1,
-      transcript: "must roll back",
-      finalized: "",
-      agreed: "",
-      tentative: "must roll back",
-      audio_start_ms: 0,
-      audio_end_ms: 100,
-    });
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 1,
-    );
-    socket.message({
-      type: "input_audio_buffer.committed",
-      event_id: "mismatched_commit",
-      item_id: "wrong_item",
-      previous_item_id: null,
-    });
-    check(
-      "a mismatched acknowledgment rolls back its provisional take",
-      input.getText() === "" &&
-        status.local.at(-1).severity === "error" &&
-        status.local.at(-1).label.includes("temporarily unavailable"),
-    );
-
-    await startTake();
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "fresh_hypothesis",
-      item_id: "fresh_item",
-      content_index: 0,
-      revision: 1,
-      transcript: "fresh take",
-      finalized: "fresh",
-      agreed: "",
-      tentative: " take",
-      audio_start_ms: 100,
-      audio_end_ms: 200,
-    });
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 2,
-    );
-    socket.message({
-      type: "input_audio_buffer.committed",
-      event_id: "fresh_commit",
-      item_id: "fresh_item",
-      previous_item_id: "wrong_item",
-    });
-    socket.message({
-      type: "conversation.item.input_audio_transcription.completed",
-      event_id: "fresh_completed",
-      item_id: "fresh_item",
-      content_index: 0,
-      transcript: "fresh final",
-      usage: { type: "duration", seconds: 0.1 },
-    });
-    check(
-      "one mismatch cannot block the next take's matching acknowledgment",
-      input.getText() === "fresh final" &&
-        status.local.at(-1).label === "Dictation ready.",
-    );
-    dispose();
-  }
-
-  // --- The mic needs no wait; a session that replaces another discards the take ---
-
-  {
-    const { wire, status, mic, input, editable, recording, startTake, dispose } = await setup();
-    check("the mic mounts enabled beside an editable input", !mic.disabled && editable());
-    check(
-      "the mic is a push-to-talk button with an accessible name",
-      mic.type === "button" &&
-        mic.getAttribute("aria-label") === "Push to talk" &&
-        mic.getAttribute("aria-pressed") === "false" &&
-        mic.querySelector("svg") !== null,
-    );
-    const socket = await startTake();
-    check("the mic opens a Realtime socket before the agent waits", socket !== null);
-    if (socket === null) {
-      dispose();
-      return;
-    }
-    check(
-      "no click names a missing wait on the status bar",
-      !status.local.some((entry) => entry.label.includes("isn't asking for input")),
-    );
-    check(
-      "a live take lights the recording LED and presses the mic",
-      status.recording &&
-        mic.getAttribute("aria-pressed") === "true" &&
-        mic.getAttribute("data-mic") === "recording" &&
-        mic.classList.contains("ws-stt-mic--recording") &&
-        mic.title === "Stop recording",
-    );
-    socket.message({ type: "interim", committed: "hello", tentative: "" });
-    check(
-      "the interim lands in the input, locked to the take",
-      input.getText() === "hello" && !editable() && recording(),
-    );
-
-    // The view's first session replaces none, so the take goes on into it.
-    wire.fire.session("s1");
-    check(
-      "the first acknowledgment keeps a take started before it",
-      status.recording && recording() && input.getText() === "hello",
-    );
-
-    wire.fire.session("s2");
-    check("a new session dims the recording LED", !status.recording);
-    check(
-      "a new session releases the mic button to idle",
-      mic.getAttribute("data-mic") === "idle" &&
-        mic.getAttribute("aria-pressed") === "false" &&
-        mic.title === "Voice Input (Ctrl+Shift+Space)",
-    );
-    check("a new session keeps the reusable Realtime socket open", !socket.closed);
-    check(
-      "a new session lifts the take lock and drops the interim",
-      !recording() && input.getText() === "",
-    );
-    check("the input is editable again", editable());
-    socket.message({ type: "final", text: "LATE FINAL" });
-    check("a final arriving after the discard writes nothing", input.getText() === "");
-
-    wire.fire.awaiting();
-    const reopened = await startTake();
-    check("the mic starts a fresh take", reopened !== null);
-    wire.fire.session("s3");
-    check("clearing the second take dims the recording LED", !status.recording);
-
-    // A reattach to the same session keeps the take.
-    const third = await startTake();
-    check("a third take starts", third !== null);
-    wire.fire.session("s3");
-    check("a same-session reattach keeps the live take", status.recording && recording());
-    wire.fire.session("s4");
-    check("a new session discards the live take", third?.closed === false && !status.recording && !recording());
-
-    dispose();
-    const before = sockets.length;
-    mic.click();
-    await sleep(20);
-    check("a click on the disposed view's mic starts nothing", sockets.length === before);
-  }
-
-  // --- The agent waiting mid-take leaves the take's lock ---------------------
-
-  {
-    const { wire, input, editable, recording, startTake, dispose } = await setup();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("wait mid-take: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    socket.message({ type: "interim", committed: "held", tentative: "" });
-    wire.fire.awaiting();
-    check(
-      "the agent waiting mid-take keeps the input locked to the take",
-      !editable() && recording(),
-    );
-    socket.message({ type: "final", text: "held final" });
-    check(
-      "the take finishes into the box the waiting agent reads",
-      editable() && !recording() && input.getText() === "held final",
-    );
-    dispose();
-  }
-
-  // --- Interims splice committed and tentative -------------------------------
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("interim splice: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    // Each tentative carries one extra last word: the take holds it back.
-    const interim = (committed, tentative) => socket.message({ type: "interim", committed, tentative });
-    interim("One two.", "three held");
-    check("committed and tentative join with a space", input.getText() === "One two. three");
-    interim("One two. three four.", "");
-    check("a grown committed prefix lands verbatim", input.getText() === "One two. three four.");
-    const grownLength = input.getText().length;
-    interim("One two. three four. five six.", "se held");
-    check(
-      "a shorter tentative never shrinks the text while committed grows",
-      input.getText() === "One two. three four. five six. se" && input.getText().length > grownLength,
-    );
-    interim("One two. three four. five six. ", "seven held");
-    check(
-      "a trailing-whitespace committed prefix gains no double space",
-      input.getText() === "One two. three four. five six. seven",
-    );
-    interim("", "fresh start held");
-    check("an empty committed prefix gains no leading space", input.getText() === "fresh start");
-    dispose();
-  }
-
-  // Producer-generated ownership snapshots replay through replacement verbatim,
-  // less the held-back last tentative word, with the shown tentative words
-  // decorated in the chat box.
-
-  {
-    const { wire, input, editorEl, startTake, dispose } = await setup();
-    const marks = () =>
-      [...editorEl.querySelectorAll(".ws-stt-tentative")].map((mark) => mark.textContent);
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("producer replay: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    const first = canonicalMessage(
-      "producer_hypothesis_ownership",
-      "server",
-      "conversation.item.input_audio_transcription.hypothesis",
-    );
-    const second = canonicalMessage(
-      "producer_hypothesis_ownership",
-      "server",
-      "conversation.item.input_audio_transcription.hypothesis",
-      1,
-    );
-    socket.message(first);
-    check(
-      "producer ownership replay lands one exact transcript without a duplicated prefix",
-      input.getText() === "ask not your country new tail",
-    );
-    check(
-      "the shown tentative words are decorated in the chat box",
-      marks().join("|") === " new tail",
-    );
-    socket.message(second);
-    check(
-      "a revision that holds back its whole tentative tail clears the decoration and keeps the text",
-      marks().length === 0 && input.getText() === "ask not your country new tail",
-    );
-    dispose();
-  }
-
-  // Standalone producer transcripts compose only at the logical document end.
-
-  {
-    const { wire, mic, input, editable, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("sequential composition: the first take did not start");
-      dispose();
-      return;
-    }
-    socket.message(producerHypothesis("composition_first", "First test alpha"));
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 1,
-    );
-    socket.message(producerCommitted("composition_first"));
-    socket.message(producerCompletion("composition_first", "First test alpha"));
-
-    await startTake();
-    socket.message(producerHypothesis("composition_second", "Second test beta"));
-    check(
-      "a second standalone producer hypothesis composes after the first take",
-      input.getText() === "First test alpha Second test beta",
-    );
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 2,
-    );
-    socket.message(producerCommitted("composition_second"));
-    socket.message(producerCompletion("composition_second", "Second test beta"));
-    check(
-      "the standalone completion replaces its hypothesis without losing composition spacing",
-      input.getText() === "First test alpha Second test beta" && editable(),
-    );
-    dispose();
-  }
-
-  {
-    const { wire, mic, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("interior correction: the first take did not start");
-      dispose();
-      return;
-    }
-    socket.message(producerHypothesis("interior_first", "ask not what"));
-    mic.click();
-    await waitFor(() =>
-      socket.sent.some((event) => event.type === "input_audio_buffer.commit"),
-    );
-    socket.message(producerCommitted("interior_first"));
-    socket.message(producerCompletion("interior_first", "Ask not what"));
-
-    await startTake();
-    socket.message(producerHypothesis("interior_second", "Second"));
-    check(
-      "a take after an interior-only completion correction composes at the end",
-      input.getText() === "Ask not what Second",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, mic, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("First test alpha");
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("completion-only composition: the take did not start");
-      dispose();
-      return;
-    }
-    mic.click();
-    await waitFor(() =>
-      socket.sent.some((event) => event.type === "input_audio_buffer.commit"),
-    );
-    socket.message(producerCommitted("completion_only_second"));
-    socket.message(producerCompletion("completion_only_second", "Second test beta"));
-    check(
-      "a completion with no hypothesis composes at the logical document end",
-      input.getText() === "First test alpha Second test beta",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("First test alpha ");
-    const socket = await startTake();
-    socket?.message(producerHypothesis("existing_space", "Second test beta"));
-    check(
-      "existing trailing space prevents an added composition separator",
-      input.getText() === "First test alpha Second test beta",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("First test alpha");
-    const socket = await startTake();
-    socket?.message(producerHypothesis("producer_space", " Second test beta"));
-    check(
-      "producer-leading space prevents a duplicate composition separator",
-      input.getText() === "First test alpha Second test beta",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("First test alpha");
-    input.setSelection(7, 11);
-    const socket = await startTake();
-    socket?.message(producerHypothesis("selection", "Second"));
-    check(
-      "a selected replacement receives no composition separator",
-      input.getText() === "First Second alpha",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("alphaBeta");
-    input.setSelection(6, 6);
-    const socket = await startTake();
-    socket?.message(producerHypothesis("mid_word", "Second"));
-    check(
-      "a mid-word insertion receives no composition separator",
-      input.getText() === "alphaSecondBeta",
-    );
-    dispose();
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.session("replaced");
-    wire.fire.awaiting();
-    input.setText("First test alpha");
-    const socket = await startTake();
-    socket?.message(producerHypothesis("rollback_spacing", "Second test beta"));
-    wire.fire.session("rollback-spacing");
-    check(
-      "rolling back a composed hypothesis removes its owned separator",
-      input.getText() === "First test alpha",
-    );
-    dispose();
-  }
-
-  // A take owns the selection present when delayed capture becomes usable.
-
-  {
-    const { wire, status, mic, input, editable, recording, dispose } = await setup();
-    wire.fire.session("replaced");
-    wire.fire.awaiting();
-    input.setText("old target keep");
-    input.setSelection(5, 11);
-    const delayed = delayNextMediaStart();
-    mic.click();
-    await delayed.requested;
-    check("the prompt remains editable during microphone startup", editable() && !recording());
-
-    input.setText("edited live tail");
-    input.setSelection(8, 12);
-    delayed.release();
-    const started = await waitFor(() => status.recording);
-    const socket = sockets.filter((candidate) => candidate.url.endsWith("/v1/realtime")).at(-1);
-    check("delayed microphone startup completes", started);
-    socket.message(producerHypothesis("delayed_prompt", "spoken"));
-    check(
-      "a delayed take inserts at the selection current when startup succeeds",
-      input.getText() === "edited spoken tail",
-    );
-    wire.fire.session("delayed-start");
-    check(
-      "delayed prompt rollback preserves edits made during startup",
-      input.getText() === "edited live tail" && !recording(),
-    );
-    dispose();
-  }
-
-  // --- Takes insert at the cursor -------------------------------------------
-
-  {
-    const { wire, input, editable, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    // ProseMirror positions: inside the first paragraph, text offset + 1.
-    input.setText("ab");
-    input.setSelection(2, 2);
-    let socket = await startTake();
-    if (socket === null) {
-      failures.push("cursor insert: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    socket.message({ type: "interim", committed: "X", tentative: "" });
-    check("an interim inserts at the cursor", input.getText() === "aXb");
-    const afterInterim = input.insertionContext().range;
-    check(
-      "the cursor sits after the inserted interim",
-      afterInterim.start === 3 && afterInterim.end === 3,
-    );
-    socket.message({ type: "final", text: "Y" });
-    check("the final replaces the interim in place", input.getText() === "aYb" && editable());
-    check("the final keeps the reusable Realtime socket open", !socket.closed);
-
-    input.setText("ab");
-    input.setSelection(1, 3);
-    socket = await startTake();
-    socket?.message({ type: "interim", committed: "X", tentative: "" });
-    check("a selection is replaced outright", input.getText() === "X");
-    socket?.message({ type: "final", text: "X" });
-
-    input.setText("start");
-    socket = await startTake();
-    socket?.message({ type: "final", text: " hello" });
-    check("the first take appends at the end", input.getText() === "start hello");
-    socket = await startTake();
-    socket?.message({ type: "final", text: " world" });
-    check(
-      "a second take composes at the cursor the first left behind",
-      input.getText() === "start hello world" && editable(),
-    );
-    dispose();
-  }
-
-  // --- The live region hears sentences; a dictation is one undo step ----------
-
-  {
-    const { wire, view, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("Note");
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("live region: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    const region = view.element.querySelector(".ws-stt-live");
-    check(
-      "dictation mounts a polite live region",
-      region?.getAttribute("aria-live") === "polite" && region.textContent === "",
-    );
-    socket.message({ type: "interim", committed: "Ask not", tentative: "what." });
-    check("a sentence that is not yet stable is not announced", region?.textContent === "");
-    socket.message({ type: "interim", committed: "Ask not what. Ask", tentative: "" });
-    check("a finished stable sentence is announced", region?.textContent === "Ask not what.");
-    socket.message({ type: "interim", committed: "Ask not what. Ask what", tentative: "you" });
-    check("an announced sentence is not repeated", region?.textContent === "Ask not what.");
-    socket.message({ type: "final", text: "Ask not what. Ask what you can do." });
-    check(
-      "a completed take announces the rest it had not announced",
-      region?.textContent === "Ask what you can do.",
-    );
-    check("the dictation lands", input.getText() === "Note Ask not what. Ask what you can do.");
-    // The landed final focuses the box; Tiptap defers the DOM focus a frame.
-    await new Promise((resolve) => window.requestAnimationFrame(resolve));
-    const textControls = getService(TEXT_CONTROL_SERVICE);
-    check("the focused box routes undo", textControls.active?.kind === "prosemirror");
-    textControls.undo();
-    check(
-      "one undo removes the whole dictation, interim writes included",
-      input.getText() === "Note",
-    );
-    dispose();
-    check("disposing the view removes the live region", region?.parentElement === null);
-  }
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("see ");
-    input.insertMention({ id: "src/main.ts", label: "main.ts", kind: "file", data: null });
-    const before = JSON.stringify(input.serialize().doc);
-    // ProseMirror positions: "see " spans 1..5, the pill 5..6, its trailing space 6..7.
-    input.setSelection(5, 7);
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("pill undo: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    socket.message({ type: "interim", committed: "spoken", tentative: "" });
-    socket.message({ type: "final", text: "spoken words" });
-    check("a dictation replaces a selected pill", input.getText() === "see spoken words");
-    await new Promise((resolve) => window.requestAnimationFrame(resolve));
-    getService(TEXT_CONTROL_SERVICE).undo();
-    check(
-      "one undo brings back the pill the dictation replaced, not its text",
-      JSON.stringify(input.serialize().doc) === before,
-    );
-    dispose();
-  }
-
-  // --- The input is read-only for the take's duration ------------------------
-
-  {
-    const { wire, input, mic, editable, recording, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("prefix");
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("readonly take: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    check("the input is read-only while the take is live", !editable());
-    check("the take marks the input as recording", recording());
-    socket.message({ type: "interim", committed: " world", tentative: "" });
-    check("the interim still lands programmatically", input.getText() === "prefix world");
-    // Stopping through the mic sends "stop" and waits for the final.
-    mic.click();
-    await waitFor(() => socket.sent.some((event) => event.type === "input_audio_buffer.commit"));
-    check(
-      "a second mic click sends the canonical commit event",
-      socket.sent.some((event) => event.type === "input_audio_buffer.commit"),
-    );
-    check("the take lock holds until the final arrives", !editable());
-    socket.message({ type: "final", text: " world" });
-    check("the final lifts the take lock", editable() && !recording());
-    check("the final text stays in place", input.getText() === "prefix world");
-    dispose();
-  }
-
-  // --- A stopped take awaiting its final is still a take -------------------
-
-  {
-    const { wire, status, mic, input, editable, recording, send, startTake, dispose } = await setup();
-    wire.fire.session("replaced");
-    wire.fire.awaiting();
-    let socket = await startTake();
-    if (socket === null) {
-      failures.push("stop window: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    socket.message({ type: "interim", committed: "hello", tentative: "" });
-    mic.click();
-    check("the stop dims the recording LED while the final is awaited", !status.recording && !editable());
-    wire.fire.session("stop-window");
-    check("a new session in the stop window keeps the Realtime session reusable", !socket.closed);
-    check(
-      "a new session in the stop window lifts the take lock and drops the interim",
-      !recording() && input.getText() === "",
-    );
-    socket.message({ type: "final", text: "LATE FINAL" });
-    check("a final after a stop-window discard writes nothing", input.getText() === "");
-
-    wire.fire.awaiting();
-    socket = await startTake();
-    socket?.message({ type: "interim", committed: "sent as shown", tentative: "" });
-    mic.click();
-    send.click();
-    check(
-      "a send in the stop window submits the interim",
-      isDeepStrictEqual(wire.responses, ["sent as shown"]) && socket?.closed === false,
-    );
-    check(
-      "a send in the stop window lifts the take lock and clears the box",
-      !recording() && input.getText() === "",
-    );
-    socket?.message({ type: "final", text: "LATE FINAL" });
-    check("a final after a stop-window send writes nothing", input.getText() === "");
-
-    wire.fire.awaiting();
-    input.setText("typed ");
-    socket = await startTake();
-    socket?.message({ type: "interim", committed: "kept", tentative: "dropped words" });
-    mic.click();
-    socket?.close();
-    check(
-      "a socket dropping in the stop window lifts the take lock and keeps the finalized text",
-      editable() && !recording() && input.getText() === "typed kept",
-    );
-    check(
-      "a socket dropping in the stop window says so on the status bar",
-      status.local.some((entry) => entry.label.includes("temporarily unavailable") && entry.severity === "error"),
-    );
-    dispose();
-  }
-
-  // A stop keeps routing the worklet's buffered block until flush completes.
-
-  {
-    const { wire, mic, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("flush ordering: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    nextFlushAudio = Uint8Array.from([1, 0, 2, 0]).buffer;
-    mic.click();
-    await waitFor(() =>
-      socket.sent.some((event) => event.type === "input_audio_buffer.commit"),
-    );
-    const speechEvents = socket.sent.filter((event) =>
-      event.type.startsWith("input_audio_buffer."),
-    );
-    check(
-      "stop sends the worklet's buffered PCM block before commit",
-      speechEvents.length === 2 &&
-        speechEvents[0].type === "input_audio_buffer.append" &&
-        speechEvents[0].audio === "AQACAA==" &&
-        speechEvents[1].type === "input_audio_buffer.commit",
-    );
-    dispose();
-  }
-
-  // --- A send discards the live take -----------------------------------------
-
-  {
-    const { wire, status, input, editorEl, recording, send, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("discard on send: the mic click did not open a Realtime socket");
-      dispose();
-      return;
-    }
-    socket.message({ type: "interim", committed: "hello", tentative: "" });
-    check("the recording LED is lit before the send", status.recording);
-    // The round button is the mic while a take records, so a press on it ends
-    // the take; sending mid-take is the keyboard's Enter, and the read-only
-    // editor drops its keydown, so the frame's own listener answers.
-    check("a recording take keeps the button the mic, not the send arrow", send.getAttribute("data-state") === "mic");
-    editorEl.dispatchEvent(
-      new window.KeyboardEvent("keydown", { key: "Enter", ctrlKey: true, bubbles: true, cancelable: true }),
-    );
-    check("the send submits the interim the operator saw", isDeepStrictEqual(wire.responses, ["hello"]));
-    check("the send dims the recording LED", !status.recording);
-    check("the send keeps the reusable Realtime socket open", !socket.closed);
-    check(
-      "the send lifts the take lock and clears the box",
-      !recording() && input.getText() === "",
-    );
-    socket.message({ type: "final", text: "LATE FINAL" });
-    check("a late final after the send writes nothing", input.getText() === "");
-
-    // Enter sends the same way the button does - even mid-take, when the
-    // editor is read-only and ProseMirror drops its keydown.
-    wire.fire.awaiting();
-    const second = await startTake();
-    second?.message({ type: "interim", committed: "via enter", tentative: "" });
-    editorEl.dispatchEvent(
-      new window.KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true }),
-    );
-    check(
-      "Enter during a take discards it and sends the interim",
-      wire.responses[1] === "via enter" && second?.closed === false && !status.recording,
-    );
-    dispose();
-  }
-
-  // A discarded commit keeps its FIFO place until its acknowledgment arrives.
-
-  {
-    const { wire, mic, input, startTake, dispose } = await setup();
-    wire.fire.session("replaced");
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("commit tombstone: the first take did not start");
-      dispose();
-      return;
-    }
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 1,
-    );
-    wire.fire.session("tombstone");
-
-    wire.fire.awaiting();
-    await startTake();
-    socket.message({
-      type: "input_audio_buffer.committed",
-      event_id: "late_discarded_commit",
-      item_id: "discarded_item",
-      previous_item_id: null,
-    });
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "late_discarded_hypothesis",
-      item_id: "discarded_item",
-      content_index: 0,
-      revision: 1,
-      transcript: "WRONG TAKE",
-      finalized: "",
-      agreed: "",
-      tentative: "WRONG TAKE",
-      audio_start_ms: 0,
-      audio_end_ms: 100,
-    });
-    check(
-      "a discarded commit's late acknowledgment and hypothesis do not bind the new take",
-      input.getText() === "",
-    );
-
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 2,
-    );
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "current_hypothesis",
-      item_id: "current_item",
-      content_index: 0,
-      revision: 1,
-      transcript: "right take",
-      finalized: "right",
-      agreed: " take",
-      tentative: "",
-      audio_start_ms: 100,
-      audio_end_ms: 200,
-    });
-    socket.message({
-      type: "input_audio_buffer.committed",
-      event_id: "current_commit",
-      item_id: "current_item",
-      previous_item_id: "discarded_item",
-    });
-    check(
-      "a precommit hypothesis after a tombstone binds the current take",
-      input.getText() === "right take",
-    );
-    dispose();
-  }
-
-  // --- Overlapping items finalize independently ------------------------------
-
-  {
-    const { wire, mic, input, editable, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    input.setText("base ");
-    const socket = await startTake();
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 1,
-    );
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "overlap_hypothesis_a",
-      item_id: "item_overlap_a",
-      content_index: 0,
-      revision: 1,
-      transcript: "first",
-      finalized: "fir",
-      agreed: "s",
-      tentative: "t",
-      audio_start_ms: 0,
-      audio_end_ms: 100,
-    });
-    socket.message(
-      canonicalMessage(
-        "overlapping_items_reverse_completion",
-        "server",
-        "input_audio_buffer.committed",
-      ),
-    );
-
-    await startTake();
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 2,
-    );
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "overlap_hypothesis_b",
-      item_id: "item_overlap_b",
-      content_index: 0,
-      revision: 1,
-      transcript: " second",
-      finalized: " sec",
-      agreed: "on",
-      tentative: "d",
-      audio_start_ms: 100,
-      audio_end_ms: 200,
-    });
-    socket.message(
-      canonicalMessage(
-        "overlapping_items_reverse_completion",
-        "server",
-        "input_audio_buffer.committed",
-        1,
-      ),
-    );
-    check(
-      "overlapping hypotheses occupy isolated replacement regions",
-      input.getText() === "base first second" && !editable(),
-    );
-
-    for (const completion of [0, 1]) {
-      socket.message(canonicalMessage(
-        "overlapping_items_reverse_completion",
-        "server",
-        "conversation.item.input_audio_transcription.completed",
-        completion,
-      ));
-    }
-    check(
-      "reverse completion replaces each item with authoritative text",
-      input.getText() === "base first second" && editable(),
-    );
-    dispose();
-  }
-
-  // A correlated rejection rolls back only the client event's take.
-
-  {
-    const { wire, mic, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    if (socket === null) {
-      failures.push("correlated error: the first take did not start");
-      dispose();
-      return;
-    }
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 1,
-    );
-    socket.message({
-      type: "input_audio_buffer.committed",
-      event_id: "older_commit",
-      item_id: "older_item",
-      previous_item_id: null,
-    });
-    socket.message({
-      type: "conversation.item.input_audio_transcription.hypothesis",
-      event_id: "older_hypothesis",
-      item_id: "older_item",
-      content_index: 0,
-      revision: 1,
-      transcript: "older",
-      finalized: "old",
-      agreed: "",
-      tentative: "er",
-      audio_start_ms: 0,
-      audio_end_ms: 100,
-    });
-
-    await startTake();
-    mic.click();
-    await waitFor(
-      () =>
-        socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 2,
-    );
-    const rejectedCommit = socket.sent
-      .filter((event) => event.type === "input_audio_buffer.commit")
-      .at(-1);
-    socket.message({
-      type: "error",
-      event_id: "rejected_commit",
-      error: {
-        type: "invalid_request_error",
-        code: "audio_too_short",
-        message: "SERVER WORDING MUST NOT LEAK",
-        param: "audio",
-        event_id: rejectedCommit.event_id,
-      },
-    });
-    check(
-      "a commit rejection rolls back its take but preserves an older finalization",
-      typeof rejectedCommit.event_id === "string" && input.getText() === "older",
-    );
-    socket.message({
-      type: "conversation.item.input_audio_transcription.completed",
-      event_id: "older_completed",
-      item_id: "older_item",
-      content_index: 0,
-      transcript: "OLDER FINAL",
-      usage: { type: "duration", seconds: 0.1 },
-    });
-    check(
-      "the preserved older item still accepts authoritative completion",
-      input.getText() === "OLDER FINAL",
-    );
-    dispose();
-  }
-
-  // --- Recoverable Realtime errors use local wording -------------------------
-
-  {
-    const { wire, status, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const socket = await startTake();
-    socket?.message({ type: "interim", committed: "temporary", tentative: "" });
-    socket?.message({
-      type: "error",
-      event_id: "server_error",
-      error: {
-        type: "server_error",
-        code: "engine_replaced",
-        message: "SERVER WORDING MUST NOT LEAK",
-      },
-    });
-    check(
-      "a recoverable server error restores the pre-take text",
-      input.getText() === "",
-    );
-    check(
-      "a recoverable server error is worded locally",
-      status.local.at(-1).label.includes("temporarily unavailable") &&
-        !status.local.at(-1).label.includes("SERVER WORDING"),
-    );
-    dispose();
-  }
-
-  // A real second socket may immediately reuse the first socket's item ID.
-
-  {
-    const { wire, input, startTake, dispose } = await setup();
-    wire.fire.awaiting();
-    const first = await startTake();
-    if (first === null) {
-      failures.push("two-socket reconnect: the first take did not start");
-      dispose();
-      return;
-    }
-    first.message(producerHypothesis("reused_item", "old socket words"));
-    check("the first socket owns its provisional text", input.getText() === "old socket words");
-    first.close();
-    check("closing the first socket keeps its finalized text", input.getText() === "old socket words");
-
-    await sleep(1_050);
-    const secondCreated = await waitFor(
-      () =>
-        sockets.filter((socket) => socket.url.endsWith("/v1/realtime")).length >= 2 &&
-        sockets.at(-1) !== first,
-    );
-    const second = sockets.at(-1);
-    check("the reconnect creates a distinct second socket", secondCreated && second !== first);
-    await waitFor(() => second.readyState === FakeWebSocket.OPEN);
-    second.message(
-      canonicalMessage("first_event_readiness", "server", "session.created"),
-    );
-    await waitFor(() => second.sent.some((event) => event.type === "session.update"));
-    second.message(
-      canonicalMessage("hypothesis_negotiation", "server", "session.updated"),
-    );
-
-    const active = await startTake();
-    check("the fresh take uses the second socket", active === second);
-    second.message(producerHypothesis("reused_item", "fresh socket words"));
-    check(
-      "the second socket immediately reuses the same item ID",
-      input.getText() === "old socket words fresh socket words",
-    );
-    first.dispatch("message", {
-      data: JSON.stringify(producerCompletion("reused_item", "STALE FINAL")),
-    });
-    check(
-      "a late first-socket callback cannot rewrite the fresh take",
-      input.getText() === "old socket words fresh socket words",
-    );
-    second.message(producerCompletion("reused_item", "fresh final"));
-    check(
-      "the second socket completion remains authoritative",
-      input.getText() === "old socket words fresh final",
-    );
-    dispose();
-  }
-
-  // --- Two views over one capture service: the microphone has one owner ----
-
-  {
-    // A scripted capture backend shared by both views, so the test can
-    // push one audio chunk and see which registry streams it.
-    let emitAudio = null;
-    const capture = new SpeechCaptureService({
-      async open(onAudio) {
-        emitAudio = onAudio;
-        return {
-          clear() {},
-          async stop() {},
-          dispose() {},
-        };
-      },
-    });
-    const a = await setup(capture);
-    const b = await setup(capture);
-    b.wire.fire.session("replaced");
-    a.wire.fire.awaiting();
-    b.wire.fire.awaiting();
-    check(
-      "both mics start idle over a free microphone",
-      a.mic.getAttribute("data-mic") === "idle" && b.mic.getAttribute("data-mic") === "idle",
-    );
-
-    // startTake returns the newest Realtime socket, which is b's here;
-    // each view's own negotiated socket is what its take speaks on.
-    const socketA = a.realtime;
-    if ((await a.startTake()) === null) {
-      failures.push("two views: the first view's take did not start");
-      a.dispose();
-      b.dispose();
-      capture.dispose();
-      return;
-    }
-    check("the first press owns the microphone", a.mic.getAttribute("data-mic") === "recording");
-    check(
-      "the other view's mic reads blocked while the first records",
-      b.mic.getAttribute("data-mic") === "blocked" &&
-        b.mic.getAttribute("aria-pressed") === "false" &&
-        !b.mic.classList.contains("ws-stt-mic--recording") &&
-        b.mic.disabled === false,
-    );
-    socketA.message({ type: "interim", committed: "owner text", tentative: "" });
-    check("the owner's interim lands in the owner's box", a.input.getText() === "owner text");
-
-    b.mic.click();
-    await waitFor(() => b.status.local.length > 0);
-    check(
-      "a press on the blocked view names the other window on its status bar",
-      isDeepStrictEqual(b.status.local.at(-1), {
-        label: "Dictation is active in another window",
-        severity: "info",
-      }),
-    );
-    check(
-      "the refused press does not steal the take",
-      a.status.recording &&
-        a.mic.getAttribute("data-mic") === "recording" &&
-        b.mic.getAttribute("data-mic") === "blocked" &&
-        !b.status.recording,
-    );
-    check(
-      "the refused press did not discard the owner's take",
-      a.input.getText() === "owner text" &&
-        a.recording() &&
-        !socketA.sent.some((event) => event.type === "input_audio_buffer.clear"),
-    );
-    check("the blocked view opened no take of its own", !b.recording() && b.input.getText() === "");
-
-    emitAudio(Uint8Array.from([1, 0, 2, 0]).buffer);
-    check(
-      "the owner streams the shared audio",
-      socketA.sent.some((event) => event.type === "input_audio_buffer.append"),
-    );
-    check(
-      "the blocked view processed none of the owner's audio",
-      !b.realtime.sent.some((event) => event.type === "input_audio_buffer.append"),
-    );
-
-    // The owner stops: capture is released and the other mic reopens.
-    a.mic.click();
-    await waitFor(() => b.mic.getAttribute("data-mic") === "idle");
-    check(
-      "ending the owner's take returns the other mic to idle",
-      b.mic.getAttribute("data-mic") === "idle" && a.mic.getAttribute("data-mic") === "idle",
-    );
-    socketA.message({ type: "final", text: "owner text" });
-    check("the owner's final still lands after the release", a.input.getText() === "owner text" && a.editable());
-
-    const startedB = await b.startTake();
-    check(
-      "the freed microphone opens for the other view",
-      startedB === b.realtime && b.mic.getAttribute("data-mic") === "recording",
-    );
-    check("the first view now reads blocked", a.mic.getAttribute("data-mic") === "blocked");
-    b.wire.fire.session("s-b");
-    await waitFor(() => a.mic.getAttribute("data-mic") === "idle");
-    check("a discarded take frees the microphone for the first view again", a.mic.getAttribute("data-mic") === "idle");
-
-    a.dispose();
-    b.dispose();
-    capture.dispose();
-  }
-
-  // --- Presence and level: the status bar's view of who is dictating -------
-
-  {
-    let emitAudio = null;
-    const capture = new SpeechCaptureService({
-      async open(onAudio) {
-        emitAudio = onAudio;
-        return {
-          clear() {},
-          async stop() {},
-          dispose() {},
-        };
-      },
-    });
-    // A dock stand-in where every panel id reads as open, so openInZone
-    // takes its reopen path and records the id it activated.
-    const activated = [];
-    const noEvent = () => ({ dispose() {} });
-    const zones = initZones({
-      onDidMovePanel: noEvent,
-      onDidLayoutChange: noEvent,
-      onWillMutateLayout: noEvent,
-      onDidMutateLayout: noEvent,
-      getPanel: (id) => ({ id, api: { setActive: () => activated.push(id) } }),
-    });
-    const levels = [];
-    const levelSubscription = capture.onLevel((level) => levels.push(level));
-    let titleA = "Agent Session";
-    const a = await setup(capture, { instance: "a", title: () => titleA });
-    const b = await setup(capture, { instance: "b", title: () => "Agent Session" });
-    const cleanup = () => {
-      a.dispose();
-      b.dispose();
-      levelSubscription.dispose();
-      capture.dispose();
-      zones.dispose();
-    };
-    a.wire.fire.session("session-a");
-    a.wire.fire.awaiting();
-    b.wire.fire.awaiting();
-    check("no presence before any take", capture.presence === null);
-    if ((await a.startTake()) === null) {
-      failures.push("presence: the dictating view's take did not start");
-      cleanup();
-      return;
-    }
-
-    check(
-      "the dictating view's label names its agent and session title",
-      capture.presence?.label() === "Agent Session (chat)",
-    );
-    titleA = "Renamed session";
-    check(
-      "the label is read on each call, so a rename shows",
-      capture.presence?.label() === "Renamed session (chat)",
-    );
-    capture.presence?.reveal();
-    check(
-      "reveal opens the dictating view's own panel instance",
-      isDeepStrictEqual(activated, ["agent:a"]),
-    );
-
-    // The second view becomes the active one: focused and pressed.
-    b.input.focus();
-    b.mic.click();
-    await waitFor(() => b.status.local.length > 0);
-    const before = levels.length;
-    emitAudio(new ArrayBuffer(960));
-    emitAudio(Int16Array.from({ length: 480 }, (_, index) => (index % 2 === 0 ? 20_000 : -20_000)).buffer);
-    check(
-      "level events keep flowing while a second agent view is active",
-      levels.length === before + 2 && levels.at(-1) > levels.at(-2),
-    );
-    check(
-      "the active second view does not take the presence",
-      capture.presence?.label() === "Renamed session (chat)",
-    );
-
-    a.dispose();
-    await waitFor(() => capture.presence === null && !capture.recording);
-    check(
-      "closing the dictating panel stops capture and clears presence",
-      !capture.recording && capture.owner === null && capture.presence === null,
-    );
-    check("the other view's mic reopens", b.mic.getAttribute("data-mic") === "idle");
-    cleanup();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`agent-stt: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-stt: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-toolbar.mjs b/crates/workshop/ui/test/agent-toolbar.mjs
deleted file mode 100644
index 17d417467..000000000
--- a/crates/workshop/ui/test/agent-toolbar.mjs
+++ /dev/null
@@ -1,222 +0,0 @@
-// The agent toolbar (src/parts/agent/agent-toolbar.ts) in jsdom: a role=toolbar
-// flex row composing ModeChip, ModelPickerTrigger, and TokenRing. The picker
-// reads the constructor's ModelService; the toolbar forwards the chip's mode
-// and change event and the two menu openers the composer's keys use;
-// dispose() cascades to all three children. The stylesheet's side - a fixed
-// 28px row with 4px gaps, the model button pushing the ring and the action
-// button to the trailing edge - is read from the source text. Runs under the
-// shared leak check: an undisposed toolbar or child fails.
-// Run: node test/agent-toolbar.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ModelService } from "./src/services/model-service.ts";
-      export { AgentToolbar } from "./src/parts/agent/agent-toolbar.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// The children read the DOM globals when they build, so the jsdom globals
-// must exist before the bundle is imported.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.HTMLElement = dom.window.HTMLElement;
-globalThis.HTMLButtonElement = dom.window.HTMLButtonElement;
-globalThis.Element = dom.window.Element;
-globalThis.Node = dom.window.Node;
-globalThis.CustomEvent = dom.window.CustomEvent;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-toolbar-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { AgentToolbar, ModelService, lifecycle } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function menuEl() {
-  return document.querySelector(".menu-popup");
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- The container -----------------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const toolbar = new AgentToolbar(service);
-    document.body.appendChild(toolbar.element);
-    check(
-      "the toolbar has the ws-agent-toolbar class",
-      toolbar.element.classList.contains("ws-agent-toolbar"),
-    );
-    check(
-      "the toolbar is a named toolbar landmark",
-      toolbar.element.getAttribute("role") === "toolbar" &&
-        toolbar.element.getAttribute("aria-label") === "Agent controls",
-    );
-    toolbar.dispose();
-    service.dispose();
-    toolbar.element.remove();
-  }
-
-  // --- The children --------------------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const toolbar = new AgentToolbar(service);
-    document.body.appendChild(toolbar.element);
-    const children = [...toolbar.element.children];
-    check(
-      "the toolbar composes the chip, the picker, and the ring in order",
-      children.length === 3 &&
-        children[0]?.classList.contains("ws-mode-chip") &&
-        children[1]?.classList.contains("ws-model-picker-trigger") &&
-        children[2]?.classList.contains("ws-token-ring"),
-    );
-    check(
-      "the ring is the last child so the stylesheet can pin it to the trailing edge",
-      toolbar.element.lastElementChild?.classList.contains("ws-token-ring") === true,
-    );
-    check(
-      "each child renders its own control",
-      toolbar.element.querySelector(".ws-mode-chip__label")?.textContent === "Agent" &&
-        toolbar.element.querySelector(".ws-model-picker-trigger__label")?.textContent ===
-          "Select model" &&
-        toolbar.element.querySelector(".ws-token-ring")?.hasAttribute("hidden") === true,
-    );
-    for (const button of toolbar.element.querySelectorAll("button")) {
-      button.focus();
-      check(
-        `${button.getAttribute("aria-label") ?? button.textContent.trim()} accepts keyboard focus`,
-        document.activeElement === button && button.matches(":focus-visible"),
-      );
-    }
-    toolbar.dispose();
-    service.dispose();
-    toolbar.element.remove();
-  }
-
-  // --- The service threads into the picker -----------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const toolbar = new AgentToolbar(service);
-    document.body.appendChild(toolbar.element);
-    service.applySelected("alpha");
-    check(
-      "the picker reads the toolbar's model service",
-      toolbar.element.querySelector(".ws-model-picker-trigger__label")?.textContent ===
-        "alpha",
-    );
-    toolbar.dispose();
-    service.dispose();
-    toolbar.element.remove();
-  }
-
-  // --- The mode and the menu openers ---------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    service.setModels([{ id: "alpha" }]);
-    const toolbar = new AgentToolbar(service);
-    document.body.appendChild(toolbar.element);
-    const seen = [];
-    toolbar.onDidChangeMode((mode) => seen.push(mode));
-    check("the toolbar reports the chip's mode", toolbar.mode === "agent");
-    toolbar.openModeMenu();
-    check("openModeMenu opens the mode menu", menuEl()?.classList.contains("ws-mode-menu") === true);
-    toolbar.openModeMenu();
-    check(
-      "a second openModeMenu cycles the mode and the change event follows",
-      toolbar.mode === "plan" && seen.join(",") === "plan",
-    );
-    toolbar.element.querySelector(".ws-mode-chip")?.click();
-    check("the menu closes before the model menu opens", menuEl() === null);
-    toolbar.openModelMenu();
-    check("openModelMenu opens the model menu", menuEl()?.classList.contains("ws-model-menu") === true);
-    toolbar.dispose();
-    service.dispose();
-    toolbar.element.remove();
-  }
-
-  // --- Dispose cascades ------------------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const toolbar = new AgentToolbar(service);
-    document.body.appendChild(toolbar.element);
-    const chip = toolbar.element.querySelector(".ws-mode-chip");
-    const picker = toolbar.element.querySelector(".ws-model-picker-trigger");
-    chip?.click();
-    check("a chip menu is open before dispose", menuEl() !== null);
-    toolbar.dispose();
-    check("dispose closes the chip's open menu", menuEl() === null);
-    picker?.click();
-    check("a disposed toolbar's picker does not reopen its menu", menuEl() === null);
-    let serviceFired = false;
-    service.onDidChangeCurrent(() => {
-      serviceFired = true;
-    });
-    service.applySelected("beta");
-    check(
-      "a disposed toolbar leaves the borrowed model service alive",
-      serviceFired === true,
-    );
-    service.dispose();
-    toolbar.element.remove();
-  }
-});
-
-// --- The stylesheet --------------------------------------------------------------------
-
-{
-  const css = (
-    await readFile(path.join(testDir, "..", "src", "parts", "agent", "agent-toolbar.css"), "utf8")
-  ).replace(/\/\*[\s\S]*?\*\//g, "");
-  const componentCss = await readFile(path.join(testDir, "..", "src", "tokens", "component.css"), "utf8");
-  check("the toolbar is a fixed 28px row", /\.ws-agent-toolbar\s*\{[^}]*block-size:\s*var\(--height-base\)/.test(css));
-  check(
-    "the toolbar's children sit 4px apart",
-    /gap:\s*var\(--ws-agent-toolbar-gap\)/.test(css) && /--ws-agent-toolbar-gap:\s*var\(--ws-size-4\)/.test(componentCss),
-  );
-  check(
-    "the model button pushes the ring and the action button to the trailing edge",
-    /\.ws-agent-toolbar > \.ws-model-picker-trigger\s*\{[^}]*margin-inline-end:\s*auto/.test(css),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`ws-agent-toolbar: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-agent-toolbar: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/agent-wire-fixtures.mjs b/crates/workshop/ui/test/agent-wire-fixtures.mjs
deleted file mode 100644
index 3ccecbd26..000000000
--- a/crates/workshop/ui/test/agent-wire-fixtures.mjs
+++ /dev/null
@@ -1,292 +0,0 @@
-// The TS half of the agent-frame wire contract: every frame in the shared
-// fixture crates/workshop/server/tests/fixtures/agent-frames.json
-// routes through AgentSocket unchanged (server-to-client), and every frame
-// the socket sends matches its fixture entry byte-for-byte as parsed JSON
-// (client-to-server). The Rust half is the fixture test in
-// crates/workshop/server/src/agents/wire-tests.rs; both suites pin the same
-// case list, so a wire drift or
-// a case added on one side fails the other. Every inbound fixture frame also
-// passes its protocol.ts guard, and a copy missing any required field is
-// dropped with one warning. The `error` frame is pinned by
-// workshop-frames.json, since both sockets share its shape.
-// Run: node test/agent-wire-fixtures.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { AgentSocket } from "./src/services/agent-socket.ts";
-      export { AGENT_FRAME_GUARDS } from "./src/services/protocol.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-agent-wire-fixtures-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, AgentSocket, AGENT_FRAME_GUARDS } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const fixture = JSON.parse(
-  await readFile(
-    path.join(testDir, "..", "..", "..", "workshop", "server", "tests", "fixtures", "agent-frames.json"),
-    "utf8",
-  ),
-);
-const workshopFixture = JSON.parse(
-  await readFile(
-    path.join(testDir, "..", "..", "..", "workshop", "protocol", "tests", "fixtures", "workshop-frames.json"),
-    "utf8",
-  ),
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Both suites pin exactly the same case list, so a case added on one side
-// fails the other. This list is mirrored by the Rust fixture test.
-const CASES = [
-  "agent_delta_reasoning",
-  "agent_delta_text",
-  "agent_event_awaiting",
-  "agent_event_minimal",
-  "agent_event_run_ended",
-  "agent_event_stamped",
-  "agent_session",
-  "agents",
-  "attach",
-  "cancel",
-  "input_response",
-  "launch",
-];
-check(
-  "the fixture holds exactly the cases both suites pin",
-  isDeepStrictEqual(Object.keys(fixture).sort(), CASES),
-);
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  sent = [];
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send(data) {
-    this.sent.push(JSON.parse(data));
-  }
-  close() {
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-const warnings = [];
-console.warn = (...args) => warnings.push(args.join(" "));
-
-// --- Guards: the inbound frames /agents/ws handles -----------------------
-
-// Each inbound case and the fields it may omit; every other field except
-// `type` is required.
-const INBOUND = {
-  agents: [],
-  agent_session: [],
-  agent_event_minimal: [],
-  agent_event_awaiting: [],
-  agent_event_run_ended: [],
-  agent_event_stamped: ["reply"],
-  agent_delta_text: [],
-  agent_delta_reasoning: [],
-};
-const inbound = Object.entries(INBOUND).map(([name, optional]) => [name, fixture[name], optional]);
-inbound.push(["error (workshop-frames.json)", workshopFixture.error, ["id"]]);
-
-const fixtureTypes = new Set(
-  [...Object.values(fixture), ...Object.values(workshopFixture)].map((frame) => frame.type),
-);
-check(
-  "every inbound type the agent socket handles appears in one of the two fixtures",
-  Object.keys(AGENT_FRAME_GUARDS).every((type) => fixtureTypes.has(type)),
-);
-check(
-  "the agent socket guards exactly the inbound cases' types",
-  isDeepStrictEqual(
-    Object.keys(AGENT_FRAME_GUARDS).sort(),
-    [...new Set(inbound.map(([, frame]) => frame.type))].sort(),
-  ),
-);
-for (const [name, frame] of inbound) {
-  check(`the ${name} fixture frame passes its guard`, AGENT_FRAME_GUARDS[frame.type](frame) === true);
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Server-to-client: each fixture frame routes through unchanged ------
-
-  const socket = new AgentSocket("ws://fake/agents/ws");
-  const agents = [];
-  const sessions = [];
-  const events = [];
-  const deltas = [];
-  socket.onAgents((list) => agents.push(list));
-  socket.onSession((frame) => sessions.push(frame));
-  socket.onEvent((frame) => events.push(frame));
-  socket.onDelta((frame) => deltas.push(frame));
-  const errors = [];
-  socket.onError((message) => errors.push(message));
-  socket.connect();
-  const wire = fakeSockets[0];
-  wire.open();
-
-  wire.message(fixture.agents);
-  wire.message(fixture.agent_session);
-  wire.message(fixture.agent_event_awaiting);
-  wire.message(fixture.agent_event_minimal);
-  wire.message(fixture.agent_event_stamped);
-  wire.message(fixture.agent_event_run_ended);
-  wire.message(fixture.agent_delta_text);
-  wire.message(fixture.agent_delta_reasoning);
-
-  check(
-    "the agents fixture frame delivers its list verbatim",
-    isDeepStrictEqual(agents, [fixture.agents.agents]),
-  );
-  check(
-    "the agent_session fixture frame delivers verbatim",
-    isDeepStrictEqual(sessions, [fixture.agent_session]),
-  );
-  check(
-    "every agent_event fixture frame delivers verbatim, in order, index and reply intact",
-    isDeepStrictEqual(events, [
-      fixture.agent_event_awaiting,
-      fixture.agent_event_minimal,
-      fixture.agent_event_stamped,
-      fixture.agent_event_run_ended,
-    ]),
-  );
-  check(
-    "the agent's wait on its inbox is an agent_event of kind awaiting_input",
-    events[0]?.event.kind === "awaiting_input",
-  );
-  check(
-    "the run's end is an agent_event of kind run_ended with empty content",
-    events[3]?.event.kind === "run_ended" && events[3].event.content === "",
-  );
-  check(
-    "the minimal event omits reply and the stamped event includes it, as the fixture does",
-    events[1] !== undefined &&
-      !("reply" in events[1]) &&
-      events[2] !== undefined &&
-      events[2].reply === fixture.agent_event_stamped.reply,
-  );
-  check(
-    "both agent_delta fixture frames deliver verbatim with their superseding reply id",
-    isDeepStrictEqual(deltas, [fixture.agent_delta_text, fixture.agent_delta_reasoning]),
-  );
-  wire.message(workshopFixture.error);
-  check(
-    "the error fixture frame delivers its message",
-    isDeepStrictEqual(errors, [workshopFixture.error.message]),
-  );
-  check("well-formed frames warn about nothing", warnings.length === 0);
-
-  // Every required field of every inbound frame, plus the nested required
-  // fields of an event: a copy without it fails its guard and is dropped,
-  // with one warning naming its type.
-  const handled = [agents, sessions, events, deltas, errors];
-  const handledCounts = () => handled.map((calls) => calls.length);
-  const before = handledCounts();
-  const removals = [];
-  for (const [name, frame, optional] of inbound) {
-    for (const field of Object.keys(frame)) {
-      if (field !== "type" && !optional.includes(field)) removals.push([name, frame, [field]]);
-    }
-  }
-  for (const field of ["kind", "section", "turn", "content"]) {
-    removals.push(["agent_event_minimal", fixture.agent_event_minimal, ["event", field]]);
-  }
-  for (const nested of [
-    ["usage", "prompt_tokens"],
-    ["llama", "draft_n"],
-    ["client", "e2e_ms"],
-  ]) {
-    removals.push(["agent_event_stamped", fixture.agent_event_stamped, ["event", "metrics", ...nested]]);
-  }
-  for (const [name, frame, fieldPath] of removals) {
-    const copy = structuredClone(frame);
-    const parent = fieldPath.slice(0, -1).reduce((node, key) => node[key], copy);
-    delete parent[fieldPath.at(-1)];
-    const missing = `a ${name} frame missing ${fieldPath.join(".")}`;
-    warnings.length = 0;
-    wire.message(copy);
-    check(`${missing} fails its guard`, AGENT_FRAME_GUARDS[frame.type](copy) === false);
-    check(
-      `${missing} is dropped without a handler call`,
-      isDeepStrictEqual(handledCounts(), before),
-    );
-    check(
-      `${missing} warns once, naming ${frame.type}`,
-      warnings.length === 1 && warnings[0].includes(frame.type),
-    );
-  }
-
-  // --- Client-to-server: each send matches its fixture entry --------------
-
-  socket.launch(fixture.launch.agent);
-  socket.respond(fixture.input_response.text);
-  socket.cancelTurn();
-  check(
-    "launch, input_response, and cancel sends match their fixture entries",
-    isDeepStrictEqual(wire.sent, [fixture.launch, fixture.input_response, fixture.cancel]),
-  );
-  socket.dispose();
-
-  const attacher = new AgentSocket("ws://fake/agents/ws");
-  attacher.connect();
-  fakeSockets[1].open();
-  attacher.attach(fixture.attach.session);
-  check(
-    "an attach send matches its fixture entry",
-    isDeepStrictEqual(fakeSockets[1].sent, [fixture.attach]),
-  );
-  attacher.dispose();
-});
-
-if (failures.length > 0) {
-  console.error(`agent-wire-fixtures: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("agent-wire-fixtures: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/barberpole-beside-indicators.mjs b/crates/workshop/ui/test/barberpole-beside-indicators.mjs
deleted file mode 100644
index 3264a999c..000000000
--- a/crates/workshop/ui/test/barberpole-beside-indicators.mjs
+++ /dev/null
@@ -1,60 +0,0 @@
-// The mic meter, recording LED, and activity LED stand in one indicators
-// group beside the barberpole, never behind it: the bar reads barberpole,
-// meter, recording LED, activity LED; a busy frame shows the barberpole
-// and leaves the group and both LEDs visible, the barberpole precedes the
-// group in DOM order, and a non-busy frame hides the barberpole alone.
-// Run: node test/barberpole-beside-indicators.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("the barberpole shows beside the recording and activity LEDs", async (ctx) => {
-  const { emitStatus, barberpoleEl, indicatorsEl, recEl, ledEl, failures } = ctx;
-  if (!indicatorsEl) {
-    failures.push("status bar indicators group missing");
-    return;
-  }
-  if (!barberpoleEl) {
-    failures.push("status bar barberpole missing");
-    return;
-  }
-  if (indicatorsEl.hidden) {
-    failures.push("the indicators group must start visible");
-  }
-  if (!barberpoleEl.hidden) {
-    failures.push("the barberpole must start hidden");
-  }
-  const following = barberpoleEl.compareDocumentPosition(indicatorsEl);
-  if ((following & barberpoleEl.DOCUMENT_POSITION_FOLLOWING) === 0) {
-    failures.push("the barberpole does not precede the indicators group in DOM order");
-  }
-  if (barberpoleEl.nextElementSibling?.firstElementChild !== indicatorsEl) {
-    failures.push("something sits between the barberpole and the indicators group");
-  }
-  const reading = [...indicatorsEl.children].map((el) => el.dataset.indicator).join(",");
-  if (reading !== "mic-meter,recording,activity") {
-    failures.push(`the indicators group reads ${reading}, not mic-meter,recording,activity`);
-  }
-
-  emitStatus({
-    label: "Downloading model",
-    description: "1 of 2",
-    activity: "general",
-    busy: true,
-  });
-  if (barberpoleEl.hidden) {
-    failures.push("a busy frame did not reveal the barberpole");
-  }
-  if (indicatorsEl.hidden) {
-    failures.push("a busy frame hid the recording and activity LED group");
-  }
-  if (recEl.hidden || ledEl.hidden) {
-    failures.push("a busy frame hid an LED individually");
-  }
-
-  emitStatus({ label: "Download complete", description: "ready" });
-  if (!barberpoleEl.hidden) {
-    failures.push("a non-busy frame did not hide the barberpole");
-  }
-  if (indicatorsEl.hidden) {
-    failures.push("a non-busy frame hid the recording and activity LED group");
-  }
-});
diff --git a/crates/workshop/ui/test/boot-queue.mjs b/crates/workshop/ui/test/boot-queue.mjs
deleted file mode 100644
index 511c0dfc8..000000000
--- a/crates/workshop/ui/test/boot-queue.mjs
+++ /dev/null
@@ -1,177 +0,0 @@
-// Boot-queue test for WorkshopSocket: status/models pushes that
-// arrive before ready() are queued, then replayed in arrival order when
-// ready() is called; pushes after ready() deliver immediately; ready() is
-// idempotent; disposal and a connection drop each clear the queue; the
-// queue is bounded at BOOT_QUEUE_CAP with drop-oldest overflow. Drives the
-// socket against a scripted fake WebSocket, no DOM needed.
-// Run: node test/boot-queue.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { WorkshopSocket, BOOT_QUEUE_CAP } from "./src/services/workshop-socket.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-boot-queue-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, WorkshopSocket, BOOT_QUEUE_CAP } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  closed = false;
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send() {}
-  close() {
-    this.closed = true;
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-  drop() {
-    this.readyState = 3;
-    this.onclose?.();
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-function statusFrame(label) {
-  return {
-    type: "status",
-    label,
-    description: "",
-    severity: "info",
-    activity: "general",
-    busy: false,
-  };
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Queue before ready, replay in arrival order, immediate after -------
-
-  const socket = new WorkshopSocket("ws://fake/ws");
-  const delivered = [];
-  socket.onStatus((frame) => delivered.push(`status:${frame.label}`));
-  socket.onModels((models) => delivered.push(`models:${models[0]?.id}`));
-  socket.connect();
-  fakeSockets[0].open();
-
-  fakeSockets[0].message(statusFrame("s1"));
-  fakeSockets[0].message({ type: "models", models: [{ id: "m1", description: "" }] });
-  fakeSockets[0].message(statusFrame("s2"));
-  check("no push is delivered before ready()", delivered.length === 0);
-
-  socket.ready();
-  check(
-    "ready() replays queued pushes in arrival order, status and models interleaved",
-    delivered.join(",") === "status:s1,models:m1,status:s2",
-  );
-
-  fakeSockets[0].message(statusFrame("s3"));
-  check(
-    "a push after ready() delivers immediately",
-    delivered.length === 4 && delivered.at(-1) === "status:s3",
-  );
-
-  socket.ready();
-  check("a second ready() replays nothing", delivered.length === 4);
-  socket.dispose();
-
-  // --- Disposal clears the queue -------------------------------------------
-
-  const disposedSocket = new WorkshopSocket("ws://fake/ws");
-  const afterDisposal = [];
-  disposedSocket.onStatus((frame) => afterDisposal.push(frame.label));
-  disposedSocket.connect();
-  fakeSockets[1].open();
-  fakeSockets[1].message(statusFrame("queued"));
-  disposedSocket.dispose();
-  disposedSocket.ready();
-  check(
-    "disposal clears the queue: ready() after dispose delivers nothing",
-    afterDisposal.length === 0,
-  );
-
-  // --- The cap drops the oldest pushes --------------------------------------
-
-  const cappedSocket = new WorkshopSocket("ws://fake/ws");
-  const capped = [];
-  cappedSocket.onStatus((frame) => capped.push(frame.label));
-  cappedSocket.connect();
-  fakeSockets[2].open();
-  const overflow = 3;
-  for (let i = 1; i <= BOOT_QUEUE_CAP + overflow; i++) {
-    fakeSockets[2].message(statusFrame(`s${i}`));
-  }
-  cappedSocket.ready();
-  check("the queue never holds more than BOOT_QUEUE_CAP pushes", capped.length === BOOT_QUEUE_CAP);
-  check(
-    "overflow drops the oldest pushes, keeping the newest",
-    capped[0] === `s${overflow + 1}` && capped.at(-1) === `s${BOOT_QUEUE_CAP + overflow}`,
-  );
-  cappedSocket.dispose();
-
-  // --- A dropped connection clears its queued pushes ------------------------
-
-  const droppedSocket = new WorkshopSocket("ws://fake/ws");
-  const afterDrop = [];
-  droppedSocket.onStatus((frame) => afterDrop.push(frame.label));
-  droppedSocket.connect();
-  fakeSockets[3].open();
-  fakeSockets[3].message(statusFrame("stale"));
-  fakeSockets[3].drop();
-  droppedSocket.ready();
-  check(
-    "a connection drop before ready() clears its queued pushes",
-    afterDrop.length === 0,
-  );
-  droppedSocket.dispose();
-});
-
-if (failures.length > 0) {
-  console.error(`boot-queue: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("boot-queue: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/boot-ui-storage.mjs b/crates/workshop/ui/test/boot-ui-storage.mjs
deleted file mode 100644
index 7af98af6c..000000000
--- a/crates/workshop/ui/test/boot-ui-storage.mjs
+++ /dev/null
@@ -1,301 +0,0 @@
-// Boot test for the UI-state preload in the composition root (src/main.ts):
-// the app fetches GET /user/state and GET /workspace/file/state before it
-// resolves any service (the first getService call, recorded by the boot
-// fixture's registry seam as a RESOLVE entry in the fetch log); with both
-// buckets answering, every store holds its bucket's value (the four user
-// stores and the zoom from ui-state.json, the layout, tree, and closed
-// editors from the workspace file); a bucket that fails yields defaults
-// for its stores only, with one warning; and a server that never answers
-// still lets boot complete on defaults after the preload timeout with one
-// warning per bucket. Stores are registry services, so the first
-// resolution of any token bounds the first store construction from
-// above, and the fixture's resolveService reads each one back by id.
-// Every scenario also asserts that the booted workbench fetched the
-// granted roots (GET /workspace/tree, path null) exactly once: the tree
-// panel and the window title share one load through TreeStateService.
-//
-// bootWorkbench exits the process, so each scenario boots in its own child
-// process; run without arguments this file drives them all and fails if
-// any does. Run: node test/boot-ui-storage.mjs (after `npm run build`).
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-const USER_STATE = "/user/state";
-const WORKSPACE_STATE = "/workspace/file/state";
-// The granted-roots listing; the fixture answers it empty. fetchTree
-// sends the bare route for the roots (no ?path=), so an exact match is
-// the `path=null` request.
-const WORKSPACE_TREE = "/workspace/tree";
-// main.ts preloads with a 3000 ms timeout; the hanging scenario allows the
-// timer some slack either side.
-const PRELOAD_TIMEOUT_MS = 3000;
-
-// Counts the adapter's own console warnings across the whole boot; the
-// bundle writes to the Node global console, which jsdom does not replace.
-const uiStorageWarnings = [];
-const realWarn = console.warn;
-console.warn = (...args) => {
-  const text = args.map(String).join(" ");
-  if (text.startsWith("ui-storage:")) {
-    uiStorageWarnings.push(text);
-  } else {
-    realWarn(...args);
-  }
-};
-
-const isStateGet = (entry) =>
-  entry.method === "GET" && (entry.url === USER_STATE || entry.url === WORKSPACE_STATE);
-const stateGets = (fetchLog) => fetchLog.filter(isStateGet);
-// The first service resolution of the boot; `url` holds the token id.
-const firstResolve = (fetchLog) => fetchLog.find((entry) => entry.method === "RESOLVE");
-
-// Both state GETs recorded once each, both before the first getService.
-function checkOrdering(fetchLog, failures) {
-  const gets = stateGets(fetchLog);
-  const urls = gets.map((entry) => entry.url).sort();
-  if (urls.join(",") !== [USER_STATE, WORKSPACE_STATE].join(",")) {
-    failures.push(
-      `boot must GET each state bucket exactly once, saw ${JSON.stringify(gets.map((e) => e.url))}`,
-    );
-  }
-  const resolveIndex = fetchLog.findIndex((entry) => entry.method === "RESOLVE");
-  if (resolveIndex === -1) {
-    failures.push("boot never resolved a service; the registry seam is not recording");
-    return;
-  }
-  const lastStateGet = fetchLog.reduce((last, entry, index) => (isStateGet(entry) ? index : last), -1);
-  if (lastStateGet > resolveIndex) {
-    failures.push(
-      `both state GETs must precede the first getService (${fetchLog[resolveIndex].url}); log: ${JSON.stringify(fetchLog.map((e) => `${e.method} ${e.url}`))}`,
-    );
-  }
-  checkRootsFetch(fetchLog, failures);
-}
-
-// The booted workbench (tree panel mounted, title rendered) fetched the
-// roots once: the panel and the window title share TreeStateService's load.
-function checkRootsFetch(fetchLog, failures) {
-  const rootsGets = fetchLog.filter((entry) => entry.method === "GET" && entry.url === WORKSPACE_TREE);
-  if (rootsGets.length !== 1) {
-    failures.push(
-      `boot must GET ${WORKSPACE_TREE} (the roots, path null) exactly once, saw ${rootsGets.length}; log: ${JSON.stringify(fetchLog.filter((e) => e.method !== "RESOLVE").map((e) => `${e.method} ${e.url}`))}`,
-    );
-  }
-}
-
-// --- Seeded bucket documents and what each store must read from them -----
-
-// The user bucket (ui-state.json), every key set off its default.
-const USER_DOC = {
-  editor_settings: { wordWrap: true, renderWhitespace: "all", renderControlCharacters: false, columnSelection: true },
-  // Level 2 of the 1.2-per-level zoom: a stored factor restores to its nearest level.
-  zoom: 1.44,
-  recent_files: ["C:\\seed\\a.md", "C:\\seed\\b.md"],
-  commands_history: ["workbench.action.zoomIn", "workbench.action.files.save"],
-};
-const DEFAULT_EDITOR_SETTINGS = {
-  wordWrap: false,
-  renderWhitespace: "selection",
-  renderControlCharacters: true,
-  columnSelection: false,
-};
-const SEEDED_EDITOR_SETTINGS = USER_DOC.editor_settings;
-
-// The workspace bucket (.rvwork kv rows): a v5 layout envelope as
-// buildLayoutEnvelope writes it (tree left, agent right) whose group ids
-// are distinctive, so a restore is told from the default layout by the
-// zone map alone; an expanded set; a closed stack.
-const SEEDED_LAYOUT = {
-  version: 5,
-  zones: { left: "seeded-left", right: "seeded-right" },
-  overrides: {},
-  layout: {
-    grid: {
-      root: {
-        type: "branch",
-        data: [
-          { type: "leaf", data: { views: ["tree"], activeView: "tree", id: "seeded-left" }, size: 100 },
-          { type: "leaf", data: { views: ["agent"], activeView: "agent", id: "seeded-right" }, size: 100 },
-        ],
-        size: 100,
-      },
-      width: 100,
-      height: 100,
-      orientation: "HORIZONTAL",
-    },
-    panels: {
-      tree: { id: "tree", contentComponent: "tree", tabComponent: "panel-tab", title: "Workshop" },
-      agent: { id: "agent", contentComponent: "agent", tabComponent: "panel-tab", title: "Agent Session" },
-    },
-    activeGroup: "seeded-right",
-  },
-};
-const WORKSPACE_DOC = {
-  layout: SEEDED_LAYOUT,
-  tree: { expanded: ["C:\\seed", "C:\\seed\\src"] },
-  closed_editors: { paths: ["C:\\seed\\old.md", "C:\\seed\\older.md"] },
-};
-
-// Asserts the user-bucket stores against `doc`, or the defaults when
-// `doc` is null. Zoom applies to the document in browser mode (no desktop app
-// in the fixture): a restore sets the root zoom and pins the body;
-// the default path never touches either.
-function checkUserStores({ resolveService, document }, doc, failures) {
-  const expect = (what, actual, expected) => {
-    if (!isDeepStrictEqual(actual, expected)) {
-      failures.push(`${what}: expected ${JSON.stringify(expected)}, saw ${JSON.stringify(actual)}`);
-    }
-  };
-  expect("editor settings", resolveService("workshop.editorSettings").settings, doc === null ? DEFAULT_EDITOR_SETTINGS : SEEDED_EDITOR_SETTINGS);
-  expect("recent files", [...resolveService("workshop.recentFiles").list], doc?.recent_files ?? []);
-  expect("commands history", [...resolveService("workshop.commandsHistory").list], doc?.commands_history ?? []);
-  const zoomApplied = document.body.style.position === "relative";
-  expect("zoom restored", zoomApplied, doc !== null);
-  if (doc !== null) {
-    expect("zoom factor", document.documentElement.style.zoom, String(doc.zoom));
-  }
-}
-
-// Asserts the workspace-bucket stores against `doc`, or the defaults
-// when `doc` is null: the default layout's groups are Dockview-numbered,
-// never the seeded ids.
-function checkWorkspaceStores({ resolveService }, doc, failures) {
-  const expect = (what, actual, expected) => {
-    if (!isDeepStrictEqual(actual, expected)) {
-      failures.push(`${what}: expected ${JSON.stringify(expected)}, saw ${JSON.stringify(actual)}`);
-    }
-  };
-  const zones = resolveService("workshop.zoneState");
-  const groups = [zones.groupFor("left"), zones.groupFor("right")];
-  if (doc) {
-    expect("layout restored through the zone map", groups, ["seeded-left", "seeded-right"]);
-  } else if (groups.some((id) => typeof id !== "string" || id.startsWith("seeded-"))) {
-    failures.push(`the default layout must anchor both zones under Dockview's own group ids, saw ${JSON.stringify(groups)}`);
-  }
-  expect("tree expansion", [...resolveService("workshop.treeState").expandedPaths], doc?.tree.expanded ?? []);
-  expect("closed editors", resolveService("workshop.closedEditors").snapshot().paths, doc?.closed_editors.paths ?? []);
-}
-
-const scenarios = {
-  // Both buckets answer: the two GETs are the first entries of the boot
-  // log, ahead of every service resolution, nothing warns, and every
-  // store holds its bucket's value.
-  resolve: () =>
-    bootWorkbench(
-      "boot preloads both UI-state buckets before any store resolves and seeds every store",
-      async (ctx) => {
-        const { fetchLog, failures } = ctx;
-        checkOrdering(fetchLog, failures);
-        const firstTwo = fetchLog.slice(0, 2).map((entry) => `${entry.method} ${entry.url}`).sort();
-        if (firstTwo.join(",") !== `GET ${USER_STATE},GET ${WORKSPACE_STATE}`) {
-          failures.push(`the state GETs must be the first two fetches, saw ${JSON.stringify(firstTwo)}`);
-        }
-        if (uiStorageWarnings.length !== 0) {
-          failures.push(`a clean preload must not warn, saw ${JSON.stringify(uiStorageWarnings)}`);
-        }
-        checkUserStores(ctx, USER_DOC, failures);
-        checkWorkspaceStores(ctx, WORKSPACE_DOC, failures);
-      },
-      { uiState: { user: USER_DOC, workspace: WORKSPACE_DOC } },
-    ),
-
-  // The user bucket fails, the workspace bucket answers: the user stores
-  // boot on defaults with one warning naming that GET, and the workspace
-  // stores still hold the file's values.
-  userFails: () =>
-    bootWorkbench(
-      "a failed user bucket yields defaults for the user stores only",
-      async (ctx) => {
-        const { fetchLog, failures } = ctx;
-        checkOrdering(fetchLog, failures);
-        if (uiStorageWarnings.length !== 1 || !uiStorageWarnings[0].includes(`GET ${USER_STATE}`)) {
-          failures.push(`the failed bucket must warn exactly once, naming GET ${USER_STATE}; saw ${JSON.stringify(uiStorageWarnings)}`);
-        }
-        checkUserStores(ctx, null, failures);
-        checkWorkspaceStores(ctx, WORKSPACE_DOC, failures);
-      },
-      { uiState: { user: "reject", workspace: WORKSPACE_DOC } },
-    ),
-
-  // The workspace bucket fails, the user bucket answers: the mirror image.
-  workspaceFails: () =>
-    bootWorkbench(
-      "a failed workspace bucket yields defaults for the workspace stores only",
-      async (ctx) => {
-        const { fetchLog, failures } = ctx;
-        checkOrdering(fetchLog, failures);
-        if (uiStorageWarnings.length !== 1 || !uiStorageWarnings[0].includes(`GET ${WORKSPACE_STATE}`)) {
-          failures.push(`the failed bucket must warn exactly once, naming GET ${WORKSPACE_STATE}; saw ${JSON.stringify(uiStorageWarnings)}`);
-        }
-        checkUserStores(ctx, USER_DOC, failures);
-        checkWorkspaceStores(ctx, null, failures);
-      },
-      { uiState: { user: USER_DOC, workspace: "reject" } },
-    ),
-
-  // Both buckets hang: boot still completes (bootWorkbench itself fails
-  // when the panels never mount), the first service resolves only after
-  // the preload timeout rather than early, each bucket warns exactly
-  // once, and every store holds its defaults.
-  hang: () =>
-    bootWorkbench(
-      "boot completes on defaults when both UI-state buckets hang",
-      async (ctx) => {
-        const { fetchLog, failures } = ctx;
-        checkOrdering(fetchLog, failures);
-        checkUserStores(ctx, null, failures);
-        checkWorkspaceStores(ctx, null, failures);
-        const gets = stateGets(fetchLog);
-        const resolve = firstResolve(fetchLog);
-        if (gets.length === 2 && resolve) {
-          const waited = resolve.at - Math.max(...gets.map((entry) => entry.at));
-          if (waited < PRELOAD_TIMEOUT_MS - 200) {
-            failures.push(
-              `the first service resolved ${waited} ms after the state GETs; boot must wait out the ${PRELOAD_TIMEOUT_MS} ms preload timeout`,
-            );
-          }
-          if (waited > PRELOAD_TIMEOUT_MS + 2000) {
-            failures.push(
-              `the first service resolved ${waited} ms after the state GETs; boot must not block past the timeout`,
-            );
-          }
-        }
-        const perBucket = [USER_STATE, WORKSPACE_STATE].map(
-          (route) => uiStorageWarnings.filter((text) => text.includes(`GET ${route}`)).length,
-        );
-        if (perBucket.join(",") !== "1,1") {
-          failures.push(
-            `each hanging bucket must warn exactly once, saw ${JSON.stringify(uiStorageWarnings)}`,
-          );
-        }
-      },
-      { uiState: { user: "hang", workspace: "hang" } },
-    ),
-};
-
-const scenarioFlag = process.argv.find((arg) => arg.startsWith("--scenario="));
-if (scenarioFlag) {
-  const scenario = scenarios[scenarioFlag.slice("--scenario=".length)];
-  if (!scenario) {
-    console.error(`unknown scenario ${scenarioFlag}; known: ${Object.keys(scenarios).join(", ")}`);
-    process.exit(1);
-  }
-  await scenario();
-} else {
-  // Driver: one child per scenario, output forwarded, any failure fails
-  // the file. Sequential so the two boots' timing assertions never share a
-  // CPU with each other.
-  const self = fileURLToPath(import.meta.url);
-  let failed = 0;
-  for (const name of Object.keys(scenarios)) {
-    const code = await new Promise((resolve) => {
-      const child = spawn(process.execPath, [self, `--scenario=${name}`], { stdio: "inherit" });
-      child.on("exit", (exitCode) => resolve(exitCode ?? 1));
-      child.on("error", () => resolve(1));
-    });
-    if (code !== 0) failed += 1;
-  }
-  process.exit(failed === 0 ? 0 : 1);
-}
diff --git a/crates/workshop/ui/test/chat-box.mjs b/crates/workshop/ui/test/chat-box.mjs
deleted file mode 100644
index 1dccfc300..000000000
--- a/crates/workshop/ui/test/chat-box.mjs
+++ /dev/null
@@ -1,1744 +0,0 @@
-// The chat box (src/parts/chatbox/chat-box.ts) in jsdom: a Tiptap/
-// ProseMirror editor framed as the chat box, with its mic and send
-// buttons on the bar. Covers: the editor mounts inside the framed
-// container with an accessible editable region; the placeholder
-// decorates the empty paragraph and lifts once content lands; Enter
-// emits `send` while an IME-composition Enter and Shift+Enter do not
-// (Shift+Enter inserts a hard break); the box height tracks content
-// clamped between the min/max tokens (jsdom reports scrollHeight 0, so
-// the test stubs it to drive the clamp, and pins the exported clamp
-// directly); getText returns paragraphs and breaks as single newlines;
-// clear empties; update({ editable }) toggles contenteditable; the box
-// registers a prosemirror text-control adapter through the injected registrar
-// whose canUndo/canRedo track the ProseMirror history plugin's depth;
-// setTentativeRange decorates each dictation take's tentative span, maps it
-// through later edits, and clears it, never changing the document text;
-// a transient replaceRange stays out of undo history while any other is
-// its own undo step, so each landed dictation undoes whole and alone and
-// never merges with an edit typed just before or after it; restoreRange
-// puts a captured selection's pills and paragraph breaks back outside
-// undo history, so undoing a dictation over them brings them back;
-// dispose destroys the editor. The contract: defaults, data-* state
-// mirrors (variant, editable, action, mic), the send button's three
-// states, the mic button's rendering per state, the controls slot, the
-// attachments strip, update() as a DOM no-op for unchanged props, and
-// the `send` event's mentions. The handle's persistence surface:
-// insertMention places a pill plus one trailing space at the cursor;
-// serialize/restore round-trips text, pills, and each pill's payload
-// byte-for-byte and paints attachments into the strip; restore with a
-// missing or unknown `v` leaves the box unchanged. The typeahead seams:
-// the default stub source lists its three entries when `@` is typed;
-// an injected mentionSource replaces the stub and the popup lists its
-// items; the source receives the ProseMirror plugin's AbortSignal, which
-// fires when a newer keystroke arrives; an older query resolving after a
-// newer one does not overwrite the newer results; `/` is plain text with no
-// popup (commandSource's default is stored, not wired). The static
-// renderer (src/parts/chatbox/chat-box-view.ts): renderDraft turns a
-// SerializedDraft with text, one inline pill, and one attachment into
-// the expected read-only DOM. Runs under the shared leak check: a
-// ChatBox that is never disposed fails.
-// The round action button: the mic over an empty box, the send arrow once
-// there is text, Stop over an empty box while the agent generates (with the
-// placeholder "Add a follow-up") and the send arrow over its follow-up, the
-// agent mode picking the send and Stop fill; a recording mic stays the mic;
-// Enter ignores auto-repeat and Ctrl+Enter sends. The
-// stylesheet's side - the card, the editor, the button's fills - is read from
-// the source text.
-// Run: node test/chat-box.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ChatBox, clampPromptInputHeight, stubMentionSource } from "./src/parts/chatbox/chat-box.ts";
-      export { renderDraft } from "./src/parts/chatbox/chat-box-view.ts";
-      export { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// ProseMirror reads the DOM globals at construction, so the jsdom
-// globals must exist before the bundle is imported. pretendToBeVisual
-// supplies the requestAnimationFrame ProseMirror schedules with.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.getComputedStyle = dom.window.getComputedStyle.bind(dom.window);
-// The text-control service probes these constructor globals when it
-// classifies the focused element.
-globalThis.Element = dom.window.Element;
-globalThis.HTMLElement = dom.window.HTMLElement;
-globalThis.HTMLInputElement = dom.window.HTMLInputElement;
-globalThis.HTMLTextAreaElement = dom.window.HTMLTextAreaElement;
-globalThis.Node = dom.window.Node;
-// The ProseMirror suggestion plugin's managed mount reads the DOMRect global.
-globalThis.DOMRect = dom.window.DOMRect;
-// Tiptap's focus command schedules with the bare globals.
-globalThis.requestAnimationFrame = dom.window.requestAnimationFrame.bind(dom.window);
-globalThis.cancelAnimationFrame = dom.window.cancelAnimationFrame.bind(dom.window);
-// jsdom has no layout: a focused editor's scroll-to-selection measures
-// the cursor through range geometry, so stub it to zero rects.
-const zeroRect = { x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0, toJSON: () => ({}) };
-dom.window.Range.prototype.getClientRects = () => [];
-dom.window.Range.prototype.getBoundingClientRect = () => zeroRect;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-chat-box-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  lifecycle,
-  ChatBox,
-  clampPromptInputHeight,
-  stubMentionSource,
-  renderDraft,
-  TEXT_CONTROL_SERVICE,
-  getService,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function pressEnter(target, init = {}) {
-  target.dispatchEvent(
-    new dom.window.KeyboardEvent("keydown", {
-      key: "Enter",
-      bubbles: true,
-      cancelable: true,
-      ...init,
-    }),
-  );
-}
-
-function editorElement(input) {
-  return input.element.querySelector(".ws-prompt-input__editor");
-}
-
-function frameElement(input) {
-  return input.element.querySelector(".ws-prompt-input");
-}
-
-// The one round button: the mic while the box is empty, the send arrow once it
-// has text, Stop over an empty box while the agent generates. Both names reach
-// the same element,
-// so each test reads as the state it is exercising.
-function actionButton(input) {
-  return input.element.querySelector(".ws-agent-session__action");
-}
-const micButton = actionButton;
-const sendButton = actionButton;
-
-// The ProseMirror suggestion plugin debounces its item fetch (the
-// component configures 50 to 100 ms), so a typeahead assertion waits past
-// that window plus the mount's computePosition before reading the popup.
-function settle() {
-  return new Promise((resolve) => setTimeout(resolve, 160));
-}
-
-// A mounted box whose editor the test can drive: Tiptap stamps the
-// Editor on the view DOM (dom.editor), and the suggestion session only
-// activates for a focused, connected editor.
-function mountedBox(props = {}, sink = () => {}) {
-  const input = new ChatBox(props, sink);
-  document.body.appendChild(input.element);
-  const editor = editorElement(input).editor;
-  editor.commands.focus();
-  return { input, editor };
-}
-
-// insertContent dispatches the same transaction typing would.
-async function typeText(editor, text) {
-  editor.commands.insertContent(text);
-  await settle();
-}
-
-function popup() {
-  return document.body.querySelector(".ws-typeahead-popup");
-}
-
-function popupLabels() {
-  return [...(popup()?.querySelectorAll(".ws-typeahead-popup__item") ?? [])].map(
-    (item) => item.querySelector(".ws-typeahead-popup__label")?.textContent ?? item.textContent,
-  );
-}
-
-// A source whose every call is recorded and resolves only when the test
-// says so, for the abort and stale-result assertions.
-function deferredSource() {
-  const calls = [];
-  const source = (query, signal) =>
-    new Promise((resolve) => {
-      calls.push({ query, signal, resolve });
-    });
-  source.calls = calls;
-  return source;
-}
-
-// A sink that records every event and counts the sends, standing in for
-// the onSubmit callback the box used to take.
-function recordingSink() {
-  const events = [];
-  const sink = (event) => {
-    events.push(event);
-  };
-  sink.events = events;
-  sink.sends = () => events.filter((event) => event.type === "send").length;
-  return sink;
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Mount ----------------------------------------------------------------
-
-  {
-    const input = new ChatBox();
-    const editor = editorElement(input);
-    check(
-      "the editor mounts a ProseMirror region inside the framed container on the bar",
-      input.element.classList.contains("ws-agent-session__bar") &&
-        frameElement(input) !== null &&
-        editor !== null &&
-        editor.classList.contains("ProseMirror"),
-    );
-    check(
-      "the editable region is contenteditable with an accessible name",
-      editor.getAttribute("contenteditable") === "true" &&
-        editor.getAttribute("role") === "textbox" &&
-        editor.getAttribute("aria-label") === "Message" &&
-        editor.getAttribute("aria-multiline") === "true",
-    );
-    input.dispose();
-  }
-
-  // --- Placeholder ------------------------------------------------------------
-
-  {
-    const input = new ChatBox({ placeholder: "Message the agent" });
-    const empty = editorElement(input).querySelector("p");
-    check(
-      "the empty paragraph has the placeholder decoration",
-      empty !== null &&
-        empty.classList.contains("is-editor-empty") &&
-        empty.getAttribute("data-placeholder") === "Message the agent",
-    );
-    const filled = new ChatBox({ content: "<p>hello</p>" });
-    const paragraph = editorElement(filled).querySelector("p");
-    check(
-      "content lifts the placeholder decoration",
-      paragraph !== null && !paragraph.classList.contains("is-editor-empty"),
-    );
-    input.dispose();
-    filled.dispose();
-  }
-
-  // --- Submit -----------------------------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>hello</p>" }, sink);
-    const editor = editorElement(input);
-    pressEnter(editor);
-    check("Enter emits send", sink.sends() === 1);
-    check(
-      "the send event holds the text untrimmed with empty mentions and attachments",
-      sink.events[0]?.text === "hello" &&
-        Array.isArray(sink.events[0]?.mentions) &&
-        sink.events[0].mentions.length === 0 &&
-        Array.isArray(sink.events[0]?.attachments) &&
-        sink.events[0].attachments.length === 0,
-    );
-    check(
-      "a submitting Enter leaves the text untouched",
-      input.getText() === "hello",
-    );
-    input.dispose();
-  }
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>hello</p>" }, sink);
-    const editor = editorElement(input);
-    // A full composition session: ProseMirror tracks composing state
-    // from compositionstart, so the committing Enter is inert end to end.
-    editor.dispatchEvent(new dom.window.CompositionEvent("compositionstart", { bubbles: true }));
-    pressEnter(editor, { isComposing: true });
-    check(
-      "an Enter committing an IME composition does not submit",
-      sink.sends() === 0,
-    );
-    check(
-      "an Enter committing an IME composition leaves the text untouched",
-      input.getText() === "hello",
-    );
-    editor.dispatchEvent(new dom.window.CompositionEvent("compositionend", { bubbles: true }));
-    // A bare isComposing flag, with no session ProseMirror tracked: the
-    // guard in the keydown handler is the only thing refusing the send.
-    pressEnter(editor, { isComposing: true });
-    check(
-      "an Enter flagged isComposing without a tracked session still does not submit",
-      sink.sends() === 0,
-    );
-    check(
-      "an Enter flagged isComposing is claimed, not split into a paragraph",
-      input.getText() === "hello",
-    );
-    input.dispose();
-  }
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>hello</p>" }, sink);
-    const editor = editorElement(input);
-    pressEnter(editor, { shiftKey: true });
-    check("Shift+Enter does not submit", sink.sends() === 0);
-    check(
-      "Shift+Enter inserts a hard break",
-      editor.querySelector("br:not(.ProseMirror-trailingBreak)") !== null &&
-        input.getText() === "\nhello",
-    );
-    input.dispose();
-  }
-
-  // --- Auto-resize --------------------------------------------------------------
-
-  check(
-    "the clamp passes heights inside the band through",
-    clampPromptInputHeight(150, 22, 240) === 150,
-  );
-  check(
-    "the clamp holds heights at the max token",
-    clampPromptInputHeight(500, 22, 240) === 240,
-  );
-  check(
-    "the clamp lifts heights to the min token",
-    clampPromptInputHeight(10, 22, 240) === 22,
-  );
-
-  {
-    const input = new ChatBox({ content: "<p>hello</p>" });
-    const editor = editorElement(input);
-    let measured = 150;
-    // jsdom reports scrollHeight 0; the stub stands in for layout.
-    Object.defineProperty(editor, "scrollHeight", {
-      configurable: true,
-      get: () => measured,
-    });
-    input.syncHeight();
-    check(
-      "the box height follows the content inside the band",
-      editor.style.height === "150px",
-    );
-    measured = 500;
-    input.syncHeight();
-    check(
-      "the box height clamps at the max token, 240px by default",
-      editor.style.height === "240px",
-    );
-    measured = 10;
-    input.syncHeight();
-    check(
-      "the box height clamps at the min token, one 22px line by default",
-      editor.style.height === "22px",
-    );
-    measured = 120;
-    input.clear();
-    check(
-      "an edit re-measures the box",
-      editor.style.height === "120px",
-    );
-    input.dispose();
-  }
-
-  // --- Text extraction -----------------------------------------------------------
-
-  {
-    const input = new ChatBox({ content: "<p>first</p><p>second</p>" });
-    check(
-      "getText joins paragraphs with single newlines",
-      input.getText() === "first\nsecond",
-    );
-    input.clear();
-    check("clear empties the editor", input.getText() === "");
-    input.dispose();
-  }
-
-  // --- Editable gate ---------------------------------------------------------------
-
-  {
-    const input = new ChatBox();
-    const editor = editorElement(input);
-    input.update({ editable: false });
-    check(
-      "update({ editable: false }) lifts contenteditable",
-      editor.getAttribute("contenteditable") === "false",
-    );
-    input.update({ editable: true });
-    check(
-      "update({ editable: true }) restores contenteditable",
-      editor.getAttribute("contenteditable") === "true",
-    );
-    input.dispose();
-  }
-
-  // --- The dictation target seam (SttInputTarget) ----------------------------
-
-  {
-    const input = new ChatBox();
-    input.setText("ab");
-    check("setText loads plain text", input.getText() === "ab");
-    input.setSelection(2, 2);
-    const middle = input.insertionContext();
-    check(
-      "insertionContext captures a mid-word cursor with no composition prefix",
-      middle.range.start === 2 &&
-        middle.range.end === 2 &&
-        middle.original === "" &&
-        middle.compositionPrefix === "",
-    );
-    input.replaceRange(2, 2, "X");
-    check("replaceRange splices at the cursor", input.getText() === "aXb");
-    const afterInsert = input.insertionContext().range;
-    check(
-      "replaceRange leaves the cursor after the inserted text",
-      afterInsert.start === 3 && afterInsert.end === 3,
-    );
-    input.replaceRange(1, 4, "");
-    check("replaceRange with empty text deletes the range", input.getText() === "");
-    input.setText("line one\nline two");
-    check(
-      "setText writes one paragraph per newline",
-      input.getText() === "line one\nline two" &&
-        editorElement(input).querySelectorAll("p").length === 2,
-    );
-    input.dispose();
-  }
-
-  {
-    const input = new ChatBox();
-    input.setText("First test alpha");
-    const append = input.insertionContext();
-    check(
-      "insertionContext captures a ProseMirror append separator",
-      append.range.start === append.range.end &&
-        append.range.end === 17 &&
-        append.original === "" &&
-        append.compositionPrefix === " ",
-    );
-    input.replaceRange(append.range.start, append.range.end, " ");
-    check(
-      "a captured ProseMirror composition prefix is immutable",
-      append.compositionPrefix === " ",
-    );
-    input.setText("First test alpha ");
-    check(
-      "insertionContext preserves existing ProseMirror trailing whitespace",
-      input.insertionContext().compositionPrefix === "",
-    );
-    input.setText("First test alpha");
-    input.setSelection(7, 11);
-    const replacement = input.insertionContext();
-    check(
-      "insertionContext captures selected ProseMirror text without a separator",
-      replacement.range.start === 7 &&
-        replacement.range.end === 11 &&
-        replacement.original === "test" &&
-        replacement.compositionPrefix === "",
-    );
-    input.dispose();
-  }
-
-  // --- Newlines cross the target seam ---------------------------------------------
-
-  {
-    const input = new ChatBox();
-    input.setText("a\n\nb");
-    check(
-      "setText writes an empty paragraph for an empty line",
-      input.getText() === "a\n\nb" &&
-        editorElement(input).querySelectorAll("p").length === 3,
-    );
-    input.setText("ab");
-    input.setSelection(2, 2);
-    input.replaceRange(2, 2, "x\ny");
-    check(
-      "replaceRange splices a newline as a hard break inside the paragraph",
-      input.getText() === "ax\nyb" &&
-        editorElement(input).querySelectorAll("p").length === 1,
-    );
-    // The take's splice math (TakeState.length in stt.ts) holds only while
-    // every inserted character, newline included, occupies one position.
-    const afterNewline = input.insertionContext().range;
-    check(
-      "a spliced newline occupies one position, keeping the take's length arithmetic",
-      afterNewline.start === 5 && afterNewline.end === 5,
-    );
-    input.replaceRange(2, 5, "");
-    check(
-      "deleting the spliced range restores the pre-take text",
-      input.getText() === "ab",
-    );
-    input.dispose();
-  }
-
-  // --- Dictation's tentative tail is a decoration, not text ----------------------
-
-  {
-    const input = new ChatBox();
-    input.setText("ask not what your");
-    const before = JSON.stringify(input.serialize());
-    const marks = () =>
-      [...editorElement(input).querySelectorAll(".ws-stt-tentative")].map((mark) => mark.textContent);
-    const unchanged = () =>
-      input.getText() === "ask not what your" && JSON.stringify(input.serialize()) === before;
-    // ProseMirror positions: the paragraph opens at 0, so " your" spans 13..18.
-    input.setTentativeRange(1, { from: 13, to: 18 });
-    check("a tentative range decorates exactly its span", marks().join("|") === " your");
-    check("the tentative decoration leaves the document text unchanged", unchanged());
-    input.setTentativeRange(2, { from: 1, to: 4 });
-    check("each take owns its own tentative range", marks().join("|") === "ask| your");
-    input.setTentativeRange(1, { from: 8, to: 13 });
-    check("a take's next range replaces its previous one", marks().join("|") === "ask| what");
-    input.replaceRange(1, 1, "so ");
-    check("both ranges follow an edit before them", marks().join("|") === "ask| what");
-    input.replaceRange(1, 4, "");
-    input.setTentativeRange(1, null);
-    input.setTentativeRange(2, null);
-    check("clearing every take's range removes the decoration", marks().length === 0);
-    check("clearing the decoration leaves the document text unchanged", unchanged());
-    input.setTentativeRange(1, { from: 30, to: 40 });
-    check("a range outside the document is ignored", marks().length === 0 && unchanged());
-    input.dispose();
-  }
-
-  // --- The two locks compose on one contenteditable -----------------------------
-
-  {
-    const input = new ChatBox();
-    const editor = editorElement(input);
-    const frame = frameElement(input);
-    input.setReadOnly(true);
-    check(
-      "setReadOnly locks the editor and marks the frame",
-      editor.getAttribute("contenteditable") === "false" &&
-        frame.classList.contains("ws-stt-input--recording"),
-    );
-    input.update({ editable: false });
-    input.setReadOnly(false);
-    check(
-      "lifting the take lock under a closed gate stays non-editable",
-      editor.getAttribute("contenteditable") === "false" &&
-        !frame.classList.contains("ws-stt-input--recording"),
-    );
-    input.setReadOnly(true);
-    input.update({ editable: true });
-    check(
-      "the gate reopening under a live take lock stays non-editable",
-      editor.getAttribute("contenteditable") === "false",
-    );
-    input.setReadOnly(false);
-    check(
-      "lifting the last lock reopens the editor",
-      editor.getAttribute("contenteditable") === "true",
-    );
-    input.dispose();
-  }
-
-  // --- Enter submits while read-only --------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>hello</p>" }, sink);
-    input.setReadOnly(true);
-    pressEnter(editorElement(input));
-    check(
-      "Enter emits send while the box is read-only (a live take)",
-      sink.sends() === 1,
-    );
-    check(
-      "the read-only submitting Enter leaves the text untouched",
-      input.getText() === "hello",
-    );
-    input.dispose();
-  }
-
-  // --- Placeholder dynamics --------------------------------------------------------
-
-  {
-    let label = "first";
-    const input = new ChatBox({ placeholder: () => label });
-    check(
-      "a function placeholder is evaluated for the decoration",
-      editorElement(input).querySelector("p")?.getAttribute("data-placeholder") === "first",
-    );
-    label = "second";
-    input.update({ editable: false });
-    check(
-      "the placeholder re-evaluates on the gate flip",
-      editorElement(input).querySelector("p")?.getAttribute("data-placeholder") === "second",
-    );
-    check(
-      "the placeholder still shows while non-editable",
-      editorElement(input).querySelector("p")?.classList.contains("is-editor-empty") === true,
-    );
-    input.dispose();
-  }
-
-  // --- The text-control adapter (Edit menu routing) ----------------------------
-
-  {
-    const textControls = getService(TEXT_CONTROL_SERVICE);
-    const input = new ChatBox({ textControls: textControls.register.bind(textControls) });
-    document.body.appendChild(input.element);
-    input.focus();
-    // Tiptap defers the DOM focus to the next animation frame.
-    await new Promise((resolve) => globalThis.requestAnimationFrame(resolve));
-    const active = textControls.active;
-    check(
-      "the prompt registers a prosemirror text-control adapter through the injected registrar",
-      active !== null && active.kind === "prosemirror",
-    );
-    check(
-      "a fresh prompt reports an empty undo and redo history",
-      active !== null && active.canUndo() === false && active.canRedo() === false,
-    );
-    input.setText("hello");
-    check("an edit deepens the adapter's undo history", active !== null && active.canUndo() === true);
-    textControls.undo();
-    check("routing undo through the service reverts the edit", input.getText() === "");
-    check("the reverted edit reports redo depth", active !== null && active.canRedo() === true);
-    textControls.redo();
-    check("routing redo through the service replays the edit", input.getText() === "hello");
-    input.dispose();
-    check("disposing the prompt unregisters its adapter", textControls.active === null);
-    input.element.remove();
-  }
-
-  // --- Each landed dictation is one undo step --------------------------------------
-
-  {
-    const textControls = getService(TEXT_CONTROL_SERVICE);
-    const input = new ChatBox({ textControls: textControls.register.bind(textControls) });
-    document.body.appendChild(input.element);
-    input.focus();
-    await new Promise((resolve) => globalThis.requestAnimationFrame(resolve));
-    const active = textControls.active;
-    input.replaceRange(1, 1, "draft", { transient: true });
-    check(
-      "a transient replace lands its text but leaves undo history empty",
-      input.getText() === "draft" && active !== null && active.canUndo() === false,
-    );
-    input.replaceRange(1, 6, "", { transient: true });
-    input.setText("Note");
-    // Two dictations back to back, as the take registry writes them:
-    // transient interims, a transient restore of the original, then one
-    // tracked write of the landed text.
-    input.replaceRange(5, 5, " ask", { transient: true });
-    input.replaceRange(5, 9, " ask not", { transient: true });
-    input.replaceRange(5, 13, "", { transient: true });
-    input.replaceRange(5, 5, " ask not what");
-    input.replaceRange(18, 18, " more", { transient: true });
-    input.replaceRange(18, 23, "", { transient: true });
-    input.replaceRange(18, 18, " and more");
-    check("both dictations land", input.getText() === "Note ask not what and more");
-    textControls.undo();
-    check("one undo removes only the latest dictation", input.getText() === "Note ask not what");
-    textControls.undo();
-    check(
-      "the next undo removes the earlier dictation whole, not its interim writes",
-      input.getText() === "Note",
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  {
-    const { input, editor } = mountedBox();
-    input.setText("Note");
-    editor.commands.insertContent(" typed");
-    input.replaceRange(11, 11, " spoken");
-    editor.commands.undo();
-    check(
-      "an edit typed just before a landed replace stays when the replace is undone",
-      input.getText() === "Note typed",
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  {
-    const { input, editor } = mountedBox();
-    input.setText("Note");
-    input.replaceRange(5, 5, " spoken");
-    editor.commands.insertContent(" typed");
-    editor.commands.undo();
-    check(
-      "an edit typed just after a landed replace undoes alone",
-      input.getText() === "Note spoken",
-    );
-    editor.commands.undo();
-    check("the landed replace then undoes alone", input.getText() === "Note");
-    input.dispose();
-    input.element.remove();
-  }
-
-  // --- A dictation over pills and paragraphs undoes back to them -------------------
-
-  {
-    const { input, editor } = mountedBox({
-      content:
-        '<p>see <span data-type="mentionNode" data-id="src/main.ts" data-label="main.ts"></span> now</p><p>then</p>',
-    });
-    const before = JSON.stringify(input.serialize().doc);
-    // ProseMirror positions: the pill sits at 5, the second paragraph's "then" spans 12..16.
-    input.setSelection(5, 14);
-    const context = input.insertionContext();
-    // The take registry's writes: a whole first interim, a patch, the
-    // restore of the captured selection, then the one tracked final.
-    input.replaceRange(5, 14, "spoken", { transient: true });
-    input.replaceRange(11, 11, " words", { transient: true });
-    input.restoreRange(5, 17, context.content);
-    check(
-      "a restore puts the captured pill and paragraph break back outside undo history",
-      JSON.stringify(input.serialize().doc) === before &&
-        editor.can().undo() === false &&
-        editor.state.selection.from === 14,
-    );
-    input.replaceRange(5, 14, "spoken words");
-    check("the final replaces the restored selection", input.getText() === "see spoken wordsen");
-    editor.commands.undo();
-    check(
-      "one undo brings back the pill and the paragraph break the dictation replaced",
-      JSON.stringify(input.serialize().doc) === before,
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  {
-    const textControls = getService(TEXT_CONTROL_SERVICE);
-    const input = new ChatBox();
-    document.body.appendChild(input.element);
-    input.focus();
-    await new Promise((resolve) => globalThis.requestAnimationFrame(resolve));
-    check(
-      "a box built without a registrar makes no service-registry registration",
-      textControls.active === null,
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  // --- Dispose -----------------------------------------------------------------------
-
-  {
-    const input = new ChatBox({ content: "<p>hello</p>" });
-    document.body.appendChild(input.element);
-    check(
-      "a live editor renders its paragraph",
-      editorElement(input)?.querySelector("p") !== null,
-    );
-    input.dispose();
-    check(
-      "dispose destroys the editor, removing its DOM from the container",
-      editorElement(input) === null,
-    );
-    input.element.remove();
-  }
-
-  // --- The contract: defaults and data-* state mirrors ---------------------------
-
-  {
-    const input = new ChatBox();
-    const frame = frameElement(input);
-    const mic = micButton(input);
-    const send = sendButton(input);
-    check(
-      "props read back the defaults",
-      input.props.editable === true &&
-        input.props.action === "send" &&
-        input.props.mic === "idle" &&
-        input.props.mode === "agent" &&
-        input.props.variant === "expanded",
-    );
-    check(
-      "the root has data-variant=expanded with the prop absent",
-      input.element.getAttribute("data-variant") === "expanded",
-    );
-    check(
-      "the frame mirrors the default editable state",
-      frame.getAttribute("data-editable") === "true" &&
-        editorElement(input).getAttribute("contenteditable") === "true",
-    );
-    check(
-      "the editable region has the default accessible name",
-      editorElement(input).getAttribute("aria-label") === "Message",
-    );
-    check(
-      "the default placeholder is empty",
-      editorElement(input).querySelector("p")?.getAttribute("data-placeholder") === "",
-    );
-    check(
-      "an empty box's one round button is the mic, enabled, with its accessible name, tooltip, and icon",
-      mic !== null &&
-        mic.getAttribute("data-state") === "mic" &&
-        mic.getAttribute("data-action") === "send" &&
-        mic.getAttribute("data-mic") === "idle" &&
-        mic.getAttribute("data-mode") === "agent" &&
-        mic.type === "button" &&
-        mic.disabled === false &&
-        mic.getAttribute("aria-label") === "Push to talk" &&
-        mic.getAttribute("aria-pressed") === "false" &&
-        mic.title === "Voice Input (Ctrl+Shift+Space)" &&
-        mic.querySelector("svg") !== null,
-    );
-    check("the box has one action button and no separate mic", input.element.querySelectorAll("button").length === 1);
-    input.setText("hello");
-    check(
-      "text turns the button into the send arrow: enabled, not aria-disabled, named Send",
-      send.getAttribute("data-state") === "send" &&
-        send.disabled === false &&
-        send.getAttribute("aria-disabled") === "false" &&
-        send.getAttribute("aria-label") === "Send" &&
-        send.title === "Send" &&
-        !send.hasAttribute("aria-pressed") &&
-        send.querySelector("svg") !== null,
-    );
-    input.clear();
-    check("emptying the box brings the mic back", send.getAttribute("data-state") === "mic");
-    const strip = frame.querySelector(".ws-prompt-input__attachments");
-    check(
-      "an empty attachments strip sits inside the frame before the editor",
-      strip !== null &&
-        strip.childElementCount === 0 &&
-        strip.parentElement === frame &&
-        strip.nextElementSibling === editorElement(input),
-    );
-    check(
-      "without controls the action button sits on the bar after the frame",
-      mic.parentElement === input.element && frame.nextElementSibling === mic,
-    );
-    input.dispose();
-  }
-
-  {
-    const input = new ChatBox({ variant: "expanded", ariaLabel: "Ask" });
-    check(
-      "an explicit variant and aria label render",
-      input.element.getAttribute("data-variant") === "expanded" &&
-        editorElement(input).getAttribute("aria-label") === "Ask",
-    );
-    input.dispose();
-  }
-
-  // --- data-editable is the effective state of both locks ------------------------
-
-  {
-    const input = new ChatBox();
-    const frame = frameElement(input);
-    const states = [frame.getAttribute("data-editable")];
-    input.setReadOnly(true);
-    states.push(frame.getAttribute("data-editable"));
-    input.setReadOnly(false);
-    states.push(frame.getAttribute("data-editable"));
-    check(
-      "data-editable reads true, false, true across a take lock",
-      states.join(",") === "true,false,true",
-    );
-    input.update({ editable: false });
-    check(
-      "data-editable reads false under a closed gate",
-      frame.getAttribute("data-editable") === "false" && input.props.editable === false,
-    );
-    input.setReadOnly(true);
-    input.update({ editable: true });
-    check(
-      "data-editable stays false while a take lock outlives the gate",
-      frame.getAttribute("data-editable") === "false" && input.props.editable === true,
-    );
-    input.dispose();
-  }
-
-  // --- The send button's states follow update() ---------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>draft</p>" }, sink);
-    const send = sendButton(input);
-    const editor = editorElement(input);
-    send.click();
-    check("a click on the send button emits send", sink.sends() === 1);
-
-    input.update({ action: "send-blocked" });
-    check(
-      "send-blocked renders aria-disabled but stays clickable",
-      send.getAttribute("data-action") === "send-blocked" &&
-        send.disabled === false &&
-        send.getAttribute("aria-disabled") === "true" &&
-        input.props.action === "send-blocked",
-    );
-    send.click();
-    check("a click while send-blocked still emits send", sink.sends() === 2);
-    pressEnter(editor);
-    check("Enter while send-blocked still emits send", sink.sends() === 3);
-
-    input.update({ action: "idle" });
-    check(
-      "idle disables the send button",
-      send.getAttribute("data-action") === "idle" &&
-        send.disabled === true &&
-        send.getAttribute("aria-disabled") === "false",
-    );
-    send.click();
-    pressEnter(editor);
-    check("idle is silent: neither a click nor Enter emits", sink.sends() === 3);
-
-    input.update({ action: "send" });
-    check(
-      "returning to send re-enables the button",
-      send.getAttribute("data-action") === "send" && send.disabled === false,
-    );
-    pressEnter(editor);
-    check("Enter after returning to send emits again", sink.sends() === 4);
-    input.dispose();
-  }
-
-  // --- Stop: the agent is generating --------------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ placeholder: "Plan, Build" }, sink);
-    const button = actionButton(input);
-    const editor = editorElement(input);
-    check(
-      "before generating the placeholder is the owner's",
-      editor.querySelector("p")?.getAttribute("data-placeholder") === "Plan, Build",
-    );
-    input.update({ action: "stop" });
-    check(
-      "stop turns the button into Stop, even with an empty box",
-      button.getAttribute("data-state") === "stop" &&
-        button.getAttribute("data-action") === "stop" &&
-        button.disabled === false &&
-        button.getAttribute("aria-label") === "Stop" &&
-        button.title === "Stop (Ctrl+Shift+Backspace)" &&
-        !button.hasAttribute("aria-pressed") &&
-        button.querySelector("svg") !== null,
-    );
-    check(
-      "while generating the placeholder reads Add a follow-up",
-      editor.querySelector("p")?.getAttribute("data-placeholder") === "Add a follow-up",
-    );
-    button.click();
-    check(
-      "a click on Stop emits stop, not send or mic-press",
-      sink.events.length === 1 && sink.events[0].type === "stop",
-    );
-    pressEnter(editor);
-    check(
-      "Enter over an empty box while generating emits nothing: Stop is the button's alone",
-      sink.events.length === 1,
-    );
-    input.setText("typed");
-    check(
-      "text in the box turns Stop into the send arrow while generating",
-      button.getAttribute("data-state") === "send" &&
-        button.getAttribute("data-action") === "stop" &&
-        button.disabled === false &&
-        button.getAttribute("aria-label") === "Send",
-    );
-    check(
-      "the follow-up placeholder stays while the box holds text",
-      input.props.action === "stop",
-    );
-    button.click();
-    check(
-      "a click on the send arrow while generating emits the follow-up as send",
-      sink.events.length === 2 && sink.events[1].type === "send" && sink.events[1].text === "typed",
-    );
-    pressEnter(editor);
-    check(
-      "Enter with text while generating emits send too",
-      sink.events.length === 3 && sink.events[2].type === "send",
-    );
-    input.clear();
-    check("an emptied box is Stop again", button.getAttribute("data-state") === "stop");
-    input.update({ action: "send" });
-    check(
-      "the turn ending brings the mic back over an empty box, with the owner's placeholder",
-      button.getAttribute("data-state") === "mic" &&
-        editor.querySelector("p")?.getAttribute("data-placeholder") === "Plan, Build",
-    );
-    input.dispose();
-  }
-
-  // --- The mode picks the fill ----------------------------------------------------------
-
-  {
-    const input = new ChatBox({ mode: "plan" });
-    const button = actionButton(input);
-    check("the mode prop mirrors onto the button", button.getAttribute("data-mode") === "plan" && input.props.mode === "plan");
-    for (const mode of ["ask", "debug", "multitask", "agent"]) {
-      input.update({ mode });
-      check(`the mode ${mode} mirrors onto the button`, button.getAttribute("data-mode") === mode);
-    }
-    input.dispose();
-  }
-
-  // --- Held and Ctrl Enter ---------------------------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>hello</p>" }, sink);
-    const editor = editorElement(input);
-    pressEnter(editor, { repeat: true });
-    check("an auto-repeating Enter does not send", sink.sends() === 0);
-    check("an auto-repeating Enter does not split the paragraph either", input.getText() === "hello");
-    pressEnter(editor);
-    check("the first Enter of a hold sends", sink.sends() === 1);
-    pressEnter(editor, { ctrlKey: true });
-    check("Ctrl+Enter sends", sink.sends() === 2);
-    pressEnter(editor, { metaKey: true });
-    check("Cmd+Enter sends", sink.sends() === 3);
-    input.dispose();
-  }
-
-  {
-    // The non-editable path (a dictation take holds the box) follows the same rule.
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>take</p>" }, sink);
-    document.body.appendChild(input.element);
-    input.setReadOnly(true);
-    const frame = frameElement(input);
-    frame.dispatchEvent(
-      new dom.window.KeyboardEvent("keydown", { key: "Enter", repeat: true, bubbles: true, cancelable: true }),
-    );
-    check("a held Enter over a read-only box sends nothing", sink.sends() === 0);
-    frame.dispatchEvent(new dom.window.KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true }));
-    check("the first Enter over a read-only box still sends", sink.sends() === 1);
-    input.setReadOnly(false);
-    input.dispose();
-    input.element.remove();
-  }
-
-  // --- The button's state follows the box and the mic ----------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({}, sink);
-    const mic = micButton(input);
-    mic.click();
-    check(
-      "a click on the mic emits mic-press",
-      sink.events.length === 1 && sink.events[0].type === "mic-press",
-    );
-    input.update({ mic: "recording" });
-    check(
-      "recording presses the mic, paints the recording class, and swaps the title",
-      mic.getAttribute("data-mic") === "recording" &&
-        mic.getAttribute("aria-pressed") === "true" &&
-        mic.classList.contains("ws-stt-mic--recording") &&
-        mic.title === "Stop recording" &&
-        input.props.mic === "recording",
-    );
-    mic.click();
-    check("a click while recording still emits mic-press", sink.events.length === 2);
-    // Dictated words land in the box while the take records; the button must
-    // stay the mic so a second press can end the take.
-    input.setText("dictated words");
-    check(
-      "a recording mic stays the mic whatever the box holds",
-      mic.getAttribute("data-state") === "mic" && mic.classList.contains("ws-stt-mic--recording"),
-    );
-    mic.click();
-    check("a press on a recording mic over a filled box still emits mic-press", sink.events.length === 3);
-    input.update({ mic: "blocked" });
-    check(
-      "blocked ends the recording look, and with text in the box the button is the send arrow",
-      mic.getAttribute("data-mic") === "blocked" &&
-        !mic.classList.contains("ws-stt-mic--recording") &&
-        mic.getAttribute("data-state") === "send" &&
-        !mic.hasAttribute("aria-pressed") &&
-        mic.disabled === false,
-    );
-    input.clear();
-    check(
-      "a blocked mic over an empty box reads as an idle one",
-      mic.getAttribute("data-state") === "mic" &&
-        mic.getAttribute("aria-pressed") === "false" &&
-        mic.title === "Voice Input (Ctrl+Shift+Space)" &&
-        mic.disabled === false,
-    );
-    mic.click();
-    check("a click while blocked still emits mic-press so the owning part can name the blocker", sink.events.length === 4);
-    input.update({ mic: "idle" });
-    check(
-      "idle restores the default rendering",
-      mic.getAttribute("data-mic") === "idle" &&
-        mic.getAttribute("aria-pressed") === "false" &&
-        mic.title === "Voice Input (Ctrl+Shift+Space)",
-    );
-    input.update({ action: "idle" });
-    check("an idle agent leaves the mic enabled over an empty box", mic.disabled === false && mic.getAttribute("data-state") === "mic");
-    input.setText("x");
-    check("an idle agent dims the send arrow once there is text", mic.getAttribute("data-state") === "send" && mic.disabled === true);
-    input.dispose();
-  }
-
-  // --- Typing, restoring, and clearing move the button too ---------------------------------
-
-  {
-    const input = new ChatBox();
-    const button = actionButton(input);
-    const editor = editorElement(input).editor;
-    editor.commands.insertContent("typed");
-    check("typing turns the mic into the send arrow", button.getAttribute("data-state") === "send");
-    editor.commands.clearContent();
-    check("deleting everything brings the mic back", button.getAttribute("data-state") === "mic");
-    input.insertMention({ id: "a.ts", label: "a.ts", data: null });
-    check("a lone mention pill counts as content", button.getAttribute("data-state") === "send");
-    input.restore({ v: 1, doc: { type: "doc", content: [{ type: "paragraph" }] }, attachments: [] });
-    check("restoring an empty draft brings the mic back", button.getAttribute("data-state") === "mic");
-    input.dispose();
-  }
-
-  // --- The controls slot ------------------------------------------------------------
-
-  {
-    const controls = document.createElement("div");
-    controls.className = "owner-toolbar";
-    const existing = document.createElement("span");
-    controls.appendChild(existing);
-    const input = new ChatBox({ controls });
-    const frame = frameElement(input);
-    const button = actionButton(input);
-    check(
-      "the controls element sits on the bar after the frame",
-      controls.parentElement === input.element && frame.nextElementSibling === controls,
-    );
-    check(
-      "with controls the action button is the last child, after the owning part's own",
-      controls.children.length === 2 &&
-        controls.children[0] === existing &&
-        controls.children[1] === button &&
-        input.element.querySelector(":scope > .ws-agent-session__action") === null,
-    );
-    input.dispose();
-    check(
-      "dispose removes the box's button from the controls element and leaves the owning part's",
-      controls.children.length === 1 && controls.children[0] === existing,
-    );
-  }
-
-  // --- update() with unchanged props touches no DOM ----------------------------------
-
-  {
-    const input = new ChatBox({ mic: "recording", action: "send-blocked", editable: false });
-    document.body.appendChild(input.element);
-    const observer = new dom.window.MutationObserver(() => {});
-    observer.observe(input.element, {
-      attributes: true,
-      childList: true,
-      characterData: true,
-      subtree: true,
-    });
-    input.update({ mic: "recording", action: "send-blocked", editable: false });
-    input.update({});
-    check(
-      "an update with unchanged values mutates nothing",
-      observer.takeRecords().length === 0,
-    );
-    input.update({ mic: "idle" });
-    const changed = observer.takeRecords();
-    check(
-      "an update with one changed value mutates only the mic button",
-      changed.length > 0 && changed.every((record) => record.target === micButton(input)),
-    );
-    observer.disconnect();
-    input.dispose();
-    input.element.remove();
-  }
-
-  // --- send includes the pills present -----------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox(
-      {
-        content:
-          '<p>see <span data-type="mentionNode" data-id="src/main.ts" data-label="main.ts" data-kind="file" data-payload=\'{"path":"src/main.ts"}\'></span> and <span data-type="mentionNode" data-id="README.md" data-label="README.md"></span></p>',
-      },
-      sink,
-    );
-    sendButton(input).click();
-    const event = sink.events[0];
-    check(
-      "send lists one ChipRef per pill in document order with the stored subset",
-      event?.type === "send" &&
-        event.mentions.length === 2 &&
-        event.mentions[0].id === "src/main.ts" &&
-        event.mentions[0].label === "main.ts" &&
-        event.mentions[0].kind === "file" &&
-        JSON.stringify(event.mentions[0].data) === '{"path":"src/main.ts"}' &&
-        event.mentions[0].description === undefined &&
-        event.mentions[0].group === undefined &&
-        event.mentions[1].id === "README.md" &&
-        event.mentions[1].kind === undefined &&
-        event.mentions[1].data === null,
-    );
-    check(
-      "send's attachments are empty while the strip is empty",
-      event?.attachments.length === 0,
-    );
-    check(
-      "send's text renders each pill through the editor's text serializer",
-      typeof event?.text === "string" && event.text.startsWith("see "),
-    );
-    input.dispose();
-  }
-
-  // --- insertMention places a pill at the cursor ----------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({ content: "<p>see</p>" }, sink);
-    // ProseMirror positions: paragraph opens at 0, "see" spans 1..4.
-    input.setSelection(4, 4);
-    const chip = { id: "src/main.ts", label: "main.ts", kind: "file", data: { path: "src/main.ts" } };
-    input.insertMention(chip);
-    const pill = editorElement(input).querySelector(".ws-mention-chip");
-    check(
-      "insertMention renders one pill through the NodeView at the cursor",
-      pill !== null &&
-        pill.getAttribute("data-id") === "src/main.ts" &&
-        pill.getAttribute("data-kind") === "file" &&
-        pill.querySelector(".ws-mention-chip__label")?.textContent === "main.ts",
-    );
-    const inline = input.serialize().doc.content?.[0]?.content ?? [];
-    check(
-      "the pill follows the text and is followed by exactly one space",
-      inline.length === 3 &&
-        inline[0]?.type === "text" &&
-        inline[0].text === "see" &&
-        inline[1]?.type === "mentionNode" &&
-        inline[2]?.type === "text" &&
-        inline[2].text === " ",
-    );
-    const after = input.insertionContext().range;
-    check(
-      "the cursor lands after the trailing space (text + node + space)",
-      after.start === 6 && after.end === 6,
-    );
-    sendButton(input).click();
-    const event = sink.events[0];
-    check(
-      "a send after insertMention lists the inserted chip with its payload intact",
-      event?.type === "send" &&
-        event.mentions.length === 1 &&
-        event.mentions[0].id === "src/main.ts" &&
-        event.mentions[0].kind === "file" &&
-        JSON.stringify(event.mentions[0].data) === JSON.stringify(chip.data),
-    );
-    input.setSelection(1, 1);
-    input.insertMention({ id: "README.md", label: "README.md", data: null });
-    const front = input.serialize().doc.content?.[0]?.content ?? [];
-    check(
-      "insertMention at the paragraph start places the pill before the text",
-      front[0]?.type === "mentionNode" &&
-        front[0].attrs?.id === "README.md" &&
-        front[1]?.type === "text" &&
-        front[1].text === " see",
-    );
-    input.dispose();
-  }
-
-  // --- serialize / restore round-trip -------------------------------------------------
-
-  {
-    const source = new ChatBox({
-      content:
-        '<p>look at <span data-type="mentionNode" data-id="src/main.ts" data-label="main.ts" data-kind="file" data-payload=\'{"path":"src/main.ts","nested":[1,{"k":"v"}]}\'></span> first</p><p>then</p>',
-    });
-    const draft = source.serialize();
-    check(
-      "serialize returns v: 1, the ProseMirror JSON document, and empty attachments",
-      draft.v === 1 &&
-        draft.doc.type === "doc" &&
-        Array.isArray(draft.attachments) &&
-        draft.attachments.length === 0,
-    );
-    const attachment = { id: "img-1", label: "shot.png", kind: "image", data: { fileId: 7 } };
-    const withStrip = { ...draft, attachments: [attachment] };
-
-    const sink = recordingSink();
-    const target = new ChatBox({}, sink);
-    const frame = frameElement(target);
-    target.restore(withStrip);
-    check("restore reproduces the text", target.getText() === source.getText());
-    const restored = target.serialize();
-    check(
-      "serialize after restore reproduces the document byte-for-byte",
-      JSON.stringify(restored.doc) === JSON.stringify(draft.doc),
-    );
-    const pillNode = restored.doc.content?.[0]?.content?.find((node) => node.type === "mentionNode");
-    check(
-      "the pill's opaque payload survives the round-trip byte-for-byte",
-      pillNode !== undefined &&
-        JSON.stringify(pillNode.attrs?.data) === '{"path":"src/main.ts","nested":[1,{"k":"v"}]}',
-    );
-    check(
-      "restore paints the pill in the editor",
-      editorElement(target).querySelector(".ws-mention-chip[data-id='src/main.ts']") !== null,
-    );
-    const strip = frame.querySelector(".ws-prompt-input__attachments");
-    check(
-      "restore paints one chip per attachment into the strip",
-      strip.childElementCount === 1 &&
-        strip.firstElementChild?.classList.contains("ws-mention-chip") === true &&
-        strip.firstElementChild?.getAttribute("data-kind") === "image" &&
-        strip.querySelector(".ws-mention-chip__label")?.textContent === "shot.png",
-    );
-    check(
-      "the restored strip pill omits the remove button",
-      strip.querySelector(".ws-mention-chip__remove") === null,
-    );
-    check(
-      "serialize after restore returns the attachments as a copy",
-      JSON.stringify(restored.attachments) === JSON.stringify([attachment]) &&
-        restored.attachments !== withStrip.attachments,
-    );
-    sendButton(target).click();
-    check(
-      "send after restore includes the restored pill and attachments",
-      sink.events[0]?.type === "send" &&
-        sink.events[0].mentions.length === 1 &&
-        sink.events[0].mentions[0].id === "src/main.ts" &&
-        JSON.stringify(sink.events[0].attachments) === JSON.stringify([attachment]),
-    );
-    target.restore({ v: 1, doc: { type: "doc", content: [] }, attachments: [] });
-    check(
-      "restoring an empty draft clears the text and the strip",
-      target.getText() === "" && strip.childElementCount === 0,
-    );
-    source.dispose();
-    target.dispose();
-  }
-
-  // --- restore rejects an unknown or missing version -----------------------------------
-
-  {
-    const input = new ChatBox({ content: "<p>keep me</p>" });
-    const strip = frameElement(input).querySelector(".ws-prompt-input__attachments");
-    const before = JSON.stringify(input.serialize());
-    const foreign = { type: "doc", content: [{ type: "paragraph", content: [{ type: "text", text: "replaced" }] }] };
-    const attachment = { id: "img-1", label: "shot.png", kind: "image", data: null };
-    input.restore({ v: 2, doc: foreign, attachments: [attachment] });
-    check(
-      "restore with an unknown version leaves the text, the strip, and the serialized form unchanged",
-      input.getText() === "keep me" &&
-        strip.childElementCount === 0 &&
-        JSON.stringify(input.serialize()) === before,
-    );
-    input.restore({ doc: foreign, attachments: [attachment] });
-    check(
-      "restore with a missing version leaves the box unchanged",
-      input.getText() === "keep me" &&
-        strip.childElementCount === 0 &&
-        JSON.stringify(input.serialize()) === before,
-    );
-    input.restore({ v: "1", doc: foreign, attachments: [attachment] });
-    check(
-      "restore with a string version is not coerced to 1",
-      input.getText() === "keep me" && strip.childElementCount === 0,
-    );
-    input.dispose();
-  }
-
-  // --- The mention source seam -----------------------------------------------------------
-
-  {
-    const all = await stubMentionSource("", new AbortController().signal);
-    check(
-      "the default stub source lists its three canned entries as chips",
-      all.length === 3 &&
-        all[0].label === "README.md" &&
-        all[1].label === "src/main.ts" &&
-        all[2].label === "Cargo.toml" &&
-        all.every((chip) => chip.id === chip.label && chip.kind === "file" && chip.data === null),
-    );
-    const narrowed = await stubMentionSource("RE", new AbortController().signal);
-    check(
-      "the stub source filters by case-insensitive substring on the label",
-      narrowed.length === 1 &&
-        narrowed[0].label === "README.md" &&
-        (await stubMentionSource("re", new AbortController().signal)).length === 1 &&
-        (await stubMentionSource("zzz", new AbortController().signal)).length === 0,
-    );
-  }
-
-  {
-    const { input, editor } = mountedBox();
-    await typeText(editor, "@");
-    check(
-      "with no mentionSource, typing @ lists the stub entries",
-      popupLabels().join(",") === "README.md,src/main.ts,Cargo.toml",
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  {
-    const seen = [];
-    const mentionSource = async (query, signal) => {
-      seen.push({ query, aborted: signal instanceof AbortSignal ? signal.aborted : null });
-      return [
-        { id: "docs/alpha.md", label: "alpha.md", kind: "file", description: "docs", data: { p: 1 } },
-        { id: "docs/beta.md", label: "beta.md", kind: "file", description: "docs", data: { p: 2 } },
-      ].filter((chip) => chip.label.includes(query));
-    };
-    const { input, editor } = mountedBox({ mentionSource });
-    await typeText(editor, "@");
-    check(
-      "an injected mentionSource replaces the stub and the popup lists its items",
-      popupLabels().join(",") === "alpha.md,beta.md" && popup()?.hidden === false,
-    );
-    check(
-      "the source is called with the query and a live AbortSignal",
-      seen.length >= 1 && seen[0].query === "" && seen[0].aborted === false,
-    );
-    await typeText(editor, "bet");
-    check(
-      "a narrowed query reaches the source and filters the popup",
-      seen.at(-1)?.query === "bet" && popupLabels().join(",") === "beta.md",
-    );
-    input.dispose();
-    input.element.remove();
-    check("disposing the box mid-session removes the popup", popup() === null);
-  }
-
-  {
-    const mentionSource = deferredSource();
-    const { input, editor } = mountedBox({ mentionSource });
-    await typeText(editor, "@");
-    check(
-      "the pending source has been asked for the empty query",
-      mentionSource.calls.length === 1 && mentionSource.calls[0].query === "",
-    );
-    await typeText(editor, "x");
-    check(
-      "a newer keystroke fires the older query's AbortSignal",
-      mentionSource.calls[0].signal.aborted === true &&
-        mentionSource.calls.length === 2 &&
-        mentionSource.calls[1].query === "x" &&
-        mentionSource.calls[1].signal.aborted === false,
-    );
-    mentionSource.calls[1].resolve([{ id: "x1", label: "xylophone.ts", data: null }]);
-    await settle();
-    check(
-      "the newer query's results fill the popup",
-      popupLabels().join(",") === "xylophone.ts",
-    );
-    mentionSource.calls[0].resolve([{ id: "old", label: "stale.ts", data: null }]);
-    await settle();
-    check(
-      "an older query resolving after a newer one does not overwrite the newer results",
-      popupLabels().join(",") === "xylophone.ts",
-    );
-    input.dispose();
-    input.element.remove();
-  }
-
-  {
-    const { input, editor } = mountedBox();
-    await typeText(editor, "/");
-    check(
-      "a typed / is plain text with no popup while commandSource is the default",
-      popup() === null && input.getText() === "/",
-    );
-    await typeText(editor, "help");
-    check("text after / stays text", popup() === null && input.getText() === "/help");
-    input.dispose();
-    input.element.remove();
-  }
-
-  // --- The static renderer (chat-box-view.ts) ----------------------------------------
-
-  {
-    const attachment = { id: "img-1", label: "shot.png", kind: "image", data: { fileId: 7 } };
-    const pill = { id: "src/main.ts", label: "main.ts", kind: "file", data: { path: "src/main.ts" } };
-    const draft = {
-      v: 1,
-      doc: {
-        type: "doc",
-        content: [
-          {
-            type: "paragraph",
-            content: [
-              { type: "text", text: "look at " },
-              { type: "mentionNode", attrs: { ...pill, mentionSuggestionChar: "@" } },
-              { type: "text", text: " first" },
-              { type: "hardBreak" },
-              { type: "text", text: "then" },
-            ],
-          },
-          { type: "paragraph" },
-          { type: "paragraph", content: [{ type: "text", text: "done" }] },
-        ],
-      },
-      attachments: [attachment],
-    };
-    const fragment = renderDraft(draft);
-    const root = fragment.firstElementChild;
-    check(
-      "renderDraft returns a fragment holding one ws-draft-view root",
-      fragment.childElementCount === 1 && root?.classList.contains("ws-draft-view") === true,
-    );
-    const strip = root?.firstElementChild;
-    check(
-      "the attachments strip comes first and holds one pill per attachment",
-      strip?.classList.contains("ws-draft-view__strip") === true &&
-        strip.querySelectorAll(".ws-mention-chip").length === 1 &&
-        strip.querySelector(".ws-mention-chip")?.getAttribute("data-kind") === "image" &&
-        strip.querySelector(".ws-mention-chip__label")?.textContent === "shot.png",
-    );
-    const paragraphs = [...(root?.querySelectorAll(".ws-draft-view__paragraph") ?? [])];
-    check(
-      "one paragraph element per paragraph node, in order, after the strip",
-      paragraphs.length === 3 &&
-        paragraphs[0] === strip?.nextElementSibling &&
-        paragraphs[2] === root?.lastElementChild,
-    );
-    const first = paragraphs[0];
-    check(
-      "text, the inline pill, and the hard break land in document order",
-      first !== undefined &&
-        first.childNodes[0]?.nodeType === dom.window.Node.TEXT_NODE &&
-        first.childNodes[0]?.textContent === "look at " &&
-        first.childNodes[1]?.classList?.contains("ws-mention-chip") === true &&
-        first.childNodes[1]?.getAttribute("data-kind") === "file" &&
-        first.childNodes[1]?.querySelector(".ws-mention-chip__label")?.textContent === "main.ts" &&
-        first.childNodes[2]?.textContent === " first" &&
-        first.childNodes[3]?.tagName === "BR" &&
-        first.childNodes[4]?.textContent === "then",
-    );
-    check(
-      "an empty paragraph renders as an empty paragraph element",
-      paragraphs[1]?.childNodes.length === 0 && paragraphs[2]?.textContent === "done",
-    );
-    check(
-      "the read-only rendering omits the remove buttons and the editor",
-      root?.querySelector(".ws-mention-chip__remove") === null &&
-        root?.querySelector(".ProseMirror") === null &&
-        root?.querySelector('[contenteditable="true"]') === null,
-    );
-    const empty = renderDraft({ v: 1, doc: { type: "doc", content: [] }, attachments: [] });
-    check(
-      "an empty draft renders a root with an empty strip and no paragraphs",
-      empty.firstElementChild?.querySelector(".ws-draft-view__strip")?.childElementCount === 0 &&
-        empty.firstElementChild?.querySelectorAll(".ws-draft-view__paragraph").length === 0,
-    );
-  }
-
-  // --- The error popup -----------------------------------------------------------------------
-
-  {
-    const sink = recordingSink();
-    const input = new ChatBox({}, sink);
-    const popup = () => input.element.querySelector(".ws-chat-error");
-    const retry = () => popup()?.querySelector(".ws-chat-error__retry");
-    check("a box with no error has no popup", popup() === null && input.props.error === null);
-
-    input.update({ error: { message: "The socket closed." } });
-    check(
-      "an error opens the popup on the card, an alert",
-      popup() !== null && popup().parentElement === input.element && popup().getAttribute("role") === "alert",
-    );
-    check(
-      "the title defaults to Connection Error and the message sits below it",
-      popup().querySelector(".ws-chat-error__title")?.textContent === "Connection Error" &&
-        popup().querySelector(".ws-chat-error__message")?.textContent === "The socket closed.",
-    );
-    check(
-      "the popup carries the warning glyph",
-      popup().querySelector(".ws-chat-error__icon svg") !== null,
-    );
-    check("without tryAgain there is no Try again button shown", retry()?.hidden === true);
-
-    input.update({ error: { title: "Connection failed", message: "Check your network.", tryAgain: "disabled" } });
-    check(
-      "a given title replaces the default, and the popup is reused in place",
-      popup().querySelector(".ws-chat-error__title")?.textContent === "Connection failed" &&
-        input.element.querySelectorAll(".ws-chat-error").length === 1,
-    );
-    check(
-      "Try again shows disabled until the owner enables it",
-      retry()?.hidden === false && retry().disabled === true && retry().textContent === "Try again",
-    );
-    retry().click();
-    check("a disabled Try again reports nothing", sink.events.every((event) => event.type !== "retry"));
-
-    input.update({ error: { title: "Connection failed", message: "Check your network.", tryAgain: "enabled" } });
-    check("the owner enables Try again", retry().disabled === false);
-    retry().click();
-    check(
-      "pressing Try again emits retry",
-      sink.events.filter((event) => event.type === "retry").length === 1,
-    );
-    check(
-      "Try again is the secondary small button",
-      retry().classList.contains("button-secondary") && retry().classList.contains("button-sm"),
-    );
-
-    const same = popup();
-    input.update({ error: { title: "Connection failed", message: "Check your network.", tryAgain: "enabled" } });
-    check("an unchanged error touches nothing", popup() === same);
-
-    input.update({ error: { message: "<b>markup</b>" } });
-    check(
-      "the message is text, never markup",
-      popup().querySelector("b") === null &&
-        popup().querySelector(".ws-chat-error__message")?.textContent === "<b>markup</b>",
-    );
-
-    input.update({ error: null });
-    check("a null error removes the popup", popup() === null && input.props.error === null);
-    input.dispose();
-  }
-
-  {
-    const input = new ChatBox({ error: { message: "from construction" } });
-    check(
-      "an error given at construction opens the popup",
-      input.element.querySelector(".ws-chat-error__message")?.textContent === "from construction",
-    );
-    input.dispose();
-  }
-});
-
-// --- The stylesheet: the card, the editor, and the action button ---------------------------
-
-{
-  const css = (
-    await readFile(path.join(testDir, "..", "src", "parts", "chatbox", "chat-box.css"), "utf8")
-  ).replace(/\/\*[\s\S]*?\*\//g, "");
-  const lookTokens = await readFile(path.join(testDir, "..", "..", "look", "tokens.css"), "utf8");
-  const componentCss = await readFile(path.join(testDir, "..", "src", "tokens", "component.css"), "utf8");
-  const sessionCss = await readFile(path.join(testDir, "..", "src", "parts", "agent", "agent-session.css"), "utf8");
-  const rule = (selector) => {
-    const match = new RegExp(`${selector.replace(/[.[\]"=():>~+*]/g, "\\$&")}\\s*\\{([^}]*)\\}`).exec(css);
-    return match === null ? "" : match[1].replace(/\s+/g, " ");
-  };
-  const token = (name) => new RegExp(`${name}:\\s*([^;]+);`).exec(lookTokens)?.[1].trim();
-
-  const card = rule(".ws-agent-session__bar");
-  check(
-    "the card's fill is the input color at 90%, about #202020",
-    token("--prompt-input-bg") === "color-mix(in srgb, var(--bg-input) 90%, transparent)" &&
-      /background:\s*var\(--prompt-input-bg\)/.test(card),
-  );
-  check(
-    "the card keeps its 12px radius and 8/10/6 padding",
-    token("--agent-card-radius") === "12px" &&
-      /border-radius:\s*var\(--agent-card-radius\)/.test(card) &&
-      /padding:\s*var\(--space-2\) var\(--space-2-5\) var\(--space-1-5\)/.test(card) &&
-      token("--space-2") === "8px" &&
-      token("--space-2-5") === "10px" &&
-      token("--space-1-5") === "6px",
-  );
-  check(
-    "the card's border and shadow ease over 100ms",
-    /transition:\s*border-color var\(--duration-fast\) ease-in-out, box-shadow var\(--duration-fast\) ease-in-out/.test(card) &&
-      token("--duration-fast") === "100ms",
-  );
-  check(
-    "the card sits 10px from each side",
-    token("--agent-outer-padding") === "10px" && /padding-inline:\s*var\(--agent-outer-padding\)/.test(sessionCss),
-  );
-  check(
-    "the toolbar sits 9px under the editor",
-    /gap:\s*var\(--ws-composer-toolbar-gap\)/.test(card) && /--ws-composer-toolbar-gap:\s*var\(--ws-size-9\)/.test(componentCss),
-  );
-  check(
-    "the card is the composer container the toolbar's breakpoints answer to",
-    /container:\s*ws-composer \/ inline-size/.test(card),
-  );
-
-  const editor = rule(".ws-prompt-input__editor");
-  check(
-    "the editor is 14px/22px with no letter-spacing",
-    /font-size:\s*var\(--font-size-lg\)/.test(editor) &&
-      /line-height:\s*var\(--line-height-lg\)/.test(editor) &&
-      /letter-spacing:\s*normal/.test(editor) &&
-      token("--font-size-lg") === "14px" &&
-      token("--line-height-lg") === "22px",
-  );
-  check(
-    "the editor grows from 22px to 240px",
-    token("--prompt-input-min-height") === "22px" && token("--prompt-input-max-height") === "240px",
-  );
-
-  check(
-    "the action button is a round control with a #141414 glyph on the Agent fill",
-    /border-radius:\s*var\(--radius-full\)/.test(rule(".ws-agent-session__action")) &&
-      /color:\s*var\(--cursor-chrome\)/.test(rule(".ws-agent-session__action")) &&
-      /background:\s*var\(--cursor-base\)/.test(rule(".ws-agent-session__action")) &&
-      token("--cursor-chrome") === "#141414",
-  );
-  check(
-    "the mic is a 66% fill under a #181818 glyph",
-    /color:\s*var\(--cursor-editor\)/.test(rule('.ws-agent-session__action[data-state="mic"]')) &&
-      /background:\s*var\(--cursor-icon-secondary\)/.test(rule('.ws-agent-session__action[data-state="mic"]')) &&
-      /--cursor-icon-secondary:\s*color-mix\(in srgb, var\(--cursor-base\) 66%, transparent\)/.test(lookTokens),
-  );
-  check(
-    "Plan fills yellow and Ask green, for send and Stop alike",
-    /\[data-state="send"\]\[data-mode="plan"\],\s*\.ws-agent-session__action\[data-state="stop"\]\[data-mode="plan"\]\s*\{[^}]*background:\s*var\(--cursor-yellow\)/.test(css) &&
-      /\[data-state="send"\]\[data-mode="ask"\],\s*\.ws-agent-session__action\[data-state="stop"\]\[data-mode="ask"\]\s*\{[^}]*background:\s*var\(--cursor-green\)/.test(css) &&
-      token("--cursor-yellow") === "#F1B467" &&
-      token("--cursor-green") === "#3FA266",
-  );
-  check(
-    "Debug and Multitask fill the base color at 80%",
-    /\[data-mode="debug"\][^{]*\[data-mode="multitask"\][^{]*\{[^}]*color-mix\(in srgb, var\(--cursor-base\) 80%, transparent\)/.test(css),
-  );
-  check(
-    "a disabled button keeps its fill at opacity 0.3",
-    /opacity:\s*0\.3/.test(rule(".ws-agent-session__action:disabled")) &&
-      !/background/.test(rule(".ws-agent-session__action:disabled")),
-  );
-  check(
-    "the recording look survives on the one button",
-    /ws-agent-session__action\.ws-stt-mic--recording/.test(css) &&
-      !/\.ws-agent-session__(mic|send)\b/.test(css),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`chat-box: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("chat-box: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/chatbox-boundary.mjs b/crates/workshop/ui/test/chatbox-boundary.mjs
deleted file mode 100644
index f26b4cc2c..000000000
--- a/crates/workshop/ui/test/chatbox-boundary.mjs
+++ /dev/null
@@ -1,63 +0,0 @@
-// The chat box boundary guard: `src/parts/chatbox/` is an isolated
-// component - it imports only `@workshop/platform/lifecycle`, `@workshop/look/icons`, the
-// shared menu surface `@workshop/look/dropdown.css`, skin tokens through CSS, and
-// `@tiptap/*` - so this test walks
-// every file in the directory and fails on any quoted import prefix that
-// reaches back into the embedding layers (`"../agent`, `"../stt`,
-// `"../chrome`, `"../../services`, or any `"@workshop/platform/` module
-// other than `lifecycle`; bare quoted prefixes, so an
-// `import type` line trips it too) or on the string `grant`, the owning
-// part's concern that must never leak into the component. No jsdom:
-// this is a source-text check.
-// Run: node --test test/chatbox-boundary.mjs
-import assert from "node:assert/strict";
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import { test } from "node:test";
-import { fileURLToPath } from "node:url";
-
-const chatboxDir = path.join(
-  path.dirname(fileURLToPath(import.meta.url)),
-  "..",
-  "src",
-  "parts",
-  "chatbox",
-);
-
-// Spelled as joined fragments so this guard's own source never matches
-// its own rule were it ever moved beside the component.
-const FORBIDDEN = [
-  { name: "an import from parts/agent", pattern: '"' + "../agent" },
-  { name: "an import from parts/stt", pattern: '"' + "../stt" },
-  { name: "an import from parts/chrome", pattern: '"' + "../chrome" },
-  { name: "an import from services/", pattern: '"' + "../../services" },
-  {
-    name: "an import from @workshop/platform other than lifecycle",
-    pattern: new RegExp('"' + "@workshop/platform/" + "(?!" + "lifecycle" + '")'),
-  },
-  { name: "the owning part's access-control vocabulary", pattern: ["gr", "ant"].join("") },
-];
-
-const files = (await readdir(chatboxDir, { recursive: true, withFileTypes: true }))
-  .filter((entry) => entry.isFile())
-  .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name))
-  .sort();
-
-test("the chatbox directory holds the component's files", () => {
-  assert.ok(files.length > 0, "src/parts/chatbox/ holds no files; the walk is broken");
-});
-
-test("no file under src/parts/chatbox/ reaches into the embedding layers", async () => {
-  const offenders = [];
-  for (const file of files) {
-    const lines = (await readFile(file, "utf8")).split("\n");
-    lines.forEach((line, index) => {
-      for (const { name, pattern } of FORBIDDEN) {
-        if (typeof pattern === "string" ? line.includes(pattern) : pattern.test(line)) {
-          offenders.push(`${path.relative(chatboxDir, file)}:${index + 1} (${name}): ${line.trim()}`);
-        }
-      }
-    });
-  }
-  assert.deepEqual(offenders, [], `boundary violations:\n  ${offenders.join("\n  ")}`);
-});
diff --git a/crates/workshop/ui/test/close-commands.mjs b/crates/workshop/ui/test/close-commands.mjs
deleted file mode 100644
index 9ecfe86d9..000000000
--- a/crates/workshop/ui/test/close-commands.mjs
+++ /dev/null
@@ -1,560 +0,0 @@
-// Integration test for the confirm-then-close path: WorkshopPart's default
-// confirmClose (@workshop/platform/workshop-part.ts), the editor's
-// unsaved-changes confirmation (src/parts/editor/editor-panel.ts), and the
-// Close and Close Others commands (src/parts/layout/panel-close.ts,
-// registered by layout.contribution.ts). Mounts a real Dockview dock in
-// jsdom with synthetic panel types - "doc" builds a real EditorPanel over a
-// stub surface and stub file I/O, "probe" is a bare WorkshopPart, "plain"
-// is a renderer that is not a WorkshopPart, and "pinned" registers
-// closable: false - and runs every command through the shared registries,
-// so the contribution's run bodies must forward their { panelId } argument.
-// Covers: Close targets the { panelId } panel over the active one, else the
-// active panel; a non-closable panel stays; a plain renderer and a clean
-// WorkshopPart close without a prompt; an unsaved editor is activated and
-// prompts, and Cancel, Escape, or a failed save keep it open while the
-// command settles; a second Close while the prompt is up declines; Close
-// Others activates and prompts each unsaved editor in turn, closes nothing
-// when either is canceled (a save already made stands), and closes every
-// other closable panel once both are answered, sparing the non-closable
-// one; an editor edited after its confirmation voids the batch; a panel
-// that leaves the dock mid-batch is skipped without disturbing the group;
-// an editor that leaves the dock with its prompt up still settles Close
-// and Close Others, and the batch closes nothing; Ctrl+F4 still closes the
-// active editor only while it has text focus.
-// Run: node --test test/close-commands.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export {
-        registerPanelFactory,
-        registerPanelType,
-        resolvePanelContent,
-      } from "@workshop/platform/panel-registry";
-      export { WorkshopPart } from "@workshop/platform/workshop-part";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { detectPlatform } from "@workshop/platform/keybinding-parser";
-      export { getService } from "@workshop/platform/service-registry";
-      export { initZones, openInZone, resetZones } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent } from "./src/parts/layout/panel-types.ts";
-      export { KeybindingDispatcher } from "./src/parts/layout/keybinding-dispatcher.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; strip it - jsdom applies
-  // no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-globalThis.fetch = async (url) => {
-  throw new Error(`unexpected fetch in the close-commands test: ${url}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLTextAreaElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "KeyboardEvent",
-  "MutationObserver",
-  "ResizeObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-close-commands-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  registerPanelFactory,
-  registerPanelType,
-  resolvePanelContent,
-  WorkshopPart,
-  Commands,
-  CONTEXT_KEY_SERVICE,
-  detectPlatform,
-  getService,
-  initZones,
-  openInZone,
-  resetZones,
-  createPanelComponent,
-  createPanelTabComponent,
-  KeybindingDispatcher,
-  EditorPanel,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// A command's promise, watched without awaiting it: a close waiting on a
-// prompt must not hang the test, and a rejection must not crash it.
-const rejections = [];
-function track(promise) {
-  const state = { settled: false };
-  promise.then(
-    () => {
-      state.settled = true;
-    },
-    (error) => {
-      state.settled = true;
-      rejections.push(String(error?.stack ?? error));
-    },
-  );
-  return state;
-}
-
-// The EditorSurface contract over plain fields. Each surface registers
-// under its document's path when the panel opens it, so a test can type
-// into a panel it only knows by name.
-const surfaces = new Map();
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      surfaces.set(document.path, this);
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    editorView() {
-      return null;
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-// File I/O stubs: every read answers an empty file; writes are recorded,
-// and fail while failWrites is set.
-const writes = [];
-let failWrites = false;
-const readDoc = async (filePath) => ({ path: filePath, size: 0, token: "t1", text: "" });
-const writeDoc = async (filePath, text) => {
-  if (failWrites) {
-    throw new Error("the disk is full");
-  }
-  writes.push({ path: filePath, text });
-  return { path: filePath, size: text.length, token: "t2", text };
-};
-
-class ProbePart extends WorkshopPart {
-  create() {}
-}
-
-// One lazy "feature directory" serving every synthetic type, all in the
-// main zone so they share one group.
-const feature = {
-  register() {
-    registerPanelFactory(
-      "doc",
-      () => new EditorPanel({ createSurface: createStubSurface, readFile: readDoc, writeFile: writeDoc }),
-    );
-    registerPanelFactory("probe", () => new ProbePart());
-    registerPanelFactory("plain", () => ({ element: window.document.createElement("div"), init() {} }));
-    registerPanelFactory("pinned", () => new ProbePart());
-  },
-};
-const load = () => Promise.resolve(feature);
-registerPanelType({
-  type: "doc",
-  title: (params) => String(params.path),
-  defaultZone: "main",
-  panelId: (params) => `doc:${params.path}`,
-  load,
-});
-registerPanelType({ type: "probe", title: "Probe", defaultZone: "main", load });
-registerPanelType({ type: "plain", title: "Plain", defaultZone: "main", load });
-registerPanelType({ type: "pinned", title: "Pinned", defaultZone: "main", closable: false, load });
-
-let dock = null;
-function freshDock() {
-  const element = window.document.createElement("div");
-  element.className = "ws-dock";
-  window.document.body.appendChild(element);
-  dock = createDockview(element, {
-    createComponent: createPanelComponent,
-    createTabComponent: createPanelTabComponent,
-    theme: themeDark,
-    disableFloatingGroups: true,
-    hideBorders: true,
-    locked: false,
-    noPanelsOverlay: "emptyGroup",
-  });
-  initZones(dock);
-  resetZones();
-}
-
-async function openDoc(name) {
-  const panel = openInZone("doc", { path: name });
-  await flush();
-  return panel;
-}
-
-async function openPanel(type) {
-  const panel = openInZone(type, {});
-  await flush();
-  return panel;
-}
-
-const CLOSE = "workbench.action.closeActiveEditor";
-const CLOSE_OTHERS = "workbench.action.closeOtherEditors";
-
-const isOpen = (panel) => dock.getPanel(panel.id) === panel;
-const partOf = (panel) => resolvePanelContent(panel.view.content);
-const isDirty = (panel) => partOf(panel) instanceof EditorPanel && partOf(panel).isDirty();
-const promptsIn = (panel) => partOf(panel).element.querySelectorAll(".ws-editor-close-overlay").length;
-
-/** Clicks one button of the panel's unsaved-changes prompt; false when none is up. */
-function clickPrompt(panel, label) {
-  const button = [...partOf(panel).element.querySelectorAll(".ws-editor-close__button")].find(
-    (candidate) => candidate.textContent === label,
-  );
-  button?.click();
-  return button !== undefined;
-}
-
-// --- Close: the { panelId } target, else the active panel ---------------------
-
-freshDock();
-const first = await openDoc("first.txt");
-const second = await openDoc("second.txt");
-await Commands.execute(CLOSE, { panelId: first.id });
-await flush();
-check("Close with { panelId } closes that panel", !isOpen(first));
-check("Close with { panelId } leaves the active panel open", isOpen(second));
-await Commands.execute(CLOSE);
-await flush();
-check("Close with no argument closes the active panel", !isOpen(second));
-
-const pinned = await openPanel("pinned");
-await Commands.execute(CLOSE, { panelId: pinned.id });
-await Commands.execute(CLOSE);
-await flush();
-check("Close leaves a closable: false panel open, by id or as the active panel", isOpen(pinned));
-
-const plain = await openPanel("plain");
-const probe = await openPanel("probe");
-await Commands.execute(CLOSE, { panelId: plain.id });
-await Commands.execute(CLOSE, { panelId: probe.id });
-await flush();
-check("Close closes a panel that is not a WorkshopPart directly", !isOpen(plain));
-check("Close closes a clean WorkshopPart through its default confirmClose", !isOpen(probe));
-
-// --- Close on an unsaved editor: activate, prompt, and honor the answer -------
-
-const unsaved = await openDoc("unsaved.txt");
-const other = await openDoc("other.txt");
-surfaces.get("unsaved.txt").type("draft\n");
-
-const canceled = track(Commands.execute(CLOSE, { panelId: unsaved.id }));
-await flush();
-check(
-  "Close on an unsaved inactive editor activates it and prompts instead of closing",
-  dock.activePanel === unsaved && isOpen(unsaved) && promptsIn(unsaved) === 1,
-);
-check("the prompt offers Cancel", clickPrompt(unsaved, "Cancel"));
-await flush();
-check("Cancel keeps the unsaved editor open and dirty", isOpen(unsaved) && isDirty(unsaved));
-check("Close settles after Cancel", canceled.settled);
-
-const escaped = track(Commands.execute(CLOSE, { panelId: unsaved.id }));
-await flush();
-window.document.dispatchEvent(
-  new window.KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }),
-);
-await flush();
-check("Escape dismisses the prompt and keeps the unsaved editor open", promptsIn(unsaved) === 0 && isOpen(unsaved));
-check("Close settles after Escape", escaped.settled);
-
-failWrites = true;
-const failedSave = track(Commands.execute(CLOSE, { panelId: unsaved.id }));
-await flush();
-check("the prompt offers Save", clickPrompt(unsaved, "Save"));
-await flush();
-failWrites = false;
-check("a failed save in the prompt keeps the unsaved editor open", isOpen(unsaved) && isDirty(unsaved));
-check("Close settles after a failed save", failedSave.settled);
-
-const asking = track(Commands.execute(CLOSE, { panelId: unsaved.id }));
-await flush();
-const again = track(Commands.execute(CLOSE, { panelId: unsaved.id }));
-await flush();
-check(
-  "a second Close while the prompt is up declines at once and opens no second prompt",
-  again.settled && !asking.settled && promptsIn(unsaved) === 1 && isOpen(unsaved),
-);
-check("the prompt offers Don't Save", clickPrompt(unsaved, "Don't Save"));
-await flush();
-check("Don't Save closes the unsaved editor", !isOpen(unsaved) && asking.settled);
-check("closing the unsaved editor leaves the other editor open", isOpen(other));
-
-// --- Close Others: confirm the batch in turn, then close it together ----------
-
-freshDock();
-const keep = await openDoc("keep.txt");
-const one = await openDoc("one.txt");
-const clean = await openDoc("clean.txt");
-const bare = await openPanel("probe");
-const raw = await openPanel("plain");
-const fixed = await openPanel("pinned");
-const two = await openDoc("two.txt");
-const others = [one, clean, bare, raw, two];
-check(
-  "the Close Others panels share one group",
-  [one, clean, bare, raw, fixed, two].every((panel) => panel.group === keep.group),
-);
-surfaces.get("one.txt").type("one\n");
-surfaces.get("two.txt").type("two\n");
-
-keep.api.setActive();
-const cancelFirst = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-check(
-  "Close Others activates the first unsaved editor and prompts for it",
-  dock.activePanel === one && promptsIn(one) === 1,
-);
-check("the second unsaved editor waits its turn", promptsIn(two) === 0);
-clickPrompt(one, "Cancel");
-await flush();
-check(
-  "canceling the first prompt closes nothing and never prompts the second",
-  [keep, ...others, fixed].every(isOpen) && promptsIn(two) === 0,
-);
-check("Close Others settles after the first Cancel", cancelFirst.settled);
-
-const writesBefore = writes.length;
-const cancelSecond = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-clickPrompt(one, "Save");
-await flush();
-check(
-  "answering the first prompt activates and prompts the second unsaved editor",
-  dock.activePanel === two && promptsIn(two) === 1,
-);
-clickPrompt(two, "Cancel");
-await flush();
-check("canceling the second prompt closes nothing", [keep, ...others, fixed].every(isOpen));
-check(
-  "a save made before the Cancel stands",
-  writes.length === writesBefore + 1 && writes.at(-1)?.text === "one\n" && !isDirty(one),
-);
-check("Close Others settles after the second Cancel", cancelSecond.settled);
-
-surfaces.get("one.txt").type("one again\n");
-const answered = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-clickPrompt(one, "Don't Save");
-await flush();
-clickPrompt(two, "Don't Save");
-await flush();
-check(
-  "answering both prompts closes every other closable panel, clean ones included",
-  others.every((panel) => !isOpen(panel)),
-);
-check("Close Others spares its target and the non-closable panel", isOpen(keep) && isOpen(fixed));
-check("Close Others settles once the batch closes", answered.settled);
-
-// An editor confirmed clean, then edited while a later prompt is up, never
-// answered for its new changes: the batch closes nothing.
-const edited = await openDoc("edited.txt");
-const three = await openDoc("three.txt");
-surfaces.get("three.txt").type("three\n");
-const voided = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-check("the batch reaches the unsaved editor's prompt", promptsIn(three) === 1);
-surfaces.get("edited.txt").type("typed during the prompt\n");
-clickPrompt(three, "Don't Save");
-await flush();
-check(
-  "an editor edited after its confirmation voids the batch",
-  isOpen(edited) && isOpen(three) && isOpen(keep),
-);
-check("Close Others settles when the batch is voided", voided.settled);
-
-// A panel that leaves the dock mid-batch, the way Dockview's own tab close
-// removes one, is skipped rather than closed a second time.
-for (const panel of [edited, three]) {
-  if (isOpen(panel)) dock.removePanel(panel);
-}
-const gone = await openDoc("gone.txt");
-const four = await openDoc("four.txt");
-surfaces.get("four.txt").type("four\n");
-const skipping = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-check("the batch reaches the last unsaved editor's prompt", promptsIn(four) === 1);
-dock.removePanel(gone);
-clickPrompt(four, "Don't Save");
-await flush();
-check(
-  "a panel that left the dock mid-batch is skipped while the rest close",
-  !isOpen(four) && isOpen(keep) && isOpen(fixed),
-);
-check(
-  "closing the batch leaves the group's panel list intact",
-  keep.group.panels.length === 2 && keep.group.panels.includes(keep) && keep.group.panels.includes(fixed),
-);
-check("Close Others settles after skipping the departed panel", skipping.settled);
-
-// An editor that leaves the dock with its prompt up, the way Dockview's own
-// tab close removes one, answers through neither a button nor Escape: the
-// command awaiting it still settles, and the batch closes nothing.
-const bystander = await openDoc("bystander.txt");
-const five = await openDoc("five.txt");
-surfaces.get("five.txt").type("five\n");
-const departedBatch = track(Commands.execute(CLOSE_OTHERS, { panelId: keep.id }));
-await flush();
-check("the batch reaches the prompt of the editor about to leave", promptsIn(five) === 1);
-dock.removePanel(five);
-await flush();
-check("Close Others settles when its prompting editor leaves the dock", departedBatch.settled);
-check(
-  "a batch whose prompting editor left closes nothing",
-  isOpen(bystander) && isOpen(keep) && isOpen(fixed),
-);
-
-const six = await openDoc("six.txt");
-surfaces.get("six.txt").type("six\n");
-const departedClose = track(Commands.execute(CLOSE, { panelId: six.id }));
-await flush();
-check("Close reaches the prompt of the editor about to leave", promptsIn(six) === 1);
-dock.removePanel(six);
-await flush();
-check("Close settles when its prompting editor leaves the dock", departedClose.settled);
-
-// --- Ctrl+F4 through the keybinding dispatcher ---------------------------------
-
-// The shared registry reports a rejected command; the dispatcher dispatches
-// through it, so watching the report is watching for a rejection.
-const failedCommands = [];
-const failureWatch = Commands.onDidFailCommand((failure) => failedCommands.push(failure.id));
-const dispatcher = new KeybindingDispatcher({ status: { show() {}, clear() {} } });
-const contextKeys = getService(CONTEXT_KEY_SERVICE);
-const activeEditorKey = contextKeys.createKey("activeEditor", undefined);
-const textFocusKey = contextKeys.createKey("editorTextFocus", false);
-// ctrlcmd resolves against the platform the shared registry detected.
-const chordModifier = detectPlatform() === "mac" ? { metaKey: true } : { ctrlKey: true };
-function pressCloseChord() {
-  window.document.body.dispatchEvent(
-    new window.KeyboardEvent("keydown", { key: "F4", code: "F4", bubbles: true, cancelable: true, ...chordModifier }),
-  );
-}
-
-const focused = await openDoc("focused.txt");
-activeEditorKey.set("editor");
-textFocusKey.set(false);
-pressCloseChord();
-await flush();
-check("Ctrl+F4 leaves the active editor open without editor text focus", isOpen(focused));
-textFocusKey.set(true);
-pressCloseChord();
-await flush();
-check("Ctrl+F4 closes the active editor while it has text focus", !isOpen(focused));
-check("no close command rejected through the dispatcher", failedCommands.length === 0);
-failureWatch.dispose();
-dispatcher.dispose();
-activeEditorKey.reset();
-textFocusKey.reset();
-
-check(`no close command rejected (got: ${rejections.join("; ")})`, rejections.length === 0);
-
-if (failures.length > 0) {
-  console.error(`close-commands: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("close-commands: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/closed-editors.mjs b/crates/workshop/ui/test/closed-editors.mjs
deleted file mode 100644
index 85d081209..000000000
--- a/crates/workshop/ui/test/closed-editors.mjs
+++ /dev/null
@@ -1,222 +0,0 @@
-// Unit test for the closed-editor stack (src/parts/editor/closed-editors.ts,
-// consumed by editor-lifecycle.ts): the adapter-backed stack behind
-// Reopen Closed Editor. Bundles the module with esbuild and drives it
-// over the fake UI-state adapter the way main.ts binds the live one: the
-// initial value read from the workspace bucket's "closed_editors" key,
-// every mutation written back to the same key as `{ paths: [...] }`,
-// most recent first. Covers: the token's self-registration, the initial
-// stack applied at construction (and construction writing nothing), push
-// prepending the path in the written snapshot, pop removing it and
-// writing, pop on an empty stack writing nothing, untitled entries kept
-// in memory but absent from the persisted paths (unsaved text never
-// persists), the retention cap of 50, replaceClosedEditors replacing the
-// stack without a write, the hand-written shape check on the initial
-// value, a new instance over the written value reading it back, and a
-// writer that throws leaving the stack intact.
-// Run: node --test test/closed-editors.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { ClosedEditors } from "./src/parts/editor/closed-editors.ts";
-      export { CLOSED_EDITORS } from "./src/services/closed-editors.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { ClosedEditors, CLOSED_EDITORS, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** The workspace-bucket key the composition root binds the stack to. */
-const KEY = "closed_editors";
-
-/**
- * Builds a stack over a fake adapter the way main.ts binds the live one.
- * Returns the stack and the fake, whose `sets` records the writes.
- */
-function stackOver(initial) {
-  const storage = createFakeUiStorage(initial === undefined ? {} : { workspace: { [KEY]: initial } });
-  const stack = new ClosedEditors(storage.get("workspace", KEY), (value) =>
-    storage.set("workspace", KEY, value),
-  );
-  return { stack, storage };
-}
-
-/** The last recorded write's value, or undefined when nothing was written. */
-function lastWrite(storage) {
-  return storage.sets[storage.sets.length - 1]?.value;
-}
-
-const file = (p) => ({ kind: "file", path: p });
-
-// --- Self-registration --------------------------------------------------------
-
-check("the CLOSED_EDITORS token self-registers", getService(CLOSED_EDITORS) instanceof ClosedEditors);
-check("the default instance starts empty", getService(CLOSED_EDITORS).snapshot().paths.length === 0);
-check("the default instance pops nothing", getService(CLOSED_EDITORS).pop() === undefined);
-
-// --- The initial value ----------------------------------------------------------
-
-{
-  const { stack, storage } = stackOver({ paths: ["/b.ts", "/a.ts"] });
-  check("the initial stack is applied most-recent-first", stack.snapshot().paths.join(",") === "/b.ts,/a.ts");
-  check("construction writes nothing", storage.sets.length === 0);
-  const first = stack.pop();
-  check(
-    "pop returns the most recently closed file first",
-    first !== undefined && first.kind === "file" && first.path === "/b.ts",
-  );
-  const second = stack.pop();
-  check("the next pop returns the older file", second !== undefined && second.path === "/a.ts");
-  check("the seeded stack empties in order", stack.pop() === undefined);
-}
-
-// --- Push, pop, and the write-through -------------------------------------------
-
-const { stack, storage } = stackOver();
-check("a fresh stack is empty", stack.snapshot().paths.length === 0);
-
-stack.push(file("/a.ts"));
-check(
-  "push writes the snapshot to the workspace bucket",
-  storage.sets.length === 1 &&
-    storage.sets[0].bucket === "workspace" &&
-    storage.sets[0].key === KEY &&
-    Array.isArray(storage.sets[0].value?.paths) &&
-    storage.sets[0].value.paths.join(",") === "/a.ts",
-);
-stack.push(file("/b.ts"));
-check("the snapshot lists the most recent close first", stack.snapshot().paths.join(",") === "/b.ts,/a.ts");
-check("the second push writes the whole two-entry stack", lastWrite(storage)?.paths.join(",") === "/b.ts,/a.ts");
-
-const popped = stack.pop();
-check("pop returns the most recent close", popped?.kind === "file" && popped.path === "/b.ts");
-check("pop writes the reduced stack", storage.sets.length === 3 && lastWrite(storage)?.paths.join(",") === "/a.ts");
-
-stack.pop();
-const writesBeforeEmptyPop = storage.sets.length;
-check("popping the last entry writes the empty snapshot", lastWrite(storage)?.paths.length === 0);
-check("pop on an empty stack returns undefined", stack.pop() === undefined);
-check("pop on an empty stack writes nothing", storage.sets.length === writesBeforeEmptyPop);
-
-// --- Untitled buffers stay in memory only ------------------------------------------
-
-{
-  const { stack: mixed, storage: mixedStorage } = stackOver();
-  mixed.push(file("/x.ts"));
-  mixed.push({ kind: "untitled", text: "draft" });
-  check("an untitled close is absent from the persisted paths", lastWrite(mixedStorage)?.paths.join(",") === "/x.ts");
-  check("an untitled close still writes a snapshot", mixedStorage.sets.length === 2);
-  const untitled = mixed.pop();
-  check(
-    "an untitled close pops back with its text",
-    untitled?.kind === "untitled" && untitled.text === "draft",
-  );
-  const next = mixed.pop();
-  check("the file beneath an untitled close pops next", next?.kind === "file" && next.path === "/x.ts");
-}
-
-// --- The cap ----------------------------------------------------------------------------
-
-{
-  const { stack: capped, storage: cappedStorage } = stackOver();
-  for (let i = 0; i < 55; i += 1) {
-    capped.push(file(`/f${i}.ts`));
-  }
-  const paths = capped.snapshot().paths;
-  check("the stack is capped at 50", paths.length === 50);
-  check("the newest entry leads the snapshot", paths[0] === "/f54.ts");
-  check("the oldest entries drop off", !paths.includes("/f4.ts") && paths.includes("/f5.ts"));
-  check("the written snapshot is the capped stack", lastWrite(cappedStorage)?.paths.length === 50);
-  const { stack: oversized } = stackOver({ paths: Array.from({ length: 60 }, (_, i) => `/p${i}.ts`) });
-  const seeded = oversized.snapshot().paths;
-  check("an oversized initial value keeps the 50 most recent", seeded.length === 50 && seeded[0] === "/p0.ts");
-  check("an oversized initial value drops the oldest", !seeded.includes("/p50.ts") && seeded.includes("/p49.ts"));
-}
-
-// --- Persistence: a relaunch reads what the last write stored -----------------------
-
-{
-  const { stack: source, storage: sourceStorage } = stackOver();
-  source.push(file("/one.ts"));
-  source.push(file("/two.ts"));
-  const reloaded = new ClosedEditors(sourceStorage.get("workspace", KEY), () => {});
-  check(
-    "a new stack over the written value reads it back",
-    reloaded.snapshot().paths.join(",") === source.snapshot().paths.join(","),
-  );
-}
-
-// --- replaceClosedEditors (Open Workspace from File) ----------------------------------
-
-{
-  const { stack: switched, storage: switchedStorage } = stackOver({ paths: ["/old.ts"] });
-  switched.push(file("/live.ts"));
-  const writesBeforeReplace = switchedStorage.sets.length;
-  switched.replaceClosedEditors(["/new-b.ts", "/new-a.ts"]);
-  check("replaceClosedEditors replaces the stack", switched.snapshot().paths.join(",") === "/new-b.ts,/new-a.ts");
-  check("replaceClosedEditors writes nothing", switchedStorage.sets.length === writesBeforeReplace);
-  const top = switched.pop();
-  check("the replaced stack pops most-recent-first", top?.kind === "file" && top.path === "/new-b.ts");
-  switched.replaceClosedEditors([]);
-  check("replacing with an empty list empties the stack", switched.pop() === undefined);
-}
-
-// --- The shape check on the initial value --------------------------------------------
-
-check("a null initial value reads as empty", stackOver(null).stack.snapshot().paths.length === 0);
-check("a string initial value reads as empty, never a cast", stackOver("nope").stack.snapshot().paths.length === 0);
-check("a bare array reads as empty", stackOver(["/a.ts"]).stack.snapshot().paths.length === 0);
-check("an object without paths reads as empty", stackOver({ other: 1 }).stack.snapshot().paths.length === 0);
-check("a non-array paths field reads as empty", stackOver({ paths: "x" }).stack.snapshot().paths.length === 0);
-check(
-  "non-string and empty entries drop out",
-  stackOver({ paths: ["ok", 42, null, "", "also"] }).stack.snapshot().paths.join(",") === "ok,also",
-);
-
-// --- A writer that fails -----------------------------------------------------------------
-
-{
-  const memoryOnly = new ClosedEditors();
-  memoryOnly.push(file("/x.ts"));
-  check("a stack with the default no-op writer still tracks in memory", memoryOnly.snapshot().paths.length === 1);
-
-  let attempts = 0;
-  const degraded = new ClosedEditors({ paths: ["/kept.ts"] }, () => {
-    attempts += 1;
-    throw new Error("denied");
-  });
-  degraded.push(file("/y.ts"));
-  check("a throwing writer is still called", attempts === 1);
-  check("a throwing write keeps the in-memory stack", degraded.snapshot().paths.join(",") === "/y.ts,/kept.ts");
-  const popped = degraded.pop();
-  check("a throwing write on pop still pops", popped?.path === "/y.ts" && attempts === 2);
-}
-
-if (failures.length > 0) {
-  console.error(`closed-editors: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("closed-editors: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/command-center.mjs b/crates/workshop/ui/test/command-center.mjs
deleted file mode 100644
index 13d660351..000000000
--- a/crates/workshop/ui/test/command-center.mjs
+++ /dev/null
@@ -1,252 +0,0 @@
-// Unit test for the command center (src/parts/chrome/command-center.ts): the
-// title-bar toolbar over MenuId.CommandCenter, mounted inside the center
-// drag region with the no-drag marker. The built-in folder-name button
-// shows the window title and dispatches the menu's first command row on
-// mousedown (a keyboard-synthesized click does the same, and the click
-// that follows a mouse press does not run it twice); there is no search
-// icon and no ? chevron; further command rows render as toolbar buttons.
-// Also covers the button's tooltip and the WindowTitle helper showing the first granted root's
-// folder name (falling back to "Runvil" when no root is granted or
-// the listing fails), re-rendering on the workspace-changed event, and
-// tracking document.title. The default listRoots reads the roots through
-// TreeStateService.roots(): a listing already cached there answers with no
-// fetch, and two titles refreshing on an empty cache share one fetch.
-// Bundles the module with esbuild and drives it against jsdom.
-// Run: node --test test/command-center.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM(
-  `<header class="ws-window-titlebar">
-     <div class="ws-window-titlebar__left"></div>
-     <div class="ws-window-titlebar__center ws-window-titlebar__drag"></div>
-     <div class="ws-window-titlebar__right"></div>
-   </header>`,
-  { url: "http://127.0.0.1:7910/" },
-);
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { CommandCenter, WindowTitle } from "./src/parts/chrome/command-center.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-      export { WORKSPACE_CHANGED_EVENT } from "./src/services/workspace-events.ts";
-      export { TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const { CommandCenter, WindowTitle, CommandRegistry, MenuRegistry, MenuId, WORKSPACE_CHANGED_EVENT, TREE_STATE, getService } =
-  await import(`data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
-
-// --- Fixture: a command center in the title bar's center drag region -------
-
-const center = window.document.querySelector(".ws-window-titlebar__center");
-let roots = [{ name: "runvil" }];
-const commands = new CommandRegistry();
-const ran = [];
-commands.register("workbench.action.quickOpenWithModes", { run: () => ran.push("modes") });
-commands.register("workbench.action.quickOpenHelp", { run: () => ran.push("help") });
-commands.register("example.extra", { title: "Extra Row", run: () => ran.push("extra") });
-const menus = new MenuRegistry();
-menus.appendMenuItem(MenuId.CommandCenter, { command: "workbench.action.quickOpenWithModes" });
-menus.appendMenuItem(MenuId.CommandCenter, { command: "example.extra", group: "1_extra" });
-
-const commandCenter = new CommandCenter(center, { commands, menus, listRoots: async () => roots });
-await flush();
-
-// --- Mounting and no-drag placement ----------------------------------------
-
-const container = center.querySelector(".ws-command-center");
-check("the command center mounts inside the center drag region", container !== null);
-check(
-  "the command center has the no-drag marker",
-  container?.classList.contains("ws-window-titlebar__no-drag") === true,
-);
-
-const folder = container.querySelector(".ws-command-center__folder");
-check("the folder-name button is a button", folder?.tagName === "BUTTON");
-check("the folder-name button is a type=button control", folder?.type === "button");
-check(
-  "the folder-name button explains itself in its tooltip",
-  folder?.getAttribute("title") === "Search files, commands, and more",
-);
-check(
-  "the folder-name button keeps its visible text as its accessible name",
-  !folder?.hasAttribute("aria-label"),
-);
-check("the pill, its search icon, and its ? chevron are gone", container.querySelector(
-  ".ws-command-center__pill, .ws-command-center__search, .ws-command-center__chevron",
-) === null);
-
-// --- Window title: first granted root, then document.title -----------------
-
-check("the button shows the first granted root's folder name", folder.textContent === "runvil");
-check("document.title tracks the folder name", window.document.title === "runvil");
-
-// --- Press routing: mousedown opens quick open --------------------------------
-
-const press = (init) => folder.dispatchEvent(new window.MouseEvent("mousedown", { bubbles: true, cancelable: true, ...init }));
-const clickEvent = (detail) => folder.dispatchEvent(new window.MouseEvent("click", { bubbles: true, detail }));
-
-// The press's default action would move focus to the button after quick
-// open has focused its box; jsdom skips default actions, so the check is
-// that the handler cancels the event.
-const primaryPress = press({ button: 0, detail: 1 });
-await flush();
-check("mousedown on the button opens quick open with modes", ran.length === 1 && ran[0] === "modes");
-check(
-  "the primary press cancels its default focus change so quick open keeps focus",
-  primaryPress === false,
-);
-clickEvent(1);
-await flush();
-check("the click that follows a mouse press does not open it twice", ran.length === 1);
-const secondaryPress = press({ button: 2, detail: 1 });
-await flush();
-check("a non-primary press opens nothing", ran.length === 1);
-check("a non-primary press keeps its default action", secondaryPress === true);
-folder.click();
-await flush();
-check("a keyboard-synthesized click (detail 0) opens quick open", ran.length === 2 && ran[1] === "modes");
-ran.length = 0;
-
-// --- Extra menu rows render as toolbar buttons ------------------------------
-
-const extraRow = container.querySelector(".ws-command-center__item");
-check(
-  "a second menu row renders as a toolbar button",
-  extraRow?.tagName === "BUTTON" && extraRow?.type === "button",
-);
-check("the extra row takes the command's title", extraRow?.textContent === "Extra Row");
-extraRow.click();
-await flush();
-check("clicking the extra row dispatches its command", ran.length === 1 && ran[0] === "extra");
-
-// --- Grant changes re-render the title --------------------------------------
-
-roots = [{ name: "other-folder" }];
-window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-await flush();
-check("a grant change re-renders the title", folder.textContent === "other-folder");
-check("document.title follows the grant change", window.document.title === "other-folder");
-
-roots = [];
-window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-await flush();
-check("no granted roots falls back to Runvil", folder.textContent === "Runvil");
-check("document.title falls back to Runvil", window.document.title === "Runvil");
-
-// --- A failing roots listing keeps the fallback -----------------------------
-
-const secondCenter = window.document.createElement("div");
-window.document.body.appendChild(secondCenter);
-const failing = new CommandCenter(secondCenter, {
-  commands,
-  listRoots: async () => {
-    throw new Error("server down");
-  },
-});
-await flush();
-const failingFolder = secondCenter.querySelector(".ws-command-center__folder");
-check("a failed listing falls back to Runvil", failingFolder.textContent === "Runvil");
-failing.dispose();
-check("dispose removes the command center", secondCenter.querySelector(".ws-command-center") === null);
-
-// --- No registered rows: a press dispatches nothing --------------------------
-
-const emptyContainer = window.document.createElement("div");
-window.document.body.appendChild(emptyContainer);
-const noRows = new CommandCenter(emptyContainer, {
-  commands,
-  menus: new MenuRegistry(),
-  listRoots: async () => roots,
-});
-await flush();
-const inert = emptyContainer.querySelector(".ws-command-center__folder");
-inert.dispatchEvent(new window.MouseEvent("mousedown", { bubbles: true, button: 0, detail: 1 }));
-inert.click();
-await flush();
-check("an empty menu leaves the folder button inert", ran.length === 1);
-noRows.dispose();
-
-// --- WindowTitle stands alone ------------------------------------------------
-
-let standaloneRoots = [{ name: "solo" }];
-const title = new WindowTitle({ listRoots: async () => standaloneRoots });
-await flush();
-check("WindowTitle exposes its element", title.element instanceof window.HTMLElement);
-check("WindowTitle sets document.title on its own", window.document.title === "solo");
-title.dispose();
-
-// --- The default listRoots reads the shared tree-state cache ------------------
-
-const rootEntry = (name) => ({ name, path: `C:\\${name}`, kind: "directory", size: 0, modified_ms: 1, exists: true });
-{
-  const tree = getService(TREE_STATE);
-  tree.cacheListing("", { path: null, entries: [rootEntry("cached-root")] });
-  let fetches = 0;
-  globalThis.fetch = async () => {
-    fetches += 1;
-    throw new Error("the title must not fetch while the roots are cached");
-  };
-  const shared = new WindowTitle();
-  await flush();
-  check("the default listRoots reads the listing cached on TREE_STATE", window.document.title === "cached-root");
-  check("the default listRoots issues no fetch when the roots are cached", fetches === 0);
-  shared.dispose();
-
-  // An empty cache: two titles refreshing at once share one roots fetch,
-  // the fetch that the tree panel's own load would also share.
-  tree.invalidateRoots();
-  globalThis.fetch = async () => {
-    fetches += 1;
-    return { ok: true, status: 200, json: async () => ({ path: null, entries: [rootEntry("fetched-root")] }) };
-  };
-  const one = new WindowTitle();
-  const two = new WindowTitle();
-  await flush();
-  check("two titles refreshing on an empty cache share one roots fetch", fetches === 1);
-  check("the shared fetch lands in the title", window.document.title === "fetched-root");
-  check("the shared fetch lands in the tree-state cache", tree.listing("")?.entries[0]?.name === "fetched-root");
-  one.dispose();
-  two.dispose();
-  tree.invalidateRoots();
-}
-
-commandCenter.dispose();
-check("disposing the command center removes its container", center.querySelector(".ws-command-center") === null);
-
-if (failures.length > 0) {
-  console.error(`command-center: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("command-center: all assertions passed");
diff --git a/crates/workshop/ui/test/command-failure-toast.mjs b/crates/workshop/ui/test/command-failure-toast.mjs
deleted file mode 100644
index ed062cf42..000000000
--- a/crates/workshop/ui/test/command-failure-toast.mjs
+++ /dev/null
@@ -1,131 +0,0 @@
-// A command that throws or rejects raises Cursor's toast, "Command '{0}'
-// resulted in an error", with {0} the command's palette label (Category:
-// Title, the bare title, or the id). The platform registry reports the
-// failure (platform/test/command-failures.mjs); toastCommandFailures turns
-// each report into an error toast on the shared stack, and disposing it
-// stops that. The toast carries no error text, so the detail stays with
-// the caller's console log. A run that bypasses the registry (the layout
-// core's direct close) raises the same toast by hand. Bundles the module with
-// esbuild and drives it against jsdom with the real toast stack.
-// Run: node --test test/command-failure-toast.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { toastCommandFailures, toastCommandFailure } from "./src/services/command-failure-toasts.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { createToastStack } from "@workshop/look/toast";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { TOAST_STACK } from "./src/services/toast-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const { toastCommandFailures, toastCommandFailure, CommandRegistry, createToastStack, registerService, TOAST_STACK } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const stack = createToastStack();
-window.document.body.append(stack.element);
-const toasts = () =>
-  [...stack.element.querySelectorAll(".toast")].map((toast) => ({
-    text: toast.querySelector(".toast__message").textContent,
-    error: toast.classList.contains("toast-error"),
-  }));
-
-const commands = new CommandRegistry();
-const watch = toastCommandFailures(commands, stack);
-commands.register("file.save", { title: "Save", category: "File", run: () => Promise.reject(new Error("disk full")) });
-commands.register("window.reload", {
-  title: "Reload Window",
-  run: () => {
-    throw new TypeError("not a function");
-  },
-});
-commands.register("fine", { title: "Fine", run: () => {} });
-
-await commands.execute("file.save").catch(() => undefined);
-check(
-  "a rejected command raises the toast with its Category: Title label",
-  toasts().length === 1 && toasts()[0].text === "Command 'File: Save' resulted in an error",
-);
-check("the toast is an error toast", toasts()[0]?.error === true);
-check("the toast leaves the error text out", !toasts()[0]?.text.includes("disk full"));
-
-await commands.execute("window.reload").catch(() => undefined);
-check(
-  "a synchronous throw raises the toast with the bare title",
-  toasts()[0]?.text === "Command 'Reload Window' resulted in an error" && toasts().length === 2,
-);
-
-await commands.execute("fine");
-await commands.execute("missing");
-check("a command that succeeds and an unknown id raise nothing", toasts().length === 2);
-
-watch.dispose();
-await commands.execute("file.save").catch(() => undefined);
-check("a disposed subscription raises no more toasts", toasts().length === 2);
-
-// A run that bypassed the registry (the layout core's direct close) reports by hand.
-const logged = [];
-const realConsoleError = console.error;
-console.error = (...args) => logged.push(args);
-toastCommandFailure("file.save", new Error("disk full"), commands);
-check("a bare widget with no stack registered raises nothing", toasts().length === 2);
-registerService(TOAST_STACK, () => stack);
-toastCommandFailure("file.save", new Error("disk full"), commands);
-console.error = realConsoleError;
-check(
-  "a direct failure raises the same toast, labelled from the registry",
-  toasts().length === 3 && toasts()[0].text === "Command 'File: Save' resulted in an error" && toasts()[0].error,
-);
-check(
-  "a direct failure keeps its detail on the console both times",
-  logged.length === 2 && logged.every((args) => String(args[0]).includes("file.save") && args[1]?.message === "disk full"),
-);
-
-// The composition root wires the shared registry to the shared stack, right
-// after it registers the stack. A booted app cannot reach the bundle's
-// registry, so the wiring is read from the source.
-const main = await readFile(path.join(uiDir, "..", "src", "main.ts"), "utf8");
-check(
-  "main.ts toasts the shared registry's failures on the shared stack, once, after registering it",
-  /registerService\(TOAST_STACK, \(\) => toasts\);\s*disposables\.add\(toastCommandFailures\(Commands, toasts\)\);/.test(main) &&
-    main.match(/toastCommandFailures\(/g)?.length === 1,
-);
-
-if (failures.length > 0) {
-  console.error(`command-failure-toast: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("command-failure-toast: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/disconnect-recovery.mjs b/crates/workshop/ui/test/disconnect-recovery.mjs
deleted file mode 100644
index c1e7d3047..000000000
--- a/crates/workshop/ui/test/disconnect-recovery.mjs
+++ /dev/null
@@ -1,27 +0,0 @@
-// Disconnect recovery: a dropped /ws socket resets the bar to its
-// reconnecting state, and the backoff opens a replacement socket (the
-// first retry waits one second).
-// Run: node test/disconnect-recovery.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("a dropped socket reconnects", async ({ sockets, wsSocket, statusText, sleep, failures }) => {
-  const persistentSocket = wsSocket();
-  if (!persistentSocket) {
-    failures.push("no /ws socket was opened at boot");
-    return;
-  }
-  const socketCount = sockets.length;
-  persistentSocket.onclose?.();
-  if (statusText.textContent !== "Reconnecting...") {
-    failures.push("a dropped /ws socket did not reset the status bar");
-  }
-  const reconnectDeadline = Date.now() + 5000;
-  while (sockets.length === socketCount && Date.now() < reconnectDeadline) {
-    await sleep(50);
-  }
-  if (sockets.length === socketCount) {
-    failures.push("no replacement /ws socket opened after the reconnect backoff");
-  } else if (wsSocket() === persistentSocket) {
-    failures.push("the reconnect did not open a fresh /ws socket");
-  }
-});
diff --git a/crates/workshop/ui/test/disposable-adoption.mjs b/crates/workshop/ui/test/disposable-adoption.mjs
deleted file mode 100644
index 31be25a34..000000000
--- a/crates/workshop/ui/test/disposable-adoption.mjs
+++ /dev/null
@@ -1,404 +0,0 @@
-// Integration test for the Disposable adoption: representative
-// workshop components register their listeners, subscriptions, and timers
-// through the lifecycle primitives, so one root dispose() severs them all.
-// Bundles the TS modules with esbuild and drives them against jsdom built
-// from the real index.html. Covers: the Menubar releasing its
-// document-level listeners and popovers, EditorPanel disposing its surface
-// child and dirty subscription, ActivityIndicator canceling its LED decay timer,
-// and the generic panel tab dropping its title subscription (emitter delivery
-// stops after the root disposes). A final section drives WorkshopSocket
-// against a scripted fake WebSocket: emitter fan-out and unsubscribe, a
-// normal server close still reconnecting, and disposal closing the
-// socket without a disconnect fan-out or reconnect.
-// Run: node test/disposable-adoption.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { DisposableStore } from "@workshop/platform/lifecycle";
-      export { Emitter } from "@workshop/platform/event";
-      export { WorkshopSocket } from "./src/services/workshop-socket.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { StatusBar } from "./src/parts/status/status-bar.ts";
-      export { ActivityIndicator } from "./src/parts/status/activity-indicator.ts";
-      export { Menubar } from "./src/parts/menu/menubar.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Element = window.Element;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.HTMLTextAreaElement = window.HTMLTextAreaElement;
-globalThis.Node = window.Node;
-globalThis.getComputedStyle = window.getComputedStyle.bind(window);
-
-const bundlePath = path.join(os.tmpdir(), "runvil-disposable-adoption-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  DisposableStore,
-  Emitter,
-  WorkshopSocket,
-  CommandRegistry,
-  MenuRegistry,
-  MenuId,
-  ContextKeyService,
-  createKeybindingsRegistry,
-  StatusBar,
-  ActivityIndicator,
-  Menubar,
-  EditorPanel,
-  createPanelTabComponent,
-  PANEL_TAB,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-// The root of the tree under test: every component registers here and one
-// dispose() at the end must sever everything.
-const root = new DisposableStore();
-
-// --- Spy on document-level listeners ---------------------------------------
-// Every addEventListener on the document is tracked until its matching
-// removeEventListener; after the root disposes, the live count must be
-// back at the pre-setup baseline.
-
-const liveDocListeners = new Set();
-const realAddEventListener = window.document.addEventListener.bind(window.document);
-const realRemoveEventListener = window.document.removeEventListener.bind(window.document);
-window.document.addEventListener = (type, listener, options) => {
-  liveDocListeners.add(listener);
-  realAddEventListener(type, listener, options);
-};
-window.document.removeEventListener = (type, listener, options) => {
-  liveDocListeners.delete(listener);
-  realRemoveEventListener(type, listener, options);
-};
-
-// --- Menubar: document listeners and popovers -----------------------------
-
-const baselineListeners = liveDocListeners.size;
-const menuRegistry = new MenuRegistry();
-const commandRegistry = new CommandRegistry();
-commandRegistry.register("file.new", { title: "New File", run: () => {} });
-menuRegistry.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/file", title: "File", order: 1 });
-menuRegistry.appendMenuItem("menubar/file", { command: "file.new" });
-root.add(
-  new Menubar(window.document.querySelector(".ws-window-titlebar__menus"), {
-    menus: menuRegistry,
-    commands: commandRegistry,
-    contextKeys: new ContextKeyService(),
-    keybindings: createKeybindingsRegistry("linux"),
-  }),
-);
-check("the menubar registers a document-level listener", liveDocListeners.size > baselineListeners);
-const fileButton = window.document.querySelector('[data-menu="file"]');
-fileButton.click();
-const filePopover = window.document.querySelector(".ws-window-titlebar__popover");
-check("the File menu opens before disposal", filePopover !== null && filePopover.hidden === false);
-// The menu stays open into the disposal below: the open popover's own
-// document listeners (keydown, outside pointer) must release with it.
-
-// --- EditorPanel: surface child and dirty subscription ----------------------
-
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    disposeCount: 0,
-    dirty: false,
-    currentText: "",
-    open(document) {
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {
-      this.disposeCount += 1;
-    },
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-  };
-}
-
-const stub = createStubSurface();
-const titles = [];
-const panel = root.add(
-  new EditorPanel({
-    createSurface: () => stub,
-    readFile: async () => ({ path: "C:\\ws\\a.txt", size: 6, token: "t1", text: "hello\n" }),
-    writeFile: async () => {
-      throw new Error("no writes in this test");
-    },
-  }),
-);
-// The dirty state reaches the panel's tab, not its title: mount the tab the
-// dock would, under the panel's id.
-const mountEditorTab = () => {
-  const editorTab = createPanelTabComponent({ name: PANEL_TAB });
-  editorTab.init({
-    title: "a.txt",
-    api: { id: "adoption-a", component: "editor", onDidTitleChange: new Emitter().event },
-    tabLocation: "header",
-  });
-  return editorTab;
-};
-const dirtyTab = root.add(mountEditorTab());
-panel.init({
-  params: { path: "C:\\ws\\a.txt" },
-  api: { id: "adoption-a", setTitle: (title) => titles.push(title) },
-});
-await flush();
-check("the panel loads its document before disposal", stub.currentText === "hello\n");
-stub.setDirty(true);
-check(
-  "the dirty subscription delivers before disposal",
-  dirtyTab.element.classList.contains("ws-tab--dirty") && titles.at(-1) === "a.txt",
-);
-stub.setDirty(false);
-
-// --- ActivityIndicator: the LED decay timer ---------------------------------
-
-const statusBar = root.add(new StatusBar());
-const activity = root.add(new ActivityIndicator(statusBar));
-const led = window.document.querySelector('.status-bar__led[data-indicator="activity"]');
-const generatingFrame = {
-  type: "status",
-  label: "Working",
-  description: "",
-  severity: "info",
-  activity: "generating",
-  busy: false,
-};
-activity.render(generatingFrame);
-check(
-  "a generating frame lights the LED",
-  led.classList.contains("status-bar__led--green"),
-);
-// Control: while the bar is live, the decay timer clears the pulse.
-await sleep(400);
-check(
-  "the live decay timer clears the pulse",
-  !led.classList.contains("status-bar__led--green"),
-);
-// Re-arm the pulse; disposal must cancel this timer.
-activity.render(generatingFrame);
-check(
-  "the re-armed pulse lights the LED again",
-  led.classList.contains("status-bar__led--green"),
-);
-
-// --- The panel tab: the title subscription -----------------------------------
-
-const tab = root.add(createPanelTabComponent({ name: PANEL_TAB }));
-const titleChanges = new Emitter();
-tab.init({
-  title: "Workshop",
-  api: { id: "workshop", component: "workshop", onDidTitleChange: titleChanges.event },
-  tabLocation: "header",
-});
-const tabTitle = () => tab.element.querySelector(".dv-default-tab-content")?.textContent;
-check("the panel tab renders its initial title", tabTitle() === "Workshop");
-titleChanges.fire({ title: "Renamed" });
-check("the tab follows title changes before disposal", tabTitle() === "Renamed");
-
-// --- One dispose() up the tree ------------------------------------------------
-
-root.dispose();
-
-// Window menus: document listeners gone, popovers (and their row
-// listeners) out of the DOM, buttons inert.
-check(
-  "disposal releases every document-level listener the menus added",
-  liveDocListeners.size === baselineListeners,
-);
-check(
-  "disposal removes the menu popovers",
-  window.document.querySelectorAll(".ws-window-titlebar__popover").length === 0,
-);
-fileButton.click();
-check(
-  "a disposed menu button no longer opens anything",
-  window.document.querySelectorAll(".ws-window-titlebar__popover").length === 0,
-);
-
-// EditorPanel: the surface child disposed once, the dirty subscription severed.
-check("disposal reaches the panel's surface child exactly once", stub.disposeCount === 1);
-stub.setDirty(true);
-// A tab mounted after disposal would show the dot if the subscription still reached setTabDirty.
-const lateTab = mountEditorTab();
-check("the dirty subscription is severed after disposal", !lateTab.element.classList.contains("ws-tab--dirty"));
-lateTab.dispose();
-
-// ActivityIndicator: the armed decay timer was canceled, so the pulse never decays.
-await sleep(400);
-check(
-  "disposal cancels the LED decay timer",
-  led.classList.contains("status-bar__led--green"),
-);
-
-// The panel tab: emitter delivery stops.
-titleChanges.fire({ title: "After" });
-check("the disposed tab ignores title changes", tabTitle() === "Renamed");
-
-// A second root dispose is harmless.
-root.dispose();
-
-// --- WorkshopSocket: emitter fan-out, reconnect, disposal -------------------
-// A scripted fake WebSocket drives the socket through open, a
-// server-initiated close, the reconnect that must follow it, and disposal,
-// which must close the socket without a disconnect fan-out or reconnect.
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  closed = false;
-  sent = [];
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send(data) {
-    this.sent.push(data);
-  }
-  close() {
-    this.closed = true;
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  serverClose() {
-    this.readyState = 3;
-    this.onclose?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-const socket = new WorkshopSocket("ws://fake/ws");
-const statusOrder = [];
-const firstSub = socket.onStatus(() => statusOrder.push("first"));
-socket.onStatus(() => statusOrder.push("second"));
-let disconnects = 0;
-socket.onDisconnect(() => (disconnects += 1));
-// Handlers wired: declare readiness so pushes deliver instead of queueing
-// (the boot queue has its own test, boot-queue.mjs).
-socket.ready();
-
-socket.connect();
-check("connect opens one underlying socket", fakeSockets.length === 1);
-fakeSockets[0].open();
-const statusFrame = {
-  type: "status",
-  label: "Working",
-  description: "",
-  severity: "info",
-  activity: "general",
-  busy: false,
-};
-fakeSockets[0].message(statusFrame);
-check(
-  "both status subscribers receive the frame in subscription order",
-  statusOrder.join(",") === "first,second",
-);
-firstSub.dispose();
-fakeSockets[0].message(statusFrame);
-check(
-  "a disposed subscription no longer receives frames",
-  statusOrder.join(",") === "first,second,second",
-);
-
-// A server-initiated close is a dropout: the disconnect fan-out fires and
-// the backoff opens a fresh socket - disposal must not have changed this.
-fakeSockets[0].serverClose();
-check("a server-initiated close fires onDisconnect", disconnects === 1);
-await sleep(1200); // one full RECONNECT_INITIAL_MS backoff step
-check("a server-initiated close schedules a reconnect", fakeSockets.length === 2);
-
-// Disposal is not a dropout: the socket closes, but there is no
-// disconnect fan-out and no reconnect.
-fakeSockets[1].open();
-await flush();
-socket.dispose();
-check("disposal closes the underlying socket", fakeSockets[1].closed === true);
-check("disposal detaches onclose before closing", fakeSockets[1].onclose === null);
-check("disposal does not fire onDisconnect", disconnects === 1);
-const deliveredBeforeDisposal = statusOrder.length;
-fakeSockets[1].message(statusFrame);
-check("no status handler fires after disposal", statusOrder.length === deliveredBeforeDisposal);
-await sleep(1200);
-check("no reconnect happens after disposal", fakeSockets.length === 2);
-
-if (failures.length > 0) {
-  console.error(`disposable-adoption: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("disposable-adoption: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/dock-css.mjs b/crates/workshop/ui/test/dock-css.mjs
deleted file mode 100644
index f939def3d..000000000
--- a/crates/workshop/ui/test/dock-css.mjs
+++ /dev/null
@@ -1,261 +0,0 @@
-// Source-text contract for the dock's and the file tree's stylesheets
-// (src/parts/layout/zones.css, src/parts/workspace/workshop-panel.css).
-// jsdom applies no layout, so the values are read from the files and followed
-// through the token sheets (test/helpers/css-values.mjs) down to the literals
-// Cursor's workbench uses. Covers: the dockview palette (groups #181818, the
-// tab strip #141414, active tab #181818 and inactive #141414, tab text #F0F0F0
-// and #F0F0F05C with #F0F0F0BD in unfocused groups, separators #F0F0F013, the
-// drop overlay #F0F0F011, the sash lighting #F0F0F026 after 300ms over 100ms);
-// the editor tabs (35px tall, 10px left padding, at least 120px wide, a 1px
-// right border and strip underline, the active tab's #181818 underline, the
-// hover wash only in unfocused groups); the close button (20x20 in a 28px
-// slot, a 5px radius, hidden until the tab is hovered or active, half visible
-// outside the active group, a dot in its place on a dirty tab until hover);
-// the empty editor group (strip hidden, #141414); the left zone's pills; and
-// the tree (full-width rows driven by a depth variable, the twistie box, the
-// indent guides, the section header with hover actions, the drag pill).
-// Run: node test/dock-css.mjs
-import { declaration, readUi, resolver, rulesOf, valueIn } from "./helpers/css-values.mjs";
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const resolve = await resolver();
-const zones = rulesOf(await readUi("src/parts/layout/zones.css"));
-const tree = rulesOf(await readUi("src/parts/workspace/workshop-panel.css"));
-const zone = (selector, property, at = null) => resolve(valueIn(zones, selector, property, at));
-const treeValue = (selector, property, at = null) => resolve(valueIn(tree, selector, property, at));
-
-// --- The dockview palette ---------------------------------------------------------------
-
-// Dockview puts the theme class on its shell element, inside the #dock element.
-const DOCK = ".ws-dock .dockview-theme-dark";
-check("groups are #181818", zone(DOCK, "--dv-group-view-background-color") === "#181818");
-check("the tab strip is #141414", zone(DOCK, "--dv-tabs-and-actions-container-background-color") === "#141414");
-check("the strip is 35px tall", zone(DOCK, "--dv-tabs-and-actions-container-height") === "35px");
-check(
-  "the active tab is #181818 in every group state",
-  zone(DOCK, "--dv-activegroup-visiblepanel-tab-background-color") === "#181818" &&
-    zone(DOCK, "--dv-inactivegroup-visiblepanel-tab-background-color") === "#181818",
-);
-check(
-  "an inactive tab is #141414 in every group state",
-  zone(DOCK, "--dv-activegroup-hiddenpanel-tab-background-color") === "#141414" &&
-    zone(DOCK, "--dv-inactivegroup-hiddenpanel-tab-background-color") === "#141414",
-);
-check(
-  "an inactive tab's text is #F0F0F05C",
-  zone(DOCK, "--dv-activegroup-hiddenpanel-tab-color") === "#f0f0f05c" &&
-    zone(DOCK, "--dv-inactivegroup-hiddenpanel-tab-color") === "#f0f0f05c",
-);
-check(
-  "an unfocused group's active tab text is #F0F0F0BD",
-  zone(DOCK, "--dv-activegroup-visiblepanel-tab-color") === "#f0f0f0bd" &&
-    zone(DOCK, "--dv-inactivegroup-visiblepanel-tab-color") === "#f0f0f0bd",
-);
-check(
-  "the Workshop's active group reads #F0F0F0 whatever Dockview thinks is active",
-  zone(".ws-dock [data-ws-active-group]", "--dv-activegroup-visiblepanel-tab-color") === "#f0f0f0" &&
-    zone(".ws-dock [data-ws-active-group]", "--dv-inactivegroup-visiblepanel-tab-color") === "#f0f0f0",
-);
-check("separators are #F0F0F013", zone(DOCK, "--dv-separator-border") === "#f0f0f013");
-check("the drop overlay is #F0F0F011", zone(DOCK, "--dv-drag-over-background-color") === "#f0f0f011");
-check("the tab drop line is #F0F0F0", zone(DOCK, "--dv-drag-over-border-color") === "#f0f0f0");
-check(
-  "a hovered sash lights #F0F0F026",
-  zone(DOCK, "--dv-active-sash-color") === "color-mix(in srgb, #f0f0f0 15%, transparent)",
-);
-check("a sash lights after 300ms", zone(DOCK, "--dv-active-sash-transition-delay") === "300ms");
-check("a sash fades in over 100ms", zone(DOCK, "--dv-active-sash-transition-duration") === "100ms");
-check("tab close hovers are #5A5D5E50", zone(DOCK, "--dv-icon-hover-background-color") === "#5a5d5e50");
-
-// --- The editor tabs ------------------------------------------------------------------------
-
-const MAIN = '[data-ws-zone="main"]';
-check("a tab is at least 120px wide", zone(`${MAIN} .dv-tab`, "min-inline-size") === "120px");
-check("a tab has a 1px #F0F0F013 right border", zone(`${MAIN} .dv-tab`, "border-inline-end") === "1px solid #f0f0f013");
-check(
-  "the strip has a 1px #F0F0F013 underline",
-  (zone(`${MAIN} .dv-tabs-and-actions-container`, "box-shadow") ?? "").includes("#f0f0f013"),
-);
-check(
-  "the active tab's underline is #181818, so it merges into the editor",
-  (zone(`${MAIN} .dv-tab.dv-active-tab`, "box-shadow") ?? "").includes("#181818"),
-);
-check(
-  "Dockview's own tab dividers are dropped for the right border",
-  zone(`.ws-dock ${MAIN} .dv-tabs-container .dv-tab:not(:first-child)::before`, "display") === "none",
-);
-check("a tab has a 10px left padding", zone(`${MAIN} .dv-tab .dv-default-tab`, "padding-inline-start") === "10px");
-check(
-  "a tab with no close button has a 10px right padding",
-  zone(`${MAIN} .dv-tab .dv-default-tab.ws-tab--no-close`, "padding-inline-end") === "10px",
-);
-check("tab text is 13px", zone(DOCK, "--dv-tab-font-size") === "13px");
-check(
-  "the hover wash is #2A2A2AB3 by default",
-  zone(DOCK, "--ws-tab-hover-wash") === "#2a2a2ab3",
-);
-check(
-  "the active group and the side zones take no hover wash",
-  zone(".ws-dock [data-ws-active-group]", "--ws-tab-hover-wash") === "transparent" &&
-    zone('.ws-dock [data-ws-zone="left"]', "--ws-tab-hover-wash") === "transparent" &&
-    zone('.ws-dock [data-ws-zone="right"]', "--ws-tab-hover-wash") === "transparent",
-);
-check(
-  "a hovered editor tab draws the wash",
-  (zone(`${MAIN} .dv-tab:hover`, "background-image") ?? "").includes("--ws-tab-hover-wash"),
-);
-
-// --- The close button -----------------------------------------------------------------------
-
-const ACTION = `${MAIN} .dv-tab .dv-default-tab .dv-default-tab-action`;
-check("the close button is 20px wide and tall", zone(ACTION, "inline-size") === "20px" && zone(ACTION, "block-size") === "20px");
-check("the close button sits in a 28px slot: 20px and 4px each side", zone(ACTION, "margin-inline") === "4px");
-check("the close button has a 5px radius", zone(ACTION, "border-radius") === "5px");
-check("the close button is hidden by default", zone(ACTION, "opacity") === "0");
-check("the close button hovers #5A5D5E50", zone(`${ACTION}:hover`, "background-color") === "#5a5d5e50");
-check(
-  "the close button is fully visible on the active tab of the active group",
-  zone(`[data-ws-active-group] .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action`, "opacity") === "1",
-);
-check(
-  "the close button is fully visible on a hovered tab of the active group",
-  zone(`[data-ws-active-group] .dv-tab:hover .dv-default-tab .dv-default-tab-action`, "opacity") === "1",
-);
-check(
-  "the close button is half visible on the active tab of another group",
-  zone(`${MAIN}:not([data-ws-active-group]) .dv-tab.dv-active-tab .dv-default-tab .dv-default-tab-action`, "opacity") === "0.5",
-);
-check(
-  "the close button is half visible on a hovered tab of another group",
-  zone(`${MAIN}:not([data-ws-active-group]) .dv-tab:hover .dv-default-tab .dv-default-tab-action`, "opacity") === "0.5",
-);
-
-// --- The dirty dot ----------------------------------------------------------------------------
-
-const DOT = `${MAIN} .dv-default-tab.ws-tab--dirty::after`;
-check("a dirty tab draws an 8px dot", zone(DOT, "inline-size") === "8px" && zone(DOT, "block-size") === "8px");
-check("the dot is round", zone(DOT, "border-radius") === "9999px");
-check("the dot sits where the close button's centre is: 10px from the edge", zone(DOT, "inset-inline-end") === "10px");
-check("hovering the tab takes the dot away", zone(`${MAIN} .dv-default-tab.ws-tab--dirty:hover::after`, "display") === "none");
-check(
-  "the close button stays out of sight on a dirty tab until the tab is hovered",
-  zone(`${MAIN} .dv-tab .dv-default-tab.ws-tab--dirty:not(:hover) .dv-default-tab-action`, "visibility") === "hidden",
-);
-
-// --- The empty editor group ---------------------------------------------------------------------
-
-const EMPTY = `${MAIN}[data-ws-empty]`;
-check("an empty editor group is #141414", zone(EMPTY, "--dv-group-view-background-color") === "#141414");
-check("an empty editor group hides its tab strip", zone(`${EMPTY} .dv-tabs-and-actions-container`, "display") === "none");
-
-// --- The left zone's header ---------------------------------------------------------------------
-
-const LEFT = '[data-ws-zone="left"]';
-check("the left header's tabs are centered", zone(`${LEFT} .dv-tabs-container`, "justify-content") === "center");
-check("the left header's pills are 2px apart", zone(`${LEFT} .dv-tabs-container`, "gap") === "2px");
-check("a pill is 22px tall", zone(`${LEFT} .dv-tab .dv-default-tab`, "block-size") === "22px");
-check("a pill has a 4px radius", zone(`${LEFT} .dv-tab .dv-default-tab`, "border-radius") === "4px");
-check(
-  "a pill reads 12px at weight 500",
-  zone(`${LEFT} .dv-tab .dv-default-tab`, "font-size") === "12px" &&
-    zone(`${LEFT} .dv-tab .dv-default-tab`, "font-weight") === "500",
-);
-check("a pill's text is #F0F0F0BD", zone(`${LEFT} .dv-tab .dv-default-tab`, "color") === "#f0f0f0bd");
-check("a hovered pill is #F0F0F011", zone(`${LEFT} .dv-tab .dv-default-tab:hover`, "background-color") === "#f0f0f011");
-
-// --- The tree ----------------------------------------------------------------------------------------
-
-check("the tree has no padding", treeValue(".ws-workshop-tree", "padding") === "0");
-check(
-  "the tree reserves no scrollbar gutter",
-  [undefined, "auto"].includes(valueIn(tree, ".ws-workshop-tree", "scrollbar-gutter")),
-);
-check("tree text is #F0F0F0BD", treeValue(".ws-workshop-tree__row", "color") === "#f0f0f0bd");
-check("a row spans the tree", treeValue(".ws-workshop-tree__row", "inline-size") === "100%");
-check("a row is 22px tall", treeValue(".ws-workshop-tree__row", "block-size") === "22px");
-check("a row has a 4px inset", treeValue(".ws-workshop-tree__row", "padding-inline-start") === "4px");
-check("a hovered row is #F0F0F011", treeValue(".ws-workshop-tree__row:hover", "background-color") === "#f0f0f011");
-check("a focused row is #F0F0F01E", treeValue(".ws-workshop-tree__row:focus-visible", "background-color") === "#f0f0f01e");
-check(
-  "a focused row draws the 1px #F0F0F026 outline inside itself",
-  treeValue(".ws-workshop-tree__row:focus-visible", "outline") === "1px solid color-mix(in srgb, #f0f0f0 15%, transparent)" &&
-    treeValue(".ws-workshop-tree__row:focus-visible", "outline-offset") === "-1px",
-);
-check(
-  "the twistie box is 8px per depth plus 16px plus 6px",
-  treeValue(".ws-workshop-tree__twistie", "inline-size") === "calc(var(--ws-tree-depth) * 8px + 16px + 6px)",
-);
-check(
-  "the twistie's chevron indents 8px per depth",
-  treeValue(".ws-workshop-tree__twistie", "padding-inline-start") === "calc(var(--ws-tree-depth) * 8px)",
-);
-check(
-  "a collapsed folder's chevron is turned -90deg",
-  treeValue('.ws-workshop-tree__row[aria-expanded="false"] .ws-workshop-tree__twistie svg', "transform") ===
-    "rotate(-90deg)",
-);
-check(
-  "an indent guide is a 1px line at 20px plus 8px per level",
-  treeValue(".ws-workshop-tree__children::before", "inset-inline-start") ===
-    "calc(20px + (var(--ws-tree-depth) - 1) * 8px)" &&
-    treeValue(".ws-workshop-tree__children::before", "inline-size") === "1px",
-);
-check(
-  "guides are #F0F0F013 while the tree is hovered",
-  treeValue(".ws-workshop-tree:hover", "--ws-tree-guide") === "#f0f0f013",
-);
-check(
-  "the list holding the focused row lights its own guide #F0F0F030",
-  treeValue(".ws-workshop-tree__children--focused::before", "background-color") === "#f0f0f030",
-);
-// A custom property inherits, so a lit color carried on --ws-tree-guide by the
-// focused list would reach every expanded list nested inside it (workshop-zones
-// pins that only the list holding the focused row has the focused class).
-check(
-  "the lit color is not carried by an inherited custom property",
-  tree
-    .filter((rule) => declaration(rule.body, "--ws-tree-guide") !== undefined)
-    .flatMap((rule) => rule.selectors)
-    .join("|") === ".ws-workshop-tree:hover",
-);
-check(
-  "the focused guide's rule follows the base guide's, so it wins at equal specificity",
-  tree.findIndex((rule) => rule.selectors.includes(".ws-workshop-tree__children--focused::before")) >
-    tree.findIndex((rule) => rule.selectors.includes(".ws-workshop-tree__children::before")),
-);
-check("the section header sits on #141414", treeValue(".ws-workshop-tree__header", "background-color") === "#141414");
-check(
-  "the section header has no bottom border",
-  [undefined, "0", "none"].includes(valueIn(tree, ".ws-workshop-tree__header", "border-bottom")),
-);
-check("the section title is #F0F0F05C", treeValue(".ws-workshop-tree__section-title", "color") === "#f0f0f05c");
-check("the section chevron is 16px", treeValue(".ws-workshop-tree__section-chevron", "inline-size") === "16px");
-check("header actions are hidden until the header is hovered", treeValue(".ws-workshop-tree__actions", "opacity") === "0");
-check(
-  "hovering or focusing within the header shows its actions",
-  treeValue(".ws-workshop-tree__header:hover .ws-workshop-tree__actions", "opacity") === "1" &&
-    treeValue(".ws-workshop-tree__header:focus-within .ws-workshop-tree__actions", "opacity") === "1",
-);
-check(
-  "a header action is a 20px button with a 5px radius",
-  treeValue(".ws-workshop-tree__add", "inline-size") === "20px" &&
-    treeValue(".ws-workshop-tree__add", "block-size") === "20px" &&
-    treeValue(".ws-workshop-tree__add", "border-radius") === "5px",
-);
-check(
-  "the drag pill is #F0F0F01E with a 10px radius and 12px text",
-  treeValue(".ws-workshop-tree__drag-pill", "background-color") === "#f0f0f01e" &&
-    treeValue(".ws-workshop-tree__drag-pill", "border-radius") === "10px" &&
-    treeValue(".ws-workshop-tree__drag-pill", "font-size") === "12px",
-);
-
-if (failures.length > 0) {
-  console.error(`dock-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("dock-css: all assertions passed");
diff --git a/crates/workshop/ui/test/drop-position.mjs b/crates/workshop/ui/test/drop-position.mjs
deleted file mode 100644
index 5fd6498ec..000000000
--- a/crates/workshop/ui/test/drop-position.mjs
+++ /dev/null
@@ -1,143 +0,0 @@
-// The dock's drop-position resolver and theme (src/parts/layout/drop-position.ts
-// and src/parts/layout/dock-theme.ts), the two options main.ts hands Dockview
-// for Cursor's drag-to-dock behavior. The drop target is cut in thirds, and
-// the middle ninth is the center. Where two edges claim the pointer (a
-// corner), the nearer one wins, measured against the target's own size. A
-// pointer within 10% of an edge is inside that edge's third and nearer it than
-// any other edge, so it docks there with no rule of its own (a band branch
-// ahead of the thirds could never change an answer). A target that does not
-// accept the chosen position falls back to the center, and one that accepts
-// nothing answers null. The theme is the dark theme with the thin insertion
-// line for tab drops.
-// Run: node test/drop-position.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { dropPositionResolver, resolveDropPosition } from "./src/parts/layout/drop-position.ts";
-      export { dockTheme } from "./src/parts/layout/dock-theme.ts";
-      export { themeDark } from "dockview";
-    `,
-    resolveDir: uiDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const bundlePath = path.join(os.tmpdir(), "runvil-drop-position-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { dropPositionResolver, resolveDropPosition, dockTheme, themeDark } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const ALL = new Set(["top", "bottom", "left", "right", "center"]);
-/** The position a pointer at (x, y) percent of a 1000 x 600 target resolves to. */
-function at(xPercent, yPercent, zones = ALL) {
-  const result = resolveDropPosition({
-    x: (xPercent / 100) * 1000,
-    y: (yPercent / 100) * 600,
-    width: 1000,
-    height: 600,
-    zones,
-    event: {},
-  });
-  return result === null ? null : result.position;
-}
-
-// --- The middle ninth is the center -------------------------------------------------
-
-check("the middle of the target is the center", at(50, 50) === "center");
-check("just inside the middle ninth is still the center", at(40, 40) === "center" && at(60, 60) === "center");
-
-// --- A pointer within a tenth of an edge docks against that edge -------------------
-// No rule of its own: such a pointer is in that edge's third and nearer it than
-// any other edge, so the thirds below already send it there.
-
-check("the left edge docks left", at(3, 50) === "left");
-check("the right edge docks right", at(97, 50) === "right");
-check("the top edge docks top", at(50, 2) === "top");
-check("the bottom edge docks bottom", at(50, 98) === "bottom");
-{
-  // Wherever along an edge the pointer is, up to a tenth in from it (clear of the
-  // corners, where two edges are that close and the nearer one wins instead).
-  let wrong = 0;
-  for (let along = 15; along <= 85; along += 5) {
-    for (const across of [0, 1, 5, 9.9]) {
-      if (at(across, along) !== "left") wrong += 1;
-      if (at(100 - across, along) !== "right") wrong += 1;
-      if (at(along, across) !== "top") wrong += 1;
-      if (at(along, 100 - across) !== "bottom") wrong += 1;
-    }
-  }
-  check("a pointer within a tenth of an edge docks there all along that edge", wrong === 0);
-}
-check(
-  "a pointer is measured against the target's own size, not in pixels",
-  // 20% across a 1000px target is 200px from the left edge and 25% down a 600px target is
-  // 150px from the top edge: pixels would pick the top, fractions pick the nearer edge, the left.
-  at(20, 25) === "left",
-);
-// --- Outside the bands the target is cut in thirds ----------------------------------
-
-check("the left third docks left", at(20, 50) === "left");
-check("the right third docks right", at(80, 50) === "right");
-check("the top third docks top", at(50, 20) === "top");
-check("the bottom third docks bottom", at(50, 80) === "bottom");
-check("a corner cell goes to the nearer edge: nearer the top", at(30, 15) === "top");
-check("a corner cell goes to the nearer edge: nearer the left", at(15, 30) === "left");
-check("a corner cell goes to the nearer edge: nearer the right", at(85, 30) === "right");
-check("a corner cell goes to the nearer edge: nearer the bottom", at(70, 85) === "bottom");
-
-// --- A target accepts only some positions --------------------------------------------
-
-const sidesOnly = new Set(["left", "right", "center"]);
-check("a position the target accepts is kept", at(10, 50, sidesOnly) === "left");
-check("a position the target refuses falls back to the center", at(50, 5, sidesOnly) === "center");
-check("a center-only target takes every pointer as the center", at(2, 2, new Set(["center"])) === "center");
-check("a target accepting nothing answers null", at(50, 50, new Set()) === null);
-check(
-  "a target with no area is the center",
-  resolveDropPosition({ x: 0, y: 0, width: 0, height: 0, zones: ALL, event: {} })?.position === "center",
-);
-
-// --- The resolver object is what Dockview takes --------------------------------------
-
-check(
-  "the exported resolver resolves through the same function",
-  dropPositionResolver.resolve({ x: 30, y: 300, width: 1000, height: 600, zones: ALL, event: {} })?.position ===
-    "left",
-);
-check("a resolved position carries no edge marker", at(3, 50) === "left" && resolveDropPosition({ x: 30, y: 300, width: 1000, height: 600, zones: ALL, event: {} })?.edge === undefined);
-
-// --- The theme: dark, with the thin insertion line -----------------------------------
-
-check("the dock theme shows tab drops as a thin line", dockTheme.dndTabIndicator === "line");
-check(
-  "the dock theme is the dark theme otherwise",
-  dockTheme.className === themeDark.className && dockTheme.colorScheme === themeDark.colorScheme,
-);
-
-if (failures.length > 0) {
-  console.error(`drop-position: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("drop-position: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/dropdown-bundle-css.mjs b/crates/workshop/ui/test/dropdown-bundle-css.mjs
deleted file mode 100644
index c81e9b5f1..000000000
--- a/crates/workshop/ui/test/dropdown-bundle-css.mjs
+++ /dev/null
@@ -1,32 +0,0 @@
-// Reads the packaged dist/app.css and asserts the action menu's rules
-// (@workshop/look/dropdown.css) landed in it: the vendored predecessor's
-// stylesheet had silently dropped out of the bundle, leaving the menu
-// unstyled. Whitespace-tolerant: the packaged bundle minifies to `.x{`
-// while the debug build that `cargo build` writes emits `.x {`; both must
-// include the rules.
-// Run: node test/dropdown-bundle-css.mjs (after `npm run build`).
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const distDir = path.join(uiDir, "..", "dist");
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The bundled stylesheet's name is content-hashed; the build's manifest
-// maps the logical name to it.
-const manifest = JSON.parse(await readFile(path.join(distDir, "manifest.json"), "utf8"));
-const appCss = await readFile(path.join(distDir, manifest["app.css"]), "utf8");
-check("the bundled app.css includes the menu surface rules", /\.menu-item\s*\{/.test(appCss));
-check("the bundled app.css includes the popup menu's rules", /\.menu-popup\s*\{/.test(appCss));
-
-if (failures.length > 0) {
-  console.error(`dropdown-bundle-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("dropdown-bundle-css: all assertions passed");
diff --git a/crates/workshop/ui/test/editor-commands.mjs b/crates/workshop/ui/test/editor-commands.mjs
deleted file mode 100644
index 64c623919..000000000
--- a/crates/workshop/ui/test/editor-commands.mjs
+++ /dev/null
@@ -1,1061 +0,0 @@
-// Unit test for the editor commands catalog
-// (src/parts/editor/editor-commands.ts and editor.contribution.ts) and the
-// editor lifecycle (untitled buffers, the closed-editor
-// stack, the CodeMirror text-control adapter, the ":" go-to-line
-// provider, recent-files recording, and the activeEditor/editorLangId
-// context keys). Every
-// CodeMirror-backed catalog row is driven against a real EditorState -
-// comment toggles, line copy/move, duplicate selection, cursor add rows,
-// occurrence rows, bracket jump - or against a real EditorView in jsdom
-// for the view commands (find, replace, smart select with its selection
-// stack, diagnostic navigation). runInActiveEditor, withActiveEditor,
-// and splitActiveEditor run against a stub dock, and the contribution's
-// registry wiring (menu
-// rows, palette rows, keybinding rules, the lazy run path) is asserted
-// on the shared registries. Bundles the modules with esbuild and drives
-// them in jsdom with the same measurement shims as editor-idioms.mjs.
-// Run: node --test test/editor-commands.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/editor/editor.contribution.ts";
-      export * as editorCommands from "./src/parts/editor/editor-commands.ts";
-      export * as editorLifecycle from "./src/parts/editor/editor-lifecycle.ts";
-      export { ClosedEditors } from "./src/parts/editor/closed-editors.ts";
-      export { CLOSED_EDITORS } from "./src/services/closed-editors.ts";
-      export { parseLineColumn, createGotoLineProvider } from "./src/parts/editor/goto-line.ts";
-      export { EditorState, EditorSelection } from "@codemirror/state";
-      export { EditorView } from "@codemirror/view";
-      export { search } from "@codemirror/search";
-      export { createFindWidget } from "./src/parts/editor/find-widget.ts";
-      export { javascript } from "@codemirror/lang-javascript";
-      export { ensureSyntaxTree } from "@codemirror/language";
-      export { setDiagnostics } from "@codemirror/lint";
-      export { registerService, getService } from "@workshop/platform/service-registry";
-      export { DOCK } from "@workshop/platform/panel-registry";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { CodeMirrorSurface } from "./src/parts/editor/editor-surface.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus, MenuId } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { RECENT_FILES_STORE } from "./src/services/recent-files-store.ts";
-      export { TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-      export { bindActiveEditorKey, initZones } from "./src/parts/layout/zones.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-// CodeMirror measures text through Range, which jsdom does not layout;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-if (!window.HTMLElement.prototype.getBoundingClientRect) {
-  window.HTMLElement.prototype.getBoundingClientRect = zeroRect;
-}
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-for (const key of [
-  "document",
-  "navigator",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLTextAreaElement",
-  "Node",
-  "Element",
-  "Range",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The contribution registers at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-commands-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  editorCommands,
-  editorLifecycle,
-  ClosedEditors,
-  CLOSED_EDITORS,
-  parseLineColumn,
-  createGotoLineProvider,
-  EditorState,
-  EditorSelection,
-  EditorView,
-  search,
-  createFindWidget,
-  javascript,
-  ensureSyntaxTree,
-  setDiagnostics,
-  registerService,
-  getService,
-  DOCK,
-  EditorPanel,
-  CodeMirrorSurface,
-  Commands,
-  Menus,
-  MenuId,
-  KeybindingsRegistry,
-  QuickAccessRegistry,
-  CONTEXT_KEY_SERVICE,
-  RECENT_FILES_STORE,
-  TEXT_CONTROL_SERVICE,
-  bindActiveEditorKey,
-  initZones,
-} = await import(pathToFileURL(bundlePath).href);
-console.error = realConsoleError;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-/** Runs a StateCommand against a real EditorState, capturing the dispatch. */
-function runState(command, doc, selection, extensions = []) {
-  // allowMultipleSelections mirrors the surface's basicSetup: without it
-  // the state normalizes added cursors away.
-  const state = EditorState.create({
-    doc,
-    selection,
-    extensions: [EditorState.allowMultipleSelections.of(true), ...extensions],
-  });
-  let next = null;
-  const result = command({ state, dispatch: (tr) => { next = tr.state; } });
-  return { result, state: next ?? state };
-}
-
-/** Builds a real EditorView attached to the jsdom document. */
-function makeView(doc, selection, extensions = []) {
-  const parent = window.document.createElement("div");
-  window.document.body.appendChild(parent);
-  return new EditorView({
-    state: EditorState.create({
-      doc,
-      selection,
-      extensions: [EditorState.allowMultipleSelections.of(true), ...extensions],
-    }),
-    parent,
-  });
-}
-
-const selJson = (view) => JSON.stringify(view.state.selection.ranges.map((r) => [r.from, r.to]));
-
-{
-  // Comment toggles against a real javascript state.
-  const commented = runState(editorCommands.toggleLineComment, "let a = 1;\n", EditorSelection.single(4), [javascript()]);
-  check("toggleLineComment comments the cursor line", commented.result === true && commented.state.doc.toString() === "// let a = 1;\n");
-  const restored = runState(editorCommands.toggleLineComment, "// let a = 1;\n", EditorSelection.single(5), [javascript()]);
-  check("toggleLineComment uncomments a commented line", restored.result === true && restored.state.doc.toString() === "let a = 1;\n");
-  const block = runState(editorCommands.toggleBlockComment, "let a = 1;\n", EditorSelection.range(4, 5), [javascript()]);
-  check("toggleBlockComment wraps the selection", block.result === true && block.state.doc.toString() === "let /* a */ = 1;\n");
-}
-
-{
-  // Line copy and move.
-  const copyDown = runState(editorCommands.copyLineDown, "one\ntwo\n", EditorSelection.single(1));
-  check("copyLineDown duplicates the line below", copyDown.result === true && copyDown.state.doc.toString() === "one\none\ntwo\n");
-  const copyUp = runState(editorCommands.copyLineUp, "one\ntwo\n", EditorSelection.single(5));
-  check("copyLineUp duplicates the line above", copyUp.result === true && copyUp.state.doc.toString() === "one\ntwo\ntwo\n");
-  const moveDown = runState(editorCommands.moveLineDown, "one\ntwo\n", EditorSelection.single(1));
-  check("moveLineDown swaps the line down", moveDown.result === true && moveDown.state.doc.toString() === "two\none\n");
-  const moveUp = runState(editorCommands.moveLineUp, "one\ntwo\n", EditorSelection.single(5));
-  check("moveLineUp swaps the line up", moveUp.result === true && moveUp.state.doc.toString() === "two\none\n");
-}
-
-{
-  // Duplicate Selection: empty ranges copy the line down; non-empty
-  // ranges insert the selected text after each range and select the copy.
-  const empty = runState(editorCommands.duplicateSelection, "one\ntwo\n", EditorSelection.single(1));
-  check("duplicateSelection on an empty range copies the line down", empty.result === true && empty.state.doc.toString() === "one\none\ntwo\n");
-  const single = runState(editorCommands.duplicateSelection, "ab cd", EditorSelection.range(0, 2));
-  check("duplicateSelection inserts the selected text after the range", single.result === true && single.state.doc.toString() === "abab cd");
-  check("duplicateSelection selects the inserted copy", single.state.selection.main.from === 2 && single.state.selection.main.to === 4);
-  const multi = runState(
-    editorCommands.duplicateSelection,
-    "ab cd",
-    EditorSelection.create([EditorSelection.range(0, 2), EditorSelection.range(3, 5)]),
-  );
-  check("duplicateSelection duplicates every range", multi.state.doc.toString() === "abab cdcd");
-  check(
-    "duplicateSelection selects both copies at their mapped positions",
-    multi.state.selection.ranges.length === 2 &&
-      multi.state.selection.ranges[0].from === 2 && multi.state.selection.ranges[0].to === 4 &&
-      multi.state.selection.ranges[1].from === 7 && multi.state.selection.ranges[1].to === 9,
-  );
-}
-
-{
-  // Add Cursor Above / Below: one new cursor per head, same column,
-  // clamped to the target line's end; a no-op past the document edge.
-  const below = runState(editorCommands.insertCursorBelow, "ab\nxy\n", EditorSelection.cursor(1));
-  check(
-    "insertCursorBelow adds a cursor one line down at the same column",
-    below.result === true && below.state.selection.ranges.length === 2 && below.state.selection.ranges[1].head === 4,
-  );
-  const clamped = runState(editorCommands.insertCursorBelow, "abc\nx\n", EditorSelection.cursor(2));
-  check("insertCursorBelow clamps the column to a shorter line", clamped.state.selection.ranges[1].head === 5);
-  const above = runState(editorCommands.insertCursorAbove, "ab\nxy\n", EditorSelection.cursor(4));
-  check(
-    "insertCursorAbove adds a cursor one line up",
-    above.result === true && above.state.selection.ranges.length === 2 && above.state.selection.ranges[0].head === 1,
-  );
-  const topEdge = runState(editorCommands.insertCursorAbove, "ab\nxy\n", EditorSelection.cursor(1));
-  check("insertCursorAbove on the first line is a no-op", topEdge.result === false && topEdge.state.selection.main.head === 1);
-  const bottomEdge = runState(editorCommands.insertCursorBelow, "ab\nxy", EditorSelection.cursor(4));
-  check("insertCursorBelow on the last line is a no-op", bottomEdge.result === false);
-}
-
-{
-  // Add Cursors to Line Ends: one cursor per touched line; a selection
-  // ending exactly at a line start does not touch that line.
-  const ends = runState(editorCommands.insertCursorAtLineEnds, "aa\nbb\ncc", EditorSelection.range(0, 4));
-  check(
-    "insertCursorAtLineEnds adds a cursor at every touched line's end",
-    ends.result === true &&
-      ends.state.selection.ranges.length === 2 &&
-      ends.state.selection.ranges[0].head === 2 &&
-      ends.state.selection.ranges[1].head === 5,
-  );
-  const trailing = runState(editorCommands.insertCursorAtLineEnds, "aa\nbb\ncc", EditorSelection.range(0, 3));
-  check(
-    "a selection ending at a line start does not touch that line",
-    trailing.state.selection.ranges.length === 1 && trailing.state.selection.ranges[0].head === 2,
-  );
-}
-
-{
-  // Occurrence rows: next, previous (custom, backwards and wrapping),
-  // and select-all.
-  const next = runState(editorCommands.selectNextOccurrence, "foo bar foo", EditorSelection.range(0, 3));
-  check(
-    "selectNextOccurrence adds the next match",
-    next.result === true && next.state.selection.ranges.length === 2 &&
-      next.state.selection.ranges[1].from === 8 && next.state.selection.ranges[1].to === 11,
-  );
-  const previous = runState(editorCommands.selectPreviousOccurrence, "foo bar foo", EditorSelection.range(8, 11));
-  check(
-    "selectPreviousOccurrence adds the previous match",
-    previous.result === true && previous.state.selection.ranges.length === 2 &&
-      previous.state.selection.ranges[0].from === 0 && previous.state.selection.ranges[0].to === 3,
-  );
-  const wraps = runState(editorCommands.selectPreviousOccurrence, "foo bar foo", EditorSelection.range(0, 3));
-  check(
-    "selectPreviousOccurrence wraps to the last match",
-    wraps.result === true && wraps.state.selection.ranges.length === 2 && wraps.state.selection.ranges[1].from === 8,
-  );
-  const emptySel = runState(editorCommands.selectPreviousOccurrence, "foo bar foo", EditorSelection.cursor(4));
-  check("selectPreviousOccurrence on an empty selection is a no-op", emptySel.result === false);
-  const only = runState(editorCommands.selectPreviousOccurrence, "foo bar", EditorSelection.range(0, 3));
-  check("selectPreviousOccurrence with only the selected match is a no-op", only.result === false);
-  const all = runState(editorCommands.selectSelectionMatches, "foo bar foo", EditorSelection.range(0, 3));
-  check("selectSelectionMatches selects every match", all.result === true && all.state.selection.ranges.length === 2);
-}
-
-{
-  // Go to Bracket.
-  const jump = runState(editorCommands.cursorMatchingBracket, "(ab)", EditorSelection.cursor(1));
-  check("cursorMatchingBracket jumps to the matching bracket", jump.result === true && jump.state.selection.main.head === 3);
-}
-
-{
-  // Find and Replace open the search panel; Replace focuses the
-  // replace field.
-  const findView = makeView("alpha\nbeta\n", EditorSelection.cursor(0));
-  check("openSearchPanel opens the search panel", editorCommands.openSearchPanel(findView) === true);
-  check("the search panel is in the editor DOM", findView.dom.querySelector(".cm-panel") !== null);
-  findView.destroy();
-
-  const replaceView = makeView("alpha\nbeta\n", EditorSelection.cursor(0));
-  check("startFindReplace opens the panel", editorCommands.startFindReplace(replaceView) === true);
-  const replaceInput = replaceView.dom.querySelector("input[name=replace]");
-  check(
-    "startFindReplace focuses the replace field",
-    replaceInput !== null && window.document.activeElement === replaceInput,
-  );
-  replaceView.destroy();
-
-  // With Cursor's find widget, the replace row is hidden until revealed, so
-  // Replace must show it before it can focus the field.
-  const widgetView = makeView("alpha\nbeta\n", EditorSelection.cursor(0), [search({ createPanel: createFindWidget })]);
-  check(
-    "Find opens the widget with the replace row hidden",
-    editorCommands.openSearchPanel(widgetView) === true &&
-      widgetView.dom.querySelector(".ws-find-widget")?.dataset.replace === "false",
-  );
-  const widgetReplaceView = makeView("alpha\nbeta\n", EditorSelection.cursor(0), [search({ createPanel: createFindWidget })]);
-  check("startFindReplace opens the find widget", editorCommands.startFindReplace(widgetReplaceView) === true);
-  const widget = widgetReplaceView.dom.querySelector(".ws-find-widget");
-  check("startFindReplace shows the widget's replace row", widget?.dataset.replace === "true");
-  const widgetReplaceInput = widgetReplaceView.dom.querySelector("input[name=replace]");
-  check(
-    "startFindReplace focuses the widget's replace field",
-    widgetReplaceInput !== null && window.document.activeElement === widgetReplaceInput,
-  );
-  widgetView.destroy();
-  widgetReplaceView.destroy();
-}
-
-{
-  // Smart select: expand pushes the pre-expansion selection, shrink
-  // pops and restores it, and an empty stack is a no-op.
-  const view = makeView("const x = foo(1, 2);\n", EditorSelection.cursor(15), [javascript()]);
-  ensureSyntaxTree(view.state, view.state.doc.length);
-  const original = selJson(view);
-  check(
-    "smartSelectExpand grows the cursor into a node selection",
-    editorCommands.smartSelectExpand(view) === true && !view.state.selection.main.empty,
-  );
-  const expanded1 = selJson(view);
-  check("smartSelectExpand grows the selection again", editorCommands.smartSelectExpand(view) === true && selJson(view) !== expanded1);
-  const expanded2 = selJson(view);
-  check("the second expansion differs from the first", expanded2 !== expanded1);
-  check("smartSelectShrink restores the previous expansion", editorCommands.smartSelectShrink(view) === true && selJson(view) === expanded1);
-  check("smartSelectShrink restores the original cursor", editorCommands.smartSelectShrink(view) === true && selJson(view) === original);
-  check("smartSelectShrink on an empty stack is a no-op", editorCommands.smartSelectShrink(view) === false);
-  view.destroy();
-
-  const plain = makeView("plain text\n", EditorSelection.cursor(2));
-  check("smartSelectExpand without a syntax tree returns false", editorCommands.smartSelectExpand(plain) === false);
-  check("a failed expand pushes nothing to shrink", editorCommands.smartSelectShrink(plain) === false);
-  plain.destroy();
-}
-
-{
-  // Diagnostic navigation over setDiagnostics.
-  const view = makeView("alpha\nbeta\ngamma\n", EditorSelection.cursor(5));
-  view.dispatch(
-    setDiagnostics(view.state, [
-      { from: 0, to: 2, severity: "error", message: "one" },
-      { from: 11, to: 14, severity: "warning", message: "two" },
-    ]),
-  );
-  check(
-    "nextDiagnostic selects the next diagnostic",
-    editorCommands.nextDiagnostic(view) === true &&
-      view.state.selection.main.from === 11 && view.state.selection.main.head === 14,
-  );
-  check(
-    "previousDiagnostic selects the previous diagnostic",
-    editorCommands.previousDiagnostic(view) === true &&
-      view.state.selection.main.from === 0 && view.state.selection.main.head === 2,
-  );
-  view.destroy();
-  const clean = makeView("alpha\n", EditorSelection.cursor(0));
-  check("nextDiagnostic with no lint state is a no-op", editorCommands.nextDiagnostic(clean) === false);
-  clean.destroy();
-}
-
-{
-  // runInActiveEditor and withActiveEditor against a stub dock.
-  const unregisterEmpty = registerService(DOCK, () => ({ activePanel: undefined, panels: [] }));
-  check(
-    "runInActiveEditor without an active editor returns false",
-    editorCommands.runInActiveEditor(editorCommands.copyLineDown) === false,
-  );
-  let called = 0;
-  editorCommands.withActiveEditor(() => { called += 1; });
-  check("withActiveEditor without an active editor does not call fn", called === 0);
-  unregisterEmpty.dispose();
-
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\a.txt", text: "one\ntwo\n" });
-  const panel = new EditorPanel({ createSurface: () => surface });
-  const fakePanel = { view: { content: panel } };
-  const unregisterDock = registerService(DOCK, () => ({ activePanel: fakePanel, panels: [fakePanel] }));
-  check(
-    "runInActiveEditor runs the command against the active view",
-    editorCommands.runInActiveEditor(editorCommands.copyLineDown) === true,
-  );
-  check("the command changed the active editor's document", surface.text() === "one\none\ntwo\n");
-  let seen = null;
-  editorCommands.withActiveEditor((p) => { seen = p; });
-  check("withActiveEditor passes the active editor panel", seen === panel);
-  unregisterDock.dispose();
-  panel.dispose();
-}
-
-{
-  // splitActiveEditor against a fake dock recording addGroup/moveTo:
-  // each Split direction maps to its dockview direction, the active
-  // editor moves into the fresh group, and a missing or non-editor
-  // active panel is a no-op.
-  const splitSurface = new CodeMirrorSurface();
-  window.document.body.appendChild(splitSurface.element);
-  splitSurface.open({ path: "C:\\project\\split.txt", text: "one\n" });
-  const splitPanel = new EditorPanel({ createSurface: () => splitSurface });
-  const moveTos = [];
-  const splitDockPanel = {
-    view: { content: splitPanel },
-    api: { moveTo: (target) => moveTos.push(target) },
-  };
-  const addGroups = [];
-  const group = { id: "split-group" };
-  const unregisterSplitDock = registerService(DOCK, () => ({
-    activePanel: splitDockPanel,
-    panels: [splitDockPanel],
-    addGroup: (options) => {
-      addGroups.push(options);
-      return group;
-    },
-  }));
-
-  const directions = { up: "above", down: "below", left: "left", right: "right" };
-  for (const [split, dockviewDirection] of Object.entries(directions)) {
-    addGroups.length = 0;
-    moveTos.length = 0;
-    editorCommands.splitActiveEditor(split);
-    check(
-      `split ${split} adds a group ${dockviewDirection} of the active editor`,
-      addGroups.length === 1 &&
-        addGroups[0].referencePanel === splitDockPanel &&
-        addGroups[0].direction === dockviewDirection,
-    );
-    check(
-      `split ${split} moves the active editor into the new group`,
-      moveTos.length === 1 && moveTos[0].group === group,
-    );
-  }
-  unregisterSplitDock.dispose();
-
-  // No active editor: addGroup is never called.
-  const emptyAddGroups = [];
-  const unregisterEmptySplit = registerService(DOCK, () => ({
-    activePanel: undefined,
-    panels: [],
-    addGroup: (options) => {
-      emptyAddGroups.push(options);
-      return group;
-    },
-  }));
-  editorCommands.splitActiveEditor("right");
-  check("split with no active editor is a no-op", emptyAddGroups.length === 0);
-  unregisterEmptySplit.dispose();
-
-  // A non-editor active panel is a no-op too.
-  const foreignAddGroups = [];
-  const unregisterForeignSplit = registerService(DOCK, () => ({
-    activePanel: { view: { content: {} }, api: {} },
-    panels: [],
-    addGroup: (options) => {
-      foreignAddGroups.push(options);
-      return group;
-    },
-  }));
-  editorCommands.splitActiveEditor("right");
-  check("split with a non-editor active panel is a no-op", foreignAddGroups.length === 0);
-  unregisterForeignSplit.dispose();
-  splitPanel.dispose();
-}
-
-{
-  // The contribution's registry wiring: every catalog row lands in the
-  // command registry, its menu, and the palette; keybound rows get a
-  // label, the three keybinding-less rows get none.
-  const EXPECTED_IDS = [
-    "actions.find",
-    "editor.action.startFindReplaceAction",
-    "editor.action.commentLine",
-    "editor.action.blockComment",
-    "editor.action.smartSelect.expand",
-    "editor.action.smartSelect.shrink",
-    "editor.action.copyLinesUpAction",
-    "editor.action.copyLinesDownAction",
-    "editor.action.moveLinesUpAction",
-    "editor.action.moveLinesDownAction",
-    "editor.action.duplicateSelection",
-    "editor.action.insertCursorAbove",
-    "editor.action.insertCursorBelow",
-    "editor.action.insertCursorAtEndOfEachLineSelected",
-    "editor.action.addSelectionToNextFindMatch",
-    "editor.action.addSelectionToPreviousFindMatch",
-    "editor.action.selectHighlights",
-    "editor.action.jumpToBracket",
-    "editor.action.marker.nextInFiles",
-    "editor.action.marker.prevInFiles",
-    "workbench.action.files.newUntitledFile",
-    "workbench.action.reopenClosedEditor",
-    "workbench.action.gotoLine",
-    // The workbench-level editor rows: Save, the four splits, and cycling.
-    "workbench.action.files.save",
-    "workbench.action.splitEditorUp",
-    "workbench.action.splitEditorDown",
-    "workbench.action.splitEditorLeft",
-    "workbench.action.splitEditorRight",
-    "workbench.action.nextEditor",
-    "workbench.action.previousEditor",
-  ];
-  check("the contribution registered without errors", consoleErrors.length === 0);
-  check(
-    "every catalog row is a registered command",
-    EXPECTED_IDS.every((id) => Commands.lookup(id) !== undefined),
-  );
-  const palette = Menus.getMenuItems(MenuId.CommandPalette).map((row) => row.command);
-  // The catalog rows plus the four settings toggles; EXPECTED_IDS
-  // includes the three lifecycle actions.
-  check(
-    "every catalog row reaches the palette",
-    palette.length === EXPECTED_IDS.length + 4 && EXPECTED_IDS.every((id) => palette.includes(id)),
-  );
-  check("find declares the editor-only precondition", Commands.lookup("actions.find")?.precondition === "activeEditor == 'editor'");
-  check("commentLine keeps its catalog title", Commands.lookup("editor.action.commentLine")?.title === "Toggle Line Comment");
-
-  const selectionMenu = Menus.getMenuItems(MenuId.MenubarSelectionMenu).map((row) => row.command);
-  // The thirteen catalog rows plus the Column Selection Mode toggle.
-  check(
-    "the Selection menu lists its thirteen rows",
-    selectionMenu.length === 14 &&
-      ["editor.action.smartSelect.expand", "editor.action.smartSelect.shrink"].every((id) => selectionMenu.includes(id)),
-  );
-  const editMenu = Menus.getMenuItems(MenuId.MenubarEditMenu).map((row) => row.command);
-  check(
-    "the Edit menu lists find, replace, and the comment toggles",
-    editMenu.length === 4 &&
-      ["actions.find", "editor.action.startFindReplaceAction", "editor.action.commentLine", "editor.action.blockComment"]
-        .every((id) => editMenu.includes(id)),
-  );
-  const goMenu = Menus.getMenuItems(MenuId.MenubarGoMenu).map((row) => row.command);
-  check(
-    "the Go menu lists bracket jump, problem navigation, and go-to-line",
-    goMenu.length === 4 &&
-      ["editor.action.jumpToBracket", "editor.action.marker.nextInFiles", "editor.action.marker.prevInFiles", "workbench.action.gotoLine"]
-        .every((id) => goMenu.includes(id)),
-  );
-  const fileMenu = Menus.getMenuItems(MenuId.MenubarFileMenu).map((row) => row.command);
-  // The editor contribution also registers Save (File 4_save); Close
-  // Editor registers from the layout contribution.
-  check(
-    "the File menu lists New Text File and Save",
-    fileMenu.length === 2 &&
-      ["workbench.action.files.newUntitledFile", "workbench.action.files.save"].every((id) => fileMenu.includes(id)),
-  );
-  const recentMenu = Menus.getMenuItems(MenuId.MenubarRecentMenu).map((row) => row.command);
-  check(
-    "Open Recent lists Reopen Closed Editor",
-    recentMenu.length === 1 && recentMenu.includes("workbench.action.reopenClosedEditor"),
-  );
-  check(
-    "Go to Line declares the editor-only precondition",
-    Commands.lookup("workbench.action.gotoLine")?.precondition === "activeEditor == 'editor'",
-  );
-  check("New Text File has a keybinding label", KeybindingsRegistry.lookupKeybinding("workbench.action.files.newUntitledFile") !== undefined);
-  check("Reopen Closed Editor has a keybinding label", KeybindingsRegistry.lookupKeybinding("workbench.action.reopenClosedEditor") !== undefined);
-  check("Go to Line has a keybinding label", KeybindingsRegistry.lookupKeybinding("workbench.action.gotoLine") !== undefined);
-  check("the contribution registers the ':' go-to-line provider", QuickAccessRegistry.getQuickAccessProvider(":12")?.prefix === ":");
-
-  check("a keybound row gets a keybinding label", KeybindingsRegistry.lookupKeybinding("editor.action.commentLine") !== undefined);
-  check("Duplicate Selection has no keybinding", KeybindingsRegistry.lookupKeybinding("editor.action.duplicateSelection") === undefined);
-  check(
-    "Add Previous Occurrence has no keybinding",
-    KeybindingsRegistry.lookupKeybinding("editor.action.addSelectionToPreviousFindMatch") === undefined,
-  );
-  check(
-    "Select All Occurrences shows Ctrl+Shift+L, the chord the chat pane wins at dispatch",
-    KeybindingsRegistry.lookupKeybinding("editor.action.selectHighlights")?.getLabel() === "Ctrl+Shift+L",
-  );
-
-  // Executing through the command registry exercises the run body's
-  // lazy import of editor-commands.
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\b.txt", text: "alpha\nbeta\n" });
-  const panel = new EditorPanel({ createSurface: () => surface });
-  const fakePanel = { view: { content: panel } };
-  const unregisterDock = registerService(DOCK, () => ({ activePanel: fakePanel, panels: [fakePanel] }));
-  const executed = await Commands.execute("editor.action.copyLinesDownAction");
-  check(
-    "executing a catalog command runs through the lazy import",
-    executed === true && surface.text() === "alpha\nalpha\nbeta\n",
-  );
-
-  // Indent Line and Outdent Line: the keybinding-only rows that keep
-  // Ctrl+] and Ctrl+[ working in the editor beside the chat's chords.
-  const beforeIndent = surface.text();
-  await Commands.execute("editor.action.indentLines");
-  const indented = surface.text();
-  check(
-    "Indent Line indents the cursor line through the command registry",
-    indented.length > beforeIndent.length && indented.replace(/^[ \t]+/gm, "") === beforeIndent,
-  );
-  await Commands.execute("editor.action.outdentLines");
-  check("Outdent Line takes the indent back out", surface.text() === beforeIndent);
-  check(
-    "the indent rows bind Ctrl+] and Ctrl+[ while the editor's text is focused",
-    KeybindingsRegistry.lookupKeybinding("editor.action.indentLines")?.getLabel() === "Ctrl+]" &&
-      KeybindingsRegistry.lookupKeybinding("editor.action.outdentLines")?.getLabel() === "Ctrl+[",
-  );
-  unregisterDock.dispose();
-  panel.dispose();
-}
-
-// --- Editor lifecycle -----------------------------------------------------
-// A stub surface with the EditorSurface contract's dirty semantics, for
-// panel-level tests that never touch CodeMirror.
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    opened: [],
-    open(document) {
-      this.opened.push(document);
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    editorView() {
-      return null;
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-  };
-}
-
-// A fake dock good enough for zones and the lifecycle: panel opens are
-// recorded, and the add/remove/active listeners are test-driven.
-function makeFakeDock() {
-  const listeners = { add: [], remove: [], active: [], move: [] };
-  const added = [];
-  const dock = {
-    panels: [],
-    groups: [],
-    activePanel: undefined,
-    onDidMovePanel: (fn) => {
-      listeners.move.push(fn);
-      return { dispose() {} };
-    },
-    onDidAddPanel: (fn) => {
-      listeners.add.push(fn);
-      return { dispose() {} };
-    },
-    onDidRemovePanel: (fn) => {
-      listeners.remove.push(fn);
-      return { dispose() {} };
-    },
-    onWillMutateLayout: () => ({ dispose() {} }),
-    onDidMutateLayout: () => ({ dispose() {} }),
-    onDidLayoutChange: () => ({ dispose() {} }),
-    onDidActivePanelChange: (fn) => {
-      listeners.active.push(fn);
-      return { dispose() {} };
-    },
-    getPanel: () => undefined,
-    getGroup: () => undefined,
-    addPanel: (options) => {
-      added.push(options);
-      const panel = {
-        id: options.id,
-        params: options.params,
-        group: { id: "g1" },
-        api: { setActive() {} },
-        view: { content: {} },
-      };
-      dock.panels.push(panel);
-      return panel;
-    },
-  };
-  return { dock, listeners, added };
-}
-
-const { dock, listeners, added } = makeFakeDock();
-initZones(dock);
-
-{
-  // Untitled buffers: the panel titles itself, reads nothing, and its
-  // save delegates to the Save As command.
-  const recentsBefore = getService(RECENT_FILES_STORE).list.length;
-  let reads = 0;
-  const untitledStub = createStubSurface();
-  const untitledPanel = new EditorPanel({
-    createSurface: () => untitledStub,
-    readFile: async () => {
-      reads += 1;
-      throw new Error("an untitled buffer must not read");
-    },
-  });
-  const untitledTitles = [];
-  untitledPanel.init({
-    params: { untitled: 7 },
-    api: { setTitle: (title) => untitledTitles.push(title), close() {} },
-  });
-  check("an untitled panel titles itself Untitled-N", untitledTitles.at(-1) === "Untitled-7");
-  check(
-    "an untitled panel opens an empty buffer without reading",
-    reads === 0 && untitledStub.opened.length === 1 && untitledStub.opened[0].text === "",
-  );
-  check("a fresh untitled buffer is not dirty", !untitledPanel.isDirty());
-  check("an untitled buffer reports no file path", untitledPanel.filePath() === null && untitledPanel.isUntitled());
-  check(
-    "an untitled buffer records no recent-files entry",
-    getService(RECENT_FILES_STORE).list.length === recentsBefore,
-  );
-
-  let saveAsCalls = 0;
-  const saveAsRegistration = Commands.register("workbench.action.files.saveAs", {
-    run: () => {
-      saveAsCalls += 1;
-    },
-  });
-  await untitledPanel.save();
-  check("save on an untitled buffer runs Save As", saveAsCalls === 1);
-  saveAsRegistration.dispose();
-  untitledPanel.dispose();
-
-  // A reopened untitled buffer restores its text, dirty against the
-  // empty baseline: the content was never persisted.
-  const restoredStub = createStubSurface();
-  const restoredPanel = new EditorPanel({ createSurface: () => restoredStub });
-  const restoredTitles = [];
-  restoredPanel.init({
-    params: { untitled: 8, text: "draft" },
-    api: { setTitle: (title) => restoredTitles.push(title), close() {} },
-  });
-  check("a reopened untitled buffer keeps its text", restoredStub.text() === "draft");
-  check("a reopened untitled buffer with content is dirty", restoredPanel.isDirty());
-  check("a dirty untitled title is the bare name; the dot is the tab's", restoredTitles.at(-1) === "Untitled-8");
-  restoredPanel.dispose();
-}
-
-{
-  // newUntitledFile opens an untitled editor panel per call.
-  editorLifecycle.newUntitledFile();
-  editorLifecycle.newUntitledFile();
-  check(
-    "newUntitledFile opens an untitled editor panel",
-    added.length === 2 && typeof added[0].params.untitled === "number",
-  );
-  check(
-    "untitled panel ids are unique per buffer",
-    added[0].id !== added[1].id && added[0].id.startsWith("editor:untitled-"),
-  );
-  const beforeCommand = added.length;
-  const executed = await Commands.execute("workbench.action.files.newUntitledFile");
-  check(
-    "executing New Text File runs through the lazy lifecycle import",
-    executed === true && added.length === beforeCommand + 1,
-  );
-}
-
-{
-  // The closed-editor stack: file editors reopen by path, untitled
-  // buffers reopen with their text under a fresh serial. The tracking
-  // and the reopen resolve the stack through the CLOSED_EDITORS token,
-  // bound here the way main.ts binds it: seeded from the workspace
-  // bucket and writing `{ paths: [...] }` back on every change.
-  const closedWrites = [];
-  registerService(
-    CLOSED_EDITORS,
-    () => new ClosedEditors({ paths: ["C:\\p\\seeded.txt"] }, (value) => closedWrites.push(value)),
-  );
-  const tracking = editorLifecycle.installClosedEditorTracking(dock);
-
-  const fileStub = createStubSurface();
-  const filePanel = new EditorPanel({
-    createSurface: () => fileStub,
-    readFile: async () => ({ path: "C:\\p\\x.txt", size: 1, token: "t1", text: "x" }),
-  });
-  filePanel.init({ params: { path: "C:\\p\\x.txt" }, api: { setTitle() {}, close() {} } });
-  await flush();
-  for (const listener of listeners.remove) listener({ id: "editor:C:\\p\\x.txt", view: { content: filePanel }, group: { id: "g1", panels: [] } });
-  check(
-    "closing a file editor prepends its path and writes the snapshot",
-    closedWrites.length === 1 && closedWrites[0].paths.join(",") === "C:\\p\\x.txt,C:\\p\\seeded.txt",
-  );
-  const beforeFileReopen = added.length;
-  editorLifecycle.reopenClosedEditor();
-  check(
-    "reopenClosedEditor reopens the last closed file editor by path",
-    added.length === beforeFileReopen + 1 && added.at(-1).params.path === "C:\\p\\x.txt",
-  );
-  check(
-    "reopening removes the path and writes the snapshot",
-    closedWrites.length === 2 && closedWrites[1].paths.join(",") === "C:\\p\\seeded.txt",
-  );
-
-  const untitledStub = createStubSurface();
-  const untitledPanel = new EditorPanel({ createSurface: () => untitledStub });
-  untitledPanel.init({ params: { untitled: 3, text: "unsaved draft" }, api: { setTitle() {}, close() {} } });
-  for (const listener of listeners.remove) listener({ id: "editor:untitled-3", view: { content: untitledPanel }, group: { id: "g1", panels: [] } });
-  check(
-    "a closed untitled buffer never persists its text",
-    closedWrites.length === 3 && closedWrites[2].paths.join(",") === "C:\\p\\seeded.txt",
-  );
-  editorLifecycle.reopenClosedEditor();
-  check(
-    "a closed untitled editor reopens with its text under a fresh serial",
-    added.at(-1).params.text === "unsaved draft" &&
-      typeof added.at(-1).params.untitled === "number" &&
-      added.at(-1).params.untitled !== 3,
-  );
-
-  // The seeded entry from the workspace file reopens last.
-  editorLifecycle.reopenClosedEditor();
-  check(
-    "the stack seeded from the workspace bucket reopens by path",
-    added.at(-1).params.path === "C:\\p\\seeded.txt",
-  );
-
-  const beforeEmpty = added.length;
-  editorLifecycle.reopenClosedEditor();
-  check("reopenClosedEditor on an empty stack is a no-op", added.length === beforeEmpty);
-
-  // A non-editor panel close records nothing.
-  for (const listener of listeners.remove) listener({ id: "tree", view: { content: {} }, group: { id: "g1", panels: [{}] } });
-  editorLifecycle.reopenClosedEditor();
-  check("closing a non-editor panel pushes nothing onto the stack", added.length === beforeEmpty);
-  tracking.dispose();
-  filePanel.dispose();
-  untitledPanel.dispose();
-}
-
-{
-  // The editor-sourced editorLangId and the layout's activeEditor follow
-  // the dock's active panel.
-  const binding = editorLifecycle.bindEditorContextKeys(dock);
-  const activeEditorBinding = bindActiveEditorKey(dock);
-  const context = getService(CONTEXT_KEY_SERVICE);
-
-  const markdownStub = createStubSurface();
-  const markdownPanel = new EditorPanel({
-    createSurface: () => markdownStub,
-    readFile: async () => ({ path: "C:\\p\\notes.md", size: 4, token: "t1", text: "# hi" }),
-  });
-  markdownPanel.init({ params: { path: "C:\\p\\notes.md" }, api: { setTitle() {}, close() {} } });
-  await flush();
-  check(
-    "opening a file records it in the recent-files store",
-    getService(RECENT_FILES_STORE).list.includes("C:\\p\\notes.md"),
-  );
-
-  const markdownDockPanel = {
-    id: "editor:C:\\p\\notes.md",
-    api: { component: "editor" },
-    view: { content: markdownPanel },
-  };
-  dock.activePanel = markdownDockPanel;
-  for (const listener of listeners.active) listener({ panel: markdownDockPanel });
-  check("activeEditor is the active editor panel's type id", context.getValue("activeEditor") === "editor");
-  check("editorLangId comes from the active editor's language", context.getValue("editorLangId") === "markdown");
-
-  dock.activePanel = { id: "tree", api: { component: "tree" }, view: { content: {} } };
-  for (const listener of listeners.active) listener({ panel: dock.activePanel });
-  check("a non-editor active panel sets activeEditor to its type id", context.getValue("activeEditor") === "tree");
-  check("a non-editor active panel clears editorLangId", context.getValue("editorLangId") === undefined);
-  activeEditorBinding.dispose();
-  binding.dispose();
-  markdownPanel.dispose();
-}
-
-{
-  // The CodeMirror text-control adapter: the surface registers itself,
-  // and the Edit menu's undo/select-all route to its history.
-  const adapterSurface = new CodeMirrorSurface();
-  window.document.body.appendChild(adapterSurface.element);
-  adapterSurface.open({ path: "C:\\p\\t.txt", text: "one\ntwo\n" });
-  const textControls = getService(TEXT_CONTROL_SERVICE);
-  adapterSurface.focus();
-  check("a focused editor surface activates its codemirror adapter", textControls.active?.kind === "codemirror");
-  check(
-    "editorTextFocus follows the focused editor",
-    getService(CONTEXT_KEY_SERVICE).getValue("editorTextFocus") === true,
-  );
-  const adapterView = adapterSurface.editorView();
-  adapterView.dispatch({ changes: { from: 0, insert: "x" } });
-  textControls.undo();
-  check("undo routes through the adapter to the editor's history", adapterSurface.text() === "one\ntwo\n");
-  textControls.selectAll();
-  check(
-    "selectAll routes through the adapter",
-    adapterView.state.selection.main.from === 0 &&
-      adapterView.state.selection.main.to === adapterView.state.doc.length,
-  );
-  adapterSurface.dispose();
-  check("disposing the surface unregisters its adapter", textControls.active === null);
-}
-
-{
-  // The ":" go-to-line provider: parse, guidance row, and accept.
-  const bare = parseLineColumn("12");
-  check("parseLineColumn parses a bare line", bare?.line === 12 && bare?.column === undefined);
-  const withColon = parseLineColumn("12:5");
-  check("parseLineColumn parses line:column", withColon?.line === 12 && withColon?.column === 5);
-  const withComma = parseLineColumn("12,5");
-  check("parseLineColumn parses line,column", withComma?.line === 12 && withComma?.column === 5);
-  check("parseLineColumn rejects non-numeric input", parseLineColumn("abc") === null);
-  check("parseLineColumn rejects empty input", parseLineColumn("") === null);
-  check("parseLineColumn rejects a zero line", parseLineColumn("0") === null);
-
-  const provider = createGotoLineProvider();
-  const guidance = provider.getItems("");
-  check("an empty filter shows a guidance row", guidance.length === 1 && guidance[0].label.length > 0);
-  const rows = provider.getItems("12");
-  check("a line filter offers a go-to row", rows.length === 1 && rows[0].label.includes("12"));
-  // Cursor's wording: "Go to line {0}." and, with a column, "Go to line {0} and character {1}."
-  check("the go-to row reads `Go to line 12.`", rows[0].label === "Go to line 12.");
-  check(
-    "a line and column read `Go to line 12 and character 5.`",
-    provider.getItems("12:5")[0].label === "Go to line 12 and character 5.",
-  );
-
-  const gotoSurface = new CodeMirrorSurface();
-  window.document.body.appendChild(gotoSurface.element);
-  gotoSurface.open({
-    path: "C:\\p\\g.txt",
-    text: Array.from({ length: 20 }, (_, index) => `line ${index + 1}`).join("\n"),
-  });
-  const gotoPanel = new EditorPanel({ createSurface: () => gotoSurface });
-  dock.activePanel = { id: "editor:C:\\p\\g.txt", view: { content: gotoPanel } };
-  rows[0].accept();
-  await flush();
-  const gotoView = gotoSurface.editorView();
-  check(
-    "accepting a go-to row moves the cursor to the line",
-    gotoView.state.selection.main.head === gotoView.state.doc.line(12).from,
-  );
-  editorCommands.goToLine(5, 2);
-  check(
-    "goToLine honors the column",
-    gotoView.state.selection.main.head === gotoView.state.doc.line(5).from + 1,
-  );
-  editorCommands.goToLine(999);
-  check(
-    "goToLine clamps past the last line",
-    gotoView.state.selection.main.head === gotoView.state.doc.line(20).from,
-  );
-  gotoPanel.dispose();
-}
-
-{
-  // The editor's context menu: Cut, Copy, Paste, then Command Palette...,
-  // registered on the editor/context menu and opened at the pointer by a
-  // right-click on the editor panel.
-  const EDITOR_CONTEXT = "editor/context";
-  const expected = [
-    ["editor.action.clipboardCutAction", "Cut", "9_cutcopypaste", 1],
-    ["editor.action.clipboardCopyAction", "Copy", "9_cutcopypaste", 2],
-    ["editor.action.clipboardPasteAction", "Paste", "9_cutcopypaste", 3],
-    ["workbench.action.showCommands", "Command Palette...", "z_commands", 1],
-  ];
-  const registered = Menus.getMenuItems(EDITOR_CONTEXT);
-  check(
-    "the editor context menu holds exactly Cut, Copy, Paste, and Command Palette",
-    registered.length === expected.length &&
-      expected.every(([id, , group, order]) =>
-        registered.some((row) => row.command === id && row.group === group && row.order === order),
-      ),
-  );
-
-  // The commands the rows name come from the edit and quick-input
-  // contributions in the app; stand-ins carry the titles here.
-  for (const [id, title] of expected) {
-    if (Commands.lookup(id) === undefined) {
-      Commands.register(id, { title, run() {} });
-    }
-  }
-  const menuPanel = new EditorPanel({ createSurface: () => createStubSurface() });
-  window.document.body.appendChild(menuPanel.element);
-  const rightClick = new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: 24, clientY: 16 });
-  menuPanel.element.dispatchEvent(rightClick);
-  check("a right-click on the editor is claimed, so no native menu opens", rightClick.defaultPrevented);
-  const popover = [...window.document.querySelectorAll(".ws-window-titlebar__popover")].find((p) => !p.hidden);
-  const labels = [...(popover?.querySelectorAll(".ws-window-titlebar__item-label") ?? [])].map((n) => n.textContent);
-  check(
-    "the menu reads Cut, Copy, Paste, Command Palette... in that order",
-    labels.join("|") === "Cut|Copy|Paste|Command Palette...",
-  );
-  window.document.body.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true }));
-  check(
-    "a click outside dismisses the menu",
-    [...window.document.querySelectorAll(".ws-window-titlebar__popover")].every((p) => p.hidden),
-  );
-  menuPanel.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`editor-commands: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-commands: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-idioms.mjs b/crates/workshop/ui/test/editor-idioms.mjs
deleted file mode 100644
index 313f57482..000000000
--- a/crates/workshop/ui/test/editor-idioms.mjs
+++ /dev/null
@@ -1,666 +0,0 @@
-// Editor idiom test (src/parts/editor/editor-surface.ts): the
-// readOnly toggle runs through a Compartment - one reconfigure dispatch,
-// so document text, dirty tracking, and the live view all survive a
-// toggle - and reloads into a live view dispatch a transaction tagged
-// with the externalUpdate annotation, distinguishable from local typing
-// via the exported isExternalUpdate helper. Runs CodeMirror under jsdom
-// with the same measurement shims as editor-panel.mjs.
-// Run: node test/editor-idioms.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-import { declaration, readUi, resolver, rulesOf } from "./helpers/css-values.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export {
-        CodeMirrorSurface,
-        externalUpdate,
-        isExternalUpdate,
-      } from "./src/parts/editor/editor-surface.ts";
-      export { redo, undo, undoDepth } from "@codemirror/commands";
-      export { EditorView, getDrawSelectionConfig } from "@codemirror/view";
-      export { foldEffect, getIndentUnit, indentUnit } from "@codemirror/language";
-      export { closeSearchPanel, getSearchQuery, openSearchPanel, searchPanelOpen } from "@codemirror/search";
-      export { revealReplace } from "./src/parts/editor/find-widget.ts";
-      export { ICON_CHEVRON_DOWN, ICON_CHEVRON_RIGHT } from "@workshop/look/icons";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7911/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-// CodeMirror measures text through Range, which jsdom does not layout;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-if (!window.HTMLElement.prototype.getBoundingClientRect) {
-  window.HTMLElement.prototype.getBoundingClientRect = zeroRect;
-}
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-for (const key of [
-  "document",
-  "navigator",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLButtonElement",
-  "KeyboardEvent",
-  "Node",
-  "Element",
-  "Range",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-idioms-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  lifecycle,
-  CodeMirrorSurface,
-  externalUpdate,
-  isExternalUpdate,
-  redo,
-  undo,
-  undoDepth,
-  EditorView,
-  getDrawSelectionConfig,
-  foldEffect,
-  getIndentUnit,
-  indentUnit,
-  closeSearchPanel,
-  getSearchQuery,
-  openSearchPanel,
-  searchPanelOpen,
-  revealReplace,
-  ICON_CHEVRON_DOWN,
-  ICON_CHEVRON_RIGHT,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const FILE_PATH = "C:\\project\\notes.md";
-
-function contentEditableOf(surface) {
-  return surface.element.querySelector(".cm-content")?.getAttribute("contenteditable");
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- readOnly toggles through the compartment ----------------------------
-
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: FILE_PATH, text: "alpha\n" });
-
-  check("a fresh surface accepts input", contentEditableOf(surface) === "true");
-  check("a fresh surface state is not readOnly", surface.view.state.readOnly === false);
-
-  surface.setReadOnly(true);
-  check("setReadOnly(true) flips the state's readOnly facet", surface.view.state.readOnly === true);
-  check("setReadOnly(true) makes the content non-editable", contentEditableOf(surface) === "false");
-
-  surface.setReadOnly(false);
-  check(
-    "setReadOnly(false) restores the editable state",
-    surface.view.state.readOnly === false && contentEditableOf(surface) === "true",
-  );
-
-  // --- toggling reconfigures in place: no state rebuild ---------------------
-
-  // The view is TypeScript-private but reachable at runtime, same as in
-  // editor-panel.mjs: the assertions drive the real dispatch path.
-  surface.view.dispatch({ changes: { from: 0, insert: "x" } });
-  check("an edit before the toggle dirties the surface", surface.isDirty());
-
-  const viewBefore = surface.view;
-  const editorNodeBefore = surface.element.querySelector(".cm-editor");
-  surface.setReadOnly(true);
-  surface.setReadOnly(false);
-  check(
-    "toggling keeps the same view and editor DOM node - no rebuild",
-    surface.view === viewBefore &&
-      surface.element.querySelector(".cm-editor") === editorNodeBefore,
-  );
-  check("toggling keeps the document text", surface.text() === "xalpha\n");
-  check("toggling keeps the dirty state", surface.isDirty());
-
-  // The unrelated dirty-tracking extension survives the toggles: reverting
-  // the edit still lands on the updateListener and clears dirty.
-  surface.view.dispatch({ changes: { from: 0, to: 1 } });
-  check("the dirty updateListener still runs after toggles", !surface.isDirty());
-
-  // --- externalUpdate tags server-originated reloads ------------------------
-
-  // Capture the transactions the surface dispatches by intercepting the
-  // view's update entry point; open() keeps the view alive on reload, so
-  // the interception survives it.
-  const captured = [];
-  const view = surface.view;
-  const realUpdate = view.update.bind(view);
-  view.update = (transactions) => {
-    captured.push(...transactions);
-    realUpdate(transactions);
-  };
-
-  surface.open({ path: FILE_PATH, text: "from the server\n" });
-  check(
-    "a reload into a live view dispatches a transaction tagged externalUpdate",
-    captured.some((tr) => isExternalUpdate(tr)),
-  );
-  check(
-    "the annotation itself reads back off the transaction",
-    captured.some((tr) => tr.annotation(externalUpdate) === true),
-  );
-  check("the reload replaced the document text", surface.text() === "from the server\n");
-  check("a reload is not dirty", !surface.isDirty());
-
-  // The reload deliberately enters undo history:
-  // undo can cross it back into pre-reload text, and dirty tracking flags
-  // the result against the reloaded baseline.
-  check("the reload keeps undo history", undoDepth(view.state) > 0);
-  undo(view);
-  check("undo crosses the reload into the pre-reload text", surface.text() === "alpha\n");
-  check("undoing past the reload marks the surface dirty", surface.isDirty());
-  redo(view);
-  check(
-    "redo reapplies the reload and returns to clean",
-    surface.text() === "from the server\n" && !surface.isDirty(),
-  );
-
-  const capturedBefore = captured.length;
-  view.dispatch({ changes: { from: 0, insert: "typed " } });
-  check(
-    "a typed change is not tagged externalUpdate",
-    captured.length === capturedBefore + 1 && !isExternalUpdate(captured.at(-1)),
-  );
-  check("the typed change landed", surface.text() === "typed from the server\n");
-
-  surface.dispose();
-  check("dispose still tears the editor down", !surface.element.querySelector(".cm-editor"));
-
-  // --- readOnly set before open() seeds the first state ---------------------
-
-  const lockedSurface = new CodeMirrorSurface();
-  window.document.body.appendChild(lockedSurface.element);
-  lockedSurface.setReadOnly(true);
-  lockedSurface.open({ path: "C:\\project\\b.txt", text: "locked\n" });
-  check(
-    "readOnly set before open applies to the first state",
-    lockedSurface.view.state.readOnly === true && contentEditableOf(lockedSurface) === "false",
-  );
-  lockedSurface.dispose();
-});
-
-// --- Cursor's editor idioms ---------------------------------------------------
-//
-// The behaviors and look the surface copies from Cursor: a has-selection
-// class that hides the current line, Monaco's cursor blink, indent unit,
-// scroll-past-end, Alt+click and Shift+Alt+drag gestures (no crosshair), a
-// glyph lane before the line numbers, fold chevrons, and a floating find
-// widget. The look is read back from the stylesheets the editor mounts
-// (jsdom applies no layout, so the declared values are the contract): the
-// theme's rules from the document's injected <style> text, resolved through
-// the token sheets down to Cursor Dark's literals.
-
-const resolve = await resolver();
-const panelRules = rulesOf(await readUi("src/parts/editor/editor-panel.css"));
-
-/** Every style the editor injected into the document, as one string. */
-function injectedCss() {
-  const parts = [];
-  for (const style of window.document.querySelectorAll("style")) {
-    parts.push(style.textContent ?? "");
-    try {
-      if (style.sheet) parts.push([...style.sheet.cssRules].map((rule) => rule.cssText).join("\n"));
-    } catch {
-      // A sheet jsdom cannot enumerate adds nothing beyond its text.
-    }
-  }
-  return parts.join("\n");
-}
-
-/** Whether some rule whose selector satisfies `matches` declares `property` as `expected`, tokens resolved. */
-function declares(matches, property, expected) {
-  return rulesOf(injectedCss()).some(
-    (rule) => rule.selectors.some(matches) && resolve(declaration(rule.body, property)) === expected,
-  );
-}
-const endsWith = (suffix) => (selector) => selector.endsWith(suffix);
-
-/** An SVG string as the DOM serializes it, so it compares with an element's innerHTML. */
-function iconHtml(svg) {
-  const holder = window.document.createElement("span");
-  holder.innerHTML = svg;
-  return holder.innerHTML;
-}
-
-/** The value a stylesheet rule list holds for a selector's property, tokens resolved. */
-function panelValue(selector, property) {
-  let found;
-  for (const rule of panelRules) {
-    if (!rule.selectors.includes(selector)) continue;
-    const value = declaration(rule.body, property);
-    if (value !== undefined) found = value;
-  }
-  return resolve(found);
-}
-
-{
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\idioms.txt", text: "const a = 1;\nlet b = 2;\n" });
-  const view = surface.editorView();
-
-  // The has-selection class rides on the editor through editorAttributes, so
-  // the stylesheet can hide the current-line wash whenever a selection exists.
-  check("no has-selection class while nothing is selected", !view.dom.classList.contains("ws-has-selection"));
-  view.dispatch({ selection: { anchor: 0, head: 5 } });
-  check("a non-empty selection sets the has-selection class", view.dom.classList.contains("ws-has-selection"));
-  view.dispatch({ selection: { anchor: 2 } });
-  check("collapsing the selection clears the class", !view.dom.classList.contains("ws-has-selection"));
-
-  check("the cursor blinks once a second", getDrawSelectionConfig(view.state).cursorBlinkRate === 1000);
-  check("the indent unit is four spaces", view.state.facet(indentUnit) === "    " && getIndentUnit(view.state) === 4);
-  check(
-    "scroll past end pads the document so the last line can reach the top",
-    Number.parseFloat(view.contentDOM.style.paddingBottom) > 0,
-  );
-
-  // Alt+click adds a cursor; Shift+Alt+drag selects a column; Alt alone shows no crosshair.
-  const click = (init) => ({ altKey: false, shiftKey: false, ctrlKey: false, metaKey: false, ...init });
-  const addsRange = (event) => view.state.facet(EditorView.clickAddsSelectionRange).some((fn) => fn(event));
-  check("Alt+click adds a cursor", addsRange(click({ altKey: true })));
-  check("a plain click does not add a cursor", !addsRange(click({})));
-  const drag = (init) => ({ button: 0, clientX: 0, clientY: 0, ...click(init) });
-  const rectangular = (event) =>
-    view.state.facet(EditorView.mouseSelectionStyle).some((style) => style(view, event) !== null);
-  check("Shift+Alt+drag selects a column", rectangular(drag({ altKey: true, shiftKey: true })));
-  check("Alt+drag alone is not a column selection", !rectangular(drag({ altKey: true })));
-  view.contentDOM.dispatchEvent(
-    new window.KeyboardEvent("keydown", { key: "Alt", keyCode: 18, altKey: true, bubbles: true }),
-  );
-  check("pressing Alt draws no crosshair cursor", view.contentDOM.style.cursor !== "crosshair");
-
-  // The gutter: a glyph lane, then line numbers, then the fold lane.
-  const lanes = [...view.dom.querySelector(".cm-gutters").children].map((lane) => lane.className);
-  const laneIndex = (name) => lanes.findIndex((className) => className.includes(name));
-  check(
-    "the gutter runs glyph margin, line numbers, fold lane",
-    laneIndex("cm-glyphMargin") === 0 && laneIndex("cm-lineNumbers") === 1 && laneIndex("cm-foldGutter") === 2,
-  );
-
-  // A folded range reads as a bare ellipsis.
-  view.dispatch({ effects: foldEffect.of({ from: 5, to: 10 }) });
-  check(
-    "a folded range shows a one-character ellipsis placeholder",
-    view.contentDOM.querySelector(".cm-foldPlaceholder")?.textContent === "\u22EF",
-  );
-  // The fold lane marks the folded range with a right chevron that stays visible.
-  // The lane's first element is CodeMirror's hidden width spacer; the line markers follow it.
-  const foldedMarkers = [...view.dom.querySelectorAll('.cm-foldGutter .cm-gutterElement .ws-fold-marker[data-state="folded"]')].filter(
-    (marker) => marker.parentElement.style.visibility !== "hidden",
-  );
-  check(
-    "the folded range's lane shows one folded chevron-right marker",
-    foldedMarkers.length === 1 && foldedMarkers[0].innerHTML === iconHtml(ICON_CHEVRON_RIGHT),
-  );
-  check(
-    "the folded marker stays visible without gutter hover",
-    declares((selector) => selector.endsWith(".ws-fold-marker[data-state=folded]"), "opacity", "1"),
-  );
-
-  // The look, as the theme declares it.
-  check("text is 14px", declares(endsWith(".cm-scroller"), "font-size", "14px"));
-  check("lines are 19px tall", declares(endsWith(".cm-scroller"), "line-height", "19px"));
-  check("the gutter is #181818", declares(endsWith(".cm-gutters"), "background-color", "#181818"));
-  check("the gutter has no right border", declares(endsWith(".cm-gutters"), "border-right", "none"));
-  check("line numbers are #F0F0F05C", declares(endsWith(".cm-gutters"), "color", "#f0f0f05c"));
-  check(
-    "the active line number is #F0F0F0",
-    declares(endsWith(".cm-activeLineGutter"), "color", "#f0f0f0"),
-  );
-  check(
-    "the active line's gutter takes no tint",
-    declares(endsWith(".cm-activeLineGutter"), "background-color", "transparent"),
-  );
-  check("line numbers are at least five characters wide", declares(endsWith(".cm-lineNumbers .cm-gutterElement"), "min-width", "5ch"));
-  check("the glyph lane is 19px", declares(endsWith(".cm-glyphMargin"), "min-width", "19px"));
-  check("the fold lane is 26px", declares(endsWith(".cm-foldGutter"), "min-width", "26px"));
-  check("the content has no padding", declares(endsWith(".cm-content"), "padding", "0"));
-  check("the current line is #262626", declares(endsWith(".cm-activeLine"), "background-color", "#262626"));
-  check(
-    "the current line wash is hidden while a selection exists",
-    declares((selector) => selector.includes("ws-has-selection") && selector.endsWith(".cm-activeLine"), "background-color", "transparent"),
-  );
-  check(
-    "a focused selection is #40404099 over the long selection-layer selector",
-    declares(
-      (selector) => selector.endsWith(".cm-selectionLayer .cm-selectionBackground") && selector.includes(".cm-focused"),
-      "background",
-      "#40404099",
-    ),
-  );
-  check(
-    "an unfocused selection is #40404077 over the long selection-layer selector",
-    declares(
-      (selector) => selector.endsWith(".cm-selectionLayer .cm-selectionBackground") && !selector.includes(".cm-focused"),
-      "background",
-      "#40404077",
-    ),
-  );
-  check(
-    "selection corners are 3px",
-    declares((selector) => selector.endsWith(".cm-selectionBackground"), "border-radius", "3px"),
-  );
-  check("the cursor is a 2px bar", declares(endsWith(".cm-cursor"), "border-left-width", "2px"));
-  check("the cursor is #F0F0F0", declares(endsWith(".cm-cursor"), "border-left-color", "#f0f0f0"));
-  check("the cursor sits 1px left", declares(endsWith(".cm-cursor"), "margin-left", "-1px"));
-  check("the editor draws no focus outline", declares(endsWith(".cm-focused"), "outline", "none"));
-  check("find matches are #88C0D044", declares(endsWith(".cm-searchMatch"), "background-color", "#88c0d044"));
-  check(
-    "the current find match is #88C0D066",
-    declares((selector) => selector.endsWith(".cm-searchMatch-selected"), "background-color", "#88c0d066"),
-  );
-  check("find matches have no outline", declares(endsWith(".cm-searchMatch"), "outline", "none"));
-  check(
-    "the word under the cursor is #F0F0F01E",
-    declares(endsWith(".cm-selectionMatch-main"), "background-color", "#f0f0f01e"),
-  );
-  check(
-    "other occurrences of a selection are #404040CC",
-    declares(endsWith(".cm-selectionMatch"), "background-color", "#404040cc"),
-  );
-  check(
-    "a bracket match is a #F0F0F01E box with a transparent 1px border",
-    declares(endsWith(".cm-matchingBracket"), "background-color", "#f0f0f01e") &&
-      declares(endsWith(".cm-matchingBracket"), "border", "1px solid transparent"),
-  );
-  check(
-    "a bracket match shows with the editor unfocused",
-    declares((selector) => selector.endsWith(".cm-matchingBracket") && !selector.includes(".cm-focused"), "background-color", "#f0f0f01e"),
-  );
-  check("fold chevrons are #C5C5C5", declares((selector) => selector.includes("cm-foldGutter"), "color", "#c5c5c5"));
-  check(
-    "fold chevrons fade in over 0.5s",
-    declares((selector) => selector.includes("cm-foldGutter"), "transition", "opacity 0.5s"),
-  );
-  check("the folded placeholder is #808080", declares(endsWith(".cm-foldPlaceholder"), "color", "#808080"));
-  check(
-    "whitespace dots are drawn in #505050B3",
-    rulesOf(injectedCss()).some(
-      (rule) =>
-        rule.selectors.some(endsWith(".cm-highlightSpace")) &&
-        resolve(declaration(rule.body, "background-image"))?.includes("#505050b3"),
-    ),
-  );
-
-  // Every syntax token reads Cursor Dark's tokenColors through an --editor-token-* value.
-  const TOKENS = {
-    keyword: "#82d2ce",
-    operator: "#d6d6dd",
-    punctuation: "#d6d6dd",
-    string: "#e394dc",
-    number: "#ebc88d",
-    constant: "#f0f0f0",
-    comment: "#f0f0f099",
-    type: "#efb080",
-    function: "#efb080",
-    variable: "#87c3ff",
-    "constant-variable": "#aaa0fa",
-    property: "#aaa0fa",
-    attribute: "#aaa0fa",
-    tag: "#87c3ff",
-    "tag-punctuation": "#a4a4a4",
-    heading: "#88c0d0",
-    link: "#82d2ce",
-    strong: "#f8c762",
-    emphasis: "#82d2ce",
-    invalid: "#d6d6dd",
-  };
-  const css = injectedCss();
-  for (const [name, value] of Object.entries(TOKENS)) {
-    check(`--editor-token-${name} is ${value}`, resolve(`var(--editor-token-${name})`) === value);
-    check(`the highlight style reads --editor-token-${name}`, css.includes(`var(--editor-token-${name})`));
-  }
-  check(
-    "comments are italic",
-    rulesOf(css).some(
-      (rule) => declaration(rule.body, "font-style") === "italic" && declaration(rule.body, "color")?.includes("--editor-token-comment"),
-    ),
-  );
-
-  surface.dispose();
-}
-
-// --- The fold lane's open chevron ----------------------------------------------------
-
-{
-  // A foldable line shows a down chevron while open; the JSON mode loads lazily.
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\fold.json", text: '{\n  "a": 1\n}\n' });
-  const view = surface.editorView();
-  const openMarker = () => view.dom.querySelector('.cm-foldGutter .ws-fold-marker[data-state="open"]');
-  for (let attempt = 0; attempt < 50 && openMarker() === null; attempt += 1) {
-    await new Promise((resolveWait) => setTimeout(resolveWait, 20));
-  }
-  const marker = openMarker();
-  check("a foldable line shows an open fold marker", marker !== null);
-  check(
-    "the open fold marker is a chevron-down, not the folded chevron-right",
-    marker?.innerHTML === iconHtml(ICON_CHEVRON_DOWN) && marker.innerHTML !== iconHtml(ICON_CHEVRON_RIGHT),
-  );
-  surface.dispose();
-}
-
-// --- The scrollbars and the find widget's stylesheet ---------------------------------
-
-{
-  const bar = ".ws-editor-surface .cm-scroller::-webkit-scrollbar";
-  check("the vertical scrollbar is 14px", panelValue(bar, "width") === "14px");
-  check("the horizontal scrollbar is 12px", panelValue(bar, "height") === "12px");
-  check("scrollbar thumbs are square", panelValue(`${bar}-thumb`, "border-radius") === "0");
-  check("the scrollbar thumb is #F0F0F011", panelValue(`${bar}-thumb`, "background-color") === "#f0f0f011");
-  check("a hovered thumb is #F0F0F01E", panelValue(`${bar}-thumb:hover`, "background-color") === "#f0f0f01e");
-  check("the find widget floats", panelValue(".ws-find-widget", "position") === "absolute");
-  check("the find widget is 419px wide", panelValue(".ws-find-widget", "inline-size") === "419px");
-  check("the find widget sits 28px from the right", panelValue(".ws-find-widget", "inset-inline-end") === "28px");
-  check("find widget rows are 33px", panelValue(".ws-find-row", "block-size") === "33px");
-}
-
-// --- The find widget -------------------------------------------------------------------
-
-{
-  const surface = new CodeMirrorSurface();
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\find.txt", text: "alpha beta\nthird line\n" });
-  const view = surface.editorView();
-  check("the find widget is not open until asked for", view.dom.querySelector(".ws-find-widget") === null);
-  openSearchPanel(view);
-  const widget = view.dom.querySelector(".ws-find-widget");
-  check("find opens Cursor's widget, not the stock search panel", widget !== null && view.dom.querySelector(".cm-search") === null);
-  check("the widget sits in a CodeMirror panel", widget?.closest(".cm-panel") !== null);
-
-  const find = widget.querySelector("input[name=search]");
-  const replace = widget.querySelector("input[name=replace]");
-  check("the find field says Find", find?.getAttribute("placeholder") === "Find" && find.getAttribute("aria-label") === "Find");
-  check(
-    "the replace field says Replace",
-    replace?.getAttribute("placeholder") === "Replace" && replace.getAttribute("aria-label") === "Replace",
-  );
-  const labels = [...widget.querySelectorAll("button")].map((button) => button.getAttribute("aria-label")).sort();
-  const EXPECTED = [
-    "Close (Escape)",
-    "Match Case (Alt+C)",
-    "Match Whole Word (Alt+W)",
-    "Next Match (Enter)",
-    "Previous Match (Shift+Enter)",
-    "Replace (Enter)",
-    "Replace All (Ctrl+Alt+Enter)",
-    "Toggle Replace",
-    "Use Regular Expression (Alt+R)",
-  ].sort();
-  check(`the buttons carry Cursor's labels (${labels.join(" | ")})`, labels.join("|") === EXPECTED.join("|"));
-  check(
-    "every button's tooltip is its label",
-    [...widget.querySelectorAll("button")].every((button) => button.title === button.getAttribute("aria-label")),
-  );
-  const button = (label) => widget.querySelector(`button[aria-label="${label}"]`);
-  const count = () => widget.querySelector(".ws-find-count")?.textContent;
-  const type = (input, value) => {
-    input.value = value;
-    input.dispatchEvent(new window.Event("input", { bubbles: true }));
-  };
-  const press = (input, init) =>
-    input.dispatchEvent(new window.KeyboardEvent("keydown", { bubbles: true, cancelable: true, ...init }));
-
-  check("the replace row starts hidden", widget.dataset.replace === "false");
-  button("Toggle Replace").click();
-  check("Toggle Replace shows the replace row", widget.dataset.replace === "true");
-  button("Toggle Replace").click();
-  check("Toggle Replace again hides it", widget.dataset.replace === "false");
-  revealReplace(view);
-  check("revealReplace shows the replace row for Replace (Ctrl+H)", widget.dataset.replace === "true");
-
-  check("an empty query reads No results", count() === "No results");
-  type(find, "zzz");
-  check("a query with no match reads No results", count() === "No results");
-  type(find, "a");
-  check("typing sets the search query", getSearchQuery(view.state).search === "a");
-  check("matches are counted, the current one unknown", count() === "? of 3");
-  press(find, { key: "Enter", keyCode: 13 });
-  check(
-    "Enter goes to the first match and counts it",
-    view.state.selection.main.from === 0 && view.state.selection.main.to === 1 && count() === "1 of 3",
-  );
-  press(find, { key: "Enter", keyCode: 13 });
-  check("Enter again goes to the next match", view.state.selection.main.from === 4 && count() === "2 of 3");
-  press(find, { key: "Enter", keyCode: 13, shiftKey: true });
-  check("Shift+Enter goes back", view.state.selection.main.from === 0 && count() === "1 of 3");
-  button("Next Match (Enter)").click();
-  button("Previous Match (Shift+Enter)").click();
-  check("the Next and Previous buttons walk the matches", view.state.selection.main.from === 0 && count() === "1 of 3");
-
-  // The count rescans the document only when its answer can change: an update
-  // that moves nothing (scroll, focus, geometry) must not walk every match.
-  const queryProto = Object.getPrototypeOf(getSearchQuery(view.state));
-  const realGetCursor = queryProto.getCursor;
-  let scans = 0;
-  queryProto.getCursor = function countedGetCursor(...args) {
-    scans += 1;
-    return realGetCursor.apply(this, args);
-  };
-  try {
-    view.dispatch({});
-    view.dispatch({ effects: EditorView.scrollIntoView(0) });
-    view.requestMeasure();
-    check("updates that change neither query, text, nor selection do not rescan", scans === 0);
-  } finally {
-    queryProto.getCursor = realGetCursor;
-  }
-  view.dispatch({ selection: { anchor: 4, head: 5 } });
-  check("a moved selection recounts", count() === "2 of 3");
-  view.dispatch({ changes: { from: view.state.doc.length, insert: "a" } });
-  check("an edit recounts", count() === "2 of 4");
-  view.dispatch({ changes: { from: view.state.doc.length - 1, to: view.state.doc.length } });
-  view.dispatch({ selection: { anchor: 0, head: 1 } });
-  check("undoing the edit and moving back recounts", count() === "1 of 3");
-
-  const toggles = ["Match Case (Alt+C)", "Match Whole Word (Alt+W)", "Use Regular Expression (Alt+R)"];
-  check("the option toggles start unpressed", toggles.every((label) => button(label).getAttribute("aria-pressed") === "false"));
-  button("Match Case (Alt+C)").click();
-  check(
-    "Match Case sets the query's flag and shows pressed",
-    getSearchQuery(view.state).caseSensitive === true && button("Match Case (Alt+C)").getAttribute("aria-pressed") === "true",
-  );
-  press(find, { key: "w", altKey: true });
-  check("Alt+W toggles whole word from the find field", getSearchQuery(view.state).wholeWord === true);
-  press(find, { key: "r", altKey: true });
-  check("Alt+R toggles the regular expression", getSearchQuery(view.state).regexp === true);
-  press(find, { key: "c", altKey: true });
-  check("Alt+C toggles match case back off", getSearchQuery(view.state).caseSensitive === false);
-  button("Match Whole Word (Alt+W)").click();
-  button("Use Regular Expression (Alt+R)").click();
-
-  // Replace through the widget.
-  type(find, "alpha");
-  type(replace, "ALPHA");
-  press(find, { key: "Enter", keyCode: 13 });
-  button("Replace (Enter)").click();
-  check("Replace swaps the current match", surface.text() === "ALPHA beta\nthird line\n");
-  type(find, "i");
-  type(replace, "!");
-  press(replace, { key: "Enter", keyCode: 13, ctrlKey: true, altKey: true });
-  check("Ctrl+Alt+Enter replaces every match", surface.text() === "ALPHA beta\nth!rd l!ne\n");
-  type(find, "e");
-  button("Replace All (Ctrl+Alt+Enter)").click();
-  check("Replace All swaps every match", surface.text() === "ALPHA b!ta\nth!rd l!n!\n");
-  type(find, "th!rd");
-  type(replace, "third");
-  press(find, { key: "Enter", keyCode: 13 });
-  press(replace, { key: "Enter", keyCode: 13 });
-  check("Enter in the replace field replaces the current match", surface.text() === "ALPHA b!ta\nthird l!n!\n");
-
-  press(find, { key: "Escape", keyCode: 27 });
-  check("Escape closes the widget", !searchPanelOpen(view.state) && view.dom.querySelector(".ws-find-widget") === null);
-  openSearchPanel(view);
-  view.dom.querySelector('button[aria-label="Close (Escape)"]').click();
-  check("the Close button closes it", !searchPanelOpen(view.state));
-  openSearchPanel(view);
-  closeSearchPanel(view);
-  surface.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`editor-idioms: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-idioms: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-panel.mjs b/crates/workshop/ui/test/editor-panel.mjs
deleted file mode 100644
index aeb051d4c..000000000
--- a/crates/workshop/ui/test/editor-panel.mjs
+++ /dev/null
@@ -1,405 +0,0 @@
-// Integration test for the editor panel and EditorSurface contract
-// (src/parts/editor/editor-panel.ts, editor-surface.ts, and the file
-// read/write half of src/services/workspace-api.ts). Bundles the modules with esbuild
-// and drives them in jsdom.
-//
-// jsdom note: CodeMirror 6 runs in jsdom once Range gains the measurement
-// shims below (getBoundingClientRect / getClientRects), so the surface
-// contract - open, dirty tracking, markSaved - is tested against the real
-// CodeMirrorSurface. The panel logic (dirty title, save flow, conflict
-// dialog) is tested with the real EditorPanel and a stubbed surface, so
-// those assertions never depend on editor internals.
-//
-// Run: node test/editor-panel.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { CodeMirrorSurface } from "./src/parts/editor/editor-surface.ts";
-      export { PanelTab } from "./src/parts/layout/panel-tab.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-// CodeMirror measures text through Range, which jsdom does not layout;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-if (!window.HTMLElement.prototype.getBoundingClientRect) {
-  window.HTMLElement.prototype.getBoundingClientRect = zeroRect;
-}
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-for (const key of [
-  "document",
-  "navigator",
-  "Window",
-  "HTMLElement",
-  "Node",
-  "Element",
-  "Range",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-panel-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { EditorPanel, CodeMirrorSurface, PanelTab } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- A scripted workspace file API with a token state machine -------------
-//
-// The "disk" holds text and an opaque conflict token (a counter rendered
-// as a string, as the server's token is opaque to the client). PUT with a
-// matching expected token writes and bumps the token; a stale token
-// answers 409 with the server's modified_conflict code. `failNextPut`
-// forces one conflict regardless, so the test can arm the race
-// deterministically.
-const FILE_PATH = "C:\\project\\a.txt";
-const disk = { text: "hello\n", tokenSeq: 100, failNextPut: false };
-const diskToken = () => `t${disk.tokenSeq}`;
-const puts = [];
-globalThis.fetch = async (url, options) => {
-  const target = typeof url === "string" ? url : url.url;
-  if (target.startsWith("/workspace/file") && !options) {
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        path: FILE_PATH,
-        size: disk.text.length,
-        token: diskToken(),
-        text: disk.text,
-      }),
-    };
-  }
-  if (target === "/workspace/file" && options?.method === "PUT") {
-    const body = JSON.parse(options.body);
-    puts.push(body);
-    if (disk.failNextPut || body.expected_token !== diskToken()) {
-      disk.failNextPut = false;
-      return {
-        ok: false,
-        status: 409,
-        json: async () => ({
-          error: { message: "file changed on disk since it was read", code: "modified_conflict" },
-        }),
-      };
-    }
-    disk.text = body.text;
-    disk.tokenSeq += 100;
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        path: FILE_PATH,
-        size: disk.text.length,
-        token: diskToken(),
-        text: disk.text,
-      }),
-    };
-  }
-  throw new Error(`unexpected fetch in the ws-editor-panel test: ${target}`);
-};
-
-// --- A stub EditorSurface: the panel's contract, no editor internals ------
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    opened: [],
-    currentText: "",
-    dirty: false,
-    open(document) {
-      this.opened.push(document);
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-function fakeParameters(path, id = `editor:${path}`) {
-  const titles = [];
-  return {
-    params: { path },
-    api: { id, setTitle: (title) => titles.push(title) },
-    titles,
-  };
-}
-
-/** The header tab Dockview would mount for a panel id, wired the way the dock wires it. */
-function mountTab(id, title) {
-  const tab = new PanelTab();
-  tab.init({
-    api: { id, component: "editor", onDidTitleChange: () => ({ dispose() {} }) },
-    title,
-    tabLocation: "header",
-    params: {},
-    containerApi: {},
-    group: {},
-  });
-  return tab;
-}
-
-// --- Panel logic: open, dirty title, save, conflict dialog -----------------
-
-const stub = createStubSurface();
-const params = fakeParameters(FILE_PATH, "editor-a");
-// The tab mounts before the panel, as Dockview mounts a panel's tab with it.
-const panelTab = mountTab("editor-a", "a.txt");
-const panel = new EditorPanel({ createSurface: () => stub });
-panel.init(params);
-await flush();
-const dotted = () => panelTab.element.classList.contains("ws-tab--dirty");
-
-check(
-  "opening a file loads its text into the surface",
-  stub.opened.length === 1 && stub.opened[0].text === "hello\n",
-);
-check("the tab title is the file's base name", params.titles.at(-1) === "a.txt");
-check("a freshly opened document is not dirty", !panel.isDirty());
-check("a clean document's tab shows no dirty dot", !dotted());
-
-stub.type("hello world\n");
-check("typing sets the dirty state", panel.isDirty());
-check("dirty state shows as the tab's dot", dotted());
-check("the dirty title carries no bullet prefix", params.titles.every((title) => !title.includes("●")));
-check("the dirty title is still the file's base name", params.titles.at(-1) === "a.txt");
-
-await panel.save();
-check("save writes with the read token", puts.length === 1 && puts[0].expected_token === "t100");
-check("save sends the editor text", puts[0].text === "hello world\n");
-check("save clears the dirty state", !panel.isDirty());
-check("save clears the tab's dirty dot", !dotted());
-check("save leaves the clean title", params.titles.at(-1) === "a.txt");
-
-// A tab that mounts after the panel went dirty still shows the dot.
-stub.type("typed before the tab mounted\n");
-panelTab.dispose();
-const lateTab = mountTab("editor-a", "a.txt");
-check("a tab mounted while the panel is dirty shows the dot at once", lateTab.element.classList.contains("ws-tab--dirty"));
-stub.markSaved(stub.text());
-check("a clean panel's dot goes out", !lateTab.element.classList.contains("ws-tab--dirty"));
-lateTab.dispose();
-// Back to the saved text, so the conflict cases below start from the disk's content.
-stub.currentText = "hello world\n";
-
-// Stale token: the next PUT conflicts, surfacing the dialog.
-stub.type("local edits\n");
-disk.failNextPut = true;
-await panel.save();
-const overlay = panel.element.querySelector(".ws-editor-conflict-overlay");
-check("a stale modified-time token surfaces the conflict dialog", !!overlay);
-check(
-  "the conflict dialog is a modal dialog",
-  overlay?.querySelector(".ws-editor-conflict")?.getAttribute("role") === "dialog" &&
-    overlay.querySelector(".ws-editor-conflict")?.getAttribute("aria-modal") === "true",
-);
-check(
-  "the conflict dialog wears Cursor's confirmation skin",
-  overlay?.classList.contains("modal-overlay--confirmation") === true &&
-    overlay.querySelector(".ws-editor-conflict")?.classList.contains("modal-dialog--confirmation") === true,
-);
-check("the conflicted save did not write", disk.text === "hello world\n");
-
-// Escape dismisses without resolving the conflict.
-document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Escape" }));
-check("Escape dismisses the conflict dialog", !panel.element.querySelector(".ws-editor-conflict-overlay"));
-check("dismissing leaves the editor dirty", panel.isDirty());
-
-// Reload: the on-disk text replaces the editor's text.
-disk.text = "on disk\n";
-disk.failNextPut = true;
-await panel.save();
-const reloadButton = [...panel.element.querySelectorAll(".ws-editor-conflict__button")].find(
-  (button) => button.textContent === "Reload",
-);
-reloadButton.click();
-await flush();
-check("Reload dismisses the dialog", !panel.element.querySelector(".ws-editor-conflict-overlay"));
-check(
-  "Reload replaces the editor text with the on-disk text",
-  stub.opened.at(-1).text === "on disk\n",
-);
-check("Reload clears the dirty state", !panel.isDirty());
-
-// Overwrite: re-read the fresh token, then write the editor's text.
-stub.type("mine\n");
-disk.failNextPut = true;
-await panel.save();
-const overwriteButton = [...panel.element.querySelectorAll(".ws-editor-conflict__button")].find(
-  (button) => button.textContent === "Overwrite",
-);
-const putsBeforeOverwrite = puts.length;
-overwriteButton.click();
-await flush();
-check("Overwrite dismisses the dialog", !panel.element.querySelector(".ws-editor-conflict-overlay"));
-check(
-  "Overwrite re-reads the token and writes the editor text",
-  puts.length === putsBeforeOverwrite + 1 &&
-    puts.at(-1).text === "mine\n" &&
-    puts.at(-1).expected_token === `t${disk.tokenSeq - 100}`,
-);
-check("Overwrite wins the file", disk.text === "mine\n");
-check("Overwrite clears the dirty state", !panel.isDirty());
-
-// The conflict dialog traps Tab inside its buttons (jsdom only tracks
-// focus for connected elements, so the panel mounts for this pass).
-stub.type("trap check\n");
-disk.failNextPut = true;
-await panel.save();
-window.document.body.appendChild(panel.element);
-const trapButtons = [...panel.element.querySelectorAll(".ws-editor-conflict__button")];
-trapButtons.at(-1).focus();
-document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Tab" }));
-check("Tab wraps focus from the last button to the first", document.activeElement === trapButtons[0]);
-trapButtons[0].focus();
-document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Tab", shiftKey: true }));
-check(
-  "Shift+Tab wraps focus from the first button to the last",
-  document.activeElement === trapButtons.at(-1),
-);
-document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Escape" }));
-panel.element.remove();
-
-// Revert File on a dirty editor asks first, in the same confirmation skin.
-panel.requestRevert();
-const revertOverlay = panel.element.querySelector(".ws-editor-revert-overlay");
-check(
-  "Revert File on a dirty editor opens the confirmation prompt",
-  revertOverlay?.classList.contains("modal-overlay--confirmation") === true &&
-    revertOverlay.querySelector(".ws-editor-revert")?.classList.contains("modal-dialog--confirmation") === true,
-);
-document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Escape" }));
-check("Escape dismisses the revert prompt", !panel.element.querySelector(".ws-editor-revert-overlay"));
-
-// --- The real CodeMirrorSurface honors the EditorSurface contract ---------
-
-const surface = new CodeMirrorSurface();
-window.document.body.appendChild(surface.element);
-surface.open({ path: FILE_PATH, text: "one\n" });
-check("the real surface mounts a CodeMirror editor", !!surface.element.querySelector(".cm-editor"));
-check("the real surface starts clean", !surface.isDirty());
-check("the real surface reports its text", surface.text() === "one\n");
-
-// Type through the view's dispatch, as user input would. The view is
-// TypeScript-private but reachable at runtime, which keeps the dirty
-// assertions on the real updateListener instead of a reimplementation.
-const view = surface.element.querySelector(".cm-content");
-check("the editor content is editable", view?.getAttribute("contenteditable") === "true");
-
-const dirtyEvents = [];
-const unsubscribe = surface.onDirtyChange((dirty) => dirtyEvents.push(dirty));
-surface.view.dispatch({ changes: { from: 3, insert: "!" } });
-check("an edit sets the real surface dirty", surface.isDirty());
-check("the dirty transition fires the listener", dirtyEvents.join(",") === "true");
-check("the edit landed in the document", surface.text() === "one!\n");
-
-// Reverting the edit by hand returns to the saved baseline: clean again.
-surface.view.dispatch({ changes: { from: 3, to: 4 } });
-check("reverting to the saved text clears dirty", !surface.isDirty());
-check("the clean transition fires the listener", dirtyEvents.join(",") === "true,false");
-
-surface.view.dispatch({ changes: { from: 0, insert: "x" } });
-check("a second edit dirties again", surface.isDirty());
-surface.markSaved(surface.text());
-check("markSaved with the current text clears dirty and rebaselines", !surface.isDirty());
-surface.view.dispatch({ changes: { from: 1, to: 1 } });
-check("a no-op change keeps the surface clean", !surface.isDirty());
-
-surface.open({ path: FILE_PATH, text: "two\n" });
-check("reopening replaces the document", surface.text() === "two\n" && !surface.isDirty());
-unsubscribe();
-surface.dispose();
-check("dispose tears the editor down", !surface.element.querySelector(".cm-editor"));
-
-if (failures.length > 0) {
-  console.error(`ws-editor-panel: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-editor-panel: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-save-as.mjs b/crates/workshop/ui/test/editor-save-as.mjs
deleted file mode 100644
index 2f4901cfb..000000000
--- a/crates/workshop/ui/test/editor-save-as.mjs
+++ /dev/null
@@ -1,428 +0,0 @@
-// Save As test for the editor panel (src/parts/editor/editor-panel.ts):
-// the OS save dialog's replace confirmation is the user's consent, so a
-// Save As onto an existing file retries once with the target's token
-// instead of opening the conflict dialog, which acts on the old path.
-// Covers six cases: Save As onto an existing file writes the target,
-// retargets the panel, and leaves the old file untouched; a target read
-// failure shows an error naming the target and doesn't retarget; a retry
-// that conflicts again does the same; a 408 shows the save timeout
-// message, doesn't retarget, and leaves the open file's token known; a
-// 408 on the retry onto an existing target does the same; and a retry
-// after a 408 whose write landed takes the 409 path and converges.
-// Drives the real EditorPanel with a stubbed surface and an in-memory
-// disk, the same way editor-save-timeout.mjs does.
-// Run: node test/editor-save-as.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { CatalogError, ErrorCatalog } from "./src/services/error-catalog.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The panel imports its colocated CSS; strip it - the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7913/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-for (const key of [
-  "document",
-  "navigator",
-  "HTMLElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "KeyboardEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-save-as-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, EditorPanel, CatalogError, ErrorCatalog } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const OLD_PATH = "C:\\project\\a.txt";
-const TARGET_PATH = "C:\\elsewhere\\b.txt";
-
-// The panel's contract stub, mirroring editor-save-timeout.mjs: markSaved
-// rebaselines against the written text, dirty recomputes against the live
-// text.
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-function fakeParameters(filePath) {
-  return { params: { path: filePath }, api: { setTitle() {}, close() {} } };
-}
-
-// The typed failures the reader and writer surface, matching the
-// boundary's codes so the panel's narrowing helpers recognize them.
-const deadlineError = () =>
-  new CatalogError(ErrorCatalog.DeadlineElapsed, "save timed out", { status: 408 });
-const conflictError = () =>
-  new CatalogError(ErrorCatalog.ModifiedConflict, "file changed on disk", { status: 409 });
-const notTextError = () =>
-  new CatalogError(ErrorCatalog.HttpStatus, "the file is not UTF-8 text", { status: 422 });
-const notFoundError = () =>
-  new CatalogError(ErrorCatalog.HttpStatus, "no such file", { status: 404 });
-
-// An in-memory workspace with the server's token rule: a write whose
-// expected token doesn't match the file on disk is refused with a 409,
-// and a null token matches only a file that doesn't exist yet. `script`
-// scripts the next writes in order: "timeout" answers 408 before writing,
-// "timeout-landed" writes and then answers 408, and null follows the
-// token rule. `unreadable` maps a path to the error its read throws, and
-// `afterRead` runs after each successful read.
-function createDisk(files) {
-  const entries = new Map(Object.entries(files));
-  let serial = 0;
-  const disk = {
-    entries,
-    puts: [],
-    reads: [],
-    script: [],
-    unreadable: new Map(),
-    afterRead: () => {},
-    readFile: async (filePath) => {
-      disk.reads.push(filePath);
-      const failure = disk.unreadable.get(filePath);
-      if (failure !== undefined) throw failure();
-      const file = entries.get(filePath);
-      if (file === undefined) throw notFoundError();
-      disk.afterRead(filePath);
-      return { path: filePath, size: file.text.length, token: file.token, text: file.text };
-    },
-    writeFile: async (filePath, text, expectedToken) => {
-      disk.puts.push({ path: filePath, text, expectedToken });
-      const scripted = disk.script.shift() ?? null;
-      if (scripted === "timeout") throw deadlineError();
-      if ((entries.get(filePath)?.token ?? null) !== expectedToken) throw conflictError();
-      serial += 1;
-      const file = { text, token: `t${serial}` };
-      entries.set(filePath, file);
-      if (scripted === "timeout-landed") throw deadlineError();
-      return { path: filePath, size: text.length, token: file.token, text };
-    },
-  };
-  return disk;
-}
-
-function createPanel(stub, disk) {
-  return new EditorPanel({
-    createSurface: () => stub,
-    readFile: disk.readFile,
-    writeFile: disk.writeFile,
-  });
-}
-
-const errorBar = (panel) => panel.element.querySelector(".ws-editor-panel__error");
-const conflictOverlay = (panel) => panel.element.querySelector(".ws-editor-conflict-overlay");
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Save As onto an existing file replaces it and retargets ---------------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({
-      [OLD_PATH]: { text: "old", token: "t-old" },
-      [TARGET_PATH]: { text: "target", token: "t-target" },
-    });
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "Save As onto an existing file retries once with the target's token",
-      disk.puts.length === 2 &&
-        disk.puts[0].expectedToken === null &&
-        disk.puts[1].expectedToken === "t-target",
-    );
-    check(
-      "Save As onto an existing file writes the live text to the target",
-      disk.entries.get(TARGET_PATH)?.text === "new",
-    );
-    check("Save As onto an existing file retargets the panel", panel.filePath() === TARGET_PATH);
-    check("Save As onto an existing file leaves the panel clean", !panel.isDirty());
-    check(
-      "Save As onto an existing file leaves the old file untouched",
-      disk.puts.every((put) => put.path === TARGET_PATH) &&
-        disk.entries.get(OLD_PATH)?.text === "old" &&
-        disk.entries.get(OLD_PATH)?.token === "t-old",
-    );
-    check(
-      "Save As onto an existing file never opens the conflict dialog",
-      conflictOverlay(panel) === null && errorBar(panel) === null,
-    );
-
-    // The panel adopted the target's fresh token, so the next save lands.
-    stub.type("newer");
-    await panel.save();
-    check(
-      "a save after Save As onto an existing file writes the target with its fresh token",
-      disk.entries.get(TARGET_PATH)?.text === "newer" &&
-        conflictOverlay(panel) === null &&
-        errorBar(panel) === null,
-    );
-    panel.dispose();
-  }
-
-  // --- A target read failure shows an error and doesn't retarget -------------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({
-      [OLD_PATH]: { text: "old", token: "t-old" },
-      [TARGET_PATH]: { text: "binary", token: "t-target" },
-    });
-    disk.unreadable.set(TARGET_PATH, notTextError);
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "an unreadable Save As target shows an error naming the target",
-      errorBar(panel)?.textContent.includes(TARGET_PATH),
-    );
-    check("an unreadable Save As target doesn't retarget", panel.filePath() === OLD_PATH);
-    check("an unreadable Save As target leaves the panel dirty", panel.isDirty());
-    check("an unreadable Save As target never opens the conflict dialog", conflictOverlay(panel) === null);
-    check(
-      "an unreadable Save As target is never written",
-      disk.puts.length === 1 && disk.entries.get(TARGET_PATH)?.text === "binary",
-    );
-    panel.dispose();
-  }
-
-  // --- A retry that conflicts again shows an error and doesn't retarget ------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({
-      [OLD_PATH]: { text: "old", token: "t-old" },
-      [TARGET_PATH]: { text: "target", token: "t-target" },
-    });
-    // An outside edit lands between the target read and the retry.
-    disk.afterRead = (filePath) => {
-      if (filePath === TARGET_PATH) {
-        disk.entries.set(TARGET_PATH, { text: "outside", token: "t-outside" });
-      }
-    };
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "a Save As retry that conflicts again shows an error naming the target",
-      errorBar(panel)?.textContent.includes(TARGET_PATH),
-    );
-    check("a Save As retry that conflicts again doesn't retarget", panel.filePath() === OLD_PATH);
-    check(
-      "a Save As retry that conflicts again never opens the conflict dialog",
-      conflictOverlay(panel) === null,
-    );
-    check(
-      "a Save As retry that conflicts again retries only once and keeps the outside edit",
-      disk.puts.length === 2 && disk.entries.get(TARGET_PATH)?.text === "outside",
-    );
-    panel.dispose();
-  }
-
-  // --- A 408 shows the timeout message and doesn't retarget ------------------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({ [OLD_PATH]: { text: "old", token: "t-old" } });
-    disk.script = ["timeout"];
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "a Save As 408 shows the save timeout message",
-      errorBar(panel)?.textContent.includes("may or may not"),
-    );
-    check("a Save As 408 doesn't retarget", panel.filePath() === OLD_PATH);
-    check("a Save As 408 leaves the panel dirty", panel.isDirty());
-    check("a Save As 408 never opens the conflict dialog", conflictOverlay(panel) === null);
-
-    // The timeout was the target's, not the open file's: the next save
-    // writes the open file with its known token, without a reconcile read.
-    const readsBefore = disk.reads.length;
-    await panel.save();
-    check(
-      "a Save As 408 leaves the open file's token known",
-      disk.reads.length === readsBefore &&
-        disk.puts.at(-1)?.path === OLD_PATH &&
-        disk.puts.at(-1)?.expectedToken === "t-old" &&
-        disk.entries.get(OLD_PATH)?.text === "new",
-    );
-    panel.dispose();
-  }
-
-  // --- A 408 on the retry shows the timeout and doesn't retarget -------------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({
-      [OLD_PATH]: { text: "old", token: "t-old" },
-      [TARGET_PATH]: { text: "target", token: "t-target" },
-    });
-    // The null-token write conflicts; the retry with the target's token
-    // times out before writing.
-    disk.script = [null, "timeout"];
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "a Save As retry 408 comes from the retry with the target's token",
-      disk.puts.length === 2 && disk.puts[1].expectedToken === "t-target",
-    );
-    check(
-      "a Save As retry 408 shows the save timeout message",
-      errorBar(panel)?.textContent.includes("may or may not"),
-    );
-    check("a Save As retry 408 doesn't retarget", panel.filePath() === OLD_PATH);
-    check("a Save As retry 408 leaves the panel dirty", panel.isDirty());
-    check("a Save As retry 408 never opens the conflict dialog", conflictOverlay(panel) === null);
-    check(
-      "a Save As retry 408 leaves the target untouched",
-      disk.entries.get(TARGET_PATH)?.text === "target",
-    );
-
-    const readsBefore = disk.reads.length;
-    await panel.save();
-    check(
-      "a Save As retry 408 leaves the open file's token known",
-      disk.reads.length === readsBefore &&
-        disk.puts.at(-1)?.path === OLD_PATH &&
-        disk.puts.at(-1)?.expectedToken === "t-old" &&
-        disk.entries.get(OLD_PATH)?.text === "new",
-    );
-    panel.dispose();
-  }
-
-  // --- A retry after a landed 408 takes the 409 path and converges -----------
-  {
-    const stub = createStubSurface();
-    const disk = createDisk({ [OLD_PATH]: { text: "old", token: "t-old" } });
-    disk.script = ["timeout-landed"];
-    const panel = createPanel(stub, disk);
-    panel.init(fakeParameters(OLD_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.saveAs(TARGET_PATH);
-    check("a landed Save As 408 still doesn't retarget", panel.filePath() === OLD_PATH);
-    const landedToken = disk.entries.get(TARGET_PATH)?.token;
-
-    errorBar(panel)?.remove();
-    await panel.saveAs(TARGET_PATH);
-    check(
-      "a Save As retry after a landed 408 retries once with the landed token",
-      disk.puts.length === 3 &&
-        disk.puts[1].expectedToken === null &&
-        disk.puts[2].expectedToken === landedToken,
-    );
-    check("a Save As retry after a landed 408 retargets the panel", panel.filePath() === TARGET_PATH);
-    check("a Save As retry after a landed 408 leaves the panel clean", !panel.isDirty());
-    check(
-      "a Save As retry after a landed 408 shows no error and no conflict dialog",
-      errorBar(panel) === null && conflictOverlay(panel) === null,
-    );
-    panel.dispose();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`editor-save-as: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-save-as: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-save-race.mjs b/crates/workshop/ui/test/editor-save-race.mjs
deleted file mode 100644
index 12144a1d7..000000000
--- a/crates/workshop/ui/test/editor-save-race.mjs
+++ /dev/null
@@ -1,297 +0,0 @@
-// Save-race test for the editor panel (src/parts/editor/editor-panel.ts,
-// editor-surface.ts): the saved baseline is the text the write persisted,
-// not whatever the editor holds when the PUT resolves. Keystrokes typed
-// while a write is in flight must stay dirty: baselining the live text
-// instead would count them as saved, and confirmClose() would skip the
-// unsaved-changes prompt and lose them silently. Drives the real
-// EditorPanel with a stubbed surface and a writer that stalls until the
-// test releases it.
-// Run: node test/editor-save-race.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { CatalogError, ErrorCatalog } from "./src/services/error-catalog.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The panel imports its colocated CSS; strip it - the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-for (const key of [
-  "document",
-  "navigator",
-  "HTMLElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "KeyboardEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-save-race-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, EditorPanel, CatalogError, ErrorCatalog } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const FILE_PATH = "C:\\project\\race.txt";
-
-// The panel's contract stub, mirroring markSaved's semantics: the saved
-// baseline is the written text, dirty recomputes against the live text.
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-// A writer that records every PUT and stalls each one until released.
-function createStallingWriter() {
-  const puts = [];
-  let release = null;
-  let nextTokenSeq = 200;
-  return {
-    puts,
-    write(filePath, text, expectedToken) {
-      puts.push({ path: filePath, text, expectedToken });
-      return new Promise((resolve) => {
-        release = () => {
-          const token = `t${nextTokenSeq}`;
-          nextTokenSeq += 100;
-          resolve({ path: filePath, size: text.length, token, text });
-        };
-      });
-    },
-    release() {
-      release();
-      release = null;
-    },
-  };
-}
-
-function fakeParameters(filePath) {
-  return { params: { path: filePath }, api: { setTitle() {} } };
-}
-
-const readFile = async () => ({ path: FILE_PATH, size: 0, token: "t100", text: "" });
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Typing while a save is in flight stays dirty -------------------------
-
-  const stub = createStubSurface();
-  const writer = createStallingWriter();
-  const panel = new EditorPanel({
-    createSurface: () => stub,
-    readFile,
-    writeFile: writer.write,
-  });
-  panel.init(fakeParameters(FILE_PATH));
-  await flush();
-
-  stub.type("A");
-  const firstSave = panel.save();
-  check("the stalled save writes the text captured at save time", writer.puts.at(-1)?.text === "A");
-
-  void panel.save();
-  check("a second save while one is in flight is a no-op", writer.puts.length === 1);
-
-  stub.type("AB");
-  writer.release();
-  await firstSave;
-  await flush();
-
-  check("a keystroke typed during the write stays dirty after the save resolves", panel.isDirty());
-
-  const secondSave = panel.save();
-  check(
-    "a second save writes the full text including the in-flight keystroke",
-    writer.puts.length === 2 && writer.puts.at(-1).text === "AB",
-  );
-  check(
-    "the second save sends the token from the first write",
-    writer.puts.at(-1).expectedToken === "t200",
-  );
-  writer.release();
-  await secondSave;
-  check("the second save clears the dirty state", !panel.isDirty());
-  panel.dispose();
-
-  // --- The close-dialog Save path keeps the panel open while text is unsaved
-
-  const closeStub = createStubSurface();
-  const closeWriter = createStallingWriter();
-  const closePanel = new EditorPanel({
-    createSurface: () => closeStub,
-    readFile,
-    writeFile: closeWriter.write,
-  });
-  closePanel.init(fakeParameters(FILE_PATH));
-  await flush();
-
-  closeStub.type("A");
-  let dialogAnswer = null;
-  void closePanel.confirmClose().then((confirmed) => {
-    dialogAnswer = confirmed;
-  });
-  check(
-    "a dirty panel opens the unsaved-changes dialog",
-    closePanel.element.querySelector(".ws-editor-close-overlay") !== null,
-  );
-  const saveButton = [...closePanel.element.querySelectorAll(".ws-editor-close__button")].find(
-    (button) => button.textContent === "Save",
-  );
-  saveButton.click();
-  closeStub.type("AB");
-  closeWriter.release();
-  await flush();
-
-  check("the close-dialog Save does not close while a keystroke is unsaved", dialogAnswer === false);
-  check("the panel is still dirty after the close-dialog Save", closePanel.isDirty());
-
-  const finishSave = closePanel.save();
-  closeWriter.release();
-  await finishSave;
-  check(
-    "once fully saved, the panel closes without a prompt",
-    (await closePanel.confirmClose()) === true &&
-      closePanel.element.querySelector(".ws-editor-close-overlay") === null,
-  );
-  closePanel.dispose();
-
-  // --- The saving guard does not wedge the conflict dialog's Overwrite ------
-
-  const conflictStub = createStubSurface();
-  const conflictPuts = [];
-  let releaseOverwrite = null;
-  let failNextPut = true;
-  const conflictPanel = new EditorPanel({
-    createSurface: () => conflictStub,
-    readFile: async () => ({ path: FILE_PATH, size: 7, token: "t500", text: "on disk" }),
-    writeFile: (filePath, text, expectedToken) => {
-      if (failNextPut) {
-        failNextPut = false;
-        return Promise.reject(
-          new CatalogError(ErrorCatalog.ModifiedConflict, "file changed on disk"),
-        );
-      }
-      conflictPuts.push({ path: filePath, text, expectedToken });
-      return new Promise((resolve) => {
-        releaseOverwrite = () =>
-          resolve({ path: filePath, size: text.length, token: "t900", text });
-      });
-    },
-  });
-  conflictPanel.init(fakeParameters(FILE_PATH));
-  await flush();
-
-  conflictStub.type("mine");
-  await conflictPanel.save();
-  check(
-    "a conflicted save opens the conflict dialog",
-    conflictPanel.element.querySelector(".ws-editor-conflict-overlay") !== null,
-  );
-
-  const overwriteButton = [...conflictPanel.element.querySelectorAll(".ws-editor-conflict__button")]
-    .find((button) => button.textContent === "Overwrite");
-  overwriteButton.click();
-  await flush();
-  check(
-    "the Overwrite button runs despite the saving guard, with the fresh token",
-    conflictPuts.length === 1 && conflictPuts[0].expectedToken === "t500",
-  );
-
-  void conflictPanel.save();
-  check("a save while the overwrite is in flight is a no-op", conflictPuts.length === 1);
-
-  releaseOverwrite();
-  await flush();
-  check("the released overwrite clears the dirty state", !conflictPanel.isDirty());
-  conflictPanel.dispose();
-});
-
-if (failures.length > 0) {
-  console.error(`editor-save-race: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-save-race: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-save-timeout.mjs b/crates/workshop/ui/test/editor-save-timeout.mjs
deleted file mode 100644
index 2c80e30ad..000000000
--- a/crates/workshop/ui/test/editor-save-timeout.mjs
+++ /dev/null
@@ -1,406 +0,0 @@
-// Save-timeout test for the editor panel (src/parts/editor/editor-panel.ts):
-// a 408 on save (the deadline_elapsed error) leaves the conflict token
-// unknown, and the next save reconciles with the file on disk instead of
-// re-sending a token that may now be stale. Covers six cases: the 408
-// marks the token unknown and sends no stale token; a disk match adopts
-// the fresh token and saves; a mismatch shows the conflict dialog, worded
-// for an earlier timed-out save or an outside edit; a late write that
-// lands after the re-read surfaces the conflict dialog, not a raw error;
-// an Overwrite 408 marks the token unknown the same way a save 408 does;
-// and an Overwrite entered with the token already unknown, whose
-// timed-out write landed, lets the next save adopt the fresh token.
-// Drives the real EditorPanel with a stubbed surface and scripted
-// reader/writer, the same way editor-save-race.mjs does.
-// Run: node test/editor-save-timeout.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { CatalogError, ErrorCatalog } from "./src/services/error-catalog.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The panel imports its colocated CSS; strip it - the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7913/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-for (const key of [
-  "document",
-  "navigator",
-  "HTMLElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "KeyboardEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-save-timeout-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, EditorPanel, CatalogError, ErrorCatalog } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const FILE_PATH = "C:\\project\\save-timeout.txt";
-
-// The panel's contract stub, mirroring editor-save-race.mjs: markSaved
-// rebaselines against the written text, dirty recomputes against the live
-// text.
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-function fakeParameters(filePath) {
-  return { params: { path: filePath }, api: { setTitle() {}, close() {} } };
-}
-
-// The typed failures the writer surfaces, matching the write boundary's
-// codes so the panel's narrowing helpers recognize them.
-const deadlineError = () =>
-  new CatalogError(ErrorCatalog.DeadlineElapsed, "save timed out", { status: 408 });
-const conflictError = () =>
-  new CatalogError(ErrorCatalog.ModifiedConflict, "file changed on disk", { status: 409 });
-
-const errorBar = (panel) => panel.element.querySelector(".ws-editor-panel__error");
-const conflictOverlay = (panel) => panel.element.querySelector(".ws-editor-conflict-overlay");
-const conflictMessage = (panel) =>
-  panel.element.querySelector(".ws-editor-conflict__line")?.textContent ?? "";
-const overwriteButton = (panel) =>
-  [...panel.element.querySelectorAll(".ws-editor-conflict__button")].find(
-    (button) => button.textContent === "Overwrite",
-  );
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- A 408 leaves the token unknown and sends no stale token ---------------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        // The write never lands: the server answered 408 before it wrote.
-        return Promise.reject(deadlineError());
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    check(
-      "a 408 tells the user the save may not have landed",
-      errorBar(panel)?.textContent.includes("may or may not"),
-    );
-
-    await panel.save();
-    check(
-      "an unknown token never sends the stale token on the next save",
-      puts.length === 1 && puts[0].expectedToken === "t100",
-    );
-    panel.dispose();
-  }
-
-  // --- A disk match adopts the fresh token and saves -------------------------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    let timedOut = true;
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        if (timedOut) {
-          timedOut = false;
-          // The late write lands: the disk now holds what was sent.
-          disk = { text, token: "t200" };
-          return Promise.reject(deadlineError());
-        }
-        return Promise.resolve({ path: filePath, size: text.length, token: "t300", text });
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    await panel.save();
-    check(
-      "a disk match adopts the fresh token and saves with it",
-      puts.length === 2 && puts[1].expectedToken === "t200" && puts[1].text === "new",
-    );
-    check("the adopted-token save clears the dirty state", !panel.isDirty());
-    panel.dispose();
-  }
-
-  // --- A mismatch shows the conflict dialog ----------------------------------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        return Promise.reject(deadlineError());
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    // The file changed externally while the write was unknown.
-    disk = { text: "external edit", token: "t500" };
-    await panel.save();
-    check("a mismatched disk shows the conflict dialog", conflictOverlay(panel) !== null);
-    check(
-      "the mismatch dialog names an earlier timed-out save as well as an outside edit",
-      conflictMessage(panel).includes("timed-out save") && conflictMessage(panel).includes("outside edit"),
-    );
-    check("a mismatch never writes with the stale token", puts.length === 1);
-    panel.dispose();
-  }
-
-  // --- A late write landing after the re-read shows the conflict dialog -------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    let timedOut = true;
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        if (timedOut) {
-          timedOut = false;
-          // The late write lands before the re-read, so the disk matches.
-          disk = { text, token: "t200" };
-          return Promise.reject(deadlineError());
-        }
-        // The adopted token was fresh at re-read time, but a late write
-        // landed afterward and bumped the token: the write conflicts.
-        return Promise.reject(conflictError());
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    errorBar(panel)?.remove();
-    await panel.save();
-    check(
-      "a late write landing after the re-read shows the conflict dialog",
-      conflictOverlay(panel) !== null,
-    );
-    check(
-      "a late write landing after the re-read is not a raw error",
-      errorBar(panel) === null,
-    );
-    panel.dispose();
-  }
-
-  // --- An Overwrite 408 leaves the token unknown ------------------------------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        if (puts.length === 1) {
-          // The file changed externally since the load: the save conflicts.
-          disk = { text: "external edit", token: "t500" };
-          return Promise.reject(conflictError());
-        }
-        if (puts.length === 2) {
-          // The Overwrite never lands: the server answered 408 before it wrote.
-          return Promise.reject(deadlineError());
-        }
-        return Promise.resolve({ path: filePath, size: text.length, token: "t900", text });
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    overwriteButton(panel).click();
-    await flush();
-    check(
-      "an Overwrite 408 tells the user the save may not have landed",
-      errorBar(panel)?.textContent.includes("may or may not"),
-    );
-
-    await panel.save();
-    check(
-      "an Overwrite 408 leaves the token unknown, so the next save re-reads instead of writing",
-      puts.length === 2 && conflictOverlay(panel) !== null,
-    );
-    panel.dispose();
-  }
-
-  // --- An Overwrite whose timed-out write landed adopts the fresh token -------
-  {
-    const stub = createStubSurface();
-    const puts = [];
-    let disk = { text: "old", token: "t100" };
-    const panel = new EditorPanel({
-      createSurface: () => stub,
-      readFile: async () => ({
-        path: FILE_PATH, size: disk.text.length, token: disk.token, text: disk.text,
-      }),
-      writeFile: (filePath, text, expectedToken) => {
-        puts.push({ path: filePath, text, expectedToken });
-        if (puts.length === 1) {
-          // The save never lands: the server answered 408 before it wrote.
-          return Promise.reject(deadlineError());
-        }
-        if (puts.length === 2) {
-          // The late Overwrite lands: the disk now holds what was sent.
-          disk = { text, token: "t600" };
-          return Promise.reject(deadlineError());
-        }
-        return Promise.resolve({ path: filePath, size: text.length, token: "t700", text });
-      },
-    });
-    panel.init(fakeParameters(FILE_PATH));
-    await flush();
-
-    stub.type("new");
-    await panel.save();
-    // The file changed externally while the write was unknown, so the
-    // reconcile read mismatches and the dialog opens with the token still
-    // unknown.
-    disk = { text: "external edit", token: "t500" };
-    await panel.save();
-    check(
-      "an unknown-token mismatch opens the conflict dialog before the Overwrite",
-      puts.length === 1 && conflictOverlay(panel) !== null,
-    );
-    // Typed after the mismatched save, so the Overwrite sends different
-    // text than the timed-out save did and reconciliation must match the
-    // Overwrite's.
-    stub.type("newer");
-    overwriteButton(panel).click();
-    await flush();
-    await panel.save();
-    check(
-      "an Overwrite whose timed-out write landed lets the next save adopt the fresh token",
-      puts.length === 3 && puts[2].expectedToken === "t600" && puts[2].text === "newer",
-    );
-    check(
-      "the adopted-token save after an Overwrite does not reopen the conflict dialog",
-      conflictOverlay(panel) === null,
-    );
-    check("the adopted-token save after an Overwrite clears the dirty state", !panel.isDirty());
-    panel.dispose();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`editor-save-timeout: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-save-timeout: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/editor-settings.mjs b/crates/workshop/ui/test/editor-settings.mjs
deleted file mode 100644
index 211388050..000000000
--- a/crates/workshop/ui/test/editor-settings.mjs
+++ /dev/null
@@ -1,503 +0,0 @@
-// Unit test for the editor settings service and its surface wiring
-// (src/parts/editor/editor-settings-service.ts,
-// editor-surface.ts, editor.contribution.ts). The service seeds four
-// settings (three booleans and the three-way Render Whitespace mode)
-// from the UI-state adapter's user bucket behind a shape check, writes every change back through the adapter, publishes
-// them as the config.editor.* context keys, and fires onDidChange; the
-// CodeMirror surface holds one Compartment per setting and follows
-// the service in place - no state rebuild. The contribution's four
-// toggle actions are asserted on the shared registries. Bundles the
-// modules with esbuild and drives them in jsdom with the same
-// measurement shims as editor-idioms.mjs.
-// Run: node --test test/editor-settings.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/editor/editor.contribution.ts";
-      export { CodeMirrorSurface } from "./src/parts/editor/editor-surface.ts";
-      export { EditorSettingsService } from "./src/parts/editor/editor-settings-service.ts";
-      export { DEFAULT_EDITOR_SETTINGS, EDITOR_SETTINGS_SERVICE } from "./src/services/editor-settings-service.ts";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { getService } from "@workshop/platform/service-registry";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus, MenuId } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { EditorView } from "@codemirror/view";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7913/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-// CodeMirror measures text through Range, which jsdom does not layout;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-if (!window.HTMLElement.prototype.getBoundingClientRect) {
-  window.HTMLElement.prototype.getBoundingClientRect = zeroRect;
-}
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-for (const key of [
-  "document",
-  "navigator",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "Node",
-  "Element",
-  "Range",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-  "localStorage",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The contribution registers at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-editor-settings-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  CodeMirrorSurface,
-  DEFAULT_EDITOR_SETTINGS,
-  EDITOR_SETTINGS_SERVICE,
-  EditorSettingsService,
-  ContextKeyService,
-  getService,
-  Commands,
-  Menus,
-  MenuId,
-  KeybindingsRegistry,
-  EditorView,
-} = await import(pathToFileURL(bundlePath).href);
-console.error = realConsoleError;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** The user-bucket key the composition root binds the service to. */
-const KEY = "editor_settings";
-
-/**
- * Builds a service over a fake adapter the way main.ts binds the live one:
- * the initial value read from the user bucket, every change written back
- * to the same key. Returns the service and the fake, whose `sets` records
- * the writes.
- */
-function serviceOver(initial, contextKeys = null) {
-  const storage = createFakeUiStorage(initial === undefined ? {} : { user: { [KEY]: initial } });
-  const service = new EditorSettingsService(
-    storage.get("user", KEY),
-    (value) => storage.set("user", KEY, value),
-    contextKeys,
-  );
-  return { service, storage };
-}
-
-{
-  // Defaults, toggle, the write-through, and the no-op set.
-  const { service, storage } = serviceOver();
-  check("wordWrap defaults off", service.settings.wordWrap === false);
-  check("renderWhitespace defaults to selection, as in Cursor", service.settings.renderWhitespace === "selection");
-  check("the exported renderWhitespace default is selection", DEFAULT_EDITOR_SETTINGS.renderWhitespace === "selection");
-  check("renderControlCharacters defaults on, as in Cursor", service.settings.renderControlCharacters === true);
-  check("columnSelection defaults off", service.settings.columnSelection === false);
-  check("the exported defaults match", DEFAULT_EDITOR_SETTINGS.renderControlCharacters === true);
-  check("construction writes nothing", storage.sets.length === 0);
-
-  let fired = 0;
-  let last = null;
-  service.onDidChange((settings) => { fired += 1; last = settings; });
-  service.toggle("wordWrap");
-  check("toggle flips the setting", service.settings.wordWrap === true);
-  check("toggle fires onDidChange with the new settings", fired === 1 && last !== null && last.wordWrap === true);
-  check(
-    "toggle writes the whole settings object to the user bucket",
-    storage.sets.length === 1 &&
-      storage.sets[0].bucket === "user" &&
-      storage.sets[0].key === KEY &&
-      storage.sets[0].value.wordWrap === true &&
-      storage.sets[0].value.renderControlCharacters === true,
-  );
-
-  service.set("wordWrap", true);
-  check("set to the current value is a no-op - no event, no write", fired === 1 && storage.sets.length === 1);
-
-  // A relaunch: a new service seeded from what the last write stored.
-  const reloaded = new EditorSettingsService(storage.get("user", KEY), () => {}, null);
-  check("a new service over the written value reads it back", reloaded.settings.wordWrap === true);
-
-  const { service: fromMalformed } = serviceOver("{not json");
-  check(
-    "a non-object initial value reads as the defaults, never a cast",
-    fromMalformed.settings.wordWrap === false && fromMalformed.settings.renderControlCharacters === true,
-  );
-  const { service: fromArray } = serviceOver([true, true, true, true]);
-  check("an array initial value reads as the defaults", fromArray.settings.wordWrap === false);
-  const { service: fromWrongTypes } = serviceOver({ wordWrap: "yes", columnSelection: 1, renderWhitespace: true });
-  check(
-    "mistyped fields drop to defaults",
-    fromWrongTypes.settings.wordWrap === false &&
-      fromWrongTypes.settings.columnSelection === false &&
-      fromWrongTypes.settings.renderWhitespace === "selection",
-  );
-  // The three render-whitespace modes; any other stored value reads as the
-  // default (selection).
-  const modeOf = (stored) => serviceOver({ renderWhitespace: stored }).service.settings.renderWhitespace;
-  check("a stored none reads as none", modeOf("none") === "none");
-  check("a stored selection reads as selection", modeOf("selection") === "selection");
-  check("a stored all reads as all", modeOf("all") === "all");
-  check("a stored boolean reads as the default", modeOf(true) === "selection" && modeOf(false) === "selection");
-  check("an unknown stored string reads as the default", modeOf("sometimes") === "selection");
-  check("a stored number reads as the default", modeOf(1) === "selection");
-  check("a missing key reads as the default", serviceOver({}).service.settings.renderWhitespace === "selection");
-
-  // Choosing a mode writes the mode string, never a boolean.
-  const { service: modal, storage: modalStorage } = serviceOver();
-  modal.set("renderWhitespace", "all");
-  check(
-    "set takes a mode and writes it to the user bucket",
-    modal.settings.renderWhitespace === "all" && modalStorage.sets.at(-1)?.value.renderWhitespace === "all",
-  );
-  modal.set("renderWhitespace", "all");
-  check("set to the current mode is a no-op write", modalStorage.sets.length === 1);
-
-  // The Render Whitespace toggle flips between none and all; the default
-  // selection reads as on, so the first flip turns it off.
-  const { service: flipper } = serviceOver();
-  flipper.toggle("renderWhitespace");
-  check("toggling from the default selection goes to none", flipper.settings.renderWhitespace === "none");
-  flipper.toggle("renderWhitespace");
-  check("toggling from none goes to all", flipper.settings.renderWhitespace === "all");
-  flipper.toggle("renderWhitespace");
-  check("toggling from all goes to none", flipper.settings.renderWhitespace === "none");
-  modal.dispose();
-  flipper.dispose();
-
-  service.dispose();
-  reloaded.dispose();
-  fromMalformed.dispose();
-  fromArray.dispose();
-  fromWrongTypes.dispose();
-}
-
-{
-  // A writer that fails leaves the in-memory settings authoritative: the
-  // toggle still lands, the event still fires, and nothing escapes.
-  let writes = 0;
-  const service = new EditorSettingsService(
-    null,
-    () => {
-      writes += 1;
-      throw new Error("denied");
-    },
-    null,
-  );
-  let fired = 0;
-  service.onDidChange(() => { fired += 1; });
-  let escaped = false;
-  try {
-    service.toggle("columnSelection");
-  } catch {
-    escaped = true;
-  }
-  check("a failing writer does not escape the toggle", escaped === false);
-  check("a failing writer still receives the attempt", writes === 1);
-  check("a failing writer leaves the new value in place", service.settings.columnSelection === true);
-  check("a failing writer still fires onDidChange", fired === 1);
-  service.dispose();
-}
-
-{
-  // The config.editor.* context keys follow the service.
-  const contextKeys = new ContextKeyService();
-  const { service } = serviceOver({ wordWrap: true }, contextKeys);
-  check(
-    "construction publishes the defaults - the render-whitespace key is true under the default selection mode",
-    contextKeys.getValue("config.editor.renderControlCharacters") === true &&
-      contextKeys.getValue("config.editor.renderWhitespace") === true &&
-      contextKeys.getValue("config.editor.columnSelection") === false,
-  );
-  check(
-    "construction publishes the persisted value over the default",
-    contextKeys.getValue("config.editor.wordWrap") === true,
-  );
-  service.toggle("renderWhitespace");
-  check(
-    "toggling Render Whitespace off clears its boolean key",
-    contextKeys.getValue("config.editor.renderWhitespace") === false,
-  );
-  service.toggle("renderWhitespace");
-  check("toggling back sets the boolean key (mode all)", contextKeys.getValue("config.editor.renderWhitespace") === true);
-  service.set("renderWhitespace", "selection");
-  check(
-    "the key stays boolean true for the selection mode",
-    contextKeys.getValue("config.editor.renderWhitespace") === true,
-  );
-  service.set("renderWhitespace", "none");
-  check("only the none mode clears the key", contextKeys.getValue("config.editor.renderWhitespace") === false);
-  service.dispose();
-
-  // A persisted none publishes false over the true default.
-  const offKeys = new ContextKeyService();
-  const { service: persistedOff } = serviceOver({ renderWhitespace: "none" }, offKeys);
-  check(
-    "a persisted none publishes a false key at construction",
-    offKeys.getValue("config.editor.renderWhitespace") === false,
-  );
-  persistedOff.dispose();
-}
-
-{
-  // The surface's compartments follow the service in place.
-  const contextKeys = new ContextKeyService();
-  const { service } = serviceOver(undefined, contextKeys);
-  const surface = new CodeMirrorSurface(service);
-  window.document.body.appendChild(surface.element);
-  surface.open({ path: "C:\\project\\c.txt", text: "alpha beta\nthird line\n" });
-  const view = surface.editorView();
-
-  const wraps = () =>
-    view.state
-      .facet(EditorView.contentAttributes)
-      .some((value) => typeof value !== "function" && value.class === "cm-lineWrapping");
-  check("word wrap starts off", !wraps());
-  service.toggle("wordWrap");
-  check("toggling wordWrap reconfigures the lineWrapping compartment", wraps());
-  check("the wordWrap context key follows the surface's service", contextKeys.getValue("config.editor.wordWrap") === true);
-  check("a reconfigure keeps the same view - no state rebuild", surface.editorView() === view);
-  check("a reconfigure keeps the document text", surface.text() === "alpha beta\nthird line\n");
-  service.toggle("wordWrap");
-  check("toggling wordWrap off reconfigures back", !wraps());
-
-  // Render Whitespace: the default selection mode marks whitespace inside
-  // the selection only; all marks every space and tab; none marks nothing.
-  const spaces = () => view.contentDOM.querySelectorAll(".cm-highlightSpace").length;
-  const tabs = () => view.contentDOM.querySelectorAll(".cm-highlightTab").length;
-  check("the default is the selection mode", service.settings.renderWhitespace === "selection");
-  check("selection mode marks nothing while no text is selected", spaces() === 0);
-  view.dispatch({ selection: { anchor: 0, head: 10 } });
-  check("selection mode marks the space inside a selection", spaces() === 1);
-  view.dispatch({ selection: { anchor: 0, head: 5 } });
-  check("selection mode marks nothing when the selection holds no whitespace", spaces() === 0);
-  view.dispatch({ selection: { anchor: 11, head: 21 } });
-  check("selection mode marks only the selected line's whitespace", spaces() === 1);
-  view.dispatch({ selection: { anchor: 3, head: 3 } });
-  check("selection mode clears when the selection collapses", spaces() === 0);
-
-  service.set("renderWhitespace", "all");
-  check("all marks every space in the document", spaces() === 2);
-  service.toggle("renderWhitespace");
-  check("toggling from all removes the highlights", spaces() === 0);
-  view.dispatch({ selection: { anchor: 0, head: 21 } });
-  check("none marks nothing even inside a selection", spaces() === 0);
-  service.toggle("renderWhitespace");
-  check("toggling from none highlights every space again", spaces() === 2);
-
-  // Tabs follow the same rules as spaces.
-  surface.open({ path: "C:\\project\\tabs.txt", text: "a\tb\n" });
-  check("all marks a tab", tabs() === 1);
-  service.set("renderWhitespace", "selection");
-  view.dispatch({ selection: { anchor: 0, head: 3 } });
-  check("selection mode marks a selected tab", tabs() === 1);
-  view.dispatch({ selection: { anchor: 0, head: 1 } });
-  check("selection mode leaves an unselected tab alone", tabs() === 0);
-  surface.open({ path: "C:\\project\\c.txt", text: "alpha beta\nthird line\n" });
-  service.set("renderWhitespace", "selection");
-
-  // Control characters: on by default, over a document holding one.
-  surface.open({ path: "C:\\project\\c.txt", text: "a\u0001b\n" });
-  check(
-    "control characters render by default",
-    view.contentDOM.querySelector(".cm-specialChar") !== null,
-  );
-  service.toggle("renderControlCharacters");
-  check(
-    "toggling renderControlCharacters off drops the rendering",
-    view.contentDOM.querySelector(".cm-specialChar") === null,
-  );
-  service.toggle("renderControlCharacters");
-  check(
-    "toggling renderControlCharacters back on restores it",
-    view.contentDOM.querySelector(".cm-specialChar") !== null,
-  );
-
-  // Column selection: the mouseSelectionStyle facet answers whether a
-  // drag gesture starts a rectangular selection. Cursor's gesture is
-  // Shift+Alt+drag, because a plain Alt+click adds a cursor; the off state
-  // keeps exactly that one.
-  const plainDrag = { altKey: false, shiftKey: false, button: 0, clientX: 0, clientY: 0 };
-  const altDrag = { altKey: true, shiftKey: false, button: 0, clientX: 0, clientY: 0 };
-  const shiftAltDrag = { altKey: true, shiftKey: true, button: 0, clientX: 0, clientY: 0 };
-  const styles = () => view.state.facet(EditorView.mouseSelectionStyle);
-  check(
-    "Shift+Alt+drag starts a rectangular selection",
-    styles().some((style) => style(view, shiftAltDrag) !== null),
-  );
-  check(
-    "a plain Alt+drag is not rectangular - Alt+click adds a cursor instead",
-    styles().every((style) => style(view, altDrag) === null),
-  );
-  check(
-    "a plain drag is not rectangular by default",
-    styles().every((style) => style(view, plainDrag) === null),
-  );
-  service.toggle("columnSelection");
-  check(
-    "column selection makes every left drag rectangular",
-    styles().some((style) => style(view, plainDrag) !== null),
-  );
-  service.toggle("columnSelection");
-  check(
-    "toggling column selection off restores the Shift+Alt gesture only",
-    styles().every((style) => style(view, plainDrag) === null) &&
-      styles().some((style) => style(view, shiftAltDrag) !== null),
-  );
-
-  // A surface created after a change seeds its first state from the
-  // service's current settings.
-  service.set("wordWrap", true);
-  const seeded = new CodeMirrorSurface(service);
-  window.document.body.appendChild(seeded.element);
-  seeded.open({ path: "C:\\project\\d.txt", text: "seeded\n" });
-  check(
-    "a new surface's first state applies the current settings",
-    seeded
-      .editorView()
-      .state.facet(EditorView.contentAttributes)
-      .some((value) => typeof value !== "function" && value.class === "cm-lineWrapping"),
-  );
-  seeded.dispose();
-  surface.dispose();
-  service.dispose();
-}
-
-{
-  // The contribution's four toggle actions on the shared registries.
-  check("the contribution registered without errors", consoleErrors.length === 0);
-  const TOGGLES = [
-    ["editor.action.toggleColumnSelection", "config.editor.columnSelection"],
-    ["editor.action.toggleWordWrap", "config.editor.wordWrap"],
-    ["editor.action.toggleRenderWhitespace", "config.editor.renderWhitespace"],
-    ["editor.action.toggleRenderControlCharacter", "config.editor.renderControlCharacters"],
-  ];
-  for (const [id, toggled] of TOGGLES) {
-    check(`${id} is a registered command`, Commands.lookup(id) !== undefined);
-    check(`${id} declares its toggled expression`, Commands.lookup(id)?.toggled === toggled);
-  }
-  const palette = Menus.getMenuItems(MenuId.CommandPalette).map((row) => row.command);
-  check(
-    "every toggle reaches the palette",
-    TOGGLES.every(([id]) => palette.includes(id)),
-  );
-  const viewMenu = Menus.getMenuItems(MenuId.MenubarViewMenu).map((row) => row.command);
-  check("Word Wrap lands in the View menu", viewMenu.includes("editor.action.toggleWordWrap"));
-  const appearance = Menus.getMenuItems("menubar/view/appearance").map((row) => row.command);
-  check(
-    "the render toggles land in the Appearance menu",
-    appearance.includes("editor.action.toggleRenderWhitespace") &&
-      appearance.includes("editor.action.toggleRenderControlCharacter"),
-  );
-  const selectionMenu = Menus.getMenuItems(MenuId.MenubarSelectionMenu).map((row) => row.command);
-  check(
-    "Column Selection Mode lands in the Selection menu",
-    selectionMenu.includes("editor.action.toggleColumnSelection"),
-  );
-  check(
-    "Word Wrap binds Alt+Z",
-    KeybindingsRegistry.lookupKeybinding("editor.action.toggleWordWrap") !== undefined,
-  );
-  check(
-    "Render Whitespace has no keybinding",
-    KeybindingsRegistry.lookupKeybinding("editor.action.toggleRenderWhitespace") === undefined,
-  );
-  check(
-    "Column Selection Mode keeps the editor-only precondition",
-    Commands.lookup("editor.action.toggleColumnSelection")?.precondition === "activeEditor == 'editor'",
-  );
-  check(
-    "Word Wrap has no precondition - it toggles without an active editor",
-    Commands.lookup("editor.action.toggleWordWrap")?.precondition === undefined,
-  );
-
-  // Executing through the command registry flips the shared service.
-  const shared = getService(EDITOR_SETTINGS_SERVICE);
-  check(
-    "the Render Whitespace row reads as checked by default: its mode is not none",
-    shared.settings.renderWhitespace === "selection",
-  );
-  await Commands.execute("editor.action.toggleRenderWhitespace");
-  check("executing the Render Whitespace row turns it off", shared.settings.renderWhitespace === "none");
-  await Commands.execute("editor.action.toggleRenderWhitespace");
-  check("executing it again turns it all the way on", shared.settings.renderWhitespace === "all");
-  shared.set("renderWhitespace", "selection");
-  const before = shared.settings.wordWrap;
-  const executed = await Commands.execute("editor.action.toggleWordWrap");
-  check(
-    "executing the toggle flips the shared settings service",
-    executed === true && shared.settings.wordWrap === !before,
-  );
-  await Commands.execute("editor.action.toggleWordWrap");
-}
-
-if (failures.length > 0) {
-  console.error(`editor-settings: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("editor-settings: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/error-catalog.mjs b/crates/workshop/ui/test/error-catalog.mjs
deleted file mode 100644
index c2a50786e..000000000
--- a/crates/workshop/ui/test/error-catalog.mjs
+++ /dev/null
@@ -1,246 +0,0 @@
-// Unit test for the typed error catalog (src/services/error-catalog.ts), the
-// Result constructors it builds on (@workshop/platform/result), and its
-// adoption at the HTTP boundaries (src/services/workspace-api.ts,
-// src/parts/workspace/workspace-drops.ts). Bundles the TS modules with esbuild
-// and imports them via a data URL. Covers: the Result constructors and the
-// CatalogError shape; the shared errorText narrowing; the workspace API
-// throwing typed variants for transport, HTTP, shape, and conflict
-// failures; isModifiedConflict keying on the catalog code rather than a
-// class; and grantPath returning a typed Result instead of throwing.
-// Run: node test/error-catalog.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as catalog from "./src/services/error-catalog.ts";
-      export * as result from "@workshop/platform/result";
-      export * as workspace from "./src/services/workspace-api.ts";
-      export { grantPath } from "./src/parts/workspace/workspace-drops.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { catalog, result, workspace, grantPath } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const { ErrorCatalog, CatalogError } = catalog;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Scripts globalThis.fetch per case: `respond` is a fake Response or a
-// function throwing a transport failure.
-function withFetch(respond, run) {
-  const previous = globalThis.fetch;
-  globalThis.fetch =
-    respond instanceof Error
-      ? async () => {
-          throw respond;
-        }
-      : async () => respond;
-  return run().finally(() => {
-    globalThis.fetch = previous;
-  });
-}
-
-const jsonResponse = (status, body) => ({
-  ok: status >= 200 && status < 300,
-  status,
-  json: async () => body,
-});
-
-// --- The Result constructors ------------------------------------------------
-
-{
-  const success = result.ok(42);
-  check("ok holds the value", success.ok === true && success.value === 42);
-  const failure = result.err(new CatalogError(ErrorCatalog.Transport, "down"));
-  check("err holds the error", failure.ok === false && failure.error.code === "transport");
-  check(
-    "the catalog leaves the Result constructors to platform",
-    !("ok" in catalog) && !("err" in catalog),
-  );
-}
-
-// --- The CatalogError shape ---------------------------------------------------
-
-{
-  const error = new CatalogError(ErrorCatalog.HttpStatus, "GET /x answered 500", {
-    status: 500,
-  });
-  check("a catalog error is an Error", error instanceof Error);
-  check("a catalog error keeps its message", error.message === "GET /x answered 500");
-  check("a catalog error keeps its code", error.code === ErrorCatalog.HttpStatus);
-  check("a catalog error keeps the HTTP status", error.status === 500);
-  check("a catalog error names itself", error.name === "CatalogError");
-  check(
-    "isCatalogError narrows by code",
-    catalog.isCatalogError(error, ErrorCatalog.HttpStatus) &&
-      !catalog.isCatalogError(error, ErrorCatalog.Transport),
-  );
-  check(
-    "isCatalogError refuses plain Errors",
-    !catalog.isCatalogError(new Error("GET /x answered 500")),
-  );
-}
-
-// --- errorText: the one narrowing helper --------------------------------------
-
-{
-  check(
-    "errorText reads an Error's message",
-    catalog.errorText(new Error("plain")) === "plain",
-  );
-  check(
-    "errorText reads a foreign object's message",
-    catalog.errorText({ message: "foreign" }) === "foreign",
-  );
-  check("errorText falls back to String()", catalog.errorText(42) === "42");
-}
-
-// --- workspace-api: typed transport, HTTP, and shape failures -----------------
-
-await withFetch(new Error("connection refused"), async () => {
-  let caught = null;
-  try {
-    await workspace.fetchTree(null);
-  } catch (error) {
-    caught = error;
-  }
-  check("a transport failure throws a CatalogError", caught instanceof CatalogError);
-  check(
-    "a transport failure reports the transport code",
-    caught !== null && caught.code === ErrorCatalog.Transport,
-  );
-  check(
-    "a transport failure keeps the cause's message",
-    caught !== null && caught.message.includes("connection refused"),
-  );
-});
-
-await withFetch(
-  jsonResponse(500, { error: { message: "disk full", code: "internal" } }),
-  async () => {
-    let caught = null;
-    try {
-      await workspace.fetchTree(null);
-    } catch (error) {
-      caught = error;
-    }
-    check("an HTTP failure throws a CatalogError", caught instanceof CatalogError);
-    check(
-      "an HTTP failure reports the http_status code and status",
-      caught !== null && caught.code === ErrorCatalog.HttpStatus && caught.status === 500,
-    );
-    check(
-      "an HTTP failure keeps the server's message",
-      caught !== null && caught.message === "disk full",
-    );
-  },
-);
-
-await withFetch(jsonResponse(200, { unexpected: true }), async () => {
-  let caught = null;
-  try {
-    await workspace.fetchTree(null);
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "a shape failure reports the unexpected_shape code",
-    caught instanceof CatalogError && caught.code === ErrorCatalog.UnexpectedShape,
-  );
-});
-
-// --- writeFile: the conflict is a catalog code, not a class --------------------
-
-await withFetch(
-  jsonResponse(409, { error: { message: "the file changed on disk", code: "modified_conflict" } }),
-  async () => {
-    let caught = null;
-    try {
-      await workspace.writeFile("/tmp/a.md", "text", null);
-    } catch (error) {
-      caught = error;
-    }
-    check(
-      "a modified conflict is a CatalogError with the conflict code",
-      caught instanceof CatalogError && caught.code === ErrorCatalog.ModifiedConflict,
-    );
-    check("isModifiedConflict recognizes the conflict", workspace.isModifiedConflict(caught));
-  },
-);
-
-await withFetch(
-  jsonResponse(409, { error: { message: "some other refusal", code: "other" } }),
-  async () => {
-    let caught = null;
-    try {
-      await workspace.writeFile("/tmp/a.md", "text", null);
-    } catch (error) {
-      caught = error;
-    }
-    check(
-      "a non-conflict 409 is a plain HTTP failure",
-      caught instanceof CatalogError && caught.code === ErrorCatalog.HttpStatus,
-    );
-    check(
-      "isModifiedConflict refuses a non-conflict failure",
-      !workspace.isModifiedConflict(caught),
-    );
-  },
-);
-
-// --- grantPath: a typed Result instead of a throw ------------------------------
-
-await withFetch(jsonResponse(200, { granted: "/tmp/x" }), async () => {
-  const result = await grantPath("/tmp/x");
-  check("a granted path resolves ok", result.ok === true);
-});
-
-await withFetch(
-  jsonResponse(403, { error: { message: "path is outside every granted root" } }),
-  async () => {
-    const result = await grantPath("/tmp/blocked");
-    check("a refused grant resolves err, never throws", result.ok === false);
-    check(
-      "a refused grant reports the grant_refused code",
-      result.ok === false && result.error.code === ErrorCatalog.GrantRefused,
-    );
-    check(
-      "a refused grant keeps the server's message",
-      result.ok === false && result.error.message === "path is outside every granted root",
-    );
-  },
-);
-
-await withFetch(new Error("socket hangup"), async () => {
-  const result = await grantPath("/tmp/x");
-  check(
-    "a grant transport failure resolves err with the transport code",
-    result.ok === false && result.error.code === ErrorCatalog.Transport,
-  );
-});
-
-if (failures.length > 0) {
-  console.error(`error-catalog: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("error-catalog: all assertions passed");
diff --git a/crates/workshop/ui/test/feed-scroll.mjs b/crates/workshop/ui/test/feed-scroll.mjs
deleted file mode 100644
index 4e91f3e19..000000000
--- a/crates/workshop/ui/test/feed-scroll.mjs
+++ /dev/null
@@ -1,318 +0,0 @@
-// The transcript feed's scroll behavior (src/parts/agent/transcript/feed-scroll.ts)
-// against a fake scroller and a ResizeObserver shim: the feed starts pinned;
-// scrolling up within 250ms of an input event unpins it, scrolling with no
-// recent input (a layout shift, its own follow) does not, and reaching the
-// bottom pins again; while pinned, growth up to one viewport follows
-// smoothly at no more than 3.6px/ms, bigger growth and reduced motion jump;
-// a send forces an instant pin; growth while unpinned leaves the feed where
-// the operator put it; the trailing spacer is 14px plus a fifth of the
-// feed's height clamped to 80-240px.
-// Run: node test/feed-scroll.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export {
-        FeedScroll,
-        spacerHeight,
-        PIN_THRESHOLD_PX,
-        INPUT_WINDOW_MS,
-        FOLLOW_SPEED_PX_PER_MS,
-        FOLLOW_SNAP_MS,
-      } from "./src/parts/agent/transcript/feed-scroll.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// A frame queue the test steps by hand.
-let frames = [];
-let nextFrame = 0;
-globalThis.requestAnimationFrame = (callback) => {
-  frames.push({ id: ++nextFrame, callback });
-  return nextFrame;
-};
-globalThis.cancelAnimationFrame = (id) => {
-  frames = frames.filter((frame) => frame.id !== id);
-};
-function runFrame(time) {
-  const due = frames;
-  frames = [];
-  for (const frame of due) frame.callback(time);
-}
-
-// A ResizeObserver whose callbacks the test fires.
-const observers = [];
-globalThis.ResizeObserver = class {
-  constructor(callback) {
-    this.callback = callback;
-    this.live = true;
-    observers.push(this);
-  }
-  observe() {}
-  disconnect() {
-    this.live = false;
-  }
-};
-const resize = () => {
-  for (const observer of observers) if (observer.live) observer.callback([]);
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-feed-scroll-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  FeedScroll,
-  spacerHeight,
-  PIN_THRESHOLD_PX,
-  INPUT_WINDOW_MS,
-  FOLLOW_SPEED_PX_PER_MS,
-  FOLLOW_SNAP_MS,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** A scroller whose metrics the test sets; scrollTop clamps like a real one. */
-function makeFeed({ clientHeight = 400, scrollHeight = 1000, scrollTop = 600 } = {}) {
-  const element = document.createElement("div");
-  const content = document.createElement("div");
-  const spacer = document.createElement("div");
-  element.append(content, spacer);
-  document.body.appendChild(element);
-  const state = { scrollTop, scrollHeight, clientHeight };
-  Object.defineProperty(element, "scrollTop", {
-    get: () => state.scrollTop,
-    set: (value) => {
-      state.scrollTop = Math.max(0, Math.min(value, state.scrollHeight - state.clientHeight));
-    },
-  });
-  Object.defineProperty(element, "scrollHeight", { get: () => state.scrollHeight });
-  Object.defineProperty(element, "clientHeight", { get: () => state.clientHeight });
-  return { element, content, spacer, state };
-}
-
-let clock = 0;
-const now = () => clock;
-const wheel = (element) => element.dispatchEvent(new window.Event("wheel"));
-const scrolled = (element) => element.dispatchEvent(new window.Event("scroll"));
-
-function start(options) {
-  const feed = makeFeed(options);
-  const layouts = [];
-  const scroll = new FeedScroll(feed.element, feed.content, {
-    spacer: feed.spacer,
-    now,
-    onLayout: (reason) => layouts.push(reason),
-  });
-  const bottom = () => feed.state.scrollHeight - feed.state.clientHeight;
-  return { ...feed, scroll, layouts, bottom };
-}
-
-// --- The trailing spacer ---------------------------------------------------------------
-
-check("the spacer is 14px plus the 80px floor for a short feed", spacerHeight(100) === 94);
-check("the spacer is 14px plus a fifth of a mid-size feed", spacerHeight(900) === 194);
-check("the spacer is 14px plus the 240px ceiling for a tall feed", spacerHeight(2000) === 254);
-{
-  const feed = start({ clientHeight: 400 });
-  check("the spacer takes its height from the feed on construction", feed.spacer.style.height === "94px");
-  feed.state.clientHeight = 900;
-  resize();
-  check("the spacer follows a resize of the feed", feed.spacer.style.height === "194px");
-  feed.scroll.dispose();
-}
-
-// --- Pinned, released, re-pinned -----------------------------------------------------
-
-check("the thresholds hold their pinned values", PIN_THRESHOLD_PX === 4 && INPUT_WINDOW_MS === 250 && FOLLOW_SPEED_PX_PER_MS === 3.6 && FOLLOW_SNAP_MS === 250);
-
-{
-  const feed = start();
-  check("a feed starts pinned", feed.scroll.pinned === true);
-
-  clock = 1000;
-  wheel(feed.element);
-  clock = 1100;
-  feed.state.scrollTop = 500;
-  scrolled(feed.element);
-  check("scrolling up within 250ms of an input unpins", feed.scroll.pinned === false);
-  check("a scroll reports a layout pass", feed.layouts.includes("scroll"));
-
-  feed.state.scrollTop = feed.bottom() - PIN_THRESHOLD_PX;
-  scrolled(feed.element);
-  check("coming within 4px of the bottom pins again", feed.scroll.pinned === true);
-  feed.scroll.dispose();
-}
-
-{
-  const feed = start();
-  clock = 2000;
-  feed.state.scrollTop = 550;
-  scrolled(feed.element);
-  check("scrolling up with no input at all (a layout shift) does not unpin", feed.scroll.pinned === true);
-
-  wheel(feed.element);
-  clock = 2000 + INPUT_WINDOW_MS + 1;
-  feed.state.scrollTop = 500;
-  scrolled(feed.element);
-  check("scrolling up after the input window has closed does not unpin", feed.scroll.pinned === true);
-
-  clock = 3000;
-  wheel(feed.element);
-  clock = 3000 + INPUT_WINDOW_MS;
-  feed.state.scrollTop = 400;
-  scrolled(feed.element);
-  check("the window's last millisecond still counts", feed.scroll.pinned === false);
-  feed.scroll.dispose();
-}
-
-// --- Following growth ---------------------------------------------------------------------
-
-{
-  const feed = start();
-  feed.state.scrollHeight = 1100;
-  resize();
-  check("growth within a viewport follows on the next frame, not at once", feed.state.scrollTop === 600 && frames.length === 1);
-  runFrame(0);
-  const first = feed.state.scrollTop;
-  runFrame(16);
-  const second = feed.state.scrollTop;
-  check(
-    "the follow eases: each step is at most 3.6px per elapsed millisecond",
-    first > 600 && first - 600 <= FOLLOW_SPEED_PX_PER_MS * 16 + 1e-9 && second > first && second - first <= FOLLOW_SPEED_PX_PER_MS * 16 + 1e-9,
-  );
-  runFrame(32);
-  runFrame(48);
-  check("the follow arrives at the bottom within the snap window", feed.state.scrollTop === feed.bottom() && frames.length === 0);
-  feed.scroll.dispose();
-}
-
-{
-  const feed = start();
-  feed.state.scrollHeight = 1300;
-  resize();
-  clock = 100;
-  wheel(feed.element);
-  runFrame(0);
-  clock = 110;
-  feed.state.scrollTop = feed.state.scrollTop;
-  scrolled(feed.element);
-  runFrame(16);
-  scrolled(feed.element);
-  check("the follow's own downward scrolls never unpin", feed.scroll.pinned === true);
-  feed.scroll.dispose();
-}
-
-{
-  const feed = start();
-  feed.state.scrollHeight = 1600;
-  resize();
-  check(
-    "growth bigger than a viewport jumps straight to the bottom",
-    feed.state.scrollTop === feed.bottom() && frames.length === 0,
-  );
-  feed.scroll.dispose();
-}
-
-{
-  window.matchMedia = (query) => ({ matches: true, media: query });
-  const feed = start();
-  feed.state.scrollHeight = 1100;
-  resize();
-  check(
-    "under reduced motion even small growth jumps",
-    feed.state.scrollTop === feed.bottom() && frames.length === 0,
-  );
-  feed.scroll.dispose();
-  delete window.matchMedia;
-}
-
-{
-  const feed = start();
-  feed.state.clientHeight = 300;
-  resize();
-  check(
-    "a shorter feed while pinned keeps the bottom in view",
-    feed.state.scrollTop === feed.bottom() && frames.length === 0,
-  );
-  feed.scroll.dispose();
-}
-
-// --- Not following ------------------------------------------------------------------------------
-
-{
-  const feed = start();
-  clock = 5000;
-  wheel(feed.element);
-  feed.state.scrollTop = 300;
-  scrolled(feed.element);
-  feed.state.scrollHeight = 1500;
-  resize();
-  check(
-    "growth while unpinned leaves the operator where they are",
-    feed.scroll.pinned === false && feed.state.scrollTop === 300 && frames.length === 0,
-  );
-
-  feed.scroll.forcePin();
-  check(
-    "a send pins at once and jumps to the bottom",
-    feed.scroll.pinned === true && feed.state.scrollTop === feed.bottom() && frames.length === 0,
-  );
-  feed.state.scrollHeight = 1600;
-  resize();
-  check(
-    "growth right after a send jumps rather than easing",
-    feed.state.scrollTop === feed.bottom() && frames.length === 0,
-  );
-  feed.state.scrollHeight = 1700;
-  resize();
-  check("the jump is spent: the next small growth eases again", frames.length === 1);
-  feed.scroll.dispose();
-}
-
-// --- Disposal ----------------------------------------------------------------------------------
-
-{
-  const feed = start();
-  feed.state.scrollHeight = 1100;
-  resize();
-  feed.scroll.dispose();
-  check("disposal cancels a running follow", frames.length === 0);
-  const before = feed.layouts.length;
-  clock = 9000;
-  wheel(feed.element);
-  feed.state.scrollTop = 100;
-  scrolled(feed.element);
-  resize();
-  check("a disposed controller ignores scrolls and resizes", feed.layouts.length === before);
-}
-
-if (failures.length > 0) {
-  console.error(`feed-scroll: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("feed-scroll: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/files-actions.mjs b/crates/workshop/ui/test/files-actions.mjs
deleted file mode 100644
index 4a24f5433..000000000
--- a/crates/workshop/ui/test/files-actions.mjs
+++ /dev/null
@@ -1,700 +0,0 @@
-// Unit test for the File menu's pickers and file actions
-// (src/parts/workspace/workspace.contribution.ts, file-actions.ts, and
-// the add-folder flow in add-folder.ts). Bundles the
-// contribution with esbuild - "@tauri-apps/plugin-dialog" aliased to the
-// scripted stub in test/helpers - and drives the commands through the
-// shared registries against jsdom. Covers: the catalog wiring (titles,
-// menu groups, preconditions, chord labels, palette rows); Open File
-// granting and opening the picked path, with cancel a no-op; Open Folder
-// and Add Folder to Workspace sharing one flow - the native picker on
-// desktop, the typed-path dialog in a plain browser; Save As granting
-// the target's parent before writing and retargeting the panel, with
-// cancel a no-op; Save All writing every dirty editor sequentially and
-// skipping clean ones; and Revert File prompting on unsaved changes
-// before reloading from disk. Also covers: the Open Recent menu's
-// dynamic root and recent-file rows merged with the static More... and
-// Clear Recently Opened... rows; the "" quick-access provider over the
-// recent-files store and the tree's fetched listings, deduped and
-// substring-filtered, whose accept opens an editor through vscode.open;
-// vscode.open and vscode.openFolder narrowing their path argument;
-// vscode.openFolder fetching, caching, and expanding an uncached root
-// before focusing the tree; clearRecentFiles emptying the store; and
-// openRecent showing quick open at the "" list.
-// Run: node --test test/files-actions.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/workspace/workspace.contribution.ts";
-      // Opening a file needs the editor's panel type, registered by its contribution.
-      import "./src/parts/editor/editor.contribution.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-      export { RECENT_FILES_STORE, RecentFilesStore } from "./src/services/recent-files-store.ts";
-      export { TREE_STATE, TreeStateService } from "./src/services/tree-state-service.ts";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { DOCK } from "@workshop/platform/panel-registry";
-      export { QUICK_INPUT_SERVICE } from "./src/services/quick-input-service.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { initZones } from "./src/parts/layout/zones.ts";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-// CodeMirror measures text through Range, which jsdom does not layout;
-// zero-rect shims are enough because the test never asserts geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-if (!window.HTMLElement.prototype.getBoundingClientRect) {
-  window.HTMLElement.prototype.getBoundingClientRect = zeroRect;
-}
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-for (const key of [
-  "document",
-  "navigator",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "Range",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-// Node ships its own Event and CustomEvent globals, so the copy loop skips
-// them - but events the bundle dispatches into the jsdom document must be
-// jsdom-realm instances: jsdom's dispatchEvent rejects Node's Event.
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-
-// The contribution registers at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-files-actions-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  Commands,
-  Menus,
-  KeybindingsRegistry,
-  QuickAccessRegistry,
-  RECENT_FILES_STORE,
-  RecentFilesStore,
-  TREE_STATE,
-  TreeStateService,
-  registerService,
-  DOCK,
-  QUICK_INPUT_SERVICE,
-  EditorPanel,
-  initZones,
-  STATUS_BAR,
-} = await import(pathToFileURL(bundlePath).href);
-console.error = realConsoleError;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets an async action chain (fetch -> json -> dialog) run to completion.
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- Shared fakes ------------------------------------------------------------
-
-const statusMessages = [];
-registerService(STATUS_BAR, () => ({
-  showLocal: (label, severity) => statusMessages.push({ label, severity }),
-}));
-
-// One ordered event log across grants and writes, so Save As can be
-// pinned to grant-the-parent-before-write.
-const events = [];
-const grants = [];
-// Scripted GET /workspace/tree answers, keyed by directory path ("" is
-// the synthetic granted-roots listing). vscode.openFolder reads these.
-const treeListings = new Map();
-let treeFetches = 0;
-globalThis.fetch = async (url, init) => {
-  if (url === "/workspace/grant") {
-    const granted = JSON.parse(init.body).path;
-    grants.push(granted);
-    events.push(`grant:${granted}`);
-    return { ok: true, status: 200, json: async () => ({ granted }) };
-  }
-  if (url === "/workspace/tree" || url.startsWith("/workspace/tree?")) {
-    treeFetches += 1;
-    const dir = new URL(url, "http://127.0.0.1").searchParams.get("path") ?? "";
-    const listing = treeListings.get(dir) ?? { path: dir === "" ? null : dir, entries: [] };
-    return { ok: true, status: 200, json: async () => listing };
-  }
-  throw new Error(`unexpected fetch in the files-actions test: ${url}`);
-};
-
-let workspaceChanges = 0;
-window.addEventListener("runvil:workspace-changed", () => {
-  workspaceChanges += 1;
-});
-
-// A recording EditorSurface stand-in: dirty is divergence from the last
-// open/markSaved baseline, exactly the real surface's contract.
-function fakeSurface(text) {
-  let current = text;
-  let baseline = text;
-  const listeners = [];
-  return {
-    element: window.document.createElement("div"),
-    open(doc) {
-      current = doc.text;
-      baseline = doc.text;
-    },
-    text: () => current,
-    markSaved(t) {
-      baseline = t;
-    },
-    isDirty: () => current !== baseline,
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.push(listener);
-      return () => {};
-    },
-    editorView: () => null,
-    focus() {},
-    dispose() {},
-    // Test-only edit seam: types text and notifies dirty listeners.
-    setText(t) {
-      current = t;
-      for (const listener of listeners) listener(current !== baseline);
-    },
-  };
-}
-
-const writeCalls = [];
-let writesInFlight = 0;
-let maxWritesInFlight = 0;
-const writeFileStub = async (path, text, token) => {
-  writesInFlight += 1;
-  maxWritesInFlight = Math.max(maxWritesInFlight, writesInFlight);
-  writeCalls.push({ path, text, token });
-  events.push(`write:${path}`);
-  await new Promise((resolve) => setTimeout(resolve, 10));
-  writesInFlight -= 1;
-  return { path, size: text.length, token: "tok-next", text };
-};
-
-// Builds an EditorPanel over a fake surface, mounted and loaded.
-function makeEditorPanel({ path: filePath, text, readFile }) {
-  const surface = fakeSurface(text);
-  const titles = [];
-  const panel = new EditorPanel({
-    createSurface: () => surface,
-    readFile:
-      readFile ?? (async (p) => ({ path: p, size: text.length, token: "tok-1", text })),
-    writeFile: writeFileStub,
-  });
-  panel.init({
-    params: { path: filePath },
-    api: { setTitle: (title) => titles.push(title), close() {} },
-  });
-  window.document.body.appendChild(panel.element);
-  return { panel, surface, titles };
-}
-
-// --- Catalog wiring ----------------------------------------------------------
-
-check("the contribution registers without a malformed descriptor", consoleErrors.length === 0);
-
-{
-  const fileRows = Menus.getMenuItems("menubar/file");
-  const paletteRows = Menus.getMenuItems("commandPalette");
-  const expected = [
-    ["workbench.action.files.openFile", "Open File...", "2_open", "!isWeb", "Ctrl+O"],
-    ["workbench.action.files.openFolder", "Open Folder...", "2_open", undefined, "Ctrl+M Ctrl+O"],
-    ["workbench.action.addRootFolder", "Add Folder to Workspace...", "3_workspace", undefined, undefined],
-    ["workbench.action.files.saveAs", "Save As...", "4_save", "!isWeb && activeEditor == 'editor'", "Ctrl+Shift+S"],
-    ["workbench.action.files.saveAll", "Save All", "4_save", undefined, "Ctrl+M S"],
-    ["workbench.action.files.revert", "Revert File", "6_close", "activeEditor == 'editor'", undefined],
-  ];
-  for (const [id, title, group, precondition, label] of expected) {
-    const command = Commands.lookup(id);
-    check(`${id} is registered with its catalog title`, command?.title === title);
-    check(`${id} declares its catalog precondition`, command?.precondition === precondition);
-    const row = fileRows.find((r) => r.command === id);
-    check(`${id} sits in the File menu's ${group} group`, row?.group === group);
-    check(
-      `${id} reaches the command palette`,
-      paletteRows.some((r) => r.command === id),
-    );
-    const keybinding = KeybindingsRegistry.lookupKeybinding(id);
-    check(
-      `${id} binds ${label ?? "no chord"}`,
-      label === undefined ? keybinding === undefined : keybinding?.getLabel() === label,
-    );
-  }
-}
-
-// --- Open File: pick, grant, open; cancel is a no-op -------------------------
-
-window.__TAURI_INTERNALS__ = {};
-const addedPanels = [];
-initZones({
-  panels: [],
-  groups: [],
-  getPanel: (id) => addedPanels.find((p) => p.id === id),
-  // The stub tracks no live groups; a recorded zone group reads as closed
-  // away, and openInZone rebuilds the zone - dockview's own self-healing.
-  getGroup: () => undefined,
-  addPanel: (opts) => {
-    const panel = {
-      id: opts.id,
-      params: opts.params,
-      group: { id: "g-main" },
-      api: { setActive() {} },
-      // focusWorkshopTree unwraps view.content before its instanceof check.
-      view: { content: {} },
-    };
-    addedPanels.push(panel);
-    return panel;
-  },
-  onDidMovePanel: () => ({ dispose() {} }),
-  onDidRemovePanel: () => ({ dispose() {} }),
-  onWillMutateLayout: () => ({ dispose() {} }),
-  onDidMutateLayout: () => ({ dispose() {} }),
-  onDidLayoutChange: () => ({ dispose() {} }),
-});
-
-{
-  window.__TAURI_DIALOG__ = { calls: [], answer: null };
-  await Commands.execute("workbench.action.files.openFile");
-  await flush();
-  check("a canceled Open File grants nothing", grants.length === 0);
-  check("a canceled Open File opens no editor", addedPanels.length === 0);
-
-  window.__TAURI_DIALOG__.answer = "C:\\picked\\notes.txt";
-  await Commands.execute("workbench.action.files.openFile");
-  await flush();
-  check(
-    "Open File opens the native file picker",
-    window.__TAURI_DIALOG__.calls.some((c) => c.kind === "open" && c.directory !== true),
-  );
-  check("Open File grants the picked path", grants.includes("C:\\picked\\notes.txt"));
-  check("Open File announces one workspace change", workspaceChanges === 1);
-  check(
-    "Open File opens an editor on the picked path",
-    addedPanels.some((p) => p.id === "editor:C:\\picked\\notes.txt"),
-  );
-}
-
-// --- Open Folder / Add Folder to Workspace: one shared flow ------------------
-
-{
-  const grantsBefore = grants.length;
-  window.__TAURI_DIALOG__.answer = null;
-  await Commands.execute("workbench.action.files.openFolder");
-  await flush();
-  check(
-    "Open Folder opens the native directory picker",
-    window.__TAURI_DIALOG__.calls.at(-1)?.kind === "open" &&
-      window.__TAURI_DIALOG__.calls.at(-1)?.directory === true,
-  );
-  check("a canceled Open Folder grants nothing", grants.length === grantsBefore);
-
-  window.__TAURI_DIALOG__.answer = "C:\\picked-dir";
-  await Commands.execute("workbench.action.files.openFolder");
-  await flush();
-  check("Open Folder grants the picked folder", grants.at(-1) === "C:\\picked-dir");
-  check(
-    "a granted folder confirms on the status bar as info",
-    statusMessages.some(
-      (e) => e.severity === "info" && e.label.includes("Added") && e.label.includes("C:\\picked-dir"),
-    ),
-  );
-
-  window.__TAURI_DIALOG__.answer = "C:\\added-dir";
-  await Commands.execute("workbench.action.addRootFolder");
-  await flush();
-  check("Add Folder to Workspace runs the same flow", grants.at(-1) === "C:\\added-dir");
-}
-
-// --- Browser mode: the typed-path dialog fallback ----------------------------
-
-{
-  delete window.__TAURI_INTERNALS__;
-  await Commands.execute("workbench.action.files.openFolder");
-  await flush();
-  const overlay = window.document.querySelector(".ws-workspace-add-overlay");
-  check("browser Open Folder opens the typed-path dialog", overlay !== null);
-  const input = overlay?.querySelector("input#workspace-add-path");
-  const addButton = [...(overlay?.querySelectorAll("button") ?? [])].find(
-    (b) => b.textContent === "Add",
-  );
-  check("the dialog gates Add on a typed path", addButton?.disabled === true);
-  input.value = "C:\\typed-dir";
-  input.dispatchEvent(new window.Event("input", { bubbles: true }));
-  addButton.click();
-  await flush();
-  check("the typed path is granted", grants.at(-1) === "C:\\typed-dir");
-  check(
-    "the dialog dismisses after Add",
-    window.document.querySelector(".ws-workspace-add-overlay") === null,
-  );
-  window.__TAURI_INTERNALS__ = {};
-}
-
-// --- Save As: grant the parent, write, retarget; cancel is a no-op -----------
-
-{
-  const { panel, surface, titles } = makeEditorPanel({ path: "C:\\project\\a.txt", text: "original" });
-  await flush();
-  surface.setText("changed");
-  const fakePanel = { view: { content: panel } };
-  const unregister = registerService(DOCK, () => ({ activePanel: fakePanel, panels: [fakePanel] }));
-
-  window.__TAURI_DIALOG__ = { calls: [], answer: null };
-  const writesBefore = writeCalls.length;
-  await Commands.execute("workbench.action.files.saveAs");
-  await flush();
-  check("a canceled Save As writes nothing", writeCalls.length === writesBefore);
-  check("a canceled Save As keeps the panel's path", panel.filePath() === "C:\\project\\a.txt");
-
-  window.__TAURI_DIALOG__.answer = "C:\\elsewhere\\b.txt";
-  await Commands.execute("workbench.action.files.saveAs");
-  await flush();
-  check(
-    "Save As opens the native save dialog seeded with the current path",
-    window.__TAURI_DIALOG__.calls.some(
-      (c) => c.kind === "save" && c.defaultPath === "C:\\project\\a.txt",
-    ),
-  );
-  check("Save As grants the target's parent directory", grants.includes("C:\\elsewhere"));
-  check(
-    "Save As grants the parent before writing",
-    events.indexOf("grant:C:\\elsewhere") !== -1 &&
-      events.indexOf("grant:C:\\elsewhere") < events.indexOf("write:C:\\elsewhere\\b.txt"),
-  );
-  check(
-    "Save As writes the live text to the new path with no conflict token",
-    writeCalls.some((w) => w.path === "C:\\elsewhere\\b.txt" && w.text === "changed" && w.token === null),
-  );
-  check("Save As retargets the panel onto the new path", panel.filePath() === "C:\\elsewhere\\b.txt");
-  check("Save As leaves the panel clean", panel.isDirty() === false);
-  check("Save As retitles the tab", titles.includes("b.txt"));
-  unregister.dispose();
-  panel.dispose();
-}
-
-// --- Save All: every dirty editor, sequentially ------------------------------
-
-{
-  const a = makeEditorPanel({ path: "C:\\project\\a.txt", text: "aaa" });
-  const b = makeEditorPanel({ path: "C:\\project\\b.txt", text: "bbb" });
-  const c = makeEditorPanel({ path: "C:\\project\\c.txt", text: "ccc" });
-  await flush();
-  a.surface.setText("aaa edited");
-  b.surface.setText("bbb edited");
-  // c stays clean.
-  const panels = [a, b, c].map(({ panel }) => ({ view: { content: panel } }));
-  const unregister = registerService(DOCK, () => ({ activePanel: panels[0], panels }));
-  const writesBefore = writeCalls.length;
-  maxWritesInFlight = 0;
-  await Commands.execute("workbench.action.files.saveAll");
-  await flush();
-  const written = writeCalls.slice(writesBefore).map((w) => w.path);
-  check(
-    "Save All writes every dirty editor",
-    written.includes("C:\\project\\a.txt") && written.includes("C:\\project\\b.txt"),
-  );
-  check("Save All skips clean editors", !written.includes("C:\\project\\c.txt"));
-  check("Save All saves sequentially, never concurrently", maxWritesInFlight === 1);
-  check(
-    "Save All leaves every saved editor clean",
-    !a.panel.isDirty() && !b.panel.isDirty() && c.panel.isDirty() === false,
-  );
-  unregister.dispose();
-  for (const { panel } of [a, b, c]) panel.dispose();
-}
-
-// --- Revert File: the dirty prompt, then a reload from disk ------------------
-
-{
-  let reads = 0;
-  const readFile = async (p) => {
-    reads += 1;
-    return { path: p, size: 7, token: "tok-1", text: "on disk" };
-  };
-  const { panel, surface } = makeEditorPanel({ path: "C:\\project\\r.txt", text: "on disk", readFile });
-  await flush();
-  check("the panel loaded its file once", reads === 1);
-  surface.setText("edited");
-  const fakePanel = { view: { content: panel } };
-  const unregister = registerService(DOCK, () => ({ activePanel: fakePanel, panels: [fakePanel] }));
-
-  await Commands.execute("workbench.action.files.revert");
-  await flush();
-  const overlay = panel.element.querySelector(".ws-editor-revert-overlay");
-  check("reverting a dirty editor prompts first", overlay !== null);
-  check("the prompt holds the reload", reads === 1);
-  const cancel = [...(overlay?.querySelectorAll("button") ?? [])].find((b) => b.textContent === "Cancel");
-  cancel.click();
-  await flush();
-  check("canceling the revert keeps the edits", surface.text() === "edited" && panel.isDirty());
-  check("canceling the revert reloads nothing", reads === 1);
-
-  await Commands.execute("workbench.action.files.revert");
-  await flush();
-  const confirmOverlay = panel.element.querySelector(".ws-editor-revert-overlay");
-  const revertButton = [...(confirmOverlay?.querySelectorAll("button") ?? [])].find(
-    (b) => b.textContent === "Revert",
-  );
-  revertButton.click();
-  await flush();
-  check("confirming the revert reloads the file", reads === 2);
-  check("the reverted editor shows the on-disk text", surface.text() === "on disk");
-  check("the reverted editor is clean", panel.isDirty() === false);
-
-  await Commands.execute("workbench.action.files.revert");
-  await flush();
-  check(
-    "reverting a clean editor skips the prompt",
-    panel.element.querySelector(".ws-editor-revert-overlay") === null,
-  );
-  check("a clean revert still reloads from disk", reads === 3);
-  unregister.dispose();
-  panel.dispose();
-}
-
-// --- Revert on an untitled buffer is a no-op ---------------------------------
-
-{
-  const panel = new EditorPanel({ createSurface: () => fakeSurface(""), writeFile: writeFileStub });
-  panel.init({ params: { untitled: 1 }, api: { setTitle() {}, close() {} } });
-  window.document.body.appendChild(panel.element);
-  await flush();
-  const fakePanel = { view: { content: panel } };
-  const unregister = registerService(DOCK, () => ({ activePanel: fakePanel, panels: [fakePanel] }));
-  await Commands.execute("workbench.action.files.revert");
-  await flush();
-  check(
-    "reverting an untitled buffer opens no prompt",
-    panel.element.querySelector(".ws-editor-revert-overlay") === null,
-  );
-  unregister.dispose();
-  panel.dispose();
-}
-
-// --- Open Recent catalog wiring ----------------------------------------------
-
-// Real DOM-free service instances bound over the self-registered defaults;
-// the contribution's provider and run bodies resolve them at call time.
-const treeState = new TreeStateService();
-const recentStore = new RecentFilesStore(null);
-registerService(TREE_STATE, () => treeState);
-registerService(RECENT_FILES_STORE, () => recentStore);
-
-{
-  const recentRows = Menus.getMenuItems("menubar/file/recent");
-  check(
-    "More... sits in Open Recent's y_more group",
-    recentRows.some((r) => r.command === "workbench.action.openRecent" && r.group === "y_more"),
-  );
-  check(
-    "Clear Recently Opened... sits in Open Recent's z_clear group",
-    recentRows.some((r) => r.command === "workbench.action.clearRecentFiles" && r.group === "z_clear"),
-  );
-  check(
-    "More... binds Ctrl+R",
-    KeybindingsRegistry.lookupKeybinding("workbench.action.openRecent")?.getLabel() === "Ctrl+R",
-  );
-  const paletteRows = Menus.getMenuItems("commandPalette");
-  check(
-    "Open Recent's More... reaches the palette",
-    paletteRows.some((r) => r.command === "workbench.action.openRecent"),
-  );
-  check(
-    "Clear Recently Opened reaches the palette",
-    paletteRows.some((r) => r.command === "workbench.action.clearRecentFiles"),
-  );
-  check(
-    "vscode.open is registered but stays out of the palette",
-    Commands.lookup("vscode.open") !== undefined && !paletteRows.some((r) => r.command === "vscode.open"),
-  );
-}
-
-// --- Provider rows and the "" quick-access provider --------------------------
-
-{
-  // Seed: one granted root with a fetched listing, two recent files.
-  treeState.cacheListing("", {
-    path: null,
-    entries: [{ name: "project", path: "C:\\project", kind: "directory", size: 0, modifiedMs: 1, exists: true }],
-  });
-  treeState.cacheListing("C:\\project", {
-    path: "C:\\project",
-    entries: [
-      { name: "a.txt", path: "C:\\project\\a.txt", kind: "file", size: 3, modifiedMs: 2, exists: true },
-      { name: "b.txt", path: "C:\\project\\b.txt", kind: "file", size: 3, modifiedMs: 3, exists: true },
-    ],
-  });
-  // Most recent first: a.txt was "opened" after notes.txt.
-  recentStore.add("C:\\picked\\notes.txt");
-  recentStore.add("C:\\project\\a.txt");
-
-  // Action rows omit the title; the widget falls back to the command's.
-  const titles = Menus.getMenuItems("menubar/file/recent").map(
-    (r) => r.title ?? Commands.lookup(r.command)?.title,
-  );
-  check(
-    "Open Recent lists the editor's reopen row, roots, then recent files, then the static rows",
-    titles.join(",") === "Reopen Closed Editor,project,a.txt,notes.txt,More...,Clear Recently Opened...",
-  );
-
-  const descriptor = QuickAccessRegistry.getQuickAccessProvider("b.txt");
-  check("an unprefixed query routes to the '' provider", descriptor?.prefix === "");
-  const provider = descriptor.factory();
-  const items = provider.getItems("");
-  check(
-    "the '' provider lists recent files first, then tree files, deduped",
-    items.map((i) => i.description).join(",") === "C:\\project\\a.txt,C:\\picked\\notes.txt,C:\\project\\b.txt",
-  );
-  check(
-    "the '' provider labels rows with the file's base name",
-    items.map((i) => i.label).join(",") === "a.txt,notes.txt,b.txt",
-  );
-  check(
-    "the '' provider filters by case-insensitive substring",
-    provider.getItems("NOTES").map((i) => i.label).join(",") === "notes.txt",
-  );
-
-  const panelsBefore = addedPanels.length;
-  items.find((i) => i.description === "C:\\project\\b.txt").accept();
-  await flush();
-  check(
-    "accepting a '' row opens an editor on the file",
-    addedPanels.length === panelsBefore + 1 && addedPanels.some((p) => p.id === "editor:C:\\project\\b.txt"),
-  );
-
-  await Commands.execute("vscode.open");
-  await Commands.execute("vscode.open", 42);
-  await flush();
-  check(
-    "vscode.open narrows its argument: a missing or non-string path opens nothing",
-    addedPanels.length === panelsBefore + 1,
-  );
-
-  await Commands.execute("workbench.action.clearRecentFiles");
-  await flush();
-  check("Clear Recently Opened empties the store", recentStore.list.length === 0);
-  check(
-    "the cleared store drops the recent-file rows",
-    !Menus.getMenuItems("menubar/file/recent").some((r) => r.title === "notes.txt"),
-  );
-}
-
-// --- More... opens quick open; vscode.openFolder focuses a root --------------
-
-{
-  const shown = [];
-  registerService(QUICK_INPUT_SERVICE, () => ({ quickAccess: { show: (value) => shown.push(value) } }));
-  await Commands.execute("workbench.action.openRecent");
-  await flush();
-  check("More... opens quick open at the '' file list", shown.length === 1 && shown[0] === "");
-
-  // The wire shape: modified_ms, snake_case, as the server answers.
-  treeListings.set("C:\\picked-dir", {
-    path: "C:\\picked-dir",
-    entries: [{ name: "notes.txt", path: "C:\\picked-dir\\notes.txt", kind: "file", size: 5, modified_ms: 4, exists: true }],
-  });
-  const changesBefore = workspaceChanges;
-  await Commands.execute("vscode.openFolder", "C:\\picked-dir");
-  await flush();
-  check(
-    "vscode.openFolder fetches and caches an uncached root's listing",
-    treeState.listing("C:\\picked-dir") !== undefined,
-  );
-  check("vscode.openFolder expands the root in the tree state", treeState.isExpanded("C:\\picked-dir"));
-  check(
-    "vscode.openFolder announces the workspace change so an open tree re-renders",
-    workspaceChanges === changesBefore + 1,
-  );
-  check("vscode.openFolder focuses the tree panel", addedPanels.some((p) => p.id === "tree"));
-
-  const fetchesBefore = treeFetches;
-  await Commands.execute("vscode.openFolder", "C:\\picked-dir");
-  await flush();
-  check(
-    "vscode.openFolder reuses the cached listing on a second focus",
-    treeFetches === fetchesBefore,
-  );
-
-  await Commands.execute("vscode.openFolder", 42);
-  await flush();
-  check("vscode.openFolder narrows its argument", treeState.listing("42") === undefined);
-}
-
-if (failures.length > 0) {
-  console.error(`files-actions: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("files-actions: all assertions passed");
diff --git a/crates/workshop/ui/test/fixtures/audio/pcm16le-24khz.json b/crates/workshop/ui/test/fixtures/audio/pcm16le-24khz.json
deleted file mode 100644
index 426f2ca81..000000000
--- a/crates/workshop/ui/test/fixtures/audio/pcm16le-24khz.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "encoding": "pcm_s16le",
-  "sample_rate_hz": 24000,
-  "channels": 1,
-  "samples": [-32768, -16384, -1, 0, 1, 16384, 32767],
-  "bytes": [0, 128, 0, 192, 255, 255, 0, 0, 1, 0, 0, 64, 255, 127],
-  "base64": "AIAAwP//AAABAABA/38="
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/jfk-native-recaptured.snapshots.json b/crates/workshop/ui/test/fixtures/replay/jfk-native-recaptured.snapshots.json
deleted file mode 100644
index c8817afde..000000000
--- a/crates/workshop/ui/test/fixtures/replay/jfk-native-recaptured.snapshots.json
+++ /dev/null
@@ -1,225 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 632,
-      "revision": 1,
-      "transcript": "And...",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "And...",
-      "audio_start_ms": 0,
-      "audio_end_ms": 500
-    },
-    {
-      "at_ms": 1014,
-      "revision": 2,
-      "transcript": "And so...",
-      "finalized": "",
-      "agreed": "And",
-      "tentative": " so...",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1517,
-      "revision": 3,
-      "transcript": "And so my fell",
-      "finalized": "",
-      "agreed": "And so",
-      "tentative": " my fell",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2021,
-      "revision": 4,
-      "transcript": "And so my fellow American...",
-      "finalized": "",
-      "agreed": "And so my",
-      "tentative": " fellow American...",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2529,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 3023,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3523,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3500
-    },
-    {
-      "at_ms": 4023,
-      "revision": 6,
-      "transcript": "And so my fellow Americans asked",
-      "finalized": "",
-      "agreed": "And so my fellow Americans",
-      "tentative": " asked",
-      "audio_start_ms": 0,
-      "audio_end_ms": 4000
-    },
-    {
-      "at_ms": 4525,
-      "revision": 7,
-      "transcript": "And so my fellow Americans asked not",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked",
-      "tentative": " not",
-      "audio_start_ms": 0,
-      "audio_end_ms": 4500
-    },
-    {
-      "at_ms": 5032,
-      "revision": 8,
-      "transcript": "And so my fellow Americans asked not",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not",
-      "tentative": "",
-      "audio_start_ms": 0,
-      "audio_end_ms": 5000
-    },
-    {
-      "at_ms": 5540,
-      "revision": 9,
-      "transcript": "And so my fellow Americans asked not what happened.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not",
-      "tentative": " what happened.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 5500
-    },
-    {
-      "at_ms": 6046,
-      "revision": 10,
-      "transcript": "And so my fellow Americans asked not what you are coming to.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what",
-      "tentative": " you are coming to.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 6000
-    },
-    {
-      "at_ms": 6543,
-      "revision": 11,
-      "transcript": "And so my fellow Americans asked not what your country can",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what",
-      "tentative": " your country can",
-      "audio_start_ms": 0,
-      "audio_end_ms": 6500
-    },
-    {
-      "at_ms": 7039,
-      "revision": 12,
-      "transcript": "And so my fellow Americans asked not what your country can do for",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can",
-      "tentative": " do for",
-      "audio_start_ms": 0,
-      "audio_end_ms": 7000
-    },
-    {
-      "at_ms": 7554,
-      "revision": 13,
-      "transcript": "And so my fellow Americans asked not what your country can do for you.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for",
-      "tentative": " you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 7500
-    },
-    {
-      "at_ms": 8058,
-      "revision": 13,
-      "transcript": "And so my fellow Americans asked not what your country can do for you.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for",
-      "tentative": " you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 8000
-    },
-    {
-      "at_ms": 8546,
-      "revision": 14,
-      "transcript": "And so my fellow Americans asked not what your country can do for you asked",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for you",
-      "tentative": " asked",
-      "audio_start_ms": 0,
-      "audio_end_ms": 8500
-    },
-    {
-      "at_ms": 9056,
-      "revision": 15,
-      "transcript": "And so my fellow Americans asked not what your country can do for you asked what you",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for you asked",
-      "tentative": " what you",
-      "audio_start_ms": 0,
-      "audio_end_ms": 9000
-    },
-    {
-      "at_ms": 9557,
-      "revision": 16,
-      "transcript": "And so my fellow Americans asked not what your country can do for you asked what you can do.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for you asked what you",
-      "tentative": " can do.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 9500
-    },
-    {
-      "at_ms": 10058,
-      "revision": 17,
-      "transcript": "And so my fellow Americans asked not what your country can do for you asked what you can do for your",
-      "finalized": "",
-      "agreed": "And so my fellow Americans asked not what your country can do for you asked what you can do",
-      "tentative": " for your",
-      "audio_start_ms": 0,
-      "audio_end_ms": 10000
-    },
-    {
-      "at_ms": 10197,
-      "revision": 18,
-      "transcript": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "tentative": "",
-      "audio_start_ms": 10000,
-      "audio_end_ms": 10000
-    },
-    {
-      "at_ms": 11013,
-      "revision": 19,
-      "transcript": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country. country.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "tentative": " country.",
-      "audio_start_ms": 10080,
-      "audio_end_ms": 11000
-    }
-  ],
-  "completed": "And so my fellow Americans Ask not what your country can do for you. Ask what you can do for your country."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/jfk-native.snapshots.json b/crates/workshop/ui/test/fixtures/replay/jfk-native.snapshots.json
deleted file mode 100644
index ce14a2037..000000000
--- a/crates/workshop/ui/test/fixtures/replay/jfk-native.snapshots.json
+++ /dev/null
@@ -1,225 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 622,
-      "revision": 1,
-      "transcript": "And",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "And",
-      "audio_start_ms": 0,
-      "audio_end_ms": 500
-    },
-    {
-      "at_ms": 1014,
-      "revision": 2,
-      "transcript": "And so...",
-      "finalized": "",
-      "agreed": "And",
-      "tentative": " so...",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1515,
-      "revision": 3,
-      "transcript": "And so my fellow",
-      "finalized": "",
-      "agreed": "And so",
-      "tentative": " my fellow",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2017,
-      "revision": 4,
-      "transcript": "And so my fellow American",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " American",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2521,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 3021,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3519,
-      "revision": 5,
-      "transcript": "And so my fellow Americans.",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3500
-    },
-    {
-      "at_ms": 4020,
-      "revision": 6,
-      "transcript": "And so my fellow Americans asked",
-      "finalized": "",
-      "agreed": "And so my fellow Americans",
-      "tentative": " asked",
-      "audio_start_ms": 0,
-      "audio_end_ms": 4000
-    },
-    {
-      "at_ms": 4521,
-      "revision": 7,
-      "transcript": "And so my fellow Americans ask not",
-      "finalized": "",
-      "agreed": "And so my fellow Americans",
-      "tentative": " ask not",
-      "audio_start_ms": 0,
-      "audio_end_ms": 4500
-    },
-    {
-      "at_ms": 5022,
-      "revision": 8,
-      "transcript": "And so my fellow Americans ask not",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not",
-      "tentative": "",
-      "audio_start_ms": 0,
-      "audio_end_ms": 5000
-    },
-    {
-      "at_ms": 5524,
-      "revision": 9,
-      "transcript": "And so my fellow Americans ask not why",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not",
-      "tentative": " why",
-      "audio_start_ms": 0,
-      "audio_end_ms": 5500
-    },
-    {
-      "at_ms": 6025,
-      "revision": 10,
-      "transcript": "And so my fellow Americans ask not what your",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not",
-      "tentative": " what your",
-      "audio_start_ms": 0,
-      "audio_end_ms": 6000
-    },
-    {
-      "at_ms": 6533,
-      "revision": 11,
-      "transcript": "And so my fellow Americans ask not what your country can do.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your",
-      "tentative": " country can do.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 6500
-    },
-    {
-      "at_ms": 7033,
-      "revision": 12,
-      "transcript": "And so my fellow Americans ask not what your country can do for",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do",
-      "tentative": " for",
-      "audio_start_ms": 0,
-      "audio_end_ms": 7000
-    },
-    {
-      "at_ms": 7537,
-      "revision": 13,
-      "transcript": "And so my fellow Americans ask not what your country can do for you.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for",
-      "tentative": " you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 7500
-    },
-    {
-      "at_ms": 8037,
-      "revision": 13,
-      "transcript": "And so my fellow Americans ask not what your country can do for you.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for",
-      "tentative": " you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 8000
-    },
-    {
-      "at_ms": 8539,
-      "revision": 14,
-      "transcript": "And so my fellow Americans ask not what your country can do for you as a",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you",
-      "tentative": " as a",
-      "audio_start_ms": 0,
-      "audio_end_ms": 8500
-    },
-    {
-      "at_ms": 9043,
-      "revision": 15,
-      "transcript": "And so my fellow Americans ask not what your country can do for you ask what you",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you",
-      "tentative": " ask what you",
-      "audio_start_ms": 0,
-      "audio_end_ms": 9000
-    },
-    {
-      "at_ms": 9548,
-      "revision": 16,
-      "transcript": "And so my fellow Americans ask not what your country can do for you Ask what you can do.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you Ask what you",
-      "tentative": " can do.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 9500
-    },
-    {
-      "at_ms": 10053,
-      "revision": 17,
-      "transcript": "And so my fellow Americans ask not what your country can do for you Ask what you can do for your country.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you Ask what you can do",
-      "tentative": " for your country.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 10000
-    },
-    {
-      "at_ms": 10158,
-      "revision": 18,
-      "transcript": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "tentative": "",
-      "audio_start_ms": 10000,
-      "audio_end_ms": 10000
-    },
-    {
-      "at_ms": 11019,
-      "revision": 19,
-      "transcript": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country. I'm free.",
-      "finalized": "",
-      "agreed": "And so my fellow Americans ask not what your country can do for you. Ask what you can do for your country.",
-      "tentative": " I'm free.",
-      "audio_start_ms": 10048,
-      "audio_end_ms": 11000
-    }
-  ],
-  "completed": "And so my fellow Americans Ask not what your country can do for you. Ask what you can do for your country."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-agreed-shrink.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-agreed-shrink.snapshots.json
deleted file mode 100644
index aec4119e2..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-agreed-shrink.snapshots.json
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "Why is it",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "Why is it",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1650,
-      "revision": 2,
-      "transcript": "Why is it",
-      "finalized": "",
-      "agreed": "Why is it",
-      "tentative": "",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "Why is it",
-      "finalized": "",
-      "agreed": "Why is it",
-      "tentative": "",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2650,
-      "revision": 3,
-      "transcript": "Why is it the",
-      "finalized": "",
-      "agreed": "Why is it",
-      "tentative": " the",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 3150,
-      "revision": 4,
-      "transcript": "Why is it the way",
-      "finalized": "",
-      "agreed": "Why is it the",
-      "tentative": " way",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3350,
-      "revision": 5,
-      "transcript": "Why is it the way?",
-      "finalized": "",
-      "agreed": "Why is it the",
-      "tentative": " way?",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    }
-  ],
-  "completed": "Why is that the way?"
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-final-word.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-final-word.snapshots.json
deleted file mode 100644
index 2a4ec138c..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-final-word.snapshots.json
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "We choose",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "We choose",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1650,
-      "revision": 2,
-      "transcript": "We choose to go",
-      "finalized": "",
-      "agreed": "We choose",
-      "tentative": " to go",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2150,
-      "revision": 3,
-      "transcript": "We choose to go to the",
-      "finalized": "",
-      "agreed": "We choose to go",
-      "tentative": " to the",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2650,
-      "revision": 4,
-      "transcript": "We choose to go to the moon",
-      "finalized": "",
-      "agreed": "We choose to go to the",
-      "tentative": " moon",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 4800,
-      "revision": 5,
-      "transcript": "We chose to go to the moon",
-      "finalized": "We chose to go to the moon",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 2500,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 6050,
-      "revision": 6,
-      "transcript": "We chose to go to the moon and do",
-      "finalized": "We chose to go to the moon",
-      "agreed": "",
-      "tentative": " and do",
-      "audio_start_ms": 2500,
-      "audio_end_ms": 5900
-    },
-    {
-      "at_ms": 6650,
-      "revision": 7,
-      "transcript": "We chose to go to the moon and do the other",
-      "finalized": "We chose to go to the moon",
-      "agreed": " and do",
-      "tentative": " the other",
-      "audio_start_ms": 2500,
-      "audio_end_ms": 6500
-    },
-    {
-      "at_ms": 7150,
-      "revision": 8,
-      "transcript": "We chose to go to the moon and do the other things",
-      "finalized": "We chose to go to the moon",
-      "agreed": " and do the other",
-      "tentative": " things",
-      "audio_start_ms": 2500,
-      "audio_end_ms": 7000
-    },
-    {
-      "at_ms": 7750,
-      "revision": 9,
-      "transcript": "We chose to go to the moon and do the other things",
-      "finalized": "We chose to go to the moon",
-      "agreed": " and do the other things",
-      "tentative": "",
-      "audio_start_ms": 2500,
-      "audio_end_ms": 7600
-    }
-  ],
-  "completed": "We chose to go to the moon and do the other things"
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-punctuation-case.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-punctuation-case.snapshots.json
deleted file mode 100644
index 4872e2531..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-punctuation-case.snapshots.json
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "ask not",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "ask not",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1650,
-      "revision": 2,
-      "transcript": "Ask not what",
-      "finalized": "",
-      "agreed": "Ask not",
-      "tentative": " what",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2150,
-      "revision": 3,
-      "transcript": "Ask not what your country",
-      "finalized": "",
-      "agreed": "Ask not what",
-      "tentative": " your country",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2650,
-      "revision": 4,
-      "transcript": "Ask not what your country can do",
-      "finalized": "",
-      "agreed": "Ask not what your country",
-      "tentative": " can do",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 3150,
-      "revision": 5,
-      "transcript": "Ask not what your country can do for you.",
-      "finalized": "",
-      "agreed": "Ask not what your country can do",
-      "tentative": " for you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3650,
-      "revision": 6,
-      "transcript": "Ask not what your country can do for you",
-      "finalized": "",
-      "agreed": "Ask not what your country can do for",
-      "tentative": " you",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3500
-    },
-    {
-      "at_ms": 3950,
-      "revision": 7,
-      "transcript": "Ask not what your country can do for you.",
-      "finalized": "",
-      "agreed": "Ask not what your country can do for",
-      "tentative": " you.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3716
-    }
-  ],
-  "completed": "Ask not what your country can do for you."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-short-word-final.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-short-word-final.snapshots.json
deleted file mode 100644
index d2effa350..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-short-word-final.snapshots.json
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "Okay",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "Okay",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "Okay listen",
-      "finalized": "",
-      "agreed": "Okay",
-      "tentative": " listen",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 3150,
-      "revision": 3,
-      "transcript": "Okay listen up.",
-      "finalized": "",
-      "agreed": "Okay listen",
-      "tentative": " up.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3550,
-      "revision": 3,
-      "transcript": "Okay listen up.",
-      "finalized": "",
-      "agreed": "Okay listen",
-      "tentative": " up.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4200,
-      "revision": 4,
-      "transcript": "Okay, listen up.",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 7550,
-      "revision": 5,
-      "transcript": "Okay, listen up. Hey",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": " Hey",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 7500
-    },
-    {
-      "at_ms": 8050,
-      "revision": 5,
-      "transcript": "Okay, listen up. Hey",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": " Hey",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 7556
-    },
-    {
-      "at_ms": 9500,
-      "revision": 6,
-      "transcript": "Okay, listen up. Hey.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 7556,
-      "audio_end_ms": 7556
-    },
-    {
-      "at_ms": 11150,
-      "revision": 7,
-      "transcript": "Okay, listen up. Hey. the commit rule",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": "",
-      "tentative": " the commit rule",
-      "audio_start_ms": 7556,
-      "audio_end_ms": 11000
-    },
-    {
-      "at_ms": 12150,
-      "revision": 8,
-      "transcript": "Okay, listen up. Hey. the commit rule needs two",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " the commit rule",
-      "tentative": " needs two",
-      "audio_start_ms": 7556,
-      "audio_end_ms": 12000
-    },
-    {
-      "at_ms": 13150,
-      "revision": 9,
-      "transcript": "Okay, listen up. Hey. the commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " the commit rule needs two",
-      "tentative": " passes.",
-      "audio_start_ms": 7556,
-      "audio_end_ms": 13000
-    },
-    {
-      "at_ms": 13650,
-      "revision": 9,
-      "transcript": "Okay, listen up. Hey. the commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " the commit rule needs two",
-      "tentative": " passes.",
-      "audio_start_ms": 7556,
-      "audio_end_ms": 13500
-    },
-    {
-      "at_ms": 14200,
-      "revision": 10,
-      "transcript": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 13500,
-      "audio_end_ms": 13500
-    }
-  ],
-  "completed": "Okay, listen up. Hey. The commit rule needs two passes."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-silence-short-word.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-silence-short-word.snapshots.json
deleted file mode 100644
index a22e0ce2b..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-silence-short-word.snapshots.json
+++ /dev/null
@@ -1,115 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "About one tick",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "About one tick",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 1650,
-      "revision": 2,
-      "transcript": "About one tick faster than",
-      "finalized": "",
-      "agreed": "About one tick",
-      "tentative": " faster than",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1500
-    },
-    {
-      "at_ms": 2150,
-      "revision": 3,
-      "transcript": "About one tick faster than the plans",
-      "finalized": "",
-      "agreed": "About one tick faster than",
-      "tentative": " the plans",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 2650,
-      "revision": 4,
-      "transcript": "About one tick faster than the plans 0.6",
-      "finalized": "",
-      "agreed": "About one tick faster than the plans",
-      "tentative": " 0.6",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2500
-    },
-    {
-      "at_ms": 3150,
-      "revision": 5,
-      "transcript": "About one tick faster than the plans 0.6 seconds.",
-      "finalized": "",
-      "agreed": "About one tick faster than the plans 0.6",
-      "tentative": " seconds.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3550,
-      "revision": 5,
-      "transcript": "About one tick faster than the plans 0.6 seconds.",
-      "finalized": "",
-      "agreed": "About one tick faster than the plans 0.6",
-      "tentative": " seconds.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4200,
-      "revision": 6,
-      "transcript": "About one tick faster than the plan's 0.6 seconds.",
-      "finalized": "About one tick faster than the plan's 0.6 seconds.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 8350,
-      "revision": 7,
-      "transcript": "About one tick faster than the plan's 0.6 seconds. Hey.",
-      "finalized": "About one tick faster than the plan's 0.6 seconds.",
-      "agreed": "",
-      "tentative": " Hey.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 8300
-    },
-    {
-      "at_ms": 8850,
-      "revision": 7,
-      "transcript": "About one tick faster than the plan's 0.6 seconds. Hey.",
-      "finalized": "About one tick faster than the plan's 0.6 seconds.",
-      "agreed": "",
-      "tentative": " Hey.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 8700
-    },
-    {
-      "at_ms": 9150,
-      "revision": 7,
-      "transcript": "About one tick faster than the plan's 0.6 seconds. Hey.",
-      "finalized": "About one tick faster than the plan's 0.6 seconds.",
-      "agreed": "",
-      "tentative": " Hey.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 8740
-    },
-    {
-      "at_ms": 9800,
-      "revision": 8,
-      "transcript": "About one tick faster than the plan's 0.6 seconds. Hey.",
-      "finalized": "About one tick faster than the plan's 0.6 seconds. Hey.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 8740,
-      "audio_end_ms": 8740
-    }
-  ],
-  "completed": "About one tick faster than the plan's 0.6 seconds. Hey."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-skipped-word-then-speech.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-skipped-word-then-speech.snapshots.json
deleted file mode 100644
index 80855bc35..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-skipped-word-then-speech.snapshots.json
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "Okay",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "Okay",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "Okay listen",
-      "finalized": "",
-      "agreed": "Okay",
-      "tentative": " listen",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 3150,
-      "revision": 3,
-      "transcript": "Okay listen up.",
-      "finalized": "",
-      "agreed": "Okay listen",
-      "tentative": " up.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3550,
-      "revision": 3,
-      "transcript": "Okay listen up.",
-      "finalized": "",
-      "agreed": "Okay listen",
-      "tentative": " up.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4200,
-      "revision": 4,
-      "transcript": "Okay, listen up.",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 7550,
-      "revision": 5,
-      "transcript": "Okay, listen up. Hey.",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": " Hey.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 7300
-    },
-    {
-      "at_ms": 7850,
-      "revision": 5,
-      "transcript": "Okay, listen up. Hey.",
-      "finalized": "Okay, listen up.",
-      "agreed": "",
-      "tentative": " Hey.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 7332
-    },
-    {
-      "at_ms": 8100,
-      "revision": 6,
-      "transcript": "Okay, listen up. Hey.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 7332,
-      "audio_end_ms": 7332
-    },
-    {
-      "at_ms": 11150,
-      "revision": 7,
-      "transcript": "Okay, listen up. Hey. The commit rule",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": "",
-      "tentative": " The commit rule",
-      "audio_start_ms": 7332,
-      "audio_end_ms": 11000
-    },
-    {
-      "at_ms": 12150,
-      "revision": 8,
-      "transcript": "Okay, listen up. Hey. The commit rule needs two",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " The commit rule",
-      "tentative": " needs two",
-      "audio_start_ms": 7332,
-      "audio_end_ms": 12000
-    },
-    {
-      "at_ms": 13150,
-      "revision": 9,
-      "transcript": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " The commit rule needs two",
-      "tentative": " passes.",
-      "audio_start_ms": 7332,
-      "audio_end_ms": 13000
-    },
-    {
-      "at_ms": 13650,
-      "revision": 9,
-      "transcript": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey.",
-      "agreed": " The commit rule needs two",
-      "tentative": " passes.",
-      "audio_start_ms": 7332,
-      "audio_end_ms": 13500
-    },
-    {
-      "at_ms": 14200,
-      "revision": 10,
-      "transcript": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "finalized": "Okay, listen up. Hey. The commit rule needs two passes.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 13500,
-      "audio_end_ms": 13500
-    }
-  ],
-  "completed": "Okay, listen up. Hey. The commit rule needs two passes."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-sliding-window.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-sliding-window.snapshots.json
deleted file mode 100644
index 488d452b2..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-sliding-window.snapshots.json
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "And so",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "And so",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "And so my fellow",
-      "finalized": "",
-      "agreed": "And so",
-      "tentative": " my fellow",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 3150,
-      "revision": 3,
-      "transcript": "And so my fellow Americans",
-      "finalized": "",
-      "agreed": "And so my fellow",
-      "tentative": " Americans",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 4150,
-      "revision": 4,
-      "transcript": "And so my fellow Americans, ask not",
-      "finalized": "",
-      "agreed": "And so my fellow Americans,",
-      "tentative": " ask not",
-      "audio_start_ms": 0,
-      "audio_end_ms": 4000
-    },
-    {
-      "at_ms": 5150,
-      "revision": 5,
-      "transcript": "And so my fellow Americans, ask not what your",
-      "finalized": "",
-      "agreed": "And so my fellow Americans, ask not",
-      "tentative": " what your",
-      "audio_start_ms": 1000,
-      "audio_end_ms": 5000
-    },
-    {
-      "at_ms": 6150,
-      "revision": 6,
-      "transcript": "And so my fellow Americans, ask not what your country can",
-      "finalized": "",
-      "agreed": "And so my fellow Americans, ask not what your",
-      "tentative": " country can",
-      "audio_start_ms": 2000,
-      "audio_end_ms": 6000
-    },
-    {
-      "at_ms": 7150,
-      "revision": 7,
-      "transcript": "And so my fellow Americans, ask not what your country can do for",
-      "finalized": "",
-      "agreed": "And so my fellow Americans, ask not what your country can",
-      "tentative": " do for",
-      "audio_start_ms": 3000,
-      "audio_end_ms": 7000
-    },
-    {
-      "at_ms": 8150,
-      "revision": 8,
-      "transcript": "And so my fellow Americans, ask not what your country can do for you,",
-      "finalized": "",
-      "agreed": "And so my fellow Americans, ask not what your country can do for",
-      "tentative": " you,",
-      "audio_start_ms": 4000,
-      "audio_end_ms": 8000
-    },
-    {
-      "at_ms": 8750,
-      "revision": 9,
-      "transcript": "And so my fellow Americans, ask not what your country can do for you, ask",
-      "finalized": "",
-      "agreed": "And so my fellow Americans, ask not what your country can do for you,",
-      "tentative": " ask",
-      "audio_start_ms": 4516,
-      "audio_end_ms": 8516
-    }
-  ],
-  "completed": "And so, my fellow Americans, ask not what your country can do for you, ask"
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo-same-pass.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo-same-pass.snapshots.json
deleted file mode 100644
index c8d633b37..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo-same-pass.snapshots.json
+++ /dev/null
@@ -1,105 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "Okay listen up",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "Okay listen up",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "Okay listen up this is",
-      "finalized": "",
-      "agreed": "Okay listen up",
-      "tentative": " this is",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 3150,
-      "revision": 3,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "",
-      "agreed": "Okay listen up this is",
-      "tentative": " what I want.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3550,
-      "revision": 3,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "",
-      "agreed": "Okay listen up this is",
-      "tentative": " what I want.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4200,
-      "revision": 4,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4450,
-      "revision": 5,
-      "transcript": "Okay listen up this is what I want. I want you",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": "",
-      "tentative": " I want you",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 4300
-    },
-    {
-      "at_ms": 4950,
-      "revision": 6,
-      "transcript": "Okay listen up this is what I want. I want you to create",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you",
-      "tentative": " to create",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 4800
-    },
-    {
-      "at_ms": 5450,
-      "revision": 7,
-      "transcript": "Okay listen up this is what I want. I want you to create a",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you to create",
-      "tentative": " a",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 5300
-    },
-    {
-      "at_ms": 5950,
-      "revision": 8,
-      "transcript": "Okay listen up this is what I want. I want you to create a plan.",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you to create",
-      "tentative": " a plan.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 5636
-    },
-    {
-      "at_ms": 6800,
-      "revision": 9,
-      "transcript": "Okay listen up this is what I want. I want you to create a plan.",
-      "finalized": "Okay listen up this is what I want. I want you to create a plan.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 5636,
-      "audio_end_ms": 5636
-    }
-  ],
-  "completed": "Okay listen up this is what I want. I want you to create a plan."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo.snapshots.json b/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo.snapshots.json
deleted file mode 100644
index e23364ee5..000000000
--- a/crates/workshop/ui/test/fixtures/replay/scripted-trailing-echo.snapshots.json
+++ /dev/null
@@ -1,105 +0,0 @@
-{
-  "snapshots": [
-    {
-      "at_ms": 1150,
-      "revision": 1,
-      "transcript": "Okay listen up",
-      "finalized": "",
-      "agreed": "",
-      "tentative": "Okay listen up",
-      "audio_start_ms": 0,
-      "audio_end_ms": 1000
-    },
-    {
-      "at_ms": 2150,
-      "revision": 2,
-      "transcript": "Okay listen up this is",
-      "finalized": "",
-      "agreed": "Okay listen up",
-      "tentative": " this is",
-      "audio_start_ms": 0,
-      "audio_end_ms": 2000
-    },
-    {
-      "at_ms": 3150,
-      "revision": 3,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "",
-      "agreed": "Okay listen up this is",
-      "tentative": " what I want.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3000
-    },
-    {
-      "at_ms": 3550,
-      "revision": 3,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "",
-      "agreed": "Okay listen up this is",
-      "tentative": " what I want.",
-      "audio_start_ms": 0,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4200,
-      "revision": 4,
-      "transcript": "Okay listen up this is what I want.",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 3108
-    },
-    {
-      "at_ms": 4650,
-      "revision": 5,
-      "transcript": "Okay listen up this is what I want. I want you to",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": "",
-      "tentative": " I want you to",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 4500
-    },
-    {
-      "at_ms": 5150,
-      "revision": 6,
-      "transcript": "Okay listen up this is what I want. I want you to create",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you to",
-      "tentative": " create",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 5000
-    },
-    {
-      "at_ms": 5650,
-      "revision": 7,
-      "transcript": "Okay listen up this is what I want. I want you to create a plan.",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you to create",
-      "tentative": " a plan.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 5500
-    },
-    {
-      "at_ms": 6150,
-      "revision": 7,
-      "transcript": "Okay listen up this is what I want. I want you to create a plan.",
-      "finalized": "Okay listen up this is what I want.",
-      "agreed": " I want you to create",
-      "tentative": " a plan.",
-      "audio_start_ms": 3108,
-      "audio_end_ms": 5636
-    },
-    {
-      "at_ms": 6800,
-      "revision": 8,
-      "transcript": "Okay listen up this is what I want. I want you to create a plan.",
-      "finalized": "Okay listen up this is what I want. I want you to create a plan.",
-      "agreed": "",
-      "tentative": "",
-      "audio_start_ms": 5636,
-      "audio_end_ms": 5636
-    }
-  ],
-  "completed": "Okay listen up this is what I want. I want you to create a plan."
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/ui-baseline.json b/crates/workshop/ui/test/fixtures/replay/ui-baseline.json
deleted file mode 100644
index b810f4b51..000000000
--- a/crates/workshop/ui/test/fixtures/replay/ui-baseline.json
+++ /dev/null
@@ -1,90 +0,0 @@
-{
-  "jfk-native": {
-    "changed_pairs": 13,
-    "changed_words": 43,
-    "completed_words": 22,
-    "pairs": 21,
-    "upsr": 0.6190476190476191,
-    "upwr": 1.9545454545454546
-  },
-  "jfk-native-recaptured": {
-    "changed_pairs": 3,
-    "changed_words": 35,
-    "completed_words": 22,
-    "pairs": 22,
-    "upsr": 0.13636363636363635,
-    "upwr": 1.5909090909090908
-  },
-  "scripted-agreed-shrink": {
-    "changed_pairs": 3,
-    "changed_words": 4,
-    "completed_words": 5,
-    "pairs": 6,
-    "upsr": 0.5,
-    "upwr": 0.8
-  },
-  "scripted-final-word": {
-    "changed_pairs": 1,
-    "changed_words": 6,
-    "completed_words": 12,
-    "pairs": 11,
-    "upsr": 0.09090909090909091,
-    "upwr": 0.5
-  },
-  "scripted-punctuation-case": {
-    "changed_pairs": 6,
-    "changed_words": 18,
-    "completed_words": 9,
-    "pairs": 7,
-    "upsr": 0.8571428571428571,
-    "upwr": 2
-  },
-  "scripted-short-word-final": {
-    "changed_pairs": 3,
-    "changed_words": 8,
-    "completed_words": 10,
-    "pairs": 15,
-    "upsr": 0.2,
-    "upwr": 0.8
-  },
-  "scripted-silence-short-word": {
-    "changed_pairs": 1,
-    "changed_words": 2,
-    "completed_words": 10,
-    "pairs": 9,
-    "upsr": 0.1111111111111111,
-    "upwr": 0.2
-  },
-  "scripted-skipped-word-then-speech": {
-    "changed_pairs": 1,
-    "changed_words": 2,
-    "completed_words": 9,
-    "pairs": 12,
-    "upsr": 0.08333333333333333,
-    "upwr": 0.2222222222222222
-  },
-  "scripted-sliding-window": {
-    "changed_pairs": 3,
-    "changed_words": 20,
-    "completed_words": 15,
-    "pairs": 9,
-    "upsr": 0.3333333333333333,
-    "upwr": 1.3333333333333333
-  },
-  "scripted-trailing-echo": {
-    "changed_pairs": 1,
-    "changed_words": 4,
-    "completed_words": 15,
-    "pairs": 10,
-    "upsr": 0.1,
-    "upwr": 0.26666666666666666
-  },
-  "scripted-trailing-echo-same-pass": {
-    "changed_pairs": 1,
-    "changed_words": 4,
-    "completed_words": 15,
-    "pairs": 10,
-    "upsr": 0.1,
-    "upwr": 0.26666666666666666
-  }
-}
diff --git a/crates/workshop/ui/test/fixtures/replay/ui-metrics.json b/crates/workshop/ui/test/fixtures/replay/ui-metrics.json
deleted file mode 100644
index 1b8f27250..000000000
--- a/crates/workshop/ui/test/fixtures/replay/ui-metrics.json
+++ /dev/null
@@ -1,90 +0,0 @@
-{
-  "jfk-native": {
-    "changed_pairs": 4,
-    "changed_words": 29,
-    "completed_words": 22,
-    "pairs": 22,
-    "upsr": 0.18181818181818182,
-    "upwr": 1.3181818181818181
-  },
-  "jfk-native-recaptured": {
-    "changed_pairs": 3,
-    "changed_words": 35,
-    "completed_words": 22,
-    "pairs": 22,
-    "upsr": 0.13636363636363635,
-    "upwr": 1.5909090909090908
-  },
-  "scripted-agreed-shrink": {
-    "changed_pairs": 1,
-    "changed_words": 2,
-    "completed_words": 5,
-    "pairs": 6,
-    "upsr": 0.16666666666666666,
-    "upwr": 0.4
-  },
-  "scripted-final-word": {
-    "changed_pairs": 1,
-    "changed_words": 5,
-    "completed_words": 12,
-    "pairs": 9,
-    "upsr": 0.1111111111111111,
-    "upwr": 0.4166666666666667
-  },
-  "scripted-punctuation-case": {
-    "changed_pairs": 1,
-    "changed_words": 1,
-    "completed_words": 9,
-    "pairs": 7,
-    "upsr": 0.14285714285714285,
-    "upwr": 0.1111111111111111
-  },
-  "scripted-short-word-final": {
-    "changed_pairs": 2,
-    "changed_words": 7,
-    "completed_words": 10,
-    "pairs": 13,
-    "upsr": 0.15384615384615385,
-    "upwr": 0.7
-  },
-  "scripted-silence-short-word": {
-    "changed_pairs": 1,
-    "changed_words": 2,
-    "completed_words": 10,
-    "pairs": 11,
-    "upsr": 0.09090909090909091,
-    "upwr": 0.2
-  },
-  "scripted-skipped-word-then-speech": {
-    "changed_pairs": 1,
-    "changed_words": 2,
-    "completed_words": 10,
-    "pairs": 13,
-    "upsr": 0.07692307692307693,
-    "upwr": 0.2
-  },
-  "scripted-sliding-window": {
-    "changed_pairs": 1,
-    "changed_words": 13,
-    "completed_words": 15,
-    "pairs": 9,
-    "upsr": 0.1111111111111111,
-    "upwr": 0.8666666666666667
-  },
-  "scripted-trailing-echo": {
-    "changed_pairs": 0,
-    "changed_words": 0,
-    "completed_words": 15,
-    "pairs": 10,
-    "upsr": 0,
-    "upwr": 0
-  },
-  "scripted-trailing-echo-same-pass": {
-    "changed_pairs": 0,
-    "changed_words": 0,
-    "completed_words": 15,
-    "pairs": 10,
-    "upsr": 0,
-    "upwr": 0
-  }
-}
diff --git a/crates/workshop/ui/test/foundation-css.mjs b/crates/workshop/ui/test/foundation-css.mjs
deleted file mode 100644
index 8818fa463..000000000
--- a/crates/workshop/ui/test/foundation-css.mjs
+++ /dev/null
@@ -1,211 +0,0 @@
-// Source-text contract for the Cursor IDE foundation in the Workshop UI's own
-// stylesheets (jsdom applies no stylesheets, so the values are read from the
-// files): the global reset does not strip focus outlines, so the shared
-// look rules draw Cursor's; the global scrollbars are the view bars (the
-// look token's width, square, shown while the scroller is hovered), and a
-// menu marked `.scrollbar-menu` keeps look's 7px bar through those unlayered
-// view rules; and the per-dialog copies of the modal skin are gone from the
-// layout and editor stylesheets, because the shared confirmation and form
-// skins own the look of the Add Folder, save, revert, and overwrite prompts.
-// Run: node test/foundation-css.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-const read = (relative) => readFile(path.join(uiDir, relative), "utf8");
-const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, "");
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** Every rule as { selectors, body }, nesting flattened. */
-function rulesOf(css) {
-  return [...stripComments(css).matchAll(/([^{}]+)\{([^{}]*)\}/g)].map((match) => ({
-    selectors: match[1].split(",").map((selector) => selector.replace(/\s+/g, " ").trim()),
-    body: match[2].replace(/\s+/g, " ").trim(),
-  }));
-}
-
-// --- style.css -----------------------------------------------------------------------
-
-const style = rulesOf(await read("style.css"));
-check(
-  "no global rule strips focus outlines",
-  !style.some((rule) => rule.selectors.includes(":focus") && /outline:\s*none/.test(rule.body)),
-);
-check(
-  "no style.css rule forces an outline off with !important",
-  !style.some((rule) => /outline:\s*none\s*!important/.test(rule.body)),
-);
-
-const thumb = style.find((rule) => rule.selectors.includes("::-webkit-scrollbar-thumb"));
-check("the scrollbar thumb is square", /border-radius:\s*0\b/.test(thumb?.body ?? ""));
-check(
-  "the scrollbar thumb is hidden until the scroller is hovered",
-  /background:\s*transparent/.test(thumb?.body ?? ""),
-);
-check(
-  "a hovered scroller shows the thumb",
-  style.some(
-    (rule) =>
-      rule.selectors.some((selector) => /:hover::-webkit-scrollbar-thumb$/.test(selector)) &&
-      rule.body.includes("var(--scrollbar-thumb)"),
-  ),
-);
-const bar = style.find((rule) => rule.selectors.includes("::-webkit-scrollbar"));
-check(
-  "the view scrollbar takes its width from the look token",
-  (bar?.body ?? "").includes("var(--scrollbar-width)"),
-);
-
-// --- a menu keeps its 7px bar through the view rules ----------------------------------
-
-/**
- * Every style rule with whether it sits inside an `@layer` block. At-rule wrappers (`@layer`,
- * `@supports`, `@media`) are flattened; a rule's own header is its selector list.
- */
-function layeredRules(css) {
-  const code = stripComments(css);
-  const rules = [];
-  const open = [];
-  let headerStart = 0;
-  for (let i = 0; i < code.length; i += 1) {
-    if (code[i] === "{") {
-      open.push({ header: code.slice(headerStart, i).replace(/\s+/g, " ").trim(), bodyStart: i + 1 });
-      headerStart = i + 1;
-    } else if (code[i] === "}") {
-      const closed = open.pop();
-      const body = code.slice(closed.bodyStart, i);
-      if (!closed.header.startsWith("@") && !body.includes("{")) {
-        rules.push({
-          selectors: closed.header.split(",").map((selector) => selector.trim()),
-          body: body.replace(/\s+/g, " ").trim(),
-          layered: open.some((entry) => entry.header.startsWith("@layer")),
-        });
-      }
-      headerStart = i + 1;
-    } else if (code[i] === ";") {
-      headerStart = i + 1;
-    }
-  }
-  return rules;
-}
-
-const declaration = (body, property) => {
-  for (const part of body.split(";")) {
-    const colon = part.indexOf(":");
-    if (colon >= 0 && part.slice(0, colon).trim() === property) return part.slice(colon + 1).trim();
-  }
-  return undefined;
-};
-
-/**
- * The value the cascade gives a scrollbar pseudo-element property: an unlayered rule beats a
- * layered one whatever the specificity, then the more specific selector wins, then the later rule.
- * Models only the selector shapes the scrollbar rules use:
- * `[.class][:hover]::pseudo[:hover]`, where a leading `:hover` is the scroller and a trailing one the part.
- */
-function cascaded(rules, element, pseudo, property) {
-  let best = null;
-  rules.forEach((rule, order) => {
-    const value = declaration(rule.body, property);
-    if (value === undefined) return;
-    for (const selector of rule.selectors) {
-      const parts = /^(?:\.([\w-]+))?(:hover)?(::[\w-]+)(:hover)?$/.exec(selector);
-      if (parts === null || parts[3] !== pseudo) continue;
-      const [, cls, scrollerHover, , partHover] = parts;
-      if (cls !== undefined && !element.classes.includes(cls)) continue;
-      if (scrollerHover !== undefined && !element.scrollerHover) continue;
-      if (partHover !== undefined && !element.partHover) continue;
-      const rank = [
-        rule.layered ? 0 : 1,
-        (cls === undefined ? 0 : 1) + (scrollerHover === undefined ? 0 : 1) + (partHover === undefined ? 0 : 1),
-        order,
-      ];
-      const beats =
-        best === null ||
-        rank[0] > best.rank[0] ||
-        (rank[0] === best.rank[0] && (rank[1] > best.rank[1] || (rank[1] === best.rank[1] && rank[2] > best.rank[2])));
-      if (beats) best = { rank, value };
-    }
-  });
-  return best?.value;
-}
-
-const controlsPath = fileURLToPath(import.meta.resolve("@workshop/look/controls.css"));
-const controlRules = layeredRules(await readFile(controlsPath, "utf8"));
-const viewRules = layeredRules(await read("style.css"));
-// Bundle order: look's sheets first, then the app's base sheet.
-const scrollbarRules = [...controlRules, ...viewRules];
-
-const menuRules = controlRules.filter((rule) => rule.selectors.some((selector) => selector.startsWith(".scrollbar-menu")));
-check("look has the menu scrollbar rules", menuRules.length > 0);
-check(
-  "no menu scrollbar rule sits in a layer, where the unlayered view rules would beat it",
-  menuRules.every((rule) => !rule.layered),
-);
-check(
-  "style.css's view scrollbar rules are unlayered, which is why the menu rules must be too",
-  viewRules.filter((rule) => rule.selectors.includes("::-webkit-scrollbar")).every((rule) => !rule.layered),
-);
-
-const menu = { classes: ["scrollbar-menu"], scrollerHover: false, partHover: false };
-const view = { classes: [], scrollerHover: false, partHover: false };
-check(
-  "a menu scrollbar is 7px wide after the view rules",
-  cascaded(scrollbarRules, menu, "::-webkit-scrollbar", "width") === "var(--scrollbar-width-menu)",
-);
-check(
-  "a menu scrollbar is 7px tall after the view rules",
-  cascaded(scrollbarRules, menu, "::-webkit-scrollbar", "height") === "var(--scrollbar-width-menu)",
-);
-check(
-  "a view scrollbar stays 10px wide",
-  cascaded(scrollbarRules, view, "::-webkit-scrollbar", "width") === "var(--scrollbar-width)",
-);
-check(
-  "a menu thumb shows without hover, unlike the view thumb",
-  cascaded(scrollbarRules, menu, "::-webkit-scrollbar-thumb", "background") === "var(--scrollbar-thumb)" &&
-    cascaded(scrollbarRules, view, "::-webkit-scrollbar-thumb", "background") === "transparent",
-);
-check(
-  "a hovered menu thumb takes the hover color",
-  cascaded(scrollbarRules, { ...menu, partHover: true }, "::-webkit-scrollbar-thumb", "background") ===
-    "var(--scrollbar-thumb-hover)",
-);
-
-// --- the per-dialog copies are gone --------------------------------------------------
-
-const zones = rulesOf(await read("src/parts/layout/zones.css"));
-check(
-  "zones.css carries no Add Folder dialog rules",
-  !zones.some((rule) => rule.selectors.some((selector) => selector.includes("ws-workspace-add"))),
-);
-const editor = rulesOf(await read("src/parts/editor/editor-panel.css"));
-check(
-  "editor-panel.css carries no panel dialog rules",
-  !editor.some((rule) =>
-    rule.selectors.some((selector) => /ws-editor-(conflict|close|revert)/.test(selector)),
-  ),
-);
-check(
-  "editor-panel.css keeps the panel and error bar rules",
-  editor.some((rule) => rule.selectors.includes(".ws-editor-panel")) &&
-    editor.some((rule) => rule.selectors.includes(".ws-editor-panel__error")),
-);
-
-const component = await read("src/tokens/component.css");
-check(
-  "the dialog size tokens left with their stylesheets",
-  !component.includes("--ws-editor-dialog-max-width") && !component.includes("--ws-workspace-dialog-min-width"),
-);
-
-if (failures.length > 0) {
-  console.error(`foundation-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("foundation-css: all assertions passed");
diff --git a/crates/workshop/ui/test/gateway-config-bridge.mjs b/crates/workshop/ui/test/gateway-config-bridge.mjs
deleted file mode 100644
index a91c879d9..000000000
--- a/crates/workshop/ui/test/gateway-config-bridge.mjs
+++ /dev/null
@@ -1,212 +0,0 @@
-// Unit test for the Gateway Config panel's workshop side: the
-// window-level postMessage bridge (src/parts/gateway/gateway-config-bridge.ts) and
-// the panel that embeds the iframe (src/parts/gateway/gateway-config-panel.ts).
-// Bundles the TS modules with esbuild and drives them in jsdom. Covers:
-// origin pinning (the iframe is proxied same-origin, so a message from
-// any foreign origin - the gateway's own port included - is ignored and
-// never forwarded), the ready announcement answered with a context
-// message (theme + initial route) pinned to the workshop origin, the
-// API-forward round trip through a stubbed /gateway/api server route
-// (bearer stays server-side by construction - the browser never sees a
-// key), the transport-failure answer (status 0), action notifications
-// landing on the status bar stub, listener teardown on dispose, and the
-// panel's iframe address, sandbox, and title.
-// Run: node test/gateway-config-bridge.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const result = await esbuild.build({
-  stdin: {
-    contents: `
-      export { setupGatewayConfigBridge } from "./src/parts/gateway/gateway-config-bridge.ts";
-      export { GatewayConfigPanel } from "./src/parts/gateway/gateway-config-panel.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The panel imports its colocated CSS; strip it - the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const code = result.outputFiles[0].text;
-const { setupGatewayConfigBridge, GatewayConfigPanel } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const WORKSHOP_ORIGIN = "http://127.0.0.1:7910";
-const GATEWAY_ORIGIN = "http://127.0.0.1:8081";
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: `${WORKSHOP_ORIGIN}/`,
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** Lets queued microtasks and zero-delay timers run. */
-async function flush(turns = 10) {
-  for (let i = 0; i < turns; i += 1) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- A stubbed workshop server: origin probe + proxy route -------------------
-
-const fetched = [];
-const fetchFn = async (url, init = {}) => {
-  fetched.push({ url, init });
-  if (url === "/gateway/api/admin/status") {
-    return new Response(JSON.stringify({ profile: "default", models: [] }), {
-      status: 200,
-      headers: { "content-type": "application/json" },
-    });
-  }
-  if (url === "/gateway/api/admin/system") {
-    throw new TypeError("the workshop server is unreachable");
-  }
-  return new Response(JSON.stringify({ error: { code: "forward_denied" } }), {
-    status: 403,
-    headers: { "content-type": "application/json" },
-  });
-};
-const proxyCalls = () => fetched.filter((call) => call.url.startsWith("/gateway/api"));
-
-const statusLines = [];
-const statusBar = {
-  showLocal: (label, severity) => statusLines.push({ label, severity }),
-};
-
-const replies = [];
-const bridge = setupGatewayConfigBridge({
-  statusBar,
-  fetchFn,
-  win: window,
-  reply: (_event, message, targetOrigin) => replies.push({ message, targetOrigin }),
-});
-
-function dispatch(data, origin = WORKSHOP_ORIGIN) {
-  window.dispatchEvent(new window.MessageEvent("message", { data, origin }));
-}
-
-// --- Origin pinning: a foreign origin is ignored ------------------------------
-
-dispatch({ type: "rv-api", id: "evil", method: "GET", path: "/admin/status", body: null }, "https://evil.example");
-await flush();
-check("a message from a foreign origin is never forwarded", proxyCalls().length === 0);
-check("a message from a foreign origin is never answered", replies.length === 0);
-
-// --- The gateway's own origin is foreign: the iframe is proxied same-origin ----
-
-dispatch({ type: "rv-bridge-ready" }, GATEWAY_ORIGIN);
-await flush();
-check("a ready announcement from the gateway origin is refused", replies.length === 0);
-
-// --- The ready announcement is answered with the pinned context ---------------
-
-dispatch({ type: "rv-bridge-ready" });
-await flush();
-check("the ready announcement is answered", replies.length === 1);
-check(
-  "the answer is a context message holding theme and initial route",
-  replies[0]?.message.type === "rv-context" &&
-    replies[0]?.message.theme === "dark" &&
-    replies[0]?.message.route === "#/local",
-);
-check(
-  "the context reply pins the workshop origin, never *",
-  replies[0]?.targetOrigin === WORKSHOP_ORIGIN,
-);
-
-// --- The API-forward round trip -----------------------------------------------
-
-dispatch({ type: "rv-api", id: "r1", method: "GET", path: "/admin/status", body: null });
-await flush();
-check(
-  "an api request forwards through the workshop server proxy route",
-  proxyCalls().length === 1 && proxyCalls()[0].url === "/gateway/api/admin/status",
-);
-const apiReply = replies.find((entry) => entry.message.type === "rv-api-result");
-check(
-  "the proxy's answer comes back with the request id, status, and body",
-  apiReply !== undefined &&
-    apiReply.message.id === "r1" &&
-    apiReply.message.status === 200 &&
-    apiReply.message.contentType === "application/json" &&
-    apiReply.message.body.includes('"profile":"default"'),
-);
-check("the api reply pins the workshop origin", apiReply?.targetOrigin === WORKSHOP_ORIGIN);
-
-// --- A transport failure answers status 0 --------------------------------------
-
-dispatch({ type: "rv-api", id: "r2", method: "GET", path: "/admin/system", body: null });
-await flush();
-const failureReply = replies.find((entry) => entry.message.id === "r2");
-check(
-  "an unreachable workshop server answers status 0, not silence",
-  failureReply !== undefined && failureReply.message.status === 0,
-);
-
-// --- Action notifications land on the status bar --------------------------------
-
-dispatch({ type: "rv-action", action: "apply" });
-dispatch({ type: "rv-action", action: "download-started" });
-dispatch({ type: "rv-action", action: "reboot-the-machine" });
-await flush();
-check(
-  "apply and download-started reach the status bar as local info lines",
-  statusLines.map((line) => line.label).join("|") ===
-    "Gateway configuration applied|Gateway download started" &&
-    statusLines.every((line) => line.severity === "info"),
-);
-
-// --- Dispose detaches the listener ----------------------------------------------
-
-const repliesBefore = replies.length;
-bridge.dispose();
-dispatch({ type: "rv-bridge-ready" });
-await flush();
-check("a disposed bridge answers nothing", replies.length === repliesBefore);
-
-// --- The panel embeds the iframe same-origin through the workshop proxy ---------
-
-{
-  const panel = new GatewayConfigPanel({
-    workshopOrigin: WORKSHOP_ORIGIN,
-  });
-  panel.init({ params: {} });
-  const iframe = panel.element.querySelector("iframe");
-  check("the panel embeds an iframe immediately (no async origin probe)", iframe !== null);
-  check(
-    "the iframe loads the config SPA same-origin via the workshop proxy",
-    iframe?.getAttribute("src") ===
-      `/gateway/config/?mode=panel&bridge=${encodeURIComponent(WORKSHOP_ORIGIN)}`,
-  );
-  check(
-    "the iframe sandbox grants scripts and same-origin only",
-    iframe?.getAttribute("sandbox") === "allow-scripts allow-same-origin",
-  );
-  check("the iframe has an accessible title", iframe?.getAttribute("title") === "Gateway Config");
-  panel.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`gateway-config-bridge: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("gateway-config-bridge: all assertions passed");
diff --git a/crates/workshop/ui/test/gateway-config-menu.mjs b/crates/workshop/ui/test/gateway-config-menu.mjs
deleted file mode 100644
index a70a53b6c..000000000
--- a/crates/workshop/ui/test/gateway-config-menu.mjs
+++ /dev/null
@@ -1,446 +0,0 @@
-// Unit test for the step-19 feature contributions: chrome, layout,
-// workspace, status, agent, and gateway
-// (src/parts/<feature>/<feature>.contribution.ts).
-// Bundles the six contribution modules with esbuild - the Tauri APIs
-// aliased to the recording stubs in test/helpers - and drives them
-// through the shared registries against jsdom with a recording fake
-// dock. Covers: the catalog wiring (titles, menu groups, chord labels,
-// palette rows); File > Preferences > Settings opening the Gateway
-// Config panel, with a second activation focusing the existing panel;
-// the zoom chords (Ctrl+=, Ctrl+Shift+=, Ctrl+-, Ctrl+NumPad0, Ctrl+0)
-// dispatching through the keybinding dispatcher to the real zoom
-// functions; F11 toggling native fullscreen; Close Window reaching the
-// native window; About opening the dialog; New Agents Window opening a
-// keyed agent panel; and the Primary Side Bar / Secondary Side Bar /
-// Status Bar toggles flipping their targets and context keys.
-// Run: node --test test/gateway-config-menu.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/chrome/chrome.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/status/status.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      import "./src/parts/gateway/gateway.contribution.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { getService, registerService } from "@workshop/platform/service-registry";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-      export { Menu } from "./src/parts/menu/menu.ts";
-      export { KeybindingDispatcher } from "./src/parts/layout/keybinding-dispatcher.ts";
-      export { initZones } from "./src/parts/layout/zones.ts";
-      export { getZoom } from "./src/parts/chrome/zoom.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-    "@tauri-apps/api/webviewWindow": path.join(uiDir, "helpers", "tauri-webview-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-for (const key of [
-  "document",
-  "navigator",
-  "HTMLElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.window = window;
-globalThis.document = window.document;
-// Events dispatched into the jsdom document must be jsdom-realm instances.
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-// New Agents Window keys its panel by a random UUID.
-if (typeof window.crypto?.randomUUID !== "function") {
-  let serial = 0;
-  Object.defineProperty(window, "crypto", {
-    configurable: true,
-    value: { randomUUID: () => `uuid-${(serial += 1)}` },
-  });
-}
-
-// The contributions register at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-step19-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  Commands,
-  Menus,
-  KeybindingsRegistry,
-  CONTEXT_KEY_SERVICE,
-  getService,
-  registerService,
-  STATUS_BAR,
-  Menu,
-  KeybindingDispatcher,
-  initZones,
-  getZoom,
-} = await import(pathToFileURL(bundlePath).href);
-console.error = realConsoleError;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-check("no contribution reported a malformed descriptor", consoleErrors.length === 0);
-
-// --- Shared fakes ------------------------------------------------------------
-
-// The status bar toggle targets the composition root's StatusBar; a
-// recording stand-in takes its slot and, like the real bar's setVisible,
-// mirrors the outcome into the statusBarVisible context key.
-let barVisible = true;
-registerService(STATUS_BAR, () => ({
-  get isVisible() {
-    return barVisible;
-  },
-  setVisible(visible) {
-    barVisible = visible;
-    getService(CONTEXT_KEY_SERVICE).createKey("statusBarVisible", true).set(visible);
-  },
-}));
-
-// A recording fake dock: added panels, activations, removals, and the
-// per-group visibility the Secondary Side Bar toggle drives.
-const addedPanels = [];
-const activated = [];
-const removed = [];
-const groups = new Map();
-function makeGroup(id) {
-  const api = {
-    isVisible: true,
-    setVisible(visible) {
-      api.isVisible = visible;
-    },
-  };
-  const group = { id, api };
-  groups.set(id, group);
-  return group;
-}
-initZones({
-  panels: [],
-  groups: [],
-  getPanel: (id) => addedPanels.find((panel) => panel.id === id),
-  getGroup: (id) => groups.get(id),
-  addPanel: (opts) => {
-    const panel = {
-      id: opts.id,
-      params: opts.params,
-      title: opts.title,
-      group: makeGroup(`g-${opts.id}`),
-      api: { setActive() {
-        activated.push(opts.id);
-      } },
-      view: { content: {} },
-    };
-    addedPanels.push(panel);
-    return panel;
-  },
-  removePanel: (panel) => {
-    removed.push(panel.id);
-    const index = addedPanels.indexOf(panel);
-    if (index !== -1) addedPanels.splice(index, 1);
-  },
-  onDidMovePanel: () => ({ dispose() {} }),
-  onDidRemovePanel: () => ({ dispose() {} }),
-  onWillMutateLayout: () => ({ dispose() {} }),
-  onDidMutateLayout: () => ({ dispose() {} }),
-  onDidLayoutChange: () => ({ dispose() {} }),
-});
-
-const contextKeys = getService(CONTEXT_KEY_SERVICE);
-
-// --- Catalog wiring ----------------------------------------------------------
-
-{
-  const prefRows = Menus.getMenuItems("menubar/file/preferences");
-  check(
-    "Preferences holds the Settings row in 1_settings",
-    prefRows.length === 1 &&
-      prefRows[0].command === "workbench.action.openSettings" &&
-      prefRows[0].group === "1_settings",
-  );
-
-  const titles = (rows) => rows.map((row) => Commands.lookup(row.command)?.title);
-  const appearance = titles(Menus.getMenuItems("menubar/view/appearance"));
-  check(
-    "Appearance lists the step-19 rows in group order",
-    appearance.join(",") ===
-      "Full Screen,Primary Side Bar,Secondary Side Bar,Status Bar,Zoom In,Zoom Out,Reset Zoom",
-  );
-  const file = titles(Menus.getMenuItems("menubar/file"));
-  check(
-    "File lists New Agents Window and Close Window",
-    file.includes("New Agents Window") && file.includes("Close Window"),
-  );
-  const help = titles(Menus.getMenuItems("menubar/help"));
-  check("Help lists About", help.includes("About"));
-
-  const palette = new Set(Menus.getMenuItems("commandPalette").map((row) => row.command));
-  const f1Ids = [
-    "workbench.action.toggleFullScreen",
-    "workbench.action.closeWindow",
-    "workbench.action.zoomIn",
-    "workbench.action.zoomOut",
-    "workbench.action.zoomReset",
-    "workbench.action.showAboutDialog",
-    "workbench.view.explorer",
-    "workbench.action.toggleSidebarVisibility",
-    "workbench.action.toggleAuxiliaryBar",
-    "workbench.action.toggleStatusbarVisibility",
-    "workbench.action.newAgentsWindow",
-    "workbench.action.openSettings",
-  ];
-  check(
-    "every step-19 action reaches the palette",
-    f1Ids.every((id) => palette.has(id)),
-  );
-
-  const label = (id) => KeybindingsRegistry.lookupKeybinding(id)?.getLabel();
-  check("Settings shows Ctrl+,", label("workbench.action.openSettings") === "Ctrl+,");
-  check("Reset Zoom's label is the NumPad0 rule", label("workbench.action.zoomReset") === "Ctrl+NumPad0");
-  check("Full Screen shows F11", label("workbench.action.toggleFullScreen") === "F11");
-  check("New Agents Window shows Ctrl+Alt+N", label("workbench.action.newAgentsWindow") === "Ctrl+Alt+N");
-  check("Explorer shows Ctrl+Shift+E", label("workbench.view.explorer") === "Ctrl+Shift+E");
-  check("Secondary Side Bar shows Ctrl+Alt+B", label("workbench.action.toggleAuxiliaryBar") === "Ctrl+Alt+B");
-}
-
-// --- Preferences > Settings opens the Gateway Config panel -------------------
-
-const menu = new Menu();
-const anchor = window.document.createElement("button");
-anchor.type = "button";
-window.document.body.appendChild(anchor);
-// The menubar's submenu declarations land with the menubar contribution;
-// the test declares the one flyout it drives.
-Menus.appendMenuItem("menubar/file", {
-  submenu: "menubar/file/preferences",
-  title: "Preferences",
-  group: "5_prefs",
-});
-
-function popovers() {
-  return [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter(
-    (el) => !el.hidden,
-  );
-}
-function rowByLabel(popover, label) {
-  return [...popover.querySelectorAll(":scope > .ws-window-titlebar__item")].find(
-    (row) => row.querySelector(".ws-window-titlebar__item-label")?.textContent === label,
-  );
-}
-function openPreferences() {
-  menu.open("menubar/file", anchor);
-  const filePopover = popovers().at(-1);
-  // A click opens the flyout at once; a hover waits 250ms (menubar-submenu.mjs).
-  rowByLabel(filePopover, "Preferences").click();
-  return popovers().at(-1);
-}
-
-{
-  const flyout = openPreferences();
-  const settings = rowByLabel(flyout, "Settings");
-  check("the Preferences flyout lists Settings", settings !== undefined);
-  check(
-    "the Settings row shows its chord",
-    settings?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+,",
-  );
-  settings.click();
-  await flush();
-  const configPanels = addedPanels.filter((panel) => panel.id === "config");
-  check("Settings opens the Gateway Config panel", configPanels.length === 1);
-  check("the panel opens titled Gateway Config", configPanels[0]?.title === "Gateway Config");
-  check("activating a row closes the menu", popovers().length === 0);
-
-  const again = openPreferences();
-  rowByLabel(again, "Settings").click();
-  await flush();
-  check(
-    "a second activation focuses the existing panel",
-    addedPanels.filter((panel) => panel.id === "config").length === 1 &&
-      activated.includes("config"),
-  );
-}
-
-// --- Zoom chords through the keybinding dispatcher -----------------------------
-
-const dispatcher = new KeybindingDispatcher({
-  status: { show() {}, clear() {} },
-});
-function press(key, init = {}) {
-  const event = new window.KeyboardEvent("keydown", {
-    key,
-    bubbles: true,
-    cancelable: true,
-    ...init,
-  });
-  window.document.dispatchEvent(event);
-  return event;
-}
-
-{
-  check("zoom starts at 100%", getZoom() === 1);
-  const equal = press("=", { code: "Equal", ctrlKey: true });
-  check("Ctrl+= dispatches zoomIn", getZoom() === 1.2);
-  check("Ctrl+= is consumed", equal.defaultPrevented === true);
-  const shifted = press("+", { code: "Equal", ctrlKey: true, shiftKey: true });
-  check("Ctrl+Shift+= dispatches zoomIn through the shifted + key", getZoom() === 1.44);
-  check("Ctrl+Shift+= is consumed", shifted.defaultPrevented === true);
-  press("-", { code: "Minus", ctrlKey: true });
-  check("Ctrl+- dispatches zoomOut", getZoom() === 1.2);
-  press("0", { code: "Numpad0", ctrlKey: true });
-  check("Ctrl+NumPad0 dispatches zoomReset", getZoom() === 1);
-  const numpadPlus = press("+", { code: "NumpadAdd", ctrlKey: true });
-  check("Ctrl+NumPad+ dispatches zoomIn", getZoom() === 1.2);
-  check("Ctrl+NumPad+ is consumed", numpadPlus.defaultPrevented === true);
-  const numpadMinus = press("-", { code: "NumpadSubtract", ctrlKey: true });
-  check("Ctrl+NumPad- dispatches zoomOut", getZoom() === 1);
-  check("Ctrl+NumPad- is consumed", numpadMinus.defaultPrevented === true);
-  press("=", { code: "Equal", ctrlKey: true });
-  press("0", { code: "Digit0", ctrlKey: true });
-  check("Ctrl+0 is the second zoomReset rule", getZoom() === 1);
-  check(
-    "the browser fallback applied the CSS zoom",
-    window.document.documentElement.style.zoom !== "",
-  );
-}
-
-// --- Full Screen and Close Window reach the native window ----------------------
-
-window.__TAURI_INTERNALS__ = {};
-{
-  press("F11", { code: "F11" });
-  await flush();
-  check("F11 enters native fullscreen", window.__TAURI_STUB__?.fullscreen === true);
-  press("F11", { code: "F11" });
-  await flush();
-  check("F11 again leaves native fullscreen", window.__TAURI_STUB__?.fullscreen === false);
-
-  await Commands.execute("workbench.action.closeWindow");
-  await flush();
-  check(
-    "Close Window closes the native window",
-    window.__TAURI_STUB__?.calls.includes("close"),
-  );
-}
-
-// --- About, New Agents Window, and the three visibility toggles -----------------
-
-{
-  await Commands.execute("workbench.action.showAboutDialog");
-  const dialog = window.document.querySelector(".ws-about-dialog");
-  check("About opens the dialog", dialog !== null);
-  dialog?.querySelector(".ws-about-dialog__close")?.click();
-  check(
-    "the dialog's Close dismisses it",
-    window.document.querySelector(".ws-about-dialog") === null,
-  );
-
-  await Commands.execute("workbench.action.newAgentsWindow");
-  const agentPanels = addedPanels.filter((panel) => panel.id.startsWith("agent:"));
-  check(
-    "New Agents Window opens a keyed agent panel",
-    agentPanels.length === 1 && typeof agentPanels[0]?.params?.instance === "string",
-  );
-
-  await Commands.execute("workbench.action.toggleAuxiliaryBar");
-  const agentGroup = agentPanels[0]?.group;
-  check(
-    "Secondary Side Bar hides the agent zone's group",
-    agentGroup?.api.isVisible === false &&
-      contextKeys.getValue("auxiliaryBarVisible") === false,
-  );
-  await Commands.execute("workbench.action.toggleAuxiliaryBar");
-  check(
-    "Secondary Side Bar shows the group again",
-    agentGroup?.api.isVisible === true &&
-      contextKeys.getValue("auxiliaryBarVisible") === true,
-  );
-
-  await Commands.execute("workbench.action.toggleSidebarVisibility");
-  check(
-    "Primary Side Bar opens the tree and sets its key",
-    addedPanels.some((panel) => panel.id === "tree") &&
-      contextKeys.getValue("sideBarVisible") === true,
-  );
-  await Commands.execute("workbench.action.toggleSidebarVisibility");
-  check(
-    "Primary Side Bar again removes the tree and clears its key",
-    removed.includes("tree") && contextKeys.getValue("sideBarVisible") === false,
-  );
-
-  await Commands.execute("workbench.action.toggleStatusbarVisibility");
-  check(
-    "Status Bar hides the bar and clears its key",
-    barVisible === false && contextKeys.getValue("statusBarVisible") === false,
-  );
-  await Commands.execute("workbench.action.toggleStatusbarVisibility");
-  check(
-    "Status Bar again shows the bar",
-    barVisible === true && contextKeys.getValue("statusBarVisible") === true,
-  );
-}
-
-dispatcher.dispose();
-menu.dispose();
-
-if (failures.length > 0) {
-  console.error(`gateway-config-menu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("gateway-config-menu: all assertions passed");
diff --git a/crates/workshop/ui/test/helpers/boot.mjs b/crates/workshop/ui/test/helpers/boot.mjs
deleted file mode 100644
index 2b6369006..000000000
--- a/crates/workshop/ui/test/helpers/boot.mjs
+++ /dev/null
@@ -1,515 +0,0 @@
-// Shared browser-environment fixture for the bundle-level workshop tests:
-// the jsdom boot that smoke.mjs originally built inline, extracted so every
-// per-feature slice boots the exact same way. bootWorkbench(name, run)
-// loads dist/index.html into jsdom, stands in fakes for the APIs jsdom
-// lacks (WebSocket, audio capture, fetch, layout metrics), imports the built
-// bundle (which lazy-loads its feature chunks from dist/chunks/),
-// waits for the app to settle, then runs `run` under the shared
-// disposable-leak check and reports the verdict through the
-// process exit code. The optional third argument scripts the two UI-state
-// buckets the app preloads (see `uiStateOptions`) and the #dock element's
-// client size (`dockSize`); every fetch the app
-// makes, and every service resolution (method RESOLVE), lands in
-// ctx.fetchLog in order, ctx.resolveService(id) reads any registry
-// service the boot bound, and ctx.registeredServiceIds() lists the bound
-// token ids in registration order. Run after `npm run build`.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-import { JSDOM } from "jsdom";
-import { attachSeams, distDir } from "./bundle-seams.mjs";
-import { assertNoLeaks } from "./leak-check.mjs";
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-// The UI-state routes the composition root preloads at boot and the stores
-// write through (src/services/ui-storage.ts). GET answers the bucket's
-// document; PUT /{key} answers `{ saved: true }`.
-const UI_STATE_ROUTES = {
-  "/user/state": "user",
-  "/workspace/file/state": "workspace",
-};
-
-const jsonResponse = (body, status = 200) =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-
-/**
- * Normalizes `options.uiState` into one entry per bucket. Each bucket is
- * scripted as `"resolve"` (the default: an empty document, every key
- * absent), `"reject"` (the fetch rejects with a network error), `"hang"`
- * (the fetch never settles, so the app's preload timeout decides), or an
- * object (the fetch resolves with that object as the bucket's document, the
- * way a test seeds stores with values). Unknown modes fail loudly: a typo
- * would otherwise silently boot on defaults.
- */
-function uiStateOptions(uiState = {}) {
-  const buckets = {};
-  for (const bucket of ["user", "workspace"]) {
-    const mode = uiState[bucket] ?? "resolve";
-    if (typeof mode === "object" && mode !== null) {
-      buckets[bucket] = { mode: "resolve", body: mode };
-    } else if (mode === "resolve") {
-      buckets[bucket] = { mode, body: {} };
-    } else if (mode === "reject" || mode === "hang") {
-      buckets[bucket] = { mode, body: null };
-    } else {
-      throw new Error(`uiState.${bucket} must be resolve, reject, hang, or an object; got ${mode}`);
-    }
-  }
-  return buckets;
-}
-
-/**
- * Boots the bundled workbench in jsdom and runs `run(ctx)` - the test body -
- * under the shared disposable-leak check: a body that leaves a
- * DisposableStore created during the run undisposed fails the test. The
- * app's own boot tree is exempt by construction (the tracker installs after
- * boot settles); it lives for the page lifetime by design.
- *
- * `ctx` holds the window, the scripted-socket registry, the status bar
- * elements, the fetch log, and the push helpers; `run` records failed
- * expectations by pushing plain-English messages onto ctx.failures.
- * `options.uiState` scripts the two UI-state buckets (see uiStateOptions).
- * `options.dockSize` ({ width, height }) gives #dock that client size
- * before the entry evaluates; without it jsdom reports zero and the dock
- * boots unsized.
- * This function never returns: it prints the verdict and exits the process,
- * because pending app timers (the status-bar LED pulse, reconnect backoffs)
- * outlive the assertions.
- */
-export async function bootWorkbench(name, run, options = {}) {
-  const uiState = uiStateOptions(options.uiState);
-  const html = await readFile(path.join(distDir, "index.html"), "utf8");
-  const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-  const { window } = dom;
-
-  // jsdom lacks layout APIs the panels touch; no-op stubs are enough because
-  // nothing scrolls in the tests.
-  window.matchMedia =
-    window.matchMedia ||
-    (() => ({
-      matches: false,
-      media: "",
-      addEventListener() {},
-      removeEventListener() {},
-      addListener() {},
-      removeListener() {},
-      dispatchEvent: () => false,
-    }));
-  window.ResizeObserver = class {
-    observe() {}
-    unobserve() {}
-    disconnect() {}
-  };
-  window.IntersectionObserver = class {
-    observe() {}
-    unobserve() {}
-    disconnect() {}
-    takeRecords() {
-      return [];
-    }
-  };
-  window.Element.prototype.scrollTo = () => {};
-  window.HTMLElement.prototype.scrollIntoView = () => {};
-  // jsdom's Range has no layout rects; ProseMirror's scroll-to-selection
-  // reads them when a landed dictation final focuses the prompt editor.
-  window.Range.prototype.getClientRects = () => [];
-  window.Range.prototype.getBoundingClientRect = () => new window.DOMRect();
-  if (options.dockSize !== undefined) {
-    const dockEl = window.document.getElementById("dock");
-    Object.defineProperty(dockEl, "clientWidth", { value: options.dockSize.width });
-    Object.defineProperty(dockEl, "clientHeight", { value: options.dockSize.height });
-  }
-
-  // A scripted WebSocket stands in for the server's persistent sockets:
-  // the workshop /ws connection the composition root opens, and the
-  // /agents/ws connection the agent panel opens. It must live on
-  // globalThis: the bundle calls the global `WebSocket`, not
-  // `window.WebSocket`. Frames a test wants answered are pushed through
-  // the socket's own onmessage by the ctx helpers below.
-  const sockets = [];
-  const realtimeSession = (include, prompt = "") => ({
-    id: "boot_realtime",
-    object: "realtime.transcription_session",
-    type: "transcription",
-    audio: {
-      input: {
-        format: { type: "audio/pcm", rate: 24000 },
-        noise_reduction: null,
-        transcription: { model: "realtime-transcribe", prompt },
-        turn_detection: null,
-      },
-    },
-    include,
-  });
-  class FakeWebSocket {
-    static CONNECTING = 0;
-    static OPEN = 1;
-    static CLOSING = 2;
-    static CLOSED = 3;
-    constructor(url) {
-      this.url = url;
-      this.readyState = FakeWebSocket.CONNECTING;
-      this.sent = [];
-      sockets.push(this);
-      setTimeout(() => {
-        this.readyState = FakeWebSocket.OPEN;
-        this.onopen?.();
-        if (this.url.endsWith("/v1/realtime")) {
-          this.onmessage?.({
-            data: JSON.stringify({
-              type: "session.created",
-              event_id: "boot_realtime_created",
-              session: realtimeSession([]),
-            }),
-          });
-        }
-      }, 0);
-    }
-    addEventListener(type, listener) {
-      const prop = `on${type}`;
-      const previous = this[prop];
-      this[prop] = previous ? (event) => (previous(event), listener(event)) : listener;
-    }
-    send(data) {
-      this.sent.push(data);
-      const event = typeof data === "string" ? JSON.parse(data) : null;
-      if (event?.type === "session.update") {
-        queueMicrotask(() =>
-          this.onmessage?.({
-            data: JSON.stringify({
-              type: "session.updated",
-              event_id: "boot_realtime_updated",
-              session: realtimeSession(
-                ["item.input_audio_transcription.hypothesis"],
-                event.session.audio.input.transcription.prompt,
-              ),
-            }),
-          }),
-        );
-      }
-    }
-    close() {
-      this.readyState = FakeWebSocket.CLOSED;
-    }
-  }
-  globalThis.WebSocket = FakeWebSocket;
-
-  // Dictation stubs: jsdom has no audio stack, so the mic button's
-  // getUserMedia/AudioContext path is scripted to succeed. The bundle
-  // reads the globals.
-  const fakeAudioStream = { getTracks: () => [{ stop() {} }] };
-  globalThis.navigator.mediaDevices = {
-    getUserMedia: () => Promise.resolve(fakeAudioStream),
-  };
-  class FakeAudioContext {
-    constructor() {
-      this.sampleRate = 24_000;
-      this.destination = {};
-      this.audioWorklet = { addModule: () => Promise.resolve() };
-    }
-    createMediaStreamSource() {
-      return { connect() {}, disconnect() {} };
-    }
-    close() {
-      return Promise.resolve();
-    }
-    resume() {
-      return Promise.resolve();
-    }
-  }
-  class FakeAudioWorkletNode {
-    constructor() {
-      this.port = {
-        onmessage: null,
-        postMessage: (message) => {
-          if (message?.type === "flush") {
-            queueMicrotask(() => this.port.onmessage?.({ data: { type: "flushed" } }));
-          }
-        },
-      };
-    }
-    connect() {}
-    disconnect() {}
-  }
-  window.AudioContext = FakeAudioContext;
-  globalThis.AudioContext = FakeAudioContext;
-  globalThis.AudioWorkletNode = FakeAudioWorkletNode;
-
-  // The workbench state (models, profiles, selection) arrives only over
-  // the socket, so a booted workbench fetches nothing but the two UI-state
-  // buckets the composition root preloads (scripted per `options.uiState`)
-  // and the Workshop tree's roots listing (answered empty: no grants yet).
-  // Store writes PUT to the state routes and are answered saved. Any other
-  // fetch rejects the test. Every call is recorded in order, with a timestamp
-  // and the parsed PUT body, so a test can assert what the app fetched and
-  // when relative to the rest of boot; the service observer installed
-  // below interleaves getService resolutions into the same log.
-  const fetchLog = [];
-  const bootStart = Date.now();
-  globalThis.fetch = (url, init = {}) => {
-    const method = init.method ?? "GET";
-    const entry = { url, method, at: Date.now() - bootStart };
-    if (method === "PUT" && typeof init.body === "string") {
-      entry.body = JSON.parse(init.body);
-    }
-    fetchLog.push(entry);
-    if (url === "/workspace/tree") {
-      return Promise.resolve(jsonResponse({ path: null, entries: [] }));
-    }
-    const bucket = UI_STATE_ROUTES[url];
-    if (bucket !== undefined && method === "GET") {
-      const script = uiState[bucket];
-      if (script.mode === "hang") {
-        return new Promise(() => {});
-      }
-      if (script.mode === "reject") {
-        return Promise.reject(new TypeError(`scripted network failure for ${url}`));
-      }
-      return Promise.resolve(jsonResponse(script.body));
-    }
-    const putRoute = Object.keys(UI_STATE_ROUTES).find((route) => url.startsWith(`${route}/`));
-    if (putRoute !== undefined && method === "PUT") {
-      return Promise.resolve(jsonResponse({ saved: true }));
-    }
-    return Promise.reject(new Error(`unexpected fetch in a booted workbench test: ${url}`));
-  };
-
-  for (const key of [
-    "document",
-    "navigator",
-    "location",
-    "localStorage",
-    "HTMLElement",
-    "HTMLTemplateElement",
-    "HTMLInputElement",
-    "HTMLTextAreaElement",
-    "HTMLButtonElement",
-    "Node",
-    "Element",
-    "Event",
-    "CustomEvent",
-    "MutationObserver",
-    "Option",
-    "DOMParser",
-    "NodeFilter",
-    "ResizeObserver",
-    "IntersectionObserver",
-    "getComputedStyle",
-    "requestAnimationFrame",
-    "cancelAnimationFrame",
-  ]) {
-    if (!(key in globalThis) && key in window) {
-      globalThis[key] = window[key];
-    }
-  }
-  // Node ships its own Event and CustomEvent globals, so the copy loop skips
-  // them - but events the bundle dispatches into the jsdom document must be
-  // jsdom-realm instances: jsdom's dispatchEvent rejects Node's Event with
-  // "parameter 1 is not of type 'Event'".
-  globalThis.Event = window.Event;
-  globalThis.CustomEvent = window.CustomEvent;
-  globalThis.window = window;
-  globalThis.document = window.document;
-
-  // The bundle's test-only seams (the disposable tracker, the service
-  // observer) are tree-shaken out of the entry; bundle-seams.mjs reattaches
-  // them as appended exports and answers the chunk path holding each.
-  const seams = await attachSeams();
-  // The service observer must be live before the entry evaluates: the
-  // resolutions it records happen during boot itself. Importing the seam's
-  // chunk first evaluates only that shared chunk (the registry and its
-  // base-layer dependencies), and the entry's later import reuses the
-  // evaluated instance. Every getService call lands in fetchLog beside the
-  // fetches, under the RESOLVE method, so a test reads one ordered log.
-  const serviceSeam = await import(pathToFileURL(seams.__setServiceObserver).href);
-  serviceSeam.__setServiceObserver({
-    serviceResolved: (id) => {
-      fetchLog.push({ url: id, method: "RESOLVE", at: Date.now() - bootStart });
-    },
-  });
-  // The entry's name is content-hashed (dist/bundle/app-<hash>.js); the
-  // build's manifest maps the logical name to it.
-  const manifest = JSON.parse(await readFile(path.join(distDir, "manifest.json"), "utf8"));
-  await import(pathToFileURL(path.join(distDir, manifest["app.js"])).href);
-  const trackerSeam = await import(pathToFileURL(seams.__setDisposableTracker).href);
-  const lifecycle = { setDisposableTracker: trackerSeam.__setDisposableTracker };
-
-  // Resolves a registry service by token id the way the bundle's own
-  // getService does (building it on first use from the current factory),
-  // so a test can read a store the boot bound - including one no consumer
-  // has resolved yet - without a seam per store. Throws on an unknown id.
-  const registrySeam = await import(pathToFileURL(seams.__serviceRegistrations).href);
-  function resolveService(id) {
-    for (const [token, registration] of registrySeam.__serviceRegistrations()) {
-      if (token.id !== id) continue;
-      if (!registration.built) {
-        registration.instance = registration.factory();
-        registration.built = true;
-      }
-      return registration.instance;
-    }
-    throw new Error(`no service registered for ${id}`);
-  }
-
-  // The bound token ids in registration order (a re-registered token keeps
-  // its first position), so a test can assert what boot bound before what.
-  function registeredServiceIds() {
-    return [...registrySeam.__serviceRegistrations().keys()].map((token) => token.id);
-  }
-
-  const statusBar = window.document.querySelector(".status-bar");
-  const statusText = window.document.querySelector(".status-bar__text");
-  const statusSlot = window.document.querySelector(".status-bar__slot");
-  const barberpoleEl = window.document.querySelector(".status-bar__barberpole");
-  const indicatorsEl = window.document.querySelector(".status-bar__indicators");
-  const ledEl = window.document.querySelector('.status-bar__led[data-indicator="activity"]');
-  const recEl = window.document.querySelector('.status-bar__led[data-indicator="recording"]');
-
-  // Every booted test reads the status bar and the mounted workbench; a
-  // boot without them is broken, not a per-feature failure, so fail
-  // loudly here. The agent panel mounts a beat after the dock, so poll.
-  let agentPanel = null;
-  for (let i = 0; i < 100 && !agentPanel; i++) {
-    agentPanel = window.document.querySelector("#dock .ws-agent-panel");
-    if (!agentPanel) await sleep(20);
-  }
-  const missing = [
-    ["the status bar", statusBar],
-    ["the ws-agent-session panel", agentPanel],
-    ["the Workshop tree", window.document.querySelector("#dock .ws-workshop-tree")],
-  ]
-    .filter(([, node]) => !node)
-    .map(([what]) => what);
-  if (missing.length > 0) {
-    throw new Error(`the workbench did not boot: ${missing.join(", ")} never mounted`);
-  }
-
-  // The composition root's own workshop socket: /ws exactly, never the
-  // agent panel's /agents/ws connection.
-  const wsSocket = () =>
-    sockets.filter((socket) => socket.url.endsWith("/ws") && !socket.url.endsWith("/agents/ws")).at(-1);
-  // The agent panel's session socket, and the per-take Realtime sockets
-  // the mic opens.
-  const agentsSocket = () => sockets.filter((socket) => socket.url.endsWith("/agents/ws")).at(-1);
-  const sttSockets = () => sockets.filter((socket) => socket.url.endsWith("/v1/realtime"));
-
-  // The fake socket flips to OPEN on a 0ms timer, and the app can boot
-  // during the bundle import's own microtask drain - before any macrotask
-  // ran. Wait for the boot socket to open so no test body observes (or
-  // drops) a socket that is still CONNECTING: a real WebSocket never fires
-  // open after close, but the fake's late timer would, and that stale
-  // onopen cancels the reconnect backoff the close just scheduled.
-  const socketDeadline = Date.now() + 5000;
-  while (wsSocket()?.readyState !== FakeWebSocket.OPEN && Date.now() < socketDeadline) {
-    await sleep(10);
-  }
-  if (wsSocket()?.readyState !== FakeWebSocket.OPEN) {
-    throw new Error("the workbench did not boot: the /ws socket never opened");
-  }
-
-  // Pushes one observer status frame down the persistent socket, as the
-  // server's /ws route would. Fields default to a plain idle update.
-  function emitStatus(overrides = {}) {
-    wsSocket()?.onmessage?.({
-      data: JSON.stringify({
-        type: "status",
-        label: "Ready",
-        description: "",
-        severity: "info",
-        activity: "general",
-        busy: false,
-        ...overrides,
-      }),
-    });
-  }
-
-  // Pushes a models frame, as the server does when the gateway returns
-  // after an outage.
-  function emitModels(models) {
-    wsSocket()?.onmessage?.({ data: JSON.stringify({ type: "models", models }) });
-  }
-
-  // Pushes one complete workbench snapshot, as the server's /ws route
-  // does whenever its menu state changes. Fields default to the booted
-  // single-model state.
-  function emitWorkbench(overrides = {}) {
-    wsSocket()?.onmessage?.({
-      data: JSON.stringify({
-        type: "workbench",
-        profiles: [],
-        active: null,
-        switching: null,
-        switch_in_flight: false,
-        selected: "test-model",
-        chat_ready: true,
-        ...overrides,
-      }),
-    });
-  }
-
-  // Pushes one frame down the agent panel's /agents/ws socket, as the
-  // server's agent route would: a session acknowledgment, an event, a
-  // wait announcement.
-  function emitAgent(frame) {
-    agentsSocket()?.onmessage?.({ data: JSON.stringify(frame) });
-  }
-
-  // The server pushes the retained status, the model catalog, and a
-  // workbench snapshot on connect, in that order (session.rs) - the app
-  // makes no HTTP state fetches at boot. Mirror all three pushes here:
-  // the status seeds the status bar, the catalog populates the agent
-  // toolbar's model picker, and the snapshot names the selection.
-  emitStatus();
-  emitModels([{ id: "test-model", description: "scripted" }]);
-  emitWorkbench();
-
-  const failures = [];
-
-  const ctx = {
-    window,
-    document: window.document,
-    sockets,
-    FakeWebSocket,
-    wsSocket,
-    agentsSocket,
-    sttSockets,
-    emitAgent,
-    agentPanel,
-    statusBar,
-    statusText,
-    statusSlot,
-    barberpoleEl,
-    indicatorsEl,
-    ledEl,
-    recEl,
-    emitStatus,
-    emitModels,
-    emitWorkbench,
-    fetchLog,
-    resolveService,
-    registeredServiceIds,
-    sleep,
-    failures,
-  };
-
-  try {
-    await assertNoLeaks(lifecycle, () => run(ctx));
-  } catch (error) {
-    // Either the leak report or a crash in the test body; both fail the
-    // test with the message in the verdict.
-    failures.push(error?.stack ?? String(error));
-  }
-
-  if (failures.length > 0) {
-    console.error(`${name} failed:\n- ${failures.join("\n- ")}`);
-    process.exit(1);
-  }
-  console.log(`${name} passed`);
-  process.exit(0);
-}
diff --git a/crates/workshop/ui/test/helpers/bundle-seams.mjs b/crates/workshop/ui/test/helpers/bundle-seams.mjs
deleted file mode 100644
index 09999e07e..000000000
--- a/crates/workshop/ui/test/helpers/bundle-seams.mjs
+++ /dev/null
@@ -1,116 +0,0 @@
-// The built bundle's test-only seams. The entry bundle exports nothing
-// (main.ts is an entry point) and esbuild tree-shakes the unused test-only
-// setters (setDisposableTracker, setServiceObserver) away, so the seams
-// are unreachable from outside the bundle. attachSeams reattaches them by
-// appending exports to the bundle text: the dist bytes execute unmodified,
-// and each appended function assigns the bundle's own module-scope
-// variable, located by its single distinctive call site. Consumers import
-// the returned chunk paths through file URLs, because the split bundle's
-// relative chunk imports cannot resolve from a data: URL.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-import { readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-export const distDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "dist");
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-// Each seam is a module-scope variable the built code reads through one
-// distinctive call site (minified identifiers change per build, property
-// names do not; identifiers may contain $, which \w excludes). The
-// appended export named `name` assigns that variable, or, for a `read`
-// seam, answers it.
-const SEAMS = [
-  // @workshop/platform/lifecycle: the DisposableStore constructor's tracker call.
-  { name: "__setDisposableTracker", callSite: /([\w$]+)\?\.trackCreated\(this\)/ },
-  // @workshop/platform/service-registry: getService's observer call.
-  { name: "__setServiceObserver", callSite: /([\w$]+)\?\.serviceResolved\([\w$]+\.id\)/ },
-  // @workshop/platform/service-registry: getService's lookup in the
-  // registrations map, followed by its unregistered-token throw. Read
-  // seam: a boot test resolves any registered store by token id.
-  {
-    name: "__serviceRegistrations",
-    read: true,
-    callSite: /([\w$]+)\.get\([\w$]+\);if\([\w$]+===void 0\)throw new Error\(`no service registered for/,
-  },
-];
-
-/** The appended export for one located seam. */
-function seamExport(seam, variable) {
-  return seam.read
-    ? `export function ${seam.name}() { return ${variable}; }`
-    : `export function ${seam.name}(next) { ${variable} = next; }`;
-}
-
-/**
- * Scans every dist script for the SEAMS call sites and appends the missing
- * exports, answering a map from seam name to the path of the chunk that
- * holds it. With code splitting a seam may live in any chunk, and two
- * seams may share one. Idempotent: dist is not rebuilt between test runs,
- * so a previous run's appended exports may already be there.
- */
-export async function attachSeams() {
-  const found = {};
-  const distScripts = (await readdir(distDir, { recursive: true }))
-    .filter((name) => name.endsWith(".js"))
-    .map((name) => path.join(distDir, name));
-  for (const scriptPath of distScripts) {
-    const source = await readFile(scriptPath, "utf8");
-    const exports = [];
-    for (const seam of SEAMS) {
-      const match = source.match(seam.callSite);
-      if (!match) continue;
-      found[seam.name] = scriptPath;
-      if (!source.includes(seam.name)) {
-        exports.push(seamExport(seam, match[1]));
-      }
-    }
-    if (exports.length > 0) {
-      await appendAtomically(scriptPath, source, exports);
-    }
-    if (Object.keys(found).length === SEAMS.length) break;
-  }
-  const missing = SEAMS.map((seam) => seam.name).filter((name) => !(name in found));
-  if (missing.length > 0) {
-    throw new Error(
-      `bundle-seams.mjs could not locate ${missing.join(", ")} in dist/; rebuild dist or retune the seam regex`,
-    );
-  }
-  return found;
-}
-
-// Atomic append: node --test runs the boot tests concurrently, and a
-// truncate-and-write would let a concurrent scanner read a partial chunk -
-// missing the seam entirely, or worse, appending the export to truncated
-// bytes and corrupting the chunk. Write a per-process temp file and rename
-// it over the chunk so readers only ever see complete content.
-async function appendAtomically(scriptPath, source, exports) {
-  const tempPath = `${scriptPath}.${process.pid}.tmp`;
-  await writeFile(tempPath, `${source}\n${exports.join("\n")}\n`);
-  // Windows: when two boot tests lose the scan race together, both rename
-  // over the chunk, and the loser's rename fails with EPERM while the
-  // winner's freshly replaced file is still held open. The append is
-  // idempotent, so a chunk that already holds every export satisfies
-  // every concurrent appender; only a chunk still missing one after the
-  // retries is a real failure.
-  const names = SEAMS.map((seam) => seam.name).filter((name) => exports.some((e) => e.includes(name)));
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await rename(tempPath, scriptPath);
-      return;
-    } catch (error) {
-      const current = await readFile(scriptPath, "utf8").catch(() => "");
-      if (names.every((name) => current.includes(name))) {
-        await rm(tempPath, { force: true });
-        return;
-      }
-      if (error?.code !== "EPERM" || attempt >= 4) {
-        await rm(tempPath, { force: true });
-        throw error;
-      }
-      await sleep(50);
-    }
-  }
-}
diff --git a/crates/workshop/ui/test/helpers/css-values.mjs b/crates/workshop/ui/test/helpers/css-values.mjs
deleted file mode 100644
index 3ce55d113..000000000
--- a/crates/workshop/ui/test/helpers/css-values.mjs
+++ /dev/null
@@ -1,139 +0,0 @@
-// Source-text readers for the stylesheet contract tests. jsdom applies no
-// layout, so a test that pins a declared value reads the stylesheet itself:
-// rulesOf() flattens a sheet into { at, selectors, body } rows (the
-// at-rule headers around a rule, such as an @container query, ride along in
-// `at`), declaration() reads one property out of a body, and resolver() builds
-// a function that follows var(--token) chains through the token sheets
-// (look's tokens, sizes, and semantic sheets and the app's component
-// sheet) down to the literal a stylesheet declares.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
-const lookDir = path.join(uiDir, "..", "look");
-
-/** Reads a file under crates/workshop/ui. */
-export const readUi = (relative) => readFile(path.join(uiDir, relative), "utf8");
-
-/** Reads a file under crates/workshop/look. */
-export const readLook = (relative) => readFile(path.join(lookDir, relative), "utf8");
-
-export const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, "");
-
-/**
- * Every style rule in a sheet as { at, selectors, body }: `at` lists the
- * at-rule headers wrapped around it (outermost first), `selectors` the
- * whitespace-normalized selector list, `body` the declarations.
- */
-export function rulesOf(css) {
-  const code = stripComments(css);
-  const rules = [];
-  const open = [];
-  let headerStart = 0;
-  for (let i = 0; i < code.length; i += 1) {
-    const char = code[i];
-    if (char === "{") {
-      open.push({ header: code.slice(headerStart, i).replace(/\s+/g, " ").trim(), bodyStart: i + 1 });
-      headerStart = i + 1;
-    } else if (char === "}") {
-      const closed = open.pop();
-      const body = code.slice(closed.bodyStart, i);
-      if (!closed.header.startsWith("@") && !body.includes("{")) {
-        rules.push({
-          at: open.map((entry) => entry.header).filter((header) => header.startsWith("@")),
-          selectors: closed.header.split(",").map((selector) => selector.replace(/\s+/g, " ").trim()),
-          body: body.replace(/\s+/g, " ").trim(),
-        });
-      }
-      headerStart = i + 1;
-    } else if (char === ";") {
-      headerStart = i + 1;
-    }
-  }
-  return rules;
-}
-
-/** One property's value out of a rule body, or undefined. */
-export function declaration(body, property) {
-  for (const part of body.split(";")) {
-    const colon = part.indexOf(":");
-    if (colon >= 0 && part.slice(0, colon).trim() === property) {
-      return part.slice(colon + 1).trim();
-    }
-  }
-  return undefined;
-}
-
-/**
- * The value `property` has in the rules whose selector list holds
- * `selector`, outside any at-rule unless `at` says which; the last such rule
- * that declares it wins, as the cascade breaks a tie by source order.
- */
-export function valueIn(rules, selector, property, at = null) {
-  let found;
-  for (const rule of rules) {
-    if (!rule.selectors.includes(selector)) continue;
-    if (at === null ? rule.at.length > 0 : !rule.at.some((header) => header.includes(at))) continue;
-    const value = declaration(rule.body, property);
-    if (value !== undefined) found = value;
-  }
-  return found;
-}
-
-/**
- * Builds resolve(value): follows var(--name) and var(--name, fallback)
- * references through every token sheet until only literals remain, and
- * lowercases the result so a hex color compares however the sheet cases it.
- */
-export async function resolver() {
-  const sheets = [
-    await readLook("tokens.css"),
-    await readLook("sizes.css"),
-    await readLook("semantic.css"),
-    await readUi("src/tokens/component.css"),
-  ];
-  const tokens = new Map();
-  for (const sheet of sheets) {
-    for (const match of stripComments(sheet).matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)) {
-      tokens.set(match[1], match[2].replace(/\s+/g, " ").trim());
-    }
-  }
-  const resolve = (value, depth = 0) => {
-    if (value === undefined || depth > 20) return value;
-    let out = "";
-    let i = 0;
-    while (i < value.length) {
-      const start = value.indexOf("var(", i);
-      if (start === -1) {
-        out += value.slice(i);
-        break;
-      }
-      out += value.slice(i, start);
-      // Scan to the var()'s balanced closing parenthesis, noting the first top-level comma.
-      let nesting = 0;
-      let comma = -1;
-      let end = start + 3;
-      for (; end < value.length; end += 1) {
-        if (value[end] === "(") nesting += 1;
-        else if (value[end] === ")") {
-          nesting -= 1;
-          if (nesting === 0) break;
-        } else if (value[end] === "," && nesting === 1 && comma === -1) comma = end;
-      }
-      const inner = value.slice(start + 4, end);
-      const name = (comma === -1 ? inner : value.slice(start + 4, comma)).trim();
-      const fallback = comma === -1 ? undefined : value.slice(comma + 1, end).trim();
-      const target = tokens.get(name);
-      if (target !== undefined) out += resolve(target, depth + 1);
-      else if (fallback !== undefined) out += resolve(fallback, depth + 1);
-      else out += value.slice(start, end + 1);
-      i = end + 1;
-    }
-    return out.toLowerCase();
-  };
-  resolve.tokens = tokens;
-  return resolve;
-}
diff --git a/crates/workshop/ui/test/helpers/lazy-feature.mjs b/crates/workshop/ui/test/helpers/lazy-feature.mjs
deleted file mode 100644
index c9a6e7b66..000000000
--- a/crates/workshop/ui/test/helpers/lazy-feature.mjs
+++ /dev/null
@@ -1,30 +0,0 @@
-// A synthetic lazy feature directory for the panel-registry test: stands
-// in for a feature barrel (src/parts/<feature>/index.ts) loaded through a
-// panel type's import thunk. register() installs the panel factory, as the
-// real barrels do, and records its own invocations on globalThis so the
-// test can count them from outside the bundle. The returned disposable
-// records its disposal the same way.
-//
-// The registry's registerPanelFactory arrives through a global injected
-// by the test bundle: a static import of the TS source would resolve to a
-// second module-instance copy of the registry when this file is bundled,
-// and would break plain `node --test` discovery of this helper.
-// Export-only fixture: running this file directly must (and does) exit 0.
-
-export function register() {
-  globalThis.__lazyFeatureRegisters = (globalThis.__lazyFeatureRegisters ?? 0) + 1;
-  globalThis.__testRegisterPanelFactory("fake", () => ({
-    element: Object.assign(document.createElement("div"), { className: "fake-lazy-panel" }),
-    init(params) {
-      this.element.dataset.params = JSON.stringify(params.params);
-    },
-    dispose() {
-      globalThis.__lazyFeatureDisposes = (globalThis.__lazyFeatureDisposes ?? 0) + 1;
-    },
-  }));
-  return {
-    dispose() {
-      globalThis.__lazyFeatureRegisterDisposed = true;
-    },
-  };
-}
diff --git a/crates/workshop/ui/test/helpers/leak-check.mjs b/crates/workshop/ui/test/helpers/leak-check.mjs
deleted file mode 100644
index 8ee5b33f8..000000000
--- a/crates/workshop/ui/test/helpers/leak-check.mjs
+++ /dev/null
@@ -1,53 +0,0 @@
-// Shared leak check for workshop UI tests: assertNoLeaks(lifecycle, run)
-// fails when `run` creates DisposableStores it never disposes. Each test
-// bundles its own copy of `@workshop/platform/lifecycle`, so the caller hands in
-// that bundled module and the tracker lands on the exact class instance
-// the code under test uses. This helper is the only consumer of the
-// setDisposableTracker seam in lifecycle.ts.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-// Covered by: test/leak-check.mjs.
-
-/**
- * Runs `run` (sync or async) with DisposableStore tracking enabled on
- * `lifecycle` - a loaded copy of `@workshop/platform/lifecycle` exposing
- * setDisposableTracker - and throws if any store created during the run
- * is still undisposed afterwards, naming each leak by its construction
- * site. The tracker is uninstalled on the way out even when `run` throws.
- */
-export async function assertNoLeaks(lifecycle, run) {
-  const live = new Map();
-  lifecycle.setDisposableTracker({
-    trackCreated(store) {
-      live.set(store, new Error().stack ?? "(stack unavailable)");
-    },
-    trackDisposed(store) {
-      live.delete(store);
-    },
-  });
-  try {
-    await run();
-  } finally {
-    lifecycle.setDisposableTracker(undefined);
-  }
-  if (live.size > 0) {
-    const sites = [...live.values()].map(
-      (stack, index) => `  leak ${index + 1}: created at ${constructionSite(stack)}`,
-    );
-    throw new Error(`${live.size} DisposableStore(s) leaked:\n${sites.join("\n")}`);
-  }
-}
-
-// Keeps the frames that name the leak: the tracker's own frame and the
-// DisposableStore constructor are noise, and three frames are enough to
-// see which component was constructed where.
-function constructionSite(stack) {
-  const frames = stack
-    .split("\n")
-    .slice(1)
-    .map((line) => line.trim())
-    .filter(
-      (line) => !line.includes("trackCreated") && !line.includes("new DisposableStore"),
-    );
-  return frames.slice(0, 3).join("\n    ") || "(construction site unknown)";
-}
diff --git a/crates/workshop/ui/test/helpers/tauri-dialog-stub.mjs b/crates/workshop/ui/test/helpers/tauri-dialog-stub.mjs
deleted file mode 100644
index bb8a00f6b..000000000
--- a/crates/workshop/ui/test/helpers/tauri-dialog-stub.mjs
+++ /dev/null
@@ -1,24 +0,0 @@
-// Test double for "@tauri-apps/plugin-dialog", substituted into the bundle
-// by esbuild's `alias` in the workshop-panel and files-actions unit tests.
-// The test scripts each pick's answer through window.__TAURI_DIALOG__.answer
-// (a path string, or null for a canceled dialog) and reads back the options
-// each open or save received; every call records its kind ("open" or "save")
-// beside the caller's options.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-
-function record(kind, options) {
-  if (window.__TAURI_DIALOG__ === undefined) {
-    window.__TAURI_DIALOG__ = { calls: [], answer: null };
-  }
-  window.__TAURI_DIALOG__.calls.push({ kind, ...options });
-  return Promise.resolve(window.__TAURI_DIALOG__.answer);
-}
-
-export function open(options) {
-  return record("open", options);
-}
-
-export function save(options) {
-  return record("save", options);
-}
diff --git a/crates/workshop/ui/test/helpers/tauri-event-stub.mjs b/crates/workshop/ui/test/helpers/tauri-event-stub.mjs
deleted file mode 100644
index 99f8dfcde..000000000
--- a/crates/workshop/ui/test/helpers/tauri-event-stub.mjs
+++ /dev/null
@@ -1,25 +0,0 @@
-// Test double for "@tauri-apps/api/event", substituted into the bundle by
-// esbuild's `alias` in the workspace-files unit test. Only `emit` is
-// doubled: it is the one export the bundled contributions import. Every
-// emit records its event name and payload on window.__TAURI_EVENTS__ so
-// the test can assert what the page told the desktop app; a scripted failure
-// (window.__TAURI_EVENTS__.fail = true) rejects the emit the way a page
-// without event permissions would.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-
-function log() {
-  if (window.__TAURI_EVENTS__ === undefined) {
-    window.__TAURI_EVENTS__ = { emitted: [], fail: false };
-  }
-  return window.__TAURI_EVENTS__;
-}
-
-export function emit(event, payload) {
-  const events = log();
-  if (events.fail) {
-    return Promise.reject(new Error("event.emit not allowed"));
-  }
-  events.emitted.push({ event, payload });
-  return Promise.resolve();
-}
diff --git a/crates/workshop/ui/test/helpers/tauri-webview-stub.mjs b/crates/workshop/ui/test/helpers/tauri-webview-stub.mjs
deleted file mode 100644
index 2958d1d92..000000000
--- a/crates/workshop/ui/test/helpers/tauri-webview-stub.mjs
+++ /dev/null
@@ -1,23 +0,0 @@
-// Test double for "@tauri-apps/api/webviewWindow", substituted into the
-// bundle by esbuild's `alias` in the zoom unit test. The real module talks
-// to the Tauri runtime over window.__TAURI_INTERNALS__; this double records
-// each setZoom factor on window.__TAURI_WEBVIEW_STUB__ so the test can read
-// them back out of the bundled module.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-
-function state() {
-  if (window.__TAURI_WEBVIEW_STUB__ === undefined) {
-    window.__TAURI_WEBVIEW_STUB__ = { zooms: [] };
-  }
-  return window.__TAURI_WEBVIEW_STUB__;
-}
-
-export function getCurrentWebviewWindow() {
-  return {
-    setZoom(factor) {
-      state().zooms.push(factor);
-      return Promise.resolve();
-    },
-  };
-}
diff --git a/crates/workshop/ui/test/helpers/tauri-window-stub.mjs b/crates/workshop/ui/test/helpers/tauri-window-stub.mjs
deleted file mode 100644
index a0e215908..000000000
--- a/crates/workshop/ui/test/helpers/tauri-window-stub.mjs
+++ /dev/null
@@ -1,58 +0,0 @@
-// Test double for "@tauri-apps/api/window", substituted into the bundle by
-// esbuild's `alias` in the window-chrome unit test. The real module talks
-// to the Tauri runtime over window.__TAURI_INTERNALS__; this double records
-// each native window command on window.__TAURI_STUB__ so the test can read
-// them back out of the bundled module, and lets the test script the
-// maximized state and fire resize events.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-
-function state() {
-  if (window.__TAURI_STUB__ === undefined) {
-    window.__TAURI_STUB__ = { calls: [], maximized: false, fullscreen: false, resizeHandlers: [] };
-  }
-  return window.__TAURI_STUB__;
-}
-
-export function getCurrentWindow() {
-  return {
-    minimize() {
-      state().calls.push("minimize");
-      return Promise.resolve();
-    },
-    toggleMaximize() {
-      const s = state();
-      s.maximized = !s.maximized;
-      s.calls.push("toggle-maximize");
-      return Promise.resolve();
-    },
-    close() {
-      state().calls.push("close");
-      return Promise.resolve();
-    },
-    startDragging() {
-      state().calls.push("drag");
-      return Promise.resolve();
-    },
-    isMaximized() {
-      return Promise.resolve(state().maximized);
-    },
-    // Reads stay unrecorded (isMaximized sets the precedent); only the
-    // state-changing write lands in calls.
-    isFullscreen() {
-      return Promise.resolve(state().fullscreen);
-    },
-    setFullscreen(fullscreen) {
-      state().fullscreen = fullscreen;
-      state().calls.push("set-fullscreen");
-      return Promise.resolve();
-    },
-    onResized(handler) {
-      state().resizeHandlers.push(handler);
-      return Promise.resolve(() => {
-        const s = state();
-        s.resizeHandlers = s.resizeHandlers.filter((h) => h !== handler);
-      });
-    },
-  };
-}
diff --git a/crates/workshop/ui/test/helpers/ui-storage.mjs b/crates/workshop/ui/test/helpers/ui-storage.mjs
deleted file mode 100644
index 4a3dd01aa..000000000
--- a/crates/workshop/ui/test/helpers/ui-storage.mjs
+++ /dev/null
@@ -1,61 +0,0 @@
-// Shared fake for the UI-state adapter (src/services/ui-storage.ts): an
-// in-memory UiStorage that every store test seeds with initial bucket
-// values and inspects for the writes the store made. It mirrors the real
-// adapter's contract - `get` answers null for an absent key, `set` updates
-// the cache and records the call, `suppressWrites` drops workspace-bucket
-// writes for the duration of the callback - without any fetch, so a store
-// under test never touches the network. `replaceWorkspace` stands in for
-// what the real adapter's `reloadWorkspace` does after Open: it swaps the
-// workspace bucket for another file's values without recording a write.
-// Export-only module: the node --test runner discovers every file under
-// test/, so running this file directly must (and does) exit 0.
-
-/**
- * Builds a fake adapter. `initial` is `{ user: {...}, workspace: {...} }`;
- * either bucket may be omitted. The returned object has the adapter
- * surface plus `sets`, the recorded `set` calls in order as
- * `{ bucket, key, value }`, and `suppressed`, the workspace writes that
- * `suppressWrites` swallowed.
- */
-export function createFakeUiStorage(initial = {}) {
-  const buckets = {
-    user: new Map(Object.entries(initial.user ?? {})),
-    workspace: new Map(Object.entries(initial.workspace ?? {})),
-  };
-  const sets = [];
-  const suppressed = [];
-  let suppressDepth = 0;
-  return {
-    sets,
-    suppressed,
-    preload() {
-      return Promise.resolve();
-    },
-    get(bucket, key) {
-      const value = buckets[bucket].get(key);
-      return value === undefined ? null : value;
-    },
-    set(bucket, key, value) {
-      if (bucket === "workspace" && suppressDepth > 0) {
-        suppressed.push({ bucket, key, value });
-        return;
-      }
-      buckets[bucket].set(key, value);
-      sets.push({ bucket, key, value });
-    },
-    reloadWorkspace() {
-      return Promise.resolve();
-    },
-    replaceWorkspace(values) {
-      buckets.workspace = new Map(Object.entries(values ?? {}));
-    },
-    suppressWrites(fn) {
-      suppressDepth += 1;
-      try {
-        return fn();
-      } finally {
-        suppressDepth -= 1;
-      }
-    },
-  };
-}
diff --git a/crates/workshop/ui/test/json-request-timeout.mjs b/crates/workshop/ui/test/json-request-timeout.mjs
deleted file mode 100644
index 7446e1766..000000000
--- a/crates/workshop/ui/test/json-request-timeout.mjs
+++ /dev/null
@@ -1,137 +0,0 @@
-// Unit test for the route-timeout rendering in the shared HTTP floor
-// (src/services/json-request.ts) and its adoption at the write boundary
-// (src/services/workspace-api.ts). Bundles the TS modules with esbuild and
-// imports them via a data URL. Covers: a 408 whose body is the JSON error
-// envelope yields the envelope's message and the `deadline_elapsed` code; a
-// 408 whose body is empty reads as `null` and renders a readable timeout
-// error, never the non-JSON-answer shape failure.
-// Run: node --test test/json-request-timeout.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as jsonRequest from "./src/services/json-request.ts";
-      export * as workspace from "./src/services/workspace-api.ts";
-      export { ErrorCatalog } from "./src/services/error-catalog.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { jsonRequest, workspace, ErrorCatalog } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The server's deadline envelope, as support/deadline.rs answers it.
-const TIMEOUT_MESSAGE =
-  "the request did not finish within its 10s deadline; the operation may still complete";
-const ENVELOPE = { error: { message: TIMEOUT_MESSAGE, code: "deadline_elapsed" } };
-
-const jsonResponse = (status, body) => ({
-  ok: status >= 200 && status < 300,
-  status,
-  json: async () => body,
-});
-
-// An empty 408 body: json() rejects the way a real empty Response does.
-const emptyResponse = {
-  ok: false,
-  status: 408,
-  json: async () => {
-    throw new SyntaxError("unexpected end of JSON input");
-  },
-};
-
-// Scripts globalThis.fetch per case: `respond` is a fake Response.
-function withFetch(respond, run) {
-  const previous = globalThis.fetch;
-  globalThis.fetch = async () => respond;
-  return run().finally(() => {
-    globalThis.fetch = previous;
-  });
-}
-
-// --- The shared floor: a 408 JSON envelope yields message and code ---------
-
-{
-  check(
-    "a 408 JSON envelope yields the envelope's message",
-    jsonRequest.errorMessage(ENVELOPE, 408, "PUT /workspace/file") === TIMEOUT_MESSAGE,
-  );
-  check(
-    "a 408 JSON envelope yields the deadline_elapsed code",
-    jsonRequest.errorCode(ENVELOPE) === "deadline_elapsed",
-  );
-}
-
-// --- The shared floor: an empty 408 body reads as null, renders a timeout --
-
-{
-  const body = await jsonRequest.readJson(emptyResponse, "PUT /workspace/file");
-  check("an empty 408 body reads as null", body === null);
-  check(
-    "an empty 408 body renders a readable timeout, not a non-JSON answer",
-    jsonRequest.errorMessage(body, 408, "PUT /workspace/file") === "PUT /workspace/file timed out",
-  );
-}
-
-// --- Through the write boundary: the envelope message reaches the caller ---
-
-await withFetch(jsonResponse(408, ENVELOPE), async () => {
-  let caught = null;
-  try {
-    await workspace.writeFile("/tmp/note.txt", "late write", null);
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "a write's 408 envelope keeps the server's timeout message",
-    caught !== null && caught.message === TIMEOUT_MESSAGE,
-  );
-  check("a write's 408 envelope keeps the status", caught !== null && caught.status === 408);
-  check(
-    "a write's 408 is typed as DeadlineElapsed, not HttpStatus",
-    caught !== null && caught.code === ErrorCatalog.DeadlineElapsed,
-  );
-});
-
-await withFetch(emptyResponse, async () => {
-  let caught = null;
-  try {
-    await workspace.writeFile("/tmp/note.txt", "late write", null);
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "a write's empty 408 body renders a readable timeout",
-    caught !== null && caught.message === "PUT /workspace/file timed out",
-  );
-  check(
-    "a write's empty 408 body never reports a non-JSON answer",
-    caught !== null && !caught.message.includes("non-JSON"),
-  );
-});
-
-if (failures.length > 0) {
-  console.error(`json-request-timeout: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("json-request-timeout: all assertions passed");
diff --git a/crates/workshop/ui/test/keybinding-dispatcher.mjs b/crates/workshop/ui/test/keybinding-dispatcher.mjs
deleted file mode 100644
index a6d0b8f17..000000000
--- a/crates/workshop/ui/test/keybinding-dispatcher.mjs
+++ /dev/null
@@ -1,333 +0,0 @@
-// Unit test for the keybinding dispatcher
-// (src/parts/layout/keybinding-dispatcher.ts): the capture-phase document
-// listener that resolves pressed chords through the keybinding registry
-// and context-key service. Covers: a bound chord running its command
-// and being swallowed before an inner (CodeMirror-shaped) bubble
-// listener sees it, unbound keys and modifier-only presses falling
-// through untouched, the MoreChordsNeeded waiting status with the
-// chordPending context key, the five-second timeout and window-blur
-// exits, the three-second not-a-command status for an unrecognized
-// second key, a context-gated chord swallowed without running, a
-// rejected command reported by the registry (the toast's source) and
-// logged rather than posted to the sink, the default status-bar sink's
-// chord prompts and its empty idle text, and the zoom chords
-// (Ctrl+= / Ctrl+Shift+= / Ctrl+- / Ctrl+0 through event.code, Alt
-// chords unbound, dispose uninstalling the listener). Bundles the
-// module with esbuild and drives it against jsdom; the timer exits use
-// mocked timers.
-// Run: node --test test/keybinding-dispatcher.mjs
-import { mock } from "node:test";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { KeybindingDispatcher } from "./src/parts/layout/keybinding-dispatcher.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const {
-  KeybindingDispatcher,
-  CommandRegistry,
-  ContextKeyService,
-  createKeybindingsRegistry,
-  registerService,
-  STATUS_BAR,
-} = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Each scenario gets fresh registries, a recording status sink, and its
-// own dispatcher, so the capture listener and the chordPending key never
-// leak across scenarios.
-function scenario() {
-  const commands = new CommandRegistry();
-  const contextKeys = new ContextKeyService();
-  const keybindings = createKeybindingsRegistry("linux");
-  const statusLog = [];
-  const status = {
-    show: (message) => statusLog.push(["show", message]),
-    clear: () => statusLog.push(["clear"]),
-  };
-  const runs = [];
-  const dispatcher = new KeybindingDispatcher({ commands, contextKeys, keybindings, status });
-  const press = (key, { target, ...init } = {}) => {
-    const event = new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true, ...init });
-    (target ?? window.document.body).dispatchEvent(event);
-    return event;
-  };
-  const shown = () => statusLog.filter(([kind]) => kind === "show").map(([, message]) => message);
-  return { commands, contextKeys, keybindings, statusLog, runs, press, shown, dispose: () => dispatcher.dispose() };
-}
-
-// --- Dispatch: a bound chord runs its command and is consumed ---------------
-
-{
-  const s = scenario();
-  s.commands.register("test.save", { run: () => s.runs.push("test.save") });
-  s.keybindings.registerKeybindingRule({ id: "test.save", keybinding: "ctrl+s" });
-  const event = s.press("s", { code: "KeyS", ctrlKey: true });
-  check("a bound chord runs its command", s.runs.join(",") === "test.save");
-  check("a bound chord is consumed", event.defaultPrevented === true);
-  s.dispose();
-}
-
-// --- Capture phase: claimed chords never reach an inner listener ------------
-
-{
-  const s = scenario();
-  s.commands.register("test.save", { run: () => s.runs.push("test.save") });
-  s.keybindings.registerKeybindingRule({ id: "test.save", keybinding: "ctrl+s" });
-  // A bubble-phase listener on a nested element stands in for
-  // CodeMirror's keymap on its content element.
-  const editor = window.document.createElement("div");
-  window.document.body.append(editor);
-  const seen = [];
-  editor.addEventListener("keydown", (event) => seen.push(event.key));
-  const claimed = s.press("s", { code: "KeyS", ctrlKey: true, target: editor });
-  check("a claimed chord is swallowed before the inner listener", seen.length === 0);
-  check("a claimed chord is consumed at capture", claimed.defaultPrevented === true);
-  check("a claimed chord still runs its command", s.runs.join(",") === "test.save");
-  const unbound = s.press("a", { code: "KeyA", target: editor });
-  check("an unbound key reaches the inner listener", seen.join(",") === "a");
-  check("an unbound key is not consumed", unbound.defaultPrevented === false);
-  const modifier = s.press("Control", { code: "ControlLeft", ctrlKey: true, target: editor });
-  check("a modifier-only press reaches the inner listener", seen.join(",") === "a,Control");
-  check("a modifier-only press is not consumed", modifier.defaultPrevented === false);
-  s.dispose();
-}
-
-// --- Chords: waiting status, chordPending, completion ------------------------
-
-{
-  const s = scenario();
-  s.commands.register("test.chord", { run: () => s.runs.push("test.chord") });
-  s.keybindings.registerKeybindingRule({ id: "test.chord", keybinding: "ctrl+m ctrl+o" });
-  const first = s.press("m", { code: "KeyM", ctrlKey: true });
-  check("a chord prefix is consumed", first.defaultPrevented === true);
-  check("a chord prefix does not run the command", s.runs.length === 0);
-  check("a chord prefix sets chordPending", s.contextKeys.getValue("chordPending") === true);
-  check(
-    "a chord prefix posts the waiting status",
-    s.shown().includes("(Ctrl+M) was pressed. Waiting for second key of chord..."),
-  );
-  const second = s.press("o", { code: "KeyO", ctrlKey: true });
-  check("the second chord key runs the command", s.runs.join(",") === "test.chord");
-  check("the second chord key is consumed", second.defaultPrevented === true);
-  check("a completed chord clears chordPending", s.contextKeys.getValue("chordPending") === false);
-  check("a completed chord clears the waiting status", s.statusLog.some(([kind]) => kind === "clear"));
-  s.dispose();
-}
-
-// --- Chords: the five-second timeout abandons the pending chord --------------
-
-{
-  mock.timers.enable({ apis: ["setTimeout"] });
-  const s = scenario();
-  s.commands.register("test.chord", { run: () => s.runs.push("test.chord") });
-  s.keybindings.registerKeybindingRule({ id: "test.chord", keybinding: "ctrl+m ctrl+o" });
-  s.press("m", { code: "KeyM", ctrlKey: true });
-  mock.timers.tick(4999);
-  check("the chord waits the full five seconds", s.contextKeys.getValue("chordPending") === true);
-  mock.timers.tick(1);
-  check("a five-second timeout abandons the chord", s.contextKeys.getValue("chordPending") === false);
-  check("a timeout clears the waiting status", s.statusLog.some(([kind]) => kind === "clear"));
-  const after = s.press("o", { code: "KeyO", ctrlKey: true });
-  check("the second key after a timeout is not the chord", s.runs.length === 0);
-  check("the second key after a timeout falls through", after.defaultPrevented === false);
-  s.dispose();
-  mock.timers.reset();
-}
-
-// --- Chords: window blur abandons the pending chord --------------------------
-
-{
-  const s = scenario();
-  s.commands.register("test.chord", { run: () => s.runs.push("test.chord") });
-  s.keybindings.registerKeybindingRule({ id: "test.chord", keybinding: "ctrl+m ctrl+o" });
-  s.press("m", { code: "KeyM", ctrlKey: true });
-  window.dispatchEvent(new window.Event("blur"));
-  check("window blur abandons the chord", s.contextKeys.getValue("chordPending") === false);
-  check("window blur clears the waiting status", s.statusLog.some(([kind]) => kind === "clear"));
-  const after = s.press("o", { code: "KeyO", ctrlKey: true });
-  check("the second key after blur is not the chord", s.runs.length === 0);
-  check("the second key after blur falls through", after.defaultPrevented === false);
-  s.dispose();
-}
-
-// --- Chords: an unrecognized second key posts the not-a-command status -------
-
-{
-  mock.timers.enable({ apis: ["setTimeout"] });
-  const s = scenario();
-  s.commands.register("test.chord", { run: () => s.runs.push("test.chord") });
-  s.keybindings.registerKeybindingRule({ id: "test.chord", keybinding: "ctrl+m ctrl+o" });
-  s.press("m", { code: "KeyM", ctrlKey: true });
-  const stray = s.press("x", { code: "KeyX" });
-  check("an unrecognized second key is consumed", stray.defaultPrevented === true);
-  check("an unrecognized second key abandons the chord", s.contextKeys.getValue("chordPending") === false);
-  check(
-    "an unrecognized chord posts the not-a-command status",
-    s.shown().includes("The key combination (Ctrl+M, X) is not a command."),
-  );
-  check("the not-a-command status has not cleared yet", !s.statusLog.some(([kind]) => kind === "clear"));
-  mock.timers.tick(3000);
-  check("the not-a-command status clears after three seconds", s.statusLog.some(([kind]) => kind === "clear"));
-  s.dispose();
-  mock.timers.reset();
-}
-
-// --- Context gating: a claimed chord is swallowed even when its when fails ---
-
-{
-  const s = scenario();
-  const canRun = s.contextKeys.createKey("canRun", false);
-  s.commands.register("test.gated", { run: () => s.runs.push("test.gated") });
-  s.keybindings.registerKeybindingRule({ id: "test.gated", keybinding: "ctrl+k", when: "canRun" });
-  const blocked = s.press("k", { code: "KeyK", ctrlKey: true });
-  check("a context-gated chord is still swallowed", blocked.defaultPrevented === true);
-  check("a context-gated chord does not run", s.runs.length === 0);
-  canRun.set(true);
-  s.press("k", { code: "KeyK", ctrlKey: true });
-  check("the chord runs once its when passes", s.runs.join(",") === "test.gated");
-  s.dispose();
-}
-
-// --- Failure: the registry reports a rejected command, the sink stays quiet ----
-
-{
-  const s = scenario();
-  const failed = [];
-  s.commands.onDidFailCommand((failure) => failed.push(failure));
-  s.commands.register("test.boom", { title: "Boom", category: "Test", run: () => Promise.reject(new Error("boom")) });
-  s.keybindings.registerKeybindingRule({ id: "test.boom", keybinding: "ctrl+e" });
-  // The dispatcher logs the detail the toast leaves out; capture it.
-  const logged = [];
-  const realConsoleError = console.error;
-  console.error = (...args) => logged.push(args);
-  const event = s.press("e", { code: "KeyE", ctrlKey: true });
-  check("a failing command's chord is still consumed", event.defaultPrevented === true);
-  for (let i = 0; i < 5; i += 1) {
-    await Promise.resolve();
-  }
-  console.error = realConsoleError;
-  check(
-    "the registry reports the failed chord once, labelled Test: Boom",
-    failed.length === 1 && failed[0].label === "Test: Boom" && failed[0].error.message === "boom",
-  );
-  check("the dispatcher posts no status message of its own for a failure", s.statusLog.length === 0);
-  check(
-    "the dispatcher keeps the failure's detail on the console",
-    logged.length === 1 && String(logged[0][0]).includes("test.boom") && logged[0][1]?.message === "boom",
-  );
-  s.dispose();
-}
-
-// --- The default sink: chord prompts on the bar, the idle text empty ----------
-
-{
-  mock.timers.enable({ apis: ["setTimeout"] });
-  const barLog = [];
-  registerService(STATUS_BAR, () => ({
-    showLocal: (label, severity) => barLog.push([label, severity]),
-    isVisible: true,
-    setVisible() {},
-  }));
-  const commands = new CommandRegistry();
-  const contextKeys = new ContextKeyService();
-  const keybindings = createKeybindingsRegistry("linux");
-  const dispatcher = new KeybindingDispatcher({ commands, contextKeys, keybindings });
-  commands.register("test.chord", { run: () => {} });
-  keybindings.registerKeybindingRule({ id: "test.chord", keybinding: "ctrl+m ctrl+o" });
-  const press = (key, init) =>
-    window.document.body.dispatchEvent(
-      new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true, ...init }),
-    );
-  press("m", { code: "KeyM", ctrlKey: true });
-  check(
-    "the chord prompt goes to the bar as an info message",
-    barLog.length === 1 && barLog[0][1] === "info" && barLog[0][0].startsWith("(Ctrl+M) was pressed."),
-  );
-  press("x", { code: "KeyX" });
-  mock.timers.tick(3000);
-  check(
-    "the bar returns to an empty idle text",
-    barLog.at(-1)?.[0] === "" && barLog.at(-1)?.[1] === "info",
-  );
-  dispatcher.dispose();
-  contextKeys.dispose();
-  mock.timers.reset();
-}
-
-// --- Zoom chords: Ctrl+= / Ctrl+Shift+= / Ctrl+- / Ctrl+0
-
-{
-  const s = scenario();
-  s.commands.register("chrome.zoomIn", { run: () => s.runs.push("zoomIn") });
-  s.commands.register("chrome.zoomOut", { run: () => s.runs.push("zoomOut") });
-  s.commands.register("chrome.resetZoom", { run: () => s.runs.push("resetZoom") });
-  // The zoom-in pair: the shifted plus key is the same physical key, so
-  // both chords bind the command (VS Code binds ctrl+= and ctrl+shift+=).
-  s.keybindings.registerKeybindingRule({ id: "chrome.zoomIn", keybinding: "ctrlcmd+=" });
-  s.keybindings.registerKeybindingRule({ id: "chrome.zoomIn", keybinding: "ctrlcmd+shift+=" });
-  s.keybindings.registerKeybindingRule({ id: "chrome.zoomOut", keybinding: "ctrlcmd+-" });
-  s.keybindings.registerKeybindingRule({ id: "chrome.resetZoom", keybinding: "ctrlcmd+0" });
-  let event = s.press("=", { code: "Equal", ctrlKey: true });
-  check("Ctrl+= dispatches zoom in", s.runs.at(-1) === "zoomIn");
-  check("Ctrl+= is consumed", event.defaultPrevented === true);
-  event = s.press("+", { code: "Equal", ctrlKey: true, shiftKey: true });
-  check("Ctrl+Shift+= dispatches zoom in through the shifted + key", s.runs.at(-1) === "zoomIn");
-  check("Ctrl+Shift+= is consumed", event.defaultPrevented === true);
-  event = s.press("-", { code: "Minus", ctrlKey: true });
-  check("Ctrl+- dispatches zoom out", s.runs.at(-1) === "zoomOut");
-  check("Ctrl+- is consumed", event.defaultPrevented === true);
-  event = s.press("0", { code: "Digit0", ctrlKey: true });
-  check("Ctrl+0 dispatches reset zoom", s.runs.at(-1) === "resetZoom");
-  check("Ctrl+0 is consumed", event.defaultPrevented === true);
-  event = s.press("=", { code: "Equal", ctrlKey: true, altKey: true });
-  check("an Alt chord is not a zoom binding", s.runs.at(-1) === "resetZoom");
-  check("an Alt chord is not consumed", event.defaultPrevented === false);
-  s.dispose();
-  event = s.press("=", { code: "Equal", ctrlKey: true });
-  check("disposing uninstalls the keydown listener", s.runs.at(-1) === "resetZoom");
-  check("a disposed dispatcher no longer consumes", event.defaultPrevented === false);
-}
-
-if (failures.length > 0) {
-  console.error(`keybinding-dispatcher: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("keybinding-dispatcher: all assertions passed");
diff --git a/crates/workshop/ui/test/layout-open-registry.mjs b/crates/workshop/ui/test/layout-open-registry.mjs
deleted file mode 100644
index 825b8514b..000000000
--- a/crates/workshop/ui/test/layout-open-registry.mjs
+++ /dev/null
@@ -1,528 +0,0 @@
-// Integration test for the open panel registry (@workshop/platform's
-// panel-registry.ts) driven through the zone registry
-// (src/parts/layout/zones.ts), layout persistence, the layout boot
-// decision (src/parts/layout/layout-boot.ts), and the layout
-// contribution's Secondary Side Bar toggle. Bundles the layout core
-// without any feature contribution, mounts a real Dockview dock in
-// jsdom, and registers synthetic panel types the core has never heard of.
-// Covers: the core declares no panel type of its own; a registered type
-// opens in its default zone with its static title; the `instance` param
-// keys side-by-side instances and reopening one reveals it; a custom
-// panelId and title function govern identity and the tab title; a
-// `closable: false` type opens and keeps the flag; the generic tab gives
-// every closable variant a close button and a right-click menu over the
-// core's Close rows and a test-only row, and the `closable: false` variant neither, before
-// and after a restore; ids holding a Windows
-// drive colon still resolve their type; save-then-restore brings every
-// panel back with its params, title, and zone; a duplicate registration
-// throws; and a registered layout policy over the synthetic types (left
-// anchor "pinned", right anchor "probe") seeds the default layout, gets
-// a lost anchor back after a restore without seeding, and gives the
-// Secondary Side Bar toggle its right anchor to open when the right zone
-// was never built - the layout core names no feature. With no editor
-// contribution in the bundle, the layout core's close path still runs: a
-// probe tab's X and Delete on its focused tab close it, and Close Others
-// voids its batch when a part confirmed clean turns dirty through
-// WorkshopPart.isDirty() while a later part confirms; closeActiveEditor
-// resolves true on a confirmed close and false on a refusal, a
-// `closable: false` panel, or a panelId naming no open panel.
-// Run: node --test test/layout-open-registry.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      // The dock lifecycle reads the closed-editor stack through its token;
-      // the implementation's module scope self-registers the empty default.
-      import "./src/parts/editor/closed-editors.ts";
-      // The Secondary Side Bar toggle registers from the layout core's own
-      // contribution.
-      import "./src/parts/layout/layout.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export {
-        registerPanelType,
-        registerPanelFactory,
-        isPanelType,
-        panelTypeEntry,
-        resolvePanelContent,
-      } from "@workshop/platform/panel-registry";
-      // The dirty-capable probe subclasses this copy, the one the close
-      // path's instanceof check sees.
-      export { WorkshopPart } from "@workshop/platform/workshop-part";
-      export {
-        initZones,
-        openInZone,
-        panelIdFor,
-        resetZones,
-        setZoneOverride,
-        zoneOfPanel,
-      } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-      export { restoreLayout, buildLayoutEnvelope } from "./src/parts/layout/layout-persistence.ts";
-      export { applyLayoutOrDefault } from "./src/parts/layout/layout-boot.ts";
-      export { closeActiveEditor } from "./src/parts/layout/panel-close.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { MenuId, Menus } from "@workshop/platform/menu-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { getService, registerService } from "@workshop/platform/service-registry";
-      export { LAYOUT_POLICY } from "./src/services/layout-policy.ts";
-      export { ZONE_STATE } from "./src/services/zone-state-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-globalThis.fetch = async (url) => {
-  throw new Error(`unexpected fetch in the layout-open-registry test: ${url}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "Window",
-  "HTMLElement",
-  "Node",
-  "Element",
-  "MutationObserver",
-  "ResizeObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "layout-open-registry-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  registerPanelType,
-  registerPanelFactory,
-  isPanelType,
-  panelTypeEntry,
-  resolvePanelContent,
-  WorkshopPart,
-  initZones,
-  openInZone,
-  panelIdFor,
-  resetZones,
-  setZoneOverride,
-  zoneOfPanel,
-  createPanelComponent,
-  createPanelTabComponent,
-  PANEL_TAB,
-  restoreLayout,
-  buildLayoutEnvelope,
-  applyLayoutOrDefault,
-  closeActiveEditor,
-  Commands,
-  MenuId,
-  Menus,
-  CONTEXT_KEY_SERVICE,
-  getService,
-  registerService,
-  LAYOUT_POLICY,
-  ZONE_STATE,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-function createDock(element) {
-  element.className = "ws-dock";
-  window.document.body.appendChild(element);
-  return createDockview(element, {
-    createComponent: createPanelComponent,
-    createTabComponent: createPanelTabComponent,
-    defaultTabComponent: PANEL_TAB,
-    theme: themeDark,
-    disableFloatingGroups: true,
-    hideBorders: true,
-    locked: false,
-    noPanelsOverlay: "emptyGroup",
-  });
-}
-
-/** The probe content a panel element mounted, once its chunk resolved. */
-function probeContent(panel) {
-  return panel.view.content.element.querySelector(".probe-panel");
-}
-
-// --- The core knows no panel type ---------------------------------------------
-
-check(
-  "the core declares no panel type of its own",
-  !["tree", "editor", "config", "agent", "run"].some((type) => isPanelType(type)),
-);
-
-// --- Synthetic types, registered the way a feature contribution does ---------
-
-// One lazy "feature directory" serving all three synthetic types.
-const probeFeature = {
-  register() {
-    for (const type of ["probe", "custom", "pinned"]) {
-      registerPanelFactory(type, () => ({
-        element: Object.assign(window.document.createElement("div"), { className: "probe-panel" }),
-        init(parameters) {
-          this.element.dataset.type = type;
-          this.element.dataset.params = JSON.stringify(parameters.params);
-        },
-      }));
-    }
-  },
-};
-const load = () => Promise.resolve(probeFeature);
-
-registerPanelType({ type: "probe", title: "Probe", defaultZone: "right", load });
-registerPanelType({
-  type: "custom",
-  title: (params) => `Custom ${params.name}`,
-  defaultZone: "main",
-  panelId: (params) => `custom:${params.name}`,
-  load,
-});
-registerPanelType({ type: "pinned", title: "Pinned", defaultZone: "left", closable: false, load });
-
-check("a registered synthetic type narrows", isPanelType("probe") && isPanelType("custom"));
-
-let duplicateThrew = false;
-try {
-  registerPanelType({ type: "probe", title: "Probe again", defaultZone: "main", load });
-} catch {
-  duplicateThrew = true;
-}
-check("registering a duplicate type throws", duplicateThrew);
-check("the duplicate left the first registration in place", panelTypeEntry("probe")?.title === "Probe");
-
-// --- The identity rule ---------------------------------------------------------
-
-check("a type without panelId or instance is a singleton id", panelIdFor("probe", {}) === "probe");
-check("a string instance keys the id as type:instance", panelIdFor("probe", { instance: "a" }) === "probe:a");
-check("a non-string instance is ignored", panelIdFor("probe", { instance: 7 }) === "probe");
-check(
-  "a custom panelId wins over the instance rule",
-  panelIdFor("custom", { name: "x", instance: "ignored" }) === "custom:x",
-);
-
-// --- Opening, instance keying, titles, zones -----------------------------------
-
-const dock = createDock(window.document.getElementById("dock"));
-initZones(dock);
-resetZones();
-
-const single = openInZone("probe", {});
-const first = openInZone("probe", { instance: "a" });
-const second = openInZone("probe", { instance: "b" });
-const custom = openInZone("custom", { name: "x" });
-const pinned = openInZone("pinned", {});
-await flush();
-
-check("the singleton probe opens under its bare type id", single.id === "probe");
-check("instances open side by side", first.id === "probe:a" && second.id === "probe:b" && first !== second);
-check(
-  "every probe opens in its default zone",
-  [single, first, second].every((panel) => zoneOfPanel(panel) === "right"),
-);
-check("a static title becomes the tab title", single.title === "Probe" && first.title === "Probe");
-check("a custom panelId names the panel", custom.id === "custom:x");
-check("a title function receives the params", custom.title === "Custom x");
-check("the custom type opens in its default zone", zoneOfPanel(custom) === "main");
-check("a closable: false type opens in its default zone", zoneOfPanel(pinned) === "left");
-check("the closable flag is kept on the entry", panelTypeEntry("pinned")?.closable === false);
-check("the lazy chunk mounts each panel's content", [single, first, second, custom, pinned].every(probeContent));
-check(
-  "the dockview params reach the panel",
-  probeContent(first)?.dataset.params === JSON.stringify({ instance: "a" }),
-);
-check(
-  "reopening an open instance reveals it instead of duplicating",
-  openInZone("probe", { instance: "a" }) === first && dock.panels.length === 5,
-);
-
-// --- The generic tab: closable variants get an X and a menu ---------------------
-
-// The core's own tab-menu rows are Close and Close Others, from the
-// layout contribution; the test places one more the way a feature
-// contribution does.
-Commands.register("test.tabRow", { title: "Tab Row", run() {} });
-Menus.appendMenuItem(MenuId.EditorTitleContext, { command: "test.tabRow" });
-const TAB_MENU_ROWS = ["test.tabRow", "workbench.action.closeActiveEditor", "workbench.action.closeOtherEditors"].join("|");
-
-const closeButtonOf = (panel) => panel.view.tab.element.querySelector(".dv-default-tab-action");
-/** The shown tab menu's row keys after a right-click on the panel's tab, or null when none opened. */
-function tabMenuRows(panel) {
-  panel.view.tab.element.dispatchEvent(
-    new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: 10, clientY: 10 }),
-  );
-  const shown = [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter(
-    (popover) => !popover.hidden,
-  );
-  window.document.body.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true }));
-  if (shown.length === 0) {
-    return null;
-  }
-  return shown.flatMap((popover) =>
-    [...popover.querySelectorAll(".ws-window-titlebar__item")].map((row) => row.dataset.menuRowKey),
-  );
-}
-
-for (const [name, panel] of [
-  ["the singleton probe", single],
-  ["a probe instance", first],
-  ["the custom type", custom],
-]) {
-  check(`${name} shows a close button`, closeButtonOf(panel)?.getAttribute("aria-label") === "Close");
-  check(`${name} opens the tab menu on right-click`, tabMenuRows(panel)?.join("|") === TAB_MENU_ROWS);
-}
-check("the closable: false variant shows no close button", closeButtonOf(pinned) === null);
-check("the closable: false variant opens no tab menu", tabMenuRows(pinned) === null);
-
-// --- Windows ids split at the first colon ---------------------------------------
-
-const windowsId = panelIdFor("custom", { name: "C:\\dir\\f.txt" });
-setZoneOverride(windowsId, "left");
-check("a moved panel records its override", getService(ZONE_STATE).overrideFor(windowsId) === "left");
-setZoneOverride(windowsId, "main");
-check(
-  "an id holding a drive colon resolves its type, so moving home clears the override",
-  getService(ZONE_STATE).overrideFor(windowsId) === undefined,
-);
-
-// --- Save, then restore on a fresh dock ------------------------------------------
-
-const envelope = JSON.parse(JSON.stringify(buildLayoutEnvelope(dock)));
-const relaunched = createDock(window.document.createElement("div"));
-initZones(relaunched);
-check("the saved layout restores", restoreLayout(relaunched, envelope) === true);
-relaunched.layout(1200, 800);
-await flush();
-
-const restoredIds = relaunched.panels.map((panel) => panel.id).sort();
-check(
-  "every panel comes back under its id",
-  JSON.stringify(restoredIds) === JSON.stringify(["custom:x", "pinned", "probe", "probe:a", "probe:b"]),
-);
-check("the restored title-function title holds", relaunched.getPanel("custom:x")?.title === "Custom x");
-check(
-  "the restored instance keeps its params",
-  probeContent(relaunched.getPanel("probe:b"))?.dataset.params === JSON.stringify({ instance: "b" }),
-);
-check(
-  "restored panels return to their zones",
-  zoneOfPanel(relaunched.getPanel("probe:a")) === "right" &&
-    zoneOfPanel(relaunched.getPanel("custom:x")) === "main" &&
-    zoneOfPanel(relaunched.getPanel("pinned")) === "left",
-);
-check(
-  "restored tabs keep the closable rule",
-  closeButtonOf(relaunched.getPanel("probe:a")) !== null && closeButtonOf(relaunched.getPanel("pinned")) === null,
-);
-
-// --- A registered layout policy the core never names ----------------------------
-
-// The default layout and its anchors are product policy: the composition
-// root registers them, and the layout core applies whatever is
-// registered. This policy has the product's shape over the synthetic
-// types - a non-closable left anchor and a right anchor - and counts its
-// seeds so a default layout is told apart from a restore.
-let seeds = 0;
-registerService(LAYOUT_POLICY, () => ({
-  anchors: ["pinned", "probe"],
-  seed: () => {
-    seeds += 1;
-    openInZone("pinned", {});
-    openInZone("probe", {});
-  },
-}));
-
-const seeded = createDock(window.document.createElement("div"));
-initZones(seeded);
-applyLayoutOrDefault(seeded, null);
-await flush();
-check("a null apply seeds the registered policy once", seeds === 1);
-check(
-  "the seeded anchors open in their zones",
-  zoneOfPanel(seeded.getPanel("pinned")) === "left" && zoneOfPanel(seeded.getPanel("probe")) === "right",
-);
-
-// A layout saved after the right anchor closed away restores, and the
-// anchor re-opens into the zone's surviving group.
-seeded.removePanel(seeded.getPanel("probe"));
-const lostAnchor = JSON.parse(JSON.stringify(buildLayoutEnvelope(seeded)));
-const restored = createDock(window.document.createElement("div"));
-initZones(restored);
-applyLayoutOrDefault(restored, lostAnchor);
-await flush();
-check("a restore never seeds the policy", seeds === 1);
-check(
-  "a restored layout that lost an anchor gets it back in its zone",
-  zoneOfPanel(restored.getPanel("probe")) === "right" && restored.panels.length === 2,
-);
-
-// The Secondary Side Bar toggle on a dock whose right zone was never
-// built opens the policy's right-zone anchors, and only those.
-const bare = createDock(window.document.createElement("div"));
-initZones(bare);
-resetZones();
-openInZone("custom", { name: "doc" });
-const contextKeys = getService(CONTEXT_KEY_SERVICE);
-await Commands.execute("workbench.action.toggleAuxiliaryBar");
-await flush();
-check(
-  "the side bar toggle opens the policy's right anchor when the right zone was never built",
-  zoneOfPanel(bare.getPanel("probe")) === "right" && contextKeys.getValue("auxiliaryBarVisible") === true,
-);
-check("the side bar toggle opens no anchor outside the right zone", bare.getPanel("pinned") === undefined);
-await Commands.execute("workbench.action.toggleAuxiliaryBar");
-check(
-  "the next toggle hides the right anchor's group",
-  bare.getPanel("probe")?.group.api.isVisible === false && contextKeys.getValue("auxiliaryBarVisible") === false,
-);
-
-// --- Closing through the layout core ----------------------------------------------
-
-// The bundle holds no editor contribution, so every close below runs the
-// layout core's own path.
-const closing = createDock(window.document.createElement("div"));
-initZones(closing);
-resetZones();
-
-const xProbe = openInZone("probe", { instance: "x" });
-const keyProbe = openInZone("probe", { instance: "delete" });
-await flush();
-closeButtonOf(xProbe)?.click();
-await flush();
-check("a closable probe tab's X closes its panel", closing.getPanel(xProbe.id) === undefined);
-const keyWrapper = keyProbe.view.tab.element.parentElement;
-keyWrapper?.focus();
-keyWrapper?.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Delete", bubbles: true, cancelable: true }));
-await flush();
-check("Delete on a focused probe tab closes its panel", closing.getPanel(keyProbe.id) === undefined);
-
-// A part that is not an editor, with a settable dirty flag and a
-// scriptable confirmClose(), so Close Others' re-check reads isDirty().
-class DirtyProbePart extends WorkshopPart {
-  dirty = false;
-  confirms = 0;
-  onConfirm = () => true;
-  create() {}
-  isDirty() {
-    return this.dirty;
-  }
-  confirmClose() {
-    this.confirms += 1;
-    return Promise.resolve(this.onConfirm());
-  }
-}
-const dirtyFeature = {
-  register() {
-    registerPanelFactory("dirty", () => new DirtyProbePart());
-  },
-};
-registerPanelType({ type: "dirty", title: "Dirty", defaultZone: "main", load: () => Promise.resolve(dirtyFeature) });
-
-const target = openInZone("custom", { name: "target" });
-const cleanFirst = openInZone("dirty", { instance: "first" });
-const dirtiesFirst = openInZone("dirty", { instance: "second" });
-await flush();
-const firstPart = resolvePanelContent(cleanFirst.view.content);
-const secondPart = resolvePanelContent(dirtiesFirst.view.content);
-secondPart.onConfirm = () => {
-  firstPart.dirty = true;
-  return true;
-};
-const batch = [target, cleanFirst, dirtiesFirst];
-const sameGroup = batch.every((panel) => panel.group === target.group);
-const ran = await Commands.execute("workbench.action.closeOtherEditors", { panelId: target.id });
-await flush();
-check(
-  "Close Others asks each probe and keeps the group open when one confirmed clean turns dirty",
-  sameGroup &&
-    ran === true &&
-    firstPart.confirms === 1 &&
-    secondPart.confirms === 1 &&
-    batch.every((panel) => closing.getPanel(panel.id) === panel),
-);
-
-// closeActiveEditor resolves true only when it closed the panel.
-secondPart.onConfirm = () => false;
-check(
-  "closeActiveEditor resolves false when the part refuses, leaving the panel open",
-  (await closeActiveEditor({ panelId: dirtiesFirst.id })) === false && closing.getPanel(dirtiesFirst.id) === dirtiesFirst,
-);
-const closingPinned = openInZone("pinned", {});
-await flush();
-check(
-  "closeActiveEditor resolves false for a closable: false panel, leaving it open",
-  (await closeActiveEditor({ panelId: closingPinned.id })) === false && closing.getPanel(closingPinned.id) === closingPinned,
-);
-check(
-  "closeActiveEditor resolves false for a panelId naming no open panel",
-  (await closeActiveEditor({ panelId: "probe:never-opened" })) === false,
-);
-check(
-  "closeActiveEditor resolves true when the part confirms and the panel closes",
-  (await closeActiveEditor({ panelId: cleanFirst.id })) === true && closing.getPanel(cleanFirst.id) === undefined,
-);
-
-if (failures.length > 0) {
-  console.error(`layout-open-registry: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("layout-open-registry: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/layout-policy-boot.mjs b/crates/workshop/ui/test/layout-policy-boot.mjs
deleted file mode 100644
index 336af1f2b..000000000
--- a/crates/workshop/ui/test/layout-policy-boot.mjs
+++ /dev/null
@@ -1,110 +0,0 @@
-// The product's layout policy on the booted workbench (src/main.ts): with
-// no stored layout, the dock takes #dock's size before the boot apply, and
-// the policy the composition root registers seeds the Workshop tree into
-// the left zone at min(300px, W/4) (never under 214px) and the agent
-// session into the right zone at min(400px, W/4) (never under 300px), with
-// an empty editor group between them from the first paint - the watermark's
-// home. The dock draws Cursor's 1px borders between its parts.
-// test/workshop-layout.mjs and test/layout-open-registry.mjs pin the boot
-// decision against test policies; this proves the policy main.ts registers,
-// the dock options it passes, and the boot sizing it relies on. It also
-// closes the tree and grants a folder, to prove the watermark's "Add Folder"
-// row follows a workspace change with no tree panel alive.
-// Run: node test/layout-policy-boot.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench(
-  "the booted default layout puts the tree left, an empty editor group in the middle, and the agent right",
-  async ({ document, window, resolveService, sleep, failures }) => {
-    const dock = resolveService("workshop.dock");
-    const zones = resolveService("workshop.zoneState");
-    const tree = dock.getPanel("tree");
-    const agent = dock.getPanel("agent");
-    if (!tree || !agent) {
-      failures.push("the default layout opened no tree or no agent panel");
-      return;
-    }
-    const treeZone = zones.zoneForGroupId(tree.group.id);
-    const agentZone = zones.zoneForGroupId(agent.group.id);
-    if (treeZone !== "left" || agentZone !== "right") {
-      failures.push(`the tree opened in ${treeZone} and the agent in ${agentZone}, expected left and right`);
-    }
-    // A 1200px dock: a quarter is 300px, which is the tree's preferred width
-    // (min(300, 300)) and the agent's floor (max(300, min(400, 300))).
-    if (tree.group.api.width !== 300) {
-      failures.push(`the tree's group is ${tree.group.api.width}px wide, expected 300`);
-    }
-    if (agent.group.api.width !== 300) {
-      failures.push(`the agent's group is ${agent.group.api.width}px wide, expected 300`);
-    }
-    if (dock.groups.length !== 3) {
-      failures.push(`the default layout built ${dock.groups.length} groups, expected 3 with main empty`);
-    }
-    const mainId = zones.groupFor("main");
-    const main = mainId === undefined ? undefined : dock.getGroup(mainId);
-    if (main === undefined) {
-      failures.push("the default layout has no main-zone group");
-      return;
-    }
-    if (main.panels.length !== 0) {
-      failures.push(`the main group holds ${main.panels.length} panels at startup, expected none`);
-    }
-    if (main.element.dataset.wsEmpty !== "true") {
-      failures.push("the empty main group is not marked empty");
-    }
-    if (main.element.dataset.wsActiveGroup !== "true") {
-      failures.push("the empty main group is not the Workshop's active group at startup");
-    }
-    if (main.api.width !== 600) {
-      failures.push(`the empty main group is ${main.api.width}px wide, expected the 600px between the sides`);
-    }
-
-    // The watermark fills the empty group and only that group.
-    const watermark = main.element.querySelector(".ws-watermark");
-    if (watermark === null) {
-      failures.push("the empty main group shows no watermark");
-    } else {
-      const labels = [...watermark.querySelectorAll(".ws-watermark__label")].map((label) => label.textContent);
-      // The boot's roots listing is empty, so no Add Folder row.
-      if (labels.join("|") !== "New Agent|Show Files|Search Files") {
-        failures.push(`the watermark rows read ${labels.join("|")}, expected New Agent|Show Files|Search Files`);
-      }
-    }
-
-    // hideBorders: false gives the split view Dockview's separator-border class.
-    if (document.querySelector("#dock .dv-split-view-container.dv-separator-border") === null) {
-      failures.push("the dock's split view carries no separator border");
-    }
-
-    // The watermark is on screen when Explorer is closed, and then no tree panel is
-    // alive to drop the shared roots listing. Granting a folder must still reach it:
-    // the composition root has the tree-state service follow the workspace-changed
-    // event, so the listing is dropped and the "Add Folder" row (one root) appears.
-    dock.removePanel(tree);
-    await sleep(50);
-    const bootFetch = globalThis.fetch;
-    const grantedRoot = { name: "project", path: "C:\\project", kind: "directory", size: 0, modified_ms: 1, exists: true };
-    globalThis.fetch = (url, init) =>
-      url === "/workspace/tree"
-        ? Promise.resolve(
-            new Response(JSON.stringify({ path: null, entries: [grantedRoot] }), {
-              status: 200,
-              headers: { "content-type": "application/json" },
-            }),
-          )
-        : bootFetch(url, init);
-    try {
-      window.dispatchEvent(new window.CustomEvent("runvil:workspace-changed"));
-      await sleep(100);
-    } finally {
-      globalThis.fetch = bootFetch;
-    }
-    const labelsAfterGrant = [...main.element.querySelectorAll(".ws-watermark__label")].map((label) => label.textContent);
-    if (labelsAfterGrant.join("|") !== "New Agent|Show Files|Search Files|Add Folder") {
-      failures.push(
-        `with no tree panel open, granting a folder left the watermark rows at ${labelsAfterGrant.join("|")}, expected Add Folder to appear`,
-      );
-    }
-  },
-  { dockSize: { width: 1200, height: 800 } },
-);
diff --git a/crates/workshop/ui/test/lazy-css-entry-bundle.mjs b/crates/workshop/ui/test/lazy-css-entry-bundle.mjs
deleted file mode 100644
index 1baa572bb..000000000
--- a/crates/workshop/ui/test/lazy-css-entry-bundle.mjs
+++ /dev/null
@@ -1,72 +0,0 @@
-// Lazy-CSS entry-bundle contract. The entry bundle is the eagerly loaded
-// composition: `crates/workshop/ui/src/main.ts` and the
-// `*.contribution.ts` modules it imports. Lazy panels never import a
-// module inside it, directly or through another import. Everything else
-// that eager and lazy code both import, such as `@workshop/platform`,
-// `services/`, `base/`, and shared parts modules like
-// `parts/layout/zones.ts`, is shared code.
-// The lazy feature directories (one marker below per directory) import
-// their stylesheets beside their TypeScript, and esbuild hoists CSS
-// reachable through dynamic imports into the entry's app-*.css - no
-// eager re-import in main.ts is needed or wanted.
-// This test builds for real and asserts over the build output: the entry
-// stylesheet must include one marker class per lazy directory, so a future
-// esbuild behavior change (or an accidental import-graph cut) that drops
-// a lazy directory's CSS fails here instead of shipping unstyled panels.
-// The build goes to a scratch directory through build.mjs --out: the
-// node --test runner executes the suite in parallel, and rebuilding dist/
-// here would race the boot tests reading it.
-// Run: node test/lazy-css-entry-bundle.mjs
-import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { spawnSync } from "node:child_process";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-const outDir = await mkdtemp(path.join(os.tmpdir(), "workshop-lazy-css-"));
-
-try {
-  const build = spawnSync(process.execPath, ["build.mjs", "--out", outDir], {
-    cwd: uiDir,
-    encoding: "utf8",
-  });
-  if (build.status !== 0) {
-    console.error(build.stdout);
-    console.error(build.stderr);
-    console.error(`lazy-css-entry-bundle: the build failed (status ${build.status})`);
-    process.exit(1);
-  }
-
-  const manifest = JSON.parse(await readFile(path.join(outDir, "manifest.json"), "utf8"));
-  const css = await readFile(path.join(outDir, manifest["app.css"]), "utf8");
-
-  // One marker class per lazy feature directory: a class that only that
-  // directory's colocated stylesheet defines. The chat box is reached
-  // through the agent directory's lazy import; its mic rules (the former
-  // stt marker) live in chatbox/chat-box.css, and stt/stt.css defines no
-  // class of its own today.
-  const markers = {
-    agent: "ws-agent-session",
-    chatbox: "ws-stt-mic--recording",
-    editor: "ws-editor-panel",
-    gateway: "ws-gateway-config-panel",
-    run: "ws-run-panel",
-  };
-
-  const failures = [];
-  for (const [directory, marker] of Object.entries(markers)) {
-    if (!css.includes(`.${marker}`)) {
-      failures.push(`the entry stylesheet is missing .${marker} (the ${directory} directory's CSS)`);
-    }
-  }
-
-  if (failures.length > 0) {
-    console.error(`lazy-css-entry-bundle: ${failures.length} failure(s)`);
-    for (const failure of failures) console.error(`  - ${failure}`);
-    process.exit(1);
-  }
-  console.log("lazy-css-entry-bundle: all assertions passed");
-} finally {
-  await rm(outDir, { recursive: true, force: true });
-}
diff --git a/crates/workshop/ui/test/lazy-panel-sizing.mjs b/crates/workshop/ui/test/lazy-panel-sizing.mjs
deleted file mode 100644
index 447f8cdac..000000000
--- a/crates/workshop/ui/test/lazy-panel-sizing.mjs
+++ /dev/null
@@ -1,358 +0,0 @@
-// Regression test for the lazy panel placeholder's sizing contract
-// (src/parts/layout/panel-types.ts LazyPanel, .ws-panel-lazy in
-// src/parts/layout/zones.css, and the agent session's feed/input split in
-// src/parts/agent/agent-session.css). Dockview mounts the LazyPanel element
-// as the content of a leaf; the real panel swaps in underneath it. Every
-// panel root sizes itself with `height: 100%`, so the placeholder between it
-// and dockview's content container must pass the container's height
-// through - otherwise the agent feed grows with its transcript instead of
-// scrolling, pushes the prompt input below the window, and softlocks the
-// panel. jsdom has no layout engine, so the test pins the structural
-// contract: the declared styles the cascade assigns to the placeholder, the
-// panel root, and the feed; the feed-then-input DOM order; the autoscroll
-// landing on the feed element when a message appends; and LazyPanel
-// forwarding dockview's layout(width, height) to the real panel.
-// Bundles the modules with esbuild, mounts a real Dockview dock in jsdom
-// against the real index.html with the two component stylesheets
-// installed as a <style>, and opens the agent session through the zone
-// API exactly as main.ts does.
-// Run: node test/lazy-panel-sizing.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-const uiDir = path.join(testDir, "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import { registerPanelType, registerPanelFactory } from "@workshop/platform/panel-registry";
-      // A synthetic lazy panel kind whose factory the test supplies through
-      // a global, so the test observes the real panel's layout() calls
-      // from outside the bundle.
-      registerPanelType({
-        type: "sized",
-        defaultZone: "main",
-        title: "Sized",
-        load: () =>
-          Promise.resolve({
-            register() {
-              return registerPanelFactory("sized", () => globalThis.__makeSizedPanel());
-            },
-          }),
-      });
-      // The agent panel type registers from its contribution.
-      import "./src/parts/agent/agent.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export { initZones, openInZone } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent } from "./src/parts/layout/panel-types.ts";
-    `,
-    resolveDir: uiDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules import their colocated CSS as a side effect; strip it
-  // from the bundle. The two sheets under test are installed into the
-  // document below, where jsdom's cascade can assign their declarations.
-  loader: { ".css": "empty" },
-});
-
-const html = await readFile(path.join(uiDir, "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-// The sheets whose declarations size the placeholder, the panel root, and the
-// feed. jsdom resolves declared values through the cascade (it applies
-// no layout), so the assertions read the declared contract, not pixels.
-const style = window.document.createElement("style");
-style.textContent = [
-  await readFile(path.join(uiDir, "src", "parts", "layout", "zones.css"), "utf8"),
-  await readFile(path.join(uiDir, "src", "parts", "agent", "agent-session.css"), "utf8"),
-].join("\n");
-window.document.head.appendChild(style);
-
-// The same layout stubs the other dock tests install: jsdom has no layout.
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-// The transcript's feed scroll watches its content column for growth; the
-// test keeps that observer's callback to play the browser's resize report.
-const feedGrowth = [];
-window.ResizeObserver = class {
-  constructor(callback) {
-    this.callback = callback;
-  }
-  observe(target) {
-    if (target?.classList?.contains("ws-transcript")) feedGrowth.push(this.callback);
-  }
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-window.Range.prototype.getClientRects = () => [];
-window.Range.prototype.getBoundingClientRect = () => new window.DOMRect();
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "Window",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The agent panel probes STT capability on mount and the tree lists its
-// roots; the probe may fail (the mic stays gated), the roots come back
-// empty, and anything else is a regression.
-globalThis.fetch = (url) => {
-  if (url === "/workspace/tree") {
-    return Promise.resolve(
-      new Response(JSON.stringify({ path: null, entries: [] }), {
-        status: 200,
-        headers: { "content-type": "application/json" },
-      }),
-    );
-  }
-  return Promise.reject(new Error(`unexpected fetch in the lazy-panel-sizing test: ${url}`));
-};
-
-// A scripted WebSocket for the agent panel's /agents/ws connection: it
-// opens on a timer and the test pushes server frames through onmessage.
-const sockets = [];
-class FakeWebSocket {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  constructor(url) {
-    this.url = url;
-    this.readyState = FakeWebSocket.CONNECTING;
-    this.sent = [];
-    sockets.push(this);
-    setTimeout(() => {
-      this.readyState = FakeWebSocket.OPEN;
-      this.onopen?.();
-    }, 0);
-  }
-  addEventListener(type, listener) {
-    this[`on${type}`] = listener;
-  }
-  send(data) {
-    this.sent.push(data);
-  }
-  close() {
-    this.readyState = FakeWebSocket.CLOSED;
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-const bundlePath = path.join(os.tmpdir(), "lazy-panel-sizing-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { createDockview, themeDark, initZones, openInZone, createPanelComponent, createPanelTabComponent } =
-  await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 10; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const computed = (element) => window.getComputedStyle(element);
-
-// --- The agent session mounts through the lazy placeholder into the dock ----------
-
-const dock = createDockview(window.document.getElementById("dock"), {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-openInZone("agent", {});
-await flush();
-
-const panelRoot = window.document.querySelector("#dock .ws-agent-panel");
-check("the agent panel mounted into the dock", panelRoot !== null);
-const placeholder = panelRoot?.parentElement ?? null;
-check("the agent panel mounts inside the lazy placeholder", placeholder?.classList.contains("ws-panel-lazy") === true);
-check(
-  "the lazy placeholder is a direct child of dockview's content container",
-  placeholder?.parentElement?.classList.contains("dv-content-container") === true,
-);
-
-// The sizing chain: the placeholder hands the container's height through, the
-// panel root fills the placeholder, the feed is the flexible scroll region.
-if (placeholder !== null) {
-  const placeholderStyle = computed(placeholder);
-  check("the lazy placeholder is full height", placeholderStyle.height === "100%");
-  check(
-    "the lazy placeholder is a flex column",
-    placeholderStyle.display === "flex" && placeholderStyle.flexDirection === "column",
-  );
-  check("the lazy placeholder may shrink below its content", placeholderStyle.minHeight === "0px");
-}
-if (panelRoot !== null) {
-  const rootStyle = computed(panelRoot);
-  check("the agent panel root is full height", rootStyle.height === "100%");
-  check(
-    "the agent panel root is a flex column",
-    rootStyle.display === "flex" && rootStyle.flexDirection === "column",
-  );
-}
-
-const session = panelRoot?.querySelector(".ws-agent-session") ?? null;
-const feed = session?.querySelector(".ws-agent-session__feed") ?? null;
-const outer = session?.querySelector(".ws-agent-session__outer") ?? null;
-check("the session view holds a feed and an input affordance", feed !== null && outer !== null);
-if (session !== null && feed !== null && outer !== null) {
-  const sessionStyle = computed(session);
-  check(
-    "the session view is a flex column that fills the panel",
-    sessionStyle.display === "flex" &&
-      sessionStyle.flexDirection === "column" &&
-      sessionStyle.flexGrow === "1" &&
-      sessionStyle.minHeight === "0px",
-  );
-  const feedStyle = computed(feed);
-  check(
-    "the feed is the flexible region",
-    feedStyle.flexGrow === "1" && feedStyle.minHeight === "0px",
-  );
-  check("the feed is the scroll container", feedStyle.overflowY === "auto");
-  check("the input affordance does not flex", computed(outer).flexGrow === "0");
-  check(
-    "the input affordance follows the feed",
-    feed.parentElement === session &&
-      outer.parentElement === session &&
-      feed.compareDocumentPosition(outer) & window.Node.DOCUMENT_POSITION_FOLLOWING,
-  );
-}
-
-// --- Appending a message autoscrolls the feed element -------------------------
-
-if (feed !== null) {
-  // jsdom reports every scroll metric as 0; a scripted scrollHeight and a
-  // spied scrollTop setter pin which element the view scrolls, and to what.
-  const scrollTops = [];
-  Object.defineProperty(feed, "scrollHeight", { configurable: true, get: () => 4321 });
-  Object.defineProperty(feed, "scrollTop", {
-    configurable: true,
-    get: () => scrollTops.at(-1) ?? 0,
-    set: (value) => scrollTops.push(value),
-  });
-
-  const agentsSocket = sockets.find((socket) => socket.url.endsWith("/agents/ws"));
-  check("the agent panel opened its session socket", agentsSocket !== undefined);
-  await flush();
-  const push = (frame) => agentsSocket?.onmessage?.({ data: JSON.stringify(frame) });
-  push({ type: "agents", agents: ["chat"] });
-  push({ type: "agent_session", session: "s1", agent: "chat" });
-  push({
-    type: "agent_event",
-    index: 0,
-    event: { kind: "user_message", section: "chat", turn: 0, content: "hello" },
-  });
-  await flush();
-
-  check("the message painted a human row in the feed", feed.querySelectorAll(".ws-human-message").length === 1);
-  check("the feed's scroll watches the transcript column", feedGrowth.length >= 1);
-  // The column grew; the pinned feed follows it to the bottom.
-  for (const callback of feedGrowth) callback([]);
-  check(
-    "appending a message scrolls the feed to its bottom",
-    scrollTops.length > 0 && scrollTops.at(-1) === 4321,
-  );
-}
-
-// --- LazyPanel forwards layout() to the real panel -----------------------------
-
-const layouts = [];
-globalThis.__makeSizedPanel = () => ({
-  element: Object.assign(window.document.createElement("div"), { className: "sized-panel" }),
-  init() {},
-  layout(width, height) {
-    layouts.push([width, height]);
-  },
-  dispose() {},
-});
-
-const lazy = createPanelComponent({ id: "sized", name: "sized" });
-check("the lazy placeholder has its sizing class", lazy.element.className === "ws-panel-lazy");
-check("the lazy placeholder implements layout", typeof lazy.layout === "function");
-// A resize before the chunk resolves replays at the swap.
-lazy.layout?.(640, 480);
-lazy.init({ params: {}, api: {} });
-await flush();
-check("the real panel swapped in", lazy.element.querySelector(".sized-panel") !== null);
-check(
-  "a layout before the swap reaches the real panel at the swap",
-  layouts.length === 1 && layouts[0][0] === 640 && layouts[0][1] === 480,
-);
-lazy.layout?.(800, 600);
-check(
-  "a layout after the swap forwards to the real panel",
-  layouts.length === 2 && layouts[1][0] === 800 && layouts[1][1] === 600,
-);
-lazy.dispose();
-
-if (failures.length > 0) {
-  console.error(`lazy-panel-sizing: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("lazy-panel-sizing: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/leak-check.mjs b/crates/workshop/ui/test/leak-check.mjs
deleted file mode 100644
index fb1255f42..000000000
--- a/crates/workshop/ui/test/leak-check.mjs
+++ /dev/null
@@ -1,146 +0,0 @@
-// Covering test for the shared leak-check helper
-// (test/helpers/leak-check.mjs). Bundles `@workshop/platform/lifecycle` with
-// esbuild and imports it via a data URL, then drives assertNoLeaks
-// through both verdicts. Covers: a clean sync run passes, a clean async
-// run through a Disposable subclass passes, a leaking run throws with
-// the leak count and the construction site named (bare store and
-// Disposable subclass), the run's own error propagates, and a store
-// created between runs is not attributed to a later run.
-// Run: node test/leak-check.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-async function loadModule(specifier) {
-  const bundle = await esbuild.build({
-    stdin: {
-      contents: `export * from "${specifier}";`,
-      resolveDir: path.join(uiDir, ".."),
-      loader: "ts",
-    },
-    bundle: true,
-    write: false,
-    format: "esm",
-    platform: "browser",
-    target: "es2022",
-    logLevel: "silent",
-  });
-  const code = bundle.outputFiles[0].text;
-  return import(`data:text/javascript;base64,${Buffer.from(code).toString("base64")}`);
-}
-
-const lifecycle = await loadModule("@workshop/platform/lifecycle");
-const { Disposable, DisposableStore } = lifecycle;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Clean runs pass ----------------------------------------------------------
-
-{
-  let error = null;
-  try {
-    await assertNoLeaks(lifecycle, () => {
-      const store = new DisposableStore();
-      store.add({ dispose() {} });
-      store.dispose();
-    });
-  } catch (caught) {
-    error = caught;
-  }
-  check("a clean sync run passes", error === null);
-}
-
-{
-  class CleanComponent extends Disposable {}
-  let error = null;
-  try {
-    await assertNoLeaks(lifecycle, async () => {
-      const component = new CleanComponent();
-      await Promise.resolve();
-      component.dispose();
-    });
-  } catch (caught) {
-    error = caught;
-  }
-  check("a clean async run through a Disposable subclass passes", error === null);
-}
-
-// --- Leaking runs fail, naming the construction site ---------------------------
-
-{
-  function leakyComponent() {
-    new DisposableStore(); // never disposed
-  }
-  let error = null;
-  try {
-    await assertNoLeaks(lifecycle, () => {
-      leakyComponent();
-    });
-  } catch (caught) {
-    error = caught;
-  }
-  check("a leaking run throws", error instanceof Error);
-  check(
-    "the failure counts the leaked stores",
-    error !== null && error.message.includes("1 DisposableStore(s) leaked"),
-  );
-  check(
-    "the failure names the construction site",
-    error !== null && error.message.includes("leakyComponent"),
-  );
-}
-
-{
-  class LeakyPanel extends Disposable {}
-  let error = null;
-  try {
-    await assertNoLeaks(lifecycle, () => {
-      new LeakyPanel();
-    });
-  } catch (caught) {
-    error = caught;
-  }
-  check("a leaked Disposable subclass is caught", error instanceof Error);
-  check(
-    "the subclass leak is named by its class",
-    error !== null && error.message.includes("LeakyPanel"),
-  );
-}
-
-// --- The run's own error propagates and the tracker is uninstalled -------------
-
-{
-  let error = null;
-  try {
-    await assertNoLeaks(lifecycle, () => {
-      throw new Error("boom");
-    });
-  } catch (caught) {
-    error = caught;
-  }
-  check("the run's own error propagates", error !== null && error.message === "boom");
-
-  // A store created between runs must not be attributed to a later run.
-  const stray = new DisposableStore();
-  let secondError = null;
-  try {
-    await assertNoLeaks(lifecycle, () => {});
-  } catch (caught) {
-    secondError = caught;
-  }
-  check("a run after a throwing run starts clean", secondError === null);
-  stray.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`leak-check: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("leak-check: all assertions passed");
diff --git a/crates/workshop/ui/test/led-error-after-thinking.mjs b/crates/workshop/ui/test/led-error-after-thinking.mjs
deleted file mode 100644
index c3bb29bab..000000000
--- a/crates/workshop/ui/test/led-error-after-thinking.mjs
+++ /dev/null
@@ -1,41 +0,0 @@
-// The live "upstream connect error" repro: a Thinking status frame sustains
-// the amber LED past its pulse window (the decay re-adds the sustained
-// state and clears the timer), then an error frame with general activity
-// arrives with no pulse pending. The error frame must return the LED to
-// idle instead of orphaning the amber glow indefinitely.
-// The pulse window defaults to 250ms here (jsdom loads no stylesheet), so
-// 400ms of silence guarantees the window has expired.
-// Run: node test/led-error-after-thinking.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench(
-  "an error frame after the pulse window returns the LED to idle",
-  async ({ emitStatus, ledEl, sleep, failures }) => {
-    const ledLit = () =>
-      ledEl.classList.contains("status-bar__led--green") ||
-      ledEl.classList.contains("status-bar__led--amber");
-
-    // Let any pulse from boot-time frames decay before starting the repro.
-    await sleep(400);
-    if (ledLit()) failures.push("the LED did not start idle after the pulse window");
-    emitStatus({ label: "Thinking", severity: "info", activity: "thinking" });
-    if (!ledEl.classList.contains("status-bar__led--amber")) {
-      failures.push("the thinking status frame did not light the LED amber");
-    }
-    // The pulse window expires; the decay re-adds the sustained thinking
-    // state and clears the timer, so the amber glow survives.
-    await sleep(400);
-    if (!ledEl.classList.contains("status-bar__led--amber")) {
-      failures.push("the sustained thinking state did not outlive the pulse window");
-    }
-    emitStatus({
-      label: "upstream connect error",
-      description: "the gateway rejected the completion",
-      severity: "error",
-      activity: "general",
-    });
-    if (ledLit()) failures.push("the error frame left the LED stuck amber");
-    await sleep(400);
-    if (ledLit()) failures.push("the LED re-lit after the error frame");
-  },
-);
diff --git a/crates/workshop/ui/test/markdown-render.mjs b/crates/workshop/ui/test/markdown-render.mjs
deleted file mode 100644
index 96bc35507..000000000
--- a/crates/workshop/ui/test/markdown-render.mjs
+++ /dev/null
@@ -1,515 +0,0 @@
-// The markdown renderer (src/parts/agent/markdown-render.ts) in jsdom: marked
-// output lands under a .ws-markdown-content root with the right elements for
-// headings, paragraphs, emphasis, links, lists, blockquotes, tables, and
-// images (including the =WxH dimension suffix); fenced code blocks get
-// Shiki's theme colors once markdownReady resolves; and model-authored
-// attacks - javascript: hrefs, <script> tags, inline event handlers -
-// are stripped by the DOMPurify pass inside renderMarkdown. highlightCode
-// is exercised directly for its plain-fallback paths. Run:
-// node test/markdown-render.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { mock } from "node:test";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { resolver, rulesOf, valueIn } from "./helpers/css-values.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { renderMarkdown, highlightCode, markdownReady, MarkdownStream, FADE_MS } from "./src/parts/agent/markdown-render.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// DOMPurify reads the global window at module load, so the jsdom globals
-// must exist before the bundle is imported.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-markdown-render-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { renderMarkdown, highlightCode, markdownReady, MarkdownStream, FADE_MS } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-// The clipboard the code blocks' copy buttons write to, recorded.
-const clipboard = [];
-Object.defineProperty(globalThis, "navigator", {
-  configurable: true,
-  value: {
-    clipboard: {
-      writeText: async (text) => {
-        clipboard.push(text);
-      },
-    },
-  },
-});
-
-// Highlighting is the async half of the contract; everything below runs
-// after readiness, so code blocks exercise the Shiki path.
-await markdownReady;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Renders text into a container element and returns the .ws-markdown-content root.
-function render(text, options) {
-  const container = document.createElement("div");
-  container.append(renderMarkdown(text, options));
-  return container.firstElementChild;
-}
-
-// --- Structure -----------------------------------------------------------
-
-{
-  const root = render("# Title\n\nA paragraph of prose.");
-  check("the rendered fragment's root has the ws-markdown-content class",
-    root?.classList.contains("ws-markdown-content"));
-  check("a level-1 heading renders as an h1 with its text",
-    root?.querySelector("h1")?.textContent === "Title");
-  check("a paragraph renders as a p with its text",
-    root?.querySelector("p")?.textContent === "A paragraph of prose.");
-}
-
-{
-  const root = render("Some **bold** and *italic* and `inline code`.");
-  check("double asterisks render as strong",
-    root?.querySelector("strong")?.textContent === "bold");
-  check("single asterisks render as em",
-    root?.querySelector("em")?.textContent === "italic");
-  check("backticks render as inline code",
-    root?.querySelector("p code")?.textContent === "inline code");
-}
-
-{
-  const root = render("- one\n- two\n- three");
-  const items = root?.querySelectorAll("ul li") ?? [];
-  check("a dash list renders as a ul with one li per item",
-    root?.querySelector("ul") !== null && items.length === 3);
-}
-
-{
-  const root = render("1. one\n2. two");
-  check("a numbered list renders as an ol",
-    root?.querySelectorAll("ol li").length === 2);
-}
-
-{
-  const root = render("> quoted words");
-  check("an angle bracket quote renders as a blockquote",
-    root?.querySelector("blockquote")?.textContent?.includes("quoted words") === true);
-}
-
-{
-  const root = render("| name | value |\n| ---- | ----- |\n| a | 1 |");
-  check("a pipe table renders as a table with a header cell",
-    root?.querySelector("table th")?.textContent === "name");
-  check("a pipe table renders its body cells",
-    root?.querySelector("table td")?.textContent === "a");
-}
-
-// --- Links and images ----------------------------------------------------
-
-{
-  const root = render("[label](https://example.test)");
-  const anchor = root?.querySelector("a");
-  check("a markdown link keeps its href",
-    anchor?.getAttribute("href") === "https://example.test");
-  check("a link without a title falls back to the href as its title",
-    anchor?.getAttribute("title") === "https://example.test");
-  check("a rendered link is not draggable",
-    anchor?.getAttribute("draggable") === "false");
-}
-
-{
-  const root = render('[label](https://example.test "Custom title")');
-  check("a link with a title keeps the given title",
-    root?.querySelector("a")?.getAttribute("title") === "Custom title");
-}
-
-{
-  const root = render("![alt text](<image.png =100x200>)");
-  const img = root?.querySelector("img");
-  check("an image with a dimension suffix drops the suffix from its src",
-    img?.getAttribute("src") === "image.png");
-  check("an image with a dimension suffix gains width and height attributes",
-    img?.getAttribute("width") === "100" && img?.getAttribute("height") === "200");
-  check("an image keeps its alt text",
-    img?.getAttribute("alt") === "alt text");
-}
-
-{
-  const root = render("![alt](image.png)");
-  const img = root?.querySelector("img");
-  check("an image without a dimension suffix keeps its src and gains no dimensions",
-    img?.getAttribute("src") === "image.png" && img?.getAttribute("width") === null);
-}
-
-{
-  const root = render("![alt](<image.png =100x>)");
-  const img = root?.querySelector("img");
-  check("an image with a width-only dimension suffix gains a width and no height",
-    img?.getAttribute("width") === "100" && img?.getAttribute("height") === null);
-}
-
-// --- Code blocks ---------------------------------------------------------
-
-{
-  const root = render("```rust\nfn main() { let x = 1; }\n```");
-  const pre = root?.querySelector("pre");
-  check("a fenced code block renders through Shiki once ready",
-    pre?.classList.contains("shiki") === true);
-  check("a keyword in the block reads the theme's keyword slot",
-    pre?.innerHTML.includes("color:var(--shiki-token-keyword)") === true);
-  check("the block's text content survives highlighting",
-    pre?.textContent?.includes("fn main()") === true);
-}
-
-{
-  const root = render("```html\n<script>alert(1)</script>\n```");
-  check("markup inside a code block is escaped text, not live elements",
-    root?.querySelector("script") === null
-      && root?.querySelector("pre")?.textContent?.includes("<script>") === true);
-}
-
-{
-  const root = render("```not-a-real-language\nsome code\n```");
-  const code = root?.querySelector("pre code");
-  check("an unknown language degrades to a plain pre with the language class",
-    code?.classList.contains("language-not-a-real-language") === true
-      && root?.querySelector("pre")?.classList.contains("shiki") === false);
-  check("an unknown language keeps its code text",
-    code?.textContent?.includes("some code") === true);
-}
-
-// --- highlightCode -------------------------------------------------------
-
-{
-  const html = highlightCode('{"a": 1}', "json");
-  check("highlightCode returns Shiki markup for a loaded language",
-    html.includes('class="shiki') && html.includes("style="));
-}
-
-{
-  const html = highlightCode("plain <text>", "not-a-real-language");
-  check("highlightCode escapes and passes through an unknown language unhighlighted",
-    html === '<pre><code class="language-not-a-real-language">plain &lt;text&gt;</code></pre>');
-}
-
-{
-  const html = highlightCode("plain", "");
-  check("highlightCode with no language emits a classless plain block",
-    html === "<pre><code>plain</code></pre>");
-}
-
-// --- The CSS-variables theme -----------------------------------------------
-
-// Cursor colors code through a Shiki theme whose every color is a CSS
-// variable (--shiki-foreground, --shiki-token-keyword, ...) that the
-// stylesheet fills from the skin's --syntax-* tokens. The markup carries
-// only var() references; the stylesheet must declare every slot the theme
-// can emit, and each must resolve to a color.
-{
-  const SLOTS = [
-    "foreground",
-    "background",
-    "token-comment",
-    "token-string",
-    "token-string-expression",
-    "token-constant",
-    "token-keyword",
-    "token-variable",
-    "token-language-variable",
-    "token-parameter",
-    "token-constant-variable",
-    "token-property",
-    "token-function",
-    "token-type",
-    "token-class",
-    "token-tag",
-    "token-attribute",
-    "token-punctuation",
-    "token-link",
-  ];
-  const resolve = await resolver();
-  const css = await readFile(path.join(testDir, "..", "src", "parts", "agent", "markdown-render.css"), "utf8");
-  const rules = rulesOf(css);
-  const slotValue = (slot) => resolve(valueIn(rules, ".ws-markdown-content", `--shiki-${slot}`));
-
-  for (const slot of SLOTS) {
-    const value = slotValue(slot);
-    check(`--shiki-${slot} is declared and resolves to a color`, typeof value === "string" && /^#[0-9a-f]{6,8}$|^transparent$/.test(value));
-  }
-  check("the foreground is #F0F0F0", slotValue("foreground") === "#f0f0f0");
-  check("comments are #F0F0F099", slotValue("token-comment") === "#f0f0f099");
-  check("the skin's --syntax-fg is #F0F0F0", resolve("var(--syntax-fg)") === "#f0f0f0");
-  check("the skin's --syntax-comment is #F0F0F099", resolve("var(--syntax-comment)") === "#f0f0f099");
-  check("the block background is the skin's #181818", slotValue("background") === "#181818");
-
-  // The theme draws on no slot the stylesheet leaves out, across the kinds of token a block holds.
-  const samples = [
-    ["typescript", 'import { a } from "b";\n// note\nclass Foo<T> extends Bar {\n  static readonly N = 10;\n  constructor(private p: number) { super(); this.q = `x${p}`; }\n  run(arg: T): void { const re = /ab+c/g; if (this.q === "x") { console.log(arg, true, null, Foo.N); } }\n}\n'],
-    ["html", '<div class="a" id="b">text</div>\n'],
-    ["css", "a { color: red; margin: 0 }\n"],
-    ["json", '{"a": [1, true, null, "x"]}\n'],
-    ["python", "@deco\ndef f(x, *, y=1):\n    return [x for x in range(3)]  # c\n"],
-    ["markdown", "# Title\n\n[link](http://example.test) and `code` and **bold**\n\n> quoted\n"],
-    ["rust", "fn main<'a>(x: &'a str) { let y = Vec::<u8>::new(); println!(\"{x}\"); }\n"],
-  ];
-  const used = new Set();
-  for (const [lang, code] of samples) {
-    for (const match of highlightCode(code, lang).matchAll(/var\(--shiki-([a-z-]+)\)/g)) used.add(match[1]);
-  }
-  check("the samples exercise a spread of slots", used.size >= 8);
-  check(
-    `every slot the theme emits is declared (${[...used].filter((slot) => !SLOTS.includes(slot)).join(", ") || "none missing"})`,
-    [...used].every((slot) => SLOTS.includes(slot)),
-  );
-  const comment = highlightCode("// hello\nlet x = 1;", "typescript");
-  check(
-    "a comment is italic through the same slot",
-    comment.includes("color:var(--shiki-token-comment);font-style:italic"),
-  );
-  check(
-    "no color in a highlighted block is a literal hex",
-    !/(?:color|background-color):#[0-9a-fA-F]{3,8}/.test(highlightCode("fn main() { let x = 1; }", "rust")),
-  );
-}
-
-// --- Sanitization --------------------------------------------------------
-
-{
-  const root = render("[click](javascript:alert(1))");
-  const anchor = root?.querySelector("a");
-  check("a javascript: href is stripped from a rendered link",
-    anchor !== null && anchor.getAttribute("href") === null);
-}
-
-{
-  const root = render("<script>alert(1)</script>\n\nafter");
-  check("a raw script tag in model-authored input never reaches the DOM",
-    root?.querySelector("script") === null);
-}
-
-{
-  const root = render('<img src="x" onerror="alert(1)">\n\n<div onclick="alert(1)">d</div>');
-  check("inline event handlers are stripped from rendered markup",
-    root?.querySelector("[onerror]") === null && root?.querySelector("[onclick]") === null);
-}
-
-// --- Streaming ------------------------------------------------------------
-
-{
-  const partial = render("# Streaming\n\npartial **bo", { streaming: true });
-  check("streaming mode renders a partial buffer through the same pipeline",
-    partial?.querySelector("h1")?.textContent === "Streaming");
-}
-
-{
-  const section =
-    "Some **bold** and *italic* prose with a [link](https://example.test) and `inline code`.\n\n" +
-    "```rust\nfn main() { let x = 1; println!(\"{x}\"); }\n```\n\n";
-  let doc = "";
-  while (doc.length < 5000) doc += section;
-  const deltas = 30;
-  const start = performance.now();
-  for (let i = 1; i <= deltas; i++) {
-    renderMarkdown(doc.slice(0, Math.floor((doc.length * i) / deltas)), { streaming: true });
-  }
-  const elapsed = performance.now() - start;
-  check(
-    `a full re-parse per delta stays cheap at chat scale (30 deltas of a ${doc.length}-char buffer in ${Math.round(elapsed)}ms)`,
-    elapsed < 5000,
-  );
-}
-
-// --- The streaming fade -------------------------------------------------------
-
-// A stream rendered at scripted times: the text a render adds past the
-// previous render's text fades in, word by word, and only text younger than
-// FADE_MS is wrapped, with a negative animation-delay of how far into the
-// fade it already is.
-{
-  const stream = new MarkdownStream();
-  const draw = (text, now, streaming = true) => {
-    const container = document.createElement("div");
-    container.append(stream.render(text, { streaming, now }));
-    return container.firstElementChild;
-  };
-  const fades = (root) => [...root.querySelectorAll(".ws-fade-in")];
-  const words = (root) => fades(root).map((span) => span.textContent);
-  const delays = (root) => fades(root).map((span) => Number.parseFloat(span.style.animationDelay));
-
-  check("the fade lasts 150ms", FADE_MS === 150);
-
-  let root = draw("Hello", 1000);
-  check(
-    "the first render of a stream fades all of its text in, with no delay yet",
-    words(root).join(",") === "Hello" && delays(root)[0] === 0,
-  );
-
-  root = draw("Hello world", 1050);
-  check(
-    "a delta fades its own word in; the earlier word, 50ms in, carries its fade on",
-    words(root).join(",") === "Hello,world" && delays(root)[0] === -50 && delays(root)[1] === 0,
-  );
-  check("the text itself is unchanged by the wrapping", root.querySelector("p")?.textContent === "Hello world");
-
-  root = draw("Hello world again", 1200);
-  check(
-    "text older than 150ms is no longer wrapped: only the new word fades",
-    words(root).join(",") === "again" && root.querySelector("p")?.textContent === "Hello world again",
-  );
-
-  root = draw("Hello world again", 1500);
-  check("a render with nothing new wraps nothing once the fade is over", fades(root).length === 0);
-
-  root = draw("Hello world again and more", 1600, false);
-  check(
-    "a settle that still has new text keeps fading it (a stream that streamed keeps its fade)",
-    words(root).join(",") === "and,more",
-  );
-}
-
-{
-  const stream = new MarkdownStream();
-  const container = document.createElement("div");
-  container.append(stream.render("settled history", { streaming: false, now: 5 }));
-  check(
-    "a reply that never streamed renders plain, with no fade",
-    container.querySelectorAll(".ws-fade-in").length === 0 &&
-      container.textContent === "settled history",
-  );
-}
-
-{
-  const stream = new MarkdownStream();
-  const container = document.createElement("div");
-  container.append(stream.render("intro\n\n```js\nconst a = 1;\n```\n\noutro", { streaming: true, now: 10 }));
-  const spans = [...container.querySelectorAll(".ws-fade-in")].map((span) => span.textContent);
-  check(
-    "prose fades but a code block never does",
-    spans.join(",") === "intro,outro" &&
-      container.querySelectorAll("pre .ws-fade-in").length === 0 &&
-      container.querySelector("pre")?.textContent?.includes("const a = 1;") === true,
-  );
-  check(
-    "the copy button is chrome and never fades",
-    container.querySelector(".ws-code-block__copy .ws-fade-in") === null &&
-      container.querySelector(".ws-code-block__copy")?.textContent === "Copy code",
-  );
-}
-
-{
-  const stream = new MarkdownStream();
-  const container = document.createElement("div");
-  container.append(stream.render("one **two", { streaming: true, now: 100 }));
-  container.replaceChildren(stream.render("one **two** three", { streaming: true, now: 400 }));
-  check(
-    "when earlier text changes (markup closing), the text from the change on fades again",
-    [...container.querySelectorAll(".ws-fade-in")].map((span) => span.textContent).join(",") === "two,three" &&
-      container.querySelector("strong")?.textContent === "two",
-  );
-}
-
-{
-  window.matchMedia = (query) => ({ matches: true, media: query });
-  const stream = new MarkdownStream();
-  const container = document.createElement("div");
-  container.append(stream.render("moving words", { streaming: true, now: 1 }));
-  check(
-    "under reduced motion nothing is wrapped to fade",
-    container.querySelectorAll(".ws-fade-in").length === 0 && container.textContent === "moving words",
-  );
-  delete window.matchMedia;
-}
-
-{
-  const stream = new MarkdownStream();
-  const container = document.createElement("div");
-  container.append(
-    stream.render(
-      '<script>alert(1)</script>\n\n[x](javascript:alert(1)) <img src="x" onerror="alert(1)">',
-      { streaming: true, now: 1 },
-    ),
-  );
-  check(
-    "DOMPurify still runs on a stream: no script, no javascript: href, no handler",
-    container.querySelector("script") === null &&
-      container.querySelector("a")?.getAttribute("href") === null &&
-      container.querySelector("[onerror]") === null,
-  );
-}
-
-// --- No caret -----------------------------------------------------------------
-
-{
-  const css = (await readFile(path.join(testDir, "..", "src", "parts", "agent", "markdown-render.css"), "utf8")).toLowerCase();
-  const session = (await readFile(path.join(testDir, "..", "src", "parts", "agent", "agent-session.css"), "utf8")).toLowerCase();
-  check("no stylesheet draws a streaming caret", !css.includes("caret") && !session.includes("caret"));
-  const root = render("partial text", { streaming: true });
-  check("a streaming render adds no caret element", root?.querySelector("[class*='caret']") === null);
-}
-
-// --- Copy code ---------------------------------------------------------------------
-
-{
-  mock.timers.enable({ apis: ["setTimeout"] });
-  const root = render("```js\nconst a = 1;\n```");
-  const holder = root?.querySelector(".ws-code-block");
-  const button = holder?.querySelector(".ws-code-block__copy");
-  check(
-    "a fenced block sits in a holder with a Copy code button after its pre and no language label",
-    holder?.firstElementChild?.tagName === "PRE" &&
-      button?.textContent === "Copy code" &&
-      button?.previousElementSibling === holder.firstElementChild &&
-      holder.querySelector("[class*='lang']") === null,
-  );
-  button?.click();
-  for (let turn = 0; turn < 5; turn++) await Promise.resolve();
-  check(
-    "clicking copies the block's code and reads Copied",
-    clipboard.at(-1)?.includes("const a = 1;") === true &&
-      button?.textContent === "Copied" &&
-      button.classList.contains("ws-code-block__copy--copied"),
-  );
-  mock.timers.tick(2000);
-  check(
-    "the button reads Copy code again after a moment",
-    button?.textContent === "Copy code" && !button.classList.contains("ws-code-block__copy--copied"),
-  );
-  mock.timers.reset();
-  check(
-    "an unknown language still gets the button",
-    render("```nope\nx\n```")?.querySelector(".ws-code-block__copy") !== null,
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`markdown-render: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("markdown-render: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/mention-chip.mjs b/crates/workshop/ui/test/mention-chip.mjs
deleted file mode 100644
index 289e8d099..000000000
--- a/crates/workshop/ui/test/mention-chip.mjs
+++ /dev/null
@@ -1,501 +0,0 @@
-// The mention chip (src/parts/chatbox/mention-chip.ts) in jsdom: the
-// configured Mention extension renamed to mentionNode with a vanilla-DOM
-// NodeView pill. Covers: a mention node renders as a pill with icon
-// slot, label, and a labelled remove button; the pill has the
-// mention's rendered data-id, data-label, and data-mention-suggestion-char
-// attributes; the label falls back to the
-// id when no label is set; the chip is non-editable; the remove button
-// deletes the node and leaves the surrounding text intact; getJSON
-// serializes the node with type "mentionNode"; ChatBox registers the
-// extension, so chips render and remove inside the real input. The chip
-// model: a pill inserted with a kind has data-kind and one without
-// omits it; kind, icon, preview, tone, and data survive getJSON, are
-// null on a chip inserted without them, and are rebuilt by setContent
-// from that JSON; data round-trips byte-for-byte; parsing the pill's
-// rendered HTML (copy and paste) restores data-payload; renderChip
-// (src/parts/chatbox/chip-view.ts) draws the same pill standalone. Runs
-// under the shared leak check: a ChatBox that is never disposed
-// fails. The pill's icons are codicons; its stylesheet values (6px radius,
-// padding 1px 4px, the 24% blue fill, a label of at most 200px, the close X
-// taking the icon's cell on hover while the editor is focused) are read from
-// the source text.
-// Run: node test/mention-chip.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ChatBox } from "./src/parts/chatbox/chat-box.ts";
-      export { MentionChip } from "./src/parts/chatbox/mention-chip.ts";
-      export { renderChip } from "./src/parts/chatbox/chip-view.ts";
-      export { Editor } from "@tiptap/core";
-      export { StarterKit } from "@tiptap/starter-kit";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// ProseMirror reads the DOM globals at construction, so the jsdom
-// globals must exist before the bundle is imported. pretendToBeVisual
-// supplies the requestAnimationFrame ProseMirror schedules with.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.getComputedStyle = dom.window.getComputedStyle.bind(dom.window);
-
-const bundlePath = path.join(os.tmpdir(), "runvil-mention-chip-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, ChatBox, MentionChip, renderChip, Editor, StarterKit } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// A bare editor over the same extensions ChatBox uses, so the chip
-// mechanics are pinned directly against the extension.
-function createEditor() {
-  const element = document.createElement("div");
-  const editor = new Editor({
-    element,
-    extensions: [StarterKit, MentionChip],
-    content: "<p>before after</p>",
-  });
-  editor.commands.insertContentAt(7, {
-    type: "mentionNode",
-    attrs: { id: "README.md", label: "README.md" },
-  });
-  return editor;
-}
-
-function mentionInDoc(editor) {
-  let found = false;
-  editor.state.doc.descendants((node) => {
-    if (node.type.name === "mentionNode") found = true;
-    return !found;
-  });
-  return found;
-}
-
-function mentionJson(editor) {
-  const paragraph = editor.getJSON().content?.[0];
-  return paragraph?.content?.find((node) => node.type === "mentionNode");
-}
-
-// A bare editor with one chip holding the given attrs at position 1.
-function editorWithChip(attrs) {
-  const editor = new Editor({
-    element: document.createElement("div"),
-    extensions: [StarterKit, MentionChip],
-    content: "<p>x</p>",
-  });
-  editor.commands.insertContentAt(1, { type: "mentionNode", attrs });
-  return editor;
-}
-
-// The full chip model, with a payload whose shape exercises nesting,
-// unicode, and JSON-significant characters.
-const FULL_CHIP = {
-  id: "src/main.ts",
-  label: "main.ts",
-  kind: "file",
-  icon: "file-code",
-  preview: "rv://preview/1",
-  tone: "expired",
-  data: { path: "src/main.ts", grants: ["r\"w"], nested: { n: 1.5, ok: true, none: null }, s: "é\n" },
-};
-
-await assertNoLeaks(lifecycle, () => {
-  // --- Render ---------------------------------------------------------------
-
-  {
-    const editor = createEditor();
-    const chip = editor.view.dom.querySelector(".ws-mention-chip");
-    check("a mention node renders as a pill inside the editor", chip !== null);
-    check(
-      "the pill shows the mention label",
-      chip?.querySelector(".ws-mention-chip__label")?.textContent === "README.md",
-    );
-    check(
-      "the pill includes an icon slot",
-      chip?.querySelector(".ws-mention-chip__icon") !== null,
-    );
-    check(
-      "the pill is non-editable",
-      chip?.getAttribute("contenteditable") === "false",
-    );
-    check(
-      "the pill includes a labelled remove button",
-      chip?.querySelector('button.ws-mention-chip__remove[aria-label="Remove"]') !== null,
-    );
-    check(
-      "the pill has the mention's rendered data attributes",
-      chip?.getAttribute("data-id") === "README.md" &&
-        chip?.getAttribute("data-label") === "README.md" &&
-        chip?.getAttribute("data-mention-suggestion-char") === "@",
-    );
-    editor.destroy();
-  }
-
-  // --- Label fallback ---------------------------------------------------------
-
-  {
-    const editor = new Editor({
-      element: document.createElement("div"),
-      extensions: [StarterKit, MentionChip],
-      content: "<p>x</p>",
-    });
-    editor.commands.insertContentAt(1, {
-      type: "mentionNode",
-      attrs: { id: "src/main.ts" },
-    });
-    check(
-      "a mention without a label falls back to its id",
-      editor.view.dom.querySelector(".ws-mention-chip__label")?.textContent === "src/main.ts",
-    );
-    editor.destroy();
-  }
-
-  // --- Serialization ----------------------------------------------------------
-
-  {
-    const editor = createEditor();
-    const json = editor.getJSON();
-    const paragraph = json.content?.[0];
-    const mention = paragraph?.content?.find((node) => node.type === "mentionNode");
-    check(
-      "getJSON serializes the mention with the mentionNode type",
-      mention !== undefined &&
-        mention.attrs?.id === "README.md" &&
-        mention.attrs?.label === "README.md",
-    );
-    editor.destroy();
-  }
-
-  // --- Remove -----------------------------------------------------------------
-
-  {
-    const editor = createEditor();
-    const button = editor.view.dom.querySelector(".ws-mention-chip__remove");
-    button?.click();
-    check(
-      "the remove button deletes the mention node",
-      editor.view.dom.querySelector(".ws-mention-chip") === null && !mentionInDoc(editor),
-    );
-    check(
-      "the surrounding text survives the removal",
-      editor.getText() === "before after",
-    );
-    editor.destroy();
-  }
-
-  // --- ChatBox registration -------------------------------------------------
-
-  {
-    const input = new ChatBox({
-      content:
-        '<p>look at <span data-type="mentionNode" data-id="README.md" data-label="README.md"></span> please</p>',
-    });
-    check(
-      "ChatBox renders a mention node as a pill",
-      input.element.querySelector(".ws-mention-chip") !== null,
-    );
-    input.element.querySelector(".ws-mention-chip__remove")?.click();
-    check(
-      "the remove button deletes the chip inside ChatBox",
-      input.element.querySelector(".ws-mention-chip") === null,
-    );
-    input.dispose();
-  }
-
-  // --- Chip model: kind on the pill ------------------------------------------------
-
-  {
-    const editor = editorWithChip({ id: "src/main.ts", label: "main.ts", kind: "file" });
-    check(
-      "a pill inserted with a kind has data-kind",
-      editor.view.dom.querySelector(".ws-mention-chip")?.getAttribute("data-kind") === "file",
-    );
-    editor.destroy();
-  }
-
-  {
-    const editor = editorWithChip({ id: "src/main.ts", label: "main.ts" });
-    check(
-      "a pill inserted without a kind omits data-kind",
-      editor.view.dom.querySelector(".ws-mention-chip")?.hasAttribute("data-kind") === false,
-    );
-    editor.destroy();
-  }
-
-  // --- Chip model: the extended attrs survive getJSON -----------------------------
-
-  {
-    const editor = editorWithChip(FULL_CHIP);
-    const mention = mentionJson(editor);
-    check(
-      "kind, icon, preview, and tone survive getJSON",
-      mention?.attrs?.kind === "file" &&
-        mention?.attrs?.icon === "file-code" &&
-        mention?.attrs?.preview === "rv://preview/1" &&
-        mention?.attrs?.tone === "expired",
-    );
-    check(
-      "data round-trips through getJSON byte-for-byte",
-      JSON.stringify(mention?.attrs?.data) === JSON.stringify(FULL_CHIP.data),
-    );
-    // setContent from the serialized JSON: the round trip is the persisted
-    // draft's path back into a live editor.
-    const rebuilt = new Editor({
-      element: document.createElement("div"),
-      extensions: [StarterKit, MentionChip],
-      content: editor.getJSON(),
-    });
-    const again = mentionJson(rebuilt);
-    check(
-      "setContent from the JSON rebuilds the extended attrs",
-      again?.attrs?.kind === "file" &&
-        again?.attrs?.icon === "file-code" &&
-        again?.attrs?.preview === "rv://preview/1" &&
-        again?.attrs?.tone === "expired" &&
-        JSON.stringify(again?.attrs?.data) === JSON.stringify(FULL_CHIP.data),
-    );
-    check(
-      "the rebuilt pill renders its kind and tone",
-      rebuilt.view.dom.querySelector(".ws-mention-chip")?.getAttribute("data-kind") === "file" &&
-        rebuilt.view.dom.querySelector(".ws-mention-chip")?.getAttribute("data-tone") === "expired",
-    );
-    rebuilt.destroy();
-    editor.destroy();
-  }
-
-  {
-    const editor = editorWithChip({ id: "README.md", label: "README.md" });
-    const mention = mentionJson(editor);
-    check(
-      "kind, icon, preview, tone, and data are absent from a chip inserted without them",
-      mention !== undefined &&
-        mention.attrs?.kind == null &&
-        mention.attrs?.icon == null &&
-        mention.attrs?.preview == null &&
-        mention.attrs?.tone == null &&
-        mention.attrs?.data == null,
-    );
-    editor.destroy();
-  }
-
-  // --- Chip model: the rendered HTML parses back (copy and paste) -----------------
-
-  {
-    const editor = editorWithChip(FULL_CHIP);
-    // getHTML runs the schema's renderHTML - the clipboard serializer's
-    // path - and setContent from that HTML runs parseHTML, the paste path.
-    const html = editor.getHTML();
-    check(
-      "the rendered pill HTML includes a JSON data-payload and the model attributes",
-      html.includes('data-kind="file"') &&
-        html.includes('data-icon="file-code"') &&
-        html.includes('data-preview="rv://preview/1"') &&
-        html.includes('data-tone="expired"') &&
-        html.includes("data-payload="),
-    );
-    const pasted = new Editor({
-      element: document.createElement("div"),
-      extensions: [StarterKit, MentionChip],
-      content: html,
-    });
-    const mention = mentionJson(pasted);
-    check(
-      "parsing the pill's HTML restores the model attrs and data-payload",
-      mention?.attrs?.id === "src/main.ts" &&
-        mention?.attrs?.kind === "file" &&
-        mention?.attrs?.icon === "file-code" &&
-        mention?.attrs?.preview === "rv://preview/1" &&
-        mention?.attrs?.tone === "expired" &&
-        JSON.stringify(mention?.attrs?.data) === JSON.stringify(FULL_CHIP.data),
-    );
-    pasted.destroy();
-    editor.destroy();
-  }
-
-  {
-    const plain = new Editor({
-      element: document.createElement("div"),
-      extensions: [StarterKit, MentionChip],
-      content:
-        '<p><span data-type="mentionNode" data-id="a" data-label="a" data-payload="not json"></span></p>',
-    });
-    check(
-      "an unparseable data-payload parses as null rather than throwing",
-      mentionJson(plain)?.attrs?.data === null,
-    );
-    plain.destroy();
-  }
-
-  // --- renderChip: the standalone pill --------------------------------------------
-
-  {
-    const pill = renderChip(FULL_CHIP);
-    check(
-      "renderChip draws the pill with icon, label, and remove button",
-      pill.classList.contains("ws-mention-chip") &&
-        pill.querySelector(".ws-mention-chip__icon svg") !== null &&
-        pill.querySelector(".ws-mention-chip__label")?.textContent === "main.ts" &&
-        pill.querySelector('button.ws-mention-chip__remove[aria-label="Remove"]') !== null,
-    );
-    check(
-      "renderChip stamps data-kind and data-tone from the chip",
-      pill.getAttribute("data-kind") === "file" && pill.getAttribute("data-tone") === "expired",
-    );
-    const bare = renderChip({ id: "x", label: "x", data: null });
-    check(
-      "renderChip leaves data-kind and data-tone off a chip without them",
-      !bare.hasAttribute("data-kind") && !bare.hasAttribute("data-tone"),
-    );
-    const byExtension = renderChip({ id: "notes.md", label: "notes.md", data: null });
-    check(
-      "renderChip picks the icon from the label's extension when none is named",
-      byExtension.querySelector(".ws-mention-chip__icon svg")?.outerHTML !==
-        bare.querySelector(".ws-mention-chip__icon svg")?.outerHTML,
-    );
-    const named = renderChip({ id: "notes.md", label: "notes.md", icon: "folder", data: null });
-    check(
-      "a named icon overrides the extension map",
-      named.querySelector(".ws-mention-chip__icon svg")?.outerHTML !==
-        byExtension.querySelector(".ws-mention-chip__icon svg")?.outerHTML,
-    );
-    check(
-      "an unknown named icon falls back to the extension map",
-      renderChip({ id: "notes.md", label: "notes.md", icon: "no-such-icon", data: null })
-        .querySelector(".ws-mention-chip__icon svg")?.outerHTML ===
-        byExtension.querySelector(".ws-mention-chip__icon svg")?.outerHTML,
-    );
-  }
-
-  // --- The pill's icons are codicons, and the X shares the icon's cell ----------------
-
-  {
-    const codeIcon = renderChip({ id: "a.ts", label: "a.ts", data: null }).querySelector(".ws-mention-chip__icon svg");
-    check(
-      "a codicon is drawn at the pill's 12px size, decorative",
-      codeIcon?.getAttribute("viewBox") === "0 0 16 16" &&
-        codeIcon.getAttribute("width") === "12" &&
-        codeIcon.getAttribute("height") === "12" &&
-        codeIcon.getAttribute("aria-hidden") === "true" &&
-        codeIcon.getAttribute("fill") === "currentColor",
-    );
-    const iconOf = (chip) => renderChip({ id: "x", label: "x", data: null, ...chip }).querySelector(".ws-mention-chip__icon svg")?.innerHTML;
-    check("a source file and a text file draw different glyphs", iconOf({ label: "a.ts" }) !== iconOf({ label: "a.md" }));
-    check("an image file draws the media glyph, and so does the named image icon", iconOf({ label: "a.png" }) === iconOf({ label: "a", icon: "image" }));
-    check("a folder and a link draw their own glyphs", iconOf({ icon: "folder" }) !== iconOf({ icon: "link" }) && iconOf({ icon: "folder" }) !== iconOf({}));
-    check("a command and a terminal share the keyword glyph", iconOf({ icon: "command" }) === iconOf({ icon: "terminal" }));
-    const pill = renderChip({ id: "a.ts", label: "a.ts", data: null });
-    const remove = pill.querySelector(".ws-mention-chip__remove");
-    check(
-      "the remove button draws the close codicon beside the label, after it in the DOM",
-      remove?.querySelector("svg")?.getAttribute("width") === "12" &&
-        pill.lastElementChild === remove &&
-        pill.children.length === 3,
-    );
-  }
-});
-
-// --- The stylesheet: the pill's values ---------------------------------------------------
-
-{
-  const css = (
-    await readFile(path.join(testDir, "..", "src", "parts", "chatbox", "chat-box.css"), "utf8")
-  ).replace(/\/\*[\s\S]*?\*\//g, "");
-  const lookTokens = await readFile(path.join(testDir, "..", "..", "look", "tokens.css"), "utf8");
-  const componentCss = await readFile(path.join(testDir, "..", "src", "tokens", "component.css"), "utf8");
-  const rule = (selector) => {
-    const match = new RegExp(`${selector.replace(/[.[\]"=():>~+*]/g, "\\$&")}\\s*\\{([^}]*)\\}`).exec(css);
-    return match === null ? "" : match[1].replace(/\s+/g, " ");
-  };
-  const pill = rule(".ws-mention-chip");
-  check("the pill has a 6px radius", /border-radius:\s*var\(--radius\)/.test(pill) && /--radius:\s*6px/.test(lookTokens));
-  check("the pill pads 1px 4px", /padding:\s*var\(--ws-size-1\) var\(--space-1\)/.test(pill));
-  check("the pill's fill is the blue at 24%", /--mention-bg:\s*color-mix\(in srgb, var\(--cursor-blue\) 24%, transparent\)/.test(lookTokens) && /background:\s*var\(--mention-bg\)/.test(pill));
-  check(
-    "the label is at most 200px wide",
-    /max-inline-size:\s*var\(--ws-prompt-chip-label-max-width\)/.test(rule(".ws-mention-chip__label")) &&
-      /--ws-prompt-chip-label-max-width:\s*var\(--ws-size-200\)/.test(componentCss),
-  );
-  check(
-    "the icon and the remove button share the pill's first grid cell",
-    /grid-area:\s*1 \/ 1/.test(rule(".ws-mention-chip__icon")) && /grid-area:\s*1 \/ 1/.test(rule(".ws-mention-chip__remove")),
-  );
-  check(
-    "the X replaces the icon on hover only while the editor is focused",
-    /\.ws-prompt-input__editor\.ProseMirror-focused \.ws-mention-chip:hover \.ws-mention-chip__icon\s*\{[^}]*opacity:\s*0/.test(css) &&
-      /\.ws-prompt-input__editor\.ProseMirror-focused \.ws-mention-chip:hover \.ws-mention-chip__remove[^{]*\{[^}]*opacity:\s*1/.test(css) &&
-      /opacity:\s*0/.test(rule(".ws-mention-chip__remove")),
-  );
-
-  // The X sits over the icon and is hidden by opacity alone, which still takes
-  // clicks: until the focused-hover or keyboard-focus rule reveals it, it must
-  // be inert and show no pointer cursor.
-  const revealRule = /\.ws-prompt-input__editor\.ProseMirror-focused \.ws-mention-chip:hover \.ws-mention-chip__remove,\s*\.ws-mention-chip__remove:focus-visible\s*\{([^}]*)\}/.exec(css)?.[1] ?? "";
-  check(
-    "the hidden X takes no pointer events and shows no pointer cursor",
-    /pointer-events:\s*none/.test(rule(".ws-mention-chip__remove")) &&
-      !/cursor:\s*pointer/.test(rule(".ws-mention-chip__remove")),
-  );
-  check(
-    "the revealing rule (focused hover or keyboard focus) restores pointer events and the pointer cursor",
-    /pointer-events:\s*auto/.test(revealRule) && /cursor:\s*pointer/.test(revealRule),
-  );
-
-  // Under the real rules in jsdom: an unfocused editor's pill has an inert X,
-  // and clicking its icon keeps the pill.
-  const style = document.createElement("style");
-  style.textContent = css.slice(css.indexOf(".ws-mention-chip {"), css.indexOf(".ws-draft-view {"));
-  document.head.appendChild(style);
-  const editor = createEditor();
-  document.body.appendChild(editor.options.element);
-  const remove = editor.view.dom.querySelector(".ws-mention-chip__remove");
-  check(
-    "in an unfocused editor the pill's X computes to pointer-events none",
-    remove !== null && getComputedStyle(remove).pointerEvents === "none",
-  );
-  editor.view.dom.querySelector(".ws-mention-chip__icon")?.click();
-  check(
-    "clicking the icon of a pill in an unfocused editor keeps the pill",
-    editor.view.dom.querySelector(".ws-mention-chip") !== null && mentionInDoc(editor),
-  );
-  editor.destroy();
-  editor.options.element.remove();
-  style.remove();
-}
-
-if (failures.length > 0) {
-  console.error(`ws-mention-chip: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-mention-chip: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/menu-registries.mjs b/crates/workshop/ui/test/menu-registries.mjs
deleted file mode 100644
index 3b4af93e3..000000000
--- a/crates/workshop/ui/test/menu-registries.mjs
+++ /dev/null
@@ -1,215 +0,0 @@
-// Unit test for the workbench menu registries
-// (`@workshop/platform/command-registry`, `@workshop/platform/menu-registry`) and
-// the menubar's button generation (src/parts/menu/menubar.ts). Commands are
-// actions keyed by id in the command registry; menu rows are command
-// references or submenu pointers per menu id in the menu registry; the
-// menubar generates the title bar's buttons from the root menu's
-// submenu rows. Bundles the modules with esbuild and drives them
-// against jsdom built from the real index.html. Covers: command
-// registration, lookup, execution with arguments, upsert, and disposal;
-// menu row sort order, upsert by id, submenu rows, provider rows merged
-// with static rows and re-read at every call; button generation with
-// data-menu last-segment selectors, registry sort order, command rows
-// on the root menu not becoming buttons, and disposal.
-// Run: node --test test/menu-registries.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { Menubar, appendMenubarButtons } from "./src/parts/menu/menubar.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { CommandRegistry, MenuRegistry, MenuId, ContextKeyService, createKeybindingsRegistry, Menubar, appendMenubarButtons } =
-  await import(`data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Command registry ---------------------------------------------------------
-
-{
-  const commands = new CommandRegistry();
-  const runs = [];
-  const registration = commands.register("test.run", { title: "Run", run: (...args) => runs.push(args) });
-  check("a registered command is found by lookup", commands.lookup("test.run")?.title === "Run");
-  check("an unknown command is not found", commands.lookup("test.nope") === undefined);
-  check(
-    "execute runs the command with its arguments and reports it",
-    (await commands.execute("test.run", 1, "x")) === true && runs.length === 1 && runs[0].join(",") === "1,x",
-  );
-  check("execute reports an unknown command as not run", (await commands.execute("test.nope")) === false);
-
-  let asyncDone = false;
-  commands.register("test.async", {
-    run: async () => {
-      await Promise.resolve();
-      asyncDone = true;
-    },
-  });
-  await commands.execute("test.async");
-  check("execute awaits an async run", asyncDone === true);
-
-  commands.register("test.run", { title: "Run Again", run: () => runs.push(["again"]) });
-  await commands.execute("test.run");
-  check(
-    "re-registering upserts the action",
-    runs.length === 2 && runs[1][0] === "again" && commands.lookup("test.run").title === "Run Again",
-  );
-  registration.dispose();
-  await commands.execute("test.run");
-  check("disposing the original registration leaves the upsert in place", runs.length === 3);
-}
-
-// --- Menu registry --------------------------------------------------------------
-
-{
-  const menus = new MenuRegistry();
-  menus.appendMenuItem("menubar/file", { command: "b.two", group: "1_b", order: 2 });
-  menus.appendMenuItem("menubar/file", { command: "a.one" });
-  menus.appendMenuItem("menubar/file", { command: "b.one", group: "1_b", order: 1 });
-  menus.appendMenuItem("menubar/file", { command: "c.one", group: "2_c" });
-  const ids = (rows) => rows.map((row) => ("submenu" in row ? row.submenu : row.command)).join(",");
-  check(
-    "rows sort navigation first, then groups lexically, then order",
-    ids(menus.getMenuItems("menubar/file")) === "a.one,b.one,b.two,c.one",
-  );
-
-  menus.appendMenuItem("menubar/file", { command: "a.one", title: "Renamed" });
-  const rows = menus.getMenuItems("menubar/file");
-  check(
-    "an upsert by command id keeps one row with the new data",
-    rows.length === 4 && rows[0].title === "Renamed",
-  );
-
-  menus.appendMenuItem("menubar/file", { submenu: "menubar/file/recent", title: "Recent", group: "3_z" });
-  const last = menus.getMenuItems("menubar/file").at(-1);
-  check(
-    "a submenu row round-trips its menu id and title",
-    last !== undefined && "submenu" in last && last.submenu === "menubar/file/recent" && last.title === "Recent",
-  );
-
-  let dynamic = [{ command: "p.one" }];
-  const providerReg = menus.setProvider("menubar/file", () => dynamic);
-  check(
-    "provider rows merge with static rows in sort order",
-    ids(menus.getMenuItems("menubar/file")) === "a.one,p.one,b.one,b.two,c.one,menubar/file/recent",
-  );
-  dynamic = [{ command: "p.two", group: "2_c" }];
-  check(
-    "provider rows are re-read at every call",
-    ids(menus.getMenuItems("menubar/file")) === "a.one,b.one,b.two,c.one,p.two,menubar/file/recent",
-  );
-  providerReg.dispose();
-  check(
-    "disposing the provider drops its rows",
-    ids(menus.getMenuItems("menubar/file")) === "a.one,b.one,b.two,c.one,menubar/file/recent",
-  );
-
-  const rowReg = menus.appendMenuItem("menubar/file", { command: "d.one" });
-  menus.appendMenuItem("menubar/file", { command: "d.one", title: "Replacement" });
-  rowReg.dispose();
-  check(
-    "disposing a stale row registration leaves its replacement in place",
-    menus.getMenuItems("menubar/file").some((row) => !("submenu" in row) && row.command === "d.one" && row.title === "Replacement"),
-  );
-}
-
-// --- Button generation -----------------------------------------------------------
-
-{
-  const nav = window.document.createElement("nav");
-  const buttons = appendMenubarButtons(nav, [
-    { submenu: "menubar/file", title: "File" },
-    { submenu: "menubar/view/appearance", title: "Appearance" },
-  ]);
-  check("one button per submenu row", buttons.length === 2 && nav.children.length === 2);
-  check(
-    "data-menu holds the menu id's last segment",
-    buttons[0].dataset.menu === "file" && buttons[1].dataset.menu === "appearance",
-  );
-  check(
-    "buttons are type=button with the popup aria state",
-    buttons.every(
-      (button) =>
-        button.type === "button" &&
-        button.getAttribute("aria-haspopup") === "menu" &&
-        button.getAttribute("aria-expanded") === "false",
-    ),
-  );
-  check("the button label is the row title", buttons[0].textContent === "File");
-}
-
-// --- Menubar: buttons from the root menu in sort order ----------------------------
-
-{
-  const menus = new MenuRegistry();
-  const commands = new CommandRegistry();
-  commands.register("file.new", { title: "New File", run: () => {} });
-  // Registered out of order on purpose; a command row on the root menu
-  // is not a top-level menu and must not become a button.
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/view", title: "View", order: 3 });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { command: "file.new" });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/file", title: "File", order: 1 });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/edit", title: "Edit", order: 2 });
-
-  const nav = window.document.querySelector(".ws-window-titlebar__menus");
-  const menubar = new Menubar(nav, {
-    menus,
-    commands,
-    contextKeys: new ContextKeyService(),
-    keybindings: createKeybindingsRegistry("linux"),
-  });
-  const buttons = [...nav.querySelectorAll(".ws-window-titlebar__menu")];
-  check(
-    "the menubar generates the root menu's submenu rows in sort order",
-    buttons.map((button) => button.textContent).join(",") === "File,Edit,View",
-  );
-  check(
-    "the generated buttons have the last-segment selectors",
-    buttons.map((button) => button.dataset.menu).join(",") === "file,edit,view",
-  );
-  menubar.dispose();
-  check("disposal removes the generated buttons", nav.querySelectorAll(".ws-window-titlebar__menu").length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`menu-registries: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("menu-registries: all assertions passed");
diff --git a/crates/workshop/ui/test/menu-spec.mjs b/crates/workshop/ui/test/menu-spec.mjs
deleted file mode 100644
index f77ea0081..000000000
--- a/crates/workshop/ui/test/menu-spec.mjs
+++ /dev/null
@@ -1,490 +0,0 @@
-// The menu-spec test: the menu and flyout contents restated as one spec
-// table, driven against the shared registries after bundling every
-// contribution module - the menubar and stub tables plus the feature
-// contributions. Covers: the eight top-level menus in order; every spec
-// row in its menu and group, in spec render order within each menu, the
-// editor tab menu and the second placement of Move Editor into New Window
-// (titled Move into New Window there) included; every
-// wired row listed in the command palette (f1); every stub row
-// registered with precondition "false" (always disabled) and absent
-// from the palette; the constant toggled expressions on the checkable
-// stub rows (Menu Bar and Panel checked, the rest unchecked, one radio
-// default per group).
-//
-// Two catalog rows are wired but deliberately not f1 and are excluded
-// from the palette check: vscode.open (a palette row cannot supply its
-// path argument) and workbench.action.quickOpenWithModes /
-// quickOpenHelp (the command-center pill's rows, not menu-spec rows).
-//
-// Run: node --test test/menu-spec.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/menu/menubar.contribution.ts";
-      import "./src/parts/menu/stubs.contribution.ts";
-      import "./src/parts/menu/edit.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/workspace-document/workspace-document.contribution.ts";
-      import "./src/parts/chrome/chrome.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      import "./src/parts/status/status.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      import "./src/parts/gateway/gateway.contribution.ts";
-      import "./src/parts/run/run.contribution.ts";
-      import "./src/parts/quickinput/quickinput.contribution.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus, MenuId } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { RECENT_FILES_STORE } from "./src/services/recent-files-store.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-    "@tauri-apps/api/event": path.join(uiDir, "helpers", "tauri-event-stub.mjs"),
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-    "@tauri-apps/api/webviewWindow": path.join(uiDir, "helpers", "tauri-webview-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The contributions register at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-step20-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { Commands, Menus, KeybindingsRegistry, registerService, TREE_STATE, RECENT_FILES_STORE } = await import(
-  pathToFileURL(bundlePath).href
-);
-console.error = realConsoleError;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-check("no contribution reported a malformed descriptor", consoleErrors.length === 0);
-
-// The Open Recent provider resolves its stores at call time; empty
-// fakes keep the dynamic half row-free so the static rows stand alone.
-registerService(TREE_STATE, () => ({ listing: () => undefined, cachedListings: () => [] }));
-registerService(RECENT_FILES_STORE, () => ({ list: [], clear() {}, record() {} }));
-
-// --- The spec table -----------------------------------------------------------
-//
-// One entry per menu, rows in spec render order. A row is
-// [id, group, kind, title?, toggled?]: the command id or submenu id, the
-// sort group (undefined for the groupless root menu), "wired" | "stub" |
-// "sub", the row label for stub and submenu rows, and the constant
-// toggled expression for checkable stub rows.
-const SPEC = {
-  menubar: [
-    ["menubar/file", undefined, "sub", "File"],
-    ["menubar/edit", undefined, "sub", "Edit"],
-    ["menubar/selection", undefined, "sub", "Selection"],
-    ["menubar/view", undefined, "sub", "View"],
-    ["menubar/go", undefined, "sub", "Go"],
-    ["menubar/run", undefined, "sub", "Run"],
-    ["menubar/terminal", undefined, "sub", "Terminal"],
-    ["menubar/help", undefined, "sub", "Help"],
-  ],
-  "menubar/file": [
-    ["workbench.action.files.newUntitledFile", "1_new", "wired"],
-    ["workbench.action.newWindow", "1_new", "stub", "New Window"],
-    ["workbench.action.newAgentsWindow", "1_new", "wired"],
-    ["menubar/file/newWindowWithProfile", "1_new", "sub", "New Window with Profile"],
-    ["workbench.action.files.openFile", "2_open", "wired"],
-    ["workbench.action.files.openFolder", "2_open", "wired"],
-    ["workbench.action.openWorkspace", "2_open", "wired", "Open Workspace from File..."],
-    ["menubar/file/recent", "2_open", "sub", "Open Recent"],
-    ["workbench.action.addRootFolder", "3_workspace", "wired"],
-    ["workbench.action.saveWorkspaceAs", "3_workspace", "wired", "Save Workspace As..."],
-    ["workbench.action.duplicateWorkspace", "3_workspace", "wired", "Duplicate Workspace"],
-    ["workbench.action.files.save", "4_save", "wired"],
-    ["workbench.action.files.saveAs", "4_save", "wired"],
-    ["workbench.action.files.saveAll", "4_save", "wired"],
-    ["menubar/file/share", "4_share", "sub", "Share"],
-    ["workbench.action.toggleAutoSave", "5_settings", "stub", "Auto Save", "false"],
-    ["menubar/file/preferences", "5_settings", "sub", "Preferences"],
-    ["workbench.action.files.revert", "6_close", "wired"],
-    ["workbench.action.closeActiveEditor", "6_close", "wired"],
-    ["workbench.action.closeFolder", "6_close", "stub", "Close Folder"],
-    ["workbench.action.closeWindow", "6_close", "wired"],
-    ["workbench.action.quit", "z_Exit", "wired"],
-  ],
-  "menubar/file/newWindowWithProfile": [
-    ["workbench.profiles.actions.createProfile", "2_new", "stub", "New Profile..."],
-  ],
-  "menubar/file/recent": [
-    ["workbench.action.reopenClosedEditor", "1_editor", "wired"],
-    ["workbench.action.openRecent", "y_more", "wired"],
-    ["workbench.action.clearRecentFiles", "z_clear", "wired"],
-  ],
-  "menubar/file/share": [
-    ["workbench.profiles.actions.exportProfile", "1_profiles", "stub", "Export Profile (Default)..."],
-  ],
-  "menubar/file/preferences": [
-    ["workbench.profiles.actions.manageProfiles", "1_settings", "stub", "Profiles"],
-    ["workbench.action.openSettings", "1_settings", "wired"],
-    ["workbench.view.extensions", "1_settings", "stub", "Extensions"],
-    ["workbench.action.openGlobalKeybindings", "1_settings", "stub", "Keyboard Shortcuts"],
-    ["workbench.action.openSnippets", "1_settings", "stub", "Configure Snippets"],
-    ["workbench.action.tasks.configureTaskRunner", "1_settings", "stub", "Tasks"],
-    ["menubar/file/preferences/themes", "1_settings", "sub", "Themes"],
-    ["workbench.action.openOnlineServicesSettings", "2_online", "stub", "Online Services Settings"],
-  ],
-  "menubar/file/preferences/themes": [
-    ["workbench.action.selectTheme", "1_themes", "stub", "Color Theme"],
-    ["workbench.action.selectIconTheme", "1_themes", "stub", "File Icon Theme"],
-    ["workbench.action.selectProductIconTheme", "1_themes", "stub", "Product Icon Theme"],
-  ],
-  "menubar/edit": [
-    ["undo", "1_do", "wired"],
-    ["redo", "1_do", "wired"],
-    ["editor.action.clipboardCutAction", "2_ccp", "wired"],
-    ["editor.action.clipboardCopyAction", "2_ccp", "wired"],
-    ["editor.action.clipboardPasteAction", "2_ccp", "wired"],
-    ["actions.find", "3_find", "wired"],
-    ["editor.action.startFindReplaceAction", "3_find", "wired"],
-    ["workbench.action.findInFiles", "4_findInFiles", "stub", "Find in Files"],
-    ["workbench.action.replaceInFiles", "4_findInFiles", "stub", "Replace in Files"],
-    ["editor.action.commentLine", "5_insert", "wired"],
-    ["editor.action.blockComment", "5_insert", "wired"],
-    ["editor.emmet.action.expandAbbreviation", "5_insert", "stub", "Emmet: Expand Abbreviation"],
-  ],
-  "menubar/selection": [
-    ["editor.action.selectAll", "1_basic", "wired"],
-    ["editor.action.smartSelect.expand", "1_basic", "wired"],
-    ["editor.action.smartSelect.shrink", "1_basic", "wired"],
-    ["editor.action.copyLinesUpAction", "2_line", "wired"],
-    ["editor.action.copyLinesDownAction", "2_line", "wired"],
-    ["editor.action.moveLinesUpAction", "2_line", "wired"],
-    ["editor.action.moveLinesDownAction", "2_line", "wired"],
-    ["editor.action.duplicateSelection", "2_line", "wired"],
-    ["editor.action.insertCursorAbove", "3_multi", "wired"],
-    ["editor.action.insertCursorBelow", "3_multi", "wired"],
-    ["editor.action.insertCursorAtEndOfEachLineSelected", "3_multi", "wired"],
-    ["editor.action.addSelectionToNextFindMatch", "3_multi", "wired"],
-    ["editor.action.addSelectionToPreviousFindMatch", "3_multi", "wired"],
-    ["editor.action.selectHighlights", "3_multi", "wired"],
-    ["editor.action.toggleMultiCursorModifier", "4_config", "stub", "Switch to Ctrl+Click for Multi-Cursor"],
-    ["editor.action.toggleColumnSelection", "4_config", "wired"],
-  ],
-  "menubar/view": [
-    ["workbench.action.showCommands", "1_open", "wired", "Command Palette..."],
-    ["workbench.action.quickOpenView", "1_open", "stub", "Open View..."],
-    ["menubar/view/appearance", "2_submenus", "sub", "Appearance"],
-    ["menubar/view/editorLayout", "2_submenus", "sub", "Editor Layout"],
-    ["workbench.view.explorer", "3_views", "wired"],
-    ["workbench.view.search", "3_views", "stub", "Search"],
-    ["workbench.view.scm", "3_views", "stub", "Source Control"],
-    ["workbench.view.debug", "3_views", "stub", "Run"],
-    ["workbench.view.extensions", "3_views", "stub", "Extensions"],
-    ["workbench.actions.view.problems", "4_panels", "stub", "Problems"],
-    ["workbench.action.output.toggleOutput", "4_panels", "stub", "Output"],
-    ["workbench.debug.action.toggleRepl", "4_panels", "stub", "Debug Console"],
-    ["workbench.action.terminal.toggleTerminal", "4_panels", "stub", "Terminal"],
-    ["editor.action.toggleWordWrap", "5_editor", "wired"],
-  ],
-  "menubar/view/appearance": [
-    ["workbench.action.toggleFullScreen", "1_toggle_view", "wired"],
-    ["workbench.action.toggleZenMode", "1_toggle_view", "stub", "Zen Mode"],
-    ["workbench.action.toggleCenteredLayout", "1_toggle_view", "stub", "Centered Layout"],
-    ["workbench.action.openBrowser", "1_toggle_view", "stub", "Open Browser"],
-    ["workbench.action.toggleMenuBar", "2_workbench_layout", "stub", "Menu Bar", "true"],
-    ["workbench.action.toggleSidebarVisibility", "2_workbench_layout", "wired"],
-    ["workbench.action.toggleAuxiliaryBar", "2_workbench_layout", "wired"],
-    ["workbench.action.toggleStatusbarVisibility", "2_workbench_layout", "wired"],
-    ["workbench.action.togglePanel", "2_workbench_layout", "stub", "Panel", "true"],
-    ["workbench.action.toggleSidebarPosition", "3_panel_layout", "stub", "Move Primary Side Bar Right"],
-    ["menubar/view/appearance/panelPosition", "3_panel_layout", "sub", "Panel Position"],
-    ["menubar/view/appearance/alignPanel", "3_panel_layout", "sub", "Align Panel"],
-    ["menubar/view/appearance/tabBar", "3_panel_layout", "sub", "Tab Bar"],
-    ["menubar/view/appearance/editorActionsPosition", "3_panel_layout", "sub", "Editor Actions Position"],
-    ["editor.action.toggleMinimap", "4_editor", "stub", "Minimap", "false"],
-    ["breadcrumbs.toggle", "4_editor", "stub", "Toggle Breadcrumbs"],
-    ["editor.action.toggleStickyScroll", "4_editor", "stub", "Sticky Scroll", "false"],
-    ["editor.action.toggleRenderWhitespace", "4_editor", "wired"],
-    ["editor.action.toggleRenderControlCharacter", "4_editor", "wired"],
-    ["workbench.action.zoomIn", "5_zoom", "wired"],
-    ["workbench.action.zoomOut", "5_zoom", "wired"],
-    ["workbench.action.zoomReset", "5_zoom", "wired"],
-  ],
-  "menubar/view/appearance/panelPosition": [
-    ["workbench.action.positionPanelTop", "1_position", "stub", "Top", "false"],
-    ["workbench.action.positionPanelLeft", "1_position", "stub", "Left", "false"],
-    ["workbench.action.positionPanelRight", "1_position", "stub", "Right", "false"],
-    ["workbench.action.positionPanelBottom", "1_position", "stub", "Bottom", "true"],
-  ],
-  "menubar/view/appearance/alignPanel": [
-    ["workbench.action.alignPanelCenter", "1_align", "stub", "Center", "true"],
-    ["workbench.action.alignPanelJustify", "1_align", "stub", "Justify", "false"],
-    ["workbench.action.alignPanelLeft", "1_align", "stub", "Left", "false"],
-    ["workbench.action.alignPanelRight", "1_align", "stub", "Right", "false"],
-  ],
-  "menubar/view/appearance/tabBar": [
-    ["workbench.action.showMultipleEditorTabs", "1_tabs", "stub", "Multiple Tabs", "true"],
-    ["workbench.action.showSingleEditorTab", "1_tabs", "stub", "Single Tab", "false"],
-    ["workbench.action.hideEditorTabs", "1_tabs", "stub", "Hidden", "false"],
-  ],
-  "menubar/view/appearance/editorActionsPosition": [
-    ["workbench.action.editorActionsPositionTabBar", "1_position", "stub", "Tab Bar", "true"],
-    ["workbench.action.editorActionsPositionTitleBar", "1_position", "stub", "Title Bar", "false"],
-    ["workbench.action.editorActionsPositionHidden", "1_position", "stub", "Hidden", "false"],
-  ],
-  "menubar/view/editorLayout": [
-    ["workbench.action.splitEditorUp", "1_split", "wired"],
-    ["workbench.action.splitEditorDown", "1_split", "wired"],
-    ["workbench.action.splitEditorLeft", "1_split", "wired"],
-    ["workbench.action.splitEditorRight", "1_split", "wired"],
-    ["workbench.action.splitEditorInGroup", "1_split_in_group", "stub", "Split in Group"],
-    ["workbench.action.moveEditorToNewWindow", "2_new_window", "stub", "Move Editor into New Window"],
-    ["workbench.action.copyEditorToNewWindow", "2_new_window", "stub", "Copy Editor into New Window"],
-    ["workbench.action.editorLayoutSingle", "3_layout", "stub", "Single"],
-    ["workbench.action.editorLayoutTwoColumns", "3_layout", "stub", "Two Columns"],
-    ["workbench.action.editorLayoutThreeColumns", "3_layout", "stub", "Three Columns"],
-    ["workbench.action.editorLayoutTwoRows", "3_layout", "stub", "Two Rows"],
-    ["workbench.action.editorLayoutThreeRows", "3_layout", "stub", "Three Rows"],
-    ["workbench.action.editorLayoutTwoByTwoGrid", "3_layout", "stub", "Grid (2x2)"],
-    ["workbench.action.editorLayoutTwoRowsRight", "3_layout", "stub", "Two Rows Right"],
-    ["workbench.action.editorLayoutTwoColumnsBottom", "3_layout", "stub", "Two Columns Bottom"],
-    ["workbench.action.toggleEditorGroupLayout", "4_flip", "stub", "Flip Layout"],
-  ],
-  "menubar/go": [
-    ["workbench.action.navigateBack", "1_back", "stub", "Back"],
-    ["workbench.action.navigateForward", "1_back", "stub", "Forward"],
-    ["workbench.action.navigateToLastEditLocation", "1_back", "stub", "Last Edit Location"],
-    ["menubar/go/switchEditor", "2_switch", "sub", "Switch Editor"],
-    ["menubar/go/switchGroup", "2_switch", "sub", "Switch Group"],
-    ["workbench.action.quickOpen", "3_global_nav", "wired"],
-    ["workbench.action.showAllSymbols", "3_global_nav", "stub", "Go to Symbol in Workspace..."],
-    ["workbench.action.gotoSymbol", "4_symbol_nav", "stub", "Go to Symbol in Editor..."],
-    ["editor.action.revealDefinition", "4_symbol_nav", "stub", "Go to Definition"],
-    ["editor.action.revealDeclaration", "4_symbol_nav", "stub", "Go to Declaration"],
-    ["editor.action.goToTypeDefinition", "4_symbol_nav", "stub", "Go to Type Definition"],
-    ["editor.action.goToImplementation", "4_symbol_nav", "stub", "Go to Implementations"],
-    ["workbench.action.addSymbolToCurrentChat", "4_symbol_nav", "stub", "Add Symbol to Current Chat"],
-    ["editor.action.goToReferences", "4_symbol_nav", "stub", "Go to References"],
-    ["workbench.action.addSymbolToNewChat", "4_symbol_nav", "stub", "Add Symbol to New Chat"],
-    ["workbench.action.gotoLine", "5_infile_nav", "wired"],
-    ["editor.action.jumpToBracket", "5_infile_nav", "wired"],
-    ["editor.action.marker.nextInFiles", "6_problem_nav", "wired"],
-    ["editor.action.marker.prevInFiles", "6_problem_nav", "wired"],
-    ["workbench.action.editor.nextChange", "7_change_nav", "stub", "Next Change"],
-    ["workbench.action.editor.previousChange", "7_change_nav", "stub", "Previous Change"],
-  ],
-  "menubar/go/switchEditor": [
-    ["workbench.action.nextEditor", "1_sideBySide", "wired"],
-    ["workbench.action.previousEditor", "1_sideBySide", "wired"],
-    ["workbench.action.openNextRecentlyUsedEditor", "2_used", "stub", "Next Used Editor"],
-    ["workbench.action.openPreviousRecentlyUsedEditor", "2_used", "stub", "Previous Used Editor"],
-    ["workbench.action.nextEditorInGroup", "3_group", "stub", "Next Editor in Group"],
-    ["workbench.action.previousEditorInGroup", "3_group", "stub", "Previous Editor in Group"],
-    ["workbench.action.openNextRecentlyUsedEditorInGroup", "4_used_group", "stub", "Next Used Editor in Group"],
-    ["workbench.action.openPreviousRecentlyUsedEditorInGroup", "4_used_group", "stub", "Previous Used Editor in Group"],
-  ],
-  "menubar/go/switchGroup": [
-    ["workbench.action.focusFirstEditorGroup", "1_by_index", "stub", "Group 1"],
-    ["workbench.action.focusSecondEditorGroup", "1_by_index", "stub", "Group 2"],
-    ["workbench.action.focusThirdEditorGroup", "1_by_index", "stub", "Group 3"],
-    ["workbench.action.focusFourthEditorGroup", "1_by_index", "stub", "Group 4"],
-    ["workbench.action.focusFifthEditorGroup", "1_by_index", "stub", "Group 5"],
-    ["workbench.action.focusNextGroup", "2_nav", "stub", "Next Group"],
-    ["workbench.action.focusPreviousGroup", "2_nav", "stub", "Previous Group"],
-    ["workbench.action.focusLeftGroup", "3_directional", "stub", "Group Left"],
-    ["workbench.action.focusRightGroup", "3_directional", "stub", "Group Right"],
-    ["workbench.action.focusAboveGroup", "3_directional", "stub", "Group Above"],
-    ["workbench.action.focusBelowGroup", "3_directional", "stub", "Group Below"],
-  ],
-  "menubar/run": [
-    ["workbench.action.newRunWindow", "0_run", "wired", "New Run Window"],
-    ["workbench.action.debug.start", "1_debug", "stub", "Start Debugging"],
-    ["workbench.action.debug.run", "1_debug", "stub", "Run Without Debugging"],
-    ["workbench.action.debug.stop", "1_debug", "stub", "Stop Debugging"],
-    ["workbench.action.debug.restart", "1_debug", "stub", "Restart Debugging"],
-    ["workbench.action.debug.configure", "2_configurations", "stub", "Open Configurations"],
-    ["workbench.action.debug.addConfiguration", "2_configurations", "stub", "Add Configuration..."],
-    ["workbench.action.debug.stepOver", "3_step", "stub", "Step Over"],
-    ["workbench.action.debug.stepInto", "3_step", "stub", "Step Into"],
-    ["workbench.action.debug.stepOut", "3_step", "stub", "Step Out"],
-    ["workbench.action.debug.continue", "3_step", "stub", "Continue"],
-    ["editor.debug.action.toggleBreakpoint", "4_breakpoints", "stub", "Toggle Breakpoint"],
-    ["menubar/run/newBreakpoint", "4_breakpoints", "sub", "New Breakpoint"],
-    ["editor.debug.action.enableAllBreakpoints", "5_breakpoints", "stub", "Enable All Breakpoints"],
-    ["editor.debug.action.disableAllBreakpoints", "5_breakpoints", "stub", "Disable All Breakpoints"],
-    ["editor.debug.action.removeAllBreakpoints", "5_breakpoints", "stub", "Remove All Breakpoints"],
-    ["workbench.action.debug.installAdditionalDebuggers", "6_install", "stub", "Install Additional Debuggers..."],
-  ],
-  "menubar/run/newBreakpoint": [
-    ["editor.debug.action.conditionalBreakpoint", "1_breakpoints", "stub", "Conditional Breakpoint..."],
-    ["editor.debug.action.editBreakpoint", "1_breakpoints", "stub", "Edit Breakpoint"],
-    ["editor.debug.action.toggleInlineBreakpoint", "1_breakpoints", "stub", "Inline Breakpoint"],
-    ["editor.debug.action.addFunctionBreakpoint", "1_breakpoints", "stub", "Function Breakpoint..."],
-    ["editor.debug.action.addLogpoint", "1_breakpoints", "stub", "Logpoint..."],
-    ["editor.debug.action.addTriggeredBreakpoint", "1_breakpoints", "stub", "Triggered Breakpoint..."],
-  ],
-  "menubar/terminal": [
-    ["workbench.action.terminal.new", "1_terminal", "stub", "New Terminal"],
-    ["workbench.action.terminal.split", "1_terminal", "stub", "Split Terminal"],
-    ["workbench.action.tasks.runTask", "2_tasks", "stub", "Run Task..."],
-    ["workbench.action.tasks.build", "2_tasks", "stub", "Run Build Task..."],
-    ["workbench.action.terminal.runActiveFile", "2_tasks", "stub", "Run Active File"],
-    ["workbench.action.terminal.runSelectedText", "2_tasks", "stub", "Run Selected Text"],
-    ["workbench.action.tasks.showTasks", "3_running", "stub", "Show Running Tasks..."],
-    ["workbench.action.tasks.restartTask", "3_running", "stub", "Restart Running Task..."],
-    ["workbench.action.tasks.terminateTask", "3_running", "stub", "Terminate Task..."],
-    ["workbench.action.tasks.configureTaskRunner", "4_configure", "stub", "Configure Tasks..."],
-    ["workbench.action.tasks.configureDefaultBuildTask", "4_configure", "stub", "Configure Default Build Task..."],
-  ],
-  "menubar/help": [
-    ["workbench.action.showCommands", "1_welcome", "wired", "Show All Commands"],
-    ["update.showCurrentReleaseNotes", "1_welcome", "stub", "Show Release Notes"],
-    ["workbench.action.openIssueReporter", "3_feedback", "stub", "Report Issue"],
-    ["workbench.action.giveFeedback", "3_feedback", "stub", "Give Feedback..."],
-    ["workbench.action.openLicenseUrl", "4_license", "stub", "View License"],
-    ["workbench.action.toggleDevTools", "5_devtools", "stub", "Toggle Developer Tools"],
-    ["workbench.action.openProcessExplorer", "5_devtools", "stub", "Open Process Explorer"],
-    ["workbench.action.openExtensionMonitor", "5_devtools", "stub", "Open Extension Monitor"],
-    ["workbench.action.showAboutDialog", "z_about", "wired"],
-  ],
-  "editor/title/context": [
-    ["workbench.action.closeActiveEditor", "1_close", "wired", "Close"],
-    ["workbench.action.closeOtherEditors", "1_close", "wired", "Close Others"],
-    ["workbench.action.closeEditorsToTheRight", "1_close", "stub", "Close to the Right"],
-    ["workbench.action.closeUnmodifiedEditors", "1_close", "stub", "Close Saved"],
-    ["workbench.action.closeAllEditors", "1_close", "stub", "Close All"],
-    ["workbench.action.reopenWithEditor", "1_open", "stub", "Reopen Editor With..."],
-    // The chat tab's own row: the tab menu opens with the clicked tab's type as activeEditor.
-    ["workbench.action.chat.rename", "2_chat", "wired", "Rename Chat"],
-    ["workbench.action.keepEditor", "3_preview", "stub", "Keep Open"],
-    ["workbench.action.pinEditor", "3_preview", "stub", "Pin"],
-    ["workbench.action.moveEditorToNewWindow", "7_new_window", "stub", "Move into New Window"],
-  ],
-};
-
-// --- Every spec row in its menu and group, in spec order ------------------------
-
-for (const [menu, rows] of Object.entries(SPEC)) {
-  const actual = Menus.getMenuItems(menu);
-  const actualIds = actual.map((row) => row.command ?? row.submenu);
-  const expectedIds = rows.map((row) => row[0]);
-  check(
-    `${menu}: exactly the spec's rows in spec order (got: ${actualIds.join(", ") || "none"})`,
-    actualIds.join("|") === expectedIds.join("|"),
-  );
-  for (const [id, group, , title] of rows) {
-    const row = actual.find((candidate) => (candidate.command ?? candidate.submenu) === id);
-    check(`${menu}: ${id} sits in group ${group}`, row !== undefined && row.group === group);
-    if (title !== undefined) {
-      const shown = row?.title ?? Commands.lookup(id)?.title;
-      check(`${menu}: ${id} is labeled '${title}' (got: '${shown}')`, shown === title);
-    }
-  }
-}
-
-// --- Every wired row f1, every stub disabled ------------------------------------
-
-const palette = new Set(Menus.getMenuItems("commandPalette").map((row) => row.command));
-const wiredIds = new Set();
-const stubIds = new Set();
-for (const rows of Object.values(SPEC)) {
-  for (const [id, , kind] of rows) {
-    if (kind === "wired") wiredIds.add(id);
-    if (kind === "stub") stubIds.add(id);
-  }
-}
-
-// Wired rows that deliberately omit f1: menu-only commands. New Run
-// Window is one menu row by design (no palette row, no keybinding), and
-// Close Others is a tab-menu row acting on the clicked tab's group, and Rename Chat
-// one acting on the clicked chat tab.
-const WIRED_WITHOUT_F1 = new Set([
-  "workbench.action.newRunWindow",
-  "workbench.action.closeOtherEditors",
-  "workbench.action.chat.rename",
-]);
-
-for (const id of wiredIds) {
-  if (WIRED_WITHOUT_F1.has(id)) {
-    check(`menu-only row '${id}' stays out of the palette`, !palette.has(id));
-    continue;
-  }
-  check(`wired row '${id}' reaches the palette (f1)`, palette.has(id));
-}
-for (const id of stubIds) {
-  const command = Commands.lookup(id);
-  check(`stub '${id}' is registered`, command !== undefined);
-  check(`stub '${id}' is always disabled`, command?.precondition === "false");
-  check(`stub '${id}' stays out of the palette`, !palette.has(id));
-}
-
-// --- The constant toggled expressions on checkable stub rows ---------------------
-
-for (const rows of Object.values(SPEC)) {
-  for (const [id, , kind, , toggled] of rows) {
-    if (kind === "stub" && toggled !== undefined) {
-      check(`stub '${id}' declares toggled '${toggled}'`, Commands.lookup(id)?.toggled === toggled);
-    }
-  }
-}
-
-// --- Shortcut labels the menu shows ---------------------------------------------------
-//
-// Three rows show a chord another command wins at dispatch: the chat pane's
-// Ctrl+Shift+I and Ctrl+Shift+L beat Toggle Developer Tools and Select All
-// Occurrences (agent-keybindings.mjs drives the presses), and Ctrl+Q opens
-// Open View... where the native menu once quit. The labels are still shown.
-
-const labelOf = (id) => KeybindingsRegistry.lookupKeybinding(id)?.getLabel();
-check("Toggle Developer Tools shows Ctrl+Shift+I", labelOf("workbench.action.toggleDevTools") === "Ctrl+Shift+I");
-check("Open View... shows Ctrl+Q", labelOf("workbench.action.quickOpenView") === "Ctrl+Q");
-check("Select All Occurrences shows Ctrl+Shift+L", labelOf("editor.action.selectHighlights") === "Ctrl+Shift+L");
-check(
-  "the Share flyout holds only Export Profile (Default)...",
-  Menus.getMenuItems("menubar/file/share").length === 1 && Commands.lookup("workbench.profiles.actions.importProfile") === undefined,
-);
-check(
-  "Share is alone in its group, between Save and Auto Save",
-  Menus.getMenuItems("menubar/file").filter((row) => row.group === "4_share").length === 1,
-);
-
-if (failures.length > 0) {
-  console.error(`menu-spec: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("menu-spec: all assertions passed");
diff --git a/crates/workshop/ui/test/menubar-submenu.mjs b/crates/workshop/ui/test/menubar-submenu.mjs
deleted file mode 100644
index 0ef8832ea..000000000
--- a/crates/workshop/ui/test/menubar-submenu.mjs
+++ /dev/null
@@ -1,531 +0,0 @@
-// Unit test for the menu popover widget (src/parts/menu/menu.ts): one
-// popover rebuilt at every open from the menu registry's getMenuItems,
-// command rows versus submenu rows, a single child-submenu slot opened
-// on hover (after 250ms) or ArrowRight (at once) and closed on ArrowLeft or
-// 750ms after the pointer moves to another row (recursive for nested
-// flyouts), rows firing on mouseup (press, drag, release) with the click a
-// press ends ignored, flyouts and context menus flipping to stay on
-// screen, a max height that leaves the menu room to scroll under a 7px
-// bar, group-boundary separators, empty submenus dropped, rows
-// hidden by a failing when, aria-disabled by a failing precondition,
-// menuitemcheckbox with aria-checked from toggled, shortcut labels from
-// the keybinding registry, the context value passed as the first run
-// argument, self-owned dismissal (Escape, outside pointer, window blur),
-// and rebuild-while-open only when a referenced context key changes with
-// focus restored by row key. Bundles the module with esbuild and drives
-// it against jsdom.
-// Run: node --test test/menubar-submenu.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { Menu } from "./src/parts/menu/menu.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry } from "@workshop/platform/menu-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const { Menu, CommandRegistry, MenuRegistry, ContextKeyService, createKeybindingsRegistry, registerService, STATUS_BAR } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Fixture: registries, keys, and a menu tree with two flyout levels -------
-
-const commands = new CommandRegistry();
-const menus = new MenuRegistry();
-const contextKeys = new ContextKeyService();
-const keybindings = createKeybindingsRegistry("linux");
-
-const canOpen = contextKeys.createKey("canOpen", false);
-const wordWrap = contextKeys.createKey("wordWrap", true);
-const unrelated = contextKeys.createKey("unrelated", false);
-
-const runs = [];
-commands.register("file.new", { title: "New File", run: (...args) => runs.push(["file.new", ...args]) });
-commands.register("file.open", { title: "Open", precondition: "canOpen", run: (...args) => runs.push(["file.open", ...args]) });
-commands.register("view.wordWrap", { title: "Word Wrap", toggled: "wordWrap", run: () => runs.push(["view.wordWrap"]) });
-commands.register("file.reopen", { title: "Reopen Closed Editor", run: () => runs.push(["file.reopen"]) });
-commands.register("file.deepAction", { title: "Deep Action", run: () => runs.push(["file.deepAction"]) });
-keybindings.registerKeybindingRule({ id: "file.new", keybinding: "ctrl+n" });
-
-menus.appendMenuItem("menubar/file", { command: "file.new" });
-menus.appendMenuItem("menubar/file", { command: "file.open" });
-menus.appendMenuItem("menubar/file", { command: "file.hidden", title: "Hidden", when: "canOpen" });
-menus.appendMenuItem("menubar/file", { submenu: "menubar/file/recent", title: "Recent", group: "1_recent" });
-menus.appendMenuItem("menubar/file", { submenu: "menubar/file/empty", title: "Empty", group: "1_recent" });
-menus.appendMenuItem("menubar/file", { command: "view.wordWrap", group: "2_view" });
-menus.appendMenuItem("menubar/file/recent", { command: "file.reopen" });
-menus.appendMenuItem("menubar/file/recent", { submenu: "menubar/file/recent/deep", title: "Deep", group: "1_deep" });
-menus.appendMenuItem("menubar/file/recent/deep", { command: "file.deepAction" });
-// The empty submenu has no rows at all; the widget drops its row.
-
-const anchor = window.document.createElement("button");
-anchor.type = "button";
-window.document.body.appendChild(anchor);
-
-const menu = new Menu({ menus, commands, contextKeys, keybindings });
-
-function popovers() {
-  return [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter((el) => !el.hidden);
-}
-function rowsOf(popover) {
-  return [...popover.querySelectorAll(":scope > .ws-window-titlebar__item")];
-}
-function rowByLabel(popover, label) {
-  return rowsOf(popover).find((row) => row.querySelector(".ws-window-titlebar__item-label")?.textContent === label);
-}
-function pressKey(key) {
-  window.document.dispatchEvent(new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }));
-}
-function pointerDownOn(target) {
-  target.dispatchEvent(new window.Event("pointerdown", { bubbles: true }));
-}
-function hover(target) {
-  target.dispatchEvent(new window.Event("pointerenter", { bubbles: false }));
-}
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function mouse(target, type, init = {}) {
-  return target.dispatchEvent(
-    new window.MouseEvent(type, { bubbles: true, cancelable: true, button: 0, detail: 1, ...init }),
-  );
-}
-
-// --- Open renders command and submenu rows, separators, shortcuts -------------
-
-menu.open("menubar/file", anchor);
-
-{
-  check("one popover is shown", popovers().length === 1);
-  const popover = popovers()[0];
-  check("the popover has role=menu", popover?.getAttribute("role") === "menu");
-  const labels = rowsOf(popover).map((row) => row.querySelector(".ws-window-titlebar__item-label")?.textContent);
-  check(
-    "rows render in sort order with the command title as the default label",
-    labels.join(",") === "New File,Open,Recent,Word Wrap",
-  );
-  check("every row is a type=button menuitem", rowsOf(popover).every((row) => row.type === "button"));
-  check(
-    "a when that fails hides the row",
-    rowByLabel(popover, "Hidden") === undefined,
-  );
-  check(
-    "an empty submenu is dropped",
-    rowByLabel(popover, "Empty") === undefined,
-  );
-  check(
-    "a group boundary renders a separator",
-    popover.querySelectorAll(".ws-window-titlebar__separator").length === 2,
-  );
-  const newRow = rowByLabel(popover, "New File");
-  check(
-    "the shortcut label comes from the keybinding registry",
-    newRow?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+N",
-  );
-  const recentRow = rowByLabel(popover, "Recent");
-  check(
-    "a submenu row has aria-haspopup and a collapsed state",
-    recentRow?.getAttribute("aria-haspopup") === "menu" && recentRow?.getAttribute("aria-expanded") === "false",
-  );
-}
-
-// --- Disabled and checked rendering -------------------------------------------
-
-{
-  const popover = popovers()[0];
-  const openRow = rowByLabel(popover, "Open");
-  check("a failing precondition renders aria-disabled", openRow?.getAttribute("aria-disabled") === "true");
-  openRow?.dispatchEvent(new window.Event("click", { bubbles: true }));
-  check("clicking a disabled row runs nothing", runs.length === 0);
-
-  const wrapRow = rowByLabel(popover, "Word Wrap");
-  check(
-    "a toggled row renders as a checked menuitemcheckbox",
-    wrapRow?.getAttribute("role") === "menuitemcheckbox" && wrapRow?.getAttribute("aria-checked") === "true",
-  );
-
-  wordWrap.set(false);
-  const wrapRowAfter = rowByLabel(popovers()[0], "Word Wrap");
-  check(
-    "a toggled-key change rebuilds the open menu unchecked",
-    wrapRowAfter?.getAttribute("aria-checked") === "false",
-  );
-
-  canOpen.set(true);
-  const after = popovers()[0];
-  check(
-    "a precondition-key change re-enables the row and reveals the gated row",
-    rowByLabel(after, "Open")?.getAttribute("aria-disabled") === "false" && rowByLabel(after, "Hidden") !== undefined,
-  );
-}
-
-// --- Rebuild while open restores focus by row key; unrelated keys do not ------
-
-{
-  const popover = popovers()[0];
-  const openRow = rowByLabel(popover, "Open");
-  openRow.focus();
-  check("the row holds focus", window.document.activeElement === openRow);
-  const before = rowByLabel(popovers()[0], "Open");
-  unrelated.set(true);
-  check(
-    "an unrelated key change does not rebuild",
-    rowByLabel(popovers()[0], "Open") === before && window.document.activeElement === before,
-  );
-  wordWrap.set(true);
-  const rebuilt = rowByLabel(popovers()[0], "Open");
-  check(
-    "a referenced key change rebuilds and restores focus by row key",
-    rebuilt !== before && window.document.activeElement === rebuilt,
-  );
-}
-
-// --- Flyout: opens 250ms after hover, closes 750ms after the pointer leaves ----
-
-{
-  const popover = popovers()[0];
-  hover(rowByLabel(popover, "Recent"));
-  check("hovering a submenu row does not open its flyout at once", popovers().length === 1);
-  await sleep(100);
-  check("the flyout is still closed before the 250ms show delay", popovers().length === 1);
-  await sleep(250);
-  check("hovering a submenu row opens its flyout after 250ms", popovers().length === 2);
-  check(
-    "the parent row reports the flyout expanded",
-    rowByLabel(popover, "Recent")?.getAttribute("aria-expanded") === "true",
-  );
-  const flyout = popovers()[1];
-  check(
-    "the flyout renders the child menu's rows",
-    rowByLabel(flyout, "Reopen Closed Editor") !== undefined && rowByLabel(flyout, "Deep") !== undefined,
-  );
-  check(
-    "a hover-opened flyout leaves the keyboard focus where it was",
-    window.document.activeElement !== rowByLabel(flyout, "Reopen Closed Editor"),
-  );
-
-  hover(rowByLabel(popover, "New File"));
-  check("hovering a command row leaves the flyout open at first", popovers().length === 2);
-  await sleep(400);
-  check("the flyout survives well inside the 750ms hide delay", popovers().length === 2);
-  await sleep(450);
-  check("the flyout closes 750ms after the pointer moved to a command row", popovers().length === 1);
-  check(
-    "the parent row reports the flyout collapsed",
-    rowByLabel(popover, "Recent")?.getAttribute("aria-expanded") === "false",
-  );
-}
-
-// --- Leaving a submenu row before 250ms cancels its open ------------------------
-
-{
-  const popover = popovers()[0];
-  hover(rowByLabel(popover, "Recent"));
-  await sleep(100);
-  hover(rowByLabel(popover, "New File"));
-  await sleep(300);
-  check("moving off a submenu row inside the show delay opens nothing", popovers().length === 1);
-}
-
-// --- Entering the flyout cancels the pending hide -------------------------------
-
-{
-  const popover = popovers()[0];
-  hover(rowByLabel(popover, "Recent"));
-  await sleep(300);
-  const flyout = popovers()[1];
-  hover(rowByLabel(popover, "New File"));
-  await sleep(300);
-  hover(flyout);
-  await sleep(700);
-  check("the pointer reaching the flyout inside the hide delay keeps it open", popovers().length === 2);
-  hover(rowByLabel(popover, "Word Wrap"));
-  await sleep(900);
-  check("leaving to a command row afterwards closes it after the delay", popovers().length === 1);
-}
-
-// --- Click on a submenu row opens at once; a sibling submenu replaces it after the delay ---
-
-{
-  const second = menus.appendMenuItem("menubar/file", { submenu: "menubar/file/other", title: "Other", group: "1_recent" });
-  const otherRow = menus.appendMenuItem("menubar/file/other", { command: "file.otherAction", title: "Other Action" });
-  commands.register("file.otherAction", { title: "Other Action", run: () => runs.push(["file.otherAction"]) });
-  menu.close();
-  menu.open("menubar/file", anchor);
-  const popover = popovers()[0];
-  rowByLabel(popover, "Recent").click();
-  check("clicking a submenu row opens its flyout immediately", popovers().length === 2);
-  hover(rowByLabel(popover, "Other"));
-  check("hovering a sibling submenu row keeps the first flyout until the delay", rowByLabel(popovers()[1], "Reopen Closed Editor") !== undefined);
-  await sleep(350);
-  check(
-    "after the delay the sibling's flyout replaces it",
-    popovers().length === 2 && rowByLabel(popovers()[1], "Other Action") !== undefined,
-  );
-  menu.close();
-  second.dispose();
-  otherRow.dispose();
-  menu.open("menubar/file", anchor);
-}
-
-// --- ArrowRight opens, ArrowLeft closes, nested flyouts recurse -----------------
-
-{
-  const popover = popovers()[0];
-  rowByLabel(popover, "Recent").focus();
-  pressKey("ArrowRight");
-  check("ArrowRight on a submenu row opens the flyout", popovers().length === 2);
-  const flyout = popovers()[1];
-  check(
-    "ArrowRight moves focus into the flyout's first row",
-    window.document.activeElement === rowByLabel(flyout, "Reopen Closed Editor"),
-  );
-
-  pressKey("ArrowDown");
-  check("ArrowDown moves focus within the flyout", window.document.activeElement === rowByLabel(flyout, "Deep"));
-  pressKey("ArrowRight");
-  check("ArrowRight opens a nested flyout", popovers().length === 3);
-  check(
-    "the nested flyout renders its rows",
-    rowByLabel(popovers()[2], "Deep Action") !== undefined,
-  );
-
-  pressKey("ArrowLeft");
-  check("ArrowLeft closes the nested flyout", popovers().length === 2);
-  check(
-    "ArrowLeft returns focus to the parent flyout row",
-    window.document.activeElement === rowByLabel(popovers()[1], "Deep"),
-  );
-  pressKey("ArrowLeft");
-  check("ArrowLeft closes the flyout", popovers().length === 1);
-  check(
-    "focus returns to the parent submenu row",
-    window.document.activeElement === rowByLabel(popovers()[0], "Recent"),
-  );
-}
-
-// --- Activation passes the context value and closes ----------------------------
-
-menu.close();
-runs.length = 0;
-menu.open("menubar/file", anchor, { path: "src/a.ts" });
-
-{
-  const popover = popovers()[0];
-  rowByLabel(popover, "New File").dispatchEvent(new window.Event("click", { bubbles: true }));
-  check("activating a row closes the menu", popovers().length === 0);
-  check(
-    "the context value is the run's first argument",
-    runs.length === 1 && runs[0][0] === "file.new" && runs[0][1]?.path === "src/a.ts",
-  );
-}
-
-// --- Rows fire on mouseup: press, drag, release ---------------------------------
-
-menu.close();
-runs.length = 0;
-menu.open("menubar/file", anchor);
-
-{
-  const row = rowByLabel(popovers()[0], "New File");
-  mouse(row, "mousedown");
-  check("pressing a row fires nothing yet", runs.length === 0 && popovers().length === 1);
-  mouse(row, "mouseup");
-  check(
-    "releasing on the row fires its command and closes the menu",
-    runs.length === 1 && runs[0][0] === "file.new" && popovers().length === 0,
-  );
-  mouse(row, "click");
-  check("the click that ends a press does not fire the command again", runs.length === 1);
-}
-
-menu.open("menubar/file", anchor);
-{
-  mouse(anchor, "mousedown");
-  mouse(rowByLabel(popovers()[0], "New File"), "mouseup");
-  check("press on the anchor, drag onto a row, release fires that row", runs.length === 2 && popovers().length === 0);
-}
-
-canOpen.set(false);
-menu.open("menubar/file", anchor);
-{
-  const popover = popovers()[0];
-  mouse(rowByLabel(popover, "New File"), "mouseup", { button: 2 });
-  check("a non-primary release fires nothing", runs.length === 2 && popovers().length === 1);
-  mouse(rowByLabel(popover, "Open"), "mouseup");
-  check("releasing on a disabled row runs nothing and keeps the menu open", runs.length === 2 && popovers().length === 1);
-  mouse(popover, "mouseup");
-  check("releasing on the popover's dead space runs nothing", runs.length === 2 && popovers().length === 1);
-  rowByLabel(popover, "New File").click();
-  check("a keyboard-style click (detail 0) still fires", runs.length === 3);
-}
-
-// --- Flipping and the max height --------------------------------------------------
-
-{
-  const rects = new WeakMap();
-  const rect = (left, top, width, height) => ({
-    left,
-    top,
-    width,
-    height,
-    right: left + width,
-    bottom: top + height,
-    x: left,
-    y: top,
-    toJSON() {},
-  });
-  const originalRect = window.HTMLElement.prototype.getBoundingClientRect;
-  window.HTMLElement.prototype.getBoundingClientRect = function () {
-    if (rects.has(this)) return rects.get(this);
-    if (this.classList.contains("ws-window-titlebar__popover")) return rect(0, 0, 200, 300);
-    return originalRect.call(this);
-  };
-  window.innerWidth = 1000;
-  window.innerHeight = 800;
-  const at = (popover) => [popover.style.left, popover.style.top, popover.style.maxHeight].join(" ");
-
-  menu.close();
-  menu.open("menubar/file", { x: 100, y: 100 });
-  check("a context menu with room opens at the pointer", at(popovers()[0]) === "100px 100px 665px");
-  check(
-    "a context menu is marked as one, for its fade",
-    popovers()[0].classList.contains("ws-window-titlebar__popover--context"),
-  );
-  menu.close();
-  menu.open("menubar/file", { x: 900, y: 700 });
-  check(
-    "a context menu flips left and up when it would leave the window",
-    at(popovers()[0]) === "700px 400px 365px",
-  );
-  menu.close();
-
-  rects.set(anchor, rect(950, 0, 40, 35));
-  menu.open("menubar/file", anchor);
-  check("a dropdown from the bar slides left to stay on screen", at(popovers()[0]) === "800px 35px 730px");
-  check(
-    "a dropdown has no fade and a menu scrollbar",
-    !popovers()[0].classList.contains("ws-window-titlebar__popover--context") &&
-      popovers()[0].classList.contains("scrollbar-menu"),
-  );
-  menu.close();
-
-  rects.set(anchor, rect(100, 0, 40, 35));
-  menu.open("menubar/file", anchor);
-  check("a dropdown with room opens under its button", at(popovers()[0]) === "100px 35px 730px");
-  const recentRow = rowByLabel(popovers()[0], "Recent");
-  rects.set(recentRow, rect(100, 120, 200, 22));
-  recentRow.click();
-  check("a flyout with room opens beside its parent row", at(popovers()[1]) === "300px 120px 645px");
-  menu.close();
-
-  menu.open("menubar/file", anchor);
-  const crowdedRow = rowByLabel(popovers()[0], "Recent");
-  rects.set(crowdedRow, rect(700, 120, 200, 22));
-  crowdedRow.click();
-  check("a flyout flips to the parent row's left side when the right has no room", at(popovers()[1]) === "500px 120px 645px");
-  menu.close();
-
-  menu.open("menubar/file", anchor);
-  const lowRow = rowByLabel(popovers()[0], "Recent");
-  rects.set(lowRow, rect(100, 700, 200, 22));
-  lowRow.click();
-  check("a flyout near the bottom shifts up to fit", at(popovers()[1]) === "300px 500px 265px");
-  menu.close();
-
-  window.HTMLElement.prototype.getBoundingClientRect = originalRect;
-}
-
-// --- A failed command: the registry reports it, the menu keeps the detail -------
-
-const statusMessages = [];
-const statusRegistration = registerService(STATUS_BAR, () => ({
-  showLocal: (label, severity) => statusMessages.push([label, severity]),
-}));
-commands.register("file.boom", { title: "Boom", category: "File", run: () => Promise.reject(new Error("kaboom")) });
-menus.appendMenuItem("menubar/file", { command: "file.boom", group: "9_z" });
-const reported = [];
-const failureWatch = commands.onDidFailCommand((failure) => reported.push(failure));
-const logged = [];
-const realConsoleError = console.error;
-console.error = (...args) => logged.push(args);
-
-menu.open("menubar/file", anchor);
-{
-  const popover = popovers()[0];
-  rowByLabel(popover, "Boom").dispatchEvent(new window.Event("click", { bubbles: true }));
-  await new Promise((resolve) => setTimeout(resolve, 0));
-  console.error = realConsoleError;
-  check("activating a failing row closes the menu", popovers().length === 0);
-  check(
-    "the registry reports the failed row's command with its palette label",
-    reported.length === 1 && reported[0].id === "file.boom" && reported[0].label === "File: Boom",
-  );
-  check(
-    "the menu logs the failure's detail on the console",
-    logged.length === 1 && String(logged[0][0]).includes("file.boom") && logged[0][1]?.message === "kaboom",
-  );
-  check("the menu posts nothing to the status bar for a failure", statusMessages.length === 0);
-}
-failureWatch.dispose();
-statusRegistration.dispose();
-
-// --- Dismissal: Escape, outside pointer, window blur ----------------------------
-
-menu.open("menubar/file", anchor);
-pressKey("Escape");
-check("Escape closes the menu", popovers().length === 0);
-check("Escape returns focus to the anchor", window.document.activeElement === anchor);
-
-menu.open("menubar/file", anchor);
-pointerDownOn(window.document.body);
-check("an outside pointer press closes the menu", popovers().length === 0);
-
-menu.open("menubar/file", anchor);
-pointerDownOn(popovers()[0]);
-check("an inside pointer press keeps the menu open", popovers().length === 1);
-window.dispatchEvent(new window.Event("blur"));
-check("window blur closes the menu", popovers().length === 0);
-
-menu.open("menubar/file", anchor);
-menu.dispose();
-check("dispose closes an open menu and removes its popover", window.document.querySelector(".ws-window-titlebar__popover") === null);
-
-if (failures.length > 0) {
-  console.error(`menubar-submenu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("menubar-submenu: all assertions passed");
diff --git a/crates/workshop/ui/test/menus.mjs b/crates/workshop/ui/test/menus.mjs
deleted file mode 100644
index 45bb2d792..000000000
--- a/crates/workshop/ui/test/menus.mjs
+++ /dev/null
@@ -1,260 +0,0 @@
-// Unit test for the command and menu registries in their platform home
-// (`@workshop/platform/command-registry`, `@workshop/platform/menu-registry`): the
-// CommandAction shape (run plus title/category/precondition/toggled
-// metadata, no label/shortcut/enabled), execute dispatching arguments and
-// awaiting async runs, upsert-by-id with self-only disposal; the MenuId
-// const object, MenuItem and SubmenuItem rows, appendMenuItem upsert,
-// setProvider dynamic rows merged with static rows, and getMenuItems
-// sorting (navigation group first, then groups lexically, then order,
-// then title) so group boundaries - never a separator item kind - fall
-// between contiguous group clusters. Also covers the workspace feature's
-// Open Recent provider: dynamic root and recent-file rows
-// merged with the static Reopen/More/Clear rows in sort order, and no
-// rows when roots and history are both empty. Bundles the modules with
-// esbuild and drives them DOM-free.
-// Run: node --test test/menus.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { CommandRegistry, Commands, registerCommand, executeCommand } from "@workshop/platform/command-registry";
-      export { MenuRegistry, Menus, MenuId, appendMenuItem } from "@workshop/platform/menu-registry";
-      export { createRecentMenuProvider } from "./src/parts/workspace/open-recent.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The provider's accept path imports the status-bar token, whose module
-  // pulls colocated CSS; the test drives only the JS.
-  loader: { ".css": "empty" },
-});
-const { CommandRegistry, MenuRegistry, MenuId, createRecentMenuProvider } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Command registry -----------------------------------------------------------
-
-{
-  const commands = new CommandRegistry();
-  let runs = 0;
-  let seenArgs = null;
-  const registration = commands.register("test.run", {
-    title: "Run",
-    category: "Test",
-    precondition: "isReady",
-    toggled: "isToggled",
-    run: (...args) => {
-      runs += 1;
-      seenArgs = args;
-    },
-  });
-  const found = commands.lookup("test.run");
-  check(
-    "a registered action round-trips with its metadata",
-    found?.title === "Run" && found?.category === "Test" && found?.precondition === "isReady" && found?.toggled === "isToggled",
-  );
-  check("an unknown command is not found", commands.lookup("test.nope") === undefined);
-
-  const executed = await commands.execute("test.run", "a", 2);
-  check("execute dispatches arguments and reports the run", executed === true && runs === 1 && seenArgs?.[0] === "a" && seenArgs?.[1] === 2);
-  check("execute reports an unknown command as not run", (await commands.execute("test.nope")) === false);
-
-  let resolved = false;
-  commands.register("test.async", {
-    run: () =>
-      new Promise((resolve) => {
-        setTimeout(() => {
-          resolved = true;
-          resolve();
-        }, 0);
-      }),
-  });
-  await commands.execute("test.async");
-  check("execute awaits an async run", resolved === true);
-
-  commands.register("test.run", { title: "Run Again", run: () => (runs += 10) });
-  await commands.execute("test.run");
-  check("re-registering upserts the action", runs === 11 && commands.lookup("test.run").title === "Run Again");
-  registration.dispose();
-  await commands.execute("test.run");
-  check("disposing the stale registration leaves the upsert in place", runs === 21);
-  const current = commands.lookup("test.run");
-  check("the upsert drops the stale metadata", current.category === undefined && current.precondition === undefined);
-
-  const disposable = commands.register("test.gone", { run: () => {} });
-  disposable.dispose();
-  check("disposing the current registration unregisters it", commands.lookup("test.gone") === undefined && (await commands.execute("test.gone")) === false);
-}
-
-// --- Menu registry: ids and rows --------------------------------------------------
-
-{
-  check(
-    "the MenuId const object defines the well-known ids",
-    MenuId.MenubarMainMenu === "menubar" && MenuId.MenubarFileMenu === "menubar/file" && MenuId.CommandPalette === "commandPalette",
-  );
-
-  const menus = new MenuRegistry();
-  menus.appendMenuItem(MenuId.MenubarFileMenu, { command: "file.save", title: "Save", group: "1_modification", order: 1 });
-  menus.appendMenuItem(MenuId.MenubarFileMenu, { command: "file.open", title: "Open", group: "navigation", order: 2 });
-  menus.appendMenuItem(MenuId.MenubarFileMenu, { command: "file.new", title: "New", group: "navigation", order: 1 });
-  menus.appendMenuItem(MenuId.MenubarFileMenu, { command: "file.untitled", title: "Untitled" });
-  const rows = menus.getMenuItems(MenuId.MenubarFileMenu);
-  check(
-    "rows sort navigation first, then groups lexically, then order",
-    rows.map((row) => row.command).join(",") === "file.untitled,file.new,file.open,file.save",
-  );
-  check("an ungrouped row joins the navigation group", rows[0].command === "file.untitled");
-  check(
-    "group clusters are contiguous so separators fall on boundaries",
-    rows.slice(0, 3).every((row) => (row.group ?? "navigation") === "navigation") && rows[3].group === "1_modification",
-  );
-
-  menus.appendMenuItem(MenuId.MenubarFileMenu, { command: "file.open", title: "Open…", group: "navigation", order: 0 });
-  const afterUpsert = menus.getMenuItems(MenuId.MenubarFileMenu);
-  check(
-    "an item upsert replaces the row without duplicating it",
-    afterUpsert.length === 4 && afterUpsert[0].command === "file.open" && afterUpsert[0].title === "Open…",
-  );
-
-  const titles = [
-    { command: "zeta", title: "Beta", group: "g", order: 1 },
-    { command: "alpha", title: "Alpha", group: "g", order: 1 },
-  ];
-  for (const item of titles) menus.appendMenuItem("menu/titles", item);
-  check(
-    "equal group and order fall back to title",
-    menus.getMenuItems("menu/titles").map((row) => row.title).join(",") === "Alpha,Beta",
-  );
-}
-
-// --- Menu registry: submenus, providers, disposal -----------------------------------
-
-{
-  const menus = new MenuRegistry();
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: MenuId.MenubarFileMenu, title: "File", order: 1 });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/edit", title: "Edit", order: 2 });
-  const top = menus.getMenuItems(MenuId.MenubarMainMenu);
-  check(
-    "a top-level menu is a submenu row on the main menu",
-    top.length === 2 && top[0].submenu === "menubar/file" && top[0].title === "File" && top[1].submenu === "menubar/edit",
-  );
-
-  menus.appendMenuItem("menu/recent", { command: "reopen", title: "Reopen Closed Editor", group: "1_reopen", order: 1 });
-  menus.appendMenuItem("menu/recent", { command: "more", title: "More…", group: "3_more", order: 1 });
-  let recent = ["a.ts", "b.ts"];
-  const providerDisposable = menus.setProvider("menu/recent", () =>
-    recent.map((name, index) => ({ command: `open:${name}`, title: name, group: "2_history", order: index })),
-  );
-  const merged = menus.getMenuItems("menu/recent");
-  check(
-    "provider rows merge with static rows in sort order",
-    merged.map((row) => row.title).join(",") === "Reopen Closed Editor,a.ts,b.ts,More…",
-  );
-  recent = ["c.ts"];
-  check(
-    "provider rows are re-read at every call",
-    menus.getMenuItems("menu/recent").map((row) => row.title).join(",") === "Reopen Closed Editor,c.ts,More…",
-  );
-  providerDisposable.dispose();
-  check(
-    "disposing the provider drops its rows",
-    menus.getMenuItems("menu/recent").map((row) => row.title).join(",") === "Reopen Closed Editor,More…",
-  );
-
-  const stale = menus.appendMenuItem("menu/disp", { command: "one", title: "One" });
-  menus.appendMenuItem("menu/disp", { command: "one", title: "One Again" });
-  stale.dispose();
-  check(
-    "disposing a stale row leaves its upsert in place",
-    menus.getMenuItems("menu/disp").map((row) => row.title).join(",") === "One Again",
-  );
-  const live = menus.appendMenuItem("menu/disp", { command: "two", title: "Two" });
-  live.dispose();
-  check(
-    "disposing a live row removes only it",
-    menus.getMenuItems("menu/disp").map((row) => row.title).join(",") === "One Again",
-  );
-}
-
-// --- Open Recent: the workspace provider's dynamic rows -----------------------
-
-{
-  const menus = new MenuRegistry();
-  menus.appendMenuItem(MenuId.MenubarRecentMenu, {
-    command: "workbench.action.reopenClosedEditor",
-    title: "Reopen Closed Editor",
-    group: "1_editor",
-  });
-  menus.appendMenuItem(MenuId.MenubarRecentMenu, {
-    command: "workbench.action.openRecent",
-    title: "More...",
-    group: "y_more",
-  });
-  menus.appendMenuItem(MenuId.MenubarRecentMenu, {
-    command: "workbench.action.clearRecentFiles",
-    title: "Clear Recently Opened...",
-    group: "z_clear",
-  });
-
-  const rootsListing = {
-    path: null,
-    entries: [
-      { name: "alpha", path: "C:\\alpha", kind: "directory", size: 0, modifiedMs: 1, exists: true },
-      { name: "beta", path: "C:\\beta", kind: "directory", size: 0, modifiedMs: 2, exists: true },
-    ],
-  };
-  const treeState = { listing: (path) => (path === "" ? rootsListing : undefined) };
-  const recentFiles = { list: ["C:\\alpha\\one.ts", "C:\\beta\\two.ts"] };
-  menus.setProvider(MenuId.MenubarRecentMenu, createRecentMenuProvider({ treeState, recentFiles }));
-
-  const rows = menus.getMenuItems(MenuId.MenubarRecentMenu);
-  check(
-    "Open Recent merges roots and recent files with the static rows in sort order",
-    rows.map((row) => row.title).join(",") ===
-      "Reopen Closed Editor,alpha,beta,one.ts,two.ts,More...,Clear Recently Opened...",
-  );
-  const rootRow = rows.find((row) => row.title === "alpha");
-  check(
-    "a root row dispatches vscode.openFolder with the root path",
-    rootRow?.command === "vscode.openFolder" && rootRow?.args?.[0] === "C:\\alpha" && rootRow?.group === "2_roots",
-  );
-  const fileRow = rows.find((row) => row.title === "one.ts");
-  check(
-    "a recent-file row dispatches vscode.open with the file path",
-    fileRow?.command === "vscode.open" && fileRow?.args?.[0] === "C:\\alpha\\one.ts" && fileRow?.group === "3_files",
-  );
-
-  const empty = new MenuRegistry();
-  empty.setProvider(
-    MenuId.MenubarRecentMenu,
-    createRecentMenuProvider({ treeState: { listing: () => undefined }, recentFiles: { list: [] } }),
-  );
-  check(
-    "the provider answers no rows when roots and history are both empty",
-    empty.getMenuItems(MenuId.MenubarRecentMenu).length === 0,
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`menus: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("menus: all assertions passed");
diff --git a/crates/workshop/ui/test/mic-meter.mjs b/crates/workshop/ui/test/mic-meter.mjs
deleted file mode 100644
index 67c7e6dc8..000000000
--- a/crates/workshop/ui/test/mic-meter.mjs
+++ /dev/null
@@ -1,301 +0,0 @@
-// The status bar mic meter (parts/status/mic-meter.ts): a slot left of
-// the record LED that draws the shared capture's last METER_BARS levels,
-// newest on the right, on animation frames it requests only while capture
-// has an owner. Idle, the bars rest as dots and no frame is scheduled; the
-// tooltip and accessible label name the owner; a click reveals the owner
-// and does nothing without one; the owner's release returns the meter to
-// idle. Drives a real StatusBar and SpeechCaptureService (behind a
-// scripted backend) against jsdom built from the real index.html, with a
-// hand-cranked requestAnimationFrame.
-// Run: node --test test/mic-meter.mjs
-import assert from "node:assert/strict";
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-const html = await readFile(path.join(uiDir, "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { StatusBar } from "./src/parts/status/status-bar.ts";
-      export { MicMeter, METER_BARS } from "./src/parts/status/mic-meter.ts";
-      export { SpeechCaptureService } from "./src/services/speech-capture.ts";
-    `,
-    resolveDir: uiDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Element = window.Element;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Node = window.Node;
-globalThis.getComputedStyle = window.getComputedStyle.bind(window);
-
-// A hand-cranked animation clock: frame requests queue here, and
-// runFrames() runs the queued callbacks the way one display refresh would.
-const frames = new Map();
-let nextFrame = 1;
-let requested = 0;
-const requestFrame = (callback) => {
-  requested += 1;
-  const id = nextFrame++;
-  frames.set(id, callback);
-  return id;
-};
-const cancelFrame = (id) => {
-  frames.delete(id);
-};
-window.requestAnimationFrame = requestFrame;
-window.cancelAnimationFrame = cancelFrame;
-globalThis.requestAnimationFrame = requestFrame;
-globalThis.cancelAnimationFrame = cancelFrame;
-function runFrames() {
-  const due = [...frames.values()];
-  frames.clear();
-  for (const callback of due) callback(0);
-}
-
-const bundlePath = path.join(os.tmpdir(), "runvil-mic-meter-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, StatusBar, MicMeter, METER_BARS, SpeechCaptureService } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-// A PCM16 square wave whose chunkLevel reads `level`: the level maps -60
-// dBFS to 0 and full scale to 1, and a square wave's RMS is its amplitude.
-function chunkAt(level) {
-  const amplitude = Math.round(32_767 * 10 ** (-3 * (1 - level)));
-  const view = new DataView(new ArrayBuffer(480 * 2));
-  for (let index = 0; index < 480; index++) {
-    view.setInt16(index * 2, index % 2 === 0 ? amplitude : -amplitude, true);
-  }
-  return view.buffer;
-}
-
-// One status bar holding the record LED, a capture service whose scripted
-// backend hands its emit to the test (optionally emitting one chunk while
-// the graph is still opening), and the meter under test.
-function harness(options = {}) {
-  frames.clear();
-  requested = 0;
-  const bar = new StatusBar();
-  const record = bar.register({ id: "recording", name: "Recording indicator", order: 0 });
-  const h = {
-    bar,
-    emit: null,
-    owner: Symbol("agent"),
-    name: "Session (Agent)",
-    reveals: 0,
-  };
-  h.presence = {
-    label: () => h.name,
-    reveal: () => {
-      h.reveals += 1;
-    },
-  };
-  h.capture = new SpeechCaptureService({
-    async open(emitAudio) {
-      h.emit = emitAudio;
-      if (options.chunkWhileOpening !== undefined) {
-        emitAudio(options.chunkWhileOpening);
-      }
-      return { clear() {}, async stop() {}, dispose() {} };
-    },
-  });
-  h.meter = new MicMeter(bar, h.capture);
-  h.element = window.document.querySelector('.status-bar__indicators > [data-indicator="mic-meter"]');
-  h.levels = () =>
-    [...h.element.querySelectorAll(".status-bar__meter-bar")].map((bar) =>
-      Number(bar.style.getPropertyValue("--level")),
-    );
-  h.idle = () => h.element.classList.contains("status-bar__meter--idle");
-  h.start = async () => {
-    const outcome = await h.capture.start(h.owner, h.presence);
-    assert.equal(outcome.ok, true, "the scripted capture starts");
-  };
-  h.dispose = () => {
-    h.meter.dispose();
-    h.capture.dispose();
-    record.dispose();
-    bar.dispose();
-  };
-  return h;
-}
-
-function assertLevels(actual, expected, message) {
-  assert.equal(actual.length, expected.length, `${message}: bar count`);
-  actual.forEach((level, index) => {
-    assert.ok(
-      Math.abs(level - expected[index]) < 0.01,
-      `${message}: bar ${index} reads ${level}, expected ${expected[index]} (all: ${actual.join(", ")})`,
-    );
-  });
-}
-
-const dots = () => Array.from({ length: METER_BARS }, () => 0);
-
-test("the meter is a button of nine bars left of the record LED", async () => {
-  await assertNoLeaks(lifecycle, () => {
-    const h = harness();
-    assert.equal(METER_BARS, 9);
-    assert.equal(h.element?.tagName, "BUTTON", "the meter renders as a button");
-    const order = [...window.document.querySelectorAll(".status-bar__indicators > *")].map(
-      (el) => el.dataset.indicator,
-    );
-    assert.deepEqual(order, ["mic-meter", "recording"], "the meter stands left of the record LED");
-    assert.equal(h.element.querySelectorAll(".status-bar__meter-bar").length, METER_BARS);
-    h.dispose();
-  });
-});
-
-test("idle shows dots and schedules no frames", async () => {
-  await assertNoLeaks(lifecycle, () => {
-    const h = harness();
-    assert.equal(h.idle(), true, "a meter with no owner is idle");
-    assertLevels(h.levels(), dots(), "idle bars rest as dots");
-    assert.equal(requested, 0, "an idle meter requests no animation frame");
-    h.dispose();
-  });
-});
-
-test("a level that arrives before the owner is recorded draws nothing", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness({ chunkWhileOpening: chunkAt(0.9) });
-    await h.start();
-    assert.equal(requested, 0, "an unowned level requests no frame");
-    runFrames();
-    assertLevels(h.levels(), dots(), "the unowned level never reaches the bars");
-    h.dispose();
-  });
-});
-
-test("bars scroll right to left as levels arrive", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    await h.start();
-    assert.equal(h.idle(), false, "an owned meter is live");
-    h.emit(chunkAt(0.2));
-    h.emit(chunkAt(0.5));
-    assertLevels(h.levels(), dots(), "levels wait for the next frame");
-    assert.equal(frames.size, 1, "two levels in one frame share one frame request");
-    runFrames();
-    assertLevels(h.levels(), [0, 0, 0, 0, 0, 0, 0, 0.2, 0.5], "the newest level is rightmost");
-    h.emit(chunkAt(0.8));
-    runFrames();
-    assertLevels(h.levels(), [0, 0, 0, 0, 0, 0, 0.2, 0.5, 0.8], "earlier levels move left");
-    const latest = [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9];
-    for (const level of latest) h.emit(chunkAt(level));
-    runFrames();
-    assertLevels(h.levels(), latest, "only the last METER_BARS levels stay");
-    assert.equal(frames.size, 0, "no frame is requested without a new level");
-    h.dispose();
-  });
-});
-
-test("the tooltip and accessible label name the owner", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    assert.equal(h.element.title, "", "an idle meter has no tooltip");
-    await h.start();
-    assert.match(h.element.title, /Session \(Agent\)/, "the tooltip names the owner");
-    assert.match(h.element.getAttribute("aria-label"), /Session \(Agent\)/, "the label names the owner");
-    h.name = "Renamed (Agent)";
-    h.emit(chunkAt(0.4));
-    runFrames();
-    assert.match(h.element.title, /Renamed \(Agent\)/, "a renamed owner shows on the next frame");
-    assert.match(h.element.getAttribute("aria-label"), /Renamed \(Agent\)/);
-    await h.capture.stop(h.owner);
-    assert.equal(h.element.title, "", "the released meter drops the tooltip");
-    assert.doesNotMatch(h.element.getAttribute("aria-label"), /Agent/, "the released label names nobody");
-    h.dispose();
-  });
-});
-
-test("a click calls the owner's reveal", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    await h.start();
-    h.element.click();
-    assert.equal(h.reveals, 1, "one click reveals the owner once");
-    h.dispose();
-  });
-});
-
-test("a click with no owner does nothing", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    h.element.click();
-    assert.equal(h.reveals, 0, "a click before any owner reveals nothing");
-    await h.start();
-    await h.capture.stop(h.owner);
-    h.element.click();
-    assert.equal(h.reveals, 0, "a click after the owner released reveals nothing");
-    h.dispose();
-  });
-});
-
-test("the meter returns to idle when the owner releases the microphone", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    await h.start();
-    h.emit(chunkAt(0.5));
-    runFrames();
-    h.emit(chunkAt(0.7));
-    assert.equal(frames.size, 1, "a level is waiting for its frame");
-    await h.capture.stop(h.owner);
-    assert.equal(h.idle(), true, "the released meter is idle");
-    assertLevels(h.levels(), dots(), "the released meter rests as dots at once");
-    assert.equal(frames.size, 0, "the release cancels the pending frame");
-    const before = requested;
-    h.emit(chunkAt(0.9));
-    assert.equal(requested, before, "a stray level after the release requests no frame");
-    h.dispose();
-  });
-});
-
-test("the meter returns to idle when the capture service disposes", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    await h.start();
-    h.emit(chunkAt(0.6));
-    runFrames();
-    h.capture.dispose();
-    assert.equal(h.idle(), true, "the meter idles with the disposed capture");
-    assertLevels(h.levels(), dots(), "the bars rest as dots");
-    h.dispose();
-  });
-});
-
-test("disposing the meter removes its slot and stops drawing", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    const h = harness();
-    await h.start();
-    h.emit(chunkAt(0.5));
-    h.meter.dispose();
-    assert.equal(h.element.isConnected, false, "the slot leaves the bar");
-    assert.equal(frames.size, 0, "the pending frame is canceled");
-    const before = requested;
-    h.emit(chunkAt(0.5));
-    assert.equal(requested, before, "a disposed meter requests no frame");
-    h.dispose();
-  });
-});
diff --git a/crates/workshop/ui/test/mode-chip.mjs b/crates/workshop/ui/test/mode-chip.mjs
deleted file mode 100644
index ea36e3bfd..000000000
--- a/crates/workshop/ui/test/mode-chip.mjs
+++ /dev/null
@@ -1,402 +0,0 @@
-// The mode chip (src/parts/agent/mode-chip.ts) in jsdom: a button showing the
-// current mode's codicon, label, and chevron, with the tooltip "Switch Agent
-// Mode (Ctrl+.)". Clicking opens a DropdownMenu of Cursor's five modes on the
-// composer's menu surface: a description under each label, a check-only
-// selection, opening above the chip at its left edge minus 6px. Picking one
-// updates the chip and fires "agent-mode-changed" on document with the mode
-// as detail, and onDidChangeMode; re-picking the current mode fires nothing;
-// openOrCycle (Ctrl+. and Shift+Tab) opens the menu and, while it is open,
-// cycles to the next mode; dispose() closes an open menu. The stylesheet's
-// side - the 20px chip, the tints, hiding the label below 300px of composer -
-// is read from the source text. Runs under the shared leak check: a ModeChip
-// left undisposed fails.
-// Run: node test/mode-chip.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { AGENT_MODE_CHANGED_EVENT, ModeChip, UNIFIED_MODES } from "./src/parts/agent/mode-chip.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// The chip reads the DOM globals when it builds, so the jsdom globals must
-// exist before the bundle is imported.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.HTMLElement = dom.window.HTMLElement;
-globalThis.HTMLButtonElement = dom.window.HTMLButtonElement;
-globalThis.Element = dom.window.Element;
-globalThis.Node = dom.window.Node;
-globalThis.CustomEvent = dom.window.CustomEvent;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-mode-chip-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { AGENT_MODE_CHANGED_EVENT, ModeChip, UNIFIED_MODES, lifecycle } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function menuEl() {
-  return document.querySelector(".menu-popup");
-}
-
-function menuItems() {
-  return [...(menuEl()?.querySelectorAll(".menu-item") ?? [])];
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- The mode constants ----------------------------------------------------
-
-  check(
-    "the modes are a fixed as-const map",
-    UNIFIED_MODES.Agent === "agent" &&
-      UNIFIED_MODES.Plan === "plan" &&
-      UNIFIED_MODES.Debug === "debug" &&
-      UNIFIED_MODES.Multitask === "multitask" &&
-      UNIFIED_MODES.Ask === "ask",
-  );
-  check(
-    "the mode-changed event name is a fixed literal",
-    AGENT_MODE_CHANGED_EVENT === "agent-mode-changed",
-  );
-
-  // --- The trigger -----------------------------------------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    check(
-      "the chip is a type=button trigger",
-      chip.element.tagName === "BUTTON" && chip.element.type === "button",
-    );
-    check(
-      "the chip has the ws-mode-chip class",
-      chip.element.classList.contains("ws-mode-chip"),
-    );
-    check("the chip starts on the agent mode", chip.mode === "agent");
-    check(
-      "the chip shows the current mode's label and icon",
-      chip.element.querySelector(".ws-mode-chip__label")?.textContent === "Agent" &&
-        chip.element.querySelector(".ws-mode-chip__icon svg") !== null &&
-        chip.element.querySelector(".ws-mode-chip__chevron svg") !== null,
-    );
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  // --- The dropdown ------------------------------------------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    chip.element.click();
-    check("clicking the chip opens the dropdown", menuEl() !== null);
-    const items = menuItems();
-    const labels = items.map(
-      (item) => item.querySelector(".menu-item__label")?.textContent,
-    );
-    check(
-      "the dropdown lists Cursor's five modes in order",
-      items.length === 5 &&
-        labels.join(",") === "Agent,Plan,Debug,Multitask,Ask",
-    );
-    check(
-      "the current mode row shows the codicon check, and only that row",
-      items[0]?.querySelector(".menu-item__check svg") !== null &&
-        items.slice(1).every((item) => item.querySelector(".menu-item__check") === null),
-    );
-    check(
-      "every mode item renders its icon",
-      items.every((item) => item.querySelector(".menu-item__icon svg") !== null),
-    );
-    check(
-      "every mode row carries Cursor's description under its label",
-      items
-        .map((item) => item.querySelector(".menu-item__description")?.textContent)
-        .join("|") ===
-        [
-          "Plan, search, build anything",
-          "Create detailed plans for accomplishing tasks",
-          "Systematically diagnose and fix bugs using runtime traces",
-          "Run and coordinate multiple tasks in parallel",
-          "Ask Cursor questions about your codebase",
-        ].join("|"),
-    );
-    check(
-      "the menu wears the composer surface, sized by the mode menu class",
-      menuEl()?.classList.contains("menu-composer") === true &&
-        menuEl()?.classList.contains("ws-mode-menu") === true,
-    );
-    check(
-      "the trigger gains the menu's aria wiring",
-      chip.element.getAttribute("aria-haspopup") === "menu" &&
-        chip.element.getAttribute("aria-expanded") === "true",
-    );
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  // --- Selection -----------------------------------------------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    const events = [];
-    const onModeChanged = (event) => events.push(event);
-    document.addEventListener(AGENT_MODE_CHANGED_EVENT, onModeChanged);
-
-    const agentIconHtml = chip.element.querySelector(".ws-mode-chip__icon")?.innerHTML;
-    chip.element.click();
-    menuItems()[1]?.click();
-    check(
-      "selecting a mode changes the chip label",
-      chip.element.querySelector(".ws-mode-chip__label")?.textContent === "Plan",
-    );
-    check(
-      "selecting a mode changes the chip icon",
-      chip.element.querySelector(".ws-mode-chip__icon svg") !== null &&
-        chip.element.querySelector(".ws-mode-chip__icon")?.innerHTML !== agentIconHtml,
-    );
-    check("selecting a mode updates the chip's mode", chip.mode === "plan");
-    check(
-      "selecting a mode fires agent-mode-changed once with the mode as detail",
-      events.length === 1 && events[0]?.detail === "plan",
-    );
-    check("selecting a mode closes the dropdown", menuEl() === null);
-
-    chip.element.click();
-    menuItems()[1]?.click();
-    check("re-selecting the current mode fires no event", events.length === 1);
-
-    document.removeEventListener(AGENT_MODE_CHANGED_EVENT, onModeChanged);
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  // --- The tooltip, the placement, and the change event ---------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    check(
-      "the chip's tooltip is Switch Agent Mode (Ctrl+.)",
-      chip.element.title === "Switch Agent Mode (Ctrl+.)",
-    );
-    chip.element.getBoundingClientRect = () => ({
-      x: 40, y: 300, left: 40, right: 100, top: 300, bottom: 320, width: 60, height: 20, toJSON: () => ({}),
-    });
-    chip.element.click();
-    check(
-      "the menu opens at the chip's left edge minus 6px",
-      menuEl()?.style.left === "34px",
-    );
-    check(
-      "the menu opens above the chip",
-      Number.parseFloat(menuEl()?.style.top ?? "9999") < 300,
-    );
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    const seen = [];
-    const subscription = chip.onDidChangeMode((mode) => seen.push(mode));
-    chip.element.click();
-    menuItems()[4]?.click();
-    check("onDidChangeMode fires with the picked mode", seen.join(",") === "ask" && chip.mode === "ask");
-    check(
-      "the chip carries its mode as data-mode for the tint",
-      chip.element.dataset.mode === "ask",
-    );
-    chip.element.click();
-    menuItems()[4]?.click();
-    check("re-picking the current mode fires no change event", seen.length === 1);
-    subscription.dispose();
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  // --- openOrCycle: Ctrl+. and Shift+Tab ------------------------------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    const seen = [];
-    chip.onDidChangeMode((mode) => seen.push(mode));
-    chip.openOrCycle();
-    check("the first press opens the menu without changing the mode", menuEl() !== null && seen.length === 0);
-    chip.openOrCycle();
-    check(
-      "pressing again cycles to the next mode and keeps the menu open on it",
-      chip.mode === "plan" &&
-        menuEl() !== null &&
-        menuItems()[1]?.querySelector(".menu-item__check") !== null &&
-        menuItems()[0]?.querySelector(".menu-item__check") === null,
-    );
-    chip.openOrCycle();
-    chip.openOrCycle();
-    chip.openOrCycle();
-    check("cycling walks Debug, Multitask, Ask in menu order", seen.join(",") === "plan,debug,multitask,ask");
-    chip.openOrCycle();
-    check("cycling wraps from Ask back to Agent", chip.mode === "agent" && seen.at(-1) === "agent");
-
-    // Shift+Tab with the menu open and focus in it: the document listener cycles
-    // instead of the menu treating Tab as its dismissal.
-    const before = chip.mode;
-    menuEl()?.dispatchEvent(
-      new dom.window.KeyboardEvent("keydown", { key: "Tab", shiftKey: true, bubbles: true, cancelable: true }),
-    );
-    check(
-      "Shift+Tab in the open menu cycles the mode and leaves the menu open",
-      chip.mode !== before && menuEl() !== null,
-    );
-    chip.dispose();
-    chip.element.remove();
-  }
-
-  // dispose() closes the menu before anything else, and the Shift+Tab handler
-  // acts only while the menu is open, so a keypress after dispose cannot tell a
-  // removed listener from a leaked one. Watch the document's registrations
-  // directly: every capture keydown listener a chip adds must be the one its
-  // dispose removes.
-  {
-    const added = [];
-    const removed = [];
-    const realAdd = document.addEventListener;
-    const realRemove = document.removeEventListener;
-    document.addEventListener = function addEventListener(type, listener, options) {
-      added.push({ type, listener, options });
-      return realAdd.call(this, type, listener, options);
-    };
-    document.removeEventListener = function removeEventListener(type, listener, options) {
-      removed.push({ type, listener, options });
-      return realRemove.call(this, type, listener, options);
-    };
-    let chip;
-    try {
-      chip = new ModeChip();
-      document.body.appendChild(chip.element);
-      const keydownBeforeDispose = added.filter((entry) => entry.type === "keydown");
-      check(
-        "a chip listens for Shift+Tab with one capture keydown listener on the document",
-        keydownBeforeDispose.length === 1 && keydownBeforeDispose[0]?.options === true,
-      );
-      check("nothing is removed while the chip lives", removed.length === 0);
-      chip.dispose();
-    } finally {
-      document.addEventListener = realAdd;
-      document.removeEventListener = realRemove;
-    }
-    const registered = added.find((entry) => entry.type === "keydown");
-    check(
-      "dispose removes that same keydown listener with the same capture flag",
-      registered !== undefined &&
-        removed.some(
-          (entry) =>
-            entry.type === "keydown" && entry.listener === registered.listener && entry.options === registered.options,
-        ),
-    );
-    chip.element.remove();
-  }
-
-  // --- The stylesheet --------------------------------------------------------------------
-
-  {
-    const css = (
-      await readFile(path.join(testDir, "..", "src", "parts", "agent", "mode-chip.css"), "utf8")
-    ).replace(/\/\*[\s\S]*?\*\//g, "");
-    const rule = (selector) => {
-      const match = new RegExp(`${selector.replace(/[.[\]"=]/g, "\\$&")}\\s*\\{([^}]*)\\}`).exec(css);
-      return match === null ? "" : match[1].replace(/\s+/g, " ");
-    };
-    check("the chip is 20px tall", /block-size:\s*var\(--height-xs\)/.test(rule(".ws-mode-chip")));
-    check(
-      "the chip pads 2px 4px 2px 8px",
-      /padding:\s*var\(--ws-size-2\) var\(--space-1\) var\(--ws-size-2\) var\(--space-2\)/.test(rule(".ws-mode-chip")),
-    );
-    check(
-      "the icon is 16px at 0.5 opacity",
-      /\.ws-mode-chip__icon,\s*\.ws-mode-chip__chevron\s*\{[^}]*opacity:\s*0\.5/.test(css) &&
-        /inline-size:\s*var\(--ws-size-16\)/.test(rule(".ws-mode-chip__icon svg")),
-    );
-    check("the label reads at 0.8", /opacity:\s*0\.8/.test(rule(".ws-mode-chip__label")));
-    check("the chevron is 14px", /inline-size:\s*var\(--ws-size-14\)/.test(rule(".ws-mode-chip__chevron svg")));
-    check(
-      "Plan tints yellow, Ask green, Debug red, Multitask violet, each a 24% fill under text of the same color",
-      [
-        ["plan", "yellow"],
-        ["ask", "green"],
-        ["debug", "red"],
-        ["multitask", "multitask"],
-      ].every(([mode, color]) => {
-        const body = rule(`.ws-mode-chip[data-mode="${mode}"]`);
-        return body.includes(`color: var(--cursor-${color})`) && body.includes(`var(--cursor-${color}) 24%`);
-      }),
-    );
-    check(
-      "the label hides below 300px of composer",
-      /@container ws-composer \(width < 300px\)\s*\{\s*\.ws-mode-chip__label\s*\{\s*display:\s*none/.test(css),
-    );
-    check(
-      "the menu is at least 170px wide",
-      /min-inline-size:\s*var\(--ws-mode-menu-min-width\)/.test(rule(".ws-mode-menu")),
-    );
-  }
-
-  // --- Dispose ---------------------------------------------------------------------
-
-  {
-    const chip = new ModeChip();
-    document.body.appendChild(chip.element);
-    chip.element.click();
-    check("a menu is open before dispose", menuEl() !== null);
-    chip.dispose();
-    check("dispose closes the open menu", menuEl() === null);
-    check(
-      "dispose restores the trigger's aria state",
-      chip.element.getAttribute("aria-expanded") === null,
-    );
-    chip.element.click();
-    check("a disposed chip does not reopen its menu", menuEl() === null);
-    chip.element.remove();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`ws-mode-chip: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-mode-chip: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/model-picker-trigger.mjs b/crates/workshop/ui/test/model-picker-trigger.mjs
deleted file mode 100644
index dff43a37c..000000000
--- a/crates/workshop/ui/test/model-picker-trigger.mjs
+++ /dev/null
@@ -1,315 +0,0 @@
-// The model picker trigger (src/parts/chrome/model-picker-trigger.ts) in jsdom: a
-// button showing the selected model's id and a 9px chevron, with the tooltip
-// "Switch Model (Ctrl+/)". Clicking (or open(), which Ctrl+/ calls) opens a
-// DropdownMenu of the ModelService catalog on the composer's menu surface with
-// a check-only selection, 230px wide and at most 320px tall, reading "No models
-// found" when the catalog is empty; picking one sends the select command
-// through the service and leaves the label for the server's confirming
-// snapshot. The trigger re-renders when the service's selection changes (a
-// catalog change leaves the label alone); dispose()
-// closes an open menu and unsubscribes. The stylesheet's side - 20px tall, a
-// 4px radius, 6px side padding, 13px/18px secondary text, an 8% hover fill, the
-// chevron at 0.7 - is read from the source text. The service under test is a
-// real ModelService with a recording send function - its constructor takes
-// nothing else. Runs under the shared leak check: an undisposed trigger or
-// service fails.
-// Run: node test/model-picker-trigger.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ModelService } from "./src/services/model-service.ts";
-      export { ModelPickerTrigger } from "./src/parts/chrome/model-picker-trigger.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// The trigger reads the DOM globals when it builds, so the jsdom globals
-// must exist before the bundle is imported.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.HTMLElement = dom.window.HTMLElement;
-globalThis.HTMLButtonElement = dom.window.HTMLButtonElement;
-globalThis.Element = dom.window.Element;
-globalThis.Node = dom.window.Node;
-globalThis.CustomEvent = dom.window.CustomEvent;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-model-picker-trigger-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { ModelPickerTrigger, ModelService, lifecycle } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function menuEl() {
-  return document.querySelector(".menu-popup");
-}
-
-function menuItems() {
-  return [...(menuEl()?.querySelectorAll(".menu-item") ?? [])];
-}
-
-function labelOf(trigger) {
-  return trigger.element.querySelector(".ws-model-picker-trigger__label")?.textContent;
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- The trigger shows the current model ---------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    check(
-      "the trigger is a type=button pill",
-      trigger.element.tagName === "BUTTON" && trigger.element.type === "button",
-    );
-    check(
-      "the trigger has the ws-model-picker-trigger class",
-      trigger.element.classList.contains("ws-model-picker-trigger"),
-    );
-    check("no selection shows the placeholder label", labelOf(trigger) === "Select model");
-    check(
-      "the tooltip is Switch Model (Ctrl+/) with or without a selection",
-      trigger.element.title === "Switch Model (Ctrl+/)",
-    );
-    check(
-      "the chevron is a codicon",
-      trigger.element.querySelector(".ws-model-picker-trigger__icon svg") !== null,
-    );
-    service.applySelected("alpha");
-    check("the trigger shows the current model id", labelOf(trigger) === "alpha");
-    check("the tooltip stays the same after a selection", trigger.element.title === "Switch Model (Ctrl+/)");
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  {
-    const service = new ModelService(() => true);
-    service.applySelected("beta");
-    const trigger = new ModelPickerTrigger(service);
-    check("the initial render reads the service's selection", labelOf(trigger) === "beta");
-    trigger.dispose();
-    service.dispose();
-  }
-
-  // --- The dropdown lists the catalog ----------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    service.setModels([{ id: "alpha", description: "the alpha model" }, { id: "beta" }]);
-    service.applySelected("beta");
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    trigger.element.click();
-    check("clicking the trigger opens the dropdown", menuEl() !== null);
-    const items = menuItems();
-    check(
-      "the dropdown lists the catalog in order",
-      items.length === 2 &&
-        items[0]?.querySelector(".menu-item__label")?.textContent === "alpha" &&
-        items[1]?.querySelector(".menu-item__label")?.textContent === "beta",
-    );
-    check(
-      "the trigger gains the menu's aria wiring",
-      trigger.element.getAttribute("aria-haspopup") === "menu" &&
-        trigger.element.getAttribute("aria-expanded") === "true",
-    );
-    check(
-      "the menu wears the composer surface at the model menu's size",
-      menuEl()?.classList.contains("menu-composer") === true &&
-        menuEl()?.classList.contains("ws-model-menu") === true,
-    );
-    check(
-      "the selection is a check on the current model alone",
-      items[1]?.querySelector(".menu-item__check svg") !== null &&
-        items[0]?.querySelector(".menu-item__check") === null,
-    );
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  {
-    // Ctrl+/ opens the same menu through open(); a second call leaves it open.
-    const service = new ModelService(() => true);
-    service.setModels([{ id: "alpha" }]);
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    trigger.open();
-    check("open() opens the model menu", menuEl() !== null);
-    trigger.open();
-    check("open() while open keeps the menu open", menuEl() !== null);
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  {
-    const sent = [];
-    const service = new ModelService((id) => (sent.push(id), true));
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    trigger.element.click();
-    const items = menuItems();
-    check(
-      "an empty catalog lists a single no-models row",
-      items.length === 1 && items[0]?.textContent === "No models found",
-    );
-    items[0]?.click();
-    check(
-      "the no-models row is inert",
-      sent.length === 0 && menuEl() === null,
-    );
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  // --- Selection sends the command through the service ------------------------
-
-  {
-    const sent = [];
-    const service = new ModelService((id) => (sent.push(id), true));
-    service.setModels([{ id: "alpha" }, { id: "beta" }]);
-    service.applySelected("alpha");
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    trigger.element.click();
-    menuItems()[1]?.click();
-    check(
-      "selecting a model sends the select command with its id",
-      sent.join(",") === "beta",
-    );
-    check("selecting a model closes the dropdown", menuEl() === null);
-    check(
-      "the label waits for the snapshot instead of updating optimistically",
-      labelOf(trigger) === "alpha",
-    );
-    service.applySelected("beta");
-    check("the confirming snapshot updates the label", labelOf(trigger) === "beta");
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  // --- Reactive updates ---------------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    service.setModels([{ id: "alpha", description: "the alpha model" }]);
-    service.applySelected("alpha");
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    check("the label follows the selection", labelOf(trigger) === "alpha");
-    service.setModels([{ id: "alpha", description: "the renamed alpha" }, { id: "beta" }]);
-    check("a catalog change leaves the label and the fixed tooltip alone", labelOf(trigger) === "alpha" && trigger.element.title === "Switch Model (Ctrl+/)");
-    service.applySelected("beta");
-    check("a new selection updates the label", labelOf(trigger) === "beta");
-    service.applySelected("gamma");
-    check(
-      "a selection absent from the catalog shows its id",
-      labelOf(trigger) === "gamma" && trigger.element.title === "Switch Model (Ctrl+/)",
-    );
-    trigger.dispose();
-    service.dispose();
-    trigger.element.remove();
-  }
-
-  // --- Dispose ---------------------------------------------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    service.setModels([{ id: "alpha" }]);
-    const trigger = new ModelPickerTrigger(service);
-    document.body.appendChild(trigger.element);
-    trigger.element.click();
-    check("a menu is open before dispose", menuEl() !== null);
-    trigger.dispose();
-    check("dispose closes the open menu", menuEl() === null);
-    check(
-      "dispose restores the trigger's aria state",
-      trigger.element.getAttribute("aria-expanded") === null,
-    );
-    service.applySelected("alpha");
-    check("a disposed trigger stops reacting to the service", labelOf(trigger) === "Select model");
-    trigger.element.click();
-    check("a disposed trigger does not reopen its menu", menuEl() === null);
-    service.dispose();
-    trigger.element.remove();
-  }
-});
-
-// --- The stylesheet --------------------------------------------------------------------
-
-{
-  const css = (
-    await readFile(path.join(testDir, "..", "src", "parts", "chrome", "model-picker-trigger.css"), "utf8")
-  ).replace(/\/\*[\s\S]*?\*\//g, "");
-  const lookTokens = await readFile(path.join(testDir, "..", "..", "look", "tokens.css"), "utf8");
-  const rule = (selector) => {
-    const match = new RegExp(`${selector.replace(/[.[\]"=]/g, "\\$&")}\\s*\\{([^}]*)\\}`).exec(css);
-    return match === null ? "" : match[1].replace(/\s+/g, " ");
-  };
-  const trigger = rule(".ws-model-picker-trigger");
-  check("the button is 20px tall", /block-size:\s*var\(--model-trigger-height\)/.test(trigger) && /--model-trigger-height:\s*20px/.test(lookTokens));
-  check("the button has a 4px radius", /border-radius:\s*var\(--model-trigger-radius\)/.test(trigger) && /--model-trigger-radius:\s*4px/.test(lookTokens));
-  check("the button pads 6px at its sides", /padding-inline:\s*var\(--space-1-5\)/.test(trigger));
-  check(
-    "the text is 13px/18px in the secondary tier",
-    /font-size:\s*var\(--font-size-base\)/.test(trigger) &&
-      /line-height:\s*var\(--line-height-base\)/.test(trigger) &&
-      /color:\s*var\(--cursor-text-secondary\)/.test(trigger),
-  );
-  check(
-    "hover fills 8%",
-    /\.ws-model-picker-trigger:hover[^{]*\{[^}]*var\(--cursor-bg-tertiary\)/.test(css),
-  );
-  check(
-    "the chevron is 9px at 0.7 opacity",
-    /opacity:\s*0\.7/.test(rule(".ws-model-picker-trigger__icon")) &&
-      /inline-size:\s*var\(--ws-model-chevron-size\)/.test(rule(".ws-model-picker-trigger__icon svg")),
-  );
-  check(
-    "the menu is 230px wide and at most 320px tall",
-    /inline-size:\s*var\(--ws-model-menu-width\)/.test(rule(".ws-model-menu")) &&
-      /max-block-size:\s*var\(--ws-model-menu-max-height\)/.test(rule(".ws-model-menu")),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`ws-model-picker-trigger: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-model-picker-trigger: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/model-service.mjs b/crates/workshop/ui/test/model-service.mjs
deleted file mode 100644
index 7a93f7c71..000000000
--- a/crates/workshop/ui/test/model-service.mjs
+++ /dev/null
@@ -1,134 +0,0 @@
-// Unit test for the shared model service (src/services/model-service.ts).
-// Bundles the TS module with esbuild and imports it via a data URL. The
-// server owns the selection, so the service splits command from state:
-// setCurrent sends the select command through the injected function and
-// mutates nothing; applySelected applies the server's snapshot without
-// sending. Covers: catalog set/get with no selection fallback, the
-// command sending without mutating and reporting the send outcome, the
-// apply/emit cycle firing only on real changes, apply never re-sending,
-// and disposed subscriptions receiving nothing. Runs under the shared
-// disposable-leak check.
-// Run: node test/model-service.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ModelService } from "./src/services/model-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { lifecycle, ModelService } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const ids = (models) => models.map((model) => model.id).join(",");
-
-await assertNoLeaks(lifecycle, () => {
-  // --- Catalog state: no selection fallback --------------------------------
-
-  {
-    const sent = [];
-    const service = new ModelService((id) => (sent.push(id), true));
-    check("a new service starts with an empty catalog", service.models.length === 0);
-    check("a new service starts with no selection", service.current === "");
-    service.setModels([{ id: "alpha", description: "the alpha model" }, { id: "beta" }]);
-    check("setModels records the catalog", ids(service.models) === "alpha,beta");
-    check("a new catalog leaves the selection untouched", service.current === "");
-    check("a new catalog sends no select command", sent.length === 0);
-    service.dispose();
-  }
-
-  // --- setCurrent is a command: sends without mutating ----------------------
-
-  {
-    const sent = [];
-    const service = new ModelService((id) => (sent.push(id), true));
-    const currents = [];
-    service.onDidChangeCurrent((id) => currents.push(id));
-    check("setCurrent reports a successful send", service.setCurrent("alpha") === true);
-    check("setCurrent puts the select command on the wire", sent.join(",") === "alpha");
-    check("the command mutates nothing", service.current === "");
-    check("the command fires no change event", currents.length === 0);
-    check(
-      "re-issuing the command sends again - the server owns dedupe",
-      service.setCurrent("alpha") === true && sent.join(",") === "alpha,alpha",
-    );
-    service.dispose();
-  }
-
-  {
-    const service = new ModelService(() => false);
-    check("setCurrent reports a failed send", service.setCurrent("alpha") === false);
-    check("a failed send also mutates nothing", service.current === "");
-    service.dispose();
-  }
-
-  // --- applySelected: the apply/emit cycle -----------------------------------
-
-  {
-    const sent = [];
-    const service = new ModelService((id) => (sent.push(id), true));
-    const currents = [];
-    service.onDidChangeCurrent((id) => currents.push(id));
-    service.applySelected("alpha");
-    check("applying a snapshot selection records it", service.current === "alpha");
-    check("applying a snapshot selection fires the change event", currents.join("|") === "alpha");
-    service.applySelected("alpha");
-    check("re-applying the same selection fires nothing", currents.join("|") === "alpha");
-    service.applySelected("beta");
-    check("a changed selection fires with the new id", currents.join("|") === "alpha|beta");
-    service.applySelected(null);
-    check("a null selection clears the current model", service.current === "");
-    check("clearing fires with the empty id", currents.join("|") === "alpha|beta|");
-    check("apply never re-sends, so a snapshot cannot echo", sent.length === 0);
-    service.dispose();
-  }
-
-  // --- Disposed subscriptions receive nothing ---------------------------------
-
-  {
-    const service = new ModelService(() => true);
-    const catalogs = [];
-    const currents = [];
-    const modelsSubscription = service.onDidChangeModels((models) => catalogs.push(ids(models)));
-    const currentSubscription = service.onDidChangeCurrent((id) => currents.push(id));
-    service.setModels([{ id: "alpha" }]);
-    service.applySelected("alpha");
-    modelsSubscription.dispose();
-    currentSubscription.dispose();
-    service.setModels([{ id: "gamma" }]);
-    service.applySelected("gamma");
-    check("a disposed catalog subscription receives nothing", catalogs.join("|") === "alpha");
-    check("a disposed selection subscription receives nothing", currents.join("|") === "alpha");
-    check("state still updates after subscribers leave", service.current === "gamma");
-    service.dispose();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`model-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("model-service: all assertions passed");
diff --git a/crates/workshop/ui/test/models-push-refresh.mjs b/crates/workshop/ui/test/models-push-refresh.mjs
deleted file mode 100644
index 59a6ffb88..000000000
--- a/crates/workshop/ui/test/models-push-refresh.mjs
+++ /dev/null
@@ -1,62 +0,0 @@
-// Models frames: a pushed catalog (sent when the gateway comes back after
-// an outage) refreshes the model service without a fetch - and without
-// touching the selection, which the server owns. The selection moves only
-// when a workbench snapshot says so: a catalog push that drops the
-// selected model changes nothing locally until the server's snapshot
-// lands with the reconciled selection. Both sides are asserted observably
-// through the agent toolbar's model picker: after a push its dropdown
-// lists the pushed models, and the trigger label follows the workbench
-// snapshots alone.
-// Run: node test/models-push-refresh.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("models push refreshes the picker's catalog, snapshots move the selection", async ({ document, emitModels, emitWorkbench, failures }) => {
-  const trigger = document.querySelector("#dock .ws-agent-panel .ws-model-picker-trigger");
-  if (!trigger) {
-    failures.push("the agent toolbar's model picker trigger did not mount");
-    return;
-  }
-  const label = () => trigger.querySelector(".ws-model-picker-trigger__label")?.textContent ?? "";
-  // Opens the picker's dropdown, reads the row labels, toggles it closed.
-  const pickerRows = () => {
-    trigger.click();
-    const rows = [...document.querySelectorAll(".menu-popup .menu-item__label")].map(
-      (el) => el.textContent ?? "",
-    );
-    trigger.click();
-    return rows;
-  };
-
-  if (label() !== "test-model") {
-    failures.push(`the boot snapshot's selection did not reach the picker: "${label()}"`);
-  }
-
-  // The push must observably reach the picker - the socket's onModels feed
-  // into the model service: open the dropdown and read its rows off the
-  // catalog, while the label keeps the server-owned selection.
-  emitModels([
-    { id: "fresh-model", description: "pushed" },
-    { id: "test-model", description: "scripted" },
-  ]);
-  let rows = pickerRows();
-  if (!rows.includes("fresh-model") || !rows.includes("test-model")) {
-    failures.push(`the pushed catalog did not render as picker rows: ${rows.join(",")}`);
-  }
-  if (label() !== "test-model") {
-    failures.push(`a catalog push moved the server-owned selection: "${label()}"`);
-  }
-
-  emitModels([{ id: "fresh-model", description: "pushed" }]);
-  rows = pickerRows();
-  if (!rows.includes("fresh-model") || rows.includes("test-model")) {
-    failures.push(`a narrowing catalog push did not replace the picker rows: ${rows.join(",")}`);
-  }
-  if (label() !== "test-model") {
-    failures.push(`a catalog push that dropped the selection changed it locally: "${label()}"`);
-  }
-
-  emitWorkbench({ selected: "fresh-model" });
-  if (label() !== "fresh-model") {
-    failures.push(`the workbench snapshot's selection did not take effect: "${label()}"`);
-  }
-});
diff --git a/crates/workshop/ui/test/no-local-storage.mjs b/crates/workshop/ui/test/no-local-storage.mjs
deleted file mode 100644
index 53c02ab6e..000000000
--- a/crates/workshop/ui/test/no-local-storage.mjs
+++ /dev/null
@@ -1,44 +0,0 @@
-// Guard: the SPA keeps no browser-storage state. The desktop app binds
-// the server to an OS-assigned loopback port, so the page origin, and
-// every origin-scoped storage entry with it, changes on each launch;
-// every store reads and writes through the server-backed UI-state
-// adapter. Walks every file under src/ and fails on any that names the
-// browser storage API.
-// Run: node --test test/no-local-storage.mjs
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const srcDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "src");
-
-// Spelled as a pattern so this guard's own source, were it ever moved
-// under src/, would still describe rather than trip the rule.
-const FORBIDDEN = new RegExp(["local", "Storage"].join(""));
-
-const files = (await readdir(srcDir, { recursive: true, withFileTypes: true }))
-  .filter((entry) => entry.isFile())
-  .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name))
-  .sort();
-
-if (files.length === 0) {
-  console.error("no-local-storage: src/ holds no files; the walk is broken");
-  process.exit(1);
-}
-
-const offenders = [];
-for (const file of files) {
-  const text = await readFile(file, "utf8");
-  const lines = text.split("\n");
-  lines.forEach((line, index) => {
-    if (FORBIDDEN.test(line)) {
-      offenders.push(`${path.relative(srcDir, file)}:${index + 1}: ${line.trim()}`);
-    }
-  });
-}
-
-if (offenders.length > 0) {
-  console.error(`no-local-storage: ${offenders.length} reference(s) to browser storage under src/`);
-  for (const offender of offenders) console.error(`  - ${offender}`);
-  process.exit(1);
-}
-console.log(`no-local-storage: ${files.length} files under src/ name no browser storage`);
diff --git a/crates/workshop/ui/test/no-shared-ui.mjs b/crates/workshop/ui/test/no-shared-ui.mjs
deleted file mode 100644
index 9efb76fe7..000000000
--- a/crates/workshop/ui/test/no-shared-ui.mjs
+++ /dev/null
@@ -1,48 +0,0 @@
-// The fork guard: the Workshop UI takes its visual layer from
-// `@workshop/look`, never from `crates/shared-ui`, the Gateway's copy.
-// Walks every file under `src/` and `test/` and fails on any line that
-// contains `shared-ui`, naming the file and line. This file is skipped:
-// it has to spell the name it forbids. No jsdom: this is a source-text
-// check.
-// Run: node test/no-shared-ui.mjs
-import assert from "node:assert/strict";
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import { test } from "node:test";
-import { fileURLToPath } from "node:url";
-
-const self = fileURLToPath(import.meta.url);
-const uiDir = path.join(path.dirname(self), "..");
-const FORBIDDEN = "shared-ui";
-
-async function filesUnder(dir) {
-  return (await readdir(dir, { recursive: true, withFileTypes: true }))
-    .filter((entry) => entry.isFile())
-    .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name));
-}
-
-const files = [
-  ...(await filesUnder(path.join(uiDir, "src"))),
-  ...(await filesUnder(path.join(uiDir, "test"))),
-]
-  .filter((file) => file !== self)
-  .sort();
-
-test("the walk reaches both src/ and test/", () => {
-  const relative = files.map((file) => path.relative(uiDir, file).split(path.sep)[0]);
-  assert.ok(relative.includes("src"), "the walk found no file under src/");
-  assert.ok(relative.includes("test"), "the walk found no file under test/ besides this guard");
-});
-
-test("no file under src/ or test/ names shared-ui", async () => {
-  const offenders = [];
-  for (const file of files) {
-    const lines = (await readFile(file, "utf8")).split("\n");
-    lines.forEach((line, index) => {
-      if (line.includes(FORBIDDEN)) {
-        offenders.push(`${path.relative(uiDir, file)}:${index + 1}: ${line.trim()}`);
-      }
-    });
-  }
-  assert.deepEqual(offenders, [], `the Workshop UI names ${FORBIDDEN}:\n  ${offenders.join("\n  ")}`);
-});
diff --git a/crates/workshop/ui/test/open-recent.mjs b/crates/workshop/ui/test/open-recent.mjs
deleted file mode 100644
index 3812462c5..000000000
--- a/crates/workshop/ui/test/open-recent.mjs
+++ /dev/null
@@ -1,178 +0,0 @@
-// Unit test for the Open Recent providers
-// (src/parts/workspace/open-recent.ts): the menu provider's dynamic rows
-// and the "" quick-access provider's accept, driven over injected stores
-// and an injected command registry the way test/menus.mjs drives the
-// menu half. Covers the workspace-file rows (TWF-003): a .rvwork entry
-// in the recent-files store renders in 1_workspaces dispatching
-// workbench.action.openWorkspace with the path argument, any case of the
-// extension; a text entry still renders vscode.open in 3_files; the
-// quick-access provider's accept dispatches the workspace command for a
-// .rvwork hit and vscode.open for a text hit, a filter's match in the file
-// name is highlighted, and a rejected run is logged naming the command that
-// ran (the registry reports it as the toast, so no status message posts).
-// Bundles the module with esbuild and drives it DOM-free.
-// Run: node --test test/open-recent.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createRecentMenuProvider, createFileQuickAccessProvider, isWorkspaceFilePath } from "./src/parts/workspace/open-recent.ts";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The status-bar token's module pulls colocated CSS; the test drives only the JS.
-  loader: { ".css": "empty" },
-});
-const { createRecentMenuProvider, createFileQuickAccessProvider, isWorkspaceFilePath, registerService, STATUS_BAR } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets an accept's rejected command run reach its failure report.
-async function flush() {
-  for (let i = 0; i < 4; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-const WORKSPACE = "C:\\work\\Alpha.rvwork";
-const UPPER = "C:\\work\\Beta.RVWORK";
-const NOTE = "C:\\work\\notes.md";
-
-const statusMessages = [];
-registerService(STATUS_BAR, () => ({
-  showLocal: (label, severity) => statusMessages.push({ label, severity }),
-}));
-
-// --- The extension predicate ------------------------------------------------------
-
-check("a .rvwork path is a workspace file", isWorkspaceFilePath(WORKSPACE));
-check("the extension check is case-insensitive", isWorkspaceFilePath(UPPER));
-check("a .md path is not a workspace file", !isWorkspaceFilePath(NOTE));
-check("the extension must end the path", !isWorkspaceFilePath("C:\\work\\Alpha.rvwork.bak"));
-
-// --- The menu provider -------------------------------------------------------------
-
-{
-  const treeState = { listing: () => undefined, cachedListings: () => [] };
-  const recentFiles = { list: [WORKSPACE, NOTE, UPPER] };
-  const rows = createRecentMenuProvider({ treeState, recentFiles })();
-
-  const workspaceRow = rows.find((row) => row.args?.[0] === WORKSPACE);
-  check(
-    "a .rvwork entry renders in 1_workspaces dispatching workbench.action.openWorkspace with the path",
-    workspaceRow?.command === "workbench.action.openWorkspace" &&
-      workspaceRow?.group === "1_workspaces" &&
-      workspaceRow?.title === "Alpha.rvwork" &&
-      workspaceRow?.order === 0,
-  );
-  const upperRow = rows.find((row) => row.args?.[0] === UPPER);
-  check(
-    "an upper-case .RVWORK entry is a workspace row too",
-    upperRow?.command === "workbench.action.openWorkspace" && upperRow?.group === "1_workspaces" && upperRow?.order === 1,
-  );
-  const noteRow = rows.find((row) => row.args?.[0] === NOTE);
-  check(
-    "a .md entry still renders vscode.open in 3_files",
-    noteRow?.command === "vscode.open" && noteRow?.group === "3_files" && noteRow?.title === "notes.md" && noteRow?.order === 0,
-  );
-  check("workspace rows stay out of 3_files", !rows.some((row) => row.group === "3_files" && isWorkspaceFilePath(row.args[0])));
-  check("the provider renders every recent entry once", rows.length === 3);
-}
-
-// --- The quick-access provider's accept ----------------------------------------------
-
-{
-  const executed = [];
-  const commands = {
-    execute: (id, ...args) => {
-      executed.push({ id, args });
-      return Promise.resolve(true);
-    },
-  };
-  const treeState = { listing: () => undefined, cachedListings: () => [] };
-  const recentFiles = { list: [WORKSPACE, NOTE] };
-  const provider = createFileQuickAccessProvider({ treeState, recentFiles, commands });
-  const items = provider.getItems("");
-  check("the quick-access provider lists both entries", items.length === 2);
-
-  items.find((item) => item.description === WORKSPACE)?.accept();
-  check(
-    "accepting a .rvwork hit dispatches workbench.action.openWorkspace with the path",
-    executed.at(-1)?.id === "workbench.action.openWorkspace" && executed.at(-1)?.args?.[0] === WORKSPACE,
-  );
-  items.find((item) => item.description === NOTE)?.accept();
-  check(
-    "accepting a text hit dispatches vscode.open with the path",
-    executed.at(-1)?.id === "vscode.open" && executed.at(-1)?.args?.[0] === NOTE,
-  );
-  check("each accept runs exactly one command", executed.length === 2);
-}
-
-// --- The matched text of a file name is highlighted --------------------------------------
-
-{
-  const treeState = { listing: () => undefined, cachedListings: () => [] };
-  const recentFiles = { list: [WORKSPACE, NOTE] };
-  const provider = createFileQuickAccessProvider({ treeState, recentFiles, commands: { execute: () => Promise.resolve(true) } });
-  const named = provider.getItems("NOTE").find((item) => item.description === NOTE);
-  check(
-    "a filter that matches the file name highlights the match",
-    named?.labelHighlights?.length === 1 && named.labelHighlights[0].start === 0 && named.labelHighlights[0].end === 4,
-  );
-  const byPath = provider.getItems("c:\\work\\n").find((item) => item.description === NOTE);
-  check("a filter that matches only the path highlights nothing in the name", byPath !== undefined && byPath.labelHighlights === undefined);
-  check("an empty filter highlights nothing", provider.getItems("").every((item) => item.labelHighlights === undefined));
-}
-
-// --- A rejected run: the registry reports it, the provider keeps the detail --------------
-
-{
-  const commands = {
-    execute: () => Promise.reject(new Error("refused")),
-  };
-  const treeState = { listing: () => undefined, cachedListings: () => [] };
-  const recentFiles = { list: [WORKSPACE, NOTE] };
-  const items = createFileQuickAccessProvider({ treeState, recentFiles, commands }).getItems("");
-
-  const logged = [];
-  const realConsoleError = console.error;
-  console.error = (...args) => logged.push(args);
-  items.find((item) => item.description === WORKSPACE)?.accept();
-  await flush();
-  check(
-    "a rejected workspace open is logged naming workbench.action.openWorkspace with its error",
-    String(logged.at(-1)?.[0]).includes("workbench.action.openWorkspace") && logged.at(-1)?.[1]?.message === "refused",
-  );
-  items.find((item) => item.description === NOTE)?.accept();
-  await flush();
-  console.error = realConsoleError;
-  check("a rejected text open is logged naming vscode.open", String(logged.at(-1)?.[0]).includes("'vscode.open'"));
-  check("the provider posts no status message of its own for a failure", statusMessages.length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`open-recent: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("open-recent: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/panel-registry.mjs b/crates/workshop/ui/test/panel-registry.mjs
deleted file mode 100644
index b0ba0007a..000000000
--- a/crates/workshop/ui/test/panel-registry.mjs
+++ /dev/null
@@ -1,208 +0,0 @@
-// Unit test for the panel registry (@workshop/platform/panel-registry) and
-// the lazy panel seam in panel-types.ts: panel types are declared with
-// import thunks, the feature chunk loads on first activation, the
-// directory's register() runs exactly once no matter how many panels
-// open, and the real panel swaps into the dockview renderer element when
-// the chunk resolves. Bundles the modules with esbuild (the features'
-// thunks come along but are never triggered) and drives the registry
-// against jsdom with a synthetic lazy feature
-// (test/helpers/lazy-feature.mjs). Covers: the feature panel types'
-// metadata as their contribution modules register it (zone affinity,
-// title and its fallback for a missing, empty or root path, closability),
-// isPanelType narrowing, the unknown-name placeholder, lazy
-// mount with init params forwarded, register-once semantics, disposal
-// reaching the real panel, and the registration outliving the panel.
-// Run: node test/panel-registry.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-// The built-in thunks' graph reads the document at import time, so the
-// globals must exist before the bundle loads.
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.Event = window.Event;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import { registerPanelType, registerPanelFactory } from "@workshop/platform/panel-registry";
-      // Each feature registers its own panel type from its contribution.
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/gateway/gateway.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      import "./src/parts/run/run.contribution.ts";
-      // The synthetic lazy feature, registered from inside the bundle so
-      // its register() shares this module graph's registry instance (the
-      // helper receives registerPanelFactory through a global: a static
-      // import of the TS source would give it a second registry copy).
-      globalThis.__testRegisterPanelFactory = registerPanelFactory;
-      registerPanelType({
-        type: "fake",
-        defaultZone: "main",
-        title: "Fake",
-        load: () => import("./test/helpers/lazy-feature.mjs"),
-      });
-      export { registerPanelType, isPanelType, panelTypeEntry } from "@workshop/platform/panel-registry";
-      export { createPanelComponent } from "./src/parts/layout/panel-types.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// The bundle's graph includes dockview and shiki through the built-in
-// thunks, so it is far too large for a data URL; import from a temp file.
-const bundlePath = path.join(os.tmpdir(), "panel-registry-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  registerPanelType,
-  isPanelType,
-  panelTypeEntry,
-  createPanelComponent,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 10; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- The contribution-registered panel types -----------------------------------
-
-const editorTitle = panelTypeEntry("editor")?.title;
-const editorPanelId = panelTypeEntry("editor")?.panelId;
-const runTitle = panelTypeEntry("run")?.title;
-check(
-  "the tree anchors the left zone and is not closable",
-  panelTypeEntry("tree")?.defaultZone === "left" &&
-    panelTypeEntry("tree")?.title === "Workshop" &&
-    panelTypeEntry("tree")?.closable === false,
-);
-check(
-  "the editor opens in the main zone and is closable",
-  panelTypeEntry("editor")?.defaultZone === "main" &&
-    panelTypeEntry("editor")?.closable !== false,
-);
-check(
-  "the editor titles by base name, else Editor",
-  typeof editorTitle === "function" &&
-    editorTitle({ path: "C:\\project\\a.txt" }) === "a.txt" &&
-    editorTitle({ untitled: 1 }) === "Editor",
-);
-check(
-  "an editor with no path, an empty path, or a root path is titled Editor",
-  typeof editorTitle === "function" &&
-    editorTitle({}) === "Editor" &&
-    editorTitle({ path: "" }) === "Editor" &&
-    editorTitle({ path: "/" }) === "Editor" &&
-    editorTitle({ path: "\\" }) === "Editor",
-);
-check(
-  "the editor keys by path, then untitled serial, then the bare prefix",
-  typeof editorPanelId === "function" &&
-    editorPanelId({ path: "C:\\project\\a.txt" }) === "editor:C:\\project\\a.txt" &&
-    editorPanelId({ untitled: 3 }) === "editor:untitled-3" &&
-    editorPanelId({}) === "editor:",
-);
-check(
-  "the gateway config opens in the main zone",
-  panelTypeEntry("config")?.defaultZone === "main" &&
-    panelTypeEntry("config")?.title === "Gateway Config",
-);
-check(
-  "the agent session opens in the right zone, titled New Agent, closable and renamable",
-  panelTypeEntry("agent")?.defaultZone === "right" &&
-    panelTypeEntry("agent")?.title === "New Agent" &&
-    panelTypeEntry("agent")?.closable !== false &&
-    panelTypeEntry("agent")?.renamable === true,
-);
-check(
-  "the Run window opens in the main zone, titled after its file",
-  panelTypeEntry("run")?.defaultZone === "main" &&
-    typeof runTitle === "function" &&
-    runTitle({ path: "C:\\project\\p.md" }) === "Run: p.md" &&
-    runTitle({}) === "Run",
-);
-check(
-  "a Run window with an empty or root path is titled Run",
-  typeof runTitle === "function" && runTitle({ path: "" }) === "Run" && runTitle({ path: "/" }) === "Run",
-);
-check("isPanelType narrows registered names", isPanelType("editor") && !isPanelType("nope"));
-
-// --- Unknown names render a placeholder ---------------------------------------
-
-const unknown = createPanelComponent({ id: "x", name: "nope" });
-check(
-  "an unknown component name renders a labelled placeholder",
-  unknown.element.textContent === "Unknown panel: nope",
-);
-
-// --- A lazy panel type loads on first activation -------------------------------
-// (The "fake" type was registered inside the bundle, above.)
-
-check("a registered type narrows", isPanelType("fake"));
-
-const renderer = createPanelComponent({ id: "fake", name: "fake" });
-check("the lazy renderer mounts nothing before the chunk resolves", renderer.element.childElementCount === 0);
-renderer.init({ params: { a: 1 }, api: {} });
-await flush();
-
-const inner = renderer.element.querySelector(".fake-lazy-panel");
-check("the real panel swaps in once the chunk resolves", inner !== null);
-check(
-  "the dockview init params reach the real panel",
-  inner?.dataset.params === JSON.stringify({ a: 1 }),
-);
-check("the feature's register() ran", globalThis.__lazyFeatureRegisters === 1);
-
-// A second panel of the same type reuses the registration.
-const second = createPanelComponent({ id: "fake2", name: "fake" });
-second.init({ params: {}, api: {} });
-await flush();
-check("the second panel mounts from the same chunk", !!second.element.querySelector(".fake-lazy-panel"));
-check("register() ran exactly once across panels", globalThis.__lazyFeatureRegisters === 1);
-
-// Disposal reaches the real panel but not the directory's registration:
-// commands, keybindings, and factories live for the page, not the panel.
-renderer.dispose();
-check("disposing the wrapper disposes the real panel", globalThis.__lazyFeatureDisposes === 1);
-check(
-  "the registration outlives the panel",
-  globalThis.__lazyFeatureRegisterDisposed === undefined,
-);
-
-if (failures.length > 0) {
-  console.error(`panel-registry: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("panel-registry: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/pcm-worklet.mjs b/crates/workshop/ui/test/pcm-worklet.mjs
deleted file mode 100644
index 3744b20de..000000000
--- a/crates/workshop/ui/test/pcm-worklet.mjs
+++ /dev/null
@@ -1,110 +0,0 @@
-import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import test from "node:test";
-import vm from "node:vm";
-import { fileURLToPath } from "node:url";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-const uiDir = path.join(testDir, "..");
-// Workshop's own copy of the shared PCM16 fixture, beside the other test
-// fixtures the UI suite owns.
-const fixturePath = path.join(uiDir, "test", "fixtures", "audio", "pcm16le-24khz.json");
-
-async function loadProcessor(
-  name = "pcm16-capture",
-  options = {},
-  outputSampleRate = 24_000,
-) {
-  const source = await readFile(path.join(uiDir, "pcm-worklet.js"), "utf8");
-  const processors = new Map();
-  const messages = [];
-  const port = {
-    onmessage: null,
-    postMessage(value, transfer) {
-      messages.push({ value, transfer });
-    },
-  };
-  const context = vm.createContext({
-    sampleRate: outputSampleRate,
-    AudioWorkletProcessor: class {
-      constructor() {
-        this.port = port;
-      }
-    },
-    registerProcessor(name, constructor) {
-      assert.equal(processors.has(name), false, `${name} is registered once`);
-      processors.set(name, constructor);
-    },
-  });
-  new vm.Script(source, { filename: "pcm-worklet.js" }).runInContext(context);
-  assert.deepEqual([...processors.keys()], ["pcm16-capture"]);
-  const Processor = processors.get(name);
-  assert.ok(Processor, `the real worklet registers ${name}`);
-  return { processor: new Processor(options), messages, port };
-}
-
-function bytesOf(buffer) {
-  return [...new Uint8Array(buffer)];
-}
-
-test("the real worklet emits the shared fixture as exact little-endian PCM16", async () => {
-  const fixture = JSON.parse(await readFile(fixturePath, "utf8"));
-  assert.equal(fixture.encoding, "pcm_s16le");
-  assert.equal(fixture.sample_rate_hz, 24_000);
-  assert.equal(fixture.channels, 1);
-  await assert.rejects(
-    () => loadProcessor("pcm16-capture", {}, 16_000),
-    /24 kHz/,
-    "the PCM16 processor rejects a graph with the wrong output rate",
-  );
-
-  const { processor, messages } = await loadProcessor(
-    "pcm16-capture",
-    { processorOptions: { chunkSamples: fixture.samples.length } },
-  );
-  const floats = fixture.samples.map((sample) =>
-    sample < 0 ? sample / 32_768 : sample / 32_767,
-  );
-  processor.process([[Float32Array.from(floats.slice(0, 3))]]);
-  assert.equal(messages.length, 0, "a partial block is buffered");
-  processor.process([[Float32Array.from(floats.slice(3))]]);
-
-  assert.equal(messages.length, 1);
-  assert.equal(Object.prototype.toString.call(messages[0].value), "[object ArrayBuffer]");
-  assert.equal(messages[0].transfer.length, 1);
-  assert.equal(messages[0].transfer[0], messages[0].value);
-  assert.deepEqual(bytesOf(messages[0].value), fixture.bytes);
-});
-
-test("the real worklet clips samples and flushes only the buffered partial block", async () => {
-  const { processor, messages, port } = await loadProcessor(
-    "pcm16-capture",
-    { processorOptions: { chunkSamples: 4 } },
-  );
-  processor.process([[Float32Array.from([-2, 2, -0.5, 0.5, 0.25])]]);
-
-  assert.deepEqual(bytesOf(messages[0].value), [0, 128, 255, 127, 0, 192, 0, 64]);
-  assert.equal(messages.length, 1);
-  port.onmessage({ data: { type: "flush" } });
-  assert.deepEqual(bytesOf(messages[1].value), [0, 32]);
-  assert.equal(messages[2].value.type, "flushed");
-  port.onmessage({ data: { type: "flush" } });
-  assert.equal(messages[3].value.type, "flushed");
-});
-
-test("clear resets buffered PCM16 before the next flush", async () => {
-  const { processor, messages, port } = await loadProcessor(
-    "pcm16-capture",
-    { processorOptions: { chunkSamples: 4 } },
-  );
-
-  processor.process([[Float32Array.from([-0.5, 0.5])]]);
-  port.onmessage({ data: { type: "clear" } });
-  processor.process([[Float32Array.from([0.25])]]);
-  port.onmessage({ data: { type: "flush" } });
-
-  assert.equal(messages.length, 2);
-  assert.deepEqual(bytesOf(messages[0].value), [0, 32]);
-  assert.equal(messages[1].value.type, "flushed");
-});
diff --git a/crates/workshop/ui/test/quick-access-wording.mjs b/crates/workshop/ui/test/quick-access-wording.mjs
deleted file mode 100644
index 5bfee636d..000000000
--- a/crates/workshop/ui/test/quick-access-wording.mjs
+++ /dev/null
@@ -1,194 +0,0 @@
-// Quick input speaks Cursor's words. After bundling the contribution modules
-// that register the providers (quickinput owns >, %, @, debug, task, and ?;
-// the workspace feature owns the default file provider; the editor feature
-// owns :), the shared registry holds Cursor's exact placeholder and help text
-// for every provider, the command-center order, label, and command id of each
-// help entry, and the real widget renders both lists from them: the modes
-// list the folder-name button opens (the ordered entries, with prefix
-// descriptions and keybinding chips) and the ? list (a prefix label per row,
-// the help text beside it, sorted by prefix, with ? itself left out).
-// Run: node --test test/quick-access-wording.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/menu/stubs.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/quickinput/quickinput.contribution.ts";
-      import "./src/parts/quickinput/commands-history.ts";
-      export { QuickInputService } from "./src/parts/quickinput/quick-input.ts";
-      export { QuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { QUICK_INPUT_SERVICE } from "./src/services/quick-input-service.ts";
-      export { TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { RECENT_FILES_STORE } from "./src/services/recent-files-store.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-    "@tauri-apps/api/event": path.join(uiDir, "helpers", "tauri-event-stub.mjs"),
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-    "@tauri-apps/api/webviewWindow": path.join(uiDir, "helpers", "tauri-webview-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-quick-access-wording-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  QuickInputService,
-  QuickAccessRegistry,
-  registerService,
-  QUICK_INPUT_SERVICE,
-  TREE_STATE,
-  RECENT_FILES_STORE,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- The registered descriptors -------------------------------------------------
-
-const providers = QuickAccessRegistry.getQuickAccessProviders();
-const wording = Object.fromEntries(
-  providers.map((provider) => [
-    provider.prefix,
-    [provider.placeholder, ...provider.helpEntries.map((entry) => entry.description)],
-  ]),
-);
-const expectedWording = {
-  "": [
-    "Search files, content, and symbols (append : to go to line or @ to go to symbol)",
-    "Go to File",
-  ],
-  ":": [
-    "Type the line number and optional column to go to (e.g. 42:5 for line 42 and column 5).",
-    "Go to Line/Column",
-  ],
-  ">": ["Type the name of a command to run.", "Show and Run Commands"],
-  "%": ["Search for text in your workspace files.", "Search for Text"],
-  "@": ["Type the name of a symbol to go to.", "Go to Symbol in Editor", "Go to Symbol in Editor by Category"],
-  "debug ": ["Type the name of a launch configuration to run.", "Start Debugging"],
-  "task ": ["Type the name of a task to run.", "Run Task"],
-  "?": ["Type '?' to get help on the actions you can take from here.", "Show all Quick Access Providers"],
-};
-for (const [prefix, expected] of Object.entries(expectedWording)) {
-  check(
-    `the "${prefix}" provider uses Cursor's placeholder and help text`,
-    JSON.stringify(wording[prefix]) === JSON.stringify(expected),
-  );
-}
-check(
-  "no provider is registered beyond Cursor's list",
-  Object.keys(wording).sort().join("|") === Object.keys(expectedWording).sort().join("|"),
-);
-
-const entryOf = (prefix, index = 0) => providers.find((provider) => provider.prefix === prefix)?.helpEntries[index];
-check(
-  "Go to File is first in the modes list and names quickOpen",
-  entryOf("")?.commandCenterOrder === 10 && entryOf("")?.commandId === "workbench.action.quickOpen",
-);
-check(
-  "Go to Line/Column names gotoLine and is not in the modes list",
-  entryOf(":")?.commandId === "workbench.action.gotoLine" && entryOf(":")?.commandCenterOrder === undefined,
-);
-check("the ? entry is last, labelled More", entryOf("?")?.commandCenterOrder === 70 && entryOf("?")?.commandCenterLabel === "More");
-
-// --- The real widget over the real registrations ----------------------------------
-
-// The file provider reads two stores at call time; empty fakes keep its rows out of the way.
-registerService(TREE_STATE, () => ({ listing: () => undefined, cachedListings: () => [] }));
-registerService(RECENT_FILES_STORE, () => ({ list: [], clear() {}, record() {} }));
-const widget = new QuickInputService();
-registerService(QUICK_INPUT_SERVICE, () => widget);
-
-const panel = () => window.document.querySelector(".ws-quick-input");
-const input = () => panel().querySelector("input");
-const options = () => [...panel().querySelectorAll('[role="option"]')];
-const text = (row, selector) => row.querySelector(selector)?.textContent;
-const chips = (row) => [...row.querySelectorAll(".ws-quick-input__key")].map((chip) => chip.textContent).join("+");
-
-widget.quickAccess.show("", { includeHelp: true });
-{
-  const rows = options();
-  check(
-    "the modes list reads Cursor's seven rows in order",
-    rows.map((row) => text(row, ".ws-quick-input__option-label")).join(",") ===
-      "Go to File,Show and Run Commands,Search for Text,Go to Symbol in Editor,Start Debugging,Run Task,More",
-  );
-  check(
-    "each mode row shows its prefix, the default mode none",
-    rows.map((row) => text(row, ".ws-quick-input__option-description") ?? "").join("|") === "|>|%|@|debug |task |?",
-  );
-  check("Go to File shows Ctrl+P", chips(rows[0]) === "Ctrl+P");
-  check("Show and Run Commands shows Ctrl+Shift+P", chips(rows[1]) === "Ctrl+Shift+P");
-  check("Go to Symbol in Editor shows Ctrl+Shift+O", chips(rows[3]) === "Ctrl+Shift+O");
-  check("a mode without a keybinding shows no chips", chips(rows[2]) === "" && chips(rows[5]) === "" && chips(rows[6]) === "");
-  check("the placeholder is Cursor's file search text", input().placeholder === expectedWording[""][0]);
-  rows[6].click();
-  check("the More row enters the ? mode", input().value === "?" && input().placeholder === expectedWording["?"][0]);
-}
-
-{
-  // The ? list: one row per help entry, sorted by prefix, ? itself left out.
-  const rows = options();
-  check(
-    "the ? list labels each row with its prefix and the default mode with an ellipsis",
-    rows.map((row) => text(row, ".ws-quick-input__option-label")).join(",") === "\u2026,:,@,@:,%,>,debug ,task ",
-  );
-  check(
-    "the ? list describes each row with its help text",
-    rows.map((row) => text(row, ".ws-quick-input__option-description")).join("|") ===
-      "Go to File|Go to Line/Column|Go to Symbol in Editor|Go to Symbol in Editor by Category|Search for Text|Show and Run Commands|Start Debugging|Run Task",
-  );
-  check("the ? list shows Go to Line/Column's Ctrl+G", chips(rows[1]) === "Ctrl+G");
-  rows[5].click();
-  check("a ? row enters its mode", input().value === ">" && input().placeholder === expectedWording[">"][0]);
-  // Typing ?% from the help list jumps straight to the % mode.
-  input().value = "?";
-  input().dispatchEvent(new window.Event("input", { bubbles: true }));
-  input().value = "?%";
-  input().dispatchEvent(new window.Event("input", { bubbles: true }));
-  check("typing ?% enters the % mode", input().value === "%" && input().placeholder === expectedWording["%"][0]);
-}
-
-widget.dispose();
-
-if (failures.length > 0) {
-  console.error(`quick-access-wording: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("quick-access-wording: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/quick-input-css.mjs b/crates/workshop/ui/test/quick-input-css.mjs
deleted file mode 100644
index 0dd93763f..000000000
--- a/crates/workshop/ui/test/quick-input-css.mjs
+++ /dev/null
@@ -1,109 +0,0 @@
-// Source-text contract for the quick input stylesheet
-// (src/parts/quickinput/quick-input.css). jsdom applies no layout, so the
-// values are read from the file and followed through the token sheets
-// (test/helpers/css-values.mjs) down to the literals Cursor's workbench uses:
-// the frame (width min(62vw, 820px), at most 80vw, an 8px radius, no border,
-// the xl shadow, no padding or gap, 35px from the top), the rows (22px tall,
-// padding 0 7px, margin 0 5px, a 6px radius, no gaps, a list at most
-// min(440px, 40vh), selected #F0F0F01E, hover #F0F0F011), the box (26px, padding
-// 0 7px, inside a 4px 6px header with no divider, placeholder #F0F0F099 at 0.5),
-// the match highlights (#88C0D0 at weight 700, descriptions 0.9em at 0.6), the
-// key chips (11px, 3px padding, a 3px radius, plain on the selected row), and
-// the group labels (at the right of the row, a #F0F0F01C top line).
-// Run: node test/quick-input-css.mjs
-import { readUi, resolver, rulesOf, valueIn } from "./helpers/css-values.mjs";
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const resolve = await resolver();
-const rules = rulesOf(await readUi("src/parts/quickinput/quick-input.css"));
-const value = (selector, property) => resolve(valueIn(rules, selector, property));
-const has = (selector) => rules.some((rule) => rule.selectors.includes(selector));
-
-// --- The frame --------------------------------------------------------------------------
-
-const FRAME = ".ws-quick-input";
-check("the frame sits 35px from the top", value(FRAME, "top") === "35px");
-check("the frame is min(62vw, 820px) wide", value(FRAME, "width") === "min(62vw, 820px)");
-check("the frame is at most 80vw wide", value(FRAME, "max-width") === "80vw");
-check("the frame has an 8px radius", value(FRAME, "border-radius") === "8px");
-check("the frame has no border", value(FRAME, "border") === "none");
-check(
-  "the frame carries the IDE's xl shadow",
-  value(FRAME, "box-shadow") === resolve("var(--cursor-box-shadow-xl)"),
-);
-check("the frame has no padding", value(FRAME, "padding") === "0");
-check("the frame has no gap", value(FRAME, "gap") === "0");
-check("the frame clips its rounded corners", value(FRAME, "overflow") === "hidden");
-
-// --- The header and the box ---------------------------------------------------------------
-
-check("the header pads 4px 6px", value(".ws-quick-input__header", "padding") === "4px 6px");
-check("the header has no divider", value(".ws-quick-input__header", "border-bottom") === undefined || value(".ws-quick-input__header", "border-bottom") === "none");
-const BOX = ".ws-quick-input__input";
-check("the box is 26px tall", value(BOX, "height") === "26px");
-check("the box pads 0 7px", value(BOX, "padding") === "0 7px");
-check("the box has no border of its own", value(BOX, "border") === "none");
-check("the placeholder is #F0F0F099", value(".ws-quick-input__input::placeholder", "color") === "#f0f0f099");
-check("the placeholder is at half opacity", value(".ws-quick-input__input::placeholder", "opacity") === "0.5");
-
-// --- The rows -----------------------------------------------------------------------------
-
-const ROW = ".ws-quick-input__option";
-check("a row is 22px tall", value(ROW, "height") === "22px");
-check("a row pads 0 7px", value(ROW, "padding") === "0 7px");
-check("a row keeps a 0 5px margin", value(ROW, "margin") === "0 5px");
-check("a row has a 6px radius", value(ROW, "border-radius") === "6px");
-check("a row has no gap", value(ROW, "gap") === "0");
-check("the list has no gap between rows", value(".ws-quick-input__list", "gap") === "0");
-check("the list is at most min(440px, 40vh) tall", value(".ws-quick-input__list", "max-height") === "min(440px, 40vh)");
-check("the selected row is #F0F0F01E", value(`${ROW}[aria-selected="true"]`, "background") === "#f0f0f01e");
-check("a hovered row is #F0F0F011", value(`${ROW}:hover`, "background") === "#f0f0f011");
-
-// --- Matches and descriptions ----------------------------------------------------------------
-
-check("a match highlight is #88C0D0", value(".ws-quick-input__highlight", "color") === "#88c0d0");
-check("a match highlight is weight 700", value(".ws-quick-input__highlight", "font-weight") === "700");
-check("a description is 0.9em", value(".ws-quick-input__option-description", "font-size") === "0.9em");
-check("a description is at 0.6 opacity", value(".ws-quick-input__option-description", "opacity") === "0.6");
-
-// --- Key chips ------------------------------------------------------------------------------------
-
-const KEY = ".ws-quick-input__key";
-check("a chip is 11px", value(KEY, "font-size") === "11px");
-check("a chip pads 3px", value(KEY, "padding") === "3px");
-check("a chip has a 3px radius", value(KEY, "border-radius") === "3px");
-check("a chip draws a 1px solid border", /^1px solid /.test(value(KEY, "border") ?? ""));
-check("a chord separator is 6px wide", value(".ws-quick-input__chord-separator", "width") === "6px");
-check(
-  "a chip is plain on the selected row",
-  value(`${ROW}[aria-selected="true"] ${KEY}`, "background") === "none" &&
-    value(`${ROW}[aria-selected="true"] ${KEY}`, "color") === "inherit",
-);
-
-// --- Group labels and the empty message ------------------------------------------------------------
-
-const SEPARATOR = ".ws-quick-input__separator";
-check("a group label sits at the right of its row", value(SEPARATOR, "justify-content") === "flex-end");
-check("a group label draws a #F0F0F01C top line", /^1px solid #f0f0f01c$/.test(value(SEPARATOR, "border-top") ?? ""));
-check("the first group label has no top line", value(`${SEPARATOR}:first-child`, "border-top") === "none");
-check("a group label is 0.9em", value(SEPARATOR, "font-size") === "0.9em");
-check("the empty message is a row-height line", value(".ws-quick-input__empty", "height") === "22px");
-check("the empty message is dimmed to 0.6", value(".ws-quick-input__empty", "opacity") === "0.6");
-
-// --- The hidden state, and no raw values -----------------------------------------------------------------
-
-check("the stylesheet still declares the hidden state", has(".ws-quick-input[hidden]"));
-const source = (await readUi("src/parts/quickinput/quick-input.css")).replace(/\/\*[\s\S]*?\*\//g, "");
-const literals = source.match(/(?<![\w-])\d*\.?\d+(?:px|em|rem|vw|vh)\b|#[0-9a-fA-F]{3,8}\b|rgba?\(/g) ?? [];
-check(`the stylesheet takes every size and color from a token (found ${literals.join(", ")})`, literals.length === 0);
-
-if (failures.length > 0) {
-  console.error(`quick-input-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("quick-input-css: all assertions passed");
diff --git a/crates/workshop/ui/test/quick-input.mjs b/crates/workshop/ui/test/quick-input.mjs
deleted file mode 100644
index ccf4e08c4..000000000
--- a/crates/workshop/ui/test/quick-input.mjs
+++ /dev/null
@@ -1,843 +0,0 @@
-// Unit test for the quick input widget (src/parts/quickinput/quick-input.ts):
-// the floating panel under the title bar with the WAI-ARIA combobox
-// pattern (a role=combobox input with aria-autocomplete, aria-expanded,
-// aria-controls, and aria-activedescendant, a visually-hidden label, and
-// a ul role=listbox of li role=option rows), longest-prefix re-routing
-// in place as the input changes (the filter handed to a provider is the
-// value minus the prefix), ArrowUp/ArrowDown moving the active option,
-// Enter accepting the active row and closing, Escape closing with focus
-// restored, a factory whose product is not a provider rendering an empty
-// list, and includeHelp rendering the help entries that carry a
-// commandCenterOrder above the active provider's rows (sorted by it,
-// relabelled by commandCenterLabel, with the prefix as the description and
-// the command's keybinding as chips) with a row re-routing to its provider's
-// prefix. Rows draw key chips (one per key, "+" between, a gap between
-// chords), match highlights, group labels above the row they open, and an
-// empty message for a provider that has one.
-// The provider half covers the command palette provider (Category: Title
-// labels, keybinding labels, precondition filtering, substring filter and
-// its highlights, the "recently used" and "other commands" group labels,
-// "No matching commands", CommandsHistory recency over the fake UI-state
-// adapter, the COMMANDS_HISTORY registry token the provider resolves when
-// no history is injected), the ? help provider (prefix labels, help-text
-// descriptions, sorted by prefix, ? itself left out, the ?> jump), the
-// not-available placeholder providers, and the real provider descriptors'
-// Cursor wording and modes list rendering before the recent files.
-// Bundles the module with esbuild and drives it against jsdom.
-// Run: node --test test/quick-input.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { QuickInputService } from "./src/parts/quickinput/quick-input.ts";
-      export { createQuickAccessRegistry } from "@workshop/platform/quick-access-registry";
-      export { CommandsHistory } from "./src/parts/quickinput/commands-history.ts";
-      export { COMMANDS_HISTORY } from "./src/services/commands-history.ts";
-      export { getService, registerService } from "@workshop/platform/service-registry";
-      export {
-        createCommandPaletteProvider,
-        createHelpProvider,
-        createPlaceholderProvider,
-        createQuickAccessProviderDescriptors,
-      } from "./src/parts/quickinput/quick-access-providers.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const {
-  QuickInputService,
-  createQuickAccessRegistry,
-  CommandsHistory,
-  COMMANDS_HISTORY,
-  getService,
-  registerService,
-  createCommandPaletteProvider,
-  createHelpProvider,
-  createPlaceholderProvider,
-  createQuickAccessProviderDescriptors,
-  CommandRegistry,
-  MenuRegistry,
-  MenuId,
-  createKeybindingsRegistry,
-  ContextKeyService,
-} = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Fixture: a registry with stub providers at four prefixes -----------------
-
-const registry = createQuickAccessRegistry();
-const accepted = [];
-
-function stubProvider(prefix, placeholder, helpEntries, labels) {
-  const filters = [];
-  registry.registerQuickAccessProvider({
-    prefix,
-    placeholder,
-    helpEntries,
-    factory: () => ({
-      getItems(filter) {
-        filters.push(filter);
-        return labels.map((label) => ({
-          label,
-          accept: () => accepted.push([prefix, label]),
-        }));
-      },
-    }),
-  });
-  return filters;
-}
-
-// Only entries with a commandCenterOrder reach the modes list, sorted by it:
-// the file entry first, then the debug entry (relabelled), then commands. The
-// entry without an order never shows there.
-const fileFilters = stubProvider(
-  "",
-  "Search files by name",
-  [{ description: "Go to File", commandId: "test.quickOpen", commandCenterOrder: 10 }],
-  ["a.ts", "b.ts"],
-);
-const commandFilters = stubProvider(
-  ">",
-  "Type a command",
-  [{ description: "Show and Run Commands", prefix: ">", commandCenterOrder: 60 }],
-  ["Save", "Save All"],
-);
-const debugFilters = stubProvider(
-  "debug ",
-  "Debug configurations",
-  [
-    { description: "Start Debugging", prefix: "debug ", commandCenterOrder: 20, commandCenterLabel: "Debug" },
-    { description: "Never in the modes list", prefix: "debug " },
-  ],
-  ["Launch"],
-);
-registry.registerQuickAccessProvider({
-  prefix: "%",
-  placeholder: "Not a provider",
-  helpEntries: [],
-  factory: () => ({}),
-});
-
-const quickKeybindings = createKeybindingsRegistry("linux");
-quickKeybindings.registerKeybindingRule({ id: "test.quickOpen", keybinding: "ctrl+p" });
-const quickInput = new QuickInputService({ registry, keybindings: quickKeybindings });
-
-function panel() {
-  return window.document.querySelector(".ws-quick-input");
-}
-function input() {
-  return panel().querySelector("input");
-}
-function options() {
-  return [...panel().querySelectorAll('[role="option"]')];
-}
-function optionLabels() {
-  return options().map((row) => row.querySelector(".ws-quick-input__option-label")?.textContent);
-}
-function type(value) {
-  input().value = value;
-  input().dispatchEvent(new window.Event("input", { bubbles: true }));
-}
-function key(name) {
-  input().dispatchEvent(new window.KeyboardEvent("keydown", { key: name, bubbles: true, cancelable: true }));
-}
-
-// --- Closed until shown; show renders the combobox ------------------------------
-
-check("the panel starts hidden", panel().hidden === true);
-
-quickInput.quickAccess.show("");
-
-{
-  check("show reveals the panel", panel().hidden === false);
-  check("the input holds focus", window.document.activeElement === input());
-  check("the input is a combobox", input().getAttribute("role") === "combobox");
-  check("the combobox autocompletes from its list", input().getAttribute("aria-autocomplete") === "list");
-  check("the combobox reports expanded", input().getAttribute("aria-expanded") === "true");
-  const list = panel().querySelector("ul");
-  check("the list is a listbox", list?.getAttribute("role") === "listbox");
-  check("aria-controls names the listbox", input().getAttribute("aria-controls") === list?.id);
-  const label = panel().querySelector("label");
-  check("a visually-hidden label names the input", label?.textContent.length > 0);
-  check("the placeholder comes from the routed provider", input().placeholder === "Search files by name");
-  check("the rows come from the empty-prefix provider", optionLabels().join(",") === "a.ts,b.ts");
-  check("every row is an option", options().every((row) => row.tagName === "LI"));
-  check(
-    "the first row starts active",
-    input().getAttribute("aria-activedescendant") === options()[0]?.id &&
-      options()[0]?.getAttribute("aria-selected") === "true",
-  );
-}
-
-// --- Enter accepts the active row and closes ------------------------------------
-
-key("Enter");
-check("Enter runs the first row's accept", accepted.length === 1 && accepted[0][1] === "a.ts");
-check("Enter closes the panel", panel().hidden === true);
-check("a closed combobox reports collapsed", input().getAttribute("aria-expanded") === "false");
-
-// --- Arrow keys move the active row; Enter accepts it ----------------------------
-
-quickInput.quickAccess.show("");
-key("ArrowDown");
-check(
-  "ArrowDown moves the active descendant",
-  input().getAttribute("aria-activedescendant") === options()[1]?.id,
-);
-key("ArrowDown");
-check("ArrowDown wraps past the last row", input().getAttribute("aria-activedescendant") === options()[0]?.id);
-key("ArrowUp");
-check("ArrowUp wraps before the first row", input().getAttribute("aria-activedescendant") === options()[1]?.id);
-key("Enter");
-check("Enter accepts the moved-to row", accepted.length === 2 && accepted[1][1] === "b.ts");
-
-// --- Prefix routing strips the prefix and re-routes in place ---------------------
-
-quickInput.quickAccess.show(">sa");
-check("the routed provider's placeholder shows", input().placeholder === "Type a command");
-check("the provider sees the value minus its prefix", commandFilters.at(-1) === "sa");
-check("the routed provider's rows render", optionLabels().join(",") === "Save,Save All");
-
-type("");
-check("clearing the input re-routes to the default provider", input().placeholder === "Search files by name");
-type("debug foo");
-check("the longest matching prefix wins", input().placeholder === "Debug configurations");
-check("the debug provider sees its filter", debugFilters.at(-1) === "foo");
-check("the panel never closed during re-routing", panel().hidden === false);
-check("the default provider saw its empty filter", fileFilters.includes(""));
-key("Escape");
-
-// --- Escape closes and returns focus ---------------------------------------------
-
-const before = window.document.createElement("button");
-before.type = "button";
-window.document.body.appendChild(before);
-before.focus();
-quickInput.quickAccess.show("");
-key("Escape");
-check("Escape closes the panel", panel().hidden === true);
-check("Escape returns focus to the prior element", window.document.activeElement === before);
-
-// --- A factory whose product is not a provider renders an empty list -------------
-
-quickInput.quickAccess.show("%");
-check("a non-provider factory renders no rows", options().length === 0);
-check("a non-provider factory keeps its placeholder", input().placeholder === "Not a provider");
-check("an empty list clears the active descendant", input().getAttribute("aria-activedescendant") === null);
-key("Enter");
-check("Enter with no rows accepts nothing", accepted.length === 2);
-check("Enter with no rows leaves the panel open", panel().hidden === false);
-key("Escape");
-
-// --- includeHelp renders the modes list above the provider's rows -----------------
-
-quickInput.quickAccess.show("", { includeHelp: true });
-{
-  check(
-    "ordered help entries render above the provider's rows, relabelled and sorted",
-    optionLabels().join(",") === "Go to File,Debug,Show and Run Commands,a.ts,b.ts",
-  );
-  const descriptions = options().map((row) => row.querySelector(".ws-quick-input__option-description")?.textContent);
-  check(
-    "a mode row shows its prefix as the description, and the default mode shows none",
-    descriptions[0] === undefined && descriptions[1] === "debug " && descriptions[2] === ">",
-  );
-  const chips = [...options()[0].querySelectorAll(".ws-quick-input__key")].map((chip) => chip.textContent);
-  check("a mode row shows its command's keybinding as chips", chips.join(",") === "Ctrl,P");
-  key("ArrowDown");
-  key("Enter");
-  check("accepting a mode row re-routes to its provider's prefix", input().value === "debug ");
-  check("a mode row keeps the panel open", panel().hidden === false);
-  check("the re-routed provider's rows render", optionLabels().join(",") === "Launch");
-  key("Escape");
-}
-
-// The panels below find theirs by class, so the shared one goes first.
-quickInput.dispose();
-check("dispose removes the panel", window.document.querySelector(".ws-quick-input") === null);
-
-// --- Rows: key chips, match highlights, group labels, the empty message -----------
-
-{
-  const rowsRegistry = createQuickAccessRegistry();
-  let rowItems = [];
-  rowsRegistry.registerQuickAccessProvider({
-    prefix: "",
-    placeholder: "rows",
-    helpEntries: [],
-    factory: () => ({ getItems: () => rowItems, noResultsMessage: "No matching commands" }),
-  });
-  const rowsInput = new QuickInputService({ registry: rowsRegistry });
-  const accept = () => {};
-  rowItems = [
-    {
-      label: "File: Save",
-      labelHighlights: [{ start: 6, end: 10 }],
-      keybinding: "Ctrl+Shift+P",
-      separator: "recently used",
-      accept,
-    },
-    { label: "File: Save All", description: "every file", keybinding: "Ctrl+K Ctrl+S", separator: "other commands", accept },
-    { label: "Plain", accept },
-  ];
-  rowsInput.quickAccess.show("");
-  const first = options()[0];
-  const second = options()[1];
-  check(
-    "a match highlight wraps only the matched text",
-    [...first.querySelectorAll(".ws-quick-input__highlight")].map((mark) => mark.textContent).join("|") === "Save",
-  );
-  check(
-    "a highlighted label still reads as one label",
-    first.querySelector(".ws-quick-input__option-label")?.textContent === "File: Save",
-  );
-  check(
-    "a plain row has no highlight",
-    options()[2].querySelector(".ws-quick-input__highlight") === null,
-  );
-  check(
-    "a keybinding renders one chip per key",
-    [...first.querySelectorAll(".ws-quick-input__key")].map((chip) => chip.textContent).join(",") === "Ctrl,Shift,P",
-  );
-  check(
-    "a plus sits between the keys of a chord",
-    [...first.querySelectorAll(".ws-quick-input__key-separator")].map((plus) => plus.textContent).join("") === "++",
-  );
-  check(
-    "a two-chord keybinding renders four chips and a chord separator",
-    [...second.querySelectorAll(".ws-quick-input__key")].map((chip) => chip.textContent).join(",") === "Ctrl,K,Ctrl,S" &&
-      second.querySelectorAll(".ws-quick-input__chord-separator").length === 1,
-  );
-  check("a row without a keybinding has no chips", options()[2].querySelector(".ws-quick-input__key") === null);
-  const separators = [...panel().querySelectorAll(".ws-quick-input__separator")];
-  check(
-    "each group label sits above its row",
-    separators.map((label) => label.textContent).join(",") === "recently used,other commands" &&
-      separators[0].nextElementSibling === first &&
-      separators[1].nextElementSibling === second,
-  );
-  check("a group label is not an option", options().length === 3 && separators.every((label) => label.getAttribute("role") === "presentation"));
-  key("ArrowDown");
-  check(
-    "arrow keys step over a group label to the next row",
-    input().getAttribute("aria-activedescendant") === second.id,
-  );
-  check("no empty message while rows exist", panel().querySelector(".ws-quick-input__empty") === null);
-
-  rowItems = [];
-  type("zzz");
-  const empty = panel().querySelector(".ws-quick-input__empty");
-  check("a provider with no rows shows its empty message", empty?.textContent === "No matching commands");
-  check("the empty message is not an option", options().length === 0 && empty?.getAttribute("role") === "presentation");
-  key("Enter");
-  check("Enter on the empty message does nothing", panel().hidden === false);
-  key("Escape");
-  rowsInput.dispose();
-}
-
-{
-  // A provider may answer several spans, in any order, and a bad one never
-  // breaks the label: the spans draw in label order, a span that overlaps
-  // the one before it, runs off the label, or is empty is skipped, and the
-  // label's text always reads whole.
-  const label = "File: Save All";
-  const spanRegistry = createQuickAccessRegistry();
-  let spans = [];
-  spanRegistry.registerQuickAccessProvider({
-    prefix: "",
-    placeholder: "spans",
-    helpEntries: [],
-    factory: () => ({ getItems: () => [{ label, labelHighlights: spans, accept() {} }] }),
-  });
-  const spanInput = new QuickInputService({ registry: spanRegistry });
-  const marks = () =>
-    [...options()[0].querySelectorAll(".ws-quick-input__highlight")].map((mark) => mark.textContent).join("|");
-  const reads = () => options()[0].querySelector(".ws-quick-input__option-label")?.textContent === label;
-  const render = (next) => {
-    spans = next;
-    spanInput.quickAccess.show("");
-    return marks();
-  };
-
-  check(
-    "two spans given out of order draw in label order",
-    render([
-      { start: 11, end: 14 },
-      { start: 0, end: 4 },
-    ]) === "File|All" && reads(),
-  );
-  key("Escape");
-  check(
-    "a span that overlaps the one before it is skipped",
-    render([
-      { start: 0, end: 6 },
-      { start: 4, end: 8 },
-    ]) === "File: " && reads(),
-  );
-  key("Escape");
-  check("a span that runs off the label is skipped", render([{ start: 11, end: 99 }]) === "" && reads());
-  key("Escape");
-  check(
-    "a valid span still draws beside a skipped out-of-range one",
-    render([
-      { start: 20, end: 30 },
-      { start: 6, end: 10 },
-    ]) === "Save" && reads(),
-  );
-  key("Escape");
-  check(
-    "an empty or inverted span is skipped",
-    render([
-      { start: 3, end: 3 },
-      { start: 9, end: 5 },
-    ]) === "" && reads(),
-  );
-  key("Escape");
-  spanInput.dispose();
-}
-
-{
-  // A provider without a message shows nothing when it has no rows.
-  const plainRegistry = createQuickAccessRegistry();
-  plainRegistry.registerQuickAccessProvider({
-    prefix: "",
-    placeholder: "plain",
-    helpEntries: [],
-    factory: () => ({ getItems: () => [] }),
-  });
-  const plainInput = new QuickInputService({ registry: plainRegistry });
-  plainInput.quickAccess.show("");
-  check("a provider without a message shows no empty row", panel().querySelector(".ws-quick-input__empty") === null);
-  key("Escape");
-  plainInput.dispose();
-}
-
-// --- Provider half: the command palette provider --------------------------------
-
-/** The user-bucket key the composition root binds the history to. */
-const HISTORY_KEY = "commands_history";
-
-/**
- * Builds a history over a fake adapter the way main.ts binds the live
- * one: the initial value read from the user bucket, every change written
- * back to the same key. Returns the history and the fake, whose `sets`
- * records the writes.
- */
-function historyOver(initial) {
-  const storage = createFakeUiStorage(initial === undefined ? {} : { user: { [HISTORY_KEY]: initial } });
-  const history = new CommandsHistory(storage.get("user", HISTORY_KEY), (value) =>
-    storage.set("user", HISTORY_KEY, value),
-  );
-  return { history, storage };
-}
-
-function paletteSetup(initialHistory) {
-  const commands = new CommandRegistry();
-  const menus = new MenuRegistry();
-  const keybindings = createKeybindingsRegistry("windows");
-  const context = new ContextKeyService();
-  const { history, storage } = historyOver(initialHistory);
-  const provider = createCommandPaletteProvider({ commands, menus, keybindings, context, history });
-  return { commands, menus, keybindings, context, storage, history, provider };
-}
-
-{
-  // Palette rows are Category: Title and show the keybinding label.
-  const { commands, menus, keybindings, provider } = paletteSetup();
-  let ran = 0;
-  commands.register("file.save", { title: "Save", category: "File", run: () => { ran += 1; } });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "file.save" });
-  keybindings.registerKeybindingRule({ id: "file.save", keybinding: "ctrl+s" });
-  const rows = provider.getItems("");
-  check("the palette lists the palette-menu command", rows.length === 1);
-  check("the palette label is Category: Title", rows[0]?.label === "File: Save");
-  check("the palette row shows the keybinding label", rows[0]?.keybinding === "Ctrl+S");
-  check("with no history the palette shows no group label", rows[0]?.separator === undefined);
-  check("the palette's empty result reads 'No matching commands'", provider.noResultsMessage === "No matching commands");
-  rows[0]?.accept();
-  await Promise.resolve();
-  check("accept runs the command through the registry", ran === 1);
-}
-
-{
-  // A command whose precondition fails is absent from the palette.
-  const { commands, menus, context, provider } = paletteSetup();
-  const focus = context.createKey("editorTextFocus", false);
-  commands.register("editor.format", { title: "Format", precondition: "editorTextFocus", run: () => {} });
-  commands.register("file.save", { title: "Save", category: "File", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "editor.format" });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "file.save" });
-  check(
-    "a failed precondition keeps the command out of the palette",
-    provider.getItems("").map((row) => row.label).join(",") === "File: Save",
-  );
-  focus.set(true);
-  check("a met precondition admits the command", provider.getItems("").length === 2);
-  context.dispose();
-}
-
-{
-  // The filter narrows rows; a category-less command labels with its title.
-  const { commands, menus, provider } = paletteSetup();
-  commands.register("file.save", { title: "Save", category: "File", run: () => {} });
-  commands.register("window.reload", { title: "Reload Window", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "file.save" });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "window.reload" });
-  check("a category-less label is the bare title", provider.getItems("").map((row) => row.label).join(",") === "File: Save,Reload Window");
-  check("the filter narrows case-insensitively", provider.getItems("reload").map((row) => row.label).join(",") === "Reload Window");
-  check("a filter matching nothing renders no rows", provider.getItems("zzz").length === 0);
-  const reload = provider.getItems("rEl")[0];
-  check(
-    "the matched text of the label is highlighted",
-    reload?.labelHighlights?.length === 1 && reload.labelHighlights[0].start === 0 && reload.labelHighlights[0].end === 3,
-  );
-  const save = provider.getItems("sav")[0];
-  check(
-    "a match inside the title is highlighted past its category",
-    save?.labelHighlights?.[0]?.start === 6 && save.labelHighlights[0].end === 9,
-  );
-  check("an empty filter highlights nothing", provider.getItems("").every((row) => row.labelHighlights === undefined));
-}
-
-{
-  // Recently used commands sort first, in recency order; accept records history.
-  const { commands, menus, storage, history, provider } = paletteSetup();
-  commands.register("a.one", { title: "One", run: () => {} });
-  commands.register("b.two", { title: "Two", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "a.one" });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "b.two" });
-  check("without history the rows keep menu order", provider.getItems("").map((row) => row.label).join(",") === "One,Two");
-  check("without history no row carries a group label", provider.getItems("").every((row) => row.separator === undefined));
-  history.add("b.two");
-  check("a used command sorts first", provider.getItems("").map((row) => row.label).join(",") === "Two,One");
-  check(
-    "the used commands open under 'recently used' and the rest under 'other commands'",
-    provider.getItems("")[0]?.separator === "recently used" && provider.getItems("")[1]?.separator === "other commands",
-  );
-  provider.getItems("")[1]?.accept();
-  await Promise.resolve();
-  check("accept records the command in the history", history.list[0] === "a.one");
-  check(
-    "each add writes the full id list to the user bucket",
-    storage.sets.length === 2 &&
-      storage.sets.every((entry) => entry.bucket === "user" && entry.key === HISTORY_KEY) &&
-      storage.sets[0].value.join(",") === "b.two" &&
-      storage.sets[1].value.join(",") === "a.one,b.two",
-  );
-  const reloaded = new CommandsHistory(storage.get("user", HISTORY_KEY), () => {});
-  check("a new history over the written value reads it back", reloaded.list.join(",") === "a.one,b.two");
-  check("a malformed initial value reads as no history", historyOver({ not: "a list" }).history.list.length === 0);
-  check("a string initial value reads as no history, never a cast", historyOver('["x"]').history.list.length === 0);
-  check("a null initial value reads as no history", historyOver(null).history.list.length === 0);
-  check(
-    "non-string, empty, and duplicate initial entries drop out",
-    historyOver(["ok", 7, "", "ok", "two"]).history.list.join(",") === "ok,two",
-  );
-}
-
-{
-  // The initial list drives recency before any command runs; construction writes nothing.
-  const { commands, menus, storage, provider } = paletteSetup(["b.two"]);
-  commands.register("a.one", { title: "One", run: () => {} });
-  commands.register("b.two", { title: "Two", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "a.one" });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "b.two" });
-  check("the initial history list sorts its command first", provider.getItems("").map((row) => row.label).join(",") === "Two,One");
-  check("construction writes nothing", storage.sets.length === 0);
-}
-
-{
-  // Only recent commands: one 'recently used' label and no 'other commands'.
-  const { commands, menus, provider } = paletteSetup(["a.one"]);
-  commands.register("a.one", { title: "One", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "a.one" });
-  const rows = provider.getItems("");
-  check(
-    "a palette of only recent commands has the one label",
-    rows.length === 1 && rows[0].separator === "recently used",
-  );
-}
-
-{
-  // The cap, the empty id, and a writer that throws.
-  const { history, storage } = historyOver();
-  history.add("");
-  check("an empty id is ignored and writes nothing", history.list.length === 0 && storage.sets.length === 0);
-  for (let i = 0; i < 55; i += 1) {
-    history.add(`cmd.${i}`);
-  }
-  check("the history is capped at 50", history.list.length === 50 && history.list[0] === "cmd.54");
-  check("the written list is the capped list", storage.sets[storage.sets.length - 1].value.length === 50);
-
-  let attempts = 0;
-  const degraded = new CommandsHistory(["kept"], () => {
-    attempts += 1;
-    throw new Error("denied");
-  });
-  degraded.add("fresh");
-  check("a throwing writer is still called", attempts === 1);
-  check("a rejected write leaves the in-memory list intact", degraded.list.join(",") === "fresh,kept");
-}
-
-{
-  // The registry token: an empty no-op default self-registers, and the
-  // palette provider resolves it when no history is injected, so the
-  // composition root's re-registration reaches the palette.
-  const fallback = getService(COMMANDS_HISTORY);
-  check("COMMANDS_HISTORY self-registers a CommandsHistory", fallback instanceof CommandsHistory);
-  check("the default history starts empty", fallback.list.length === 0);
-  const { history: bound } = historyOver(["b.two"]);
-  registerService(COMMANDS_HISTORY, () => bound);
-  const commands = new CommandRegistry();
-  const menus = new MenuRegistry();
-  const context = new ContextKeyService();
-  commands.register("a.one", { title: "One", run: () => {} });
-  commands.register("b.two", { title: "Two", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "a.one" });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "b.two" });
-  const provider = createCommandPaletteProvider({ commands, menus, context });
-  check(
-    "without an injected history the palette resolves COMMANDS_HISTORY",
-    provider.getItems("").map((row) => row.label).join(",") === "Two,One",
-  );
-  provider.getItems("")[1]?.accept();
-  await Promise.resolve();
-  check("accept records into the registry-resolved history", bound.list[0] === "a.one");
-  context.dispose();
-}
-
-// --- Provider half: the help provider --------------------------------------------
-
-/**
- * A registry shaped like Cursor's: the default provider, a symbol provider
- * with two entries, the commands provider, and the ? provider itself. Each
- * stub provider answers one row named after its prefix.
- */
-function helpFixture() {
-  const helpRegistry = createQuickAccessRegistry();
-  const stub = (prefix, helpEntries) =>
-    helpRegistry.registerQuickAccessProvider({
-      prefix,
-      placeholder: `placeholder for "${prefix}"`,
-      helpEntries,
-      factory: () => ({ getItems: () => [{ label: `row of "${prefix}"`, accept: () => {} }] }),
-    });
-  stub(">", [{ description: "Show and Run Commands", commandId: "test.showCommands" }]);
-  stub("@", [
-    { description: "Go to Symbol in Editor", prefix: "@" },
-    { description: "Go to Symbol in Editor by Category", prefix: "@:" },
-  ]);
-  stub("", [{ description: "Go to File", commandId: "test.quickOpen" }]);
-  const shown = [];
-  const keybindings = createKeybindingsRegistry("linux");
-  keybindings.registerKeybindingRule({ id: "test.quickOpen", keybinding: "ctrl+p" });
-  const help = createHelpProvider({ registry: helpRegistry, keybindings, show: (value) => shown.push(value) });
-  helpRegistry.registerQuickAccessProvider({
-    prefix: "?",
-    placeholder: "Type '?' to get help",
-    helpEntries: [{ description: "Show all Quick Access Providers", commandCenterOrder: 70, commandCenterLabel: "More" }],
-    factory: () => help,
-  });
-  return { helpRegistry, help, shown, keybindings };
-}
-
-{
-  const { help, shown } = helpFixture();
-  const rows = help.getItems("");
-  check(
-    "a help row's label is its prefix, or an ellipsis for the default mode",
-    rows.map((row) => row.label).join(",") === "\u2026,@,@:,>",
-  );
-  check(
-    "a help row's description is the help text",
-    rows.map((row) => row.description).join("|") ===
-      "Go to File|Go to Symbol in Editor|Go to Symbol in Editor by Category|Show and Run Commands",
-  );
-  check("the ? provider's own entry is left out", !rows.some((row) => row.label === "?"));
-  check("a help row shows its command's keybinding", rows[0]?.keybinding === "Ctrl+P" && rows[3]?.keybinding === undefined);
-  rows[3]?.accept();
-  rows[2]?.accept();
-  check("accepting a help row enters its mode", shown.join(",") === ">,@:");
-}
-
-{
-  // ?> jumps into the > mode: the help provider redirects the typed value.
-  const { help, helpRegistry } = helpFixture();
-  check("typing a prefix after ? redirects to that mode", help.redirect?.(">") === ">");
-  check("a longer prefix after ? redirects to its provider's prefix", help.redirect?.("@:x") === "@");
-  check("a bare ? stays in help", help.redirect?.("") === undefined);
-  check("text that routes to the default mode stays in help", help.redirect?.("save") === undefined);
-  check("a second ? stays in help", help.redirect?.("?") === undefined);
-
-  const jumpInput = new QuickInputService({ registry: helpRegistry });
-  jumpInput.quickAccess.show("?");
-  check("the ? list renders in the widget", optionLabels().join(",") === "\u2026,@,@:,>");
-  check("the ? list's placeholder is the ? provider's", input().placeholder === "Type '?' to get help");
-  type("?>");
-  check("typing ?> enters the > mode", input().value === ">" && input().placeholder === `placeholder for ">"`);
-  check("the > mode's rows replace the help list", optionLabels().join(",") === `row of ">"`);
-  check("the jump never closed the panel", panel().hidden === false);
-  key("Escape");
-  jumpInput.dispose();
-}
-
-// --- Provider half: the placeholder provider --------------------------------------
-
-{
-  const placeholder = createPlaceholderProvider("Debugging is not available");
-  const rows = placeholder.getItems("anything");
-  check("a placeholder provider renders its single row", rows.length === 1 && rows[0]?.label === "Debugging is not available");
-  const stateRegistry = createQuickAccessRegistry();
-  stateRegistry.registerQuickAccessProvider({
-    prefix: "",
-    placeholder: "Search files by name",
-    helpEntries: [],
-    factory: () => ({ getItems: () => [{ label: "a.ts", accept: () => {} }] }),
-  });
-  const stateInput = new QuickInputService({ registry: stateRegistry });
-  stateInput.quickAccess.show("");
-  rows[0]?.accept();
-  check(
-    "a placeholder row's accept leaves quick input state unchanged",
-    panel().hidden === false && optionLabels().join(",") === "a.ts",
-  );
-  key("Escape");
-  stateInput.dispose();
-}
-
-// --- Provider half: includeHelp renders the modes list before recent files ---------
-
-{
-  const modesRegistry = createQuickAccessRegistry();
-  modesRegistry.registerQuickAccessProvider({
-    prefix: "",
-    placeholder: "Search files by name",
-    helpEntries: [{ description: "Go to File", commandId: "test.quickOpen", commandCenterOrder: 10 }],
-    factory: () => ({
-      getItems: () => [
-        { label: "alpha.md", accept: () => {} },
-        { label: "beta.md", accept: () => {} },
-      ],
-    }),
-  });
-  const { commands, menus, keybindings, context, history } = paletteSetup();
-  commands.register("file.save", { title: "Save", category: "File", run: () => {} });
-  menus.appendMenuItem(MenuId.CommandPalette, { command: "file.save" });
-  const descriptors = createQuickAccessProviderDescriptors({
-    commands,
-    menus,
-    keybindings,
-    context,
-    history,
-    quickAccess: modesRegistry,
-    show: () => {},
-  });
-  for (const descriptor of descriptors) {
-    modesRegistry.registerQuickAccessProvider(descriptor);
-  }
-
-  // Cursor's own words for every placeholder and help row of the providers this file owns.
-  const wording = Object.fromEntries(
-    descriptors.map((descriptor) => [
-      descriptor.prefix,
-      [descriptor.placeholder, ...descriptor.helpEntries.map((entry) => entry.description)],
-    ]),
-  );
-  const expectedWording = {
-    ">": ["Type the name of a command to run.", "Show and Run Commands"],
-    "%": ["Search for text in your workspace files.", "Search for Text"],
-    "@": [
-      "Type the name of a symbol to go to.",
-      "Go to Symbol in Editor",
-      "Go to Symbol in Editor by Category",
-    ],
-    "debug ": ["Type the name of a launch configuration to run.", "Start Debugging"],
-    "task ": ["Type the name of a task to run.", "Run Task"],
-    "?": ["Type '?' to get help on the actions you can take from here.", "Show all Quick Access Providers"],
-  };
-  check(
-    "every descriptor this file owns uses Cursor's placeholder and help text",
-    JSON.stringify(wording) === JSON.stringify(expectedWording),
-  );
-  const orders = Object.fromEntries(
-    descriptors.flatMap((descriptor) =>
-      descriptor.helpEntries
-        .filter((entry) => entry.commandCenterOrder !== undefined)
-        .map((entry) => [descriptor.prefix, [entry.commandCenterOrder, entry.commandCenterLabel ?? null, entry.commandId ?? null]]),
-    ),
-  );
-  check(
-    "the modes list's order, label, and command ids match Cursor's",
-    JSON.stringify(orders) ===
-      JSON.stringify({
-        ">": [20, null, "workbench.action.showCommands"],
-        "%": [25, null, "workbench.action.quickTextSearch"],
-        "@": [40, null, "workbench.action.gotoSymbol"],
-        "debug ": [50, null, "workbench.action.debug.selectandstart"],
-        "task ": [60, null, null],
-        "?": [70, "More", null],
-      }),
-  );
-
-  const modesInput = new QuickInputService({ registry: modesRegistry, keybindings });
-  modesInput.quickAccess.show("", { includeHelp: true });
-  check(
-    "includeHelp renders the modes list before the recent files",
-    optionLabels().join(",") ===
-      "Go to File,Show and Run Commands,Search for Text,Go to Symbol in Editor,Start Debugging,Run Task,More,alpha.md,beta.md",
-  );
-  check(
-    "the unordered help entries stay out of the modes list",
-    !optionLabels().includes("Go to Symbol in Editor by Category") && !optionLabels().includes("Show all Quick Access Providers"),
-  );
-  key("Escape");
-  modesInput.quickAccess.show(">");
-  check("the palette descriptor routes the > prefix", optionLabels().join(",") === "File: Save");
-  key("Escape");
-  modesInput.quickAccess.show("debug ");
-  check("the debug descriptor renders its not-available row", optionLabels().join(",") === "Debugging is not available");
-  key("Escape");
-  modesInput.dispose();
-  context.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`quick-input: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("quick-input: all assertions passed");
diff --git a/crates/workshop/ui/test/realtime-wire-fixtures.mjs b/crates/workshop/ui/test/realtime-wire-fixtures.mjs
deleted file mode 100644
index 8d66c110d..000000000
--- a/crates/workshop/ui/test/realtime-wire-fixtures.mjs
+++ /dev/null
@@ -1,498 +0,0 @@
-import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-const decoderBundle = await esbuild.build({
-  entryPoints: [path.join(testDir, "..", "src", "services", "realtime-event-decoder.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { decodeRealtimeEvent } = await import(
-  `data:text/javascript;base64,${Buffer.from(decoderBundle.outputFiles[0].text).toString("base64")}`
-);
-// The canonical Realtime fixtures Workshop owns, under the server's test
-// fixtures beside `agent-frames.json`. The Gateway keeps its own copies.
-const fixtureDir = path.join(
-  testDir,
-  "..",
-  "..",
-  "server",
-  "tests",
-  "fixtures",
-  "realtime",
-);
-
-const minimumCommitAudioBytes = (24_000 * 2) / 10;
-const hypothesisInclude = "item.input_audio_transcription.hypothesis";
-const negotiableIncludes = [[], [hypothesisInclude]];
-
-async function fixture(name) {
-  const parsed = JSON.parse(await readFile(path.join(fixtureDir, name), "utf8"));
-  assert.deepEqual(JSON.parse(JSON.stringify(parsed)), parsed, `${name} round-trips`);
-  return parsed;
-}
-
-function sortedKeys(value) {
-  return Object.keys(value).sort();
-}
-
-function assertExactKeys(value, expected, context) {
-  assert.deepEqual(sortedKeys(value), [...expected].sort(), `${context} strict keys`);
-}
-
-function assertNonemptyString(value, context) {
-  assert.equal(typeof value, "string", `${context} is a string`);
-  assert.notEqual(value.length, 0, `${context} is nonempty`);
-}
-
-function fieldPaths(value, prefix = []) {
-  if (typeof value !== "object" || value === null) return [];
-  if (Array.isArray(value)) {
-    return value.flatMap((entry, index) => fieldPaths(entry, [...prefix, index]));
-  }
-  return Object.entries(value).flatMap(([key, entry]) => [
-    [...prefix, key],
-    ...fieldPaths(entry, [...prefix, key]),
-  ]);
-}
-
-function objectPaths(value, prefix = []) {
-  if (typeof value !== "object" || value === null) return [];
-  if (Array.isArray(value)) {
-    return value.flatMap((entry, index) => objectPaths(entry, [...prefix, index]));
-  }
-  return [
-    prefix,
-    ...Object.entries(value).flatMap(([key, entry]) =>
-      objectPaths(entry, [...prefix, key]),
-    ),
-  ];
-}
-
-function parentAt(value, path) {
-  return path.slice(0, -1).reduce((parent, segment) => parent[segment], value);
-}
-
-function valueAt(value, path) {
-  return path.reduce((entry, segment) => entry[segment], value);
-}
-
-function pathName(path) {
-  return path.map(String).join(".");
-}
-
-function isOptionalErrorField(path) {
-  return (
-    path.length >= 2 &&
-    path.at(-2) === "error" &&
-    (path.at(-1) === "param" || path.at(-1) === "event_id")
-  );
-}
-
-function assertSession(session, context) {
-  assertExactKeys(session, ["audio", "id", "include", "object", "type"], context);
-  assertNonemptyString(session.id, `${context}.id`);
-  assert.equal(session.object, "realtime.transcription_session");
-  assert.equal(session.type, "transcription");
-  assert.ok(
-    negotiableIncludes.some((include) => isDeepStrictEqual(session.include, include)),
-    `${context}.include is a negotiable include list`,
-  );
-  assertExactKeys(session.audio, ["input"], `${context}.audio`);
-  const input = session.audio.input;
-  assertExactKeys(
-    input,
-    ["format", "noise_reduction", "transcription", "turn_detection"],
-    `${context}.audio.input`,
-  );
-  assert.equal(input.noise_reduction, null);
-  assert.equal(input.turn_detection, null);
-  assert.deepEqual(input.format, { type: "audio/pcm", rate: 24000 });
-  assertExactKeys(input.transcription, ["model", "prompt"], `${context}.transcription`);
-  assert.equal(input.transcription.model, "realtime-transcribe");
-  assert.equal(typeof input.transcription.prompt, "string");
-}
-
-function assertError(event, correlation, context) {
-  assertExactKeys(event, ["error", "event_id", "type"], context);
-  assertNonemptyString(event.event_id, `${context}.event_id`);
-  assert.equal(event.type, "error");
-  for (const field of Object.keys(event.error)) {
-    assert.ok(["code", "event_id", "message", "param", "type"].includes(field));
-  }
-  for (const field of ["type", "code", "message"]) {
-    assertNonemptyString(event.error[field], `${context}.error.${field}`);
-  }
-  if ("param" in event.error) {
-    assert.ok(event.error.param === null || typeof event.error.param === "string");
-  }
-  if (correlation === undefined) {
-    assert.equal("event_id" in event.error, false);
-  } else {
-    assert.equal(event.error.event_id, correlation);
-  }
-}
-
-function canonicalBase64ByteLength(value, context) {
-  assert.equal(typeof value, "string", `${context} Base64 is a string`);
-  assert.match(
-    value,
-    /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/,
-    `${context} is canonical Base64`,
-  );
-  const decoded = Buffer.from(value, "base64");
-  assert.equal(decoded.toString("base64"), value, `${context} round-trips as Base64`);
-  return decoded.length;
-}
-
-function assertValidCommitAudio(name, events) {
-  let bufferedAudioBytes = 0;
-  for (const [index, entry] of events.entries()) {
-    const { message } = entry;
-    if (entry.direction === "client") {
-      if (message.type === "input_audio_buffer.append") {
-        bufferedAudioBytes += canonicalBase64ByteLength(
-          message.audio,
-          `${name}[${index}].message.audio`,
-        );
-      } else if (message.type === "input_audio_buffer.commit") {
-        assert.ok(
-          bufferedAudioBytes >= minimumCommitAudioBytes,
-          `${name}[${index}] commits ${bufferedAudioBytes} PCM16 bytes, below 100 ms`,
-        );
-      }
-    } else if (
-      message.type === "input_audio_buffer.committed" ||
-      message.type === "input_audio_buffer.cleared"
-    ) {
-      bufferedAudioBytes = 0;
-    }
-  }
-}
-
-function assertServerEventFields(event, context) {
-  const fieldsByType = {
-    "session.created": ["event_id", "session", "type"],
-    "session.updated": ["event_id", "session", "type"],
-    "input_audio_buffer.committed": [
-      "event_id",
-      "item_id",
-      "previous_item_id",
-      "type",
-    ],
-    "input_audio_buffer.cleared": ["event_id", "type"],
-    "conversation.item.created": ["event_id", "item", "previous_item_id", "type"],
-    "conversation.item.input_audio_transcription.delta": [
-      "content_index",
-      "delta",
-      "event_id",
-      "item_id",
-      "type",
-    ],
-    "conversation.item.input_audio_transcription.completed": [
-      "content_index",
-      "event_id",
-      "item_id",
-      "transcript",
-      "type",
-      "usage",
-    ],
-    "conversation.item.input_audio_transcription.failed": [
-      "content_index",
-      "error",
-      "event_id",
-      "item_id",
-      "type",
-    ],
-    "conversation.item.input_audio_transcription.hypothesis": [
-      "agreed",
-      "audio_end_ms",
-      "audio_start_ms",
-      "content_index",
-      "event_id",
-      "finalized",
-      "item_id",
-      "revision",
-      "tentative",
-      "transcript",
-      "type",
-    ],
-    error: ["error", "event_id", "type"],
-  };
-  assertExactKeys(event, fieldsByType[event.type], context);
-  if (event.type === "session.created" || event.type === "session.updated") {
-    assertSession(event.session, `${context}.session`);
-  }
-  if ("content_index" in event) assert.equal(event.content_index, 0);
-  if ("previous_item_id" in event) {
-    assert.ok(
-      event.previous_item_id === null ||
-        (typeof event.previous_item_id === "string" && event.previous_item_id.length > 0),
-    );
-  }
-  if (event.type === "conversation.item.created") {
-    assertExactKeys(event.item, ["content", "id", "role", "status", "type"], `${context}.item`);
-    assertNonemptyString(event.item.id, `${context}.item.id`);
-    assert.equal(event.item.type, "message");
-    assert.equal(event.item.status, "completed");
-    assert.equal(event.item.role, "user");
-    assert.deepEqual(event.item.content, [{ type: "input_audio", transcript: null }]);
-  }
-}
-
-test("canonical Realtime event fixtures satisfy the browser wire contract", async () => {
-  const clients = await fixture("client-events.json");
-  assert.equal(clients.session_update.type, "session.update");
-  assert.equal(clients.input_audio_buffer_append.type, "input_audio_buffer.append");
-  assert.equal(clients.input_audio_buffer_commit.type, "input_audio_buffer.commit");
-  assert.equal(clients.input_audio_buffer_clear.type, "input_audio_buffer.clear");
-  assertExactKeys(clients.session_update, ["event_id", "session", "type"], "session update");
-  assertExactKeys(
-    clients.input_audio_buffer_append,
-    ["audio", "event_id", "type"],
-    "append",
-  );
-  assertExactKeys(clients.input_audio_buffer_commit, ["type"], "commit");
-  assertExactKeys(clients.input_audio_buffer_clear, ["type"], "clear");
-  assertExactKeys(
-    clients.session_update.session,
-    ["audio", "include", "type"],
-    "session update body",
-  );
-  assert.equal(clients.session_update.session.type, "transcription");
-  assertExactKeys(clients.session_update.session.audio, ["input"], "session update audio");
-  assertExactKeys(
-    clients.session_update.session.audio.input,
-    ["format", "noise_reduction", "transcription", "turn_detection"],
-    "session update input",
-  );
-
-  const sessions = await fixture("effective-sessions.json");
-  assert.deepEqual(sortedKeys(sessions), ["default", "updated"]);
-  assertSession(sessions.default, "default session");
-  assertSession(sessions.updated, "updated session");
-
-  const servers = await fixture("server-events.json");
-  for (const [name, event] of Object.entries(servers)) {
-    assertNonemptyString(event.event_id, `${name}.event_id`);
-    assertNonemptyString(event.type, `${name}.type`);
-    assertServerEventFields(event, name);
-  }
-  assert.deepEqual(servers.session_created.session, sessions.default);
-  assert.deepEqual(servers.session_updated.session, sessions.updated);
-  assertError(servers.error_correlated, "client_bad_update", "correlated error");
-  assertError(servers.error_minimal, undefined, "minimal error");
-  assertError(servers.error_uncorrelated, null, "uncorrelated error");
-  assert.deepEqual(sortedKeys(servers.transcription_completed.usage), ["seconds", "type"]);
-  assert.equal(servers.transcription_completed.usage.type, "duration");
-  assert.ok(servers.transcription_completed.usage.seconds >= 0);
-
-  const hypothesis = servers.transcription_hypothesis;
-  assert.equal(
-    hypothesis.finalized + hypothesis.agreed + hypothesis.tentative,
-    hypothesis.transcript,
-  );
-  assert.ok(Number.isSafeInteger(hypothesis.revision) && hypothesis.revision >= 0);
-  assert.ok(hypothesis.audio_start_ms >= 0);
-  assert.ok(hypothesis.audio_end_ms >= hypothesis.audio_start_ms);
-});
-
-test("the production decoder rejects an include the session did not negotiate", async () => {
-  const servers = await fixture("server-events.json");
-  const sessions = await fixture("effective-sessions.json");
-  for (const include of [
-    ["item.input_audio_transcription.logprobs"],
-    [hypothesisInclude, "item.input_audio_transcription.logprobs"],
-  ]) {
-    assert.equal(
-      decodeRealtimeEvent({
-        ...servers.session_updated,
-        session: { ...sessions.updated, include },
-      }),
-      null,
-      `include ${JSON.stringify(include)} is rejected`,
-    );
-  }
-});
-
-test("the production decoder rejects every canonical field mutation", async () => {
-  const servers = await fixture("server-events.json");
-  for (const [name, event] of Object.entries(servers)) {
-    assert.deepEqual(decodeRealtimeEvent(event), event, `${name} decodes unchanged`);
-    for (const fieldPath of fieldPaths(event)) {
-      const mutated = structuredClone(event);
-      const original = valueAt(mutated, fieldPath);
-      parentAt(mutated, fieldPath)[fieldPath.at(-1)] =
-        typeof original === "number" ? Number.NaN : 7;
-      assert.equal(
-        decodeRealtimeEvent(mutated),
-        null,
-        `${name} rejects invalid ${pathName(fieldPath)}`,
-      );
-
-      if (!isOptionalErrorField(fieldPath)) {
-        const omitted = structuredClone(event);
-        delete parentAt(omitted, fieldPath)[fieldPath.at(-1)];
-        assert.equal(
-          decodeRealtimeEvent(omitted),
-          null,
-          `${name} rejects missing ${pathName(fieldPath)}`,
-        );
-      }
-    }
-    for (const objectPath of objectPaths(event)) {
-      const mutated = structuredClone(event);
-      valueAt(mutated, objectPath).unexpected = true;
-      assert.equal(
-        decodeRealtimeEvent(mutated),
-        null,
-        `${name} rejects unknown ${pathName(objectPath) || "event"} field`,
-      );
-    }
-  }
-
-  assert.equal(
-    decodeRealtimeEvent({ event_id: "evt_future", type: "response.created" }),
-    null,
-    "unsupported event types are rejected",
-  );
-
-  const semanticMutations = [
-    ["empty event ID", "session_created", ["event_id"], ""],
-    ["empty session ID", "session_created", ["session", "id"], ""],
-    ["unknown include", "session_updated", ["session", "include"], ["unsupported"]],
-    ["empty item ID", "input_audio_buffer_committed", ["item_id"], ""],
-    [
-      "empty nullable lineage ID",
-      "input_audio_buffer_committed",
-      ["previous_item_id"],
-      "",
-    ],
-    ["empty conversation item ID", "conversation_item_created", ["item", "id"], ""],
-    ["wrong content index", "transcription_completed", ["content_index"], 1],
-    ["negative revision", "transcription_hypothesis", ["revision"], -1],
-    ["fractional revision", "transcription_hypothesis", ["revision"], 1.5],
-    [
-      "unsafe revision",
-      "transcription_hypothesis",
-      ["revision"],
-      Number.MAX_SAFE_INTEGER + 1,
-    ],
-    [
-      "unequal transcript partition",
-      "transcription_hypothesis",
-      ["transcript"],
-      "different",
-    ],
-    [
-      "negative audio span",
-      "transcription_hypothesis",
-      ["audio_start_ms"],
-      -1,
-    ],
-    [
-      "reversed audio span",
-      "transcription_hypothesis",
-      ["audio_start_ms"],
-      1251,
-    ],
-    [
-      "negative completion usage",
-      "transcription_completed",
-      ["usage", "seconds"],
-      -0.01,
-    ],
-    [
-      "non-finite completion usage",
-      "transcription_completed",
-      ["usage", "seconds"],
-      Number.POSITIVE_INFINITY,
-    ],
-    [
-      "empty error correlation ID",
-      "error_correlated",
-      ["error", "event_id"],
-      "",
-    ],
-    ["empty nullable error param", "error_correlated", ["error", "param"], ""],
-  ];
-  for (const [context, caseName, fieldPath, replacement] of semanticMutations) {
-    const mutated = structuredClone(servers[caseName]);
-    parentAt(mutated, fieldPath)[fieldPath.at(-1)] = replacement;
-    assert.equal(decodeRealtimeEvent(mutated), null, `${context} is rejected`);
-  }
-});
-
-test("canonical Realtime sequences cover every frozen contract path", async () => {
-  const valid = await fixture("valid-sequences.json");
-  for (const [name, sequence] of Object.entries(valid)) {
-    assertExactKeys(sequence, ["events", "invariants"], name);
-    assert.ok(sequence.events.length > 0, `${name} has events`);
-    assert.ok(sequence.invariants.length > 0, `${name} has invariants`);
-    for (const entry of sequence.events) {
-      assertExactKeys(entry, ["direction", "message"], `${name} entry`);
-      assert.ok(entry.direction === "client" || entry.direction === "server");
-      assertNonemptyString(entry.message.type, `${name} event type`);
-      if (entry.direction === "server" || "event_id" in entry.message) {
-        assertNonemptyString(entry.message.event_id, `${name} event ID`);
-      }
-      if (entry.direction === "server") {
-        assertServerEventFields(entry.message, `${name} server event`);
-        assert.deepEqual(
-          decodeRealtimeEvent(entry.message),
-          entry.message,
-          `${name} server event decodes`,
-        );
-      }
-    }
-    assertValidCommitAudio(name, sequence.events);
-  }
-  assert.deepEqual(
-    valid.hypothesis_negotiation.events
-      .filter(
-        ({ message }) =>
-          message.type === "conversation.item.input_audio_transcription.hypothesis",
-      )
-      .map(({ message }) => message.revision),
-    [1, 2],
-  );
-
-  const invalid = await fixture("invalid-sequences.json");
-  for (const [name, sequence] of Object.entries(invalid)) {
-    assertExactKeys(
-      sequence,
-      [
-        "effective_session_after",
-        "expected_error",
-        "input",
-        "keeps_connection_usable",
-      ],
-      name,
-    );
-    assert.equal(sequence.keeps_connection_usable, true);
-    assert.ok(
-      sequence.effective_session_after === "default" ||
-        sequence.effective_session_after === "updated",
-    );
-    let correlation;
-    if ("message" in sequence.input) {
-      correlation =
-        typeof sequence.input.message.event_id === "string"
-          ? sequence.input.message.event_id
-          : sequence.input.message.event_id === undefined
-            ? undefined
-            : null;
-    }
-    assertError(sequence.expected_error, correlation, `${name} expected error`);
-    assert.ok("message" in sequence.input || "wire_text" in sequence.input);
-  }
-});
diff --git a/crates/workshop/ui/test/recent-files-store.mjs b/crates/workshop/ui/test/recent-files-store.mjs
deleted file mode 100644
index 7319e8fda..000000000
--- a/crates/workshop/ui/test/recent-files-store.mjs
+++ /dev/null
@@ -1,193 +0,0 @@
-// Unit test for the recent-files store
-// (src/services/recent-files-store.ts): the adapter-backed list of
-// recently opened paths feeding File > Open Recent and the quick-access
-// "" provider. Bundles the module with esbuild and drives it over the
-// fake UI-state adapter the way main.ts binds the live one: the initial
-// value read from the user bucket, every change written back to the same
-// key. Covers: the initial list applied at construction, most-recent-first
-// order, dedupe on re-open, the retention cap, empty-path rejection, each
-// mutation writing the full list, a new instance over the written value
-// reading it back, the hand-written shape check on the initial value
-// (non-array payloads, non-string and duplicate entries), clear
-// semantics, the change event, and a writer that throws leaving the
-// in-memory list intact.
-// Run: node --test test/recent-files-store.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { RecentFilesStore, RECENT_FILES_STORE } from "./src/services/recent-files-store.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { RecentFilesStore, RECENT_FILES_STORE, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** The user-bucket key the composition root binds the store to. */
-const KEY = "recent_files";
-
-/**
- * Builds a store over a fake adapter the way main.ts binds the live one.
- * Returns the store and the fake, whose `sets` records the writes.
- */
-function storeOver(initial) {
-  const storage = createFakeUiStorage(initial === undefined ? {} : { user: { [KEY]: initial } });
-  const store = new RecentFilesStore(storage.get("user", KEY), (value) => storage.set("user", KEY, value));
-  return { store, storage };
-}
-
-/** The last recorded write's value, or undefined when nothing was written. */
-function lastWrite(storage) {
-  return storage.sets[storage.sets.length - 1]?.value;
-}
-
-// --- Self-registration --------------------------------------------------------
-
-check(
-  "the RECENT_FILES_STORE token self-registers",
-  getService(RECENT_FILES_STORE) instanceof RecentFilesStore,
-);
-check("the default instance starts empty", getService(RECENT_FILES_STORE).list.length === 0);
-
-// --- The initial value ----------------------------------------------------------
-
-{
-  const { store, storage } = storeOver(["/one.ts", "/two.ts"]);
-  check("the initial list is applied most-recent-first", store.list.join(",") === "/one.ts,/two.ts");
-  check("construction writes nothing", storage.sets.length === 0);
-  store.dispose();
-}
-
-// --- Ordering, dedupe, the cap, and the write-through ---------------------------
-
-const { store, storage } = storeOver();
-check("a fresh store is empty", store.list.length === 0);
-
-store.add("/a.ts");
-check(
-  "add writes the full list to the user bucket",
-  storage.sets.length === 1 &&
-    storage.sets[0].bucket === "user" &&
-    storage.sets[0].key === KEY &&
-    Array.isArray(storage.sets[0].value) &&
-    storage.sets[0].value.join(",") === "/a.ts",
-);
-store.add("/b.ts");
-check("adds prepend, most recent first", store.list.join(",") === "/b.ts,/a.ts");
-check("the second add writes the whole two-entry list", lastWrite(storage)?.join(",") === "/b.ts,/a.ts");
-
-store.add("/a.ts");
-check("re-adding moves the path to the front", store.list.join(",") === "/a.ts,/b.ts");
-check("re-adding does not duplicate", store.list.length === 2);
-check("re-adding writes the reordered list", lastWrite(storage)?.join(",") === "/a.ts,/b.ts");
-
-const writesBeforeEmpty = storage.sets.length;
-store.add("");
-check("an empty path is ignored", store.list.length === 2);
-check("an ignored add writes nothing", storage.sets.length === writesBeforeEmpty);
-
-for (let i = 0; i < 55; i += 1) {
-  store.add(`/f${i}.ts`);
-}
-check("the list is capped", store.list.length === 50);
-check("the newest entry leads", store.list[0] === "/f54.ts");
-check("the oldest entries drop off", !store.list.includes("/f4.ts") && store.list.includes("/f5.ts"));
-check("the written list is the capped list", lastWrite(storage)?.length === 50 && lastWrite(storage)[0] === "/f54.ts");
-
-// --- Persistence: a relaunch reads what the last write stored -----------------------
-
-{
-  const reloaded = new RecentFilesStore(storage.get("user", KEY), () => {});
-  check("a new store over the written value reads it back", reloaded.list.join(",") === store.list.join(","));
-  reloaded.dispose();
-}
-
-// --- The shape check on the initial value --------------------------------------------
-
-check("a null initial value reads as empty", storeOver(null).store.list.length === 0);
-check("a string initial value reads as empty, never a cast", storeOver("not a list").store.list.length === 0);
-check("a non-array object reads as empty", storeOver({ a: 1 }).store.list.length === 0);
-check("a number reads as empty", storeOver(42).store.list.length === 0);
-const { store: mixed } = storeOver(["ok", 42, null, "also-ok", ""]);
-check("non-string and empty entries drop out", mixed.list.join(",") === "ok,also-ok");
-const { store: duped } = storeOver(["a", "a", "b"]);
-check("persisted duplicates collapse", duped.list.join(",") === "a,b");
-
-// --- Clear and the change event -------------------------------------------------------
-
-let fires = 0;
-const subscription = store.onDidChange(() => {
-  fires += 1;
-});
-store.add("/new.ts");
-check("add fires onDidChange", fires === 1);
-store.clear();
-check("clear fires onDidChange", fires === 2);
-check("clear empties the list", store.list.length === 0);
-check("clear writes the empty list", Array.isArray(lastWrite(storage)) && lastWrite(storage).length === 0);
-const writesBeforeNoop = storage.sets.length;
-store.clear();
-check("clearing an empty store does not fire", fires === 2);
-check("clearing an empty store writes nothing", storage.sets.length === writesBeforeNoop);
-subscription.dispose();
-store.add("/after.ts");
-check("a disposed subscription stops events", fires === 2);
-
-// --- A writer that fails -----------------------------------------------------------------
-
-{
-  const memoryOnly = new RecentFilesStore();
-  memoryOnly.add("/x.ts");
-  check("a store with the default no-op writer still tracks in memory", memoryOnly.list.length === 1);
-  memoryOnly.dispose();
-
-  let attempts = 0;
-  const degraded = new RecentFilesStore(["/kept.ts"], () => {
-    attempts += 1;
-    throw new Error("denied");
-  });
-  let fired = 0;
-  degraded.onDidChange(() => {
-    fired += 1;
-  });
-  degraded.add("/y.ts");
-  check("a throwing writer is still called", attempts === 1);
-  check("a throwing write keeps the in-memory list", degraded.list.join(",") === "/y.ts,/kept.ts");
-  check("a throwing write still fires onDidChange", fired === 1);
-  degraded.clear();
-  check("a throwing write on clear still empties the list", degraded.list.length === 0 && attempts === 2);
-  degraded.dispose();
-}
-
-store.dispose();
-mixed.dispose();
-duped.dispose();
-
-if (failures.length > 0) {
-  console.error(`recent-files-store: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("recent-files-store: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/run-api.mjs b/crates/workshop/ui/test/run-api.mjs
deleted file mode 100644
index 3abe53d94..000000000
--- a/crates/workshop/ui/test/run-api.mjs
+++ /dev/null
@@ -1,281 +0,0 @@
-// Unit test for the Run window's contract client (src/services/run-api.ts).
-// Bundles the module with esbuild, imports it via a data URL, and drives it
-// against a scripted fetch. Covers: a full contract narrows field by field
-// (snake_case wire keys to the client's camelCase) and carries no tools
-// section; the implicit-args shape; narrowing rejects an unknown arg type; a
-// 422 envelope surfaces the server's code and message; a non-JSON answer and
-// a transport failure throw their typed variants.
-// Run: node --test test/run-api.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(uiDir, "..", "src", "services", "run-api.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { fetchPromptContract } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The full-frontmatter contract, as POST /prompts/contract answers it.
-const CONTRACT = {
-  name: "papergate",
-  description: "Screens papers",
-  runvil: 1,
-  max_tool_iterations: 12,
-  input: { path: "in/papers.md", description: "the papers" },
-  output: { path: "out/verdicts.md", description: "the verdicts" },
-  uses: [{ id: "tools/web" }],
-  args: {
-    implicit: false,
-    fields: [
-      { name: "topic", type: "string", optional: false, default: null, description: "the topic" },
-      { name: "deep", type: "boolean", optional: true, default: false, description: null },
-      { name: "limit", type: "integer", optional: true, default: 5, description: null },
-    ],
-  },
-  models: [
-    { label: "strong", min_context: 32000, thinking: true },
-  ],
-};
-
-function scriptFetch(responder) {
-  const calls = [];
-  globalThis.fetch = async (url, init) => {
-    calls.push({ url, init });
-    return responder(url, init);
-  };
-  return calls;
-}
-
-const json = (body, status = 200) => ({
-  ok: status >= 200 && status < 300,
-  status,
-  json: async () => body,
-});
-
-// --- A full contract narrows field by field --------------------------------
-
-{
-  const calls = scriptFetch(() => json(CONTRACT));
-  const contract = await fetchPromptContract("papergate.md", "prompt text");
-  check(
-    "the request posts name and text to the contract route",
-    calls.length === 1 &&
-      calls[0].url === "/prompts/contract" &&
-      calls[0].init.method === "POST" &&
-      JSON.parse(calls[0].init.body).name === "papergate.md" &&
-      JSON.parse(calls[0].init.body).text === "prompt text",
-  );
-  check(
-    "scalars narrow",
-    contract.name === "papergate" &&
-      contract.description === "Screens papers" &&
-      contract.runvil === 1 &&
-      contract.maxToolIterations === 12,
-  );
-  check(
-    "input and output narrow",
-    contract.input?.path === "in/papers.md" &&
-      contract.output?.path === "out/verdicts.md" &&
-      contract.output?.description === "the verdicts",
-  );
-  check(
-    "uses narrow",
-    contract.uses.length === 1 && contract.uses[0].id === "tools/web",
-  );
-  check("a contract without tools narrows with no tools section", !("tools" in contract));
-  check(
-    "arg fields narrow with defaults and descriptions",
-    contract.args.implicit === false &&
-      contract.args.fields.length === 3 &&
-      contract.args.fields[0].name === "topic" &&
-      contract.args.fields[0].type === "string" &&
-      contract.args.fields[0].optional === false &&
-      contract.args.fields[1].default === false &&
-      contract.args.fields[2].type === "integer" &&
-      contract.args.fields[2].default === 5,
-  );
-  // The Run window shows a described arg's text as a second line under its
-  // label and draws no line for an undescribed one, so the narrowed
-  // description must survive as the string, or as null when the prompt
-  // gives none.
-  check(
-    "an arg's description narrows to its text, or null when the prompt gives none",
-    contract.args.fields[0].description === "the topic" &&
-      contract.args.fields[1].description === null &&
-      contract.args.fields[2].description === null,
-  );
-  check(
-    "model roles narrow",
-    contract.models.length === 1 &&
-      contract.models[0].label === "strong" &&
-      contract.models[0].minContext === 32000 &&
-      contract.models[0].thinking === true,
-  );
-}
-
-// --- Absent sections narrow to null; implicit args name the prose field ----
-
-{
-  scriptFetch(() =>
-    json({
-      name: "bare",
-      description: "",
-      runvil: null,
-      max_tool_iterations: null,
-      input: null,
-      output: null,
-      uses: [],
-      args: {
-        implicit: true,
-        fields: [
-          { name: "prose", type: "string", optional: false, default: null, description: null },
-        ],
-      },
-      models: [],
-    }),
-  );
-  const contract = await fetchPromptContract("bare.md", "text");
-  check(
-    "absent sections narrow to null",
-    contract.runvil === null &&
-      contract.maxToolIterations === null &&
-      contract.input === null &&
-      contract.output === null,
-  );
-  check(
-    "the implicit args declaration names the single prose field",
-    contract.args.implicit === true &&
-      contract.args.fields.length === 1 &&
-      contract.args.fields[0].name === "prose" &&
-      contract.args.fields[0].type === "string",
-  );
-}
-
-// --- Model requirements: null forms narrow to null, a bad shape is refused ---
-
-{
-  scriptFetch(() =>
-    json({
-      ...CONTRACT,
-      models: [{ label: "fast", min_context: null, thinking: null }],
-    }),
-  );
-  const contract = await fetchPromptContract("p.md", "text");
-  check(
-    "a role with no requirements narrows both to null",
-    contract.models.length === 1 &&
-      contract.models[0].label === "fast" &&
-      contract.models[0].minContext === null &&
-      contract.models[0].thinking === null,
-  );
-}
-
-{
-  scriptFetch(() =>
-    json({
-      ...CONTRACT,
-      models: [{ label: "strong", min_context: null, thinking: "yes" }],
-    }),
-  );
-  let caught = null;
-  try {
-    await fetchPromptContract("p.md", "text");
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "a model entry whose thinking is a string is a shape failure",
-    caught !== null && caught.code === "unexpected_shape",
-  );
-}
-
-// --- Narrowing rejects unknown variants -------------------------------------
-
-{
-  scriptFetch(() =>
-    json({
-      ...CONTRACT,
-      args: {
-        implicit: false,
-        fields: [
-          { name: "when", type: "date", optional: true, default: null, description: null },
-        ],
-      },
-    }),
-  );
-  let caught = null;
-  try {
-    await fetchPromptContract("p.md", "text");
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "an unknown arg type is a shape failure",
-    caught !== null && caught.code === "unexpected_shape",
-  );
-}
-
-// --- A 422 envelope surfaces the server's code and message ------------------
-
-{
-  scriptFetch(() =>
-    json(
-      { error: { code: "parse_frontmatter", message: "line 3: bad YAML key" } },
-      422,
-    ),
-  );
-  let caught = null;
-  try {
-    await fetchPromptContract("broken.md", "text");
-  } catch (error) {
-    caught = error;
-  }
-  check(
-    "a 422 surfaces the status",
-    caught !== null && caught.status === 422,
-  );
-  check(
-    "a 422 surfaces the server's code and message",
-    caught !== null &&
-      caught.message.includes("parse_frontmatter") &&
-      caught.message.includes("line 3: bad YAML key"),
-  );
-}
-
-// --- Transport and non-JSON failures throw their typed variants -------------
-
-{
-  scriptFetch(() => {
-    throw new TypeError("connection refused");
-  });
-  let caught = null;
-  try {
-    await fetchPromptContract("p.md", "text");
-  } catch (error) {
-    caught = error;
-  }
-  check("a transport failure is typed", caught !== null && caught.code === "transport");
-}
-
-if (failures.length > 0) {
-  console.error(`run-api: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("run-api: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/run-panel.mjs b/crates/workshop/ui/test/run-panel.mjs
deleted file mode 100644
index 3543887ee..000000000
--- a/crates/workshop/ui/test/run-panel.mjs
+++ /dev/null
@@ -1,891 +0,0 @@
-// Integration test for the Run window panel (src/parts/run/, the tab's
-// loading shimmer through setTabLoading in src/parts/layout/panel-tab.ts,
-// the tree's drag-out in
-// workshop-panel.ts, and the drop-target dispatch in workspace-drops.ts).
-// Bundles the modules with esbuild, mounts a real Dockview dock in jsdom,
-// and scripts fetch for /workspace/tree, /workspace/file, /prompts/contract,
-// and /workspace/grant. Covers: the empty open, and the Run tab title for
-// an empty path; a pre-filled open reaching
-// ready with one row per contract item and no tool row; the shimmer class on the tab title
-// in loading and its absence in ready and error, including after the
-// overflow list inits a second tab for the panel; tree dragstart setting
-// application/x-workshop-path and a tree drop loading the prompt; an OS
-// drop granting then loading the first .md; a Browse pick granted then
-// loading to ready; a parse failure rendering the
-// line-numbered error row with Choose Prompt; two opens
-// yielding two windows; and a superseded load discarded by the generation
-// counter.
-// The Cursor Settings layout is covered too: an arg's description as a
-// visible second line (never a tooltip), a boolean arg as a .switch, the
-// screen-reader-only Prompt label tied to its field, Browse... and Choose
-// Prompt as inline links, the drag-over class a droppable drag sets, Choose
-// Prompt and Choose Input opening the form modal with Cancel first, and the
-// stylesheet's values (the 4% card, the 12px rows, the stacked layout under
-// 500px, the 35px toolbar, the 22px state lines, the footer), read from the
-// source because jsdom applies no layout.
-// Run: node --test test/run-panel.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { readUi, resolver, rulesOf, valueIn } from "./helpers/css-values.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      // The panel types this test opens register from their contributions.
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/run/run.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export { initZones, openInZone, panelIdFor, zoneOfPanel } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-      export { setupWorkspaceDrops } from "./src/parts/workspace/workspace-drops.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-  },
-});
-
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-// The agent panel composes an AgentSocket on init; a scripted stand-in
-// that never opens keeps the panel inert.
-globalThis.WebSocket = class {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  readyState = 0;
-  send() {}
-  close() {}
-};
-
-// --- The scripted workspace and prompt routes --------------------------------
-
-const ROOT = "C:\\project";
-const PROMPT = `${ROOT}\\prompt.md`;
-const BROKEN = `${ROOT}\\broken.md`;
-const SLOW = `${ROOT}\\slow.md`;
-const FAST = `${ROOT}\\fast.md`;
-const OSDROP = `${ROOT}\\osdrop.md`;
-
-const calls = [];
-// Paths whose /workspace/file answer pends until releaseDeferred() runs.
-const deferred = new Map();
-
-function contractFor(name) {
-  return {
-    name,
-    description: `contract for ${name}`,
-    runvil: 1,
-    max_tool_iterations: 12,
-    input: { path: "in/papers.md", description: "the papers" },
-    output: { path: "out/verdicts.md", description: "the verdicts" },
-    uses: [{ id: "tools/web" }],
-    args: {
-      implicit: false,
-      fields: [
-        { name: "topic", type: "string", optional: false, default: null, description: "the topic" },
-        { name: "deep", type: "boolean", optional: true, default: false, description: null },
-        { name: "limit", type: "integer", optional: true, default: 5, description: null },
-      ],
-    },
-    models: [
-      { label: "strong", min_context: 32000, thinking: true },
-      { label: "small", min_context: null, thinking: false },
-      { label: "fast", min_context: null, thinking: null },
-    ],
-  };
-}
-
-const json = (body, status = 200) => ({
-  ok: status >= 200 && status < 300,
-  status,
-  json: async () => body,
-});
-
-globalThis.fetch = (url, init) => {
-  const target = typeof url === "string" ? url : url.url;
-  const method = init?.method ?? "GET";
-  calls.push({ url: target, method });
-  if (target.startsWith("/workspace/tree")) {
-    const query = target.includes("?") ? new URL(target, "http://127.0.0.1:7910").searchParams : null;
-    const pathParam = query ? query.get("path") : null;
-    if (pathParam === null || pathParam === "") {
-      return Promise.resolve(
-        json({ path: null, entries: [{ name: "project", path: ROOT, kind: "directory", size: 0, modified_ms: 100, exists: true }] }),
-      );
-    }
-    if (pathParam === ROOT) {
-      return Promise.resolve(
-        json({
-          path: ROOT,
-          entries: [
-            { name: "prompt.md", path: PROMPT, kind: "file", size: 3, modified_ms: 100, exists: true },
-            { name: "slow.md", path: SLOW, kind: "file", size: 3, modified_ms: 100, exists: true },
-            { name: "fast.md", path: FAST, kind: "file", size: 3, modified_ms: 100, exists: true },
-          ],
-        }),
-      );
-    }
-  }
-  if (target.startsWith("/workspace/file")) {
-    const pathParam = new URL(target, "http://127.0.0.1:7910").searchParams.get("path");
-    if (deferred.has(pathParam)) {
-      return new Promise((resolve) => deferred.set(pathParam, resolve));
-    }
-    return Promise.resolve(
-      json({ path: pathParam, size: 7, token: "t100", text: `text of ${pathParam}` }),
-    );
-  }
-  if (target === "/prompts/contract" && method === "POST") {
-    const name = JSON.parse(init.body).name;
-    if (name.includes("broken")) {
-      return Promise.resolve(
-        json({ error: { code: "parse_frontmatter", message: "line 3: bad YAML key" } }, 422),
-      );
-    }
-    return Promise.resolve(json(contractFor(name)));
-  }
-  if (target === "/workspace/grant" && method === "POST") {
-    return Promise.resolve(json({ granted: JSON.parse(init.body).path }));
-  }
-  throw new Error(`unexpected fetch in the run-panel test: ${target}`);
-};
-
-function releaseDeferred(path) {
-  const resolve = deferred.get(path);
-  deferred.delete(path);
-  resolve?.({
-    ok: true,
-    status: 200,
-    json: async () => ({ path, size: 7, token: "t100", text: `text of ${path}` }),
-  });
-}
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "HTMLInputElement",
-  "HTMLTextAreaElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "run-panel-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  initZones,
-  openInZone,
-  panelIdFor,
-  createPanelComponent,
-  createPanelTabComponent,
-  PANEL_TAB,
-  setupWorkspaceDrops,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// jsdom has no DragEvent; a plain Event with a scripted dataTransfer is
-// enough for the handlers' types/getData probes.
-function syntheticDrag(type, target, dataTransfer) {
-  const event = new window.Event(type, { cancelable: true, bubbles: true });
-  Object.defineProperty(event, "dataTransfer", { value: dataTransfer });
-  target.dispatchEvent(event);
-  return event;
-}
-
-// The run panel's element, once the lazy chunk has swapped it in.
-function runElement(panel) {
-  return panel.view.content.element.querySelector(".ws-run-panel");
-}
-
-const dock = createDockview(window.document.getElementById("dock"), {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  defaultTabComponent: PANEL_TAB,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-
-// The tree anchors the left zone and provides the drag source rows.
-openInZone("tree", {});
-await flush();
-
-// --- Empty open: the prompt field, Browse, and the drop zone ----------------
-
-const emptyRun = openInZone("run", { instance: "empty" });
-await flush();
-const emptyEl = runElement(emptyRun);
-check("an empty Run window mounts", !!emptyEl);
-check("the empty window shows the prompt field", !!emptyEl?.querySelector(".ws-run-panel__prompt-path"));
-check("the empty window shows a Browse button", !!emptyEl?.querySelector(".ws-run-panel__browse"));
-check("the panel root is the file-drop target", emptyEl?.hasAttribute("data-ws-file-drop") === true);
-check("the empty window shows the empty-state hint", !!emptyEl?.querySelector(".ws-run-panel__hint"));
-const hintLink = emptyEl?.querySelector(".ws-run-panel__hint .ws-run-panel__link");
-check(
-  "the empty state offers Browse... as an inline link in the hint",
-  emptyEl?.querySelector(".ws-run-panel__hint")?.textContent === "Drop a prompt file here, or Browse..." &&
-    hintLink?.tagName === "BUTTON" &&
-    hintLink.textContent === "Browse..." &&
-    !hintLink.classList.contains("button"),
-);
-const promptLabel = emptyEl?.querySelector(".ws-run-panel__prompt-label");
-const promptPath = emptyEl?.querySelector(".ws-run-panel__prompt-path");
-check(
-  "the Prompt label is a real label tied to the path field",
-  promptLabel?.tagName === "LABEL" &&
-    promptLabel.textContent === "Prompt" &&
-    typeof promptPath?.id === "string" &&
-    promptPath.id.length > 0 &&
-    promptLabel.htmlFor === promptPath.id,
-);
-check(
-  "the toolbar lists the label, the path field, then Browse",
-  [...(emptyEl?.querySelector(".ws-run-panel__toolbar")?.children ?? [])]
-    .map((child) => child.className.split(" ").find((name) => name.startsWith("ws-run-panel__")))
-    .join(",") === "ws-run-panel__prompt-label,ws-run-panel__prompt-path,ws-run-panel__browse",
-);
-check("the Run button is disabled before ready", emptyEl?.querySelector(".ws-run-panel__run")?.disabled === true);
-check("an empty open fetches nothing", calls.filter((c) => c.url.startsWith("/workspace/file")).length === 0);
-
-const blankRun = openInZone("run", { instance: "blank", path: "" });
-await flush();
-check(
-  "a Run window opened with an empty path shows the Run tab title",
-  blankRun.title === "Run" &&
-    blankRun.view.tab.element.querySelector(".dv-default-tab-content")?.textContent === "Run",
-);
-check(
-  "two windows give their path fields distinct ids",
-  runElement(blankRun)?.querySelector(".ws-run-panel__prompt-path")?.id !== promptPath?.id &&
-    runElement(blankRun)?.querySelector(".ws-run-panel__prompt-label")?.htmlFor ===
-      runElement(blankRun)?.querySelector(".ws-run-panel__prompt-path")?.id,
-);
-
-// --- Pre-filled open: loading shimmers, then one row per contract item ------
-
-deferred.set(PROMPT, null);
-const filledRun = openInZone("run", { instance: "filled", path: PROMPT });
-await flush();
-const filledEl = runElement(filledRun);
-check("a pre-filled window mounts", !!filledEl);
-const filledTabContent = filledRun.view.tab.element.querySelector(".dv-default-tab-content");
-check(
-  "the tab title shimmers while loading",
-  filledTabContent?.classList.contains("ws-shimmer-text") === true,
-);
-check("the body stays blank while loading", filledEl?.querySelector(".ws-run-panel__rows") === null);
-// The overflow list's row renderer: a second tab for the same panel id,
-// which Dockview never disposes.
-const overflowTab = filledRun.view.createTabRenderer("headerOverflow");
-check(
-  "an overflow copy of the tab picks up the loading shimmer",
-  overflowTab.element.querySelector(".dv-default-tab-content")?.classList.contains("ws-shimmer-text") === true,
-);
-releaseDeferred(PROMPT);
-await flush();
-check(
-  "the shimmer clears on ready, on the header tab and not its overflow copy",
-  filledTabContent?.classList.contains("ws-shimmer-text") === false,
-);
-check(
-  "the file read precedes the contract post",
-  calls.some((c) => c.url.startsWith("/workspace/file")) &&
-    calls.some((c) => c.url === "/prompts/contract" && c.method === "POST"),
-);
-check("the title names the loaded prompt", filledRun.title === "Run: prompt.md");
-
-const rows = [...filledEl.querySelectorAll(".ws-run-panel__row")];
-const rowText = (label) =>
-  rows.find((row) => row.querySelector(".ws-run-panel__row-label")?.textContent === label);
-check("the name renders as a read-only row", rowText("name")?.textContent.includes("prompt.md") === true);
-check(
-  "the description renders as a read-only row",
-  rowText("description")?.textContent.includes("contract for prompt.md") === true,
-);
-const inputField = rowText("input")?.querySelector("input");
-check(
-  "the input row is a text field prefilled from the contract, with Browse",
-  inputField?.value === "in/papers.md" && !!rowText("input")?.querySelector("button"),
-);
-const outputField = rowText("output")?.querySelector("input");
-check("the output row is a prefilled text field", outputField?.value === "out/verdicts.md");
-const topicRow = rowText("topic");
-check(
-  "a required arg is marked required",
-  topicRow?.querySelector(".ws-run-panel__required") !== null &&
-    topicRow?.querySelector("input") !== null,
-);
-const topicDescription = topicRow?.querySelector(".ws-run-panel__row-description");
-check(
-  "an arg's description is a visible second line under its label",
-  topicDescription?.textContent === "the topic" &&
-    topicDescription.parentElement === topicRow.querySelector(".ws-run-panel__row-label")?.parentElement?.parentElement &&
-    topicRow.querySelector(".ws-run-panel__row-text") === topicDescription.parentElement,
-);
-check(
-  "an arg's description is not also a tooltip",
-  topicRow?.querySelector("input")?.getAttribute("title") === null &&
-    topicRow.getAttribute("title") === null,
-);
-const deepRow = rowText("deep");
-const deepSwitch = deepRow?.querySelector("button.switch");
-check(
-  "a boolean arg is a switch from its default, not a checkbox",
-  deepSwitch?.getAttribute("role") === "switch" &&
-    deepSwitch.getAttribute("type") === "button" &&
-    deepSwitch.getAttribute("aria-checked") === "false" &&
-    deepRow.querySelector('input[type="checkbox"]') === null,
-);
-deepSwitch?.click();
-check("clicking a switch turns it on", deepSwitch?.getAttribute("aria-checked") === "true");
-deepSwitch?.click();
-check("clicking it again turns it off", deepSwitch?.getAttribute("aria-checked") === "false");
-const limitRow = rowText("limit");
-check(
-  "an arg without a description has no second line",
-  deepRow?.querySelector(".ws-run-panel__row-description") === null &&
-    limitRow?.querySelector(".ws-run-panel__row-description") === null,
-);
-check(
-  "an integer arg is a numeric control prefilled from its default",
-  limitRow?.querySelector('input[type="number"]')?.value === "5" &&
-    limitRow.querySelector('input[type="number"]')?.step === "1",
-);
-check(
-  "the ready panel renders no tool row",
-  rows.length > 0 && filledEl.querySelector(".ws-run-panel__row--tool") === null,
-);
-const modelRow = rowText("strong");
-check(
-  "a model role renders min_context and thinking read-only",
-  modelRow?.textContent.includes("min context 32000, thinking") === true,
-);
-check(
-  "a role that requires no thinking reads no thinking",
-  rowText("small")?.textContent.includes("no thinking") === true,
-);
-check(
-  "a role with no requirements shows only its label",
-  rowText("fast")?.textContent === "fast",
-);
-const iterationsField = rowText("max_tool_iterations")?.querySelector('input[type="number"]');
-check("max_tool_iterations prefills from the contract", iterationsField?.value === "12");
-
-const fetchesBeforeRun = calls.length;
-const runButton = filledEl.querySelector(".ws-run-panel__run");
-check("the Run button is enabled in ready", runButton?.disabled === false);
-runButton.click();
-await flush();
-check("the Run button does nothing when clicked", calls.length === fetchesBeforeRun);
-
-// --- Tree drag: dragstart sets the MIME type; a drop loads the prompt -------
-
-const projectRow = [...window.document.querySelectorAll(".ws-workshop-tree__row")].find(
-  (row) => row.textContent === "project",
-);
-projectRow.click();
-await flush();
-const fileRow = [...window.document.querySelectorAll(".ws-workshop-tree__row")].find(
-  (row) => row.textContent === "prompt.md",
-);
-check("the tree file row is draggable", fileRow?.draggable === true);
-const drags = [];
-syntheticDrag("dragstart", fileRow, {
-  setData: (type, value) => drags.push({ type, value }),
-});
-check(
-  "a tree dragstart sets application/x-workshop-path to the entry path",
-  drags.length === 1 && drags[0].type === "application/x-workshop-path" && drags[0].value === PROMPT,
-);
-
-// Dropping the tree path onto the empty window loads it.
-const treeDrop = syntheticDrag("drop", emptyEl.querySelector(".ws-run-panel__body"), {
-  types: ["application/x-workshop-path"],
-  getData: (type) => (type === "application/x-workshop-path" ? PROMPT : ""),
-});
-await flush();
-check("a tree drop on the zone is accepted", treeDrop.defaultPrevented === true);
-check(
-  "a tree drop loads the prompt to ready",
-  emptyEl.querySelector(".ws-run-panel__rows") !== null &&
-    emptyEl.querySelector(".ws-run-panel__run")?.disabled === false,
-);
-
-// The content column holds the toolbar, body, and footer, and the panel's
-// dialogs mount beside it, so the column's width container never contains them.
-check(
-  "the content column holds the toolbar, the body, and the footer",
-  [...(emptyEl.querySelector(".ws-run-panel__content")?.children ?? [])]
-    .map((child) => child.className)
-    .join(",") === "ws-run-panel__toolbar,ws-run-panel__body,ws-run-panel__footer",
-);
-
-// --- Drag over: a droppable drag marks the panel with the overlay class -----
-
-const OVER = "ws-run-panel--drag-over";
-const dragRun = openInZone("run", { instance: "dragover" });
-await flush();
-const dragEl = runElement(dragRun);
-const dragBody = dragEl.querySelector(".ws-run-panel__body");
-const dragHint = dragEl.querySelector(".ws-run-panel__hint");
-const TREE_DRAG = { types: ["application/x-workshop-path"], getData: () => "" };
-check("a panel at rest carries no drag-over class", !dragEl.classList.contains(OVER));
-syntheticDrag("dragenter", dragBody, TREE_DRAG);
-check("a tree drag entering marks the panel", dragEl.classList.contains(OVER));
-syntheticDrag("dragenter", dragHint, TREE_DRAG);
-syntheticDrag("dragleave", dragBody, TREE_DRAG);
-check("moving onto a child keeps the mark", dragEl.classList.contains(OVER));
-syntheticDrag("dragleave", dragHint, TREE_DRAG);
-check("leaving the panel clears the mark", !dragEl.classList.contains(OVER));
-syntheticDrag("dragenter", dragBody, { types: ["Files"] });
-check("an OS file drag entering marks the panel", dragEl.classList.contains(OVER));
-syntheticDrag("drop", dragBody, { types: ["Files"], getData: () => "" });
-check("a drop clears the mark", !dragEl.classList.contains(OVER));
-syntheticDrag("dragenter", dragBody, { types: ["text/plain"] });
-check("an unrelated drag never marks the panel", !dragEl.classList.contains(OVER));
-syntheticDrag("dragleave", dragBody, { types: ["text/plain"] });
-syntheticDrag("dragenter", dragBody, TREE_DRAG);
-syntheticDrag("drop", dragBody, { types: ["application/x-workshop-path"], getData: () => FAST });
-await flush();
-check(
-  "a tree drop clears the mark and still loads the prompt",
-  !dragEl.classList.contains(OVER) && dragEl.querySelector(".ws-run-panel__rows") !== null,
-);
-
-// A drag that ends with no drop on the panel (canceled, or released
-// elsewhere) is the source row's dragend bubbling up to the window. It
-// clears the mark and the enter/leave depth count, so the next drag starts
-// from zero instead of needing extra leaves to clear.
-const dragEndRun = openInZone("run", { instance: "dragend" });
-await flush();
-const dragEndEl = runElement(dragEndRun);
-const dragEndBody = dragEndEl.querySelector(".ws-run-panel__body");
-const dragEndHint = dragEndEl.querySelector(".ws-run-panel__hint");
-syntheticDrag("dragenter", dragEndBody, TREE_DRAG);
-syntheticDrag("dragenter", dragEndHint, TREE_DRAG);
-check("a tree drag over a child marks the panel", dragEndEl.classList.contains(OVER));
-syntheticDrag("dragend", fileRow, TREE_DRAG);
-check("a drag that ends over the panel clears the mark", !dragEndEl.classList.contains(OVER));
-syntheticDrag("dragenter", dragEndBody, TREE_DRAG);
-check("a new drag marks the panel again after a drag ended", dragEndEl.classList.contains(OVER));
-syntheticDrag("dragleave", dragEndBody, TREE_DRAG);
-check(
-  "a drag that ended leaves no depth behind: one leave clears the next mark",
-  !dragEndEl.classList.contains(OVER),
-);
-
-// --- OS drop: grant first, then the first .md loads --------------------------
-
-window.__TAURI_INTERNALS__ = {};
-const statusMessages = [];
-setupWorkspaceDrops({ showLocal: (label, severity) => statusMessages.push({ label, severity }) });
-
-const osRun = openInZone("run", { instance: "osdrop" });
-await flush();
-const osEl = runElement(osRun);
-const targetDrops = [];
-osEl.addEventListener("workshop:file-drop", (event) => targetDrops.push(event.detail.paths));
-const grantsBefore = calls.filter((c) => c.url === "/workspace/grant").length;
-syntheticDrag("drop", osEl.querySelector(".ws-run-panel__body"), { types: ["Files"] });
-window.dispatchEvent(
-  new window.CustomEvent("runvil:file-drop", {
-    detail: { paths: [`${ROOT}\\notes.txt`, OSDROP] },
-  }),
-);
-await flush();
-const grants = calls.filter((c) => c.url === "/workspace/grant").length - grantsBefore;
-check("an OS drop grants every path before the read", grants === 2);
-check(
-  "the drop target receives the workshop:file-drop dispatch after granting",
-  targetDrops.length === 1 && targetDrops[0].join("|") === `${ROOT}\\notes.txt|${OSDROP}`,
-);
-check(
-  "the first .md of an OS drop loads to ready",
-  osEl.querySelector(".ws-run-panel__rows") !== null &&
-    [...osEl.querySelectorAll(".ws-run-panel__row")].some((row) =>
-      row.textContent.includes("osdrop.md"),
-    ),
-);
-
-// --- Browse: the picked path is granted, then loads to ready -----------------
-
-// __TAURI_INTERNALS__ is set (the OS-drop section), so Browse takes the
-// native-picker path, answered by the aliased tauri-dialog stub.
-const BROWSED = `${ROOT}\\browsed.md`;
-const browseRun = openInZone("run", { instance: "browse" });
-await flush();
-const browseEl = runElement(browseRun);
-window.__TAURI_DIALOG__ = { calls: [], answer: BROWSED };
-const grantsBeforeBrowse = calls.filter((c) => c.url === "/workspace/grant").length;
-browseEl.querySelector(".ws-run-panel__browse").click();
-await flush();
-check(
-  "Browse opens the native picker filtered to .md",
-  window.__TAURI_DIALOG__.calls.length === 1 &&
-    window.__TAURI_DIALOG__.calls[0].kind === "open" &&
-    window.__TAURI_DIALOG__.calls[0].filters?.[0]?.extensions?.includes("md") === true,
-);
-const browsedGrant = calls.findIndex((c, i) => i >= grantsBeforeBrowse && c.url === "/workspace/grant");
-const browsedRead = calls.findIndex(
-  (c) => c.url.startsWith("/workspace/file") && c.url.includes("browsed.md"),
-);
-check(
-  "a Browse pick is granted before the read",
-  browsedGrant !== -1 && browsedRead !== -1 && browsedGrant < browsedRead,
-);
-check(
-  "a Browse pick loads the prompt to ready",
-  browseEl.querySelector(".ws-run-panel__rows") !== null &&
-    [...browseEl.querySelectorAll(".ws-run-panel__row")].some((row) =>
-      row.textContent.includes("browsed.md"),
-    ) &&
-    browseEl.querySelector(".ws-run-panel__run")?.disabled === false,
-);
-
-// --- Parse failure: the line-numbered error row and Choose Prompt -----------
-
-const brokenRun = openInZone("run", { instance: "broken", path: BROKEN });
-await flush();
-const brokenEl = runElement(brokenRun);
-const errorRow = brokenEl?.querySelector(".ws-run-panel__error");
-check("a parse failure renders the error row", !!errorRow);
-check(
-  "the error row shows the server's line-numbered message",
-  errorRow?.textContent.includes("line 3: bad YAML key") === true,
-);
-check("the error row is announced as an alert", errorRow?.getAttribute("role") === "alert");
-check("the error state offers Choose Prompt", !!brokenEl?.querySelector(".ws-run-panel__choose"));
-const chooseLink = brokenEl?.querySelector(".ws-run-panel__choose");
-const errorBlock = errorRow?.closest(".ws-run-panel__message") ?? null;
-check(
-  "Choose Prompt is an inline link beside the error text, not a button",
-  chooseLink?.tagName === "BUTTON" &&
-    chooseLink.textContent === "Choose Prompt" &&
-    chooseLink.classList.contains("ws-run-panel__link") &&
-    !chooseLink.classList.contains("button") &&
-    errorBlock !== null &&
-    errorBlock === chooseLink.closest(".ws-run-panel__message"),
-);
-check(
-  "the alert carries the server's message and not the link's text",
-  errorRow?.textContent.includes("line 3: bad YAML key") === true &&
-    !errorRow.textContent.includes("Choose Prompt"),
-);
-check(
-  "the shimmer clears on error",
-  brokenRun.view.tab.element
-    .querySelector(".dv-default-tab-content")
-    ?.classList.contains("ws-shimmer-text") === false,
-);
-check("the Run button stays disabled in error", brokenEl?.querySelector(".ws-run-panel__run")?.disabled === true);
-
-// --- Two opens yield two windows ---------------------------------------------
-
-const first = openInZone("run", { instance: "one" });
-const second = openInZone("run", { instance: "two" });
-check(
-  "two opens produce two windows with distinct ids",
-  first !== second && first.id === "run:one" && second.id === "run:two",
-);
-check("run panel ids key by instance", panelIdFor("run", { instance: "one" }) === "run:one");
-
-// --- A superseded load is discarded by the generation counter ----------------
-
-const genRun = openInZone("run", { instance: "gen" });
-await flush();
-const genEl = runElement(genRun);
-// The slow load pends at the file read; the fast load lands first and
-// must win even after the slow read resolves.
-deferred.set(SLOW, null);
-syntheticDrag("drop", genEl.querySelector(".ws-run-panel__body"), {
-  types: ["application/x-workshop-path"],
-  getData: () => SLOW,
-});
-syntheticDrag("drop", genEl.querySelector(".ws-run-panel__body"), {
-  types: ["application/x-workshop-path"],
-  getData: () => FAST,
-});
-await flush();
-releaseDeferred(SLOW);
-await flush();
-const genRows = [...genEl.querySelectorAll(".ws-run-panel__row")].map((row) => row.textContent);
-check(
-  "a superseded load never renders",
-  genRows.some((text) => text.includes("contract for fast.md")) &&
-    !genRows.some((text) => text.includes("contract for slow.md")),
-);
-
-// --- Dialogs: Choose Prompt and Choose Input open the form modal, Cancel first
-
-// A plain browser has no native picker, so Browse takes the typed-path dialog.
-delete window.__TAURI_INTERNALS__;
-
-const dialogButtons = (dialog) =>
-  [...dialog.querySelectorAll(".modal-actions button")].map((button) => button.textContent);
-
-const dialogRun = openInZone("run", { instance: "dialogs" });
-await flush();
-const dialogEl = runElement(dialogRun);
-dialogEl.querySelector(".ws-run-panel__hint .ws-run-panel__link").click();
-await flush();
-const chooseDialog = dialogEl.querySelector(".ws-run-choose");
-check("the Browse... link opens Choose Prompt", chooseDialog !== null);
-check(
-  "Choose Prompt uses the form modal skin",
-  chooseDialog?.classList.contains("modal-dialog--form") === true &&
-    dialogEl.querySelector(".ws-run-choose-overlay")?.classList.contains("modal-overlay--form") === true,
-);
-check(
-  "a dialog mounts beside the content column, outside the width container",
-  dialogEl.querySelector(".ws-run-choose-overlay")?.parentElement === dialogEl &&
-    dialogEl.querySelector(".ws-run-panel__content .ws-run-choose-overlay") === null,
-);
-check(
-  "Choose Prompt puts Cancel first and the primary Choose last",
-  dialogButtons(chooseDialog).join(",") === "Cancel,Choose" &&
-    chooseDialog.querySelector(".modal-actions button:last-child")?.classList.contains("button-primary") === true,
-);
-const chooseButton = chooseDialog.querySelector(".modal-actions button:last-child");
-check("Choose waits for a path", chooseButton.disabled === true);
-const chooseField = chooseDialog.querySelector("input");
-chooseField.value = `${ROOT}\\typed.md`;
-chooseField.dispatchEvent(new window.Event("input", { bubbles: true }));
-check("Choose enables once a path is typed", chooseButton.disabled === false);
-chooseButton.click();
-await flush();
-check("Choose closes the dialog and loads the typed prompt", dialogEl.querySelector(".ws-run-choose") === null &&
-  [...dialogEl.querySelectorAll(".ws-run-panel__row")].some((row) => row.textContent.includes("typed.md")));
-
-dialogEl.querySelector(".ws-run-panel__input-browse").click();
-await flush();
-const inputDialog = dialogEl.querySelector(".ws-run-input");
-check("the input row's Browse opens Choose Input", inputDialog !== null);
-check(
-  "Choose Input uses the form modal skin with Cancel first",
-  inputDialog?.classList.contains("modal-dialog--form") === true &&
-    dialogButtons(inputDialog).join(",") === "Cancel,Choose",
-);
-const inputPath = inputDialog.querySelector("input");
-inputPath.value = `${ROOT}\\input.md`;
-inputPath.dispatchEvent(new window.Event("input", { bubbles: true }));
-inputDialog.querySelector(".modal-actions button:last-child").click();
-await flush();
-check(
-  "Choose Input fills the input row's field",
-  dialogEl.querySelector(".ws-run-input") === null &&
-    [...dialogEl.querySelectorAll(".ws-run-panel__row")]
-      .find((row) => row.querySelector(".ws-run-panel__row-label")?.textContent === "input")
-      ?.querySelector("input")?.value === `${ROOT}\\input.md`,
-);
-
-brokenEl.querySelector(".ws-run-panel__choose").click();
-await flush();
-const errorChoose = brokenEl.querySelector(".ws-run-choose");
-check("the error state's Choose Prompt link opens the same dialog", errorChoose !== null);
-errorChoose.querySelector(".modal-actions button:first-child").click();
-await flush();
-check("Cancel dismisses Choose Prompt", brokenEl.querySelector(".ws-run-choose") === null);
-
-// --- The stylesheet: Cursor Settings rows, states, toolbar, and footer ------
-
-const resolve = await resolver();
-const runCss = await readUi("src/parts/run/run-panel.css");
-const runRules = rulesOf(runCss);
-const css = (selector, property, at = null) => resolve(valueIn(runRules, selector, property, at));
-const px = (selector, property) => css(selector, property);
-const MUTED = "color-mix(in srgb, #f0f0f0 4%, transparent)";
-
-check("the rows form a 4% tinted card", css(".ws-run-panel__rows", "background") === MUTED);
-check("the card has a 12px radius", css(".ws-run-panel__rows", "border-radius") === "12px");
-check("a row pads 12px", px(".ws-run-panel__row", "padding") === "12px");
-check("a row's gap is 20px", px(".ws-run-panel__row", "gap") === "20px");
-check(
-  "an inset divider at 4% sits above every row after the first",
-  css(".ws-run-panel__row + .ws-run-panel__row::before", "background") === MUTED &&
-    css(".ws-run-panel__row + .ws-run-panel__row::before", "left") === "12px" &&
-    css(".ws-run-panel__row + .ws-run-panel__row::before", "right") === "12px" &&
-    css(".ws-run-panel__row + .ws-run-panel__row::before", "height") === "1px",
-);
-check("a row's label is 13px", px(".ws-run-panel__row-label", "font-size") === "13px");
-check("a row's label is the primary text", css(".ws-run-panel__row-label", "color") === "#f0f0f0");
-check("a description is 13px", px(".ws-run-panel__row-description", "font-size") === "13px");
-check(
-  "a description is the secondary text",
-  css(".ws-run-panel__row-description", "color") === "color-mix(in srgb, #f0f0f0 74%, transparent)",
-);
-// The container is the content column, which is never the scroller, so its
-// width excludes no scrollbar gutter: a panel 500 to 509px wide stays side by
-// side. It is not the panel element, whose containment would make it the
-// containing block for the dialogs' fixed overlay.
-check(
-  "the content column is the width container for the stacked layout",
-  css(".ws-run-panel__content", "container-type") === "inline-size",
-);
-check(
-  "the scrolling body is not the width container",
-  css(".ws-run-panel__body", "container-type") === undefined &&
-    css(".ws-run-panel__body", "overflow") === "auto",
-);
-check(
-  "the panel element is not a container, so its dialogs' fixed overlay still covers the window",
-  css(".ws-run-panel", "container-type") === undefined,
-);
-check(
-  "rows stack under 500px: the row turns into a column",
-  css(".ws-run-panel__row", "flex-direction", "width < 500px") === "column" &&
-    css(".ws-run-panel__row-controls", "flex", "width < 500px") === "none",
-);
-check(
-  "rows stay side by side at 500px and wider",
-  css(".ws-run-panel__row", "flex-direction") === undefined,
-);
-check("the toolbar is a 35px strip", css(".ws-run-panel__toolbar", "height") === "35px");
-check("the toolbar pads 8px", css(".ws-run-panel__toolbar", "padding") === "0 8px");
-check("the path field is 24px tall", css(".ws-run-panel__prompt-path", "height") === "24px");
-check("the path field text is 12px", css(".ws-run-panel__prompt-path", "font-size") === "12px");
-check("the path field has a 2px radius", css(".ws-run-panel__prompt-path", "border-radius") === "2px");
-check("the path field fill is #F0F0F00A", css(".ws-run-panel__prompt-path", "background") === "#f0f0f00a");
-check(
-  "the path field border is 1px #F0F0F013",
-  css(".ws-run-panel__prompt-path", "border") === "1px solid #f0f0f013",
-);
-check(
-  "the Prompt label is for screen readers only",
-  css(".ws-run-panel__prompt-label", "position") === "absolute" &&
-    css(".ws-run-panel__prompt-label", "clip-path") === "inset(50%)" &&
-    css(".ws-run-panel__prompt-label", "width") === "1px",
-);
-check("a state line is 22px tall", css(".ws-run-panel__message", "line-height") === "22px");
-check("a state line pads 20px on the left", css(".ws-run-panel__message", "padding-left") === "20px");
-check(
-  "an inline link is underlined, in the link color",
-  css(".ws-run-panel__link", "text-decoration") === "underline" &&
-    css(".ws-run-panel__link", "color") === "#81a1c1" &&
-    css(".ws-run-panel__link", "display") === "inline",
-);
-check(
-  "the drag-over overlay is #F0F0F011 and lets the drop through",
-  css(".ws-run-panel--drag-over::after", "background") === "#f0f0f011" &&
-    css(".ws-run-panel--drag-over::after", "pointer-events") === "none",
-);
-check("the footer pads 10px", css(".ws-run-panel__footer", "padding") === "10px");
-check("the footer's gap is 8px", css(".ws-run-panel__footer", "gap") === "8px");
-check("the footer is right-aligned", css(".ws-run-panel__footer", "justify-content") === "flex-end");
-check(
-  "the footer's top border is 8%",
-  css(".ws-run-panel__footer", "border-top") === "1px solid color-mix(in srgb, #f0f0f0 8%, transparent)",
-);
-check(
-  "the stylesheet declares no raw color or length",
-  runRules.every((rule) => !/#[0-9a-f]{3,8}\b|\b\d*\.?\d+(px|rem|em)\b/i.test(rule.body)),
-);
-
-// --- Reduced motion: the shimmer degrades to a static muted title ------------
-
-// jsdom applies no stylesheets, so the reduced-motion contract is checked
-// against the stylesheet itself: under prefers-reduced-motion the
-// animation, gradient, clip, and transparent fill all come off.
-const shimmerCss = await readFile(
-  fileURLToPath(import.meta.resolve("@workshop/look/shimmer.css")),
-  "utf8");
-const reducedBlock = shimmerCss.split("@media (prefers-reduced-motion: reduce)")[1] ?? "";
-check("the shimmer class is defined", shimmerCss.includes(".ws-shimmer-text"));
-check("the shimmer has a reduced-motion block", reducedBlock.length > 0);
-check(
-  "reduced motion strips the animation, gradient, clip, and transparent fill",
-  reducedBlock.includes("animation: none") &&
-    reducedBlock.includes("background-image: none") &&
-    reducedBlock.includes("background-clip: unset") &&
-    reducedBlock.includes("-webkit-text-fill-color: unset"),
-);
-
-if (failures.length > 0) {
-  console.error(`run-panel: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("run-panel: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/smoke.mjs b/crates/workshop/ui/test/smoke.mjs
deleted file mode 100644
index a53ae2522..000000000
--- a/crates/workshop/ui/test/smoke.mjs
+++ /dev/null
@@ -1,30 +0,0 @@
-// Bundle smoke test: dist/app.js boots against dist/index.html in jsdom -
-// the dock mounts the Workshop tree and the agent-session panel, the
-// status bar reads the boot push, and the agent panel opens its own
-// /agents/ws socket beside the workshop /ws connection.
-// Run: node test/smoke.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("the bundled app boots the workbench", async (ctx) => {
-  const { document, sockets, statusText, failures } = ctx;
-
-  if (!document.querySelector("#dock .ws-workshop-tree")) {
-    failures.push("the Workshop tree did not mount in the dock");
-  }
-  if (!document.querySelector("#dock .ws-agent-panel")) {
-    failures.push("the ws-agent-session panel did not mount in the dock");
-  }
-  if (statusText.textContent !== "Ready") {
-    failures.push(`the boot status push did not render: "${statusText.textContent}"`);
-  }
-  const agentSockets = sockets.filter((socket) => socket.url.endsWith("/agents/ws"));
-  if (agentSockets.length !== 1) {
-    failures.push(`the agent panel must open exactly one /agents/ws socket, saw ${agentSockets.length}`);
-  }
-  const workshopSockets = sockets.filter(
-    (socket) => socket.url.endsWith("/ws") && !socket.url.endsWith("/agents/ws"),
-  );
-  if (workshopSockets.length !== 1) {
-    failures.push(`the app must open exactly one /ws socket, saw ${workshopSockets.length}`);
-  }
-});
diff --git a/crates/workshop/ui/test/speech-capture.mjs b/crates/workshop/ui/test/speech-capture.mjs
deleted file mode 100644
index 6e1fb2711..000000000
--- a/crates/workshop/ui/test/speech-capture.mjs
+++ /dev/null
@@ -1,636 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { SpeechCaptureService } from "./src/services/speech-capture.ts";
-    `,
-    resolveDir: uiDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { lifecycle, SpeechCaptureService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-// Owner tokens: one per dictation surface in production; two here so the
-// ownership tests can act as a second window.
-const a = Symbol("owner-a");
-const b = Symbol("owner-b");
-const presenceA = { label: () => "Owner A", reveal() {} };
-const presenceB = { label: () => "Owner B", reveal() {} };
-
-// Little-endian PCM16 bytes for the fake worklet's emit().
-function pcm16(samples) {
-  const view = new DataView(new ArrayBuffer(samples.length * 2));
-  samples.forEach((sample, index) => view.setInt16(index * 2, sample, true));
-  return [...new Uint8Array(view.buffer)];
-}
-
-function square(amplitude, length = 480) {
-  return pcm16(Array.from({ length }, (_, index) => (index % 2 === 0 ? amplitude : -amplitude)));
-}
-
-function installBrowser(options = {}) {
-  const resources = {
-    constraints: [],
-    contexts: [],
-    sources: [],
-    nodes: [],
-    tracks: [{ stops: 0 }, { stops: 0 }],
-    stream: null,
-  };
-  const stream = {
-    getTracks: () =>
-      resources.tracks.map((track) => ({
-        stop() {
-          track.stops += 1;
-        },
-      })),
-  };
-  resources.stream = stream;
-
-  class FakeAudioContext {
-    constructor(contextOptions) {
-      if (options.contextError) {
-        throw options.contextError;
-      }
-      this.options = contextOptions;
-      this.sampleRate = options.contextSampleRate ?? 24_000;
-      this.destination = { kind: "destination" };
-      this.resumeCalls = 0;
-      this.closeCalls = 0;
-      this.audioWorklet = {
-        addModule: async (url) => {
-          this.moduleUrl = url;
-          if (options.moduleError) {
-            throw options.moduleError;
-          }
-        },
-      };
-      resources.contexts.push(this);
-    }
-
-    createMediaStreamSource(receivedStream) {
-      assert.equal(receivedStream, stream);
-      const source = {
-        connects: [],
-        disconnects: 0,
-        connect(target) {
-          this.connects.push(target);
-        },
-        disconnect() {
-          this.disconnects += 1;
-        },
-      };
-      resources.sources.push(source);
-      return source;
-    }
-
-    async resume() {
-      this.resumeCalls += 1;
-      if (options.resumeError) {
-        throw options.resumeError;
-      }
-    }
-
-    async close() {
-      this.closeCalls += 1;
-      if (options.closeError) {
-        throw options.closeError;
-      }
-    }
-  }
-
-  class FakeAudioWorkletNode {
-    constructor(context, name) {
-      if (options.nodeError) {
-        throw options.nodeError;
-      }
-      this.context = context;
-      this.name = name;
-      this.connects = [];
-      this.disconnects = 0;
-      this.messages = [];
-      this.port = {
-        onmessage: null,
-        postMessage: (message) => {
-          this.messages.push(message);
-          if (message?.type === "flush" && options.autoFlush !== false) {
-            queueMicrotask(() => this.port.onmessage?.({ data: { type: "flushed" } }));
-          }
-          if (
-            options.postMessageError &&
-            (!options.postMessageType || options.postMessageType === message?.type)
-          ) {
-            throw options.postMessageError;
-          }
-        },
-      };
-      resources.nodes.push(this);
-    }
-
-    connect(target) {
-      this.connects.push(target);
-    }
-
-    disconnect() {
-      this.disconnects += 1;
-    }
-
-    emit(bytes) {
-      this.port.onmessage?.({ data: Uint8Array.from(bytes).buffer });
-    }
-  }
-
-  const previous = {
-    navigator: Object.getOwnPropertyDescriptor(globalThis, "navigator"),
-    AudioContext: Object.getOwnPropertyDescriptor(globalThis, "AudioContext"),
-    AudioWorkletNode: Object.getOwnPropertyDescriptor(globalThis, "AudioWorkletNode"),
-  };
-  Object.defineProperty(globalThis, "navigator", {
-    configurable: true,
-    value: {
-      mediaDevices: {
-        getUserMedia: async (constraints) => {
-          resources.constraints.push(constraints);
-          if (options.mediaError) {
-            throw options.mediaError;
-          }
-          if (options.mediaPromise) {
-            return options.mediaPromise;
-          }
-          return stream;
-        },
-      },
-    },
-  });
-  Object.defineProperty(globalThis, "AudioContext", {
-    configurable: true,
-    value: FakeAudioContext,
-  });
-  Object.defineProperty(globalThis, "AudioWorkletNode", {
-    configurable: true,
-    value: FakeAudioWorkletNode,
-  });
-
-  return {
-    resources,
-    restore() {
-      for (const [name, descriptor] of Object.entries(previous)) {
-        if (descriptor) {
-          Object.defineProperty(globalThis, name, descriptor);
-        } else {
-          delete globalThis[name];
-        }
-      }
-    },
-  };
-}
-
-async function withBrowser(options, run) {
-  const browser = installBrowser(options);
-  try {
-    await run(browser.resources);
-  } finally {
-    browser.restore();
-  }
-}
-
-test("the default backend owns the complete 24 kHz capture lifecycle", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({}, async (resources) => {
-      const service = new SpeechCaptureService();
-      const audio = [];
-      service.onAudio((chunk) => audio.push(...new Uint8Array(chunk)));
-
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      assert.equal(service.recording, true);
-      assert.deepEqual(resources.constraints, [
-        {
-          audio: {
-            channelCount: 1,
-            sampleRate: 24_000,
-            echoCancellation: true,
-            noiseSuppression: true,
-          },
-        },
-      ]);
-      assert.equal(resources.contexts[0].options.sampleRate, 24_000);
-      assert.equal(resources.contexts[0].sampleRate, 24_000);
-      assert.equal(resources.contexts[0].moduleUrl, "/pcm-worklet.js");
-      assert.equal(resources.contexts[0].resumeCalls, 1);
-      assert.equal(resources.nodes[0].name, "pcm16-capture");
-      assert.deepEqual(resources.sources[0].connects, [resources.nodes[0]]);
-      assert.deepEqual(resources.nodes[0].connects, [resources.contexts[0].destination]);
-
-      resources.nodes[0].emit([1, 2, 255]);
-      assert.deepEqual(audio, [1, 2, 255]);
-      assert.deepEqual(service.clear(a), { ok: true, kind: "cleared" });
-      assert.deepEqual(resources.nodes[0].messages, [{ type: "clear" }]);
-      assert.deepEqual(await service.start(a, presenceA), {
-        ok: false,
-        kind: "start-failed",
-        message: "speech capture is already active",
-        recoverable: true,
-      });
-
-      assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-      assert.equal(service.recording, false);
-      assert.deepEqual(resources.nodes[0].messages, [{ type: "clear" }, { type: "flush" }]);
-      assert.equal(resources.sources[0].disconnects, 1);
-      assert.equal(resources.nodes[0].disconnects, 1);
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-      assert.equal(resources.nodes[0].port.onmessage, null);
-      assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-      service.dispose();
-    });
-  });
-});
-
-test("every emitted chunk fires one level; silence reads near 0 and full scale near 1", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({}, async (resources) => {
-      const service = new SpeechCaptureService();
-      let chunks = 0;
-      const levels = [];
-      service.onAudio(() => {
-        chunks += 1;
-      });
-      service.onLevel((level) => levels.push(level));
-
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      const node = resources.nodes[0];
-      node.emit(pcm16(new Array(480).fill(0)));
-      node.emit(square(32_767));
-      node.emit(square(1_036));
-      node.emit([1, 2, 255]);
-      node.emit([]);
-
-      assert.equal(chunks, 5);
-      assert.equal(levels.length, chunks, "one level per emitted chunk");
-      assert.ok(levels[0] < 0.01, `silence reads near 0, got ${levels[0]}`);
-      assert.ok(levels[1] > 0.95, `full scale reads near 1, got ${levels[1]}`);
-      assert.ok(
-        levels[2] > 0.2 && levels[2] < 0.8,
-        `a -30 dBFS chunk reads mid-scale on a logarithmic scale, got ${levels[2]}`,
-      );
-      assert.ok(
-        levels.every((level) => Number.isFinite(level) && level >= 0 && level <= 1),
-        `odd-length and empty chunks still read within 0 to 1, got ${levels}`,
-      );
-
-      assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-      service.dispose();
-    });
-  });
-});
-
-test("presence is set on start, cleared on release, and never set by a busy or failed start", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({}, async () => {
-      const service = new SpeechCaptureService();
-      const seen = [];
-      const subscription = service.onOwnerChange(() => seen.push(service.presence));
-      assert.equal(service.presence, null);
-
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      assert.equal(service.presence, presenceA);
-      assert.equal((await service.start(b, presenceB)).kind, "busy");
-      assert.equal(service.presence, presenceA, "a busy start never replaces the owner's presence");
-      assert.deepEqual(await service.stop(b), { ok: true, kind: "stopped" });
-      assert.equal(service.presence, presenceA, "a non-owner's stop leaves the presence");
-
-      assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-      assert.equal(service.presence, null, "presence releases with the take");
-
-      assert.deepEqual(await service.start(b, presenceB), { ok: true, kind: "started" });
-      assert.equal(service.presence, presenceB);
-      service.dispose();
-      assert.equal(service.presence, null, "disposal clears presence with the owner");
-      assert.deepEqual(
-        seen,
-        [presenceA, null, presenceB, null],
-        "every owner change already reads the matching presence",
-      );
-      subscription.dispose();
-    });
-
-    await withBrowser(
-      { mediaError: new DOMException("microphone denied", "NotAllowedError") },
-      async () => {
-        const service = new SpeechCaptureService();
-        assert.equal((await service.start(a, presenceA)).kind, "permission-denied");
-        assert.equal(service.presence, null, "a failed start sets no presence");
-        service.dispose();
-      },
-    );
-  });
-});
-
-test("one owner token holds the microphone; another is told busy and cannot stop or clear it", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({}, async (resources) => {
-      const service = new SpeechCaptureService();
-      const owners = [];
-      const subscription = service.onOwnerChange((owner) => owners.push(owner));
-      assert.equal(service.owner, null);
-
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      assert.equal(service.owner, a, "the starting token owns the live take");
-      assert.deepEqual(owners, [a]);
-
-      assert.deepEqual(await service.start(b, presenceB), {
-        ok: false,
-        kind: "busy",
-        message: "speech capture is held by another owner",
-        recoverable: true,
-      });
-      assert.deepEqual(
-        await service.start(a, presenceA),
-        {
-          ok: false,
-          kind: "start-failed",
-          message: "speech capture is already active",
-          recoverable: true,
-        },
-        "a same-owner double start keeps its existing wording",
-      );
-
-      assert.deepEqual(service.clear(b), { ok: true, kind: "cleared" });
-      assert.deepEqual(await service.stop(b), { ok: true, kind: "stopped" });
-      assert.equal(service.recording, true, "a non-owner's stop leaves the session running");
-      assert.equal(service.owner, a);
-      assert.deepEqual(resources.nodes[0].messages, [], "a non-owner's clear and stop reach no worklet");
-      assert.deepEqual(owners, [a]);
-
-      assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-      assert.equal(service.owner, null, "ownership releases with the take");
-      assert.deepEqual(owners, [a, null]);
-
-      assert.deepEqual(await service.start(b, presenceB), { ok: true, kind: "started" });
-      assert.equal(service.owner, b, "a released microphone accepts the next owner");
-      service.dispose();
-      assert.equal(service.owner, null);
-      assert.deepEqual(owners, [a, null, b, null], "disposal releases ownership too");
-      subscription.dispose();
-    });
-  });
-});
-
-test("a second owner's start during the owner's flush is start-failed, not busy", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({ autoFlush: false }, async (resources) => {
-      const service = new SpeechCaptureService();
-      const owners = [];
-      const subscription = service.onOwnerChange((owner) => owners.push(owner));
-
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      const stopping = service.stop(a);
-      assert.equal(service.owner, a, "the flush still belongs to the owner");
-      assert.deepEqual(
-        await service.start(b, presenceB),
-        {
-          ok: false,
-          kind: "start-failed",
-          message: "speech capture is already active",
-          recoverable: true,
-        },
-        "the closing window is a transient, so the second owner is not told busy",
-      );
-      assert.deepEqual(await service.start(a, presenceA), {
-        ok: false,
-        kind: "start-failed",
-        message: "speech capture is already active",
-        recoverable: true,
-      });
-
-      resources.nodes[0].port.onmessage?.({ data: { type: "flushed" } });
-      assert.deepEqual(await stopping, { ok: true, kind: "stopped" });
-      assert.equal(service.owner, null);
-      assert.deepEqual(owners, [a, null]);
-
-      assert.deepEqual(await service.start(b, presenceB), { ok: true, kind: "started" });
-      assert.equal(service.owner, b, "the second owner's retry succeeds once the flush ends");
-      service.dispose();
-      subscription.dispose();
-    });
-  });
-});
-
-test("the default backend classifies permission, device, and graph start failures", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    for (const [mediaError, kind] of [
-      [new DOMException("microphone denied", "NotAllowedError"), "permission-denied"],
-      [new DOMException("no microphone", "NotFoundError"), "device-unavailable"],
-    ]) {
-      await withBrowser({ mediaError }, async (resources) => {
-        const service = new SpeechCaptureService();
-        assert.deepEqual(await service.start(a, presenceA), {
-          ok: false,
-          kind,
-          message: mediaError.message,
-          recoverable: true,
-        });
-        assert.equal(service.recording, false);
-        assert.equal(resources.contexts.length, 0);
-        assert.deepEqual(
-          resources.tracks.map((track) => track.stops),
-          [0, 0],
-        );
-        service.dispose();
-      });
-    }
-
-    await withBrowser(
-      { moduleError: new Error("worklet load failed") },
-      async (resources) => {
-        const service = new SpeechCaptureService();
-        assert.deepEqual(await service.start(a, presenceA), {
-          ok: false,
-          kind: "start-failed",
-          message: "worklet load failed",
-          recoverable: true,
-        });
-        assert.equal(service.recording, false);
-        assert.deepEqual(
-          resources.tracks.map((track) => track.stops),
-          [1, 1],
-        );
-        assert.equal(resources.contexts[0].closeCalls, 1);
-        assert.equal(resources.sources.length, 0);
-        assert.equal(resources.nodes.length, 0);
-        service.dispose();
-      },
-    );
-
-    await withBrowser({ contextSampleRate: 48_000 }, async (resources) => {
-      const service = new SpeechCaptureService();
-      assert.deepEqual(await service.start(a, presenceA), {
-        ok: false,
-        kind: "start-failed",
-        message: "browser opened audio at 48000 Hz instead of 24000 Hz",
-        recoverable: true,
-      });
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-      service.dispose();
-    });
-  });
-});
-
-test("stop and disposal release every production graph resource", async () => {
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({ closeError: new Error("context close failed") }, async (resources) => {
-      const service = new SpeechCaptureService();
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      assert.deepEqual(await service.stop(a), {
-        ok: false,
-        kind: "stop-failed",
-        message: "context close failed",
-        recoverable: true,
-      });
-      assert.equal(service.recording, false);
-      assert.equal(resources.sources[0].disconnects, 1);
-      assert.equal(resources.nodes[0].disconnects, 1);
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-      assert.equal(resources.nodes[0].port.onmessage, null);
-      service.dispose();
-    });
-
-    await withBrowser(
-      { postMessageError: new Error("worklet port failed") },
-      async (resources) => {
-        const service = new SpeechCaptureService();
-        assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-        assert.deepEqual(await service.stop(a), {
-          ok: false,
-          kind: "stop-failed",
-          message: "worklet port failed",
-          recoverable: true,
-        });
-        assert.equal(resources.sources[0].disconnects, 1);
-        assert.equal(resources.nodes[0].disconnects, 1);
-        assert.deepEqual(
-          resources.tracks.map((track) => track.stops),
-          [1, 1],
-        );
-        assert.equal(resources.contexts[0].closeCalls, 1);
-        service.dispose();
-      },
-    );
-
-    await withBrowser(
-      {
-        postMessageError: new Error("clear failed"),
-        postMessageType: "clear",
-      },
-      async () => {
-        const service = new SpeechCaptureService();
-        assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-        assert.deepEqual(service.clear(a), {
-          ok: false,
-          kind: "clear-failed",
-          message: "clear failed",
-          recoverable: true,
-        });
-        assert.equal(service.recording, true);
-        assert.deepEqual(await service.stop(a), { ok: true, kind: "stopped" });
-        service.dispose();
-      },
-    );
-
-    await withBrowser({ autoFlush: false }, async (resources) => {
-      const service = new SpeechCaptureService();
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      const stopping = service.stop(a);
-      service.dispose();
-      assert.deepEqual(await stopping, {
-        ok: false,
-        kind: "stop-failed",
-        message: "speech capture was disposed while flushing",
-        recoverable: true,
-      });
-      assert.equal(resources.sources[0].disconnects, 1);
-      assert.equal(resources.nodes[0].disconnects, 1);
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-    });
-
-    await withBrowser({}, async (resources) => {
-      const service = new SpeechCaptureService();
-      assert.deepEqual(await service.start(a, presenceA), { ok: true, kind: "started" });
-      service.dispose();
-      service.dispose();
-      assert.equal(service.recording, false);
-      assert.equal(resources.sources[0].disconnects, 1);
-      assert.equal(resources.nodes[0].disconnects, 1);
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-      assert.equal(resources.nodes[0].port.onmessage, null);
-    });
-  });
-});
-
-test("disposal during production start rejects the take and leaks no graph", async () => {
-  let resolveMedia;
-  const mediaPromise = new Promise((resolve) => {
-    resolveMedia = resolve;
-  });
-
-  await assertNoLeaks(lifecycle, async () => {
-    await withBrowser({ mediaPromise }, async (resources) => {
-      const service = new SpeechCaptureService();
-      const starting = service.start(a, presenceA);
-      await Promise.resolve();
-      service.dispose();
-      resolveMedia(resources.stream);
-
-      assert.deepEqual(await starting, {
-        ok: false,
-        kind: "start-failed",
-        message: "speech capture was disposed while starting",
-        recoverable: true,
-      });
-      assert.equal(service.recording, false);
-      assert.equal(resources.sources[0].disconnects, 1);
-      assert.equal(resources.nodes[0].disconnects, 1);
-      assert.deepEqual(
-        resources.tracks.map((track) => track.stops),
-        [1, 1],
-      );
-      assert.equal(resources.contexts[0].closeCalls, 1);
-      assert.equal(resources.nodes[0].port.onmessage, null);
-    });
-  });
-});
diff --git a/crates/workshop/ui/test/status-frames.mjs b/crates/workshop/ui/test/status-frames.mjs
deleted file mode 100644
index 1ddd0e778..000000000
--- a/crates/workshop/ui/test/status-frames.mjs
+++ /dev/null
@@ -1,92 +0,0 @@
-// Status frames render into the status bar. Text and tooltip: info and
-// error frames set the bar text and description tooltip, error frames style
-// the text and the styling clears on the next info frame, and debug frames
-// are internal instrumentation that must not touch either. Busy: a busy
-// frame shows the barberpole beside the recording+activity LED indicators
-// group, which stays visible; a non-busy frame hides the barberpole; debug
-// frames never disturb it. Local: a status-bar error raises an error toast
-// and leaves the bar's text alone.
-// Run: node test/status-frames.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("status frames render into the bar", async (ctx) => {
-  const { emitStatus, statusText, statusBar, barberpoleEl, indicatorsEl, failures } = ctx;
-
-  emitStatus({
-    label: "Streaming response...",
-    description: "gateway stream open",
-    activity: "thinking",
-  });
-  if (statusText.textContent !== "Streaming response...") {
-    failures.push("a status frame did not update the bar text");
-  }
-  if (statusBar.title !== "gateway stream open") {
-    failures.push("the status description did not land on the bar tooltip");
-  }
-  emitStatus({ label: "per-delta pulse", description: "debug", severity: "debug", activity: "generating" });
-  if (statusText.textContent !== "Streaming response...") {
-    failures.push("a debug status frame changed the bar text");
-  }
-  if (statusBar.title !== "gateway stream open") {
-    failures.push("a debug status frame changed the tooltip");
-  }
-  emitStatus({
-    label: "Gateway error: 500",
-    description: "upstream declined",
-    severity: "error",
-    activity: "general",
-  });
-  if (statusText.textContent !== "Gateway error: 500") {
-    failures.push("an error frame did not update the bar text");
-  }
-  if (!statusText.classList.contains("status-bar__text--error")) {
-    failures.push("an error frame did not style the bar text");
-  }
-  emitStatus({ label: "Ready", description: "idle" });
-  if (statusText.classList.contains("status-bar__text--error")) {
-    failures.push("the error styling did not clear on the next info frame");
-  }
-
-  emitStatus({
-    label: "Downloading model",
-    description: "1 of 4",
-    activity: "general",
-    busy: true,
-  });
-  if (barberpoleEl.hidden) failures.push("a busy frame did not reveal the barberpole");
-  if (indicatorsEl.hidden) {
-    failures.push("the recording and activity LED group hid while the barberpole is showing");
-  }
-  emitStatus({
-    label: "Downloading model",
-    description: "2 of 4",
-    activity: "general",
-    busy: true,
-  });
-  emitStatus({ label: "per-delta pulse", severity: "debug", activity: "generating" });
-  if (barberpoleEl.hidden) {
-    failures.push("a debug frame disturbed the barberpole");
-  }
-  emitStatus({ label: "Download complete", description: "ready" });
-  if (!barberpoleEl.hidden) failures.push("a non-busy frame did not hide the barberpole");
-  if (indicatorsEl.hidden) {
-    failures.push("the recording and activity LED group hid when busy cleared");
-  }
-
-  // A local error is a toast on the shared stack, not red bar text: the
-  // bar keeps the last frame's text, and the toast outlives the next frame.
-  const { document, resolveService } = ctx;
-  const before = statusText.textContent;
-  resolveService("workshop.statusBar").showLocal("Could not open C:\\work\\notes.md: denied", "error");
-  const toast = document.querySelector(".toast-stack .toast-error .toast__message");
-  if (toast?.textContent !== "Could not open C:\\work\\notes.md: denied") {
-    failures.push(`a local error did not raise an error toast (got ${toast?.textContent})`);
-  }
-  if (statusText.textContent !== before || statusText.classList.contains("status-bar__text--error")) {
-    failures.push("a local error changed the bar text instead of raising a toast");
-  }
-  emitStatus({ label: "Ready", description: "idle" });
-  if (document.querySelector(".toast-stack .toast-error") === null) {
-    failures.push("the next status frame cleared the error toast");
-  }
-});
diff --git a/crates/workshop/ui/test/status-indicators.mjs b/crates/workshop/ui/test/status-indicators.mjs
deleted file mode 100644
index 95e1e29d7..000000000
--- a/crates/workshop/ui/test/status-indicators.mjs
+++ /dev/null
@@ -1,293 +0,0 @@
-// The status bar's indicator slots (parts/status/status-bar.ts behind
-// @workshop/platform/status-indicators): indicators render in `order`
-// with stable elements, `set` shows exactly one color and null clears
-// it, a tooltip updates the title and the accessible label, a decorative
-// indicator is hidden from assistive tech, `dispose` removes the element,
-// and a duplicate id throws. The bar owns no LED and no recording port:
-// every indicator belongs to the feature that registers it. A synthetic
-// "probe" indicator runs through every color and back to off. Non-LED
-// slots get a button host ordered among the LEDs by the same rule and
-// sharing their id space; the handle labels it, a click runs `activate`,
-// and `dispose` removes it and stops activating.
-// Bundles the TS modules with esbuild and drives them against jsdom built
-// from the real index.html.
-// Run: node --test test/status-indicators.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { StatusBar } from "./src/parts/status/status-bar.ts";
-      export { STATUS_INDICATORS } from "@workshop/platform/status-indicators";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { TOAST_STACK } from "./src/services/toast-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Element = window.Element;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Node = window.Node;
-globalThis.getComputedStyle = window.getComputedStyle.bind(window);
-
-const bundlePath = path.join(os.tmpdir(), "runvil-status-indicators-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { StatusBar, STATUS_INDICATORS, registerService, TOAST_STACK } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const COLORS = ["green", "amber", "red"];
-const litColors = (el) => COLORS.filter((color) => el.classList.contains(`status-bar__led--${color}`));
-const ids = () =>
-  [...window.document.querySelectorAll(".status-bar__indicators > .status-bar__led")].map(
-    (el) => el.dataset.indicator,
-  );
-const byId = (id) => window.document.querySelector(`.status-bar__led[data-indicator="${id}"]`);
-
-check("the platform exports the STATUS_INDICATORS token", typeof STATUS_INDICATORS?.id === "string");
-
-const bar = new StatusBar();
-check(`the status bar registers no indicator of its own (got ${ids().join(",")})`, ids().length === 0);
-check("the status bar exposes no recording port", !("setRecording" in bar));
-
-// The idle bar reads empty: Cursor's status bar has no "Ready" placeholder.
-const barText = window.document.querySelector(".status-bar__text");
-check(`an idle bar reads empty (got "${barText.textContent}")`, barText.textContent === "");
-
-// Local messages. Info paints the bar. An error is a toast when a stack is
-// registered, and falls back to red bar text when none is, so a failure is
-// never silent in a bare bar.
-bar.showLocal("Added /x to the Workshop", "info");
-check("an info message paints the bar text", barText.textContent === "Added /x to the Workshop");
-check("an info message is not styled as an error", !barText.classList.contains("status-bar__text--error"));
-bar.showLocal("Could not open /y", "error");
-check(
-  "without a toast stack an error paints the bar red",
-  barText.textContent === "Could not open /y" && barText.classList.contains("status-bar__text--error"),
-);
-bar.showLocal("", "info");
-check("an empty local message clears the bar to idle", barText.textContent === "");
-check("an empty local message clears the error styling", !barText.classList.contains("status-bar__text--error"));
-
-const toasts = [];
-registerService(TOAST_STACK, () => ({
-  element: window.document.createElement("div"),
-  show: (message, kind) => toasts.push([message, kind]),
-}));
-bar.showLocal("Status line", "info");
-bar.showLocal("Could not add /z: denied", "error");
-check(
-  "an error raises one error toast with the caller's text",
-  toasts.length === 1 && toasts[0][0] === "Could not add /z: denied" && toasts[0][1] === "error",
-);
-check("an error toast leaves the bar text alone", barText.textContent === "Status line");
-check("an error toast does not paint the bar red", !barText.classList.contains("status-bar__text--error"));
-bar.showLocal("Still fine", "info");
-check("an info message raises no toast", toasts.length === 1 && barText.textContent === "Still fine");
-bar.showLocal("", "info");
-
-// Ordering: registration order differs from `order`; the DOM follows `order`.
-const late = bar.register({ id: "late", name: "Late indicator", order: 5 });
-const early = bar.register({ id: "early", name: "Early indicator", order: 1 });
-const middle = bar.register({ id: "middle", name: "Middle indicator", order: 3 });
-check(`indicators render in ascending order (got ${ids().join(",")})`, ids().join(",") === "early,middle,late");
-const middleEl = byId("middle");
-middle.set("green");
-early.set("amber");
-check("set keeps the indicator's element stable", byId("middle") === middleEl);
-check("indicators keep their order after set", ids().join(",") === "early,middle,late");
-
-// Exactly one color, and null clears it.
-middle.set("amber");
-check("set replaces the previous color", litColors(middleEl).join(",") === "amber");
-middle.set(null);
-check("set(null) returns the lens to unlit", litColors(middleEl).length === 0);
-
-// The accessible label and tooltip.
-check("name becomes the aria-label", middleEl.getAttribute("aria-label") === "Middle indicator");
-check("a non-decorative indicator is not aria-hidden", !middleEl.hasAttribute("aria-hidden"));
-middle.set("green", "3 tasks running");
-check("a tooltip sets title", middleEl.title === "3 tasks running");
-check(
-  "a tooltip joins the accessible label",
-  middleEl.getAttribute("aria-label").startsWith("Middle indicator") &&
-    middleEl.getAttribute("aria-label").includes("3 tasks running"),
-);
-middle.set("green");
-check("a set without a tooltip clears title", middleEl.title === "");
-check("a set without a tooltip restores the plain label", middleEl.getAttribute("aria-label") === "Middle indicator");
-
-// Decorative indicators.
-const deco = bar.register({ id: "deco", name: "Decoration", order: 9, decorative: true });
-const decoEl = byId("deco");
-check("decorative sets aria-hidden", decoEl.getAttribute("aria-hidden") === "true");
-check("decorative carries no aria-label", !decoEl.hasAttribute("aria-label"));
-deco.set("green", "tip");
-check("a decorative tooltip still sets title", decoEl.title === "tip");
-check("a decorative tooltip adds no aria-label", !decoEl.hasAttribute("aria-label"));
-
-// Duplicate ids throw, and the first registration survives.
-let threw = false;
-try {
-  bar.register({ id: "middle", name: "Again", order: 0 });
-} catch {
-  threw = true;
-}
-check("a duplicate id throws", threw);
-check("a rejected duplicate leaves the original in place", byId("middle") === middleEl && ids().length === 4);
-
-// dispose removes the element; the id is free again afterward.
-late.dispose();
-check("dispose removes the element", byId("late") === null);
-late.dispose();
-const again = bar.register({ id: "late", name: "Late again", order: 5 });
-check("a disposed id can register again", byId("late") !== null);
-again.dispose();
-early.dispose();
-middle.dispose();
-deco.dispose();
-
-// Descending registration: each new slot lands before the leftmost DOM slot
-// with a higher order, not the first such slot in registration order.
-const five = bar.register({ id: "five", name: "Five", order: 5 });
-const three = bar.register({ id: "three", name: "Three", order: 3 });
-const one = bar.register({ id: "one", name: "One", order: 1 });
-check(`descending registration renders in ascending order (got ${ids().join(",")})`, ids().join(",") === "one,three,five");
-five.dispose();
-three.dispose();
-one.dispose();
-
-// The probe: every color, then off.
-const probe = bar.register({ id: "probe", name: "Probe", order: 2 });
-const probeEl = byId("probe");
-for (const color of COLORS) {
-  probe.set(color);
-  check(`the probe shows ${color} alone`, litColors(probeEl).join(",") === color);
-}
-probe.set(null);
-check("the probe returns to off", litColors(probeEl).length === 0);
-probe.dispose();
-
-// render never touches indicators: no color on any LED from a frame.
-const watched = bar.register({ id: "watched", name: "Watched", order: 0 });
-bar.render({ type: "status", label: "x", description: "", severity: "info", activity: "generating", busy: false });
-check("render never lights an indicator", litColors(byId("watched")).length === 0);
-watched.dispose();
-
-// Non-LED slots stand in the same group as the LEDs.
-const everything = () =>
-  [...window.document.querySelectorAll(".status-bar__indicators > *")].map((el) => el.dataset.indicator);
-const anyById = (id) => window.document.querySelector(`.status-bar__indicators > [data-indicator="${id}"]`);
-const right = bar.register({ id: "led-right", name: "Right LED", order: 1 });
-const left = bar.register({ id: "led-left", name: "Left LED", order: -2 });
-let activations = 0;
-const meter = bar.registerSlot({
-  id: "meter",
-  name: "Meter",
-  order: 0,
-  activate: () => {
-    activations += 1;
-  },
-});
-const meterEl = anyById("meter");
-check(
-  `a slot orders among the LEDs (got ${everything().join(",")})`,
-  everything().join(",") === "led-left,meter,led-right",
-);
-check("a slot's host is a plain button", meterEl?.tagName === "BUTTON" && meterEl.type === "button");
-check("the handle exposes the slot's host element", meter.element === meterEl);
-check("a slot is not an LED", !meterEl.classList.contains("status-bar__led"));
-const tie = bar.register({ id: "led-tie", name: "Tie LED", order: 0 });
-check(
-  `an LED tying a slot's order lands after it (got ${everything().join(",")})`,
-  everything().join(",") === "led-left,meter,led-tie,led-right",
-);
-tie.dispose();
-
-// Slots and LEDs share one id space.
-const throws = (register) => {
-  try {
-    register();
-    return false;
-  } catch {
-    return true;
-  }
-};
-check(
-  "a slot reusing an LED's id throws",
-  throws(() => bar.registerSlot({ id: "led-left", name: "Again", order: 3, activate() {} })),
-);
-check("an LED reusing a slot's id throws", throws(() => bar.register({ id: "meter", name: "Again", order: 3 })));
-check(
-  "a slot reusing a slot's id throws",
-  throws(() => bar.registerSlot({ id: "meter", name: "Again", order: 3, activate() {} })),
-);
-check(
-  `rejected duplicates leave the group as it was (got ${everything().join(",")})`,
-  everything().join(",") === "led-left,meter,led-right" && anyById("meter") === meterEl,
-);
-
-// The label and tooltip.
-check("a slot's name becomes its aria-label", meterEl.getAttribute("aria-label") === "Meter");
-check("a slot starts with no title", meterEl.title === "");
-meter.setTooltip("Dictating to Owner A");
-check("a slot tooltip sets title", meterEl.title === "Dictating to Owner A");
-check(
-  "a slot tooltip joins the accessible label",
-  meterEl.getAttribute("aria-label").startsWith("Meter") &&
-    meterEl.getAttribute("aria-label").includes("Dictating to Owner A"),
-);
-meter.setTooltip();
-check("clearing a slot tooltip clears title", meterEl.title === "");
-check("clearing a slot tooltip restores the plain label", meterEl.getAttribute("aria-label") === "Meter");
-
-// Activation.
-meterEl.click();
-check(`a click runs activate once (ran ${activations})`, activations === 1);
-
-// Disposal.
-meter.dispose();
-check("dispose removes the slot", anyById("meter") === null);
-meterEl.click();
-check(`a disposed slot no longer activates (ran ${activations})`, activations === 1);
-meter.dispose();
-const reborn = bar.registerSlot({ id: "meter", name: "Meter again", order: 0, activate() {} });
-meter.dispose();
-check("a stale handle's dispose leaves a re-registered slot alone", anyById("meter") === reborn.element);
-reborn.dispose();
-left.dispose();
-right.dispose();
-
-bar.dispose();
-
-if (failures.length > 0) {
-  console.error(`status-indicators: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("status-indicators: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/stt-capture-score.mjs b/crates/workshop/ui/test/stt-capture-score.mjs
deleted file mode 100644
index 4035a2bf0..000000000
--- a/crates/workshop/ui/test/stt-capture-score.mjs
+++ /dev/null
@@ -1,558 +0,0 @@
-// Scores a native Realtime capture against a line file. The capture is the
-// JSON the gateway's native Realtime capture test writes; its server events
-// render through the take reducer the way Workshop shows them. A line file
-// is an array of `{ text, start_ms, end_ms }`, one entry per scripted line,
-// with times in milliseconds of clip audio. The capture appends audio at
-// real-time pace from its first append, so clip time and the capture's
-// receive times share one clock, to within one append.
-//
-// Per line, the score reports the final latency: the receive time of the
-// first final pass after which the line reads exactly as it does in the
-// completed transcript, minus the line's speech end. A final pass is a
-// hypothesis whose finalized text changes, read with its agreed text, or the
-// completed transcript itself; agreed text alone is not final until a final
-// pass lands. The score also reports whether the line's final text keeps the
-// script's terminal punctuation, each distinct run of words that renders
-// during the following pause beyond the script spoken so far, and, for the
-// take, the completed transcript and its word errors against the whole
-// script.
-// Words compare lowercased, with leading and trailing punctuation removed;
-// line texts compare exactly.
-//
-// With RUNVIL_REALTIME_CAPTURE naming a capture,
-// RUNVIL_CAPTURE_LINES a line file, and RUNVIL_CAPTURE_SCORE an
-// output path, the capture is scored into the output; otherwise only the
-// synthetic tests run.
-
-import assert from "node:assert/strict";
-import { readFileSync, writeFileSync } from "node:fs";
-import test from "node:test";
-import { applyEdits, createTakeRegistry, reduceTakeRegistry } from "./take-reducer-loader.mjs";
-
-const CAPTURE_VARIABLE = "RUNVIL_REALTIME_CAPTURE";
-const LINES_VARIABLE = "RUNVIL_CAPTURE_LINES";
-const SCORE_VARIABLE = "RUNVIL_CAPTURE_SCORE";
-const HYPOTHESIS = "conversation.item.input_audio_transcription.hypothesis";
-const COMMITTED = "input_audio_buffer.committed";
-const COMPLETED = "conversation.item.input_audio_transcription.completed";
-
-/**
- * Plays the capture's server events through the take reducer, stopping the
- * take where the capture committed. Returns the editor text after each
- * event, the stable text of each final pass, and the editor text once the
- * take completes.
- */
-function render(capture) {
-  let state = createTakeRegistry();
-  let editor = "";
-  const step = (input) => {
-    const result = reduceTakeRegistry(state, input);
-    state = result.state;
-    editor = applyEdits(editor, result.effects);
-    return result.effects;
-  };
-  const stop = () => {
-    const stopped = step({ type: "user.stop" }).find(
-      (effect) => effect.domain === "capture" && effect.command === "stop",
-    );
-    assert.ok(stopped, "stopping the take requests a capture stop");
-    const commit = step({ type: "capture.stopped", takeId: stopped.takeId, ok: true }).find(
-      (effect) => effect.domain === "wire" && effect.command === "commit",
-    );
-    assert.ok(commit, "a finished capture commits the take");
-    step({ type: "wire.result", requestId: commit.requestId, eventId: "commit" });
-  };
-
-  step({
-    type: "user.start",
-    context: { range: { start: 0, end: 0 }, original: "", compositionPrefix: "" },
-  });
-  const renders = [];
-  const finals = [];
-  let committed = false;
-  let revision = -1;
-  let finalized = "";
-  let completedText = null;
-  for (const { at_ms: atMs, event } of capture.events) {
-    if (!committed && atMs >= capture.commit_ms) {
-      committed = true;
-      stop();
-    }
-    step({ type: "server.event", event });
-    renders.push({ at_ms: atMs, text: editor });
-    if (event.type === HYPOTHESIS && event.revision > revision) {
-      revision = event.revision;
-      if (event.finalized !== finalized) {
-        finalized = event.finalized;
-        finals.push({ at_ms: atMs, text: event.finalized + event.agreed });
-      }
-    } else if (event.type === COMPLETED) {
-      finals.push({ at_ms: atMs, text: event.transcript });
-      completedText = editor;
-    }
-  }
-  return { renders, finals, completed: completedText };
-}
-
-/** Each whitespace-separated token with its compared form; tokens of only punctuation drop out. */
-function words(text) {
-  return text.split(/\s+/u).flatMap((token) => {
-    const word = token
-      .toLowerCase()
-      .replaceAll("\u2019", "'")
-      .replace(/^[^\p{L}\p{N}]+|[^\p{L}\p{N}]+$/gu, "");
-    return word === "" ? [] : [{ token, word }];
-  });
-}
-
-function compared(text) {
-  return words(text).map(({ word }) => word);
-}
-
-/**
- * A minimum-edit alignment of hypothesis words to reference words, with
- * the reference index each hypothesis word matches or substitutes, or
- * null for an insertion. With `prefix`, the hypothesis aligns to the
- * reference prefix that costs least, the longest on a tie. Ties align
- * trailing hypothesis words as insertions.
- */
-function align(hypothesis, reference, prefix = false) {
-  const rows = hypothesis.length + 1;
-  const columns = reference.length + 1;
-  const cost = Array.from({ length: rows }, (_, i) =>
-    Array.from({ length: columns }, (_, j) => (i === 0 ? j : j === 0 ? i : 0)),
-  );
-  const differs = (i, j) => (hypothesis[i - 1] === reference[j - 1] ? 0 : 1);
-  for (let i = 1; i < rows; i += 1) {
-    for (let j = 1; j < columns; j += 1) {
-      cost[i][j] = Math.min(
-        cost[i - 1][j - 1] + differs(i, j),
-        cost[i - 1][j] + 1,
-        cost[i][j - 1] + 1,
-      );
-    }
-  }
-  const last = cost[rows - 1];
-  const end = prefix
-    ? last.reduce((best, value, j) => (value <= last[best] ? j : best), 0)
-    : columns - 1;
-  const referenceIndex = Array(hypothesis.length).fill(null);
-  const counts = { substitutions: 0, deletions: 0, insertions: 0 };
-  let i = rows - 1;
-  let j = end;
-  while (i > 0 || j > 0) {
-    if (i > 0 && cost[i][j] === cost[i - 1][j] + 1) {
-      counts.insertions += 1;
-      i -= 1;
-    } else if (i > 0 && j > 0 && cost[i][j] === cost[i - 1][j - 1] + differs(i, j)) {
-      referenceIndex[i - 1] = j - 1;
-      counts.substitutions += differs(i, j);
-      i -= 1;
-      j -= 1;
-    } else {
-      counts.deletions += 1;
-      j -= 1;
-    }
-  }
-  return { referenceIndex, ...counts };
-}
-
-/** The sentence or clause mark that ends a text, past any closing quotes or brackets. */
-function terminalMark(text) {
-  return /([.?!,;:])[\p{Pe}\p{Pf}"']*\s*$/u.exec(text)?.[1] ?? null;
-}
-
-/** Whether `text` ends with the script line's mark, or null when the script line has none. */
-function keepsPunctuation(text, script) {
-  const mark = terminalMark(script);
-  return mark === null ? null : terminalMark(text) === mark;
-}
-
-/**
- * Each line's text within a transcript: its tokens from the first aligned
- * to one of the line's script words through the last, with any inserted
- * tokens between them, or null when no token aligns to the line.
- */
-function lineTexts(text, scriptWords, lineEnds) {
-  const tokens = words(text);
-  const { referenceIndex } = align(
-    tokens.map(({ word }) => word),
-    scriptWords,
-    true,
-  );
-  return lineEnds.map((end, index) => {
-    const start = lineEnds[index - 1] ?? 0;
-    const inside = (reference) => reference !== null && reference >= start && reference < end;
-    const first = referenceIndex.findIndex(inside);
-    if (first < 0) {
-      return null;
-    }
-    return tokens
-      .slice(first, referenceIndex.findLastIndex(inside) + 1)
-      .map(({ token }) => token)
-      .join(" ");
-  });
-}
-
-/** The shown words after the last one that aligns to a spoken script word. */
-function unsaidWords(text, spoken) {
-  const shown = compared(text);
-  const { referenceIndex } = align(shown, spoken, true);
-  return shown.slice(referenceIndex.findLastIndex((index) => index !== null) + 1);
-}
-
-/** Each nonempty run once, in the order first seen. */
-function distinctRuns(runs) {
-  return [
-    ...new Map(runs.filter((run) => run.length > 0).map((run) => [run.join(" "), run])).values(),
-  ];
-}
-
-function wordErrors(text, scriptWords) {
-  const { substitutions, deletions, insertions } = align(compared(text), scriptWords);
-  const errors = substitutions + deletions + insertions;
-  return {
-    substitutions,
-    deletions,
-    insertions,
-    errors,
-    script_words: scriptWords.length,
-    rate: errors / scriptWords.length,
-  };
-}
-
-function scoreCapture(capture, lines) {
-  const { renders, finals, completed } = render(capture);
-  const script = lines.map(({ text }) => compared(text));
-  const scriptWords = script.flat();
-  let through = 0;
-  const lineEnds = script.map((lineWords) => (through += lineWords.length));
-  const completedLines =
-    completed === null ? [] : lineTexts(completed, scriptWords, lineEnds);
-  const finalLines = finals.map(({ at_ms: atMs, text }) => ({
-    at_ms: atMs,
-    lines: lineTexts(text, scriptWords, lineEnds),
-  }));
-  return {
-    lines: lines.map((line, index) => {
-      const finalText = completedLines[index] ?? null;
-      const final =
-        finalText === null
-          ? undefined
-          : finalLines[
-              finalLines.findLastIndex((candidate) => candidate.lines[index] !== finalText) + 1
-            ];
-      const pauseEnd = lines[index + 1]?.start_ms ?? capture.commit_ms;
-      const spoken = scriptWords.slice(0, lineEnds[index]);
-      return {
-        text: line.text,
-        start_ms: line.start_ms,
-        end_ms: line.end_ms,
-        final_text: finalText,
-        final_ms: final?.at_ms ?? null,
-        final_latency_ms: final === undefined ? null : final.at_ms - line.end_ms,
-        punctuation_kept: finalText === null ? null : keepsPunctuation(finalText, line.text),
-        pause_unsaid_runs: distinctRuns(
-          renders
-            .filter(({ at_ms: atMs }) => atMs >= line.end_ms && atMs < pauseEnd)
-            .map(({ text }) => unsaidWords(text, spoken)),
-        ),
-      };
-    }),
-    take: { completed, word_errors: wordErrors(completed ?? "", scriptWords) },
-  };
-}
-
-function readLines(file) {
-  const lines = JSON.parse(readFileSync(file, "utf8"));
-  assert.ok(Array.isArray(lines) && lines.length > 0, `${file} lists the script's lines`);
-  lines.forEach((line, index) => {
-    assert.ok(
-      typeof line.text === "string" && compared(line.text).length > 0,
-      `line ${index} of ${file} has script words`,
-    );
-    assert.ok(
-      Number.isFinite(line.start_ms) && Number.isFinite(line.end_ms) && line.start_ms < line.end_ms,
-      `line ${index} of ${file} starts before it ends`,
-    );
-    assert.ok(
-      index === 0 || lines[index - 1].end_ms <= line.start_ms,
-      `line ${index} of ${file} starts after the line before it ends`,
-    );
-  });
-  return lines;
-}
-
-const scoring = [CAPTURE_VARIABLE, LINES_VARIABLE, SCORE_VARIABLE].map((name) => process.env[name]);
-
-test(
-  "the capture the environment names is scored into its output",
-  {
-    skip:
-      scoring.some((value) => !value) &&
-      `set ${CAPTURE_VARIABLE}, ${LINES_VARIABLE}, and ${SCORE_VARIABLE} to score a capture`,
-  },
-  () => {
-    const [capturePath, linesPath, scorePath] = scoring;
-    const score = scoreCapture(JSON.parse(readFileSync(capturePath, "utf8")), readLines(linesPath));
-    assert.notEqual(score.take.completed, null, `${capturePath} completes its take`);
-    writeFileSync(scorePath, `${JSON.stringify(score, null, 2)}\n`);
-  },
-);
-
-const ITEM_ID = "item_capture";
-
-function hypothesis(atMs, revision, finalized, agreed, tentative) {
-  return {
-    at_ms: atMs,
-    event: {
-      type: HYPOTHESIS,
-      event_id: `hypothesis_${revision}`,
-      item_id: ITEM_ID,
-      content_index: 0,
-      revision,
-      transcript: finalized + agreed + tentative,
-      finalized,
-      agreed,
-      tentative,
-      audio_start_ms: 0,
-      audio_end_ms: atMs,
-    },
-  };
-}
-
-function committed(atMs) {
-  return {
-    at_ms: atMs,
-    event: { type: COMMITTED, event_id: "committed", item_id: ITEM_ID, previous_item_id: null },
-  };
-}
-
-function completed(atMs, transcript) {
-  return {
-    at_ms: atMs,
-    event: {
-      type: COMPLETED,
-      event_id: "completed",
-      item_id: ITEM_ID,
-      content_index: 0,
-      transcript,
-      usage: { type: "duration", seconds: 0 },
-    },
-  };
-}
-
-const LINE_ONE = "Ask not what your country can do for you.";
-const LINE_TWO = "Ask what you can do for your country.";
-
-/** Two lines; the first final lands in the pause, the second after the commit without its period. */
-const SYNTHETIC_LINES = [
-  { text: LINE_ONE, start_ms: 0, end_ms: 2_000 },
-  { text: LINE_TWO, start_ms: 3_000, end_ms: 5_000 },
-];
-
-const SYNTHETIC_CAPTURE = {
-  audio_ms: 5_500,
-  chunk_ms: 100,
-  last_append_ms: 5_400,
-  commit_ms: 5_600,
-  completed: `${LINE_ONE} Ask what you can do for my country`,
-  events: [
-    hypothesis(1_200, 1, "", "", "Ask not what your"),
-    hypothesis(2_100, 2, "", "Ask not what your country", " can do for you. Ask"),
-    hypothesis(2_400, 3, LINE_ONE, "", ""),
-    hypothesis(2_600, 4, LINE_ONE, "", " Thank you so"),
-    hypothesis(2_800, 5, LINE_ONE, "", ""),
-    hypothesis(4_200, 6, LINE_ONE, " Ask what you", " can do for"),
-    hypothesis(5_300, 7, LINE_ONE, ` ${LINE_TWO}`, ""),
-    committed(5_700),
-    hypothesis(5_900, 8, `${LINE_ONE} Ask what you can do for my country`, "", ""),
-    completed(6_000, `${LINE_ONE} Ask what you can do for my country`),
-  ],
-};
-
-test("a line's final latency runs from its speech end to the final pass that lands its text", () => {
-  const score = scoreCapture(SYNTHETIC_CAPTURE, SYNTHETIC_LINES);
-  assert.deepEqual(
-    score.lines.map((line) => line.final_latency_ms),
-    [400, 900],
-  );
-});
-
-test("a final keeps or loses its line's terminal punctuation", () => {
-  const score = scoreCapture(SYNTHETIC_CAPTURE, SYNTHETIC_LINES);
-  assert.deepEqual(
-    score.lines.map((line) => line.punctuation_kept),
-    [true, false],
-  );
-});
-
-test("a pause counts rendered words beyond the script spoken so far, never said words", () => {
-  const score = scoreCapture(SYNTHETIC_CAPTURE, SYNTHETIC_LINES);
-  assert.deepEqual(
-    score.lines.map((line) => line.pause_unsaid_runs),
-    [[["thank", "you"]], []],
-  );
-});
-
-test("a pause reports each distinct unsaid run it shows, not only the longest", () => {
-  const first = "Can you check it?";
-  const second = "Use it now.";
-  const lines = [
-    { text: first, start_ms: 0, end_ms: 1_000 },
-    { text: second, start_ms: 3_000, end_ms: 4_000 },
-  ];
-  const transcript = `${first} ${second}`;
-  const capture = {
-    audio_ms: 4_500,
-    chunk_ms: 100,
-    last_append_ms: 4_400,
-    commit_ms: 4_500,
-    completed: transcript,
-    events: [
-      hypothesis(1_200, 1, first, "", ""),
-      hypothesis(1_500, 2, first, "", " Thank you so"),
-      hypothesis(1_700, 3, first, "", " Thank you so"),
-      hypothesis(1_900, 4, first, "", ""),
-      hypothesis(2_200, 5, first, "", " Bye now so"),
-      hypothesis(2_500, 6, first, "", ""),
-      hypothesis(4_300, 7, transcript, "", ""),
-      committed(4_600),
-      completed(4_700, transcript),
-    ],
-  };
-  assert.deepEqual(
-    scoreCapture(capture, lines).lines.map((line) => line.pause_unsaid_runs),
-    [[["thank", "you"], ["bye", "now"]], []],
-  );
-});
-
-test("the completed transcript reports its word errors against the whole script", () => {
-  const score = scoreCapture(SYNTHETIC_CAPTURE, SYNTHETIC_LINES);
-  assert.equal(score.take.completed, `${LINE_ONE} Ask what you can do for my country`);
-  assert.deepEqual(score.take.word_errors, {
-    substitutions: 1,
-    deletions: 0,
-    insertions: 0,
-    errors: 1,
-    script_words: 17,
-    rate: 1 / 17,
-  });
-});
-
-test("word errors count a dropped script word, an inserted word, and a substitution apart", () => {
-  const transcript = "Ask not what country can do for you. Ask what you can do for my own country";
-  const capture = {
-    audio_ms: 5_500,
-    chunk_ms: 100,
-    last_append_ms: 5_400,
-    commit_ms: 5_600,
-    completed: transcript,
-    events: [committed(5_700), completed(5_800, transcript)],
-  };
-  const score = scoreCapture(capture, SYNTHETIC_LINES);
-  assert.equal(score.take.completed, transcript);
-  assert.deepEqual(score.take.word_errors, {
-    substitutions: 1,
-    deletions: 1,
-    insertions: 1,
-    errors: 3,
-    script_words: 17,
-    rate: 3 / 17,
-  });
-});
-
-test("a line's final is the first final pass after which it reads as the completed transcript does", () => {
-  const first = "Can you check it?";
-  const second = "Use Runvil now.";
-  const third = "Keep talking, so the window cuts here.";
-  const lines = [
-    { text: first, start_ms: 0, end_ms: 1_000 },
-    { text: second, start_ms: 2_000, end_ms: 3_000 },
-    { text: third, start_ms: 4_000, end_ms: 6_000 },
-  ];
-  const transcript = `${first} ${second} ${third}`;
-  const capture = {
-    audio_ms: 6_500,
-    chunk_ms: 100,
-    last_append_ms: 6_400,
-    commit_ms: 7_000,
-    completed: transcript,
-    events: [
-      hypothesis(1_300, 1, "", first, ""),
-      hypothesis(1_700, 2, first, "", ""),
-      hypothesis(2_600, 3, first, " Use runvil now.", ""),
-      hypothesis(3_400, 4, `${first} Use`, " runvil now.", ""),
-      hypothesis(3_600, 5, `${first} ${second}`, "", ""),
-      hypothesis(6_800, 6, `${first} ${second} Keep talking,`, " so the window cuts here.", ""),
-      committed(7_100),
-      completed(7_200, transcript),
-    ],
-  };
-  assert.deepEqual(
-    scoreCapture(capture, lines).lines.map((line) => line.final_latency_ms),
-    [700, 600, 800],
-    "agreed text waits for a final pass, a final pass with other text does not count, and agreed text a final pass leaves behind does",
-  );
-});
-
-test("a final pass that revises a line's matching text moves its final to the pass that restores it", () => {
-  const first = "Can you check it?";
-  const second = "Use it now.";
-  const lines = [
-    { text: first, start_ms: 0, end_ms: 1_000 },
-    { text: second, start_ms: 2_000, end_ms: 3_000 },
-  ];
-  const transcript = `${first} ${second}`;
-  const capture = {
-    audio_ms: 3_500,
-    chunk_ms: 100,
-    last_append_ms: 3_400,
-    commit_ms: 4_000,
-    completed: transcript,
-    events: [
-      hypothesis(1_300, 1, "Can", " you check it?", ""),
-      hypothesis(1_600, 2, "Can you", " chuck it?", ""),
-      hypothesis(1_900, 3, first, "", ""),
-      hypothesis(3_400, 4, transcript, "", ""),
-      committed(4_100),
-      completed(4_200, transcript),
-    ],
-  };
-  assert.deepEqual(
-    scoreCapture(capture, lines).lines.map((line) => line.final_latency_ms),
-    [900, 400],
-  );
-});
-
-test("a split or misheard word still completes its line and never counts as unsaid", () => {
-  const lines = [
-    { text: "I cannot wait.", start_ms: 0, end_ms: 1_000 },
-    { text: "Let us go.", start_ms: 2_000, end_ms: 3_000 },
-  ];
-  const capture = {
-    audio_ms: 3_100,
-    chunk_ms: 100,
-    last_append_ms: 3_000,
-    commit_ms: 3_200,
-    completed: "I can not wait. Let us goal.",
-    events: [
-      hypothesis(1_300, 1, "I can not wait.", "", ""),
-      hypothesis(1_500, 2, "I can not wait.", "", ""),
-      committed(3_300),
-      completed(3_500, "I can not wait. Let us goal."),
-    ],
-  };
-  const score = scoreCapture(capture, lines);
-  assert.deepEqual(
-    score.lines.map(({ final_latency_ms, punctuation_kept, pause_unsaid_runs }) => ({
-      final_latency_ms,
-      punctuation_kept,
-      pause_unsaid_runs,
-    })),
-    [
-      { final_latency_ms: 300, punctuation_kept: true, pause_unsaid_runs: [] },
-      { final_latency_ms: 500, punctuation_kept: true, pause_unsaid_runs: [] },
-    ],
-  );
-});
diff --git a/crates/workshop/ui/test/stt-replay.mjs b/crates/workshop/ui/test/stt-replay.mjs
deleted file mode 100644
index ac0a14a47..000000000
--- a/crates/workshop/ui/test/stt-replay.mjs
+++ /dev/null
@@ -1,309 +0,0 @@
-// Speech-sandbox replay through the take reducer. Workshop owns every file
-// this test reads: the frozen snapshot streams and the two rendered-text
-// baselines under `test/fixtures/replay/`. The Gateway's own replay test
-// reads its speech-sandbox fixtures from its own tree, and neither suite
-// writes a file the other reads.
-//
-// These snapshots are a frozen copy, not a conformance copy. The test guards
-// how Workshop's take reducer renders a fixed sequence of transcription
-// events, and its baseline records how well that reduced to what was said. A
-// Gateway developer who edits a fixture is not changing Workshop's rendering,
-// so a drift check here would fail the wrong suite; the frozen input is what
-// makes this a regression guard rather than a moving target.
-
-import assert from "node:assert/strict";
-import { readdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { applyEdits, createTakeRegistry, reduceTakeRegistry } from "./take-reducer-loader.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-const replayDir = path.join(testDir, "fixtures", "replay");
-const UPDATE_VARIABLE = "RUNVIL_REPLAY_UPDATE";
-const METRICS_FILE = "ui-metrics.json";
-const BASELINE_FILE = "ui-baseline.json";
-const SNAPSHOTS_SUFFIX = ".snapshots.json";
-const ITEM_ID = "replay";
-
-function readJson(file) {
-  return JSON.parse(readFileSync(path.join(replayDir, file), "utf8"));
-}
-
-function byKey([left], [right]) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-function sorted(record) {
-  return Object.fromEntries(Object.entries(record).sort(byKey));
-}
-
-function writeJson(file, value) {
-  writeFileSync(path.join(replayDir, file), `${JSON.stringify(value, null, 2)}\n`);
-}
-
-function fixtures() {
-  return readdirSync(replayDir)
-    .filter((file) => file.endsWith(SNAPSHOTS_SUFFIX))
-    .sort()
-    .map((file) => [file.slice(0, -SNAPSHOTS_SUFFIX.length), readJson(file)]);
-}
-
-function words(text) {
-  return text.split(/\s+/).filter((word) => word !== "");
-}
-
-function changedWords(earlier, later) {
-  const before = words(earlier);
-  const after = words(later);
-  let common = 0;
-  while (common < before.length && before[common] === after[common]) {
-    common += 1;
-  }
-  return before.length - common;
-}
-
-function ratio(numerator, denominator) {
-  return denominator === 0 ? 0 : numerator / denominator;
-}
-
-/** Counts the editor text sequence the way the Gateway replay counts transcripts. */
-function renderedMetrics(rendered) {
-  const counts = rendered
-    .slice(1)
-    .map((later, index) => changedWords(rendered[index], later));
-  const changed = counts.reduce((sum, count) => sum + count, 0);
-  const changedPairs = counts.filter((count) => count > 0).length;
-  const completedWords = words(rendered.at(-1) ?? "").length;
-  return {
-    changed_pairs: changedPairs,
-    changed_words: changed,
-    completed_words: completedWords,
-    pairs: counts.length,
-    upsr: ratio(changedPairs, counts.length),
-    upwr: ratio(changed, completedWords),
-  };
-}
-
-/** The Gateway replay's UPWR rule, compared without division. */
-function thresholdViolations(current, baseline) {
-  return Object.entries(current).flatMap(([name, metrics]) => {
-    const base = baseline[name];
-    if (base === undefined) {
-      return [`${name} has no recorded baseline`];
-    }
-    return metrics.changed_words * base.completed_words >
-      base.changed_words * metrics.completed_words
-      ? [`${name} rendered UPWR ${metrics.upwr} is above its baseline ${base.upwr}`]
-      : [];
-  });
-}
-
-/** Whether total changed over total completed words, across fixtures, is strictly below the baseline's. */
-function aggregateUpwrBelowBaseline(current, baseline) {
-  const names = Object.keys(current);
-  const total = (metrics, field) =>
-    names.reduce((sum, name) => sum + (metrics[name]?.[field] ?? 0), 0);
-  return (
-    total(current, "changed_words") * total(baseline, "completed_words") <
-    total(baseline, "changed_words") * total(current, "completed_words")
-  );
-}
-
-function hypothesis(snapshot) {
-  return {
-    type: "conversation.item.input_audio_transcription.hypothesis",
-    event_id: `hypothesis_${snapshot.revision}`,
-    item_id: ITEM_ID,
-    content_index: 0,
-    revision: snapshot.revision,
-    transcript: snapshot.transcript,
-    finalized: snapshot.finalized,
-    agreed: snapshot.agreed,
-    tentative: snapshot.tentative,
-    audio_start_ms: snapshot.audio_start_ms,
-    audio_end_ms: snapshot.audio_end_ms,
-  };
-}
-
-/** The editor text after each snapshot, then after the completed transcript lands. */
-function render({ snapshots, completed }) {
-  let state = createTakeRegistry();
-  let editor = "";
-  const step = (input) => {
-    const result = reduceTakeRegistry(state, input);
-    state = result.state;
-    editor = applyEdits(editor, result.effects);
-    return result.effects;
-  };
-  step({
-    type: "user.start",
-    context: { range: { start: 0, end: 0 }, original: "", compositionPrefix: "" },
-  });
-  const rendered = snapshots.map((snapshot) => {
-    step({ type: "server.event", event: hypothesis(snapshot) });
-    return editor;
-  });
-  const stop = step({ type: "user.stop" }).find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(stop, "stopping the take requests a capture stop");
-  const commit = step({ type: "capture.stopped", takeId: stop.takeId, ok: true }).find(
-    (effect) => effect.domain === "wire" && effect.command === "commit",
-  );
-  assert.ok(commit, "a finished capture commits the take");
-  step({ type: "wire.result", requestId: commit.requestId, eventId: "commit_replay" });
-  step({
-    type: "server.event",
-    event: {
-      type: "input_audio_buffer.committed",
-      event_id: "committed_replay",
-      item_id: ITEM_ID,
-      previous_item_id: null,
-    },
-  });
-  step({
-    type: "server.event",
-    event: {
-      type: "conversation.item.input_audio_transcription.completed",
-      event_id: "completed_replay",
-      item_id: ITEM_ID,
-      content_index: 0,
-      transcript: completed,
-      usage: { type: "duration", seconds: 0 },
-    },
-  });
-  assert.equal(state.takes.length, 0, "the completed transcript retires the take");
-  rendered.push(editor);
-  return rendered;
-}
-
-test("every replay fixture renders through the take reducer within its ui baseline", () => {
-  const update = process.env[UPDATE_VARIABLE] === "1";
-  const loaded = fixtures();
-  assert.ok(
-    loaded.filter(([name]) => name.startsWith("scripted-")).length >= 4,
-    "every scripted fixture is discovered",
-  );
-  assert.ok(
-    loaded.some(([name]) => name === "jfk-native"),
-    "the native jfk fixture is discovered",
-  );
-
-  const current = {};
-  for (const [name, outcome] of loaded) {
-    const rendered = render(outcome);
-    assert.equal(
-      rendered.at(-1),
-      outcome.completed.trimEnd(),
-      `${name} lands its completed transcript`,
-    );
-    current[name] = renderedMetrics(rendered);
-  }
-
-  if (update) {
-    writeJson(METRICS_FILE, current);
-  } else {
-    assert.deepEqual(
-      readJson(METRICS_FILE),
-      current,
-      `${METRICS_FILE} drifted; run with ${UPDATE_VARIABLE}=1 to regenerate it`,
-    );
-  }
-
-  const recorded = readJson(BASELINE_FILE);
-  const unrecorded = Object.keys(current).filter((name) => !(name in recorded));
-  const baseline = { ...recorded };
-  if (update && unrecorded.length > 0) {
-    for (const name of unrecorded) {
-      baseline[name] = current[name];
-    }
-    writeJson(BASELINE_FILE, sorted(baseline));
-  }
-  const violations = thresholdViolations(current, baseline);
-  assert.deepEqual(violations, [], `rendered-text thresholds are broken:\n${violations.join("\n")}`);
-  assert.ok(
-    aggregateUpwrBelowBaseline(current, baseline),
-    "aggregate rendered UPWR across fixtures is below the recorded baseline aggregate",
-  );
-});
-
-test("a final that lands in silence shows the last word and its period before the next word", () => {
-  const outcome = readJson("scripted-silence-short-word.snapshots.json");
-  const rendered = render(outcome);
-  const beforeNextWord = outcome.snapshots.findIndex((snapshot) =>
-    snapshot.transcript.includes("Hey"),
-  ) - 1;
-  assert.ok(beforeNextWord >= 0, "the fixture says a word after its silence");
-  assert.equal(rendered[beforeNextWord], "About one tick faster than the plan's 0.6 seconds.");
-});
-
-test("a final shows no tentative echo of the words it covers", () => {
-  const outcome = readJson("scripted-trailing-echo.snapshots.json");
-  const rendered = render(outcome);
-  const landed = outcome.snapshots.findIndex((snapshot) =>
-    snapshot.finalized.endsWith("create a plan."),
-  );
-  assert.ok(landed >= 0, "the fixture's second final lands before the commit");
-  assert.equal(
-    rendered[landed],
-    "Okay listen up this is what I want. I want you to create a plan.",
-  );
-});
-
-test("a repeat decoded from trailing silence never renders, before or after its final", () => {
-  for (const name of ["scripted-trailing-echo", "scripted-trailing-echo-same-pass"]) {
-    const echoes = render(readJson(`${name}${SNAPSHOTS_SUFFIX}`)).filter((text) =>
-      text.includes("plan. I want"),
-    );
-    assert.deepEqual(echoes, [], `${name} renders the echo`);
-  }
-});
-
-test("rendered UPWR and UPSR count earlier editor words after the exact common prefix", () => {
-  assert.deepEqual(
-    renderedMetrics(["ask not", "Ask not what", "Ask not, what your", "Ask not, what your country"]),
-    {
-      changed_pairs: 2,
-      changed_words: 4,
-      completed_words: 5,
-      pairs: 3,
-      upsr: 2 / 3,
-      upwr: 4 / 5,
-    },
-  );
-});
-
-test("the ui threshold flags rendered UPWR above baseline and a fixture without one", () => {
-  const counted = (changed, completed) => ({
-    changed_words: changed,
-    completed_words: completed,
-    upwr: changed / completed,
-  });
-  const baseline = { "scripted-a": counted(2, 10) };
-  const check = (metrics, name = "scripted-a") =>
-    thresholdViolations({ [name]: metrics }, baseline).length;
-
-  assert.equal(check(counted(2, 10)), 0);
-  assert.equal(check(counted(1, 10)), 0);
-  assert.equal(check(counted(4, 20)), 0, "an equal ratio over more words passes");
-  assert.equal(check(counted(3, 10)), 1, "UPWR rises");
-  assert.equal(check(counted(2, 10), "scripted-b"), 1, "a fixture without a baseline section fails");
-});
-
-test("the aggregate ui rule sums every fixture and requires strictly lower UPWR", () => {
-  const counted = (changed, completed) => ({ changed_words: changed, completed_words: completed });
-  const baseline = { a: counted(4, 10), b: counted(2, 10) };
-
-  assert.equal(aggregateUpwrBelowBaseline({ a: counted(3, 10), b: counted(2, 10) }, baseline), true);
-  assert.equal(
-    aggregateUpwrBelowBaseline({ a: counted(6, 10), b: counted(0, 10) }, baseline),
-    false,
-    "an equal aggregate is not below",
-  );
-  assert.equal(
-    aggregateUpwrBelowBaseline({ a: counted(1, 10), b: counted(6, 10) }, baseline),
-    false,
-    "one fixture's rise outweighs another's fall",
-  );
-});
diff --git a/crates/workshop/ui/test/stt-stream.mjs b/crates/workshop/ui/test/stt-stream.mjs
deleted file mode 100644
index 70d760309..000000000
--- a/crates/workshop/ui/test/stt-stream.mjs
+++ /dev/null
@@ -1,1527 +0,0 @@
-// Browser Realtime transcription service, pinned to the canonical wire
-// fixtures shared with the Rust implementation. Run: node test/stt-stream.mjs
-import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
-import { mock } from "node:test";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-// Workshop's own copy of the canonical wire fixtures, beside the Rust test
-// that reads the same files, the way `agent-frames.json` is shared.
-const fixtures = path.join(uiDir, "..", "..", "server", "tests", "fixtures", "realtime");
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { RealtimeTranscriptionService } from "./src/services/realtime-transcription.ts";
-      export { SpeechCaptureService } from "./src/services/speech-capture.ts";
-      export { setupStt, textareaSttTarget } from "./src/parts/stt/stt.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  loader: { ".css": "empty" },
-  logLevel: "silent",
-});
-
-const {
-  lifecycle,
-  RealtimeTranscriptionService,
-  SpeechCaptureService,
-  setupStt,
-  textareaSttTarget,
-} = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-const client = JSON.parse(await readFile(path.join(fixtures, "client-events.json"), "utf8"));
-const server = JSON.parse(await readFile(path.join(fixtures, "server-events.json"), "utf8"));
-globalThis.location = new URL("http://127.0.0.1:7910/");
-const presence = { label: () => "Dictation test", reveal() {} };
-
-function timelineText(start, end) {
-  return Array.from({ length: end - start }, (_, index) =>
-    `word${String(start + index).padStart(4, "0")}`
-  ).join(" ");
-}
-
-{
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const target = textareaSttTarget(textarea);
-
-  textarea.value = "First test alpha";
-  textarea.setSelectionRange(textarea.value.length, textarea.value.length);
-  const append = target.insertionContext();
-  assert.deepEqual(append, {
-    range: { start: 16, end: 16 },
-    original: "",
-    compositionPrefix: " ",
-  });
-
-  textarea.value += " ";
-  assert.equal(
-    append.compositionPrefix,
-    " ",
-    "a captured textarea composition prefix is immutable",
-  );
-  textarea.setSelectionRange(textarea.value.length, textarea.value.length);
-  assert.equal(
-    target.insertionContext().compositionPrefix,
-    "",
-    "existing textarea whitespace prevents a composition separator",
-  );
-
-  textarea.value = "First test alpha";
-  textarea.setSelectionRange(6, 10);
-  assert.deepEqual(
-    target.insertionContext(),
-    {
-      range: { start: 6, end: 10 },
-      original: "test",
-      compositionPrefix: "",
-    },
-    "a textarea selection is captured without a composition separator",
-  );
-
-  textarea.value = "alphaBeta";
-  textarea.setSelectionRange(5, 5);
-  assert.deepEqual(
-    target.insertionContext(),
-    {
-      range: { start: 5, end: 5 },
-      original: "",
-      compositionPrefix: "",
-    },
-    "a mid-word textarea insertion receives no composition separator",
-  );
-}
-
-class ScriptedSocket {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  constructor(url) {
-    this.url = url;
-    this.readyState = ScriptedSocket.CONNECTING;
-    this.sent = [];
-    this.listeners = new Map();
-  }
-  addEventListener(type, listener, options) {
-    if (!this.listeners.has(type)) this.listeners.set(type, []);
-    this.listeners.get(type).push({ listener, once: options?.once === true });
-  }
-  dispatch(type, event) {
-    const entries = this.listeners.get(type) ?? [];
-    this.listeners.set(
-      type,
-      entries.filter((entry) => !entry.once),
-    );
-    for (const entry of entries) entry.listener(event);
-  }
-  send(data) {
-    this.sent.push(JSON.parse(data));
-  }
-  close() {
-    if (this.readyState === ScriptedSocket.CLOSED) return;
-    this.readyState = ScriptedSocket.CLOSED;
-    this.dispatch("close", {});
-  }
-  open() {
-    this.readyState = ScriptedSocket.OPEN;
-    this.dispatch("open", {});
-  }
-  message(frame) {
-    this.dispatch("message", { data: JSON.stringify(frame) });
-  }
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({ socket: () => socket });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-
-    let finishCaptureStart = null;
-    const capture = new SpeechCaptureService({
-      open: () =>
-        new Promise((resolve) => {
-          finishCaptureStart = () =>
-            resolve({
-              clear() {},
-              async stop() {},
-              dispose() {},
-            });
-        }),
-    });
-    const status = {
-      recording: false,
-      showLocal() {},
-      setRecording(recording) {
-        this.recording = recording;
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    textarea.value = "old target keep";
-    textarea.setSelectionRange(4, 10);
-    textarea.focus();
-    stt.press();
-    assert.equal(typeof finishCaptureStart, "function");
-    assert.equal(textarea.readOnly, false, "the textarea remains editable during startup");
-
-    textarea.value = "edited live tail";
-    textarea.setSelectionRange(7, 11);
-    finishCaptureStart();
-    for (let turn = 0; turn < 4 && !status.recording; turn++) {
-      await Promise.resolve();
-    }
-    assert.equal(textarea.readOnly, true, "successful startup locks the current textarea context");
-
-    socket.message({
-      ...server.transcription_hypothesis,
-      event_id: "evt_delayed_textarea_hypothesis",
-      item_id: "item_delayed_textarea",
-      transcript: "spoken",
-      finalized: "",
-      agreed: "spoken",
-      tentative: "",
-    });
-    assert.equal(textarea.value, "edited spoken tail");
-    stt.discardIfRecording();
-    assert.equal(
-      textarea.value,
-      "edited live tail",
-      "textarea rollback restores the selection captured after delayed startup",
-    );
-    assert.equal(textarea.selectionStart, 11);
-    assert.equal(dom.window.document.activeElement, textarea);
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({ socket: () => socket });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-    const captureTrace = [];
-    const capture = new SpeechCaptureService({
-      async open() {
-        return {
-          clear() {},
-          async stop() {
-            captureTrace.push("stop");
-          },
-          dispose() {},
-        };
-      },
-    });
-    const status = {
-      recording: false,
-      showLocal() {},
-      setRecording(recording) {
-        this.recording = recording;
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    stt.press();
-    for (let turn = 0; turn < 4 && !status.recording; turn++) {
-      await Promise.resolve();
-    }
-    const snapshots = [
-      {
-        transcript: timelineText(0, 11),
-        finalized: "",
-        agreed: timelineText(0, 10),
-        tentative: ` ${timelineText(10, 11)}`,
-      },
-      {
-        transcript: timelineText(0, 21),
-        finalized: timelineText(0, 2),
-        agreed: ` ${timelineText(2, 19)}`,
-        tentative: ` ${timelineText(19, 21)}`,
-      },
-    ];
-    const shown = [timelineText(0, 10), timelineText(0, 20)];
-    let previousLength = 0;
-    for (const [revision, snapshot] of snapshots.entries()) {
-      socket.message({
-        ...server.transcription_hypothesis,
-        event_id: `evt_live_prefix_${revision}`,
-        item_id: "item_live_prefix",
-        revision: revision + 1,
-        ...snapshot,
-      });
-      assert.equal(
-        textarea.value,
-        shown[revision],
-        "the textarea shows every word but the held-back last tentative one, unstyled",
-      );
-      assert.ok(
-        textarea.value.length >= previousLength,
-        "the production editor never drops the revisable forced middle",
-      );
-      previousLength = textarea.value.length;
-    }
-
-    stt.press();
-    for (
-      let turn = 0;
-      turn < 4 &&
-      socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 0;
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-    assert.deepEqual(captureTrace, ["stop"]);
-    socket.message({
-      ...server.input_audio_buffer_committed,
-      event_id: "evt_live_prefix_committed",
-      item_id: "item_live_prefix",
-    });
-    socket.message({
-      ...server.transcription_completed,
-      event_id: "evt_live_prefix_completed",
-      item_id: "item_live_prefix",
-      transcript: timelineText(0, 21),
-    });
-    assert.equal(
-      textarea.value,
-      timelineText(0, 21),
-      "Stop preserves the same full text shown while recording",
-    );
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    let nextEventId = 1;
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({
-      eventId: () => `client_failure_${nextEventId++}`,
-      socket: () => socket,
-    });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-
-    const captureTrace = [];
-    let emitAudio = null;
-    const capture = new SpeechCaptureService({
-      async open(onAudio) {
-        emitAudio = onAudio;
-        return {
-          clear() {
-            captureTrace.push("clear");
-          },
-          async stop() {
-            captureTrace.push("stop");
-          },
-          dispose() {},
-        };
-      },
-    });
-    const status = {
-      local: [],
-      recording: [],
-      showLocal(label, severity) {
-        this.local.push({ label, severity });
-      },
-      setRecording(recording) {
-        this.recording.push(recording);
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    stt.press();
-    for (let turn = 0; turn < 4 && status.recording.at(-1) !== true; turn++) {
-      await Promise.resolve();
-    }
-    emitAudio(Uint8Array.from([1, 0]).buffer);
-    socket.message({
-      ...server.transcription_hypothesis,
-      event_id: "evt_failure_hypothesis",
-      item_id: "item_failure",
-      transcript: "accepted visible words",
-      finalized: "accepted ",
-      agreed: "visible words",
-      tentative: "",
-    });
-    const precommit = {
-      event_id: "evt_precommit_failure",
-      type: "error",
-      error: {
-        type: "invalid_request_error",
-        code: "precommit_transcription_failed",
-        message: "Further appends are rejected after accurate precommit failure",
-        param: "audio",
-        event_id: "client_failure_2",
-      },
-    };
-    const sentBeforeFailure = socket.sent.length;
-    socket.message(precommit);
-    socket.message({ ...precommit, event_id: "evt_precommit_failure_duplicate" });
-    for (
-      let turn = 0;
-      turn < 4 &&
-      socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 0;
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-
-    assert.equal(textarea.value, "accepted visible words");
-    assert.deepEqual(captureTrace, ["stop"]);
-    assert.equal(
-      socket.sent
-        .slice(sentBeforeFailure)
-        .filter((event) => event.type === "input_audio_buffer.clear").length,
-      0,
-    );
-    assert.equal(
-      socket.sent
-        .slice(sentBeforeFailure)
-        .filter((event) => event.type === "input_audio_buffer.commit").length,
-      1,
-    );
-
-    socket.message({
-      ...server.input_audio_buffer_committed,
-      event_id: "evt_failure_committed",
-      item_id: "item_failure",
-    });
-    const terminalFailure = {
-      ...server.transcription_failed,
-      event_id: "evt_terminal_failure",
-      item_id: "item_failure",
-      error: {
-        ...server.transcription_failed.error,
-        code: "precommit_transcription_failed",
-      },
-    };
-    status.local.length = 0;
-    socket.message(terminalFailure);
-    assert.equal(textarea.value, "accepted visible words");
-    assert.equal(textarea.readOnly, false);
-    assert.deepEqual(status.local, [
-      {
-        label:
-          "Dictation could not be fully transcribed. Visible text was kept and can be edited.",
-        severity: "error",
-      },
-    ]);
-
-    socket.message({ ...terminalFailure, event_id: "evt_terminal_failure_duplicate" });
-    socket.message({
-      ...server.transcription_hypothesis,
-      event_id: "evt_stale_failure_hypothesis",
-      item_id: "item_failure",
-      transcript: "MUST NOT REPLACE",
-      finalized: "",
-      agreed: "",
-      tentative: "MUST NOT REPLACE",
-    });
-    socket.message({
-      ...server.transcription_completed,
-      event_id: "evt_stale_failure_completion",
-      item_id: "item_failure",
-      transcript: "MUST NOT REPLACE",
-    });
-    assert.equal(textarea.value, "accepted visible words");
-    assert.equal(status.local.length, 1);
-
-    stt.press();
-    for (
-      let turn = 0;
-      turn < 4 && status.recording.at(-1) !== true;
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-    emitAudio(Uint8Array.from([2, 0]).buffer);
-    emitAudio(Uint8Array.from([3, 0]).buffer);
-    const laterAppends = socket.sent.filter(
-      (event) => event.type === "input_audio_buffer.append",
-    );
-    assert.equal(laterAppends.length, 3);
-    const supersededAppendId = laterAppends[1].event_id;
-    const liveAppendId = laterAppends[2].event_id;
-    const commitsBeforeStale = socket.sent.filter(
-      (event) => event.type === "input_audio_buffer.commit",
-    ).length;
-    const staleFailures = [
-      {
-        ...precommit,
-        event_id: "evt_stale_null_precommit",
-        error: { ...precommit.error, event_id: null },
-      },
-      {
-        ...precommit,
-        event_id: "evt_stale_missing_precommit",
-        error: { ...precommit.error },
-      },
-      {
-        ...precommit,
-        event_id: "evt_stale_retired_precommit",
-        error: { ...precommit.error, event_id: "client_failure_2" },
-      },
-      {
-        ...precommit,
-        event_id: "evt_stale_superseded_precommit",
-        error: { ...precommit.error, event_id: supersededAppendId },
-      },
-    ];
-    delete staleFailures[1].error.event_id;
-    for (const staleFailure of staleFailures) {
-      socket.message(staleFailure);
-    }
-    await Promise.resolve();
-    assert.deepEqual(captureTrace, ["stop"]);
-    assert.equal(
-      socket.sent.filter(
-        (event) => event.type === "input_audio_buffer.commit",
-      ).length,
-      commitsBeforeStale,
-      "uncorrelated and stale failures cannot commit the later take",
-    );
-
-    const liveFailure = {
-      ...precommit,
-      event_id: "evt_live_precommit",
-      error: { ...precommit.error, event_id: liveAppendId },
-    };
-    socket.message(liveFailure);
-    socket.message({ ...liveFailure, event_id: "evt_live_precommit_duplicate" });
-    for (
-      let turn = 0;
-      turn < 4 &&
-      socket.sent.filter((event) => event.type === "input_audio_buffer.commit")
-        .length === commitsBeforeStale;
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-    assert.deepEqual(captureTrace, ["stop", "stop"]);
-    assert.equal(
-      socket.sent.filter(
-        (event) => event.type === "input_audio_buffer.commit",
-      ).length,
-      commitsBeforeStale + 1,
-      "the live append failure stops and commits exactly once",
-    );
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    let nextEventId = 1;
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({
-      eventId: () => `client_overload_${nextEventId++}`,
-      socket: () => socket,
-    });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-
-    const captureTrace = [];
-    let emitHourAudio = null;
-    const capture = new SpeechCaptureService({
-      async open(emitAudio) {
-        emitHourAudio = emitAudio;
-        return {
-          clear() {
-            captureTrace.push("clear");
-          },
-          async stop() {
-            captureTrace.push("stop");
-          },
-          dispose() {},
-        };
-      },
-    });
-    const status = {
-      local: [],
-      recording: [],
-      showLocal(label, severity) {
-        this.local.push({ label, severity });
-      },
-      setRecording(recording) {
-        this.recording.push(recording);
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    stt.press();
-    for (let turn = 0; turn < 4 && status.recording.at(-1) !== true; turn++) {
-      await Promise.resolve();
-    }
-    assert.equal(typeof emitHourAudio, "function");
-    const boundedChunk = Uint8Array.from([1, 0, 2, 0]).buffer;
-    for (let stride = 0; stride < 360; stride++) {
-      emitHourAudio(boundedChunk);
-    }
-    assert.equal(
-      socket.sent.filter((event) => event.type === "input_audio_buffer.append").length,
-      360,
-      "production setup streams an hour-equivalent 360 bounded chunks",
-    );
-    socket.message({
-      ...server.transcription_hypothesis,
-      event_id: "evt_hour_hypothesis",
-      item_id: "item_hour",
-      transcript: "accepted visible words",
-      finalized: "accepted ",
-      agreed: "visible words",
-      tentative: "",
-    });
-    assert.equal(textarea.value, "accepted visible words");
-    captureTrace.length = 0;
-    status.local.length = 0;
-    status.recording.length = 0;
-    const sentBeforeOverload = socket.sent.length;
-
-    socket.message({
-      event_id: "evt_hour_overload",
-      type: "error",
-      error: {
-        type: "overload_error",
-        code: "too_much_unfinalized_audio",
-        message: "Unfinalized audio exceeds 30 seconds",
-        param: "audio",
-        event_id: "client_overload_361",
-      },
-    });
-    socket.message({
-      event_id: "evt_hour_overload_duplicate",
-      type: "error",
-      error: {
-        type: "overload_error",
-        code: "too_much_unfinalized_audio",
-        message: "Unfinalized audio exceeds 30 seconds",
-        param: "audio",
-        event_id: "client_overload_361",
-      },
-    });
-    for (
-      let turn = 0;
-      turn < 4 &&
-      socket.sent.filter((event) => event.type === "input_audio_buffer.commit").length === 0;
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-
-    assert.equal(textarea.value, "accepted visible words");
-    assert.deepEqual(captureTrace, ["stop"], "duplicate overload stops capture once");
-    assert.deepEqual(status.recording, [false]);
-    assert.deepEqual(status.local, [
-      {
-        label: "Dictation stopped because transcription could not keep up. Captured audio is being finalized.",
-        severity: "error",
-      },
-    ]);
-    assert.equal(
-      socket.sent
-        .slice(sentBeforeOverload)
-        .filter((event) => event.type === "input_audio_buffer.clear").length,
-      0,
-      "the production overload path sends no clear",
-    );
-    assert.equal(
-      socket.sent
-        .slice(sentBeforeOverload)
-        .filter((event) => event.type === "input_audio_buffer.commit").length,
-      1,
-      "the production overload path commits the still-valid server input once",
-    );
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    let nextEventId = 1;
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({
-      eventId: () => `client_once_${nextEventId++}`,
-      socket: () => socket,
-    });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-
-    const captureTrace = [];
-    const capture = new SpeechCaptureService({
-      async open() {
-        return {
-          clear() {
-            captureTrace.push("clear");
-          },
-          async stop() {
-            captureTrace.push("stop");
-          },
-          dispose() {},
-        };
-      },
-    });
-    const status = {
-      local: [],
-      recording: [],
-      showLocal(label, severity) {
-        this.local.push({ label, severity });
-      },
-      setRecording(recording) {
-        this.recording.push(recording);
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    stt.press();
-    for (let turn = 0; turn < 4 && status.recording.at(-1) !== true; turn++) {
-      await Promise.resolve();
-    }
-    captureTrace.length = 0;
-    status.local.length = 0;
-    status.recording.length = 0;
-
-    socket.message(server.error_uncorrelated);
-
-    assert.deepEqual(captureTrace, ["clear", "stop"]);
-    assert.deepEqual(status.recording, [false]);
-    assert.deepEqual(status.local, [
-      {
-        label: "Dictation is temporarily unavailable. Try again.",
-        severity: "error",
-      },
-    ]);
-    assert.equal(
-      socket.sent.filter(
-        (event) => event.type === "input_audio_buffer.clear",
-      ).length,
-      1,
-      "one decoded failure produces one reducer-owned wire clear",
-    );
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM("<!doctype html><textarea></textarea>");
-  const textarea = dom.window.document.querySelector("textarea");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    const trace = [];
-    const socket = new ScriptedSocket("/v1/realtime");
-    const realtime = new RealtimeTranscriptionService({
-      eventId: () => "client_loss_update",
-      socket: () => socket,
-    });
-    socket.open();
-    socket.message(server.session_created);
-    socket.message(server.session_updated);
-
-    const capture = new SpeechCaptureService({
-      async open() {
-        return {
-          clear() {
-            trace.push("capture.clear");
-          },
-          async stop() {
-            trace.push("capture.stop");
-          },
-          dispose() {},
-        };
-      },
-    });
-    const status = {
-      showLocal(label) {
-        trace.push(`status.local:${label}`);
-      },
-      setRecording(recording) {
-        trace.push(`status.recording:${recording}`);
-      },
-    };
-    const stt = setupStt(
-      { input: textareaSttTarget(textarea) },
-      status,
-      () => null,
-      capture,
-      presence,
-      realtime,
-    );
-
-    stt.press();
-    for (
-      let turn = 0;
-      turn < 4 && trace.at(-1) !== "status.local:Listening...";
-      turn++
-    ) {
-      await Promise.resolve();
-    }
-    trace.length = 0;
-    const sentBeforeLoss = structuredClone(socket.sent);
-
-    socket.close();
-
-    assert.deepEqual(trace, [
-      "capture.clear",
-      "capture.stop",
-      "status.recording:false",
-      "status.local:Dictation is temporarily unavailable. Try again.",
-    ]);
-    assert.deepEqual(
-      socket.sent,
-      sentBeforeLoss,
-      "connection loss cannot emit a clear on the already unavailable socket",
-    );
-
-    stt.dispose();
-    capture.dispose();
-    realtime.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-// Two dictation surfaces over one shared capture service: the first press
-// owns the microphone; the second is refused with a reason, sees `blocked`,
-// receives none of the owner's audio, and returns to `idle` when the
-// owner's take ends.
-await assertNoLeaks(lifecycle, async () => {
-  const dom = new JSDOM(
-    '<!doctype html><textarea id="a"></textarea><textarea id="b"></textarea>',
-  );
-  const textareaA = dom.window.document.querySelector("#a");
-  const textareaB = dom.window.document.querySelector("#b");
-  const previousEvent = globalThis.Event;
-  globalThis.Event = dom.window.Event;
-  try {
-    const negotiated = (socket) => {
-      const realtime = new RealtimeTranscriptionService({ socket: () => socket });
-      socket.open();
-      socket.message(server.session_created);
-      socket.message(server.session_updated);
-      return realtime;
-    };
-    const socketA = new ScriptedSocket("/v1/realtime");
-    const socketB = new ScriptedSocket("/v1/realtime");
-    const realtimeA = negotiated(socketA);
-    const realtimeB = negotiated(socketB);
-
-    let emitAudio = null;
-    const capture = new SpeechCaptureService({
-      async open(onAudio) {
-        emitAudio = onAudio;
-        return {
-          clear() {},
-          async stop() {},
-          dispose() {},
-        };
-      },
-    });
-    const makeStatus = () => ({
-      local: [],
-      recording: [],
-      showLocal(label, severity) {
-        this.local.push({ label, severity });
-      },
-      setRecording(recording) {
-        this.recording.push(recording);
-      },
-    });
-    const statusA = makeStatus();
-    const statusB = makeStatus();
-    const sttA = setupStt({ input: textareaSttTarget(textareaA) }, statusA, () => null, capture, presence, realtimeA);
-    const sttB = setupStt({ input: textareaSttTarget(textareaB) }, statusB, () => null, capture, presence, realtimeB);
-    const statesB = [];
-    const subscription = sttB.onState((state) => statesB.push(state));
-    assert.equal(sttA.state, "idle");
-    assert.equal(sttB.state, "idle");
-
-    sttA.press();
-    for (let turn = 0; turn < 4 && statusA.recording.at(-1) !== true; turn++) {
-      await Promise.resolve();
-    }
-    assert.equal(sttA.state, "recording", "the first press owns the microphone");
-    assert.equal(sttB.state, "blocked", "the other surface sees the microphone as taken");
-    assert.deepEqual(statesB, ["blocked"], "onState fires once for the change to blocked");
-
-    sttB.press();
-    for (let turn = 0; turn < 4 && statusB.local.length === 0; turn++) {
-      await Promise.resolve();
-    }
-    assert.deepEqual(
-      statusB.local,
-      [{ label: "Dictation is active in another window", severity: "info" }],
-      "a press on the blocked surface names the other window, not the owning part's blocker",
-    );
-    assert.equal(sttA.state, "recording", "the refused press does not steal the take");
-    assert.equal(statusA.recording.at(-1), true);
-
-    emitAudio(Uint8Array.from([1, 0]).buffer);
-    assert.equal(
-      socketA.sent.filter((event) => event.type === "input_audio_buffer.append").length,
-      1,
-      "the owner streams the shared audio",
-    );
-    assert.equal(
-      socketB.sent.filter((event) => event.type === "input_audio_buffer.append").length,
-      0,
-      "a non-owner drops the owner's audio",
-    );
-    assert.equal(statusB.recording.includes(true), false, "a non-owner never lights its LED");
-
-    sttA.press();
-    for (let turn = 0; turn < 6 && sttB.state !== "idle"; turn++) {
-      await Promise.resolve();
-    }
-    assert.equal(sttA.state, "idle", "stopping the take dims the owner's mic");
-    assert.equal(sttB.state, "idle", "releasing the microphone unblocks the other surface");
-    assert.deepEqual(statesB, ["blocked", "idle"]);
-
-    subscription.dispose();
-    sttA.dispose();
-    sttB.dispose();
-    capture.dispose();
-    realtimeA.dispose();
-    realtimeB.dispose();
-  } finally {
-    globalThis.Event = previousEvent;
-    dom.window.close();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const sockets = [];
-  const service = new RealtimeTranscriptionService({
-    prompt: "meeting notes",
-    eventId: (() => {
-      const ids = [
-        "client_update_1",
-        "client_append_1",
-        "client_commit_1",
-        "client_clear_1",
-      ];
-      return () => ids.shift();
-    })(),
-    socket: (url) => {
-      const socket = new ScriptedSocket(url);
-      sockets.push(socket);
-      return socket;
-    },
-  });
-  const states = [];
-  const events = [];
-  const errors = [];
-  service.onState((value) => states.push(value));
-  service.onEvent((value) => events.push(value));
-  service.onError((value) => errors.push(value));
-
-  assert.equal(sockets.length, 1);
-  assert.match(sockets[0].url, /\/v1\/realtime$/);
-  sockets[0].open();
-  sockets[0].message(server.session_created);
-  assert.deepEqual(
-    sockets[0].sent,
-    [client.session_update],
-    "the production service requests hypotheses",
-  );
-  sockets[0].message(server.session_updated);
-  assert.equal(service.state, "ready");
-  assert.deepEqual(states, [{ state: "ready", generation: 1 }]);
-
-  service.append(Uint8Array.from([0, 0, 1, 0, 255, 255]).buffer);
-  service.commit();
-  service.clear();
-  assert.deepEqual(sockets[0].sent.slice(1), [
-    client.input_audio_buffer_append,
-    { ...client.input_audio_buffer_commit, event_id: "client_commit_1" },
-    { ...client.input_audio_buffer_clear, event_id: "client_clear_1" },
-  ]);
-
-  sockets[0].message(server.input_audio_buffer_committed);
-  sockets[0].message(server.transcription_hypothesis);
-  sockets[0].message(server.transcription_delta);
-  sockets[0].message(server.transcription_completed);
-  sockets[0].message(server.transcription_failed);
-  sockets[0].message(server.error_correlated);
-  assert.deepEqual(
-    events.map(({ event }) => event.type),
-    [
-      "session.created",
-      "session.updated",
-      "input_audio_buffer.committed",
-      "conversation.item.input_audio_transcription.hypothesis",
-      "conversation.item.input_audio_transcription.completed",
-      "conversation.item.input_audio_transcription.failed",
-      "error",
-    ],
-    "the production service publishes strict decoded events for reducer ownership",
-  );
-  assert.deepEqual(
-    errors,
-    [],
-    "decoded server failures publish only through the reducer event seam",
-  );
-
-  service.dispose();
-  assert.equal(sockets[0].readyState, ScriptedSocket.CLOSED);
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  mock.timers.enable({ apis: ["setTimeout"] });
-  try {
-    const sockets = [];
-    const service = new RealtimeTranscriptionService({
-      eventId: () => "client_hypothesis_update",
-      socket: (url) => {
-        const socket = new ScriptedSocket(url);
-        sockets.push(socket);
-        return socket;
-      },
-    });
-    const events = [];
-    const errors = [];
-    service.onEvent((value) => events.push(value));
-    service.onError((value) => errors.push(value));
-    const unnegotiatedSessionUpdated = {
-      ...server.session_updated,
-      session: {
-        ...server.session_updated.session,
-        include: [
-          ...client.session_update.session.include,
-          "item.input_audio_transcription.logprobs",
-        ],
-      },
-    };
-    const malformedHypothesis = { ...server.transcription_hypothesis, revision: "3" };
-    const invalidEventGenerations = () =>
-      errors
-        .filter(({ code }) => code === "invalid_server_event")
-        .map(({ generation }) => generation);
-
-    for (const index of [0, 1]) {
-      const socket = sockets[index];
-      const generation = index + 1;
-      socket.open();
-      events.length = 0;
-      socket.message(server.session_created);
-      assert.deepEqual(
-        socket.sent.map(({ session }) => session.include),
-        [client.session_update.session.include],
-        `generation ${generation} requests hypotheses`,
-      );
-      socket.message(unnegotiatedSessionUpdated);
-      assert.equal(service.state, "connecting", "a session with an unnegotiated include is rejected");
-      socket.message(server.session_updated);
-      assert.equal(service.state, "ready");
-      socket.message(server.transcription_delta);
-      socket.message(malformedHypothesis);
-      socket.message(server.transcription_hypothesis);
-      assert.deepEqual(
-        events.map(({ event }) => event),
-        [server.session_created, server.session_updated, server.transcription_hypothesis],
-        `generation ${generation} publishes the valid events and drops deltas`,
-      );
-      assert.deepEqual(
-        invalidEventGenerations(),
-        Array.from({ length: generation }, (_, earlier) => [earlier + 1, earlier + 1]).flat(),
-        `generation ${generation} reports the unnegotiated session and the malformed hypothesis as invalid`,
-      );
-      if (index === 0) {
-        socket.close();
-        mock.timers.tick(1_000);
-        assert.equal(sockets.length, 2, "the session reconnects");
-      }
-    }
-
-    service.dispose();
-  } finally {
-    mock.timers.reset();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  const sockets = [];
-  const service = new RealtimeTranscriptionService({
-    eventId: () => "client_decoder_update",
-    socket: (url) => {
-      const socket = new ScriptedSocket(url);
-      sockets.push(socket);
-      return socket;
-    },
-  });
-  const events = [];
-  const errors = [];
-  service.onEvent((value) => events.push(value));
-  service.onError((value) => errors.push(value));
-
-  sockets[0].open();
-  sockets[0].message(server.session_created);
-  sockets[0].message(server.session_updated);
-  events.length = 0;
-  sockets[0].message({
-    ...server.input_audio_buffer_committed,
-    unexpected: true,
-  });
-  sockets[0].message({
-    ...server.transcription_completed,
-    content_index: 1,
-  });
-  sockets[0].message({
-    event_id: "evt_future",
-    type: "response.created",
-  });
-
-  assert.deepEqual(events, []);
-  assert.deepEqual(
-    errors,
-    Array.from({ length: 3 }, () => ({
-      code: "invalid_server_event",
-      scope: "session",
-      eventId: null,
-      recoverable: true,
-      generation: 1,
-    })),
-  );
-  service.dispose();
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  mock.timers.enable({ apis: ["setTimeout"] });
-  try {
-    const sockets = [];
-    const service = new RealtimeTranscriptionService({
-      eventId: () => "client_fallback_update",
-      socket: (url) => {
-        const socket = new ScriptedSocket(url);
-        sockets.push(socket);
-        return socket;
-      },
-    });
-    const errors = [];
-    const events = [];
-    service.onEvent((value) => events.push(value));
-    service.onError((value) => errors.push(value));
-
-    const fallbackSessionUpdated = {
-      ...server.session_updated,
-      session: {
-        ...server.session_updated.session,
-        include: [],
-      },
-    };
-    sockets[0].open();
-    sockets[0].message(server.session_created);
-    sockets[0].message(fallbackSessionUpdated);
-    sockets[0].message({
-      ...server.transcription_delta,
-      event_id: "evt_stale_delta_1",
-      item_id: "item_shared",
-      delta: "stale",
-    });
-    sockets[0].message({
-      ...server.transcription_delta,
-      event_id: "evt_stale_delta_2",
-      item_id: "item_shared",
-      delta: " prefix",
-    });
-
-    sockets[0].close();
-    mock.timers.tick(1_000);
-    assert.equal(sockets.length, 2, "the fallback session reconnects deterministically");
-    sockets[1].open();
-    sockets[1].message(server.session_created);
-    sockets[1].message(fallbackSessionUpdated);
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_fresh_delta_1",
-      item_id: "item_shared",
-      delta: "fresh",
-    });
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_isolated_delta_1",
-      item_id: "item_isolated",
-      delta: "other",
-    });
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_fresh_delta_2",
-      item_id: "item_shared",
-      delta: " transcript",
-    });
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_isolated_delta_2",
-      item_id: "item_isolated",
-      delta: " item",
-    });
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_invalid_fallback_delta",
-      item_id: "item_invalid",
-      unexpected: true,
-    });
-    sockets[1].message({
-      ...server.transcription_completed,
-      event_id: "evt_fresh_completed",
-      item_id: "item_shared",
-      transcript: "fresh transcript",
-    });
-
-    sockets[1].message(server.session_updated);
-    sockets[1].message({
-      ...server.transcription_delta,
-      event_id: "evt_ignored_after_negotiation",
-      item_id: "item_isolated",
-      delta: " ignored",
-    });
-    sockets[1].message({
-      ...server.transcription_hypothesis,
-      event_id: "evt_later_hypothesis",
-      item_id: "item_isolated",
-      transcript: "hypothesis wins",
-      finalized: "",
-      agreed: "",
-      tentative: "hypothesis wins",
-    });
-    sockets[1].message({
-      ...server.transcription_completed,
-      event_id: "evt_isolated_completed",
-      item_id: "item_isolated",
-      transcript: "hypothesis wins",
-    });
-
-    assert.deepEqual(
-      events
-        .filter(
-          ({ event }) =>
-            event.type ===
-            "conversation.item.input_audio_transcription.delta",
-        )
-        .map(({ event }) => event.event_id),
-      [
-        "evt_stale_delta_1",
-        "evt_stale_delta_2",
-        "evt_fresh_delta_1",
-        "evt_isolated_delta_1",
-        "evt_fresh_delta_2",
-        "evt_isolated_delta_2",
-      ],
-      "fallback deltas reach the reducer seam until hypotheses are negotiated",
-    );
-    assert.deepEqual(
-      events
-        .filter(
-          ({ event }) =>
-            event.type ===
-              "conversation.item.input_audio_transcription.hypothesis" ||
-            event.type ===
-              "conversation.item.input_audio_transcription.completed",
-        )
-        .map(({ event }) => [event.type, event.item_id, event.transcript]),
-      [
-        [
-          "conversation.item.input_audio_transcription.completed",
-          "item_shared",
-          "fresh transcript",
-        ],
-        [
-          "conversation.item.input_audio_transcription.hypothesis",
-          "item_isolated",
-          "hypothesis wins",
-        ],
-        [
-          "conversation.item.input_audio_transcription.completed",
-          "item_isolated",
-          "hypothesis wins",
-        ],
-      ],
-      "strict decoded events report every take transition without service snapshots",
-    );
-    assert.deepEqual(errors.at(-1), {
-      code: "invalid_server_event",
-      scope: "session",
-      eventId: null,
-      recoverable: true,
-      generation: 2,
-    });
-
-    service.dispose();
-  } finally {
-    mock.timers.reset();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  mock.timers.enable({ apis: ["setTimeout"] });
-  try {
-    const sockets = [];
-    const service = new RealtimeTranscriptionService({
-      eventId: (() => {
-        let id = 0;
-        return () => `generation_event_${++id}`;
-      })(),
-      socket: (url) => {
-        const socket = new ScriptedSocket(url);
-        sockets.push(socket);
-        return socket;
-      },
-    });
-    const states = [];
-    const events = [];
-    const errors = [];
-    service.onState((value) => states.push(value));
-    service.onEvent((value) => events.push(value));
-    service.onError((value) => errors.push(value));
-
-    sockets[0].open();
-    sockets[0].message(server.session_created);
-    sockets[0].message(server.session_updated);
-    const firstAppend = service.append(new ArrayBuffer(2));
-    sockets[0].close();
-    mock.timers.tick(1_000);
-    sockets[1].open();
-    sockets[1].message(server.session_created);
-    sockets[1].message(server.session_updated);
-    const secondAppend = service.append(new ArrayBuffer(2));
-    const secondCommit = service.commit();
-    const secondClear = service.clear();
-    sockets[1].message(server.transcription_hypothesis);
-
-    assert.deepEqual(firstAppend, {
-      generation: 1,
-      eventId: "generation_event_2",
-    });
-    assert.deepEqual(secondAppend, {
-      generation: 2,
-      eventId: "generation_event_4",
-    });
-    assert.deepEqual(secondCommit, {
-      generation: 2,
-      eventId: "generation_event_5",
-    });
-    assert.deepEqual(secondClear, {
-      generation: 2,
-      eventId: "generation_event_6",
-    });
-    assert.deepEqual(
-      states.map(({ state, generation }) => [state, generation]),
-      [
-        ["ready", 1],
-        ["unavailable", 1],
-        ["connecting", 2],
-        ["ready", 2],
-      ],
-      "connection state envelopes retain the socket generation",
-    );
-    assert.equal(events.at(-1).generation, 2);
-    assert.equal(events.at(-1).event.type, server.transcription_hypothesis.type);
-    assert.equal(errors.at(-1).generation, 1);
-    assert.equal(service.generation, 2);
-
-    service.dispose();
-  } finally {
-    mock.timers.reset();
-  }
-});
-
-// The service's reconnect backoff captures Math.random when it is built, so a
-// source pinned only during construction holds every jittered wait at exactly
-// half the computed delay.
-function withLowerBoundJitter(construct) {
-  const realRandom = Math.random;
-  Math.random = () => 0;
-  try {
-    return construct();
-  } finally {
-    Math.random = realRandom;
-  }
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  mock.timers.enable({ apis: ["setTimeout"] });
-  try {
-    let attempts = 0;
-    const service = withLowerBoundJitter(() => new RealtimeTranscriptionService({
-      socket: () => {
-        attempts += 1;
-        throw new Error("gateway is still starting");
-      },
-    }));
-
-    assert.equal(service.state, "unavailable");
-    assert.equal(attempts, 1);
-    const schedule = [1_000, 2_000, 4_000, 8_000, 16_000, 30_000, 30_000];
-    for (const [index, delay] of schedule.entries()) {
-      const wait = delay / 2;
-      mock.timers.tick(wait - 1);
-      assert.equal(
-        attempts,
-        index + 1,
-        `retry ${index + 1} does not run before half its ${delay} ms delay`,
-      );
-      mock.timers.tick(1);
-      assert.equal(
-        attempts,
-        index + 2,
-        `retry ${index + 1} runs at half its ${delay} ms delay`,
-      );
-    }
-
-    service.dispose();
-    mock.timers.tick(30_000);
-    assert.equal(attempts, 8, "disposal cancels the pending capped retry");
-  } finally {
-    mock.timers.reset();
-  }
-});
-
-await assertNoLeaks(lifecycle, async () => {
-  mock.timers.enable({ apis: ["setTimeout"] });
-  try {
-    const sockets = [];
-    let attempts = 0;
-    const service = withLowerBoundJitter(() => new RealtimeTranscriptionService({
-      socket: (url) => {
-        attempts += 1;
-        if (attempts === 1) {
-          throw new Error("gateway is still starting");
-        }
-        const socket = new ScriptedSocket(url);
-        sockets.push(socket);
-        return socket;
-      },
-    }));
-
-    mock.timers.tick(1000);
-    assert.equal(attempts, 2, "an initial failure reconnects without another mic click");
-    sockets[0].open();
-    sockets[0].message(server.session_created);
-    sockets[0].message(server.session_updated);
-    assert.equal(service.state, "ready");
-
-    sockets[0].close();
-    mock.timers.tick(499);
-    assert.equal(
-      attempts,
-      2,
-      "readiness resets the reconnect delay to one second, a 500 ms wait at the lower jitter bound",
-    );
-    mock.timers.tick(1);
-    assert.equal(attempts, 3, "an established connection reconnects on the reset delay");
-    const racing = sockets[1];
-    service.dispose();
-    racing.dispatch("close", {});
-    mock.timers.tick(30_000);
-    assert.equal(attempts, 3, "disposal cancels a reconnect even as its socket is created");
-  } finally {
-    mock.timers.reset();
-  }
-});
diff --git a/crates/workshop/ui/test/tab-menu.mjs b/crates/workshop/ui/test/tab-menu.mjs
deleted file mode 100644
index 547fa76ae..000000000
--- a/crates/workshop/ui/test/tab-menu.mjs
+++ /dev/null
@@ -1,657 +0,0 @@
-// Integration test for the generic tab and its registry-driven menu: the
-// tab renderer (src/parts/layout/panel-tab.ts, dispatched as "panel-tab"
-// through panel-types.ts), the menu widget's context overlay
-// (src/parts/menu/menu.ts), the EditorTitleContext rows the editor and
-// stub contributions register, and the confirm-then-close path the X and
-// the Close row share (src/parts/layout/panel-close.ts, registered by
-// layout.contribution.ts). Mounts a real
-// Dockview dock in jsdom with synthetic panel types - "doc" builds a real
-// EditorPanel over a stub surface and stub file I/O, "agent", "probe" and
-// "side" are bare WorkshopParts, and "pinned" registers closable: false -
-// and adds test-only rows whose when, toggled and keybinding rules read
-// activeEditor, while the global activeEditor key stays empty.
-// Covers: the menu opens at the pointer with the registry rows in order;
-// the Close row is enabled through the overlay and shows Ctrl+F4; the stub
-// rows render disabled under their final names and shortcuts, the Move row
-// under VS Code's tab-menu title while the menubar keeps its own; a row gated
-// on activeEditor == 'agent' shows only on agent tabs, and the overlay
-// also drives toggled rows, keybinding labels and a submenu's flyout;
-// Close acts on the clicked tab rather than the active one, and Close
-// Others on the clicked tab's group; a non-closable tab has no X and opens
-// no menu; the X on an unsaved editor prompts, and Cancel keeps the tab;
-// the X on another group's background tab closes it without activating
-// it or its group, and every X is out of the tab order;
-// Delete and Backspace on a focused tab leave a non-closable tab open,
-// prompt on an unsaved editor (Cancel keeps it), and close a clean tab,
-// moving focus to the tab now at its index so a second Delete closes that;
-// and a close the layout core rejects (a part whose confirmClose throws)
-// raises the "Command 'Close Editor' resulted in an error" toast from the X
-// and from Delete, leaving the tab open.
-// Run: node --test test/tab-menu.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      import "./src/parts/menu/stubs.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export { registerPanelFactory, registerPanelType, resolvePanelContent } from "@workshop/platform/panel-registry";
-      export { WorkshopPart } from "@workshop/platform/workshop-part";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { MenuId, Menus } from "@workshop/platform/menu-registry";
-      export { KeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { detectPlatform, formatKeybinding, parseKeybinding } from "@workshop/platform/keybinding-parser";
-      export { getService, registerService } from "@workshop/platform/service-registry";
-      export { createToastStack } from "@workshop/look/toast";
-      export { TOAST_STACK } from "./src/services/toast-service.ts";
-      export { initZones, openInZone, resetZones } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import colocated CSS; strip it - jsdom applies
-  // no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-globalThis.fetch = async (url) => {
-  throw new Error(`unexpected fetch in the tab-menu test: ${url}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "Window",
-  "HTMLElement",
-  "HTMLInputElement",
-  "HTMLTextAreaElement",
-  "HTMLButtonElement",
-  "Node",
-  "Element",
-  "KeyboardEvent",
-  "MouseEvent",
-  "MutationObserver",
-  "ResizeObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-tab-menu-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  registerPanelFactory,
-  registerPanelType,
-  resolvePanelContent,
-  WorkshopPart,
-  Commands,
-  MenuId,
-  Menus,
-  KeybindingsRegistry,
-  CONTEXT_KEY_SERVICE,
-  detectPlatform,
-  formatKeybinding,
-  parseKeybinding,
-  getService,
-  registerService,
-  createToastStack,
-  TOAST_STACK,
-  initZones,
-  openInZone,
-  resetZones,
-  createPanelComponent,
-  createPanelTabComponent,
-  PANEL_TAB,
-  EditorPanel,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// The EditorSurface contract over plain fields. Each surface registers
-// under its document's path when the panel opens it, so a test can type
-// into a panel it only knows by name.
-const surfaces = new Map();
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      surfaces.set(document.path, this);
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    setReadOnly() {},
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    editorView() {
-      return null;
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-const readDoc = async (filePath) => ({ path: filePath, size: 0, token: "t1", text: "" });
-const writeDoc = async (filePath, text) => ({ path: filePath, size: text.length, token: "t2", text });
-
-class ProbePart extends WorkshopPart {
-  create() {}
-}
-
-// A part whose close confirmation throws, so the layout core's close
-// rejects for its tab.
-class FaultyPart extends WorkshopPart {
-  create() {}
-  confirmClose() {
-    return Promise.reject(new Error("confirm exploded"));
-  }
-}
-
-// One lazy "feature directory" serving every synthetic type. Everything
-// but "side" shares the main zone's group.
-const feature = {
-  register() {
-    registerPanelFactory(
-      "doc",
-      () => new EditorPanel({ createSurface: createStubSurface, readFile: readDoc, writeFile: writeDoc }),
-    );
-    for (const type of ["agent", "probe", "side", "pinned"]) {
-      registerPanelFactory(type, () => new ProbePart());
-    }
-    registerPanelFactory("faulty", () => new FaultyPart());
-  },
-};
-const load = () => Promise.resolve(feature);
-registerPanelType({
-  type: "doc",
-  title: (params) => String(params.path),
-  defaultZone: "main",
-  panelId: (params) => `doc:${params.path}`,
-  load,
-});
-registerPanelType({ type: "agent", title: "Agent", defaultZone: "main", load });
-registerPanelType({ type: "probe", title: "Probe", defaultZone: "main", load });
-registerPanelType({ type: "side", title: "Side", defaultZone: "right", load });
-registerPanelType({ type: "pinned", title: "Pinned", defaultZone: "main", closable: false, load });
-registerPanelType({ type: "faulty", title: "Faulty", defaultZone: "main", load });
-
-// Test-only rows in the tab menu's own group, sorted after every shipped
-// row: one gated on the clicked type, one checked by it, one labelled by
-// the rule its when selects, and a flyout whose only row is gated on it.
-const AGENT_ONLY = "test.tabMenu.agentOnly";
-const CHECKED = "test.tabMenu.checked";
-const LABELLED = "test.tabMenu.labelled";
-const FLYOUT = "test/tabMenu/flyout";
-const FLYOUT_ROW = "test.tabMenu.flyoutRow";
-Commands.register(AGENT_ONLY, { title: "Agent Only", run() {} });
-Commands.register(CHECKED, { title: "Checked", toggled: "activeEditor == 'agent'", run() {} });
-Commands.register(LABELLED, { title: "Labelled", run() {} });
-Commands.register(FLYOUT_ROW, { title: "Flyout Row", run() {} });
-Menus.appendMenuItem(MenuId.EditorTitleContext, {
-  command: AGENT_ONLY,
-  when: "activeEditor == 'agent'",
-  group: "9_test",
-  order: 1,
-});
-Menus.appendMenuItem(MenuId.EditorTitleContext, { submenu: FLYOUT, title: "Flyout", group: "9_test", order: 2 });
-Menus.appendMenuItem(MenuId.EditorTitleContext, { command: CHECKED, group: "9_test", order: 3 });
-Menus.appendMenuItem(MenuId.EditorTitleContext, { command: LABELLED, group: "9_test", order: 4 });
-Menus.appendMenuItem(FLYOUT, { command: FLYOUT_ROW, when: "activeEditor == 'agent'" });
-KeybindingsRegistry.registerKeybindingRule({ id: LABELLED, keybinding: "alt+f7", when: "activeEditor == 'doc'" });
-KeybindingsRegistry.registerKeybindingRule({ id: LABELLED, keybinding: "alt+f8", when: "activeEditor == 'agent'" });
-
-// The global key names no panel type, so everything the menu reads from
-// activeEditor has to come from the overlay.
-getService(CONTEXT_KEY_SERVICE).createKey("activeEditor", "").set("");
-
-const platform = detectPlatform();
-/** The label the keybinding registry renders for `chord` on this platform. */
-function chordLabel(chord) {
-  const parsed = parseKeybinding(chord, platform);
-  return parsed.ok ? formatKeybinding(parsed.value, platform) : `malformed ${chord}`;
-}
-
-let dock = null;
-function freshDock() {
-  const element = window.document.createElement("div");
-  element.className = "ws-dock";
-  window.document.body.appendChild(element);
-  dock = createDockview(element, {
-    createComponent: createPanelComponent,
-    createTabComponent: createPanelTabComponent,
-    defaultTabComponent: PANEL_TAB,
-    theme: themeDark,
-    disableFloatingGroups: true,
-    hideBorders: true,
-    locked: false,
-    noPanelsOverlay: "emptyGroup",
-  });
-  initZones(dock);
-  resetZones();
-}
-
-async function open(type, params = {}) {
-  const panel = openInZone(type, params);
-  await flush();
-  return panel;
-}
-
-const isOpen = (panel) => dock.getPanel(panel.id) === panel;
-const partOf = (panel) => resolvePanelContent(panel.view.content);
-const tabOf = (panel) => panel.view.tab.element;
-const closeButton = (panel) => tabOf(panel).querySelector(".dv-default-tab-action");
-
-function rightClick(panel, x = 40, y = 30) {
-  tabOf(panel).dispatchEvent(
-    new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: x, clientY: y }),
-  );
-}
-const shownPopovers = () =>
-  [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter((popover) => !popover.hidden);
-const rootPopover = () =>
-  shownPopovers().find((popover) => !popover.classList.contains("ws-window-titlebar__popover--flyout"));
-const flyoutPopover = () =>
-  shownPopovers().find((popover) => popover.classList.contains("ws-window-titlebar__popover--flyout"));
-const rowsOf = (popover) => [...(popover?.querySelectorAll(".ws-window-titlebar__item") ?? [])];
-const keysOf = (popover) => rowsOf(popover).map((row) => row.dataset.menuRowKey);
-const rowFor = (popover, key) => rowsOf(popover).find((row) => row.dataset.menuRowKey === key);
-const labelOf = (row) => row?.querySelector(".ws-window-titlebar__item-label")?.textContent;
-const shortcutOf = (row) => row?.querySelector(".ws-window-titlebar__shortcut")?.textContent;
-function dismiss() {
-  window.document.body.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true }));
-}
-
-const CLOSE = "workbench.action.closeActiveEditor";
-const CLOSE_OTHERS = "workbench.action.closeOtherEditors";
-const SHIPPED_ROWS = [
-  CLOSE,
-  CLOSE_OTHERS,
-  "workbench.action.closeEditorsToTheRight",
-  "workbench.action.closeUnmodifiedEditors",
-  "workbench.action.closeAllEditors",
-  "workbench.action.reopenWithEditor",
-  "workbench.action.keepEditor",
-  "workbench.action.pinEditor",
-  "workbench.action.moveEditorToNewWindow",
-];
-// [id, final name, chord or undefined]
-const STUBS = [
-  ["workbench.action.closeEditorsToTheRight", "Close to the Right", undefined],
-  ["workbench.action.closeUnmodifiedEditors", "Close Saved", "ctrlcmd+m u"],
-  ["workbench.action.closeAllEditors", "Close All", "ctrlcmd+m w"],
-  ["workbench.action.reopenWithEditor", "Reopen Editor With...", undefined],
-  ["workbench.action.keepEditor", "Keep Open", "ctrlcmd+m enter"],
-  ["workbench.action.pinEditor", "Pin", "ctrlcmd+m shift+enter"],
-  ["workbench.action.moveEditorToNewWindow", "Move into New Window", undefined],
-];
-
-// --- The menu opens at the pointer with the registry rows ----------------------
-
-freshDock();
-const doc = await open("doc", { path: "a.txt" });
-const agent = await open("agent");
-const probeA = await open("probe", { instance: "a" });
-const probeB = await open("probe", { instance: "b" });
-const pinned = await open("pinned");
-const side = await open("side");
-check(
-  "the main-zone panels share one group apart from side",
-  [agent, probeA, probeB, pinned].every((panel) => panel.group === doc.group) && side.group !== doc.group,
-);
-
-rightClick(doc, 40, 30);
-const docMenu = rootPopover();
-check("right-clicking a closable tab opens one menu", docMenu !== undefined && shownPopovers().length === 1);
-check("the menu opens at the pointer", docMenu?.style.left === "40px" && docMenu?.style.top === "30px");
-check(
-  `the doc tab's menu lists the registry rows in order (got: ${keysOf(docMenu).join(", ")})`,
-  keysOf(docMenu).join("|") === [...SHIPPED_ROWS, CHECKED, LABELLED].join("|"),
-);
-const closeRow = rowFor(docMenu, CLOSE);
-check("the Close row reads Close", labelOf(closeRow) === "Close");
-check(
-  `the Close row shows ${chordLabel("ctrlcmd+f4")} (got: ${shortcutOf(closeRow)})`,
-  shortcutOf(closeRow) === chordLabel("ctrlcmd+f4"),
-);
-check(
-  "the Close row is enabled through the overlay while the global activeEditor is empty",
-  closeRow?.getAttribute("aria-disabled") === "false",
-);
-check("the Close Others row reads Close Others", labelOf(rowFor(docMenu, CLOSE_OTHERS)) === "Close Others");
-for (const [id, title, chord] of STUBS) {
-  const row = rowFor(docMenu, id);
-  check(`the ${title} stub renders disabled`, row?.getAttribute("aria-disabled") === "true");
-  check(`the ${id} stub reads '${title}' (got: '${labelOf(row)}')`, labelOf(row) === title);
-  check(
-    `the ${title} stub shows ${chord === undefined ? "no shortcut" : chordLabel(chord)} (got: ${shortcutOf(row)})`,
-    shortcutOf(row) === (chord === undefined ? undefined : chordLabel(chord)),
-  );
-}
-const menubarMove = Menus.getMenuItems("menubar/view/editorLayout").find(
-  (row) => row.command === "workbench.action.moveEditorToNewWindow",
-);
-check(
-  "the menubar's Move row keeps the command title",
-  (menubarMove?.title ?? Commands.lookup(menubarMove?.command ?? "")?.title) === "Move Editor into New Window",
-);
-
-// --- The overlay: when, toggled, keybinding labels, and submenus ---------------
-
-check("a row gated on an agent tab stays hidden on a doc tab", rowFor(docMenu, AGENT_ONLY) === undefined);
-check("a flyout with no visible rows is dropped on a doc tab", rowFor(docMenu, FLYOUT) === undefined);
-check("the toggled row is unchecked on a doc tab", rowFor(docMenu, CHECKED)?.getAttribute("aria-checked") === "false");
-check(
-  `the doc tab labels the row with its doc rule (got: ${shortcutOf(rowFor(docMenu, LABELLED))})`,
-  shortcutOf(rowFor(docMenu, LABELLED)) === chordLabel("alt+f7"),
-);
-dismiss();
-check("an outside pointer closes the tab menu", shownPopovers().length === 0);
-
-rightClick(agent);
-const agentMenu = rootPopover();
-check("a row gated on activeEditor == 'agent' shows on an agent tab", rowFor(agentMenu, AGENT_ONLY) !== undefined);
-check("the toggled row is checked on an agent tab", rowFor(agentMenu, CHECKED)?.getAttribute("aria-checked") === "true");
-check(
-  `the agent tab labels the row with its agent rule (got: ${shortcutOf(rowFor(agentMenu, LABELLED))})`,
-  shortcutOf(rowFor(agentMenu, LABELLED)) === chordLabel("alt+f8"),
-);
-const flyoutRow = rowFor(agentMenu, FLYOUT);
-check("the flyout row shows on an agent tab", flyoutRow !== undefined);
-flyoutRow?.click();
-check(
-  "the overlay reaches the flyout's rows",
-  keysOf(flyoutPopover()).join("|") === FLYOUT_ROW,
-);
-dismiss();
-check("an outside pointer closes the menu and its flyout", shownPopovers().length === 0);
-
-// --- Close acts on the clicked tab; Close Others on the clicked tab's group ----
-
-probeB.api.setActive();
-rightClick(probeA);
-rowFor(rootPopover(), CLOSE)?.click();
-await flush();
-check("Close closes the clicked tab", !isOpen(probeA));
-check("Close leaves the active panel open", isOpen(probeB));
-check("running a row closes the menu", shownPopovers().length === 0);
-
-side.api.setActive();
-rightClick(probeB);
-rowFor(rootPopover(), CLOSE_OTHERS)?.click();
-await flush();
-check("Close Others keeps the clicked tab", isOpen(probeB));
-check("Close Others closes the clicked tab's closable siblings", !isOpen(doc) && !isOpen(agent));
-check("Close Others spares the non-closable sibling", isOpen(pinned));
-check("Close Others leaves the active panel's other group alone", isOpen(side));
-
-// --- A non-closable tab: no X and no menu ---------------------------------------
-
-check("a non-closable tab has no close button", closeButton(pinned) === null);
-rightClick(pinned);
-check("right-clicking a non-closable tab opens no menu", shownPopovers().length === 0);
-
-// --- The X: the confirm-then-close path -----------------------------------------
-
-const button = closeButton(probeB);
-check(
-  "a closable tab's X is the default chip's labelled close action",
-  button?.classList.contains("dv-default-tab-action") === true && button?.getAttribute("aria-label") === "Close",
-);
-const unsaved = await open("doc", { path: "unsaved.txt" });
-surfaces.get("unsaved.txt").type("draft\n");
-probeB.api.setActive();
-closeButton(unsaved)?.click();
-await flush();
-const prompts = () => partOf(unsaved).element.querySelectorAll(".ws-editor-close-overlay").length;
-check("the X on an unsaved editor prompts instead of closing", isOpen(unsaved) && prompts() === 1);
-const cancel = [...partOf(unsaved).element.querySelectorAll(".ws-editor-close__button")].find(
-  (candidate) => candidate.textContent === "Cancel",
-);
-check("the prompt offers Cancel", cancel !== undefined);
-cancel?.click();
-await flush();
-check("Cancel keeps the unsaved editor's tab", isOpen(unsaved) && partOf(unsaved).isDirty() === true);
-
-// --- The dirty dot and the close slot (setTabDirty, src/parts/layout/panel-tab.ts) ------
-
-check("an unsaved editor's tab carries the dirty mark", tabOf(unsaved).classList.contains("ws-tab--dirty"));
-check(
-  "the dirty tab keeps its close button, which the stylesheet swaps for the dot until the tab is hovered",
-  closeButton(unsaved) !== null,
-);
-check("a clean closable tab has no dirty mark", !tabOf(probeB).classList.contains("ws-tab--dirty"));
-check("a closable tab is not marked as having no close", !tabOf(probeB).classList.contains("ws-tab--no-close"));
-check(
-  "a tab with no close button is marked, which gives it 10px of right padding",
-  tabOf(pinned).classList.contains("ws-tab--no-close"),
-);
-check("no tab titles carry a bullet", [...window.document.querySelectorAll(".dv-default-tab-content")].every((content) => !content.textContent.includes("●")));
-surfaces.get("unsaved.txt").markSaved("draft\n");
-check("saving clears the tab's dirty mark", !tabOf(unsaved).classList.contains("ws-tab--dirty"));
-surfaces.get("unsaved.txt").type("draft\n");
-check("typing again marks the tab dirty again", tabOf(unsaved).classList.contains("ws-tab--dirty"));
-
-closeButton(probeB)?.click();
-await flush();
-check("the X closes a clean panel", !isOpen(probeB));
-
-// --- The X never activates its tab ----------------------------------------------
-
-const sideFront = await open("side", { instance: "front" });
-check(
-  "the side zone holds a background tab behind its active one",
-  side.group === sideFront.group && side.group.activePanel === sideFront,
-);
-unsaved.api.setActive();
-await flush();
-const closeX = closeButton(side);
-closeX?.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true, cancelable: true, button: 0 }));
-closeX?.dispatchEvent(new window.MouseEvent("click", { bubbles: true, cancelable: true, button: 0 }));
-await flush();
-check("the X on another group's background tab closes it", !isOpen(side));
-check("the X on another group's tab leaves the active group active", dock.activeGroup === unsaved.group);
-check("the X on another group's tab leaves the active panel active", dock.activePanel === unsaved);
-const dockButtons = [...window.document.querySelectorAll(".ws-dock .dv-default-tab-action")];
-check(
-  "every close button in the dock is out of the tab order",
-  dockButtons.length > 0 && dockButtons.every((candidate) => candidate.tabIndex === -1),
-);
-
-// --- Delete and Backspace on a focused tab: the X's path ------------------------
-
-/** Presses `key` on the panel's focused tab: the Dockview wrapper its tab strip's own key handler matches. */
-function pressOnTab(panel, key) {
-  const wrapper = tabOf(panel).parentElement;
-  wrapper?.focus();
-  wrapper?.dispatchEvent(new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }));
-}
-function cancelPrompt() {
-  [...partOf(unsaved).element.querySelectorAll(".ws-editor-close__button")]
-    .find((candidate) => candidate.textContent === "Cancel")
-    ?.click();
-}
-
-for (const key of ["Delete", "Backspace"]) {
-  pressOnTab(pinned, key);
-  await flush();
-  check(`${key} on a focused non-closable tab leaves it open`, isOpen(pinned));
-
-  pressOnTab(unsaved, key);
-  await flush();
-  check(`${key} on a focused unsaved editor tab prompts instead of closing`, isOpen(unsaved) && prompts() === 1);
-  cancelPrompt();
-  await flush();
-  check(
-    `Cancel after ${key} keeps the unsaved editor's tab`,
-    isOpen(unsaved) && prompts() === 0 && partOf(unsaved).isDirty() === true,
-  );
-
-  const clean = await open("probe", { instance: key });
-  pressOnTab(clean, key);
-  await flush();
-  check(`${key} on a focused clean closable tab closes it`, !isOpen(clean));
-}
-
-const left = await open("probe", { instance: "left" });
-const middle = await open("probe", { instance: "middle" });
-const right = await open("probe", { instance: "right" });
-const middleIndex = middle.group.panels.indexOf(middle);
-check(
-  "three clean tabs sit side by side in one group",
-  [left, right].every((panel) => panel.group === middle.group) &&
-    left.group.panels.indexOf(left) === middleIndex - 1 &&
-    right.group.panels.indexOf(right) === middleIndex + 1,
-);
-pressOnTab(middle, "Delete");
-await flush();
-check("Delete on the middle tab closes it", !isOpen(middle));
-check(
-  "Delete moves focus to the wrapper of the tab now at the closed tab's index",
-  right.group.panels[middleIndex] === right && window.document.activeElement === tabOf(right).parentElement,
-);
-window.document.activeElement?.dispatchEvent(
-  new window.KeyboardEvent("keydown", { key: "Delete", bubbles: true, cancelable: true }),
-);
-await flush();
-check("a second Delete closes the tab focus moved to", !isOpen(right) && isOpen(left));
-check(
-  "Delete on the last tab moves focus to the wrapper of the tab before it",
-  window.document.activeElement === tabOf(left).parentElement,
-);
-
-// --- A close the layout core rejects raises the command-failure toast ------------
-
-const toastStack = createToastStack();
-window.document.body.append(toastStack.element);
-registerService(TOAST_STACK, () => toastStack);
-const toastTexts = () =>
-  [...toastStack.element.querySelectorAll(".toast")].map((toast) => ({
-    text: toast.querySelector(".toast__message")?.textContent,
-    error: toast.classList.contains("toast-error"),
-  }));
-const failedClose = `Command '${Commands.labelOf(CLOSE)}' resulted in an error`;
-check(`the close command's label is its Close Editor title (got: ${Commands.labelOf(CLOSE)})`, Commands.labelOf(CLOSE) === "Close Editor");
-
-const faulty = await open("faulty");
-const loggedFailures = [];
-const realConsoleError = console.error;
-console.error = (...args) => loggedFailures.push(args);
-closeButton(faulty)?.click();
-await flush();
-check("a rejected close from the X raises one error toast", toastTexts().length === 1 && toastTexts()[0].error === true);
-check(
-  `the toast names the close command, as Cursor words it (got: ${toastTexts()[0]?.text})`,
-  toastTexts()[0]?.text === failedClose,
-);
-check("a rejected close from the X leaves the tab open", isOpen(faulty));
-
-pressOnTab(faulty, "Delete");
-await flush();
-check(
-  "a rejected close from Delete raises a second error toast with the same text",
-  toastTexts().length === 2 && toastTexts().every((toast) => toast.error && toast.text === failedClose),
-);
-check("a rejected close from Delete leaves the tab open", isOpen(faulty));
-
-tabOf(faulty).dispatchEvent(new window.MouseEvent("auxclick", { bubbles: true, cancelable: true, button: 1 }));
-await flush();
-check("a rejected close from a middle click raises a third error toast", toastTexts().length === 3);
-console.error = realConsoleError;
-check(
-  "each failed close keeps its detail on the console",
-  loggedFailures.length === 3 &&
-    loggedFailures.every((args) => String(args[0]).includes(CLOSE) && args[1]?.message === "confirm exploded"),
-);
-
-if (failures.length > 0) {
-  console.error(`tab-menu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("tab-menu: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/tab-shimmer.mjs b/crates/workshop/ui/test/tab-shimmer.mjs
deleted file mode 100644
index 55ca86636..000000000
--- a/crates/workshop/ui/test/tab-shimmer.mjs
+++ /dev/null
@@ -1,131 +0,0 @@
-// The tab renderer's loading shimmer (src/parts/layout/panel-tab.ts) goes
-// through @workshop/look's setShimmer, so a loading tab title shares the
-// one sweep phase with every other shimmering element: the tab keeps no
-// private epoch, class toggle, or animation delay of its own. The test
-// bundles panel-tab.ts with `@workshop/look/shimmer` swapped for a recorder,
-// so every call the tab makes is visible and the tab's own effect on the
-// title is exactly what it does without the helper: nothing.
-// Run: node test/tab-shimmer.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const recorder = {
-  name: "shimmer-recorder",
-  setup(build) {
-    build.onResolve({ filter: /^@workshop\/look\/shimmer$/ }, () => ({
-      path: "shimmer-recorder",
-      namespace: "shimmer-recorder",
-    }));
-    build.onLoad({ filter: /.*/, namespace: "shimmer-recorder" }, () => ({
-      contents: `
-        export const calls = [];
-        export function setShimmer(element, on) { calls.push({ element, on }); }
-      `,
-      loader: "js",
-    }));
-  },
-};
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { PanelTab, setTabLoading } from "./src/parts/layout/panel-tab.ts";
-      export { calls } from "@workshop/look/shimmer";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  plugins: [recorder],
-  // The modules under test import their colocated CSS; the test drives only the JS.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://127.0.0.1:7910/" });
-for (const name of ["window", "document", "Element", "HTMLElement", "Node", "MouseEvent", "KeyboardEvent", "Event"]) {
-  globalThis[name] = dom.window[name];
-}
-
-const bundlePath = path.join(os.tmpdir(), "runvil-tab-shimmer-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { PanelTab, setTabLoading, calls } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** A dockview tab-part init payload for one panel. */
-function initParameters(id, tabLocation = "header") {
-  return {
-    api: {
-      id,
-      component: "test-panel",
-      onDidTitleChange: () => ({ dispose() {} }),
-    },
-    title: "Run",
-    tabLocation,
-    params: {},
-    containerApi: {},
-    group: {},
-  };
-}
-
-const contentOf = (tab) => tab.element.querySelector(".dv-default-tab-content");
-const lastCall = () => calls[calls.length - 1];
-
-// --- A header tab drives its title through setShimmer ---------------------------------
-
-const tab = new PanelTab();
-tab.init(initParameters("p1"));
-const content = contentOf(tab);
-check("mounting an idle tab asks setShimmer to keep the title still", lastCall()?.element === content && lastCall()?.on === false);
-
-setTabLoading("p1", true);
-check("loading turns the title shimmer on through setShimmer", lastCall()?.element === content && lastCall()?.on === true);
-check("the tab adds no shimmer class of its own", !content.classList.contains("ws-shimmer-text"));
-check("the tab sets no animation delay of its own", content.style.animationDelay === "" || content.style.animationDelay === undefined);
-
-setTabLoading("p1", false);
-check("ready turns the title shimmer off through setShimmer", lastCall()?.element === content && lastCall()?.on === false);
-
-// --- A tab that mounts after loading started picks the state up ----------------------
-
-setTabLoading("p2", true);
-const late = new PanelTab();
-late.init(initParameters("p2"));
-check(
-  "a tab mounted mid-load shimmers through setShimmer",
-  lastCall()?.element === contentOf(late) && lastCall()?.on === true,
-);
-
-// --- An overflow copy under the same id shimmers too ----------------------------------
-
-const overflow = new PanelTab();
-overflow.init(initParameters("p2", "headerOverflow"));
-check(
-  "an overflow copy picks up the loading state through setShimmer",
-  lastCall()?.element === contentOf(overflow) && lastCall()?.on === true,
-);
-
-tab.dispose();
-late.dispose();
-overflow.dispose();
-
-if (failures.length > 0) {
-  console.error(`tab-shimmer: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("tab-shimmer: all assertions passed");
diff --git a/crates/workshop/ui/test/take-reducer-loader.mjs b/crates/workshop/ui/test/take-reducer-loader.mjs
deleted file mode 100644
index a88bb4997..000000000
--- a/crates/workshop/ui/test/take-reducer-loader.mjs
+++ /dev/null
@@ -1,47 +0,0 @@
-// The take reducer bundled from its TypeScript sources, and the editor edit
-// applier, shared by the tests that render server events into editor text.
-
-import assert from "node:assert/strict";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export {
-        createTakeRegistry,
-        reduceTakeRegistry,
-      } from "./src/parts/take/take-registry.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-export const { createTakeRegistry, reduceTakeRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-export function applyEdits(text, effects) {
-  let next = text;
-  for (const effect of effects) {
-    if (effect.domain !== "editor" || effect.command !== "replace") {
-      continue;
-    }
-    assert.ok(
-      effect.from >= 0 && effect.from <= effect.to && effect.to <= next.length,
-      `replace [${effect.from}, ${effect.to}] lies inside ${JSON.stringify(next)}`,
-    );
-    next = next.slice(0, effect.from) + effect.text + next.slice(effect.to);
-  }
-  return next;
-}
diff --git a/crates/workshop/ui/test/take-registry-regressions.mjs b/crates/workshop/ui/test/take-registry-regressions.mjs
deleted file mode 100644
index 939e79dd7..000000000
--- a/crates/workshop/ui/test/take-registry-regressions.mjs
+++ /dev/null
@@ -1,525 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export {
-        createTakeRegistry,
-        reduceTakeRegistry,
-      } from "./src/parts/take/take-registry.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const { createTakeRegistry, reduceTakeRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-function context(start, end = start, original = "", compositionPrefix = "") {
-  return {
-    range: { start, end },
-    original,
-    compositionPrefix,
-  };
-}
-
-function reduce(state, input) {
-  return reduceTakeRegistry(state, input);
-}
-
-function start(state, insertion) {
-  return reduce(state, { type: "user.start", context: insertion });
-}
-
-function stop(state) {
-  return reduce(state, { type: "user.stop" });
-}
-
-function finishCapture(state, takeId, ok = true) {
-  return reduce(state, { type: "capture.stopped", takeId, ok });
-}
-
-function stopAndCommit(state, eventId) {
-  const stopping = stop(state);
-  const stopEffect = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(stopEffect);
-  const stopped = finishCapture(stopping.state, stopEffect.takeId);
-  const commit = stopped.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "commit",
-  );
-  assert.ok(commit);
-  return reduce(stopped.state, {
-    type: "wire.result",
-    requestId: commit.requestId,
-    eventId,
-  });
-}
-
-function server(state, event) {
-  return reduce(state, { type: "server.event", event });
-}
-
-function committed(itemId) {
-  return {
-    type: "input_audio_buffer.committed",
-    event_id: `commit_${itemId}`,
-    item_id: itemId,
-    previous_item_id: null,
-  };
-}
-
-function parts(itemId, revision, { finalized = "", agreed = "", tentative = "" }) {
-  return {
-    type: "conversation.item.input_audio_transcription.hypothesis",
-    event_id: `hypothesis_${itemId}_${revision}`,
-    item_id: itemId,
-    content_index: 0,
-    revision,
-    transcript: `${finalized}${agreed}${tentative}`,
-    finalized,
-    agreed,
-    tentative,
-    audio_start_ms: 0,
-    audio_end_ms: 100,
-  };
-}
-
-// Agreed text renders whole, so no word is held back as tentative.
-function hypothesis(itemId, transcript, revision = 1) {
-  return parts(itemId, revision, { agreed: transcript });
-}
-
-function completion(itemId, transcript) {
-  return {
-    type: "conversation.item.input_audio_transcription.completed",
-    event_id: `completion_${itemId}`,
-    item_id: itemId,
-    content_index: 0,
-    transcript,
-    usage: { type: "duration", seconds: 0.1 },
-  };
-}
-
-function replacements(effects) {
-  return effects.filter(
-    (effect) => effect.domain === "editor" && effect.command === "replace",
-  );
-}
-
-function announcements(effects) {
-  return effects
-    .filter((effect) => effect.domain === "status" && effect.command === "announce")
-    .map(({ text }) => text);
-}
-
-// A target's undo history: a transient replace stays out of it, and any
-// other replace is one undo step back to the text before it.
-function applyWithHistory(target, effects) {
-  let { text } = target;
-  const undo = [...target.undo];
-  for (const effect of replacements(effects)) {
-    assert.ok(effect.from >= 0 && effect.from <= effect.to && effect.to <= text.length);
-    if (!effect.transient) {
-      undo.push(text);
-    }
-    text = text.slice(0, effect.from) + effect.text + text.slice(effect.to);
-  }
-  return { text, undo };
-}
-
-test("captured coordinate width owns replacement and rollback independently of text length", () => {
-  let state = start(createTakeRegistry(), context(4, 9, "xy")).state;
-
-  let result = server(state, hypothesis("selection", "spoken"));
-  assert.deepEqual(replacements(result.effects), [
-    {
-      domain: "editor",
-      command: "replace",
-      from: 4,
-      to: 9,
-      text: "spoken",
-      transient: true,
-    },
-  ]);
-  state = result.state;
-
-  result = reduce(state, { type: "user.discard" });
-  assert.deepEqual(replacements(result.effects), [
-    {
-      domain: "editor",
-      command: "replace",
-      from: 4,
-      to: 10,
-      text: "xy",
-      transient: true,
-    },
-  ]);
-});
-
-test("interim writes stay out of undo history and a completion lands as one undo step", () => {
-  let target = { text: "Note: xy!", undo: [] };
-  let state = start(createTakeRegistry(), context(6, 8, "xy")).state;
-  const step = (result) => {
-    state = result.state;
-    target = applyWithHistory(target, result.effects);
-    return replacements(result.effects);
-  };
-
-  const interim = step(server(state, hypothesis("item", "ask", 1)));
-  interim.push(...step(server(state, hypothesis("item", "ask not", 2))));
-  assert.ok(interim.length > 0);
-  assert.ok(interim.every((effect) => effect.transient), "every interim write is transient");
-  assert.deepEqual(target, { text: "Note: ask not!", undo: [] });
-
-  state = stopAndCommit(state, "client_item").state;
-  state = server(state, committed("item")).state;
-  assert.deepEqual(step(server(state, completion("item", "ask not what"))), [
-    { domain: "editor", command: "replace", from: 6, to: 13, text: "xy", transient: true },
-    { domain: "editor", command: "replace", from: 6, to: 8, text: "ask not what", transient: false },
-  ]);
-  assert.deepEqual(
-    target,
-    { text: "Note: ask not what!", undo: ["Note: xy!"] },
-    "the one undo step restores the text from before the dictation",
-  );
-});
-
-test("a take hands the target's captured content back before its text lands, and spans the captured width after", () => {
-  const content = { captured: "selection" };
-  const captured = { ...context(4, 9, "xy"), content };
-  const edits = (effects) =>
-    effects.filter(
-      (effect) =>
-        effect.domain === "editor" && (effect.command === "replace" || effect.command === "restore"),
-    );
-
-  let state = start(createTakeRegistry(), captured).state;
-  state = server(state, hypothesis("item", "spoken")).state;
-  state = stopAndCommit(state, "client_item").state;
-  state = server(state, committed("item")).state;
-  assert.deepEqual(edits(server(state, completion("item", "final")).effects), [
-    { domain: "editor", command: "restore", from: 4, to: 10, content },
-    { domain: "editor", command: "replace", from: 4, to: 9, text: "final", transient: false },
-  ]);
-
-  let result = start(createTakeRegistry(), captured);
-  result = server(result.state, parts("item", 1, { agreed: "kept", tentative: " dropped words" }));
-  assert.deepEqual(edits(reduce(result.state, { type: "connection.lost" }).effects), [
-    { domain: "editor", command: "restore", from: 4, to: 16, content },
-    { domain: "editor", command: "replace", from: 4, to: 9, text: "kept", transient: false },
-  ]);
-
-  state = start(createTakeRegistry(), captured).state;
-  assert.deepEqual(
-    edits(reduce(state, { type: "user.discard" }).effects),
-    [],
-    "an unwritten take leaves its selection untouched",
-  );
-  state = server(state, hypothesis("item", "spoken")).state;
-  assert.deepEqual(edits(reduce(state, { type: "user.discard" }).effects), [
-    { domain: "editor", command: "restore", from: 4, to: 10, content },
-  ]);
-});
-
-test("a socket loss lands finalized and agreed text, drops the tentative tail, and releases the take", () => {
-  let target = { text: "Note", undo: [] };
-  let result = start(createTakeRegistry(), context(4, 4, "", " "));
-  result = server(
-    result.state,
-    parts("item", 1, { finalized: "Ask not ", agreed: "what your", tentative: " country can" }),
-  );
-  target = applyWithHistory(target, result.effects);
-  assert.equal(target.text, "Note Ask not what your country");
-
-  result = reduce(result.state, { type: "connection.lost" });
-  target = applyWithHistory(target, result.effects);
-  assert.deepEqual(
-    target,
-    { text: "Note Ask not what your", undo: ["Note"] },
-    "the kept text lands as one undo step",
-  );
-  assert.deepEqual(result.state.takes, []);
-  assert.equal(result.state.activeTakeId, null);
-  assert.ok(
-    result.effects.some(
-      (effect) => effect.domain === "editor" && effect.command === "read-only" && !effect.readOnly,
-    ),
-    "releasing the take unlocks the editor",
-  );
-  assert.ok(
-    result.effects.some((effect) => effect.domain === "capture" && effect.command === "stop"),
-  );
-});
-
-test("a socket loss with only tentative words restores the take's original text", () => {
-  let target = { text: "Hey xy!", undo: [] };
-  let result = start(createTakeRegistry(), context(4, 6, "xy"));
-  result = server(result.state, parts("item", 1, { tentative: "spoken words" }));
-  target = applyWithHistory(target, result.effects);
-  assert.equal(target.text, "Hey spoken!");
-
-  result = reduce(result.state, { type: "connection.lost" });
-  target = applyWithHistory(target, result.effects);
-  assert.deepEqual(target, { text: "Hey xy!", undo: [] });
-  assert.deepEqual(result.state.takes, []);
-});
-
-test("the live region hears each finished stable sentence once and a completed take's rest", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  const heard = (event) => {
-    const result = server(state, event);
-    state = result.state;
-    return announcements(result.effects);
-  };
-
-  assert.deepEqual(
-    heard(parts("item", 1, { agreed: "Ask not", tentative: " what." })),
-    [],
-    "a tentative sentence end is not announced",
-  );
-  assert.deepEqual(heard(parts("item", 2, { finalized: "Ask not what.", tentative: " Ask" })), [
-    "Ask not what.",
-  ]);
-  assert.deepEqual(
-    heard(parts("item", 3, { finalized: "Ask not what.", agreed: " Ask 3.5 times", tentative: " now" })),
-    [],
-    "an announced sentence is not repeated and a period inside a number ends nothing",
-  );
-  assert.deepEqual(
-    heard(parts("item", 4, { finalized: "Ask not what.", agreed: " Ask 3.5 times? Then go! And" })),
-    ["Ask 3.5 times? Then go!"],
-  );
-
-  state = stopAndCommit(state, "client_item").state;
-  state = server(state, committed("item")).state;
-  assert.deepEqual(
-    heard(completion("item", "Ask not what. Ask 3.5 times? Then go! And stay")),
-    ["And stay"],
-  );
-});
-
-test("a completion announces nothing once every sentence was heard", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  let result = server(state, hypothesis("item", "Hello there."));
-  assert.deepEqual(announcements(result.effects), ["Hello there."]);
-  state = stopAndCommit(result.state, "client_item").state;
-  state = server(state, committed("item")).state;
-  result = server(state, completion("item", "Hello there.  "));
-  assert.deepEqual(announcements(result.effects), []);
-
-  state = start(result.state, context(12, 12, "", " ")).state;
-  state = stopAndCommit(state, "client_unheard").state;
-  state = server(state, committed("unheard")).state;
-  result = server(state, completion("unheard", "Never heard. At all"));
-  assert.deepEqual(announcements(result.effects), ["Never heard. At all"]);
-});
-
-test("a hypothesis patches only its changed words and an unchanged one writes nothing", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-
-  let result = server(state, hypothesis("whole", "ask not", 1));
-  assert.deepEqual(replacements(result.effects), [
-    {
-      domain: "editor",
-      command: "replace",
-      from: 0,
-      to: 0,
-      text: "ask not",
-      transient: true,
-    },
-  ]);
-  state = result.state;
-
-  result = server(state, hypothesis("whole", "ask not what", 2));
-  assert.deepEqual(replacements(result.effects), [
-    {
-      domain: "editor",
-      command: "replace",
-      from: 7,
-      to: 7,
-      text: " what",
-      transient: true,
-    },
-  ]);
-  state = result.state;
-
-  result = server(state, hypothesis("whole", "ask not what", 3));
-  assert.deepEqual(replacements(result.effects), []);
-});
-
-test("a precommit tombstone consumes its matching acknowledgment before the next take", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = server(state, hypothesis("discarded", "temporary")).state;
-  state = stopAndCommit(state, "client_discarded").state;
-  state = reduce(state, { type: "user.discard" }).state;
-
-  state = start(state, context(0)).state;
-  let result = server(state, committed("discarded"));
-  assert.equal(result.state.awaitingCommit.length, 0);
-  assert.equal(result.state.takes[0].itemId, null);
-
-  state = stopAndCommit(result.state, "client_current").state;
-  state = server(state, committed("current")).state;
-  assert.equal(state.takes[0].itemId, "current");
-
-  result = server(state, hypothesis("current", "provisional"));
-  assert.equal(result.state.takes[0].text, "provisional");
-  result = server(result.state, completion("current", "complete"));
-  assert.deepEqual(replacements(result.effects), [
-    { domain: "editor", command: "replace", from: 0, to: 11, text: "", transient: true },
-    { domain: "editor", command: "replace", from: 0, to: 0, text: "complete", transient: false },
-  ]);
-  assert.equal(result.state.takes.length, 0);
-});
-
-test("a mismatched capture completion cannot release the stopping take", () => {
-  const recording = start(createTakeRegistry(), context(0)).state;
-  const stopping = stop(recording);
-  const owner = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(owner);
-
-  const before = structuredClone(stopping.state);
-  const stale = finishCapture(stopping.state, owner.takeId + 100);
-  assert.deepEqual(stale.state, before);
-  assert.deepEqual(stale.effects, []);
-
-  const owned = finishCapture(stale.state, owner.takeId);
-  assert.equal(owned.state.capture, "idle");
-  assert.ok(
-    owned.effects.some(
-      (effect) => effect.domain === "wire" && effect.command === "commit",
-    ),
-  );
-});
-
-test("a duplicate capture completion cannot recommit an older retained take", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  let stopping = stop(state);
-  const firstOwner = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(firstOwner);
-  state = finishCapture(stopping.state, firstOwner.takeId).state;
-
-  state = start(state, context(0)).state;
-  stopping = stop(state);
-  const secondOwner = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(secondOwner);
-
-  const before = structuredClone(stopping.state);
-  const duplicate = finishCapture(stopping.state, firstOwner.takeId);
-  assert.deepEqual(duplicate.state, before);
-  assert.deepEqual(duplicate.effects, []);
-
-  const owned = finishCapture(duplicate.state, secondOwner.takeId);
-  const commits = owned.effects.filter(
-    (effect) => effect.domain === "wire" && effect.command === "commit",
-  );
-  assert.equal(commits.length, 1);
-  assert.equal(commits[0].takeId, secondOwner.takeId);
-});
-
-test("audio flushed while capture stops remains owned by the stopping take", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  const stopping = stop(state);
-  const owner = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(owner);
-
-  const flushed = reduce(stopping.state, {
-    type: "capture.audio",
-    chunk: Uint8Array.from([1, 0, 2, 0]).buffer,
-  });
-  const append = flushed.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(append);
-  assert.equal(append.takeId, owner.takeId);
-
-  state = reduce(flushed.state, {
-    type: "wire.result",
-    requestId: append.requestId,
-    eventId: "flushed_append",
-  }).state;
-  const stopped = finishCapture(state, owner.takeId);
-  assert.ok(
-    stopped.effects.some(
-      (effect) => effect.domain === "wire" && effect.command === "commit",
-    ),
-    "the append is followed by commit after capture flushes",
-  );
-});
-
-test("readiness advances monotonically and stale asynchronous completions are inert", () => {
-  let state = reduce(createTakeRegistry(), {
-    type: "connection.ready",
-    generation: 7,
-  }).state;
-  const duplicate = reduce(state, {
-    type: "connection.ready",
-    generation: 7,
-  });
-  assert.deepEqual(duplicate.state, state);
-  assert.deepEqual(duplicate.effects, []);
-
-  state = reduce(state, {
-    type: "user.start",
-    generation: 7,
-    context: context(0),
-  }).state;
-  const stopping = reduce(state, { type: "user.stop", generation: 7 });
-  const owner = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(owner);
-  state = reduce(stopping.state, {
-    type: "connection.lost",
-    generation: 7,
-  }).state;
-  state = reduce(state, {
-    type: "connection.ready",
-    generation: 8,
-  }).state;
-  const before = structuredClone(state);
-
-  for (const input of [
-    { type: "connection.ready", generation: 7 },
-    {
-      type: "capture.stopped",
-      generation: 7,
-      takeId: owner.takeId,
-      ok: true,
-    },
-    {
-      type: "wire.result",
-      generation: 7,
-      requestId: 1,
-      eventId: "late_wire",
-    },
-  ]) {
-    const stale = reduce(state, input);
-    assert.deepEqual(stale.state, before);
-    assert.deepEqual(stale.effects, []);
-    state = stale.state;
-  }
-});
diff --git a/crates/workshop/ui/test/take-registry.mjs b/crates/workshop/ui/test/take-registry.mjs
deleted file mode 100644
index 043a6f8e3..000000000
--- a/crates/workshop/ui/test/take-registry.mjs
+++ /dev/null
@@ -1,1188 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export {
-        createTakeRegistry,
-        reduceTakeRegistry,
-      } from "./src/parts/take/take-registry.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const { createTakeRegistry, reduceTakeRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-function context(start, end = start, original = "", compositionPrefix = "") {
-  return {
-    range: { start, end },
-    original,
-    compositionPrefix,
-  };
-}
-
-function start(state, insertion) {
-  return reduceTakeRegistry(state, { type: "user.start", context: insertion });
-}
-
-function stopAndCommit(state, eventId) {
-  const stopping = reduceTakeRegistry(state, { type: "user.stop" });
-  const stopEffect = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(stopEffect, "stop emits a capture request");
-  const stopped = reduceTakeRegistry(stopping.state, {
-    type: "capture.stopped",
-    takeId: stopEffect.takeId,
-    ok: true,
-  });
-  const commit = stopped.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "commit",
-  );
-  assert.ok(commit, "successful capture stop emits a commit");
-  const sent = reduceTakeRegistry(stopped.state, {
-    type: "wire.result",
-    requestId: commit.requestId,
-    eventId,
-  });
-  return { state: sent.state, effects: [...stopping.effects, ...stopped.effects, ...sent.effects] };
-}
-
-function server(state, event) {
-  return reduceTakeRegistry(state, { type: "server.event", event });
-}
-
-function committed(itemId, eventId = `commit_${itemId}`) {
-  return {
-    type: "input_audio_buffer.committed",
-    event_id: eventId,
-    item_id: itemId,
-    previous_item_id: null,
-  };
-}
-
-function parts(itemId, revision, { finalized = "", agreed = "", tentative = "" }) {
-  return {
-    type: "conversation.item.input_audio_transcription.hypothesis",
-    event_id: `hypothesis_${itemId}_${revision}`,
-    item_id: itemId,
-    content_index: 0,
-    revision,
-    transcript: `${finalized}${agreed}${tentative}`,
-    finalized,
-    agreed,
-    tentative,
-    audio_start_ms: 0,
-    audio_end_ms: 100,
-  };
-}
-
-// Agreed text renders whole; the tentative hold-back has its own tests.
-function hypothesis(itemId, transcript, revision = 1) {
-  return parts(itemId, revision, { agreed: transcript });
-}
-
-function completion(itemId, transcript) {
-  return {
-    type: "conversation.item.input_audio_transcription.completed",
-    event_id: `completion_${itemId}`,
-    item_id: itemId,
-    content_index: 0,
-    transcript,
-    usage: { type: "duration", seconds: 0.1 },
-  };
-}
-
-function transcriptionFailure(itemId, eventId = `failure_${itemId}`) {
-  return {
-    type: "conversation.item.input_audio_transcription.failed",
-    event_id: eventId,
-    item_id: itemId,
-    content_index: 0,
-    error: {
-      type: "server_error",
-      code: "precommit_transcription_failed",
-      message: "must stay local",
-      param: null,
-    },
-  };
-}
-
-function editorReplacements(effects) {
-  return effects.filter(
-    (effect) => effect.domain === "editor" && effect.command === "replace",
-  );
-}
-
-function patches(effects) {
-  return editorReplacements(effects).map(({ from, to, text }) => ({ from, to, text }));
-}
-
-function tentativeMarks(effects) {
-  return effects
-    .filter((effect) => effect.domain === "editor" && effect.command === "tentative")
-    .map(({ takeId, range }) => ({ takeId, range }));
-}
-
-function applyEdits(text, effects) {
-  let next = text;
-  for (const { from, to, text: inserted } of editorReplacements(effects)) {
-    assert.ok(from >= 0 && from <= to && to <= next.length, `replace [${from}, ${to}] lies inside the text`);
-    next = next.slice(0, from) + inserted + next.slice(to);
-  }
-  return next;
-}
-
-// Every target leaves the caret after a replace's insert and moves it on a caret effect.
-function applyToTarget(target, effects) {
-  let caret = target.caret;
-  for (const effect of effects) {
-    if (effect.domain === "editor" && effect.command === "replace") {
-      caret = effect.from + effect.text.length;
-    } else if (effect.domain === "editor" && effect.command === "caret") {
-      caret = effect.at;
-    }
-  }
-  return { text: applyEdits(target.text, effects), caret };
-}
-
-test("transition table replaces selections and gives completion authority", () => {
-  let state = createTakeRegistry();
-  const transitions = [
-    {
-      input: { type: "user.start", context: context(6, 10, "test") },
-      replacements: [],
-      takeCount: 1,
-    },
-    {
-      input: { type: "server.event", event: hypothesis("selection", "spoken") },
-      replacements: [{ from: 6, to: 10, text: "spoken" }],
-      takeCount: 1,
-    },
-    {
-      input: { type: "server.event", event: hypothesis("selection", "provisional", 2) },
-      replacements: [{ from: 6, to: 12, text: "provisional" }],
-      takeCount: 1,
-    },
-    {
-      input: { type: "server.event", event: completion("selection", "final   ") },
-      replacements: [
-        { from: 6, to: 17, text: "test" },
-        { from: 6, to: 10, text: "final" },
-      ],
-      takeCount: 0,
-    },
-  ];
-
-  for (const row of transitions) {
-    const result = reduceTakeRegistry(state, row.input);
-    assert.deepEqual(
-      editorReplacements(result.effects).map(({ from, to, text }) => ({ from, to, text })),
-      row.replacements,
-    );
-    assert.equal(result.state.takes.length, row.takeCount);
-    state = result.state;
-  }
-
-  assert.ok(
-    reduceTakeRegistry(state, {
-      type: "server.event",
-      event: hypothesis("selection", "late"),
-    }).effects.length === 0,
-    "a retired item cannot rewrite its completed selection",
-  );
-});
-
-test("precommit binding confirms matches and rolls back mismatches", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  let result = server(state, hypothesis("provisional", "temporary"));
-  state = result.state;
-  assert.equal(state.takes[0].itemId, "provisional");
-
-  state = stopAndCommit(state, "client_commit").state;
-  result = server(state, committed("wrong"));
-  assert.deepEqual(editorReplacements(result.effects), [
-    {
-      domain: "editor",
-      command: "replace",
-      from: 0,
-      to: 9,
-      text: "",
-      transient: true,
-    },
-  ]);
-  assert.equal(result.state.takes.length, 0);
-  assert.deepEqual(
-    result.state.retiredItems.map(({ itemId }) => itemId).sort(),
-    ["provisional", "wrong"],
-  );
-  assert.ok(
-    result.effects.some(
-      (effect) =>
-        effect.domain === "status" &&
-        effect.command === "local" &&
-        effect.severity === "error",
-    ),
-  );
-
-  state = start(result.state, context(0)).state;
-  state = stopAndCommit(state, "client_commit_2").state;
-  state = server(state, hypothesis("fresh", "new")).state;
-  result = server(state, committed("fresh"));
-  assert.equal(result.state.takes[0].itemId, "fresh");
-  assert.equal(editorReplacements(result.effects).length, 0);
-});
-
-test("commit tombstones consume late acknowledgments without stealing a new take", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = stopAndCommit(state, "client_commit_1").state;
-  state = reduceTakeRegistry(state, { type: "user.discard" }).state;
-
-  state = start(state, context(0)).state;
-  let result = server(state, committed("discarded"));
-  assert.equal(result.state.takes[0].itemId, null);
-  assert.ok(result.state.retiredItems.some(({ itemId }) => itemId === "discarded"));
-  result = server(result.state, hypothesis("discarded", "WRONG TAKE"));
-  assert.equal(editorReplacements(result.effects).length, 0);
-
-  state = stopAndCommit(result.state, "client_commit_2").state;
-  state = server(state, hypothesis("current", "right take")).state;
-  result = server(state, committed("current"));
-  assert.equal(result.state.takes[0].itemId, "current");
-  assert.equal(result.state.takes[0].text, "right take");
-});
-
-test("duplicate acknowledgments preserve the next FIFO owner", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = stopAndCommit(state, "commit_a").state;
-  state = server(state, committed("a")).state;
-  state = start(state, context(0)).state;
-  state = stopAndCommit(state, "commit_b").state;
-
-  state = server(state, committed("a", "duplicate_a")).state;
-  assert.deepEqual(state.awaitingCommit, [
-    { generation: 0, takeId: 2, itemId: null },
-  ]);
-  const result = server(state, committed("b"));
-  assert.deepEqual(
-    result.state.takes.map((take) => take.itemId),
-    ["a", "b"],
-  );
-});
-
-test("hypotheses at or below their item's last applied revision are ignored", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = stopAndCommit(state, "commit_a").state;
-  let result = server(state, hypothesis("a", "ask not", 2));
-  assert.equal(editorReplacements(result.effects)[0].text, "ask not");
-  state = server(result.state, committed("a")).state;
-
-  for (const revision of [2, 1, 0]) {
-    const stale = server(state, hypothesis("a", `stale ${revision}`, revision));
-    assert.deepEqual(stale.effects, [], `revision ${revision} emits no effects`);
-    assert.deepEqual(stale.state, state, `revision ${revision} leaves the registry unchanged`);
-  }
-
-  result = server(state, hypothesis("a", "ask not what", 5));
-  assert.deepEqual(patches(result.effects), [{ from: 7, to: 7, text: " what" }]);
-  state = result.state;
-  assert.deepEqual(server(state, hypothesis("a", "stale", 4)).effects, []);
-
-  state = start(state, context(12, 12, "", " ")).state;
-  result = server(state, hypothesis("b", "your", 1));
-  assert.deepEqual(
-    editorReplacements(result.effects).map(({ from, to, text }) => ({ from, to, text })),
-    [{ from: 12, to: 12, text: " your" }],
-    "another item's revisions are tracked separately",
-  );
-  state = result.state;
-  assert.deepEqual(server(state, hypothesis("b", "stale", 1)).effects, []);
-  result = server(state, hypothesis("a", "ask not what you", 6));
-  assert.deepEqual(patches(result.effects), [{ from: 12, to: 12, text: " you" }]);
-  assert.deepEqual(
-    result.state.takes.map(({ itemId, text }) => ({ itemId, text })),
-    [
-      { itemId: "a", text: "ask not what you" },
-      { itemId: "b", text: " your" },
-    ],
-  );
-});
-
-test("a revision replaces only the word runs that changed and shifts later takes", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = stopAndCommit(state, "commit_a").state;
-  let result = server(state, hypothesis("a", "ask not what"));
-  let editor = applyEdits("", result.effects);
-  state = server(result.state, committed("a")).state;
-  state = start(state, context(12, 12, "", " ")).state;
-  result = server(state, hypothesis("b", "your"));
-  editor = applyEdits(editor, result.effects);
-  state = result.state;
-
-  result = server(state, hypothesis("a", "Ask not, what you", 2));
-  assert.deepEqual(
-    patches(result.effects),
-    [
-      { from: 0, to: 7, text: "Ask not," },
-      { from: 13, to: 13, text: " you" },
-    ],
-    "the unchanged word between the two changes is not rewritten",
-  );
-  editor = applyEdits(editor, result.effects);
-  assert.equal(editor, "Ask not, what you your");
-  assert.deepEqual(
-    result.state.takes.map(({ from, to, text }) => ({ from, to, text })),
-    [
-      { from: 0, to: 17, text: "Ask not, what you" },
-      { from: 17, to: 22, text: " your" },
-    ],
-  );
-
-  assert.deepEqual(
-    patches(server(result.state, hypothesis("a", "Ask not, what you", 3)).effects),
-    [],
-    "an unchanged revision writes nothing",
-  );
-});
-
-test("an interior-only correction leaves the caret at the take's end for the next take", () => {
-  let target = { text: "", caret: 0 };
-  let result = server(start(createTakeRegistry(), context(0)).state, hypothesis("a", "ask not what"));
-  target = applyToTarget(target, result.effects);
-
-  result = server(result.state, hypothesis("a", "ask NOT what", 2));
-  assert.deepEqual(patches(result.effects), [{ from: 4, to: 7, text: "NOT" }]);
-  target = applyToTarget(target, result.effects);
-  assert.deepEqual(target, { text: "ask NOT what", caret: 12 }, "a hypothesis patch parks the caret");
-
-  let state = stopAndCommit(result.state, "commit_a").state;
-  state = server(state, committed("a")).state;
-  result = server(state, completion("a", "Ask NOT what"));
-  assert.deepEqual(patches(result.effects), [
-    { from: 0, to: 12, text: "" },
-    { from: 0, to: 0, text: "Ask NOT what" },
-  ]);
-  target = applyToTarget(target, result.effects);
-  assert.deepEqual(target, { text: "Ask NOT what", caret: 12 }, "a landed completion parks the caret");
-
-  state = start(result.state, context(target.caret, target.caret, "", " ")).state;
-  result = server(state, hypothesis("b", "Second"));
-  assert.equal(applyToTarget(target, result.effects).text, "Ask NOT what Second");
-});
-
-test("a changed middle past the alignment budget becomes one patch that lands the exact text", () => {
-  const words = (count) => Array.from({ length: count }, (_, index) => `w${index}`).join(" ");
-  const revise = (count) => {
-    const before = `keep start alpha ${words(count)} omega keep end`;
-    const after = `keep start ALPHA ${words(count)} OMEGA keep end`;
-    const state = server(start(createTakeRegistry(), context(0)).state, hypothesis("a", before)).state;
-    const { effects } = server(state, hypothesis("a", after, 2));
-    assert.equal(applyEdits(before, effects), after, `${count} middle words land the exact text`);
-    return { before, after, patches: patches(effects) };
-  };
-
-  assert.equal(revise(10).patches.length, 2, "a middle inside the budget patches each changed word");
-
-  const { before, after, patches: [patch, ...rest] } = revise(150);
-  assert.deepEqual(rest, [], "about 300 runs a side collapse into one patch");
-  const prefix = "keep start ".length;
-  const suffix = " keep end".length;
-  assert.deepEqual(
-    patch,
-    { from: prefix, to: before.length - suffix, text: after.slice(prefix, after.length - suffix) },
-    "the patch spans exactly the changed middle and keeps the shared prefix and suffix",
-  );
-});
-
-test("the tentative mark covers exactly the shown tentative words and clears on completion", () => {
-  let editor = "Note";
-  let state = start(createTakeRegistry(), context(4, 4, "", " ")).state;
-  const step = (event) => {
-    const result = server(state, event);
-    state = result.state;
-    editor = applyEdits(editor, result.effects);
-    return tentativeMarks(result.effects);
-  };
-
-  assert.deepEqual(
-    step(parts("a", 1, { tentative: "ask not" })),
-    [{ takeId: 1, range: { from: 5, to: 8 } }],
-    "the mark leaves out the take's separator",
-  );
-  assert.equal(editor, "Note ask");
-
-  assert.deepEqual(
-    step(parts("a", 2, { agreed: "ask not", tentative: " what your" })),
-    [{ takeId: 1, range: { from: 12, to: 17 } }],
-  );
-  assert.equal(editor, "Note ask not what");
-  assert.equal(editor.slice(12, 17), " what");
-
-  assert.deepEqual(
-    step(parts("a", 3, { agreed: "ask not what", tentative: " your" })),
-    [{ takeId: 1, range: null }],
-    "a tail that is wholly held back clears the mark",
-  );
-  assert.equal(editor, "Note ask not what");
-
-  assert.deepEqual(
-    step(parts("a", 4, { agreed: "ask not what", tentative: " your country" })),
-    [{ takeId: 1, range: { from: 17, to: 22 } }],
-  );
-
-  state = stopAndCommit(state, "commit_a").state;
-  state = server(state, committed("a")).state;
-  assert.deepEqual(
-    step(completion("a", "ask not what your country")),
-    [{ takeId: 1, range: null }],
-    "completion clears the mark",
-  );
-  assert.equal(editor, "Note ask not what your country");
-});
-
-test("a discarded, failed, or disconnected take clears its tentative mark once", () => {
-  const recording = start(createTakeRegistry(), context(0)).state;
-  const live = server(recording, parts("live", 1, { agreed: "kept", tentative: " words here" }));
-  assert.deepEqual(tentativeMarks(live.effects), [{ takeId: 1, range: { from: 4, to: 10 } }]);
-
-  for (const [label, input] of [
-    ["a discard", { type: "user.discard" }],
-    ["a transcription failure", { type: "server.event", event: transcriptionFailure("live") }],
-    ["a connection loss", { type: "connection.lost" }],
-  ]) {
-    assert.deepEqual(
-      tentativeMarks(reduceTakeRegistry(live.state, input).effects),
-      [{ takeId: 1, range: null }],
-      `${label} clears the mark once`,
-    );
-  }
-});
-
-test("the last tentative word stays hidden until the next update or completion", () => {
-  let editor = "";
-  let state = start(createTakeRegistry(), context(0)).state;
-  const show = (event) => {
-    const result = server(state, event);
-    state = result.state;
-    editor = applyEdits(editor, result.effects);
-    return editor;
-  };
-
-  assert.equal(show(parts("a", 1, { tentative: "ask" })), "", "a lone tentative word is held back");
-  assert.equal(
-    show(parts("a", 2, { tentative: "ask not" })),
-    "ask",
-    "the next update shows the word it held back",
-  );
-  assert.equal(show(parts("a", 3, { agreed: "ask not", tentative: " what" })), "ask not");
-  assert.equal(
-    show(parts("a", 4, { agreed: "ask not wh", tentative: "at" })),
-    "ask not what",
-    "a fragment glued to stable text is not a whole word and stays shown",
-  );
-
-  state = stopAndCommit(state, "commit_a").state;
-  state = server(state, committed("a")).state;
-  assert.equal(show(completion("a", "ask not what you")), "ask not what you", "completion shows every word");
-});
-
-test("decoded delta events accumulate into replacement snapshots", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  for (const [index, delta] of ["one", " two"].entries()) {
-    const result = server(state, {
-      type: "conversation.item.input_audio_transcription.delta",
-      event_id: `delta_${index}`,
-      item_id: "delta_item",
-      content_index: 0,
-      delta,
-    });
-    state = result.state;
-    assert.equal(state.takes[0].text, index === 0 ? "one" : "one two");
-    assert.equal(editorReplacements(result.effects)[0].text, index === 0 ? "one" : " two");
-  }
-});
-
-test("overlapping takes shift isolated regions and complete in reverse order", () => {
-  let state = start(createTakeRegistry(), context(5)).state;
-  state = stopAndCommit(state, "commit_a").state;
-  let result = server(state, hypothesis("a", "first"));
-  state = result.state;
-  state = server(state, committed("a")).state;
-
-  state = start(state, context(10, 10, "", " ")).state;
-  state = stopAndCommit(state, "commit_b").state;
-  result = server(state, hypothesis("b", "second"));
-  state = server(result.state, committed("b")).state;
-  assert.deepEqual(
-    state.takes.map((take) => ({ itemId: take.itemId, from: take.from, text: take.text })),
-    [
-      { itemId: "a", from: 5, text: "first" },
-      { itemId: "b", from: 10, text: " second" },
-    ],
-  );
-
-  result = server(state, completion("b", "second"));
-  state = result.state;
-  assert.deepEqual(
-    patches(result.effects),
-    [
-      { from: 10, to: 17, text: "" },
-      { from: 10, to: 10, text: " second" },
-    ],
-    "an unchanged completion still lands as one undoable write",
-  );
-  assert.equal(state.takes.length, 1);
-  result = server(state, completion("a", "FIRST"));
-  assert.deepEqual(editorReplacements(result.effects), [
-    { domain: "editor", command: "replace", from: 5, to: 10, text: "", transient: true },
-    { domain: "editor", command: "replace", from: 5, to: 5, text: "FIRST", transient: false },
-  ]);
-  assert.equal(result.state.takes.length, 0);
-});
-
-test("terminal failure preserves visible text and later take coordinates", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = stopAndCommit(state, "commit_a").state;
-  state = server(state, hypothesis("a", "temporary")).state;
-  state = server(state, committed("a")).state;
-  state = start(state, context(9, 9, "", " ")).state;
-  state = stopAndCommit(state, "commit_b").state;
-  state = server(state, hypothesis("b", "kept")).state;
-  state = server(state, committed("b")).state;
-
-  let result = server(state, {
-    type: "conversation.item.input_audio_transcription.failed",
-    event_id: "failure_a",
-    item_id: "a",
-    content_index: 0,
-    error: {
-      type: "transcription_error",
-      code: "failed",
-      message: "must stay local",
-    },
-  });
-  assert.deepEqual(editorReplacements(result.effects), []);
-  assert.equal(result.state.takes[0].from, 9);
-
-  result = server(result.state, completion("b", "KEPT"));
-  assert.deepEqual(patches(result.effects), [
-    { from: 9, to: 14, text: "" },
-    { from: 9, to: 9, text: " KEPT" },
-  ]);
-});
-
-test("sequential takes own exactly one composition separator", () => {
-  let state = start(createTakeRegistry(), context(16, 16, "", " ")).state;
-  state = stopAndCommit(state, "commit_first").state;
-  state = server(state, committed("first")).state;
-  let result = server(state, completion("first", "Second test beta"));
-  assert.equal(editorReplacements(result.effects)[0].text, " Second test beta");
-
-  state = start(result.state, context(32, 32, "", " ")).state;
-  result = server(state, hypothesis("second", " leading"));
-  assert.equal(editorReplacements(result.effects)[0].text, " leading");
-  state = result.state;
-  result = server(state, completion("second", "authoritative   "));
-  assert.deepEqual(
-    patches(result.effects),
-    [
-      { from: 32, to: 40, text: "" },
-      { from: 32, to: 32, text: " authoritative" },
-    ],
-    "the landed completion keeps the take's one separator",
-  );
-});
-
-test("a reconnect lands agreed text and rejects the old session's late events", () => {
-  let state = start(createTakeRegistry(), context(4, 4, "", " ")).state;
-  state = server(state, hypothesis("old", "temporary")).state;
-
-  let result = reduceTakeRegistry(state, { type: "connection.lost" });
-  assert.deepEqual(editorReplacements(result.effects), [
-    { domain: "editor", command: "replace", from: 4, to: 14, text: "", transient: true },
-    { domain: "editor", command: "replace", from: 4, to: 4, text: " temporary", transient: false },
-  ]);
-  assert.ok(
-    result.effects.some(
-      (effect) => effect.domain === "capture" && effect.command === "clear",
-    ),
-  );
-  assert.deepEqual(result.state.retiredItems, []);
-  const stopEffect = result.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(stopEffect);
-  state = reduceTakeRegistry(result.state, {
-    type: "capture.stopped",
-    takeId: stopEffect.takeId,
-    ok: true,
-  }).state;
-  state = reduceTakeRegistry(state, { type: "connection.ready" }).state;
-  assert.equal(state.connection, "ready");
-
-  result = server(state, completion("old", "LATE"));
-  assert.equal(result.effects.length, 0);
-  state = start(result.state, context(4, 4, "", " ")).state;
-  result = server(state, hypothesis("new", "fresh"));
-  assert.equal(editorReplacements(result.effects)[0].text, " fresh");
-});
-
-test("capture and wire effects are typed and correlated to their take", () => {
-  let result = start(createTakeRegistry(), context(0));
-  let state = result.state;
-  assert.deepEqual(result.effects, [
-    { domain: "editor", command: "read-only", readOnly: true },
-    { domain: "status", command: "recording", recording: true },
-    {
-      domain: "status",
-      command: "local",
-      label: "Listening...",
-      severity: "info",
-    },
-  ]);
-
-  result = reduceTakeRegistry(state, {
-    type: "capture.audio",
-    chunk: Uint8Array.from([1, 2]).buffer,
-  });
-  state = result.state;
-  const append = result.effects[0];
-  assert.equal(append.domain, "wire");
-  assert.equal(append.command, "append");
-  assert.equal(append.takeId, state.activeTakeId);
-
-  result = reduceTakeRegistry(state, {
-    type: "wire.result",
-    requestId: append.requestId,
-    eventId: "append_event",
-  });
-  state = result.state;
-  const error = {
-    type: "error",
-    event_id: "server_error",
-    error: {
-      type: "invalid_request_error",
-      code: "bad_audio",
-      message: "must not surface",
-      event_id: "append_event",
-    },
-  };
-  result = server(state, error);
-  assert.equal(result.state.takes.length, 0);
-  assert.ok(
-    result.effects.some(
-      (effect) =>
-        effect.domain === "status" &&
-        effect.command === "local" &&
-        !effect.label.includes("must not surface"),
-    ),
-  );
-});
-
-test("retained-audio overload stops capture and commits accepted visible text", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  let result = server(state, hypothesis("long_take", "accepted visible words"));
-  state = result.state;
-  for (let stride = 0; stride < 360; stride++) {
-    const appendResult = reduceTakeRegistry(state, {
-      type: "capture.audio",
-      chunk: Uint8Array.from([1, 0]).buffer,
-    });
-    const append = appendResult.effects.find(
-      (effect) => effect.domain === "wire" && effect.command === "append",
-    );
-    assert.ok(append);
-    state = reduceTakeRegistry(appendResult.state, {
-      type: "wire.result",
-      requestId: append.requestId,
-      eventId: `hour_append_${stride}`,
-    }).state;
-    assert.ok(state.clientEvents.length <= 1, "append correlation history stays fixed");
-  }
-  assert.deepEqual(state.clientEvents, [
-    {
-      eventId: "hour_append_359",
-      generation: 0,
-      takeId: state.activeTakeId,
-      command: "append",
-    },
-  ]);
-
-  result = server(state, {
-    type: "error",
-    event_id: "stale_server_overload",
-    error: {
-      type: "overload_error",
-      code: "too_much_unfinalized_audio",
-      message: "must stay local",
-      param: "audio",
-      event_id: "hour_append_0",
-    },
-  });
-  assert.equal(result.state.capture, "recording", "retired append ownership cannot stop its take");
-  state = result.state;
-
-  result = server(state, {
-    type: "error",
-    event_id: "server_overload",
-    error: {
-      type: "overload_error",
-      code: "too_much_unfinalized_audio",
-      message: "must stay local",
-      param: "audio",
-      event_id: "hour_append_359",
-    },
-  });
-  const duplicate = server(result.state, {
-    type: "error",
-    event_id: "duplicate_server_overload",
-    error: {
-      type: "overload_error",
-      code: "too_much_unfinalized_audio",
-      message: "must stay local",
-      param: "audio",
-      event_id: "hour_append_359",
-    },
-  });
-
-  assert.equal(result.state.takes[0].text, "accepted visible words");
-  assert.equal(result.state.capture, "stopping");
-  assert.equal(
-    [...result.effects, ...duplicate.effects].filter(
-      (effect) => effect.domain === "capture" && effect.command === "stop",
-    ).length,
-    1,
-    "duplicate overload emits one capture stop",
-  );
-  assert.equal(
-    result.effects.some(
-      (effect) =>
-        (effect.domain === "capture" && effect.command === "clear") ||
-        (effect.domain === "wire" && effect.command === "clear") ||
-        (effect.domain === "editor" && effect.command === "replace"),
-    ),
-    false,
-    "throughput overload cannot erase accepted visible text",
-  );
-
-  const stopped = reduceTakeRegistry(duplicate.state, {
-    type: "capture.stopped",
-    takeId: result.state.stoppingTakeId,
-    ok: true,
-  });
-  assert.ok(
-    stopped.effects.some(
-      (effect) => effect.domain === "wire" && effect.command === "commit",
-    ),
-    "the still-valid accepted input commits after capture flushes",
-  );
-});
-
-test("precommit and terminal transcription failures preserve visible editor text", () => {
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = server(state, hypothesis("failed_take", "accepted visible words")).state;
-  let result = reduceTakeRegistry(state, {
-    type: "capture.audio",
-    chunk: Uint8Array.from([1, 0]).buffer,
-  });
-  const append = result.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(append);
-  state = reduceTakeRegistry(result.state, {
-    type: "wire.result",
-    requestId: append.requestId,
-    eventId: "failed_append",
-  }).state;
-  const precommit = {
-    type: "error",
-    event_id: "precommit_error",
-    error: {
-      type: "invalid_request_error",
-      code: "precommit_transcription_failed",
-      message: "must stay local",
-      param: "audio",
-      event_id: "failed_append",
-    },
-  };
-
-  result = server(state, precommit);
-  assert.equal(result.state.capture, "stopping");
-  assert.equal(result.state.takes[0].text, "accepted visible words");
-  assert.equal(editorReplacements(result.effects).length, 0);
-  assert.equal(
-    result.effects.some(
-      (effect) =>
-        (effect.domain === "capture" && effect.command === "clear") ||
-        (effect.domain === "wire" && effect.command === "clear"),
-    ),
-    false,
-  );
-  assert.equal(
-    result.effects.filter(
-      (effect) => effect.domain === "capture" && effect.command === "stop",
-    ).length,
-    1,
-  );
-  const duplicatePrecommit = server(result.state, precommit);
-  assert.deepEqual(duplicatePrecommit.effects, []);
-
-  const stopped = reduceTakeRegistry(duplicatePrecommit.state, {
-    type: "capture.stopped",
-    takeId: result.state.stoppingTakeId,
-    ok: true,
-  });
-  const commit = stopped.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "commit",
-  );
-  assert.ok(commit);
-  state = reduceTakeRegistry(stopped.state, {
-    type: "wire.result",
-    requestId: commit.requestId,
-    eventId: "failed_commit",
-  }).state;
-  state = server(state, committed("failed_take")).state;
-
-  result = server(state, transcriptionFailure("failed_take"));
-  assert.equal(result.state.takes.length, 0);
-  assert.ok(
-    result.state.retiredItems.some(({ itemId }) => itemId === "failed_take"),
-  );
-  assert.equal(editorReplacements(result.effects).length, 0);
-  assert.ok(
-    result.effects.some(
-      (effect) =>
-        effect.domain === "editor" &&
-        effect.command === "read-only" &&
-        effect.readOnly === false,
-    ),
-  );
-  assert.ok(
-    result.effects.some(
-      (effect) =>
-        effect.domain === "status" &&
-        effect.command === "local" &&
-        effect.label ===
-          "Dictation could not be fully transcribed. Visible text was kept and can be edited." &&
-        effect.severity === "error",
-    ),
-  );
-
-  const duplicateFailure = server(
-    result.state,
-    transcriptionFailure("failed_take", "duplicate_failure"),
-  );
-  assert.deepEqual(duplicateFailure.effects, []);
-  assert.deepEqual(server(duplicateFailure.state, hypothesis("failed_take", "late")).effects, []);
-  assert.deepEqual(
-    server(duplicateFailure.state, completion("failed_take", "LATE")).effects,
-    [],
-  );
-});
-
-test("precommit recovery requires the active take's latest append correlation", () => {
-  function precommit(eventId, includeCorrelation = true) {
-    const error = {
-      type: "invalid_request_error",
-      code: "precommit_transcription_failed",
-      message: "must stay local",
-      param: "audio",
-    };
-    if (includeCorrelation) {
-      error.event_id = eventId;
-    }
-    return {
-      type: "error",
-      event_id: `server_${String(eventId)}`,
-      error,
-    };
-  }
-
-  let state = start(createTakeRegistry(), context(0)).state;
-  state = server(state, hypothesis("retired_take", "visible old text")).state;
-  let append = reduceTakeRegistry(state, {
-    type: "capture.audio",
-    chunk: new ArrayBuffer(2),
-  });
-  const retiredRequest = append.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(retiredRequest);
-  state = reduceTakeRegistry(append.state, {
-    type: "wire.result",
-    requestId: retiredRequest.requestId,
-    eventId: "retired_append",
-  }).state;
-  const terminal = server(state, transcriptionFailure("retired_take"));
-  const terminalStop = terminal.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(terminalStop);
-  state = reduceTakeRegistry(terminal.state, {
-    type: "capture.stopped",
-    takeId: terminalStop.takeId,
-    ok: true,
-  }).state;
-
-  state = start(state, context(16)).state;
-  append = reduceTakeRegistry(state, {
-    type: "capture.audio",
-    chunk: new ArrayBuffer(2),
-  });
-  const supersededRequest = append.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(supersededRequest);
-  state = reduceTakeRegistry(append.state, {
-    type: "wire.result",
-    requestId: supersededRequest.requestId,
-    eventId: "superseded_append",
-  }).state;
-  append = reduceTakeRegistry(state, {
-    type: "capture.audio",
-    chunk: new ArrayBuffer(2),
-  });
-  const liveRequest = append.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(liveRequest);
-  state = reduceTakeRegistry(append.state, {
-    type: "wire.result",
-    requestId: liveRequest.requestId,
-    eventId: "live_append",
-  }).state;
-
-  for (const stale of [
-    precommit(null),
-    precommit(undefined, false),
-    precommit("retired_append"),
-    precommit("superseded_append"),
-  ]) {
-    const ignored = server(state, stale);
-    assert.equal(ignored.state.capture, "recording");
-    assert.deepEqual(ignored.effects, []);
-    state = ignored.state;
-  }
-
-  const matched = server(state, precommit("live_append"));
-  assert.equal(matched.state.capture, "stopping");
-  assert.equal(
-    matched.effects.filter(
-      (effect) => effect.domain === "capture" && effect.command === "stop",
-    ).length,
-    1,
-  );
-  assert.deepEqual(server(matched.state, precommit("live_append")).effects, []);
-});
-
-test("every transition preserves registry invariants without mutating its input", () => {
-  let state = createTakeRegistry();
-  const inputs = [
-    { type: "user.start", context: context(0) },
-    { type: "capture.audio", chunk: new ArrayBuffer(2) },
-    { type: "user.stop" },
-    { type: "connection.lost" },
-    { type: "connection.ready" },
-    { type: "user.start", context: context(0) },
-    { type: "user.discard" },
-  ];
-
-  for (const input of inputs) {
-    const before = structuredClone(state);
-    const result = reduceTakeRegistry(state, input);
-    assert.deepEqual(state, before, `${input.type} mutated its input`);
-    assert.equal(
-      new Set(result.state.takes.map((take) => take.id)).size,
-      result.state.takes.length,
-      `${input.type} duplicated a take id`,
-    );
-    assert.equal(
-      result.state.takes.filter((take) => take.id === result.state.activeTakeId).length,
-      result.state.activeTakeId === null ? 0 : 1,
-      `${input.type} left an invalid active take`,
-    );
-    assert.equal(
-      new Set(
-        result.state.retiredItems.map(
-          ({ generation, itemId }) => `${generation}:${itemId}`,
-        ),
-      ).size,
-      result.state.retiredItems.length,
-      `${input.type} duplicated a tombstoned item id`,
-    );
-    for (let index = 1; index < result.state.takes.length; index += 1) {
-      assert.ok(
-        result.state.takes[index - 1].from <= result.state.takes[index].from,
-        `${input.type} left take regions out of order`,
-      );
-    }
-    state = result.state;
-  }
-});
-
-test("connection generations scope wire identity and permit immediate item ID reuse", () => {
-  let state = reduceTakeRegistry(createTakeRegistry(), {
-    type: "connection.ready",
-    generation: 1,
-  }).state;
-  state = reduceTakeRegistry(state, {
-    type: "user.start",
-    generation: 1,
-    context: context(0),
-  }).state;
-  state = reduceTakeRegistry(state, {
-    type: "server.event",
-    generation: 1,
-    event: hypothesis("reused", "old words"),
-  }).state;
-
-  let result = reduceTakeRegistry(state, {
-    type: "connection.lost",
-    generation: 1,
-  });
-  assert.equal(result.state.activeGeneration, 1);
-  state = reduceTakeRegistry(result.state, {
-    type: "connection.ready",
-    generation: 2,
-  }).state;
-  state = reduceTakeRegistry(state, {
-    type: "user.start",
-    generation: 2,
-    context: context(0),
-  }).state;
-  result = reduceTakeRegistry(state, {
-    type: "server.event",
-    generation: 2,
-    event: hypothesis("reused", "fresh words"),
-  });
-  assert.equal(result.state.takes[0].text, "fresh words");
-  assert.equal(result.state.takes[0].itemGeneration, 2);
-  assert.equal(result.state.takes[0].itemId, "reused");
-
-  const freshRecording = result.state;
-  const idle = reduceTakeRegistry(createTakeRegistry(), {
-    type: "connection.ready",
-    generation: 2,
-  }).state;
-  const stopping = reduceTakeRegistry(freshRecording, {
-    type: "user.stop",
-    generation: 2,
-  });
-  const stopEffect = stopping.effects.find(
-    (effect) => effect.domain === "capture" && effect.command === "stop",
-  );
-  assert.ok(stopEffect);
-  const appending = reduceTakeRegistry(freshRecording, {
-    type: "capture.audio",
-    generation: 2,
-    chunk: new ArrayBuffer(2),
-  });
-  const appendEffect = appending.effects.find(
-    (effect) => effect.domain === "wire" && effect.command === "append",
-  );
-  assert.ok(appendEffect);
-  const unavailable = reduceTakeRegistry(freshRecording, {
-    type: "connection.lost",
-    generation: 2,
-  }).state;
-
-  const staleCases = [
-    {
-      label: "connection readiness",
-      state: unavailable,
-      input: { type: "connection.ready", generation: 1 },
-    },
-    {
-      label: "connection loss",
-      state: freshRecording,
-      input: { type: "connection.lost", generation: 1 },
-    },
-    {
-      label: "user start",
-      state: idle,
-      input: {
-        type: "user.start",
-        generation: 1,
-        context: context(0),
-      },
-    },
-    {
-      label: "user stop",
-      state: freshRecording,
-      input: { type: "user.stop", generation: 1 },
-    },
-    {
-      label: "user discard",
-      state: freshRecording,
-      input: { type: "user.discard", generation: 1 },
-    },
-    {
-      label: "capture audio",
-      state: freshRecording,
-      input: { type: "capture.audio", generation: 1, chunk: new ArrayBuffer(2) },
-    },
-    {
-      label: "capture completion",
-      state: stopping.state,
-      input: {
-        type: "capture.stopped",
-        generation: 1,
-        takeId: stopEffect.takeId,
-        ok: true,
-      },
-    },
-    {
-      label: "wire result",
-      state: appending.state,
-      input: {
-        type: "wire.result",
-        generation: 1,
-        requestId: appendEffect.requestId,
-        eventId: "stale",
-      },
-    },
-    {
-      label: "service error",
-      state: freshRecording,
-      input: { type: "service.error", generation: 1, eventId: null },
-    },
-    {
-      label: "server event",
-      state: freshRecording,
-      input: {
-        type: "server.event",
-        generation: 1,
-        event: completion("reused", "STALE"),
-      },
-    },
-  ];
-
-  for (const { label, state: current, input } of staleCases) {
-    const before = structuredClone(current);
-    const accepted = reduceTakeRegistry(current, { ...input, generation: 2 });
-    assert.notDeepEqual(
-      { state: accepted.state, effects: accepted.effects },
-      { state: before, effects: [] },
-      `${label} fixture must exercise behavior behind the generation guard`,
-    );
-
-    const ignored = reduceTakeRegistry(current, input);
-    assert.deepEqual(ignored.state, before, `${label} from the old socket mutated state`);
-    assert.deepEqual(ignored.effects, [], `${label} from the old socket emitted effects`);
-  }
-});
diff --git a/crates/workshop/ui/test/text-control-service.mjs b/crates/workshop/ui/test/text-control-service.mjs
deleted file mode 100644
index 129d24d63..000000000
--- a/crates/workshop/ui/test/text-control-service.mjs
+++ /dev/null
@@ -1,337 +0,0 @@
-// Unit test for the text-control service
-// (`@workshop/platform/text-control-service`): per-widget undo/redo/select-all
-// adapters registered on DOM roots, focus tracking across the document,
-// the inputFocus / editorTextFocus / textInputFocus context keys, and the
-// execCommand fallback for native editables (including the remembered
-// target, since a menu click steals focus before the command runs).
-// Also covers the edit contribution (src/parts/menu/edit.contribution.ts):
-// the six edit rows register with the textInputFocus precondition and
-// their commands route through the shared service singleton - adapter
-// when one is active, the native path otherwise.
-// Bundles the modules with esbuild and drives them against jsdom.
-// Run: node --test test/text-control-service.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { TextControlService, TEXT_CONTROL_SERVICE } from "@workshop/platform/text-control-service";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { getService } from "@workshop/platform/service-registry";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus, MenuId } from "@workshop/platform/menu-registry";
-      import "./src/parts/menu/edit.contribution.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const dom = new JSDOM("<!DOCTYPE html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Element = window.Element;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.HTMLTextAreaElement = window.HTMLTextAreaElement;
-globalThis.Node = window.Node;
-
-const { TextControlService, TEXT_CONTROL_SERVICE, ContextKeyService, getService, Commands, Menus, MenuId } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Self-registration ---------------------------------------------------------
-
-check(
-  "the TEXT_CONTROL_SERVICE token self-registers",
-  getService(TEXT_CONTROL_SERVICE) instanceof TextControlService,
-);
-
-// --- Fixture ---------------------------------------------------------------------
-
-const execCalls = [];
-window.document.execCommand = (command) => {
-  execCalls.push(command);
-  return true;
-};
-
-const contextKeys = new ContextKeyService();
-const service = new TextControlService(contextKeys, window.document);
-const body = window.document.body;
-
-function addElement(tag) {
-  const element = window.document.createElement(tag);
-  body.appendChild(element);
-  return element;
-}
-
-const input = addElement("input"); // type text by default
-const textarea = addElement("textarea");
-const checkbox = addElement("input");
-checkbox.type = "checkbox";
-const editable = addElement("div");
-editable.setAttribute("contenteditable", "");
-editable.tabIndex = 0;
-const button = addElement("button");
-
-const keys = () => ({
-  input: contextKeys.getValue("inputFocus"),
-  editor: contextKeys.getValue("editorTextFocus"),
-  text: contextKeys.getValue("textInputFocus"),
-});
-const allClear = () => keys().input === false && keys().editor === false && keys().text === false;
-
-// --- Focus keys over native editables ----------------------------------------------
-
-check("the focus keys start false", allClear());
-
-input.focus();
-check("a focused text input sets inputFocus and textInputFocus", keys().input === true && keys().text === true);
-check("a focused text input leaves editorTextFocus false", keys().editor === false);
-
-textarea.focus();
-check("a focused textarea sets inputFocus and textInputFocus", keys().input === true && keys().text === true);
-
-checkbox.focus();
-check("a non-text input clears inputFocus", keys().input === false);
-check("a non-text input clears textInputFocus", keys().text === false);
-
-editable.focus();
-check("a focused contentEditable sets textInputFocus", keys().text === true);
-check("a focused contentEditable leaves inputFocus false", keys().input === false);
-
-button.focus();
-check("focusing a non-editable clears every focus key", allClear());
-
-input.focus();
-input.blur();
-check("blurring to nothing clears every focus key", allClear());
-
-// --- Adapter registration and active tracking -----------------------------------------
-
-const container = addElement("div");
-const inner = window.document.createElement("div");
-inner.tabIndex = 0;
-container.appendChild(inner);
-
-const calls = { undo: 0, redo: 0, selectAll: 0 };
-let undoDepth = 1;
-let redoDepth = 1;
-const control = {
-  kind: "codemirror",
-  undo: () => {
-    calls.undo += 1;
-  },
-  redo: () => {
-    calls.redo += 1;
-  },
-  selectAll: () => {
-    calls.selectAll += 1;
-  },
-  canUndo: () => undoDepth > 0,
-  canRedo: () => redoDepth > 0,
-};
-
-inner.focus();
-check("no adapter is active before registration", service.active === null);
-
-const registration = service.register(container, control);
-check("the focused subtree's adapter is active", service.active === control);
-check("a codemirror adapter sets editorTextFocus", keys().editor === true);
-check("a codemirror adapter sets textInputFocus", keys().text === true);
-check("a codemirror adapter leaves inputFocus false", keys().input === false);
-
-button.focus();
-check("focus outside every root leaves no active adapter", service.active === null);
-check("losing adapter focus clears editorTextFocus", keys().editor === false);
-
-inner.focus();
-check("returning focus reactivates the adapter", service.active === control);
-
-// --- Command routing --------------------------------------------------------------------
-
-const execBefore = execCalls.length;
-service.undo();
-check("undo routes to the active adapter when it can undo", calls.undo === 1);
-check("adapter undo does not touch execCommand", execCalls.length === execBefore);
-
-service.redo();
-check("redo routes to the active adapter when it can redo", calls.redo === 1);
-
-service.selectAll();
-check("selectAll routes to the active adapter", calls.selectAll === 1);
-
-undoDepth = 0;
-service.undo();
-check("an empty undo history falls back instead of no-op-ing", calls.undo === 1);
-check(
-  "the undo fallback runs execCommand",
-  execCalls.length === execBefore + 1 && execCalls[execCalls.length - 1] === "undo",
-);
-check("the fallback refocuses the remembered editable", window.document.activeElement === input);
-
-inner.focus();
-redoDepth = 0;
-service.redo();
-check("an empty redo history falls back", calls.redo === 1);
-check("the redo fallback runs execCommand", execCalls[execCalls.length - 1] === "redo");
-
-input.remove();
-button.focus();
-const execCount = execCalls.length;
-service.undo();
-check("a disconnected fallback target no-ops", execCalls.length === execCount);
-
-// --- Registration semantics -----------------------------------------------------------------
-
-const replacement = {
-  kind: "prosemirror",
-  undo: () => {},
-  redo: () => {},
-  selectAll: () => {},
-};
-const stale = registration;
-const current = service.register(container, replacement);
-stale.dispose();
-inner.focus();
-check("disposing a stale registration keeps its replacement", service.active === replacement);
-check("a prosemirror adapter does not set editorTextFocus", keys().editor === false);
-check("a prosemirror adapter sets textInputFocus", keys().text === true);
-
-current.dispose();
-check("disposing the current registration unregisters it", service.active === null);
-check("unregistering the focused adapter clears editorTextFocus", keys().editor === false);
-
-// --- Dispose ---------------------------------------------------------------------------------
-
-service.dispose();
-textarea.focus();
-check("a disposed service stops tracking focus", allClear());
-
-contextKeys.dispose();
-
-// --- Edit contribution (src/parts/menu/edit.contribution.ts) ------------------------
-
-// The contribution registers the six edit rows into the shared
-// registries at module scope; the commands route through the shared
-// text-control singleton.
-const editService = getService(TEXT_CONTROL_SERVICE);
-
-const editCommands = [
-  ["undo", "Undo"],
-  ["redo", "Redo"],
-  ["editor.action.clipboardCutAction", "Cut"],
-  ["editor.action.clipboardCopyAction", "Copy"],
-  ["editor.action.clipboardPasteAction", "Paste"],
-  ["editor.action.selectAll", "Select All"],
-];
-for (const [id, title] of editCommands) {
-  const action = Commands.lookup(id);
-  check(`the edit contribution registers '${id}' titled '${title}'`, action !== undefined && action.title === title);
-  check(`'${id}' gates on the textInputFocus precondition`, action !== undefined && action.precondition === "textInputFocus");
-}
-
-const inMenu = (menuId, command, group) =>
-  Menus.getMenuItems(menuId).some((row) => row.command === command && row.group === group);
-check(
-  "undo and redo land in the Edit menu's 1_do group",
-  inMenu(MenuId.MenubarEditMenu, "undo", "1_do") && inMenu(MenuId.MenubarEditMenu, "redo", "1_do"),
-);
-check(
-  "cut, copy, and paste land in the Edit menu's 2_ccp group",
-  inMenu(MenuId.MenubarEditMenu, "editor.action.clipboardCutAction", "2_ccp") &&
-    inMenu(MenuId.MenubarEditMenu, "editor.action.clipboardCopyAction", "2_ccp") &&
-    inMenu(MenuId.MenubarEditMenu, "editor.action.clipboardPasteAction", "2_ccp"),
-);
-check(
-  "select-all lands in the Selection menu's 1_basic group",
-  inMenu(MenuId.MenubarSelectionMenu, "editor.action.selectAll", "1_basic"),
-);
-
-// Command routing: a focused adapter takes undo/redo/select-all.
-const editRoot = addElement("div");
-const editInner = window.document.createElement("div");
-editInner.tabIndex = 0;
-editRoot.appendChild(editInner);
-
-const routed = { undo: 0, redo: 0, selectAll: 0 };
-let promptUndoDepth = 1;
-editInner.focus();
-const editAdapter = editService.register(editRoot, {
-  kind: "prosemirror",
-  undo: () => {
-    routed.undo += 1;
-  },
-  redo: () => {
-    routed.redo += 1;
-  },
-  selectAll: () => {
-    routed.selectAll += 1;
-  },
-  canUndo: () => promptUndoDepth > 0,
-});
-
-const routedExecBefore = execCalls.length;
-await Commands.execute("undo");
-check("the undo command routes to the focused adapter", routed.undo === 1);
-await Commands.execute("redo");
-check("the redo command routes to the focused adapter", routed.redo === 1);
-await Commands.execute("editor.action.selectAll");
-check("the select-all command routes to the focused adapter", routed.selectAll === 1);
-check("adapter routing never touches execCommand", execCalls.length === routedExecBefore);
-
-// A native editable focused earlier stays the remembered fallback
-// target while the adapter holds focus.
-const nativeBox = addElement("input");
-nativeBox.focus();
-editInner.focus();
-promptUndoDepth = 0;
-await Commands.execute("undo");
-check(
-  "the undo command falls back to execCommand on an empty adapter history",
-  routed.undo === 1 && execCalls[execCalls.length - 1] === "undo",
-);
-check("the undo fallback refocuses the remembered editable", window.document.activeElement === nativeBox);
-
-// Cut/copy/paste are always the native path, refocused onto the
-// remembered editable (a menu click has moved focus since).
-const chromeButton = addElement("button");
-chromeButton.focus();
-await Commands.execute("editor.action.clipboardCutAction");
-check(
-  "the cut command execCommands on the remembered editable",
-  execCalls[execCalls.length - 1] === "cut" && window.document.activeElement === nativeBox,
-);
-await Commands.execute("editor.action.clipboardCopyAction");
-check("the copy command execCommands on the remembered editable", execCalls[execCalls.length - 1] === "copy");
-await Commands.execute("editor.action.clipboardPasteAction");
-check("the paste command execCommands on the remembered editable", execCalls[execCalls.length - 1] === "paste");
-
-editAdapter.dispose();
-
-if (failures.length > 0) {
-  console.error(`text-control-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("text-control-service: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/titlebar-browser-mode.mjs b/crates/workshop/ui/test/titlebar-browser-mode.mjs
deleted file mode 100644
index f6317cc99..000000000
--- a/crates/workshop/ui/test/titlebar-browser-mode.mjs
+++ /dev/null
@@ -1,128 +0,0 @@
-// Custom window title bar in browser mode: the bar holds the application
-// menus, so it must be visible after boot even without the Tauri runtime;
-// only the native window-control cluster hides, and the module never calls
-// into the Tauri window API - the whole test runs with no
-// __TAURI_INTERNALS__ defined, so a passing run proves the menu path needs
-// no desktop bridge.
-// Covers the <header> landmark, the program icon's attributes, the eight
-// generated menus (File opens and announces aria-expanded; the popover is
-// built lazily at open), the drag region, and the window-control
-// cluster's buttons and glyphs.
-// Run: node test/titlebar-browser-mode.mjs (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("the title bar works in browser mode without ipc", async ({ window, document, failures }) => {
-  const titlebar = document.querySelector(".ws-window-titlebar");
-  if (!titlebar) {
-    failures.push("window title bar missing");
-  } else {
-    if (titlebar.tagName !== "HEADER") {
-      failures.push("the window title bar is not a <header> landmark");
-    }
-    if (window.__TAURI_INTERNALS__ !== undefined) {
-      failures.push("this test must run without the Tauri runtime present");
-    }
-    if (titlebar.hidden) {
-      failures.push("the title bar must be visible after boot in browser mode");
-    }
-    const controlsCluster = titlebar.querySelector(".ws-window-titlebar__controls");
-    if (!controlsCluster) {
-      failures.push("title bar window-control cluster missing");
-    } else if (!controlsCluster.hidden) {
-      failures.push("the window-control cluster must stay hidden in browser mode");
-    }
-    const icon = titlebar.querySelector(".ws-window-titlebar__icon");
-    if (!icon) {
-      failures.push("title bar program icon missing");
-    } else {
-      if (icon.getAttribute("src") !== "/icons/runvil-icon.png") {
-        failures.push(`title bar icon src is "${icon.getAttribute("src")}"`);
-      }
-      if (icon.getAttribute("srcset") !== "/icons/runvil-icon.png 1x, /icons/runvil-icon@2x.png 2x") {
-        failures.push(`title bar icon srcset is "${icon.getAttribute("srcset")}"; it must name the @2x render`);
-      }
-      if (icon.getAttribute("alt") !== "") {
-        failures.push("the decorative title bar icon must have an empty alt");
-      }
-      if (!icon.getAttribute("width") || !icon.getAttribute("height")) {
-        failures.push("the title bar icon must set width and height");
-      }
-    }
-    if (icon && (icon.getAttribute("width") !== "16" || icon.getAttribute("height") !== "16")) {
-      failures.push("the title bar icon must be declared 16px");
-    }
-    const toolLabels = [...titlebar.querySelectorAll(".ws-window-titlebar__tool")].map((button) =>
-      button.getAttribute("aria-label"),
-    );
-    if (toolLabels.join(",") !== "Toggle Primary Side Bar,Toggle Agents,Settings") {
-      failures.push(
-        `title bar toolbars are "${toolLabels.join(",")}", expected "Toggle Primary Side Bar,Toggle Agents,Settings"`,
-      );
-    }
-    if (titlebar.querySelector(".ws-command-center__folder") === null) {
-      failures.push("the command center's folder-name button is missing from the title bar");
-    }
-    if (titlebar.querySelector(".ws-command-center__pill, .ws-command-center__chevron") !== null) {
-      failures.push("the command center's pill and ? chevron must be gone");
-    }
-    const menuLabels = [...titlebar.querySelectorAll(".ws-window-titlebar__menu")].map(
-      (button) => button.textContent,
-    );
-    if (menuLabels.join(",") !== "File,Edit,Selection,View,Go,Run,Terminal,Help") {
-      failures.push(
-        `title bar menus are "${menuLabels.join(",")}", expected "File,Edit,Selection,View,Go,Run,Terminal,Help"`,
-      );
-    }
-    for (const button of titlebar.querySelectorAll(".ws-window-titlebar__menu")) {
-      if (button.tagName !== "BUTTON") failures.push("a title bar menu is not a <button>");
-    }
-    if (document.querySelectorAll(".ws-window-titlebar__popover").length !== 0) {
-      failures.push("the menubar must build its popovers lazily, not at boot");
-    }
-    const fileButton = titlebar.querySelector('[data-menu="file"]');
-    if (fileButton) {
-      fileButton.click();
-      const filePopover = [...document.querySelectorAll(".ws-window-titlebar__popover")].find(
-        (popover) => !popover.hidden,
-      );
-      if (!filePopover) {
-        failures.push("clicking the File menu button does not open its popover in browser mode");
-      }
-      if (fileButton.getAttribute("aria-expanded") !== "true") {
-        failures.push("the open File menu button is not announced expanded");
-      }
-      fileButton.click();
-      // A mouse press opens the menu on mousedown; the click that ends it leaves it open.
-      fileButton.dispatchEvent(new window.MouseEvent("mousedown", { bubbles: true, button: 0, detail: 1 }));
-      if (![...document.querySelectorAll(".ws-window-titlebar__popover")].some((popover) => !popover.hidden)) {
-        failures.push("a mousedown on the File menu button does not open its popover in browser mode");
-      }
-      fileButton.dispatchEvent(new window.MouseEvent("click", { bubbles: true, detail: 1 }));
-      if (fileButton.getAttribute("aria-expanded") !== "true") {
-        failures.push("the click that ends a press must not close the File menu");
-      }
-      fileButton.dispatchEvent(new window.MouseEvent("mousedown", { bubbles: true, button: 0, detail: 1 }));
-    }
-    if (!titlebar.querySelector(".ws-window-titlebar__drag")) {
-      failures.push("title bar drag region missing");
-    }
-    const controls = [...titlebar.querySelectorAll(".ws-window-titlebar__control")];
-    const controlLabels = controls.map((button) => button.getAttribute("aria-label"));
-    if (controlLabels.join(",") !== "Minimize,Maximize,Close") {
-      failures.push(
-        `window controls are "${controlLabels.join(",")}", expected "Minimize,Maximize,Close"`,
-      );
-    }
-    for (const button of controls) {
-      if (button.tagName !== "BUTTON") {
-        failures.push(`window control "${button.getAttribute("aria-label")}" is not a <button>`);
-      }
-      if (!button.querySelector("svg")) {
-        failures.push(`window control "${button.getAttribute("aria-label")}" has no inline SVG glyph`);
-      }
-    }
-  }
-  if ("__TAURI_INTERNALS__" in window) {
-    failures.push("browser mode must not require the Tauri internals");
-  }
-});
diff --git a/crates/workshop/ui/test/titlebar-macos.mjs b/crates/workshop/ui/test/titlebar-macos.mjs
deleted file mode 100644
index 37c65b01a..000000000
--- a/crates/workshop/ui/test/titlebar-macos.mjs
+++ /dev/null
@@ -1,157 +0,0 @@
-// Title bar under macOS overlay chrome: the desktop app runs the
-// window with titleBarStyle Overlay and a hidden title, so the native
-// traffic lights float over the bar's left edge and cover
-// close/minimize/zoom. window-chrome.ts detects the platform through the
-// shared detectPlatform() and, on macOS only, hides the custom
-// Windows-style control cluster and marks the bar so window-chrome.css can
-// inset the left region clear of the lights. The drag region and the
-// maximized/fullscreen sync keep working - the green light's native
-// fullscreen is what isFullscreen tracks. Windows and Linux keep the
-// cluster; a plain browser changes nothing, because browser mode already
-// hides the cluster and no traffic lights overlay the bar.
-// Run: node --test test/titlebar-macos.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(uiDir, "..", "src", "parts", "chrome", "window-chrome.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-  },
-});
-const code = bundle.outputFiles[0].text;
-const { setupWindowChrome } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets the async maximized/fullscreen sync (stubbed promises) run out.
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// detectPlatform() reads the global navigator at setup time, so each
-// scenario installs the platform's navigator before calling
-// setupWindowChrome and restores the original afterward.
-const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
-const NAVIGATORS = {
-  mac: { platform: "MacIntel", userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" },
-  windows: { platform: "Win32", userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" },
-  linux: { platform: "Linux x86_64", userAgent: "Mozilla/5.0 (X11; Linux x86_64)" },
-};
-
-function scenario({ desktop, platform }) {
-  const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-  const { window } = dom;
-  if (desktop) {
-    window.__TAURI_INTERNALS__ = {};
-  }
-  globalThis.window = window;
-  globalThis.document = window.document;
-  globalThis.CustomEvent = window.CustomEvent;
-  Object.defineProperty(globalThis, "navigator", {
-    value: NAVIGATORS[platform],
-    configurable: true,
-    writable: true,
-  });
-  try {
-    const chrome = setupWindowChrome();
-    return {
-      window,
-      chrome,
-      bar: window.document.querySelector(".ws-window-titlebar"),
-      stub: () => window.__TAURI_STUB__,
-    };
-  } finally {
-    Object.defineProperty(globalThis, "navigator", originalNavigator);
-  }
-}
-
-// --- macOS desktop: the native traffic lights replace the custom cluster ---
-
-{
-  const { window, bar, stub } = scenario({ desktop: true, platform: "mac" });
-  check("macOS reveals the bar", bar.hidden === false);
-  check(
-    "macOS hides the custom window-control cluster",
-    bar.querySelector(".ws-window-titlebar__controls").hidden === true,
-  );
-  check(
-    "macOS marks the bar for the traffic-light inset",
-    bar.classList.contains("ws-window-titlebar--macos"),
-  );
-
-  // The empty center still drags the window.
-  const drag = bar.querySelector(".ws-window-titlebar__drag");
-  drag.dispatchEvent(new window.MouseEvent("mousedown", { button: 0, detail: 1, bubbles: true }));
-  check("macOS keeps the drag region live", stub().calls.join(",") === "drag");
-
-  // The maximized/fullscreen sync stays wired: the green light's native
-  // fullscreen and the traffic-light zoom still surface as resizes.
-  check(
-    "macOS keeps the resize sync wired",
-    stub().resizeHandlers.length === 1,
-  );
-  await flush();
-  const maximize = bar.querySelector('[data-command="toggle-maximize"]');
-  check(
-    "macOS still syncs the maximize state",
-    maximize.getAttribute("aria-label") === "Maximize",
-  );
-}
-
-// --- Windows and Linux desktop: the custom cluster stays -------------------
-
-for (const platform of ["windows", "linux"]) {
-  const { bar } = scenario({ desktop: true, platform });
-  check(
-    `${platform} keeps the window-control cluster visible`,
-    bar.querySelector(".ws-window-titlebar__controls").hidden === false,
-  );
-  check(
-    `${platform} does not mark the bar for the traffic-light inset`,
-    !bar.classList.contains("ws-window-titlebar--macos"),
-  );
-}
-
-// --- Browser on macOS: nothing changes --------------------------------------
-
-{
-  const { bar } = scenario({ desktop: false, platform: "mac" });
-  check(
-    "a browser on macOS keeps the cluster hidden as plain browser mode",
-    bar.querySelector(".ws-window-titlebar__controls").hidden === true,
-  );
-  check(
-    "a browser on macOS takes no traffic-light inset; no lights overlay it",
-    !bar.classList.contains("ws-window-titlebar--macos"),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`titlebar-macos: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("titlebar-macos: all assertions passed");
diff --git a/crates/workshop/ui/test/titlebar-style.mjs b/crates/workshop/ui/test/titlebar-style.mjs
deleted file mode 100644
index eb26ec491..000000000
--- a/crates/workshop/ui/test/titlebar-style.mjs
+++ /dev/null
@@ -1,361 +0,0 @@
-// Title-bar built-artifact contract: loads the bundled stylesheet and
-// shipped markup into jsdom, mounts the menubar (src/parts/menu/menubar.ts)
-// over the shipped empty nav with the eight top-level menus registered,
-// then checks the region structure, the generated buttons, visibility,
-// sizing, glyph, and keyboard-focus behavior that jsdom can execute
-// without a layout engine.
-// Run after `npm run build`: `node --test test/titlebar-style.mjs`.
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const distDir = path.join(uiDir, "..", "dist");
-// The bundled stylesheet's name is content-hashed; the build's manifest
-// maps the logical name to it.
-const manifest = JSON.parse(await readFile(path.join(distDir, "manifest.json"), "utf8"));
-const [html, css] = await Promise.all([
-  readFile(path.join(distDir, "index.html"), "utf8"),
-  readFile(path.join(distDir, manifest["app.css"]), "utf8"),
-]);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-check("the production stylesheet bundle is nonempty", css.length > 0);
-
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-const style = window.document.createElement("style");
-style.textContent = css;
-window.document.head.appendChild(style);
-
-const barEl = window.document.querySelector(".ws-window-titlebar");
-check("title bar present in the shipped markup", barEl !== null);
-
-// --- Region structure: __left (icon + menus), __center (drag), __right (controls) ---
-
-if (barEl) {
-  const left = barEl.querySelector(":scope > .ws-window-titlebar__left");
-  const center = barEl.querySelector(":scope > .ws-window-titlebar__center");
-  const right = barEl.querySelector(":scope > .ws-window-titlebar__right");
-  check("the bar splits into left, center, and right regions", left !== null && center !== null && right !== null);
-  if (left) {
-    check("the left region holds the program icon", left.querySelector(".ws-window-titlebar__icon") !== null);
-    const nav = left.querySelector(".ws-window-titlebar__menus");
-    check(
-      "the left region holds the menubar nav as a menubar landmark",
-      nav !== null && nav.getAttribute("role") === "menubar" && nav.getAttribute("aria-label") === "Application menus",
-    );
-    check("the menubar nav ships empty; the buttons are generated", nav !== null && nav.children.length === 0);
-  }
-  if (center) {
-    check("the center region is the drag surface", center.classList.contains("ws-window-titlebar__drag"));
-  }
-  if (right) {
-    check("the right region holds the window controls", right.querySelector(".ws-window-titlebar__controls") !== null);
-  }
-}
-
-// --- The menubar generates the eight top-level buttons ------------------------------
-
-// The shipped nav is empty; mount the real Menubar over it with the
-// eight top-level menus registered, as the menubar contribution does at
-// boot. The bundle reads the globals, so point them at this jsdom first.
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { Menubar } from "./src/parts/menu/menubar.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-      export { ContextKeyService } from "@workshop/platform/context-key-service";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-const { Menubar, CommandRegistry, MenuRegistry, MenuId, ContextKeyService, createKeybindingsRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-if (barEl) {
-  const menus = new MenuRegistry();
-  const topLevel = [
-    [MenuId.MenubarFileMenu, "File"],
-    [MenuId.MenubarEditMenu, "Edit"],
-    [MenuId.MenubarSelectionMenu, "Selection"],
-    [MenuId.MenubarViewMenu, "View"],
-    [MenuId.MenubarGoMenu, "Go"],
-    [MenuId.MenubarRunMenu, "Run"],
-    [MenuId.MenubarTerminalMenu, "Terminal"],
-    [MenuId.MenubarHelpMenu, "Help"],
-  ];
-  topLevel.forEach(([id, title], index) => {
-    menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: id, title, order: index + 1 });
-  });
-  const nav = barEl.querySelector(".ws-window-titlebar__menus");
-  new Menubar(nav, {
-    menus,
-    commands: new CommandRegistry(),
-    contextKeys: new ContextKeyService(),
-    keybindings: createKeybindingsRegistry("linux"),
-  });
-  const buttons = [...nav.querySelectorAll(".ws-window-titlebar__menu")];
-  check(
-    "the menubar generates the eight top-level buttons in order",
-    buttons.map((button) => button.textContent).join(",") === "File,Edit,Selection,View,Go,Run,Terminal,Help",
-  );
-  check(
-    "the buttons have the last-segment data-menu selectors",
-    buttons.map((button) => button.dataset.menu).join(",") === "file,edit,selection,view,go,run,terminal,help",
-  );
-}
-
-// --- Visibility, sizing, controls, glyphs, focus -------------------------------------
-
-if (barEl) {
-  const order = [...barEl.querySelectorAll(".ws-window-titlebar__control")].map((button) =>
-    button.getAttribute("aria-label"),
-  );
-  check(
-    "window controls are ordered Minimize, Maximize, Close",
-    order.join(",") === "Minimize,Maximize,Close",
-  );
-  check(
-    "the [hidden] bar computes to display:none in browser mode",
-    window.getComputedStyle(barEl).display === "none",
-  );
-  barEl.hidden = false;
-  const revealed = window.getComputedStyle(barEl);
-  check("the revealed bar computes to the flex row", revealed.display === "flex");
-  // jsdom reports the declared var() expression for height but resolves
-  // custom properties themselves; together they prove the fixed height
-  // flows through the variable.
-  check(
-    "the revealed bar's height is declared via --titlebar-height",
-    revealed.height.startsWith("var(--titlebar-height"),
-  );
-  check(
-    "--titlebar-height resolves to a fixed pixel value",
-    /^\d+px$/.test(revealed.getPropertyValue("--titlebar-height").trim()),
-  );
-  for (const button of barEl.querySelectorAll("button")) {
-    button.focus();
-    check(
-      `${button.textContent.trim() || button.getAttribute("aria-label")} accepts keyboard focus`,
-      window.document.activeElement === button && button.matches(":focus"),
-    );
-    check(
-      `${button.textContent.trim() || button.getAttribute("aria-label")} focus has no browser outline`,
-      window.getComputedStyle(button).outlineStyle === "none",
-    );
-  }
-  const restoreGlyph = barEl.querySelector(".ws-window-titlebar__glyph--restore");
-  const maximizeGlyph = barEl.querySelector(".ws-window-titlebar__glyph--maximize");
-  check(
-    "the restore glyph ships with the hidden attribute",
-    restoreGlyph !== null && restoreGlyph.hasAttribute("hidden"),
-  );
-  if (restoreGlyph && maximizeGlyph) {
-    check(
-      "the [hidden] restore glyph computes to display:none",
-      window.getComputedStyle(restoreGlyph).display === "none",
-    );
-    check(
-      "the visible maximize glyph does not compute to display:none",
-      window.getComputedStyle(maximizeGlyph).display !== "none",
-    );
-  }
-}
-
-// --- Cursor's title-bar skin, read from the source stylesheets --------------------
-//
-// jsdom applies no stylesheets for var() resolution, so the skin's values are
-// read from the sources: the palette tokens in @workshop/look, the window
-// controls, icon box, toolbars, and zoom counter-scaling in window-chrome.css,
-// and the folder-name button in command-center.css.
-
-const stripComments = (source) => source.replace(/\/\*[\s\S]*?\*\//g, "");
-const rulesOf = (source) =>
-  [...stripComments(source).matchAll(/([^{}]+)\{([^{}]*)\}/g)].map((match) => ({
-    selectors: match[1].split(",").map((selector) => selector.replace(/\s+/g, " ").trim()),
-    body: match[2].replace(/\s+/g, " ").trim(),
-  }));
-/** Every declaration the rules naming exactly `selector` carry, concatenated. */
-const bodyOf = (rules, selector) =>
-  rules
-    .filter((rule) => rule.selectors.includes(selector))
-    .map((rule) => rule.body)
-    .join(" ");
-const declares = (body, property, value) =>
-  new RegExp(`(?:^|[\\s;])${property}:\\s*${value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*(?:;|$)`).test(body);
-
-const lookTokens = await readFile(path.join(uiDir, "..", "..", "look", "tokens.css"), "utf8");
-const tokenValue = (name) => new RegExp(`${name}:\\s*([^;]+);`).exec(stripComments(lookTokens))?.[1].trim();
-check("the window-control glyphs are #F0F0F084", tokenValue("--titlebar-glyph") === "#F0F0F084");
-check("a window control's hover is #FFFFFF1A", tokenValue("--titlebar-control-hover") === "#FFFFFF1A");
-check("the close control's hover is #E81123E6", tokenValue("--titlebar-close-hover") === "#E81123E6");
-check("an inactive window's title-bar text is #F0F0F099", tokenValue("--titlebar-foreground-inactive") === "#F0F0F099");
-check("the folder-name button's hover is #FFFFFF14", tokenValue("--titlebar-folder-hover") === "#FFFFFF14");
-check("the app icon is 16px", tokenValue("--titlebar-icon-size") === "16px");
-check("the app icon's box is the 35px bar height", tokenValue("--titlebar-icon-box") === "var(--titlebar-height)" && tokenValue("--titlebar-height") === "35px");
-check("the toolbar buttons are 22px", tokenValue("--titlebar-tool-size") === "22px");
-
-const chromeRules = rulesOf(await readFile(path.join(uiDir, "..", "src", "parts", "chrome", "window-chrome.css"), "utf8"));
-check(
-  "an inactive window dims the bar to its inactive text color",
-  declares(bodyOf(chromeRules, ".ws-window-titlebar--inactive"), "color", "var(--titlebar-foreground-inactive)"),
-);
-check(
-  "the window controls divide the zoom factor out to keep their physical size",
-  declares(bodyOf(chromeRules, ".ws-window-titlebar__controls"), "zoom", "calc(1 / var(--ws-zoom-factor, 1))"),
-);
-check(
-  "minimize and maximize hover with the control wash",
-  declares(bodyOf(chromeRules, ".ws-window-titlebar__control--minimize:hover"), "background", "var(--titlebar-control-hover)"),
-);
-check(
-  "close hovers red",
-  declares(bodyOf(chromeRules, ".ws-window-titlebar__control--close:hover"), "background", "var(--titlebar-close-hover)"),
-);
-const iconBody = bodyOf(chromeRules, ".ws-window-titlebar__icon");
-check(
-  "the app icon is 16px, centered in a box the bar's height, flush to the left edge",
-  declares(iconBody, "width", "var(--titlebar-icon-size)") &&
-    declares(iconBody, "height", "var(--titlebar-icon-size)") &&
-    declares(iconBody, "box-sizing", "content-box") &&
-    declares(iconBody, "padding", "calc((var(--titlebar-icon-box) - var(--titlebar-icon-size)) / 2)") &&
-    declares(iconBody, "margin", "0"),
-);
-const toolBody = bodyOf(chromeRules, ".ws-window-titlebar__tool");
-check(
-  "a toolbar button is a 22px square with a 6px-radius toolbar-hover wash",
-  declares(toolBody, "width", "var(--titlebar-tool-size)") &&
-    declares(toolBody, "height", "var(--titlebar-tool-size)") &&
-    declares(bodyOf(chromeRules, ".ws-window-titlebar__tool:hover"), "background", "var(--cursor-toolbar-hover)"),
-);
-
-const centerRules = rulesOf(await readFile(path.join(uiDir, "..", "src", "parts", "chrome", "command-center.css"), "utf8"));
-const folderBody = bodyOf(centerRules, ".ws-command-center__folder");
-check(
-  "the folder-name button is 12px text with 1px 6px padding and a 6px radius",
-  declares(folderBody, "font-size", "var(--font-size-sm)") &&
-    declares(folderBody, "padding", "var(--ws-size-1) var(--ws-size-6)") &&
-    declares(folderBody, "border-radius", "var(--radius)"),
-);
-check(
-  "the folder-name button hovers with the folder wash",
-  declares(bodyOf(centerRules, ".ws-command-center__folder:hover"), "background", "var(--titlebar-folder-hover)"),
-);
-
-// --- Cursor's menu skin, read from the source stylesheet --------------------------
-
-const menuRules = rulesOf(await readFile(path.join(uiDir, "..", "src", "parts", "menu", "window-menu.css"), "utf8"));
-// The menu label's color must come from the bar, or an inactive window dims
-// the folder-name button but leaves the menu labels at the active color.
-// jsdom resolves neither var() nor inherited color, so the contract is read
-// from the sources: the label declares no color but `inherit`, the bar sets
-// the active color, and the inactive rule overrides it on the bar.
-check(
-  "a menubar label inherits its color from the title bar",
-  declares(bodyOf(menuRules, ".ws-window-titlebar__menu"), "color", "inherit"),
-);
-check(
-  "the title bar sets the active label color the labels inherit",
-  declares(bodyOf(chromeRules, ".ws-window-titlebar"), "color", "var(--titlebar-foreground)"),
-);
-const popoverBody = bodyOf(menuRules, ".ws-window-titlebar__popover");
-check(
-  "the menu popover has a 5px radius, an outline instead of a border, and scrolls",
-  declares(popoverBody, "border-radius", "var(--ws-menu-radius)") &&
-    /(?:^|[\s;])outline:\s*var\(--ws-border-width\) solid/.test(popoverBody) &&
-    !/(?:^|[\s;])border:/.test(popoverBody) &&
-    declares(popoverBody, "overflow-y", "auto"),
-);
-check("the menu radius token is 5px", /--ws-menu-radius:\s*var\(--ws-size-5\)/.test(await readFile(path.join(uiDir, "..", "src", "tokens", "component.css"), "utf8")));
-check("a top-level dropdown has no fade", !/(?:^|[\s;])animation:/.test(popoverBody));
-check(
-  "flyouts and context menus keep the 83ms fade",
-  declares(bodyOf(menuRules, ".ws-window-titlebar__popover--flyout"), "animation", "fadeIn 0.083s linear") &&
-    declares(bodyOf(menuRules, ".ws-window-titlebar__popover--context"), "animation", "fadeIn 0.083s linear"),
-);
-check(
-  "reduced motion drops the fade",
-  /@media \(prefers-reduced-motion: reduce\)\s*\{[^@]*animation:\s*none/.test(
-    stripComments(await readFile(path.join(uiDir, "..", "src", "parts", "menu", "window-menu.css"), "utf8")),
-  ),
-);
-
-const itemBody = bodyOf(menuRules, ".ws-window-titlebar__item");
-check("a row has no padding of its own", declares(itemBody, "padding", "0"));
-check(
-  "a row's hover and focus wash is #F0F0F01E, the active background",
-  declares(bodyOf(menuRules, ".ws-window-titlebar__item:hover"), "background", "var(--cursor-bg-active)") &&
-    declares(bodyOf(menuRules, ".ws-window-titlebar__item:focus-visible"), "background", "var(--cursor-bg-active)") &&
-    tokenValue("--cursor-bg-active") === "#F0F0F01E",
-);
-check(
-  "the label is padded 0 2em",
-  declares(bodyOf(menuRules, ".ws-window-titlebar__item-label"), "padding", "0 2em"),
-);
-const shortcutBody = bodyOf(menuRules, ".ws-window-titlebar__shortcut");
-check(
-  "the shortcut is 13px, padded 0 2em, right-aligned, at 0.7 opacity",
-  declares(shortcutBody, "font-size", "var(--font-size-base)") &&
-    declares(shortcutBody, "padding", "0 2em") &&
-    declares(shortcutBody, "margin-inline-start", "auto") &&
-    declares(shortcutBody, "opacity", "0.7"),
-);
-check(
-  "the shortcut is fully opaque on hover",
-  declares(bodyOf(menuRules, ".ws-window-titlebar__item:hover .ws-window-titlebar__shortcut"), "opacity", "1"),
-);
-const checkBody = bodyOf(menuRules, ".ws-window-titlebar__item-check");
-check(
-  "the check mark sits in an absolute 2em left column, in the text color",
-  declares(checkBody, "position", "absolute") &&
-    declares(checkBody, "inset-inline-start", "0") &&
-    declares(checkBody, "width", "2em") &&
-    declares(checkBody, "color", "var(--text)"),
-);
-const chevronBody = bodyOf(menuRules, ".ws-window-titlebar__chevron");
-check(
-  "the submenu chevron is absolute, 9px from the right, at 0.7 opacity",
-  declares(chevronBody, "position", "absolute") &&
-    declares(chevronBody, "inset-inline-end", "var(--ws-size-9)") &&
-    declares(chevronBody, "opacity", "0.7"),
-);
-const disabled = '.ws-window-titlebar__item[aria-disabled="true"]';
-check(
-  "a disabled row is half opaque with a #CCCCCC80 label and a 0.4 shortcut",
-  declares(bodyOf(menuRules, disabled), "opacity", "0.5") &&
-    declares(bodyOf(menuRules, `${disabled} .ws-window-titlebar__item-label`), "color", "var(--menu-disabled-label)") &&
-    declares(bodyOf(menuRules, `${disabled} .ws-window-titlebar__shortcut`), "opacity", "0.4") &&
-    tokenValue("--menu-disabled-label") === "#CCCCCC80",
-);
-
-if (failures.length > 0) {
-  console.error(`titlebar-style: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("titlebar-style: all assertions passed");
diff --git a/crates/workshop/ui/test/token-ring.mjs b/crates/workshop/ui/test/token-ring.mjs
deleted file mode 100644
index 3bd224a46..000000000
--- a/crates/workshop/ui/test/token-ring.mjs
+++ /dev/null
@@ -1,239 +0,0 @@
-// The token ring (src/parts/chrome/token-ring.ts) in jsdom: a 15px SVG gauge
-// (stroke 2, radius 5.5, round line caps) with a track circle and a progress
-// circle whose stroke-dashoffset encodes the context-usage percentage. The
-// default provider stub reports no usage data (null), which hides the ring
-// and drops its value; an injected provider or setPercentage drives the
-// percentages, clamped to 0-100, and null hides the ring again. The
-// stylesheet's side of the contract - the 15px size in a 20px box, the 8%
-// track, hiding below 260px of composer - is read from the source text.
-// Runs under the shared leak check: a TokenRing left undisposed fails.
-// Run: node test/token-ring.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { TokenRing } from "./src/parts/chrome/token-ring.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.Element = dom.window.Element;
-globalThis.Node = dom.window.Node;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-token-ring-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { TokenRing, lifecycle } = await import(pathToFileURL(bundlePath).href);
-
-// The geometry the component fixes: a 15-unit viewBox, radius 5.5, stroke width 2.
-const RADIUS = 5.5;
-const CIRCUMFERENCE = 2 * Math.PI * RADIUS;
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function closeTo(actual, expected) {
-  return Math.abs(actual - expected) < 1e-9;
-}
-
-function circles(ring) {
-  return [...ring.element.querySelectorAll("circle")];
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Structure -------------------------------------------------------------
-
-  {
-    const ring = new TokenRing();
-    document.body.appendChild(ring.element);
-    check(
-      "the ring is an svg with the ws-token-ring class",
-      ring.element.tagName === "svg" &&
-        ring.element.getAttribute("class") === "ws-token-ring",
-    );
-    check(
-      "the svg uses the 15px viewBox",
-      ring.element.getAttribute("viewBox") === "0 0 15 15",
-    );
-    const [background, progress] = circles(ring);
-    check(
-      "the ring renders a background circle then a progress circle",
-      background?.getAttribute("class") === "ws-token-ring-background" &&
-        progress?.getAttribute("class") === "ws-token-ring-progress",
-    );
-    check(
-      "both circles share the center, radius 5.5, and stroke width 2",
-      circles(ring).every(
-        (circle) =>
-          circle.getAttribute("cx") === "7.5" &&
-          circle.getAttribute("cy") === "7.5" &&
-          circle.getAttribute("r") === String(RADIUS) &&
-          circle.getAttribute("stroke-width") === "2",
-      ),
-    );
-    check(
-      "only the progress circle gets the dash wiring and round caps",
-      background?.getAttribute("stroke-dasharray") === null &&
-        closeTo(Number(progress?.getAttribute("stroke-dasharray")), CIRCUMFERENCE) &&
-        progress?.getAttribute("stroke-linecap") === "round",
-    );
-    ring.dispose();
-    ring.element.remove();
-  }
-
-  // --- Accessibility -----------------------------------------------------------
-
-  {
-    const ring = new TokenRing();
-    check(
-      "the ring is a labeled progressbar over 0-100",
-      ring.element.getAttribute("role") === "progressbar" &&
-        ring.element.getAttribute("aria-label") === "Context usage" &&
-        ring.element.getAttribute("aria-valuemin") === "0" &&
-        ring.element.getAttribute("aria-valuemax") === "100",
-    );
-    ring.dispose();
-  }
-
-  // --- The stub: no usage data hides the ring ---------------------------------------
-
-  {
-    const ring = new TokenRing();
-    check("the default provider reports no usage data", ring.percentage === null);
-    check(
-      "with no usage data the ring is hidden and reports no value",
-      ring.element.hasAttribute("hidden") && !ring.element.hasAttribute("aria-valuenow"),
-    );
-    ring.setPercentage(40);
-    check(
-      "usage data shows the ring and its value",
-      !ring.element.hasAttribute("hidden") &&
-        ring.element.getAttribute("aria-valuenow") === "40",
-    );
-    ring.setPercentage(null);
-    check(
-      "null hides the ring again",
-      ring.percentage === null &&
-        ring.element.hasAttribute("hidden") &&
-        !ring.element.hasAttribute("aria-valuenow"),
-    );
-    ring.dispose();
-  }
-
-  // --- Percentages ----------------------------------------------------------------------
-
-  {
-    const ring = new TokenRing(() => 25);
-    const progress = ring.element.querySelector(".ws-token-ring-progress");
-    check(
-      "an injected provider sets the initial percentage and shows the ring",
-      ring.percentage === 25 &&
-        ring.element.getAttribute("aria-valuenow") === "25" &&
-        !ring.element.hasAttribute("hidden"),
-    );
-    check(
-      "25% fills a quarter of the circumference",
-      closeTo(Number(progress?.getAttribute("stroke-dashoffset")), CIRCUMFERENCE * 0.75),
-    );
-
-    ring.setPercentage(50);
-    check(
-      "setPercentage re-renders the arc and the aria value",
-      ring.percentage === 50 &&
-        ring.element.getAttribute("aria-valuenow") === "50" &&
-        closeTo(Number(progress?.getAttribute("stroke-dashoffset")), CIRCUMFERENCE * 0.5),
-    );
-
-    ring.setPercentage(140);
-    check(
-      "percentages above 100 clamp to a full ring",
-      ring.percentage === 100 &&
-        closeTo(Number(progress?.getAttribute("stroke-dashoffset")), 0),
-    );
-
-    ring.setPercentage(-10);
-    check(
-      "percentages below 0 clamp to an empty ring",
-      ring.percentage === 0 &&
-        closeTo(Number(progress?.getAttribute("stroke-dashoffset")), CIRCUMFERENCE),
-    );
-
-    ring.setPercentage(Number.NaN);
-    check(
-      "a non-finite percentage reads as an empty ring",
-      ring.percentage === 0 &&
-        ring.element.getAttribute("aria-valuenow") === "0" &&
-        closeTo(Number(progress?.getAttribute("stroke-dashoffset")), CIRCUMFERENCE),
-    );
-    ring.dispose();
-
-    const nanRing = new TokenRing(() => Number.NaN);
-    check(
-      "a non-finite provider value reads as 0%",
-      nanRing.percentage === 0 &&
-        nanRing.element.getAttribute("aria-valuenow") === "0",
-    );
-    nanRing.dispose();
-
-    const nullRing = new TokenRing(() => null);
-    check("a null provider value is no data", nullRing.percentage === null && nullRing.element.hasAttribute("hidden"));
-    nullRing.dispose();
-  }
-});
-
-// --- The stylesheet --------------------------------------------------------------------
-
-{
-  const css = (await readFile(path.join(testDir, "..", "src", "parts", "chrome", "token-ring.css"), "utf8")).replace(
-    /\/\*[\s\S]*?\*\//g,
-    "",
-  );
-  const lookTokens = await readFile(
-    path.join(testDir, "..", "..", "look", "tokens.css"),
-    "utf8",
-  );
-  check("the ring is 15px", /--token-ring-size:\s*15px/.test(lookTokens) && /inline-size:\s*var\(--token-ring-size\)/.test(css));
-  check("the ring's track is the 8% stroke", /--token-ring-track:\s*var\(--cursor-stroke-tertiary\)/.test(lookTokens));
-  check("the ring sits in a 20px box: the 2.5px margin around the 15px gauge", /margin:\s*var\(--ws-token-ring-margin\)/.test(css));
-  check("the progress arc has round line caps", /stroke-linecap:\s*round/.test(css));
-  check("a ring with no data stays hidden", /\.ws-token-ring\[hidden\]\s*\{\s*display:\s*none/.test(css));
-  check(
-    "the ring hides below 260px of composer",
-    /@container ws-composer \(width < 260px\)\s*\{\s*\.ws-token-ring\s*\{\s*display:\s*none/.test(css),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`ws-token-ring: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-token-ring: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/tool-line.mjs b/crates/workshop/ui/test/tool-line.mjs
deleted file mode 100644
index 55297bbf3..000000000
--- a/crates/workshop/ui/test/tool-line.mjs
+++ /dev/null
@@ -1,348 +0,0 @@
-// The transcript's tool line (src/parts/agent/transcript/tool-line.ts) and its
-// web hover card (web-hover-card.ts) in jsdom, on fake timers. A search or
-// fetch line is not expandable; its card opens 600ms after the pointer
-// settles on it, never while the call loads, lists the result titles and
-// URLs parsed from the search result `{query, results: [...]}`, turns only
-// http(s) URLs into links (a `javascript:` URL stays plain text), closes on
-// leave, Escape, or a link click, and is absent when the result doesn't
-// parse as that shape. A generic tool expands into one block - its
-// arguments as indented JSON, a blank line, then its result - and keeps
-// its open state across updates. While a call loads only the verb
-// shimmers.
-// Run: node test/tool-line.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { mock } from "node:test";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { ToolLine, toolBlockText } from "./src/parts/agent/transcript/tool-line.ts";
-      export { webCardEntries, WEB_CARD_OPEN_DELAY_MS } from "./src/parts/agent/transcript/web-hover-card.ts";
-      export { toolKind, toolLabel } from "./src/parts/agent/transcript/tool-labels.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-tool-line-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { ToolLine, toolBlockText, webCardEntries, WEB_CARD_OPEN_DELAY_MS, toolKind, toolLabel } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-mock.timers.enable({ apis: ["setTimeout"] });
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-/** A tool step the way the model builds one, for a tool of a Pack from `vendor`. */
-function step({ name, tool, vendor = "runvil", args = {}, result = null, loading = false }) {
-  const call = { id: "c1", name, tool, vendor, args: args === "" ? "" : JSON.stringify(args) };
-  return {
-    step: "tool",
-    key: "c:0:c1",
-    call,
-    toolKind: toolKind(`${vendor}/${tool}`),
-    result,
-    loading,
-    label: toolLabel(call, loading),
-  };
-}
-
-const searchResult = JSON.stringify({
-  query: "q",
-  results: [
-    { title: "Alpha <b>docs</b>", url: "https://alpha.test/docs", description: "d" },
-    { title: "Beta", url: "javascript:alert(1)", description: "" },
-    { title: "Gamma", url: "file:///etc/passwd", description: "" },
-    { url: "http://delta.test/" },
-  ],
-});
-
-function mount(initial) {
-  const line = new ToolLine();
-  document.body.appendChild(line.element);
-  line.update(initial);
-  const header = line.element.querySelector(".ws-collapsible__header");
-  const hover = () => header.dispatchEvent(new window.MouseEvent("mouseenter"));
-  const leave = () => header.dispatchEvent(new window.MouseEvent("mouseleave"));
-  const card = () => document.querySelector(".ws-web-card");
-  const dispose = () => {
-    line.dispose();
-    line.element.remove();
-    card()?.remove();
-  };
-  return { line, header, hover, leave, card, dispose };
-}
-
-// --- The card parses the result ----------------------------------------------------------
-
-{
-  check(
-    "a search result lists a title and URL per result, a missing title falling back to the URL",
-    JSON.stringify(webCardEntries("search", '{"query":"q"}', searchResult)) ===
-      JSON.stringify([
-        { title: "Alpha <b>docs</b>", url: "https://alpha.test/docs" },
-        { title: "Beta", url: "javascript:alert(1)" },
-        { title: "Gamma", url: "file:///etc/passwd" },
-        { title: "http://delta.test/", url: "http://delta.test/" },
-      ]),
-  );
-  check("a search with no result yet has no card", webCardEntries("search", "{}", null) === null);
-  check("a result that isn't JSON has no card", webCardEntries("search", "{}", "plain text") === null);
-  check("a result without a results array has no card", webCardEntries("search", "{}", '{"query":"q"}') === null);
-  check("an empty results array has no card", webCardEntries("search", "{}", '{"results":[]}') === null);
-  check(
-    "results that carry no URL are skipped",
-    webCardEntries("search", "{}", '{"results":[{"title":"x"},{"title":"y","url":"https://y.test/"}]}')?.length === 1,
-  );
-  check(
-    "a fetch lists the URL it was asked for",
-    JSON.stringify(webCardEntries("fetch", '{"url":"https://page.test/"}', null)) ===
-      JSON.stringify([{ title: "https://page.test/", url: "https://page.test/" }]),
-  );
-  check("a fetch with no url argument has no card", webCardEntries("fetch", "{}", null) === null);
-}
-
-// --- Hover: 600ms, enabled only when settled, closing -----------------------------------------
-
-{
-  const search = (extra) => step({ name: "search", tool: "web/search", args: { query: "q" }, ...extra });
-  const { line, header, hover, leave, card, dispose } = mount(search({ result: searchResult }));
-
-  check("a search line isn't expandable: no role, no chevron", header.getAttribute("role") === null && line.element.dataset.expandable === "false");
-  check("a search line reads Searched web with its query", header.textContent.includes("Searched web") && header.textContent.includes("q"));
-
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS - 1);
-  check("the card is not open before 600ms", card() === null);
-  mock.timers.tick(1);
-  check("the card opens at 600ms", card() !== null);
-  const entries = [...card().querySelectorAll(".ws-web-card__entry")];
-  check("the card lists every result", entries.length === 4);
-  const links = [...card().querySelectorAll("a")];
-  check(
-    "only http and https URLs become links",
-    links.length === 2 &&
-      links[0].getAttribute("href") === "https://alpha.test/docs" &&
-      links[1].getAttribute("href") === "http://delta.test/",
-  );
-  check(
-    "a javascript: or file: URL stays plain, unclickable text",
-    document.querySelector('a[href^="javascript"]') === null &&
-      entries[1].querySelector("span.ws-web-card__title")?.textContent === "Beta" &&
-      entries[1].querySelector(".ws-web-card__url")?.textContent === "javascript:alert(1)" &&
-      entries[2].querySelector("a") === null,
-  );
-  check(
-    "titles are text, never markup",
-    card().querySelector("b") === null && links[0].textContent === "Alpha <b>docs</b>",
-  );
-  check("a link is not draggable", links[0].draggable === false);
-
-  const opened = [];
-  links[0].addEventListener("click", (event) => {
-    event.preventDefault();
-    opened.push(event.target.href);
-  });
-  links[0].click();
-  check("clicking a link opens it and closes the card", opened.length === 1 && card() === null);
-
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  leave();
-  check("the card survives the moment after the pointer leaves the line", card() !== null);
-  mock.timers.tick(200);
-  check("the card closes once the pointer has left", card() === null);
-
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  leave();
-  card().dispatchEvent(new window.MouseEvent("mouseenter"));
-  mock.timers.tick(500);
-  check("reaching the card keeps it open", card() !== null);
-  card().dispatchEvent(new window.MouseEvent("mouseleave"));
-  mock.timers.tick(200);
-  check("leaving the card closes it", card() === null);
-
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  document.dispatchEvent(new window.KeyboardEvent("keydown", { key: "Escape" }));
-  check("Escape closes the card", card() === null);
-
-  hover();
-  leave();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check("leaving before 600ms cancels the open", card() === null);
-  dispose();
-}
-
-{
-  const search = (extra) => step({ name: "search", tool: "web/search", args: { query: "q" }, ...extra });
-  const { line, hover, card, dispose } = mount(search({ loading: true }));
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS * 2);
-  check("the card is disabled while the call loads", card() === null);
-  line.update(search({ result: searchResult }));
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check("the same line opens its card once the call finishes", card() !== null);
-  line.update(search({ loading: true, result: searchResult }));
-  check("a call that starts loading closes an open card", card() === null);
-  dispose();
-}
-
-{
-  const { hover, card, header, dispose } = mount(
-    step({ name: "search", tool: "web/search", args: { query: "q" }, result: "no results found" }),
-  );
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check(
-    "a result that doesn't parse as search results gives no card, and the line stays plain",
-    card() === null && header.getAttribute("role") === null && header.textContent.includes("Searched web"),
-  );
-  dispose();
-}
-
-{
-  const { hover, card, dispose } = mount(
-    step({ name: "fetch", tool: "web/fetch", args: { url: "https://page.test/a" }, result: "<html>" }),
-  );
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check(
-    "a fetch's card lists its URL as a link",
-    card()?.querySelectorAll("a").length === 1 && card().querySelector("a").getAttribute("href") === "https://page.test/a",
-  );
-  dispose();
-}
-
-{
-  const { hover, card, dispose } = mount(
-    step({ name: "fetch", tool: "web/fetch", args: { url: "javascript:alert(1)" }, result: "x" }),
-  );
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check(
-    "a fetch of a non-http URL lists it as plain text",
-    card() !== null && card().querySelector("a") === null && card().textContent.includes("javascript:alert(1)"),
-  );
-  dispose();
-}
-
-// --- The generic block ---------------------------------------------------------------------
-
-{
-  const generic = (extra) => step({ name: "read", tool: "fs/read", args: { path: "a" }, ...extra });
-  const { line, header, dispose } = mount(generic({}));
-  check(
-    "a generic tool with arguments is expandable",
-    header.getAttribute("role") === "button" && header.getAttribute("aria-expanded") === "false",
-  );
-  check(
-    "its block holds the arguments as indented JSON",
-    line.element.querySelector(".ws-tool-block__pre").textContent === '{\n  "path": "a"\n}',
-  );
-  header.click();
-  line.update(generic({ result: "contents <i>here</i>" }));
-  check(
-    "a result lands after the arguments and a blank line, in an open block that stayed open",
-    line.element.dataset.open === "true" &&
-      line.element.querySelector(".ws-tool-block__pre").textContent === '{\n  "path": "a"\n}\n\ncontents <i>here</i>' &&
-      line.element.querySelector("i") === null,
-  );
-  header.click();
-  line.update(generic({ result: "contents <i>here</i>", loading: false }));
-  check("a block the operator closed stays closed across an update", line.element.dataset.open === "false");
-  dispose();
-}
-
-{
-  const bare = step({ name: "ping", tool: "net/ping", args: "" });
-  const { header, dispose } = mount(bare);
-  check("a generic tool with no arguments and no result has nothing to open", header.getAttribute("role") === null);
-  check("a block with neither arguments nor result is empty text", toolBlockText(bare) === "");
-  dispose();
-}
-
-{
-  const raw = step({ name: "odd", tool: "x/odd", args: "" });
-  raw.call = { ...raw.call, args: "not json" };
-  check("arguments that don't parse show as given", toolBlockText({ ...raw, result: "r" }) === "not json\n\nr");
-  check("a result alone is the whole block", toolBlockText({ ...step({ name: "n", tool: "x/n", args: "" }), result: "only" }) === "only");
-}
-
-// --- The verb shimmers, nothing else ----------------------------------------------------------
-
-{
-  const generic = (loading) => step({ name: "read", tool: "fs/read", args: { path: "a" }, loading });
-  const { line, dispose } = mount(generic(true));
-  const action = line.element.querySelector(".ws-collapsible__action");
-  const details = line.element.querySelector(".ws-collapsible__details");
-  const call = line.element.querySelector(".ws-collapsible__call");
-  check(
-    "while loading the verb shimmers in the tool tone and nothing else does",
-    action.classList.contains("ws-shimmer-text") &&
-      action.classList.contains("ws-shimmer-text--tool") &&
-      !details.classList.contains("ws-shimmer-text") &&
-      !call.classList.contains("ws-shimmer-text") &&
-      line.element.dataset.loading === "true",
-  );
-  line.update(generic(false));
-  check(
-    "the shimmer stops when the call finishes",
-    !action.classList.contains("ws-shimmer-text") && line.element.dataset.loading === "false",
-  );
-  check("the line has no icon, dot, or badge", line.element.querySelectorAll("img, .ws-badge, .ws-dot").length === 0);
-  dispose();
-}
-
-// --- Ask lines --------------------------------------------------------------------------------
-
-{
-  const ask = (loading) => step({ name: "ask", tool: "user-input/ask", args: { question: "?" }, loading });
-  const { line, header, hover, card, dispose } = mount(ask(true));
-  check(
-    "an ask line reads Asking questions with no details",
-    header.textContent.startsWith("Asking questions") && line.element.dataset.toolKind === "ask",
-  );
-  line.update(ask(false));
-  hover();
-  mock.timers.tick(WEB_CARD_OPEN_DELAY_MS);
-  check(
-    "an ask line reads Asked questions, isn't expandable, and opens no card",
-    header.textContent.startsWith("Asked questions") && header.getAttribute("role") === null && card() === null,
-  );
-  dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`tool-line: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("tool-line: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/transcript-model.mjs b/crates/workshop/ui/test/transcript-model.mjs
deleted file mode 100644
index fd2bb5da9..000000000
--- a/crates/workshop/ui/test/transcript-model.mjs
+++ /dev/null
@@ -1,832 +0,0 @@
-// The agent transcript model (src/parts/agent/transcript/transcript-model.ts
-// and tool-labels.ts), pure and DOM-free: session items in, turns, rows,
-// and a tail status out. Covers the turn rules (a result joining its
-// call's turn across a steering message, the open batch loading
-// whichever turn holds it, and an ended batch never loading), every
-// grouping case, the stable row keys, the group summary grammar and
-// plurals, tool verbs and details, the loading rule, thought labels
-// (including title-only thinking), and every tail-status rule.
-// Run: node test/transcript-model.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { buildTranscript, thoughtLabel } from "./src/parts/agent/transcript/transcript-model.ts";
-      export { toolLabel, toolKind, isToolLoading, groupSummary } from "./src/parts/agent/transcript/tool-labels.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-transcript-model-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { buildTranscript, thoughtLabel, toolLabel, toolKind, isToolLoading, groupSummary } =
-  await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-function same(name, actual, expected) {
-  if (!isDeepStrictEqual(actual, expected)) {
-    failures.push(`${name}: got ${JSON.stringify(actual)}, wanted ${JSON.stringify(expected)}`);
-  }
-}
-
-// --- Item builders ------------------------------------------------------------
-
-const user = (text) => ({ kind: "user", text });
-const reply = (text, n, pending = false) => ({ kind: "reply", text, model: null, pending, reply: n });
-const thought = (text, n, { pending = false, startedAt = 0, endedAt = null } = {}) => ({
-  kind: "reasoning",
-  text,
-  model: null,
-  pending,
-  reply: n,
-  startedAt,
-  endedAt,
-});
-// A thought that ran `ms` milliseconds and settled.
-const thoughtFor = (text, n, ms) => thought(text, n, { startedAt: 1000, endedAt: 1000 + ms });
-// A call to `tool` of a Pack from `vendor`; a bound tool's vendor is runvil unless named.
-const call = (id, name, tool, args = {}, vendor = tool === null ? null : "runvil") => ({
-  id,
-  name,
-  tool,
-  vendor,
-  args: JSON.stringify(args),
-});
-const batch = (...calls) => ({ kind: "tool-call", calls, text: "", model: null, ended: false });
-// A batch whose work is over, as the service marks it.
-const endedBatch = (...calls) => ({ ...batch(...calls), ended: true });
-const result = (id, text = "ok") => ({ kind: "tool-result", toolCallId: id, text });
-const failure = (message) => ({ kind: "error", message, title: null });
-
-const search = (id, query = "q") => call(id, "search", "web/search", { query });
-const fetchCall = (id, url = "https://example.com/") => call(id, "fetch", "web/fetch", { url });
-const generic = (id, name = "read", tool = "fs/read") => call(id, name, tool, { path: "a" });
-const ask = (id) => call(id, "ask", "user-input/ask", { question: "?" });
-
-const rowsOf = (model, turn = 0) => model.turns[turn].rows;
-const kindsOf = (model, turn = 0) => rowsOf(model, turn).map((row) => row.kind);
-const keysOf = (model, turn = 0) => rowsOf(model, turn).map((row) => row.key);
-
-// --- Turns ------------------------------------------------------------------
-
-{
-  const none = buildTranscript([], false, false);
-  check("no items give no turns and no tail", none.turns.length === 0 && none.tail === null);
-
-  const model = buildTranscript(
-    [user("one"), reply("a", 0), user("two"), reply("b", 1)],
-    false,
-    false,
-  );
-  check("each user item starts a turn", model.turns.length === 2);
-  same("a turn's rows start with its human row", [kindsOf(model, 0), kindsOf(model, 1)], [
-    ["human", "markdown"],
-    ["human", "markdown"],
-  ]);
-  same("human rows key by item index, replies by reply id", [keysOf(model, 0), keysOf(model, 1)], [
-    ["h:0", "r:0"],
-    ["h:2", "r:1"],
-  ]);
-  check("a human row holds the text byte-exact", rowsOf(model, 0)[0].text === "one");
-
-  const lead = buildTranscript([reply("hello", 0), user("x")], false, false);
-  check(
-    "items before the first user item form a turn with no human row",
-    lead.turns.length === 2 && rowsOf(lead, 0)[0].kind === "markdown",
-  );
-
-  const frozen = Object.freeze([Object.freeze(user("x")), Object.freeze(reply("y", 0))]);
-  check("the model never mutates its input", buildTranscript(frozen, true, false).turns.length === 1);
-}
-
-// --- Tool results attach by id within the turn and never become rows -----------
-
-{
-  const items = [
-    user("go"),
-    batch(generic("c1")),
-    result("c1", "file body"),
-    reply("done", 1),
-    user("again"),
-    batch(generic("c1")),
-  ];
-  const model = buildTranscript(items, true, false);
-  const first = rowsOf(model, 0)[1];
-  check("a lone tool call becomes a tool row", first.kind === "tool");
-  check(
-    "its result attached and stopped it loading",
-    first.step.result === "file body" && first.step.loading === false,
-  );
-  check("a result never becomes a row", kindsOf(model, 0).join() === "human,tool,markdown");
-  const second = rowsOf(model, 1)[1];
-  check(
-    "a recycled id in another turn does not take the earlier turn's result",
-    second.step.result === null && second.step.loading === true,
-  );
-  check(
-    "a result with no call, or no id, is ignored",
-    buildTranscript([user("x"), result("zzz"), { kind: "tool-result", toolCallId: null, text: "t" }], false, false)
-      .turns[0].rows.length === 1,
-  );
-}
-
-// --- A steering message: results join their call's turn, and the open batch loads ---
-
-{
-  const steered = buildTranscript(
-    [user("go"), batch(generic("c1")), user("steer"), result("c1", "file body")],
-    true,
-    false,
-  );
-  const first = rowsOf(steered, 0)[1];
-  check(
-    "a result after a steering message attaches to its call in the earlier turn",
-    first.step.result === "file body" && first.step.loading === false,
-  );
-  same("the steering turn holds only its human row", kindsOf(steered, 1), ["human"]);
-
-  const running = buildTranscript([user("go"), batch(search("c1", "rust")), user("steer")], true, false);
-  check(
-    "the open batch's call shows loading in the earlier turn that holds it",
-    rowsOf(running, 0)[1].step.loading === true,
-  );
-  same("the tail reads the open batch's running call", running.tail, {
-    kind: "tool",
-    action: "Searching web",
-    details: "rust",
-    callName: null,
-    inGroup: false,
-  });
-  check(
-    "the open batch stops loading when generating stops",
-    rowsOf(buildTranscript([user("go"), batch(search("c1")), user("steer")], false, false), 0)[1].step
-      .loading === false,
-  );
-
-  const half = buildTranscript(
-    [user("go"), batch(search("c1"), generic("c2", "read", "fs/read")), user("steer"), result("c1")],
-    true,
-    false,
-  );
-  same(
-    "a call answered after the steer stops loading while its sibling keeps loading",
-    rowsOf(half, 0)[1].steps.map((step) => step.loading),
-    [false, true],
-  );
-  check(
-    "the tail reads the sibling still running",
-    half.tail.kind === "tool" && half.tail.action === "Running" && half.tail.details === "read in fs",
-  );
-
-  const recycled = buildTranscript(
-    [
-      user("go"),
-      batch(generic("call_1")),
-      result("call_1", "first"),
-      user("next"),
-      batch(generic("call_1")),
-      result("call_1", "second"),
-    ],
-    false,
-    false,
-  );
-  same(
-    "a recycled id's result joins the latest call with that id",
-    [rowsOf(recycled, 0)[1].step.result, rowsOf(recycled, 1)[1].step.result],
-    ["first", "second"],
-  );
-
-  const stale = buildTranscript(
-    [user("a"), batch(search("c1")), user("b"), batch(generic("c2")), result("c2")],
-    true,
-    false,
-  );
-  check(
-    "only the open batch loads: a call left unanswered before a later batch does not",
-    rowsOf(stale, 0)[1].step.loading === false,
-  );
-
-  // A stop dropped the call, so it never gets a result, and its batch ended.
-  const dropped = buildTranscript([user("go"), endedBatch(search("c1", "rust")), user("next")], true, false);
-  check(
-    "an ended batch is not the open batch: its unanswered call does not load in the earlier turn",
-    rowsOf(dropped, 0)[1].step.loading === false,
-  );
-  check("the tail plans instead of naming an ended batch's call", dropped.tail?.kind === "planning");
-  check(
-    "an ended batch's unanswered call does not load in the last turn either",
-    rowsOf(buildTranscript([user("go"), endedBatch(search("c1"))], true, false), 0)[1].step.loading === false,
-  );
-}
-
-// --- Grouping ---------------------------------------------------------------------
-
-{
-  // One tool call and nothing else: a tool row keyed by turn and call id.
-  const one = buildTranscript([user("q"), batch(generic("c1")), result("c1")], false, false);
-  same("one call becomes a tool row", kindsOf(one), ["human", "tool"]);
-  same("a tool step keys by turn and call id", keysOf(one), ["h:0", "c:0:c1"]);
-
-  // Thinking only becomes a thought row keyed by its first thought.
-  const thinking = buildTranscript([user("q"), thoughtFor("hmm", 0, 2000)], false, false);
-  same("thinking only becomes a thought row", kindsOf(thinking), ["human", "thought"]);
-  same("a thought keys by reply id", keysOf(thinking), ["h:0", "t:0"]);
-  check("a thought row holds each thought", rowsOf(thinking)[1].thoughts.length === 1);
-
-  // Thinking plus a call: a group that takes its first step's key.
-  const mixed = buildTranscript(
-    [user("q"), thoughtFor("hmm", 0, 2000), batch(generic("c1")), result("c1")],
-    false,
-    false,
-  );
-  same("thinking plus a call becomes a group", kindsOf(mixed), ["human", "group"]);
-  same("a group takes its first step's key", keysOf(mixed), ["h:0", "t:0"]);
-  same(
-    "group steps keep their order",
-    rowsOf(mixed)[1].steps.map((step) => step.step),
-    ["thought", "tool"],
-  );
-
-  // A batch splits into one step per call; two calls make a group.
-  const two = buildTranscript(
-    [user("q"), batch(search("c1"), fetchCall("c2")), result("c1"), result("c2")],
-    false,
-    false,
-  );
-  same("a two-call batch is one group", kindsOf(two), ["human", "group"]);
-  same("the group takes the first call's key", keysOf(two), ["h:0", "c:0:c1"]);
-  same("each call is its own step", rowsOf(two)[1].steps.map((step) => step.key), ["c:0:c1", "c:0:c2"]);
-
-  // Rounds append to the open group.
-  const rounds = buildTranscript(
-    [
-      user("q"),
-      thoughtFor("a", 0, 1000),
-      batch(generic("c1")),
-      result("c1"),
-      thoughtFor("b", 1, 1000),
-      batch(generic("c2")),
-      result("c2"),
-    ],
-    false,
-    false,
-  );
-  same("rounds append to one open group", kindsOf(rounds), ["human", "group"]);
-  check("the group holds all four steps", rowsOf(rounds)[1].steps.length === 4);
-
-  // A reply closes the group; the next round opens another.
-  const split = buildTranscript(
-    [
-      user("q"),
-      batch(search("c1"), search("c2")),
-      result("c1"),
-      result("c2"),
-      reply("so far", 1),
-      batch(generic("c3")),
-      result("c3"),
-      batch(generic("c4")),
-      result("c4"),
-    ],
-    false,
-    false,
-  );
-  same("a reply closes the open group", kindsOf(split), ["human", "group", "markdown", "group"]);
-
-  // An error closes the group and renders no row of its own.
-  const errored = buildTranscript(
-    [user("q"), batch(generic("c1")), result("c1"), failure("boom"), batch(generic("c2")), result("c2")],
-    false,
-    false,
-  );
-  same("an error closes the group and is not a row", kindsOf(errored), ["human", "tool", "tool"]);
-
-  // A user item closes the group by starting the next turn.
-  const turns = buildTranscript(
-    [user("q"), batch(generic("c1")), result("c1"), user("r"), batch(generic("c2")), result("c2")],
-    false,
-    false,
-  );
-  same("a user item closes the group", [kindsOf(turns, 0), kindsOf(turns, 1)], [
-    ["human", "tool"],
-    ["human", "tool"],
-  ]);
-  same("a tool step keys by its turn number", [keysOf(turns, 0)[1], keysOf(turns, 1)[1]], [
-    "c:0:c1",
-    "c:1:c2",
-  ]);
-}
-
-// --- Ask-tool calls are always standalone ------------------------------------------
-
-{
-  const model = buildTranscript(
-    [
-      user("q"),
-      batch(search("c1"), fetchCall("c2"), ask("c3")),
-      result("c1"),
-      result("c2"),
-      result("c3", "the answer"),
-      batch(generic("c4")),
-      result("c4"),
-    ],
-    false,
-    false,
-  );
-  same("an ask call closes the group and stands alone", kindsOf(model), [
-    "human",
-    "group",
-    "tool",
-    "tool",
-  ]);
-  check(
-    "the ask row holds the ask step",
-    rowsOf(model)[2].step.label.action === "Asked questions" &&
-      rowsOf(model)[2].step.result === "the answer",
-  );
-
-  const lone = buildTranscript([user("q"), batch(ask("c1"))], false, false);
-  same("a lone ask is a tool row", kindsOf(lone), ["human", "tool"]);
-  const withThought = buildTranscript(
-    [user("q"), thoughtFor("hm", 0, 1000), batch(ask("c1"))],
-    false,
-    false,
-  );
-  same("thinking before an ask settles as its own thought row", kindsOf(withThought), [
-    "human",
-    "thought",
-    "tool",
-  ]);
-
-  const foreign = buildTranscript(
-    [
-      user("q"),
-      batch(
-        call("c1", "ask", "user-input/ask", {}, "acme"),
-        call("c2", "ask", "runvil/user-input/ask", {}, null),
-        call("c3", "ask", "adhoc/ask", {}, null),
-      ),
-    ],
-    false,
-    false,
-  );
-  same("an ask from another vendor, without a vendor, or adhoc groups as ordinary tools", kindsOf(foreign), [
-    "human",
-    "group",
-  ]);
-  same(
-    "each such ask is an ordinary tool step",
-    rowsOf(foreign)[1].steps.map((step) => step.toolKind),
-    ["other", "other", "other"],
-  );
-}
-
-// --- Keys: stable across pending and durable, unique within a turn ----------------
-
-{
-  const pending = buildTranscript(
-    [user("q"), thought("hm", 3, { pending: true }), reply("par", 3, true)],
-    true,
-    false,
-  );
-  const settled = buildTranscript(
-    [user("q"), thoughtFor("hmm", 3, 1500), reply("partial done", 3)],
-    true,
-    false,
-  );
-  same("pending and durable rows share keys", keysOf(pending), keysOf(settled));
-  same("the keys are the reply ids", keysOf(settled), ["h:0", "t:3", "r:3"]);
-
-  // A recycled call id inside one turn gets a distinct key.
-  const recycled = buildTranscript(
-    [user("q"), batch(generic("call_1")), result("call_1"), batch(generic("call_1")), result("call_1", "second")],
-    false,
-    false,
-  );
-  const keys = rowsOf(recycled)[1].steps.map((step) => step.key);
-  check("recycled ids within a turn keep unique keys", keys.length === 2 && keys[0] !== keys[1]);
-  check("the first occurrence keeps the plain key", keys[0] === "c:0:call_1");
-  check(
-    "each recycled call takes its own result",
-    rowsOf(recycled)[1].steps[0].result === "ok" && rowsOf(recycled)[1].steps[1].result === "second",
-  );
-
-  // A call with no id falls back to the item index (and position in the batch).
-  const noId = buildTranscript([user("q"), batch(generic(""), generic(""))], false, false);
-  const noIdKeys = rowsOf(noId)[1].steps.map((step) => step.key);
-  check(
-    "calls with no id key by item index, distinct per call",
-    noIdKeys[0] !== noIdKeys[1] && noIdKeys.every((key) => key.startsWith("c:0:") && key.includes("1")),
-  );
-
-  // Growth keeps every earlier key.
-  const base = [user("q"), reply("a", 0), user("r")];
-  const before = buildTranscript(base, true, false);
-  const after = buildTranscript([...base, thought("hm", 1, { pending: true })], true, false);
-  same("appending items keeps earlier keys", keysOf(after, 0), keysOf(before, 0));
-
-  // Rows with nothing to show are dropped.
-  const blank = buildTranscript([user("q"), reply("  \n", 0, true), thoughtFor("  ", 1, 1000)], true, false);
-  same("blank replies and settled blank thoughts render no row", kindsOf(blank), ["human"]);
-}
-
-// --- Group summary: verb, parts, plurals, order -------------------------------------
-
-{
-  const summaryOf = (calls, { generating = false, tail = [] } = {}) => {
-    const model = buildTranscript(
-      [user("q"), batch(...calls), ...calls.map((c) => result(c.id)), ...tail],
-      generating,
-      false,
-    );
-    return rowsOf(model)[1].summary;
-  };
-  same("two searches", summaryOf([search("a"), search("b")]), { action: "Explored", details: "2 searches" });
-  same("one search and one fetch", summaryOf([search("a"), fetchCall("b")]), {
-    action: "Explored",
-    details: "1 search, 1 fetch",
-  });
-  same("fetch plurals", summaryOf([fetchCall("a"), fetchCall("b"), fetchCall("c")]).details, "3 fetches");
-  same("one tool", summaryOf([search("a"), generic("b")]).details, "1 search, 1 tool");
-  same(
-    "parts run search, fetch, tool whatever the call order",
-    summaryOf([generic("a"), generic("b"), fetchCall("c"), search("d"), search("e"), generic("f")]).details,
-    "2 searches, 1 fetch, 3 tools",
-  );
-  check("the parts have no 'and'", !summaryOf([search("a"), fetchCall("b"), generic("c")]).details.includes("and"));
-
-  const withThinking = buildTranscript(
-    [user("q"), thoughtFor("a", 0, 1000), batch(search("a"), generic("b")), result("a"), result("b")],
-    false,
-    false,
-  );
-  check(
-    "thinking steps are not counted",
-    rowsOf(withThinking)[1].summary.details === "1 search, 1 tool",
-  );
-
-  check(
-    "the verb is Exploring while the group is the last row of a generating turn",
-    summaryOf([search("a"), search("b")], { generating: true }).action === "Exploring",
-  );
-  check(
-    "the verb is Explored once the turn stops generating",
-    summaryOf([search("a"), search("b")], { generating: false }).action === "Explored",
-  );
-  check(
-    "the verb is Explored when a row follows the group",
-    summaryOf([search("a"), search("b")], { generating: true, tail: [reply("hi", 5, true)] }).action ===
-      "Explored",
-  );
-  const earlier = buildTranscript(
-    [user("q"), batch(search("a"), search("b")), result("a"), result("b"), user("next")],
-    true,
-    false,
-  );
-  check("a group in an earlier turn is Explored", rowsOf(earlier, 0)[1].summary.action === "Explored");
-
-  // The exported summary helper alone.
-  same("groupSummary builds its parts", groupSummary({ searches: 1, fetches: 2, tools: 1 }, true), {
-    action: "Exploring",
-    details: "1 search, 2 fetches, 1 tool",
-  });
-  same("groupSummary omits zero parts", groupSummary({ searches: 0, fetches: 0, tools: 2 }, false), {
-    action: "Explored",
-    details: "2 tools",
-  });
-}
-
-// --- Tool verbs and details ------------------------------------------------------------
-
-{
-  same(
-    "tool kinds of vendor-qualified names",
-    [
-      "runvil/web/search",
-      "runvil/web/fetch",
-      "runvil/user-input/ask",
-      "runvil/fs/read",
-      "acme/user-input/ask",
-      "acme/web/search",
-      "adhoc/ask",
-      null,
-    ].map(toolKind),
-    ["search", "fetch", "ask", "other", "other", "other", "other", "other"],
-  );
-  same(
-    "a call is special only under the runvil vendor",
-    [
-      call("a", "ask", "user-input/ask", {}, "acme"),
-      call("a", "search", "web/search", { query: "q" }, "acme"),
-      call("a", "ask", "runvil/user-input/ask", {}, null),
-      call("a", "ask", "adhoc/ask", {}, null),
-    ].map((row) => toolLabel(row, false)),
-    [
-      { action: "Ran", details: "ask in user-input", callName: "ask" },
-      { action: "Ran", details: "search in web", callName: "search" },
-      { action: "Ran", details: "ask in runvil", callName: "ask" },
-      { action: "Ran", details: "ask in adhoc", callName: "ask" },
-    ],
-  );
-  same("web/search running", toolLabel(search("a", "rust async"), true), {
-    action: "Searching web",
-    details: "rust async",
-    callName: null,
-  });
-  same("web/search done", toolLabel(search("a", "rust async"), false), {
-    action: "Searched web",
-    details: "rust async",
-    callName: null,
-  });
-  same("web/fetch running", toolLabel(fetchCall("a", "https://x.dev/p"), true), {
-    action: "Fetching page",
-    details: "https://x.dev/p",
-    callName: null,
-  });
-  same("web/fetch done", toolLabel(fetchCall("a", "https://x.dev/p"), false).action, "Fetched page");
-  same("ask running and done", [toolLabel(ask("a"), true), toolLabel(ask("a"), false)], [
-    { action: "Asking questions", details: "", callName: null },
-    { action: "Asked questions", details: "", callName: null },
-  ]);
-  same("a generic tool names the call and its namespace", toolLabel(generic("a", "read", "fs/read"), false), {
-    action: "Ran",
-    details: "read in fs",
-    callName: "read",
-  });
-  same("a generic tool running", toolLabel(generic("a", "read", "fs/read"), true).action, "Running");
-  same("an adhoc call names the call and the adhoc Pack", toolLabel(call("a", "grab", "adhoc/grab", {}, null), false), {
-    action: "Ran",
-    details: "grab in adhoc",
-    callName: "grab",
-  });
-  same("a call the wire did not stamp shows its name alone", toolLabel(call("a", "unstamped", null), false), {
-    action: "Ran",
-    details: "unstamped",
-    callName: "unstamped",
-  });
-  same(
-    "malformed or missing arguments give empty details",
-    [
-      toolLabel({ id: "a", name: "search", tool: "web/search", vendor: "runvil", args: "not json" }, false).details,
-      toolLabel({ id: "a", name: "search", tool: "web/search", vendor: "runvil", args: "" }, false).details,
-      toolLabel({ id: "a", name: "search", tool: "web/search", vendor: "runvil", args: '{"query": 5}' }, false).details,
-      toolLabel({ id: "a", name: "fetch", tool: "web/fetch", vendor: "runvil", args: "[]" }, false).details,
-    ],
-    ["", "", "", ""],
-  );
-}
-
-// --- Loading ----------------------------------------------------------------------------
-
-{
-  same(
-    "loading: no result and a generating last turn",
-    [
-      isToolLoading("other", false, { last: true, generating: true }),
-      isToolLoading("other", true, { last: true, generating: true }),
-      isToolLoading("other", false, { last: true, generating: false }),
-      isToolLoading("other", false, { last: false, generating: false }),
-    ],
-    [true, false, false, false],
-  );
-  same(
-    "loading: an ask without a result waits even while generating is off",
-    [
-      isToolLoading("ask", false, { last: true, generating: false }),
-      isToolLoading("ask", true, { last: true, generating: false }),
-      isToolLoading("ask", false, { last: false, generating: false }),
-    ],
-    [true, false, false],
-  );
-
-  const waiting = buildTranscript([user("q"), batch(ask("c1"))], false, false);
-  check("an unanswered ask row is loading with generating off", rowsOf(waiting)[1].step.loading === true);
-  const running = buildTranscript([user("q"), batch(search("c1"))], true, false);
-  check("a running search row is loading", rowsOf(running)[1].step.loading === true);
-  const stopped = buildTranscript([user("q"), batch(search("c1"))], false, false);
-  check("a call with no result stops loading when generating stops", rowsOf(stopped)[1].step.loading === false);
-}
-
-// --- Thought labels ------------------------------------------------------------------------
-
-{
-  const label = (text, durationMs, streaming = false) =>
-    thoughtLabel([{ text, durationMs, streaming }]);
-  same("streaming thinking", label("hm", null, true), { action: "Thinking", details: null });
-  same("unknown duration", label("hm", null), { action: "Thought", details: "briefly" });
-  same("zero duration", label("hm", 0), { action: "Thought", details: "briefly" });
-  same("under 500ms", label("hm", 499), { action: "Thought", details: "briefly" });
-  same("4 seconds", label("hm", 4000), { action: "Thought", details: "4s" });
-  same("300 seconds, never minutes", label("hm", 300000), { action: "Thought", details: "300s" });
-  same("rounds to the nearest second", label("hm", 4400), { action: "Thought", details: "4s" });
-  check("the label never says 'for'", !label("hm", 4000).details.includes("for"));
-
-  // Title-only thinking: the last title replaces "Thought".
-  same("a bold title replaces Thought", label("**Planning the fix**", 4000), {
-    action: "Planning the fix",
-    details: "4s",
-  });
-  same("a heading title replaces Thought", label("# Checking files\n\n", 2000), {
-    action: "Checking files",
-    details: "2s",
-  });
-  same("the last title wins", label("**First**\n\n## Second\n", 3000).action, "Second");
-  same("title-only details are none under 500ms", label("**Quick**", 300), { action: "Quick", details: null });
-  same("title-only details are none when the duration is unknown", label("**Quick**", null), {
-    action: "Quick",
-    details: null,
-  });
-  same("a title plus body text is not title-only", label("**Plan**\nsome real thinking", 4000), {
-    action: "Thought",
-    details: "4s",
-  });
-  same("two bold spans on one line are body text, not one title", label("**Option A** vs **Option B**", 4000), {
-    action: "Thought",
-    details: "4s",
-  });
-  same("streaming title-only thinking still says Thinking", label("**Plan**", null, true), {
-    action: "Thinking",
-    details: null,
-  });
-
-  // A title-only thought under a second shows one decimal, reached through the label.
-  same("title-only at 600ms shows 0.6s", label("**Quick**", 600), { action: "Quick", details: "0.6s" });
-  same("title-only at the 500ms floor shows 0.5s", label("**Quick**", 500), { action: "Quick", details: "0.5s" });
-  same("title-only just under a second truncates, never 1.0s", label("**Quick**", 999).details, "0.9s");
-  same("title-only at a second is whole seconds", label("**Quick**", 1000).details, "1s");
-  same("title-only with whole seconds", label("**Quick**", 3200).details, "3s");
-  same("plain thinking at 600ms rounds to whole seconds", label("hm", 600), { action: "Thought", details: "1s" });
-
-  // A thought row sums its thoughts' durations.
-  const summed = buildTranscript(
-    [user("q"), thoughtFor("one", 0, 2000), thoughtFor("two", 1, 3000)],
-    false,
-    false,
-  );
-  const row = rowsOf(summed)[1];
-  check("consecutive thinking is one thought row", row.kind === "thought" && row.thoughts.length === 2);
-  same("a thought row's duration is the sum", row.label, { action: "Thought", details: "5s" });
-  check("a thought row's text joins its thoughts", row.text === "one\n\ntwo");
-  const titleRow = rowsOf(buildTranscript([user("q"), thoughtFor("**Reading**", 0, 2000)], false, false))[1];
-  same("a title-only thought row's label carries the title", titleRow.label, { action: "Reading", details: "2s" });
-
-  // Streaming follows endedAt, so a closed-but-pending thought has settled.
-  const closed = buildTranscript(
-    [user("q"), thought("hm", 0, { pending: true, startedAt: 100, endedAt: 4100 })],
-    true,
-    false,
-  );
-  check("a pending thought whose thinking ended is not streaming", rowsOf(closed)[1].streaming === false);
-  same("and labels as settled", rowsOf(closed)[1].label, { action: "Thought", details: "4s" });
-  const open = buildTranscript([user("q"), thought("hm", 0, { pending: true, startedAt: 100 })], true, false);
-  check("a pending thought still thinking is streaming", rowsOf(open)[1].streaming === true);
-  same("and labels as Thinking", rowsOf(open)[1].label, { action: "Thinking", details: null });
-
-  // Inner thinking steps carry their own label.
-  const inGroup = buildTranscript(
-    [user("q"), thoughtFor("a", 0, 4000), batch(generic("c1")), result("c1")],
-    false,
-    false,
-  );
-  same("a group's thinking step labels itself", rowsOf(inGroup)[1].steps[0].label, {
-    action: "Thought",
-    details: "4s",
-  });
-}
-
-// --- Tail status ----------------------------------------------------------------------------
-
-{
-  const tailOf = (items, generating = true, reconnecting = false) =>
-    buildTranscript(items, generating, reconnecting).tail;
-
-  check("no tail when not generating", tailOf([user("q")], false) === null);
-  check("no tail with no items at all", tailOf([], true) === null);
-  same("just after the user sends, the tail plans", tailOf([user("q")]), {
-    kind: "planning",
-    action: "Planning next moves",
-    details: "",
-    callName: null,
-    inGroup: false,
-  });
-  check(
-    "no tail while the last row is streaming assistant text",
-    tailOf([user("q"), reply("Hel", 0, true)]) === null,
-  );
-  check(
-    "no tail while streaming text follows a group",
-    tailOf([user("q"), batch(search("c1")), result("c1"), reply("Hel", 1, true)]) === null,
-  );
-  check(
-    "blank streaming text does not suppress the tail",
-    tailOf([user("q"), reply(" ", 0, true)]) !== null,
-  );
-
-  // Reconnecting.
-  same("reconnecting shows its own status", tailOf([user("q")], true, true), {
-    kind: "reconnecting",
-    action: "Reconnecting...",
-    details: "",
-    callName: null,
-    inGroup: false,
-  });
-  check("the reconnecting text uses three ASCII dots", tailOf([user("q")], true, true).action === "Reconnecting...");
-  check("reconnecting wins over a running tool", tailOf([user("q"), batch(search("c1")), batch(search("c2"))], true, true).kind === "reconnecting");
-  check("reconnecting while idle shows nothing", tailOf([user("q")], false, true) === null);
-  check(
-    "streaming text suppresses even the reconnecting status",
-    tailOf([user("q"), reply("Hel", 0, true)], true, true) === null,
-  );
-
-  // A running tool inside a group gives its loading verb and details.
-  const insideGroup = tailOf([user("q"), batch(search("c1", "rust"), generic("c2")), result("c2")]);
-  same("a running tool inside a group shows its verb and details", insideGroup, {
-    kind: "tool",
-    action: "Searching web",
-    details: "rust",
-    callName: null,
-    inGroup: true,
-  });
-  const generic1 = tailOf([user("q"), batch(generic("c1", "read", "fs/read"), search("c2")), result("c2")]);
-  check(
-    "a generic running tool names its call",
-    generic1.kind === "tool" && generic1.action === "Running" && generic1.details === "read in fs" && generic1.callName === "read",
-  );
-
-  // Suppressed: a standalone tool row already shows it.
-  check(
-    "a running standalone tool row suppresses the tail",
-    tailOf([user("q"), batch(search("c1"))]) === null,
-  );
-  check(
-    "a running ask row suppresses the tail",
-    tailOf([user("q"), batch(ask("c1"))]) === null,
-  );
-
-  // Thinking.
-  check(
-    "a streaming thought row suppresses the tail",
-    tailOf([user("q"), thought("hm", 0, { pending: true })]) === null,
-  );
-  same(
-    "streaming thinking inside a group gives Thinking",
-    tailOf([user("q"), batch(search("c1")), result("c1"), thought("hm", 1, { pending: true })]),
-    {
-      kind: "thinking",
-      action: "Thinking",
-      details: "",
-      callName: null,
-      inGroup: true,
-    },
-  );
-
-  // Planning after finished work.
-  const planning = tailOf([user("q"), batch(search("c1"), search("c2")), result("c1"), result("c2")]);
-  check("finished tools in a group leave the tail at planning", planning.kind === "planning" && planning.inGroup === true);
-  check(
-    "settled thinking does not count as streaming",
-    tailOf([user("q"), thoughtFor("hm", 0, 2000)]).kind === "planning",
-  );
-  check(
-    "finished standalone work plans outside any group",
-    tailOf([user("q"), batch(search("c1")), result("c1")]).inGroup === false,
-  );
-  check(
-    "a settled reply row followed by nothing plans",
-    tailOf([user("q"), reply("done", 0)]).kind === "planning",
-  );
-
-  // An earlier turn counts only through the open batch.
-  check(
-    "an unfinished tool in an earlier turn drives the tail only as the open batch",
-    tailOf([user("a"), batch(search("c1")), user("b")]).kind === "tool" &&
-      tailOf([user("a"), batch(search("c1")), user("b"), batch(generic("c2")), result("c2")]).kind ===
-        "planning",
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`transcript-model: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("transcript-model: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/tree-state-service.mjs b/crates/workshop/ui/test/tree-state-service.mjs
deleted file mode 100644
index 8c78939be..000000000
--- a/crates/workshop/ui/test/tree-state-service.mjs
+++ /dev/null
@@ -1,387 +0,0 @@
-// Unit test for the tree-state service (src/services/tree-state-service.ts):
-// the Workshop tree's expansion state and fetched listing cache, held as
-// a registry service so a reopened panel restores the tree as the user
-// left it, and - since the workspace-bucket move - seeded from the
-// workspace file's "tree" value at construction and written back through
-// a debounced writer so the expansion survives a relaunch. Bundles the
-// module with esbuild and drives it against the shared fake UI-state
-// adapter. Covers: self-registration through the TREE_STATE token with a
-// working default; the singleton surviving across lookups; the initial
-// expanded set applied from `{ expanded: [...] }` (a malformed value reads
-// as empty); expansion tracking; a burst of expand/collapse coalescing
-// into one writer call with the same shape; a throwing writer leaving
-// the in-memory set intact; replaceExpanded replacing the set, firing
-// onDidChange, canceling a pending write, and writing nothing itself;
-// the listing cache; root invalidation dropping only the roots listing;
-// and roots(): concurrent callers share one fetch, a cached listing
-// answers without one, an invalidation during an in-flight load makes
-// the next call fetch again and keeps the stale result out of the cache,
-// and a rejected fetch clears the slot so the next call retries; and
-// followWorkspaceChanges, the owner of the roots invalidation (no panel
-// has to be alive): a workspace-changed event on its target drops the
-// roots listing and any load in flight but keeps the directory listings,
-// an event saying the roots are current leaves both alone, an unrelated
-// event does nothing, and a disposed follower stops.
-// Run: node test/tree-state-service.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { TreeStateService, TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { WORKSPACE_CHANGED_EVENT } from "./src/services/workspace-events.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { TreeStateService, TREE_STATE, WORKSPACE_CHANGED_EVENT, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The writer debounces at 250 ms; this outwaits it.
-const settle = () => new Promise((resolve) => setTimeout(resolve, 350));
-
-/** A service bound to a fake adapter's workspace "tree" key. */
-function bound(initial) {
-  const storage = createFakeUiStorage({ workspace: initial === undefined ? {} : { tree: initial } });
-  const service = new TreeStateService(storage.get("workspace", "tree"), (value) =>
-    storage.set("workspace", "tree", value),
-  );
-  return { storage, service };
-}
-
-const SRC = "C:\\project\\src";
-const DOCS = "C:\\project\\docs";
-
-// --- Self-registration and the singleton ------------------------------------
-
-{
-  const service = getService(TREE_STATE);
-  check("the TREE_STATE token self-registers", service instanceof TreeStateService);
-  check("the registry caches one instance", getService(TREE_STATE) === service);
-  check("the default instance starts with nothing expanded", service.expandedPaths.size === 0);
-  // The default's writer is a no-op: expanding through it must not throw.
-  service.expand(SRC);
-  check("the default instance tracks expansion without a writer", service.isExpanded(SRC));
-  service.dispose();
-}
-
-// --- The initial expanded set -----------------------------------------------
-
-{
-  const { service } = bound({ expanded: [SRC, DOCS, SRC, "", 42] });
-  check("the initial expanded set is applied", service.isExpanded(SRC) && service.isExpanded(DOCS));
-  check(
-    "duplicates, empty strings, and non-strings drop out of the initial set",
-    service.expandedPaths.size === 2,
-  );
-  check("expandedPaths exposes the live set", [...service.expandedPaths].join(",") === `${SRC},${DOCS}`);
-  service.dispose();
-}
-
-for (const [label, malformed] of [
-  ["null", null],
-  ["a bare array", [SRC]],
-  ["a string", "C:\\project"],
-  ["an object without expanded", { paths: [SRC] }],
-  ["expanded that is not an array", { expanded: SRC }],
-]) {
-  const { service } = bound(malformed);
-  check(`${label} as the initial value reads as nothing expanded`, service.expandedPaths.size === 0);
-  service.dispose();
-}
-
-// --- Expansion tracking -----------------------------------------------------
-
-{
-  const { service } = bound();
-  check("a directory starts collapsed", !service.isExpanded(SRC));
-  service.expand(SRC);
-  check("expand marks the directory expanded", service.isExpanded(SRC));
-  service.collapse(SRC);
-  check("collapse marks the directory collapsed", !service.isExpanded(SRC));
-  service.dispose();
-}
-
-// --- The debounced writer -----------------------------------------------------
-
-{
-  const { storage, service } = bound();
-  service.expand(SRC);
-  service.expand(DOCS);
-  service.collapse(SRC);
-  service.expand(SRC);
-  check("no write lands synchronously", storage.sets.length === 0);
-  await settle();
-  check("a burst of expand and collapse coalesces into one writer call", storage.sets.length === 1);
-  const written = storage.sets[0];
-  check("the write targets the workspace bucket's tree key", written?.bucket === "workspace" && written?.key === "tree");
-  check(
-    "the written shape is { expanded: [...] } with the live set",
-    JSON.stringify(written?.value) === JSON.stringify({ expanded: [DOCS, SRC] }),
-  );
-
-  // A second, separate change writes again.
-  service.collapse(DOCS);
-  await settle();
-  check("a later change writes again", storage.sets.length === 2);
-  check(
-    "the second write records the reduced set",
-    JSON.stringify(storage.sets[1]?.value) === JSON.stringify({ expanded: [SRC] }),
-  );
-
-  // A no-op change (expanding what is already expanded) writes nothing.
-  service.expand(SRC);
-  await settle();
-  check("a no-op expand writes nothing", storage.sets.length === 2);
-
-  // Dispose cancels an armed write.
-  service.expand(DOCS);
-  service.dispose();
-  await settle();
-  check("dispose cancels a pending write", storage.sets.length === 2);
-}
-
-// --- A throwing writer leaves the set intact ---------------------------------
-
-{
-  let throws = 0;
-  const service = new TreeStateService(null, () => {
-    throws += 1;
-    throw new Error("adapter down");
-  });
-  service.expand(SRC);
-  await settle();
-  check("the throwing writer was invoked", throws === 1);
-  check("a rejected write leaves the in-memory set intact", service.isExpanded(SRC));
-  service.dispose();
-}
-
-// --- replaceExpanded ------------------------------------------------------------
-
-{
-  const { storage, service } = bound({ expanded: [SRC] });
-  let changes = 0;
-  const sub = service.onDidChange(() => {
-    changes += 1;
-  });
-  // Arm a pending write from a live change, then replace: the replace
-  // must cancel it so the old workspace's set never lands in the new file.
-  service.expand(DOCS);
-  service.replaceExpanded(["C:\\other\\lib", "C:\\other\\lib", ""]);
-  check("replaceExpanded replaces the set", !service.isExpanded(SRC) && !service.isExpanded(DOCS));
-  check("replaceExpanded keeps the new paths, deduplicated", [...service.expandedPaths].join(",") === "C:\\other\\lib");
-  check("replaceExpanded emits change", changes === 1);
-  await settle();
-  check("replaceExpanded writes nothing and cancels the pending write", storage.sets.length === 0);
-  sub.dispose();
-  service.dispose();
-}
-
-// --- The listing cache -------------------------------------------------------------
-
-{
-  const { service } = bound();
-  const listing = { path: SRC, entries: [] };
-  check("an uncached path has no listing", service.listing(SRC) === undefined);
-  service.cacheListing(SRC, listing);
-  check("the listing round-trips", service.listing(SRC) === listing);
-
-  // The roots listing lives under the synthetic empty-path key; a workspace
-  // change invalidates it without dropping the directory listings.
-  service.cacheListing("", { path: null, entries: [] });
-  check("the roots listing caches under the empty key", service.listing("") !== undefined);
-  service.invalidateRoots();
-  check("invalidateRoots drops the roots listing", service.listing("") === undefined);
-  check("invalidateRoots keeps the directory listings", service.listing(SRC) === listing);
-  service.dispose();
-}
-
-// --- roots(): one shared load ---------------------------------------------------
-
-/** A gated roots fetch: counts calls, parks each on `gate` until released. */
-function gatedFetch(listings) {
-  let release = () => {};
-  const gate = new Promise((resolve) => {
-    release = () => resolve();
-  });
-  const calls = [];
-  const fetch = async (path) => {
-    calls.push(path);
-    const next = listings[calls.length - 1];
-    await gate;
-    if (next instanceof Error) {
-      throw next;
-    }
-    return next;
-  };
-  return { fetch, calls, release: () => release() };
-}
-
-{
-  const { service } = bound();
-  const roots = { path: null, entries: [] };
-  const { fetch, calls, release } = gatedFetch([roots]);
-  const first = service.roots(fetch);
-  const second = service.roots(fetch);
-  check("two concurrent roots() calls share one fetch", calls.length === 1);
-  check("the shared fetch asks for the roots (path null)", calls[0] === null);
-  check("two concurrent roots() calls receive the same promise", first === second);
-  check("the roots are not cached while the load is in flight", service.listing("") === undefined);
-  release();
-  check("the shared load resolves both callers", (await first) === roots && (await second) === roots);
-  check("a settled load caches the roots listing", service.listing("") === roots);
-  check("a cached listing answers roots() without a fetch", (await service.roots(fetch)) === roots && calls.length === 1);
-  service.dispose();
-}
-
-// --- roots(): invalidation during an in-flight load --------------------------
-
-{
-  const { service } = bound();
-  const stale = { path: null, entries: [] };
-  const fresh = { path: null, entries: [] };
-  const staleFetch = gatedFetch([stale]);
-  const freshFetch = gatedFetch([fresh]);
-  const staleLoad = service.roots(staleFetch.fetch);
-  service.invalidateRoots();
-  const freshLoad = service.roots(freshFetch.fetch);
-  check("invalidateRoots during an in-flight load makes the next roots() fetch again", freshFetch.calls.length === 1);
-  check("the load after an invalidation is a new promise", staleLoad !== freshLoad);
-  freshFetch.release();
-  check("the fresh load resolves to the fresh listing", (await freshLoad) === fresh);
-  check("the fresh listing is cached", service.listing("") === fresh);
-  staleFetch.release();
-  check("the stale load still resolves for its own caller", (await staleLoad) === stale);
-  check("the stale load does not populate the cache", service.listing("") === fresh);
-  check(
-    "a later roots() reads the fresh cache without a fetch",
-    (await service.roots(staleFetch.fetch)) === fresh && staleFetch.calls.length === 1,
-  );
-  service.dispose();
-}
-
-{
-  // The stale load settles after the invalidation but before any new
-  // call: it must leave the cache empty rather than resurrect the old roots.
-  const { service } = bound();
-  const stale = { path: null, entries: [] };
-  const { fetch, release } = gatedFetch([stale]);
-  const staleLoad = service.roots(fetch);
-  service.invalidateRoots();
-  release();
-  await staleLoad;
-  check("a stale load settling into an empty cache caches nothing", service.listing("") === undefined);
-  service.dispose();
-}
-
-// --- roots(): a rejected fetch clears the slot ---------------------------------
-
-{
-  const { service } = bound();
-  const roots = { path: null, entries: [] };
-  const { fetch, calls, release } = gatedFetch([new Error("server down"), roots]);
-  const failing = service.roots(fetch);
-  release();
-  let rejected = false;
-  try {
-    await failing;
-  } catch (error) {
-    rejected = error instanceof Error && error.message === "server down";
-  }
-  check("a failed roots load rejects its caller", rejected);
-  check("a failed roots load caches nothing", service.listing("") === undefined);
-  const retried = await service.roots(fetch);
-  check("a rejected fetch clears the slot so the next roots() retries", calls.length === 2 && retried === roots);
-  check("the retried load caches its listing", service.listing("") === roots);
-  service.dispose();
-}
-
-// --- roots(): dispose drops an in-flight load ----------------------------------
-
-{
-  const { service } = bound();
-  const roots = { path: null, entries: [] };
-  const { fetch, release } = gatedFetch([roots]);
-  const load = service.roots(fetch);
-  service.dispose();
-  release();
-  await load;
-  check("a load settling after dispose caches nothing", service.listing("") === undefined);
-}
-
-// --- followWorkspaceChanges: the service drops the roots with no panel alive -----
-
-{
-  const { service } = bound();
-  const target = new EventTarget();
-  const stale = { path: null, entries: [] };
-  const follower = service.followWorkspaceChanges(target);
-
-  service.cacheListing("", stale);
-  service.cacheListing(SRC, { path: SRC, entries: [] });
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  check("a workspace change drops the roots listing", service.listing("") === undefined);
-  check("a workspace change keeps the directory listings", service.listing(SRC) !== undefined);
-
-  service.cacheListing("", stale);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: { rootsCurrent: true } }));
-  check("an event saying the roots are current leaves the roots listing", service.listing("") === stale);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: { rootsCurrent: false } }));
-  check("an event saying the roots are not current drops the roots listing", service.listing("") === undefined);
-
-  service.cacheListing("", stale);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: "rootsCurrent" }));
-  check("an event with a detail that is not a record drops the roots listing", service.listing("") === undefined);
-
-  service.cacheListing("", stale);
-  target.dispatchEvent(new CustomEvent("runvil:something-else"));
-  check("an unrelated event leaves the roots listing", service.listing("") === stale);
-
-  // A load in flight started against the old grants: a plain change drops it, a current one keeps it.
-  service.invalidateRoots();
-  const old = gatedFetch([{ path: null, entries: [] }]);
-  const keptLoad = service.roots(old.fetch);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: { rootsCurrent: true } }));
-  check("a current event keeps the load in flight", service.roots(old.fetch) === keptLoad && old.calls.length === 1);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  const fresh = gatedFetch([{ path: null, entries: [] }]);
-  const freshLoad = service.roots(fresh.fetch);
-  check("a plain event drops the load in flight, so the next reader fetches again", freshLoad !== keptLoad && fresh.calls.length === 1);
-  old.release();
-  fresh.release();
-  await Promise.all([keptLoad, freshLoad]);
-
-  follower.dispose();
-  service.cacheListing("", stale);
-  target.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  check("a disposed follower stops dropping the roots listing", service.listing("") === stale);
-  service.dispose();
-}
-
-if (failures.length > 0) {
-  console.error(`tree-state-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("tree-state-service: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/typeahead-popup.mjs b/crates/workshop/ui/test/typeahead-popup.mjs
deleted file mode 100644
index 5fc92bb95..000000000
--- a/crates/workshop/ui/test/typeahead-popup.mjs
+++ /dev/null
@@ -1,609 +0,0 @@
-// The mention typeahead popup (src/parts/chatbox/typeahead-popup.ts) in
-// jsdom, driven through a ChatBox (src/parts/chatbox/chat-box.ts) so the
-// ProseMirror suggestion plugin runs with the component's own configuration:
-// the injected or stub mentionSource, the debounce, minQueryLength 0, and
-// the Enter/Tab yield in the editor's key handler. Covers: typing "@"
-// opens the popup with listbox semantics, a highlighted first row, and
-// inline position styles written by the managed mount (jsdom layout is
-// zero, so the positioning contract is pinned by the styles being
-// written from the virtual-element rect, not by pixel values); a
-// no-match query hides the popup, and Enter while it is hidden inserts
-// nothing; mousedown on the popup is default-prevented so the editor
-// keeps focus; ArrowUp/ArrowDown move the highlight with wraparound, and
-// narrowing the query clamps the highlight to the first matching row;
-// Enter inserts the highlighted mention node and closes the popup;
-// clicking a row does the same; Escape dismisses the session and it
-// stays dismissed while typing; destroying the editor mid-session
-// removes the popup; inside ChatBox, Enter with the popup open selects
-// instead of submitting. The extended rows: a chip's `description`
-// renders dimmed beside the label; items with `group` render a
-// non-selectable header at each group boundary and arrow navigation
-// skips the headers; a `loading` row shows while the source is pending
-// and gives way to the results; Tab accepts like Enter; a space closes
-// the popup leaving the typed text; Backspace directly after a pill
-// restores the literal "@" and reopens the popup. Runs under the shared
-// leak check: a popup or ChatBox that is never disposed fails. The @ menu
-// wears the composer's shared menu surface (look's .menu-composer); the
-// stylesheet's own values - 240px wide, at most 280px tall, the 11px
-// left-truncated path subtitle at 0.4 opacity, plain section headers - are
-// read from the source text.
-// Run: node test/typeahead-popup.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { ChatBox } from "./src/parts/chatbox/chat-box.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-// ProseMirror reads the DOM globals at construction, so the jsdom
-// globals must exist before the bundle is imported. pretendToBeVisual
-// supplies the requestAnimationFrame ProseMirror schedules with. The
-// ProseMirror suggestion plugin's managed mount also touches the
-// HTMLElement, Node, and DOMRect globals.
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7910/",
-  pretendToBeVisual: true,
-});
-globalThis.window = dom.window;
-globalThis.document = dom.window.document;
-globalThis.getComputedStyle = dom.window.getComputedStyle.bind(dom.window);
-globalThis.HTMLElement = dom.window.HTMLElement;
-globalThis.Element = dom.window.Element;
-globalThis.Node = dom.window.Node;
-globalThis.DOMRect = dom.window.DOMRect;
-// Tiptap's focus command reads requestAnimationFrame from the global
-// scope, not from the view's window.
-globalThis.requestAnimationFrame = dom.window.requestAnimationFrame.bind(dom.window);
-globalThis.cancelAnimationFrame = dom.window.cancelAnimationFrame.bind(dom.window);
-// jsdom's Range has no layout rects; ProseMirror's scroll-to-selection
-// reads them when selecting a mention focuses the editor.
-dom.window.Range.prototype.getClientRects = () => [];
-dom.window.Range.prototype.getBoundingClientRect = () => new dom.window.DOMRect();
-
-const bundlePath = path.join(os.tmpdir(), "runvil-typeahead-popup-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, ChatBox } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The suggestion session only activates for a focused, connected editor:
-// ProseMirror syncs the DOM selection (which the mention command's
-// collapseToEnd needs) only when the view has focus. Tiptap stamps the
-// Editor on the view DOM (dom.editor); the test drives commands through
-// it because ChatBox does not expose its editor.
-function createBox(props = {}, sink = () => {}) {
-  const input = new ChatBox(props, sink);
-  document.body.appendChild(input.element);
-  const editorDom = input.element.querySelector(".ws-prompt-input__editor");
-  const editor = editorDom.editor;
-  editor.commands.focus();
-  return {
-    input,
-    editor,
-    editorDom,
-    dispose() {
-      input.dispose();
-      input.element.remove();
-    },
-  };
-}
-
-// The ProseMirror suggestion plugin debounces its item fetch (the
-// component configures 50 to 100 ms); a wait past that window lets the
-// fetch and the mount's computePosition settle.
-function settle() {
-  return new Promise((resolve) => setTimeout(resolve, 160));
-}
-
-// insertContent dispatches the same transaction typing would.
-async function typeText(editor, text) {
-  editor.commands.insertContent(text);
-  await settle();
-}
-
-function pressKey(target, key) {
-  target.dispatchEvent(
-    new dom.window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }),
-  );
-}
-
-function popup() {
-  return document.body.querySelector(".ws-typeahead-popup");
-}
-
-function popupItems() {
-  return [...(popup()?.querySelectorAll(".ws-typeahead-popup__item") ?? [])];
-}
-
-function popupLabels() {
-  return popupItems().map((item) => item.querySelector(".ws-typeahead-popup__label")?.textContent);
-}
-
-function popupRows() {
-  return [...(popup()?.querySelectorAll(".ws-typeahead-popup__list > li") ?? [])];
-}
-
-function selectedItem() {
-  return popup()?.querySelector(".ws-typeahead-popup__item--selected") ?? null;
-}
-
-function mentionInDoc(editor) {
-  let found = false;
-  editor.state.doc.descendants((node) => {
-    if (node.type.name === "mentionNode") found = true;
-    return !found;
-  });
-  return found;
-}
-
-function mentionAttrs(editor) {
-  let attrs;
-  editor.state.doc.descendants((node) => {
-    if (node.type.name === "mentionNode") attrs = node.attrs;
-    return attrs === undefined;
-  });
-  return attrs;
-}
-
-// A source whose call resolves only when the test says so.
-function deferredSource() {
-  const calls = [];
-  const source = (query, signal) =>
-    new Promise((resolve) => {
-      calls.push({ query, signal, resolve });
-    });
-  source.calls = calls;
-  return source;
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Open -----------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    const el = popup();
-    check("typing @ opens the popup", el !== null && el.isConnected);
-    const items = popupItems();
-    check(
-      "the popup lists the stub entries",
-      popupLabels().join(",") === "README.md,src/main.ts,Cargo.toml",
-    );
-    const list = el?.querySelector('ul[role="listbox"]');
-    check(
-      "the popup has listbox semantics",
-      list !== null &&
-        list !== undefined &&
-        items.every((item) => item.getAttribute("role") === "option"),
-    );
-    check(
-      "the first item opens highlighted",
-      items[0] !== undefined &&
-        items[0].classList.contains("ws-typeahead-popup__item--selected") &&
-        items[0].getAttribute("aria-selected") === "true" &&
-        items[1]?.getAttribute("aria-selected") === "false",
-    );
-    check(
-      "each row draws an icon slot beside its label",
-      items.every((item) => item.querySelector(".ws-typeahead-popup__icon svg") !== null),
-    );
-    check(
-      "the managed mount writes the popup position from the cursor rect",
-      el !== null &&
-        el.style.position === "absolute" &&
-        el.style.left !== "" &&
-        el.style.top !== "",
-    );
-    const mousedown = new dom.window.MouseEvent("mousedown", {
-      bubbles: true,
-      cancelable: true,
-    });
-    el?.dispatchEvent(mousedown);
-    check(
-      "mousedown on the popup is default-prevented so the editor keeps focus",
-      mousedown.defaultPrevented === true,
-    );
-    box.dispose();
-  }
-
-  // --- Filter -----------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@RE");
-    check(
-      "typing a query filters the popup entries",
-      popupLabels().join(",") === "README.md",
-    );
-    await typeText(box.editor, "zz");
-    check(
-      "a query with no matches hides the popup",
-      popup()?.hidden === true && popupItems().length === 0,
-    );
-    pressKey(box.editorDom, "Enter");
-    check(
-      "Enter with no matching items inserts nothing",
-      !mentionInDoc(box.editor) && box.input.getText() === "@REzz",
-    );
-    box.dispose();
-  }
-
-  // --- Keyboard navigation ------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    const items = popupItems();
-    pressKey(box.editorDom, "ArrowDown");
-    check(
-      "ArrowDown moves the highlight to the next item",
-      items[1] !== undefined && selectedItem() === items[1],
-    );
-    pressKey(box.editorDom, "ArrowDown");
-    pressKey(box.editorDom, "ArrowDown");
-    check(
-      "ArrowDown wraps from the last item to the first",
-      items[0] !== undefined && selectedItem() === items[0],
-    );
-    pressKey(box.editorDom, "ArrowUp");
-    check(
-      "ArrowUp wraps from the first item to the last",
-      items[2] !== undefined && selectedItem() === items[2],
-    );
-    check(
-      "the highlighted row has aria-selected",
-      selectedItem()?.getAttribute("aria-selected") === "true",
-    );
-    await typeText(box.editor, "RE");
-    check(
-      "narrowing the query clamps the highlight to the first matching row",
-      popupItems().length === 1 && selectedItem() === popupItems()[0],
-    );
-    box.dispose();
-  }
-
-  // --- Enter selects --------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    pressKey(box.editorDom, "ArrowDown");
-    pressKey(box.editorDom, "Enter");
-    check("Enter inserts the highlighted mention", mentionInDoc(box.editor));
-    const attrs = mentionAttrs(box.editor);
-    check(
-      "the inserted mention holds the highlighted item",
-      attrs?.id === "src/main.ts" && attrs?.label === "src/main.ts" && attrs?.kind === "file",
-    );
-    check("selecting closes the popup", popup() === null);
-    // getText renders the mention through its renderText ("@label"), so
-    // the query range being replaced reads as the mention plus the
-    // trailing space the command inserts.
-    check(
-      "the mention replaces the query text",
-      box.editor.getText() === "@src/main.ts ",
-    );
-    box.dispose();
-  }
-
-  // --- Tab selects ------------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    pressKey(box.editorDom, "ArrowDown");
-    pressKey(box.editorDom, "ArrowDown");
-    pressKey(box.editorDom, "Tab");
-    check("Tab inserts the highlighted mention", mentionInDoc(box.editor));
-    check(
-      "the Tab-inserted mention holds the highlighted item",
-      mentionAttrs(box.editor)?.id === "Cargo.toml",
-    );
-    check("Tab closes the popup", popup() === null);
-    check(
-      "the Tab insertion is followed by one space",
-      box.editor.getText() === "@Cargo.toml ",
-    );
-    box.dispose();
-  }
-
-  // --- Escape dismisses -------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@RE");
-    pressKey(box.editorDom, "Escape");
-    check("Escape closes the popup", popup() === null);
-    check("Escape leaves the typed query in place", box.editor.getText() === "@RE");
-    check("Escape inserts no mention", !mentionInDoc(box.editor));
-    await typeText(box.editor, "A");
-    check("a dismissed session stays dismissed while typing", popup() === null);
-    box.dispose();
-  }
-
-  // --- Space closes ---------------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@RE");
-    check("the popup is open before the space", popup() !== null);
-    await typeText(box.editor, " ");
-    check("a space closes the popup", popup() === null);
-    check(
-      "the space leaves the typed text in place with no mention",
-      box.editor.getText() === "@RE " && !mentionInDoc(box.editor),
-    );
-    box.dispose();
-  }
-
-  // --- Click selects ------------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    const items = popupItems();
-    items[2]?.click();
-    check("clicking a row inserts its mention", mentionInDoc(box.editor));
-    check(
-      "the clicked mention holds the row's item",
-      mentionAttrs(box.editor)?.id === "Cargo.toml",
-    );
-    check("clicking closes the popup", popup() === null);
-    box.dispose();
-  }
-
-  // --- Backspace after a pill -----------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    pressKey(box.editorDom, "Enter");
-    check("the pill is in place before Backspace", mentionInDoc(box.editor));
-    // The command leaves the cursor after the trailing space; jsdom
-    // performs no native deletion, so place the cursor directly after
-    // the pill (paragraph opens at 0, the atom spans 1..2) as a real
-    // Backspace over the space would.
-    box.editor.commands.setTextSelection(2);
-    pressKey(box.editorDom, "Backspace");
-    await settle();
-    check(
-      "Backspace directly after a pill restores the literal @",
-      !mentionInDoc(box.editor) && box.editor.getText() === "@ ",
-    );
-    check(
-      "the restored @ reopens the popup with the full list",
-      popup() !== null && popupLabels().join(",") === "README.md,src/main.ts,Cargo.toml",
-    );
-    box.dispose();
-  }
-
-  // --- Destroy mid-session ---------------------------------------------------------------
-
-  {
-    const box = createBox();
-    await typeText(box.editor, "@");
-    box.input.dispose();
-    check("disposing the box mid-session removes the popup", popup() === null);
-    box.input.element.remove();
-  }
-
-  // --- Description column -------------------------------------------------------------------
-
-  {
-    const mentionSource = async () => [
-      { id: "src/a.ts", label: "a.ts", kind: "file", description: "src", data: null },
-      { id: "b.ts", label: "b.ts", kind: "file", data: null },
-    ];
-    const box = createBox({ mentionSource });
-    await typeText(box.editor, "@");
-    const items = popupItems();
-    const description = items[0]?.querySelector(".ws-typeahead-popup__description");
-    check(
-      "a chip's description renders in its own dimmed slot after the label",
-      description !== null &&
-        description !== undefined &&
-        description.textContent === "src" &&
-        description.previousElementSibling?.classList.contains("ws-typeahead-popup__label") === true,
-    );
-    check(
-      "a chip without a description renders no description slot",
-      items[1]?.querySelector(".ws-typeahead-popup__description") === null,
-    );
-    check(
-      "the popup wears the composer's shared menu surface, and its rows are menu rows",
-      popup()?.classList.contains("menu") === true &&
-        popup()?.classList.contains("menu-composer") === true &&
-        items.every((item) => item.classList.contains("menu-item")) &&
-        items.every((item) => item.querySelector(".menu-item__icon svg") !== null),
-    );
-    check(
-      "the row's icon is 14px",
-      items[0]?.querySelector(".ws-typeahead-popup__icon svg")?.getAttribute("width") === "14",
-    );
-    check(
-      "the path subtitle holds its text left to right, so truncating from the left keeps the end",
-      description?.querySelector('bdi[dir="ltr"]')?.textContent === "src",
-    );
-    check(
-      "the description is not stored on the inserted node",
-      (() => {
-        pressKey(box.editorDom, "Enter");
-        const attrs = mentionAttrs(box.editor);
-        return attrs !== undefined && attrs.id === "src/a.ts" && !("description" in attrs);
-      })(),
-    );
-    box.dispose();
-  }
-
-  // --- Group headers ----------------------------------------------------------------------------
-
-  {
-    const mentionSource = async () => [
-      { id: "f1", label: "one.ts", group: "Files", data: null },
-      { id: "d1", label: "src", kind: "folder", group: "Folders", data: null },
-      { id: "f2", label: "two.ts", group: "Files", data: null },
-      { id: "u", label: "ungrouped", data: null },
-    ];
-    const box = createBox({ mentionSource });
-    await typeText(box.editor, "@");
-    const rows = popupRows();
-    const kinds = rows.map((row) =>
-      row.classList.contains("ws-typeahead-popup__header")
-        ? `H:${row.textContent}`
-        : row.querySelector(".ws-typeahead-popup__label")?.textContent,
-    );
-    check(
-      "items sort by group with a header at each boundary and ungrouped items first",
-      kinds.join("|") === "ungrouped|H:Files|one.ts|two.ts|H:Folders|src",
-    );
-    check(
-      "headers are not options",
-      rows
-        .filter((row) => row.classList.contains("ws-typeahead-popup__header"))
-        .every((row) => row.getAttribute("role") === "presentation" && !row.hasAttribute("aria-selected")),
-    );
-    const items = popupItems();
-    check("the first item opens highlighted, not a header", selectedItem() === items[0]);
-    pressKey(box.editorDom, "ArrowDown");
-    check("ArrowDown skips the Files header", selectedItem() === items[1]);
-    pressKey(box.editorDom, "ArrowDown");
-    pressKey(box.editorDom, "ArrowDown");
-    check("ArrowDown skips the Folders header", selectedItem() === items[3]);
-    pressKey(box.editorDom, "ArrowDown");
-    check("ArrowDown wraps over items only", selectedItem() === items[0]);
-    pressKey(box.editorDom, "ArrowUp");
-    check("ArrowUp wraps to the last item, not a header", selectedItem() === items[3]);
-    pressKey(box.editorDom, "Enter");
-    check(
-      "Enter inserts the highlighted grouped item",
-      mentionAttrs(box.editor)?.id === "d1",
-    );
-    box.dispose();
-  }
-
-  // --- Loading state -----------------------------------------------------------------------------
-
-  {
-    const mentionSource = deferredSource();
-    const box = createBox({ mentionSource });
-    await typeText(box.editor, "@");
-    const loading = popup()?.querySelector(".ws-typeahead-popup__loading");
-    check(
-      "a loading row shows while the source is pending and the popup stays visible",
-      mentionSource.calls.length === 1 &&
-        loading !== null &&
-        loading !== undefined &&
-        popup()?.hidden === false &&
-        popupItems().length === 0,
-    );
-    pressKey(box.editorDom, "Enter");
-    check(
-      "Enter while loading inserts nothing",
-      !mentionInDoc(box.editor) && box.editor.getText() === "@",
-    );
-    mentionSource.calls[0].resolve([{ id: "r", label: "ready.ts", data: null }]);
-    await settle();
-    check(
-      "the results replace the loading row",
-      popup()?.querySelector(".ws-typeahead-popup__loading") === null &&
-        popupLabels().join(",") === "ready.ts",
-    );
-    box.dispose();
-  }
-
-  // --- ChatBox integration --------------------------------------------------------------
-
-  {
-    let submitted = 0;
-    const box = createBox({}, (event) => {
-      if (event.type === "send") {
-        submitted++;
-      }
-    });
-    await typeText(box.editor, "@");
-    pressKey(box.editorDom, "Enter");
-    check(
-      "Enter with the typeahead open selects instead of submitting",
-      submitted === 0 && box.input.element.querySelector(".ws-mention-chip") !== null,
-    );
-    check("the selection closed the popup", popup() === null);
-    pressKey(box.editorDom, "Enter");
-    check("Enter with no typeahead open submits", submitted === 1);
-    box.dispose();
-  }
-});
-
-// --- The stylesheet: the @ menu's own values --------------------------------------------
-
-{
-  const css = (
-    await readFile(path.join(testDir, "..", "src", "parts", "chatbox", "typeahead-popup.css"), "utf8")
-  ).replace(/\/\*[\s\S]*?\*\//g, "");
-  const componentCss = await readFile(path.join(testDir, "..", "src", "tokens", "component.css"), "utf8");
-  const rule = (selector) => {
-    const match = new RegExp(`${selector.replace(/[.[\]"=]/g, "\\$&")}\\s*\\{([^}]*)\\}`).exec(css);
-    return match === null ? "" : match[1].replace(/\s+/g, " ");
-  };
-  check(
-    "the @ menu is 240px wide and at most 280px tall",
-    /inline-size:\s*var\(--ws-typeahead-width\)/.test(rule(".ws-typeahead-popup")) &&
-      /max-block-size:\s*var\(--ws-typeahead-max-height\)/.test(rule(".ws-typeahead-popup")) &&
-      /--ws-typeahead-width:\s*var\(--ws-size-240\)/.test(componentCss) &&
-      /--ws-typeahead-max-height:\s*var\(--ws-size-280\)/.test(componentCss),
-  );
-  const description = rule(".ws-typeahead-popup__description");
-  check(
-    "the path is an 11px right-aligned subtitle at 0.4 opacity, truncated from the left",
-    /font-size:\s*var\(--font-size-xs\)/.test(description) &&
-      /direction:\s*rtl/.test(description) &&
-      /text-align:\s*end/.test(description) &&
-      /text-overflow:\s*ellipsis/.test(description) &&
-      /opacity:\s*0\.4/.test(description),
-  );
-  check(
-    "the highlighted row's path reads at 0.6",
-    /opacity:\s*0\.6/.test(rule(".ws-typeahead-popup__item--selected .ws-typeahead-popup__description")),
-  );
-  const header = rule(".ws-typeahead-popup__header");
-  check(
-    "section headers are not uppercase and have no border",
-    header !== "" &&
-      !/text-transform/.test(header) &&
-      !/border/.test(header) &&
-      !/:not\(:first-child\)/.test(css),
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`ws-typeahead-popup: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ws-typeahead-popup: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/ui-storage.mjs b/crates/workshop/ui/test/ui-storage.mjs
deleted file mode 100644
index 035ef48ef..000000000
--- a/crates/workshop/ui/test/ui-storage.mjs
+++ /dev/null
@@ -1,415 +0,0 @@
-// Unit test for the UI-state adapter (src/services/ui-storage.ts): the
-// SPA's replacement for localStorage, a two-bucket key-value cache fed by
-// GET /user/state and GET /workspace/file/state at boot and written back
-// through PUT /user/state/{key} and PUT /workspace/file/state/{key}.
-// Bundles the module with esbuild and drives it with an injected fake
-// fetch. Covers: both buckets resolving and `get` answering each value;
-// one bucket failing (rejection, non-OK status, non-object body) with only
-// its keys null and one warning; both buckets hanging past the preload
-// timeout with boot still completing on all-null; a fetch that fails after
-// the timeout adding no second warning; `set` issuing the PUT
-// with the JSON body to the right path and updating the cache; a rejected
-// or refused `set` warning once without throwing; `suppressWrites`
-// dropping workspace writes but not user writes, nesting safely, and
-// restoring after a throw; `reloadWorkspace` replacing the cached
-// workspace values; and the UI_STORAGE token's default empty adapter.
-// Run: node test/ui-storage.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createUiStorage, UI_STORAGE } from "./src/services/ui-storage.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { createUiStorage, UI_STORAGE, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
-
-// Counts console warnings while a body runs; the adapter's failure
-// posture is "one warning, continue", so the count is part of the contract.
-const realWarn = console.warn;
-let warnings = [];
-console.warn = (...args) => {
-  warnings.push(args.map(String).join(" "));
-};
-function resetWarnings() {
-  warnings = [];
-}
-
-const jsonResponse = (body, status = 200) =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-
-const USER_ROUTE = "/user/state";
-const WORKSPACE_ROUTE = "/workspace/file/state";
-
-/**
- * A scripted fetch: `script` maps a route to a behavior, one of
- * `{ body }` (200 JSON), `{ status, body }`, `{ reject: true }`,
- * `{ rejectAfter: ms }` (rejects after a delay), or `{ hang: true }`. PUT
- * routes default to `{ saved: true }`. Every call is recorded as
- * `{ method, url, body }` with the body parsed from JSON.
- */
-function scriptedFetch(script) {
-  const calls = [];
-  const fetchImpl = (url, init) => {
-    const method = init?.method ?? "GET";
-    calls.push({
-      method,
-      url,
-      headers: init?.headers ?? {},
-      body: typeof init?.body === "string" ? JSON.parse(init.body) : undefined,
-    });
-    const behavior = script[url] ?? (method === "PUT" ? { body: { saved: true } } : undefined);
-    if (behavior === undefined) {
-      return Promise.reject(new Error(`unexpected fetch ${method} ${url}`));
-    }
-    if (behavior.hang) {
-      return new Promise(() => {});
-    }
-    if (behavior.reject) {
-      return Promise.reject(new Error("connection refused"));
-    }
-    if (behavior.rejectAfter !== undefined) {
-      return new Promise((_, reject) =>
-        setTimeout(() => reject(new Error("connection reset")), behavior.rejectAfter),
-      );
-    }
-    return Promise.resolve(jsonResponse(behavior.body, behavior.status ?? 200));
-  };
-  return { fetchImpl, calls };
-}
-
-const userState = {
-  editor_settings: { wordWrap: true },
-  zoom: 1.25,
-  recent_files: ["C:\\a.md"],
-  commands_history: null,
-};
-const workspaceState = {
-  layout: { version: 3, zones: {} },
-  tree: { expanded: ["C:\\project"] },
-  closed_editors: null,
-};
-
-// --- Both buckets resolve ---------------------------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl, calls } = scriptedFetch({
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  check("get before preload answers null", storage.get("user", "zoom") === null);
-  await storage.preload(1000);
-  check(
-    "preload fetches both buckets",
-    calls.length === 2 &&
-      calls.some((c) => c.method === "GET" && c.url === USER_ROUTE) &&
-      calls.some((c) => c.method === "GET" && c.url === WORKSPACE_ROUTE),
-  );
-  check(
-    "get answers each user value",
-    storage.get("user", "zoom") === 1.25 &&
-      storage.get("user", "editor_settings")?.wordWrap === true &&
-      storage.get("user", "recent_files")?.[0] === "C:\\a.md",
-  );
-  check(
-    "get answers each workspace value",
-    storage.get("workspace", "layout")?.version === 3 &&
-      storage.get("workspace", "tree")?.expanded?.[0] === "C:\\project",
-  );
-  check(
-    "a null server value reads as null",
-    storage.get("user", "commands_history") === null && storage.get("workspace", "closed_editors") === null,
-  );
-  check("an unknown key reads as null", storage.get("user", "nope") === null);
-  check("a clean preload warns nothing", warnings.length === 0);
-}
-
-// --- One bucket fails --------------------------------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { reject: true },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  check("a rejected user bucket reads all null", storage.get("user", "zoom") === null);
-  check("the workspace bucket still holds its values", storage.get("workspace", "layout")?.version === 3);
-  check("a rejected bucket warns exactly once", warnings.length === 1);
-}
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { status: 500, body: { error: { code: "internal", message: "boom" } } },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  check("a non-OK workspace bucket reads all null", storage.get("workspace", "layout") === null);
-  check("the user bucket still holds its values", storage.get("user", "zoom") === 1.25);
-  check("a non-OK bucket warns exactly once", warnings.length === 1);
-}
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { body: ["not", "an", "object"] },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  check("a non-object body reads all null", storage.get("user", "zoom") === null);
-  check("a non-object body warns exactly once", warnings.length === 1);
-}
-
-// --- Both buckets hang past the timeout ---------------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { hang: true },
-    [WORKSPACE_ROUTE]: { hang: true },
-  });
-  const storage = createUiStorage(fetchImpl);
-  const started = Date.now();
-  await storage.preload(30);
-  check("preload resolves after the timeout", Date.now() - started < 1000);
-  check(
-    "a timed-out preload reads all null",
-    storage.get("user", "zoom") === null && storage.get("workspace", "layout") === null,
-  );
-  check("a timed-out preload warns once per bucket", warnings.length === 2);
-}
-
-// --- A fetch that fails after the timeout is not a second warning ---------------
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { rejectAfter: 80 },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(20);
-  check("the timed-out bucket reads null", storage.get("user", "zoom") === null);
-  check("the other bucket holds its values", storage.get("workspace", "layout")?.version === 3);
-  await new Promise((resolve) => setTimeout(resolve, 150));
-  check("a late failure after the timeout still warns exactly once", warnings.length === 1);
-}
-
-// --- set PUTs to the right path ------------------------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl, calls } = scriptedFetch({
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  calls.length = 0;
-
-  storage.set("user", "zoom", 1.5);
-  const userPut = calls.find((c) => c.method === "PUT");
-  check(
-    "a user set PUTs the JSON body to /user/state/{key}",
-    userPut !== undefined && userPut.url === `${USER_ROUTE}/zoom` && userPut.body === 1.5,
-  );
-  check(
-    "the PUT declares a JSON content type",
-    userPut !== undefined && /application\/json/.test(String(userPut.headers["content-type"])),
-  );
-  check("a set updates the cache before the PUT settles", storage.get("user", "zoom") === 1.5);
-
-  calls.length = 0;
-  const layout = { version: 3, zones: { tree: true } };
-  storage.set("workspace", "layout", layout);
-  const workspacePut = calls.find((c) => c.method === "PUT");
-  check(
-    "a workspace set PUTs the JSON body to /workspace/file/state/{key}",
-    workspacePut !== undefined &&
-      workspacePut.url === `${WORKSPACE_ROUTE}/layout` &&
-      workspacePut.body?.zones?.tree === true,
-  );
-  await settle();
-  check("a successful set warns nothing", warnings.length === 0);
-}
-
-// --- A failed set warns once and does not throw ----------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl } = scriptedFetch({
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-    [`${USER_ROUTE}/zoom`]: { reject: true },
-    [`${WORKSPACE_ROUTE}/tree`]: { status: 400, body: { error: { code: "bad_key", message: "no" } } },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  let threw = false;
-  try {
-    storage.set("user", "zoom", 2);
-  } catch {
-    threw = true;
-  }
-  await settle();
-  check("a rejected set does not throw", !threw);
-  check("a rejected set warns once", warnings.length === 1);
-  check("a rejected set leaves the in-memory value", storage.get("user", "zoom") === 2);
-
-  resetWarnings();
-  storage.set("workspace", "tree", { expanded: [] });
-  await settle();
-  check("a refused set warns once", warnings.length === 1);
-}
-
-// --- suppressWrites ---------------------------------------------------------------
-
-{
-  resetWarnings();
-  const { fetchImpl, calls } = scriptedFetch({
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  });
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  calls.length = 0;
-
-  const result = storage.suppressWrites(() => {
-    storage.set("workspace", "layout", { version: 3 });
-    storage.set("user", "zoom", 3);
-    storage.suppressWrites(() => {
-      storage.set("workspace", "tree", { expanded: [] });
-    });
-    storage.set("workspace", "closed_editors", { paths: [] });
-    return "done";
-  });
-  const puts = calls.filter((c) => c.method === "PUT");
-  check("suppressWrites passes the callback's return through", result === "done");
-  check(
-    "suppressWrites drops every workspace write, nested included",
-    puts.every((c) => !c.url.startsWith(WORKSPACE_ROUTE)),
-  );
-  check(
-    "suppressWrites lets user writes through",
-    puts.length === 1 && puts[0].url === `${USER_ROUTE}/zoom`,
-  );
-
-  calls.length = 0;
-  storage.set("workspace", "layout", { version: 3 });
-  check(
-    "workspace writes resume after suppressWrites",
-    calls.some((c) => c.method === "PUT" && c.url === `${WORKSPACE_ROUTE}/layout`),
-  );
-
-  calls.length = 0;
-  try {
-    storage.suppressWrites(() => {
-      throw new Error("apply failed");
-    });
-  } catch {
-    // expected
-  }
-  storage.set("workspace", "tree", { expanded: ["x"] });
-  check(
-    "suppression lifts even when the callback throws",
-    calls.some((c) => c.method === "PUT" && c.url === `${WORKSPACE_ROUTE}/tree`),
-  );
-  await settle();
-}
-
-// --- reloadWorkspace ----------------------------------------------------------------
-
-{
-  resetWarnings();
-  const script = {
-    [USER_ROUTE]: { body: userState },
-    [WORKSPACE_ROUTE]: { body: workspaceState },
-  };
-  const { fetchImpl, calls } = scriptedFetch(script);
-  const storage = createUiStorage(fetchImpl);
-  await storage.preload(1000);
-  calls.length = 0;
-
-  script[WORKSPACE_ROUTE] = {
-    body: { layout: { version: 3, zones: { other: true } }, tree: null, closed_editors: { paths: ["C:\\b.md"] } },
-  };
-  await storage.reloadWorkspace();
-  check(
-    "reloadWorkspace fetches only the workspace bucket",
-    calls.length === 1 && calls[0].method === "GET" && calls[0].url === WORKSPACE_ROUTE,
-  );
-  check(
-    "reloadWorkspace replaces the cached workspace values",
-    storage.get("workspace", "layout")?.zones?.other === true &&
-      storage.get("workspace", "tree") === null &&
-      storage.get("workspace", "closed_editors")?.paths?.[0] === "C:\\b.md",
-  );
-  check("reloadWorkspace leaves the user bucket alone", storage.get("user", "zoom") === 1.25);
-
-  script[WORKSPACE_ROUTE] = { reject: true };
-  await storage.reloadWorkspace();
-  check("a failed reload yields defaults", storage.get("workspace", "layout") === null);
-  check("a failed reload warns once", warnings.length === 1);
-}
-
-// --- The default empty adapter --------------------------------------------------------
-
-{
-  resetWarnings();
-  const fallback = getService(UI_STORAGE);
-  check("the UI_STORAGE token self-registers", fallback !== null && typeof fallback.get === "function");
-  check("the empty adapter reads null", fallback.get("user", "zoom") === null);
-  let threw = false;
-  try {
-    fallback.set("user", "zoom", 1);
-    fallback.set("workspace", "layout", {});
-  } catch {
-    threw = true;
-  }
-  check("the empty adapter's set is a no-op", !threw && fallback.get("user", "zoom") === null);
-  await fallback.preload(5);
-  await fallback.reloadWorkspace();
-  check("the empty adapter's suppressWrites runs the callback", fallback.suppressWrites(() => 7) === 7);
-  check("the empty adapter warns nothing", warnings.length === 0);
-}
-
-console.warn = realWarn;
-
-if (failures.length > 0) {
-  console.error(`ui-storage: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("ui-storage: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/update-service.mjs b/crates/workshop/ui/test/update-service.mjs
deleted file mode 100644
index f37586d9e..000000000
--- a/crates/workshop/ui/test/update-service.mjs
+++ /dev/null
@@ -1,97 +0,0 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { UpdateService } from "./src/services/update-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { lifecycle, UpdateService } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-const check = (name, condition) => {
-  if (!condition) failures.push(name);
-};
-
-await assertNoLeaks(lifecycle, async () => {
-  let relaunched = 0;
-  let closed = 0;
-  const update = {
-    currentVersion: "0.2.0",
-    version: "0.3.0",
-    body: "Faster startup\nMore details",
-    async downloadAndInstall(onEvent) {
-      onEvent({ event: "Started", data: { contentLength: 100 } });
-      onEvent({ event: "Progress", data: { chunkLength: 40 } });
-      onEvent({ event: "Progress", data: { chunkLength: 60 } });
-      onEvent({ event: "Finished" });
-    },
-    async close() {
-      closed += 1;
-    },
-  };
-  const service = new UpdateService({
-    desktop: true,
-    supported: async () => true,
-    currentVersion: async () => "0.2.0",
-    check: async () => update,
-    relaunch: async () => {
-      relaunched += 1;
-    },
-  });
-  await service.checkNow();
-  check("a newer release becomes available", service.snapshot.phase === "available");
-  check("the available version is retained", service.snapshot.version === "0.3.0");
-  check("only the first release-note line is shown", service.snapshot.notes === "Faster startup");
-  service.remindLater();
-  check("remind later dismisses the banner state", service.snapshot.phase === "dismissed");
-  service.showAvailable();
-  check("a dismissed update can be shown again", service.snapshot.phase === "available");
-  await service.install();
-  check("the completed update reaches restart", service.snapshot.phase === "restarting");
-  check("download chunks accumulate against the total", service.snapshot.downloaded === 100);
-  check("the process relaunch is requested", relaunched === 1);
-  service.dispose();
-  await Promise.resolve();
-  check("disposing closes the native update handle", closed === 1);
-
-  let checked = 0;
-  const deb = new UpdateService({
-    desktop: true,
-    supported: async () => false,
-    currentVersion: async () => "0.2.0",
-    check: async () => {
-      checked += 1;
-      return null;
-    },
-    relaunch: async () => undefined,
-  });
-  await deb.checkNow();
-  check("package-managed Linux disables in-app updates", deb.snapshot.phase === "unsupported");
-  check("an unsupported package never checks the updater endpoint", checked === 0);
-  deb.dispose();
-});
-
-if (failures.length) {
-  console.error("Update service failures:\n" + failures.map((failure) => `  - ${failure}`).join("\n"));
-  process.exitCode = 1;
-} else {
-  console.log("Update service checks passed.");
-}
diff --git a/crates/workshop/ui/test/update-view.mjs b/crates/workshop/ui/test/update-view.mjs
deleted file mode 100644
index 9fb356ef9..000000000
--- a/crates/workshop/ui/test/update-view.mjs
+++ /dev/null
@@ -1,496 +0,0 @@
-// Unit test for the update view (src/parts/chrome/update-view.ts): the shared toast
-// stack fires once when an update becomes available, a re-render in the
-// same phase does not re-toast, a failed install toasts the error, a
-// failed startup check stays quiet while a failed check the user asks for
-// toasts, and the install overlay shows the shared inline progress bar.
-// The banner's button and the overlay's status lines wear Cursor's
-// update-button labels (Download Update, Downloading Update...,
-// Installing Update...). The About dialog (src/parts/chrome/about-dialog.ts)
-// shares the file because it drives the same UpdateService: a 380px card with
-// the product icon and a copy button beside the version, and beside the date
-// once a build defines one (a bundle without the define has no date row), a
-// "Copy version info" primary button that Enter activates, Escape closing
-// the card, and the check button's Cursor labels (Check for Updates...,
-// Checking for Updates..., Download Update). Every copy confirmation (a
-// row's check icon, the primary button's "Copied") shows only when the
-// clipboard write landed: a refused write and a missing clipboard confirm
-// nothing.
-// Bundles the view with esbuild and drives it against jsdom with a
-// stub-backend UpdateService and a recording toast stub.
-// Run: node test/update-view.mjs.
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { UpdateService } from "./src/services/update-service.ts";
-      export { UpdateView } from "./src/parts/chrome/update-view.ts";
-      export { showAboutDialog } from "./src/parts/chrome/about-dialog.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The view and the shared progress bar import their colocated CSS; the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-const { lifecycle, UpdateService, UpdateView, showAboutDialog } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-// A second About bundle with a build date defined, the way a build that
-// supplies __APP_BUILD_DATE__ would ship it.
-const datedBundle = await esbuild.build({
-  stdin: {
-    contents: `export { showAboutDialog } from "./src/parts/chrome/about-dialog.ts";`,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  define: { __APP_BUILD_DATE__: JSON.stringify("2026-10-08") },
-});
-const { showAboutDialog: showDatedAboutDialog } = await import(
-  `data:text/javascript;base64,${Buffer.from(datedBundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function toastStub() {
-  const shown = [];
-  return {
-    shown,
-    element: window.document.createElement("div"),
-    show(message, kind) {
-      shown.push({ message, kind });
-    },
-  };
-}
-
-function backendWith(update) {
-  return {
-    desktop: true,
-    supported: async () => true,
-    currentVersion: async () => "0.2.0",
-    check: async () => update,
-    relaunch: async () => undefined,
-  };
-}
-
-async function waitForPhase(service, phase) {
-  for (let i = 0; i < 100 && service.snapshot.phase !== phase; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-function updateNowButton() {
-  return [...window.document.querySelectorAll(".ws-update-banner button")].find(
-    (button) => button.textContent === "Download Update",
-  );
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // The happy path: available toasts once; the install's phases do not.
-  const toasts = toastStub();
-  const service = new UpdateService(
-    backendWith({
-      currentVersion: "0.2.0",
-      version: "0.3.0",
-      body: "Faster startup",
-      async downloadAndInstall(onEvent) {
-        onEvent({ event: "Started", data: { contentLength: 10 } });
-        onEvent({ event: "Progress", data: { chunkLength: 10 } });
-        onEvent({ event: "Finished" });
-      },
-      async close() {},
-    }),
-  );
-  const view = new UpdateView(service, toasts);
-  await service.checkNow();
-  check(
-    "an available update toasts once as info",
-    toasts.shown.length === 1 &&
-      toasts.shown[0]?.kind === "info" &&
-      toasts.shown[0]?.message === "Runvil 0.3.0 is available",
-  );
-  const banner = window.document.querySelector(".ws-update-banner");
-  check("the banner keeps the actionable available state", banner?.hidden === false);
-
-  // Clicking Download Update re-renders the same phase before the install's
-  // first progress frame: the guard must not re-toast.
-  updateNowButton()?.click();
-  await waitForPhase(service, "restarting");
-  check("the same phase never re-toasts", toasts.shown.length === 1);
-  check("the install reached restarting", service.snapshot.phase === "restarting");
-  const overlay = window.document.querySelector(".ws-update-screen");
-  check("the install overlay shows", overlay?.hidden === false);
-  check(
-    "the overlay shows the shared inline progress bar",
-    overlay?.querySelector(".progress [class*='progress__fill'], .progress .progress__fill") !==
-      null ||
-      overlay?.querySelector(".progress")?.getAttribute("role") === "progressbar",
-  );
-  view.dispose();
-  service.dispose();
-
-  // The failure path: a failed install toasts the error.
-  const failToasts = toastStub();
-  const failService = new UpdateService(
-    backendWith({
-      currentVersion: "0.2.0",
-      version: "0.3.0",
-      body: "",
-      async downloadAndInstall() {
-        throw new Error("network down");
-      },
-      async close() {},
-    }),
-  );
-  const failView = new UpdateView(failService, failToasts);
-  await failService.checkNow();
-  check(
-    "the failed run's available phase toasts as info",
-    failToasts.shown.length === 1 && failToasts.shown[0]?.kind === "info",
-  );
-  updateNowButton()?.click();
-  await waitForPhase(failService, "error");
-  check("the install reached the error phase", failService.snapshot.phase === "error");
-  check(
-    "a failed install toasts the error",
-    failToasts.shown.length === 2 &&
-      failToasts.shown[1]?.kind === "error" &&
-      failToasts.shown[1]?.message === "Update failed: network down",
-  );
-  failView.dispose();
-  failService.dispose();
-
-  // A failed startup check stays quiet; the same failure from a check the
-  // user asks for toasts.
-  const quietToasts = toastStub();
-  const quietService = new UpdateService({
-    ...backendWith(null),
-    check: async () => {
-      throw new Error("Could not fetch a valid release JSON from the remote");
-    },
-  });
-  const quietView = new UpdateView(quietService, quietToasts);
-  quietService.startAutoCheck(0);
-  await waitForPhase(quietService, "error");
-  check("the startup check reached the error phase", quietService.snapshot.phase === "error");
-  check("a failed startup check shows no toast", quietToasts.shown.length === 0);
-  await quietService.checkNow();
-  check(
-    "a failed check the user asks for toasts the error",
-    quietToasts.shown.length === 1 &&
-      quietToasts.shown[0]?.kind === "error" &&
-      quietToasts.shown[0]?.message ===
-        "Update failed: Could not fetch a valid release JSON from the remote",
-  );
-  quietView.dispose();
-  quietService.dispose();
-
-  // An install started from the startup check's banner is the user's
-  // request, so its failure still toasts.
-  const installToasts = toastStub();
-  const installService = new UpdateService(
-    backendWith({
-      currentVersion: "0.2.0",
-      version: "0.3.0",
-      body: "",
-      async downloadAndInstall() {
-        throw new Error("disk full");
-      },
-      async close() {},
-    }),
-  );
-  const installView = new UpdateView(installService, installToasts);
-  installService.startAutoCheck(0);
-  await waitForPhase(installService, "available");
-  updateNowButton()?.click();
-  await waitForPhase(installService, "error");
-  check(
-    "a failed install after the startup check toasts the error",
-    installToasts.shown.length === 2 &&
-      installToasts.shown[1]?.kind === "error" &&
-      installToasts.shown[1]?.message === "Update failed: disk full",
-  );
-  installView.dispose();
-  installService.dispose();
-
-  // The overlay's status lines wear Cursor's capitalization: a download
-  // held open shows "Downloading Update... 50%".
-  let releaseDownload = () => {};
-  const gate = new Promise((resolve) => {
-    releaseDownload = resolve;
-  });
-  const slowService = new UpdateService(
-    backendWith({
-      currentVersion: "0.2.0",
-      version: "0.3.0",
-      body: "",
-      async downloadAndInstall(onEvent) {
-        onEvent({ event: "Started", data: { contentLength: 10 } });
-        onEvent({ event: "Progress", data: { chunkLength: 5 } });
-        await gate;
-        onEvent({ event: "Finished" });
-      },
-      async close() {},
-    }),
-  );
-  const slowView = new UpdateView(slowService, toastStub());
-  await slowService.checkNow();
-  updateNowButton()?.click();
-  await waitForPhase(slowService, "downloading");
-  check(
-    "a download in flight reads Downloading Update... with its percentage",
-    window.document.querySelector(".ws-update-screen__panel p")?.textContent === "Downloading Update... 50%",
-  );
-  releaseDownload();
-  await waitForPhase(slowService, "restarting");
-  slowView.dispose();
-  slowService.dispose();
-
-  // --- The About dialog -----------------------------------------------------
-
-  const clipboardWrites = [];
-  let refuseWrites = false;
-  const fakeNavigator = {
-    clipboard: {
-      writeText: async (text) => {
-        if (refuseWrites) {
-          throw new Error("NotAllowedError: clipboard write refused");
-        }
-        clipboardWrites.push(text);
-      },
-    },
-  };
-  const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
-  Object.defineProperty(globalThis, "navigator", {
-    value: fakeNavigator,
-    configurable: true,
-    writable: true,
-  });
-  const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
-  const aboutService = new UpdateService(backendWith(null));
-  await aboutService.checkNow();
-  const invoker = window.document.createElement("button");
-  window.document.body.appendChild(invoker);
-  invoker.focus();
-  const about = showAboutDialog(aboutService);
-  const card = window.document.querySelector(".ws-about-dialog");
-  check(
-    "the About card is a modal dialog named by its title",
-    card?.getAttribute("role") === "dialog" &&
-      card?.getAttribute("aria-modal") === "true" &&
-      card?.getAttribute("aria-labelledby") === card?.querySelector("h2")?.id,
-  );
-  const icon = card?.querySelector(".ws-about-dialog__icon");
-  check(
-    "the About card shows the decorative product icon",
-    icon?.tagName === "IMG" && icon?.getAttribute("src") === "/icons/runvil-icon.png" && icon?.getAttribute("alt") === "",
-  );
-  const field = (name) => card?.querySelector(`.ws-about-dialog__row[data-field="${name}"]`);
-  check("the version row shows the running version", field("version")?.querySelector(".ws-about-dialog__value")?.textContent === "0.2.0");
-  check(
-    "a bundle without a build date shows no date row, not an Unknown one",
-    field("date") === null && !card?.textContent?.includes("Unknown"),
-  );
-  const copyVersion = field("version")?.querySelector("button");
-  check("the version row has a labelled copy button", copyVersion?.getAttribute("aria-label") === "Copy version");
-  const copyIconHtml = copyVersion?.innerHTML;
-  copyVersion?.click();
-  await flush();
-  check("the version's copy button copies the version", clipboardWrites.at(-1) === "0.2.0");
-  check("a landed copy swaps the row's icon to the check", copyVersion?.innerHTML !== copyIconHtml);
-
-  const primary = card?.querySelector(".ws-about-dialog__primary");
-  check("the primary button reads Copy version info", primary?.textContent === "Copy version info");
-  check("the primary button holds focus on open", window.document.activeElement === primary);
-  const pressKey = (key) => {
-    const event = new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true });
-    window.document.dispatchEvent(event);
-    return event;
-  };
-  clipboardWrites.length = 0;
-  const enter = pressKey("Enter");
-  await flush();
-  check(
-    "Enter copies the version info",
-    clipboardWrites.length === 1 && clipboardWrites[0] === "Version: 0.2.0",
-  );
-  check("Enter's press is consumed so the focused button does not click a second time", enter.defaultPrevented === true);
-  check("a copied primary button says so", primary?.textContent === "Copied");
-
-  const closeButton = card?.querySelector(".ws-about-dialog__close");
-  closeButton?.focus();
-  clipboardWrites.length = 0;
-  const enterOnClose = pressKey("Enter");
-  await flush();
-  check(
-    "Enter on another button leaves that button's own action alone",
-    clipboardWrites.length === 0 && enterOnClose.defaultPrevented === false,
-  );
-
-  const checkButton = card?.querySelector(".ws-about-dialog__check");
-  check("the check button wears Cursor's idle label", checkButton?.textContent === "Check for Updates...");
-  pressKey("Escape");
-  check("Escape closes the About card", window.document.querySelector(".ws-about-dialog") === null);
-  check("closing the About card returns focus to its invoker", window.document.activeElement === invoker);
-  about.dispose();
-
-  // A copy confirmation shows only when the write landed: a refused write
-  // and a missing clipboard leave the icon and the primary label alone, and
-  // the next landed write confirms.
-  {
-    const refusedAbout = showAboutDialog(aboutService);
-    const refusedCard = window.document.querySelector(".ws-about-dialog");
-    const rowCopy = refusedCard?.querySelector('.ws-about-dialog__row[data-field="version"] button');
-    const rowIcon = rowCopy?.innerHTML;
-    const refusedPrimary = refusedCard?.querySelector(".ws-about-dialog__primary");
-    clipboardWrites.length = 0;
-
-    refuseWrites = true;
-    rowCopy?.click();
-    refusedPrimary?.click();
-    await flush();
-    check("a refused write leaves the row's copy icon alone", rowCopy?.innerHTML === rowIcon);
-    check(
-      "a refused write leaves the primary button reading Copy version info",
-      refusedPrimary?.textContent === "Copy version info",
-    );
-
-    refuseWrites = false;
-    fakeNavigator.clipboard = undefined;
-    rowCopy?.click();
-    refusedPrimary?.click();
-    await flush();
-    check("a missing clipboard leaves the row's copy icon alone", rowCopy?.innerHTML === rowIcon);
-    check(
-      "a missing clipboard leaves the primary button reading Copy version info",
-      refusedPrimary?.textContent === "Copy version info",
-    );
-
-    fakeNavigator.clipboard = {
-      writeText: async (text) => {
-        clipboardWrites.push(text);
-      },
-    };
-    rowCopy?.click();
-    refusedPrimary?.click();
-    await flush();
-    check("a landed write swaps the row's icon to the check", rowCopy?.innerHTML !== rowIcon);
-    check("a landed write labels the primary button Copied", refusedPrimary?.textContent === "Copied");
-    check(
-      "only the landed writes reached the clipboard",
-      clipboardWrites.length === 2 &&
-        clipboardWrites[0] === "0.2.0" &&
-        clipboardWrites[1] === "Version: 0.2.0",
-    );
-    refusedAbout.dispose();
-  }
-
-  // A build that defines the date gets the date row, its copy button, and
-  // the Date line in the primary copy.
-  {
-    const datedAbout = showDatedAboutDialog(aboutService);
-    const datedCard = window.document.querySelector(".ws-about-dialog");
-    const dateRow = datedCard?.querySelector('.ws-about-dialog__row[data-field="date"]');
-    check(
-      "a build date appears as a labelled row after the version",
-      dateRow?.querySelector(".ws-about-dialog__value")?.textContent === "2026-10-08" &&
-        dateRow?.previousElementSibling?.getAttribute("data-field") === "version",
-    );
-    const dateCopy = dateRow?.querySelector("button");
-    check("the date row has a labelled copy button", dateCopy?.getAttribute("aria-label") === "Copy date");
-    const dateIcon = dateCopy?.innerHTML;
-    clipboardWrites.length = 0;
-    dateCopy?.click();
-    await flush();
-    check(
-      "the date's copy button copies the date and confirms",
-      clipboardWrites.length === 1 && clipboardWrites[0] === "2026-10-08" && dateCopy?.innerHTML !== dateIcon,
-    );
-    clipboardWrites.length = 0;
-    datedCard?.querySelector(".ws-about-dialog__primary")?.click();
-    await flush();
-    check(
-      "the primary copy carries the version and the date",
-      clipboardWrites.length === 1 && clipboardWrites[0] === "Version: 0.2.0\nDate: 2026-10-08",
-    );
-    datedAbout.dispose();
-  }
-
-  // The check button follows the phase with Cursor's labels.
-  const availableService = new UpdateService(
-    backendWith({
-      currentVersion: "0.2.0",
-      version: "0.3.0",
-      body: "",
-      async downloadAndInstall() {},
-      async close() {},
-    }),
-  );
-  await availableService.checkNow();
-  const availableAbout = showAboutDialog(availableService);
-  check(
-    "an available update labels the check button Download Update",
-    window.document.querySelector(".ws-about-dialog__check")?.textContent === "Download Update",
-  );
-  availableAbout.dispose();
-  availableService.dispose();
-  const checkingService = new UpdateService({
-    ...backendWith(null),
-    check: () => new Promise(() => {}),
-  });
-  void checkingService.checkNow();
-  await flush();
-  const checkingAbout = showAboutDialog(checkingService);
-  const checking = window.document.querySelector(".ws-about-dialog__check");
-  check(
-    "a check in flight reads Checking for Updates... and is disabled",
-    checking?.textContent === "Checking for Updates..." && checking?.disabled === true,
-  );
-  checkingAbout.dispose();
-  checkingService.dispose();
-  aboutService.dispose();
-  invoker.remove();
-  if (originalNavigator !== undefined) {
-    Object.defineProperty(globalThis, "navigator", originalNavigator);
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`update-view: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("update-view: all assertions passed");
diff --git a/crates/workshop/ui/test/watermark.mjs b/crates/workshop/ui/test/watermark.mjs
deleted file mode 100644
index d563a4f1b..000000000
--- a/crates/workshop/ui/test/watermark.mjs
+++ /dev/null
@@ -1,309 +0,0 @@
-// The empty editor group's watermark (src/parts/layout/watermark.ts and
-// watermark.css): a product mark over shortcut rows that read their key caps
-// from the keybinding registry. The rows run New Agent, Show Files, Search
-// Files, then Add Folder; a row whose command has no keybinding is left out,
-// and Add Folder shows only while exactly one root is open, re-checking when
-// the workspace changes - with no tree panel mounted too, because the
-// tree-state service drops the shared roots load itself. The stylesheet pins
-// the look: at most 500px wide,
-// half opacity, a 100px mark, rows padded 4px 4px 4px 8px with a 4px radius,
-// the rows dropping out below a 478px-wide group, and nothing shown in the
-// side zones' empty groups.
-// Run: node test/watermark.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { declaration, readUi, resolver, rulesOf, valueIn } from "./helpers/css-values.mjs";
-
-const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createWatermark, WATERMARK_ROWS } from "./src/parts/layout/watermark.ts";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-      export { WORKSPACE_CHANGED_EVENT } from "./src/services/workspace-events.ts";
-      export { TREE_STATE, TreeStateService } from "./src/services/tree-state-service.ts";
-      export { registerService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: uiDir,
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-for (const name of ["window", "document", "Element", "HTMLElement", "Node", "Event", "CustomEvent", "KeyboardEvent"]) {
-  globalThis[name] = window[name];
-}
-const bundlePath = path.join(os.tmpdir(), "runvil-watermark-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createWatermark,
-  WATERMARK_ROWS,
-  createKeybindingsRegistry,
-  WORKSPACE_CHANGED_EVENT,
-  TREE_STATE,
-  TreeStateService,
-  registerService,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-const flush = async () => {
-  for (let i = 0; i < 4; i += 1) await new Promise((resolve) => setTimeout(resolve, 0));
-};
-
-/** A registry with every watermark command bound except the ones left out. */
-function registryWith(skip = []) {
-  const registry = createKeybindingsRegistry("windows");
-  const bindings = {
-    "workbench.action.chat.new": "ctrl+shift+l",
-    "workbench.view.explorer": "ctrl+shift+e",
-    "workbench.action.quickOpen": "ctrl+p",
-    "workbench.action.files.openFolder": "ctrl+m ctrl+o",
-  };
-  for (const [id, keybinding] of Object.entries(bindings)) {
-    if (!skip.includes(id)) registry.registerKeybindingRule({ id, keybinding });
-  }
-  return registry;
-}
-
-/** A scripted root count the test can change between workspace events. */
-function rootCounter(initial) {
-  const counter = { count: initial, reads: 0 };
-  counter.read = async () => {
-    counter.reads += 1;
-    return counter.count;
-  };
-  return counter;
-}
-
-const labelsOf = (watermark) =>
-  [...watermark.element.querySelectorAll(".ws-watermark__row")].map(
-    (row) => row.querySelector(".ws-watermark__label")?.textContent,
-  );
-const chordsOf = (row) =>
-  [...row.querySelectorAll(".ws-watermark__chord")].map((chord) =>
-    [...chord.querySelectorAll(".ws-watermark__key")].map((key) => key.textContent),
-  );
-
-// --- The row list ---------------------------------------------------------------------
-
-check(
-  "the watermark's rows run New Agent, Show Files, Search Files, Add Folder",
-  WATERMARK_ROWS.map((row) => row.label).join("|") === "New Agent|Show Files|Search Files|Add Folder",
-);
-
-// --- One root open: all four rows, with their key caps ----------------------------------
-
-{
-  const roots = rootCounter(1);
-  const watermark = createWatermark({ keybindings: registryWith(), rootCount: roots.read });
-  watermark.init({});
-  document.body.append(watermark.element);
-  await flush();
-  check("the watermark is a div with the watermark class", watermark.element.classList.contains("ws-watermark"));
-  check(
-    "the product mark is an image with no alt text",
-    watermark.element.querySelector("img.ws-watermark__mark")?.getAttribute("alt") === "",
-  );
-  check(
-    "one root shows all four rows in order",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Search Files|Add Folder",
-  );
-  const rows = [...watermark.element.querySelectorAll(".ws-watermark__row")];
-  check(
-    "a row draws one key cap per key of its chord",
-    JSON.stringify(chordsOf(rows[0])) === JSON.stringify([["Ctrl", "Shift", "L"]]) &&
-      JSON.stringify(chordsOf(rows[2])) === JSON.stringify([["Ctrl", "P"]]),
-  );
-  check(
-    "a two-chord keybinding draws one group of caps per chord",
-    JSON.stringify(chordsOf(rows[3])) === JSON.stringify([["Ctrl", "M"], ["Ctrl", "O"]]),
-  );
-  check(
-    "each row names its command",
-    rows[1].dataset.commandId === "workbench.view.explorer",
-  );
-
-  // --- The root count is re-read when the workspace changes -----------------------------
-  const readsBefore = roots.reads;
-  roots.count = 2;
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("a workspace change re-reads the root count", roots.reads === readsBefore + 1);
-  check(
-    "two roots drop the Add Folder row",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Search Files",
-  );
-  roots.count = 1;
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("back to one root, Add Folder returns", labelsOf(watermark).at(-1) === "Add Folder");
-
-  watermark.dispose?.();
-  const readsAfterDispose = roots.reads;
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("a disposed watermark stops listening for workspace changes", roots.reads === readsAfterDispose);
-  watermark.element.remove();
-}
-
-// --- No root, and the first paint before the count is known --------------------------------
-
-{
-  const roots = rootCounter(0);
-  const watermark = createWatermark({ keybindings: registryWith(), rootCount: roots.read });
-  watermark.init({});
-  check(
-    "before the count arrives the conditional row is not shown",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Search Files",
-  );
-  await flush();
-  check(
-    "no root shows no Add Folder row",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Search Files",
-  );
-  watermark.dispose?.();
-}
-
-// --- A failing count read leaves the row out ----------------------------------------------------
-
-{
-  const watermark = createWatermark({
-    keybindings: registryWith(),
-    rootCount: async () => {
-      throw new Error("server down");
-    },
-  });
-  watermark.init({});
-  await flush();
-  check("an unreadable root count leaves Add Folder out", labelsOf(watermark).at(-1) === "Search Files");
-  watermark.dispose?.();
-}
-
-// --- Only commands that have a keybinding get a row ------------------------------------------------
-
-{
-  const watermark = createWatermark({
-    keybindings: registryWith(["workbench.action.quickOpen"]),
-    rootCount: rootCounter(1).read,
-  });
-  watermark.init({});
-  await flush();
-  check(
-    "a command without a keybinding has no row",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Add Folder",
-  );
-  watermark.dispose?.();
-}
-
-// --- A workspace change with no tree panel mounted ---------------------------------------------------
-
-// The empty editor's watermark is on screen exactly when Explorer is closed,
-// so no tree panel is alive to drop the shared roots load. The tree-state
-// service follows the event itself (main.ts installs it); here the watermark
-// reads the real service through its default root count, over a scripted
-// /workspace/tree, and the only listener besides its own is the service's.
-{
-  const tree = new TreeStateService();
-  registerService(TREE_STATE, () => tree);
-  const follower = tree.followWorkspaceChanges(window);
-  const root = (name) => ({ name, path: `C:\\${name}`, kind: "directory", size: 0, modified_ms: 1, exists: true });
-  let listing = { path: null, entries: [root("one")] };
-  let treeReads = 0;
-  globalThis.fetch = async (url) => {
-    if (url !== "/workspace/tree") throw new Error(`unexpected fetch in the watermark test: ${url}`);
-    treeReads += 1;
-    return { ok: true, status: 200, json: async () => listing };
-  };
-  const watermark = createWatermark({ keybindings: registryWith() });
-  watermark.init({});
-  document.body.append(watermark.element);
-  await flush();
-  check(
-    "the real roots load shows Add Folder while one root is granted",
-    labelsOf(watermark).at(-1) === "Add Folder" && treeReads === 1,
-  );
-
-  listing = { path: null, entries: [root("one"), root("two")] };
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("a root granted with no tree panel mounted re-reads the roots", treeReads === 2);
-  check(
-    "a root granted with no tree panel mounted drops the Add Folder row",
-    labelsOf(watermark).join("|") === "New Agent|Show Files|Search Files",
-  );
-
-  listing = { path: null, entries: [root("one")] };
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("a root removed with no tree panel mounted brings Add Folder back", labelsOf(watermark).at(-1) === "Add Folder" && treeReads === 3);
-
-  window.dispatchEvent(new window.CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: { rootsCurrent: true } }));
-  await flush();
-  check("an event saying the roots are current fetches nothing", treeReads === 3);
-
-  watermark.dispose();
-  watermark.element.remove();
-  follower.dispose();
-  tree.dispose();
-}
-
-// --- The stylesheet ----------------------------------------------------------------------------------
-
-{
-  const resolve = await resolver();
-  const css = await readUi("src/parts/layout/watermark.css");
-  const rules = rulesOf(css);
-  const value = (selector, property, at = null) => resolve(valueIn(rules, selector, property, at));
-  check("the watermark is at most 500px wide", value(".ws-watermark", "max-inline-size") === "500px");
-  check("the watermark sits at half opacity", value(".ws-watermark", "opacity") === "0.5");
-  check("the watermark text is the quiet #F0F0F099", value(".ws-watermark", "color") === "#f0f0f099");
-  check("the watermark measures its own width for the row cutoff", value(".ws-watermark", "container-type") === "inline-size");
-  check("the product mark is 100px", value(".ws-watermark__mark", "inline-size") === "100px");
-  check(
-    "a row is padded 4px 4px 4px 8px",
-    value(".ws-watermark__row", "padding") === "4px 4px 4px 8px",
-  );
-  check("a row has a 4px radius", value(".ws-watermark__row", "border-radius") === "4px");
-  const cutoff = rules.find(
-    (rule) =>
-      rule.selectors.includes(".ws-watermark__rows") &&
-      rule.at.some((header) => /^@container\s*\(\s*(width\s*<\s*478px|max-width:\s*477\.98px)\s*\)$/.test(header)),
-  );
-  check(
-    "the rows are hidden in a group narrower than 478px",
-    cutoff !== undefined && declaration(cutoff.body, "display") === "none",
-  );
-  const hiddenInSides = rules.find(
-    (rule) =>
-      rule.selectors.includes('[data-ws-zone="left"] .ws-watermark') &&
-      rule.selectors.includes('[data-ws-zone="right"] .ws-watermark'),
-  );
-  check(
-    "the side zones' empty groups show no watermark",
-    hiddenInSides !== undefined && declaration(hiddenInSides.body, "display") === "none",
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`watermark: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("watermark: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/window-chrome.mjs b/crates/workshop/ui/test/window-chrome.mjs
deleted file mode 100644
index cbaa358a6..000000000
--- a/crates/workshop/ui/test/window-chrome.mjs
+++ /dev/null
@@ -1,299 +0,0 @@
-// Unit test for the custom window title bar (src/parts/chrome/window-chrome.ts). Bundles
-// the TS module with esbuild - with "@tauri-apps/api/window" aliased to the
-// recording stub in test/helpers - imports it via a data URL, and drives it
-// against jsdom built from the real index.html. Covers: without
-// __TAURI_INTERNALS__ the bar is revealed but the control cluster hides and
-// no native call is made; a missing bar throws; in the desktop app each
-// control calls its window method; the drag region only drags on the
-// primary button; double-click toggles maximize; and the maximized state
-// read back on resize switches the glyph and aria-label on transitions
-// only, with the listener dying at dispose. Also covers the title bar's
-// toolbars (Toggle Primary Side Bar on the left, Toggle Agents and the
-// settings gear on the right: icon buttons that run their command and
-// carry the chord in their tooltip) and the inactive-window class that
-// follows the window's blur and focus.
-// Run: node test/window-chrome.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { setupWindowChrome } from "./src/parts/chrome/window-chrome.ts";
-      export { CommandRegistry } from "@workshop/platform/command-registry";
-      export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The module under test imports its colocated CSS; strip it - the test
-  // drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-  },
-});
-const code = bundle.outputFiles[0].text;
-const { setupWindowChrome, CommandRegistry, createKeybindingsRegistry } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-// The toolbars dispatch through a recording command registry and label their
-// tooltips from a private keybinding registry, so no global state is shared.
-const ran = [];
-const commands = new CommandRegistry();
-for (const id of [
-  "workbench.action.toggleSidebarVisibility",
-  "workbench.action.toggleAuxiliaryBar",
-  "workbench.action.openSettings",
-]) {
-  commands.register(id, { run: () => ran.push(id) });
-}
-const keybindings = createKeybindingsRegistry("windows");
-keybindings.registerKeybindingRule({ id: "workbench.action.toggleSidebarVisibility", keybinding: "ctrl+b" });
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets the async maximized sync (a stubbed promise) run to completion.
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// Each scenario gets a fresh jsdom: setupWindowChrome reads the globals and
-// attaches listeners to the DOM it finds at call time.
-function scenario({ desktop }) {
-  const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-  const { window } = dom;
-  if (desktop) {
-    window.__TAURI_INTERNALS__ = {};
-  }
-  globalThis.window = window;
-  globalThis.document = window.document;
-  globalThis.CustomEvent = window.CustomEvent;
-  const chrome = setupWindowChrome({ commands, keybindings });
-  return {
-    window,
-    chrome,
-    bar: window.document.querySelector(".ws-window-titlebar"),
-    stub: () => window.__TAURI_STUB__,
-  };
-}
-
-// --- Browser mode: bar visible for the menus, native controls hidden --------
-
-{
-  const { window, bar } = scenario({ desktop: false });
-  check("browser mode reveals the bar", bar.hidden === false);
-  const controls = bar.querySelector(".ws-window-titlebar__controls");
-  check("browser mode hides the window-control cluster", controls.hidden === true);
-  check("browser mode never installs the Tauri internals", !("__TAURI_INTERNALS__" in window));
-  check("browser mode makes no native call", window.__TAURI_STUB__ === undefined);
-}
-
-// --- Missing markup: the module guards the DOM contract ---------------------
-
-{
-  const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-  globalThis.window = dom.window;
-  globalThis.document = dom.window.document;
-  let threw = false;
-  try {
-    setupWindowChrome();
-  } catch {
-    threw = true;
-  }
-  check("a page without the title bar throws", threw);
-}
-
-// --- Desktop mode: reveal and native window commands ------------------------
-
-{
-  const { window, bar, chrome, stub } = scenario({ desktop: true });
-  check("desktop mode reveals the bar", bar.hidden === false);
-  check(
-    "desktop mode keeps the window-control cluster visible",
-    bar.querySelector(".ws-window-titlebar__controls").hidden === false,
-  );
-
-  const callsAfterClick = (command) => {
-    stub().calls.length = 0;
-    bar.querySelector(`[data-command="${command}"]`).click();
-    return stub().calls.join(",");
-  };
-  check("minimize calls the window method", callsAfterClick("minimize") === "minimize");
-  check(
-    "maximize calls the window method",
-    callsAfterClick("toggle-maximize") === "toggle-maximize",
-  );
-  check("close calls the window method", callsAfterClick("close") === "close");
-
-  const drag = bar.querySelector(".ws-window-titlebar__drag");
-  stub().calls.length = 0;
-  drag.dispatchEvent(new window.MouseEvent("mousedown", { button: 0, detail: 1, bubbles: true }));
-  check("primary press in the empty center starts the drag", stub().calls.join(",") === "drag");
-  stub().calls.length = 0;
-  drag.dispatchEvent(new window.MouseEvent("mousedown", { button: 2, detail: 1, bubbles: true }));
-  check("non-primary press does not drag", stub().calls.length === 0);
-  // The OS move loop started by the first press swallows the release, so
-  // no dblclick ever reaches the page; the second press (detail 2) is the
-  // only signal and must toggle maximize without starting another drag.
-  stub().calls.length = 0;
-  drag.dispatchEvent(new window.MouseEvent("mousedown", { button: 0, detail: 2, bubbles: true }));
-  check("second press toggles maximize instead of dragging", stub().calls.join(",") === "toggle-maximize");
-  stub().calls.length = 0;
-  drag.dispatchEvent(new window.MouseEvent("dblclick", { bubbles: true }));
-  check("a dblclick event alone triggers nothing", stub().calls.length === 0);
-
-  // The glyphs are SVG, so visibility is the hidden *attribute* - an
-  // SVGSVGElement has no `hidden` IDL property, and assigning one would
-  // only create an inert expando that no stylesheet can see.
-  const maximize = bar.querySelector('[data-command="toggle-maximize"]');
-  const maximizeGlyph = maximize.querySelector(".ws-window-titlebar__glyph--maximize");
-  const restoreGlyph = maximize.querySelector(".ws-window-titlebar__glyph--restore");
-
-  await flush();
-  check(
-    "boot syncs the maximize glyph from the window state",
-    maximize.getAttribute("aria-label") === "Maximize" &&
-      !maximizeGlyph.hasAttribute("hidden") &&
-      restoreGlyph.hasAttribute("hidden"),
-  );
-
-  stub().maximized = true;
-  stub().resizeHandlers.forEach((handler) => handler({}));
-  await flush();
-  check(
-    "a resize into maximized switches the label to Restore",
-    maximize.getAttribute("aria-label") === "Restore",
-  );
-  check(
-    "a resize into maximized swaps the glyphs",
-    maximizeGlyph.hasAttribute("hidden") && !restoreGlyph.hasAttribute("hidden"),
-  );
-
-  stub().maximized = false;
-  stub().resizeHandlers.forEach((handler) => handler({}));
-  await flush();
-  check(
-    "a resize into restored switches the label back to Maximize",
-    maximize.getAttribute("aria-label") === "Maximize",
-  );
-  check(
-    "a resize into restored restores the glyphs",
-    !maximizeGlyph.hasAttribute("hidden") && restoreGlyph.hasAttribute("hidden"),
-  );
-
-  // The resize listener dies with the chrome: a later resize leaves the
-  // control alone.
-  chrome.dispose();
-  await flush();
-  stub().maximized = true;
-  stub().resizeHandlers.forEach((handler) => handler({}));
-  await flush();
-  check(
-    "after dispose a resize leaves the control alone",
-    maximize.getAttribute("aria-label") === "Maximize" &&
-      !maximizeGlyph.hasAttribute("hidden") &&
-      restoreGlyph.hasAttribute("hidden"),
-  );
-}
-
-// --- Toolbars: Toggle Primary Side Bar left; Toggle Agents and the gear right ---
-
-for (const desktop of [false, true]) {
-  const mode = desktop ? "desktop" : "browser";
-  const { bar, chrome } = scenario({ desktop });
-
-  const left = bar.querySelector(".ws-window-titlebar__left");
-  const leftToolbar = left.querySelector(":scope > .ws-window-titlebar__toolbar");
-  check(`${mode}: the left region holds a toolbar after the menubar`, leftToolbar !== null && leftToolbar.previousElementSibling === left.querySelector(".ws-window-titlebar__menus"));
-  const leftButtons = [...(leftToolbar?.querySelectorAll("button") ?? [])];
-  check(
-    `${mode}: the left toolbar is exactly Toggle Primary Side Bar`,
-    leftButtons.length === 1 &&
-      leftButtons[0].dataset.commandId === "workbench.action.toggleSidebarVisibility" &&
-      leftButtons[0].getAttribute("aria-label") === "Toggle Primary Side Bar",
-  );
-  check(`${mode}: the left toolbar button draws an icon`, leftButtons[0]?.querySelector("svg") !== null);
-  check(
-    `${mode}: the tooltip names the chord`,
-    leftButtons[0]?.getAttribute("title") === "Toggle Primary Side Bar (Ctrl+B)",
-  );
-
-  const right = bar.querySelector(".ws-window-titlebar__right");
-  const rightToolbar = right.querySelector(":scope > .ws-window-titlebar__toolbar");
-  check(
-    `${mode}: the right region's toolbar sits before the window controls`,
-    rightToolbar !== null && rightToolbar.nextElementSibling === right.querySelector(".ws-window-titlebar__controls"),
-  );
-  const rightButtons = [...(rightToolbar?.querySelectorAll("button") ?? [])];
-  check(
-    `${mode}: the right toolbar is Toggle Agents then Settings`,
-    rightButtons.map((button) => `${button.dataset.commandId}:${button.getAttribute("aria-label")}`).join(",") ===
-      "workbench.action.toggleAuxiliaryBar:Toggle Agents,workbench.action.openSettings:Settings",
-  );
-  check(
-    `${mode}: a tooltip without a chord is the bare name`,
-    rightButtons[0]?.getAttribute("title") === "Toggle Agents",
-  );
-  check(`${mode}: every toolbar button is a type=button control with an icon`, [...leftButtons, ...rightButtons].every((button) => button.type === "button" && button.querySelector("svg") !== null));
-
-  ran.length = 0;
-  for (const button of [...leftButtons, ...rightButtons]) button.click();
-  await flush();
-  check(
-    `${mode}: each toolbar button runs its command`,
-    ran.join(",") ===
-      "workbench.action.toggleSidebarVisibility,workbench.action.toggleAuxiliaryBar,workbench.action.openSettings",
-  );
-
-  chrome.dispose();
-  check(`${mode}: dispose removes the toolbars`, bar.querySelector(".ws-window-titlebar__toolbar") === null);
-}
-
-// --- Inactive window: the bar follows the window's blur and focus ---------------
-
-{
-  const { window, bar, chrome } = scenario({ desktop: false });
-  check("a fresh bar is active", !bar.classList.contains("ws-window-titlebar--inactive"));
-  window.dispatchEvent(new window.Event("blur"));
-  check("a blurred window marks the bar inactive", bar.classList.contains("ws-window-titlebar--inactive"));
-  window.dispatchEvent(new window.Event("focus"));
-  check("a refocused window clears the mark", !bar.classList.contains("ws-window-titlebar--inactive"));
-  window.dispatchEvent(new window.Event("blur"));
-  chrome.dispose();
-  window.dispatchEvent(new window.Event("focus"));
-  check("after dispose the focus listener is gone", bar.classList.contains("ws-window-titlebar--inactive"));
-}
-
-// --- The program icon is 16px in a 35px box ------------------------------------
-
-{
-  const { bar } = scenario({ desktop: false });
-  const icon = bar.querySelector(".ws-window-titlebar__icon");
-  check("the program icon is declared 16px", icon.getAttribute("width") === "16" && icon.getAttribute("height") === "16");
-}
-
-if (failures.length > 0) {
-  console.error(`window-chrome: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("window-chrome: all assertions passed");
diff --git a/crates/workshop/ui/test/window-menu.mjs b/crates/workshop/ui/test/window-menu.mjs
deleted file mode 100644
index 1dfb644a0..000000000
--- a/crates/workshop/ui/test/window-menu.mjs
+++ /dev/null
@@ -1,330 +0,0 @@
-// Unit test for the menubar (src/parts/menu/menubar.ts) composing the menu
-// popover widget (src/parts/menu/menu.ts) over the services registries.
-// Bundles the TS modules with esbuild - with "@tauri-apps/api/window"
-// aliased to the recording stub in test/helpers - and drives them
-// against jsdom built from the real index.html. Covers: button
-// generation in registry sort order, click toggle, one-menu-at-a-time,
-// rollover, ArrowLeft/Right between menus with flyout navigation
-// yielding to the widget, Escape, outside pointer and blur dismissal,
-// disabled rows and context-key rebuilds, command dispatch with
-// shortcut hints, and disposal. The composition-root bootstrap
-// (src/parts/menu/index.ts) is covered end-to-end by the boot tests
-// (titlebar-browser-mode.mjs).
-// Run: node --test test/window-menu.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-async function bundle(contents) {
-  const result = await esbuild.build({
-    stdin: { contents, resolveDir: path.join(uiDir, ".."), loader: "ts" },
-    bundle: true,
-    write: false,
-    format: "esm",
-    platform: "browser",
-    target: "es2022",
-    logLevel: "silent",
-    // The modules under test import their colocated CSS; strip it - the
-    // test drives only the JS, and jsdom applies no stylesheets anyway.
-    loader: { ".css": "empty" },
-    // Stands in for the build-time crate-version define (build.mjs and
-    // the crate's build.rs): the About dialog must render this value.
-    define: { __APP_VERSION__: JSON.stringify("0.0.0-test") },
-    alias: {
-      "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-    },
-  });
-  return import(`data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString("base64")}`);
-}
-
-const { Menubar, CommandRegistry, MenuRegistry, MenuId, ContextKeyService, createKeybindingsRegistry } =
-  await bundle(`
-    export { Menubar } from "./src/parts/menu/menubar.ts";
-    export { CommandRegistry } from "@workshop/platform/command-registry";
-    export { MenuRegistry, MenuId } from "@workshop/platform/menu-registry";
-    export { ContextKeyService } from "@workshop/platform/context-key-service";
-    export { createKeybindingsRegistry } from "@workshop/platform/keybinding-registry";
-  `);
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function installGlobals(window) {
-  globalThis.window = window;
-  globalThis.document = window.document;
-  globalThis.Element = window.Element;
-  globalThis.HTMLElement = window.HTMLElement;
-  globalThis.HTMLButtonElement = window.HTMLButtonElement;
-  globalThis.HTMLInputElement = window.HTMLInputElement;
-  globalThis.HTMLTextAreaElement = window.HTMLTextAreaElement;
-  globalThis.Node = window.Node;
-}
-
-// Each scenario gets a fresh jsdom and fresh registries: the widgets read
-// the globals and attach listeners to the DOM they find at call time.
-function menubarScenario() {
-  const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-  const { window } = dom;
-  installGlobals(window);
-
-  const commands = new CommandRegistry();
-  const menus = new MenuRegistry();
-  const contextKeys = new ContextKeyService();
-  const keybindings = createKeybindingsRegistry("linux");
-  const runs = [];
-
-  // Registered out of order on purpose: the bar renders registry sort
-  // order, not registration order.
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/view", title: "View", order: 3 });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/file", title: "File", order: 1 });
-  menus.appendMenuItem(MenuId.MenubarMainMenu, { submenu: "menubar/edit", title: "Edit", order: 2 });
-
-  commands.register("file.new", { title: "New File", run: (...args) => runs.push(["file.new", ...args]) });
-  commands.register("file.close", { title: "Close Window", run: () => runs.push(["file.close"]) });
-  keybindings.registerKeybindingRule({ id: "file.new", keybinding: "ctrl+n" });
-  menus.appendMenuItem("menubar/file", { command: "file.new" });
-  menus.appendMenuItem("menubar/file", { command: "file.close", group: "1_close" });
-
-  const canEdit = contextKeys.createKey("canEdit", false);
-  commands.register("edit.undo", { title: "Undo", precondition: "canEdit", run: () => runs.push(["edit.undo"]) });
-  menus.appendMenuItem("menubar/edit", { command: "edit.undo" });
-
-  menus.appendMenuItem("menubar/view", { submenu: "menubar/view/appearance", title: "Appearance" });
-  commands.register("view.toggle", { title: "Toggle Center", run: () => runs.push(["view.toggle"]) });
-  menus.appendMenuItem("menubar/view/appearance", { command: "view.toggle" });
-
-  const nav = window.document.querySelector(".ws-window-titlebar__menus");
-  const menubar = new Menubar(nav, { menus, commands, contextKeys, keybindings });
-
-  const button = (id) => window.document.querySelector(`.ws-window-titlebar__menu[data-menu="${id}"]`);
-  const popovers = () =>
-    [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter((el) => !el.hidden);
-  const rowsOf = (popover) => [...popover.querySelectorAll(":scope > .ws-window-titlebar__item")];
-  const rowByLabel = (popover, label) =>
-    rowsOf(popover).find((row) => row.querySelector(".ws-window-titlebar__item-label")?.textContent === label);
-  const keydown = (key) =>
-    window.document.dispatchEvent(new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }));
-  const hover = (target) => target.dispatchEvent(new window.Event("pointerenter", { bubbles: false }));
-  return { window, menubar, runs, canEdit, button, popovers, rowsOf, rowByLabel, keydown, hover };
-}
-
-// --- Buttons generate in registry sort order ------------------------------------
-
-{
-  const { window, button } = menubarScenario();
-  const buttons = [...window.document.querySelectorAll(".ws-window-titlebar__menu")];
-  check(
-    "the bar generates buttons in registry sort order",
-    buttons.map((b) => b.textContent).join(",") === "File,Edit,View",
-  );
-  check(
-    "the buttons have last-segment data-menu selectors and the popup state",
-    buttons.every(
-      (b) => b.getAttribute("aria-haspopup") === "menu" && b.getAttribute("aria-expanded") === "false",
-    ) && button("file") !== null && button("edit") !== null && button("view") !== null,
-  );
-}
-
-// --- Click toggles the menu ------------------------------------------------------
-
-{
-  const { button, popovers, rowsOf, rowByLabel } = menubarScenario();
-  button("file").click();
-  check("clicking a button opens its menu", popovers().length === 1);
-  check("the open button is announced expanded", button("file").getAttribute("aria-expanded") === "true");
-  const popover = popovers()[0];
-  check(
-    "the rows render in sort order with a group separator",
-    rowsOf(popover).map((row) => row.querySelector(".ws-window-titlebar__item-label").textContent).join(",") ===
-      "New File,Close Window" && popover.querySelectorAll(".ws-window-titlebar__separator").length === 1,
-  );
-  check(
-    "the shortcut hint comes from the keybinding registry",
-    rowByLabel(popover, "New File")?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+N",
-  );
-  button("file").click();
-  check("clicking the open menu's button closes it", popovers().length === 0);
-  check("the closed button collapses", button("file").getAttribute("aria-expanded") === "false");
-}
-
-// --- A mouse press opens on mousedown; rows fire on mouseup -------------------------
-
-{
-  const { window, button, popovers, rowByLabel, runs } = menubarScenario();
-  const mouse = (target, type, init = {}) =>
-    target.dispatchEvent(
-      new window.MouseEvent(type, { bubbles: true, cancelable: true, button: 0, detail: 1, ...init }),
-    );
-  mouse(button("file"), "mousedown");
-  check(
-    "mousedown on a bar button opens its menu and announces it expanded",
-    popovers().length === 1 && button("file").getAttribute("aria-expanded") === "true",
-  );
-  mouse(button("file"), "mouseup");
-  mouse(button("file"), "click");
-  check("the mouseup and click that end the press leave the menu open", popovers().length === 1);
-  mouse(button("file"), "mousedown");
-  check("a press on the open menu's own button closes it", popovers().length === 0);
-  mouse(button("file"), "mouseup");
-  mouse(button("file"), "click");
-  check("the click that ends that press does not reopen it", popovers().length === 0);
-
-  mouse(button("file"), "mousedown");
-  mouse(rowByLabel(popovers()[0], "New File"), "mouseup");
-  check(
-    "press on a bar button, drag onto a row, release fires the row and closes the menu",
-    runs.join(",") === "file.new" && popovers().length === 0,
-  );
-
-  mouse(button("file"), "mousedown", { button: 2 });
-  check("a non-primary press opens nothing", popovers().length === 0);
-}
-
-// --- One menu at a time -----------------------------------------------------------
-
-{
-  const { button, popovers, rowByLabel } = menubarScenario();
-  button("file").click();
-  button("edit").click();
-  check(
-    "clicking another button switches the open menu",
-    popovers().length === 1 && rowByLabel(popovers()[0], "Undo") !== undefined,
-  );
-  check(
-    "the replaced button collapses",
-    button("file").getAttribute("aria-expanded") === "false" &&
-      button("edit").getAttribute("aria-expanded") === "true",
-  );
-}
-
-// --- Rollover ----------------------------------------------------------------------
-
-{
-  const { button, popovers, rowsOf, hover } = menubarScenario();
-  hover(button("edit"));
-  check("hover with no menu open opens nothing", popovers().length === 0);
-  button("file").click();
-  hover(button("edit"));
-  check("hovering another button while open switches the menu", rowByLabelSafe(popovers(), "Undo"));
-  const rowsBefore = rowsOf(popovers()[0]);
-  hover(button("edit"));
-  check(
-    "hovering the open menu's own button does not rebuild its rows",
-    rowsOf(popovers()[0]).every((row, index) => row === rowsBefore[index]),
-  );
-}
-
-function rowByLabelSafe(popovers, label) {
-  return (
-    popovers.length === 1 &&
-    [...popovers[0].querySelectorAll(".ws-window-titlebar__item-label")].some((el) => el.textContent === label)
-  );
-}
-
-// --- Disabled rows and the context-key rebuild ---------------------------------------
-
-{
-  const { button, popovers, rowByLabel, runs, canEdit } = menubarScenario();
-  button("edit").click();
-  const undo = () => rowByLabel(popovers()[0], "Undo");
-  check("a failing precondition renders the row disabled", undo()?.getAttribute("aria-disabled") === "true");
-  undo().click();
-  check("clicking a disabled row runs nothing and keeps the menu open", runs.length === 0 && popovers().length === 1);
-  canEdit.set(true);
-  check("a referenced key change re-enables the row while open", undo()?.getAttribute("aria-disabled") === "false");
-  undo().click();
-  check("the enabled row runs its command and closes the menu", runs.join(",") === "edit.undo" && popovers().length === 0);
-}
-
-// --- Command dispatch ------------------------------------------------------------------
-
-{
-  const { button, popovers, rowByLabel, runs } = menubarScenario();
-  button("file").click();
-  rowByLabel(popovers()[0], "New File").click();
-  check("activating a row runs the command and closes the menu", runs.length === 1 && popovers().length === 0);
-  check("a row without args runs with none", runs[0].join(",") === "file.new");
-}
-
-// --- ArrowLeft/Right between menus, yielding to flyout navigation -----------------------
-
-{
-  const { window, button, popovers, rowsOf, rowByLabel, keydown } = menubarScenario();
-  button("file").click();
-  keydown("ArrowDown");
-  check("ArrowDown focuses the first row", window.document.activeElement === rowByLabel(popovers()[0], "New File"));
-  keydown("ArrowRight");
-  check("ArrowRight opens the next menu", rowByLabelSafe(popovers(), "Undo"));
-  check(
-    "ArrowRight focuses the new menu's first row",
-    window.document.activeElement === rowByLabel(popovers()[0], "Undo"),
-  );
-  keydown("ArrowRight");
-  check("ArrowRight again opens the third menu", rowByLabelSafe(popovers(), "Appearance"));
-  keydown("ArrowDown");
-  const appearance = rowByLabel(popovers()[0], "Appearance");
-  check("the view menu's row is the Appearance submenu", window.document.activeElement === appearance);
-  keydown("ArrowRight");
-  check(
-    "ArrowRight on a submenu row opens the flyout instead of switching menus",
-    popovers().length === 2 && rowByLabel(popovers()[1], "Toggle Center") !== undefined,
-  );
-  keydown("ArrowLeft");
-  check(
-    "ArrowLeft with a flyout open closes the flyout instead of switching menus",
-    popovers().length === 1 && window.document.activeElement === appearance,
-  );
-  keydown("ArrowLeft");
-  check("ArrowLeft now opens the previous menu", rowByLabelSafe(popovers(), "Undo"));
-  keydown("ArrowLeft");
-  keydown("ArrowLeft");
-  check("ArrowLeft from the first menu wraps to the last", rowByLabelSafe(popovers(), "Appearance"));
-  keydown("Escape");
-}
-
-// --- Dismissal: Escape, outside pointer, window blur --------------------------------------
-
-{
-  const { window, button, popovers, keydown } = menubarScenario();
-  button("file").click();
-  keydown("Escape");
-  check("Escape closes the menu", popovers().length === 0);
-  check("Escape returns focus to the menu button", window.document.activeElement === button("file"));
-
-  button("file").click();
-  window.document.body.dispatchEvent(new window.Event("pointerdown", { bubbles: true }));
-  check("an outside pointer press closes the menu", popovers().length === 0);
-
-  button("file").click();
-  window.dispatchEvent(new window.Event("blur"));
-  check("window blur closes the menu", popovers().length === 0);
-}
-
-// --- Disposal ------------------------------------------------------------------------------
-
-{
-  const { window, button, popovers, menubar } = menubarScenario();
-  const fileButton = button("file");
-  fileButton.click();
-  menubar.dispose();
-  check("disposal closes the open menu", popovers().length === 0);
-  check(
-    "disposal removes the generated buttons",
-    window.document.querySelectorAll(".ws-window-titlebar__menu").length === 0,
-  );
-  fileButton.click();
-  check("a disposed bar's button no longer opens anything", popovers().length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`window-menu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("window-menu: all assertions passed");
diff --git a/crates/workshop/ui/test/workbench-fields-css.mjs b/crates/workshop/ui/test/workbench-fields-css.mjs
deleted file mode 100644
index df28a4f30..000000000
--- a/crates/workshop/ui/test/workbench-fields-css.mjs
+++ /dev/null
@@ -1,31 +0,0 @@
-// Source-text contract for the workbench input and select values in the
-// component token sheet (src/tokens/component.css), which the run panel's
-// selects and fields take: 26px tall, a 2px radius, a 1px #F0F0F013 border;
-// selects padded 2px 23px 2px 8px with a 16px caret 6px from the right.
-// jsdom applies no layout, so the values are read from the sheets and
-// followed through the token tiers (test/helpers/css-values.mjs) down to the
-// literals Cursor's workbench uses.
-// Run: node test/workbench-fields-css.mjs
-import { resolver } from "./helpers/css-values.mjs";
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const resolve = await resolver();
-const token = (name) => resolve(`var(${name})`);
-
-check("a workbench field is 26px tall", token("--ws-workbench-input-height") === "26px");
-check("a workbench field has a 2px radius", token("--ws-workbench-input-radius") === "2px");
-check("a workbench field has a 1px #F0F0F013 border", token("--ws-workbench-input-border") === "1px solid #f0f0f013");
-check("a workbench select pads 2px 23px 2px 8px", token("--ws-workbench-select-padding") === "2px 23px 2px 8px");
-check("a workbench select's caret is 16px", token("--ws-workbench-select-caret-size") === "16px");
-check("a workbench select's caret sits 6px from the right", token("--ws-workbench-select-caret-inset") === "6px");
-
-if (failures.length > 0) {
-  console.error(`workbench-fields-css: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workbench-fields-css: all assertions passed");
diff --git a/crates/workshop/ui/test/workbench-frames.mjs b/crates/workshop/ui/test/workbench-frames.mjs
deleted file mode 100644
index db5c7d189..000000000
--- a/crates/workshop/ui/test/workbench-frames.mjs
+++ /dev/null
@@ -1,206 +0,0 @@
-// Workbench frame and event sends for WorkshopSocket: a pushed
-// workbench frame routes to the onWorkbench emitter; workbench pushes that
-// arrive before ready() replay through the boot queue in arrival order
-// beside status and models pushes; selectModel/switchProfile put the
-// documented event frames on the wire and return true; when the socket is
-// down they send nothing and return false, so the caller can surface the
-// failure. Drives the socket against a scripted fake WebSocket, no DOM
-// needed.
-// Run: node test/workbench-frames.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { WorkshopSocket } from "./src/services/workshop-socket.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-workbench-frames-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, WorkshopSocket } = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  sent = [];
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send(data) {
-    this.sent.push(data);
-  }
-  close() {
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-  drop() {
-    this.readyState = 3;
-    this.onclose?.();
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-function workbenchFrame(overrides = {}) {
-  return {
-    type: "workbench",
-    profiles: ["main", "coding"],
-    active: "main",
-    switching: null,
-    switch_in_flight: false,
-    selected: "test-model",
-    chat_ready: true,
-    ...overrides,
-  };
-}
-
-function statusFrame(label) {
-  return {
-    type: "status",
-    label,
-    description: "",
-    severity: "info",
-    activity: "general",
-    busy: false,
-  };
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- A workbench push routes to the onWorkbench emitter -------------------
-
-  const socket = new WorkshopSocket("ws://fake/ws");
-  const snapshots = [];
-  socket.onWorkbench((frame) => snapshots.push(frame));
-  socket.ready();
-  socket.connect();
-  fakeSockets[0].open();
-  fakeSockets[0].message(workbenchFrame());
-  check("a workbench push reaches the onWorkbench emitter", snapshots.length === 1);
-  check(
-    "the emitted frame holds the wire fields verbatim",
-    snapshots[0]?.active === "main" &&
-      snapshots[0]?.selected === "test-model" &&
-      snapshots[0]?.switching === null &&
-      snapshots[0]?.switch_in_flight === false &&
-      snapshots[0]?.chat_ready === true &&
-      snapshots[0]?.profiles.join(",") === "main,coding",
-  );
-  fakeSockets[0].message(workbenchFrame({ switch_in_flight: true, chat_ready: false }));
-  check(
-    "a no-profile switch in flight reports switch_in_flight beside a null switching",
-    snapshots.length === 2 &&
-      snapshots[1]?.switching === null &&
-      snapshots[1]?.switch_in_flight === true,
-  );
-
-  // --- Send methods put the documented event frames on the wire -------------
-
-  check("selectModel on an open socket reports success", socket.selectModel("gpt-test") === true);
-  check(
-    "selectModel sends one select_model frame naming the model",
-    fakeSockets[0].sent.at(-1) === JSON.stringify({ type: "select_model", model: "gpt-test" }),
-  );
-  check("switchProfile on an open socket reports success", socket.switchProfile("coding") === true);
-  check(
-    "switchProfile sends one switch_profile frame naming the profile",
-    fakeSockets[0].sent.at(-1) === JSON.stringify({ type: "switch_profile", name: "coding" }),
-  );
-  check("switchProfile(null) on an open socket reports success", socket.switchProfile(null) === true);
-  check(
-    "switchProfile(null) sends the no-profile selection as an explicit null name",
-    fakeSockets[0].sent.at(-1) === JSON.stringify({ type: "switch_profile", name: null }),
-  );
-
-  // --- Socket down: the send methods fail loudly instead of dropping --------
-
-  const sentBeforeDrop = fakeSockets[0].sent.length;
-  fakeSockets[0].drop();
-  check("selectModel on a downed socket reports failure", socket.selectModel("gpt-test") === false);
-  check("switchProfile on a downed socket reports failure", socket.switchProfile("coding") === false);
-  check(
-    "a downed socket sends nothing",
-    fakeSockets[0].sent.length === sentBeforeDrop,
-  );
-  socket.dispose();
-
-  // --- Workbench pushes replay through the boot queue ------------------------
-
-  const bootSocket = new WorkshopSocket("ws://fake/ws");
-  const replayed = [];
-  bootSocket.onStatus((frame) => replayed.push(`status:${frame.label}`));
-  bootSocket.onWorkbench((frame) => replayed.push(`workbench:${frame.active}`));
-  bootSocket.connect();
-  const bootWire = fakeSockets.at(-1);
-  bootWire.open();
-  bootWire.message(statusFrame("s1"));
-  bootWire.message(workbenchFrame({ active: "main" }));
-  bootWire.message(workbenchFrame({ active: "coding" }));
-  check("no workbench push is delivered before ready()", replayed.length === 0);
-  bootSocket.ready();
-  check(
-    "ready() replays workbench pushes in arrival order beside status pushes",
-    replayed.join(",") === "status:s1,workbench:main,workbench:coding",
-  );
-  bootWire.message(workbenchFrame({ active: "late" }));
-  check(
-    "a workbench push after ready() delivers immediately",
-    replayed.length === 4 && replayed.at(-1) === "workbench:late",
-  );
-  bootSocket.dispose();
-
-  // --- A socket that never opened also fails the send methods ---------------
-
-  const closedSocket = new WorkshopSocket("ws://fake/ws");
-  check(
-    "selectModel before any connection reports failure",
-    closedSocket.selectModel("gpt-test") === false,
-  );
-  check(
-    "switchProfile before any connection reports failure",
-    closedSocket.switchProfile("coding") === false,
-  );
-  closedSocket.dispose();
-});
-
-if (failures.length > 0) {
-  console.error(`workbench-frames: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workbench-frames: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/workbench-mount.mjs b/crates/workshop/ui/test/workbench-mount.mjs
deleted file mode 100644
index 2cbc98580..000000000
--- a/crates/workshop/ui/test/workbench-mount.mjs
+++ /dev/null
@@ -1,88 +0,0 @@
-// The bundled app mounts the whole workbench into dist/index.html: dockview
-// initializes inside #dock with the Workshop tree and the agent-session
-// panel (its menu visible, its session view hidden until a session is
-// acknowledged, its input editable with its action idle, its toolbar
-// reading the shared model service's snapshot selection), and the status
-// bar boots as a <footer> landmark reading "Ready" with its barberpole
-// hidden and its activity LED present. Guards the DOM contract between
-// index.html and the panel factories. Run: node test/workbench-mount.mjs
-// (after `npm run build`).
-import { bootWorkbench } from "./helpers/boot.mjs";
-
-await bootWorkbench("the bundled app mounts the whole workbench", async (ctx) => {
-  const { document, failures, agentPanel, statusBar, statusText, statusSlot, barberpoleEl, ledEl } = ctx;
-
-  const dock = document.querySelector("#dock");
-  if (!dock) failures.push("#dock missing");
-  if (dock && !dock.querySelector(".dv-dockview")) {
-    failures.push("dockview did not initialize inside #dock");
-  }
-  if (!document.querySelector("#dock .dv-groupview")) {
-    failures.push("dockview rendered no panel groups");
-  }
-  if (!document.querySelector("#dock .ws-workshop-tree")) {
-    failures.push("the Workshop tree panel did not mount in the dock");
-  }
-  if (!agentPanel) {
-    failures.push("the ws-agent-session panel did not mount in the dock");
-  } else {
-    const contextMenu = new document.defaultView.MouseEvent("contextmenu", {
-      bubbles: true,
-      cancelable: true,
-    });
-    agentPanel.dispatchEvent(contextMenu);
-    if (!contextMenu.defaultPrevented) {
-      failures.push("the workshop did not suppress the native WebView context menu");
-    }
-    const view = agentPanel.querySelector(".ws-agent-session");
-    if (!view) failures.push("the ws-agent-session view did not mount inside the agent panel");
-    if (view?.hidden) {
-      failures.push("the session view must be visible immediately (auto-launch skips the menu)");
-    }
-    const input = view?.querySelector(".ws-prompt-input__editor");
-    if (!input) {
-      failures.push("the ws-agent-session input did not mount");
-    } else if (input.getAttribute("contenteditable") !== "true") {
-      failures.push("the agent input must start editable, as it stays at all times");
-    }
-    const action = view?.querySelector(".ws-agent-session__action");
-    if (action?.dataset.action !== "idle") {
-      failures.push(
-        `the agent's action reads "${action?.dataset.action}", expected "idle" before the agent first waits or works`,
-      );
-    }
-    const toolbar = view?.querySelector(".ws-agent-toolbar");
-    if (!toolbar) {
-      failures.push("the ws-agent-session toolbar did not mount");
-    } else {
-      if (!toolbar.querySelector(".ws-mode-chip")) {
-        failures.push("the toolbar mounted no mode chip");
-      }
-      if (!toolbar.querySelector(".ws-token-ring")) {
-        failures.push("the toolbar mounted no context ring");
-      }
-      const pickerLabel = toolbar.querySelector(".ws-model-picker-trigger__label")?.textContent;
-      if (pickerLabel !== "test-model") {
-        failures.push(
-          `the toolbar's model picker reads "${pickerLabel}", expected the snapshot's "test-model"`,
-        );
-      }
-    }
-  }
-  if (!statusBar) failures.push("status bar placeholder missing");
-  if (statusBar && statusBar.tagName !== "FOOTER") {
-    failures.push("the status bar is not a <footer> landmark");
-  }
-  if (!statusText) {
-    failures.push("status bar text element missing");
-  } else if (statusText.textContent !== "Ready") {
-    failures.push(`status bar placeholder text is "${statusText.textContent}", expected "Ready"`);
-  }
-  if (!statusSlot) failures.push("status bar slot missing");
-  if (!barberpoleEl) {
-    failures.push("status bar barberpole element missing");
-  } else if (!barberpoleEl.hidden) {
-    failures.push("the barberpole must start hidden");
-  }
-  if (!ledEl) failures.push("status bar activity LED missing");
-});
diff --git a/crates/workshop/ui/test/workbench-service.mjs b/crates/workshop/ui/test/workbench-service.mjs
deleted file mode 100644
index 74136fd92..000000000
--- a/crates/workshop/ui/test/workbench-service.mjs
+++ /dev/null
@@ -1,144 +0,0 @@
-// Unit test for the workbench snapshot service
-// (src/services/workbench-service.ts). Bundles the TS module with esbuild
-// and imports it via a data URL. The server pushes complete workbench
-// snapshots; the service holds the last one and fans out changes. Covers:
-// the empty pre-boot state, the apply/emit cycle (fields land under UI
-// naming, the emitter fires with the held snapshot), every apply firing
-// even when unchanged (snapshots are authoritative, not diffed), a later
-// apply replacing the held snapshot, and disposed subscriptions receiving
-// nothing. Runs under the shared disposable-leak check.
-// Run: node test/workbench-service.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { WorkbenchService } from "./src/services/workbench-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { lifecycle, WorkbenchService } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-function workbenchFrame(overrides = {}) {
-  return {
-    type: "workbench",
-    profiles: ["main", "coding"],
-    active: "main",
-    switching: null,
-    switch_in_flight: false,
-    selected: "test-model",
-    chat_ready: true,
-    ...overrides,
-  };
-}
-
-await assertNoLeaks(lifecycle, () => {
-  // --- The empty pre-boot state -----------------------------------------------
-
-  {
-    const service = new WorkbenchService();
-    const snapshot = service.snapshot;
-    check(
-      "before any push the snapshot is empty and chat is gated off",
-      snapshot.profiles.length === 0 &&
-        snapshot.active === null &&
-        snapshot.switching === null &&
-        snapshot.switchInFlight === false &&
-        snapshot.selected === null &&
-        snapshot.chatReady === false,
-    );
-    service.dispose();
-  }
-
-  // --- The apply/emit cycle ----------------------------------------------------
-
-  {
-    const service = new WorkbenchService();
-    const emitted = [];
-    service.onDidChangeSnapshot((snapshot) => emitted.push(snapshot));
-    service.applySnapshot(workbenchFrame());
-    check("applying a frame notifies subscribers", emitted.length === 1);
-    check(
-      "the emitted snapshot is the held snapshot",
-      emitted[0] === service.snapshot,
-    );
-    check(
-      "the frame's fields land under UI naming",
-      service.snapshot.profiles.join(",") === "main,coding" &&
-        service.snapshot.active === "main" &&
-        service.snapshot.switching === null &&
-        service.snapshot.switchInFlight === false &&
-        service.snapshot.selected === "test-model" &&
-        service.snapshot.chatReady === true,
-    );
-    service.applySnapshot(workbenchFrame());
-    check(
-      "an unchanged frame still notifies - snapshots are authoritative",
-      emitted.length === 2,
-    );
-    service.applySnapshot(
-      workbenchFrame({
-        switching: "coding",
-        switch_in_flight: true,
-        selected: null,
-        chat_ready: false,
-      }),
-    );
-    check(
-      "a later frame replaces the held snapshot",
-      service.snapshot.switching === "coding" &&
-        service.snapshot.switchInFlight === true &&
-        service.snapshot.selected === null &&
-        service.snapshot.chatReady === false,
-    );
-    service.applySnapshot(workbenchFrame({ switch_in_flight: true, chat_ready: false }));
-    check(
-      "a no-profile switch lands as switchInFlight true beside a null switching",
-      service.snapshot.switching === null && service.snapshot.switchInFlight === true,
-    );
-    service.dispose();
-  }
-
-  // --- Disposed subscriptions receive nothing -----------------------------------
-
-  {
-    const service = new WorkbenchService();
-    const emitted = [];
-    const subscription = service.onDidChangeSnapshot((snapshot) => emitted.push(snapshot));
-    service.applySnapshot(workbenchFrame());
-    subscription.dispose();
-    service.applySnapshot(workbenchFrame({ active: "coding" }));
-    check("a disposed subscription receives nothing", emitted.length === 1);
-    check("state still updates after subscribers leave", service.snapshot.active === "coding");
-    service.dispose();
-  }
-});
-
-if (failures.length > 0) {
-  console.error(`workbench-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workbench-service: all assertions passed");
diff --git a/crates/workshop/ui/test/workshop-layout.mjs b/crates/workshop/ui/test/workshop-layout.mjs
deleted file mode 100644
index 9b9ca6478..000000000
--- a/crates/workshop/ui/test/workshop-layout.mjs
+++ /dev/null
@@ -1,864 +0,0 @@
-// Integration test for layout boot, persistence, and shortcuts
-// (src/parts/layout/layout-persistence.ts, src/parts/layout/layout-boot.ts,
-// the keybinding dispatcher resolving the contribution surface's chords,
-// the zone-state serialization in zones.ts, and EditorPanel.confirmClose).
-// Bundles the modules with esbuild, mounts real Dockview docks in jsdom
-// against the real index.html, and drives the public API with a fake
-// UI-state adapter (test/helpers/ui-storage.mjs) standing in for the
-// workspace bucket. Covers: the layout survives a reload (build the
-// envelope -> restore it), including the tree's close-button-free tab;
-// a burst of layout changes coalesces into one debounced write; a
-// mid-session restore (the Open path) writes nothing while the next real
-// change still saves; a throwing writer is logged, never escapes; a null,
-// non-object, version-mismatched, or unloadable envelope falls back to
-// defaults; applyLayoutOrDefault seeds the registered layout policy (the
-// product's shape: tree left, agent right) from null, clearing a live
-// dock's panels first (the Open path), and restores a valid envelope
-// through fromJSON without seeding; re-ensuring the tree after a restore
-// never duplicates it; each shortcut dispatches its command; the status
-// bar never enters the serialized layout.
-// Run: node test/workshop-layout.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { createDockview, themeDark } from "dockview";
-      export {
-        bindActiveEditorKey,
-        initZones,
-        openInZone,
-        panelIdFor,
-        resetZones,
-        zoneOfPanel,
-      } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-      export {
-        restoreLayout,
-        buildLayoutEnvelope,
-        startLayoutPersistence,
-        LAYOUT_SCHEMA_VERSION,
-      } from "./src/parts/layout/layout-persistence.ts";
-      export { applyLayoutOrDefault } from "./src/parts/layout/layout-boot.ts";
-      export { KeybindingDispatcher } from "./src/parts/layout/keybinding-dispatcher.ts";
-      export { CONTEXT_KEY_SERVICE } from "@workshop/platform/context-key-service";
-      export { getService, registerService } from "@workshop/platform/service-registry";
-      export { LAYOUT_POLICY } from "./src/services/layout-policy.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/layout/layout.contribution.ts";
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      export { EditorPanel } from "./src/parts/editor/editor-panel.ts";
-      export { StatusBar } from "./src/parts/status/status-bar.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-// The same layout stubs the other dock tests install: jsdom has no layout.
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-// CodeMirror measurement shims; the test never asserts editor geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-
-// A scripted workspace API: one granted root with two files; file reads
-// serve a small text per path; writes record their bodies and bump the
-// conflict token. Any other route fails the test loudly.
-const ROOT = "C:\\project";
-const FILE_A = `${ROOT}\\a.txt`;
-const FILE_B = `${ROOT}\\b.txt`;
-const FILE_C = `${ROOT}\\c.txt`;
-const puts = [];
-let tokenSeq = 100;
-globalThis.fetch = async (url, options) => {
-  const target = typeof url === "string" ? url : url.url;
-  if (target.startsWith("/workspace/file") && !options) {
-    const pathParam = new URL(target, "http://127.0.0.1:7910").searchParams.get("path");
-    if (pathParam !== null && pathParam.startsWith(ROOT)) {
-      return {
-        ok: true,
-        status: 200,
-        json: async () => ({
-          path: pathParam,
-          size: 7,
-          token: `t${tokenSeq}`,
-          text: `text of ${pathParam}`,
-        }),
-      };
-    }
-  }
-  if (target === "/workspace/file" && options?.method === "PUT") {
-    const body = JSON.parse(options.body);
-    puts.push(body);
-    tokenSeq += 100;
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        path: body.path,
-        size: body.text.length,
-        token: `t${tokenSeq}`,
-        text: body.text,
-      }),
-    };
-  }
-  if (target.startsWith("/workspace/tree")) {
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        path: null,
-        entries: [{ name: "project", path: ROOT, kind: "directory", size: 0, modified_ms: 100, exists: true }],
-      }),
-    };
-  }
-  throw new Error(`unexpected fetch in the workshop-layout test: ${target}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "Window",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The agent panel composes an AgentSocket on init; a scripted stand-in
-// that never opens keeps the panel inert - this test drives layout, not
-// the agent wire.
-globalThis.WebSocket = class {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  readyState = 0;
-  send() {}
-  close() {}
-};
-
-const bundlePath = path.join(os.tmpdir(), "workshop-layout-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  bindActiveEditorKey,
-  initZones,
-  openInZone,
-  panelIdFor,
-  resetZones,
-  zoneOfPanel,
-  createPanelComponent,
-  createPanelTabComponent,
-  PANEL_TAB,
-  restoreLayout,
-  buildLayoutEnvelope,
-  startLayoutPersistence,
-  LAYOUT_SCHEMA_VERSION,
-  applyLayoutOrDefault,
-  KeybindingDispatcher,
-  CONTEXT_KEY_SERVICE,
-  getService,
-  registerService,
-  LAYOUT_POLICY,
-  EditorPanel,
-  StatusBar,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// A structural copy with every undefined-valued key removed, and nothing
-// else changed: plain objects and arrays recurse, every other value
-// (including a Map, a Date, or NaN) passes through untouched so a deep
-// comparison against the JSON form still flags it.
-function withoutUndefined(value) {
-  if (Array.isArray(value)) {
-    return value.map(withoutUndefined);
-  }
-  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
-    return Object.fromEntries(
-      Object.entries(value)
-        .filter(([, item]) => item !== undefined)
-        .map(([key, item]) => [key, withoutUndefined(item)]),
-    );
-  }
-  return value;
-}
-
-// The workspace-bucket key the composition root binds the layout to.
-const KEY = "layout";
-
-// Builds a dock wired exactly as main.ts wires it, on a fresh element.
-function createDock(element) {
-  element.className = "ws-dock";
-  window.document.body.appendChild(element);
-  return createDockview(element, {
-    createComponent: createPanelComponent,
-    createTabComponent: createPanelTabComponent,
-    defaultTabComponent: PANEL_TAB,
-    theme: themeDark,
-    disableFloatingGroups: true,
-    hideBorders: true,
-    locked: false,
-    noPanelsOverlay: "emptyGroup",
-  });
-}
-
-const editorAId = panelIdFor("editor", { path: FILE_A });
-const editorBId = panelIdFor("editor", { path: FILE_B });
-const editorCId = panelIdFor("editor", { path: FILE_C });
-
-// A layout policy in the product's shape: the tree anchors the left zone
-// and the agent session the right. The policy main.ts registers, its
-// 280px tree included, is proven on the booted bundle by
-// layout-policy-boot.mjs. The seed count tells a default layout apart
-// from a restore.
-let seeds = 0;
-registerService(LAYOUT_POLICY, () => ({
-  anchors: ["tree", "agent"],
-  seed: () => {
-    seeds += 1;
-    openInZone("tree", {});
-    openInZone("agent", {});
-  },
-}));
-
-// --- Boot: the default layout is three-zone, always unlocked --------------
-
-const dockEl = window.document.getElementById("dock");
-const dock = createDockview(dockEl, {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  defaultTabComponent: PANEL_TAB,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-
-check("a null envelope has nothing to restore", restoreLayout(dock, null) === false);
-
-const treePanel = openInZone("tree", {});
-treePanel.group.api.setSize({ width: 280 });
-const agentPanel = openInZone("agent", {});
-await flush();
-
-check("the default layout mounts tree and agent session", dock.panels.length === 2);
-check("main stays empty until a document opens", dock.groups.length === 2);
-check("the tree opens left, agent right", zoneOfPanel(treePanel) === "left" && zoneOfPanel(agentPanel) === "right");
-
-// App placement: an editor opens into the main zone.
-const editorA = openInZone("editor", { path: FILE_A });
-await flush();
-check("app placement lands the editor in main", zoneOfPanel(editorA) === "main");
-
-// --- Persistence: the envelope is versioned and records placement ---------
-
-const built = buildLayoutEnvelope(dock);
-// The adapter PUTs JSON.stringify(value) and the boot preload hands back
-// response.json(): a wire round trip must reproduce every defined value.
-// Dockview's toJSON emits its optional panel fields (params, renderer,
-// pinned, size limits, tabComponent) as explicit undefined, which JSON
-// drops and fromJSON reads identically, so those keys are ignored; deep
-// equality over the rest catches a non-JSON type (a Map, a Date, NaN) in
-// the builder that a stringify-to-stringify comparison never could.
-const envelope = JSON.parse(JSON.stringify(built));
-check("the envelope survives the JSON wire round trip",
-  isDeepStrictEqual(envelope, withoutUndefined(built)));
-check("the envelope includes the schema version", envelope.version === LAYOUT_SCHEMA_VERSION);
-check("the envelope includes zones and overrides",
-  typeof envelope.zones === "object" && typeof envelope.overrides === "object");
-check("the envelope records the zone groups",
-  typeof envelope.zones.left === "string" && typeof envelope.zones.right === "string" &&
-    typeof envelope.zones.main === "string");
-
-// The status bar is not part of the zone system. main.ts owns the bar;
-// mount one here the way the composition root does.
-new StatusBar();
-check("the status bar is a direct child of body",
-  !!window.document.querySelector("body > .status-bar"));
-check("the status bar is outside the desk and the dock",
-  window.document.querySelector(".ws-desk .status-bar") === null &&
-    window.document.querySelector("#dock .status-bar") === null);
-check("the status bar never enters the serialized layout",
-  !JSON.stringify(envelope.layout).includes("status-bar"));
-
-// --- Reload: a fresh dock restores layout, zones, and panels --------------
-
-const dockEl2 = window.document.createElement("div");
-const dock2 = createDock(dockEl2);
-initZones(dock2);
-check("the persisted layout restores", restoreLayout(dock2, envelope) === true);
-await flush();
-check("the agent panel is restored through its factory", !!dock2.getPanel(agentPanel.id));
-check("the tree panel is restored through its factory", !!dock2.getPanel("tree"));
-check("the editor panel is restored through its factory", !!dock2.getPanel(editorAId));
-check("restored panels land in their zones",
-  zoneOfPanel(dock2.getPanel(agentPanel.id)) === "right" &&
-    zoneOfPanel(dock2.getPanel("tree")) === "left" &&
-    zoneOfPanel(dock2.getPanel(editorAId)) === "main");
-check("the restored editor mounted its surface",
-  !!dock2.getPanel(editorAId).view.content.element.querySelector(".cm-editor"));
-check("the restored tree keeps its close-button-free tab",
-  dock2.getPanel("tree").view.tab.element.querySelector(".dv-default-tab-action") === null);
-// The boot anchor guard: re-ensuring the tree after a successful restore
-// activates the existing panel instead of duplicating it.
-const panelsAfterRestore = dock2.panels.length;
-check("ensuring the tree after restore never duplicates it",
-  openInZone("tree", {}) === dock2.getPanel("tree") && dock2.panels.length === panelsAfterRestore);
-
-// Debounced writes off onDidLayoutChange, through the writer the
-// composition root binds to the workspace bucket. A burst of changes
-// inside the debounce window - open B, open C, close C - coalesces into
-// one write holding the settled layout: B present, C gone.
-const storage = createFakeUiStorage();
-startLayoutPersistence(dock2, (value) => storage.set("workspace", KEY, value));
-openInZone("editor", { path: FILE_B });
-openInZone("editor", { path: FILE_C });
-dock2.removePanel(dock2.getPanel(editorCId));
-check("no write lands before the debounce elapses", storage.sets.length === 0);
-await new Promise((resolve) => setTimeout(resolve, 400));
-check("a burst of layout changes coalesces into one write", storage.sets.length === 1);
-const debounced = storage.get("workspace", KEY);
-check("the debounced write lands on the workspace layout key",
-  storage.sets[0]?.bucket === "workspace" && storage.sets[0]?.key === KEY);
-check("the debounced write stores the settled layout",
-  debounced !== null &&
-    Object.keys(debounced.layout.panels).includes(editorBId) &&
-    !Object.keys(debounced.layout.panels).includes(editorCId));
-check("the debounced write includes the schema version",
-  debounced !== null && debounced.version === LAYOUT_SCHEMA_VERSION);
-
-// A mid-session restore is not a change to save. Open Workspace applies
-// the opened file's envelope onto the live dock through
-// applyLayoutOrDefault; real Dockview delivers the resulting
-// onDidLayoutChange on a microtask, after any synchronous suppression
-// around the apply has lifted, and the saver's debounce defers the write
-// further still. The saver must drop that echo on its own, then keep
-// saving real changes as before.
-{
-  const setsBefore = storage.sets.length;
-  const opened = JSON.parse(JSON.stringify(buildLayoutEnvelope(dock2)));
-  applyLayoutOrDefault(dock2, opened);
-  await new Promise((resolve) => setTimeout(resolve, 400));
-  check("a mid-session restore writes nothing, even past the debounce",
-    storage.sets.length === setsBefore);
-  openInZone("editor", { path: FILE_C });
-  dock2.removePanel(dock2.getPanel(editorCId));
-  await new Promise((resolve) => setTimeout(resolve, 400));
-  check("a real change after a restore still saves once",
-    storage.sets.length === setsBefore + 1);
-  check("the save after a restore stores the live layout, not a stale one",
-    Object.keys(storage.sets.at(-1).value.layout.panels).includes(editorBId) &&
-      !Object.keys(storage.sets.at(-1).value.layout.panels).includes(editorCId));
-  await flush();
-}
-
-// --- Shortcuts: the dispatcher resolves the contributions' chords -----
-
-// The real contribution surface (imported into the bundle above)
-// registered every action and keybinding rule into the shared
-// registries; one dispatcher over them handles every chord. Chords
-// resolve through event.code, so each press names the physical key's
-// code.
-const dispatcher = new KeybindingDispatcher();
-const contextKeys = getService(CONTEXT_KEY_SERVICE);
-// Save and Close are gated on activeEditor, which main.ts binds to the dock.
-bindActiveEditorKey(dock2);
-const press = (key, code, options = {}) =>
-  window.document.body.dispatchEvent(
-    new window.KeyboardEvent("keydown", { key, code, ctrlKey: true, bubbles: true, cancelable: true, ...options }),
-  );
-
-// Ctrl+S saves the active editor. The rule's when reads
-// editorTextFocus, which the text-control service owns; with no real
-// focus traversal in jsdom the test sets the key the way a focused
-// CodeMirror surface would.
-dock2.getPanel(editorAId).api.setActive();
-await flush();
-contextKeys.createKey("editorTextFocus", false).set(true);
-const putsBeforeSave = puts.length;
-press("s", "KeyS");
-await flush();
-check("Ctrl+S saves the active editor",
-  puts.length === putsBeforeSave + 1 && puts.at(-1).path === FILE_A);
-
-// Ctrl+F4 closes the now-clean editor without prompting. The run body
-// lazy-imports the command layer, so let the microtasks land.
-press("F4", "F4");
-await flush();
-check("Ctrl+F4 closes the active editor", dock2.getPanel(editorAId) === undefined);
-check("a clean close does not prompt",
-  window.document.querySelector(".ws-editor-close-overlay") === null);
-
-// Ctrl+Tab / Ctrl+Shift+Tab cycle the editors. Reopen A so two exist.
-openInZone("editor", { path: FILE_A });
-await flush();
-dock2.getPanel(editorBId).api.setActive();
-press("Tab", "Tab");
-await flush();
-check("Ctrl+Tab cycles to the next editor", dock2.activePanel?.id === editorAId);
-press("Tab", "Tab", { shiftKey: true });
-await flush();
-check("Ctrl+Shift+Tab cycles back", dock2.activePanel?.id === editorBId);
-
-// Ctrl+B toggles the Workshop panel.
-press("b", "KeyB");
-check("Ctrl+B closes the Workshop panel", dock2.getPanel("tree") === undefined);
-press("b", "KeyB");
-check("Ctrl+B reopens the Workshop panel", !!dock2.getPanel("tree"));
-// The reopened tree's chunk resolves asynchronously (the panel registry
-// lazy-loads feature directories); let the swap land before focusing.
-await flush();
-
-// Ctrl+Shift+E activates and focuses the Workshop tree.
-press("e", "KeyE", { shiftKey: true });
-const treeContent = dock2.getPanel("tree").view.content;
-check("Ctrl+Shift+E activates the Workshop tree", dock2.activePanel?.id === "tree");
-check("Ctrl+Shift+E focuses inside the tree",
-  treeContent.element.contains(window.document.activeElement));
-dispatcher.dispose();
-
-// --- Restore failures fall back to the default layout ---------------------
-
-// A stored value that is not an envelope object at all (the server hands
-// back whatever JSON was stored, so a string stands in for a corrupt value).
-const dock3 = createDock(window.document.createElement("div"));
-initZones(dock3);
-check("a non-object value fails the restore", restoreLayout(dock3, "not json{") === false);
-check("an array value fails the restore", restoreLayout(dock3, [envelope]) === false);
-openInZone("agent", {});
-openInZone("tree", {});
-check("the non-object fallback mounts the default layout", dock3.panels.length === 2);
-
-// A snapshot of any other schema version fails the restore.
-const dock4 = createDock(window.document.createElement("div"));
-initZones(dock4);
-check("a snapshot of another schema version fails the restore",
-  restoreLayout(dock4, { ...envelope, version: LAYOUT_SCHEMA_VERSION + 1 }) === false &&
-    dock4.panels.length === 0);
-
-// A structurally valid envelope whose layout fromJSON rejects.
-const dock5 = createDock(window.document.createElement("div"));
-initZones(dock5);
-check("an unloadable layout fails the restore",
-  restoreLayout(dock5, {
-    version: LAYOUT_SCHEMA_VERSION,
-    zones: {},
-    overrides: {},
-    layout: { grid: { root: { type: "leaf", data: [] } } },
-  }) === false);
-openInZone("agent", {});
-openInZone("tree", {});
-check("the unloadable-layout fallback mounts the default layout", dock5.panels.length === 2);
-
-// --- Persistence: a throwing writer is logged, never escapes ---------------
-
-// An uncaught throw inside the debounce timer would take the page down;
-// the save logs and the dock stands. Disposing cancels an armed save.
-{
-  const dockFail = createDock(window.document.createElement("div"));
-  initZones(dockFail);
-  const errors = [];
-  const originalError = console.error;
-  console.error = (...args) => {
-    errors.push(args);
-  };
-  const failing = startLayoutPersistence(dockFail, () => {
-    throw new Error("denied");
-  });
-  openInZone("tree", {});
-  await new Promise((resolve) => setTimeout(resolve, 400));
-  console.error = originalError;
-  failing.dispose();
-  check("a throwing writer is logged once", errors.length === 1);
-  check("a throwing writer leaves the dock intact", dockFail.panels.length === 1);
-  let lateWrites = 0;
-  const disposed = startLayoutPersistence(dockFail, () => {
-    lateWrites += 1;
-  });
-  openInZone("agent", {});
-  disposed.dispose();
-  await new Promise((resolve) => setTimeout(resolve, 400));
-  check("disposing persistence cancels the armed write", lateWrites === 0);
-}
-
-// --- applyLayoutOrDefault: the boot decision main.ts and Open share -------
-
-// Null (no stored layout): the registered policy seeds the default, tree
-// left, agent right, main empty. The fallback resets the zone map itself,
-// so the stale group ids the earlier docks left behind are cleared the
-// same way a live dock's would be on Open.
-{
-  const dockDefault = createDock(window.document.createElement("div"));
-  initZones(dockDefault);
-  let fromJsonCalls = 0;
-  const realFromJson = dockDefault.fromJSON.bind(dockDefault);
-  dockDefault.fromJSON = (data) => {
-    fromJsonCalls += 1;
-    return realFromJson(data);
-  };
-  const seedsBefore = seeds;
-  applyLayoutOrDefault(dockDefault, null);
-  await flush();
-  check("applyLayoutOrDefault with null never calls fromJSON", fromJsonCalls === 0);
-  check("applyLayoutOrDefault with null seeds the registered policy once", seeds === seedsBefore + 1);
-  check("applyLayoutOrDefault with null opens the default zones",
-    dockDefault.panels.length === 2 && dockDefault.groups.length === 2);
-  check("applyLayoutOrDefault with null places tree left and agent right",
-    zoneOfPanel(dockDefault.getPanel("tree")) === "left" &&
-      zoneOfPanel(dockDefault.getPanel(panelIdFor("agent", {}))) === "right");
-}
-
-// The Open path: the dock already holds the previous workspace's panels
-// and the newly opened file has no stored layout. The fallback must
-// replace the live arrangement with the default, not layer the anchors
-// onto it, so boot and Open share one behavior.
-{
-  const dockLive = createDock(window.document.createElement("div"));
-  initZones(dockLive);
-  resetZones();
-  openInZone("tree", {});
-  openInZone("agent", {});
-  openInZone("editor", { path: FILE_A });
-  openInZone("editor", { path: FILE_B });
-  await flush();
-  check("the live dock holds editors before the null apply", dockLive.panels.length === 4);
-  applyLayoutOrDefault(dockLive, null);
-  await flush();
-  check("applyLayoutOrDefault with null clears a live dock's editors",
-    dockLive.getPanel(editorAId) === undefined && dockLive.getPanel(editorBId) === undefined);
-  check("applyLayoutOrDefault with null leaves a live dock at the default layout",
-    dockLive.panels.length === 2 && dockLive.groups.length === 2 &&
-      zoneOfPanel(dockLive.getPanel("tree")) === "left" &&
-      zoneOfPanel(dockLive.getPanel(panelIdFor("agent", {}))) === "right");
-}
-
-// A valid envelope: fromJSON receives it once and the anchors are not
-// duplicated by the re-ensure step.
-{
-  const dockRestore = createDock(window.document.createElement("div"));
-  initZones(dockRestore);
-  resetZones();
-  const received = [];
-  const realFromJson = dockRestore.fromJSON.bind(dockRestore);
-  dockRestore.fromJSON = (data) => {
-    received.push(data);
-    return realFromJson(data);
-  };
-  const seedsBefore = seeds;
-  applyLayoutOrDefault(dockRestore, envelope);
-  await flush();
-  check("applyLayoutOrDefault with a valid envelope calls fromJSON once with it",
-    received.length === 1 && received[0] === envelope.layout);
-  check("applyLayoutOrDefault with a valid envelope never seeds the policy", seeds === seedsBefore);
-  check("applyLayoutOrDefault restores every persisted panel without duplicates",
-    dockRestore.panels.length === Object.keys(envelope.layout.panels).length &&
-      !!dockRestore.getPanel("tree") && !!dockRestore.getPanel(editorAId));
-}
-
-// An unloadable envelope: the failed restore clears the dock and the
-// default zones take over.
-{
-  const dockBad = createDock(window.document.createElement("div"));
-  initZones(dockBad);
-  resetZones();
-  applyLayoutOrDefault(dockBad, {
-    version: LAYOUT_SCHEMA_VERSION,
-    zones: {},
-    overrides: {},
-    layout: { grid: { root: { type: "leaf", data: [] } } },
-  });
-  await flush();
-  check("applyLayoutOrDefault with an unloadable envelope mounts the default layout",
-    dockBad.panels.length === 2 && dockBad.groups.length === 2 && !!dockBad.getPanel("tree"));
-}
-
-// --- The policy's empty zones: the editor group exists from the first paint ---------
-
-{
-  const seedPolicy = {
-    anchors: ["tree", "agent"],
-    seed: () => {
-      openInZone("tree", {});
-      openInZone("agent", {});
-    },
-  };
-  registerService(LAYOUT_POLICY, () => ({ ...seedPolicy, emptyZones: ["main"] }));
-  const emptyGroupsOf = (target) => target.groups.filter((group) => group.panels.length === 0);
-
-  // No stored layout: the seed plus one empty main group between the sides.
-  const freshElement = window.document.createElement("div");
-  const dockFresh = createDock(freshElement);
-  initZones(dockFresh);
-  resetZones();
-  applyLayoutOrDefault(dockFresh, null);
-  await flush();
-  check("a default layout with an empty main zone builds three groups", dockFresh.groups.length === 3);
-  check(
-    "the empty group is the main zone's",
-    emptyGroupsOf(dockFresh).length === 1 && emptyGroupsOf(dockFresh)[0].element.dataset.wsZone === "main",
-  );
-  check(
-    "the empty main group sits between the left and right zones, left to right in the page",
-    [...freshElement.querySelectorAll("[data-ws-zone]")].map((element) => element.dataset.wsZone).join(",") ===
-      "left,main,right",
-  );
-
-  // A stored layout with no main group gets one on restore.
-  const dockNoMain = createDock(window.document.createElement("div"));
-  initZones(dockNoMain);
-  resetZones();
-  openInZone("tree", {});
-  openInZone("agent", {});
-  await flush();
-  const noMainEnvelope = JSON.parse(JSON.stringify(buildLayoutEnvelope(dockNoMain)));
-  check(
-    "the stored layout has no main group",
-    noMainEnvelope.zones.main === undefined && dockNoMain.groups.length === 2,
-  );
-  const dockRestored = createDock(window.document.createElement("div"));
-  initZones(dockRestored);
-  resetZones();
-  applyLayoutOrDefault(dockRestored, noMainEnvelope);
-  await flush();
-  check(
-    "restoring a layout with no main group adds the empty one",
-    dockRestored.groups.length === 3 && emptyGroupsOf(dockRestored).length === 1,
-  );
-
-  // A stored layout that has its main group keeps the three groups it has.
-  const dockWithMain = createDock(window.document.createElement("div"));
-  initZones(dockWithMain);
-  resetZones();
-  applyLayoutOrDefault(dockWithMain, envelope);
-  await flush();
-  check(
-    "restoring a layout that has a main group adds no second one",
-    dockWithMain.groups.length === 3 && !!dockWithMain.getPanel(editorAId),
-  );
-
-  registerService(LAYOUT_POLICY, () => seedPolicy);
-}
-
-// --- EditorPanel.confirmClose: the dirty close prompt ---------------------
-
-function createStubSurface() {
-  const listeners = new Set();
-  return {
-    element: window.document.createElement("div"),
-    currentText: "",
-    dirty: false,
-    open(document) {
-      this.currentText = document.text;
-      this.setDirty(false);
-    },
-    text() {
-      return this.currentText;
-    },
-    markSaved(text) {
-      this.setDirty(this.currentText !== text);
-    },
-    isDirty() {
-      return this.dirty;
-    },
-    onDirtyChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    },
-    focus() {},
-    dispose() {},
-    setDirty(dirty) {
-      if (dirty === this.dirty) return;
-      this.dirty = dirty;
-      for (const listener of listeners) listener(dirty);
-    },
-    type(text) {
-      this.currentText = text;
-      this.setDirty(true);
-    },
-  };
-}
-
-function fakeParameters(path) {
-  return { params: { path }, api: { setTitle() {} } };
-}
-
-// The answer confirmClose() has settled on, or null while it is pending.
-function watchAnswer(promise) {
-  const watch = { answer: null };
-  void promise.then((confirmed) => {
-    watch.answer = confirmed;
-  });
-  return watch;
-}
-
-// A clean panel confirms without a prompt.
-const cleanPanel = new EditorPanel({ createSurface: () => createStubSurface() });
-cleanPanel.init(fakeParameters(`${ROOT}\\clean.txt`));
-await flush();
-const cleanClose = watchAnswer(cleanPanel.confirmClose());
-await flush();
-check("closing a clean editor skips the prompt",
-  cleanClose.answer === true && cleanPanel.element.querySelector(".ws-editor-close-overlay") === null);
-
-// A dirty panel prompts; Cancel keeps it, Don't Save lets it close.
-const dirtyStub = createStubSurface();
-const dirtyPanel = new EditorPanel({ createSurface: () => dirtyStub });
-dirtyPanel.init(fakeParameters(`${ROOT}\\dirty.txt`));
-await flush();
-window.document.body.appendChild(dirtyPanel.element);
-dirtyStub.type("unsaved\n");
-const cancelClose = watchAnswer(dirtyPanel.confirmClose());
-await flush();
-const closeOverlay = dirtyPanel.element.querySelector(".ws-editor-close-overlay");
-check("closing a dirty editor prompts instead of closing", cancelClose.answer === null && !!closeOverlay);
-check("the close prompt is a modal dialog",
-  closeOverlay?.querySelector(".ws-editor-close")?.getAttribute("role") === "dialog" &&
-    closeOverlay.querySelector(".ws-editor-close")?.getAttribute("aria-modal") === "true");
-const closeButton = (label) =>
-  [...dirtyPanel.element.querySelectorAll(".ws-editor-close__button")].find(
-    (button) => button.textContent === label,
-  );
-// Cursor's confirmation prompt: its wording, the Windows button order, and the skin.
-check("the close prompt asks Cursor's question",
-  closeOverlay?.querySelector(".ws-editor-close__title")?.textContent ===
-    "Do you want to save the changes you made to dirty.txt?");
-check("the close prompt warns that changes will be lost",
-  closeOverlay?.querySelector(".ws-editor-close__line")?.textContent ===
-    "Your changes will be lost if you don't save them.");
-check("the close prompt's buttons run Save, Don't Save, Cancel",
-  [...dirtyPanel.element.querySelectorAll(".ws-editor-close__button")]
-    .map((button) => button.textContent).join("|") === "Save|Don't Save|Cancel");
-check("the close prompt wears the confirmation skin",
-  closeOverlay?.classList.contains("modal-overlay--confirmation") === true &&
-    closeOverlay.querySelector(".ws-editor-close")?.classList.contains("modal-dialog--confirmation") === true);
-check("Save is the close prompt's primary button",
-  closeButton("Save")?.classList.contains("ws-editor-close__button--primary") === true);
-closeButton("Cancel").click();
-await flush();
-check("Cancel keeps the dirty editor open",
-  cancelClose.answer === false && dirtyPanel.element.querySelector(".ws-editor-close-overlay") === null);
-check("Cancel leaves the editor dirty", dirtyPanel.isDirty());
-const discardClose = watchAnswer(dirtyPanel.confirmClose());
-await flush();
-closeButton("Don't Save").click();
-await flush();
-check("Don't Save closes the dirty editor", discardClose.answer === true);
-
-// Save writes, then confirms once the write succeeds.
-const saveStub = createStubSurface();
-const savePanel = new EditorPanel({ createSurface: () => saveStub });
-savePanel.init(fakeParameters(`${ROOT}\\save.txt`));
-await flush();
-saveStub.type("keep me\n");
-const putsBeforeDialogSave = puts.length;
-const saveClose = watchAnswer(savePanel.confirmClose());
-await flush();
-[...savePanel.element.querySelectorAll(".ws-editor-close__button")]
-  .find((button) => button.textContent === "Save")
-  .click();
-await flush();
-check("Save writes the dirty editor's text",
-  puts.length === putsBeforeDialogSave + 1 && puts.at(-1).text === "keep me\n");
-check("Save closes the editor once the write succeeds", saveClose.answer === true && !saveStub.isDirty());
-
-if (failures.length > 0) {
-  console.error(`workshop-layout: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-layout: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/workshop-panel-menu.mjs b/crates/workshop/ui/test/workshop-panel-menu.mjs
deleted file mode 100644
index 0b61db72e..000000000
--- a/crates/workshop/ui/test/workshop-panel-menu.mjs
+++ /dev/null
@@ -1,465 +0,0 @@
-// Unit test for the Workshop tree's workspace management
-// (src/parts/workspace/workshop-panel.ts): the root-row context menu, the
-// missing-root rendering, and the Add Folder flows. Bundles the panel
-// with esbuild - with "@tauri-apps/plugin-dialog" aliased to the scripted
-// stub in test/helpers - and drives it against jsdom. Covers: a missing
-// root renders with the strikethrough/danger class and a "missing" text
-// label; right-clicking a root opens the shared dropdown with a danger
-// Remove item that revokes the root, announces the change, and confirms
-// on the status bar; a failed revoke paints a status-bar error and
-// announces nothing; the header "+" button is a keyboard-focusable
-// button; in the desktop app it opens the native folder picker and the
-// picked path is granted (a canceled pick grants nothing); in a plain
-// browser it opens a dialog whose labeled path input gates the Add button
-// until text is typed, Enter submits the typed path (and is inert while
-// the field is empty), and a grant the server refuses paints a status-bar
-// error.
-// Run: node test/workshop-panel-menu.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-// One jsdom for the whole test: the modules read the document at import
-// time, so the globals must exist before the bundle loads.
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.Event = window.Event;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { WorkshopTreePanel } from "./src/parts/workspace/workshop-panel.ts";
-      export { TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The panel's import graph pulls colocated CSS; the test drives only
-  // the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-  },
-});
-const { WorkshopTreePanel, TREE_STATE, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-// The composition root has the tree-state service follow the workspace-changed
-// event (main.ts), so a panel does not drop the roots listing itself.
-const follower = getService(TREE_STATE).followWorkspaceChanges(window);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets an async action chain (fetch -> json -> render) run to completion.
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- Shared fetch mock -------------------------------------------------------
-
-const LIVE_ROOT = "C:\\project";
-const DEAD_ROOT = "C:\\gone";
-const rootsListing = {
-  path: null,
-  entries: [
-    { name: "project", path: LIVE_ROOT, kind: "directory", size: 0, modified_ms: 100, exists: true },
-    { name: "gone", path: DEAD_ROOT, kind: "directory", size: 0, modified_ms: 0, exists: false },
-  ],
-};
-
-const revokes = [];
-const grants = [];
-let revokeResponse = () => ({ ok: true, status: 200, json: async () => ({ revoked: "" }) });
-let grantResponse = (path) => ({ ok: true, status: 200, json: async () => ({ granted: path }) });
-globalThis.fetch = async (url, init) => {
-  if (url === "/workspace/tree") {
-    return { ok: true, status: 200, json: async () => rootsListing };
-  }
-  if (url === "/workspace/revoke") {
-    revokes.push(JSON.parse(init.body).path);
-    return revokeResponse();
-  }
-  if (url === "/workspace/grant") {
-    const path = JSON.parse(init.body).path;
-    grants.push(path);
-    return grantResponse(path);
-  }
-  throw new Error(`unexpected fetch in the workshop-panel-menu test: ${url}`);
-};
-
-const statusMessages = [];
-const statusBar = {
-  showLocal: (label, severity) => statusMessages.push({ label, severity }),
-};
-
-let workspaceChanges = 0;
-window.addEventListener("runvil:workspace-changed", () => {
-  workspaceChanges += 1;
-});
-
-function rightClick(target) {
-  target.dispatchEvent(
-    new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true, clientX: 40, clientY: 40 }),
-  );
-}
-
-function menu() {
-  return window.document.querySelector(".menu-popup");
-}
-
-function rowByName(panel, name) {
-  return [...panel.element.querySelectorAll(".ws-workshop-tree__row")].find(
-    (row) => row.querySelector(".ws-workshop-tree__name")?.textContent === name,
-  );
-}
-
-// --- Missing roots render with the label, the class, and a working menu -----
-
-const panelA = new WorkshopTreePanel(statusBar);
-panelA.init({ params: {}, api: {} });
-window.document.body.appendChild(panelA.element);
-await flush();
-
-{
-  const gone = rowByName(panelA, "gone");
-  const live = rowByName(panelA, "project");
-  check("both granted roots render as rows", !!gone && !!live);
-  check(
-    "a missing root has the strikethrough/danger modifier class",
-    gone?.classList.contains("ws-workshop-tree__row--missing") === true,
-  );
-  check(
-    'a missing root shows a "missing" text label beside its name',
-    gone?.querySelector(".ws-workshop-tree__missing")?.textContent === "missing",
-  );
-  check(
-    "a live root omits the modifier class and the label",
-    live?.classList.contains("ws-workshop-tree__row--missing") === false &&
-      live?.querySelector(".ws-workshop-tree__missing") === null,
-  );
-}
-
-// --- Right-click on a root: Remove revokes, announces, and confirms ---------
-
-{
-  rightClick(rowByName(panelA, "project"));
-  const items = [...(menu()?.querySelectorAll(".menu-item") ?? [])];
-  check("right-clicking a root opens a one-item menu", items.length === 1);
-  check(
-    "the item is a danger-styled Remove from Workspace",
-    items[0]?.textContent === "Remove from Workspace" &&
-      items[0]?.classList.contains("menu-item--danger"),
-  );
-  items[0].click();
-  await flush();
-  check("Remove revokes the clicked root's path", revokes.join(",") === LIVE_ROOT);
-  check("a successful revoke announces one workspace change", workspaceChanges === 1);
-  check(
-    "a successful revoke confirms on the status bar as info",
-    statusMessages.some(
-      (entry) => entry.severity === "info" && entry.label.includes("Removed") && entry.label.includes(LIVE_ROOT),
-    ),
-  );
-  check("the menu closes after the action", menu() === null);
-}
-
-// --- A failed revoke paints the status bar and announces nothing ------------
-
-{
-  revokeResponse = () => ({
-    ok: false,
-    status: 404,
-    json: async () => ({ error: { message: "path is not a granted root", code: "not_granted" } }),
-  });
-  const changesBefore = workspaceChanges;
-  // The missing root's row still offers Remove: revoke is the cleanup
-  // path for roots deleted from disk.
-  rightClick(rowByName(panelA, "gone"));
-  const items = [...(menu()?.querySelectorAll(".menu-item") ?? [])];
-  check("a missing root's context menu still offers Remove", items[0]?.textContent === "Remove from Workspace");
-  items[0].click();
-  await flush();
-  check(
-    "a failed revoke paints the server message as a status-bar error",
-    statusMessages.some(
-      (entry) => entry.severity === "error" && entry.label.includes("path is not a granted root"),
-    ),
-  );
-  check("a failed revoke announces no workspace change", workspaceChanges === changesBefore);
-  revokeResponse = () => ({ ok: true, status: 200, json: async () => ({ revoked: "" }) });
-}
-
-// --- The header "+" button is keyboard-reachable -----------------------------
-
-{
-  const add = panelA.element.querySelector(".ws-workshop-tree__add");
-  check("the header renders an add-folder button", add instanceof window.HTMLButtonElement);
-  check("the add button is not removed from the tab order", add?.tabIndex === 0);
-  check("the add button has an accessible name", (add?.getAttribute("aria-label") ?? "").includes("Add Folder"));
-  add.focus();
-  check("the add button takes keyboard focus", window.document.activeElement === add);
-}
-
-panelA.dispose();
-
-// --- Desktop app: the "+" opens the native picker; the picked path grants ---
-
-{
-  window.__TAURI_INTERNALS__ = {};
-  window.__TAURI_DIALOG__ = { calls: [], answer: null };
-  const panelB = new WorkshopTreePanel(statusBar);
-  panelB.init({ params: {}, api: {} });
-  window.document.body.appendChild(panelB.element);
-  await flush();
-
-  panelB.element.querySelector(".ws-workshop-tree__add").click();
-  await flush();
-  check(
-    "the desktop add opens the native directory picker",
-    window.__TAURI_DIALOG__.calls.length === 1 &&
-      window.__TAURI_DIALOG__.calls[0].directory === true,
-  );
-  check("the desktop add opens no typed-path dialog", panelB.element.querySelector(".ws-workspace-add-overlay") === null);
-
-  // A canceled pick resolves null: nothing grants.
-  check("a canceled pick grants nothing", grants.length === 0);
-
-  const changesBefore = workspaceChanges;
-  window.__TAURI_DIALOG__.answer = "C:\\picked";
-  panelB.element.querySelector(".ws-workshop-tree__add").click();
-  await flush();
-  check("a picked path is granted", grants.join(",") === "C:\\picked");
-  check("a picked-path grant announces one workspace change", workspaceChanges === changesBefore + 1);
-  check(
-    "a picked-path grant confirms on the status bar as info",
-    statusMessages.some(
-      (entry) => entry.severity === "info" && entry.label.includes("Added") && entry.label.includes("C:\\picked"),
-    ),
-  );
-  panelB.dispose();
-}
-
-// --- Plain browser: empty-space menu opens the dialog; input gates Add ------
-
-{
-  delete window.__TAURI_INTERNALS__;
-  const panelC = new WorkshopTreePanel(statusBar);
-  panelC.init({ params: {}, api: {} });
-  window.document.body.appendChild(panelC.element);
-  await flush();
-
-  // Right-click on empty panel space (the panel element itself).
-  rightClick(panelC.element);
-  const items = [...(menu()?.querySelectorAll(".menu-item") ?? [])];
-  check(
-    "right-clicking empty space offers Add Folder to Workspace...",
-    items.length === 1 && items[0]?.textContent === "Add Folder to Workspace...",
-  );
-  items[0].click();
-
-  const overlay = panelC.element.querySelector(".ws-workspace-add-overlay");
-  check("the browser add opens the path dialog", overlay !== null);
-  const label = overlay?.querySelector('label[for="workspace-add-path"]');
-  const input = overlay?.querySelector("input#workspace-add-path");
-  check("the dialog's path input has an associated label", !!label && !!input);
-  const addButton = [...(overlay?.querySelectorAll("button") ?? [])].find(
-    (button) => button.textContent === "Add",
-  );
-  check("the Add button starts disabled while the input is empty", addButton?.disabled === true);
-  check(
-    "the Add Folder dialog opens Cursor's form modal",
-    overlay?.classList.contains("modal-overlay--form") === true &&
-      overlay.querySelector(".ws-workspace-add")?.classList.contains("modal-dialog--form") === true,
-  );
-  check(
-    "the form modal puts Cancel first and the primary Add last",
-    [...overlay.querySelectorAll(".ws-workspace-add__actions button")]
-      .map((button) => button.textContent).join("|") === "Cancel|Add",
-  );
-  addButton?.click();
-  await flush();
-  check("a disabled Add grants nothing", grants.length === 1);
-
-  input.value = "C:\\typed";
-  input.dispatchEvent(new window.Event("input", { bubbles: true }));
-  check("typing a path enables Add", addButton?.disabled === false);
-  addButton.click();
-  await flush();
-  check("Add grants the typed path", grants.join(",") === "C:\\picked,C:\\typed");
-  check("the dialog dismisses after Add", panelC.element.querySelector(".ws-workspace-add-overlay") === null);
-  panelC.dispose();
-}
-
-// --- Enter submits the dialog; a failed grant paints the status bar ---------
-
-{
-  const panelD = new WorkshopTreePanel(statusBar);
-  panelD.init({ params: {}, api: {} });
-  window.document.body.appendChild(panelD.element);
-  await flush();
-
-  panelD.element.querySelector(".ws-workshop-tree__add").click();
-  const input = panelD.element.querySelector("input#workspace-add-path");
-  const grantsBefore = grants.length;
-  const pressEnter = (target) => {
-    target.dispatchEvent(
-      new window.KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true }),
-    );
-  };
-  pressEnter(input);
-  await flush();
-  check("Enter with an empty field submits nothing", grants.length === grantsBefore);
-  check(
-    "Enter with an empty field keeps the dialog open",
-    panelD.element.querySelector(".ws-workspace-add-overlay") !== null,
-  );
-
-  input.value = "C:\\entered";
-  input.dispatchEvent(new window.Event("input", { bubbles: true }));
-  pressEnter(input);
-  await flush();
-  check("Enter with a typed path grants it", grants[grants.length - 1] === "C:\\entered");
-  check("Enter dismisses the dialog", panelD.element.querySelector(".ws-workspace-add-overlay") === null);
-
-  // A grant the server refuses (a bad path never validated client-side)
-  // paints the status bar and announces no workspace change.
-  grantResponse = () => ({
-    ok: false,
-    status: 400,
-    json: async () => ({ error: { message: "path is not absolute", code: "not_absolute" } }),
-  });
-  const changesBefore = workspaceChanges;
-  panelD.element.querySelector(".ws-workshop-tree__add").click();
-  const retry = panelD.element.querySelector("input#workspace-add-path");
-  retry.value = "relative\\path";
-  retry.dispatchEvent(new window.Event("input", { bubbles: true }));
-  pressEnter(retry);
-  await flush();
-  check(
-    "a failed grant paints the server message as a status-bar error",
-    statusMessages.some(
-      (entry) => entry.severity === "error" && entry.label.includes("path is not absolute"),
-    ),
-  );
-  check("a failed grant announces no workspace change", workspaceChanges === changesBefore);
-  grantResponse = (path) => ({ ok: true, status: 200, json: async () => ({ granted: path }) });
-  panelD.dispose();
-}
-
-// --- The section header: a chevron, the title, hover actions, a collapsing body ------------
-
-{
-  const panelE = new WorkshopTreePanel(statusBar);
-  panelE.init({ params: {}, api: {} });
-  window.document.body.appendChild(panelE.element);
-  await flush();
-
-  const header = panelE.element.querySelector(".ws-workshop-tree__header");
-  const toggle = header?.querySelector(".ws-workshop-tree__section");
-  check("the section header toggles from a button", toggle instanceof window.HTMLButtonElement);
-  check(
-    "the section header reads a chevron, then the title",
-    toggle?.firstElementChild?.querySelector("svg") !== null &&
-      toggle?.querySelector(".ws-workshop-tree__section-title")?.textContent === "Workspace",
-  );
-  check("the section starts expanded", toggle?.getAttribute("aria-expanded") === "true");
-  check(
-    "the Add Folder button is one of the header's hover actions",
-    header?.querySelector(".ws-workshop-tree__actions > .ws-workshop-tree__add") instanceof window.HTMLButtonElement,
-  );
-  const list = panelE.element.querySelector(".ws-workshop-tree__list");
-  toggle?.click();
-  check(
-    "collapsing the section hides its rows",
-    toggle?.getAttribute("aria-expanded") === "false" && list?.hidden === true,
-  );
-  toggle?.click();
-  check(
-    "expanding the section shows its rows again",
-    toggle?.getAttribute("aria-expanded") === "true" && list?.hidden === false,
-  );
-
-  // A row's geometry is driven by its depth; a root sits at depth 1 and carries a twistie box.
-  const root = rowByName(panelE, "project");
-  check("a root row is at depth 1", root?.style.getPropertyValue("--ws-tree-depth") === "1");
-  const twistie = root?.querySelector(".ws-workshop-tree__twistie");
-  check("a folder row opens with its twistie box", twistie !== null && root?.firstElementChild === twistie);
-  check(
-    "the twistie box holds a 16px chevron",
-    twistie?.querySelector("svg")?.getAttribute("width") === "16" &&
-      twistie?.querySelector("svg")?.getAttribute("height") === "16",
-  );
-  panelE.dispose();
-}
-
-// --- An empty tree says so and offers Open Folder ------------------------------------------------
-
-{
-  const panelF = new WorkshopTreePanel(statusBar);
-  panelF.init({ params: {}, api: {} });
-  window.document.body.appendChild(panelF.element);
-  await flush();
-  check("a tree with roots shows no empty state", panelF.element.querySelector(".ws-workshop-tree__empty") === null);
-
-  const savedEntries = rootsListing.entries;
-  rootsListing.entries = [];
-  window.dispatchEvent(new window.CustomEvent("runvil:workspace-changed"));
-  await flush();
-  const empty = panelF.element.querySelector(".ws-workshop-tree__empty");
-  check(
-    "the empty tree reads Cursor's sentence",
-    empty?.querySelector(".ws-workshop-tree__empty-text")?.textContent ===
-      "You have not yet added a folder to the workspace.",
-  );
-  const openFolder = empty?.querySelector("button");
-  check(
-    "the empty tree offers a primary Open Folder button",
-    openFolder?.textContent === "Open Folder" && openFolder.classList.contains("button-primary"),
-  );
-  openFolder?.click();
-  await flush();
-  check(
-    "Open Folder starts the Add Folder flow",
-    panelF.element.querySelector(".ws-workspace-add-overlay") !== null,
-  );
-  panelF.element.querySelector(".ws-workspace-add-overlay")?.querySelector("button")?.click();
-  await flush();
-
-  rootsListing.entries = savedEntries;
-  window.dispatchEvent(new window.CustomEvent("runvil:workspace-changed"));
-  await flush();
-  check("granting a root clears the empty state", panelF.element.querySelector(".ws-workshop-tree__empty") === null);
-  panelF.dispose();
-}
-
-follower.dispose();
-
-if (failures.length > 0) {
-  console.error(`workshop-panel-menu: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-panel-menu: all assertions passed");
diff --git a/crates/workshop/ui/test/workshop-panel-restore.mjs b/crates/workshop/ui/test/workshop-panel-restore.mjs
deleted file mode 100644
index 156c4ca13..000000000
--- a/crates/workshop/ui/test/workshop-panel-restore.mjs
+++ /dev/null
@@ -1,347 +0,0 @@
-// Unit test for the Workshop tree's restored expansion
-// (src/parts/workspace/workshop-panel.ts with src/services/tree-state-service.ts):
-// after a relaunch the expanded set comes back from the workspace file
-// but the listing cache is empty, so a folder that is expanded with no
-// cached listing must fetch its listing on render rather than rendering
-// open with no children. Bundles the panel with esbuild and drives it
-// against jsdom with a mocked /workspace/tree. Covers: a folder in the
-// initial expanded set with no cached listing is fetched on render and
-// renders its children; the fetched listing lands in the cache; a nested
-// expanded folder fetches once its parent renders; a collapsed folder is
-// not fetched; a folder whose fetch fails paints an error row and leaves
-// the rest of the tree standing; replaceExpanded on the service makes
-// the panel re-render with the new set; the Open Workspace sequence
-// (invalidateRoots, the tree panel re-created by the layout apply,
-// replaceExpanded, then a WORKSPACE_CHANGED_EVENT saying the roots are
-// current) fetches the roots once and renders each root once, the
-// replaceExpanded and the event joining the re-created panel's load;
-// a roots load that invalidateRoots dropped while it was in flight and
-// that settles after a fresh load rendered neither repaints the tree with
-// its stale roots nor, when it fails, paints an error row over them.
-// Run: node test/workshop-panel-restore.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.Event = window.Event;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { WorkshopTreePanel } from "./src/parts/workspace/workshop-panel.ts";
-      export { TreeStateService, TREE_STATE } from "./src/services/tree-state-service.ts";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { WORKSPACE_CHANGED_EVENT } from "./src/services/workspace-events.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-  },
-});
-const { WorkshopTreePanel, TreeStateService, TREE_STATE, registerService, WORKSPACE_CHANGED_EVENT } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- The mocked workspace tree -----------------------------------------------
-
-const ROOT = "C:\\project";
-const SRC = "C:\\project\\src";
-const SRC_LIB = "C:\\project\\src\\lib";
-const DOCS = "C:\\project\\docs";
-const BROKEN = "C:\\project\\broken";
-
-const dir = (name, p) => ({ name, path: p, kind: "directory", size: 0, modified_ms: 1, exists: true });
-const file = (name, p) => ({ name, path: p, kind: "file", size: 3, modified_ms: 1, exists: true });
-
-const listings = new Map([
-  [null, { path: null, entries: [dir("project", ROOT)] }],
-  [ROOT, { path: ROOT, entries: [dir("broken", BROKEN), dir("docs", DOCS), dir("src", SRC)] }],
-  [SRC, { path: SRC, entries: [dir("lib", SRC_LIB), file("main.ts", `${SRC}\\main.ts`)] }],
-  [SRC_LIB, { path: SRC_LIB, entries: [file("util.ts", `${SRC_LIB}\\util.ts`)] }],
-  [DOCS, { path: DOCS, entries: [file("guide.md", `${DOCS}\\guide.md`)] }],
-]);
-
-const fetched = [];
-// While set, every roots fetch (path null) parks on this promise so a test
-// can start a second load before the first resolves.
-let holdRoots = null;
-// The roots listing a roots fetch answers with; a test swaps it to stand
-// for a different workspace's grants.
-let rootsListing = listings.get(null);
-// While set, a roots fetch fails once released instead of answering.
-let failRoots = false;
-globalThis.fetch = async (url) => {
-  const parsed = new URL(url, "http://127.0.0.1:7910/");
-  if (parsed.pathname !== "/workspace/tree") {
-    throw new Error(`unexpected fetch in the workshop-panel-restore test: ${url}`);
-  }
-  const p = parsed.searchParams.get("path");
-  fetched.push(p);
-  // Captured at call time: a test parks load A, then changes the hold,
-  // the listing, or the failure flag for load B, and A must keep what it
-  // was called with.
-  const hold = p === null ? holdRoots : null;
-  const fail = p === null && failRoots;
-  const listing = p === null ? rootsListing : listings.get(p);
-  if (hold !== null) {
-    await hold;
-  }
-  if (p === BROKEN || fail) {
-    return {
-      ok: false,
-      status: 403,
-      json: async () => ({ error: { message: "path is outside the workspace", code: "forbidden" } }),
-    };
-  }
-  if (listing === undefined) {
-    throw new Error(`no mocked listing for ${p}`);
-  }
-  return { ok: true, status: 200, json: async () => listing };
-};
-
-function rowByPath(panel, p) {
-  return [...panel.element.querySelectorAll(".ws-workshop-tree__row")].find((row) => row.title === p);
-}
-function childrenOf(row) {
-  return row?.parentElement?.querySelector(".ws-workshop-tree__children") ?? null;
-}
-function childNames(row) {
-  const children = childrenOf(row);
-  return children === null
-    ? []
-    : [...children.children].map(
-        (li) => li.querySelector(".ws-workshop-tree__name")?.textContent ?? li.textContent,
-      );
-}
-
-// --- Restored expansion fetches listings on render ------------------------
-
-// The state a relaunch produces: the workspace file says these folders
-// were open; nothing has been fetched yet this session.
-const storage = createFakeUiStorage({ workspace: { tree: { expanded: [ROOT, SRC, SRC_LIB, BROKEN] } } });
-const state = new TreeStateService(storage.get("workspace", "tree"), (value) =>
-  storage.set("workspace", "tree", value),
-);
-registerService(TREE_STATE, () => state);
-// The composition root has the service follow the workspace-changed event
-// (main.ts), so the panel does not drop the roots itself; follow it here too.
-const follower = state.followWorkspaceChanges(window);
-
-let panel = new WorkshopTreePanel(null);
-panel.init({ params: {}, api: {} });
-window.document.body.appendChild(panel.element);
-await flush();
-
-{
-  const root = rowByPath(panel, ROOT);
-  check("the granted root renders", root !== undefined);
-  check("a restored root renders expanded", root?.getAttribute("aria-expanded") === "true");
-  check("a restored root with no cached listing is fetched on render", fetched.includes(ROOT));
-  check(
-    "the restored root shows its children",
-    childNames(root).join(",") === "broken,docs,src",
-  );
-  check("the fetched listing lands in the cache", state.listing(ROOT) !== undefined);
-  check("the children list is visible", childrenOf(root)?.hidden === false);
-
-  const src = rowByPath(panel, SRC);
-  check("a nested restored folder fetches once its parent renders", fetched.includes(SRC));
-  check("the nested folder renders expanded with its children", src?.getAttribute("aria-expanded") === "true" && childNames(src).join(",") === "lib,main.ts");
-  check("a third level restores too", fetched.includes(SRC_LIB) && childNames(rowByPath(panel, SRC_LIB)).join(",") === "util.ts");
-
-  const docs = rowByPath(panel, DOCS);
-  check("a collapsed folder is not fetched", !fetched.includes(DOCS));
-  check("a collapsed folder renders collapsed", docs?.getAttribute("aria-expanded") === "false" && childrenOf(docs)?.hidden === true);
-
-  const broken = rowByPath(panel, BROKEN);
-  check("a restored folder whose fetch fails was attempted", fetched.includes(BROKEN));
-  const errorRow = childrenOf(broken)?.querySelector(".ws-workshop-tree__error");
-  check("a failed restore paints an error row under the folder", errorRow?.textContent.includes("outside the workspace") === true);
-  check("a failed restore leaves the folder's row enabled", broken?.disabled === false);
-  check("a failed restore leaves the rest of the tree standing", childNames(root).length === 3 && childNames(src).length === 2);
-  check("nothing is fetched twice", new Set(fetched).size === fetched.length);
-  check("rendering a restored tree writes nothing back", storage.sets.length === 0);
-}
-
-// --- replaceExpanded re-renders the tree -------------------------------------
-
-{
-  const before = fetched.length;
-  state.replaceExpanded([ROOT, DOCS]);
-  await flush();
-  const root = rowByPath(panel, ROOT);
-  check("after replaceExpanded the root is still expanded", root?.getAttribute("aria-expanded") === "true");
-  check("after replaceExpanded the old folders render collapsed", rowByPath(panel, SRC)?.getAttribute("aria-expanded") === "false");
-  const docs = rowByPath(panel, DOCS);
-  check("after replaceExpanded the new folder renders expanded", docs?.getAttribute("aria-expanded") === "true");
-  check("the newly expanded folder is fetched", fetched.slice(before).includes(DOCS));
-  check("the newly expanded folder shows its children", childNames(docs).join(",") === "guide.md");
-  check("already cached listings are not refetched", !fetched.slice(before).includes(ROOT) && !fetched.slice(before).includes(SRC));
-  check(
-    "the tree renders one copy of the root",
-    [...panel.element.querySelectorAll(".ws-workshop-tree__row")].filter((row) => row.title === ROOT).length === 1,
-  );
-}
-
-// --- The Open Workspace sequence fetches the roots once -------------------------
-
-// What applyOpenedWorkspaceState and announceSwitched run, in order: the
-// roots are invalidated first, the layout apply re-creates the tree
-// panel (whose init starts the one roots load against the empty cache),
-// replaceExpanded lands while that load is in flight, and the
-// workspace-changed event follows with a detail saying the roots are
-// current. The replaceExpanded reload and the event join the panel's
-// load rather than dropping it and fetching again; a window-title
-// refresh on the event (state.roots()) joins it too; and however many
-// loads settle on it the tree holds one copy of each root.
-{
-  const before = fetched.length;
-  let release;
-  holdRoots = new Promise((resolve) => {
-    release = resolve;
-  });
-  state.invalidateRoots();
-  check("invalidating first empties the roots cache", state.listing("") === undefined);
-  panel.dispose();
-  panel.element.remove();
-  panel = new WorkshopTreePanel(null);
-  panel.init({ params: {}, api: {} });
-  window.document.body.appendChild(panel.element);
-  await flush();
-  check("the re-created panel starts the one roots fetch", fetched.slice(before).filter((p) => p === null).length === 1);
-  check("the roots are not cached while the fetch is in flight", state.listing("") === undefined);
-  state.replaceExpanded([ROOT, SRC]);
-  await flush();
-  check("replaceExpanded during the fetch joins the in-flight roots load", fetched.slice(before).filter((p) => p === null).length === 1);
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT, { detail: { rootsCurrent: true } }));
-  void state.roots();
-  await flush();
-  check("the event saying the roots are current does not drop the load and fetch again", fetched.slice(before).filter((p) => p === null).length === 1);
-  release();
-  holdRoots = null;
-  await flush();
-  check("the whole switch fetched the roots exactly once", fetched.slice(before).filter((p) => p === null).length === 1);
-  const roots = [...panel.element.querySelectorAll(".ws-workshop-tree__row")].filter((row) => row.title === ROOT);
-  check("overlapping loads render one copy of each root", roots.length === 1);
-  check("the roots listing is cached once every load settles", state.listing("") !== undefined);
-  check("the surviving render is expanded per the replaced set", roots[0]?.getAttribute("aria-expanded") === "true" && childNames(roots[0]).join(",") === "broken,docs,src");
-  check("the replaced set's nested folder renders expanded", rowByPath(panel, SRC)?.getAttribute("aria-expanded") === "true");
-  check("the replaced set's collapsed folder renders collapsed", rowByPath(panel, DOCS)?.getAttribute("aria-expanded") === "false");
-  check("no error row appears from the joined loads", panel.element.querySelector(".ws-workshop-tree__error") === null);
-}
-
-// --- A stale roots load settling after a fresh one rendered -----------------
-
-// Two workspace changes back to back: load A (the old grants) is still in
-// flight when the second change invalidates the roots and load B (the new
-// grants) fetches and renders. A then resolves with the old roots. The
-// service does not cache it, and the panel must not repaint the tree with
-// it: the roots on screen stay B's.
-const OTHER = "D:\\other";
-const OLD_ROOTS = { path: null, entries: [dir("project", ROOT)] };
-const NEW_ROOTS = { path: null, entries: [dir("other", OTHER)] };
-function rootTitles(panel) {
-  return [...panel.element.querySelectorAll(".ws-workshop-tree__list > li > .ws-workshop-tree__row")].map((row) => row.title);
-}
-function cachedRootPaths(state) {
-  return (state.listing("")?.entries ?? []).map((entry) => entry.path).join(",");
-}
-{
-  const before = fetched.length;
-  let releaseA;
-  holdRoots = new Promise((resolve) => {
-    releaseA = resolve;
-  });
-  rootsListing = OLD_ROOTS;
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("load A starts on the first workspace change", fetched.slice(before).filter((p) => p === null).length === 1);
-
-  holdRoots = null;
-  rootsListing = NEW_ROOTS;
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("load B fetches again after the second change invalidated the roots", fetched.slice(before).filter((p) => p === null).length === 2);
-  check("load B's roots render", rootTitles(panel).join(",") === OTHER);
-  check("load B's listing is cached", cachedRootPaths(state) === OTHER);
-
-  releaseA();
-  await flush();
-  check("the stale load A does not repaint the tree with the old roots", rootTitles(panel).join(",") === OTHER);
-  check("the stale load A does not replace the cached listing", cachedRootPaths(state) === OTHER);
-  check("no error row appears from the stale load", panel.element.querySelector(".ws-workshop-tree__error") === null);
-}
-
-// --- A stale roots load failing after a fresh one rendered ------------------
-
-// The same overlap, but the dropped load fails: the panel must not paint
-// its error row over the roots the fresh load rendered.
-{
-  const before = fetched.length;
-  let releaseC;
-  holdRoots = new Promise((resolve) => {
-    releaseC = resolve;
-  });
-  failRoots = true;
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("load C starts on the first workspace change", fetched.slice(before).filter((p) => p === null).length === 1);
-
-  holdRoots = null;
-  failRoots = false;
-  window.dispatchEvent(new CustomEvent(WORKSPACE_CHANGED_EVENT));
-  await flush();
-  check("load D fetches again and renders", fetched.slice(before).filter((p) => p === null).length === 2 && rootTitles(panel).join(",") === OTHER);
-
-  releaseC();
-  await flush();
-  check("the stale failed load C paints no error row", panel.element.querySelector(".ws-workshop-tree__error") === null);
-  check("the stale failed load C leaves load D's roots standing", rootTitles(panel).join(",") === OTHER);
-  check("the stale failed load C leaves the cached listing", cachedRootPaths(state) === OTHER);
-}
-
-panel.dispose();
-follower.dispose();
-state.dispose();
-
-if (failures.length > 0) {
-  console.error(`workshop-panel-restore: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-panel-restore: all assertions passed");
diff --git a/crates/workshop/ui/test/workshop-wire-fixtures.mjs b/crates/workshop/ui/test/workshop-wire-fixtures.mjs
deleted file mode 100644
index e3bd3b895..000000000
--- a/crates/workshop/ui/test/workshop-wire-fixtures.mjs
+++ /dev/null
@@ -1,206 +0,0 @@
-// The TS half of the workshop-frame wire contract: every frame in the
-// shared fixture crates/workshop/protocol/tests/fixtures/workshop-frames.json
-// routes through WorkshopSocket unchanged (server-to-client), and every
-// frame the socket sends matches its fixture entry byte-for-byte as parsed
-// JSON (client-to-server). The Rust half is the fixture test in
-// crates/workshop/protocol/tests/it/workshop_frames.rs; both suites pin the
-// same case list, so a wire drift or a case added on one side fails the
-// other. Every inbound fixture frame also passes its protocol.ts guard, and
-// a copy missing any required field is dropped with one warning.
-// Run: node test/workshop-wire-fixtures.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { assertNoLeaks } from "./helpers/leak-check.mjs";
-
-const testDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export * as lifecycle from "@workshop/platform/lifecycle";
-      export { WorkshopSocket } from "./src/services/workshop-socket.ts";
-      export { WORKSHOP_FRAME_GUARDS } from "./src/services/protocol.ts";
-    `,
-    resolveDir: path.join(testDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-
-const bundlePath = path.join(os.tmpdir(), "runvil-workshop-wire-fixtures-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const { lifecycle, WorkshopSocket, WORKSHOP_FRAME_GUARDS } = await import(
-  pathToFileURL(bundlePath).href
-);
-
-const fixture = JSON.parse(
-  await readFile(
-    path.join(testDir, "..", "..", "..", "workshop", "protocol", "tests", "fixtures", "workshop-frames.json"),
-    "utf8",
-  ),
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Both suites pin exactly the same case list, so a case added on one side
-// fails the other. This list is mirrored by the Rust fixture test.
-const CASES = [
-  "error",
-  "models",
-  "select_model",
-  "status",
-  "switch_profile",
-  "workbench",
-];
-check(
-  "the fixture holds exactly the cases both suites pin",
-  isDeepStrictEqual(Object.keys(fixture).sort(), CASES),
-);
-
-const fakeSockets = [];
-class FakeWebSocket {
-  static OPEN = 1;
-  readyState = 0;
-  sent = [];
-  onopen = null;
-  onclose = null;
-  onerror = null;
-  onmessage = null;
-  constructor(url) {
-    this.url = url;
-    fakeSockets.push(this);
-  }
-  send(data) {
-    this.sent.push(JSON.parse(data));
-  }
-  close() {
-    this.readyState = 3;
-  }
-  // Test-side controls, not part of the WebSocket surface.
-  open() {
-    this.readyState = 1;
-    this.onopen?.();
-  }
-  message(frame) {
-    this.onmessage?.({ data: JSON.stringify(frame) });
-  }
-}
-globalThis.WebSocket = FakeWebSocket;
-
-const warnings = [];
-console.warn = (...args) => warnings.push(args.join(" "));
-
-// --- Guards: the inbound frames /ws handles ------------------------------
-
-const INBOUND = ["models", "status", "workbench"];
-const fixtureTypes = new Set(Object.values(fixture).map((frame) => frame.type));
-check(
-  "every inbound type the workshop socket handles appears in the fixture",
-  Object.keys(WORKSHOP_FRAME_GUARDS).every((type) => fixtureTypes.has(type)),
-);
-check(
-  "the workshop socket guards exactly the inbound cases",
-  isDeepStrictEqual(Object.keys(WORKSHOP_FRAME_GUARDS).sort(), INBOUND),
-);
-for (const type of INBOUND) {
-  check(
-    `the ${type} fixture frame passes its guard`,
-    WORKSHOP_FRAME_GUARDS[type](fixture[type]) === true,
-  );
-}
-
-await assertNoLeaks(lifecycle, async () => {
-  // --- Server-to-client: each fixture frame routes through unchanged ------
-
-  const socket = new WorkshopSocket("ws://fake/ws");
-  const statuses = [];
-  const models = [];
-  const workbenches = [];
-  socket.onStatus((frame) => statuses.push(frame));
-  socket.onModels((list) => models.push(list));
-  socket.onWorkbench((frame) => workbenches.push(frame));
-  socket.ready();
-  socket.connect();
-  const wire = fakeSockets[0];
-  wire.open();
-
-  wire.message(fixture.status);
-  wire.message(fixture.models);
-  wire.message(fixture.workbench);
-
-  check(
-    "the status fixture frame delivers verbatim",
-    isDeepStrictEqual(statuses, [fixture.status]),
-  );
-  check(
-    "the models fixture frame delivers its catalog verbatim",
-    isDeepStrictEqual(models, [fixture.models.models]),
-  );
-  check(
-    "the workbench fixture frame delivers verbatim",
-    isDeepStrictEqual(workbenches, [fixture.workbench]),
-  );
-
-  // The error frame is a refusal answered to an inbound event; the
-  // workshop socket has no emitter for it, so it must not surface as a
-  // push.
-  wire.message(fixture.error);
-  check(
-    "an error fixture frame does not surface as a push",
-    statuses.length === 1 && models.length === 1 && workbenches.length === 1,
-  );
-  check("an error fixture frame on /ws warns about nothing", warnings.length === 0);
-
-  // Every required field of every inbound frame: a copy without it fails
-  // its guard and is dropped, with one warning naming its type.
-  for (const type of INBOUND) {
-    for (const field of Object.keys(fixture[type]).filter((key) => key !== "type")) {
-      const copy = structuredClone(fixture[type]);
-      delete copy[field];
-      warnings.length = 0;
-      wire.message(copy);
-      check(
-        `a ${type} frame missing ${field} fails its guard`,
-        WORKSHOP_FRAME_GUARDS[type](copy) === false,
-      );
-      check(
-        `a ${type} frame missing ${field} is dropped without a handler call`,
-        statuses.length === 1 && models.length === 1 && workbenches.length === 1,
-      );
-      check(
-        `a ${type} frame missing ${field} warns once, naming ${type}`,
-        warnings.length === 1 && warnings[0].includes(type),
-      );
-    }
-  }
-
-  // --- Client-to-server: each send matches its fixture entry --------------
-
-  socket.selectModel(fixture.select_model.model);
-  socket.switchProfile(fixture.switch_profile.name);
-  check(
-    "select_model and switch_profile sends match their fixture entries",
-    isDeepStrictEqual(wire.sent, [fixture.select_model, fixture.switch_profile]),
-  );
-  socket.dispose();
-});
-
-if (failures.length > 0) {
-  console.error(`workshop-wire-fixtures: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-wire-fixtures: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/workshop-zones.mjs b/crates/workshop/ui/test/workshop-zones.mjs
deleted file mode 100644
index 4b753445c..000000000
--- a/crates/workshop/ui/test/workshop-zones.mjs
+++ /dev/null
@@ -1,878 +0,0 @@
-// Integration test for the workshop zone registry and file tree
-// (src/parts/layout/zones.ts, panel-types.ts, and
-// src/parts/workspace/workshop-panel.ts). Bundles the
-// modules with esbuild, mounts a real Dockview dock in jsdom against the
-// real index.html, and drives the public API. Covers: the agent-session
-// and Workshop panels mount through the registry; the agent panel is a
-// singleton whose reopen focuses it; every panel renders the generic chip
-// tab, the Workshop tree's has no close button, and the agent's opens the
-// registry tab menu on right-click; the tree requests
-// directory paths from /workspace/tree and never file contents;
-// openInZone places panels by affinity and honors per-panel overrides; a
-// zone group is rebuilt empty after its last panel closes and the next
-// open fills it; tree expansion survives a panel reopen.
-// Run: node test/workshop-zones.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-// One bundle, one module graph: zones, panel-types, and the tree panel
-// share their module state, and dockview comes along for a real dock.
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      // The dock lifecycle reads the closed-editor stack through its token;
-      // the implementation's module scope self-registers the empty default,
-      // so importing it here keeps close/empty-group handling working.
-      import "./src/parts/editor/closed-editors.ts";
-      // The panel types this test opens register from their contributions.
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      // Close and Close Others, the tab menu's rows.
-      import "./src/parts/layout/layout.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { createAgentPaneHeader } from "./src/parts/agent/agent-pane-header.ts";
-      export {
-        groupOfZone,
-        initZones,
-        openInZone,
-        panelIdFor,
-        leftZonePreferredWidth,
-        rightZonePreferredWidth,
-        setZoneOverride,
-        zoneOfPanel,
-      } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent, isPanelType, PANEL_TAB } from "./src/parts/layout/panel-types.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-});
-
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-// The same layout stubs the smoke test installs: jsdom has no layout.
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-// Opening a file mounts a real CodeMirror editor; jsdom has no
-// layout, so Range and element measurement get zero-rect shims. The test
-// never asserts editor geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-
-// A scripted workspace API. The roots listing answers one directory;
-// expanding it returns a folder and two files (folders first, as the
-// server orders them). /workspace/file serves a small text per path so
-// the step-14 editor panels can load; any other route rejects, so an
-// unexpected request fails the test loudly.
-const calls = [];
-const ROOT = "C:\\project";
-const LISTINGS = new Map([
-  [
-    null,
-    { path: null, entries: [{ name: "project", path: ROOT, kind: "directory", size: 0, modified_ms: 100, exists: true }] },
-  ],
-  [
-    ROOT,
-    {
-      path: ROOT,
-      entries: [
-        { name: "src", path: `${ROOT}\\src`, kind: "directory", size: 0, modified_ms: 100, exists: true },
-        { name: "a.txt", path: `${ROOT}\\a.txt`, kind: "file", size: 3, modified_ms: 100, exists: true },
-        { name: "b.txt", path: `${ROOT}\\b.txt`, kind: "file", size: 3, modified_ms: 100, exists: true },
-      ],
-    },
-  ],
-  // "broken" has no listing: expanding it exercises the fetch-failure path.
-  [
-    `${ROOT}\\src`,
-    {
-      path: `${ROOT}\\src`,
-      entries: [
-        { name: "broken", path: `${ROOT}\\src\\broken`, kind: "directory", size: 0, modified_ms: 100, exists: true },
-      ],
-    },
-  ],
-]);
-globalThis.fetch = async (url) => {
-  calls.push(url);
-  if (typeof url === "string" && url.startsWith("/workspace/file")) {
-    const pathParam = new URL(url, "http://127.0.0.1:7910").searchParams.get("path");
-    if (pathParam !== null && pathParam.startsWith(ROOT)) {
-      return {
-        ok: true,
-        status: 200,
-        json: async () => ({
-          path: pathParam,
-          size: 7,
-          token: "t100",
-          text: `text of ${pathParam}`,
-        }),
-      };
-    }
-  }
-  if (typeof url === "string" && url.startsWith("/workspace/tree")) {
-    const query = url.includes("?") ? new URL(url, "http://127.0.0.1:7910").searchParams : null;
-    const pathParam = query ? query.get("path") : null;
-    const key = pathParam === null || pathParam === "" ? null : pathParam;
-    if (LISTINGS.has(key)) {
-      return { ok: true, status: 200, json: async () => LISTINGS.get(key) };
-    }
-  }
-  throw new Error(`unexpected fetch in the workshop-zones test: ${url}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "Window",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The agent panel composes an AgentSocket on init; a scripted stand-in
-// that never opens keeps the panel inert - this test drives placement,
-// not the agent wire.
-globalThis.WebSocket = class {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  readyState = 0;
-  send() {}
-  close() {}
-};
-
-// The bundle includes all of dockview, so it is far too large for a data
-// URL (a failure would print the whole megabyte-long URL). Import from a
-// temp file instead, which also keeps stack traces readable.
-const bundlePath = path.join(os.tmpdir(), "workshop-zones-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  Commands,
-  createAgentPaneHeader,
-  groupOfZone,
-  initZones,
-  openInZone,
-  panelIdFor,
-  leftZonePreferredWidth,
-  rightZonePreferredWidth,
-  setZoneOverride,
-  zoneOfPanel,
-  createPanelComponent,
-  createPanelTabComponent,
-  isPanelType,
-  PANEL_TAB,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets the async fetch/render chains run to completion.
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-function rowByText(text) {
-  return [...window.document.querySelectorAll(".ws-workshop-tree__row")].find(
-    (row) => row.textContent === text,
-  );
-}
-
-const treeCalls = () => calls.filter((url) => url.startsWith("/workspace/tree"));
-const fileCalls = () => calls.filter((url) => url.startsWith("/workspace/file"));
-
-// The dock, wired exactly as main.ts wires it.
-const dock = createDockview(window.document.getElementById("dock"), {
-  createComponent: createPanelComponent,
-  createTabComponent: createPanelTabComponent,
-  createRightHeaderActionComponent: createAgentPaneHeader,
-  defaultTabComponent: PANEL_TAB,
-  theme: themeDark,
-  disableFloatingGroups: true,
-  hideBorders: true,
-  locked: false,
-  noPanelsOverlay: "emptyGroup",
-});
-initZones(dock);
-
-// --- Boot: the agent session and the Workshop mount through the registry ---
-
-const agentPanel = openInZone("agent", {});
-const treePanel = openInZone("tree", {});
-await flush();
-
-check("boot opens exactly the agent and tree panels", dock.panels.length === 2);
-check("the agent panel mounts its session surface", !!window.document.querySelector("#dock .ws-agent-panel"));
-check("the Workshop tree panel mounts", !!window.document.querySelector("#dock .ws-workshop-tree"));
-check("the agent opens in the right zone", zoneOfPanel(agentPanel) === "right");
-check("the tree opens in the left zone", zoneOfPanel(treePanel) === "left");
-check("boot renders two zone groups", dock.groups.length === 2);
-check(
-  "reopening a singleton panel activates it instead of duplicating",
-  openInZone("tree", {}) === treePanel && dock.panels.length === 2,
-);
-
-// --- Each zone's group carries its zone name ----------------------------------
-
-check(
-  "the agent's group is stamped as the right zone",
-  agentPanel.group.element.dataset.wsZone === "right",
-);
-check(
-  "the tree's group is stamped as the left zone",
-  treePanel.group.element.dataset.wsZone === "left",
-);
-
-// --- The right group's header: New Agent, More Actions, Close ----------------------
-
-const paneHeader = agentPanel.group.element.querySelector(".ws-pane-header");
-const headerButtons = [...(paneHeader?.querySelectorAll(".ws-pane-header__button") ?? [])];
-check(
-  "the right group holds the pane header with three buttons in order",
-  headerButtons.map((button) => button.getAttribute("aria-label")).join("|") ===
-    "New Agent|More Actions...|Close",
-);
-check(
-  "every header button draws a codicon",
-  headerButtons.length === 3 && headerButtons.every((button) => button.querySelector("svg") !== null),
-);
-check(
-  "the left group holds the header element too, which the stylesheet shows for the right zone only",
-  treePanel.group.element.querySelector(".ws-pane-header") !== null &&
-    treePanel.group.element.dataset.wsZone !== "right",
-);
-
-// Plus is New Chat Tab, which reuses an empty chat instead of piling up tabs.
-headerButtons[0].click();
-await flush();
-check("New Agent reuses the empty chat rather than opening another", dock.panels.length === 2);
-
-// More Actions opens the pane menu with the group's active chat as its target.
-headerButtons[1].click();
-const paneMenuLabels = () =>
-  [...window.document.querySelectorAll(".ws-window-titlebar__popover")]
-    .filter((popover) => !popover.hidden)
-    .flatMap((popover) => [...popover.querySelectorAll(".ws-window-titlebar__item-label")])
-    .map((label) => label.textContent)
-    .join("|");
-check(
-  `More Actions lists Toggle Chat Pane and the three close rows (got: ${paneMenuLabels()})`,
-  paneMenuLabels() === "Toggle Chat Pane|Close Tab|Close Other Tabs|Close All Tabs",
-);
-window.document.body.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true }));
-check("an outside press closes the pane menu", paneMenuLabels() === "");
-
-// --- The right zone's sizes -------------------------------------------------------
-
-check("the right zone prefers a quarter of a 1200px dock, floored at 300px", rightZonePreferredWidth(1200) === 300);
-check("the right zone prefers a quarter of a 1400px dock, 350px", rightZonePreferredWidth(1400) === 350);
-check("the right zone caps its preference at 400px", rightZonePreferredWidth(3000) === 400);
-check("the right zone never prefers less than 300px", rightZonePreferredWidth(400) === 300);
-check("the left zone prefers a quarter of a 1000px dock, 250px", leftZonePreferredWidth(1000) === 250);
-check("the left zone caps its preference at 300px", leftZonePreferredWidth(1200) === 300 && leftZonePreferredWidth(3000) === 300);
-check("the left zone never prefers less than 214px", leftZonePreferredWidth(600) === 214 && leftZonePreferredWidth(0) === 214);
-dock.layout(1200, 800);
-// The floor goes on with the first layout change of a laid-out dock.
-agentPanel.group.api.setSize({ width: 320 });
-await flush();
-check(
-  "once the dock is laid out the right zone's width floor is 300px",
-  agentPanel.group.minimumWidth === 300 && treePanel.group.minimumWidth !== 300,
-);
-check("the floor leaves the right zone's width where it was", agentPanel.group.api.width === 320);
-
-// --- Tabs: normal chips, and the tree's has no close button -----------------
-
-const treeTab = treePanel.view.tab.element;
-const agentTab = agentPanel.view.tab.element;
-check(
-  "the tree tab renders the default chip structure",
-  treeTab.classList.contains("dv-default-tab") &&
-    treeTab.querySelector(".dv-default-tab-content")?.textContent === "Workshop",
-);
-check("the tree tab has no close button", treeTab.querySelector(".dv-default-tab-action") === null);
-check(
-  "the agent tab keeps the default closable chip",
-  agentTab.classList.contains("dv-default-tab") &&
-    agentTab.querySelector(".dv-default-tab-action") !== null,
-);
-agentTab.dispatchEvent(
-  new window.MouseEvent("contextmenu", {
-    bubbles: true,
-    cancelable: true,
-    clientX: 40,
-    clientY: 30,
-  }),
-);
-const shownTabMenus = () =>
-  [...window.document.querySelectorAll(".ws-window-titlebar__popover")].filter((popover) => !popover.hidden);
-const agentTabMenuLabels = [...(shownTabMenus()[0]?.querySelectorAll(".ws-window-titlebar__item-label") ?? [])]
-  .map((label) => label.textContent)
-  .join(",");
-check(
-  `right-clicking an agent tab opens the registry tab menu (got: ${agentTabMenuLabels})`,
-  agentTabMenuLabels === "Close,Close Others,Rename Chat",
-);
-// The menu's Rename Chat row opens the rename prompt for the clicked tab.
-const renameRow = [...(shownTabMenus()[0]?.querySelectorAll(".ws-window-titlebar__item") ?? [])].find(
-  (row) => row.querySelector(".ws-window-titlebar__item-label")?.textContent === "Rename Chat",
-);
-renameRow?.click();
-await flush();
-check(
-  "the tab menu's Rename Chat row opens the rename prompt, prefilled with the tab's name",
-  window.document.querySelector(".ws-chat-rename input")?.value === "New Agent",
-);
-[...(window.document.querySelector(".ws-chat-rename")?.querySelectorAll("button") ?? [])]
-  .find((button) => button.textContent === "Cancel")
-  ?.click();
-check("Cancel closes the prompt and renames nothing", window.document.querySelector(".ws-chat-rename") === null);
-window.document.body.dispatchEvent(new window.MouseEvent("pointerdown", { bubbles: true }));
-check("an outside pointer closes the agent tab menu", shownTabMenus().length === 0);
-treeTab.dispatchEvent(new window.MouseEvent("contextmenu", { bubbles: true, cancelable: true }));
-check("right-clicking the tree tab opens no menu", shownTabMenus().length === 0);
-treePanel.api.setTitle("Renamed");
-check(
-  "the tree tab follows title changes",
-  treeTab.querySelector(".dv-default-tab-content")?.textContent === "Renamed",
-);
-treePanel.api.setTitle("Workshop");
-
-// --- The agent session is a singleton: reopening focuses it ----------------
-
-check("a new agent tab is titled New Agent", agentPanel.title === "New Agent");
-check("the agent panel keys by its type name", panelIdFor("agent", {}) === "agent");
-check(
-  "reopening the agent session activates the same panel",
-  openInZone("agent", {}) === agentPanel && dock.panels.length === 2,
-);
-const secondAgent = openInZone("agent", { instance: "second" });
-check("an agent instance keys to its own panel", panelIdFor("agent", { instance: "second" }) === "agent:second");
-check(
-  "a new agent instance opens a distinct panel in the right zone",
-  secondAgent !== agentPanel &&
-    dock.panels.length === 3 &&
-    zoneOfPanel(secondAgent) === "right",
-);
-// --- Renaming a chat tab: in place and from the tab menu ----------------------------
-
-const tabText = (panel) => panel.view.tab.element.querySelector(".dv-default-tab-content")?.textContent;
-const renameField = (panel) => panel.view.tab.element.querySelector("input.ws-tab-rename");
-const doubleClickTab = (panel) =>
-  panel.view.tab.element.dispatchEvent(new window.MouseEvent("dblclick", { bubbles: true, cancelable: true }));
-const pressKey = (target, key) =>
-  target.dispatchEvent(new window.KeyboardEvent("keydown", { key, bubbles: true, cancelable: true }));
-
-doubleClickTab(secondAgent);
-let field = renameField(secondAgent);
-check(
-  "double-clicking a chat tab opens an inline field holding the tab's name",
-  field !== null && field.value === "New Agent",
-);
-field.value = "Docs chat";
-pressKey(field, "Enter");
-check(
-  "Enter commits the rename and the tab shows the new name",
-  tabText(secondAgent) === "Docs chat" && renameField(secondAgent) === null,
-);
-check("a rename leaves the panel's own title alone, so nothing persists", secondAgent.title === "New Agent");
-check("another chat's tab keeps its own name", tabText(agentPanel) === "New Agent");
-
-doubleClickTab(secondAgent);
-field = renameField(secondAgent);
-field.value = "Changed my mind";
-pressKey(field, "Escape");
-check("Escape cancels the rename", tabText(secondAgent) === "Docs chat" && renameField(secondAgent) === null);
-
-doubleClickTab(secondAgent);
-field = renameField(secondAgent);
-field.value = "   ";
-pressKey(field, "Enter");
-check("committing a blank name clears the rename", tabText(secondAgent) === "New Agent");
-
-doubleClickTab(secondAgent);
-field = renameField(secondAgent);
-field.value = "By blur";
-field.dispatchEvent(new window.FocusEvent("blur"));
-check("leaving the field commits the rename", tabText(secondAgent) === "By blur");
-
-doubleClickTab(treePanel);
-check(
-  "a tab whose panel type is not renamable has no rename field",
-  renameField(treePanel) === null && tabText(treePanel) === "Workshop",
-);
-
-// The tab menu's Rename Chat asks for the name in the form modal.
-await Commands.execute("workbench.action.chat.rename", { panelId: secondAgent.id });
-const renameDialog = window.document.querySelector(".ws-chat-rename");
-check(
-  "Rename Chat opens the form modal asking 'Enter new chat name'",
-  renameDialog !== null &&
-    renameDialog.textContent.includes("Enter new chat name") &&
-    renameDialog.classList.contains("modal-dialog--form"),
-);
-const renameInput = renameDialog?.querySelector("input");
-check(
-  "the field's placeholder is 'Chat name' and it starts on the current name",
-  renameInput?.placeholder === "Chat name" && renameInput?.value === "By blur",
-);
-renameInput.value = "From the menu";
-renameInput.dispatchEvent(new window.Event("input", { bubbles: true }));
-[...renameDialog.querySelectorAll("button")].find((button) => button.textContent === "Rename").click();
-check(
-  "the dialog's Rename applies the name and closes the dialog",
-  tabText(secondAgent) === "From the menu" && window.document.querySelector(".ws-chat-rename") === null,
-);
-
-// --- A middle click closes a chat tab; the tree's tab has nothing to close ------------
-
-const thirdAgent = openInZone("agent", { instance: "third" });
-await flush();
-treePanel.view.tab.element.dispatchEvent(
-  new window.MouseEvent("auxclick", { button: 1, bubbles: true, cancelable: true }),
-);
-await flush();
-check("a middle click on the non-closable tree tab closes nothing", dock.getPanel("tree") !== undefined);
-thirdAgent.view.tab.element.dispatchEvent(
-  new window.MouseEvent("auxclick", { button: 1, bubbles: true, cancelable: true }),
-);
-await flush();
-check("a middle click closes a chat tab", dock.getPanel("agent:third") === undefined);
-
-dock.removePanel(secondAgent);
-await flush();
-check("closing the second agent restores the original panel count", dock.panels.length === 2);
-
-// --- The tree requests paths, never file contents ---------------------------
-
-check("the tree fetched the granted roots on mount", treeCalls().includes("/workspace/tree"));
-check("no file contents were requested while browsing", fileCalls().length === 0);
-const projectRow = rowByText("project");
-check("the granted root renders as a directory row", !!projectRow);
-check("the root row starts collapsed", projectRow?.getAttribute("aria-expanded") === "false");
-
-// Expand the root: one request naming the directory path.
-projectRow.click();
-await flush();
-const expandUrl = `/workspace/tree?path=${encodeURIComponent(ROOT)}`;
-check("expanding a directory requests its path", calls.includes(expandUrl));
-check("expansion marks the row expanded", projectRow.getAttribute("aria-expanded") === "true");
-const childNames = [
-  ...window.document.querySelectorAll(".ws-workshop-tree__children .ws-workshop-tree__name"),
-].map((span) => span.textContent);
-check(
-  "children render folders before files in server order",
-  childNames.join(",") === "src,a.txt,b.txt",
-);
-check("still no file contents requested after expansion", fileCalls().length === 0);
-
-// --- Tree geometry: every row carries its depth, folders and files share one twistie box -------
-
-{
-  const depthOf = (row) => row?.style.getPropertyValue("--ws-tree-depth");
-  check("the root row is at depth 1", depthOf(rowByText("project")) === "1");
-  check("a child folder is at depth 2", depthOf(rowByText("src")) === "2");
-  check("a child file is at depth 2", depthOf(rowByText("a.txt")) === "2");
-  const fileRow = rowByText("a.txt");
-  const folderRow = rowByText("src");
-  check(
-    "a file row opens with an empty twistie box, so its name lines up with a sibling folder's",
-    fileRow?.firstElementChild?.classList.contains("ws-workshop-tree__twistie") === true &&
-      fileRow.firstElementChild.querySelector("svg") === null &&
-      folderRow?.firstElementChild?.classList.contains("ws-workshop-tree__twistie") === true &&
-      folderRow.firstElementChild.querySelector("svg") !== null,
-  );
-  const children = projectRow.closest("li").querySelector(".ws-workshop-tree__children");
-  check("a children list records its parent row's depth, which places its indent guide", depthOf(children) === "1");
-  check("no indent guide is lit before a row holds focus", children.classList.contains("ws-workshop-tree__children--focused") === false);
-  fileRow.dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  check(
-    "a focused row lights the guide of the list holding it",
-    children.classList.contains("ws-workshop-tree__children--focused"),
-  );
-  folderRow.dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  check(
-    "focus moving within the list keeps its guide lit",
-    children.classList.contains("ws-workshop-tree__children--focused"),
-  );
-  rowByText("project").dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  check(
-    "focus on a root row lights no child guide",
-    !children.classList.contains("ws-workshop-tree__children--focused"),
-  );
-  fileRow.dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  fileRow.dispatchEvent(new window.FocusEvent("focusout", { bubbles: true }));
-  check(
-    "leaving the tree puts the guide out",
-    !children.classList.contains("ws-workshop-tree__children--focused"),
-  );
-
-  // A folder holding an expanded subfolder: only the list that holds the focused
-  // row is lit, never the subfolder's own list. The stylesheet carries the lit
-  // color on the focused list's own guide rather than on an inherited custom
-  // property, so the class is the whole of what lights a guide (dock-css.mjs).
-  const lit = (list) => list.classList.contains("ws-workshop-tree__children--focused");
-  folderRow.click();
-  await flush();
-  const nested = folderRow.closest("li").querySelector(".ws-workshop-tree__children");
-  check(
-    "an expanded subfolder has a children list of its own, at its parent row's depth",
-    nested !== null && nested !== children && depthOf(nested) === "2",
-  );
-  fileRow.dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  check(
-    "focus on a file lights its own list and not the expanded subfolder's list",
-    lit(children) && !lit(nested),
-  );
-  rowByText("broken").dispatchEvent(new window.FocusEvent("focusin", { bubbles: true }));
-  check(
-    "focus on a row inside the subfolder lights the subfolder's list and not its parent's",
-    lit(nested) && !lit(children),
-  );
-  rowByText("broken").dispatchEvent(new window.FocusEvent("focusout", { bubbles: true }));
-  folderRow.click();
-  await flush();
-  check("collapsing the subfolder again leaves it collapsed", folderRow.getAttribute("aria-expanded") === "false");
-
-  // A file dragged out of the tree carries a pill with its name, which leaves the page once the drag starts.
-  const sets = [];
-  let image = null;
-  const dragEvent = new window.Event("dragstart", { bubbles: true, cancelable: true });
-  Object.defineProperty(dragEvent, "dataTransfer", {
-    value: {
-      setData: (type, value) => sets.push([type, value]),
-      setDragImage: (element) => {
-        image = { className: element.className, text: element.textContent, attached: element.isConnected };
-      },
-    },
-  });
-  fileRow.dispatchEvent(dragEvent);
-  check(
-    "a dragged file sets the workshop path payload",
-    sets.length === 1 && sets[0][0] === "application/x-workshop-path" && sets[0][1] === `${ROOT}\\a.txt`,
-  );
-  check(
-    "a dragged file carries a pill with its name, attached while the browser snapshots it",
-    image?.className === "ws-workshop-tree__drag-pill" && image.text === "a.txt" && image.attached === true,
-  );
-  await new Promise((resolve) => setTimeout(resolve, 5));
-  check(
-    "the pill leaves the page after the drag starts",
-    window.document.querySelector(".ws-workshop-tree__drag-pill") === null,
-  );
-}
-
-// --- File activation opens an editor in the main zone -----------------------
-
-rowByText("a.txt").click();
-const editorA = dock.getPanel(panelIdFor("editor", { path: `${ROOT}\\a.txt` }));
-check("activating a file opens an editor panel", !!editorA);
-check("the editor opens in the main zone", editorA && zoneOfPanel(editorA) === "main");
-check("a third zone group appears for main", dock.groups.length === 3);
-await flush();
-check(
-  "opening a file requests its contents through the workspace API",
-  fileCalls().includes(`/workspace/file?path=${encodeURIComponent(`${ROOT}\\a.txt`)}`),
-);
-check(
-  "the editor panel mounts its CodeMirror surface",
-  !!editorA && !!editorA.api && !!window.document.querySelector(".ws-editor-panel .cm-editor"),
-);
-
-// A second editor lands within the same main group (affinity, not a new zone).
-const editorB = openInZone("editor", { path: `${ROOT}\\b.txt` });
-check(
-  "a second editor joins the existing main group",
-  editorB.group.id === editorA.group.id && dock.groups.length === 3,
-);
-check(
-  "the main group is neither the agent nor the tree group",
-  editorB.group.id !== agentPanel.group.id && editorB.group.id !== treePanel.group.id,
-);
-
-// --- Overrides: a moved panel reopens in its chosen zone --------------------
-
-const bId = panelIdFor("editor", { path: `${ROOT}\\b.txt` });
-setZoneOverride(bId, "right");
-dock.removePanel(editorB);
-const editorB2 = openInZone("editor", { path: `${ROOT}\\b.txt` });
-check("an overridden panel reopens in the override zone", zoneOfPanel(editorB2) === "right");
-check(
-  "the override lands the panel within the right zone's group",
-  editorB2.group.id === agentPanel.group.id,
-);
-// Moving back to the affinity zone deletes the override.
-setZoneOverride(bId, "main");
-dock.removePanel(editorB2);
-const editorB3 = openInZone("editor", { path: `${ROOT}\\b.txt` });
-check(
-  "resetting to the affinity zone deletes the override",
-  zoneOfPanel(editorB3) === "main" && editorB3.group.id === editorA.group.id,
-);
-
-// --- The Workshop's active group: focusing a side zone never dims the editor tabs --------
-
-{
-  const mainGroup = editorA.group;
-  const stamp = (group) => group.element.dataset.wsActiveGroup;
-  check(
-    "the main group is the Workshop's active group while the editors have focus",
-    stamp(mainGroup) === "true" && stamp(treePanel.group) === undefined && stamp(agentPanel.group) === undefined,
-  );
-  treePanel.api.setActive();
-  await flush();
-  check("focusing the tree makes the tree's group Dockview's active group", dock.activeGroup?.id === treePanel.group.id);
-  check(
-    "focusing the tree leaves the main group as the Workshop's active group",
-    stamp(mainGroup) === "true" && stamp(treePanel.group) === undefined,
-  );
-  agentPanel.api.setActive();
-  await flush();
-  check("focusing the agent makes the agent's group Dockview's active group", dock.activeGroup?.id === agentPanel.group.id);
-  check(
-    "focusing the agent leaves the main group as the Workshop's active group",
-    stamp(mainGroup) === "true" && stamp(agentPanel.group) === undefined,
-  );
-
-  // A second editor group (a split) takes the stamp once it is activated, and gives it back.
-  const split = dock.addPanel({
-    id: "editor:split-probe",
-    component: "editor",
-    title: "split.txt",
-    params: { path: `${ROOT}\\a.txt` },
-    position: { referenceGroup: mainGroup.id, direction: "right" },
-  });
-  await flush();
-  check("a split editor group is an editor group, stamped as the main zone", split.group.element.dataset.wsZone === "main");
-  check("a split group is a different group from the first", split.group.id !== mainGroup.id);
-  check(
-    "activating the split takes the active-group stamp from the first group",
-    stamp(split.group) === "true" && stamp(mainGroup) === undefined,
-  );
-  editorA.api.setActive();
-  await flush();
-  check(
-    "activating the first group gives it back the stamp",
-    stamp(mainGroup) === "true" && stamp(split.group) === undefined,
-  );
-  treePanel.api.setActive();
-  await flush();
-  check(
-    "focusing the tree with two editor groups keeps the stamp on the last active editor group",
-    stamp(mainGroup) === "true" && stamp(split.group) === undefined && stamp(treePanel.group) === undefined,
-  );
-  dock.removePanel(split);
-  await flush();
-  check(
-    "closing the split leaves one stamped editor group",
-    dock.groups.length === 3 && stamp(mainGroup) === "true",
-  );
-  editorA.api.setActive();
-  await flush();
-}
-
-// --- An empty editor group is marked, so the stylesheet can hide its tab strip ----------
-
-check("a group holding editors is not marked empty", editorA.group.element.dataset.wsEmpty === undefined);
-
-// --- A zone group is rebuilt empty after its last panel closes ---------------
-
-/** The dock's groups holding no panel. */
-const emptyGroups = () => dock.groups.filter((group) => group.panels.length === 0);
-
-const mainGroupId = editorA.group.id;
-dock.removePanel(editorA);
-dock.removePanel(editorB3);
-await flush();
-check("closing every main panel retires the old group", dock.getGroup(mainGroupId) === undefined);
-check(
-  "the main zone is rebuilt as an empty group instead of dying",
-  dock.groups.length === 3 && emptyGroups().length === 1,
-);
-const emptyMain = emptyGroups()[0];
-check(
-  "the empty group is neither the agent nor the tree group",
-  !!emptyMain && emptyMain.id !== agentPanel.group.id && emptyMain.id !== treePanel.group.id,
-);
-check("the rebuilt empty main group is marked empty", emptyMain?.element.dataset.wsEmpty === "true");
-const editorC = openInZone("editor", { path: `${ROOT}\\c.txt` });
-check("the next main-zone open keeps the group count", dock.groups.length === 3);
-await flush();
-check("filling the empty main group clears its empty mark", editorC.group.element.dataset.wsEmpty === undefined);
-check(
-  "the reopened editor fills the empty main group",
-  editorC.group.id === emptyMain?.id && zoneOfPanel(editorC) === "main" && emptyGroups().length === 0,
-);
-
-// --- Tree reopen: expansion state survives for the session ------------------
-
-const callsBeforeReopen = treeCalls().length;
-dock.removePanel(treePanel);
-await flush();
-check(
-  "closing the tree leaves the left zone as an empty group",
-  dock.groups.length === 3 && emptyGroups().length === 1,
-);
-const emptyLeft = emptyGroups()[0];
-check("the rebuilt empty left group is marked empty too", emptyLeft?.element.dataset.wsEmpty === "true");
-const treePanel2 = openInZone("tree", {});
-await flush();
-check("the tree reopens in the left zone", zoneOfPanel(treePanel2) === "left");
-check(
-  "the reopened tree fills the empty left group",
-  dock.groups.length === 3 && treePanel2.group.id === emptyLeft?.id && emptyGroups().length === 0,
-);
-check(
-  "a reopened tree renders from the session cache without refetching",
-  treeCalls().length === callsBeforeReopen,
-);
-const reopenedProjectRow = rowByText("project");
-check(
-  "the reopened tree keeps the root expanded",
-  reopenedProjectRow?.getAttribute("aria-expanded") === "true",
-);
-const reopenedChildList = reopenedProjectRow?.closest("li")?.querySelector(".ws-workshop-tree__children");
-check(
-  "the reopened tree shows the cached children",
-  !!reopenedChildList && !reopenedChildList.hidden && !!rowByText("a.txt"),
-);
-
-// --- A failed expansion surfaces a visible error row ------------------------
-
-const srcRow = rowByText("src");
-check("the nested directory renders after reopen", !!srcRow);
-srcRow.click();
-await flush();
-const brokenRow = rowByText("broken");
-check("a directory whose listing will fail renders as a row", !!brokenRow);
-brokenRow.click();
-await flush();
-const brokenChildren = brokenRow?.closest("li")?.querySelector(".ws-workshop-tree__children");
-const errorRow = brokenChildren?.querySelector(".ws-workshop-tree__error");
-check("a failed expansion renders an error row", !!errorRow);
-check(
-  "the error row is visible rather than hidden with the collapsed list",
-  !!brokenChildren && !brokenChildren.hidden,
-);
-check("the error row is announced as an alert", errorRow?.getAttribute("role") === "alert");
-check(
-  "a failed expansion leaves the row collapsed",
-  brokenRow?.getAttribute("aria-expanded") === "false",
-);
-
-// --- Registry edge: unknown component names render a placeholder ------------
-
-const unknown = createPanelComponent({ id: "x", name: "nope" });
-check(
-  "an unknown component name renders a labelled placeholder",
-  unknown.element.textContent === "Unknown panel: nope",
-);
-check("isPanelType narrows registered names", isPanelType("editor") && !isPanelType("nope"));
-
-// --- Closing the last chat tab hides the right zone ---------------------------------
-
-check("the right zone is showing before its last chat closes", groupOfZone("right")?.api.isVisible === true);
-await Commands.execute("workbench.action.closeActiveEditor", { panelId: "agent" });
-await flush();
-check("the last chat tab is gone", dock.getPanel("agent") === undefined);
-check(
-  "closing the last chat tab hides the right zone, which stays alive and empty",
-  groupOfZone("right") !== undefined &&
-    groupOfZone("right").panels.length === 0 &&
-    groupOfZone("right").api.isVisible === false,
-);
-check(
-  "the hidden right zone shows again when a chat opens",
-  openInZone("agent", { instance: "again" }).group.api.isVisible === true,
-);
-
-if (failures.length > 0) {
-  console.error(`workshop-zones: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workshop-zones: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/workspace-drops.mjs b/crates/workshop/ui/test/workspace-drops.mjs
deleted file mode 100644
index 0d4147bfe..000000000
--- a/crates/workshop/ui/test/workspace-drops.mjs
+++ /dev/null
@@ -1,320 +0,0 @@
-// Unit test for the native workspace drop handler (src/parts/workspace/workspace-drops.ts).
-// Bundles the TS module with esbuild, imports it via a data URL, and drives
-// it against jsdom. Covers: browser mode never installs the grant listener;
-// in desktop mode a synthesized runvil:file-drop event POSTs one grant
-// per path with a paths-only JSON body; malformed details are ignored; a
-// failed grant paints the status bar and does not stop the rest; the
-// default action of file drags is suppressed (never navigating away) while
-// in-page drags keep their default; and a file drop posts its File objects
-// over the WebView2 bridge when one is present.
-// Run: node test/workspace-drops.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  entryPoints: [path.join(uiDir, "..", "src", "parts", "workspace", "workspace-drops.ts")],
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const code = bundle.outputFiles[0].text;
-const { setupWorkspaceDrops } = await import(
-  `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets the async grant chain (fetch -> json -> next path) run to completion.
-async function flush() {
-  for (let i = 0; i < 5; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// Each scenario gets a fresh jsdom and fetch mock. `responder` maps a
-// granted path to its fake Response; default is a plain 200.
-function scenario({ desktop, responder }) {
-  const dom = new JSDOM("", { url: "http://127.0.0.1:7910/" });
-  const { window } = dom;
-  if (desktop) {
-    window.__TAURI_INTERNALS__ = {};
-  }
-  const calls = [];
-  const local = [];
-  globalThis.window = window;
-  globalThis.CustomEvent = window.CustomEvent;
-  globalThis.Element = window.Element;
-  globalThis.fetch = async (url, init) => {
-    calls.push({ url, init, body: JSON.parse(init.body) });
-    const respond =
-      responder ??
-      ((path) => ({ ok: true, status: 200, json: async () => ({ granted: path }) }));
-    return respond(JSON.parse(init.body).path);
-  };
-  const statusBar = {
-    showLocal: (label, severity) => local.push({ label, severity }),
-  };
-  setupWorkspaceDrops(statusBar);
-  return { window, calls, local };
-}
-
-// --- Browser mode: no flag, no listener, no grants --------------------------
-
-{
-  const { window, calls } = scenario({ desktop: false });
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", {
-      detail: { paths: ["C:\\Users\\Vinnie\\project"] },
-    }),
-  );
-  await flush();
-  check("browser mode never grants a dropped path", calls.length === 0);
-}
-
-// --- Desktop mode: a synthesized drop grants each path ----------------------
-
-{
-  const { window, calls, local } = scenario({ desktop: true });
-  let changed = 0;
-  window.addEventListener("runvil:workspace-changed", () => {
-    changed += 1;
-  });
-  const paths = [
-    "C:\\Users\\Vinnie\\My Documents\\project",
-    "C:\\Users\\Vinnie\\café 中文.txt",
-  ];
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { paths } }),
-  );
-  await flush();
-  check("one grant request per dropped path", calls.length === 2);
-  check(
-    "every grant posts to the workspace grant route",
-    calls.every((call) => call.url === "/workspace/grant" && call.init.method === "POST"),
-  );
-  check(
-    "grant bodies hold the paths and nothing else",
-    calls.every(
-      (call, index) =>
-        Object.keys(call.body).join(",") === "path" && call.body.path === paths[index],
-    ),
-  );
-  check(
-    "grant bodies are JSON with a JSON content type",
-    calls.every((call) => call.init.headers["Content-Type"] === "application/json"),
-  );
-  check(
-    "every successful grant confirms on the status bar as info",
-    local.length === 2 &&
-      local.every(
-        (entry, index) =>
-          entry.severity === "info" &&
-          entry.label.includes(paths[index]) &&
-          entry.label.includes("Added"),
-      ),
-  );
-  check("granting announces one workspace change", changed === 1);
-}
-
-// --- Malformed events: nothing is granted -----------------------------------
-
-{
-  const { window, calls } = scenario({ desktop: true });
-  window.dispatchEvent(new window.Event("runvil:file-drop"));
-  window.dispatchEvent(new window.CustomEvent("runvil:file-drop", { detail: null }));
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { paths: "C:\\x" } }),
-  );
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { paths: ["C:\\x", 42] } }),
-  );
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { paths: [] } }),
-  );
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { other: ["C:\\x"] } }),
-  );
-  await flush();
-  check("malformed or empty drop details never grant", calls.length === 0);
-}
-
-// --- File-drag defaults are suppressed; in-page drags keep theirs ------------
-
-// jsdom has no DragEvent; a plain Event with a scripted dataTransfer is
-// enough for the handler's `types` probe and defaultPrevented flag.
-function syntheticDrag(window, type, types) {
-  const event = new window.Event(type, { cancelable: true, bubbles: true });
-  Object.defineProperty(event, "dataTransfer", { value: { types } });
-  return event;
-}
-
-for (const desktop of [false, true]) {
-  const { window } = scenario({ desktop });
-  const fileOver = syntheticDrag(window, "dragover", ["Files"]);
-  window.dispatchEvent(fileOver);
-  check(
-    `file dragover default is prevented (desktop=${desktop})`,
-    fileOver.defaultPrevented,
-  );
-  const fileDrop = syntheticDrag(window, "drop", ["Files"]);
-  window.dispatchEvent(fileDrop);
-  check(`file drop never navigates the page (desktop=${desktop})`, fileDrop.defaultPrevented);
-  const tabDrag = syntheticDrag(window, "dragover", ["text/plain", "dockview/tab"]);
-  window.dispatchEvent(tabDrag);
-  check(
-    `in-page drags keep their default action (desktop=${desktop})`,
-    !tabDrag.defaultPrevented,
-  );
-  const bareDrop = syntheticDrag(window, "drop", undefined);
-  window.dispatchEvent(bareDrop);
-  check(
-    `a drop without a dataTransfer is left alone (desktop=${desktop})`,
-    !bareDrop.defaultPrevented,
-  );
-}
-
-// --- The WebView2 bridge receives a drop's File objects ----------------------
-
-// A drop holding files posts them to the desktop app under the workspace-drop
-// message; without the bridge (plain browser) the same drop is only
-// default-suppressed. jsdom lacks DragEvent and File, so plain markers
-// stand in for the File objects - the module hands them over untouched.
-{
-  const { window } = scenario({ desktop: true });
-  const posted = [];
-  window.chrome = {
-    webview: {
-      postMessageWithAdditionalObjects: (message, objects) =>
-        posted.push({ message, objects }),
-    },
-  };
-  const fileA = { name: "a.txt" };
-  const fileB = { name: "b" };
-  const drop = syntheticDrag(window, "drop", ["Files"]);
-  // Array-like is all Array.from needs from the FileList stand-in.
-  Object.defineProperty(drop.dataTransfer, "files", {
-    value: { length: 2, 0: fileA, 1: fileB },
-  });
-  window.dispatchEvent(drop);
-  check("a file drop posts one workspace-drop message", posted.length === 1);
-  check(
-    "the message includes the sentinel and every dropped File",
-    posted.length === 1 &&
-      posted[0].message === "workspace-drop" &&
-      posted[0].objects.length === 2 &&
-      posted[0].objects[0] === fileA &&
-      posted[0].objects[1] === fileB,
-  );
-
-  const emptyDrop = syntheticDrag(window, "drop", ["Files"]);
-  Object.defineProperty(emptyDrop.dataTransfer, "files", { value: { length: 0 } });
-  window.dispatchEvent(emptyDrop);
-  check("a file drag with no files posts nothing", posted.length === 1);
-}
-
-{
-  const { window } = scenario({ desktop: true });
-  const drop = syntheticDrag(window, "drop", ["Files"]);
-  Object.defineProperty(drop.dataTransfer, "files", { value: { length: 1, 0: { name: "x" } } });
-  window.dispatchEvent(drop);
-  check("without the bridge a file drop only suppresses the default", drop.defaultPrevented);
-}
-
-// --- A failed grant paints the status bar and the rest still run ------------
-
-{
-  const { window, calls, local } = scenario({
-    desktop: true,
-    responder: (path) =>
-      path.endsWith("blocked")
-        ? {
-            ok: false,
-            status: 403,
-            json: async () => ({
-              error: { message: "path is outside every granted root", code: "outside_grants" },
-            }),
-          }
-        : { ok: true, status: 200, json: async () => ({ granted: path }) },
-  });
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", {
-      detail: { paths: ["C:\\blocked", "C:\\allowed"] },
-    }),
-  );
-  await flush();
-  check("a failed grant does not stop the remaining paths", calls.length === 2);
-  const errors = local.filter((entry) => entry.severity === "error");
-  check("a failed grant paints one local error", errors.length === 1);
-  check(
-    "the local error names the path and the server message",
-    errors.length === 1 &&
-      errors[0].label.includes("C:\\blocked") &&
-      errors[0].label.includes("path is outside every granted root"),
-  );
-  check(
-    "the surviving grant still confirms as info",
-    local.some((entry) => entry.severity === "info" && entry.label.includes("C:\\allowed")),
-  );
-}
-
-// --- The drop-target dispatch: workshop:file-drop after granting -------------
-
-{
-  const { window, calls } = scenario({ desktop: true });
-  const target = window.document.createElement("div");
-  target.setAttribute("data-ws-file-drop", "");
-  const child = window.document.createElement("div");
-  target.appendChild(child);
-  window.document.body.appendChild(target);
-  const received = [];
-  target.addEventListener("workshop:file-drop", (event) => received.push(event.detail.paths));
-
-  // The HTML5 drop lands on the target's child; the native event then
-  // answers with the real paths.
-  const drop = syntheticDrag(window, "drop", ["Files"]);
-  child.dispatchEvent(drop);
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", {
-      detail: { paths: ["C:\\a.md", "C:\\b.txt"] },
-    }),
-  );
-  await flush();
-  check("a drop on a marked target still grants every path", calls.length === 2);
-  check(
-    "the target receives workshop:file-drop after the grants",
-    received.length === 1 && received[0].join("|") === "C:\\a.md|C:\\b.txt",
-  );
-}
-
-{
-  const { window, calls } = scenario({ desktop: true });
-  const dispatched = [];
-  window.addEventListener("workshop:file-drop", () => dispatched.push(true));
-  // A drop on an unmarked element grants exactly as today, with no
-  // workshop:file-drop dispatch.
-  const drop = syntheticDrag(window, "drop", ["Files"]);
-  window.document.body.dispatchEvent(drop);
-  window.dispatchEvent(
-    new window.CustomEvent("runvil:file-drop", { detail: { paths: ["C:\\c.md"] } }),
-  );
-  await flush();
-  check("a drop on a non-target grants its paths", calls.length === 1);
-  check("a drop on a non-target dispatches nothing", dispatched.length === 0);
-}
-
-if (failures.length > 0) {
-  console.error(`workspace-drops: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workspace-drops: all assertions passed");
diff --git a/crates/workshop/ui/test/workspace-files.mjs b/crates/workshop/ui/test/workspace-files.mjs
deleted file mode 100644
index 899a55ae1..000000000
--- a/crates/workshop/ui/test/workspace-files.mjs
+++ /dev/null
@@ -1,620 +0,0 @@
-// Unit test for the workspace-file actions
-// (src/parts/workspace-document/workspace-document.contribution.ts over
-// src/services/workspace-file-client.ts). Bundles the contribution with
-// esbuild - "@tauri-apps/plugin-dialog" and "@tauri-apps/api/event"
-// aliased to the recording stubs in test/helpers - and drives the Open
-// Workspace from File..., Save Workspace As..., and Duplicate
-// Workspace... commands through the shared registries against jsdom
-// with a scripted fetch. Covers: the catalog wiring (the rows' ids and
-// labels: File > 2_open and 3_workspace, in the palette, no
-// always-false precondition, Duplicate with its ellipsis); a
-// canceled picker performing no fetch; a successful open posting the
-// picked path to /workspace/file/open, firing the
-// runvil:workspace-changed invalidation, emitting the
-// runvil:workspace-opened Tauri event with the path, and recording
-// the path in the recent-files store, with nothing painted on the status
-// bar; a run with a path argument (Open Recent, Ctrl+P; TWF-003) posting
-// that path without ever reaching the picker, a non-string or absent
-// argument still reaching it; a desktop app that rejects the emit leaving the open committed (the
-// recent recorded, the invalidation fired, a console.warn and no
-// unhandled rejection); a server refusal painting the error on the
-// status bar while emitting nothing, recording nothing, and
-// invalidating nothing; Save As and Duplicate seeding the save picker
-// with "<current name>.rvwork", appending .rvwork to a bare name exactly
-// once (never doubling an existing extension, any case), posting to
-// save-as or duplicate, then invalidating, emitting, and recording the
-// new path, with a cancel posting nothing and a refusal painting the
-// error; and the client's typed parse of the wire shape (snake_case
-// window_state) with a malformed answer refused. The UI state the switch
-// moves is covered by test/workspace-switch.mjs; here a
-// minimal dock is bound through initZones so the actions' state apply and
-// snapshot have something to run against, and the UI-state adapter stays
-// the empty default.
-// Run: node --test test/workspace-files.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/workspace-document/workspace-document.contribution.ts";
-      // The contribution reads the closed-editor stack through its token; the
-      // implementation's module scope self-registers the empty default, so
-      // importing it here keeps the switch's state snapshot working without a
-      // live adapter.
-      import "./src/parts/editor/closed-editors.ts";
-      export { register } from "./src/parts/workspace-document/index.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { Menus } from "@workshop/platform/menu-registry";
-      export { RECENT_FILES_STORE, RecentFilesStore } from "./src/services/recent-files-store.ts";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { currentWorkspaceFile, putWindowState } from "./src/services/workspace-file-client.ts";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-      export { initZones } from "./src/parts/layout/zones.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-    "@tauri-apps/api/event": path.join(uiDir, "helpers", "tauri-event-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-// Events the bundle dispatches on the jsdom window must be jsdom-realm
-// instances: jsdom's dispatchEvent rejects Node's Event.
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-
-// The contribution registers at module scope; a malformed descriptor
-// reports through console.error, so spy on it across the bundle import.
-const consoleErrors = [];
-const realConsoleError = console.error;
-console.error = (...args) => {
-  consoleErrors.push(args.join(" "));
-};
-
-const bundlePath = path.join(os.tmpdir(), "runvil-workspace-files-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  register,
-  Commands,
-  Menus,
-  RECENT_FILES_STORE,
-  RecentFilesStore,
-  registerService,
-  currentWorkspaceFile,
-  putWindowState,
-  STATUS_BAR,
-  initZones,
-} = await import(pathToFileURL(bundlePath).href);
-console.error = realConsoleError;
-
-// A dock good enough for the zone registry: the default-layout fallback
-// after an Open clears it and opens the two anchors; a Save As snapshots
-// it. Nothing here asserts on the layout.
-{
-  const panels = new Map();
-  const dock = {
-    groups: [],
-    onDidMovePanel: () => ({ dispose() {} }),
-    onDidLayoutChange: () => ({ dispose() {} }),
-    onDidRemovePanel: () => ({ dispose() {} }),
-    onWillMutateLayout: () => ({ dispose() {} }),
-    onDidMutateLayout: () => ({ dispose() {} }),
-    getPanel: (id) => panels.get(id),
-    getGroup: (id) => dock.groups.find((group) => group.id === id),
-    addPanel: (options) => {
-      const group = { id: `g-${options.id}`, api: { setSize() {}, isVisible: true, setVisible() {} } };
-      dock.groups.push(group);
-      const panel = { id: options.id, params: options.params, group, api: { setActive() {} } };
-      panels.set(options.id, panel);
-      return panel;
-    },
-    clear: () => {
-      panels.clear();
-      dock.groups.length = 0;
-    },
-    fromJSON: () => {},
-    toJSON: () => ({ grid: { root: { type: "leaf", data: { views: [], id: "1" }, size: 1 }, width: 1, height: 1, orientation: "HORIZONTAL" }, panels: {} }),
-  };
-  initZones(dock);
-}
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets an async action chain (dialog -> fetch -> json -> emit) settle.
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// --- Shared fakes ------------------------------------------------------------
-
-const statusMessages = [];
-registerService(STATUS_BAR, () => ({
-  showLocal: (label, severity) => statusMessages.push({ label, severity }),
-}));
-const recentStore = new RecentFilesStore(null);
-registerService(RECENT_FILES_STORE, () => recentStore);
-
-// Scripted server: every fetch is logged. A case that makes one kind of
-// request sets nextAnswer, repeated for every fetch; a case that chains
-// requests (Save As and Duplicate GET current before they POST) queues
-// them in answerQueue, consumed in order before nextAnswer is consulted.
-const fetches = [];
-let nextAnswer = null;
-const answerQueue = [];
-globalThis.fetch = async (url, init) => {
-  fetches.push({ url, method: init?.method ?? "GET", body: init?.body === undefined ? null : JSON.parse(init.body) });
-  const answer = answerQueue.length > 0 ? answerQueue.shift() : nextAnswer;
-  if (answer === null) {
-    throw new Error(`unexpected fetch in the workspace-files test: ${url}`);
-  }
-  return { ok: answer.status < 400, status: answer.status, json: async () => answer.body };
-};
-
-/** The POST fetches made since the given count; the switch routes are all POSTs. */
-function postsSince(count) {
-  return fetches.slice(count).filter((f) => f.method === "POST");
-}
-
-let workspaceChanges = 0;
-window.addEventListener("runvil:workspace-changed", () => {
-  workspaceChanges += 1;
-});
-
-window.__TAURI_INTERNALS__ = {};
-window.__TAURI_DIALOG__ = { calls: [], answer: null };
-window.__TAURI_EVENTS__ = { emitted: [], fail: false };
-
-const OPENED = {
-  path: "C:\\work\\Alpha.rvwork",
-  name: "Alpha",
-  grants: [{ path: "C:\\work\\src", exists: true }],
-  window_state: { width: 1280, height: 800, x: 10, y: 20, maximized: false },
-};
-
-// --- Catalog wiring ----------------------------------------------------------
-
-check("the contribution registers without a malformed descriptor", consoleErrors.length === 0);
-
-{
-  const command = Commands.lookup("workbench.action.openWorkspace");
-  check("Open Workspace keeps the stub row's command id", command !== undefined);
-  check("Open Workspace keeps the stub row's label", command?.title === "Open Workspace from File...");
-  check("Open Workspace is not disabled outright", command?.precondition !== "false");
-  const row = Menus.getMenuItems("menubar/file").find((r) => r.command === "workbench.action.openWorkspace");
-  check("Open Workspace sits in File > 2_open at the stub's position", row?.group === "2_open" && row?.order === 3);
-  check(
-    "Open Workspace reaches the command palette",
-    Menus.getMenuItems("commandPalette").some((r) => r.command === "workbench.action.openWorkspace"),
-  );
-  const activation = register();
-  check("the feature barrel's register() answers a disposable", typeof activation?.dispose === "function");
-}
-
-{
-  const fileRows = Menus.getMenuItems("menubar/file");
-  const saveAs = Commands.lookup("workbench.action.saveWorkspaceAs");
-  check("Save Workspace As keeps the stub row's command id", saveAs !== undefined);
-  check("Save Workspace As keeps the stub row's label", saveAs?.title === "Save Workspace As...");
-  check("Save Workspace As is not disabled outright", saveAs?.precondition !== "false");
-  const saveAsRow = fileRows.find((r) => r.command === "workbench.action.saveWorkspaceAs");
-  check("Save Workspace As sits in File > 3_workspace at the stub's position", saveAsRow?.group === "3_workspace" && saveAsRow?.order === 2);
-
-  const duplicate = Commands.lookup("workbench.action.duplicateWorkspace");
-  check("Duplicate Workspace keeps the stub row's command id", duplicate !== undefined);
-  check("Duplicate Workspace goes without an ellipsis, as Cursor labels it", duplicate?.title === "Duplicate Workspace");
-  check("Duplicate Workspace is not disabled outright", duplicate?.precondition !== "false");
-  const duplicateRow = fileRows.find((r) => r.command === "workbench.action.duplicateWorkspace");
-  check("Duplicate Workspace sits in File > 3_workspace at the stub's position", duplicateRow?.group === "3_workspace" && duplicateRow?.order === 3);
-
-  const palette = Menus.getMenuItems("commandPalette").map((r) => r.command);
-  check("Save Workspace As reaches the command palette", palette.includes("workbench.action.saveWorkspaceAs"));
-  check("Duplicate Workspace reaches the command palette", palette.includes("workbench.action.duplicateWorkspace"));
-}
-
-// --- A canceled picker performs no fetch --------------------------------------
-
-{
-  window.__TAURI_DIALOG__.answer = null;
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  const pick = window.__TAURI_DIALOG__.calls.at(-1);
-  check("Open Workspace opens the native file picker", pick?.kind === "open" && pick?.directory !== true);
-  check(
-    "the picker filters to .rvwork files",
-    Array.isArray(pick?.filters) &&
-      pick.filters.some((f) => f.name === "Runvil Workspace" && f.extensions.join(",") === "rvwork"),
-  );
-  check("a canceled picker performs no fetch", fetches.length === 0);
-  check("a canceled picker emits nothing", window.__TAURI_EVENTS__.emitted.length === 0);
-  check("a canceled picker records nothing", recentStore.list.length === 0);
-}
-
-// --- Success: post, invalidate, emit, record ----------------------------------
-
-{
-  window.__TAURI_DIALOG__.answer = OPENED.path;
-  nextAnswer = { status: 200, body: OPENED };
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  const post = fetches.at(-1);
-  check("a picked file is posted to /workspace/file/open", post?.url === "/workspace/file/open" && post?.method === "POST");
-  check("the post sends the picked path", post?.body?.path === OPENED.path);
-  check("a successful open fires one workspace-changed invalidation", workspaceChanges === 1);
-  const emitted = window.__TAURI_EVENTS__.emitted;
-  check(
-    "a successful open emits runvil:workspace-opened with the path",
-    emitted.length === 1 &&
-      emitted[0].event === "runvil:workspace-opened" &&
-      emitted[0].payload?.path === OPENED.path,
-  );
-  check("a successful open records the path as recent", recentStore.list[0] === OPENED.path);
-  check("a successful open paints nothing on the status bar", statusMessages.length === 0);
-}
-
-// --- A path argument skips the picker (Open Recent, Ctrl+P) ------------------
-
-{
-  const picksBefore = window.__TAURI_DIALOG__.calls.length;
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const statusBefore = statusMessages.length;
-  const RECENT = "C:\\work\\Recent.rvwork";
-  // A picker answer that must never be posted: a run with a path argument
-  // never reaches the dialog.
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Wrong.rvwork";
-  nextAnswer = { status: 200, body: { ...OPENED, path: RECENT, name: "Recent" } };
-  await Commands.execute("workbench.action.openWorkspace", RECENT);
-  await flush();
-  check("a run with a path argument never opens the picker", window.__TAURI_DIALOG__.calls.length === picksBefore);
-  const post = fetches.at(-1);
-  check(
-    "a run with a path argument posts that path to /workspace/file/open",
-    post?.url === "/workspace/file/open" && post?.method === "POST" && post?.body?.path === RECENT,
-  );
-  check("a run with a path argument fires one workspace-changed invalidation", workspaceChanges === changesBefore + 1);
-  check(
-    "a run with a path argument emits runvil:workspace-opened with that path",
-    window.__TAURI_EVENTS__.emitted.length === emittedBefore + 1 && window.__TAURI_EVENTS__.emitted.at(-1).payload?.path === RECENT,
-  );
-  check("a run with a path argument records that path as recent", recentStore.list[0] === RECENT);
-  check("a run with a path argument paints nothing on the status bar", statusMessages.length === statusBefore);
-
-  // A non-string argument is not a path: the picker flow runs as before.
-  const fetchesBefore = fetches.length;
-  window.__TAURI_DIALOG__.answer = null;
-  await Commands.execute("workbench.action.openWorkspace", 42);
-  await flush();
-  check("a run with a non-string argument still reaches the picker", window.__TAURI_DIALOG__.calls.length === picksBefore + 1);
-  check("a canceled picker after a non-string argument posts nothing", postsSince(fetchesBefore).length === 0);
-
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check("a run without an argument still reaches the picker", window.__TAURI_DIALOG__.calls.length === picksBefore + 2);
-}
-
-// --- A path argument whose open is refused paints the error -----------------------
-
-{
-  const picksBefore = window.__TAURI_DIALOG__.calls.length;
-  const changesBefore = workspaceChanges;
-  const recentBefore = recentStore.list.length;
-  const GONE = "C:\\work\\Gone.rvwork";
-  nextAnswer = { status: 404, body: { error: { code: "not_found", message: "workspace file not found: C:\\work\\Gone.rvwork" } } };
-  await Commands.execute("workbench.action.openWorkspace", GONE);
-  await flush();
-  check("a refused open by path never opens the picker", window.__TAURI_DIALOG__.calls.length === picksBefore);
-  check(
-    "a refused open by path paints the server's message naming the path",
-    statusMessages.at(-1)?.severity === "error" && statusMessages.at(-1)?.label.includes("Gone.rvwork"),
-  );
-  check("a refused open by path records nothing", recentStore.list.length === recentBefore);
-  check("a refused open by path invalidates nothing", workspaceChanges === changesBefore);
-}
-
-// --- A rejected emit never undoes the open ------------------------------------
-
-{
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const statusBefore = statusMessages.length;
-  const warnings = [];
-  const realConsoleWarn = console.warn;
-  console.warn = (...args) => {
-    warnings.push(args.join(" "));
-  };
-  const rejections = [];
-  const onRejection = (reason) => rejections.push(reason);
-  process.on("unhandledRejection", onRejection);
-  const GAMMA = "C:\\work\\Gamma.rvwork";
-  window.__TAURI_DIALOG__.answer = GAMMA;
-  window.__TAURI_EVENTS__.fail = true;
-  nextAnswer = { status: 200, body: { ...OPENED, path: GAMMA, name: "Gamma" } };
-  try {
-    await Commands.execute("workbench.action.openWorkspace");
-    await flush();
-  } finally {
-    window.__TAURI_EVENTS__.fail = false;
-    console.warn = realConsoleWarn;
-    process.off("unhandledRejection", onRejection);
-  }
-  check("a rejected emit still posts the open", fetches.at(-1)?.body?.path === GAMMA);
-  check("a rejected emit still fires the workspace-changed invalidation", workspaceChanges === changesBefore + 1);
-  check("a rejected emit still records the path as recent", recentStore.list[0] === GAMMA);
-  check("a rejected emit records no event", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-  check(
-    "a rejected emit is logged as a warning naming the event",
-    warnings.length === 1 && warnings[0].includes("runvil:workspace-opened") && warnings[0].includes("not allowed"),
-  );
-  check("a rejected emit paints nothing on the status bar", statusMessages.length === statusBefore);
-  check("a rejected emit escapes as no unhandled rejection", rejections.length === 0);
-}
-
-// --- A server refusal: error shown, nothing emitted or recorded ---------------
-
-{
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const recentBefore = recentStore.list.length;
-  window.__TAURI_DIALOG__.answer = "C:\\elsewhere\\notes.txt";
-  nextAnswer = {
-    status: 400,
-    body: { error: { code: "refused", message: "not a Runvil workspace: format 'sqlite' where 'runvil-workspace' required" } },
-  };
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check(
-    "a refused open paints the server's message on the status bar as error",
-    statusMessages.some((m) => m.severity === "error" && m.label.includes("not a Runvil workspace")),
-  );
-  check("a refused open emits nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-  check("a refused open records nothing", recentStore.list.length === recentBefore);
-  check("a refused open invalidates nothing", workspaceChanges === changesBefore);
-}
-
-// --- A transport failure is reported the same way ------------------------------
-
-{
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Beta.rvwork";
-  nextAnswer = null;
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check(
-    "a transport failure paints an error, never an unhandled rejection",
-    statusMessages.at(-1)?.severity === "error" && statusMessages.at(-1)?.label.includes("Beta.rvwork"),
-  );
-  check("a transport failure emits nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-}
-
-// --- Save As: cancel posts nothing --------------------------------------------
-
-{
-  const fetchesBefore = fetches.length;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const recentBefore = recentStore.list.length;
-  const changesBefore = workspaceChanges;
-  window.__TAURI_DIALOG__.answer = null;
-  answerQueue.push({ status: 200, body: OPENED });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  const pick = window.__TAURI_DIALOG__.calls.at(-1);
-  check("Save Workspace As opens the native save picker", pick?.kind === "save");
-  check("the save picker is seeded with the current name plus .rvwork", pick?.defaultPath === "Alpha.rvwork");
-  check(
-    "the save picker filters to .rvwork files",
-    Array.isArray(pick?.filters) &&
-      pick.filters.some((f) => f.name === "Runvil Workspace" && f.extensions.join(",") === "rvwork"),
-  );
-  check("a canceled save picker posts nothing", postsSince(fetchesBefore).length === 0);
-  check("a canceled save picker emits nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-  check("a canceled save picker records nothing", recentStore.list.length === recentBefore);
-  check("a canceled save picker invalidates nothing", workspaceChanges === changesBefore);
-}
-
-// --- Save As: a bare name gains .rvwork once and switches ------------------------
-
-{
-  const fetchesBefore = fetches.length;
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const statusBefore = statusMessages.length;
-  const BARE = "C:\\work\\Beta";
-  const SAVED = `${BARE}.rvwork`;
-  window.__TAURI_DIALOG__.answer = BARE;
-  answerQueue.push({ status: 200, body: OPENED }, { status: 200, body: { ...OPENED, path: SAVED, name: "Beta" } });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  const posts = postsSince(fetchesBefore);
-  check("a picked name is posted once to /workspace/file/save-as", posts.length === 1 && posts[0].url === "/workspace/file/save-as");
-  check("a bare name is posted with .rvwork appended", posts[0]?.body?.path === SAVED);
-  check("a successful save-as fires one workspace-changed invalidation", workspaceChanges === changesBefore + 1);
-  const emitted = window.__TAURI_EVENTS__.emitted;
-  check(
-    "a successful save-as emits runvil:workspace-opened with the new path",
-    emitted.length === emittedBefore + 1 && emitted.at(-1).event === "runvil:workspace-opened" && emitted.at(-1).payload?.path === SAVED,
-  );
-  check("a successful save-as records the new path as recent", recentStore.list[0] === SAVED);
-  check("a successful save-as paints nothing on the status bar", statusMessages.length === statusBefore);
-}
-
-// --- Save As: an existing extension is never doubled ------------------------------
-
-{
-  const fetchesBefore = fetches.length;
-  const NAMED = "C:\\work\\Gamma.rvwork";
-  window.__TAURI_DIALOG__.answer = NAMED;
-  answerQueue.push({ status: 200, body: OPENED }, { status: 200, body: { ...OPENED, path: NAMED, name: "Gamma" } });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("a name already ending in .rvwork is posted unchanged", postsSince(fetchesBefore)[0]?.body?.path === NAMED);
-
-  const fetchesBeforeUpper = fetches.length;
-  const UPPER = "C:\\work\\Delta.RVWORK";
-  window.__TAURI_DIALOG__.answer = UPPER;
-  answerQueue.push({ status: 200, body: OPENED }, { status: 200, body: { ...OPENED, path: UPPER, name: "Delta" } });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("an upper-case .RVWORK extension is recognized and not doubled", postsSince(fetchesBeforeUpper)[0]?.body?.path === UPPER);
-}
-
-// --- Save As: a refusal paints the error and switches nothing ----------------------
-
-{
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const recentBefore = recentStore.list.length;
-  const TAKEN = "C:\\work\\Alpha.rvwork";
-  window.__TAURI_DIALOG__.answer = TAKEN;
-  answerQueue.push(
-    { status: 200, body: OPENED },
-    { status: 409, body: { error: { code: "conflict", message: "workspace file already exists: C:\\work\\Alpha.rvwork" } } },
-  );
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check(
-    "a refused save-as paints the server's message on the status bar as error",
-    statusMessages.at(-1)?.severity === "error" && statusMessages.at(-1)?.label.includes("already exists"),
-  );
-  check("a refused save-as emits nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-  check("a refused save-as records nothing", recentStore.list.length === recentBefore);
-  check("a refused save-as invalidates nothing", workspaceChanges === changesBefore);
-}
-
-// --- Save As: an unreachable current still offers a default name --------------------
-
-{
-  const fetchesBefore = fetches.length;
-  const statusBefore = statusMessages.length;
-  window.__TAURI_DIALOG__.answer = null;
-  answerQueue.push({ status: 500, body: { error: { code: "internal", message: "draining" } } });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  const pick = window.__TAURI_DIALOG__.calls.at(-1);
-  check("a failed current lookup still opens the save picker", pick?.kind === "save");
-  check("a failed current lookup seeds the picker with Untitled.rvwork", pick?.defaultPath === "Untitled.rvwork");
-  check("a failed current lookup paints nothing by itself", statusMessages.length === statusBefore && postsSince(fetchesBefore).length === 0);
-}
-
-// --- Duplicate: copies, switches, emits, records -----------------------------------
-
-{
-  const fetchesBefore = fetches.length;
-  const changesBefore = workspaceChanges;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const statusBefore = statusMessages.length;
-  const COPY = "C:\\work\\Alpha copy.rvwork";
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Alpha copy";
-  answerQueue.push({ status: 200, body: OPENED }, { status: 200, body: { ...OPENED, path: COPY, name: "Alpha copy" } });
-  await Commands.execute("workbench.action.duplicateWorkspace");
-  await flush();
-  const pick = window.__TAURI_DIALOG__.calls.at(-1);
-  check("Duplicate Workspace opens the native save picker seeded with the current name", pick?.kind === "save" && pick?.defaultPath === "Alpha.rvwork");
-  const posts = postsSince(fetchesBefore);
-  check("a picked name is posted once to /workspace/file/duplicate", posts.length === 1 && posts[0].url === "/workspace/file/duplicate");
-  check("duplicate appends .rvwork to a bare name", posts[0]?.body?.path === COPY);
-  check("a successful duplicate fires one workspace-changed invalidation", workspaceChanges === changesBefore + 1);
-  const emitted = window.__TAURI_EVENTS__.emitted;
-  check(
-    "a successful duplicate emits runvil:workspace-opened with the copy's path",
-    emitted.length === emittedBefore + 1 && emitted.at(-1).payload?.path === COPY,
-  );
-  check("a successful duplicate records the copy's path as recent", recentStore.list[0] === COPY);
-  check("a successful duplicate paints nothing on the status bar", statusMessages.length === statusBefore);
-}
-
-// --- Duplicate: a refusal (ephemeral workspace) paints the error ----------------------
-
-{
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  const recentBefore = recentStore.list.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Nothing.rvwork";
-  answerQueue.push(
-    { status: 200, body: { path: null, name: "Untitled", grants: [], window_state: null } },
-    { status: 400, body: { error: { code: "refused", message: "no workspace file to duplicate: the workspace is ephemeral" } } },
-  );
-  await Commands.execute("workbench.action.duplicateWorkspace");
-  await flush();
-  check(
-    "a refused duplicate paints the server's message on the status bar as error",
-    statusMessages.at(-1)?.severity === "error" && statusMessages.at(-1)?.label.includes("ephemeral"),
-  );
-  check("a refused duplicate emits nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-  check("a refused duplicate records nothing", recentStore.list.length === recentBefore);
-}
-
-// --- The client's typed parse of the wire shape ----------------------------------
-
-check("every queued server answer was consumed by the actions above", answerQueue.length === 0);
-answerQueue.length = 0;
-
-{
-  nextAnswer = { status: 200, body: OPENED };
-  const current = await currentWorkspaceFile();
-  check("currentWorkspaceFile GETs /workspace/file/current", fetches.at(-1)?.url === "/workspace/file/current");
-  check(
-    "the client maps the wire's window_state onto windowState",
-    current.path === OPENED.path &&
-      current.name === "Alpha" &&
-      current.grants.length === 1 &&
-      current.grants[0].exists === true &&
-      current.windowState?.width === 1280 &&
-      current.windowState?.maximized === false,
-  );
-
-  nextAnswer = { status: 200, body: { path: null, name: "Untitled", grants: [], window_state: null } };
-  const ephemeral = await currentWorkspaceFile();
-  check("an ephemeral workspace parses with a null path and no geometry", ephemeral.path === null && ephemeral.windowState === null);
-
-  nextAnswer = { status: 200, body: { name: 3 } };
-  let shapeError = null;
-  try {
-    await currentWorkspaceFile();
-  } catch (error) {
-    shapeError = error;
-  }
-  check("a malformed answer is refused as an unexpected shape", shapeError !== null && /shape/.test(shapeError.message));
-
-  nextAnswer = { status: 200, body: { saved: true } };
-  const saved = await putWindowState({ width: 1, height: 2, x: 3, y: 4, maximized: true });
-  const put = fetches.at(-1);
-  check(
-    "putWindowState PUTs the geometry to /workspace/file/window-state",
-    put?.url === "/workspace/file/window-state" && put?.method === "PUT" && put?.body?.maximized === true,
-  );
-  check("putWindowState answers the server's saved flag", saved === true);
-}
-
-if (failures.length > 0) {
-  console.error(`workspace-files: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workspace-files: all assertions passed");
diff --git a/crates/workshop/ui/test/workspace-switch.mjs b/crates/workshop/ui/test/workspace-switch.mjs
deleted file mode 100644
index a751fe059..000000000
--- a/crates/workshop/ui/test/workspace-switch.mjs
+++ /dev/null
@@ -1,765 +0,0 @@
-// Unit test for the workspace switch moving UI state
-// (src/parts/workspace-document/workspace-document.contribution.ts over the
-// UI-state adapter, the dock, the tree state, and the closed-editor
-// stack). Bundles the contribution with esbuild - the Tauri dialog and
-// event modules aliased to the recording stubs in test/helpers - and
-// drives Open Workspace from File..., Save Workspace As..., and Duplicate
-// Workspace... against jsdom with a scripted fetch, the fake UI-state
-// adapter (test/helpers/ui-storage.mjs), a fake dock bound through
-// initZones, and live TreeStateService and ClosedEditors instances.
-// Covers: after a successful Open the adapter's workspace bucket is
-// reloaded, dock.fromJSON receives the opened file's layout, the tree's
-// expanded set and the closed-editor stack are replaced wholesale, and
-// no workspace write lands during or after the apply: the fake dock
-// delivers its layout-change event on a microtask as Dockview does, the
-// real debounced startLayoutPersistence is wired as main.ts wires it, and
-// the check waits past the debounce so the saver's restore echo is caught
-// rather than hidden by the apply's synchronous suppression; a real
-// layout change after the Open still saves; a refused Open reloads and
-// applies nothing; after a
-// successful Save As exactly three workspace writes store the live
-// layout envelope, expanded set, and closed stack; a canceled or
-// refused Save As writes nothing; and Duplicate writes nothing. The fake
-// dock contains a real WorkshopTreePanel as its "tree" panel and a real
-// WindowTitle reads the roots beside it, so the switch's roots traffic
-// is the real thing (UM-001, OP-001): once /workspace/file/open has
-// resolved the tree never renders the previous workspace's roots, and
-// the panel and the title together fetch GET /workspace/tree exactly
-// once for the switch. A 408 from Open, Save As, or Duplicate paints the
-// error and re-reads GET /workspace/file/current: when the server reports
-// the target, the switch landed late and the page finishes it as a
-// success does (the tree shows the opened workspace's roots); otherwise
-// the tree re-lists the roots once and nothing is applied or written.
-// Open applies the registered layout policy: a restored open never seeds
-// it, and an open whose file stores no layout clears the dock and seeds
-// the policy's default.
-// Run: node --test test/workspace-switch.mjs
-import { writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/workspace-document/workspace-document.contribution.ts";
-      // The default layout's panel types register from their contributions.
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      export { register } from "./src/parts/workspace-document/index.ts";
-      export { Commands } from "@workshop/platform/command-registry";
-      export { registerService } from "@workshop/platform/service-registry";
-      export { UI_STORAGE } from "./src/services/ui-storage.ts";
-      export { TREE_STATE, TreeStateService } from "./src/services/tree-state-service.ts";
-      export { ClosedEditors } from "./src/parts/editor/closed-editors.ts";
-      export { CLOSED_EDITORS } from "./src/services/closed-editors.ts";
-      export { initZones, openInZone } from "./src/parts/layout/zones.ts";
-      export { LAYOUT_POLICY } from "./src/services/layout-policy.ts";
-      export { LAYOUT_SCHEMA_VERSION, startLayoutPersistence } from "./src/parts/layout/layout-persistence.ts";
-      export { STATUS_BAR } from "@workshop/platform/status-bar";
-      export { WorkshopTreePanel } from "./src/parts/workspace/workshop-panel.ts";
-      export { WindowTitle } from "./src/parts/chrome/command-center.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/plugin-dialog": path.join(uiDir, "helpers", "tauri-dialog-stub.mjs"),
-    "@tauri-apps/api/event": path.join(uiDir, "helpers", "tauri-event-stub.mjs"),
-  },
-});
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: "http://127.0.0.1:7912/",
-  pretendToBeVisual: true,
-});
-const { window } = dom;
-globalThis.window = window;
-globalThis.document = window.document;
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.HTMLElement = window.HTMLElement;
-globalThis.HTMLButtonElement = window.HTMLButtonElement;
-globalThis.HTMLInputElement = window.HTMLInputElement;
-globalThis.Element = window.Element;
-globalThis.Node = window.Node;
-globalThis.MutationObserver = window.MutationObserver;
-
-const bundlePath = path.join(os.tmpdir(), "runvil-workspace-switch-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  register,
-  Commands,
-  registerService,
-  UI_STORAGE,
-  TREE_STATE,
-  TreeStateService,
-  CLOSED_EDITORS,
-  ClosedEditors,
-  initZones,
-  openInZone,
-  LAYOUT_POLICY,
-  LAYOUT_SCHEMA_VERSION,
-  startLayoutPersistence,
-  STATUS_BAR,
-  WorkshopTreePanel,
-  WindowTitle,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// Lets an async action chain (dialog -> fetch -> json -> reload -> emit) settle.
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-// Waits out the layout saver's 250 ms debounce, so a write it armed
-// would have landed by the time the caller looks.
-function settleLayoutSaver() {
-  return new Promise((resolve) => setTimeout(resolve, 400));
-}
-
-// --- The fake dock -----------------------------------------------------------
-
-// A dock good enough for the zone registry, the layout restore, and the
-// layout snapshot, with Dockview's event timing: every layout change is
-// delivered through one coalesced microtask (dockview-core's AsapEvent),
-// never synchronously, and fromJSON rebuilds groups and panels from the
-// serialized grid, queues that microtask through the adds, then fires
-// onDidLayoutFromJSON synchronously at its end. A saver wired to
-// onDidLayoutChange therefore reacts to a restore only after the apply's
-// synchronous span has ended, which is what the real Open path faces.
-// toJSON answers a distinctive live grid so a Save As snapshot is
-// recognizable; fireLayoutChange stands in for a user's drag or close.
-// The "tree" panel is a real WorkshopTreePanel, created and init'd on
-// add and disposed on clear as Dockview re-creates panel content through
-// fromJSON, so the switch drives the real roots load.
-function makeFakeDock() {
-  const layoutListeners = new Set();
-  const fromJsonListeners = new Set();
-  const panels = new Map();
-  let layoutChangeQueued = false;
-  let treePanel = null;
-  let liveGrid = { root: { type: "leaf", data: { views: [], activeView: undefined, id: "live" }, size: 1 }, width: 1, height: 1, orientation: "HORIZONTAL" };
-  const dock = {
-    fromJSONCalls: [],
-    clears: 0,
-    groups: [],
-    get panels() {
-      return [...panels.values()];
-    },
-    onDidMovePanel: () => ({ dispose() {} }),
-    onDidRemovePanel: () => ({ dispose() {} }),
-    onWillMutateLayout: () => ({ dispose() {} }),
-    onDidMutateLayout: () => ({ dispose() {} }),
-    onDidLayoutChange: (fn) => {
-      layoutListeners.add(fn);
-      return { dispose: () => layoutListeners.delete(fn) };
-    },
-    onDidLayoutFromJSON: (fn) => {
-      fromJsonListeners.add(fn);
-      return { dispose: () => fromJsonListeners.delete(fn) };
-    },
-    fireLayoutChange: () => {
-      if (layoutChangeQueued) return;
-      layoutChangeQueued = true;
-      queueMicrotask(() => {
-        layoutChangeQueued = false;
-        for (const listener of layoutListeners) listener();
-      });
-    },
-    getPanel: (id) => panels.get(id),
-    getGroup: (id) => dock.groups.find((group) => group.id === id),
-    addPanel: (options) => addPanel(options.id, `g-${options.id}`, options.params),
-    clear: () => {
-      dock.clears += 1;
-      if (panels.size > 0 || dock.groups.length > 0) dock.fireLayoutChange();
-      panels.clear();
-      dock.groups.length = 0;
-      treePanel?.dispose();
-      treePanel?.element.remove();
-      treePanel = null;
-    },
-    /** The live tree panel's element, for reading the rendered roots. */
-    get treeElement() {
-      return treePanel?.element ?? null;
-    },
-    fromJSON: (layout) => {
-      dock.fromJSONCalls.push(layout);
-      dock.clear();
-      const walk = (node) => {
-        if (node.type === "branch") {
-          for (const child of node.data) walk(child);
-          return;
-        }
-        for (const view of node.data.views) addPanel(view, node.data.id, {});
-      };
-      walk(layout.grid.root);
-      liveGrid = layout.grid;
-      for (const listener of fromJsonListeners) listener();
-    },
-    toJSON: () => ({ grid: liveGrid, panels: Object.fromEntries([...panels.keys()].map((id) => [id, { id }])), activeGroup: dock.groups[0]?.id }),
-  };
-  function addPanel(id, groupId, params) {
-    let group = dock.getGroup(groupId);
-    if (group === undefined) {
-      group = { id: groupId, api: { setSize() {}, isVisible: true, setVisible() {} } };
-      dock.groups.push(group);
-    }
-    const panel = { id, params, group, api: { setActive() {} } };
-    panels.set(id, panel);
-    if (id === "tree") {
-      treePanel = new WorkshopTreePanel(null);
-      treePanel.init({ params: {}, api: {} });
-      window.document.body.appendChild(treePanel.element);
-    }
-    dock.fireLayoutChange();
-    return panel;
-  }
-  return dock;
-}
-
-// --- The scripted server -----------------------------------------------------
-
-const fetches = [];
-const answerQueue = [];
-// The tree's traffic sits outside the ordered queue: the roots (GET
-// /workspace/tree with no path) answer with whatever `rootsListing`
-// holds, a directory answers empty. Each roots fetch is counted in
-// `rootsFetches` so the switch's total can be asserted.
-const dir = (name, p) => ({ name, path: p, kind: "directory", size: 0, modified_ms: 1, exists: true });
-const LIVE_ROOTS = { path: null, entries: [dir("src", "C:\\work\\src")] };
-const FILE_ROOTS = { path: null, entries: [dir("beta", "C:\\beta")] };
-let rootsListing = LIVE_ROOTS;
-let rootsFetches = 0;
-// Set when the scripted server answers POST /workspace/file/open: from
-// then on the tree must never paint the previous workspace's roots.
-let openResolved = false;
-
-// Every root row the tree paints after the open resolved, by path. The
-// observer sees each render's list items as they land in the roots list
-// (the record's target); the row is the item's direct child button. Read
-// from the record, not the live tree, because a later render may already
-// have cleared the item by the time the observer's microtask runs -
-// which is exactly the flash this catches.
-const rootsRendered = [];
-function rootRowOf(item) {
-  return [...item.children].find((child) => child.classList.contains("ws-workshop-tree__row")) ?? null;
-}
-const treeRenders = new MutationObserver((records) => {
-  if (!openResolved) return;
-  for (const record of records) {
-    if (!(record.target instanceof window.Element) || !record.target.classList.contains("ws-workshop-tree__list")) continue;
-    for (const node of record.addedNodes) {
-      const row = node instanceof window.Element ? rootRowOf(node) : null;
-      if (row !== null) rootsRendered.push(row.title);
-    }
-  }
-});
-treeRenders.observe(window.document.body, { childList: true, subtree: true });
-
-globalThis.fetch = async (url, init) => {
-  const parsed = new URL(url, "http://127.0.0.1:7912/");
-  if (parsed.pathname === "/workspace/tree") {
-    const p = parsed.searchParams.get("path");
-    if (p === null) {
-      rootsFetches += 1;
-      return { ok: true, status: 200, json: async () => rootsListing };
-    }
-    return { ok: true, status: 200, json: async () => ({ path: p, entries: [] }) };
-  }
-  fetches.push({ url, method: init?.method ?? "GET", body: init?.body === undefined ? null : JSON.parse(init.body) });
-  const answer = answerQueue.shift();
-  if (answer === undefined) {
-    throw new Error(`unexpected fetch in the workspace-switch test: ${url}`);
-  }
-  if (url === "/workspace/file/open" && answer.status < 400) {
-    treeRenders.takeRecords();
-    rootsRendered.length = 0;
-    openResolved = true;
-  }
-  return { ok: answer.status < 400, status: answer.status, json: async () => answer.body };
-};
-
-/** The root paths the live tree panel shows right now. */
-function rootsOnScreen() {
-  return [...(dock.treeElement?.querySelectorAll(".ws-workshop-tree__list > li") ?? [])].map((item) => rootRowOf(item)?.title ?? "");
-}
-
-const statusMessages = [];
-registerService(STATUS_BAR, () => ({
-  showLocal: (label, severity) => statusMessages.push({ label, severity }),
-}));
-
-window.__TAURI_INTERNALS__ = {};
-window.__TAURI_DIALOG__ = { calls: [], answer: null };
-window.__TAURI_EVENTS__ = { emitted: [], fail: false };
-
-const CURRENT = {
-  path: "C:\\work\\Alpha.rvwork",
-  name: "Alpha",
-  grants: [{ path: "C:\\work\\src", exists: true }],
-  window_state: null,
-};
-
-// --- The stores, bound the way main.ts binds them -------------------------------
-
-// The live arrangement before any switch: what the previous workspace held.
-const LIVE_EXPANDED = ["C:\\work\\src", "C:\\work\\src\\lib"];
-const LIVE_CLOSED = ["C:\\work\\src\\old.md"];
-
-const storage = createFakeUiStorage({
-  workspace: { tree: { expanded: LIVE_EXPANDED }, closed_editors: { paths: LIVE_CLOSED } },
-});
-let reloads = 0;
-// The opened file's bucket: what the real adapter's reloadWorkspace pulls.
-let fileState = {};
-storage.reloadWorkspace = async () => {
-  reloads += 1;
-  storage.replaceWorkspace(fileState);
-};
-registerService(UI_STORAGE, () => storage);
-
-const tree = new TreeStateService(storage.get("workspace", "tree"), (value) => storage.set("workspace", "tree", value));
-registerService(TREE_STATE, () => tree);
-// The composition root has the service follow the workspace-changed event
-// before any reader exists (main.ts), so the panel and the title below read a
-// listing that is already dropped; a switch still fetches the roots once.
-const followWorkspace = tree.followWorkspaceChanges(window);
-const closed = new ClosedEditors(storage.get("workspace", "closed_editors"), (value) =>
-  storage.set("workspace", "closed_editors", value),
-);
-registerService(CLOSED_EDITORS, () => closed);
-// The layout policy in the product's shape: the tree and the agent
-// session anchor the default layout. The seed count tells a default
-// layout apart from a restore.
-let seeds = 0;
-registerService(LAYOUT_POLICY, () => ({
-  anchors: ["tree", "agent"],
-  seed: () => {
-    seeds += 1;
-    openInZone("tree", {});
-    openInZone("agent", {});
-  },
-}));
-
-const dock = makeFakeDock();
-initZones(dock);
-dock.addPanel({ id: "tree", params: {} });
-dock.addPanel({ id: "agent", params: {} });
-// The window title reads the roots through the shared load, as the
-// command center does; its default listRoots is the real one.
-const title = new WindowTitle();
-// Let the boot layout's change event pass before the saver subscribes, so
-// the only layout writes the test sees are the ones the switch causes.
-await flush();
-check("the boot tree and title share one roots fetch", rootsFetches === 1);
-check("the boot tree shows the live workspace's roots", rootsOnScreen().join(",") === "C:\\work\\src");
-check("the boot title is the first live root", window.document.title === "src");
-// The live layout saver, exactly as main.ts wires it: debounced, off the
-// dock's microtask-delivered change events, writing into the workspace
-// bucket. Nothing here is undebounced or synchronous, so the Open echo
-// the real page would produce is the one this test can catch.
-const layoutSaver = startLayoutPersistence(dock, (value) => storage.set("workspace", "layout", value));
-
-register();
-
-const workspaceSets = () => storage.sets.filter((entry) => entry.bucket === "workspace");
-
-// --- Open: the file's arrangement replaces the live one -------------------------
-
-const OPENED_PATH = "C:\\work\\Beta.rvwork";
-const FILE_LAYOUT = {
-  version: LAYOUT_SCHEMA_VERSION,
-  zones: { left: "beta-left", right: "beta-right" },
-  overrides: { "editor:C:\\beta\\notes.md": "right" },
-  layout: {
-    grid: {
-      root: {
-        type: "branch",
-        data: [
-          { type: "leaf", data: { views: ["tree"], activeView: "tree", id: "beta-left" }, size: 30 },
-          { type: "leaf", data: { views: ["agent"], activeView: "agent", id: "beta-right" }, size: 70 },
-        ],
-        size: 100,
-      },
-      width: 100,
-      height: 100,
-      orientation: "HORIZONTAL",
-    },
-    panels: { tree: { id: "tree" }, agent: { id: "agent" } },
-    activeGroup: "beta-right",
-  },
-};
-const FILE_EXPANDED = ["C:\\beta", "C:\\beta\\docs"];
-const FILE_CLOSED = ["C:\\beta\\docs\\readme.md", "C:\\beta\\notes.md"];
-
-{
-  fileState = { layout: FILE_LAYOUT, tree: { expanded: FILE_EXPANDED }, closed_editors: { paths: FILE_CLOSED } };
-  const rootsFetchesBefore = rootsFetches;
-  // The server switches its grants with the open: the roots it answers
-  // from here on are the file's.
-  rootsListing = FILE_ROOTS;
-  window.__TAURI_DIALOG__.answer = OPENED_PATH;
-  answerQueue.push({ status: 200, body: { ...CURRENT, path: OPENED_PATH, name: "Beta" } });
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check("a successful open posts the picked path", fetches.at(-1)?.url === "/workspace/file/open" && fetches.at(-1)?.body?.path === OPENED_PATH);
-  check("the switch fetches the roots exactly once across the tree and the title", rootsFetches === rootsFetchesBefore + 1);
-  check("once the open resolved the tree never renders the previous workspace's roots", !rootsRendered.includes("C:\\work\\src"));
-  check("every root the tree renders after the open is the opened workspace's", rootsRendered.length > 0 && rootsRendered.every((p) => p === "C:\\beta"));
-  check("the re-created tree shows one copy of the opened workspace's root", rootsOnScreen().join(",") === "C:\\beta");
-  check("the title follows the opened workspace's first root", window.document.title === "beta");
-  check("a successful open reloads the workspace bucket once", reloads === 1);
-  check("dock.fromJSON receives the opened file's layout once", dock.fromJSONCalls.length === 1 && dock.fromJSONCalls[0] === FILE_LAYOUT.layout);
-  check("a restored open never seeds the layout policy", seeds === 0);
-  check("the dock holds the file's groups after the apply", dock.groups.map((group) => group.id).join(",") === "beta-left,beta-right");
-  check("the expanded set is replaced with the file's", isDeepStrictEqual([...tree.expandedPaths], FILE_EXPANDED));
-  check("the closed stack is replaced with the file's, most recent first", isDeepStrictEqual(closed.snapshot().paths, FILE_CLOSED));
-  check("no workspace write lands during the apply", workspaceSets().length === 0);
-  check("a successful open fires the workspace-changed invalidation", window.__TAURI_EVENTS__.emitted.at(-1)?.payload?.path === OPENED_PATH);
-  check("a successful open paints nothing on the status bar", statusMessages.length === 0);
-
-  // The restore's layout-change event arrived on a microtask, after the
-  // apply's suppression lifted, and the saver's debounce would have landed
-  // the echo by now; the saver dropped it instead.
-  await settleLayoutSaver();
-  check("no workspace write lands after the apply, past the saver's debounce", workspaceSets().length === 0);
-  check(
-    "the layout saver's restore echo never reaches the adapter, suppressed or otherwise",
-    storage.suppressed.filter((entry) => entry.key === "layout").length === 0,
-  );
-
-  // The saver is still live: a real layout change after the Open saves
-  // the current arrangement once.
-  dock.fireLayoutChange();
-  await settleLayoutSaver();
-  check(
-    "a real layout change after the open still saves once",
-    workspaceSets().length === 1 && workspaceSets()[0].key === "layout" && workspaceSets()[0].value.layout.grid === FILE_LAYOUT.layout.grid,
-  );
-}
-
-// --- Open: a refusal reloads and applies nothing --------------------------------
-
-{
-  const reloadsBefore = reloads;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  const setsBefore = storage.sets.length;
-  window.__TAURI_DIALOG__.answer = "C:\\elsewhere\\notes.txt";
-  answerQueue.push({ status: 400, body: { error: { code: "refused", message: "not a Runvil workspace" } } });
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check("a refused open paints the error", statusMessages.at(-1)?.severity === "error");
-  check("a refused open reloads nothing", reloads === reloadsBefore);
-  check("a refused open applies no layout", dock.fromJSONCalls.length === fromJsonBefore);
-  check("a refused open leaves the expanded set alone", isDeepStrictEqual([...tree.expandedPaths], FILE_EXPANDED));
-  check("a refused open leaves the closed stack alone", isDeepStrictEqual(closed.snapshot().paths, FILE_CLOSED));
-  await settleLayoutSaver();
-  check("a refused open writes nothing", storage.sets.length === setsBefore);
-}
-
-// --- Save As: the new file gets the live arrangement ------------------------------
-
-const SAVED_PATH = "C:\\work\\Gamma.rvwork";
-{
-  // Interactive changes since the open, so the live values differ from
-  // the file's: a folder opened (no write yet: the tree debounces), and
-  // one more editor closed (one immediate write, counted out below).
-  tree.replaceExpanded([...FILE_EXPANDED, "C:\\beta\\src"]);
-  closed.push({ kind: "file", path: "C:\\beta\\src\\main.rs" });
-  closed.push({ kind: "untitled", text: "draft" });
-  const setsBefore = storage.sets.length;
-  const liveExpanded = [...tree.expandedPaths];
-  const liveClosed = closed.snapshot();
-
-  window.__TAURI_DIALOG__.answer = SAVED_PATH;
-  answerQueue.push(
-    { status: 200, body: { ...CURRENT, path: OPENED_PATH, name: "Beta" } },
-    { status: 200, body: { ...CURRENT, path: SAVED_PATH, name: "Gamma" } },
-  );
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("a picked name is posted to /workspace/file/save-as", fetches.at(-1)?.url === "/workspace/file/save-as" && fetches.at(-1)?.body?.path === SAVED_PATH);
-  const sets = storage.sets.slice(setsBefore);
-  check("a successful save-as makes exactly three workspace writes", sets.length === 3 && sets.every((entry) => entry.bucket === "workspace"));
-  check("the three writes cover layout, tree, and closed_editors once each", [...new Set(sets.map((entry) => entry.key))].sort().join(",") === "closed_editors,layout,tree");
-  const layout = sets.find((entry) => entry.key === "layout")?.value;
-  check(
-    "the layout write is the live envelope: current schema, the zone map, the dock's own snapshot",
-    layout?.version === LAYOUT_SCHEMA_VERSION &&
-      isDeepStrictEqual(layout?.zones, FILE_LAYOUT.zones) &&
-      isDeepStrictEqual(layout?.overrides, FILE_LAYOUT.overrides) &&
-      layout?.layout?.grid === FILE_LAYOUT.layout.grid &&
-      Object.keys(layout?.layout?.panels ?? {}).sort().join(",") === "agent,tree",
-  );
-  check("the tree write stores the live expanded set", isDeepStrictEqual(sets.find((entry) => entry.key === "tree")?.value, { expanded: liveExpanded }));
-  check(
-    "the closed_editors write stores the live file stack, untitled buffers excluded",
-    isDeepStrictEqual(sets.find((entry) => entry.key === "closed_editors")?.value, liveClosed) &&
-      liveClosed.paths[0] === "C:\\beta\\src\\main.rs",
-  );
-  check("a successful save-as reloads nothing", reloads === 1);
-  check("a successful save-as emits the new path", window.__TAURI_EVENTS__.emitted.at(-1)?.payload?.path === SAVED_PATH);
-}
-
-// --- Save As: a cancel or a refusal writes nothing ------------------------------------
-
-{
-  const setsBefore = storage.sets.length;
-  window.__TAURI_DIALOG__.answer = null;
-  answerQueue.push({ status: 200, body: { ...CURRENT, path: SAVED_PATH, name: "Gamma" } });
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("a canceled save-as writes nothing", storage.sets.length === setsBefore);
-
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Alpha.rvwork";
-  answerQueue.push(
-    { status: 200, body: { ...CURRENT, path: SAVED_PATH, name: "Gamma" } },
-    { status: 409, body: { error: { code: "conflict", message: "workspace file already exists" } } },
-  );
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("a refused save-as paints the error", statusMessages.at(-1)?.label.includes("already exists") === true);
-  check("a refused save-as writes nothing", storage.sets.length === setsBefore);
-}
-
-// --- Duplicate: unchanged, writes nothing and applies nothing ---------------------------
-
-{
-  const setsBefore = storage.sets.length;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  const reloadsBefore = reloads;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Gamma copy";
-  answerQueue.push(
-    { status: 200, body: { ...CURRENT, path: SAVED_PATH, name: "Gamma" } },
-    { status: 200, body: { ...CURRENT, path: "C:\\work\\Gamma copy.rvwork", name: "Gamma copy" } },
-  );
-  await Commands.execute("workbench.action.duplicateWorkspace");
-  await flush();
-  check("a successful duplicate posts to /workspace/file/duplicate", fetches.at(-1)?.url === "/workspace/file/duplicate");
-  check("a successful duplicate writes no workspace state", storage.sets.length === setsBefore);
-  check("a successful duplicate applies no layout", dock.fromJSONCalls.length === fromJsonBefore && reloads === reloadsBefore);
-}
-
-// --- A 408 switch: the server may have committed it anyway ----------------------------
-
-// The route deadline abandons the answer, not a switch that already
-// committed (the server swaps the backing, then awaits the old file's
-// close), so after a 408 only GET /workspace/file/current says where the
-// server stands.
-const TIMED_OUT = {
-  status: 408,
-  body: {
-    error: {
-      code: "deadline_elapsed",
-      message: "the request did not finish within its 10s deadline; the operation may still complete",
-    },
-  },
-};
-const DELTA_PATH = "C:\\work\\Delta.rvwork";
-const DELTA_ROOTS = { path: null, entries: [dir("delta", "C:\\delta")] };
-const DELTA_EXPANDED = ["C:\\delta"];
-const DELTA_CURRENT = { ...CURRENT, path: DELTA_PATH, name: "Delta", grants: [{ path: "C:\\delta", exists: true }] };
-const trafficSince = (start) => fetches.slice(start).map((entry) => `${entry.method} ${entry.url}`).join(",");
-
-{
-  const fetchesBefore = fetches.length;
-  const reloadsBefore = reloads;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  fileState = { layout: FILE_LAYOUT, tree: { expanded: DELTA_EXPANDED }, closed_editors: { paths: [] } };
-  // The open committed before the deadline answered: the server lists the
-  // file's roots from here on.
-  rootsListing = DELTA_ROOTS;
-  window.__TAURI_DIALOG__.answer = DELTA_PATH;
-  answerQueue.push(TIMED_OUT, { status: 200, body: DELTA_CURRENT });
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check(
-    "a timed-out open paints the deadline error",
-    statusMessages.at(-1)?.severity === "error" && statusMessages.at(-1)?.label.includes("deadline") === true,
-  );
-  check("a timed-out open re-reads GET /workspace/file/current", trafficSince(fetchesBefore) === "POST /workspace/file/open,GET /workspace/file/current");
-  check("after a timed-out open that landed, the tree shows the opened workspace's roots", rootsOnScreen().join(",") === "C:\\delta");
-  check("after a timed-out open that landed, the title follows the opened workspace", window.document.title === "delta");
-  check(
-    "a timed-out open that landed applies the file's state as a success does",
-    reloads === reloadsBefore + 1 && dock.fromJSONCalls.length === fromJsonBefore + 1 && isDeepStrictEqual([...tree.expandedPaths], DELTA_EXPANDED),
-  );
-  check("a timed-out open that landed announces the opened file", window.__TAURI_EVENTS__.emitted.at(-1)?.payload?.path === DELTA_PATH);
-}
-
-{
-  const fetchesBefore = fetches.length;
-  const reloadsBefore = reloads;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  const rootsFetchesBefore = rootsFetches;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Epsilon.rvwork";
-  answerQueue.push(TIMED_OUT, { status: 200, body: DELTA_CURRENT });
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check("a timed-out open that never landed re-reads GET /workspace/file/current", trafficSince(fetchesBefore) === "POST /workspace/file/open,GET /workspace/file/current");
-  check("a timed-out open that never landed re-lists the roots once", rootsFetches === rootsFetchesBefore + 1 && rootsOnScreen().join(",") === "C:\\delta");
-  check(
-    "a timed-out open that never landed applies nothing",
-    reloads === reloadsBefore && dock.fromJSONCalls.length === fromJsonBefore && window.__TAURI_EVENTS__.emitted.length === emittedBefore,
-  );
-}
-
-const ZETA_PATH = "C:\\work\\Zeta.rvwork";
-{
-  const fetchesBefore = fetches.length;
-  const setsBefore = storage.sets.length;
-  window.__TAURI_DIALOG__.answer = ZETA_PATH;
-  answerQueue.push(
-    { status: 200, body: DELTA_CURRENT },
-    TIMED_OUT,
-    { status: 200, body: { ...DELTA_CURRENT, path: ZETA_PATH, name: "Zeta" } },
-  );
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check("a timed-out save-as paints the deadline error", statusMessages.at(-1)?.label.includes("deadline") === true);
-  check(
-    "a timed-out save-as re-reads GET /workspace/file/current",
-    trafficSince(fetchesBefore) === "GET /workspace/file/current,POST /workspace/file/save-as,GET /workspace/file/current",
-  );
-  const sets = storage.sets.slice(setsBefore);
-  check(
-    "a timed-out save-as that landed writes the live state into the new file once each",
-    sets.length === 3 && [...new Set(sets.map((entry) => entry.key))].sort().join(",") === "closed_editors,layout,tree",
-  );
-  check("a timed-out save-as that landed announces the new file", window.__TAURI_EVENTS__.emitted.at(-1)?.payload?.path === ZETA_PATH);
-  check("after a timed-out save-as the tree keeps the workspace's roots", rootsOnScreen().join(",") === "C:\\delta");
-}
-
-{
-  const fetchesBefore = fetches.length;
-  const setsBefore = storage.sets.length;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Eta.rvwork";
-  answerQueue.push(
-    { status: 200, body: { ...DELTA_CURRENT, path: ZETA_PATH, name: "Zeta" } },
-    TIMED_OUT,
-    { status: 200, body: { ...DELTA_CURRENT, path: ZETA_PATH, name: "Zeta" } },
-  );
-  await Commands.execute("workbench.action.saveWorkspaceAs");
-  await flush();
-  check(
-    "a timed-out save-as that never landed re-reads GET /workspace/file/current",
-    trafficSince(fetchesBefore) === "GET /workspace/file/current,POST /workspace/file/save-as,GET /workspace/file/current",
-  );
-  check("a timed-out save-as that never landed writes nothing", storage.sets.length === setsBefore);
-  check("a timed-out save-as that never landed announces nothing", window.__TAURI_EVENTS__.emitted.length === emittedBefore);
-}
-
-// Duplicate shares the save-picker switch, and the server's duplicate
-// route the same deadline tier, so a late commit resyncs there too.
-const ZETA_COPY_PATH = "C:\\work\\Zeta copy.rvwork";
-const ZETA_COPY_CURRENT = { ...DELTA_CURRENT, path: ZETA_COPY_PATH, name: "Zeta copy" };
-{
-  const fetchesBefore = fetches.length;
-  const setsBefore = storage.sets.length;
-  const reloadsBefore = reloads;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Zeta copy";
-  answerQueue.push(
-    { status: 200, body: { ...DELTA_CURRENT, path: ZETA_PATH, name: "Zeta" } },
-    TIMED_OUT,
-    { status: 200, body: ZETA_COPY_CURRENT },
-  );
-  await Commands.execute("workbench.action.duplicateWorkspace");
-  await flush();
-  check("a timed-out duplicate paints the deadline error", statusMessages.at(-1)?.label.includes("deadline") === true);
-  check(
-    "a timed-out duplicate re-reads GET /workspace/file/current",
-    trafficSince(fetchesBefore) === "GET /workspace/file/current,POST /workspace/file/duplicate,GET /workspace/file/current",
-  );
-  check("a timed-out duplicate that landed announces the copy", window.__TAURI_EVENTS__.emitted.at(-1)?.payload?.path === ZETA_COPY_PATH);
-  check("a timed-out duplicate that landed writes no workspace state", storage.sets.length === setsBefore);
-  check("a timed-out duplicate that landed applies no layout", reloads === reloadsBefore && dock.fromJSONCalls.length === fromJsonBefore);
-  check("after a timed-out duplicate the tree keeps the workspace's roots", rootsOnScreen().join(",") === "C:\\delta");
-}
-
-{
-  const fetchesBefore = fetches.length;
-  const setsBefore = storage.sets.length;
-  const reloadsBefore = reloads;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  const rootsFetchesBefore = rootsFetches;
-  const emittedBefore = window.__TAURI_EVENTS__.emitted.length;
-  window.__TAURI_DIALOG__.answer = "C:\\work\\Theta.rvwork";
-  answerQueue.push({ status: 200, body: ZETA_COPY_CURRENT }, TIMED_OUT, { status: 200, body: ZETA_COPY_CURRENT });
-  await Commands.execute("workbench.action.duplicateWorkspace");
-  await flush();
-  check(
-    "a timed-out duplicate that never landed re-reads GET /workspace/file/current",
-    trafficSince(fetchesBefore) === "GET /workspace/file/current,POST /workspace/file/duplicate,GET /workspace/file/current",
-  );
-  check("a timed-out duplicate that never landed re-lists the roots once", rootsFetches === rootsFetchesBefore + 1 && rootsOnScreen().join(",") === "C:\\delta");
-  check(
-    "a timed-out duplicate that never landed writes, applies, and announces nothing",
-    storage.sets.length === setsBefore &&
-      reloads === reloadsBefore &&
-      dock.fromJSONCalls.length === fromJsonBefore &&
-      window.__TAURI_EVENTS__.emitted.length === emittedBefore,
-  );
-}
-
-// --- Open: a file with no stored layout gets the registered policy's default ------------
-
-{
-  const IOTA_PATH = "C:\\work\\Iota.rvwork";
-  const seedsBefore = seeds;
-  const clearsBefore = dock.clears;
-  const fromJsonBefore = dock.fromJSONCalls.length;
-  fileState = { tree: { expanded: [] }, closed_editors: { paths: [] } };
-  window.__TAURI_DIALOG__.answer = IOTA_PATH;
-  answerQueue.push({ status: 200, body: { ...CURRENT, path: IOTA_PATH, name: "Iota" } });
-  await Commands.execute("workbench.action.openWorkspace");
-  await flush();
-  check("an open whose file stores no layout seeds the registered policy once", seeds === seedsBefore + 1);
-  check(
-    "the seeded default replaces the live dock without a restore",
-    dock.clears > clearsBefore && dock.fromJSONCalls.length === fromJsonBefore,
-  );
-  check(
-    "the seeded default holds the policy's anchors",
-    dock.panels.map((panel) => panel.id).sort().join(",") === "agent,tree",
-  );
-}
-
-check("every queued server answer was consumed", answerQueue.length === 0);
-
-layoutSaver.dispose();
-treeRenders.disconnect();
-title.dispose();
-dock.clear();
-followWorkspace.dispose();
-tree.dispose();
-
-if (failures.length > 0) {
-  console.error(`workspace-switch: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("workspace-switch: all assertions passed");
diff --git a/crates/workshop/ui/test/zone-stability.mjs b/crates/workshop/ui/test/zone-stability.mjs
deleted file mode 100644
index 9b88c77fe..000000000
--- a/crates/workshop/ui/test/zone-stability.mjs
+++ /dev/null
@@ -1,475 +0,0 @@
-// Integration test for zone stability (src/parts/layout/zones.ts size memory
-// and empty-group rebuild, and the restore guard in layout-persistence.ts).
-// Bundles the modules with esbuild, mounts real Dockview docks in jsdom,
-// and drives the public API. Covers: closing the last editor leaves the
-// main zone alive as an empty group at its recorded width with the side
-// zones pixel-identical; reopening an editor lands in that same group;
-// closing the last agent panel keeps the right zone; dragging a zone's
-// last panel out leaves the zone alive and empty; relocating a zone's
-// group keeps exactly one group for the zone; the layout envelope is v4
-// and omits placeholder panels; a relaunch restores the empty zones
-// at their recorded widths with no panels; a mid-session restore and a
-// reset create no extra groups; an unrelated mutation never creates a
-// zone that was never opened; and nothing in the document reads
-// "Placeholder".
-// Run: node --test test/zone-stability.mjs
-import { readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      // The dock lifecycle reads the closed-editor stack through its token;
-      // the implementation's module scope self-registers the empty default,
-      // so importing it here keeps close/empty-group handling working.
-      import "./src/parts/editor/closed-editors.ts";
-      // The panel types this test opens register from their contributions.
-      import "./src/parts/workspace/workspace.contribution.ts";
-      import "./src/parts/editor/editor.contribution.ts";
-      import "./src/parts/agent/agent.contribution.ts";
-      export { createDockview, themeDark } from "dockview";
-      export {
-        initZones,
-        openInZone,
-        panelIdFor,
-        resetZones,
-        zoneOfPanel,
-      } from "./src/parts/layout/zones.ts";
-      export { createPanelComponent, createPanelTabComponent } from "./src/parts/layout/panel-types.ts";
-      export { restoreLayout, buildLayoutEnvelope } from "./src/parts/layout/layout-persistence.ts";
-      export { getService } from "@workshop/platform/service-registry";
-      export { ZONE_STATE } from "./src/services/zone-state-service.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  loader: { ".css": "empty" },
-});
-
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/", pretendToBeVisual: true });
-const { window } = dom;
-
-window.matchMedia =
-  window.matchMedia ||
-  (() => ({
-    matches: false,
-    media: "",
-    addEventListener() {},
-    removeEventListener() {},
-    addListener() {},
-    removeListener() {},
-    dispatchEvent: () => false,
-  }));
-window.ResizeObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-};
-window.IntersectionObserver = class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-};
-window.Element.prototype.scrollTo = () => {};
-window.HTMLElement.prototype.scrollIntoView = () => {};
-
-// CodeMirror measurement shims; the test never asserts editor geometry.
-const zeroRect = () => ({
-  x: 0, y: 0, top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0,
-  toJSON: () => ({}),
-});
-window.Range.prototype.getBoundingClientRect = zeroRect;
-window.Range.prototype.getClientRects = () => ({
-  length: 0,
-  item: () => null,
-  [Symbol.iterator]: [][Symbol.iterator],
-});
-window.HTMLElement.prototype.getClientRects = function getClientRects() {
-  return { length: 0, item: () => null, [Symbol.iterator]: [][Symbol.iterator] };
-};
-
-// A scripted workspace API: one granted root with one file; file reads
-// serve a small text. Any other route fails the test loudly.
-const ROOT = "C:\\project";
-const FILE_A = `${ROOT}\\a.txt`;
-globalThis.fetch = async (url) => {
-  const target = typeof url === "string" ? url : url.url;
-  if (target.startsWith("/workspace/file")) {
-    const pathParam = new URL(target, "http://127.0.0.1:7910").searchParams.get("path");
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({ path: pathParam, size: 7, token: "t100", text: `text of ${pathParam}` }),
-    };
-  }
-  if (target.startsWith("/workspace/tree")) {
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        path: null,
-        entries: [{ name: "project", path: ROOT, kind: "directory", size: 0, modified_ms: 100, exists: true }],
-      }),
-    };
-  }
-  throw new Error(`unexpected fetch in the zone-stability test: ${target}`);
-};
-
-for (const key of [
-  "document",
-  "navigator",
-  "location",
-  "localStorage",
-  "Window",
-  "HTMLElement",
-  "HTMLTemplateElement",
-  "Node",
-  "Element",
-  "Event",
-  "CustomEvent",
-  "MutationObserver",
-  "Option",
-  "DOMParser",
-  "ResizeObserver",
-  "IntersectionObserver",
-  "getComputedStyle",
-  "requestAnimationFrame",
-  "cancelAnimationFrame",
-]) {
-  if (!(key in globalThis) && key in window) {
-    globalThis[key] = window[key];
-  }
-}
-globalThis.Event = window.Event;
-globalThis.CustomEvent = window.CustomEvent;
-globalThis.window = window;
-globalThis.document = window.document;
-
-// The agent panel composes an AgentSocket on init; a scripted stand-in
-// that never opens keeps the panel inert.
-globalThis.WebSocket = class {
-  static CONNECTING = 0;
-  static OPEN = 1;
-  static CLOSING = 2;
-  static CLOSED = 3;
-  readyState = 0;
-  send() {}
-  close() {}
-};
-
-const bundlePath = path.join(os.tmpdir(), "zone-stability-test.mjs");
-await writeFile(bundlePath, bundle.outputFiles[0].text);
-const {
-  createDockview,
-  themeDark,
-  initZones,
-  openInZone,
-  panelIdFor,
-  resetZones,
-  zoneOfPanel,
-  createPanelComponent,
-  createPanelTabComponent,
-  restoreLayout,
-  buildLayoutEnvelope,
-  getService,
-  ZONE_STATE,
-} = await import(pathToFileURL(bundlePath).href);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-async function flush() {
-  for (let i = 0; i < 8; i++) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-  }
-}
-
-function createDock(element) {
-  element.className = "ws-dock";
-  window.document.body.appendChild(element);
-  return createDockview(element, {
-    createComponent: createPanelComponent,
-    createTabComponent: createPanelTabComponent,
-    theme: themeDark,
-    disableFloatingGroups: true,
-    hideBorders: true,
-    locked: false,
-    noPanelsOverlay: "emptyGroup",
-  });
-}
-
-/** The zone's live group on `dock` per the zone map, or undefined. */
-function zoneGroup(dock, zone) {
-  const id = getService(ZONE_STATE).groupFor(zone);
-  return id === undefined ? undefined : dock.getGroup(id);
-}
-
-/** Every grid leaf (group record) in a serialized dockview layout. */
-function gridLeaves(node, out = []) {
-  if (node.type === "leaf") {
-    out.push(node.data);
-  } else if (node.type === "branch") {
-    for (const child of node.data ?? []) gridLeaves(child, out);
-  }
-  return out;
-}
-
-/** Every grid leaf's view ids in a serialized dockview layout. */
-function gridViewIds(node) {
-  return gridLeaves(node).flatMap((leaf) => leaf?.views ?? []);
-}
-
-// --- Closing the last editor: side zones hold, main stays as an empty group -
-
-const dock = createDock(window.document.getElementById("dock"));
-initZones(dock);
-resetZones();
-
-const treePanel = openInZone("tree", {});
-const agentPanel = openInZone("agent", {});
-const editorA = openInZone("editor", { path: FILE_A });
-await flush();
-
-// Explicit sizes stand in for the user's arrangement; jsdom has no layout.
-dock.layout(1200, 800);
-const leftGroup = treePanel.group;
-const rightGroup = agentPanel.group;
-leftGroup.api.setSize({ width: 280 });
-rightGroup.api.setSize({ width: 320 });
-editorA.group.api.setSize({ width: 600 });
-await flush();
-check(
-  "the arrangement took the scripted sizes",
-  leftGroup.api.width === 280 && rightGroup.api.width === 320 && editorA.group.api.width === 600,
-);
-
-dock.removePanel(editorA);
-await flush();
-
-const mainGroup = zoneGroup(dock, "main");
-check("closing the last editor leaves the main zone with a live group", mainGroup !== undefined);
-check("the rebuilt main group holds no panels", mainGroup?.panels.length === 0);
-check(
-  "every zone group is stamped with its zone: opened, and the rebuilt main group too",
-  treePanel.group.element.dataset.wsZone === "left" &&
-    agentPanel.group.element.dataset.wsZone === "right" &&
-    mainGroup?.element.dataset.wsZone === "main",
-);
-check("the dock keeps all three zone groups", dock.groups.length === 3);
-check("the rebuilt main group takes the recorded width", mainGroup?.api.width === 600);
-check(
-  "the side zones are pixel-identical",
-  leftGroup.api.width === 280 && rightGroup.api.width === 320,
-);
-check("the dock holds only the tree and agent panels", dock.panels.length === 2);
-
-// --- Reopening an editor lands in the same empty group ----------------------
-
-const editorB = openInZone("editor", { path: `${ROOT}\\b.txt` });
-await flush();
-check("the reopened editor lands in the rebuilt main group", editorB.group.id === mainGroup?.id);
-check("the reopened editor's group keeps its width", editorB.group.api.width === 600);
-check("the reopened editor is the main zone's only panel", editorB.group.panels.length === 1);
-check("the reopened editor reports the main zone", zoneOfPanel(editorB) === "main");
-
-// --- Closing the last agent panel keeps the right zone ----------------------
-
-dock.removePanel(agentPanel);
-await flush();
-const rightRebuilt = zoneGroup(dock, "right");
-check("closing the last agent panel leaves the right zone with a live group", rightRebuilt !== undefined);
-check("the rebuilt right group holds no panels", rightRebuilt?.panels.length === 0);
-check("the rebuilt right group is stamped as the right zone", rightRebuilt?.element.dataset.wsZone === "right");
-check("the rebuilt right group takes the recorded width", rightRebuilt?.api.width === 320);
-check("the dock still has three groups after the agent close", dock.groups.length === 3);
-
-// --- Dragging a zone's last panel out leaves the zone alive and empty -------
-
-// A panel drag onto another group is moveGroupOrPanel; the source group
-// empties and dockview removes it inside the same mutation.
-const mainBefore = editorB.group.id;
-editorB.api.moveTo({ group: rightRebuilt });
-await flush();
-check("the dragged editor lands in the right zone's group", editorB.group.id === rightRebuilt?.id);
-check("the drag-out reports the right zone for the editor", zoneOfPanel(editorB) === "right");
-const mainAfterDrag = zoneGroup(dock, "main");
-check("dragging the last panel out leaves the main zone alive", mainAfterDrag !== undefined);
-check("the main zone after the drag-out is a fresh empty group", mainAfterDrag?.panels.length === 0 && mainAfterDrag?.id !== mainBefore);
-check("the drag-out keeps three groups", dock.groups.length === 3);
-// Drag it back so the main zone holds the editor again.
-editorB.api.moveTo({ group: mainAfterDrag });
-await flush();
-check("dragging the editor back fills the empty main group", editorB.group.id === mainAfterDrag?.id);
-check("the right zone is empty again after the drag back", rightRebuilt?.panels.length === 0);
-check("the drag back keeps three groups", dock.groups.length === 3);
-
-// --- Relocating a zone's group keeps exactly one group for the zone ---------
-
-const mainGroupNow = editorB.group;
-mainGroupNow.api.moveTo({ group: leftGroup, position: "left" });
-await flush();
-check("relocating the main group keeps its id in the zone map", zoneGroup(dock, "main")?.id === mainGroupNow.id);
-check("relocating the main group creates no extra group", dock.groups.length === 3);
-check("the relocated main group still holds the editor", mainGroupNow.panels.length === 1 && editorB.group.id === mainGroupNow.id);
-mainGroupNow.api.moveTo({ group: leftGroup, position: "right" });
-await flush();
-check("relocating the main group back keeps three groups", dock.groups.length === 3);
-
-// --- The envelope: v4, no placeholder panels or views -------------------------
-
-dock.removePanel(editorB);
-await flush();
-check("the main zone survives the editor's close as an empty group", zoneGroup(dock, "main")?.panels.length === 0);
-const envelope = JSON.parse(JSON.stringify(buildLayoutEnvelope(dock)));
-check("the envelope reports schema version 5", envelope.version === 5);
-check(
-  "the envelope's panels omit placeholder ids",
-  !Object.keys(envelope.layout.panels).some((id) => id.startsWith("placeholder:")),
-);
-check(
-  "the envelope's grid views omit placeholder ids",
-  !gridViewIds(envelope.layout.grid.root).some((id) => id.startsWith("placeholder:")),
-);
-check("the envelope's only panel is the tree", Object.keys(envelope.layout.panels).join(",") === "tree");
-check(
-  "the envelope serializes three grid leaves, two of them empty",
-  gridLeaves(envelope.layout.grid.root).length === 3 &&
-    gridLeaves(envelope.layout.grid.root).filter((leaf) => leaf.views.length === 0).length === 2,
-);
-
-// --- Relaunch: both empty zones restore at recorded widths with no panels ----
-
-// initZones rebinds the module's dock, so the first dock is driven no
-// further.
-const dockRelaunched = createDock(window.document.createElement("div"));
-initZones(dockRelaunched);
-check("the saved layout restores on relaunch", restoreLayout(dockRelaunched, envelope) === true);
-// jsdom never sizes the dock element; a real relaunch lays the dock out
-// to the window, which is what applies the serialized view sizes.
-dockRelaunched.layout(1200, 800);
-await flush();
-check("the relaunch restores all three zone groups", dockRelaunched.groups.length === 3);
-check("the relaunch restores only the tree panel", dockRelaunched.panels.length === 1 && !!dockRelaunched.getPanel("tree"));
-const relaunchedMain = zoneGroup(dockRelaunched, "main");
-const relaunchedRight = zoneGroup(dockRelaunched, "right");
-check("the relaunch restores the main zone as an empty group", relaunchedMain?.panels.length === 0);
-check("the relaunch restores the right zone as an empty group", relaunchedRight?.panels.length === 0);
-check(
-  "the relaunch stamps every restored group with its zone",
-  dockRelaunched.getPanel("tree")?.group.element.dataset.wsZone === "left" &&
-    relaunchedMain?.element.dataset.wsZone === "main" &&
-    relaunchedRight?.element.dataset.wsZone === "right",
-);
-check(
-  "the relaunch restores the zones at their prior widths",
-  dockRelaunched.getPanel("tree")?.group.api.width === 280 &&
-    relaunchedMain?.api.width === 600 &&
-    relaunchedRight?.api.width === 320,
-);
-check(
-  "the relaunch marks the restored empty main group empty, and as the Workshop's active group",
-  relaunchedMain?.element.dataset.wsEmpty === "true" &&
-    relaunchedMain?.element.dataset.wsActiveGroup === "true" &&
-    relaunchedRight?.element.dataset.wsActiveGroup === undefined &&
-    dockRelaunched.getPanel("tree")?.group.element.dataset.wsActiveGroup === undefined,
-);
-const relaunchedEditor = openInZone("editor", { path: FILE_A });
-check("an editor opened after relaunch fills the restored empty main group", relaunchedEditor.group.id === relaunchedMain?.id);
-check("filling the restored main group adds no group", dockRelaunched.groups.length === 3);
-
-// --- A mid-session restore and a reset create no extra groups -----------------
-
-// The Open Workspace path applies the opened file's envelope onto a live
-// dock; fromJSON tears the live groups down first, and those removals
-// must never rebuild anything.
-const dockLive = createDock(window.document.createElement("div"));
-initZones(dockLive);
-resetZones();
-openInZone("tree", {});
-openInZone("agent", {});
-openInZone("editor", { path: FILE_A });
-await flush();
-const opened = JSON.parse(JSON.stringify(buildLayoutEnvelope(dockLive)));
-check("the mid-session restore succeeds", restoreLayout(dockLive, opened) === true);
-await flush();
-check("a mid-session restore creates no extra groups", dockLive.groups.length === 3);
-check("a mid-session restore keeps every panel in a zone group", dockLive.groups.every((group) => group.panels.length === 1));
-resetZones();
-await flush();
-check("a zone reset creates no groups", dockLive.groups.length === 3);
-
-// --- A never-opened zone is not created by an unrelated mutation -------------
-
-const dockTwo = createDock(window.document.createElement("div"));
-initZones(dockTwo);
-resetZones();
-openInZone("tree", {});
-openInZone("agent", {});
-await flush();
-const secondAgent = openInZone("agent", { instance: "second" });
-await flush();
-dockTwo.removePanel(secondAgent);
-await flush();
-check("an unrelated mutation leaves the never-opened main zone unmapped", zoneGroup(dockTwo, "main") === undefined);
-check("an unrelated mutation creates no group for the never-opened zone", dockTwo.groups.length === 2);
-check("the unrelated mutation keeps the right zone's group", zoneGroup(dockTwo, "right")?.panels.length === 1);
-
-// --- A right group created in a laid-out dock opens at the chat pane's preference ----
-
-{
-  const dockSized = createDock(window.document.createElement("div"));
-  initZones(dockSized);
-  resetZones();
-  dockSized.layout(1600, 800);
-  await flush();
-  openInZone("tree", {});
-  const agent = openInZone("agent", {});
-  await flush();
-  check(
-    "a right group created beside another opens at min(400px, W/4): 400px in a 1600px dock",
-    agent.group.api.width === 400,
-  );
-  agent.group.api.setSize({ width: 320 });
-  await flush();
-  check("the floor leaves a 320px chat pane where it is", agent.group.api.width === 320 && agent.group.minimumWidth === 300);
-  dockSized.removePanel(agent);
-  await flush();
-  check(
-    "the rebuilt right group returns to the width the pane last had",
-    zoneGroup(dockSized, "right")?.api.width === 320,
-  );
-}
-
-// --- No placeholder ever renders -------------------------------------------------
-
-check(
-  "no element in the document reads Placeholder",
-  ![...window.document.body.querySelectorAll("*")].some((element) => element.textContent === "Placeholder"),
-);
-check("the placeholder panel type is gone from panelIdFor", panelIdFor("placeholder", { zone: "main" }) === "placeholder");
-
-if (failures.length > 0) {
-  console.error(`zone-stability: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("zone-stability: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/zone-state-service.mjs b/crates/workshop/ui/test/zone-state-service.mjs
deleted file mode 100644
index 2425b5911..000000000
--- a/crates/workshop/ui/test/zone-state-service.mjs
+++ /dev/null
@@ -1,112 +0,0 @@
-// Unit test for the zone-state service (src/services/zone-state-service.ts):
-// the zone group map and per-panel placement overrides, moved out of
-// zones.ts module scope into a registry-held service so the state is
-// named, observable, and shared through the service registry. Bundles the
-// module with esbuild and drives it. Covers: self-registration (the
-// ZONE_STATE token resolves without any composition-root wiring), the
-// singleton surviving across lookups, group id round-trips and reverse
-// lookup, override set/clear, serialize/restore/reset with validation of
-// persisted shapes, and the change event firing on override writes.
-// Run: node test/zone-state-service.mjs
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      export { ZoneStateService, ZONE_STATE } from "./src/services/zone-state-service.ts";
-      export { ZONE_NAMES } from "@workshop/platform/panel-registry";
-      export { getService } from "@workshop/platform/service-registry";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-});
-const { ZoneStateService, ZONE_STATE, ZONE_NAMES, getService } = await import(
-  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
-);
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// --- Self-registration and the singleton ------------------------------------
-
-const service = getService(ZONE_STATE);
-check("the ZONE_STATE token self-registers", service instanceof ZoneStateService);
-check("the registry caches one instance", getService(ZONE_STATE) === service);
-check("the declared zones are left, main, right", ZONE_NAMES.join(",") === "left,main,right");
-
-// --- Group ids ----------------------------------------------------------------
-
-service.reset();
-check("an unknown zone has no group", service.groupFor("left") === undefined);
-service.setGroup("left", "g1");
-check("the group id round-trips", service.groupFor("left") === "g1");
-check("the reverse lookup names the zone", service.zoneForGroupId("g1") === "left");
-check("an unknown group id has no zone", service.zoneForGroupId("nope") === undefined);
-
-// --- Overrides ------------------------------------------------------------------
-
-let changes = 0;
-const subscription = service.onDidChange(() => {
-  changes += 1;
-});
-check("a panel without an override has none", service.overrideFor("editor:x") === undefined);
-service.setOverride("editor:x", "right");
-check("the override round-trips", service.overrideFor("editor:x") === "right");
-check("setting an override fires the change event", changes === 1);
-service.clearOverride("editor:x");
-check("clearing removes the override", service.overrideFor("editor:x") === undefined);
-check("clearing fires the change event", changes === 2);
-subscription.dispose();
-
-// --- Serialize / restore / reset -------------------------------------------------
-
-service.setGroup("main", "g9");
-service.setOverride("agent", "main");
-const snapshot = service.serialize();
-check(
-  "serialize returns the zones and overrides records",
-  snapshot.zones.main === "g9" && snapshot.overrides.agent === "main",
-);
-
-const restored = new ZoneStateService();
-restored.restore(snapshot.zones, snapshot.overrides);
-check(
-  "restore round-trips the state",
-  restored.groupFor("main") === "g9" && restored.overrideFor("agent") === "main",
-);
-restored.restore({ left: 42, bogus: "g" }, { "editor:x": "nowhere", "editor:y": "left" });
-check(
-  "restore drops unknown zones and non-string values",
-  restored.groupFor("left") === undefined &&
-    restored.groupFor("bogus") === undefined &&
-    restored.overrideFor("editor:x") === undefined &&
-    restored.overrideFor("editor:y") === "left",
-);
-restored.reset();
-check(
-  "reset clears groups and overrides",
-  restored.groupFor("main") === undefined && restored.overrideFor("agent") === undefined,
-);
-
-service.dispose();
-
-if (failures.length > 0) {
-  console.error(`zone-state-service: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("zone-state-service: all assertions passed");
-process.exit(0);
diff --git a/crates/workshop/ui/test/zoom.mjs b/crates/workshop/ui/test/zoom.mjs
deleted file mode 100644
index 41f11af94..000000000
--- a/crates/workshop/ui/test/zoom.mjs
+++ /dev/null
@@ -1,341 +0,0 @@
-// Unit test for the global zoom (src/parts/chrome/zoom.ts) and its menu
-// rows, registered by the chrome contribution
-// (src/parts/chrome/chrome.contribution.ts) into View > Appearance. Bundles
-// the TS modules with esbuild into one
-// module graph - so the menu rows and the test all
-// share one zoom state - with "@tauri-apps/api/window" and
-// "@tauri-apps/api/webviewWindow" aliased to recording stubs in
-// test/helpers, and drives them against jsdom built from the real
-// index.html. Covers: the zoom math (a factor of 1.2 per level, levels
-// -8 to 8, reset to level 0), the browser fallback's CSS zoom application,
-// the zoom factor custom property the title bar's window controls divide
-// by to keep their physical size, the write-through
-// to the UI-state adapter's user bucket and the restore from it across a
-// reload (a stored factor snaps to the nearest level), corrupt and
-// out-of-range stored values falling back to the
-// default, a failing writer leaving the zoom applied and logged, the
-// Appearance flyout's zoom rows with their shortcut hints, and the
-// desktop path routing zoom to the native webview. The Ctrl+= /
-// Ctrl+Shift+= / Ctrl+- / Ctrl+NumPad+ / Ctrl+NumPad- / Ctrl+NumPad0 /
-// Ctrl+0 keybinding assertions
-// live in test/gateway-config-menu.mjs with the dispatcher.
-// Overlay anchoring at non-1.0 zoom is a visual check,
-// deferred out of jsdom scope.
-// Run: node test/zoom.mjs
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import * as esbuild from "esbuild";
-import { JSDOM } from "jsdom";
-import { createFakeUiStorage } from "./helpers/ui-storage.mjs";
-
-const uiDir = path.dirname(fileURLToPath(import.meta.url));
-const html = await readFile(path.join(uiDir, "..", "index.html"), "utf8");
-
-const bundle = await esbuild.build({
-  stdin: {
-    contents: `
-      import "./src/parts/chrome/chrome.contribution.ts";
-      export { Menu } from "./src/parts/menu/menu.ts";
-      export {
-        getZoom,
-        getZoomLevel,
-        persistZoom,
-        restoreZoom,
-        resetZoom,
-        zoomIn,
-        zoomOut,
-      } from "./src/parts/chrome/zoom.ts";
-    `,
-    resolveDir: path.join(uiDir, ".."),
-    loader: "ts",
-  },
-  bundle: true,
-  write: false,
-  format: "esm",
-  platform: "browser",
-  target: "es2022",
-  logLevel: "silent",
-  // The modules under test import their colocated CSS; strip it - the
-  // test drives only the JS, and jsdom applies no stylesheets anyway.
-  loader: { ".css": "empty" },
-  alias: {
-    "@tauri-apps/api/window": path.join(uiDir, "helpers", "tauri-window-stub.mjs"),
-    "@tauri-apps/api/webviewWindow": path.join(uiDir, "helpers", "tauri-webview-stub.mjs"),
-  },
-});
-const bundleCode = bundle.outputFiles[0].text;
-
-// Each import of a fresh data URL is a fresh module instance with its own
-// zoom state - the same thing a reload produces. The unique comment
-// defeats the module map's URL-keyed cache.
-let instanceCounter = 0;
-async function freshModule() {
-  instanceCounter += 1;
-  const code = `${bundleCode}\n// instance ${instanceCounter}`;
-  return import(`data:text/javascript;base64,${Buffer.from(code).toString("base64")}`);
-}
-
-const failures = [];
-function check(name, condition) {
-  if (!condition) failures.push(name);
-}
-
-// The user-bucket key the composition root binds the zoom to.
-const KEY = "zoom";
-
-// Binds a module instance's zoom writer to a fake adapter the way main.ts
-// binds the live one; the fake's `sets` records every write.
-function bindStorage(module, initial = {}) {
-  const storage = createFakeUiStorage(initial);
-  module.persistZoom((value) => storage.set("user", KEY, value));
-  return storage;
-}
-
-// Each scenario gets a fresh jsdom (fresh DOM) plus a fresh module
-// instance. Pass desktop: true to exercise the native webview path
-// through the recording stub.
-async function scenario({ desktop = false } = {}) {
-  const dom = new JSDOM(html, { url: "http://127.0.0.1:7910/" });
-  const { window } = dom;
-  if (desktop) {
-    window.__TAURI_INTERNALS__ = {};
-  }
-  globalThis.window = window;
-  globalThis.document = window.document;
-  globalThis.Element = window.Element;
-  globalThis.HTMLElement = window.HTMLElement;
-  globalThis.HTMLInputElement = window.HTMLInputElement;
-  globalThis.HTMLTextAreaElement = window.HTMLTextAreaElement;
-  globalThis.Node = window.Node;
-  const module = await freshModule();
-  const webviewZooms = () => window.__TAURI_WEBVIEW_STUB__?.zooms ?? [];
-  return { window, module, webviewZooms };
-}
-
-// --- Zoom math: 1.2 per level, levels -8 to 8, reset to level 0 -------------
-
-{
-  const { window, module } = await scenario();
-  check("zoom starts at 100%", module.getZoom() === 1 && module.getZoomLevel() === 0);
-  module.zoomIn();
-  check("zoomIn steps up one level, a factor of 1.2", module.getZoom() === 1.2 && module.getZoomLevel() === 1);
-  module.zoomIn();
-  check("the factor compounds per level: 1.2 squared", module.getZoom() === 1.44 && module.getZoomLevel() === 2);
-  module.zoomIn();
-  check("the factor is rounded to four decimals", module.getZoom() === 1.728);
-  module.resetZoom();
-  module.zoomOut();
-  check("zoomOut steps down one level, a factor of 1/1.2", module.getZoom() === 0.8333 && module.getZoomLevel() === -1);
-  module.zoomOut();
-  check("zoomOut compounds below 100%", module.getZoom() === 0.6944 && module.getZoomLevel() === -2);
-  for (let i = 0; i < 20; i++) module.zoomIn();
-  check("zoomIn clamps at level 8", module.getZoomLevel() === 8 && module.getZoom() === 4.2998);
-  for (let i = 0; i < 30; i++) module.zoomOut();
-  check("zoomOut clamps at level -8", module.getZoomLevel() === -8 && module.getZoom() === 0.2326);
-  module.resetZoom();
-  check("resetZoom returns to level 0 and 100%", module.getZoom() === 1 && module.getZoomLevel() === 0);
-  module.zoomIn();
-  check(
-    "the browser fallback applies CSS zoom to the root element",
-    window.document.documentElement.style.zoom === "1.2",
-  );
-  check(
-    "the zoom factor custom property tracks the level so window controls can divide it out",
-    window.document.documentElement.style.getPropertyValue("--ws-zoom-factor") === "1.2",
-  );
-  module.resetZoom();
-  check(
-    "resetting zoom resets the custom property",
-    window.document.documentElement.style.getPropertyValue("--ws-zoom-factor") === "1",
-  );
-  module.zoomIn();
-  check(
-    "the browser fallback positions body for the overlay workaround",
-    window.document.body.style.position === "relative",
-  );
-}
-
-// --- Persistence: the factor survives a reload ------------------------------
-
-{
-  const first = await scenario();
-  const storage = bindStorage(first.module);
-  first.module.zoomIn();
-  first.module.zoomIn();
-  check(
-    "each zoom step writes the bare factor to the user bucket",
-    storage.sets.length === 2 &&
-      storage.sets.every((entry) => entry.bucket === "user" && entry.key === KEY) &&
-      storage.sets.map((entry) => entry.value).join(",") === "1.2,1.44",
-  );
-  // A reload: a fresh module instance over the same window, seeded from
-  // the value the last write stored.
-  const reloaded = await freshModule();
-  check("a reload boots at the default until restored", reloaded.getZoom() === 1);
-  const reloadedStorage = bindStorage(reloaded, { user: { [KEY]: storage.get("user", KEY) } });
-  reloaded.restoreZoom(reloadedStorage.get("user", KEY));
-  check("a reload restores the persisted factor as its level", reloaded.getZoom() === 1.44 && reloaded.getZoomLevel() === 2);
-  check(
-    "the restore re-applies CSS zoom to the root element",
-    first.window.document.documentElement.style.zoom === "1.44",
-  );
-  check("the restore does not echo the factor back to the writer", reloadedStorage.sets.length === 0);
-}
-
-// --- Persistence: the writer installed with persistZoom is replaceable -----
-
-{
-  const { module } = await scenario();
-  const first = bindStorage(module);
-  const disposable = module.persistZoom(() => {
-    throw new Error("must not be called after dispose");
-  });
-  disposable.dispose();
-  module.zoomIn();
-  check(
-    "disposing an installed writer restores the no-op, not an earlier writer",
-    first.sets.length === 0 && module.getZoom() === 1.2,
-  );
-}
-
-// --- Persistence: corrupt and out-of-range values fall back -----------------
-
-{
-  const { module } = await scenario();
-  for (const bad of [
-    "garbage",
-    "1.2",
-    5,
-    0.1,
-    0,
-    -1.2,
-    Number.POSITIVE_INFINITY,
-    Number.NaN,
-    null,
-    undefined,
-    { factor: 1.2 },
-    [1.2],
-  ]) {
-    module.restoreZoom(bad);
-    check(
-      `a corrupt stored value (${String(bad)}) falls back to 100%`,
-      module.getZoom() === 1,
-    );
-  }
-  module.restoreZoom(0.2326);
-  check("the lower bound restores", module.getZoom() === 0.2326 && module.getZoomLevel() === -8);
-  module.restoreZoom(4.2998);
-  check("the upper bound restores", module.getZoom() === 4.2998 && module.getZoomLevel() === 8);
-  module.resetZoom();
-  // An off-grid factor snaps to the nearest level.
-  module.restoreZoom(1.1);
-  check("an off-grid factor snaps up to the nearest level", module.getZoomLevel() === 1 && module.getZoom() === 1.2);
-  module.restoreZoom(0.7);
-  check("an off-grid factor snaps down to the nearest level", module.getZoomLevel() === -2 && module.getZoom() === 0.6944);
-}
-
-// --- Persistence: a failing writer does not block the zoom -------------------
-
-{
-  const { window, module } = await scenario();
-  module.persistZoom(() => {
-    throw new Error("denied");
-  });
-  const errors = [];
-  const originalError = console.error;
-  console.error = (...args) => {
-    errors.push(args);
-  };
-  let escaped = false;
-  try {
-    module.zoomIn();
-  } catch {
-    escaped = true;
-  }
-  console.error = originalError;
-  check("a writer failure does not escape the zoom", escaped === false);
-  check("the zoom still applies when the writer fails", module.getZoom() === 1.2);
-  check(
-    "the CSS fallback still applies when the writer fails",
-    window.document.documentElement.style.zoom === "1.2",
-  );
-  check("a writer failure is logged", errors.length === 1);
-}
-
-// --- Appearance flyout: the zoom rows dispatch the registered actions --------
-
-{
-  const { window, module } = await scenario();
-  const anchor = window.document.createElement("button");
-  anchor.type = "button";
-  window.document.body.appendChild(anchor);
-  const menu = new module.Menu();
-  const popover = () =>
-    [...window.document.querySelectorAll(".ws-window-titlebar__popover")].find((el) => !el.hidden);
-  const rowByLabel = (label) =>
-    [...popover().querySelectorAll(":scope > .ws-window-titlebar__item")].find(
-      (item) => item.querySelector(".ws-window-titlebar__item-label").textContent === label,
-    );
-  menu.open("menubar/view/appearance", anchor);
-  const zoomInRow = rowByLabel("Zoom In");
-  const zoomOutRow = rowByLabel("Zoom Out");
-  const resetRow = rowByLabel("Reset Zoom");
-  check(
-    "the Appearance flyout lists the zoom rows",
-    zoomInRow !== undefined && zoomOutRow !== undefined && resetRow !== undefined,
-  );
-  check(
-    "the zoom rows show their shortcut hints",
-    zoomInRow?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+=" &&
-      zoomOutRow?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+-" &&
-      resetRow?.querySelector(".ws-window-titlebar__shortcut")?.textContent === "Ctrl+NumPad0",
-  );
-  zoomInRow.click();
-  check("the menu's Zoom In zooms in", module.getZoom() === 1.2);
-  check("running Zoom In closes the menu", popover() === undefined);
-  menu.open("menubar/view/appearance", anchor);
-  rowByLabel("Zoom Out").click();
-  check("the menu's Zoom Out zooms out", module.getZoom() === 1);
-  menu.open("menubar/view/appearance", anchor);
-  rowByLabel("Zoom In").click();
-  menu.open("menubar/view/appearance", anchor);
-  rowByLabel("Reset Zoom").click();
-  check("the menu's Reset Zoom returns to 100%", module.getZoom() === 1);
-  menu.dispose();
-}
-
-// --- Desktop: viewport-aware zoom routes through the native webview -----------
-
-{
-  const { window, module, webviewZooms } = await scenario({ desktop: true });
-  const storage = bindStorage(module);
-  module.zoomIn();
-  check("desktop zoom goes to the native webview", webviewZooms().join(",") === "1.2");
-  check(
-    "desktop zoom leaves CSS zoom untouched",
-    window.document.documentElement.style.zoom === "" &&
-      window.document.body.style.position === "",
-  );
-  check(
-    "desktop zoom still publishes the factor for the window controls to divide out",
-    window.document.documentElement.style.getPropertyValue("--ws-zoom-factor") === "1.2",
-  );
-  check(
-    "desktop zoom still persists the factor",
-    storage.sets.length === 1 && storage.get("user", KEY) === 1.2,
-  );
-  const reloaded = await freshModule();
-  reloaded.restoreZoom(storage.get("user", KEY));
-  check(
-    "a desktop boot restores zoom through the native webview",
-    webviewZooms().join(",") === "1.2,1.2",
-  );
-}
-
-if (failures.length > 0) {
-  console.error(`zoom: ${failures.length} failure(s)`);
-  for (const failure of failures) console.error(`  - ${failure}`);
-  process.exit(1);
-}
-console.log("zoom: all assertions passed");
diff --git a/crates/workshop/ui/tsconfig.json b/crates/workshop/ui/tsconfig.json
deleted file mode 100644
index b7e851550..000000000
--- a/crates/workshop/ui/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "noEmit": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "verbatimModuleSyntax": true,
-    "noFallthroughCasesInSwitch": true,
-    "forceConsistentCasingInFileNames": true
-  },
-  "include": ["src"]
-}
diff --git a/crates/workshop/user-state/Cargo.toml b/crates/workshop/user-state/Cargo.toml
deleted file mode 100644
index c7af75b31..000000000
--- a/crates/workshop/user-state/Cargo.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-[package]
-name = "workshop-user-state"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[features]
-default = []
-
-[dependencies]
-axum.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-tracing.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-support.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-tower.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/user-state/src/error.rs b/crates/workshop/user-state/src/error.rs
deleted file mode 100644
index 0cddfe5e7..000000000
--- a/crates/workshop/user-state/src/error.rs
+++ /dev/null
@@ -1,98 +0,0 @@
-//! The user-state operation failure type and its wire mapping.
-//!
-//! [`UserStateError`] is the boundary between the store's refusals
-//! and its caller: a put names the key it refused or the size
-//! it exceeded, and a failed write surfaces the I/O cause. At the route
-//! boundary each variant maps to exactly one status code and one
-//! machine-readable envelope code, rendered through `workshop-protocol`'s
-//! [`ErrorEnvelope`]. Internal failure detail (the source chain) reaches
-//! the response body in debug builds only; production bodies stay at
-//! each variant's own message.
-
-use std::io;
-
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-
-use workshop_protocol::ErrorEnvelope;
-use workshop_support::{LEAK_DETAIL, StateBucketError, envelope_response, render_message};
-
-use crate::store::USER_STATE_KEYS;
-
-/// A user-state operation failure.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum UserStateError {
-    /// A put named a key outside the allow-list. The message lists the
-    /// allow-list itself so it cannot drift from the keys.
-    #[non_exhaustive]
-    #[error(
-        "user-state key {0:?} is not allowed; one of {allowed} is required",
-        allowed = USER_STATE_KEYS.join(", ")
-    )]
-    Key(String),
-
-    /// A value's JSON text exceeds the size cap.
-    #[non_exhaustive]
-    #[error("user-state value is {actual} bytes; at most {cap} bytes are allowed")]
-    TooLarge {
-        /// The size of the refused value.
-        actual: usize,
-        /// The cap it exceeded.
-        cap: usize,
-    },
-
-    /// A put body does not parse as JSON.
-    #[non_exhaustive]
-    #[error("user-state value is not JSON")]
-    NotJson {
-        /// The parse refusal.
-        #[source]
-        source: serde_json::Error,
-    },
-
-    /// The state file could not be written.
-    #[non_exhaustive]
-    #[error("user-state file cannot be written")]
-    Io(#[source] io::Error),
-}
-
-impl UserStateError {
-    /// The one HTTP status this failure answers with.
-    fn status(&self) -> StatusCode {
-        match self {
-            Self::Key(_) | Self::NotJson { .. } => StatusCode::BAD_REQUEST,
-            Self::TooLarge { .. } => StatusCode::PAYLOAD_TOO_LARGE,
-            Self::Io(_) => StatusCode::INTERNAL_SERVER_ERROR,
-        }
-    }
-
-    /// The machine-readable code of the JSON error envelope.
-    fn code(&self) -> &'static str {
-        match self {
-            Self::Key(_) => "user_state_key",
-            Self::TooLarge { .. } => "user_state_too_large",
-            Self::NotJson { .. } => "user_state_not_json",
-            Self::Io(_) => "user_state_io",
-        }
-    }
-}
-
-impl IntoResponse for UserStateError {
-    fn into_response(self) -> Response {
-        let envelope = ErrorEnvelope::new(render_message(&self, LEAK_DETAIL), self.code());
-        envelope_response(self.status(), &envelope)
-    }
-}
-
-impl From<StateBucketError> for UserStateError {
-    /// Maps a shared state-bucket refusal onto this crate's wire error,
-    /// preserving each refusal's own message.
-    fn from(error: StateBucketError) -> Self {
-        match error {
-            StateBucketError::Key(key) => Self::Key(key),
-            StateBucketError::TooLarge { actual, cap } => Self::TooLarge { actual, cap },
-            StateBucketError::NotJson { source } => Self::NotJson { source },
-        }
-    }
-}
diff --git a/crates/workshop/user-state/src/handlers-tests.rs b/crates/workshop/user-state/src/handlers-tests.rs
deleted file mode 100644
index c2e48c574..000000000
--- a/crates/workshop/user-state/src/handlers-tests.rs
+++ /dev/null
@@ -1,294 +0,0 @@
-//! The `/user/state` routes over HTTP: four nulls before any put, a
-//! put-then-get round trip per key that also survives a fresh store over
-//! the same directory, the three refusals (unknown key, over-cap body,
-//! non-JSON body) each answering the envelope and leaving the state
-//! untouched, and the write failure answering the server-error envelope
-//! while the value stands in memory.
-
-use super::*;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use tower::ServiceExt as _;
-use workshop_support::STATE_BUCKET_VALUE_CAP;
-
-use crate::store::USER_STATE_FILE;
-
-/// Collects a response body already buffered in memory and parses it.
-async fn json_body(response: Response) -> serde_json::Value {
-    let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already");
-    serde_json::from_slice(&bytes).expect("the body is JSON")
-}
-
-/// Builds a `GET /user/state` request.
-fn get_request() -> Request<Body> {
-    Request::builder()
-        .uri("/user/state")
-        .body(Body::empty())
-        .expect("static request parts are valid")
-}
-
-/// Builds a `PUT /user/state/{key}` request with a raw body.
-fn put_request(key: &str, body: impl Into<Body>) -> Request<Body> {
-    Request::builder()
-        .method("PUT")
-        .uri(format!("/user/state/{key}"))
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(body.into())
-        .expect("static request parts are valid")
-}
-
-/// Sends `request` through a fresh router over `store`.
-async fn send(store: &Arc<UserStateStore>, request: Request<Body>) -> Response {
-    routes(Arc::clone(store))
-        .oneshot(request)
-        .await
-        .expect("the router is infallible")
-}
-
-/// The GET body of `store` as it stands.
-async fn state_of(store: &Arc<UserStateStore>) -> serde_json::Value {
-    let response = send(store, get_request()).await;
-    assert_eq!(response.status(), StatusCode::OK);
-    json_body(response).await
-}
-
-/// A store over a fresh temp directory.
-fn fresh_store(dir: &tempfile::TempDir) -> Arc<UserStateStore> {
-    Arc::new(UserStateStore::new(dir.path()))
-}
-
-/// What every key reads as before any put.
-fn all_null() -> serde_json::Value {
-    serde_json::json!({
-        "editor_settings": null,
-        "zoom": null,
-        "recent_files": null,
-        "commands_history": null,
-    })
-}
-
-/// One distinct value per allow-listed key.
-fn sample_values() -> [(&'static str, serde_json::Value); 4] {
-    [
-        (
-            "editor_settings",
-            serde_json::json!({ "wordWrap": "on", "renderWhitespace": "none" }),
-        ),
-        ("zoom", serde_json::json!(1.25)),
-        (
-            "recent_files",
-            serde_json::json!(["C:\\projects\\zebra\\a.md", "C:\\projects\\zebra\\b.md"]),
-        ),
-        (
-            "commands_history",
-            serde_json::json!(["workbench.action.files.save"]),
-        ),
-    ]
-}
-
-#[tokio::test]
-async fn get_on_an_empty_store_returns_four_nulls_and_creates_no_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-
-    assert_eq!(
-        state_of(&store).await,
-        all_null(),
-        "every allow-listed key is present and null before any put"
-    );
-    assert!(
-        !dir.path().join(USER_STATE_FILE).exists(),
-        "a read never creates the state file"
-    );
-}
-
-#[tokio::test]
-async fn put_then_get_round_trips_each_key_and_survives_a_fresh_store() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-
-    for (key, value) in sample_values() {
-        let response = send(&store, put_request(key, value.to_string())).await;
-        assert_eq!(response.status(), StatusCode::OK, "for {key}");
-        assert_eq!(
-            json_body(response).await,
-            serde_json::json!({ "saved": true })
-        );
-        assert_eq!(
-            state_of(&store).await[key],
-            value,
-            "{key} reads back exactly as put"
-        );
-    }
-    let expected: serde_json::Value = sample_values()
-        .into_iter()
-        .map(|(key, value)| (key.to_owned(), value))
-        .collect::<serde_json::Map<_, _>>()
-        .into();
-    assert_eq!(state_of(&store).await, expected);
-
-    let reborn = fresh_store(&dir);
-    assert_eq!(
-        state_of(&reborn).await,
-        expected,
-        "the route wrote through to the file, not only to memory"
-    );
-}
-
-#[tokio::test]
-async fn a_put_replaces_the_earlier_value() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-    let first = send(&store, put_request("zoom", "1.5")).await;
-    assert_eq!(first.status(), StatusCode::OK, "the first put must land");
-    assert_eq!(state_of(&store).await["zoom"], serde_json::json!(1.5));
-
-    let response = send(&store, put_request("zoom", "2")).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(state_of(&store).await["zoom"], serde_json::json!(2));
-}
-
-#[tokio::test]
-async fn an_unknown_key_is_refused_and_the_state_stands() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-
-    let response = send(&store, put_request("layout", "{}")).await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "user_state_key");
-    let message = json["error"]["message"]
-        .as_str()
-        .expect("the envelope includes a message");
-    assert!(
-        message.contains("editor_settings, zoom, recent_files, commands_history"),
-        "the refusal names what is allowed: {message}"
-    );
-    assert_eq!(state_of(&store).await, all_null());
-    assert!(
-        !dir.path().join(USER_STATE_FILE).exists(),
-        "a refused put creates no file"
-    );
-}
-
-#[tokio::test]
-async fn an_over_cap_body_is_refused_and_the_state_stands() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-    let body = format!("\"{}\"", "x".repeat(STATE_BUCKET_VALUE_CAP - 1));
-    assert_eq!(
-        body.len(),
-        STATE_BUCKET_VALUE_CAP + 1,
-        "one byte past the cap"
-    );
-
-    let response = send(&store, put_request("zoom", body)).await;
-
-    assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "user_state_too_large");
-    let message = json["error"]["message"]
-        .as_str()
-        .expect("the envelope includes a message");
-    assert!(
-        message.contains(&format!("{} bytes", STATE_BUCKET_VALUE_CAP + 1))
-            && message.contains(&format!("{STATE_BUCKET_VALUE_CAP} bytes")),
-        "the refusal names actual and cap: {message}"
-    );
-    assert_eq!(state_of(&store).await, all_null());
-    assert!(
-        !dir.path().join(USER_STATE_FILE).exists(),
-        "a refused put creates no file"
-    );
-}
-
-#[tokio::test]
-async fn a_body_exactly_at_the_cap_is_accepted() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-    let body = format!("\"{}\"", "x".repeat(STATE_BUCKET_VALUE_CAP - 2));
-    assert_eq!(body.len(), STATE_BUCKET_VALUE_CAP);
-
-    let response = send(&store, put_request("zoom", body)).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        state_of(&store).await["zoom"],
-        serde_json::Value::String("x".repeat(STATE_BUCKET_VALUE_CAP - 2))
-    );
-}
-
-#[tokio::test]
-async fn a_non_json_body_is_refused_and_the_state_stands() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-
-    for body in ["{", "", "not json at all"] {
-        let response = send(&store, put_request("zoom", body)).await;
-        assert_eq!(
-            response.status(),
-            StatusCode::BAD_REQUEST,
-            "for body {body:?}"
-        );
-        let json = json_body(response).await;
-        assert_eq!(json["error"]["code"], "user_state_not_json", "for {body:?}");
-    }
-    let response = send(
-        &store,
-        put_request("zoom", Body::from(vec![0xff, 0xfe, b'"'])),
-    )
-    .await;
-    assert_eq!(
-        response.status(),
-        StatusCode::BAD_REQUEST,
-        "bytes that are not UTF-8 are not JSON either"
-    );
-    assert_eq!(
-        json_body(response).await["error"]["code"],
-        "user_state_not_json"
-    );
-    assert_eq!(state_of(&store).await, all_null());
-    assert!(
-        !dir.path().join(USER_STATE_FILE).exists(),
-        "a refused put creates no file"
-    );
-}
-
-#[tokio::test]
-async fn an_unknown_key_is_refused_before_the_body_is_judged() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = fresh_store(&dir);
-
-    let response = send(&store, put_request("layout", "{")).await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(
-        json_body(response).await["error"]["code"],
-        "user_state_key",
-        "the key refusal wins over the body refusal"
-    );
-}
-
-#[tokio::test]
-async fn a_failed_write_answers_the_server_error_envelope_and_keeps_the_value() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // A directory in the file's place: the rename over it fails.
-    std::fs::create_dir(dir.path().join(USER_STATE_FILE)).expect("directory in the file's place");
-    let store = fresh_store(&dir);
-
-    let response = send(&store, put_request("zoom", "3")).await;
-
-    assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "user_state_io");
-    assert_eq!(
-        state_of(&store).await["zoom"],
-        serde_json::json!(3),
-        "the in-memory value is the source of truth; a failed persist is degradation"
-    );
-}
diff --git a/crates/workshop/user-state/src/handlers.rs b/crates/workshop/user-state/src/handlers.rs
deleted file mode 100644
index a36125eda..000000000
--- a/crates/workshop/user-state/src/handlers.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-//! The `/user/state` route handlers: the opaque account-scoped ui-state
-//! bucket. `GET` answers every allow-listed key with its value or
-//! `null`; `PUT /{key}` stores one value and answers `saved: true`.
-//!
-//! The body is taken raw rather than through the `Json` extractor so
-//! that every refusal - an unknown key, a body over the cap, a body that
-//! is not JSON - reaches the wire as the crate's own [`UserStateError`]
-//! envelope instead of axum's plain-text rejection. The key is judged
-//! first, then the body's size, then its shape, so the client is told
-//! about the cheapest mistake. The raw body still passes through axum's
-//! default body limit (2 MiB) before it reaches the handler; that hard
-//! stop answers axum's own 413.
-
-use std::sync::Arc;
-
-use axum::Json;
-use axum::body::Bytes;
-use axum::extract::{Path, State};
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, put};
-use serde_json::Value;
-
-use workshop_support::{DEFAULT_DEADLINE, StateBucketValue, with_deadline};
-
-use crate::error::UserStateError;
-use crate::store::{USER_STATE_KEYS, UserStateStore};
-
-/// The user-state routes, narrowed to the [`UserStateStore`] - the only
-/// state their handlers use - under the default deadline tier. The
-/// subsystem registers this constructor into the registry; the server
-/// merges its result into the API router.
-pub fn routes(store: Arc<UserStateStore>) -> axum::Router {
-    with_deadline(
-        axum::Router::new()
-            .route("/user/state", get(get_state))
-            .route("/user/state/{key}", put(put_state))
-            .with_state(store),
-        DEFAULT_DEADLINE,
-    )
-}
-
-/// Reports every user-state value the store holds, keyed by its
-/// allow-listed name, `null` where nothing has been put.
-async fn get_state(State(store): State<Arc<UserStateStore>>) -> Response {
-    let document: serde_json::Map<String, Value> = store
-        .all()
-        .await
-        .into_iter()
-        .map(|(key, value)| (key.to_owned(), value.unwrap_or(Value::Null)))
-        .collect();
-    respond(Ok(Value::Object(document)))
-}
-
-/// Stores the JSON body under `key`. A refused key or body answers the
-/// envelope and changes nothing; a failed write answers the server-error
-/// envelope while the value stands in memory.
-async fn put_state(
-    State(store): State<Arc<UserStateStore>>,
-    Path(key): Path<String>,
-    body: Bytes,
-) -> Response {
-    respond(store_value(&store, &key, &body).await)
-}
-
-/// Validates the key, then the body's size, then its shape, and only
-/// then hands the value to the store.
-async fn store_value(
-    store: &UserStateStore,
-    key: &str,
-    body: &[u8],
-) -> Result<Value, UserStateError> {
-    let value = StateBucketValue::new(key, &USER_STATE_KEYS, body)?;
-    store.put(value).await?;
-    Ok(serde_json::json!({ "saved": true }))
-}
-
-/// Renders a user-state result as JSON, routing failures through the
-/// [`UserStateError`] wire envelope.
-fn respond(result: Result<Value, UserStateError>) -> Response {
-    match result {
-        Ok(value) => (StatusCode::OK, Json(value)).into_response(),
-        Err(error) => error.into_response(),
-    }
-}
-
-#[cfg(test)]
-#[path = "handlers-tests.rs"]
-mod tests;
diff --git a/crates/workshop/user-state/src/handles.rs b/crates/workshop/user-state/src/handles.rs
deleted file mode 100644
index 484475c7a..000000000
--- a/crates/workshop/user-state/src/handles.rs
+++ /dev/null
@@ -1,37 +0,0 @@
-//! The user-state subsystem's registration and any handle types. It
-//! registers its `/user/state` routes, merged into the server's API
-//! router, and the store as the subsystem's state handle, so the
-//! composition root fetches it by slot instead of holding it by name.
-
-use std::sync::Arc;
-
-use workshop_registry::{Registration, Registry, RouteRegistrarAdapter};
-
-use crate::handlers;
-use crate::store::UserStateStore;
-
-/// The user-state subsystem's registration guards: its routes and its
-/// state handle. Dropping them deregisters the subsystem.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the subsystem"]
-pub struct UserStateRegistrations {
-    /// The `/user/state` route registrar.
-    pub routes: Registration,
-    /// The store as the subsystem's state handle.
-    pub state: Registration,
-}
-
-/// Registers the user-state subsystem into the registry: its
-/// `/user/state` routes, merged into the server's API router, and the
-/// store as the subsystem's state handle, so the composition root
-/// fetches it by slot instead of holding it by name. The returned guards
-/// keep the registrations alive; the composition root holds them for the
-/// process lifetime.
-pub fn register(registry: &Registry, store: Arc<UserStateStore>) -> UserStateRegistrations {
-    let routes = registry.register_routes(Arc::new(RouteRegistrarAdapter::new({
-        let store = Arc::clone(&store);
-        move || handlers::routes(Arc::clone(&store))
-    })));
-    let state = registry.register_state::<UserStateStore>(store);
-    UserStateRegistrations { routes, state }
-}
diff --git a/crates/workshop/user-state/src/lib.rs b/crates/workshop/user-state/src/lib.rs
deleted file mode 100644
index 753096271..000000000
--- a/crates/workshop/user-state/src/lib.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-//! workshop-user-state - the account-scoped UI state bucket: the values
-//! the Workshop SPA keeps per user rather than per workspace (editor
-//! settings, zoom, recent files, command history), persisted as one
-//! JSON file in the server's state directory and served over
-//! `/user/state`.
-//!
-//! ## Invariants
-//!
-//! - Tier: feature; may depend on: `workshop-protocol`,
-//!   `workshop-registry`, `workshop-support`. Never on
-//!   `workshop-workspace`, `workshop-server`, or any `gateway-*` or
-//!   `runvil-*` crate. `cargo test -p build-xtask` enforces the product
-//!   and container boundaries.
-//! - The SPA owns every value's schema.
-//! - One writer: every put updates the in-memory map under one mutex and
-//!   rewrites the whole file through the shared atomic-write helper, so
-//!   a crash leaves the old document or the new, never a truncation.
-//! - A missing, unreadable, or corrupt file reads as "no state yet"; a
-//!   refused put is a value returned to the caller and writes nothing.
-//! - The crate maps its own [`UserStateError`] to the wire envelope at
-//!   its route boundary; no server error type appears here.
-
-mod error;
-mod handlers;
-mod handles;
-mod store;
-
-pub use error::UserStateError;
-pub use handlers::routes;
-pub use handles::{UserStateRegistrations, register};
-pub use store::{USER_STATE_KEYS, UserStateStore};
diff --git a/crates/workshop/user-state/src/store-tests.rs b/crates/workshop/user-state/src/store-tests.rs
deleted file mode 100644
index 76002e3ca..000000000
--- a/crates/workshop/user-state/src/store-tests.rs
+++ /dev/null
@@ -1,205 +0,0 @@
-//! The user-state store's file round trip and its tolerated failures:
-//! a missing or corrupt file reads as empty, and a put writes the whole
-//! document atomically.
-
-use std::collections::BTreeMap;
-use std::path::Path;
-
-use serde_json::{Value, json};
-use workshop_support::{STATE_BUCKET_VALUE_CAP, StateBucketValue};
-
-use super::*;
-
-/// A validated put of `value` under `key`, as the route builds one.
-fn bucket(key: &str, value: &Value) -> StateBucketValue {
-    StateBucketValue::new(key, &USER_STATE_KEYS, value.to_string().as_bytes())
-        .expect("the fixture is a valid put")
-}
-
-/// Every file name in `dir`, sorted, so a test can assert exactly what a
-/// write left behind.
-fn dir_names(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = std::fs::read_dir(dir)
-        .expect("readable dir")
-        .map(|entry| {
-            entry
-                .expect("entry")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-/// The map every key present and no value: what an empty store serves.
-fn all_null() -> BTreeMap<&'static str, Option<Value>> {
-    USER_STATE_KEYS.iter().map(|key| (*key, None)).collect()
-}
-
-#[tokio::test]
-async fn a_missing_file_yields_all_null_and_creates_nothing() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = UserStateStore::new(dir.path());
-    assert_eq!(store.all().await, all_null());
-    assert!(
-        dir_names(dir.path()).is_empty(),
-        "construction alone writes no file"
-    );
-}
-
-#[tokio::test]
-async fn a_put_round_trips_through_a_fresh_store() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    {
-        let store = UserStateStore::new(dir.path());
-        store
-            .put(bucket("zoom", &json!(1.25)))
-            .await
-            .expect("an allow-listed value under the cap is stored");
-        store
-            .put(bucket("recent_files", &json!(["C:/a.md", "C:/b.md"])))
-            .await
-            .expect("an allow-listed value under the cap is stored");
-    }
-    let reborn = UserStateStore::new(dir.path());
-    let state = reborn.all().await;
-    assert_eq!(state["zoom"], Some(json!(1.25)));
-    assert_eq!(state["recent_files"], Some(json!(["C:/a.md", "C:/b.md"])));
-    assert_eq!(
-        state["editor_settings"], None,
-        "an unset key reads as absent"
-    );
-    assert_eq!(
-        state["commands_history"], None,
-        "an unset key reads as absent"
-    );
-}
-
-#[tokio::test]
-async fn a_corrupt_file_yields_all_null_and_the_next_put_replaces_it() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join(USER_STATE_FILE);
-    std::fs::write(&path, "not json {").expect("write fixture");
-    let store = UserStateStore::new(dir.path());
-    assert_eq!(
-        store.all().await,
-        all_null(),
-        "corrupt state degrades to no state, never to a failure"
-    );
-    store
-        .put(bucket("zoom", &json!(2)))
-        .await
-        .expect("the put succeeds over a corrupt file");
-    let document: Value =
-        serde_json::from_slice(&std::fs::read(&path).expect("readable")).expect("valid json");
-    assert_eq!(
-        document,
-        json!({ "zoom": 2 }),
-        "the corrupt text is replaced by the whole current document"
-    );
-}
-
-#[tokio::test]
-async fn a_non_object_document_yields_all_null() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(dir.path().join(USER_STATE_FILE), "[1, 2, 3]").expect("write fixture");
-    let store = UserStateStore::new(dir.path());
-    assert_eq!(
-        store.all().await,
-        all_null(),
-        "valid JSON of the wrong shape is corrupt state"
-    );
-}
-
-#[tokio::test]
-async fn a_write_leaves_no_temp_and_the_file_holds_the_full_document() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = UserStateStore::new(dir.path());
-    store
-        .put(bucket("editor_settings", &json!({ "wordWrap": "on" })))
-        .await
-        .expect("stored");
-    store
-        .put(bucket(
-            "commands_history",
-            &json!(["workbench.action.files.save"]),
-        ))
-        .await
-        .expect("stored");
-    assert_eq!(
-        dir_names(dir.path()),
-        [USER_STATE_FILE],
-        "the state file is the only thing left behind; no .rv-tmp remains"
-    );
-    let document: Value =
-        serde_json::from_slice(&std::fs::read(dir.path().join(USER_STATE_FILE)).expect("readable"))
-            .expect("valid json");
-    assert_eq!(
-        document,
-        json!({
-            "editor_settings": { "wordWrap": "on" },
-            "commands_history": ["workbench.action.files.save"],
-        }),
-        "each put rewrites the whole document, so the earlier key survives the later put"
-    );
-}
-
-#[tokio::test]
-async fn a_value_exactly_at_the_cap_is_accepted() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let store = UserStateStore::new(dir.path());
-    // A JSON string's text is its content plus two quotes.
-    let at_cap = Value::String("x".repeat(STATE_BUCKET_VALUE_CAP - 2));
-    store
-        .put(bucket("zoom", &at_cap))
-        .await
-        .expect("a value at the cap is under the limit, not over it");
-    assert_eq!(store.all().await["zoom"], Some(at_cap));
-}
-
-#[tokio::test]
-async fn an_unwritable_state_dir_reports_io_and_keeps_the_value_in_memory() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    // A directory in the file's place: the rename over it fails for a
-    // reason other than NotFound.
-    std::fs::create_dir(dir.path().join(USER_STATE_FILE)).expect("directory in the file's place");
-    let store = UserStateStore::new(dir.path());
-    let error = store
-        .put(bucket("zoom", &json!(1)))
-        .await
-        .expect_err("renaming over a directory must fail");
-    assert!(
-        matches!(error, UserStateError::Io(_)),
-        "the write failure is reported as I/O: {error:?}"
-    );
-    assert_eq!(
-        store.all().await["zoom"],
-        Some(json!(1)),
-        "the in-memory state is the source of truth; a failed persist is degradation"
-    );
-}
-
-#[tokio::test]
-async fn unknown_keys_in_the_file_are_preserved_but_not_served() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join(USER_STATE_FILE);
-    std::fs::write(&path, r#"{"zoom": 3, "future_key": true}"#).expect("write fixture");
-    let store = UserStateStore::new(dir.path());
-    let state = store.all().await;
-    assert_eq!(state["zoom"], Some(json!(3)));
-    assert_eq!(
-        state.len(),
-        USER_STATE_KEYS.len(),
-        "only allow-listed keys are served"
-    );
-    store.put(bucket("zoom", &json!(4))).await.expect("stored");
-    let document: Value =
-        serde_json::from_slice(&std::fs::read(&path).expect("readable")).expect("valid json");
-    assert_eq!(
-        document,
-        json!({ "zoom": 4, "future_key": true }),
-        "a key this build does not know survives a rewrite"
-    );
-}
diff --git a/crates/workshop/user-state/src/store.rs b/crates/workshop/user-state/src/store.rs
deleted file mode 100644
index 2bf92c2fe..000000000
--- a/crates/workshop/user-state/src/store.rs
+++ /dev/null
@@ -1,155 +0,0 @@
-//! The user-state store: the in-memory document, its tolerant load, and
-//! the off-executor atomic rewrite on every put.
-
-use std::collections::BTreeMap;
-use std::io;
-use std::path::{Path, PathBuf};
-
-use serde_json::{Map, Value};
-use tokio::sync::Mutex;
-use workshop_support::StateBucketValue;
-
-use crate::error::UserStateError;
-
-/// The keys the user bucket accepts.
-pub const USER_STATE_KEYS: [&str; 4] = [
-    "editor_settings",
-    "zoom",
-    "recent_files",
-    "commands_history",
-];
-
-/// Name of the persisted user-state file, written in the server's state
-/// directory.
-pub(crate) const USER_STATE_FILE: &str = "ui-state.json";
-
-/// The account-scoped UI state document: one JSON object in the state
-/// directory, held in memory and rewritten whole on every put.
-///
-/// The in-memory map is the source of truth. A key this build does not
-/// know is kept in the map and rewritten with the rest, so a newer
-/// build's value survives a round trip through this one, but only the
-/// allow-listed keys are served.
-#[derive(Debug)]
-pub struct UserStateStore {
-    /// Where the document persists: `state_dir/ui-state.json`.
-    path: PathBuf,
-    /// The current document, under the single writer's lock. The lock is
-    /// held across the write so two puts cannot land their rewrites out
-    /// of order.
-    state: Mutex<Map<String, Value>>,
-}
-
-impl UserStateStore {
-    /// Opens the store over `state_dir/ui-state.json`, reading the file
-    /// tolerantly: a missing, unreadable, or corrupt file means "no state
-    /// yet" - logged and tolerated. Nothing is created until
-    /// the first put.
-    #[must_use]
-    pub fn new(state_dir: &Path) -> Self {
-        let path = state_dir.join(USER_STATE_FILE);
-        let state = load_document(&path);
-        Self {
-            path,
-            state: Mutex::new(state),
-        }
-    }
-
-    /// Every allow-listed key with its stored value, `None` when never
-    /// saved.
-    pub async fn all(&self) -> BTreeMap<&'static str, Option<Value>> {
-        let state = self.state.lock().await;
-        USER_STATE_KEYS
-            .iter()
-            .map(|key| (*key, state.get(*key).cloned()))
-            .collect()
-    }
-
-    /// Stores the validated `put` under its key, replacing any earlier
-    /// value, and rewrites the whole document atomically. A failed write
-    /// leaves the new value in memory: the map is the source of truth and
-    /// the file is its mirror.
-    ///
-    /// # Errors
-    /// Returns [`UserStateError::Io`] when the write fails.
-    pub async fn put(&self, put: StateBucketValue) -> Result<(), UserStateError> {
-        let key = put.key();
-        let mut state = self.state.lock().await;
-        state.insert(key.to_owned(), put.into_value());
-        // Serializing a map of already-parsed values cannot fail; a
-        // failure here is a serde_json invariant break, reported as I/O
-        // rather than panicking the server.
-        let bytes =
-            serde_json::to_vec(&*state).map_err(|error| UserStateError::Io(error.into()))?;
-        let path = self.path.clone();
-        let written =
-            tokio::task::spawn_blocking(move || workshop_support::write_atomic(&path, &bytes))
-                .await
-                .unwrap_or_else(|join| Err(io::Error::other(join)));
-        drop(state);
-        written.map_err(|error| {
-            tracing::warn!(
-                %error,
-                path = %self.path.display(),
-                "user state write failed; value kept in memory, not persisted"
-            );
-            UserStateError::Io(error)
-        })
-    }
-}
-
-/// Loads the document at `path`. A missing file is the ordinary "no
-/// state yet" and is silent; an unreadable file, one that does not parse,
-/// or one whose top level is not an object is corrupt state: logged once
-/// and read as empty, to be replaced whole by the next put.
-fn load_document(path: &Path) -> Map<String, Value> {
-    let raw = match std::fs::read(path) {
-        Ok(raw) => raw,
-        Err(error) => {
-            if error.kind() != io::ErrorKind::NotFound {
-                tracing::warn!(
-                    %error,
-                    path = %path.display(),
-                    "user state unreadable; starting with no state"
-                );
-            }
-            return Map::new();
-        }
-    };
-    match serde_json::from_slice::<Value>(&raw) {
-        Ok(Value::Object(document)) => document,
-        Ok(other) => {
-            tracing::warn!(
-                path = %path.display(),
-                found = other_kind(&other),
-                "user state is not a JSON object; starting with no state"
-            );
-            Map::new()
-        }
-        Err(error) => {
-            tracing::warn!(
-                %error,
-                path = %path.display(),
-                "user state corrupt; starting with no state"
-            );
-            Map::new()
-        }
-    }
-}
-
-/// The JSON kind of a value that is not the object the document requires,
-/// for the corrupt-shape warning.
-fn other_kind(value: &Value) -> &'static str {
-    match value {
-        Value::Null => "null",
-        Value::Bool(_) => "boolean",
-        Value::Number(_) => "number",
-        Value::String(_) => "string",
-        Value::Array(_) => "array",
-        Value::Object(_) => "object",
-    }
-}
-
-#[cfg(test)]
-#[path = "store-tests.rs"]
-mod tests;
diff --git a/crates/workshop/user-state/tests/it/main.rs b/crates/workshop/user-state/tests/it/main.rs
deleted file mode 100644
index d1ec969ce..000000000
--- a/crates/workshop/user-state/tests/it/main.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-//! Integration tests for `workshop-user-state`: the registration
-//! contract - the `/user/state` routes and the store's state handle
-//! served through the registry's contribution collections.
-
-use std::sync::Arc;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use tower::ServiceExt as _;
-use workshop_registry::Registry;
-use workshop_user_state::{UserStateStore, register};
-
-#[tokio::test]
-async fn the_registered_routes_write_through_to_the_registered_store() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let registry = Registry::new();
-    let store = Arc::new(UserStateStore::new(dir.path()));
-    let _guards = register(&registry, Arc::clone(&store));
-
-    let registrars = registry.routes();
-    assert_eq!(registrars.len(), 1, "the routes collection is registered");
-    let request = Request::builder()
-        .method("PUT")
-        .uri("/user/state/zoom")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from("1.5"))
-        .expect("static request parts are valid");
-    let response = registrars[0]
-        .routes()
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-
-    let state = registry
-        .state::<UserStateStore>()
-        .expect("the store is registered as the state handle");
-    assert!(
-        Arc::ptr_eq(&state, &store),
-        "the state handle is the caller's store"
-    );
-    assert_eq!(
-        state.all().await.get("zoom").cloned().flatten(),
-        Some(serde_json::json!(1.5)),
-        "a put through the registered routes lands in the registered store"
-    );
-}
-
-#[test]
-fn dropping_the_guards_deregisters_every_contribution() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let registry = Registry::new();
-    let guards = register(&registry, Arc::new(UserStateStore::new(dir.path())));
-    assert!(!registry.routes().is_empty());
-    assert!(registry.state::<UserStateStore>().is_some());
-    drop(guards);
-    assert!(registry.routes().is_empty());
-    assert!(registry.state::<UserStateStore>().is_none());
-}
diff --git a/crates/workshop/workspace/Cargo.toml b/crates/workshop/workspace/Cargo.toml
deleted file mode 100644
index f321db38b..000000000
--- a/crates/workshop/workspace/Cargo.toml
+++ /dev/null
@@ -1,41 +0,0 @@
-[package]
-name = "workshop-workspace"
-version = "0.0.0"
-publish = false
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[features]
-default = []
-# Exposes test seams (`Workspace::close_backing_for_test`,
-# `Workspace::stall_next_write_for_test` and its `WriteStallHandle`,
-# `routes_with_deadline`, and `create_alien_database_for_test`) to the
-# dependent crates' tests.
-test-fixtures = []
-
-[dependencies]
-axum.workspace = true
-dunce.workspace = true
-humantime.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio.workspace = true
-tracing.workspace = true
-turso.workspace = true
-workshop-protocol.workspace = true
-workshop-registry.workspace = true
-workshop-support.workspace = true
-
-[dev-dependencies]
-# The save-timeout integration test drives `routes_with_deadline` and the
-# write stall, both behind `test-fixtures`.
-workshop-workspace = { path = ".", features = ["test-fixtures"] }
-percent-encoding.workspace = true
-tempfile.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
-tower.workspace = true
-
-[lints]
-workspace = true
diff --git a/crates/workshop/workspace/src/blocking.rs b/crates/workshop/workspace/src/blocking.rs
deleted file mode 100644
index ef2292514..000000000
--- a/crates/workshop/workspace/src/blocking.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-//! The blocking-pool seam for the workspace's filesystem work.
-//!
-//! Every `async fn` in this crate that touches the disk directly - a
-//! stat, a canonicalize, a read, a copy, a pointer write - runs that
-//! work through one of the two helpers here so a tokio executor thread
-//! never waits on I/O. Turso's own database I/O is async-native and does
-//! not come through here. A worker that panics, or is canceled at
-//! runtime shutdown, surfaces as an `io::Error` holding the join
-//! failure, the same shape `workshop-user-state` gives its atomic write.
-
-use std::io;
-
-/// Runs `work`, synchronous filesystem work, on tokio's blocking pool
-/// and hands back what it returned; a join failure is the `Err`.
-pub(crate) async fn blocking<T>(work: impl FnOnce() -> T + Send + 'static) -> io::Result<T>
-where
-    T: Send + 'static,
-{
-    tokio::task::spawn_blocking(work)
-        .await
-        .map_err(io::Error::other)
-}
-
-/// [`blocking`] for work that itself fails with `E`: the worker's own
-/// failure passes through, and a join failure is folded into `E` by
-/// `join_failed`, so the caller sees one error type.
-pub(crate) async fn try_blocking<T, E>(
-    work: impl FnOnce() -> Result<T, E> + Send + 'static,
-    join_failed: impl FnOnce(io::Error) -> E,
-) -> Result<T, E>
-where
-    T: Send + 'static,
-    E: Send + 'static,
-{
-    match blocking(work).await {
-        Ok(result) => result,
-        Err(source) => Err(join_failed(source)),
-    }
-}
diff --git a/crates/workshop/workspace/src/error-tests.rs b/crates/workshop/workspace/src/error-tests.rs
deleted file mode 100644
index 909fe2b4e..000000000
--- a/crates/workshop/workspace/src/error-tests.rs
+++ /dev/null
@@ -1,259 +0,0 @@
-//! Workspace error tests: wire-code mapping, the JSON envelope, and debug-only source chains.
-
-use super::*;
-
-use axum::http::header;
-
-use crate::test_support::body_bytes;
-
-/// A distinctive injected cause for leak-boundary assertions.
-fn injected_io() -> io::Error {
-    io::Error::other("injected disk failure")
-}
-
-/// Every workspace failure answers with its pinned status, code, and
-/// message.
-#[test]
-fn workspace_failures_keep_their_wire_mapping() {
-    let cases: Vec<(WorkspaceError, StatusCode, &str)> = vec![
-        (
-            WorkspaceError::ResolveGrant {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "resolve_grant",
-        ),
-        (
-            WorkspaceError::ResolvePath {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "resolve_path",
-        ),
-        (
-            WorkspaceError::InspectPath {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "inspect_path",
-        ),
-        (
-            WorkspaceError::ListDirectory {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "list_directory",
-        ),
-        (
-            WorkspaceError::ReadFile {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "read_file",
-        ),
-        (
-            WorkspaceError::WriteFile {
-                source: injected_io(),
-            },
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "write_file",
-        ),
-        (
-            WorkspaceError::OutsideGrants,
-            StatusCode::FORBIDDEN,
-            "outside_grants",
-        ),
-        (
-            WorkspaceError::ForbiddenComponent,
-            StatusCode::FORBIDDEN,
-            "forbidden_component",
-        ),
-        (WorkspaceError::NotFound, StatusCode::NOT_FOUND, "not_found"),
-        (
-            WorkspaceError::NotGranted,
-            StatusCode::NOT_FOUND,
-            "not_granted",
-        ),
-        (
-            WorkspaceError::NotADirectory,
-            StatusCode::BAD_REQUEST,
-            "not_a_directory",
-        ),
-        (
-            WorkspaceError::NotAFile,
-            StatusCode::BAD_REQUEST,
-            "not_a_file",
-        ),
-        (
-            WorkspaceError::BinaryFile,
-            StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            "binary_file",
-        ),
-        (
-            WorkspaceError::NotUtf8 {
-                source: String::from_utf8(vec![0xff]).unwrap_err(),
-            },
-            StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            "not_utf8",
-        ),
-        (
-            WorkspaceError::FileTooLarge { limit: 7 },
-            StatusCode::PAYLOAD_TOO_LARGE,
-            "file_too_large",
-        ),
-        (
-            WorkspaceError::ModifiedConflict,
-            StatusCode::CONFLICT,
-            "modified_conflict",
-        ),
-    ];
-    for (error, status, code) in cases {
-        assert_eq!(error.status(), status, "status for {code}");
-        assert_eq!(error.code(), code, "code for {code}");
-    }
-}
-
-/// A refused ui-state put is the client's mistake: a foreign key or
-/// non-JSON text is a bad request, an oversized value is too large, and
-/// each message names what was required.
-#[test]
-fn ui_state_refusals_map_to_client_errors() {
-    let key = WorkspaceError::UiStateKey("window".to_string());
-    assert_eq!(key.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(key.code(), "ui_state_key");
-    let message = render_message(&key, false);
-    assert_eq!(
-        message,
-        "ui-state key \"window\" is not allowed; one of layout, tree, closed_editors is required"
-    );
-    for allowed in crate::workspace_file::UI_STATE_KEYS {
-        assert!(
-            message.contains(allowed),
-            "the message names every allow-listed key; missing {allowed}"
-        );
-    }
-
-    let large = WorkspaceError::UiStateTooLarge { actual: 9, cap: 8 };
-    assert_eq!(large.status(), StatusCode::PAYLOAD_TOO_LARGE);
-    assert_eq!(large.code(), "ui_state_too_large");
-    assert_eq!(
-        render_message(&large, false),
-        "ui-state value is 9 bytes; at most 8 bytes are allowed"
-    );
-
-    let refusal = serde_json::from_str::<serde_json::Value>("{not json").unwrap_err();
-    let not_json = WorkspaceError::UiStateNotJson { source: refusal };
-    assert_eq!(not_json.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(not_json.code(), "ui_state_not_json");
-    assert_eq!(
-        render_message(&not_json, false),
-        "ui-state value is not JSON"
-    );
-    assert!(
-        render_message(&not_json, true).starts_with("ui-state value is not JSON: "),
-        "the leaked chain names the parse refusal"
-    );
-}
-
-/// The file-backed failures map to their own statuses and codes: a
-/// refused file is the client's mistake, a taken path is a conflict,
-/// and everything else is the server's problem.
-#[test]
-fn workspace_file_failures_map_to_their_wire_codes() {
-    let refused = WorkspaceError::from(WorkspaceFileError::UnsupportedVersion {
-        found: "2".to_string(),
-        supported: "1",
-    });
-    assert_eq!(refused.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(refused.code(), "workspace_file_refused");
-    assert_eq!(
-        render_message(&refused, false),
-        "workspace file version 2 is unsupported; this build supports version 1",
-        "the required-versus-actual text reaches production bodies"
-    );
-
-    let alien = WorkspaceError::from(WorkspaceFileError::NotAWorkspace {
-        path: std::path::PathBuf::from("alien.rvwork"),
-    });
-    assert_eq!(alien.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(alien.code(), "workspace_file_refused");
-
-    let taken = WorkspaceError::from(WorkspaceFileError::Io {
-        source: io::Error::new(io::ErrorKind::AlreadyExists, "taken"),
-    });
-    assert_eq!(taken.status(), StatusCode::CONFLICT);
-    assert_eq!(taken.code(), "workspace_file_taken");
-
-    let missing = WorkspaceError::from(WorkspaceFileError::Io {
-        source: io::Error::new(io::ErrorKind::NotFound, "missing"),
-    });
-    assert_eq!(missing.status(), StatusCode::NOT_FOUND);
-    assert_eq!(missing.code(), "not_found");
-
-    let closed = WorkspaceError::from(WorkspaceFileError::Closed);
-    assert_eq!(closed.status(), StatusCode::INTERNAL_SERVER_ERROR);
-    assert_eq!(closed.code(), "workspace_file_failed");
-    assert_eq!(
-        render_message(&closed, true),
-        "workspace file operation failed: workspace file is closed",
-        "debug bodies still chain the file failure"
-    );
-}
-
-#[tokio::test]
-async fn the_json_envelope_has_message_code_and_content_type() {
-    let response = WorkspaceError::OutsideGrants.into_response();
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let content_type = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .expect("the envelope sets content-type");
-    assert_eq!(content_type, "application/json");
-    let body = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&body).expect("the envelope is JSON");
-    assert_eq!(
-        json["error"]["message"],
-        "path is outside every granted root"
-    );
-    assert_eq!(json["error"]["code"], "outside_grants");
-}
-
-#[test]
-fn production_messages_stay_at_the_variant_text() {
-    let read = WorkspaceError::ReadFile {
-        source: injected_io(),
-    };
-    assert_eq!(
-        render_message(&read, false),
-        "file cannot be read",
-        "production bodies omit the source detail"
-    );
-}
-
-#[test]
-fn debug_messages_append_the_source_chain() {
-    let read = WorkspaceError::ReadFile {
-        source: injected_io(),
-    };
-    assert_eq!(
-        render_message(&read, true),
-        "file cannot be read: injected disk failure"
-    );
-}
-
-/// Tests run under debug assertions, so the live envelope must include
-/// the detail the debug side of the boundary promises.
-#[cfg(debug_assertions)]
-#[tokio::test]
-async fn debug_builds_leak_detail_into_the_live_envelope() {
-    let response = WorkspaceError::ReadFile {
-        source: injected_io(),
-    }
-    .into_response();
-    let body = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&body).expect("the envelope is JSON");
-    assert_eq!(
-        json["error"]["message"],
-        "file cannot be read: injected disk failure"
-    );
-}
diff --git a/crates/workshop/workspace/src/error.rs b/crates/workshop/workspace/src/error.rs
deleted file mode 100644
index 4c8e8911e..000000000
--- a/crates/workshop/workspace/src/error.rs
+++ /dev/null
@@ -1,283 +0,0 @@
-//! The workspace operation failure type and its wire mapping.
-//!
-//! [`WorkspaceError`] is the boundary between a workspace operation's
-//! failures and the HTTP response: each variant maps to exactly one
-//! status code and one machine-readable envelope code, rendered through
-//! `workshop-protocol`'s [`ErrorEnvelope`] at the route boundary.
-//! Internal failure detail (the source chain) reaches the response body
-//! in debug builds only; production bodies stay at each variant's own
-//! message.
-
-use std::io;
-
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-
-use workshop_protocol::ErrorEnvelope;
-use workshop_support::{LEAK_DETAIL, StateBucketError, envelope_response, render_message};
-
-use crate::workspace_file::{UI_STATE_KEYS, WorkspaceFileError};
-
-/// A workspace operation failure.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum WorkspaceError {
-    /// A granted path could not be canonicalized.
-    #[non_exhaustive]
-    #[error("grant path cannot be resolved")]
-    ResolveGrant {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// A requested path could not be canonicalized.
-    #[non_exhaustive]
-    #[error("requested path cannot be resolved")]
-    ResolvePath {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// Filesystem metadata for a path could not be read.
-    #[non_exhaustive]
-    #[error("path cannot be inspected")]
-    InspectPath {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// A directory could not be listed.
-    #[non_exhaustive]
-    #[error("directory cannot be listed")]
-    ListDirectory {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// A file could not be read.
-    #[non_exhaustive]
-    #[error("file cannot be read")]
-    ReadFile {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// A file could not be written.
-    #[non_exhaustive]
-    #[error("file cannot be written")]
-    WriteFile {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// The path is not inside any granted root.
-    #[error("path is outside every granted root")]
-    OutsideGrants,
-
-    /// The path contains a `..` or an alternate data stream name.
-    #[error("path contains a forbidden component")]
-    ForbiddenComponent,
-
-    /// The path does not exist.
-    #[error("path does not exist")]
-    NotFound,
-
-    /// A revoke named a path that is not a granted root.
-    #[error("path is not a granted root")]
-    NotGranted,
-
-    /// A tree listing was requested for something that is not a directory.
-    #[error("path is not a directory")]
-    NotADirectory,
-
-    /// A read or write targeted something that is not a regular file.
-    #[error("path is not a file")]
-    NotAFile,
-
-    /// The file contains NUL bytes and is not editable text.
-    #[error("file is binary, not text")]
-    BinaryFile,
-
-    /// The file is not valid UTF-8.
-    #[non_exhaustive]
-    #[error("file is not utf-8 text")]
-    NotUtf8 {
-        /// Where the bytes stopped being UTF-8.
-        #[source]
-        source: std::string::FromUtf8Error,
-    },
-
-    /// The file or body exceeds the size limit.
-    #[non_exhaustive]
-    #[error("file exceeds the {limit}-byte size limit")]
-    FileTooLarge {
-        /// The size limit that was exceeded.
-        limit: u64,
-    },
-
-    /// The on-disk conflict token does not match the writer's token.
-    #[error("file changed on disk since it was read")]
-    ModifiedConflict,
-
-    /// A workspace file was refused: not a Runvil workspace, or one
-    /// at a schema version this build does not read. The message is the
-    /// refusal's own required-versus-actual text.
-    #[non_exhaustive]
-    #[error(transparent)]
-    WorkspaceFileRefused {
-        /// The refusal.
-        source: WorkspaceFileError,
-    },
-
-    /// A save-as or duplicate named a path that already exists.
-    #[error("workspace file path is already taken; a path with no file at it is required")]
-    WorkspaceFileTaken,
-
-    /// The workspace file could not be read, written, or copied.
-    #[non_exhaustive]
-    #[error("workspace file operation failed")]
-    WorkspaceFileFailed {
-        /// The underlying file failure.
-        #[source]
-        source: WorkspaceFileError,
-    },
-
-    /// A ui-state put named a key outside the allow-list. The message
-    /// lists the allow-list itself so it cannot drift from the keys.
-    #[non_exhaustive]
-    #[error(
-        "ui-state key {0:?} is not allowed; one of {allowed} is required",
-        allowed = UI_STATE_KEYS.join(", ")
-    )]
-    UiStateKey(String),
-
-    /// A ui-state value exceeds the size cap.
-    #[non_exhaustive]
-    #[error("ui-state value is {actual} bytes; at most {cap} bytes are allowed")]
-    UiStateTooLarge {
-        /// The size of the refused value.
-        actual: usize,
-        /// The cap it exceeded.
-        cap: usize,
-    },
-
-    /// A ui-state value does not parse as JSON.
-    #[non_exhaustive]
-    #[error("ui-state value is not JSON")]
-    UiStateNotJson {
-        /// The parse refusal.
-        #[source]
-        source: serde_json::Error,
-    },
-}
-
-impl From<WorkspaceFileError> for WorkspaceError {
-    /// Sorts a file failure into the wire shape the client can act on: a
-    /// missing file is the ordinary not-found, a taken path a conflict,
-    /// a refused stamp the client's mistake, and the rest the server's.
-    fn from(source: WorkspaceFileError) -> Self {
-        match source {
-            WorkspaceFileError::NotAWorkspace { .. }
-            | WorkspaceFileError::UnsupportedVersion { .. } => {
-                Self::WorkspaceFileRefused { source }
-            }
-            WorkspaceFileError::Io { source: ref cause }
-                if cause.kind() == io::ErrorKind::NotFound =>
-            {
-                Self::NotFound
-            }
-            WorkspaceFileError::Io { source: ref cause }
-                if cause.kind() == io::ErrorKind::AlreadyExists =>
-            {
-                Self::WorkspaceFileTaken
-            }
-            WorkspaceFileError::Io { .. }
-            | WorkspaceFileError::Database { .. }
-            | WorkspaceFileError::Closed => Self::WorkspaceFileFailed { source },
-        }
-    }
-}
-
-impl WorkspaceError {
-    /// The one HTTP status this failure answers with.
-    fn status(&self) -> StatusCode {
-        match self {
-            Self::NotADirectory
-            | Self::NotAFile
-            | Self::WorkspaceFileRefused { .. }
-            | Self::UiStateKey(_)
-            | Self::UiStateNotJson { .. } => StatusCode::BAD_REQUEST,
-            Self::OutsideGrants | Self::ForbiddenComponent => StatusCode::FORBIDDEN,
-            Self::NotFound | Self::NotGranted => StatusCode::NOT_FOUND,
-            Self::BinaryFile | Self::NotUtf8 { .. } => StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            Self::FileTooLarge { .. } | Self::UiStateTooLarge { .. } => {
-                StatusCode::PAYLOAD_TOO_LARGE
-            }
-            Self::ModifiedConflict | Self::WorkspaceFileTaken => StatusCode::CONFLICT,
-            Self::ResolveGrant { .. }
-            | Self::ResolvePath { .. }
-            | Self::InspectPath { .. }
-            | Self::ListDirectory { .. }
-            | Self::ReadFile { .. }
-            | Self::WriteFile { .. }
-            | Self::WorkspaceFileFailed { .. } => StatusCode::INTERNAL_SERVER_ERROR,
-        }
-    }
-
-    /// The machine-readable code of the JSON error envelope.
-    fn code(&self) -> &'static str {
-        match self {
-            Self::ResolveGrant { .. } => "resolve_grant",
-            Self::ResolvePath { .. } => "resolve_path",
-            Self::InspectPath { .. } => "inspect_path",
-            Self::ListDirectory { .. } => "list_directory",
-            Self::ReadFile { .. } => "read_file",
-            Self::WriteFile { .. } => "write_file",
-            Self::OutsideGrants => "outside_grants",
-            Self::ForbiddenComponent => "forbidden_component",
-            Self::NotFound => "not_found",
-            Self::NotGranted => "not_granted",
-            Self::NotADirectory => "not_a_directory",
-            Self::NotAFile => "not_a_file",
-            Self::BinaryFile => "binary_file",
-            Self::NotUtf8 { .. } => "not_utf8",
-            Self::FileTooLarge { .. } => "file_too_large",
-            Self::ModifiedConflict => "modified_conflict",
-            Self::WorkspaceFileRefused { .. } => "workspace_file_refused",
-            Self::WorkspaceFileTaken => "workspace_file_taken",
-            Self::WorkspaceFileFailed { .. } => "workspace_file_failed",
-            Self::UiStateKey(_) => "ui_state_key",
-            Self::UiStateTooLarge { .. } => "ui_state_too_large",
-            Self::UiStateNotJson { .. } => "ui_state_not_json",
-        }
-    }
-}
-
-impl IntoResponse for WorkspaceError {
-    fn into_response(self) -> Response {
-        let envelope = ErrorEnvelope::new(render_message(&self, LEAK_DETAIL), self.code());
-        envelope_response(self.status(), &envelope)
-    }
-}
-
-impl From<StateBucketError> for WorkspaceError {
-    /// Maps a shared state-bucket refusal onto this crate's wire error,
-    /// preserving each refusal's own message.
-    fn from(error: StateBucketError) -> Self {
-        match error {
-            StateBucketError::Key(key) => Self::UiStateKey(key),
-            StateBucketError::TooLarge { actual, cap } => Self::UiStateTooLarge { actual, cap },
-            StateBucketError::NotJson { source } => Self::UiStateNotJson { source },
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "error-tests.rs"]
-mod tests;
diff --git a/crates/workshop/workspace/src/handlers.rs b/crates/workshop/workspace/src/handlers.rs
deleted file mode 100644
index 081cfb0d9..000000000
--- a/crates/workshop/workspace/src/handlers.rs
+++ /dev/null
@@ -1,193 +0,0 @@
-//! The `/workspace/*` route handlers: query and body DTOs and the router
-//! constructor the subsystem registers into the registry. Query paths
-//! arrive decoded once by the query layer, like the undecoded JSON body
-//! paths, so a surviving `%XX` is part of a literal name.
-
-use std::path::Path;
-
-use axum::Json;
-use axum::extract::{Query, State};
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use serde::{Deserialize, Serialize};
-
-use workshop_support::{DEFAULT_DEADLINE, with_deadline};
-
-use crate::blocking::try_blocking;
-use crate::error::WorkspaceError;
-use crate::workspace::Workspace;
-
-mod file;
-mod file_state;
-
-/// The workspace routes, narrowed to the [`Workspace`] service - the only
-/// state their handlers use: the confined filesystem routes here, the
-/// `/workspace/file/*` document routes from the `file` module, and the
-/// `/workspace/file/state` ui-state bucket from `file_state`. Every
-/// route runs under the default deadline tier.
-pub(crate) fn routes(state: Workspace) -> axum::Router {
-    build(state, DEFAULT_DEADLINE)
-}
-
-/// The workspace routes bound on an explicit deadline, exposed only to
-/// tests so the 408 is reachable without waiting out the production
-/// 10-second default.
-#[cfg(feature = "test-fixtures")]
-pub fn routes_with_deadline(state: Workspace, limit: std::time::Duration) -> axum::Router {
-    build(state, limit)
-}
-
-/// Assembles the workspace routes and bounds them on `limit`.
-fn build(state: Workspace, limit: std::time::Duration) -> axum::Router {
-    with_deadline(
-        axum::Router::new()
-            .route("/workspace/tree", get(tree))
-            .route("/workspace/file", get(read_file).put(write_file))
-            .route("/workspace/grant", post(grant))
-            .route("/workspace/revoke", post(revoke))
-            .merge(file::routes())
-            .merge(file_state::routes())
-            .with_state(state),
-        limit,
-    )
-}
-
-/// The query string of `GET /workspace/tree`.
-#[derive(Debug, Deserialize)]
-struct TreeQuery {
-    /// The directory to list; absent or empty lists the granted roots.
-    path: Option<String>,
-}
-
-/// The query string of `GET /workspace/file`.
-#[derive(Debug, Deserialize)]
-pub(crate) struct FileQuery {
-    /// The file to read.
-    path: String,
-}
-
-/// The JSON body of `PUT /workspace/file`.
-#[derive(Debug, Deserialize)]
-pub(crate) struct WriteRequest {
-    /// The file to write.
-    path: String,
-    /// The new UTF-8 contents.
-    text: String,
-    /// The conflict token the writer last read; required to match when
-    /// the file already exists.
-    expected_token: Option<String>,
-}
-
-/// The JSON body of `POST /workspace/grant`.
-#[derive(Debug, Deserialize)]
-struct GrantRequest {
-    /// The dropped path: a folder grants itself, a file grants its parent.
-    path: String,
-}
-
-/// The JSON body of a successful grant.
-#[derive(Debug, Serialize)]
-struct GrantResponse {
-    /// The root that was registered.
-    granted: std::path::PathBuf,
-}
-
-/// The JSON body of `POST /workspace/revoke`.
-#[derive(Debug, Deserialize)]
-struct RevokeRequest {
-    /// The granted root to remove, as listed by the roots tree.
-    path: String,
-}
-
-/// The JSON body of a successful revoke.
-#[derive(Debug, Serialize)]
-struct RevokeResponse {
-    /// The root that was removed.
-    revoked: std::path::PathBuf,
-}
-
-/// Lists one level of a workspace directory, or the granted roots when the
-/// query has no path. The listing is filesystem work and runs on the
-/// blocking pool; the confinement check runs inside the same call, so the
-/// check-then-use window is no wider than before.
-async fn tree(State(workspace): State<Workspace>, Query(query): Query<TreeQuery>) -> Response {
-    respond(
-        try_blocking(
-            move || workspace.tree(query.path.as_deref().map(Path::new)),
-            |source| WorkspaceError::ListDirectory { source },
-        )
-        .await,
-    )
-}
-
-/// Reads a confined UTF-8 text file with its metadata. Confinement and
-/// the read run together on the blocking pool.
-pub(crate) async fn read_file(
-    State(workspace): State<Workspace>,
-    Query(query): Query<FileQuery>,
-) -> Response {
-    respond(
-        try_blocking(
-            move || workspace.read_file(Path::new(&query.path)),
-            |source| WorkspaceError::ReadFile { source },
-        )
-        .await,
-    )
-}
-
-/// Writes a confined file after path, size, and conflict-token validation.
-/// Confinement, the token check, and the write run together on the
-/// blocking pool.
-pub(crate) async fn write_file(
-    State(workspace): State<Workspace>,
-    Json(body): Json<WriteRequest>,
-) -> Response {
-    respond(
-        try_blocking(
-            move || {
-                workspace.write_file(
-                    Path::new(&body.path),
-                    &body.text,
-                    body.expected_token.as_deref(),
-                )
-            },
-            |source| WorkspaceError::WriteFile { source },
-        )
-        .await,
-    )
-}
-
-/// Registers a dropped path as a granted root, mirrored into the open
-/// workspace file when there is one.
-async fn grant(State(workspace): State<Workspace>, Json(body): Json<GrantRequest>) -> Response {
-    respond(
-        workspace
-            .grant_and_persist(Path::new(&body.path))
-            .await
-            .map(|granted| GrantResponse { granted }),
-    )
-}
-
-/// Removes a granted root, mirrored into the open workspace file when
-/// there is one; paths under it fail their next operation.
-async fn revoke(State(workspace): State<Workspace>, Json(body): Json<RevokeRequest>) -> Response {
-    respond(
-        workspace
-            .revoke_and_persist(Path::new(&body.path))
-            .await
-            .map(|revoked| RevokeResponse { revoked }),
-    )
-}
-
-/// Renders a workspace result as JSON, routing failures through the
-/// [`WorkspaceError`] wire envelope.
-fn respond<T: Serialize>(result: Result<T, WorkspaceError>) -> Response {
-    match result {
-        Ok(value) => (StatusCode::OK, Json(value)).into_response(),
-        Err(error) => error.into_response(),
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/workspace/src/handlers/file-tests.rs b/crates/workshop/workspace/src/handlers/file-tests.rs
deleted file mode 100644
index 1552fae1f..000000000
--- a/crates/workshop/workspace/src/handlers/file-tests.rs
+++ /dev/null
@@ -1,466 +0,0 @@
-//! The `/workspace/file/*` routes over HTTP: the happy path of every
-//! endpoint against tempdir files, the refusals the client can act on
-//! (alien file, missing path, taken path), and the ephemeral no-op of
-//! the window-state write.
-
-use super::*;
-
-use std::path::PathBuf;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use tower::ServiceExt as _;
-
-use crate::handlers::routes;
-use crate::test_support::{json_body, simplified};
-use crate::workspace_file::open_database;
-
-/// Builds a request with a raw JSON body.
-fn json_request(method: &str, uri: &str, body: String) -> Request<Body> {
-    Request::builder()
-        .method(method)
-        .uri(uri)
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body))
-        .expect("static request parts are valid")
-}
-
-/// Builds a `GET /workspace/file/current` request.
-fn current_request() -> Request<Body> {
-    Request::builder()
-        .uri("/workspace/file/current")
-        .body(Body::empty())
-        .expect("static request parts are valid")
-}
-
-/// A JSON body naming `path`.
-fn path_body(path: &Path) -> String {
-    serde_json::json!({ "path": path }).to_string()
-}
-
-/// Sends `request` through a fresh clone of the workspace's router.
-async fn send(workspace: &Workspace, request: Request<Body>) -> Response {
-    routes(workspace.clone())
-        .oneshot(request)
-        .await
-        .expect("the router is infallible")
-}
-
-/// A window geometry distinguished by `width`, as the desktop app would send it.
-fn window_body(width: u32) -> String {
-    serde_json::json!({
-        "width": width,
-        "height": 700,
-        "x": 5,
-        "y": 6,
-        "maximized": false,
-    })
-    .to_string()
-}
-
-/// The sorted names of every entry directly inside `dir`.
-fn names_in(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = std::fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-#[tokio::test]
-async fn current_on_an_ephemeral_workspace_reports_no_file_and_its_grants() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant the tempdir");
-
-    let response = send(&workspace, current_request()).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let json = json_body(response).await;
-    assert_eq!(json["path"], serde_json::Value::Null);
-    assert_eq!(json["name"], "Untitled");
-    assert_eq!(json["window_state"], serde_json::Value::Null);
-    assert_eq!(
-        json["grants"],
-        serde_json::json!([{ "path": root, "exists": true }])
-    );
-}
-
-/// Pins the whole `GET /workspace/file/current` body, ephemeral and
-/// file-backed: exactly these four keys, each in this wire shape.
-#[tokio::test]
-async fn current_answers_the_pinned_json_shape() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("pinned.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant the tempdir");
-
-    assert_eq!(
-        json_body(send(&workspace, current_request()).await).await,
-        serde_json::json!({
-            "path": null,
-            "name": "Untitled",
-            "grants": [{ "path": root, "exists": true }],
-            "window_state": null,
-        }),
-        "the ephemeral body"
-    );
-
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    let saved = send(
-        &workspace,
-        json_request("PUT", "/workspace/file/window-state", window_body(1111)),
-    )
-    .await;
-    assert_eq!(saved.status(), StatusCode::OK);
-    assert_eq!(
-        json_body(send(&workspace, current_request()).await).await,
-        serde_json::json!({
-            "path": file_path.to_string_lossy(),
-            "name": "pinned",
-            "grants": [{ "path": root, "exists": true }],
-            "window_state": {
-                "width": 1111,
-                "height": 700,
-                "x": 5,
-                "y": 6,
-                "maximized": false,
-            },
-        }),
-        "the file-backed body"
-    );
-}
-
-/// A path that is not valid Unicode: a lone `0xff` byte.
-#[cfg(unix)]
-fn non_unicode_path() -> PathBuf {
-    use std::os::unix::ffi::OsStrExt as _;
-    PathBuf::from(std::ffi::OsStr::from_bytes(b"/home/lost-\xff.rvwork"))
-}
-
-/// A path that is not valid Unicode: an unpaired surrogate.
-#[cfg(windows)]
-fn non_unicode_path() -> PathBuf {
-    use std::os::windows::ffi::OsStringExt as _;
-    let mut wide: Vec<u16> = "C:\\lost-".encode_utf16().collect();
-    wide.push(0xd800);
-    wide.extend(".rvwork".encode_utf16());
-    PathBuf::from(std::ffi::OsString::from_wide(&wide))
-}
-
-#[cfg(any(unix, windows))]
-#[test]
-fn a_non_unicode_workspace_path_serializes_lossily() {
-    let path = non_unicode_path();
-    let summary = WorkspaceSummary {
-        path: Some(path.clone()),
-        name: "lost".to_owned(),
-        grants: Vec::new(),
-        window_state: None,
-    };
-
-    let json = serde_json::to_value(&summary).expect("a non-Unicode path still serializes");
-
-    assert_eq!(json["path"], path.to_string_lossy().as_ref());
-    assert!(
-        json["path"]
-            .as_str()
-            .is_some_and(|text| text.contains('\u{fffd}')),
-        "the invalid part is replaced, not dropped: {json}"
-    );
-}
-
-#[tokio::test]
-async fn save_as_then_current_shows_the_new_path_and_name() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant the tempdir");
-
-    let response = send(
-        &workspace,
-        json_request("POST", "/workspace/file/save-as", path_body(&file_path)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let json = json_body(response).await;
-    assert_eq!(json["path"], file_path.to_string_lossy().as_ref());
-    assert_eq!(json["name"], "mine");
-    assert_eq!(
-        json["grants"],
-        serde_json::json!([{ "path": root, "exists": true }])
-    );
-
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(current["path"], file_path.to_string_lossy().as_ref());
-    assert_eq!(current["name"], "mine");
-    workspace.close_backing_for_test().await;
-    assert_eq!(
-        names_in(home.path()),
-        ["mine.rvwork"],
-        "save as creates exactly the file"
-    );
-}
-
-#[tokio::test]
-async fn open_replaces_the_grants_with_the_files() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("theirs.rvwork");
-    let theirs = tempfile::TempDir::new().expect("tempdir");
-    let mine = tempfile::TempDir::new().expect("tempdir");
-    let author = Workspace::new();
-    author.grant(theirs.path()).expect("grant their root");
-    author.save_as(&file_path).await.expect("save as creates");
-    author.close_backing_for_test().await;
-
-    let workspace = Workspace::new();
-    workspace.grant(mine.path()).expect("grant my root");
-    let response = send(
-        &workspace,
-        json_request("POST", "/workspace/file/open", path_body(&file_path)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let json = json_body(response).await;
-    assert_eq!(json["path"], file_path.to_string_lossy().as_ref());
-    assert_eq!(json["name"], "theirs");
-    assert_eq!(
-        json["grants"],
-        serde_json::json!([{ "path": simplified(theirs.path()), "exists": true }]),
-        "open is wholesale: the prior grant is gone and the file's grant is in"
-    );
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![simplified(theirs.path())],
-        "the router shares the workspace's grant set"
-    );
-}
-
-#[tokio::test]
-async fn an_alien_database_is_refused_and_current_still_shows_the_prior_grants() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let alien_path = home.path().join("alien.rvwork");
-    let mine = tempfile::TempDir::new().expect("tempdir");
-    {
-        let conn = open_database(&alien_path)
-            .await
-            .expect("the alien database opens");
-        conn.execute_batch("CREATE TABLE notes (body TEXT NOT NULL);")
-            .await
-            .expect("a foreign table creates");
-    }
-    let workspace = Workspace::new();
-    let root = workspace.grant(mine.path()).expect("grant mine");
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-
-    let response = send(
-        &workspace,
-        json_request("POST", "/workspace/file/open", path_body(&alien_path)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "workspace_file_refused");
-    let message = json["error"]["message"]
-        .as_str()
-        .expect("the envelope includes a message");
-    assert!(
-        message.contains("is not a runvil workspace file"),
-        "the refusal names what was required: {message}"
-    );
-
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(
-        current["path"],
-        file_path.to_string_lossy().as_ref(),
-        "the backing stands"
-    );
-    assert_eq!(
-        current["grants"],
-        serde_json::json!([{ "path": root, "exists": true }]),
-        "the grants stand"
-    );
-}
-
-#[tokio::test]
-async fn opening_a_missing_path_answers_not_found() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-
-    let response = send(
-        &workspace,
-        json_request(
-            "POST",
-            "/workspace/file/open",
-            path_body(&home.path().join("nowhere.rvwork")),
-        ),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "not_found");
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(current["path"], serde_json::Value::Null);
-}
-
-#[tokio::test]
-async fn save_as_onto_a_taken_path_answers_conflict() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let taken = home.path().join("taken.rvwork");
-    std::fs::write(&taken, b"already here").expect("placeholder writes");
-    let workspace = Workspace::new();
-
-    let response = send(
-        &workspace,
-        json_request("POST", "/workspace/file/save-as", path_body(&taken)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::CONFLICT);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "workspace_file_taken");
-    assert_eq!(
-        std::fs::read(&taken).expect("placeholder reads"),
-        b"already here",
-        "save as never overwrites"
-    );
-}
-
-#[tokio::test]
-async fn put_window_state_while_ephemeral_is_a_no_op() {
-    let workspace = Workspace::new();
-
-    let response = send(
-        &workspace,
-        json_request("PUT", "/workspace/file/window-state", window_body(800)),
-    )
-    .await;
-
-    assert_eq!(
-        response.status(),
-        StatusCode::OK,
-        "an ephemeral save is not a failure"
-    );
-    let json = json_body(response).await;
-    assert_eq!(
-        json["saved"], false,
-        "the caller is told nothing was written"
-    );
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(current["window_state"], serde_json::Value::Null);
-}
-
-#[tokio::test]
-async fn put_window_state_on_a_file_backed_workspace_persists() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-
-    let response = send(
-        &workspace,
-        json_request("PUT", "/workspace/file/window-state", window_body(1111)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let json = json_body(response).await;
-    assert_eq!(json["saved"], true);
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(
-        current["window_state"],
-        serde_json::json!({
-            "width": 1111,
-            "height": 700,
-            "x": 5,
-            "y": 6,
-            "maximized": false,
-        })
-    );
-}
-
-#[tokio::test]
-async fn duplicate_switches_current_to_the_copy() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let original_path = home.path().join("original.rvwork");
-    let copy_path = home.path().join("copy.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant the tempdir");
-    workspace
-        .save_as(&original_path)
-        .await
-        .expect("save as creates");
-
-    let response = send(
-        &workspace,
-        json_request("POST", "/workspace/file/duplicate", path_body(&copy_path)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let json = json_body(response).await;
-    assert_eq!(json["path"], copy_path.to_string_lossy().as_ref());
-    assert_eq!(
-        json["name"], "original",
-        "the copy keeps the original's display name"
-    );
-    assert_eq!(
-        json["grants"],
-        serde_json::json!([{ "path": root, "exists": true }])
-    );
-    let current = json_body(send(&workspace, current_request()).await).await;
-    assert_eq!(
-        current["path"],
-        copy_path.to_string_lossy().as_ref(),
-        "duplicate switches to the copy"
-    );
-    workspace.close_backing_for_test().await;
-    assert_eq!(
-        names_in(home.path()),
-        ["copy.rvwork", "original.rvwork"],
-        "both files exist and neither left a sidecar once closed"
-    );
-}
-
-#[tokio::test]
-async fn a_malformed_file_body_answers_bad_request() {
-    let workspace = Workspace::new();
-    for uri in [
-        "/workspace/file/open",
-        "/workspace/file/save-as",
-        "/workspace/file/duplicate",
-    ] {
-        let response = send(&workspace, json_request("POST", uri, "{".to_owned())).await;
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST, "for {uri}");
-    }
-    let response = send(
-        &workspace,
-        json_request("PUT", "/workspace/file/window-state", "{".to_owned()),
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-}
diff --git a/crates/workshop/workspace/src/handlers/file.rs b/crates/workshop/workspace/src/handlers/file.rs
deleted file mode 100644
index 85c554016..000000000
--- a/crates/workshop/workspace/src/handlers/file.rs
+++ /dev/null
@@ -1,117 +0,0 @@
-//! The `/workspace/file/*` route handlers: the workspace as a document.
-//! What is open, opening another file, saving as, duplicating, and the
-//! window geometry the desktop app keeps in it. Every mutation answers with
-//! the workspace as it stands afterwards, so the client never needs a
-//! second round trip to learn what it switched to.
-//!
-//! Failures reach the wire through [`WorkspaceError`]'s envelope: a
-//! refused file (alien or unsupported version) is the client's mistake
-//! and includes the refusal's required-versus-actual text, a missing
-//! path is the ordinary not-found, a taken path a conflict. A refusal
-//! leaves the grants and the backing as they were.
-
-use std::path::Path;
-
-use axum::Json;
-use axum::extract::State;
-use axum::response::Response;
-use axum::routing::{get, post, put};
-use serde::{Deserialize, Serialize};
-
-use crate::error::WorkspaceError;
-use crate::workspace::{Workspace, WorkspaceSummary};
-use crate::workspace_file::WindowState;
-
-use super::respond;
-
-/// The workspace-file routes, merged into the subsystem's router by the
-/// parent module so they share its state and deadline tier.
-pub(super) fn routes() -> axum::Router<Workspace> {
-    axum::Router::new()
-        .route("/workspace/file/current", get(current_file))
-        .route("/workspace/file/open", post(open_file))
-        .route("/workspace/file/save-as", post(save_as_file))
-        .route("/workspace/file/duplicate", post(duplicate_file))
-        .route("/workspace/file/window-state", put(put_window_state))
-}
-
-/// The JSON body of `POST /workspace/file/{open,save-as,duplicate}`.
-#[derive(Debug, Deserialize)]
-struct FilePathRequest {
-    /// The workspace file to open, or the path to create the new file at.
-    path: String,
-}
-
-/// The JSON body of a `PUT /workspace/file/window-state` or
-/// `PUT /workspace/file/state/{key}` answer.
-#[derive(Debug, Serialize)]
-pub(super) struct SavedResponse {
-    /// Whether the value was written; `false` when the workspace is
-    /// ephemeral and has nowhere to keep it.
-    pub(super) saved: bool,
-}
-
-/// Reports the workspace as it stands: its file, name, grants, and
-/// saved window geometry.
-async fn current_file(State(workspace): State<Workspace>) -> Response {
-    respond(Ok::<_, WorkspaceError>(workspace.current().await))
-}
-
-/// Opens a workspace file, replacing every grant with its contents, and
-/// answers with the workspace as opened. A refused or missing file
-/// changes nothing.
-async fn open_file(
-    State(workspace): State<Workspace>,
-    Json(body): Json<FilePathRequest>,
-) -> Response {
-    let result = workspace.open_file(Path::new(&body.path)).await;
-    after_switch(&workspace, result).await
-}
-
-/// Creates a new workspace file holding the current grants and switches
-/// to it; the previous file, if any, stays where it is.
-async fn save_as_file(
-    State(workspace): State<Workspace>,
-    Json(body): Json<FilePathRequest>,
-) -> Response {
-    let result = workspace.save_as(Path::new(&body.path)).await;
-    after_switch(&workspace, result).await
-}
-
-/// Copies the current workspace file and its siblings to a new path and
-/// switches to the copy.
-async fn duplicate_file(
-    State(workspace): State<Workspace>,
-    Json(body): Json<FilePathRequest>,
-) -> Response {
-    let result = workspace.duplicate(Path::new(&body.path)).await;
-    after_switch(&workspace, result).await
-}
-
-/// Saves the desktop app's window geometry into the open workspace file. An
-/// ephemeral workspace answers success with `saved: false` and writes
-/// nothing.
-async fn put_window_state(
-    State(workspace): State<Workspace>,
-    Json(state): Json<WindowState>,
-) -> Response {
-    respond(
-        workspace
-            .put_window_state(state)
-            .await
-            .map(|saved| SavedResponse { saved }),
-    )
-}
-
-/// Renders the outcome of a switch: the workspace as it now stands on
-/// success, the failure's envelope otherwise.
-async fn after_switch(workspace: &Workspace, result: Result<(), WorkspaceError>) -> Response {
-    match result {
-        Ok(()) => respond(Ok::<_, WorkspaceError>(workspace.current().await)),
-        Err(error) => respond(Err::<WorkspaceSummary, _>(error)),
-    }
-}
-
-#[cfg(test)]
-#[path = "file-tests.rs"]
-mod tests;
diff --git a/crates/workshop/workspace/src/handlers/file_state-tests.rs b/crates/workshop/workspace/src/handlers/file_state-tests.rs
deleted file mode 100644
index dc049a04a..000000000
--- a/crates/workshop/workspace/src/handlers/file_state-tests.rs
+++ /dev/null
@@ -1,297 +0,0 @@
-//! The `/workspace/file/state` routes over HTTP: three nulls before any
-//! put, a put-then-get round trip per key that also survives closing and
-//! reopening the file, the three refusals (unknown key, over-cap body,
-//! non-JSON body) each answering the envelope and leaving the state
-//! untouched, and the ephemeral put that says `saved: false`.
-
-use super::*;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use tower::ServiceExt as _;
-use workshop_support::STATE_BUCKET_VALUE_CAP;
-
-use crate::handlers::routes;
-use crate::test_support::json_body;
-
-/// Builds a `GET /workspace/file/state` request.
-fn get_request() -> Request<Body> {
-    Request::builder()
-        .uri("/workspace/file/state")
-        .body(Body::empty())
-        .expect("static request parts are valid")
-}
-
-/// Builds a `PUT /workspace/file/state/{key}` request with a raw body.
-fn put_request(key: &str, body: impl Into<Body>) -> Request<Body> {
-    Request::builder()
-        .method("PUT")
-        .uri(format!("/workspace/file/state/{key}"))
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(body.into())
-        .expect("static request parts are valid")
-}
-
-/// Sends `request` through a fresh clone of the workspace's router.
-async fn send(workspace: &Workspace, request: Request<Body>) -> Response {
-    routes(workspace.clone())
-        .oneshot(request)
-        .await
-        .expect("the router is infallible")
-}
-
-/// The GET body of `workspace` as it stands.
-async fn state_of(workspace: &Workspace) -> serde_json::Value {
-    let response = send(workspace, get_request()).await;
-    assert_eq!(response.status(), StatusCode::OK);
-    json_body(response).await
-}
-
-/// What every key reads as before any put.
-fn all_null() -> serde_json::Value {
-    serde_json::json!({ "layout": null, "tree": null, "closed_editors": null })
-}
-
-/// One distinct value per allow-listed key.
-fn sample_values() -> [(&'static str, serde_json::Value); 3] {
-    [
-        (
-            "layout",
-            serde_json::json!({ "version": 3, "zones": { "tree": 240 } }),
-        ),
-        (
-            "tree",
-            serde_json::json!({ "expanded": ["C:\\projects\\zebra"] }),
-        ),
-        (
-            "closed_editors",
-            serde_json::json!({ "paths": ["C:\\projects\\zebra\\a.md"] }),
-        ),
-    ]
-}
-
-/// A workspace backed by a fresh file under `home`.
-async fn file_backed(home: &tempfile::TempDir) -> (Workspace, std::path::PathBuf) {
-    let path = home.path().join("mine.rvwork");
-    let workspace = Workspace::new();
-    workspace.save_as(&path).await.expect("save as creates");
-    (workspace, path)
-}
-
-#[tokio::test]
-async fn get_with_no_file_returns_three_nulls() {
-    let workspace = Workspace::new();
-
-    assert_eq!(
-        state_of(&workspace).await,
-        all_null(),
-        "every allow-listed key is present and null while ephemeral"
-    );
-}
-
-#[tokio::test]
-async fn put_then_get_round_trips_each_key_and_survives_reopen() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, path) = file_backed(&home).await;
-    assert_eq!(state_of(&workspace).await, all_null());
-
-    for (key, value) in sample_values() {
-        let response = send(&workspace, put_request(key, value.to_string())).await;
-        assert_eq!(response.status(), StatusCode::OK, "for {key}");
-        assert_eq!(
-            json_body(response).await,
-            serde_json::json!({ "saved": true })
-        );
-        assert_eq!(
-            state_of(&workspace).await[key],
-            value,
-            "{key} reads back exactly as put"
-        );
-    }
-    let expected: serde_json::Value = sample_values()
-        .into_iter()
-        .map(|(key, value)| (key.to_owned(), value))
-        .collect::<serde_json::Map<_, _>>()
-        .into();
-    assert_eq!(state_of(&workspace).await, expected);
-    workspace.close_backing_for_test().await;
-
-    let reopened = Workspace::new();
-    reopened.open_file(&path).await.expect("the file reopens");
-    assert_eq!(
-        state_of(&reopened).await,
-        expected,
-        "the route wrote through to the file, not only to memory"
-    );
-}
-
-#[tokio::test]
-async fn a_put_replaces_the_earlier_value() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-    let first = send(
-        &workspace,
-        put_request("tree", r#"{"expanded":["C:\\one"]}"#),
-    )
-    .await;
-    assert_eq!(first.status(), StatusCode::OK, "the first put must land");
-    assert_eq!(json_body(first).await, serde_json::json!({ "saved": true }));
-    assert_eq!(
-        state_of(&workspace).await["tree"],
-        serde_json::json!({ "expanded": ["C:\\one"] }),
-        "the value being replaced was actually stored"
-    );
-
-    let response = send(&workspace, put_request("tree", r#"{"expanded":[]}"#)).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        state_of(&workspace).await["tree"],
-        serde_json::json!({ "expanded": [] })
-    );
-}
-
-#[tokio::test]
-async fn an_unknown_key_is_refused_and_the_state_stands() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-
-    let response = send(&workspace, put_request("scroll", "{}")).await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "ui_state_key");
-    let message = json["error"]["message"]
-        .as_str()
-        .expect("the envelope includes a message");
-    assert!(
-        message.contains("layout, tree, closed_editors"),
-        "the refusal names what is allowed: {message}"
-    );
-    assert_eq!(state_of(&workspace).await, all_null());
-}
-
-#[tokio::test]
-async fn an_over_cap_body_is_refused_and_the_state_stands() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-    let body = format!("\"{}\"", "x".repeat(STATE_BUCKET_VALUE_CAP - 1));
-    assert_eq!(
-        body.len(),
-        STATE_BUCKET_VALUE_CAP + 1,
-        "one byte past the cap"
-    );
-
-    let response = send(&workspace, put_request("layout", body)).await;
-
-    assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
-    let json = json_body(response).await;
-    assert_eq!(json["error"]["code"], "ui_state_too_large");
-    let message = json["error"]["message"]
-        .as_str()
-        .expect("the envelope includes a message");
-    assert!(
-        message.contains(&format!("{} bytes", STATE_BUCKET_VALUE_CAP + 1))
-            && message.contains(&format!("{STATE_BUCKET_VALUE_CAP} bytes")),
-        "the refusal names actual and cap: {message}"
-    );
-    assert_eq!(state_of(&workspace).await, all_null());
-}
-
-#[tokio::test]
-async fn a_body_exactly_at_the_cap_is_accepted() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-    let body = format!("\"{}\"", "x".repeat(STATE_BUCKET_VALUE_CAP - 2));
-    assert_eq!(body.len(), STATE_BUCKET_VALUE_CAP);
-
-    let response = send(&workspace, put_request("layout", body.clone())).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        state_of(&workspace).await["layout"],
-        serde_json::Value::String("x".repeat(STATE_BUCKET_VALUE_CAP - 2))
-    );
-}
-
-#[tokio::test]
-async fn a_non_json_body_is_refused_and_the_state_stands() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-
-    for body in ["{", "", "not json at all"] {
-        let response = send(&workspace, put_request("layout", body)).await;
-        assert_eq!(
-            response.status(),
-            StatusCode::BAD_REQUEST,
-            "for body {body:?}"
-        );
-        let json = json_body(response).await;
-        assert_eq!(json["error"]["code"], "ui_state_not_json", "for {body:?}");
-    }
-    let response = send(
-        &workspace,
-        put_request("layout", Body::from(vec![0xff, 0xfe, b'"'])),
-    )
-    .await;
-    assert_eq!(
-        response.status(),
-        StatusCode::BAD_REQUEST,
-        "bytes that are not UTF-8 are not JSON either"
-    );
-    assert_eq!(
-        json_body(response).await["error"]["code"],
-        "ui_state_not_json"
-    );
-    assert_eq!(state_of(&workspace).await, all_null());
-}
-
-#[tokio::test]
-async fn an_unknown_key_is_refused_before_the_body_is_judged() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let (workspace, _path) = file_backed(&home).await;
-
-    let response = send(&workspace, put_request("scroll", "{")).await;
-
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(
-        json_body(response).await["error"]["code"],
-        "ui_state_key",
-        "the key refusal wins over the body refusal"
-    );
-}
-
-#[tokio::test]
-async fn put_while_ephemeral_answers_saved_false_and_keeps_nothing() {
-    let workspace = Workspace::new();
-
-    let response = send(&workspace, put_request("layout", r#"{"version":3}"#)).await;
-
-    assert_eq!(
-        response.status(),
-        StatusCode::OK,
-        "an ephemeral put is not a failure"
-    );
-    assert_eq!(
-        json_body(response).await,
-        serde_json::json!({ "saved": false }),
-        "the caller is told nothing was written"
-    );
-    assert_eq!(state_of(&workspace).await, all_null());
-}
-
-#[tokio::test]
-async fn a_refused_put_while_ephemeral_is_still_refused() {
-    let workspace = Workspace::new();
-
-    let response = send(&workspace, put_request("scroll", "{}")).await;
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(json_body(response).await["error"]["code"], "ui_state_key");
-
-    let response = send(&workspace, put_request("layout", "{")).await;
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(
-        json_body(response).await["error"]["code"],
-        "ui_state_not_json"
-    );
-}
diff --git a/crates/workshop/workspace/src/handlers/file_state.rs b/crates/workshop/workspace/src/handlers/file_state.rs
deleted file mode 100644
index 1bc0bd03d..000000000
--- a/crates/workshop/workspace/src/handlers/file_state.rs
+++ /dev/null
@@ -1,71 +0,0 @@
-//! The `/workspace/file/state` route handlers: the opaque ui-state
-//! bucket of the open workspace file. `GET` answers every allow-listed
-//! key with its value or `null`; `PUT /{key}` stores one value and
-//! answers `saved`, which is `false` while the workspace is ephemeral
-//! and has nowhere to keep it.
-//!
-//! The body is taken raw rather than through the `Json` extractor so
-//! that every refusal - an unknown key, a body over the cap, a body that
-//! is not JSON - reaches the wire as the crate's own [`WorkspaceError`]
-//! envelope instead of axum's plain-text rejection. The key is judged
-//! first, then the body's size, then its shape, so the client is told
-//! about the cheapest mistake. The raw body still passes through axum's
-//! default body limit (2 MiB) before it reaches the handler; that hard
-//! stop answers axum's own 413, as `PUT /workspace/file` already does
-//! for oversized writes.
-
-use axum::body::Bytes;
-use axum::extract::{Path, State};
-use axum::response::Response;
-use axum::routing::{get, put};
-use workshop_support::StateBucketValue;
-
-use crate::error::WorkspaceError;
-use crate::workspace::Workspace;
-use crate::workspace_file::ui_state_kv::UI_STATE_KEYS;
-
-use super::file::SavedResponse;
-use super::respond;
-
-/// The ui-state routes, merged into the subsystem's router by the parent
-/// module so they share its state and deadline tier.
-pub(super) fn routes() -> axum::Router<Workspace> {
-    axum::Router::new()
-        .route("/workspace/file/state", get(get_state))
-        .route("/workspace/file/state/{key}", put(put_state))
-}
-
-/// Reports every ui-state value the open workspace file holds, keyed by
-/// its allow-listed name, `null` where nothing has been put. An
-/// ephemeral workspace answers every key as `null`.
-async fn get_state(State(workspace): State<Workspace>) -> Response {
-    respond(Ok::<_, WorkspaceError>(workspace.ui_state()))
-}
-
-/// Stores the JSON body under `key` in the open workspace file. An
-/// ephemeral workspace answers success with `saved: false` and writes
-/// nothing; a refused key or body answers the envelope and changes
-/// nothing, ephemeral or not.
-async fn put_state(
-    State(workspace): State<Workspace>,
-    Path(key): Path<String>,
-    body: Bytes,
-) -> Response {
-    respond(store(&workspace, &key, &body).await)
-}
-
-/// Validates the key, then the body's size, then its shape, and only
-/// then hands the value to the workspace.
-async fn store(
-    workspace: &Workspace,
-    key: &str,
-    body: &[u8],
-) -> Result<SavedResponse, WorkspaceError> {
-    let value = StateBucketValue::new(key, &UI_STATE_KEYS, body)?;
-    let saved = workspace.put_ui_state(value).await;
-    Ok(SavedResponse { saved })
-}
-
-#[cfg(test)]
-#[path = "file_state-tests.rs"]
-mod tests;
diff --git a/crates/workshop/workspace/src/handlers/tests.rs b/crates/workshop/workspace/src/handlers/tests.rs
deleted file mode 100644
index 41edf7e00..000000000
--- a/crates/workshop/workspace/src/handlers/tests.rs
+++ /dev/null
@@ -1,173 +0,0 @@
-//! Workspace handler tests: query paths decoded exactly once, traversal refusals, and revokes.
-
-use super::*;
-
-use axum::body::Body;
-use axum::http::Request;
-use tower::ServiceExt as _;
-
-use crate::test_support::{body_bytes, granted_dir, simplified};
-use crate::workspace::Workspace;
-
-/// Percent-encodes a path once for a query string, as the UI does.
-fn query_encoded(path: &Path) -> String {
-    percent_encoding::utf8_percent_encode(
-        &path.to_string_lossy(),
-        percent_encoding::NON_ALPHANUMERIC,
-    )
-    .to_string()
-}
-
-/// Sends a bodiless `GET` through a clone of `router`.
-async fn get(router: &axum::Router, uri: &str) -> Response {
-    let request = Request::builder()
-        .uri(uri)
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    router
-        .clone()
-        .oneshot(request)
-        .await
-        .expect("the router is infallible")
-}
-
-/// A granted root literally named `b%42` beside a sibling holding a file
-/// outside the grant, returned with the tempdir so it outlives the test.
-fn granted_percent_root() -> (Workspace, std::path::PathBuf, tempfile::TempDir) {
-    let parent = tempfile::TempDir::new().expect("tempdir");
-    let root = parent.path().join("b%42");
-    std::fs::create_dir(&root).expect("create the percent-named root");
-    std::fs::write(parent.path().join("secret.txt"), "secret contents")
-        .expect("seed the file outside the grant");
-    let workspace = Workspace::new();
-    workspace
-        .grant(&root)
-        .expect("grant the percent-named root");
-    (workspace, simplified(&root), parent)
-}
-
-/// A name that still looks percent-encoded is a literal name: PUT writes
-/// it from the undecoded JSON body, and both GET routes find it again
-/// from a query encoded exactly once.
-#[tokio::test]
-async fn a_literal_percent_name_round_trips_through_put_and_get() {
-    let (workspace, root, _parent) = granted_percent_root();
-    let router = routes(workspace);
-    let file = root.join("a%41.txt");
-
-    let body = serde_json::json!({ "path": file, "text": "literal" }).to_string();
-    let put = Request::builder()
-        .method("PUT")
-        .uri("/workspace/file")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body))
-        .expect("static request parts are valid");
-    let response = router
-        .clone()
-        .oneshot(put)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    assert!(file.is_file(), "the PUT wrote the literal name");
-
-    let response = get(
-        &router,
-        &format!("/workspace/file?path={}", query_encoded(&file)),
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["path"], serde_json::json!(file));
-    assert_eq!(json["text"], "literal");
-
-    let response = get(
-        &router,
-        &format!("/workspace/tree?path={}", query_encoded(&root)),
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let json: serde_json::Value =
-        serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON");
-    assert_eq!(json["path"], serde_json::json!(root));
-    assert_eq!(json["entries"][0]["name"], "a%41.txt");
-}
-
-/// A double-encoded traversal (`%252e%252e` in the raw query) survives
-/// the query layer's single decode as `%2e%2e`, a literal name. No such
-/// entry exists inside the grant, so the request fails, and neither the
-/// file nor the listing the decoded `..` would reach comes back.
-#[tokio::test]
-async fn a_double_encoded_traversal_returns_nothing_outside_the_grant() {
-    let (workspace, root, _parent) = granted_percent_root();
-    let router = routes(workspace);
-    let root = query_encoded(&root);
-    for uri in [
-        format!("/workspace/file?path={root}%2F%252e%252e%2Fsecret.txt"),
-        format!("/workspace/tree?path={root}%2F%252e%252e"),
-    ] {
-        let response = get(&router, &uri).await;
-        assert_ne!(response.status(), StatusCode::OK, "for {uri}");
-        let body = body_bytes(response).await;
-        let json: serde_json::Value = serde_json::from_slice(&body).expect("the envelope is JSON");
-        assert!(json.get("error").is_some(), "an error envelope for {uri}");
-        assert!(
-            !String::from_utf8_lossy(&body).contains("secret"),
-            "nothing outside the grant comes back for {uri}"
-        );
-    }
-}
-
-/// Builds a `POST /workspace/revoke` request with a raw JSON body.
-fn revoke_request(body: String) -> Request<Body> {
-    Request::builder()
-        .method("POST")
-        .uri("/workspace/revoke")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body))
-        .expect("static request parts are valid")
-}
-
-#[tokio::test]
-async fn a_revoke_over_http_removes_the_root() {
-    let (workspace, dir) = granted_dir();
-    let router = routes(workspace.clone());
-    let root = simplified(dir.path());
-    let body = serde_json::json!({ "path": root }).to_string();
-    let response = router
-        .oneshot(revoke_request(body))
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    let bytes = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&bytes).expect("the body is JSON");
-    assert_eq!(json["revoked"], serde_json::json!(root));
-    assert_eq!(workspace.granted_roots(), Vec::<std::path::PathBuf>::new());
-}
-
-#[tokio::test]
-async fn an_unknown_root_revoke_answers_not_found() {
-    let (workspace, _dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    let router = routes(workspace);
-    let body = serde_json::json!({ "path": outside.path() }).to_string();
-    let response = router
-        .oneshot(revoke_request(body))
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-    let bytes = body_bytes(response).await;
-    let json: serde_json::Value = serde_json::from_slice(&bytes).expect("the body is JSON");
-    assert_eq!(json["error"]["code"], "not_granted");
-}
-
-#[tokio::test]
-async fn a_malformed_revoke_body_answers_bad_request() {
-    let (workspace, _dir) = granted_dir();
-    let router = routes(workspace);
-    let response = router
-        .oneshot(revoke_request("{".to_owned()))
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-}
diff --git a/crates/workshop/workspace/src/handles.rs b/crates/workshop/workspace/src/handles.rs
deleted file mode 100644
index 8acbad3fe..000000000
--- a/crates/workshop/workspace/src/handles.rs
+++ /dev/null
@@ -1,83 +0,0 @@
-//! The workspace subsystem's registration and any handle types. It
-//! registers its `/workspace/*` routes, merged into the server's API
-//! router, the workspace itself as its state handle set, its
-//! granted-roots view and change signal, which the server's
-//! agent-session bindings read through the registry, and the shutdown
-//! lever that closes the workspace file inside the server's graceful
-//! stop.
-
-use std::sync::Arc;
-
-use workshop_registry::{
-    BackgroundTaskAdapter, Registration, Registry, RouteRegistrarAdapter, ShutdownHandle,
-    WorkspaceRoots, WorkspaceRootsAdapter,
-};
-
-use crate::handlers;
-use crate::workspace::Workspace;
-
-/// The workspace subsystem's registration guards: its routes, its state
-/// handle, and its granted-roots view. Dropping them deregisters the
-/// subsystem.
-#[derive(Debug)]
-#[must_use = "dropping the registrations deregisters the subsystem"]
-pub struct WorkspaceRegistrations {
-    /// The `/workspace/*` route registrar.
-    pub routes: Registration,
-    /// The workspace itself as its state handle.
-    pub state: Registration,
-    /// The granted-roots view the server's agent-session bindings read.
-    pub roots: Registration,
-}
-
-/// Registers the workspace subsystem into the registry: its
-/// `/workspace/*` routes (the confined filesystem and the
-/// `/workspace/file/*` document routes), merged into the server's API
-/// router, the workspace itself as its state handle set, and its
-/// granted-roots view and change signal, which the server's agent-session
-/// bindings read through the registry. The returned guards keep the
-/// registrations alive; the composition root holds them for the process
-/// lifetime.
-pub fn register(registry: &Registry, workspace: &Workspace) -> WorkspaceRegistrations {
-    let routes = registry.register_routes(Arc::new(RouteRegistrarAdapter::new({
-        let workspace = workspace.clone();
-        move || handlers::routes(workspace.clone())
-    })));
-    let state = registry.register_state::<Workspace>(Arc::new(workspace.clone()));
-    let roots =
-        registry.register_state::<dyn WorkspaceRoots>(Arc::new(WorkspaceRootsAdapter::new(
-            {
-                let workspace = workspace.clone();
-                move || workspace.granted_roots()
-            },
-            {
-                let workspace = workspace.clone();
-                move || workspace.subscribe_roots()
-            },
-        )));
-    WorkspaceRegistrations {
-        routes,
-        state,
-        roots,
-    }
-}
-
-/// Registers the subsystem's one background task: the shutdown lever
-/// that closes the workspace file. The workspace-file actor already
-/// runs from the moment a file is opened, so the task's `spawn` spawns
-/// nothing; the adapter exists only to hand the registry a
-/// [`ShutdownHandle`] the server awaits inside its graceful-shutdown
-/// closure, where [`Workspace::close_backing`] folds the WAL into the
-/// file and removes the sidecar before the runtime tears down. The
-/// server's grace window bounds the whole drain and is the close's only
-/// timeout. The returned guard keeps the registration alive; the
-/// composition root holds it for the process lifetime.
-pub fn register_tasks(registry: &Registry, workspace: &Workspace) -> Registration {
-    registry.register_task(Arc::new(BackgroundTaskAdapter::new({
-        let workspace = workspace.clone();
-        move || {
-            let workspace = workspace.clone();
-            ShutdownHandle::new(move || async move { workspace.close_backing().await })
-        }
-    })))
-}
diff --git a/crates/workshop/workspace/src/lib.rs b/crates/workshop/workspace/src/lib.rs
deleted file mode 100644
index 243a486d3..000000000
--- a/crates/workshop/workspace/src/lib.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-//! workshop-workspace - the workspace subsystem: confined filesystem
-//! access behind `/workspace/*` - directory trees, file reads, and file
-//! writes jailed to roots the user explicitly granted (drag and drop,
-//! the folder picker, or a reopened workspace file) - plus the
-//! `/workspace/file/*` routes that treat the workspace as a document:
-//! one `.rvwork` Turso file holding the grants and the window geometry,
-//! reopened at boot through the `state_dir/last-workspace` pointer.
-//!
-//! ## Invariants
-//!
-//! - Tier: feature; may depend on: `workshop-protocol`,
-//!   `workshop-registry`, `workshop-support`, and the service crates.
-//!   `cargo test -p build-xtask` enforces the product and container
-//!   boundaries.
-//! - Every request path is checked lexically (no `..`, and on Windows no
-//!   NTFS alternate data stream names) and then canonicalized and
-//!   prefix-matched against the canonical grants before any filesystem
-//!   operation, so traversal, symlink escapes, and UNC aliases cannot
-//!   reach outside a grant. Listing a directory may classify a link in it
-//!   from the link's own attributes (Windows) or from a type-only stat
-//!   (Unix), but never opens the link and never reports its target's size
-//!   or time; opening the link still confines.
-//! - The in-memory grant set is the confinement source of truth; an
-//!   optional workspace file (a single Turso database) mirrors it between
-//!   sessions. A persist that fails is logged degradation; the in-memory
-//!   state stands.
-//! - The crate maps its own [`WorkspaceError`] to the wire envelope at
-//!   its route boundary; no server error type appears here.
-
-mod blocking;
-mod error;
-mod handlers;
-mod handles;
-#[cfg(test)]
-mod test_support;
-mod workspace;
-mod workspace_file;
-
-pub use error::WorkspaceError;
-#[cfg(feature = "test-fixtures")]
-pub use handlers::routes_with_deadline;
-pub use handles::{WorkspaceRegistrations, register, register_tasks};
-pub use workspace::Workspace;
-#[cfg(feature = "test-fixtures")]
-pub use workspace::WriteStallHandle;
-pub use workspace_file::WorkspaceFileError;
-#[cfg(any(test, feature = "test-fixtures"))]
-pub use workspace_file::create_alien_database_for_test;
diff --git a/crates/workshop/workspace/src/test_support.rs b/crates/workshop/workspace/src/test_support.rs
deleted file mode 100644
index 6acedf242..000000000
--- a/crates/workshop/workspace/src/test_support.rs
+++ /dev/null
@@ -1,35 +0,0 @@
-//! Helpers the crate's unit tests share: a workspace over one granted
-//! tempdir, the canonical form grants are stored in, and readers for a
-//! route's buffered response body.
-
-use std::path::{Path, PathBuf};
-
-use axum::response::Response;
-
-use crate::workspace::Workspace;
-
-/// A workspace with one granted tempdir, returned alongside so the
-/// directory outlives the test.
-pub(crate) fn granted_dir() -> (Workspace, tempfile::TempDir) {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace.grant(dir.path()).expect("grant the tempdir");
-    (workspace, dir)
-}
-
-/// The canonical, verbatim-prefix-free form grants are stored in.
-pub(crate) fn simplified(path: &Path) -> PathBuf {
-    dunce::simplified(&path.canonicalize().expect("canonical")).to_path_buf()
-}
-
-/// Collects a response body already buffered in memory.
-pub(crate) async fn body_bytes(response: Response) -> axum::body::Bytes {
-    axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already")
-}
-
-/// Collects a response body already buffered in memory and parses it.
-pub(crate) async fn json_body(response: Response) -> serde_json::Value {
-    serde_json::from_slice(&body_bytes(response).await).expect("the body is JSON")
-}
diff --git a/crates/workshop/workspace/src/workspace.rs b/crates/workshop/workspace/src/workspace.rs
deleted file mode 100644
index f7cee8d46..000000000
--- a/crates/workshop/workspace/src/workspace.rs
+++ /dev/null
@@ -1,456 +0,0 @@
-//! Confined workspace filesystem access: directory trees, file reads, and
-//! file writes jailed to roots the user explicitly granted (drag and drop,
-//! the folder picker, or a reopened workspace file).
-//!
-//! A granted folder becomes a root; a granted file grants its parent
-//! directory. The in-memory grant set is the confinement source of truth;
-//! an optional workspace file (the `backing` module) mirrors it between
-//! sessions and is never consulted on a request path. Every request path is
-//! checked lexically (no `..`, and on Windows no NTFS alternate data
-//! stream names) and then
-//! canonicalized and prefix-matched against the canonical grants before any
-//! filesystem operation, so traversal, symlink escapes, and UNC aliases
-//! cannot reach outside a grant. This is the same confinement as the
-//! gateway's artifact-cache `confine.rs`, with canonicalization performing
-//! the resolution that module's component walk performs by hand.
-
-use std::collections::BTreeMap;
-use std::fs;
-use std::io;
-use std::path::{Path, PathBuf};
-use std::sync::atomic::AtomicBool;
-use std::sync::{Arc, PoisonError, RwLock};
-
-use serde::Serialize;
-use tokio::sync::watch;
-
-use crate::error::WorkspaceError;
-use crate::workspace_file::{WindowState, now_rfc3339};
-
-mod backing;
-mod confine;
-mod pointer;
-#[cfg(feature = "test-fixtures")]
-mod stall;
-mod token;
-mod tree;
-
-use backing::Backing;
-use confine::{canonicalize_simplified, reject_forbidden};
-#[cfg(feature = "test-fixtures")]
-pub use stall::WriteStallHandle;
-use token::{current_token, file_token};
-#[cfg(test)]
-use token::{hash_token, mtime_token};
-
-/// The largest file the workspace reads or accepts for a write: the editor
-/// targets source text, so one MiB is generous.
-const MAX_FILE_BYTES: u64 = 1024 * 1024;
-
-/// Whether a tree entry is a directory or a regular file.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub(crate) enum EntryKind {
-    /// A directory.
-    Directory,
-    /// A regular file.
-    File,
-}
-
-/// One entry in a directory listing.
-#[derive(Debug, Serialize)]
-struct TreeEntry {
-    /// The entry's file name (lossy for non-Unicode names).
-    name: String,
-    /// The entry's full path, ready to pass back to the API.
-    path: PathBuf,
-    /// Directory or file.
-    kind: EntryKind,
-    /// Byte length (0 for directories).
-    size: u64,
-    /// Modification time in milliseconds since the Unix epoch.
-    modified_ms: u64,
-    /// Whether the entry is currently on disk. Directory listings only
-    /// enumerate what exists, so their entries are always `true`; a
-    /// granted root deleted from disk lists as `false` so the panel can
-    /// flag it for cleanup.
-    exists: bool,
-}
-
-/// One level of a workspace directory tree.
-#[derive(Debug, Serialize)]
-pub(crate) struct TreeListing {
-    /// The listed directory; `None` when the listing is the granted roots.
-    path: Option<PathBuf>,
-    /// Directories before files, each group ordered by name.
-    entries: Vec<TreeEntry>,
-}
-
-/// A file's text plus the metadata a writer needs to detect conflicts.
-#[derive(Debug, Serialize)]
-pub(crate) struct FileContents {
-    /// The canonical file path.
-    path: PathBuf,
-    /// Byte length.
-    size: u64,
-    /// The opaque conflict token a writer must echo back as
-    /// `expected_token`; see [`file_token`] for its derivation.
-    token: String,
-    /// The file's UTF-8 text.
-    text: String,
-}
-
-/// One granted root as the workspace reports it.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub(crate) struct GrantEntry {
-    /// The canonical granted root.
-    pub(crate) path: PathBuf,
-    /// Whether the root is on disk right now. A vanished root stays
-    /// granted and listed so the user can see it and revoke it.
-    exists: bool,
-}
-
-/// The workspace as a whole: its file, if any, and what it holds; built
-/// by [`Workspace::current`] in the backing module. It is the JSON body
-/// of `GET /workspace/file/current` and of every successful switch.
-#[derive(Debug, Clone, Serialize)]
-pub(crate) struct WorkspaceSummary {
-    /// The backing file; `None` while the workspace is ephemeral.
-    #[serde(serialize_with = "lossy_path")]
-    pub(crate) path: Option<PathBuf>,
-    /// The display name: the file's own, or `Untitled` while ephemeral.
-    pub(crate) name: String,
-    /// The granted roots in canonical order.
-    pub(crate) grants: Vec<GrantEntry>,
-    /// The saved window geometry; `None` while ephemeral or never saved.
-    pub(crate) window_state: Option<WindowState>,
-}
-
-/// Serializes a path as its lossy UTF-8 text, so a path that is not
-/// valid Unicode still reaches the wire instead of failing the body.
-#[expect(
-    clippy::ref_option,
-    reason = "serde's serialize_with hands the field over by reference"
-)]
-fn lossy_path<S: serde::Serializer>(
-    path: &Option<PathBuf>,
-    serializer: S,
-) -> Result<S::Ok, S::Error> {
-    path.as_deref()
-        .map(Path::to_string_lossy)
-        .serialize(serializer)
-}
-
-/// What memory keeps beside each granted root so the file holds the
-/// workspace's true history: the grant's order among its peers and when
-/// it was made. Confinement never reads it. Its two readers are in the
-/// backing module: the grant mirror in [`Workspace::grant_and_persist`],
-/// which sends a new grant's row to the open file, and the save-as row
-/// builder, which writes every grant into a new file.
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct GrantMeta {
-    /// Stable tree order: the file's `position` when the grant was loaded
-    /// from one, one past the current maximum when granted in session.
-    position: u32,
-    /// RFC 3339 grant time.
-    added_at: String,
-}
-
-/// The workspace: the granted roots and the optional backing file.
-///
-/// Cloning shares the same state, so the router state and every handler
-/// see grants registered through `POST /workspace/grant` immediately. The
-/// grant set is the confinement source of truth; the backing file, when
-/// present, is its persistent mirror and is swapped at runtime by open,
-/// save-as, and duplicate, each recorded in the last-workspace pointer.
-#[derive(Debug, Clone)]
-pub struct Workspace {
-    /// The granted roots, in canonical form, each with its grant order
-    /// and time. Read-hot: its own lock.
-    grants: Arc<RwLock<BTreeMap<PathBuf, GrantMeta>>>,
-    /// The clock a new grant's `added_at` reads: the wall clock in
-    /// production, a scripted one in tests that need distinct stamps
-    /// without waiting a second between grants.
-    now: fn() -> String,
-    /// The backing workspace file; `None` while the workspace is
-    /// ephemeral.
-    backing: Arc<RwLock<Option<Backing>>>,
-    /// Serializes ui-state puts so values reach the backing file's actor
-    /// in the order they reached memory; see [`Workspace::put_ui_state`].
-    ui_state_puts: Arc<tokio::sync::Mutex<()>>,
-    /// Serializes the switch operations (open, save-as, duplicate, and
-    /// the shutdown close), grants, and revokes. Each switch is two
-    /// phases, open or create a handle and then swap it in, with awaits
-    /// between them, and the same-file guard in [`Workspace::open_file`]
-    /// reads state a concurrent switch would change. One guard held
-    /// across the whole switch keeps two openers of one file from ever
-    /// existing (turso shares one WAL handle per file process-wide, so the
-    /// second swap's close would unlink the sidecar the survivor writes
-    /// to) and keeps a reload of the current file from landing after the
-    /// backing moved on.
-    switches: Arc<tokio::sync::Mutex<()>>,
-    /// Set once by [`Workspace::close_backing`] and never cleared: after
-    /// the shutdown close no switch may install a backing nobody would
-    /// close, so a switch that loses the race to quit is refused.
-    closed: Arc<AtomicBool>,
-    /// Where the last-used file is remembered between runs; `None` when
-    /// built without a state directory (see [`Workspace::with_state_dir`]).
-    pointer: Option<pointer::LastWorkspacePointer>,
-    /// The grant-set generation behind [`Workspace::subscribe_roots`].
-    roots_generation: watch::Sender<u64>,
-    #[cfg(feature = "test-fixtures")]
-    stall: Arc<stall::WriteStall>,
-}
-
-impl Default for Workspace {
-    fn default() -> Self {
-        Self {
-            grants: Arc::default(),
-            now: now_rfc3339,
-            backing: Arc::default(),
-            ui_state_puts: Arc::default(),
-            switches: Arc::default(),
-            closed: Arc::default(),
-            pointer: None,
-            roots_generation: watch::Sender::default(),
-            #[cfg(feature = "test-fixtures")]
-            stall: Arc::new(stall::WriteStall::new()),
-        }
-    }
-}
-
-impl Workspace {
-    /// Creates an ephemeral workspace with no grants and no file.
-    #[must_use]
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// The same workspace reading grant times from `now` instead of the
-    /// wall clock, so a test can give consecutive grants distinct stamps.
-    #[cfg(test)]
-    #[must_use]
-    fn with_clock_for_test(mut self, now: fn() -> String) -> Self {
-        self.now = now;
-        self
-    }
-
-    /// Registers `path` as a granted root in memory only: a directory
-    /// grants itself, a file grants its parent directory. A new grant
-    /// takes the position one past the current maximum and the current
-    /// time; a path already granted keeps the order and time it has.
-    /// Handlers use [`Workspace::grant_and_persist`], which also mirrors
-    /// the grant into the backing file.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::ForbiddenComponent`] when the path contains
-    /// a `..` or stream name, [`WorkspaceError::ResolveGrant`] when it
-    /// cannot be canonicalized, and [`WorkspaceError::NotFound`] when a
-    /// file path has no parent directory.
-    pub fn grant(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        self.grant_with_meta(path).map(|(root, _)| root)
-    }
-
-    /// [`Workspace::grant`], also returning the order and time memory
-    /// holds for the root afterwards: the meta just assigned to a new
-    /// grant, or the one an already-granted path keeps. Read under the
-    /// same write lock as the insert, so the caller sees the row memory
-    /// holds rather than a later snapshot.
-    fn grant_with_meta(&self, path: &Path) -> Result<(PathBuf, GrantMeta), WorkspaceError> {
-        reject_forbidden(path)?;
-        let canonical = canonicalize_simplified(path)
-            .map_err(|source| WorkspaceError::ResolveGrant { source })?;
-        let root = if canonical.is_dir() {
-            canonical
-        } else {
-            canonical
-                .parent()
-                .map(Path::to_owned)
-                .ok_or(WorkspaceError::NotFound)?
-        };
-        let mut grants = self.grants.write().unwrap_or_else(PoisonError::into_inner);
-        let position = grants
-            .values()
-            .map(|meta| meta.position)
-            .max()
-            .map_or(0, |max| max.saturating_add(1));
-        let meta = grants
-            .entry(root.clone())
-            .or_insert_with(|| GrantMeta {
-                position,
-                added_at: (self.now)(),
-            })
-            .clone();
-        drop(grants);
-        self.bump_roots();
-        Ok((root, meta))
-    }
-
-    /// The grant key a revoke of `path` removes, changing nothing; the
-    /// removal is [`Workspace::remove_root`], and handlers use
-    /// [`Workspace::revoke_and_persist`]. A path that is itself a stored
-    /// key names that grant with no filesystem call, so a root deleted
-    /// from disk or replaced by a link stays revocable by the key the
-    /// roots listing handed the client. Any other path resolves by exact
-    /// canonical match, and one that no longer exists is its own key.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::ForbiddenComponent`] when the path contains
-    /// a `..` or stream name, and [`WorkspaceError::ResolveGrant`] when
-    /// canonicalization fails for a reason other than absence.
-    fn revoke_key(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        reject_forbidden(path)?;
-        let stored = self
-            .grants
-            .read()
-            .unwrap_or_else(PoisonError::into_inner)
-            .get_key_value(path)
-            .map(|(key, _)| key.clone());
-        if let Some(key) = stored {
-            return Ok(key);
-        }
-        match canonicalize_simplified(path) {
-            Ok(canonical) => Ok(canonical),
-            Err(source) if source.kind() == io::ErrorKind::NotFound => Ok(path.to_path_buf()),
-            Err(source) => Err(WorkspaceError::ResolveGrant { source }),
-        }
-    }
-
-    /// Removes the grant stored under `key`, as [`Workspace::revoke_key`]
-    /// resolved it, from memory only. Nested grants are independent:
-    /// revoking a parent leaves a separately granted child intact, and
-    /// files under the child stay reachable while everything else under
-    /// the parent loses access on its next operation.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::NotGranted`] when `key` is not a granted
-    /// root.
-    fn remove_root(&self, key: &Path) -> Result<(), WorkspaceError> {
-        let removed = self
-            .grants
-            .write()
-            .unwrap_or_else(PoisonError::into_inner)
-            .remove(key)
-            .is_some();
-        if !removed {
-            return Err(WorkspaceError::NotGranted);
-        }
-        self.bump_roots();
-        Ok(())
-    }
-
-    /// The granted roots in canonical (path) order. Grant order is kept
-    /// beside each root and reaches the file through save-as, not here.
-    #[must_use]
-    pub(crate) fn granted_roots(&self) -> Vec<PathBuf> {
-        self.grants
-            .read()
-            .unwrap_or_else(PoisonError::into_inner)
-            .keys()
-            .cloned()
-            .collect()
-    }
-
-    /// A watch on the grant-set generation, which every grant, revoke,
-    /// and workspace switch bumps, so a subscriber re-reads
-    /// [`Workspace::granted_roots`] when it changes.
-    #[must_use]
-    pub(crate) fn subscribe_roots(&self) -> watch::Receiver<u64> {
-        self.roots_generation.subscribe()
-    }
-
-    /// Bumps the grant-set generation, waking every roots subscriber.
-    /// Called after the grants lock is released, so a woken subscriber
-    /// reads the new set.
-    fn bump_roots(&self) {
-        self.roots_generation
-            .send_modify(|generation| *generation = generation.wrapping_add(1));
-    }
-
-    /// Reads a confined UTF-8 text file with its size and conflict
-    /// token. Binary and oversized files are rejected.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError`] when the path is forbidden, outside every
-    /// grant, missing, not a regular file, binary, not UTF-8, oversized, or
-    /// cannot be read.
-    pub(crate) fn read_file(&self, path: &Path) -> Result<FileContents, WorkspaceError> {
-        let canonical = self.confine_existing(path)?;
-        let metadata =
-            fs::metadata(&canonical).map_err(|source| WorkspaceError::InspectPath { source })?;
-        if !metadata.is_file() {
-            return Err(WorkspaceError::NotAFile);
-        }
-        if metadata.len() > MAX_FILE_BYTES {
-            return Err(WorkspaceError::FileTooLarge {
-                limit: MAX_FILE_BYTES,
-            });
-        }
-        let bytes = fs::read(&canonical).map_err(|source| WorkspaceError::ReadFile { source })?;
-        if bytes.contains(&0) {
-            return Err(WorkspaceError::BinaryFile);
-        }
-        let token = file_token(&metadata, &bytes);
-        let text = String::from_utf8(bytes).map_err(|source| WorkspaceError::NotUtf8 { source })?;
-        Ok(FileContents {
-            path: canonical,
-            size: metadata.len(),
-            token,
-            text,
-        })
-    }
-
-    /// Writes `text` to a confined path, creating the file when it does not
-    /// exist. When the file exists, `expected_token` must match its current
-    /// conflict token or the write is refused as a conflict.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::FileTooLarge`] when the text exceeds the
-    /// size limit, [`WorkspaceError::ModifiedConflict`] when the token is
-    /// stale, absent, or underivable for the existing file, and otherwise
-    /// [`WorkspaceError`] when the path is forbidden, outside every grant,
-    /// not a regular file, or cannot be written.
-    pub(crate) fn write_file(
-        &self,
-        path: &Path,
-        text: &str,
-        expected_token: Option<&str>,
-    ) -> Result<FileContents, WorkspaceError> {
-        if text.len() as u64 > MAX_FILE_BYTES {
-            return Err(WorkspaceError::FileTooLarge {
-                limit: MAX_FILE_BYTES,
-            });
-        }
-        let canonical = self.confine_for_write(path)?;
-        match fs::metadata(&canonical) {
-            Ok(metadata) => {
-                if !metadata.is_file() {
-                    return Err(WorkspaceError::NotAFile);
-                }
-                // Fail closed: only a derivable on-disk token that equals
-                // the writer's token proves the file is unchanged.
-                match (current_token(&canonical, &metadata), expected_token) {
-                    (Some(current), Some(expected)) if current == expected => {}
-                    _ => return Err(WorkspaceError::ModifiedConflict),
-                }
-            }
-            Err(source) if source.kind() == io::ErrorKind::NotFound => {}
-            Err(source) => return Err(WorkspaceError::InspectPath { source }),
-        }
-        #[cfg(feature = "test-fixtures")]
-        let _done = self.stall_wait();
-        workshop_support::write_atomic(&canonical, text.as_bytes())
-            .map_err(|source| WorkspaceError::WriteFile { source })?;
-        let metadata =
-            fs::metadata(&canonical).map_err(|source| WorkspaceError::InspectPath { source })?;
-        Ok(FileContents {
-            path: canonical,
-            size: metadata.len(),
-            token: file_token(&metadata, text.as_bytes()),
-            text: text.to_owned(),
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/workspace/src/workspace/backing-ui-state-memory.rs b/crates/workshop/workspace/src/workspace/backing-ui-state-memory.rs
deleted file mode 100644
index 3a038a7d5..000000000
--- a/crates/workshop/workspace/src/workspace/backing-ui-state-memory.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-//! The workspace-level view of the opaque ui-state values: an in-memory
-//! map on the backing, read from the file at open and updated on every
-//! accepted put, mirrored into the file through the actor. Memory is
-//! the source of truth, as it is for grants and window state: a persist
-//! that fails is logged and the value stands.
-
-use std::collections::BTreeMap;
-use std::sync::PoisonError;
-
-use serde_json::Value;
-use workshop_support::StateBucketValue;
-
-use crate::Workspace;
-use crate::workspace_file::empty_ui_state;
-
-impl Workspace {
-    /// The ui-state values as memory holds them: every allow-listed key,
-    /// each `None` until put or read from the file at open. An ephemeral
-    /// workspace has nowhere to keep them and reports every key as `None`.
-    #[must_use]
-    pub(crate) fn ui_state(&self) -> BTreeMap<&'static str, Option<Value>> {
-        self.backing
-            .read()
-            .unwrap_or_else(PoisonError::into_inner)
-            .as_ref()
-            .map_or_else(empty_ui_state, |backing| backing.ui_state.clone())
-    }
-
-    /// Stores the validated `put` under its key, in memory first and
-    /// then in the backing file. Returns `false` without keeping
-    /// anything when the workspace is ephemeral: an unsaved workspace
-    /// has nowhere to put it, and the SPA keeps its own copy. A persist
-    /// that fails is logged, and the in-memory value stands.
-    ///
-    /// Puts are serialized: the memory insert and the send to the file's
-    /// actor happen under one async lock, so two overlapping puts to the
-    /// same key reach the file in the order they reached memory and the
-    /// next open restores what memory last held. Without it the two
-    /// inserts could order one way and the two sends the other.
-    pub(crate) async fn put_ui_state(&self, put: StateBucketValue) -> bool {
-        let _serial = self.ui_state_puts.lock().await;
-        let file = {
-            let mut backing = self.backing.write().unwrap_or_else(PoisonError::into_inner);
-            let Some(backing) = backing.as_mut() else {
-                return false;
-            };
-            backing
-                .ui_state
-                .insert(put.key(), Some(put.value().clone()));
-            backing.file.clone()
-        };
-        if let Err(error) = file.put_ui_state(&put).await {
-            tracing::warn!(
-                %error,
-                key = put.key(),
-                file = %file.path().display(),
-                "ui state not persisted to the workspace file; the in-memory value stands"
-            );
-        }
-        true
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace/backing.rs b/crates/workshop/workspace/src/workspace/backing.rs
deleted file mode 100644
index 1a79d0155..000000000
--- a/crates/workshop/workspace/src/workspace/backing.rs
+++ /dev/null
@@ -1,500 +0,0 @@
-//! The optional workspace file behind a [`Workspace`]: the backing that
-//! mirrors the in-memory grant set between sessions, and the open,
-//! save-as, duplicate, and window-state operations that swap or write
-//! it. The grant set stays the confinement source of truth and nothing
-//! here is consulted on a request path; a persist that fails is logged
-//! degradation that leaves memory unchanged.
-
-use std::collections::BTreeMap;
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::sync::PoisonError;
-use std::sync::atomic::Ordering;
-
-use crate::blocking::{blocking, try_blocking};
-use crate::error::WorkspaceError;
-use crate::workspace_file::{
-    GrantRow, WindowState, WorkspaceContents, WorkspaceFile, WorkspaceFileError, empty_ui_state,
-    stem_of,
-};
-
-use super::confine::names_same_file;
-use super::{GrantEntry, GrantMeta, Workspace, WorkspaceSummary};
-
-#[path = "backing-ui-state-memory.rs"]
-mod ui_state_memory;
-
-/// The display name of a workspace that has no file yet.
-pub(super) const EPHEMERAL_NAME: &str = "Untitled";
-
-/// The open file behind a file-backed workspace.
-#[derive(Debug)]
-pub(super) struct Backing {
-    /// The workspace-file actor (single writer, channel-fed).
-    file: WorkspaceFile,
-    /// Where the file sits on disk.
-    path: PathBuf,
-    /// The opaque ui-state values, read from the file at open and
-    /// updated on every accepted put; what [`Workspace::ui_state`]
-    /// reports.
-    ui_state: BTreeMap<&'static str, Option<serde_json::Value>>,
-}
-
-impl Workspace {
-    /// Registers `path` as a granted root and mirrors the grant into the
-    /// backing file when one is open. Memory is updated first and stands
-    /// whatever the file does: a persist that fails is logged, and the
-    /// grant still returns success. The row holds the order and time
-    /// memory assigned; the file assigns its own stored position on
-    /// insert, and the in-memory one is what a later save-as writes.
-    ///
-    /// The grant holds the switch guard from the insert through the
-    /// mirror, so it lands whole in the workspace open when it completes:
-    /// a switch between the two would wipe the root from memory and then
-    /// mirror it into the file the switch installed. A grant after the
-    /// shutdown close is refused before it resolves or changes anything.
-    ///
-    /// # Errors
-    /// The same as [`Workspace::grant`], plus
-    /// [`WorkspaceError::WorkspaceFileFailed`] when the workspace has been
-    /// closed for shutdown; persistence never fails the call.
-    pub async fn grant_and_persist(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        let _switch = self.switches.lock().await;
-        self.refuse_if_closed("grant")?;
-        // The grant canonicalizes and stats the path: blocking-pool work.
-        let workspace = self.clone();
-        let requested = path.to_path_buf();
-        let (root, meta) = try_blocking(
-            move || workspace.grant_with_meta(&requested),
-            |source| WorkspaceError::ResolveGrant { source },
-        )
-        .await?;
-        if let Some(file) = self.backing_file() {
-            let row = GrantRow {
-                path: root.clone(),
-                position: meta.position,
-                added_at: meta.added_at,
-            };
-            if let Err(error) = file.add_grant(row).await {
-                tracing::warn!(
-                    %error,
-                    root = %root.display(),
-                    file = %file.path().display(),
-                    "grant not persisted to the workspace file; the in-memory grant stands"
-                );
-            }
-        }
-        Ok(root)
-    }
-
-    /// Removes `path` from the granted roots and mirrors the removal into
-    /// the backing file when one is open. Memory is updated first; a
-    /// persist that fails is logged, and the revoke still returns
-    /// success.
-    ///
-    /// The path resolves to its grant key before the switch guard is
-    /// taken, so a slow canonicalize never holds up a switch and a revoke
-    /// canceled while resolving changes nothing. The removal and its
-    /// mirror hold the guard, so the revoke lands whole in the workspace
-    /// open when it completes, and is refused after the shutdown close.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::ForbiddenComponent`] when the path contains
-    /// a `..` or stream name, [`WorkspaceError::ResolveGrant`] when
-    /// canonicalization fails for a reason other than absence,
-    /// [`WorkspaceError::WorkspaceFileFailed`] when the workspace has been
-    /// closed for shutdown, and [`WorkspaceError::NotGranted`] when the
-    /// resolved path is not a granted root; persistence never fails the
-    /// call.
-    pub async fn revoke_and_persist(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        // Resolving may canonicalize the path: blocking-pool work.
-        let workspace = self.clone();
-        let requested = path.to_path_buf();
-        let root = try_blocking(
-            move || workspace.revoke_key(&requested),
-            |source| WorkspaceError::ResolveGrant { source },
-        )
-        .await?;
-        let _switch = self.switches.lock().await;
-        self.refuse_if_closed("revoke")?;
-        self.remove_root(&root)?;
-        if let Some(file) = self.backing_file()
-            && let Err(error) = file.remove_grant(&root).await
-        {
-            tracing::warn!(
-                %error,
-                root = %root.display(),
-                file = %file.path().display(),
-                "revoke not persisted to the workspace file; the in-memory revoke stands"
-            );
-        }
-        Ok(root)
-    }
-
-    /// Opens the workspace file at `path` and makes it the backing: the
-    /// file's grants replace every current grant wholesale, and the
-    /// previous backing, if any, is closed. A file that fails validation
-    /// changes nothing; the current grants and backing stay as they were.
-    ///
-    /// Opening the file that is already the backing reloads its grants
-    /// and ui-state through the existing handle and leaves the backing
-    /// as it is: no second handle is opened and nothing is closed.
-    ///
-    /// Switches run one at a time (see the `switches` field): a second
-    /// open of a path the first just made current takes the reload
-    /// branch, and an open that arrives after the shutdown close is
-    /// refused.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::NotFound`] when the path does not exist,
-    /// [`WorkspaceError::WorkspaceFileRefused`] when it is not a workspace
-    /// at a supported version, and [`WorkspaceError::WorkspaceFileFailed`]
-    /// when it cannot be read or the workspace has been closed for
-    /// shutdown.
-    pub(crate) async fn open_file(&self, path: &Path) -> Result<(), WorkspaceError> {
-        let _switch = self.switches.lock().await;
-        self.refuse_if_closed("open")?;
-        // A second opener of the current file must never exist. turso
-        // 0.7.2 keys its process-wide `DATABASE_MANAGER` on OS file
-        // identity and hands every connection to the same file one shared
-        // WAL handle, so a fresh `WorkspaceFile::open` here would share the
-        // live WAL, and `swap_backing` closing the first handle would
-        // checkpoint, drop, and unlink the sidecar the survivor keeps
-        // appending to: every write after that would be lost at quit.
-        // Compare canonical forms so a respelling of the same path (a `.`
-        // segment, a case difference on Windows) takes the same branch.
-        if let Some((file, current)) = self.backing_parts() {
-            let requested = path.to_path_buf();
-            let same = blocking(move || names_same_file(&requested, &current))
-                .await
-                .map_err(|source| WorkspaceError::ResolvePath { source })?;
-            if same {
-                return self.reload_current(&file, path).await;
-            }
-        }
-        let file = WorkspaceFile::open(path).await?;
-        let contents = match file.contents().await {
-            Ok(contents) => contents,
-            Err(error) => {
-                file.close().await;
-                return Err(error.into());
-            }
-        };
-        self.replace_all(contents.grants);
-        self.swap_backing(file, path, contents.ui_state).await;
-        Ok(())
-    }
-
-    /// Creates a new workspace file at `path` holding the current grants
-    /// and the previous backing's window state, and makes it the backing.
-    /// The previous file, if any, keeps its contents and is closed; its
-    /// siblings stay where they are. Save-as moves preferences to a new
-    /// name. The ui-state keys start empty, in the file and in memory:
-    /// the SPA is their one writer and writes them after a save-as
-    /// itself.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::WorkspaceFileTaken`] when something
-    /// already exists at `path`, and [`WorkspaceError::WorkspaceFileFailed`]
-    /// when the file cannot be created or the workspace has been closed
-    /// for shutdown.
-    pub async fn save_as(&self, path: &Path) -> Result<(), WorkspaceError> {
-        let _switch = self.switches.lock().await;
-        self.refuse_if_closed("save as")?;
-        self.save_as_switched(path).await
-    }
-
-    /// [`Workspace::save_as`] with the switch guard already held, so
-    /// [`Workspace::duplicate`] can fall back to it without reacquiring.
-    async fn save_as_switched(&self, path: &Path) -> Result<(), WorkspaceError> {
-        let window_state = match self.backing_file() {
-            Some(previous) => match previous.contents().await {
-                Ok(contents) => contents.window_state,
-                Err(error) => {
-                    tracing::warn!(
-                        %error,
-                        file = %previous.path().display(),
-                        "previous workspace file unreadable; saving as without its window state"
-                    );
-                    None
-                }
-            },
-            None => None,
-        };
-        let contents = WorkspaceContents {
-            name: stem_of(path),
-            grants: self.grant_rows(),
-            window_state,
-            ui_state: empty_ui_state(),
-        };
-        let file = WorkspaceFile::create(path, &contents).await?;
-        self.swap_backing(file, path, contents.ui_state).await;
-        Ok(())
-    }
-
-    /// Copies the backing file and its siblings to `path`, then makes the
-    /// copy the backing; the original is closed and left as it was. The
-    /// in-memory ui-state values transfer unchanged, as the grants do:
-    /// the copy holds the same rows, and memory stays the source of
-    /// truth. An ephemeral workspace has no file to copy, so its
-    /// duplicate is a [`Workspace::save_as`]: the current grants land in
-    /// a new file.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::WorkspaceFileTaken`] when something
-    /// already exists at `path` or a sibling of the copy is already in
-    /// the destination folder, and [`WorkspaceError::WorkspaceFileFailed`]
-    /// when the copy cannot be made or opened or the workspace has been
-    /// closed for shutdown.
-    pub(crate) async fn duplicate(&self, path: &Path) -> Result<(), WorkspaceError> {
-        let _switch = self.switches.lock().await;
-        self.refuse_if_closed("duplicate")?;
-        let Some(previous) = self.backing_file() else {
-            return self.save_as_switched(path).await;
-        };
-        let file = previous.duplicate_to(path).await?;
-        let ui_state = self.ui_state();
-        self.swap_backing(file, path, ui_state).await;
-        Ok(())
-    }
-
-    /// Saves the window geometry into the backing file. Returns
-    /// `Ok(false)` without writing when the workspace is ephemeral: an
-    /// unsaved workspace has nowhere to keep it.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::WorkspaceFileFailed`] when the write
-    /// fails.
-    pub(crate) async fn put_window_state(
-        &self,
-        state: WindowState,
-    ) -> Result<bool, WorkspaceError> {
-        let Some(file) = self.backing_file() else {
-            return Ok(false);
-        };
-        file.put_window_state(state).await?;
-        Ok(true)
-    }
-
-    /// The workspace as a whole. The grants come from memory, the
-    /// confinement source of truth; the name and window state come from
-    /// the file. A file that cannot be read degrades to its stem and no
-    /// window state rather than failing the call.
-    pub(crate) async fn current(&self) -> WorkspaceSummary {
-        // One blocking-pool trip stats every root; a worker that cannot
-        // report degrades to no grants listed rather than failing the call.
-        let roots = self.granted_roots();
-        let grants = blocking(move || {
-            roots
-                .into_iter()
-                .map(|path| GrantEntry {
-                    exists: fs::metadata(&path).is_ok(),
-                    path,
-                })
-                .collect::<Vec<_>>()
-        })
-        .await
-        .unwrap_or_else(|error| {
-            tracing::warn!(%error, "granted roots not inspected; reporting none");
-            Vec::new()
-        });
-        let Some((file, path)) = self.backing_parts() else {
-            return WorkspaceSummary {
-                path: None,
-                name: EPHEMERAL_NAME.to_string(),
-                grants,
-                window_state: None,
-            };
-        };
-        let (name, window_state) = match file.contents().await {
-            Ok(contents) => (contents.name, contents.window_state),
-            Err(error) => {
-                tracing::warn!(
-                    %error,
-                    file = %path.display(),
-                    "workspace file unreadable; reporting its stem and no window state"
-                );
-                (stem_of(&path), None)
-            }
-        };
-        WorkspaceSummary {
-            path: Some(path),
-            name,
-            grants,
-            window_state,
-        }
-    }
-
-    /// Replaces every grant with `grants`, the contents of a file being
-    /// opened. Rows are stored as they come, position and time included:
-    /// the file holds canonical paths, and a root that has vanished from
-    /// disk still loads (it lists as `exists: false`) so the user can see
-    /// it and revoke it.
-    fn replace_all(&self, grants: Vec<GrantRow>) {
-        let mut map = self.grants.write().unwrap_or_else(PoisonError::into_inner);
-        map.clear();
-        for row in grants {
-            tracing::info!(root = %row.path.display(), "workspace grant restored from file");
-            map.insert(
-                row.path,
-                GrantMeta {
-                    position: row.position,
-                    added_at: row.added_at,
-                },
-            );
-        }
-        drop(map);
-        self.bump_roots();
-    }
-
-    /// Closes the backing file and leaves the workspace ephemeral: the
-    /// backing is taken out under the write lock, then its actor is
-    /// stopped and awaited, so when the call returns the file on disk is
-    /// complete and the `-wal` sidecar is gone. The in-memory grants
-    /// stand; only their mirror is let go. Graceful shutdown runs this
-    /// through the subsystem's registered task (see
-    /// [`crate::register_tasks`]) so a quit leaves exactly one
-    /// file to copy or back up. An ephemeral workspace has nothing to
-    /// close and returns at once.
-    ///
-    /// The close is a switch: it waits for any open, save-as, or
-    /// duplicate in flight, then marks the workspace closed so no later
-    /// switch installs a backing nobody would close. A second call is a
-    /// no-op.
-    pub async fn close_backing(&self) {
-        let _switch = self.switches.lock().await;
-        self.closed.store(true, Ordering::Release);
-        let previous = self
-            .backing
-            .write()
-            .unwrap_or_else(PoisonError::into_inner)
-            .take();
-        if let Some(previous) = previous {
-            previous.file.close().await;
-        }
-    }
-
-    /// Refuses a switch once [`Workspace::close_backing`] has run. Called
-    /// with the switch guard held, so the flag cannot flip underneath.
-    /// Expected during teardown, so it logs at debug.
-    fn refuse_if_closed(&self, what: &str) -> Result<(), WorkspaceError> {
-        if self.closed.load(Ordering::Acquire) {
-            tracing::debug!(what, "workspace switch refused: closed for shutdown");
-            return Err(WorkspaceFileError::Closed.into());
-        }
-        Ok(())
-    }
-
-    /// Stops the backing file's actor while leaving the backing in place,
-    /// so every later persist fails with a closed file and the file
-    /// itself can be reopened elsewhere. Exposes the logged-and-continue
-    /// path to tests; unlike [`Workspace::close_backing`], the workspace
-    /// still reports the file as its backing afterwards.
-    #[cfg(any(test, feature = "test-fixtures"))]
-    pub async fn close_backing_for_test(&self) {
-        if let Some(file) = self.backing_file() {
-            file.close().await;
-        }
-    }
-
-    /// The backing file's handle, if any, so a test can tell whether an
-    /// operation kept or replaced it.
-    #[cfg(test)]
-    pub(super) fn backing_file_for_test(&self) -> Option<WorkspaceFile> {
-        self.backing_file()
-    }
-
-    /// Holds the switch guard so a test can queue two switches behind it
-    /// and release them in a known order; the guard is acquired in
-    /// arrival order.
-    #[cfg(test)]
-    pub(super) async fn hold_switches_for_test(&self) -> tokio::sync::MutexGuard<'_, ()> {
-        self.switches.lock().await
-    }
-
-    /// A handle to the backing file, if any. The lock is released before
-    /// the caller awaits anything.
-    fn backing_file(&self) -> Option<WorkspaceFile> {
-        self.backing_parts().map(|(file, _)| file)
-    }
-
-    /// The backing file's handle and path, if any.
-    fn backing_parts(&self) -> Option<(WorkspaceFile, PathBuf)> {
-        self.backing
-            .read()
-            .unwrap_or_else(PoisonError::into_inner)
-            .as_ref()
-            .map(|backing| (backing.file.clone(), backing.path.clone()))
-    }
-
-    /// Installs `file` at `path` as the backing holding `ui_state` in
-    /// memory, records it as the last-used workspace, and closes the
-    /// previous backing, if any, waiting for its connection to go so the
-    /// old file is left complete with no sidecar. Called only with the
-    /// switch guard held.
-    async fn swap_backing(
-        &self,
-        file: WorkspaceFile,
-        path: &Path,
-        ui_state: BTreeMap<&'static str, Option<serde_json::Value>>,
-    ) {
-        let previous = self
-            .backing
-            .write()
-            .unwrap_or_else(PoisonError::into_inner)
-            .replace(Backing {
-                file,
-                path: path.to_path_buf(),
-                ui_state,
-            });
-        self.bump_roots();
-        self.remember(path).await;
-        if let Some(previous) = previous {
-            previous.file.close().await;
-        }
-    }
-
-    /// Re-reads `file`, the current backing, and applies what it holds:
-    /// the grants replace every current grant wholesale and the ui-state
-    /// map is replaced in place, under the same contract as an open of
-    /// any other file. The handle stays where it is. A file that cannot
-    /// be read changes nothing. Called only with the switch guard held,
-    /// so the backing it re-reads is still the backing when it applies.
-    async fn reload_current(
-        &self,
-        file: &WorkspaceFile,
-        path: &Path,
-    ) -> Result<(), WorkspaceError> {
-        let contents = file.contents().await?;
-        self.replace_all(contents.grants);
-        if let Some(backing) = self
-            .backing
-            .write()
-            .unwrap_or_else(PoisonError::into_inner)
-            .as_mut()
-        {
-            backing.ui_state = contents.ui_state;
-        }
-        self.remember(path).await;
-        Ok(())
-    }
-
-    /// The in-memory grants as file rows in grant order, each with its
-    /// own position and time, so a save-as writes the workspace's true
-    /// history rather than a fresh stamp over a path-sorted list.
-    fn grant_rows(&self) -> Vec<GrantRow> {
-        let mut rows: Vec<GrantRow> = self
-            .grants
-            .read()
-            .unwrap_or_else(PoisonError::into_inner)
-            .iter()
-            .map(|(path, meta)| GrantRow {
-                path: path.clone(),
-                position: meta.position,
-                added_at: meta.added_at.clone(),
-            })
-            .collect();
-        rows.sort_by_key(|row| row.position);
-        rows
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace/confine.rs b/crates/workshop/workspace/src/workspace/confine.rs
deleted file mode 100644
index 9b1d85d22..000000000
--- a/crates/workshop/workspace/src/workspace/confine.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-//! The confinement half of the workspace: the path checks every request
-//! passes before a filesystem operation, and the path helpers the grant
-//! and listing code share with them.
-//!
-//! A request path is first rejected lexically (`..` anywhere, and on
-//! Windows an NTFS alternate data stream name), then canonicalized so
-//! symlinks, `..`-free aliases, and UNC forms resolve to one on-disk path,
-//! and finally prefix-matched against the canonical grants. Write targets
-//! that do not exist yet confine their canonical parent and reattach the
-//! file name, so a new file can only ever land inside a grant.
-
-use std::fs;
-use std::io;
-use std::path::{Component, Path, PathBuf};
-use std::sync::PoisonError;
-use std::time::UNIX_EPOCH;
-
-use crate::error::WorkspaceError;
-
-use super::Workspace;
-
-impl Workspace {
-    /// Canonicalizes an existing path and confines it to the grants.
-    pub(super) fn confine_existing(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        reject_forbidden(path)?;
-        let canonical = canonicalize_simplified(path).map_err(|source| {
-            if source.kind() == io::ErrorKind::NotFound {
-                WorkspaceError::NotFound
-            } else {
-                WorkspaceError::ResolvePath { source }
-            }
-        })?;
-        self.check_confined(canonical)
-    }
-
-    /// Confines a write target: an existing path canonicalizes directly; a
-    /// new file confines its canonicalized parent and reattaches its name.
-    pub(super) fn confine_for_write(&self, path: &Path) -> Result<PathBuf, WorkspaceError> {
-        reject_forbidden(path)?;
-        match canonicalize_simplified(path) {
-            Ok(canonical) => self.check_confined(canonical),
-            Err(source) if source.kind() == io::ErrorKind::NotFound => {
-                // A dangling symlink canonicalizes as NotFound, but fs::write
-                // would follow it and create the target outside the grant.
-                match fs::symlink_metadata(path) {
-                    Ok(_) => return Err(WorkspaceError::OutsideGrants),
-                    Err(source) if source.kind() == io::ErrorKind::NotFound => {}
-                    Err(source) => return Err(WorkspaceError::InspectPath { source }),
-                }
-                let parent = path.parent().ok_or(WorkspaceError::NotFound)?;
-                let canonical_parent = canonicalize_simplified(parent).map_err(|source| {
-                    if source.kind() == io::ErrorKind::NotFound {
-                        WorkspaceError::NotFound
-                    } else {
-                        WorkspaceError::ResolvePath { source }
-                    }
-                })?;
-                let name = path.file_name().ok_or(WorkspaceError::ForbiddenComponent)?;
-                self.check_confined(canonical_parent.join(name))
-            }
-            Err(source) => Err(WorkspaceError::ResolvePath { source }),
-        }
-    }
-
-    /// Admits a canonical path that starts with a granted root.
-    fn check_confined(&self, canonical: PathBuf) -> Result<PathBuf, WorkspaceError> {
-        let grants = self.grants.read().unwrap_or_else(PoisonError::into_inner);
-        if grants.keys().any(|root| canonical.starts_with(root)) {
-            Ok(canonical)
-        } else {
-            Err(WorkspaceError::OutsideGrants)
-        }
-    }
-}
-
-/// Canonicalizes and strips Windows' `\\?\` verbatim prefix (a no-op on
-/// other platforms). Every path the workspace stores, compares, or returns
-/// goes through here, so grants and confinement checks stay in one form
-/// and the UI never sees the prefix.
-pub(super) fn canonicalize_simplified(path: &Path) -> io::Result<PathBuf> {
-    Ok(dunce::simplified(&path.canonicalize()?).to_path_buf())
-}
-
-/// Whether `requested` and `current` canonicalize to the same file. A
-/// path that does not canonicalize is not the same file; the open that
-/// follows reports why.
-pub(super) fn names_same_file(requested: &Path, current: &Path) -> bool {
-    canonicalize_simplified(requested).is_ok_and(|requested| {
-        canonicalize_simplified(current).is_ok_and(|current| current == requested)
-    })
-}
-
-/// Rejects the lexical tricks canonicalization would otherwise hide: `..`
-/// traversal everywhere, and `:` alternate data stream names on Windows,
-/// where a colon in a name addresses an NTFS stream. Elsewhere a colon is
-/// an ordinary filename character and passes.
-pub(super) fn reject_forbidden(path: &Path) -> Result<(), WorkspaceError> {
-    for component in path.components() {
-        match component {
-            Component::ParentDir => return Err(WorkspaceError::ForbiddenComponent),
-            #[cfg(windows)]
-            Component::Normal(name) if name.to_string_lossy().contains(':') => {
-                return Err(WorkspaceError::ForbiddenComponent);
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-/// A file's modification time as milliseconds since the Unix epoch.
-pub(super) fn modified_ms(metadata: &fs::Metadata) -> u64 {
-    metadata
-        .modified()
-        .ok()
-        .and_then(|time| time.duration_since(UNIX_EPOCH).ok())
-        .map_or(0, |duration| {
-            u64::try_from(duration.as_millis()).unwrap_or(u64::MAX)
-        })
-}
diff --git a/crates/workshop/workspace/src/workspace/pointer.rs b/crates/workshop/workspace/src/workspace/pointer.rs
deleted file mode 100644
index d34e0c7d6..000000000
--- a/crates/workshop/workspace/src/workspace/pointer.rs
+++ /dev/null
@@ -1,156 +0,0 @@
-//! The last-workspace pointer: a plain-text file in the state directory
-//! naming the workspace file that was open when the server last ran, so
-//! launch reopens it. It is written after every successful switch (open,
-//! save-as, duplicate) and read once at boot. Everything here is zone
-//! two: a pointer that cannot be written costs the next launch its
-//! reopen, and a pointer that cannot be read or followed starts the
-//! server ephemeral. Boot waits for the reopen so readiness means the
-//! grants are already in place, but it never fails for it.
-
-use std::fs;
-use std::io;
-use std::path::{Path, PathBuf};
-
-use crate::blocking::blocking;
-
-use super::Workspace;
-
-/// The pointer file's name inside the state directory.
-const POINTER_FILE: &str = "last-workspace";
-
-/// Where the last-used workspace file's path is remembered between runs:
-/// `state_dir/last-workspace`, holding the path as UTF-8 text.
-#[derive(Debug, Clone)]
-pub(super) struct LastWorkspacePointer {
-    /// The pointer file itself.
-    path: PathBuf,
-}
-
-impl LastWorkspacePointer {
-    /// The pointer inside `state_dir`; nothing is read or created yet.
-    pub(super) fn new(state_dir: &Path) -> Self {
-        Self {
-            path: state_dir.join(POINTER_FILE),
-        }
-    }
-
-    /// Records `workspace` as the last-used workspace file, atomically,
-    /// creating the state directory on a first run.
-    ///
-    /// # Errors
-    /// Returns the I/O failure when the path is not UTF-8 or the file
-    /// cannot be written.
-    pub(super) fn write(&self, workspace: &Path) -> io::Result<()> {
-        let text = workspace.to_str().ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::InvalidData,
-                "workspace path is not UTF-8; a UTF-8 path is required to remember it",
-            )
-        })?;
-        if let Some(parent) = self.path.parent() {
-            fs::create_dir_all(parent)?;
-        }
-        workshop_support::write_atomic(&self.path, text.as_bytes())
-    }
-
-    /// The remembered workspace file, or `None` when there is nothing
-    /// usable to follow. A missing pointer is the ordinary first launch
-    /// and logs nothing; unreadable, non-UTF-8, or empty content logs a
-    /// warning. A trailing newline from a hand edit is tolerated.
-    pub(super) fn read(&self) -> Option<PathBuf> {
-        let bytes = match fs::read(&self.path) {
-            Ok(bytes) => bytes,
-            Err(error) if error.kind() == io::ErrorKind::NotFound => return None,
-            Err(error) => {
-                tracing::warn!(
-                    %error,
-                    pointer = %self.path.display(),
-                    "last-workspace pointer unreadable; starting ephemeral"
-                );
-                return None;
-            }
-        };
-        let Ok(text) = String::from_utf8(bytes) else {
-            tracing::warn!(
-                pointer = %self.path.display(),
-                "last-workspace pointer is not UTF-8 text; starting ephemeral"
-            );
-            return None;
-        };
-        let trimmed = text.trim_end_matches(['\r', '\n']);
-        if trimmed.is_empty() {
-            tracing::warn!(
-                pointer = %self.path.display(),
-                "last-workspace pointer is empty; starting ephemeral"
-            );
-            return None;
-        }
-        Some(PathBuf::from(trimmed))
-    }
-}
-
-impl Workspace {
-    /// An ephemeral workspace that remembers its last-used file in
-    /// `state_dir`: every successful open, save-as, or duplicate records
-    /// the new file there, and [`Workspace::reopen_last`] follows the
-    /// record at boot. Nothing is read or written until then.
-    #[must_use]
-    pub fn with_state_dir(state_dir: &Path) -> Self {
-        Self {
-            pointer: Some(LastWorkspacePointer::new(state_dir)),
-            ..Self::default()
-        }
-    }
-
-    /// Reopens the workspace file the pointer names, if any, and returns
-    /// whether one was reopened. This never fails: a workspace built
-    /// without a state directory, a missing or corrupt pointer, a target
-    /// that has vanished, and a file that is refused all log and leave
-    /// the workspace ephemeral, so boot goes on regardless.
-    pub async fn reopen_last(&self) -> bool {
-        let Some(pointer) = self.pointer.clone() else {
-            return false;
-        };
-        let path = match blocking(move || pointer.read()).await {
-            Ok(Some(path)) => path,
-            Ok(None) => return false,
-            Err(error) => {
-                tracing::warn!(%error, "last-workspace pointer not read; starting ephemeral");
-                return false;
-            }
-        };
-        match self.open_file(&path).await {
-            Ok(()) => {
-                tracing::info!(file = %path.display(), "last-used workspace reopened");
-                true
-            }
-            Err(error) => {
-                tracing::warn!(
-                    %error,
-                    file = %path.display(),
-                    "last-used workspace not reopened; starting ephemeral"
-                );
-                false
-            }
-        }
-    }
-
-    /// Records `path` as the last-used workspace file when a state
-    /// directory is configured. The write runs on the blocking pool and
-    /// is awaited, so the pointer is on disk when this returns. A write
-    /// that fails is logged; the switch that just happened stands.
-    pub(super) async fn remember(&self, path: &Path) {
-        let Some(pointer) = self.pointer.clone() else {
-            return;
-        };
-        let target = path.to_path_buf();
-        let written = blocking(move || pointer.write(&target)).await;
-        if let Err(error) = written.unwrap_or_else(Err) {
-            tracing::warn!(
-                %error,
-                file = %path.display(),
-                "last-workspace pointer not written; the next launch starts ephemeral"
-            );
-        }
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace/stall.rs b/crates/workshop/workspace/src/workspace/stall.rs
deleted file mode 100644
index 176b4a0cb..000000000
--- a/crates/workshop/workspace/src/workspace/stall.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-//! A test-only write stall behind `test-fixtures`: it holds the next
-//! [`Workspace::write_file`] on the blocking pool until the test releases
-//! it, so the route deadline's 408 is reachable deterministically without
-//! a slow real write. nextest runs one test per process, so the per-write
-//! rendezvous held on the [`Workspace`] cannot leak across tests.
-//!
-//! [`Workspace`]: super::Workspace
-
-use std::fmt;
-use std::sync::mpsc;
-use std::sync::{Mutex, PoisonError};
-
-use super::Workspace;
-
-/// The armed rendezvous for one stalled write: `release` blocks the
-/// writer, `done` reports once the write has landed.
-pub(super) struct WriteStall {
-    armed: Mutex<Option<WriteRendezvous>>,
-}
-
-impl WriteStall {
-    pub(super) fn new() -> Self {
-        Self {
-            armed: Mutex::new(None),
-        }
-    }
-}
-
-impl fmt::Debug for WriteStall {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter.debug_struct("WriteStall").finish_non_exhaustive()
-    }
-}
-
-/// One armed stall's channels: the writer blocks on `release` and sends on
-/// `done` once the write has landed. Neither is `Debug`, so the struct
-/// stays plain data.
-struct WriteRendezvous {
-    release: mpsc::Receiver<()>,
-    done: mpsc::Sender<()>,
-}
-
-/// Signals that a released write has landed when dropped at the end of
-/// [`Workspace::write_file`].
-pub(super) struct WriteDone(mpsc::Sender<()>);
-
-impl Drop for WriteDone {
-    fn drop(&mut self) {
-        // The write may have been abandoned by the route deadline and never
-        // canceled; a failed send just means the test stopped listening.
-        let _ = self.0.send(());
-    }
-}
-
-/// The test's end of an armed stall: releases the stalled write, then
-/// reports once the write has landed on disk.
-#[must_use]
-pub struct WriteStallHandle {
-    release: mpsc::Sender<()>,
-    done: mpsc::Receiver<()>,
-}
-
-impl fmt::Debug for WriteStallHandle {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("WriteStallHandle")
-            .finish_non_exhaustive()
-    }
-}
-
-impl WriteStallHandle {
-    /// Lets the stalled write proceed.
-    pub fn release(&self) {
-        let _ = self.release.send(());
-    }
-
-    /// Blocks until the released write has landed on disk.
-    pub fn await_completion(&self) {
-        let _ = self.done.recv();
-    }
-}
-
-impl Workspace {
-    /// Arms a stall on the next write: the write blocks on the blocking
-    /// pool until the returned handle is released, after which
-    /// [`WriteStallHandle::await_completion`] reports the write landed.
-    pub fn stall_next_write_for_test(&self) -> WriteStallHandle {
-        let (release_tx, release_rx) = mpsc::channel();
-        let (done_tx, done_rx) = mpsc::channel();
-        *self
-            .stall
-            .armed
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner) = Some(WriteRendezvous {
-            release: release_rx,
-            done: done_tx,
-        });
-        WriteStallHandle {
-            release: release_tx,
-            done: done_rx,
-        }
-    }
-
-    /// Blocks on the armed stall, if any, and returns a guard that reports
-    /// completion on drop. Runs on the blocking pool inside
-    /// [`Workspace::write_file`], where a blocking wait is expected.
-    pub(super) fn stall_wait(&self) -> Option<WriteDone> {
-        let rendezvous = self
-            .stall
-            .armed
-            .lock()
-            .unwrap_or_else(PoisonError::into_inner)
-            .take()?;
-        // The route deadline may abandon this write while it waits; the
-        // blocking-pool task is not cancellable, so it stays here until the
-        // test releases it, then lands the write.
-        let _ = rendezvous.release.recv();
-        Some(WriteDone(rendezvous.done))
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace/tests.rs b/crates/workshop/workspace/src/workspace/tests.rs
deleted file mode 100644
index ab5dd659a..000000000
--- a/crates/workshop/workspace/src/workspace/tests.rs
+++ /dev/null
@@ -1,491 +0,0 @@
-//! Workspace tests: grants, confinement, tokens, tree listings, and revocation.
-
-use super::*;
-
-use crate::test_support::{granted_dir, simplified};
-
-mod backing;
-mod close;
-mod grants;
-mod jail;
-mod pointer;
-mod reopen;
-mod switch;
-mod ui_state_memory;
-#[cfg(feature = "test-fixtures")]
-mod write_stall;
-
-/// A memory-only revoke of `path`: the key it resolves to, then that
-/// key's removal.
-fn revoke(workspace: &Workspace, path: &Path) -> Result<PathBuf, WorkspaceError> {
-    let key = workspace.revoke_key(path)?;
-    workspace.remove_root(&key)?;
-    Ok(key)
-}
-
-#[test]
-fn a_folder_grant_grants_the_folder_itself() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let granted = workspace.grant(dir.path()).expect("grant succeeds");
-    assert_eq!(granted, simplified(dir.path()));
-    assert_eq!(workspace.granted_roots(), vec![granted]);
-}
-
-#[test]
-fn a_file_grant_grants_the_parent_directory() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = dir.path().join("dropped.txt");
-    fs::write(&file, "x").expect("seed the dropped file");
-    let granted = workspace.grant(&file).expect("grant succeeds");
-    assert_eq!(granted, simplified(dir.path()));
-    assert_eq!(workspace.granted_roots(), vec![granted]);
-}
-
-#[test]
-fn files_read_and_write_inside_a_grant() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    let written = workspace
-        .write_file(&file, "hello", None)
-        .expect("write inside the grant");
-    assert_eq!(written.text, "hello");
-    assert_eq!(written.size, 5);
-    let read = workspace.read_file(&file).expect("read inside the grant");
-    assert_eq!(read.text, "hello");
-    assert_eq!(read.size, 5);
-    assert_eq!(read.token, written.token);
-}
-
-#[test]
-fn writes_leave_no_temp_file_behind() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    let written = workspace
-        .write_file(&file, "one", None)
-        .expect("the create write succeeds");
-    workspace
-        .write_file(&file, "two", Some(&written.token))
-        .expect("the overwrite succeeds");
-    let names: Vec<String> = fs::read_dir(dir.path())
-        .expect("the granted directory is listable")
-        .map(|entry| {
-            entry
-                .expect("the entry is readable")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    assert_eq!(
-        names,
-        ["notes.txt"],
-        "the atomic write's temp file must not survive the write"
-    );
-}
-
-#[test]
-fn paths_outside_every_grant_are_rejected() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(dir.path().join("a.txt"), "a").expect("seed outside the grants");
-    let error = workspace
-        .read_file(&dir.path().join("a.txt"))
-        .expect_err("an ungranted path must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[test]
-fn parent_components_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let escape = dir.path().join("..").join("anything.txt");
-    let error = workspace
-        .read_file(&escape)
-        .expect_err("a .. component must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::ForbiddenComponent),
-        "expected ForbiddenComponent, got {error:?}"
-    );
-}
-
-#[cfg(windows)]
-#[test]
-fn alternate_data_stream_names_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let stream = dir.path().join("notes.txt:secret");
-    let error = workspace
-        .write_file(&stream, "hidden", None)
-        .expect_err("an alternate data stream name must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::ForbiddenComponent),
-        "expected ForbiddenComponent, got {error:?}"
-    );
-}
-
-#[test]
-fn a_symlink_escape_is_rejected() {
-    let (workspace, dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    fs::write(outside.path().join("secret.txt"), "secret").expect("seed the secret");
-    let link = dir.path().join("link");
-    #[cfg(unix)]
-    let linked = std::os::unix::fs::symlink(outside.path(), &link);
-    #[cfg(windows)]
-    let linked = std::os::windows::fs::symlink_dir(outside.path(), &link);
-    let Ok(()) = linked else {
-        // Symlink creation needs a privilege some Windows machines lack.
-        jail::symlink_unavailable(std::env::var_os("CI").is_some(), "symlink creation failed");
-        return;
-    };
-    let error = workspace
-        .read_file(&link.join("secret.txt"))
-        .expect_err("a symlink escape must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[test]
-fn a_dangling_symlink_write_is_rejected() {
-    let (workspace, dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    let target = outside.path().join("new.txt");
-    let link = dir.path().join("link.txt");
-    #[cfg(unix)]
-    let linked = std::os::unix::fs::symlink(&target, &link);
-    #[cfg(windows)]
-    let linked = std::os::windows::fs::symlink_file(&target, &link);
-    let Ok(()) = linked else {
-        // Symlink creation needs a privilege some Windows machines lack.
-        jail::symlink_unavailable(std::env::var_os("CI").is_some(), "symlink creation failed");
-        return;
-    };
-    let error = workspace
-        .write_file(&link, "payload", None)
-        .expect_err("a write through a dangling symlink must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-    assert!(!target.exists(), "nothing may be written outside the grant");
-}
-
-#[test]
-fn binary_files_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("bin.dat");
-    fs::write(&file, [0x66, 0x00, 0x66]).expect("seed a binary file");
-    let error = workspace
-        .read_file(&file)
-        .expect_err("a binary file must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::BinaryFile),
-        "expected BinaryFile, got {error:?}"
-    );
-}
-
-#[test]
-fn oversized_files_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("big.txt");
-    let big = vec![b'x'; usize::try_from(MAX_FILE_BYTES).expect("the limit fits") + 1];
-    fs::write(&file, big).expect("seed an oversized file");
-    let error = workspace
-        .read_file(&file)
-        .expect_err("an oversized file must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::FileTooLarge { .. }),
-        "expected FileTooLarge, got {error:?}"
-    );
-}
-
-#[test]
-fn oversized_writes_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let text = "x".repeat(usize::try_from(MAX_FILE_BYTES).expect("the limit fits") + 1);
-    let error = workspace
-        .write_file(&dir.path().join("big.txt"), &text, None)
-        .expect_err("an oversized write must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::FileTooLarge { .. }),
-        "expected FileTooLarge, got {error:?}"
-    );
-}
-
-#[test]
-fn a_stale_modified_token_conflicts() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("a.txt");
-    let written = workspace
-        .write_file(&file, "one", None)
-        .expect("initial write");
-    let stale = format!("{}-stale", written.token);
-    let error = workspace
-        .write_file(&file, "two", Some(&stale))
-        .expect_err("a stale token must conflict");
-    assert!(
-        matches!(error, WorkspaceError::ModifiedConflict),
-        "expected ModifiedConflict, got {error:?}"
-    );
-    let rewritten = workspace
-        .write_file(&file, "two", Some(&written.token))
-        .expect("the fresh token writes");
-    assert_eq!(rewritten.text, "two");
-}
-
-#[test]
-fn a_tokenless_write_to_an_existing_file_conflicts() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("a.txt");
-    workspace
-        .write_file(&file, "one", None)
-        .expect("initial write");
-    let error = workspace
-        .write_file(&file, "two", None)
-        .expect_err("a write with no token over an existing file must conflict");
-    assert!(
-        matches!(error, WorkspaceError::ModifiedConflict),
-        "expected ModifiedConflict, got {error:?}"
-    );
-}
-
-#[test]
-fn the_token_tracks_mtime_and_length_not_write_count() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("t.txt");
-    let written = workspace.write_file(&file, "one", None).expect("write");
-    let metadata = fs::metadata(&file).expect("metadata");
-    // The token is a pure function of full-precision mtime plus length:
-    // a same-content rewrite changes it exactly when the filesystem
-    // reports a new mtime or length, and never otherwise.
-    assert_eq!(Some(written.token.clone()), mtime_token(&metadata));
-    let rewritten = workspace
-        .write_file(&file, "one", Some(&written.token))
-        .expect("same-content rewrite");
-    let metadata = fs::metadata(&file).expect("metadata after rewrite");
-    assert_eq!(Some(rewritten.token), mtime_token(&metadata));
-    // Reading without a write in between re-derives the same token.
-    let reread = workspace.read_file(&file).expect("read");
-    let again = workspace.read_file(&file).expect("second read");
-    assert_eq!(reread.token, again.token);
-}
-
-#[test]
-fn the_hash_fallback_token_round_trips() {
-    let token = hash_token(b"same contents");
-    assert_eq!(
-        token,
-        hash_token(b"same contents"),
-        "the fallback token must be stable for identical contents"
-    );
-    assert!(token.starts_with("h-"), "got {token}");
-    assert_ne!(token, hash_token(b"different contents"));
-}
-
-#[cfg(unix)]
-#[test]
-fn colon_named_files_read_and_write_on_unix() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("backup-12:30.log");
-    let written = workspace
-        .write_file(&file, "ok", None)
-        .expect("a colon-named file writes on unix");
-    let read = workspace
-        .read_file(&file)
-        .expect("a colon-named file reads on unix");
-    assert_eq!(read.text, "ok");
-    assert_eq!(read.token, written.token);
-}
-
-#[test]
-fn tree_lists_directories_before_files_with_stable_ordering() {
-    let (workspace, dir) = granted_dir();
-    fs::create_dir(dir.path().join("zeta")).expect("dir");
-    fs::create_dir(dir.path().join("alpha")).expect("dir");
-    fs::write(dir.path().join("b.txt"), "b").expect("file");
-    fs::write(dir.path().join("a.txt"), "a").expect("file");
-    let listing = workspace.tree(Some(dir.path())).expect("tree");
-    let names: Vec<&str> = listing
-        .entries
-        .iter()
-        .map(|entry| entry.name.as_str())
-        .collect();
-    assert_eq!(names, ["alpha", "zeta", "a.txt", "b.txt"]);
-    assert_eq!(listing.entries[0].kind, EntryKind::Directory);
-    assert_eq!(listing.entries[3].kind, EntryKind::File);
-    assert!(
-        listing.entries.iter().all(|entry| entry.exists),
-        "an enumerated directory entry is on disk by construction"
-    );
-}
-
-#[test]
-fn a_tree_without_a_path_lists_the_granted_roots() {
-    let (workspace, dir) = granted_dir();
-    let listing = workspace.tree(None).expect("roots listing");
-    assert_eq!(listing.path, None);
-    assert_eq!(listing.entries.len(), 1);
-    let root = simplified(dir.path());
-    assert_eq!(listing.entries[0].path, root);
-    // A root row shows the folder's own name, not the whole path.
-    assert_eq!(
-        listing.entries[0].name,
-        root.file_name().expect("leaf").to_string_lossy()
-    );
-    assert_eq!(listing.entries[0].kind, EntryKind::Directory);
-    assert!(listing.entries[0].exists, "a live root lists as existing");
-}
-
-#[test]
-fn the_roots_listing_flags_a_deleted_root_as_missing() {
-    let workspace = Workspace::new();
-    let kept = tempfile::TempDir::new().expect("tempdir");
-    let doomed = tempfile::TempDir::new().expect("tempdir");
-    let kept_root = workspace.grant(kept.path()).expect("grant the kept root");
-    let doomed_root = workspace
-        .grant(doomed.path())
-        .expect("grant the doomed root");
-    doomed.close().expect("delete the doomed directory");
-    let listing = workspace.tree(None).expect("roots listing");
-    assert_eq!(listing.entries.len(), 2);
-    for entry in &listing.entries {
-        if entry.path == doomed_root {
-            assert!(!entry.exists, "the deleted root must list as missing");
-        } else {
-            assert_eq!(entry.path, kept_root);
-            assert!(entry.exists, "the live root must list as existing");
-        }
-    }
-}
-
-#[test]
-fn a_revoke_removes_the_granted_root() {
-    let (workspace, dir) = granted_dir();
-    let revoked = revoke(&workspace, dir.path()).expect("revoke the grant");
-    assert_eq!(revoked, simplified(dir.path()));
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-}
-
-#[test]
-fn revoking_an_unknown_root_errors() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let error = revoke(&workspace, dir.path()).expect_err("an ungranted root must not revoke");
-    assert!(
-        matches!(error, WorkspaceError::NotGranted),
-        "expected NotGranted, got {error:?}"
-    );
-}
-
-#[test]
-fn a_deleted_root_can_still_be_revoked() {
-    let (workspace, dir) = granted_dir();
-    let root = simplified(dir.path());
-    dir.close().expect("delete the granted directory");
-    let revoked = revoke(&workspace, &root).expect("revoke the deleted root");
-    assert_eq!(revoked, root);
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-}
-
-#[test]
-fn a_spelling_variant_revokes_the_same_root() {
-    let (workspace, dir) = granted_dir();
-    let variant = PathBuf::from(format!(
-        "{}{}",
-        dir.path().display(),
-        std::path::MAIN_SEPARATOR
-    ));
-    let revoked = revoke(&workspace, &variant).expect("a trailing separator names the same root");
-    assert_eq!(revoked, simplified(dir.path()));
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-}
-
-#[test]
-fn reads_and_writes_under_a_revoked_root_are_rejected() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    let written = workspace
-        .write_file(&file, "hello", None)
-        .expect("write before the revoke");
-    revoke(&workspace, dir.path()).expect("revoke the grant");
-    let error = workspace
-        .read_file(&file)
-        .expect_err("a read under a revoked root must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-    let error = workspace
-        .write_file(&file, "later", Some(&written.token))
-        .expect_err("a write under a revoked root must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[test]
-fn a_nested_grant_survives_its_parents_revoke() {
-    let workspace = Workspace::new();
-    let parent = tempfile::TempDir::new().expect("tempdir");
-    let child = parent.path().join("child");
-    fs::create_dir(&child).expect("create the nested directory");
-    fs::write(parent.path().join("outer.txt"), "outer").expect("seed the parent");
-    fs::write(child.join("inner.txt"), "inner").expect("seed the child");
-    workspace.grant(parent.path()).expect("grant the parent");
-    workspace.grant(&child).expect("grant the child");
-    revoke(&workspace, parent.path()).expect("revoke the parent");
-    assert_eq!(workspace.granted_roots(), vec![simplified(&child)]);
-    let read = workspace
-        .read_file(&child.join("inner.txt"))
-        .expect("the nested grant stays usable");
-    assert_eq!(read.text, "inner");
-    let error = workspace
-        .read_file(&parent.path().join("outer.txt"))
-        .expect_err("the parent's own files lose access");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[test]
-fn a_directory_is_neither_read_nor_written_as_a_file() {
-    let (workspace, dir) = granted_dir();
-    let nested = dir.path().join("nested");
-    fs::create_dir(&nested).expect("create the nested directory");
-    let error = workspace
-        .read_file(&nested)
-        .expect_err("a directory cannot be read as a file");
-    assert!(
-        matches!(error, WorkspaceError::NotAFile),
-        "expected NotAFile from the read, got {error:?}"
-    );
-    let error = workspace
-        .write_file(&nested, "text", None)
-        .expect_err("a directory cannot be written as a file");
-    assert!(
-        matches!(error, WorkspaceError::NotAFile),
-        "expected NotAFile from the write, got {error:?}"
-    );
-    assert!(nested.is_dir(), "the refused write leaves the directory");
-}
-
-#[test]
-fn a_tree_of_a_file_is_rejected() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("a.txt");
-    fs::write(&file, "a").expect("seed");
-    let error = workspace
-        .tree(Some(&file))
-        .expect_err("a file cannot be listed");
-    assert!(
-        matches!(error, WorkspaceError::NotADirectory),
-        "expected NotADirectory, got {error:?}"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/backing.rs b/crates/workshop/workspace/src/workspace/tests/backing.rs
deleted file mode 100644
index 49e4ca94d..000000000
--- a/crates/workshop/workspace/src/workspace/tests/backing.rs
+++ /dev/null
@@ -1,463 +0,0 @@
-//! The optional workspace-file backing: what an ephemeral workspace
-//! persists (nothing), what a file-backed one persists (every grant
-//! mutation and the window state), how open replaces the grant set, how
-//! save-as and duplicate switch files, and the path where a failed
-//! persist leaves memory standing.
-
-use super::*;
-
-use crate::workspace::backing::EPHEMERAL_NAME;
-use crate::workspace_file::{WindowState, WorkspaceFile, open_database};
-
-/// Opens the file at `path` directly, bypassing any `Workspace`, and
-/// returns the grant paths it holds in file order.
-async fn file_grants(path: &Path) -> Vec<PathBuf> {
-    let file = WorkspaceFile::open(path)
-        .await
-        .expect("the workspace file reopens on its own");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    contents
-        .grants
-        .into_iter()
-        .map(|grant| grant.path)
-        .collect()
-}
-
-/// A window geometry distinguished by `width`.
-fn window(width: u32) -> WindowState {
-    WindowState {
-        width,
-        height: 700,
-        x: 5,
-        y: 6,
-        maximized: false,
-    }
-}
-
-/// The sorted names of every entry directly inside `dir`.
-fn names_in(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-#[tokio::test]
-async fn grant_then_revoke_on_a_file_backed_workspace_persist_and_reopen_reflects_both() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let kept = tempfile::TempDir::new().expect("tempdir");
-    let dropped = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-
-    let kept_root = workspace
-        .grant_and_persist(kept.path())
-        .await
-        .expect("the kept grant lands");
-    workspace
-        .grant_and_persist(dropped.path())
-        .await
-        .expect("the dropped grant lands");
-    workspace
-        .revoke_and_persist(dropped.path())
-        .await
-        .expect("the revoke lands");
-    workspace.close_backing_for_test().await;
-
-    // A fresh workspace knows nothing but what the file says.
-    let reopened = Workspace::new();
-    reopened
-        .open_file(&file_path)
-        .await
-        .expect("the saved file opens");
-    assert_eq!(
-        reopened.granted_roots(),
-        vec![kept_root.clone()],
-        "the grant persisted and the revoke persisted"
-    );
-    let current = reopened.current().await;
-    assert_eq!(current.path.as_deref(), Some(file_path.as_path()));
-    assert_eq!(current.name, "mine");
-    assert_eq!(
-        current.grants,
-        vec![GrantEntry {
-            path: kept_root,
-            exists: true,
-        }]
-    );
-}
-
-#[tokio::test]
-async fn grants_on_an_ephemeral_workspace_leave_no_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("an ephemeral grant lands in memory");
-    let saved = workspace
-        .put_window_state(window(800))
-        .await
-        .expect("an ephemeral window save is a no-op, not a failure");
-
-    assert_eq!(workspace.granted_roots(), vec![root.clone()]);
-    assert!(!saved, "nothing was written, and the caller is told so");
-    assert_eq!(
-        names_in(dir.path()),
-        Vec::<String>::new(),
-        "an ephemeral workspace writes nothing anywhere"
-    );
-    let current = workspace.current().await;
-    assert_eq!(current.path, None, "an ephemeral workspace has no file");
-    assert_eq!(current.name, EPHEMERAL_NAME);
-    assert!(current.window_state.is_none());
-    assert_eq!(
-        current.grants,
-        vec![GrantEntry {
-            path: root,
-            exists: true
-        }]
-    );
-}
-
-#[tokio::test]
-async fn open_replaces_every_prior_grant_with_the_files() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("theirs.rvwork");
-    let theirs = tempfile::TempDir::new().expect("tempdir");
-    let mine = tempfile::TempDir::new().expect("tempdir");
-    // Author a file holding one grant, then let go of it.
-    let author = Workspace::new();
-    author.grant(theirs.path()).expect("grant their root");
-    author.save_as(&file_path).await.expect("save as creates");
-    author.close_backing_for_test().await;
-
-    let workspace = Workspace::new();
-    workspace.grant(mine.path()).expect("grant my root");
-    workspace
-        .open_file(&file_path)
-        .await
-        .expect("the authored file opens");
-
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![simplified(theirs.path())],
-        "open is wholesale: the prior grant is gone and the file's grant is in"
-    );
-    let current = workspace.current().await;
-    assert_eq!(current.path.as_deref(), Some(file_path.as_path()));
-    assert_eq!(current.name, "theirs");
-}
-
-#[tokio::test]
-async fn a_vanished_root_stays_granted_and_lists_as_missing() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("vanished.rvwork");
-    let doomed = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let doomed_root = workspace
-        .grant(doomed.path())
-        .expect("grant the doomed root");
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    doomed.close().expect("delete the doomed directory");
-
-    let current = workspace.current().await;
-    assert_eq!(
-        current.grants,
-        vec![GrantEntry {
-            path: doomed_root.clone(),
-            exists: false,
-        }],
-        "a live workspace flags the vanished root"
-    );
-
-    workspace.close_backing_for_test().await;
-    let reopened = Workspace::new();
-    reopened
-        .open_file(&file_path)
-        .await
-        .expect("a file naming a vanished root still opens");
-    assert_eq!(
-        reopened.granted_roots(),
-        vec![doomed_root.clone()],
-        "the vanished root loads rather than being dropped on open"
-    );
-    assert_eq!(
-        reopened.current().await.grants,
-        vec![GrantEntry {
-            path: doomed_root,
-            exists: false,
-        }]
-    );
-}
-
-#[tokio::test]
-async fn a_persist_failure_keeps_the_in_memory_grant_and_returns_success() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("closed.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    // The actor behind the backing stops; the backing stays installed,
-    // so every persist from here on fails with a closed file.
-    workspace.close_backing_for_test().await;
-
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("a grant whose persist fails still succeeds");
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![root.clone()],
-        "the in-memory grant stands"
-    );
-    assert!(
-        file_grants(&file_path).await.is_empty(),
-        "the closed file never received the grant"
-    );
-
-    workspace
-        .revoke_and_persist(dir.path())
-        .await
-        .expect("a revoke whose persist fails still succeeds");
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-
-    let current = workspace.current().await;
-    assert_eq!(
-        current.path.as_deref(),
-        Some(file_path.as_path()),
-        "the backing is still reported"
-    );
-    assert_eq!(
-        current.name, "closed",
-        "an unreadable file degrades to its stem"
-    );
-    assert!(current.window_state.is_none());
-}
-
-#[tokio::test]
-async fn save_as_copies_the_current_grants_and_the_previous_window_state() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let first_path = home.path().join("first.rvwork");
-    let second_path = home.path().join("second.rvwork");
-    let a = tempfile::TempDir::new().expect("tempdir");
-    let b = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let a_root = workspace.grant(a.path()).expect("grant a");
-    workspace
-        .save_as(&first_path)
-        .await
-        .expect("the first save as creates");
-    let saved = workspace
-        .put_window_state(window(1111))
-        .await
-        .expect("a file-backed window save lands");
-    assert!(saved, "the caller is told the write happened");
-    let b_root = workspace
-        .grant_and_persist(b.path())
-        .await
-        .expect("grant b persists");
-
-    workspace
-        .save_as(&second_path)
-        .await
-        .expect("the second save as creates");
-
-    let current = workspace.current().await;
-    assert_eq!(current.path.as_deref(), Some(second_path.as_path()));
-    assert_eq!(current.name, "second");
-    assert_eq!(
-        current.window_state.map(|state| state.width),
-        Some(1111),
-        "the window state travels to the new file"
-    );
-    workspace.close_backing_for_test().await;
-    let mut expected = vec![a_root, b_root];
-    expected.sort();
-    let mut in_second = file_grants(&second_path).await;
-    in_second.sort();
-    assert_eq!(
-        in_second, expected,
-        "the new file holds every current grant"
-    );
-    let mut in_first = file_grants(&first_path).await;
-    in_first.sort();
-    assert_eq!(
-        in_first, expected,
-        "the first file keeps what was persisted into it while it was the backing"
-    );
-    assert_eq!(
-        names_in(home.path()),
-        ["first.rvwork", "second.rvwork"],
-        "save as creates exactly one more file and closes the first cleanly"
-    );
-}
-
-#[tokio::test]
-async fn duplicate_switches_to_the_copy_and_leaves_the_original_independent() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let original_path = home.path().join("original.rvwork");
-    let copy_path = home.path().join("copy.rvwork");
-    let a = tempfile::TempDir::new().expect("tempdir");
-    let b = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let a_root = workspace.grant(a.path()).expect("grant a");
-    workspace
-        .save_as(&original_path)
-        .await
-        .expect("save as creates");
-
-    workspace
-        .duplicate(&copy_path)
-        .await
-        .expect("the duplicate opens");
-    let current = workspace.current().await;
-    assert_eq!(
-        current.path.as_deref(),
-        Some(copy_path.as_path()),
-        "duplicate switches to the copy"
-    );
-    assert_eq!(
-        current.name, "original",
-        "the copy keeps the original's display name"
-    );
-    assert_eq!(workspace.granted_roots(), vec![a_root.clone()]);
-
-    let b_root = workspace
-        .grant_and_persist(b.path())
-        .await
-        .expect("grant b persists into the copy");
-    workspace.close_backing_for_test().await;
-
-    let mut expected = vec![a_root.clone(), b_root];
-    expected.sort();
-    let mut copied = file_grants(&copy_path).await;
-    copied.sort();
-    assert_eq!(copied, expected, "the copy took the later grant");
-    assert_eq!(
-        file_grants(&original_path).await,
-        vec![a_root],
-        "the original never saw it"
-    );
-}
-
-#[tokio::test]
-async fn an_ephemeral_duplicate_is_a_save_as() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("from-nothing.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant");
-
-    workspace
-        .duplicate(&path)
-        .await
-        .expect("an ephemeral workspace duplicates into a fresh file");
-
-    let current = workspace.current().await;
-    assert_eq!(current.path.as_deref(), Some(path.as_path()));
-    workspace.close_backing_for_test().await;
-    assert_eq!(file_grants(&path).await, vec![root]);
-}
-
-#[tokio::test]
-async fn an_alien_file_is_refused_and_the_workspace_is_unchanged() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let alien_path = home.path().join("alien.rvwork");
-    let mine = tempfile::TempDir::new().expect("tempdir");
-    {
-        let conn = open_database(&alien_path)
-            .await
-            .expect("the alien database opens");
-        conn.execute_batch("CREATE TABLE notes (body TEXT NOT NULL);")
-            .await
-            .expect("a foreign table creates");
-    }
-    let workspace = Workspace::new();
-    let root = workspace.grant(mine.path()).expect("grant mine");
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-
-    let error = workspace
-        .open_file(&alien_path)
-        .await
-        .expect_err("a database without the stamp is refused");
-
-    assert!(
-        matches!(error, WorkspaceError::WorkspaceFileRefused { .. }),
-        "expected WorkspaceFileRefused, got {error:?}"
-    );
-    assert_eq!(workspace.granted_roots(), vec![root], "the grants stand");
-    assert_eq!(
-        workspace.current().await.path.as_deref(),
-        Some(file_path.as_path()),
-        "the backing stands"
-    );
-}
-
-#[tokio::test]
-async fn opening_a_missing_path_is_not_found() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-
-    let error = workspace
-        .open_file(&home.path().join("nowhere.rvwork"))
-        .await
-        .expect_err("a missing file cannot open");
-
-    assert!(
-        matches!(error, WorkspaceError::NotFound),
-        "expected NotFound, got {error:?}"
-    );
-    assert_eq!(workspace.current().await.path, None);
-}
-
-#[tokio::test]
-async fn save_as_onto_an_existing_path_is_refused_as_taken() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let taken = home.path().join("taken.rvwork");
-    fs::write(&taken, b"already here").expect("placeholder writes");
-    let workspace = Workspace::new();
-
-    let error = workspace
-        .save_as(&taken)
-        .await
-        .expect_err("save as never overwrites");
-
-    assert!(
-        matches!(error, WorkspaceError::WorkspaceFileTaken),
-        "expected WorkspaceFileTaken, got {error:?}"
-    );
-    assert_eq!(
-        fs::read(&taken).expect("placeholder reads"),
-        b"already here"
-    );
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "the workspace stays ephemeral"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/close.rs b/crates/workshop/workspace/src/workspace/tests/close.rs
deleted file mode 100644
index 0a04ed641..000000000
--- a/crates/workshop/workspace/src/workspace/tests/close.rs
+++ /dev/null
@@ -1,136 +0,0 @@
-//! Closing the backing at shutdown: an ephemeral workspace has nothing
-//! to close and says so quietly, a file-backed one folds its WAL into
-//! the file and drops the sidecar, leaving exactly one file behind with
-//! every grant in it while the in-memory grants stand, and the
-//! registered background task hands the server that close as its
-//! shutdown lever.
-
-use super::*;
-
-use workshop_registry::Registry;
-
-use crate::handles::register_tasks;
-use crate::workspace_file::WorkspaceFile;
-
-/// The sorted names of every entry directly inside `dir`.
-fn names_in(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-#[tokio::test]
-async fn close_backing_on_an_ephemeral_workspace_is_a_no_op() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let root = workspace.grant(dir.path()).expect("grant lands in memory");
-
-    workspace.close_backing().await;
-    workspace.close_backing().await;
-
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "an ephemeral workspace stays ephemeral"
-    );
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![root],
-        "closing nothing touches no grant"
-    );
-}
-
-#[tokio::test]
-async fn close_backing_leaves_one_file_and_no_sidecar() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands");
-
-    workspace.close_backing().await;
-
-    assert_eq!(
-        names_in(home.path()),
-        ["mine.rvwork"],
-        "the WAL is folded in and the sidecar is gone"
-    );
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "the workspace is ephemeral once its file is closed"
-    );
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![root.clone()],
-        "the confinement grants stand; only the mirror was let go"
-    );
-    let file = WorkspaceFile::open(&file_path)
-        .await
-        .expect("the closed file reopens on its own");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    assert_eq!(
-        contents
-            .grants
-            .into_iter()
-            .map(|grant| grant.path)
-            .collect::<Vec<_>>(),
-        vec![root],
-        "the grant persisted before the close is in the file"
-    );
-}
-
-#[tokio::test]
-async fn the_registered_task_closes_the_backing_on_shutdown() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let registry = Registry::new();
-    let workspace = Workspace::new();
-    let _registration = register_tasks(&registry, &workspace);
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-
-    let tasks = registry.tasks();
-    assert_eq!(tasks.len(), 1, "the subsystem registers one shutdown lever");
-    // The server's sequence: spawn with serving, stop inside the graceful
-    // shutdown. The spawn starts nothing (the actor already runs); the
-    // stop is what closes the file.
-    let handle = tasks[0].spawn();
-    assert_eq!(
-        workspace.current().await.path.as_deref(),
-        Some(file_path.as_path()),
-        "spawning the task leaves the backing open"
-    );
-
-    handle.shutdown().await;
-
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "the shutdown lever closed the backing"
-    );
-    assert_eq!(
-        names_in(home.path()),
-        ["mine.rvwork"],
-        "the file is complete and the sidecar is gone"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/grants.rs b/crates/workshop/workspace/src/workspace/tests/grants.rs
deleted file mode 100644
index 0720aff07..000000000
--- a/crates/workshop/workspace/src/workspace/tests/grants.rs
+++ /dev/null
@@ -1,235 +0,0 @@
-//! Grant order and time in memory: save-as writes the grants in the
-//! order they were made, each with its own time, whether the workspace
-//! was file-backed or ephemeral, and positions loaded from a file
-//! survive a save-as unchanged. Every grant, revoke, and switch
-//! signals a roots change.
-
-use super::*;
-
-use std::sync::atomic::{AtomicU32, Ordering};
-
-use crate::workspace_file::{GrantRow, WorkspaceContents, WorkspaceFile, empty_ui_state};
-
-/// Opens the file at `path` directly, bypassing any `Workspace`, and
-/// returns the grant rows it holds in file order.
-async fn file_rows(path: &Path) -> Vec<GrantRow> {
-    let file = WorkspaceFile::open(path)
-        .await
-        .expect("the workspace file reopens on its own");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    contents.grants
-}
-
-/// The ticks handed out by [`ticking_clock`] so far, shared by every
-/// test in the process: each grant reads the next one, so two grants in
-/// one test never share a stamp however the tests interleave.
-static TICKS: AtomicU32 = AtomicU32::new(0);
-
-/// A clock that moves one second per reading, so consecutive grants get
-/// distinct `added_at` stamps without waiting for the wall clock.
-fn ticking_clock() -> String {
-    let tick = TICKS.fetch_add(1, Ordering::SeqCst);
-    format!("2026-09-16T10:{:02}:{:02}Z", (tick / 60) % 60, tick % 60)
-}
-
-/// An ephemeral workspace whose grant times come from [`ticking_clock`].
-fn ticking_workspace() -> Workspace {
-    Workspace::new().with_clock_for_test(ticking_clock)
-}
-
-/// Grants `z` then `a` (reverse canonical order, so order-by-path and
-/// order-by-grant disagree) with distinct times, and returns their roots.
-async fn grant_z_then_a(
-    workspace: &Workspace,
-    z: &tempfile::TempDir,
-    a: &tempfile::TempDir,
-) -> (PathBuf, PathBuf) {
-    let z_root = workspace
-        .grant_and_persist(z.path())
-        .await
-        .expect("grant z lands");
-    // The workspace's clock ticks once per grant, so a's time is one
-    // second past z's without waiting on the wall clock.
-    let a_root = workspace
-        .grant_and_persist(a.path())
-        .await
-        .expect("grant a lands");
-    (z_root, a_root)
-}
-
-/// Asserts the saved rows are `z` at position 0 then `a` at position 1,
-/// each with its own time.
-fn assert_z_then_a(rows: &[GrantRow], z_root: &Path, a_root: &Path) {
-    assert_eq!(
-        rows.iter().map(|row| row.path.clone()).collect::<Vec<_>>(),
-        vec![z_root.to_path_buf(), a_root.to_path_buf()],
-        "the new file holds the grants in the order they were made, not by path"
-    );
-    assert_eq!(
-        rows.iter().map(|row| row.position).collect::<Vec<_>>(),
-        vec![0, 1],
-        "positions count from zero in grant order"
-    );
-    assert_ne!(
-        rows[0].added_at, rows[1].added_at,
-        "each grant keeps its own time rather than a shared save-as stamp"
-    );
-}
-
-/// Two tempdirs whose canonical paths sort as `z` after `a`, plus the
-/// parent that holds them, which must outlive the test.
-fn z_and_a() -> (tempfile::TempDir, tempfile::TempDir, tempfile::TempDir) {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let z = tempfile::Builder::new()
-        .prefix("z-")
-        .tempdir_in(home.path())
-        .expect("tempdir z");
-    let a = tempfile::Builder::new()
-        .prefix("a-")
-        .tempdir_in(home.path())
-        .expect("tempdir a");
-    (home, z, a)
-}
-
-#[tokio::test]
-async fn save_as_from_a_file_backed_workspace_keeps_grant_order_and_times() {
-    let files = tempfile::TempDir::new().expect("tempdir");
-    let first_path = files.path().join("first.rvwork");
-    let second_path = files.path().join("second.rvwork");
-    let (_home, z, a) = z_and_a();
-    let workspace = ticking_workspace();
-    workspace
-        .save_as(&first_path)
-        .await
-        .expect("the first save as creates");
-
-    let (z_root, a_root) = grant_z_then_a(&workspace, &z, &a).await;
-    assert!(
-        z_root > a_root,
-        "the fixture must grant in reverse path order"
-    );
-    workspace
-        .save_as(&second_path)
-        .await
-        .expect("the second save as creates");
-    workspace.close_backing_for_test().await;
-
-    assert_z_then_a(&file_rows(&second_path).await, &z_root, &a_root);
-}
-
-#[tokio::test]
-async fn save_as_from_an_ephemeral_workspace_keeps_grant_order_and_times() {
-    let files = tempfile::TempDir::new().expect("tempdir");
-    let path = files.path().join("fresh.rvwork");
-    let (_home, z, a) = z_and_a();
-    let workspace = ticking_workspace();
-
-    let (z_root, a_root) = grant_z_then_a(&workspace, &z, &a).await;
-    assert!(
-        z_root > a_root,
-        "the fixture must grant in reverse path order"
-    );
-    workspace.save_as(&path).await.expect("save as creates");
-    workspace.close_backing_for_test().await;
-
-    assert_z_then_a(&file_rows(&path).await, &z_root, &a_root);
-}
-
-#[tokio::test]
-async fn replace_all_preserves_stored_positions_through_save_as() {
-    let files = tempfile::TempDir::new().expect("tempdir");
-    let source_path = files.path().join("source.rvwork");
-    let copy_path = files.path().join("copy.rvwork");
-    let a = tempfile::TempDir::new().expect("tempdir a");
-    let b = tempfile::TempDir::new().expect("tempdir b");
-    let a_root = simplified(a.path());
-    let b_root = simplified(b.path());
-    let authored = vec![
-        GrantRow {
-            path: b_root.clone(),
-            position: 5,
-            added_at: "2026-09-16T10:00:00Z".to_string(),
-        },
-        GrantRow {
-            path: a_root.clone(),
-            position: 7,
-            added_at: "2026-09-16T10:00:07Z".to_string(),
-        },
-    ];
-    let contents = WorkspaceContents {
-        name: "source".to_string(),
-        grants: authored.clone(),
-        window_state: None,
-        ui_state: empty_ui_state(),
-    };
-    WorkspaceFile::create(&source_path, &contents)
-        .await
-        .expect("the source file creates")
-        .close()
-        .await;
-
-    let workspace = Workspace::new();
-    workspace
-        .open_file(&source_path)
-        .await
-        .expect("the source file opens");
-    workspace
-        .save_as(&copy_path)
-        .await
-        .expect("save as creates the copy");
-    workspace.close_backing_for_test().await;
-
-    assert_eq!(
-        file_rows(&copy_path).await,
-        authored,
-        "b before a with the stored positions and times intact"
-    );
-}
-
-#[tokio::test]
-async fn grants_revokes_and_switches_each_signal_a_roots_change() {
-    let files = tempfile::TempDir::new().expect("tempdir");
-    let current = files.path().join("current.rvwork");
-    let other = files.path().join("other.rvwork");
-    let writer = Workspace::new();
-    writer
-        .save_as(&other)
-        .await
-        .expect("the other file creates");
-    writer.close_backing().await;
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    let mut roots = workspace.subscribe_roots();
-    let mut signalled = |what: &str| {
-        assert!(
-            roots.has_changed().expect("the workspace holds the sender"),
-            "{what} signals a roots change"
-        );
-        roots.mark_unchanged();
-    };
-
-    workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands");
-    signalled("a grant");
-    workspace
-        .revoke_and_persist(dir.path())
-        .await
-        .expect("the revoke lands");
-    signalled("a revoke");
-    workspace.save_as(&current).await.expect("save as creates");
-    signalled("a save as");
-    workspace
-        .open_file(&other)
-        .await
-        .expect("the other file opens");
-    signalled("an open of another file");
-    workspace
-        .open_file(&other)
-        .await
-        .expect("the current file reloads");
-    signalled("a reload of the current file");
-    workspace.close_backing().await;
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/jail.rs b/crates/workshop/workspace/src/workspace/tests/jail.rs
deleted file mode 100644
index e668a0445..000000000
--- a/crates/workshop/workspace/src/workspace/tests/jail.rs
+++ /dev/null
@@ -1,380 +0,0 @@
-//! Jail edge cases: the path-spelling tricks that must never escape the
-//! grants, how linked folders and files list and open, and the CI-aware
-//! helper that turns a silent symlink skip into a CI failure.
-//!
-//! The confinement pipeline in `workspace/confine.rs` rejects `..` and
-//! Windows alternate-data-stream colons lexically, canonicalizes the rest
-//! (resolving symlinks, junctions, case, and verbatim `\\?\` prefixes), and
-//! prefix-matches the canonical path against the canonical grants. These
-//! tests pin that behavior for the spellings a request can arrive in.
-
-use super::*;
-
-use crate::workspace::confine::modified_ms;
-
-/// Turns a silent skip into a failure under CI, and prints the reason
-/// otherwise so the caller can `return`. The `ci` flag is read by the
-/// caller through `std::env::var_os("CI").is_some()`, so no test ever calls
-/// `std::env::set_var`, which is `unsafe` in Rust 2024 and forbidden here.
-pub(super) fn symlink_unavailable(ci: bool, reason: &str) {
-    assert!(!ci, "{reason}");
-    eprintln!("skipping: {reason}");
-}
-
-#[test]
-#[should_panic(expected = "symlink creation failed")]
-fn the_ci_flag_turns_a_skip_into_a_failure() {
-    symlink_unavailable(true, "symlink creation failed");
-}
-
-#[test]
-fn without_ci_a_skip_prints_and_returns() {
-    symlink_unavailable(false, "symlink creation failed");
-}
-
-/// Links `link` to the directory `target`: a symlink on Unix, a junction
-/// on Windows, which needs no symlink privilege. Returns whether the link
-/// was made.
-pub(super) fn link_dir(target: &Path, link: &Path) -> bool {
-    #[cfg(unix)]
-    {
-        std::os::unix::fs::symlink(target, link).is_ok()
-    }
-    #[cfg(windows)]
-    {
-        let outcome = std::process::Command::new("cmd")
-            .args(["/C", "mklink", "/J"])
-            .arg(link)
-            .arg(target)
-            .output();
-        matches!(&outcome, Ok(output) if output.status.success())
-    }
-}
-
-/// Sets the directory `dir`'s modified time to `time`. A Unix directory
-/// never opens for writing; a Windows directory opens only with
-/// `FILE_FLAG_BACKUP_SEMANTICS`, and setting its time needs
-/// `FILE_WRITE_ATTRIBUTES`.
-fn age_dir(dir: &Path, time: std::time::SystemTime) -> std::io::Result<()> {
-    #[cfg(unix)]
-    let file = fs::File::open(dir)?;
-    #[cfg(windows)]
-    let file = {
-        use std::os::windows::fs::OpenOptionsExt;
-        const FILE_WRITE_ATTRIBUTES: u32 = 0x0100;
-        const FILE_FLAG_BACKUP_SEMANTICS: u32 = 0x0200_0000;
-        fs::File::options()
-            .access_mode(FILE_WRITE_ATTRIBUTES)
-            .custom_flags(FILE_FLAG_BACKUP_SEMANTICS)
-            .open(dir)?
-    };
-    file.set_modified(time)
-}
-
-/// The entry named `name` in `listing`.
-fn listed<'a>(listing: &'a TreeListing, name: &str) -> &'a TreeEntry {
-    listing
-        .entries
-        .iter()
-        .find(|entry| entry.name == name)
-        .unwrap_or_else(|| panic!("{name} is not listed"))
-}
-
-#[test]
-fn a_linked_folder_inside_a_grant_lists_as_a_directory_and_opens() {
-    let (workspace, dir) = granted_dir();
-    let target = dir.path().join("real");
-    fs::create_dir(&target).expect("create the link target");
-    fs::write(target.join("inside.txt"), "inside").expect("seed the link target");
-    let link = dir.path().join("linked");
-    if !link_dir(&target, &link) {
-        symlink_unavailable(
-            std::env::var_os("CI").is_some(),
-            "directory link creation failed",
-        );
-        return;
-    }
-    let listing = workspace.tree(Some(dir.path())).expect("list the grant");
-    let entry = listed(&listing, "linked");
-    assert_eq!(entry.kind, EntryKind::Directory);
-    assert_eq!(entry.size, 0);
-    let opened = workspace
-        .tree(Some(&link))
-        .expect("a link to a granted folder opens");
-    let names: Vec<&str> = opened
-        .entries
-        .iter()
-        .map(|entry| entry.name.as_str())
-        .collect();
-    assert_eq!(names, ["inside.txt"]);
-}
-
-#[test]
-fn a_linked_folder_pointing_outside_the_grant_lists_as_a_directory_but_never_opens() {
-    let (workspace, dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    age_dir(
-        outside.path(),
-        std::time::UNIX_EPOCH + std::time::Duration::from_hours(24),
-    )
-    .expect("age the link target");
-    let link = dir.path().join("escape");
-    if !link_dir(outside.path(), &link) {
-        symlink_unavailable(
-            std::env::var_os("CI").is_some(),
-            "directory link creation failed",
-        );
-        return;
-    }
-    let listing = workspace.tree(Some(dir.path())).expect("list the grant");
-    let entry = listed(&listing, "escape");
-    assert_eq!(entry.kind, EntryKind::Directory);
-    assert_eq!(entry.size, 0);
-    let own = fs::symlink_metadata(&link).expect("inspect the link itself");
-    assert_eq!(entry.modified_ms, modified_ms(&own));
-    assert_ne!(entry.modified_ms, 86_400_000, "the target's mtime leaked");
-    let error = workspace
-        .tree(Some(&link))
-        .expect_err("opening a link out of the grant must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[test]
-fn a_dangling_link_lists_as_its_own_entry() {
-    let (workspace, dir) = granted_dir();
-    let target = dir.path().join("gone");
-    fs::create_dir(&target).expect("create the link target");
-    let link = dir.path().join("dangling");
-    if !link_dir(&target, &link) {
-        symlink_unavailable(
-            std::env::var_os("CI").is_some(),
-            "directory link creation failed",
-        );
-        return;
-    }
-    fs::remove_dir(&target).expect("remove the link target");
-    let listing = workspace
-        .tree(Some(dir.path()))
-        .expect("a dangling link must not fail the listing");
-    assert_eq!(listing.entries.len(), 1);
-    let entry = listed(&listing, "dangling");
-    #[cfg(windows)]
-    assert_eq!(entry.kind, EntryKind::Directory);
-    #[cfg(unix)]
-    assert_eq!(entry.kind, EntryKind::File);
-    assert_eq!(entry.size, 0);
-    assert!(
-        entry.exists,
-        "an enumerated entry is on disk by construction"
-    );
-}
-
-/// Links `link` to the file `target`. A Windows file symlink needs the
-/// symlink privilege or Developer Mode. Returns whether the link was made.
-fn link_file(target: &Path, link: &Path) -> bool {
-    #[cfg(unix)]
-    {
-        std::os::unix::fs::symlink(target, link).is_ok()
-    }
-    #[cfg(windows)]
-    {
-        std::os::windows::fs::symlink_file(target, link).is_ok()
-    }
-}
-
-#[test]
-fn a_linked_file_pointing_outside_the_grant_lists_by_its_own_metadata() {
-    let (workspace, dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    let target = outside.path().join("secret.txt");
-    fs::write(&target, "secret").expect("seed the link target");
-    fs::File::options()
-        .write(true)
-        .open(&target)
-        .and_then(|file| {
-            file.set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_hours(24))
-        })
-        .expect("age the link target");
-    let link = dir.path().join("linked.txt");
-    if !link_file(&target, &link) {
-        symlink_unavailable(
-            std::env::var_os("CI").is_some(),
-            "file link creation failed",
-        );
-        return;
-    }
-    let listing = workspace.tree(Some(dir.path())).expect("list the grant");
-    let entry = listed(&listing, "linked.txt");
-    assert_eq!(entry.kind, EntryKind::File);
-    assert_eq!(entry.size, 0, "a file link never reports its target's size");
-    let own = fs::symlink_metadata(&link).expect("inspect the link itself");
-    assert_eq!(entry.modified_ms, modified_ms(&own));
-    assert_ne!(entry.modified_ms, 86_400_000, "the target's mtime leaked");
-}
-
-#[cfg(windows)]
-fn verbatim(path: &Path) -> PathBuf {
-    // `\\?\` is the Win32 verbatim (extended-length) prefix: the same file,
-    // spelled a different way. Build it from the simplified DOS form so the
-    // test always exercises the prefix; `canonicalize_simplified` strips it.
-    PathBuf::from(format!("\\\\?\\{}", simplified(path).display()))
-}
-
-#[cfg(windows)]
-fn unc(path: &Path) -> PathBuf {
-    admin_share(&simplified(path))
-}
-
-#[cfg(windows)]
-fn admin_share(path: &Path) -> PathBuf {
-    // `\\localhost\C$\...` is the administrative-share spelling of a local
-    // path; it canonicalizes to a UNC form that never matches a local grant.
-    // A path without a drive has no such spelling, and a mangled one would
-    // pass the jail tests by failing to resolve, so it panics instead.
-    use std::path::{Component, Prefix};
-    let mut components = path.components();
-    let drive = match components.next() {
-        Some(Component::Prefix(prefix)) => match prefix.kind() {
-            Prefix::Disk(drive) | Prefix::VerbatimDisk(drive) => Some(char::from(drive)),
-            _ => None,
-        },
-        _ => None,
-    };
-    let Some(drive) = drive else {
-        panic!("{} has no local drive to respell", path.display());
-    };
-    let mut respelled = PathBuf::from(format!(r"\\localhost\{drive}$"));
-    respelled.extend(components);
-    respelled
-}
-
-#[cfg(windows)]
-#[test]
-fn the_unc_respelling_takes_the_drive_from_the_path_prefix() {
-    assert_eq!(
-        admin_share(Path::new(r"C:\Temp\a.txt")),
-        PathBuf::from(r"\\localhost\C$\Temp\a.txt")
-    );
-    assert_eq!(
-        admin_share(Path::new(r"\\?\D:\Temp\a.txt")),
-        PathBuf::from(r"\\localhost\D$\Temp\a.txt")
-    );
-}
-
-#[cfg(windows)]
-#[test]
-#[should_panic(expected = "has no local drive")]
-fn the_unc_respelling_refuses_a_path_without_a_local_drive() {
-    admin_share(Path::new(r"\\server\share\a.txt"));
-}
-
-#[cfg(windows)]
-#[test]
-fn a_verbatim_spelling_of_a_granted_path_is_admitted() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    fs::write(&file, "hello").expect("seed the granted file");
-    let read = workspace
-        .read_file(&verbatim(&file))
-        .expect("a verbatim spelling of a granted path reads");
-    assert_eq!(read.text, "hello");
-}
-
-#[cfg(windows)]
-#[test]
-fn a_verbatim_spelling_of_an_ungranted_path_is_rejected() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(dir.path().join("a.txt"), "a").expect("seed the ungranted file");
-    let error = workspace
-        .read_file(&verbatim(&dir.path().join("a.txt")))
-        .expect_err("a verbatim spelling of an ungranted path is rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
-
-#[cfg(windows)]
-#[test]
-fn a_unc_spelling_never_escapes_the_grants() {
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(dir.path().join("a.txt"), "a").expect("seed the local file");
-    // The UNC spelling either canonicalizes to a form that no local grant
-    // prefix-matches (OutsideGrants) or fails to resolve on a machine without
-    // the administrative share (NotFound or ResolvePath). It must never
-    // admit the path.
-    let error = workspace
-        .read_file(&unc(&dir.path().join("a.txt")))
-        .expect_err("a UNC spelling must never be admitted");
-    assert!(
-        matches!(
-            error,
-            WorkspaceError::OutsideGrants
-                | WorkspaceError::NotFound
-                | WorkspaceError::ResolvePath { .. }
-        ),
-        "expected a rejection, got {error:?}"
-    );
-}
-
-#[cfg(windows)]
-#[test]
-fn a_unc_spelling_of_a_granted_path_is_rejected() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    fs::write(&file, "hello").expect("seed the granted file");
-    // A UNC spelling canonicalizes to a UNC form that never prefix-matches a
-    // local grant, so even a granted path is refused (OutsideGrants); on a
-    // machine without the administrative share the resolution fails instead
-    // (NotFound or ResolvePath). It is never admitted.
-    let error = workspace
-        .read_file(&unc(&file))
-        .expect_err("a UNC spelling of a granted path is never admitted");
-    assert!(
-        matches!(
-            error,
-            WorkspaceError::OutsideGrants
-                | WorkspaceError::NotFound
-                | WorkspaceError::ResolvePath { .. }
-        ),
-        "expected a rejection, got {error:?}"
-    );
-}
-
-#[cfg(windows)]
-#[test]
-fn a_case_only_respelling_of_a_granted_root_is_admitted() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("notes.txt");
-    fs::write(&file, "hello").expect("seed the granted file");
-    let respelled = PathBuf::from(file.to_string_lossy().to_ascii_uppercase());
-    let read = workspace
-        .read_file(&respelled)
-        .expect("a case-only respelling of a granted path reads");
-    assert_eq!(read.text, "hello");
-}
-
-#[cfg(windows)]
-#[test]
-fn a_junction_inside_a_grant_pointing_outside_is_rejected() {
-    let (workspace, dir) = granted_dir();
-    let outside = tempfile::TempDir::new().expect("outside tempdir");
-    fs::write(outside.path().join("secret.txt"), "secret").expect("seed the secret");
-    let junction = dir.path().join("junction");
-    if !link_dir(outside.path(), &junction) {
-        symlink_unavailable(std::env::var_os("CI").is_some(), "junction creation failed");
-        return;
-    }
-    let error = workspace
-        .read_file(&junction.join("secret.txt"))
-        .expect_err("a junction escape must be rejected");
-    assert!(
-        matches!(error, WorkspaceError::OutsideGrants),
-        "expected OutsideGrants, got {error:?}"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/pointer.rs b/crates/workshop/workspace/src/workspace/tests/pointer.rs
deleted file mode 100644
index f42e75b99..000000000
--- a/crates/workshop/workspace/src/workspace/tests/pointer.rs
+++ /dev/null
@@ -1,281 +0,0 @@
-//! The last-workspace pointer: written after every successful switch
-//! (save-as, open, duplicate), read once at boot by `reopen_last`, and
-//! degraded to an ephemeral start - never a failure - when it is
-//! missing, corrupt, or names a file that is gone or refused.
-
-use super::*;
-
-use crate::workspace::pointer::LastWorkspacePointer;
-use crate::workspace_file::create_alien_database_for_test;
-
-/// The pointer file's bytes, or `None` when it does not exist.
-fn pointer_bytes(state_dir: &Path) -> Option<Vec<u8>> {
-    fs::read(state_dir.join("last-workspace")).ok()
-}
-
-/// The sorted names of every entry directly inside `dir`.
-fn names_in(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-/// Authors a workspace file at `path` holding one grant of `root`, then
-/// lets go of it so another workspace can open it.
-async fn author_file(path: &Path, root: &Path) -> PathBuf {
-    let author = Workspace::new();
-    let granted = author.grant(root).expect("grant the root");
-    author.save_as(path).await.expect("save as creates");
-    author.close_backing_for_test().await;
-    granted
-}
-
-#[tokio::test]
-async fn save_as_open_and_duplicate_each_write_the_pointer() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let first = home.path().join("first.rvwork");
-    let theirs = home.path().join("theirs.rvwork");
-    let copy = home.path().join("copy.rvwork");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    author_file(&theirs, root.path()).await;
-    let workspace = Workspace::with_state_dir(state_dir.path());
-    assert_eq!(
-        pointer_bytes(state_dir.path()),
-        None,
-        "an ephemeral workspace has written no pointer"
-    );
-
-    workspace.save_as(&first).await.expect("save as creates");
-    assert_eq!(
-        pointer_bytes(state_dir.path()),
-        Some(first.to_string_lossy().into_owned().into_bytes()),
-        "save as points at the new file"
-    );
-
-    workspace.open_file(&theirs).await.expect("theirs opens");
-    assert_eq!(
-        pointer_bytes(state_dir.path()),
-        Some(theirs.to_string_lossy().into_owned().into_bytes()),
-        "open points at the opened file"
-    );
-
-    workspace.duplicate(&copy).await.expect("duplicate opens");
-    assert_eq!(
-        pointer_bytes(state_dir.path()),
-        Some(copy.to_string_lossy().into_owned().into_bytes()),
-        "duplicate points at the copy"
-    );
-    workspace.close_backing_for_test().await;
-}
-
-#[tokio::test]
-async fn a_refused_open_leaves_the_pointer_where_it_was() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let mine = home.path().join("mine.rvwork");
-    let alien = home.path().join("alien.rvwork");
-    create_alien_database_for_test(&alien)
-        .await
-        .expect("the alien database creates");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-    workspace.save_as(&mine).await.expect("save as creates");
-
-    workspace
-        .open_file(&alien)
-        .await
-        .expect_err("the alien file is refused");
-
-    assert_eq!(
-        pointer_bytes(state_dir.path()),
-        Some(mine.to_string_lossy().into_owned().into_bytes()),
-        "only a successful switch moves the pointer"
-    );
-    workspace.close_backing_for_test().await;
-}
-
-#[tokio::test]
-async fn a_workspace_without_a_state_dir_writes_no_pointer_and_reopens_nothing() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("loose.rvwork");
-    let workspace = Workspace::new();
-    workspace.save_as(&path).await.expect("save as creates");
-    workspace.close_backing_for_test().await;
-
-    assert_eq!(
-        names_in(home.path()),
-        ["loose.rvwork"],
-        "no pointer lands beside the file or anywhere else"
-    );
-    let fresh = Workspace::new();
-    assert!(
-        !fresh.reopen_last().await,
-        "with nowhere to read a pointer from, nothing reopens"
-    );
-    assert_eq!(fresh.current().await.path, None);
-}
-
-#[tokio::test]
-async fn reopen_last_restores_the_pointed_workspace() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("mine.rvwork");
-    let root = tempfile::TempDir::new().expect("tempdir");
-    let granted = author_file(&path, root.path()).await;
-    LastWorkspacePointer::new(state_dir.path())
-        .write(&path)
-        .expect("the pointer writes");
-
-    let workspace = Workspace::with_state_dir(state_dir.path());
-    assert!(workspace.reopen_last().await, "the pointed file reopens");
-
-    assert_eq!(workspace.granted_roots(), vec![granted]);
-    let current = workspace.current().await;
-    assert_eq!(current.path.as_deref(), Some(path.as_path()));
-    assert_eq!(current.name, "mine");
-    workspace.close_backing_for_test().await;
-}
-
-#[tokio::test]
-async fn reopen_last_with_no_pointer_stays_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-
-    assert!(
-        !workspace.reopen_last().await,
-        "a first launch has no pointer"
-    );
-
-    assert_eq!(workspace.current().await.path, None);
-    assert_eq!(
-        names_in(state_dir.path()),
-        Vec::<String>::new(),
-        "reading a missing pointer creates nothing"
-    );
-}
-
-#[tokio::test]
-async fn reopen_last_with_corrupt_pointer_bytes_stays_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(
-        state_dir.path().join("last-workspace"),
-        [0xff, 0xfe, 0x00, 0xc3],
-    )
-    .expect("the corrupt pointer writes");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-
-    assert!(
-        !workspace.reopen_last().await,
-        "non-UTF-8 bytes name nothing"
-    );
-
-    assert_eq!(workspace.current().await.path, None);
-    assert_eq!(
-        LastWorkspacePointer::new(state_dir.path()).read(),
-        None,
-        "the pointer reads as absent rather than as garbage"
-    );
-}
-
-#[tokio::test]
-async fn reopen_last_with_an_empty_pointer_stays_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    fs::write(state_dir.path().join("last-workspace"), "\r\n").expect("the empty pointer writes");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-
-    assert!(!workspace.reopen_last().await, "whitespace names nothing");
-
-    assert_eq!(workspace.current().await.path, None);
-}
-
-#[tokio::test]
-async fn reopen_last_with_a_vanished_target_stays_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let gone = home.path().join("gone.rvwork");
-    LastWorkspacePointer::new(state_dir.path())
-        .write(&gone)
-        .expect("the pointer writes");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-
-    assert!(
-        !workspace.reopen_last().await,
-        "a missing file cannot reopen"
-    );
-
-    assert_eq!(workspace.current().await.path, None);
-    assert_eq!(
-        names_in(home.path()),
-        Vec::<String>::new(),
-        "reopen never creates the missing file"
-    );
-}
-
-#[tokio::test]
-async fn reopen_last_with_an_alien_target_stays_ephemeral() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let alien = home.path().join("alien.rvwork");
-    create_alien_database_for_test(&alien)
-        .await
-        .expect("the alien database creates");
-    LastWorkspacePointer::new(state_dir.path())
-        .write(&alien)
-        .expect("the pointer writes");
-    let workspace = Workspace::with_state_dir(state_dir.path());
-
-    assert!(
-        !workspace.reopen_last().await,
-        "a refused file does not reopen"
-    );
-
-    assert_eq!(workspace.current().await.path, None);
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-}
-
-#[test]
-fn the_pointer_round_trips_a_path_and_tolerates_a_trailing_newline() {
-    let state_dir = tempfile::TempDir::new().expect("tempdir");
-    let pointer = LastWorkspacePointer::new(state_dir.path());
-    let target = state_dir.path().join("somewhere").join("mine.rvwork");
-
-    pointer.write(&target).expect("the pointer writes");
-    assert_eq!(pointer.read(), Some(target.clone()));
-
-    // A hand-edited pointer with an editor's trailing newline still
-    // names the same file.
-    fs::write(
-        state_dir.path().join("last-workspace"),
-        format!("{}\n", target.display()),
-    )
-    .expect("the edited pointer writes");
-    assert_eq!(pointer.read(), Some(target));
-    assert_eq!(
-        names_in(state_dir.path()),
-        ["last-workspace"],
-        "the atomic write leaves no temp file behind"
-    );
-}
-
-#[test]
-fn the_pointer_write_creates_a_missing_state_dir() {
-    let parent = tempfile::TempDir::new().expect("tempdir");
-    let state_dir = parent.path().join("state");
-    let pointer = LastWorkspacePointer::new(&state_dir);
-    let target = parent.path().join("mine.rvwork");
-
-    pointer
-        .write(&target)
-        .expect("a first-run state directory is created on demand");
-
-    assert_eq!(pointer.read(), Some(target));
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/reopen.rs b/crates/workshop/workspace/src/workspace/tests/reopen.rs
deleted file mode 100644
index 548f83694..000000000
--- a/crates/workshop/workspace/src/workspace/tests/reopen.rs
+++ /dev/null
@@ -1,156 +0,0 @@
-//! Opening the workspace file that is already the backing: the reload
-//! path that must never start a second opener of the same file (turso
-//! shares one WAL handle per file process-wide, so a second opener
-//! followed by the first one's close unlinks the sidecar the survivor
-//! keeps writing to).
-
-use super::*;
-
-use crate::workspace_file::WorkspaceFile;
-
-/// The `-wal` sidecar the database keeps beside `path`.
-fn wal_of(path: &Path) -> PathBuf {
-    let mut name = path.as_os_str().to_owned();
-    name.push("-wal");
-    PathBuf::from(name)
-}
-
-/// `path` spelled with a redundant `.` segment before its file name, so
-/// it names the same file through a different string.
-fn dotted(path: &Path) -> PathBuf {
-    let parent = path.parent().expect("the file has a parent");
-    let name = path.file_name().expect("the file has a name");
-    parent.join(".").join(name)
-}
-
-/// The grant paths the file at `path` holds, read straight from disk
-/// through a fresh handle, in file order.
-async fn grants_on_disk(path: &Path) -> Vec<PathBuf> {
-    let file = WorkspaceFile::open(path)
-        .await
-        .expect("the workspace file reopens from disk");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    contents
-        .grants
-        .into_iter()
-        .map(|grant| grant.path)
-        .collect()
-}
-
-#[tokio::test]
-async fn reopening_the_current_file_keeps_the_wal_and_later_grants() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let one = tempfile::TempDir::new().expect("tempdir");
-    let two = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    let root_one = workspace
-        .grant_and_persist(one.path())
-        .await
-        .expect("the first grant lands");
-
-    workspace
-        .open_file(&file_path)
-        .await
-        .expect("reopening the current file succeeds");
-    workspace
-        .open_file(&dotted(&file_path))
-        .await
-        .expect("reopening the current file through another spelling succeeds");
-    let root_two = workspace
-        .grant_and_persist(two.path())
-        .await
-        .expect("the second grant lands after the reopen");
-    assert_eq!(
-        workspace.current().await.path.as_deref(),
-        Some(file_path.as_path()),
-        "the backing path is the one first opened, not the respelling"
-    );
-
-    // Hold one handle across the drop so the actor is provably live
-    // (dropping the last handle ends its `recv` loop and closes the
-    // database at the next yield). With the backing still open, the
-    // sidecar must be on disk: the reopens above must not have unlinked
-    // it from under the surviving actor.
-    let live = workspace
-        .backing_file_for_test()
-        .expect("the backing is installed");
-    drop(workspace);
-    assert!(
-        wal_of(&file_path).is_file(),
-        "the wal sidecar was unlinked from under the live backing"
-    );
-    // Close the sole opener before reading from disk, so the on-disk
-    // read never overlaps a pending close from another handle.
-    live.close().await;
-    let mut expected = vec![root_one, root_two];
-    expected.sort();
-    let mut on_disk = grants_on_disk(&file_path).await;
-    on_disk.sort();
-    assert_eq!(
-        on_disk, expected,
-        "both grants survive: the one before the reopen and the one after"
-    );
-}
-
-#[tokio::test]
-async fn reopening_the_current_file_starts_no_second_actor() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    let before = workspace
-        .backing_file_for_test()
-        .expect("save as installed a backing");
-
-    workspace
-        .open_file(&file_path)
-        .await
-        .expect("reopening the current file succeeds");
-
-    let after = workspace
-        .backing_file_for_test()
-        .expect("the backing is still installed");
-    assert!(
-        before.is_same_handle(&after),
-        "reopening the current file replaced the backing with a second opener"
-    );
-}
-
-#[tokio::test]
-async fn reopening_the_current_file_reapplies_its_grants() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file_path = home.path().join("mine.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&file_path)
-        .await
-        .expect("save as creates");
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands");
-    // Memory only: the file still holds the grant.
-    revoke(&workspace, dir.path()).expect("the memory revoke lands");
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-
-    workspace
-        .open_file(&file_path)
-        .await
-        .expect("reopening the current file succeeds");
-
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![root],
-        "the reopen reloads the file's grants wholesale"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/switch.rs b/crates/workshop/workspace/src/workspace/tests/switch.rs
deleted file mode 100644
index a733719f6..000000000
--- a/crates/workshop/workspace/src/workspace/tests/switch.rs
+++ /dev/null
@@ -1,443 +0,0 @@
-//! The switch operations (open, save-as, duplicate, and the shutdown
-//! close) run one at a time. Each is two phases, open or create a handle
-//! and then swap it in, with awaits between them; left unserialized, two
-//! overlapping switches can open two handles to one file (and the second
-//! swap's close unlinks the WAL the survivor writes to), cross-apply
-//! another file's grants after the backing moved on, or install a
-//! backing after the shutdown close took the previous one. A grant takes
-//! the same guard, so it cannot straddle a switch; a revoke resolves its
-//! path first and then takes the guard for its removal and mirror.
-
-use std::pin::{Pin, pin};
-use std::task::Poll;
-use std::time::Duration;
-
-use super::*;
-
-use crate::workspace_file::WorkspaceFile;
-
-/// Polls `future` exactly once from the calling task.
-async fn poll_once<F: Future>(mut future: Pin<&mut F>) -> Poll<F::Output> {
-    std::future::poll_fn(|cx| Poll::Ready(future.as_mut().poll(cx))).await
-}
-
-/// The `-wal` sidecar the database keeps beside `path`.
-fn wal_of(path: &Path) -> PathBuf {
-    let mut name = path.as_os_str().to_owned();
-    name.push("-wal");
-    PathBuf::from(name)
-}
-
-/// A workspace file at `path` holding exactly the grants in `roots`,
-/// written through its own workspace and closed, so the file is complete
-/// on disk with no opener left behind.
-async fn file_with_grants(path: &Path, roots: &[&Path]) {
-    let writer = Workspace::new();
-    writer.save_as(path).await.expect("save as creates");
-    for root in roots {
-        writer
-            .grant_and_persist(root)
-            .await
-            .expect("the grant lands");
-    }
-    writer.close_backing().await;
-}
-
-/// The grant paths the file at `path` holds, read straight from disk
-/// through a fresh handle, sorted.
-async fn grants_on_disk(path: &Path) -> Vec<PathBuf> {
-    let file = WorkspaceFile::open(path)
-        .await
-        .expect("the workspace file reopens from disk");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    let mut grants: Vec<PathBuf> = contents
-        .grants
-        .into_iter()
-        .map(|grant| grant.path)
-        .collect();
-    grants.sort();
-    grants
-}
-
-#[tokio::test]
-async fn concurrent_opens_of_one_new_file_share_one_handle_and_keep_the_wal() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    file_with_grants(&b, &[]).await;
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-
-    // Both pass the same-file guard before either swaps: without one
-    // switch at a time, two handles to `b` exist and the second swap's
-    // close of the first unlinks the WAL the second keeps writing to.
-    let (first, second) = tokio::join!(workspace.open_file(&b), workspace.open_file(&b));
-    first.expect("the first open succeeds");
-    second.expect("the second open succeeds");
-    assert_eq!(
-        workspace.current().await.path.as_deref(),
-        Some(b.as_path()),
-        "the backing is b"
-    );
-
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands after the opens");
-    let live = workspace
-        .backing_file_for_test()
-        .expect("the backing is installed");
-    drop(workspace);
-    assert!(
-        wal_of(&b).is_file(),
-        "the wal sidecar was unlinked from under the live backing"
-    );
-    live.close().await;
-    assert_eq!(
-        grants_on_disk(&b).await,
-        vec![root],
-        "the grant made after the concurrent opens survives on disk"
-    );
-}
-
-#[tokio::test]
-async fn reloading_the_current_file_cannot_outlive_a_switch_to_another() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    let in_a = tempfile::TempDir::new().expect("tempdir");
-    let in_b = tempfile::TempDir::new().expect("tempdir");
-    file_with_grants(&a, &[in_a.path()]).await;
-    file_with_grants(&b, &[in_b.path()]).await;
-    let expected_a = grants_on_disk(&a).await;
-    let expected_b = grants_on_disk(&b).await;
-
-    // The interleaving depends on where each open first yields, so run
-    // both orders several times; the invariant must hold after each.
-    for round in 0..8 {
-        let workspace = Workspace::new();
-        workspace.open_file(&a).await.expect("a opens");
-        let (reload, switch) = if round % 2 == 0 {
-            tokio::join!(workspace.open_file(&a), workspace.open_file(&b))
-        } else {
-            let (switch, reload) = tokio::join!(workspace.open_file(&b), workspace.open_file(&a));
-            (reload, switch)
-        };
-        reload.expect("reopening the current file succeeds");
-        switch.expect("opening the other file succeeds");
-
-        let current = workspace
-            .current()
-            .await
-            .path
-            .expect("a backing is installed");
-        let expected = if current == a {
-            &expected_a
-        } else {
-            assert_eq!(current, b, "the backing is one of the two files");
-            &expected_b
-        };
-        let mut roots = workspace.granted_roots();
-        roots.sort();
-        assert_eq!(
-            &roots, expected,
-            "round {round}: memory holds the grants of the file that is the backing"
-        );
-        workspace.close_backing().await;
-    }
-}
-
-#[tokio::test]
-async fn a_grant_racing_a_workspace_open_never_answers_success_and_then_loses_the_grant() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    file_with_grants(&b, &[]).await;
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-
-    // Start the grant and wait for its root to reach memory, then run the
-    // open as far as the switch guard allows before the grant resumes: to
-    // completion when nothing holds the guard, not at all when the grant
-    // does. A grant that straddles the open has its root wiped from memory
-    // by the open and then mirrored into the file the open installed.
-    let mut grant = pin!(workspace.grant_and_persist(dir.path()));
-    let mut open = pin!(workspace.open_file(&b));
-    assert!(
-        poll_once(grant.as_mut()).await.is_pending(),
-        "the grant resolves its path on the blocking pool"
-    );
-    // A grant that fails on the blocking pool never inserts; polling it
-    // once at the deadline surfaces its error instead of spinning.
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    while workspace.granted_roots().is_empty() {
-        if tokio::time::Instant::now() >= deadline {
-            let outcome = poll_once(grant.as_mut()).await;
-            panic!("the grant never reached memory: {outcome:?}");
-        }
-        tokio::task::yield_now().await;
-    }
-    let open_ran_first = workspace.switches.try_lock().is_ok();
-    let granted = if open_ran_first {
-        open.as_mut().await.expect("b opens");
-        grant.await
-    } else {
-        let granted = grant.await;
-        open.await.expect("b opens");
-        granted
-    };
-    let root = granted.expect("the grant succeeds");
-
-    let in_memory = workspace.granted_roots().contains(&root);
-    workspace.close_backing().await;
-    let in_a = grants_on_disk(&a).await.contains(&root);
-    let in_b = grants_on_disk(&b).await.contains(&root);
-    if open_ran_first {
-        assert!(
-            in_memory && in_b,
-            "the grant answered success after b opened, but b holds it in memory: {in_memory}, on disk: {in_b}"
-        );
-    } else {
-        assert!(
-            in_a,
-            "the grant answered success while a was open, but a's file does not hold it"
-        );
-    }
-    assert_eq!(
-        in_memory, in_b,
-        "memory and b's file disagree about the grant"
-    );
-}
-
-#[tokio::test]
-async fn a_revoke_racing_a_workspace_open_leaves_memory_and_the_open_file_agreeing() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    file_with_grants(&b, &[dir.path()]).await;
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands");
-
-    // Drive the revoke until its root leaves memory, then run the open as
-    // far as the switch guard allows before the revoke resumes: to
-    // completion when nothing holds the guard, not at all when the revoke
-    // does. A revoke that straddles the open has its removal undone by
-    // the grants the open loads and then mirrored into the file the open
-    // installed. The mirror waits on the file actor, a task on this
-    // runtime, so the revoke cannot finish inside one poll.
-    let mut revoke = pin!(workspace.revoke_and_persist(&root));
-    let mut open = pin!(workspace.open_file(&b));
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    while workspace.granted_roots().contains(&root) {
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "the revoke never removed its root from memory"
-        );
-        if let Poll::Ready(outcome) = poll_once(revoke.as_mut()).await {
-            panic!("the revoke answered before mirroring its removal: {outcome:?}");
-        }
-        tokio::task::yield_now().await;
-    }
-    let open_ran_first = workspace.switches.try_lock().is_ok();
-    if open_ran_first {
-        open.as_mut().await.expect("b opens");
-        revoke.await.expect("the revoke succeeds");
-    } else {
-        revoke.await.expect("the revoke succeeds");
-        open.await.expect("b opens");
-    }
-
-    let in_memory = workspace.granted_roots().contains(&root);
-    workspace.close_backing().await;
-    let in_a = grants_on_disk(&a).await.contains(&root);
-    let in_b = grants_on_disk(&b).await.contains(&root);
-    if open_ran_first {
-        assert!(
-            !in_memory && !in_b,
-            "the revoke answered success after b opened, but b still holds the root in memory: {in_memory}, on disk: {in_b}"
-        );
-    } else {
-        assert!(
-            !in_a,
-            "the revoke answered success while a was open, but a's file still holds the root"
-        );
-    }
-    assert_eq!(
-        in_memory, in_b,
-        "memory and b's file disagree about the root"
-    );
-}
-
-#[tokio::test]
-async fn a_revoke_after_close_backing_is_refused_and_keeps_the_root_granted() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-    let root = workspace
-        .grant_and_persist(dir.path())
-        .await
-        .expect("the grant lands");
-
-    workspace.close_backing().await;
-
-    let refused = workspace.revoke_and_persist(&root).await;
-    assert!(
-        matches!(refused, Err(WorkspaceError::WorkspaceFileFailed { .. })),
-        "a revoke after the shutdown close must answer the closed mapping, got {refused:?}"
-    );
-    assert_eq!(
-        workspace.granted_roots(),
-        vec![root.clone()],
-        "the refused revoke removed the root from memory"
-    );
-    assert_eq!(
-        grants_on_disk(&a).await,
-        vec![root],
-        "the file closed at shutdown keeps the root"
-    );
-}
-
-#[tokio::test]
-async fn a_grant_after_close_backing_is_refused_and_leaves_the_root_ungranted() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-
-    workspace.close_backing().await;
-
-    let refused = workspace.grant_and_persist(dir.path()).await;
-    assert!(
-        matches!(refused, Err(WorkspaceError::WorkspaceFileFailed { .. })),
-        "a grant after the shutdown close must answer the closed mapping, got {refused:?}"
-    );
-    assert_eq!(
-        workspace.granted_roots(),
-        Vec::<PathBuf>::new(),
-        "the refused grant added the root to memory"
-    );
-    assert_eq!(
-        grants_on_disk(&a).await,
-        Vec::<PathBuf>::new(),
-        "the file closed at shutdown gained the refused grant"
-    );
-}
-
-#[tokio::test]
-async fn a_revoke_by_the_stored_key_lands_after_the_folder_becomes_a_link_elsewhere() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let folder = home.path().join("granted");
-    let elsewhere = home.path().join("elsewhere");
-    fs::create_dir(&folder).expect("create the granted folder");
-    fs::create_dir(&elsewhere).expect("create the link target");
-    let workspace = Workspace::new();
-    let root = workspace.grant(&folder).expect("grant the folder");
-
-    fs::remove_dir(&folder).expect("remove the granted folder");
-    if !jail::link_dir(&elsewhere, &folder) {
-        jail::symlink_unavailable(
-            std::env::var_os("CI").is_some(),
-            "directory link creation failed",
-        );
-        return;
-    }
-
-    // The stored key now canonicalizes to the link's target, which is not
-    // granted; only the literal key names the grant the listing shows.
-    let revoked = workspace
-        .revoke_and_persist(&root)
-        .await
-        .expect("the stored key revokes its grant");
-    assert_eq!(revoked, root);
-    assert_eq!(workspace.granted_roots(), Vec::<PathBuf>::new());
-}
-
-#[tokio::test]
-async fn a_switch_after_close_backing_is_refused_and_opens_nothing() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    let c = home.path().join("c.rvwork");
-    let d = home.path().join("d.rvwork");
-    file_with_grants(&b, &[]).await;
-    let workspace = Workspace::new();
-    workspace.save_as(&a).await.expect("save as creates");
-
-    workspace.close_backing().await;
-
-    let refused = |result: Result<(), WorkspaceError>, what: &str| {
-        assert!(
-            matches!(result, Err(WorkspaceError::WorkspaceFileFailed { .. })),
-            "{what} after the shutdown close must answer the closed mapping"
-        );
-    };
-    refused(workspace.open_file(&b).await, "open");
-    refused(workspace.save_as(&c).await, "save as");
-    refused(workspace.duplicate(&d).await, "duplicate");
-
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "no switch installed a backing after the close"
-    );
-    assert!(!c.exists(), "save as after the close created a file");
-    assert!(!d.exists(), "duplicate after the close created a file");
-    assert!(
-        !wal_of(&b).exists(),
-        "open after the close left b's wal sidecar behind"
-    );
-}
-
-#[tokio::test]
-async fn close_backing_waits_for_an_in_flight_open() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let a = home.path().join("a.rvwork");
-    let b = home.path().join("b.rvwork");
-    file_with_grants(&a, &[]).await;
-    file_with_grants(&b, &[]).await;
-
-    // Queue the open and then the close behind a held guard, so the open
-    // is provably in flight when the close is issued; releasing hands
-    // the guard over in arrival order. The open must complete first and
-    // the close must then take `b`, leaving the workspace ephemeral with
-    // no sidecar beside either file. A close that did not wait would
-    // take `a`, and the open would then install `b` for nobody to close.
-    let workspace = Workspace::new();
-    workspace.open_file(&a).await.expect("a opens");
-    let held = workspace.hold_switches_for_test().await;
-    let opener = workspace.clone();
-    let target = b.clone();
-    let open = tokio::spawn(async move { opener.open_file(&target).await });
-    tokio::task::yield_now().await;
-    let closer = workspace.clone();
-    let close = tokio::spawn(async move { closer.close_backing().await });
-    tokio::task::yield_now().await;
-    drop(held);
-
-    open.await
-        .expect("the open task completes")
-        .expect("the open queued ahead of the close completes");
-    close.await.expect("the close task completes");
-
-    assert_eq!(
-        workspace.current().await.path,
-        None,
-        "a backing outlived the shutdown close"
-    );
-    assert!(
-        !wal_of(&b).exists(),
-        "b's wal sidecar remains after the shutdown close"
-    );
-    assert!(!wal_of(&a).exists(), "a's wal sidecar remains");
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/ui_state_memory.rs b/crates/workshop/workspace/src/workspace/tests/ui_state_memory.rs
deleted file mode 100644
index d0c2dfac8..000000000
--- a/crates/workshop/workspace/src/workspace/tests/ui_state_memory.rs
+++ /dev/null
@@ -1,309 +0,0 @@
-//! The workspace-level ui-state API over the backing file: an ephemeral
-//! put is a no-op that says so, a file-backed put lands in the file and
-//! in `ui_state()`, open reads the file's values into memory, a failed
-//! persist leaves the in-memory value standing, and save-as and
-//! duplicate start their new backing with the expected values.
-
-use std::collections::BTreeMap;
-
-use serde_json::json;
-use workshop_support::StateBucketValue;
-
-use super::*;
-
-use crate::workspace_file::{
-    UI_STATE_KEYS, WorkspaceContents, WorkspaceFile, empty_ui_state, open_database,
-};
-
-/// A validated put of `value` under `key`, as the route builds one.
-fn bucket(key: &str, value: &serde_json::Value) -> StateBucketValue {
-    StateBucketValue::new(key, &UI_STATE_KEYS, value.to_string().as_bytes())
-        .expect("the fixture is a valid put")
-}
-
-/// Opens the file at `path` directly, bypassing any `Workspace`, and
-/// returns the ui-state values it holds.
-async fn file_ui_state(path: &Path) -> BTreeMap<&'static str, Option<serde_json::Value>> {
-    let file = WorkspaceFile::open(path)
-        .await
-        .expect("the workspace file reopens on its own");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    contents.ui_state
-}
-
-/// How many rows the kv table of the closed file at `path` holds.
-async fn kv_row_count(path: &Path) -> i64 {
-    let conn = open_database(path).await.expect("the closed file opens");
-    let mut rows = conn
-        .query("SELECT count(*) FROM kv", ())
-        .await
-        .expect("kv counts");
-    let row = rows
-        .next()
-        .await
-        .expect("the count row reads")
-        .expect("count yields one row");
-    row.get(0).expect("count is an integer")
-}
-
-/// One distinct value per allow-listed key.
-fn sample_values() -> [(&'static str, serde_json::Value); 3] {
-    [
-        ("layout", json!({ "version": 3, "zones": { "tree": 240 } })),
-        ("tree", json!({ "expanded": ["C:\\projects\\zebra"] })),
-        (
-            "closed_editors",
-            json!({ "paths": ["C:\\projects\\zebra\\a.md"] }),
-        ),
-    ]
-}
-
-#[tokio::test]
-async fn put_while_ephemeral_returns_false_and_writes_nothing() {
-    let workspace = Workspace::new();
-    assert_eq!(
-        workspace.ui_state(),
-        empty_ui_state(),
-        "an ephemeral workspace has every key unset"
-    );
-
-    for (key, value) in sample_values() {
-        let saved = workspace.put_ui_state(bucket(key, &value)).await;
-        assert!(!saved, "nothing was written, and the caller is told so");
-    }
-
-    assert_eq!(
-        workspace.ui_state(),
-        empty_ui_state(),
-        "an ephemeral put leaves no value behind, matching window state"
-    );
-    assert_eq!(workspace.current().await.path, None);
-}
-
-#[tokio::test]
-async fn put_with_a_file_open_persists_and_ui_state_reflects_it() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("mine.rvwork");
-    let workspace = Workspace::new();
-    workspace.save_as(&path).await.expect("save as creates");
-    assert_eq!(
-        workspace.ui_state(),
-        empty_ui_state(),
-        "a fresh file starts with no values"
-    );
-
-    for (key, value) in sample_values() {
-        let saved = workspace.put_ui_state(bucket(key, &value)).await;
-        assert!(saved, "a file-backed put reports that it wrote");
-        assert_eq!(
-            workspace.ui_state().get(key).cloned().flatten(),
-            Some(value),
-            "{key} is visible in memory right after the put"
-        );
-    }
-    // A second put replaces the first in memory and on disk.
-    let replaced = json!({ "expanded": [] });
-    assert!(
-        workspace.put_ui_state(bucket("tree", &replaced)).await,
-        "the replace writes"
-    );
-    assert_eq!(
-        workspace.ui_state().get("tree").cloned().flatten(),
-        Some(replaced.clone())
-    );
-    workspace.close_backing_for_test().await;
-
-    let on_disk = file_ui_state(&path).await;
-    for (key, value) in sample_values() {
-        let expected = if key == "tree" { &replaced } else { &value };
-        assert_eq!(
-            on_disk.get(key).cloned().flatten().as_ref(),
-            Some(expected),
-            "{key} reopened from the file matches what was put"
-        );
-    }
-    assert_eq!(kv_row_count(&path).await, 3, "one kv row per key");
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn overlapping_puts_to_one_key_leave_the_file_holding_what_memory_holds() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("race.rvwork");
-    let workspace = Workspace::new();
-    workspace.save_as(&path).await.expect("save as creates");
-
-    // Many puts to the same key started together from several tasks:
-    // whichever lands in memory last must also be the row on disk, or
-    // the next open restores stale state. Repeated rounds give an
-    // unserialized put path many chances to interleave its memory
-    // insert and its actor send the other way round.
-    for round in 0..8 {
-        let puts = (0..16).map(|n| {
-            let workspace = workspace.clone();
-            tokio::spawn(async move {
-                workspace
-                    .put_ui_state(bucket("tree", &json!({ "round": round, "n": n })))
-                    .await
-            })
-        });
-        for put in puts {
-            assert!(put.await.expect("the put task finishes"));
-        }
-    }
-
-    let in_memory = workspace.ui_state().get("tree").cloned().flatten();
-    assert!(
-        in_memory.is_some(),
-        "one of the puts is the value memory holds"
-    );
-    workspace.close_backing_for_test().await;
-    assert_eq!(
-        file_ui_state(&path).await.get("tree").cloned().flatten(),
-        in_memory,
-        "the file's row is the value memory last accepted"
-    );
-    assert_eq!(kv_row_count(&path).await, 1, "one row, replaced in place");
-}
-
-#[tokio::test]
-async fn open_reads_a_files_ui_state_into_memory_and_a_later_open_replaces_it() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let full_path = home.path().join("full.rvwork");
-    let empty_path = home.path().join("empty.rvwork");
-    // A file written through the storage layer alone.
-    let file = WorkspaceFile::create(
-        &full_path,
-        &WorkspaceContents {
-            name: "Full".to_string(),
-            grants: Vec::new(),
-            window_state: None,
-            ui_state: empty_ui_state(),
-        },
-    )
-    .await
-    .expect("the full file creates");
-    for (key, value) in sample_values() {
-        file.put_ui_state(&bucket(key, &value))
-            .await
-            .expect("the storage layer writes");
-    }
-    file.close().await;
-    let empty = WorkspaceFile::create(
-        &empty_path,
-        &WorkspaceContents {
-            name: "Empty".to_string(),
-            grants: Vec::new(),
-            window_state: None,
-            ui_state: empty_ui_state(),
-        },
-    )
-    .await
-    .expect("the empty file creates");
-    empty.close().await;
-
-    let workspace = Workspace::new();
-    workspace
-        .open_file(&full_path)
-        .await
-        .expect("the full file opens");
-    let state = workspace.ui_state();
-    assert_eq!(state.len(), UI_STATE_KEYS.len(), "every key is present");
-    for (key, value) in sample_values() {
-        assert_eq!(
-            state.get(key).cloned().flatten(),
-            Some(value),
-            "{key} was read at open"
-        );
-    }
-
-    workspace
-        .open_file(&empty_path)
-        .await
-        .expect("the empty file opens");
-    assert_eq!(
-        workspace.ui_state(),
-        empty_ui_state(),
-        "opening another file replaces the values wholesale"
-    );
-}
-
-#[tokio::test]
-async fn a_failed_persist_leaves_the_in_memory_value_standing() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let path = home.path().join("closed.rvwork");
-    let workspace = Workspace::new();
-    workspace.save_as(&path).await.expect("save as creates");
-    // Stop the actor while leaving the backing in place: every later
-    // persist fails with a closed file.
-    workspace.close_backing_for_test().await;
-
-    let value = json!({ "version": 3 });
-    let saved = workspace.put_ui_state(bucket("layout", &value)).await;
-    assert!(
-        saved,
-        "the workspace is file-backed, so the put is accepted"
-    );
-    assert_eq!(
-        workspace.ui_state().get("layout").cloned().flatten(),
-        Some(value),
-        "memory is the source of truth and stands"
-    );
-    assert_eq!(
-        file_ui_state(&path).await.get("layout").cloned().flatten(),
-        None,
-        "the closed file never saw the value"
-    );
-}
-
-#[tokio::test]
-async fn save_as_starts_empty_and_duplicate_keeps_the_live_values() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let first_path = home.path().join("first.rvwork");
-    let second_path = home.path().join("second.rvwork");
-    let copy_path = home.path().join("copy.rvwork");
-    let workspace = Workspace::new();
-    workspace
-        .save_as(&first_path)
-        .await
-        .expect("the first save as creates");
-    let layout = json!({ "version": 3 });
-    assert!(
-        workspace.put_ui_state(bucket("layout", &layout)).await,
-        "layout writes into the first file"
-    );
-
-    workspace
-        .save_as(&second_path)
-        .await
-        .expect("the second save as creates");
-    assert_eq!(
-        workspace.ui_state(),
-        empty_ui_state(),
-        "save as starts the new backing with no values; the SPA rewrites them"
-    );
-
-    workspace
-        .open_file(&first_path)
-        .await
-        .expect("the first file reopens");
-    workspace
-        .duplicate(&copy_path)
-        .await
-        .expect("the duplicate opens");
-    assert_eq!(
-        workspace.ui_state().get("layout").cloned().flatten(),
-        Some(layout.clone()),
-        "duplicate keeps the live values, as it keeps the live grants"
-    );
-    workspace.close_backing_for_test().await;
-    assert_eq!(
-        file_ui_state(&copy_path)
-            .await
-            .get("layout")
-            .cloned()
-            .flatten(),
-        Some(layout),
-        "the copied file stores the row too"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace/tests/write_stall.rs b/crates/workshop/workspace/src/workspace/tests/write_stall.rs
deleted file mode 100644
index 969e7642c..000000000
--- a/crates/workshop/workspace/src/workspace/tests/write_stall.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! The `test-fixtures` write stall: an armed stall holds exactly the
-//! next write until the test releases it, and the write then lands.
-
-use std::sync::mpsc;
-use std::thread;
-use std::time::Duration;
-
-use super::*;
-
-/// How long an unstalled write may take before the test calls it held.
-const UNHELD_WRITE_LIMIT: Duration = Duration::from_secs(10);
-
-#[test]
-fn an_armed_stall_holds_only_the_next_write_until_released() {
-    let (workspace, dir) = granted_dir();
-    let file = dir.path().join("late.txt");
-    let stall = workspace.stall_next_write_for_test();
-
-    let writer = {
-        let workspace = workspace.clone();
-        let file = file.clone();
-        thread::spawn(move || workspace.write_file(&file, "late", None))
-    };
-    thread::sleep(Duration::from_millis(50));
-    assert!(
-        !writer.is_finished(),
-        "the stalled write waits for its release"
-    );
-    assert!(!file.exists(), "nothing lands before the release");
-
-    stall.release();
-    stall.await_completion();
-    assert_eq!(
-        fs::read_to_string(&file).expect("the released write landed"),
-        "late"
-    );
-    let written = writer
-        .join()
-        .expect("the writer thread does not panic")
-        .expect("the released write succeeds");
-
-    let (done_tx, done_rx) = mpsc::channel();
-    thread::spawn(move || {
-        let _ = done_tx.send(workspace.write_file(&file, "next", Some(&written.token)));
-    });
-    let next = done_rx
-        .recv_timeout(UNHELD_WRITE_LIMIT)
-        .expect("the stall arms one write, so the next goes straight through");
-    assert_eq!(next.expect("the next write succeeds").text, "next");
-}
diff --git a/crates/workshop/workspace/src/workspace/token.rs b/crates/workshop/workspace/src/workspace/token.rs
deleted file mode 100644
index e59df0b68..000000000
--- a/crates/workshop/workspace/src/workspace/token.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! The conflict token a file read hands the client and a file write must
-//! echo back: modified time plus length when the filesystem reports a
-//! usable mtime, a content hash otherwise.
-
-use std::fs;
-use std::hash::{DefaultHasher, Hash, Hasher};
-use std::path::Path;
-use std::time::UNIX_EPOCH;
-
-use super::MAX_FILE_BYTES;
-
-/// The mtime half of the conflict token: full-precision modified time in
-/// nanoseconds since the Unix epoch plus the byte length. `None` when the
-/// filesystem reports no usable modified time, which callers cover with
-/// [`hash_token`] - collapsing the error to a constant would make every
-/// token on such a filesystem equal and no write would ever conflict.
-pub(super) fn mtime_token(metadata: &fs::Metadata) -> Option<String> {
-    let duration = metadata.modified().ok()?.duration_since(UNIX_EPOCH).ok()?;
-    Some(format!("{}-{}", duration.as_nanos(), metadata.len()))
-}
-
-/// The content-hash fallback token for filesystems without modified times.
-/// `DefaultHasher` is stable within one process run, which is all a token
-/// needs: a restart invalidates outstanding tokens toward conflict, never
-/// toward a silent overwrite.
-pub(super) fn hash_token(contents: &[u8]) -> String {
-    let mut hasher = DefaultHasher::new();
-    contents.hash(&mut hasher);
-    format!("h-{:016x}", hasher.finish())
-}
-
-/// A file's opaque conflict token from its metadata and already-read
-/// contents: the mtime form when available, otherwise the hash form.
-pub(super) fn file_token(metadata: &fs::Metadata, contents: &[u8]) -> String {
-    mtime_token(metadata).unwrap_or_else(|| hash_token(contents))
-}
-
-/// The current on-disk token of an existing write target, reading the file
-/// only when the hash fallback demands it. `None` means no token could be
-/// derived - an unreadable or oversized file - and the caller must refuse
-/// the write rather than overwrite unverified contents.
-pub(super) fn current_token(path: &Path, metadata: &fs::Metadata) -> Option<String> {
-    if let Some(token) = mtime_token(metadata) {
-        return Some(token);
-    }
-    if metadata.len() > MAX_FILE_BYTES {
-        return None;
-    }
-    fs::read(path).ok().map(|bytes| hash_token(&bytes))
-}
diff --git a/crates/workshop/workspace/src/workspace/tree.rs b/crates/workshop/workspace/src/workspace/tree.rs
deleted file mode 100644
index 214cf9d4a..000000000
--- a/crates/workshop/workspace/src/workspace/tree.rs
+++ /dev/null
@@ -1,121 +0,0 @@
-//! Directory tree listings: one level of a confined directory, or the
-//! granted roots rendered as a synthetic listing.
-
-use std::fs;
-use std::path::Path;
-
-use crate::error::WorkspaceError;
-
-use super::confine::modified_ms;
-use super::{EntryKind, TreeEntry, TreeListing, Workspace};
-
-impl Workspace {
-    /// Lists one level of `path`, or the granted roots when `path` is
-    /// `None` or empty. Directories sort before files, each group ordered
-    /// by name.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError`] when the path is forbidden, outside every
-    /// grant, missing, not a directory, or cannot be listed.
-    pub(crate) fn tree(&self, path: Option<&Path>) -> Result<TreeListing, WorkspaceError> {
-        match path {
-            None => Ok(self.grants_listing()),
-            Some(path) if path.as_os_str().is_empty() => Ok(self.grants_listing()),
-            Some(path) => self.directory_listing(path),
-        }
-    }
-
-    /// The granted roots rendered as a synthetic directory listing.
-    fn grants_listing(&self) -> TreeListing {
-        let entries = self
-            .granted_roots()
-            .into_iter()
-            .map(|root| {
-                let metadata = fs::metadata(&root).ok();
-                // The folder's own name reads better than the full path in
-                // the tree; the path stays available as the row tooltip. A
-                // drive root (C:\) has no file name and shows the path.
-                let name = root.file_name().map_or_else(
-                    || root.to_string_lossy().into_owned(),
-                    |name| name.to_string_lossy().into_owned(),
-                );
-                TreeEntry {
-                    name,
-                    path: root,
-                    kind: EntryKind::Directory,
-                    size: 0,
-                    modified_ms: metadata.as_ref().map_or(0, modified_ms),
-                    exists: metadata.is_some(),
-                }
-            })
-            .collect();
-        TreeListing {
-            path: None,
-            entries,
-        }
-    }
-
-    /// Lists one level of an existing confined directory. A link may be
-    /// classified as a folder or a file from its own attributes (Windows) or
-    /// from a type-only stat (Unix), but listing never opens it and never
-    /// reports its target's size or time; opening a link still confines.
-    /// Opening a Windows link target can stall on, or authenticate to, the
-    /// remote server of a UNC link.
-    fn directory_listing(&self, path: &Path) -> Result<TreeListing, WorkspaceError> {
-        let canonical = self.confine_existing(path)?;
-        let metadata =
-            fs::metadata(&canonical).map_err(|source| WorkspaceError::InspectPath { source })?;
-        if !metadata.is_dir() {
-            return Err(WorkspaceError::NotADirectory);
-        }
-        let mut entries = Vec::new();
-        for entry in
-            fs::read_dir(&canonical).map_err(|source| WorkspaceError::ListDirectory { source })?
-        {
-            let entry = entry.map_err(|source| WorkspaceError::ListDirectory { source })?;
-            let own = entry
-                .metadata()
-                .map_err(|source| WorkspaceError::InspectPath { source })?;
-            let is_link = own.is_symlink();
-            let is_dir = if is_link {
-                #[cfg(windows)]
-                {
-                    use std::os::windows::fs::FileTypeExt;
-                    own.file_type().is_symlink_dir()
-                }
-                #[cfg(unix)]
-                {
-                    fs::metadata(entry.path()).is_ok_and(|target| target.is_dir())
-                }
-            } else {
-                own.is_dir()
-            };
-            entries.push(TreeEntry {
-                name: entry.file_name().to_string_lossy().into_owned(),
-                path: entry.path(),
-                kind: if is_dir {
-                    EntryKind::Directory
-                } else {
-                    EntryKind::File
-                },
-                size: if !is_link && own.is_file() {
-                    own.len()
-                } else {
-                    0
-                },
-                modified_ms: modified_ms(&own),
-                exists: true,
-            });
-        }
-        entries.sort_by(|a, b| {
-            (a.kind != EntryKind::Directory)
-                .cmp(&(b.kind != EntryKind::Directory))
-                .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
-                .then_with(|| a.name.cmp(&b.name))
-        });
-        Ok(TreeListing {
-            path: Some(canonical),
-            entries,
-        })
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace_file.rs b/crates/workshop/workspace/src/workspace_file.rs
deleted file mode 100644
index 0d57cc691..000000000
--- a/crates/workshop/workspace/src/workspace_file.rs
+++ /dev/null
@@ -1,477 +0,0 @@
-//! The workspace file: the single Turso database (`.rvwork`) that mirrors
-//! the in-memory grant set and holds window state between sessions.
-//!
-//! This is the persistence seam of the workspace subsystem. The in-memory
-//! grant set stays the confinement source of truth; nothing here is
-//! consulted on a request path. All database I/O is async because turso's
-//! API is async-native, and it all runs on one actor task that owns the
-//! one connection ([`actor::run`]): channel order is disk order.
-//!
-//! Schema v1 holds three tables: `meta`, `grants`, and `kv`. The `kv`
-//! table holds the window geometry and the opaque ui-state values the
-//! SPA owns ([`ui_state_kv`]).
-
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use std::{fs, io};
-
-use serde::{Deserialize, Serialize};
-use tokio::sync::{mpsc, oneshot};
-
-mod actor;
-mod siblings;
-pub(crate) mod ui_state_kv;
-
-pub(crate) use actor::now_rfc3339;
-use actor::{COMMAND_QUEUE_DEPTH, Command, SCHEMA_V1};
-use siblings::{already_taken, copy_siblings_or_clean_up, plan_siblings};
-pub(crate) use ui_state_kv::{UI_STATE_KEYS, empty_ui_state};
-
-use crate::blocking::{blocking, try_blocking};
-
-/// Meta key naming the file format; always [`FORMAT_NAME`].
-const META_FORMAT: &str = "format";
-/// Meta key holding the schema version; always [`SUPPORTED_VERSION`]
-/// for files this build writes.
-const META_VERSION: &str = "version";
-/// Meta key holding the display name; a file without it is refused.
-const META_NAME: &str = "name";
-/// Meta key holding the RFC 3339 creation time.
-const META_CREATED_AT: &str = "created_at";
-/// The kv key holding the desktop app's saved geometry as JSON; the other kv
-/// keys are the opaque ui-state values in [`UI_STATE_KEYS`].
-const KV_WINDOW: &str = "window";
-
-/// The value every workspace file stores under [`META_FORMAT`].
-const FORMAT_NAME: &str = "runvil-workspace";
-/// The schema version this build reads and writes, as both the `meta`
-/// text and the `user_version` pragma.
-const SUPPORTED_VERSION: &str = "1";
-/// [`SUPPORTED_VERSION`] as the pragma integer.
-const SUPPORTED_USER_VERSION: i64 = 1;
-
-/// A workspace-file operation failure. Public because [`WorkspaceError`]
-/// wraps it at the route boundary; nothing outside the crate constructs
-/// one.
-///
-/// [`WorkspaceError`]: crate::WorkspaceError
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum WorkspaceFileError {
-    /// The path could not be handed to the database, or does
-    /// not name a usable file.
-    #[error("workspace file path cannot be used")]
-    Io {
-        /// The underlying I/O failure.
-        #[source]
-        source: io::Error,
-    },
-
-    /// The database refused the operation.
-    #[error("workspace database operation failed")]
-    Database {
-        /// The underlying database failure.
-        #[source]
-        source: turso::Error,
-    },
-
-    /// The file is not a Runvil workspace: not a database, or a
-    /// database without the `meta` stamp.
-    #[error("{} is not a runvil workspace file", path.display())]
-    NotAWorkspace {
-        /// The refused path.
-        path: PathBuf,
-    },
-
-    /// The file is a workspace written by a build with a different
-    /// schema version.
-    #[error(
-        "workspace file version {found} is unsupported; this build supports version {supported}"
-    )]
-    UnsupportedVersion {
-        /// The version the file declares.
-        found: String,
-        /// The version this build supports.
-        supported: &'static str,
-    },
-
-    /// The actor behind the handle has stopped.
-    #[error("workspace file is closed")]
-    Closed,
-}
-
-impl From<turso::Error> for WorkspaceFileError {
-    fn from(source: turso::Error) -> Self {
-        Self::Database { source }
-    }
-}
-
-/// Everything a workspace file holds between sessions.
-#[derive(Debug, Clone)]
-pub(crate) struct WorkspaceContents {
-    /// Display name (meta 'name').
-    pub(crate) name: String,
-    /// Granted roots in tree order (grants table, ordered by position).
-    pub(crate) grants: Vec<GrantRow>,
-    /// Saved window geometry (kv 'window'), absent when never saved.
-    pub(crate) window_state: Option<WindowState>,
-    /// The opaque ui-state values (kv rows named by [`UI_STATE_KEYS`]),
-    /// one entry per key, `None` when never saved.
-    pub(crate) ui_state: BTreeMap<&'static str, Option<serde_json::Value>>,
-}
-
-/// One row of the grants table.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct GrantRow {
-    /// Canonical granted root, verbatim-prefix-free.
-    pub(crate) path: PathBuf,
-    /// Stable tree order.
-    pub(crate) position: u32,
-    /// RFC 3339 grant time.
-    pub(crate) added_at: String,
-}
-
-/// The kv 'window' value: the desktop app's saved geometry.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub(crate) struct WindowState {
-    /// Logical width.
-    pub(crate) width: u32,
-    /// Logical height.
-    pub(crate) height: u32,
-    /// Logical x position.
-    pub(crate) x: i32,
-    /// Logical y position.
-    pub(crate) y: i32,
-    /// Whether the window is maximized.
-    pub(crate) maximized: bool,
-}
-
-/// A handle to an open workspace file: a clone-cheap sender into the
-/// actor that owns the connection. Dropping every handle ends the actor
-/// and closes the file; [`WorkspaceFile::close`] does the same and waits
-/// for it.
-#[derive(Debug, Clone)]
-pub(crate) struct WorkspaceFile {
-    tx: mpsc::Sender<Command>,
-    path: Arc<Path>,
-}
-
-impl WorkspaceFile {
-    /// Creates a new workspace file at `path` holding `contents`, and
-    /// returns a handle to it.
-    ///
-    /// Writes exactly one file at the chosen path: the parent directory
-    /// must exist and the path must not. The schema is applied first;
-    /// the `meta` stamp, the grants, the window state, and any ui-state
-    /// values then land in one transaction. A failure after the file appears removes it
-    /// again, so a retry at the same path is not refused.
-    pub(crate) async fn create(
-        path: &Path,
-        contents: &WorkspaceContents,
-    ) -> Result<Self, WorkspaceFileError> {
-        let probe = path.to_path_buf();
-        if blocking(move || probe.exists()).await.map_err(io_failure)? {
-            return Err(already_taken("workspace file path is already taken"));
-        }
-        let conn = open_database(path).await?;
-        if let Err(error) = initialize(&conn, contents).await {
-            // The connection must go before the file can; a failed
-            // removal cannot say more than the write failure did.
-            drop(conn);
-            let created = path.to_path_buf();
-            let _ = blocking(move || {
-                let _ = fs::remove_file(actor::wal_sidecar_of(&created));
-                let _ = fs::remove_file(&created);
-            })
-            .await;
-            return Err(error);
-        }
-        Ok(Self::spawn(conn, path))
-    }
-
-    /// Opens the workspace file at `path` after validating its stamp.
-    ///
-    /// Validation reads `user_version`, `meta.format`, and
-    /// `meta.version` before anything else and writes nothing; a file
-    /// that fails it is left byte-identical. The path must already
-    /// exist: opening never creates.
-    pub(crate) async fn open(path: &Path) -> Result<Self, WorkspaceFileError> {
-        let probe = path.to_path_buf();
-        if !blocking(move || probe.is_file())
-            .await
-            .map_err(io_failure)?
-        {
-            return Err(WorkspaceFileError::Io {
-                source: io::Error::new(io::ErrorKind::NotFound, "workspace file does not exist"),
-            });
-        }
-        let conn = match open_database(path).await {
-            Ok(conn) => conn,
-            Err(error) if is_not_a_database(&error) => {
-                return Err(WorkspaceFileError::NotAWorkspace {
-                    path: path.to_path_buf(),
-                });
-            }
-            Err(error) => return Err(error),
-        };
-        validate(&conn, path).await?;
-        Ok(Self::spawn(conn, path))
-    }
-
-    /// Where the file lives on disk.
-    pub(crate) fn path(&self) -> &Path {
-        &self.path
-    }
-
-    /// Whether `other` is a clone of this handle: both feed the same
-    /// actor, so the same connection to the file.
-    #[cfg(test)]
-    pub(crate) fn is_same_handle(&self, other: &Self) -> bool {
-        self.tx.same_channel(&other.tx)
-    }
-
-    /// Reads everything the file holds.
-    pub(crate) async fn contents(&self) -> Result<WorkspaceContents, WorkspaceFileError> {
-        self.request(|reply| Command::Contents { reply }).await
-    }
-
-    /// Persists one grant at one past the file's current maximum
-    /// position, so grants reopen in the order they were made. The
-    /// row's own `position` is not consulted; only the file knows its
-    /// maximum. Re-granting a held path moves it to the end.
-    pub(crate) async fn add_grant(&self, row: GrantRow) -> Result<(), WorkspaceFileError> {
-        self.request(|reply| Command::AddGrant { row, reply }).await
-    }
-
-    /// Forgets the grant at `path`; the other grants keep their
-    /// positions. Removing a path the file does not hold succeeds.
-    pub(crate) async fn remove_grant(&self, path: &Path) -> Result<(), WorkspaceFileError> {
-        let path = path.to_path_buf();
-        self.request(|reply| Command::RemoveGrant { path, reply })
-            .await
-    }
-
-    /// Saves the window geometry, replacing any earlier save.
-    pub(crate) async fn put_window_state(
-        &self,
-        state: WindowState,
-    ) -> Result<(), WorkspaceFileError> {
-        self.request(|reply| Command::PutWindowState { state, reply })
-            .await
-    }
-
-    /// Copies this workspace to `destination` and opens the copy.
-    ///
-    /// The actor drains every pending write, checkpoints the WAL into
-    /// the main file, and copies the file in one command, so no write
-    /// lands between the checkpoint and the copy and the copy is
-    /// complete without a sidecar. The siblings the workspace has grown
-    /// then follow (never the derived index, never anything else in the
-    /// folder), and the copy is opened through the usual validation.
-    /// Like create, this writes exactly the file at the chosen path and
-    /// refuses a path already taken; a destination folder that already
-    /// holds a sibling of the same name is refused too, before anything
-    /// is written, so another workspace's data is never merged into. A
-    /// failure after the copy appears removes the file and every
-    /// sibling this call created.
-    ///
-    /// The probes and the sibling copies are synchronous filesystem work
-    /// and run on the blocking pool; the snapshot itself runs on the actor.
-    pub(crate) async fn duplicate_to(
-        &self,
-        destination: &Path,
-    ) -> Result<Self, WorkspaceFileError> {
-        let source = self.path.to_path_buf();
-        let target = destination.to_path_buf();
-        let siblings = try_blocking(
-            move || {
-                if target.exists() {
-                    return Err(already_taken("workspace file path is already taken"));
-                }
-                plan_siblings(&source, &target)
-            },
-            io_failure,
-        )
-        .await?;
-        let target = destination.to_path_buf();
-        self.request(|reply| Command::Snapshot {
-            destination: target,
-            reply,
-        })
-        .await?;
-        let target = destination.to_path_buf();
-        try_blocking(
-            move || copy_siblings_or_clean_up(&siblings, &target).map_err(io_failure),
-            io_failure,
-        )
-        .await?;
-        Self::open(destination).await
-    }
-
-    /// Stops the actor and waits for the connection to close, so the
-    /// file can be reopened, copied, or removed immediately afterwards.
-    /// A handle whose actor already stopped returns at once.
-    pub(crate) async fn close(&self) {
-        let (reply, response) = oneshot::channel();
-        if self.tx.send(Command::Shutdown { reply }).await.is_ok() {
-            let _ = response.await;
-        }
-    }
-
-    /// Sends the command `make` builds around a fresh reply slot and
-    /// awaits the answer; a stopped actor answers [`WorkspaceFileError::Closed`]
-    /// from either side of the exchange.
-    async fn request<T>(
-        &self,
-        make: impl FnOnce(oneshot::Sender<Result<T, WorkspaceFileError>>) -> Command,
-    ) -> Result<T, WorkspaceFileError> {
-        let (reply, response) = oneshot::channel();
-        self.tx
-            .send(make(reply))
-            .await
-            .map_err(|_| WorkspaceFileError::Closed)?;
-        response.await.map_err(|_| WorkspaceFileError::Closed)?
-    }
-
-    /// Starts the actor over `conn`, the connection to the file at
-    /// `path`, and returns its handle.
-    fn spawn(conn: turso::Connection, path: &Path) -> Self {
-        let (tx, rx) = mpsc::channel(COMMAND_QUEUE_DEPTH);
-        tokio::spawn(actor::run(rx, conn, path.to_path_buf()));
-        Self {
-            tx,
-            path: Arc::from(path),
-        }
-    }
-}
-
-/// Applies the v1 schema to a freshly created database, then writes
-/// `contents` into it in one transaction.
-async fn initialize(
-    conn: &turso::Connection,
-    contents: &WorkspaceContents,
-) -> Result<(), WorkspaceFileError> {
-    conn.execute_batch(SCHEMA_V1).await?;
-    actor::write_contents(conn, contents).await
-}
-
-/// Opens the database at `path`, creating the file when absent, and
-/// returns one connection to it.
-///
-/// The connection is the caller's only handle on the database and keeps
-/// it alive. The parent directory must already exist: this creates the
-/// file, never a directory.
-pub(crate) async fn open_database(path: &Path) -> Result<turso::Connection, WorkspaceFileError> {
-    // turso addresses databases by string, so a path that is not UTF-8
-    // cannot be opened at all; surface that as the I/O failure it is.
-    let path = path.to_str().ok_or_else(|| WorkspaceFileError::Io {
-        source: io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "workspace file path must be utf-8",
-        ),
-    })?;
-    let database = turso::Builder::new_local(path).build().await?;
-    Ok(database.connect()?)
-}
-
-/// Creates a database at `path` that is not a workspace - one foreign
-/// table and no stamp - and closes it, so tests in dependent crates can
-/// exercise the refusal path without a database dependency of their own.
-///
-/// # Errors
-/// Returns [`WorkspaceFileError`] when the file cannot be created or the
-/// table cannot be written.
-#[cfg(any(test, feature = "test-fixtures"))]
-pub async fn create_alien_database_for_test(path: &Path) -> Result<(), WorkspaceFileError> {
-    let conn = open_database(path).await?;
-    conn.execute_batch("CREATE TABLE notes (body TEXT NOT NULL);")
-        .await?;
-    Ok(())
-}
-
-/// Checks the stamp of an opened database without writing anything:
-/// the `meta` table must exist and hold the format name, and both the
-/// `user_version` pragma and `meta.version` must be the supported version.
-async fn validate(conn: &turso::Connection, path: &Path) -> Result<(), WorkspaceFileError> {
-    let refused = || WorkspaceFileError::NotAWorkspace {
-        path: path.to_path_buf(),
-    };
-    let user_version = match read_user_version(conn).await {
-        Ok(version) => version,
-        // A file with a foreign header fails here rather than at open.
-        Err(error) if is_not_a_database(&error) => return Err(refused()),
-        Err(error) => return Err(error),
-    };
-    if !has_meta_table(conn).await? {
-        return Err(refused());
-    }
-    match actor::read_meta(conn, META_FORMAT).await? {
-        Some(format) if format == FORMAT_NAME => {}
-        _ => return Err(refused()),
-    }
-    let version = actor::read_meta(conn, META_VERSION)
-        .await?
-        .ok_or_else(refused)?;
-    if version != SUPPORTED_VERSION {
-        return Err(WorkspaceFileError::UnsupportedVersion {
-            found: version,
-            supported: SUPPORTED_VERSION,
-        });
-    }
-    if user_version != SUPPORTED_USER_VERSION {
-        return Err(WorkspaceFileError::UnsupportedVersion {
-            found: user_version.to_string(),
-            supported: SUPPORTED_VERSION,
-        });
-    }
-    Ok(())
-}
-
-/// Reads the `user_version` pragma.
-async fn read_user_version(conn: &turso::Connection) -> Result<i64, WorkspaceFileError> {
-    let mut rows = conn.query("PRAGMA user_version", ()).await?;
-    match rows.next().await? {
-        Some(row) => Ok(row.get(0)?),
-        None => Ok(0),
-    }
-}
-
-/// Whether the schema declares a `meta` table.
-async fn has_meta_table(conn: &turso::Connection) -> Result<bool, WorkspaceFileError> {
-    let mut rows = conn
-        .query(
-            "SELECT count(*) FROM sqlite_schema WHERE type = 'table' AND name = 'meta'",
-            (),
-        )
-        .await?;
-    match rows.next().await? {
-        Some(row) => Ok(row.get::<i64>(0)? > 0),
-        None => Ok(false),
-    }
-}
-
-/// An I/O failure as the file error that wraps it.
-fn io_failure(source: io::Error) -> WorkspaceFileError {
-    WorkspaceFileError::Io { source }
-}
-
-/// Whether a database failure says the file is not a database at all.
-fn is_not_a_database(error: &WorkspaceFileError) -> bool {
-    matches!(
-        error,
-        WorkspaceFileError::Database {
-            source: turso::Error::NotAdb(_) | turso::Error::Corrupt(_)
-        }
-    )
-}
-
-/// The file stem of `path`, the display name a file falls back to.
-pub(crate) fn stem_of(path: &Path) -> String {
-    path.file_stem()
-        .map(|stem| stem.to_string_lossy().into_owned())
-        .unwrap_or_default()
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/workshop/workspace/src/workspace_file/actor.rs b/crates/workshop/workspace/src/workspace_file/actor.rs
deleted file mode 100644
index 9c7166f2e..000000000
--- a/crates/workshop/workspace/src/workspace_file/actor.rs
+++ /dev/null
@@ -1,438 +0,0 @@
-//! The workspace-file actor: one tokio task owning the one turso
-//! connection, fed by a bounded channel. Channel order is disk order,
-//! so the file mirrors memory without locks.
-
-use std::path::{Path, PathBuf};
-use std::time::SystemTime;
-
-use tokio::sync::{mpsc, oneshot};
-
-use super::ui_state_kv::{put_ui_state_row, read_ui_state_rows};
-use super::{
-    FORMAT_NAME, GrantRow, KV_WINDOW, META_CREATED_AT, META_FORMAT, META_NAME, META_VERSION,
-    SUPPORTED_VERSION, WindowState, WorkspaceContents, WorkspaceFileError, io_failure,
-};
-use crate::blocking::blocking;
-
-/// A reply slot for a command that answers with success or failure.
-type Ack = oneshot::Sender<Result<(), WorkspaceFileError>>;
-
-/// The size of a WAL file that holds a header and no frames. A sidecar
-/// this small holds nothing the main file lacks.
-const WAL_HEADER_SIZE: u64 = 32;
-
-/// The v1 schema, as applied at create time. `user_version` holds the
-/// schema version; `meta` stores the format stamp and display name;
-/// `grants` mirrors the in-memory grant set in tree order; `kv` holds
-/// JSON values keyed by name (`window` and the ui-state keys).
-pub(super) const SCHEMA_V1: &str = "\
-PRAGMA user_version = 1;
-
-CREATE TABLE meta (
-    key   TEXT PRIMARY KEY,
-    value TEXT NOT NULL
-);
-
-CREATE TABLE grants (
-    path     TEXT PRIMARY KEY,
-    position INTEGER NOT NULL,
-    added_at TEXT NOT NULL
-);
-
-CREATE TABLE kv (
-    key   TEXT PRIMARY KEY,
-    value TEXT NOT NULL
-);
-";
-
-/// How many commands may wait in the channel before senders back off.
-/// Grants arrive at user-gesture rate and geometry saves are debounced,
-/// so a small bound is ample; a full channel is a symptom.
-pub(super) const COMMAND_QUEUE_DEPTH: usize = 32;
-
-/// One unit of work for the actor. Each variant that answers holds a
-/// `oneshot` reply; a dropped reply means the caller gave up, which the
-/// actor ignores.
-#[derive(Debug)]
-pub(super) enum Command {
-    /// Reads everything the file holds.
-    Contents {
-        /// Where the contents go.
-        reply: oneshot::Sender<Result<WorkspaceContents, WorkspaceFileError>>,
-    },
-    /// Inserts or replaces one grant; the file assigns its `position`.
-    AddGrant {
-        /// The grant to persist.
-        row: GrantRow,
-        /// Fires once the row is written.
-        reply: Ack,
-    },
-    /// Deletes the grant at `path`; the survivors keep their positions.
-    RemoveGrant {
-        /// The canonical root to forget.
-        path: PathBuf,
-        /// Fires once the row is gone.
-        reply: Ack,
-    },
-    /// Inserts or replaces the saved window geometry.
-    PutWindowState {
-        /// The geometry to persist.
-        state: WindowState,
-        /// Fires once the value is written.
-        reply: Ack,
-    },
-    /// Inserts or replaces one opaque ui-state value. The key is already
-    /// allow-listed and the text already validated at the route.
-    PutUiState {
-        /// The allow-listed kv key.
-        key: &'static str,
-        /// The JSON text to store verbatim.
-        json_text: String,
-        /// Fires once the row is written.
-        reply: Ack,
-    },
-    /// Folds the WAL into the main file, then copies the main file to
-    /// `destination`, all on the actor so no write lands in between and
-    /// no checkpoint runs during the copy.
-    Snapshot {
-        /// Where the complete copy goes; must not exist.
-        destination: PathBuf,
-        /// Fires once the copy is on disk.
-        reply: Ack,
-    },
-    /// Stops the loop and closes the connection; the reply fires once the
-    /// connection is dropped, so a caller can reopen the file safely.
-    Shutdown {
-        /// Fires after the connection closes.
-        reply: oneshot::Sender<()>,
-    },
-}
-
-/// The actor loop: one task, one connection, channel order is disk
-/// order. Ends when the last sender drops or a `Shutdown` arrives; either
-/// way the connection closes through [`close_database`], so the file is
-/// left alone at `path` with no sidecar beside it.
-pub(super) async fn run(mut rx: mpsc::Receiver<Command>, conn: turso::Connection, path: PathBuf) {
-    while let Some(command) = rx.recv().await {
-        match command {
-            Command::Contents { reply } => {
-                let _ = reply.send(read_contents(&conn, &path).await);
-            }
-            Command::AddGrant { row, reply } => {
-                let _ = reply.send(add_grant(&conn, &row).await);
-            }
-            Command::RemoveGrant { path, reply } => {
-                let _ = reply.send(remove_grant(&conn, &path).await);
-            }
-            Command::PutWindowState { state, reply } => {
-                let _ = reply.send(put_window_state(&conn, state).await);
-            }
-            Command::PutUiState {
-                key,
-                json_text,
-                reply,
-            } => {
-                let _ = reply.send(put_ui_state_row(&conn, key, &json_text).await);
-            }
-            Command::Snapshot { destination, reply } => {
-                let _ = reply.send(snapshot(&conn, &path, &destination).await);
-            }
-            Command::Shutdown { reply } => {
-                // Close the channel so no later command outlives the
-                // connection, then close the file before answering.
-                rx.close();
-                close_database(conn, &path).await;
-                let _ = reply.send(());
-                return;
-            }
-        }
-    }
-    close_database(conn, &path).await;
-}
-
-/// Closes the only connection to the database at `path` and leaves
-/// exactly the file behind: the WAL is checkpointed into the main file
-/// and truncated, the connection dropped, and the emptied `-wal` sidecar
-/// removed. A sidecar that still holds frames is never touched; the
-/// database replays it on the next open. The sidecar check is filesystem
-/// work and runs on the blocking pool, awaited, so the close is complete
-/// when this returns.
-async fn close_database(conn: turso::Connection, path: &Path) {
-    if let Err(error) = checkpoint(&conn).await {
-        tracing::warn!(%error, path = %path.display(), "workspace file checkpoint failed on close");
-    }
-    drop(conn);
-    let sidecar_of = path.to_path_buf();
-    if let Err(error) = blocking(move || remove_empty_wal_sidecar(&sidecar_of)).await {
-        tracing::warn!(%error, path = %path.display(), "workspace file wal sidecar not checked");
-    }
-}
-
-/// Folds every WAL frame into the main file and truncates the WAL, so
-/// the main file alone is a complete copy of the database.
-async fn checkpoint(conn: &turso::Connection) -> Result<(), WorkspaceFileError> {
-    // The pragma answers with a status row (busy, log, checkpointed);
-    // it must be read as a query and drained for the work to complete.
-    let mut rows = conn.query("PRAGMA wal_checkpoint(TRUNCATE)", ()).await?;
-    while rows.next().await?.is_some() {}
-    Ok(())
-}
-
-/// Checkpoints the database at `path` and copies the main file to
-/// `destination`. Running on the actor, between commands, this is the
-/// one moment the main file is guaranteed complete and still: the
-/// actor owns the only connection, so nothing writes or checkpoints
-/// until the copy returns. The copy is synchronous filesystem work and
-/// runs on the blocking pool, awaited here so the actor handles no other
-/// command while it is in flight, the same discipline as
-/// [`close_database`].
-async fn snapshot(
-    conn: &turso::Connection,
-    path: &Path,
-    destination: &Path,
-) -> Result<(), WorkspaceFileError> {
-    checkpoint(conn).await?;
-    let (from, to) = (path.to_path_buf(), destination.to_path_buf());
-    match blocking(move || std::fs::copy(&from, &to)).await {
-        Ok(Ok(_)) => Ok(()),
-        Ok(Err(source)) | Err(source) => Err(io_failure(source)),
-    }
-}
-
-/// Writes the stamp, the grants, the window state, and any ui-state
-/// values into a freshly schema'd database, all in one transaction.
-pub(super) async fn write_contents(
-    conn: &turso::Connection,
-    contents: &WorkspaceContents,
-) -> Result<(), WorkspaceFileError> {
-    conn.execute("BEGIN", ()).await?;
-    let result = write_contents_rows(conn, contents).await;
-    if result.is_err() {
-        // A failed rollback cannot say more than the write failure did.
-        let _ = conn.execute("ROLLBACK", ()).await;
-        return result;
-    }
-    conn.execute("COMMIT", ()).await?;
-    Ok(())
-}
-
-/// The row inserts behind [`write_contents`]. Grants land with the
-/// positions they already have: create trusts its caller's order.
-async fn write_contents_rows(
-    conn: &turso::Connection,
-    contents: &WorkspaceContents,
-) -> Result<(), WorkspaceFileError> {
-    const INSERT_META: &str = "INSERT INTO meta (key, value) VALUES (?1, ?2)";
-    conn.execute(INSERT_META, (META_FORMAT, FORMAT_NAME))
-        .await?;
-    conn.execute(INSERT_META, (META_VERSION, SUPPORTED_VERSION))
-        .await?;
-    conn.execute(INSERT_META, (META_NAME, contents.name.as_str()))
-        .await?;
-    conn.execute(INSERT_META, (META_CREATED_AT, now_rfc3339()))
-        .await?;
-    for grant in &contents.grants {
-        insert_grant(conn, INSERT_GRANT, grant, grant.position).await?;
-    }
-    if let Some(window) = &contents.window_state {
-        conn.execute(
-            "INSERT INTO kv (key, value) VALUES (?1, ?2)",
-            (KV_WINDOW, window_json(window)),
-        )
-        .await?;
-    }
-    for (key, value) in &contents.ui_state {
-        if let Some(value) = value {
-            put_ui_state_row(conn, key, &value.to_string()).await?;
-        }
-    }
-    Ok(())
-}
-
-/// Inserts or replaces `row` at one past the file's current maximum
-/// position, so the grants table keeps insertion order across sessions.
-/// The row's own `position` is not consulted: only the file knows its
-/// maximum. Re-granting a path it already holds moves it to the end.
-async fn add_grant(conn: &turso::Connection, row: &GrantRow) -> Result<(), WorkspaceFileError> {
-    let position = next_position(conn).await?;
-    insert_grant(conn, REPLACE_GRANT, row, position).await
-}
-
-/// The create-time insert: a path given twice is a caller bug and fails
-/// on the primary key rather than silently collapsing.
-const INSERT_GRANT: &str = "INSERT INTO grants (path, position, added_at) VALUES (?1, ?2, ?3)";
-/// The `add_grant` insert: a held path moves to the new position.
-const REPLACE_GRANT: &str =
-    "INSERT OR REPLACE INTO grants (path, position, added_at) VALUES (?1, ?2, ?3)";
-
-/// One past the maximum `position` in the grants table; `0` when empty.
-async fn next_position(conn: &turso::Connection) -> Result<u32, WorkspaceFileError> {
-    let mut rows = conn
-        .query("SELECT COALESCE(MAX(position), -1) + 1 FROM grants", ())
-        .await?;
-    match rows.next().await? {
-        // The sum is never negative; a table past `u32::MAX` grants can
-        // only saturate.
-        Some(row) => Ok(u32::try_from(row.get::<i64>(0)?).unwrap_or(u32::MAX)),
-        None => Ok(0),
-    }
-}
-
-/// Writes `row` at `position` with `statement`, one of [`INSERT_GRANT`]
-/// and [`REPLACE_GRANT`].
-async fn insert_grant(
-    conn: &turso::Connection,
-    statement: &str,
-    row: &GrantRow,
-    position: u32,
-) -> Result<(), WorkspaceFileError> {
-    conn.execute(
-        statement,
-        (
-            row.path.to_string_lossy().into_owned(),
-            position,
-            row.added_at.as_str(),
-        ),
-    )
-    .await?;
-    Ok(())
-}
-
-/// Deletes the grant at `path`. The survivors keep their positions and
-/// the next grant takes one past the maximum.
-async fn remove_grant(conn: &turso::Connection, path: &Path) -> Result<(), WorkspaceFileError> {
-    conn.execute(
-        "DELETE FROM grants WHERE path = ?1",
-        (path.to_string_lossy().into_owned(),),
-    )
-    .await?;
-    Ok(())
-}
-
-/// Inserts or replaces the saved window geometry.
-async fn put_window_state(
-    conn: &turso::Connection,
-    state: WindowState,
-) -> Result<(), WorkspaceFileError> {
-    conn.execute(
-        "INSERT OR REPLACE INTO kv (key, value) VALUES (?1, ?2)",
-        (KV_WINDOW, window_json(&state)),
-    )
-    .await?;
-    Ok(())
-}
-
-/// The kv text for a window state. A five-field struct of plain numbers
-/// and a bool always serializes; the Result is a trait artifact.
-fn window_json(state: &WindowState) -> String {
-    serde_json::to_string(state).unwrap_or_default()
-}
-
-/// The current time as RFC 3339 in UTC, whole seconds.
-pub(crate) fn now_rfc3339() -> String {
-    humantime::format_rfc3339_seconds(SystemTime::now()).to_string()
-}
-
-/// Removes the `-wal` sidecar beside `path` when it holds no frames.
-fn remove_empty_wal_sidecar(path: &Path) {
-    let sidecar = wal_sidecar_of(path);
-    let Ok(metadata) = std::fs::metadata(&sidecar) else {
-        return;
-    };
-    if metadata.len() > WAL_HEADER_SIZE {
-        tracing::warn!(
-            path = %sidecar.display(),
-            "workspace file wal sidecar still holds frames after close; leaving it in place"
-        );
-        return;
-    }
-    if let Err(error) = std::fs::remove_file(&sidecar) {
-        tracing::warn!(%error, path = %sidecar.display(), "workspace file wal sidecar not removed");
-    }
-}
-
-/// The path of the WAL sidecar the database keeps beside `path`.
-pub(super) fn wal_sidecar_of(path: &Path) -> PathBuf {
-    let mut name = path.as_os_str().to_owned();
-    name.push("-wal");
-    PathBuf::from(name)
-}
-
-/// Reads the display name, the grants in position order, the saved
-/// window, and the ui-state values from an already validated connection
-/// to the file at `path`. A file without a display name is refused as
-/// not a workspace.
-async fn read_contents(
-    conn: &turso::Connection,
-    path: &Path,
-) -> Result<WorkspaceContents, WorkspaceFileError> {
-    let name =
-        read_meta(conn, META_NAME)
-            .await?
-            .ok_or_else(|| WorkspaceFileError::NotAWorkspace {
-                path: path.to_path_buf(),
-            })?;
-    let grants = read_grants(conn).await?;
-    let window_state = read_window(conn).await?;
-    let ui_state = read_ui_state_rows(conn).await?;
-    Ok(WorkspaceContents {
-        name,
-        grants,
-        window_state,
-        ui_state,
-    })
-}
-
-/// Reads one `meta` value; `None` when the key is absent.
-pub(super) async fn read_meta(
-    conn: &turso::Connection,
-    key: &str,
-) -> Result<Option<String>, WorkspaceFileError> {
-    let mut rows = conn
-        .query("SELECT value FROM meta WHERE key = ?1", (key,))
-        .await?;
-    match rows.next().await? {
-        Some(row) => Ok(Some(row.get(0)?)),
-        None => Ok(None),
-    }
-}
-
-/// Reads the grants table in tree order.
-async fn read_grants(conn: &turso::Connection) -> Result<Vec<GrantRow>, WorkspaceFileError> {
-    let mut rows = conn
-        .query(
-            "SELECT path, position, added_at FROM grants ORDER BY position",
-            (),
-        )
-        .await?;
-    let mut grants = Vec::new();
-    while let Some(row) = rows.next().await? {
-        let path: String = row.get(0)?;
-        grants.push(GrantRow {
-            path: PathBuf::from(path),
-            position: row.get(1)?,
-            added_at: row.get(2)?,
-        });
-    }
-    Ok(grants)
-}
-
-/// Reads the saved window geometry; `None` when never saved. A value
-/// that no longer parses is treated as absent: the desktop app falls back to
-/// its default geometry rather than refusing the whole file.
-async fn read_window(conn: &turso::Connection) -> Result<Option<WindowState>, WorkspaceFileError> {
-    let mut rows = conn
-        .query("SELECT value FROM kv WHERE key = ?1", (KV_WINDOW,))
-        .await?;
-    let Some(row) = rows.next().await? else {
-        return Ok(None);
-    };
-    let json: String = row.get(0)?;
-    match serde_json::from_str(&json) {
-        Ok(state) => Ok(Some(state)),
-        Err(error) => {
-            tracing::warn!(%error, "saved window state does not parse; using defaults");
-            Ok(None)
-        }
-    }
-}
diff --git a/crates/workshop/workspace/src/workspace_file/siblings.rs b/crates/workshop/workspace/src/workspace_file/siblings.rs
deleted file mode 100644
index e8a699ab6..000000000
--- a/crates/workshop/workspace/src/workspace_file/siblings.rs
+++ /dev/null
@@ -1,116 +0,0 @@
-//! The siblings a workspace grows beside its file and how a duplicate
-//! copies them: which names travel, the refusal that keeps one
-//! workspace's siblings from being merged into another's, and the copy
-//! and cleanup of a planned set.
-
-use std::path::{Path, PathBuf};
-use std::{fs, io};
-
-use super::WorkspaceFileError;
-
-/// The entries a workspace may grow beside its file, each created
-/// lazily by its own project; duplicate copies whichever exist, minus
-/// [`DERIVED_SIBLINGS`].
-const WORKSPACE_SIBLINGS: &[&str] = &["agents", "runs", "terminals", "plugins", "index.db"];
-/// Siblings derived from the others and rebuilt on demand; duplicate
-/// never copies them.
-const DERIVED_SIBLINGS: &[&str] = &["index.db"];
-
-/// Lists the `(from, to)` pairs of the siblings a duplicate of `source`
-/// at `destination` must copy, refusing before anything is written when
-/// a `to` already exists: that is another workspace's data, never to be
-/// merged into. Only the named workspace siblings travel: the derived
-/// index never does, and nothing else in the folder is the workspace's
-/// to copy. Two files in one folder share their siblings by convention,
-/// so a same-folder duplicate copies none.
-pub(super) fn plan_siblings(
-    source: &Path,
-    destination: &Path,
-) -> Result<Vec<(PathBuf, PathBuf)>, WorkspaceFileError> {
-    let (Some(source_dir), Some(destination_dir)) = (source.parent(), destination.parent()) else {
-        return Ok(Vec::new());
-    };
-    if source_dir == destination_dir {
-        return Ok(Vec::new());
-    }
-    let mut siblings = Vec::new();
-    for name in WORKSPACE_SIBLINGS {
-        if DERIVED_SIBLINGS.contains(name) {
-            continue;
-        }
-        let from = source_dir.join(name);
-        if !from.exists() {
-            continue;
-        }
-        let to = destination_dir.join(name);
-        if to.exists() {
-            return Err(already_taken(
-                "destination folder already holds a workspace sibling of the same name",
-            ));
-        }
-        siblings.push((from, to));
-    }
-    Ok(siblings)
-}
-
-/// Copies every planned sibling of a duplicate; when one copy fails,
-/// removes the siblings already copied and the copied workspace file at
-/// `destination`, so a failed duplicate leaves nothing behind. A failed
-/// removal cannot say more than the copy failure did.
-pub(super) fn copy_siblings_or_clean_up(
-    siblings: &[(PathBuf, PathBuf)],
-    destination: &Path,
-) -> io::Result<()> {
-    if let Err(source) = copy_siblings(siblings) {
-        for (_, to) in siblings {
-            let _ = remove_sibling(to);
-        }
-        let _ = fs::remove_file(destination);
-        return Err(source);
-    }
-    Ok(())
-}
-
-/// An `AlreadyExists` I/O refusal holding `message`: the shape both
-/// create and duplicate use to refuse a path that is already taken.
-pub(super) fn already_taken(message: &'static str) -> WorkspaceFileError {
-    WorkspaceFileError::Io {
-        source: io::Error::new(io::ErrorKind::AlreadyExists, message),
-    }
-}
-
-/// Copies every planned sibling, a directory tree or a single file.
-fn copy_siblings(siblings: &[(PathBuf, PathBuf)]) -> io::Result<()> {
-    for (from, to) in siblings {
-        if from.is_dir() {
-            copy_dir_recursive(from, to)?;
-        } else {
-            fs::copy(from, to)?;
-        }
-    }
-    Ok(())
-}
-
-/// Removes a copied sibling, a directory tree or a single file.
-fn remove_sibling(path: &Path) -> io::Result<()> {
-    if path.is_dir() {
-        fs::remove_dir_all(path)
-    } else {
-        fs::remove_file(path)
-    }
-}
-
-/// Copies the tree under `from` to `to`, creating directories as needed.
-fn copy_dir_recursive(from: &Path, to: &Path) -> io::Result<()> {
-    fs::create_dir_all(to)?;
-    for entry in fs::read_dir(from)? {
-        let entry = entry?;
-        let target = to.join(entry.file_name());
-        if entry.file_type()?.is_dir() {
-            copy_dir_recursive(&entry.path(), &target)?;
-        } else {
-            fs::copy(entry.path(), target)?;
-        }
-    }
-    Ok(())
-}
diff --git a/crates/workshop/workspace/src/workspace_file/tests-mutations.rs b/crates/workshop/workspace/src/workspace_file/tests-mutations.rs
deleted file mode 100644
index 399a9c215..000000000
--- a/crates/workshop/workspace/src/workspace_file/tests-mutations.rs
+++ /dev/null
@@ -1,421 +0,0 @@
-//! Mutations and duplication: grant ordering by `position`, window-state
-//! overwrite, duplicate independence and completeness, sibling copying,
-//! and the closed-actor failure mode.
-
-use std::time::Duration;
-
-use super::*;
-
-/// A grant row for `path`; the position is deliberately wrong so a test
-/// proves the file assigns its own.
-fn grant(path: &str) -> GrantRow {
-    GrantRow {
-        path: PathBuf::from(path),
-        position: 99,
-        added_at: "2026-09-16T11:00:00Z".to_string(),
-    }
-}
-
-/// A contents value with no grants and no window.
-fn empty_contents(name: &str) -> WorkspaceContents {
-    WorkspaceContents {
-        name: name.to_string(),
-        grants: Vec::new(),
-        window_state: None,
-        ui_state: empty_ui_state(),
-    }
-}
-
-/// The grant paths of `contents` as strings, in file order.
-fn paths_of(contents: &WorkspaceContents) -> Vec<String> {
-    contents
-        .grants
-        .iter()
-        .map(|grant| grant.path.to_string_lossy().into_owned())
-        .collect()
-}
-
-/// The grant positions of `contents`, in file order.
-fn positions_of(contents: &WorkspaceContents) -> Vec<u32> {
-    contents.grants.iter().map(|grant| grant.position).collect()
-}
-
-/// The five window fields as a tuple, for equality assertions.
-fn fields_of(state: WindowState) -> (u32, u32, i32, i32, bool) {
-    (state.width, state.height, state.x, state.y, state.maximized)
-}
-
-/// The sorted names of every entry directly inside `dir`.
-fn names_in(dir: &Path) -> Vec<String> {
-    let mut names: Vec<String> = fs::read_dir(dir)
-        .expect("the directory lists")
-        .map(|entry| {
-            entry
-                .expect("entry reads")
-                .file_name()
-                .to_string_lossy()
-                .into_owned()
-        })
-        .collect();
-    names.sort();
-    names
-}
-
-/// Opens `path`, reads its contents, and closes it again.
-async fn reopen_contents(path: &Path) -> WorkspaceContents {
-    let file = WorkspaceFile::open(path).await.expect("the file reopens");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-    contents
-}
-
-#[tokio::test]
-async fn three_grants_reopen_in_insertion_order_by_position() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("order.rvwork");
-    let file = WorkspaceFile::create(&path, &empty_contents("Order"))
-        .await
-        .expect("creates");
-
-    for root in ["C:\\zebra", "C:\\apple", "C:\\mango"] {
-        file.add_grant(grant(root)).await.expect("grant persists");
-    }
-    file.close().await;
-
-    let contents = reopen_contents(&path).await;
-    assert_eq!(paths_of(&contents), ["C:\\zebra", "C:\\apple", "C:\\mango"]);
-    assert_eq!(
-        positions_of(&contents),
-        [0, 1, 2],
-        "the file assigns one past its maximum, not the row's own position"
-    );
-}
-
-#[tokio::test]
-async fn removing_the_middle_grant_leaves_the_others_positions_unchanged() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("remove.rvwork");
-    let file = WorkspaceFile::create(&path, &empty_contents("Remove"))
-        .await
-        .expect("creates");
-    for root in ["C:\\zebra", "C:\\apple", "C:\\mango"] {
-        file.add_grant(grant(root)).await.expect("grant persists");
-    }
-
-    file.remove_grant(Path::new("C:\\apple"))
-        .await
-        .expect("removal persists");
-    let after_removal = file.contents().await.expect("contents read");
-    assert_eq!(paths_of(&after_removal), ["C:\\zebra", "C:\\mango"]);
-    assert_eq!(
-        positions_of(&after_removal),
-        [0, 2],
-        "removal never renumbers the survivors"
-    );
-
-    file.add_grant(grant("C:\\pear"))
-        .await
-        .expect("grant persists");
-    file.close().await;
-
-    let contents = reopen_contents(&path).await;
-    assert_eq!(paths_of(&contents), ["C:\\zebra", "C:\\mango", "C:\\pear"]);
-    assert_eq!(
-        positions_of(&contents),
-        [0, 2, 3],
-        "a later grant takes one past the maximum, not the freed slot"
-    );
-}
-
-#[tokio::test]
-async fn window_state_round_trips_and_overwrites() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("window.rvwork");
-    let file = WorkspaceFile::create(&path, &empty_contents("Window"))
-        .await
-        .expect("creates");
-    let first = WindowState {
-        width: 1024,
-        height: 768,
-        x: 10,
-        y: 20,
-        maximized: false,
-    };
-    let second = WindowState {
-        width: 1920,
-        height: 1080,
-        x: 0,
-        y: 0,
-        maximized: true,
-    };
-
-    file.put_window_state(first).await.expect("first save");
-    let saved = file.contents().await.expect("contents read");
-    assert_eq!(
-        saved.window_state.map(fields_of),
-        Some(fields_of(first)),
-        "the first save lands"
-    );
-
-    file.put_window_state(second).await.expect("second save");
-    file.close().await;
-
-    let contents = reopen_contents(&path).await;
-    assert_eq!(
-        contents.window_state.map(fields_of),
-        Some(fields_of(second)),
-        "the second save replaces the first rather than failing on the key"
-    );
-}
-
-#[tokio::test]
-async fn duplicate_then_mutate_leaves_the_original_and_the_copy_independent() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let original_path = dir.path().join("original.rvwork");
-    let copy_path = dir.path().join("copy.rvwork");
-    let original = WorkspaceFile::create(&original_path, &sample_contents())
-        .await
-        .expect("creates");
-
-    let copy = original
-        .duplicate_to(&copy_path)
-        .await
-        .expect("the duplicate opens");
-    assert_eq!(copy.path(), copy_path.as_path());
-
-    original
-        .add_grant(grant("C:\\only-in-original"))
-        .await
-        .expect("grant persists");
-    copy.add_grant(grant("C:\\only-in-copy"))
-        .await
-        .expect("grant persists");
-    copy.put_window_state(WindowState {
-        width: 1,
-        height: 1,
-        x: 1,
-        y: 1,
-        maximized: true,
-    })
-    .await
-    .expect("window persists");
-    original.close().await;
-    copy.close().await;
-
-    let original_contents = reopen_contents(&original_path).await;
-    let copy_contents = reopen_contents(&copy_path).await;
-    assert_eq!(
-        paths_of(&original_contents),
-        [
-            "C:\\projects\\zebra",
-            "C:\\projects\\apple",
-            "C:\\only-in-original"
-        ]
-    );
-    assert_eq!(
-        paths_of(&copy_contents),
-        [
-            "C:\\projects\\zebra",
-            "C:\\projects\\apple",
-            "C:\\only-in-copy"
-        ]
-    );
-    assert!(
-        !original_contents
-            .window_state
-            .map(fields_of)
-            .is_some_and(|fields| fields.4),
-        "the copy's window save never reaches the original"
-    );
-    assert_eq!(
-        names_in(dir.path()),
-        ["copy.rvwork", "original.rvwork"],
-        "a same-folder duplicate is exactly one more file"
-    );
-}
-
-#[tokio::test]
-async fn a_duplicate_taken_with_uncheckpointed_writes_contains_them() {
-    let source_dir = tempfile::TempDir::new().expect("tempdir");
-    let target_dir = tempfile::TempDir::new().expect("tempdir");
-    let source_path = source_dir.path().join("live.rvwork");
-    let target_path = target_dir.path().join("snapshot.rvwork");
-    let source = WorkspaceFile::create(&source_path, &empty_contents("Live"))
-        .await
-        .expect("creates");
-    // These writes sit in the WAL until a checkpoint folds them into the
-    // main file; a copy of the main file alone would miss them.
-    for root in ["C:\\one", "C:\\two", "C:\\three"] {
-        source.add_grant(grant(root)).await.expect("grant persists");
-    }
-
-    let copy = source
-        .duplicate_to(&target_path)
-        .await
-        .expect("the duplicate opens");
-    let contents = copy.contents().await.expect("contents read");
-    copy.close().await;
-    source.close().await;
-
-    assert_eq!(paths_of(&contents), ["C:\\one", "C:\\two", "C:\\three"]);
-    assert_eq!(
-        names_in(target_dir.path()),
-        ["snapshot.rvwork"],
-        "the copy is one complete file with no wal sidecar beside it"
-    );
-}
-
-#[tokio::test]
-async fn duplicate_copies_workspace_siblings_but_not_derived_or_unrelated_entries() {
-    let source_dir = tempfile::TempDir::new().expect("tempdir");
-    let target_dir = tempfile::TempDir::new().expect("tempdir");
-    let source_path = source_dir.path().join("world.rvwork");
-    let target_path = target_dir.path().join("world-copy.rvwork");
-    fs::create_dir_all(source_dir.path().join("runs").join("r1")).expect("runs dir");
-    fs::write(
-        source_dir.path().join("runs").join("r1").join("run.db"),
-        b"run",
-    )
-    .expect("run file");
-    fs::write(source_dir.path().join("index.db"), b"derived").expect("index file");
-    fs::create_dir(source_dir.path().join("photos")).expect("unrelated dir");
-    fs::write(source_dir.path().join("photos").join("cat.jpg"), b"cat").expect("unrelated file");
-    let source = WorkspaceFile::create(&source_path, &empty_contents("World"))
-        .await
-        .expect("creates");
-
-    let copy = source
-        .duplicate_to(&target_path)
-        .await
-        .expect("the duplicate opens");
-    copy.close().await;
-    source.close().await;
-
-    assert_eq!(
-        names_in(target_dir.path()),
-        ["runs", "world-copy.rvwork"],
-        "workspace siblings travel; the derived index and the user's own folders do not"
-    );
-    assert_eq!(
-        fs::read(target_dir.path().join("runs").join("r1").join("run.db")).expect("copied run"),
-        b"run"
-    );
-}
-
-#[tokio::test]
-async fn duplicate_refuses_a_destination_folder_that_already_holds_a_sibling() {
-    let source_dir = tempfile::TempDir::new().expect("tempdir");
-    let target_dir = tempfile::TempDir::new().expect("tempdir");
-    let source_path = source_dir.path().join("mine.rvwork");
-    let target_path = target_dir.path().join("mine-copy.rvwork");
-    fs::create_dir(source_dir.path().join("runs")).expect("source runs dir");
-    fs::write(source_dir.path().join("runs").join("mine.db"), b"mine").expect("source run");
-    // The destination folder is another workspace's home: its `runs/`
-    // must never be merged into or overwritten.
-    fs::create_dir(target_dir.path().join("runs")).expect("target runs dir");
-    fs::write(target_dir.path().join("runs").join("theirs.db"), b"theirs").expect("their run");
-    let source = WorkspaceFile::create(&source_path, &empty_contents("Mine"))
-        .await
-        .expect("creates");
-
-    let error = source
-        .duplicate_to(&target_path)
-        .await
-        .expect_err("a duplicate never lands beside another workspace's siblings");
-    source.close().await;
-
-    assert!(
-        matches!(&error, WorkspaceFileError::Io { source } if source.kind() == io::ErrorKind::AlreadyExists),
-        "expected an AlreadyExists I/O failure, got {error:?}"
-    );
-    assert!(
-        !target_path.exists(),
-        "the refusal happens before the file is written"
-    );
-    assert_eq!(
-        names_in(&target_dir.path().join("runs")),
-        ["theirs.db"],
-        "the other workspace's runs are untouched"
-    );
-}
-
-#[tokio::test]
-async fn duplicate_refuses_an_existing_destination() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let source_path = dir.path().join("source.rvwork");
-    let taken = dir.path().join("taken.rvwork");
-    fs::write(&taken, b"already here").expect("placeholder writes");
-    let source = WorkspaceFile::create(&source_path, &empty_contents("Source"))
-        .await
-        .expect("creates");
-
-    let error = source
-        .duplicate_to(&taken)
-        .await
-        .expect_err("duplicate never overwrites");
-    source.close().await;
-
-    assert!(
-        matches!(&error, WorkspaceFileError::Io { source } if source.kind() == io::ErrorKind::AlreadyExists),
-        "expected an AlreadyExists I/O failure, got {error:?}"
-    );
-    assert_eq!(
-        fs::read(&taken).expect("placeholder reads"),
-        b"already here"
-    );
-}
-
-#[tokio::test]
-async fn a_closed_actor_answers_a_further_add_grant_with_closed() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("closed.rvwork");
-    let file = WorkspaceFile::create(&path, &empty_contents("Closed"))
-        .await
-        .expect("creates");
-    let other_handle = file.clone();
-
-    file.close().await;
-
-    let error = other_handle
-        .add_grant(grant("C:\\late"))
-        .await
-        .expect_err("a stopped actor takes no more work");
-    assert!(
-        matches!(error, WorkspaceFileError::Closed),
-        "expected Closed, got {error:?}"
-    );
-    assert!(
-        reopen_contents(&path).await.grants.is_empty(),
-        "the late grant never reached the file"
-    );
-}
-
-#[tokio::test]
-async fn dropping_every_handle_closes_the_actor_and_the_file() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("dropped.rvwork");
-    let file = WorkspaceFile::create(&path, &empty_contents("Dropped"))
-        .await
-        .expect("creates");
-    file.add_grant(grant("C:\\kept"))
-        .await
-        .expect("grant persists");
-    let clone = file.clone();
-
-    drop(file);
-    drop(clone);
-
-    // The actor drains and closes on its own task; give it a bounded
-    // moment to checkpoint and remove the sidecar.
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    while names_in(dir.path()) != ["dropped.rvwork"] {
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "the actor did not close the file after every handle dropped: {:?}",
-            names_in(dir.path())
-        );
-        tokio::time::sleep(Duration::from_millis(20)).await;
-    }
-    let contents = reopen_contents(&path).await;
-    assert_eq!(paths_of(&contents), ["C:\\kept"]);
-}
diff --git a/crates/workshop/workspace/src/workspace_file/tests-ui-state-kv.rs b/crates/workshop/workspace/src/workspace_file/tests-ui-state-kv.rs
deleted file mode 100644
index c61adcad8..000000000
--- a/crates/workshop/workspace/src/workspace_file/tests-ui-state-kv.rs
+++ /dev/null
@@ -1,269 +0,0 @@
-//! The three opaque ui-state kv keys: round trip through create, put,
-//! close, open; a file with no ui-state rows reading all three as
-//! absent; and save-as leaving the new file's keys empty.
-
-use serde_json::json;
-use workshop_support::{STATE_BUCKET_VALUE_CAP, StateBucketValue};
-
-use super::*;
-use crate::Workspace;
-use crate::workspace_file::ui_state_kv::UI_STATE_KEYS;
-
-/// A validated put of `text` under `key`, as the route builds one.
-fn bucket(key: &str, text: &str) -> StateBucketValue {
-    StateBucketValue::new(key, &UI_STATE_KEYS, text.as_bytes()).expect("the fixture is a valid put")
-}
-
-/// A contents value with no grants, no window, and no ui state.
-fn bare_contents(name: &str) -> WorkspaceContents {
-    WorkspaceContents {
-        name: name.to_string(),
-        grants: Vec::new(),
-        window_state: None,
-        ui_state: empty_ui_state(),
-    }
-}
-
-/// Opens `path`, reads its ui state, and closes it again.
-async fn reopen_ui_state(path: &Path) -> BTreeMap<&'static str, Option<serde_json::Value>> {
-    let file = WorkspaceFile::open(path).await.expect("the file reopens");
-    let state = file.read_ui_state().await.expect("ui state reads");
-    file.close().await;
-    state
-}
-
-/// How many rows the kv table of the closed file at `path` holds.
-async fn kv_row_count(path: &Path) -> i64 {
-    let conn = open_database(path).await.expect("the closed file opens");
-    let mut rows = conn
-        .query("SELECT count(*) FROM kv", ())
-        .await
-        .expect("kv counts");
-    let row = rows
-        .next()
-        .await
-        .expect("the count row reads")
-        .expect("count yields one row");
-    row.get(0).expect("count is an integer")
-}
-
-#[test]
-fn the_allow_list_names_exactly_the_three_workspace_keys() {
-    assert_eq!(UI_STATE_KEYS, ["layout", "tree", "closed_editors"]);
-    assert_eq!(STATE_BUCKET_VALUE_CAP, 1 << 20);
-    let empty = empty_ui_state();
-    assert_eq!(empty.len(), 3, "the empty map still has every key");
-    assert!(empty.values().all(Option::is_none));
-}
-
-#[tokio::test]
-async fn each_allowed_key_round_trips_through_create_put_close_and_open() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("state.rvwork");
-    let file = WorkspaceFile::create(&path, &bare_contents("State"))
-        .await
-        .expect("creates");
-    let values = [
-        ("layout", json!({ "version": 3, "zones": { "tree": 240 } })),
-        ("tree", json!({ "expanded": ["C:\\projects\\zebra"] })),
-        (
-            "closed_editors",
-            json!({ "paths": ["C:\\projects\\zebra\\a.md"] }),
-        ),
-    ];
-
-    for (key, value) in &values {
-        file.put_ui_state(&bucket(key, &value.to_string()))
-            .await
-            .expect("an allowed key writes");
-    }
-    file.close().await;
-
-    let state = reopen_ui_state(&path).await;
-    for (key, value) in &values {
-        assert_eq!(
-            state.get(key).cloned().flatten().as_ref(),
-            Some(value),
-            "{key} comes back as the JSON that was put"
-        );
-    }
-    assert_eq!(kv_row_count(&path).await, 3, "one kv row per key");
-}
-
-#[tokio::test]
-async fn a_second_put_replaces_the_first_and_the_text_is_stored_verbatim() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("replace.rvwork");
-    let file = WorkspaceFile::create(&path, &bare_contents("Replace"))
-        .await
-        .expect("creates");
-
-    file.put_ui_state(&bucket("tree", r#"{"expanded":[]}"#))
-        .await
-        .expect("first put");
-    let second = bucket("tree", r#"{"expanded":["C:\\b","C:\\a"]}"#);
-    file.put_ui_state(&second).await.expect("second put");
-    file.close().await;
-
-    let conn = open_database(&path).await.expect("the closed file opens");
-    let mut rows = conn
-        .query("SELECT value FROM kv WHERE key = 'tree'", ())
-        .await
-        .expect("tree row queries");
-    let row = rows
-        .next()
-        .await
-        .expect("the row reads")
-        .expect("exactly one tree row");
-    let stored: String = row.get(0).expect("value is text");
-    assert_eq!(
-        stored,
-        second.text(),
-        "the row holds the put's text as it is"
-    );
-    drop(conn);
-    assert_eq!(kv_row_count(&path).await, 1, "a replace adds no row");
-}
-
-#[tokio::test]
-async fn a_row_that_no_longer_parses_reads_as_none_beside_intact_rows() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("corrupt.rvwork");
-    let file = WorkspaceFile::create(&path, &bare_contents("Corrupt"))
-        .await
-        .expect("creates");
-    file.put_ui_state(&bucket("layout", r#"{"version":3}"#))
-        .await
-        .expect("layout writes");
-    file.put_ui_state(&bucket("tree", r#"{"expanded":[]}"#))
-        .await
-        .expect("tree writes");
-    file.put_ui_state(&bucket("closed_editors", r#"{"paths":["C:\\a"]}"#))
-        .await
-        .expect("closed editors write");
-    file.close().await;
-
-    // `put_ui_state` takes only validated JSON, so the only way a row
-    // stops parsing is an outside edit of the closed file; seed one
-    // directly.
-    let conn = open_database(&path).await.expect("the closed file opens");
-    conn.execute(
-        "UPDATE kv SET value = ?1 WHERE key = 'tree'",
-        ("{ \"expanded\": [",),
-    )
-    .await
-    .expect("the tree row is corrupted in place");
-    drop(conn);
-
-    let state = reopen_ui_state(&path).await;
-    assert_eq!(state.len(), 3, "every key is still present");
-    assert_eq!(
-        state.get("tree").cloned().flatten(),
-        None,
-        "the unparseable row reads as absent"
-    );
-    assert_eq!(
-        state.get("layout").cloned().flatten(),
-        Some(json!({ "version": 3 })),
-        "an intact row beside it still reads"
-    );
-    assert_eq!(
-        state.get("closed_editors").cloned().flatten(),
-        Some(json!({ "paths": ["C:\\a"] })),
-        "the other intact row still reads"
-    );
-}
-
-#[tokio::test]
-async fn a_file_with_no_ui_state_rows_reads_all_three_as_none() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("bare.rvwork");
-    // A file holding only the stamp and the window row.
-    let conn = open_database(&path).await.expect("seed database opens");
-    conn.execute_batch(SCHEMA_V1)
-        .await
-        .expect("the v1 schema applies");
-    for (key, value) in [
-        (META_FORMAT, FORMAT_NAME),
-        (META_VERSION, SUPPORTED_VERSION),
-        (META_NAME, "Bare"),
-    ] {
-        conn.execute(
-            "INSERT INTO meta (key, value) VALUES (?1, ?2)",
-            (key, value),
-        )
-        .await
-        .expect("meta row inserts");
-    }
-    conn.execute(
-        "INSERT INTO kv (key, value) VALUES (?1, ?2)",
-        (
-            KV_WINDOW,
-            r#"{"width":1,"height":2,"x":3,"y":4,"maximized":false}"#,
-        ),
-    )
-    .await
-    .expect("window row inserts");
-    drop(conn);
-
-    let file = WorkspaceFile::open(&path).await.expect("the file opens");
-    let contents = file.contents().await.expect("contents read");
-    file.close().await;
-
-    assert_eq!(contents.ui_state, empty_ui_state());
-    assert_eq!(
-        contents.window_state.map(|state| state.width),
-        Some(1),
-        "the window row beside them is untouched"
-    );
-}
-
-#[tokio::test]
-async fn save_as_leaves_the_new_files_three_keys_empty() {
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let first_path = home.path().join("first.rvwork");
-    let second_path = home.path().join("second.rvwork");
-    let first = WorkspaceFile::create(&first_path, &bare_contents("First"))
-        .await
-        .expect("the first file creates");
-    first
-        .put_ui_state(&bucket("layout", r#"{"version":3}"#))
-        .await
-        .expect("layout writes");
-    first
-        .put_ui_state(&bucket("tree", r#"{"expanded":["C:\\x"]}"#))
-        .await
-        .expect("tree writes");
-    first
-        .put_ui_state(&bucket("closed_editors", r#"{"paths":[]}"#))
-        .await
-        .expect("closed editors write");
-    first.close().await;
-
-    let workspace = Workspace::new();
-    workspace
-        .open_file(&first_path)
-        .await
-        .expect("the first file opens as the backing");
-    workspace
-        .save_as(&second_path)
-        .await
-        .expect("save as creates the second file");
-    workspace.close_backing_for_test().await;
-
-    assert_eq!(
-        reopen_ui_state(&second_path).await,
-        empty_ui_state(),
-        "the SPA is the one writer of these keys after save as"
-    );
-    assert_eq!(kv_row_count(&second_path).await, 0);
-    assert_eq!(
-        reopen_ui_state(&first_path)
-            .await
-            .get("layout")
-            .cloned()
-            .flatten(),
-        Some(json!({ "version": 3 })),
-        "the first file keeps what it held"
-    );
-}
diff --git a/crates/workshop/workspace/src/workspace_file/tests.rs b/crates/workshop/workspace/src/workspace_file/tests.rs
deleted file mode 100644
index 06348f9e9..000000000
--- a/crates/workshop/workspace/src/workspace_file/tests.rs
+++ /dev/null
@@ -1,325 +0,0 @@
-//! Workspace file tests: database open and create, schema refusals, and half-written cleanup.
-
-use std::fs;
-use std::path::PathBuf;
-
-use super::actor::SCHEMA_V1;
-use super::*;
-
-#[path = "tests-mutations.rs"]
-mod mutations;
-#[path = "tests-ui-state-kv.rs"]
-mod ui_state_kv_tests;
-
-#[test]
-fn a_corrupt_database_error_says_the_file_is_not_a_database() {
-    let error = WorkspaceFileError::from(turso::Error::Corrupt(
-        "page 1 is not a b-tree page".to_owned(),
-    ));
-    assert!(is_not_a_database(&error));
-}
-
-#[tokio::test]
-async fn turso_opens_a_tempdir_database_and_round_trips_user_version() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("spike.rvwork");
-
-    let conn = open_database(&path)
-        .await
-        .expect("a fresh database opens at a path that does not exist yet");
-    conn.execute("PRAGMA user_version = 7", ())
-        .await
-        .expect("user_version is writable");
-    drop(conn);
-
-    // A second open through a fresh connection proves the write reached
-    // the file rather than living in the first connection's state.
-    let reopened = open_database(&path)
-        .await
-        .expect("the written database reopens");
-    let mut rows = reopened
-        .query("PRAGMA user_version", ())
-        .await
-        .expect("user_version is readable");
-    let row = rows
-        .next()
-        .await
-        .expect("the pragma row reads")
-        .expect("the pragma yields exactly one row");
-    let version: i64 = row.get(0).expect("user_version is an integer");
-    assert_eq!(version, 7);
-
-    assert!(
-        path.is_file(),
-        "the database is a regular file at the chosen path"
-    );
-}
-
-#[tokio::test]
-async fn open_database_refuses_a_path_whose_parent_is_missing() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("missing").join("spike.rvwork");
-
-    let error = open_database(&path)
-        .await
-        .expect_err("a database cannot be created under a directory that does not exist");
-    // The path is UTF-8, so the only failure left is the database refusing
-    // to create the file under a directory that is not there.
-    assert!(
-        matches!(error, WorkspaceFileError::Database { .. }),
-        "a missing parent surfaces as a database failure, got {error:?}"
-    );
-    assert!(!path.exists(), "a refused open creates nothing");
-}
-
-/// A fully populated contents value: two grants in a deliberate order
-/// and a saved window.
-fn sample_contents() -> WorkspaceContents {
-    WorkspaceContents {
-        name: "Sample".to_string(),
-        grants: vec![
-            GrantRow {
-                path: PathBuf::from("C:\\projects\\zebra"),
-                position: 0,
-                added_at: "2026-09-16T10:00:00Z".to_string(),
-            },
-            GrantRow {
-                path: PathBuf::from("C:\\projects\\apple"),
-                position: 1,
-                added_at: "2026-09-16T10:00:01Z".to_string(),
-            },
-        ],
-        window_state: Some(WindowState {
-            width: 1280,
-            height: 800,
-            x: 40,
-            y: 60,
-            maximized: false,
-        }),
-        ui_state: empty_ui_state(),
-    }
-}
-
-/// Builds a v1-schema database at `path` with the given meta rows and
-/// nothing else, so tests can shape the meta table by hand.
-async fn seed_schema_with_meta(path: &Path, meta: &[(&str, &str)]) {
-    let conn = open_database(path).await.expect("seed database opens");
-    conn.execute_batch(SCHEMA_V1)
-        .await
-        .expect("the v1 schema applies");
-    for (key, value) in meta {
-        conn.execute(
-            "INSERT INTO meta (key, value) VALUES (?1, ?2)",
-            (*key, *value),
-        )
-        .await
-        .expect("meta row inserts");
-    }
-}
-
-#[tokio::test]
-async fn create_then_open_round_trips_name_grants_and_window_state() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("round-trip.rvwork");
-    let expected = sample_contents();
-
-    let created = WorkspaceFile::create(&path, &expected)
-        .await
-        .expect("a fresh workspace file creates");
-    created.close().await;
-
-    let opened = WorkspaceFile::open(&path)
-        .await
-        .expect("the created workspace file opens");
-    let contents = opened.contents().await.expect("contents read");
-    opened.close().await;
-
-    assert_eq!(contents.name, expected.name);
-    assert_eq!(
-        contents.grants, expected.grants,
-        "grants keep their positions and order"
-    );
-    let window = contents.window_state.expect("the saved window comes back");
-    let saved = expected.window_state.expect("the sample has a window");
-    assert_eq!(
-        (
-            window.width,
-            window.height,
-            window.x,
-            window.y,
-            window.maximized
-        ),
-        (saved.width, saved.height, saved.x, saved.y, saved.maximized)
-    );
-}
-
-#[tokio::test]
-async fn a_database_without_a_meta_table_is_refused_and_left_byte_identical() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("foreign.rvwork");
-    {
-        let conn = open_database(&path).await.expect("foreign database opens");
-        conn.execute_batch("CREATE TABLE notes (body TEXT NOT NULL);")
-            .await
-            .expect("a foreign table creates");
-    }
-    let before = fs::read(&path).expect("the foreign file reads");
-
-    let error = WorkspaceFile::open(&path)
-        .await
-        .expect_err("a database with no meta table is not a workspace");
-
-    assert!(
-        matches!(&error, WorkspaceFileError::NotAWorkspace { path: refused } if refused == &path),
-        "expected NotAWorkspace naming the path, got {error:?}"
-    );
-    let after = fs::read(&path).expect("the foreign file still reads");
-    assert_eq!(before, after, "a refused open writes nothing to the file");
-}
-
-#[tokio::test]
-async fn a_random_bytes_file_is_refused() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("noise.rvwork");
-    // A deterministic byte soup that is neither empty nor a SQLite header.
-    let noise: Vec<u8> = (0..4096u32)
-        .map(|i| u8::try_from((i.wrapping_mul(2_654_435_761) >> 13) & 0xff).unwrap_or(0))
-        .collect();
-    fs::write(&path, &noise).expect("noise writes");
-
-    let error = WorkspaceFile::open(&path)
-        .await
-        .expect_err("random bytes are not a workspace");
-
-    assert!(
-        matches!(error, WorkspaceFileError::NotAWorkspace { .. }),
-        "expected NotAWorkspace, got {error:?}"
-    );
-    assert_eq!(
-        fs::read(&path).expect("noise still reads"),
-        noise,
-        "a refused open leaves the bytes alone"
-    );
-}
-
-#[tokio::test]
-async fn meta_version_two_is_refused_as_unsupported_version() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("future.rvwork");
-    seed_schema_with_meta(&path, &[(META_FORMAT, FORMAT_NAME), (META_VERSION, "2")]).await;
-
-    let error = WorkspaceFile::open(&path)
-        .await
-        .expect_err("a newer schema version is refused");
-
-    assert!(
-        matches!(
-            &error,
-            WorkspaceFileError::UnsupportedVersion { found, supported }
-                if found == "2" && *supported == SUPPORTED_VERSION
-        ),
-        "expected UnsupportedVersion {{ found: \"2\", supported: \"1\" }}, got {error:?}"
-    );
-}
-
-#[tokio::test]
-async fn a_file_without_a_display_name_is_refused_when_its_contents_are_read() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("nameless.rvwork");
-    seed_schema_with_meta(
-        &path,
-        &[
-            (META_FORMAT, FORMAT_NAME),
-            (META_VERSION, SUPPORTED_VERSION),
-        ],
-    )
-    .await;
-
-    let file = WorkspaceFile::open(&path)
-        .await
-        .expect("the format and version rows validate");
-    let error = file
-        .contents()
-        .await
-        .expect_err("a file without a display name is not a workspace");
-    file.close().await;
-
-    assert!(
-        matches!(&error, WorkspaceFileError::NotAWorkspace { path: refused } if refused == &path),
-        "expected NotAWorkspace naming the path, got {error:?}"
-    );
-}
-
-#[tokio::test]
-async fn create_leaves_only_the_file_in_the_directory() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("solo.rvwork");
-
-    let created = WorkspaceFile::create(&path, &sample_contents())
-        .await
-        .expect("a fresh workspace file creates");
-    created.close().await;
-
-    // No directory ceremony: the workspace is the file. Close checkpoints
-    // and removes the database's `-wal` sidecar, so nothing else remains.
-    let mut names = Vec::new();
-    for entry in fs::read_dir(dir.path()).expect("the tempdir lists") {
-        let entry = entry.expect("entry reads");
-        assert!(
-            entry.file_type().expect("entry type reads").is_file(),
-            "create made a directory: {}",
-            entry.path().display()
-        );
-        names.push(entry.file_name().to_string_lossy().into_owned());
-    }
-    assert_eq!(names, vec!["solo.rvwork".to_string()]);
-}
-
-#[tokio::test]
-async fn a_failed_create_removes_the_half_written_file_so_a_retry_succeeds() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("retry.rvwork");
-    // Two grants under one canonical path collide on the grants primary
-    // key, so the write fails after the file and schema already exist.
-    let mut colliding = sample_contents();
-    colliding.grants[1].path = colliding.grants[0].path.clone();
-
-    let error = WorkspaceFile::create(&path, &colliding)
-        .await
-        .expect_err("a primary-key collision fails the create");
-
-    assert!(
-        matches!(error, WorkspaceFileError::Database { .. }),
-        "expected the database failure, got {error:?}"
-    );
-    assert!(!path.exists(), "a failed create leaves no file behind");
-    assert!(
-        fs::read_dir(dir.path())
-            .expect("the tempdir lists")
-            .next()
-            .is_none(),
-        "a failed create leaves no sidecar behind"
-    );
-
-    let retried = WorkspaceFile::create(&path, &sample_contents())
-        .await
-        .expect("the same path is free again after the failure");
-    retried.close().await;
-}
-
-#[tokio::test]
-async fn create_refuses_an_existing_path() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let path = dir.path().join("taken.rvwork");
-    fs::write(&path, b"already here").expect("placeholder writes");
-
-    let error = WorkspaceFile::create(&path, &sample_contents())
-        .await
-        .expect_err("create never overwrites");
-
-    assert!(
-        matches!(&error, WorkspaceFileError::Io { source } if source.kind() == io::ErrorKind::AlreadyExists),
-        "expected an AlreadyExists I/O failure, got {error:?}"
-    );
-    assert_eq!(fs::read(&path).expect("placeholder reads"), b"already here");
-}
diff --git a/crates/workshop/workspace/src/workspace_file/ui_state_kv.rs b/crates/workshop/workspace/src/workspace_file/ui_state_kv.rs
deleted file mode 100644
index e04d3d12e..000000000
--- a/crates/workshop/workspace/src/workspace_file/ui_state_kv.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-//! The opaque ui-state values a workspace file holds in its `kv` table
-//! beside the window geometry: the dock layout, the expanded tree
-//! folders, and the closed-editor stack. The server stores each
-//! validated value's compact JSON text and never interprets it
-//! further; the SPA owns each value's schema.
-
-use std::collections::BTreeMap;
-
-use serde_json::Value;
-use workshop_support::StateBucketValue;
-
-use super::actor::Command;
-use super::{WorkspaceFile, WorkspaceFileError};
-use crate::error::WorkspaceError;
-
-/// The kv keys the workspace bucket accepts.
-pub(crate) const UI_STATE_KEYS: [&str; 3] = ["layout", "tree", "closed_editors"];
-
-/// The ui-state map with every key present and no value: what a file
-/// with no ui-state rows reads as, and what save-as writes.
-pub(crate) fn empty_ui_state() -> BTreeMap<&'static str, Option<Value>> {
-    UI_STATE_KEYS.iter().map(|key| (*key, None)).collect()
-}
-
-impl WorkspaceFile {
-    /// Stores the validated `put`'s JSON text under its key, replacing
-    /// any earlier value.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::WorkspaceFileFailed`] when the write fails.
-    pub(crate) async fn put_ui_state(&self, put: &StateBucketValue) -> Result<(), WorkspaceError> {
-        let key = put.key();
-        let json_text = put.text().to_owned();
-        self.request(|reply| Command::PutUiState {
-            key,
-            json_text,
-            reply,
-        })
-        .await?;
-        Ok(())
-    }
-
-    /// Reads every ui-state value; a key with no row, or whose text no
-    /// longer parses, reads as `None`. The workspace reads these values
-    /// once, through [`WorkspaceFile::contents`] at open, and serves
-    /// them from memory after that; this direct read is a test seam.
-    ///
-    /// # Errors
-    /// Returns [`WorkspaceError::WorkspaceFileFailed`] when the file
-    /// cannot be read.
-    #[cfg(test)]
-    pub(super) async fn read_ui_state(
-        &self,
-    ) -> Result<BTreeMap<&'static str, Option<Value>>, WorkspaceError> {
-        Ok(self.contents().await?.ui_state)
-    }
-}
-
-/// Inserts or replaces one ui-state row; runs on the actor.
-pub(super) async fn put_ui_state_row(
-    conn: &turso::Connection,
-    key: &'static str,
-    json_text: &str,
-) -> Result<(), WorkspaceFileError> {
-    conn.execute(
-        "INSERT OR REPLACE INTO kv (key, value) VALUES (?1, ?2)",
-        (key, json_text),
-    )
-    .await?;
-    Ok(())
-}
-
-/// Reads the ui-state rows into a map holding every allow-listed key;
-/// runs on the actor. A row whose text no longer parses is treated as
-/// absent with a warning: the SPA falls back to its default for that
-/// one value rather than the file being refused.
-pub(super) async fn read_ui_state_rows(
-    conn: &turso::Connection,
-) -> Result<BTreeMap<&'static str, Option<Value>>, WorkspaceFileError> {
-    let mut state = empty_ui_state();
-    for key in UI_STATE_KEYS {
-        let mut rows = conn
-            .query("SELECT value FROM kv WHERE key = ?1", (key,))
-            .await?;
-        let Some(row) = rows.next().await? else {
-            continue;
-        };
-        let json: String = row.get(0)?;
-        match serde_json::from_str(&json) {
-            Ok(value) => {
-                state.insert(key, Some(value));
-            }
-            Err(error) => {
-                tracing::warn!(%error, key, "saved ui state does not parse; reading it as absent");
-            }
-        }
-    }
-    Ok(state)
-}
diff --git a/crates/workshop/workspace/tests/it/main.rs b/crates/workshop/workspace/tests/it/main.rs
deleted file mode 100644
index 429f0f02f..000000000
--- a/crates/workshop/workspace/tests/it/main.rs
+++ /dev/null
@@ -1,117 +0,0 @@
-//! Integration tests for `workshop-workspace`: the registration
-//! contract - routes and the granted-roots handle served through the
-//! registry's contribution collections - and the save timeout on the
-//! workspace routes.
-
-mod save_timeout;
-
-use std::path::Path;
-
-use axum::body::Body;
-use axum::http::{Request, StatusCode};
-use axum::response::Response;
-use tower::ServiceExt as _;
-use workshop_registry::{Registry, WorkspaceRoots};
-use workshop_workspace::{Workspace, register};
-
-#[tokio::test]
-async fn the_registered_routes_serve_the_workspace_api() {
-    let registry = Registry::new();
-    let workspace = Workspace::new();
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    std::fs::write(dir.path().join("notes.txt"), "hello").expect("seed a file");
-    let _guards = register(&registry, &workspace);
-
-    let registrars = registry.routes();
-    assert_eq!(registrars.len(), 1, "the routes collection is registered");
-    let router = registrars[0].routes();
-
-    // The roots listing answers through the registered routes.
-    let request = Request::builder()
-        .uri("/workspace/tree")
-        .body(Body::empty())
-        .expect("static request parts are valid");
-    let response = router
-        .clone()
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-
-    // A grant over HTTP becomes visible through the registered roots
-    // handle immediately.
-    let body = serde_json::json!({ "path": dir.path() }).to_string();
-    let request = Request::builder()
-        .method("POST")
-        .uri("/workspace/grant")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body))
-        .expect("static request parts are valid");
-    let response = router
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-    assert_eq!(response.status(), StatusCode::OK);
-    let roots = registry
-        .state::<dyn WorkspaceRoots>()
-        .expect("the roots handle is registered")
-        .granted_roots();
-    assert_eq!(roots.len(), 1, "the grant reached the shared state");
-    assert!(
-        roots[0].ends_with(dir.path().file_name().expect("a named tempdir")),
-        "the granted root is the dropped directory: {roots:?}"
-    );
-}
-
-/// Posts a JSON body naming `path` to `uri` through `router`.
-#[expect(
-    clippy::expect_used,
-    reason = "test helpers fail by panicking with the invariant named"
-)]
-async fn post_path(router: axum::Router, uri: &str, path: &Path) -> Response {
-    let body = serde_json::json!({ "path": path }).to_string();
-    let request = Request::builder()
-        .method("POST")
-        .uri(uri)
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(body))
-        .expect("static request parts are valid");
-    router
-        .oneshot(request)
-        .await
-        .expect("the router is infallible")
-}
-
-#[tokio::test]
-async fn save_workspace_as_creates_the_file_and_switches_to_it() {
-    let registry = Registry::new();
-    let workspace = Workspace::new();
-    let home = tempfile::TempDir::new().expect("tempdir");
-    let file = home.path().join("Name.rvwork");
-    let _guards = register(&registry, &workspace);
-    let router = registry.routes()[0].routes();
-
-    let response = post_path(router, "/workspace/file/save-as", &file).await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already");
-    let json: serde_json::Value = serde_json::from_slice(&bytes).expect("the body is JSON");
-    assert_eq!(json["name"], "Name", "save as switches to the new file");
-    workspace.close_backing().await;
-    assert!(file.is_file(), "save as creates the file");
-}
-
-#[tokio::test]
-async fn dropping_the_guards_deregisters_every_contribution() {
-    let registry = Registry::new();
-    let workspace = Workspace::new();
-    let guards = register(&registry, &workspace);
-    assert!(!registry.routes().is_empty());
-    assert!(registry.state::<Workspace>().is_some());
-    assert!(registry.state::<dyn WorkspaceRoots>().is_some());
-    drop(guards);
-    assert!(registry.routes().is_empty());
-    assert!(registry.state::<Workspace>().is_none());
-    assert!(registry.state::<dyn WorkspaceRoots>().is_none());
-}
diff --git a/crates/workshop/workspace/tests/it/save_timeout.rs b/crates/workshop/workspace/tests/it/save_timeout.rs
deleted file mode 100644
index 3f891736d..000000000
--- a/crates/workshop/workspace/tests/it/save_timeout.rs
+++ /dev/null
@@ -1,76 +0,0 @@
-//! The save-timeout behavior on the workspace routes: a
-//! `PUT /workspace/file` whose write outlasts the route deadline answers
-//! a 408 whose body is the JSON error envelope, and the blocking write -
-//! abandoned, not canceled - still lands on disk once the test releases
-//! it.
-
-use std::time::Duration;
-
-use axum::body::Body;
-use axum::http::Request;
-use axum::http::StatusCode;
-use tower::ServiceExt;
-
-use workshop_workspace::Workspace;
-
-/// The test-only route deadline: short enough that the stalled write's
-/// 408 is reachable without waiting out the production 10 seconds.
-const TEST_DEADLINE: Duration = Duration::from_secs(1);
-
-#[tokio::test]
-async fn a_write_that_outlasts_its_deadline_answers_408_and_still_lands() {
-    let dir = tempfile::TempDir::new().expect("tempdir");
-    let file = dir.path().join("note.txt");
-    let workspace = Workspace::new();
-    workspace.grant(dir.path()).expect("grant the tempdir");
-
-    // Arm the stall: the write blocks on the blocking pool until released,
-    // so the route deadline elapses first and its 408 is observable.
-    let stall = workspace.stall_next_write_for_test();
-
-    let router = workshop_workspace::routes_with_deadline(workspace, TEST_DEADLINE);
-    let request = Request::builder()
-        .method("PUT")
-        .uri("/workspace/file")
-        .header(axum::http::header::CONTENT_TYPE, "application/json")
-        .body(Body::from(
-            serde_json::json!({ "path": file, "text": "late write" }).to_string(),
-        ))
-        .expect("static request parts are valid");
-
-    let response = router
-        .oneshot(request)
-        .await
-        .expect("the router is infallible");
-
-    assert_eq!(response.status(), StatusCode::REQUEST_TIMEOUT);
-    assert_eq!(
-        response
-            .headers()
-            .get(axum::http::header::CONTENT_TYPE)
-            .map(axum::http::header::HeaderValue::as_bytes),
-        Some(b"application/json".as_slice()),
-        "the deadline answers JSON"
-    );
-
-    let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("the body is in memory already");
-    let envelope: serde_json::Value = serde_json::from_slice(&bytes).expect("the body is JSON");
-    let expected = serde_json::to_value(workshop_protocol::ErrorEnvelope::new(
-        workshop_support::deadline_elapsed_message(TEST_DEADLINE),
-        workshop_support::DEADLINE_ELAPSED_CODE,
-    ))
-    .expect("the envelope serializes");
-    assert_eq!(envelope, expected, "the 408 body is the wire envelope");
-
-    // The write was abandoned by the deadline, not canceled: releasing the
-    // stall lets it land on disk.
-    stall.release();
-    stall.await_completion();
-    assert_eq!(
-        std::fs::read_to_string(&file).expect("the file exists"),
-        "late write",
-        "the released write still lands on disk"
-    );
-}
diff --git a/deny.toml b/deny.toml
index 4ac7e9572..2e8390075 100644
--- a/deny.toml
+++ b/deny.toml
@@ -22,38 +22,13 @@ version = 2
 allow = [
     "BSL-1.0",
     "MIT",
-    "MIT-0",
     "Apache-2.0",
-    "Apache-2.0 WITH LLVM-exception",
-    "BSD-2-Clause",
-    "BSD-3-Clause",
-    "ISC",
     "Zlib",
-    "MPL-2.0",
     "Unicode-3.0",
-    # Mozilla root-certificate bundle (webpki-root-certs), pulled by
-    # rustls-platform-verifier (reqwest's `rustls` feature) for targets with
-    # no OS trust store, wasm32 only; a permissive data license. The
-    # webpki-roots crate left the tree with reqwest 0.12.
-    "CDLA-Permissive-2.0",
-    # The Rust port of libbzip2 (libbz2-rs-sys), which the `bzip2` crate
-    # builds on by default and bashkit, the shell of the bashkit Plugin,
-    # depends on for its `bzip2` command; a permissive BSD-style license.
-    "bzip2-1.0.6",
-    "CC0-1.0",
     "Unlicense",
-    "0BSD",
 ]
 confidence-threshold = 0.8
 
-# cfg_block (via turso_core) names its LICENSE file but sets no SPDX
-# expression; the file is the Apache-2.0 notice. A changed file changes the
-# hash, and cargo-deny falls back to scanning it.
-[[licenses.clarify]]
-crate = "cfg_block"
-expression = "Apache-2.0"
-license-files = [{ path = "LICENSE", hash = 0xc9663a1e }]
-
 [bans]
 # Warn on duplicate versions of the same crate so unification regressions are
 # visible without hard-failing a large native-dependency graph.
@@ -71,16 +46,9 @@ crate = "serde_json"
 deny = ["preserve_order"]
 
 [sources]
-# Only crates.io is an allowed registry. The four git sources are the
-# repository of the Engine and the Harness, the C Plugin contract's own
-# repository, the std Plugin's, and the bashkit Plugin's, each of which
-# Cargo.toml pins by commit.
+# Only crates.io is an allowed registry, and no git source is allowed:
+# every dependency of this workspace comes from the registry.
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = [
-    "https://github.com/cppalliance/runvil-harness",
-    "https://github.com/cppalliance/runvil-plugin-api",
-    "https://github.com/cppalliance/runvil-plugin-std",
-    "https://github.com/cppalliance/runvil-plugin-bashkit",
-]
+allow-git = []
diff --git a/gateway-pin/README.md b/gateway-pin/README.md
deleted file mode 100644
index 1804c6b33..000000000
--- a/gateway-pin/README.md
+++ /dev/null
@@ -1,59 +0,0 @@
-# The Gateway pin
-
-`pin.json` here records the one Gateway release Workshop obtains its
-sidecar from, and the checksums that prove the bytes.
-
-## What the release must publish
-
-A Gateway release supplies everything the pin needs through the three files
-cargo-dist writes for it:
-
-- `sha256.sum`, one line of sha256 and asset name per released file.
-- `dist-manifest.json`, the build record, which names each archive's target
-  triple, its checksum, and the executable inside it.
-- The five platform archives themselves, one per supported triple.
-
-The release's own asset list supplies the size of each archive. The script
-reads the name and hash from `dist-manifest.json` and requires `sha256.sum`
-to state the same hash for that name, then checks the digest GitHub reports
-for the uploaded asset. Any disagreement stops the run before a byte is
-written.
-
-No OpenAPI or AsyncAPI document is expected. The Gateway repository
-publishes none, so the pin records no spec and says nothing about one. If a
-later release attaches `openapi.yaml` or `asyncapi.yaml`, the script copies
-it here and records its sha256.
-
-## Filling the pin
-
-Run `node tools/bump-gateway.mjs <tag>`. It downloads the release's two
-checksum sources, cross-checks them, rewrites `pin.json`, and prints a diff.
-Nothing is written if any download or check fails.
-
-`bump-gateway.mjs` fills every field, so there is nothing to hand-edit. If
-you must edit by hand, these are the fields and what each one means:
-
-- `tag`: the release tag, for example `gateway-v0.3.0`.
-- `version`: the Gateway version that tag carries, without the tag prefix.
-- `min_gateway`: the lowest Gateway release that has every operation
-  Workshop calls. Workshop warns in the status bar when it attaches to an
-  older Gateway. It equals `version` for the release being pinned.
-- `executable`: the executable's name inside each archive, `runvil-gateway`.
-  Tauri renames it per triple when the sidecar is staged.
-- `spec`: empty when the release publishes no spec. An entry that is
-  present holds `path` and `sha256`, and a placeholder there is refused.
-- `targets.<triple>.asset`: the release asset name for that triple.
-- `targets.<triple>.sha256`: that asset's sha256.
-- `targets.<triple>.size`: that asset's size in bytes.
-
-Every consumer refuses a placeholder by name. `tools/fetch-gateway-sidecar.mjs`
-will not download, so a release job fails at the fetch rather than shipping
-a Workshop with no Gateway.
-
-## What reads the pin
-
-- `tools/fetch-gateway-sidecar.mjs` downloads, verifies, and stages one
-  target's binary. `--stub` writes a placeholder instead and needs no pin.
-- `tools/bump-gateway.mjs` rewrites this file from a published release.
-- `crates/workshop/gateway/build.rs` embeds `min_gateway` so the running
-  Gateway's version can be compared with it at attach.
diff --git a/gateway-pin/pin.json b/gateway-pin/pin.json
deleted file mode 100644
index 5c0693465..000000000
--- a/gateway-pin/pin.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "pin_format": 1,
-  "repository": "cppalliance/runvil-gateway",
-  "tag": "gateway-v0.3.1",
-  "version": "0.3.1",
-  "executable": "runvil-gateway",
-  "min_gateway": "0.3.1",
-  "spec": {},
-  "targets": {
-    "x86_64-pc-windows-msvc": {
-      "asset": "gateway-x86_64-pc-windows-msvc.zip",
-      "sha256": "2e49026a9fa4017518a442c9f80f96317592087688585d2aa1308e8ceeb47a58",
-      "size": 6333454
-    },
-    "aarch64-apple-darwin": {
-      "asset": "gateway-aarch64-apple-darwin.tar.xz",
-      "sha256": "dbba6bd46ddda55ea0daf52e8bf866cd5bf6e4c59a0a7713bb696afcad0e28f7",
-      "size": 4212300
-    },
-    "x86_64-apple-darwin": {
-      "asset": "gateway-x86_64-apple-darwin.tar.xz",
-      "sha256": "c35f8ee505aed53cb862006da449deccc763bcf201cea949eee33fec8e02ae33",
-      "size": 4598532
-    },
-    "x86_64-unknown-linux-gnu": {
-      "asset": "gateway-x86_64-unknown-linux-gnu.tar.xz",
-      "sha256": "8f8ed91e9678f1fc84d6c9cee8653e90d4d82387f17cdf52435491119fa0f81f",
-      "size": 5625788
-    },
-    "aarch64-unknown-linux-gnu": {
-      "asset": "gateway-aarch64-unknown-linux-gnu.tar.xz",
-      "sha256": "157e5e7064b71d4306beb1d093c930b0329a8c503fab49c0414be232d8cd1d5b",
-      "size": 5265664
-    }
-  }
-}
diff --git a/tools/bump-gateway.mjs b/tools/bump-gateway.mjs
deleted file mode 100644
index 902f43b63..000000000
--- a/tools/bump-gateway.mjs
+++ /dev/null
@@ -1,596 +0,0 @@
-// Moves the Gateway pin to a published release.
-//
-// Given a release tag, this script asks `gh` for the release and reads the
-// two files cargo-dist publishes: `sha256.sum`, its list of asset checksums,
-// and `dist-manifest.json`, its build record. The two must agree on every
-// target's archive name and sha256 before anything is written, and the
-// release's own asset list must state the size. The tag alone supplies the
-// version, so `min_gateway` is always derivable.
-//
-// The spec files are optional. The Gateway repository publishes none, so a
-// release that has them gets them copied into `gateway-pin/` and recorded by
-// sha256, and a release without them records no spec entry at all. An
-// absent entry says the release publishes no spec, which is a different
-// thing from a hash nobody has filled in, so absence is written by leaving
-// the entry out rather than by writing a placeholder.
-//
-// Nothing is written until every download and check has succeeded, so a
-// wrong tag or a mismatched checksum leaves the pin exactly as it was.
-//
-// Usage:
-//   node tools/bump-gateway.mjs <tag> [--repo <owner/name>] [--dry-run]
-//
-// `--dry-run` performs every download and check, prints the diff, and writes
-// nothing.
-
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-import {
-  DEFAULT_RELEASE_REPOSITORY,
-  PLACEHOLDER,
-  TARGETS,
-  pinPath,
-  renderPin,
-  specPath,
-} from "./gateway-pin.mjs";
-
-const REPOSITORY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-/** The checksum asset: one line of sha256 and asset name per released file. */
-export const CHECKSUM_ASSET = "sha256.sum";
-
-/** The build record cargo-dist publishes beside the archives. */
-export const DIST_MANIFEST_ASSET = "dist-manifest.json";
-
-/**
- * The spec files a release may attach, and the pin keys they fill. A
- * release that publishes none of them is still pinnable.
- */
-export const SPEC_ASSETS = [
-  { name: "openapi.yaml", key: "openapi" },
-  { name: "asyncapi.yaml", key: "asyncapi" },
-];
-
-/** Lowercase hex sha256 of `bytes`. */
-export function sha256Hex(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-/** Runs `gh` and returns its stdout, failing with the message `gh` printed. */
-function runGh(args) {
-  const result = spawnSync("gh", args, { encoding: "utf8" });
-  if (result.error !== undefined && result.error !== null) {
-    throw new Error(`could not run gh ${args.join(" ")}: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    const detail = (result.stderr || result.stdout || "").trim();
-    throw new Error(`gh ${args.join(" ")} failed${detail === "" ? "" : `: ${detail}`}`);
-  }
-  return result.stdout;
-}
-
-/** Whether `value` reads as a lowercase or uppercase sha256 in hex. */
-function isSha256(value) {
-  return typeof value === "string" && /^[0-9a-fA-F]{64}$/.test(value);
-}
-
-/**
- * Reads `sha256.sum` into a map of asset name to lowercase sha256. A line
- * that does not read as a checksum names its number rather than being
- * skipped, because a skipped line is an asset that would pin with no check.
- */
-export function parseChecksumSum(text, source = CHECKSUM_ASSET) {
-  const checksums = new Map();
-  const lines = text.split("\n");
-  for (const [index, raw] of lines.entries()) {
-    const line = raw.trim();
-    if (line === "") {
-      continue;
-    }
-    const match = /^([0-9a-fA-F]{64}) [ *](.+)$/.exec(line);
-    if (match === null) {
-      throw new Error(
-        `${source} line ${index + 1} does not read as "<sha256> <asset>": ${line}`,
-      );
-    }
-    const asset = match[2].trim();
-    if (asset === "") {
-      throw new Error(`${source} line ${index + 1} names no asset: ${line}`);
-    }
-    checksums.set(asset, match[1].toLowerCase());
-  }
-  if (checksums.size === 0) {
-    throw new Error(`${source} lists no asset checksums`);
-  }
-  return checksums;
-}
-
-/** The version a release tag carries: `gateway-v0.3.0` becomes `0.3.0`. */
-export function versionFromTag(tag) {
-  const match = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/.exec(tag);
-  if (match === null) {
-    throw new Error(`the tag ${tag} does not end in a version like 0.3.0`);
-  }
-  return match[1];
-}
-
-/**
- * The release's version, taken from the tag and checked against the version
- * `dist-manifest.json` records. The tag is the authority: a person names it
- * on the command line, so a manifest that disagrees is a broken release
- * rather than a reason to pin a version nobody asked for.
- */
-export function releaseVersion(manifest, tag) {
-  const version = versionFromTag(tag);
-  const stated = manifest?.["releases"]?.[0]?.["app_version"];
-  if (typeof stated === "string" && stated !== "" && stated !== version) {
-    throw new Error(
-      `${DIST_MANIFEST_ASSET} for ${tag} records app_version ${stated}, so the tag does not name the release it points at`,
-    );
-  }
-  return version;
-}
-
-/**
- * The executable's name inside the archives, which `dist-manifest.json`
- * records once per archive. Every archive must name the same executable, so
- * a mixed release fails here rather than after the first fetch.
- */
-export function executableName(manifest) {
-  const names = new Set();
-  for (const artifact of Object.values(manifest?.["artifacts"] ?? {})) {
-    if (artifact?.["kind"] !== "executable-zip") {
-      continue;
-    }
-    for (const asset of artifact["assets"] ?? []) {
-      if (asset?.["kind"] === "executable" && typeof asset["name"] === "string") {
-        names.add(asset["name"]);
-      }
-    }
-  }
-  if (names.size !== 1) {
-    const described = names.size === 0 ? "no" : [...names].join(" and ");
-    throw new Error(
-      `${DIST_MANIFEST_ASSET} names ${described} executable` +
-        `${names.size === 1 ? "" : "s"} for the released archives; expected exactly one`,
-    );
-  }
-  return [...names][0];
-}
-
-/**
- * One pin target entry per released triple: the archive's name, its sha256,
- * and its size. The name and hash come from `dist-manifest.json` and must
- * also appear in `sha256.sum` with the same hash, and the digest the
- * release states for the asset must be that hash too. `sizes` and `digests`
- * come from the release's asset list, because neither checksum file records
- * a size.
- *
- * Every disagreement is collected and reported together, by pin field, so a
- * release that is wrong in several places says so in one run.
- */
-export function selectTargets({ manifest, checksums, sizes, digests }) {
-  const artifacts = manifest?.["artifacts"];
-  if (artifacts === null || typeof artifacts !== "object" || Array.isArray(artifacts)) {
-    throw new Error(`${DIST_MANIFEST_ASSET} holds no artifacts object`);
-  }
-  const problems = [];
-  const targets = {};
-  for (const target of TARGETS) {
-    const matches = Object.entries(artifacts).filter(
-      ([, artifact]) =>
-        artifact?.["kind"] === "executable-zip" &&
-        (artifact?.["target_triples"] ?? []).includes(target),
-    );
-    if (matches.length === 0) {
-      problems.push(`targets.${target}.asset is absent from ${DIST_MANIFEST_ASSET}`);
-      continue;
-    }
-    if (matches.length > 1) {
-      const named = matches.map(([name]) => name).join(", ");
-      problems.push(`targets.${target}.asset is ambiguous in ${DIST_MANIFEST_ASSET}: ${named}`);
-      continue;
-    }
-    const [asset, artifact] = matches[0];
-    const recorded = artifact?.["checksums"]?.["sha256"];
-    if (!isSha256(recorded)) {
-      problems.push(`targets.${target}.sha256 is absent from ${DIST_MANIFEST_ASSET} for ${asset}`);
-      continue;
-    }
-    const listed = checksums.get(asset);
-    if (listed === undefined) {
-      problems.push(`targets.${target}.asset ${asset} is absent from ${CHECKSUM_ASSET}`);
-      continue;
-    }
-    if (listed !== recorded.toLowerCase()) {
-      problems.push(
-        `targets.${target}.sha256 is ${recorded.toLowerCase()} in ${DIST_MANIFEST_ASSET} ` +
-          `but ${listed} in ${CHECKSUM_ASSET}`,
-      );
-      continue;
-    }
-    const digest = digests.get(asset);
-    if (digest === undefined) {
-      problems.push(`targets.${target}.sha256 is absent from the release's asset list for ${asset}`);
-      continue;
-    }
-    if (digest.toLowerCase() !== recorded.toLowerCase()) {
-      problems.push(
-        `targets.${target}.sha256 is ${recorded.toLowerCase()} in ${DIST_MANIFEST_ASSET} ` +
-          `but the release states ${digest.toLowerCase()}`,
-      );
-      continue;
-    }
-    const size = sizes.get(asset);
-    if (!Number.isInteger(size) || size <= 0) {
-      problems.push(`targets.${target}.size is absent from the release's asset list for ${asset}`);
-      continue;
-    }
-    targets[target] = { asset, sha256: recorded.toLowerCase(), size };
-  }
-  if (problems.length > 0) {
-    throw new Error(`the release cannot be pinned: ${problems.join(", ")}`);
-  }
-  return targets;
-}
-
-/**
- * Builds the pin object. `min_gateway` is the release's own version: this
- * release has every operation Workshop calls, so it is the lowest Gateway
- * that does.
- *
- * `specs` holds the spec files the release published, keyed by pin key. A
- * key that is missing leaves that entry out of `spec`, so a consumer reads
- * absence rather than a hash that means nothing.
- */
-export function buildPin({ tag, repository, version, executable, targets, specs }) {
-  const spec = {};
-  for (const { key } of SPEC_ASSETS) {
-    const found = specs[key];
-    if (found === undefined) {
-      continue;
-    }
-    spec[key] = { path: `gateway-pin/${found.name}`, sha256: found.sha256 };
-  }
-  return {
-    pin_format: 1,
-    repository,
-    tag,
-    version,
-    executable,
-    min_gateway: version,
-    spec,
-    targets,
-  };
-}
-
-/**
- * A readable diff of `before` and `after`: two lines of context around the
- * lines that differ, marked `-` and `+` and prefixed with the file. Text
- * that did not change reports as unchanged.
- */
-export function renderDiff(name, before, after) {
-  if (before === after) {
-    return `${name}: unchanged`;
-  }
-  const oldLines = before.split("\n");
-  const newLines = after.split("\n");
-  let prefix = 0;
-  while (
-    prefix < oldLines.length &&
-    prefix < newLines.length &&
-    oldLines[prefix] === newLines[prefix]
-  ) {
-    prefix += 1;
-  }
-  let suffix = 0;
-  while (
-    suffix < oldLines.length - prefix &&
-    suffix < newLines.length - prefix &&
-    oldLines[oldLines.length - 1 - suffix] === newLines[newLines.length - 1 - suffix]
-  ) {
-    suffix += 1;
-  }
-  const lines = [`--- ${name}`, `+++ ${name}`];
-  for (const line of oldLines.slice(Math.max(0, prefix - 2), prefix)) {
-    lines.push(` ${line}`);
-  }
-  for (const line of oldLines.slice(prefix, oldLines.length - suffix)) {
-    lines.push(`-${line}`);
-  }
-  for (const line of newLines.slice(prefix, newLines.length - suffix)) {
-    lines.push(`+${line}`);
-  }
-  const tail = oldLines.length - suffix;
-  for (const line of oldLines.slice(tail, tail + 2)) {
-    lines.push(` ${line}`);
-  }
-  return lines.join("\n");
-}
-
-/** Writes `text` to `path` in one step: a sibling temp file, then a rename. */
-function writeAtomic(path, text) {
-  const temporary = `${path}.bump-tmp`;
-  writeFileSync(temporary, text);
-  renameSync(temporary, path);
-}
-
-function readIfPresent(path) {
-  try {
-    return readFileSync(path, "utf8");
-  } catch {
-    return "";
-  }
-}
-
-/**
- * Reads the release's asset list, returning each asset's size and the
- * sha256 GitHub states for it. `gh` prints the digest as `sha256:<hex>`. An
- * asset with no digest in that form gets no entry, so `selectTargets`
- * refuses a target whose archive has none.
- */
-export function readReleaseAssets(release) {
-  const sizes = new Map();
-  const digests = new Map();
-  for (const asset of release?.["assets"] ?? []) {
-    const name = asset?.["name"];
-    if (typeof name !== "string" || name.length === 0) {
-      continue;
-    }
-    if (Number.isInteger(asset["size"])) {
-      sizes.set(name, asset["size"]);
-    }
-    const digest = asset["digest"];
-    if (typeof digest === "string" && digest.startsWith("sha256:")) {
-      const hex = digest.slice("sha256:".length);
-      if (isSha256(hex)) {
-        digests.set(name, hex);
-      }
-    }
-  }
-  return { sizes, digests };
-}
-
-/** Names of the release's assets, in the order `gh` listed them. */
-export function releaseAssetNames(release) {
-  return (release?.["assets"] ?? [])
-    .map((asset) => asset?.["name"])
-    .filter((name) => typeof name === "string" && name.length > 0);
-}
-
-/**
- * Downloads a release's checksum list and build record, plus any spec files
- * it publishes, and returns the new pin text and the spec texts, without
- * touching the repository. `gh` and `download` are seams for the tests.
- */
-export function downloadRelease({
-  tag,
-  repository = DEFAULT_RELEASE_REPOSITORY,
-  gh = runGh,
-  download,
-}) {
-  const fetch = download ?? gh;
-
-  const scratch = mkdtempSync(join(tmpdir(), "runvil-bump-gateway-"));
-  try {
-    let release;
-    try {
-      const text = gh([
-        "release",
-        "view",
-        tag,
-        "--repo",
-        repository,
-        "--json",
-        "tagName,name,assets",
-      ]);
-      release = typeof text === "string" && text.trim() !== "" ? JSON.parse(text) : {};
-    } catch (error) {
-      throw new Error(
-        `Gateway release ${tag} was not found in ${repository}: ${error.message}\n` +
-          "nothing was written; list the tags with " +
-          `\`gh release list --repo ${repository}\``,
-      );
-    }
-    const published = releaseAssetNames(release);
-    if (!published.includes(CHECKSUM_ASSET)) {
-      throw new Error(
-        `Gateway release ${tag} in ${repository} publishes no ${CHECKSUM_ASSET} asset, ` +
-          "so the archive checksums cannot be checked; nothing was written",
-      );
-    }
-    if (!published.includes(DIST_MANIFEST_ASSET)) {
-      throw new Error(
-        `Gateway release ${tag} in ${repository} publishes no ${DIST_MANIFEST_ASSET} asset, ` +
-          "so the archive names cannot be cross-checked; nothing was written",
-      );
-    }
-
-    const wanted = [CHECKSUM_ASSET, DIST_MANIFEST_ASSET];
-    const specsToFetch = SPEC_ASSETS.filter((spec) => published.includes(spec.name));
-    wanted.push(...specsToFetch.map((spec) => spec.name));
-    const patterns = wanted.flatMap((name) => ["--pattern", name]);
-    fetch(["release", "download", tag, "--repo", repository, "--dir", scratch, ...patterns]);
-
-    const checksums = parseChecksumSum(readFileSync(join(scratch, CHECKSUM_ASSET), "utf8"));
-    let manifest;
-    try {
-      manifest = JSON.parse(readFileSync(join(scratch, DIST_MANIFEST_ASSET), "utf8"));
-    } catch (error) {
-      throw new Error(`${DIST_MANIFEST_ASSET} for ${tag} is not valid JSON: ${error.message}`);
-    }
-    const version = releaseVersion(manifest, tag);
-    const executable = executableName(manifest);
-    const { sizes, digests } = readReleaseAssets(release);
-    const targets = selectTargets({ manifest, checksums, sizes, digests });
-
-    const specs = {};
-    for (const spec of SPEC_ASSETS) {
-      if (!specsToFetch.includes(spec)) {
-        continue;
-      }
-      const bytes = readFileSync(join(scratch, spec.name));
-      const sha256 = sha256Hex(bytes);
-      const listed = checksums.get(spec.name);
-      if (listed !== undefined && listed !== sha256) {
-        throw new Error(
-          `${spec.name} for ${tag} has sha256 ${sha256}, but ${CHECKSUM_ASSET} records ${listed}`,
-        );
-      }
-      specs[spec.key] = { name: spec.name, sha256, text: bytes.toString("utf8") };
-    }
-
-    const pin = buildPin({ tag, repository, version, executable, targets, specs });
-    const placeholders = placeholderValues(pin);
-    if (placeholders.length > 0) {
-      throw new Error(
-        `the pin for ${tag} still holds a placeholder in ${placeholders.join(", ")}; ` +
-          "a release must state every field",
-      );
-    }
-    return { pin, pinText: renderPin(pin), specs, published };
-  } finally {
-    rmSync(scratch, { force: true, recursive: true });
-  }
-}
-
-/** Every path in `pin` whose value is `PLACEHOLDER`, as dotted names. */
-function placeholderValues(pin) {
-  const found = [];
-  const walk = (value, path) => {
-    if (value === PLACEHOLDER) {
-      found.push(path);
-      return;
-    }
-    if (value !== null && typeof value === "object") {
-      for (const [key, child] of Object.entries(value)) {
-        walk(child, path === "" ? key : `${path}.${key}`);
-      }
-    }
-  };
-  walk(pin, "");
-  return found;
-}
-
-/**
- * Runs the bump: downloads, checks, prints the diff, and writes the spec
- * copies and then the pin. `dryRun` stops before the writes.
- *
- * A spec copy in `gateway-pin/` that the release does not publish is left in
- * place rather than deleted: the pin does not name it, and a person decides
- * whether the file stays as a reference.
- */
-export function bumpGateway({
-  root = REPOSITORY_ROOT,
-  tag,
-  repository = DEFAULT_RELEASE_REPOSITORY,
-  gh = runGh,
-  download,
-  dryRun = false,
-  log = console.log,
-}) {
-  if (typeof tag !== "string" || tag.length === 0) {
-    throw new Error("bump-gateway needs a release tag, for example `gateway-v0.4.0`");
-  }
-  const { pin, pinText, specs } = downloadRelease({
-    tag,
-    repository,
-    gh,
-    download: download ?? gh,
-  });
-  const written = Object.values(specs).map(({ name, text }) => ({
-    path: specPath(root, name),
-    text,
-  }));
-  const diffs = [
-    renderDiff(pinPath(root), readIfPresent(pinPath(root)), pinText),
-    ...written.map((file) => renderDiff(file.path, readIfPresent(file.path), file.text)),
-  ];
-  const absent = SPEC_ASSETS.filter(({ key }) => specs[key] === undefined).map(({ name }) => name);
-  if (absent.length > 0) {
-    log(
-      `notice: ${tag} publishes no ${absent.join(" and ")}, so the pin records no spec because ` +
-        "the release publishes none; no file was invented",
-    );
-  }
-  if (!dryRun) {
-    // The spec copies land first: the pin is the authority that says they
-    // are current, so it never names a spec that is not yet written.
-    for (const file of written) {
-      writeAtomic(file.path, file.text);
-    }
-    writeAtomic(pinPath(root), pinText);
-  }
-  return { pin, diffs, written: !dryRun };
-}
-
-function parseArguments(args) {
-  let tag;
-  let repository = DEFAULT_RELEASE_REPOSITORY;
-  let dryRun = false;
-  let repoSeen = false;
-  for (let index = 0; index < args.length; index += 1) {
-    const name = args[index];
-    if (name === "--dry-run") {
-      if (dryRun) {
-        throw new Error("duplicate bump argument: --dry-run");
-      }
-      dryRun = true;
-      continue;
-    }
-    if (name === "--repo") {
-      const value = args[index + 1];
-      if (value === undefined) {
-        throw new Error("missing value for bump argument: --repo");
-      }
-      if (repoSeen) {
-        throw new Error("duplicate bump argument: --repo");
-      }
-      repository = value;
-      repoSeen = true;
-      index += 1;
-      continue;
-    }
-    if (name.startsWith("-")) {
-      throw new Error(`unsupported bump argument: ${name}`);
-    }
-    if (tag !== undefined) {
-      throw new Error(`unexpected second tag: ${name}`);
-    }
-    tag = name;
-  }
-  if (tag === undefined) {
-    throw new Error("usage: bump-gateway.mjs <tag> [--repo <owner/name>] [--dry-run]");
-  }
-  return { tag, repository, dryRun };
-}
-
-function main(args) {
-  const parsed = parseArguments(args);
-  const result = bumpGateway(parsed);
-  for (const diff of result.diffs) {
-    console.log(diff);
-  }
-  console.log(
-    result.written
-      ? `pinned Gateway ${result.pin.tag} (${result.pin.version})`
-      : `dry run: Gateway ${result.pin.tag} would be pinned; nothing was written`,
-  );
-}
-
-if (
-  process.argv[1] !== undefined &&
-  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-}
diff --git a/tools/bump-gateway.test.mjs b/tools/bump-gateway.test.mjs
deleted file mode 100644
index 94228b41f..000000000
--- a/tools/bump-gateway.test.mjs
+++ /dev/null
@@ -1,545 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-
-import {
-  CHECKSUM_ASSET,
-  DIST_MANIFEST_ASSET,
-  SPEC_ASSETS,
-  bumpGateway,
-  buildPin,
-  downloadRelease,
-  executableName,
-  parseChecksumSum,
-  releaseAssetNames,
-  releaseVersion,
-  renderDiff,
-  selectTargets,
-  versionFromTag,
-} from "./bump-gateway.mjs";
-import { PLACEHOLDER, TARGETS, pinPath, readPin, specPath } from "./gateway-pin.mjs";
-
-const TAG = "gateway-v0.4.0";
-const REPOSITORY = "cppalliance/runvil-gateway";
-const OPENAPI = "openapi: 3.1.0\ninfo:\n  title: Runvil Gateway\n";
-const ASYNCAPI = "asyncapi: 3.0.0\ninfo:\n  title: Runvil Gateway realtime\n";
-
-function sha256(text) {
-  return createHash("sha256").update(text).digest("hex");
-}
-
-/** The asset name cargo-dist publishes for `target`. */
-function assetFor(target) {
-  const extension = target.includes("windows") ? ".zip" : ".tar.xz";
-  return `gateway-${target}${extension}`;
-}
-
-/** A synthetic digest per target, so a mismatch is visible when one moves. */
-function digestFor(target) {
-  return createHash("sha256").update(`archive ${target}`).digest("hex");
-}
-
-/** The size the release reports for each archive, keyed by asset name. */
-function sizesFor() {
-  const sizes = new Map();
-  for (const [index, target] of TARGETS.entries()) {
-    sizes.set(assetFor(target), 4000 + index);
-  }
-  return sizes;
-}
-
-/** A `dist-manifest.json` shaped the way cargo-dist writes one. */
-function distManifest({ specs = true } = {}) {
-  const artifacts = {};
-  const sums = [];
-  for (const target of TARGETS) {
-    const asset = assetFor(target);
-    const digest = digestFor(target);
-    artifacts[asset] = {
-      name: asset,
-      kind: "executable-zip",
-      target_triples: [target],
-      assets: [
-        { name: "LICENSE", path: "LICENSE", kind: "license" },
-        { name: "runvil-gateway", path: "runvil-gateway", kind: "executable" },
-      ],
-      checksum: `${asset}.sha256`,
-      checksums: { sha256: digest },
-    };
-    sums.push(`${digest} *${asset}`);
-  }
-  artifacts["source.tar.gz"] = {
-    name: "source.tar.gz",
-    kind: "source-tarball",
-    target_triples: [],
-    assets: [],
-    checksums: { sha256: "f".repeat(64) },
-  };
-  if (specs) {
-    artifacts["openapi.yaml"] = {
-      name: "openapi.yaml",
-      kind: "extra-artifact",
-      target_triples: [],
-      assets: [],
-      checksums: { sha256: sha256(OPENAPI) },
-    };
-    artifacts["asyncapi.yaml"] = {
-      name: "asyncapi.yaml",
-      kind: "extra-artifact",
-      target_triples: [],
-      assets: [],
-      checksums: { sha256: sha256(ASYNCAPI) },
-    };
-    sums.push(`${sha256(OPENAPI)} *openapi.yaml`, `${sha256(ASYNCAPI)} *asyncapi.yaml`);
-  }
-  return {
-    dist_version: "0.32.0",
-    announcement_tag: TAG,
-    releases: [{ app_name: "gateway", app_version: "0.4.0", artifacts: Object.keys(artifacts) }],
-    artifacts,
-    checksumSum: sums,
-  };
-}
-
-/** The `sha256.sum` text matching `distManifest`. */
-function checksumSum(manifest) {
-  return `${manifest.checksumSum.join("\n")}\n`;
-}
-
-/**
- * The `gh release view` answer: each asset's name, size, and digest. A
- * `sizes` value of `null` models a release that states no size for that
- * asset.
- */
-function releaseView({ manifest, sizes = sizesFor(), extras = {} }) {
-  const assets = [];
-  const push = (name, size, digest) => {
-    const asset = { name, digest: `sha256:${digest}`, state: "uploaded" };
-    if (Number.isInteger(size)) {
-      asset.size = size;
-    }
-    assets.push(asset);
-  };
-  for (const [name, entry] of Object.entries(manifest.artifacts)) {
-    push(name, sizes.has(name) ? sizes.get(name) : 1000, entry.checksums.sha256);
-  }
-  push(CHECKSUM_ASSET, 598, sha256(checksumSum(manifest)));
-  push(DIST_MANIFEST_ASSET, 23099, sha256("manifest"));
-  for (const [name, text] of Object.entries(extras)) {
-    push(name, Buffer.byteLength(text), sha256(text));
-  }
-  return JSON.stringify({ tagName: TAG, name: TAG, assets });
-}
-
-/** A sandbox repository root with a placeholder pin and placeholder specs. */
-function sandbox() {
-  const base = mkdtempSync(join(tmpdir(), "runvil-bump-gateway-"));
-  const root = join(base, "repo");
-  mkdirSync(join(root, "gateway-pin"), { recursive: true });
-  writeFileSync(
-    pinPath(root),
-    `${JSON.stringify(
-      {
-        pin_format: 1,
-        repository: "cppalliance/runvil-gateway",
-        tag: PLACEHOLDER,
-        version: PLACEHOLDER,
-        executable: "runvil-gateway",
-        min_gateway: PLACEHOLDER,
-        spec: {
-          openapi: { path: "gateway-pin/openapi.yaml", sha256: PLACEHOLDER },
-          asyncapi: { path: "gateway-pin/asyncapi.yaml", sha256: PLACEHOLDER },
-        },
-        targets: Object.fromEntries(
-          TARGETS.map((target) => [target, { asset: PLACEHOLDER, sha256: PLACEHOLDER, size: 0 }]),
-        ),
-      },
-      null,
-      2,
-    )}\n`,
-  );
-  for (const { name } of SPEC_ASSETS) {
-    writeFileSync(specPath(root, name), "# PLACEHOLDER\n");
-  }
-  return { base, root };
-}
-
-/**
- * A `gh` stand-in. `release view` answers with each asset's size and digest;
- * `release download` materializes the requested patterns into `--dir`, and
- * refuses a pattern the release does not publish, as `gh` does.
- */
-function fakeGh({
-  foundTag = TAG,
-  manifest = distManifest(),
-  specs = { "openapi.yaml": OPENAPI, "asyncapi.yaml": ASYNCAPI },
-  sizes = sizesFor(),
-  view = null,
-  calls = [],
-} = {}) {
-  const listed = releaseView({ manifest, sizes, extras: specs });
-  return (args) => {
-    calls.push(args);
-    if (args[0] === "release" && args[1] === "view") {
-      if (args[2] !== foundTag) {
-        throw new Error(`gh release view ${args[2]} failed: release not found`);
-      }
-      return view === null ? listed : view;
-    }
-    if (args[0] === "release" && args[1] === "download") {
-      const dir = args[args.indexOf("--dir") + 1];
-      const patterns = args.flatMap((arg, index) => (arg === "--pattern" ? [args[index + 1]] : []));
-      const viewNames = releaseAssetNames(JSON.parse(listed));
-      for (const pattern of patterns) {
-        if (!viewNames.includes(pattern)) {
-          throw new Error(`no asset named ${pattern}`);
-        }
-        if (pattern === CHECKSUM_ASSET) {
-          writeFileSync(join(dir, CHECKSUM_ASSET), checksumSum(manifest));
-        } else if (pattern === DIST_MANIFEST_ASSET) {
-          writeFileSync(join(dir, DIST_MANIFEST_ASSET), JSON.stringify(manifest, null, 2));
-        } else if (specs[pattern] !== undefined) {
-          writeFileSync(join(dir, pattern), specs[pattern]);
-        } else {
-          throw new Error(`no asset named ${pattern}`);
-        }
-      }
-      return "";
-    }
-    throw new Error(`unexpected gh call: ${args.join(" ")}`);
-  };
-}
-
-test("a bump rewrites the pin and both spec copies when the release publishes them", () => {
-  const { base, root } = sandbox();
-  try {
-    const result = bumpGateway({ root, tag: TAG, gh: fakeGh() });
-    assert.equal(result.written, true);
-    const pin = readPin(root);
-    assert.equal(pin["tag"], TAG);
-    assert.equal(pin["version"], "0.4.0");
-    assert.equal(pin["min_gateway"], "0.4.0");
-    assert.equal(pin["spec"]["openapi"]["sha256"], sha256(OPENAPI));
-    assert.equal(readFileSync(specPath(root, "openapi.yaml"), "utf8"), OPENAPI);
-    assert.equal(readFileSync(specPath(root, "asyncapi.yaml"), "utf8"), ASYNCAPI);
-    assert.equal(pin["targets"]["aarch64-apple-darwin"]["size"], 4001);
-    assert.equal(pin["targets"]["aarch64-apple-darwin"]["sha256"], digestFor("aarch64-apple-darwin"));
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a release that publishes no spec is pinned with no spec entry and says so", () => {
-  const { base, root } = sandbox();
-  try {
-    const printed = [];
-    const result = bumpGateway({
-      root,
-      tag: TAG,
-      gh: fakeGh({ manifest: distManifest({ specs: false }), specs: {} }),
-      log: (line) => printed.push(line),
-    });
-    assert.equal(result.written, true);
-    const pin = readPin(root);
-    assert.deepEqual(pin["spec"], {}, "an absent spec is recorded as absent");
-    assert.equal(pin["targets"]["x86_64-pc-windows-msvc"]["asset"], "gateway-x86_64-pc-windows-msvc.zip");
-    assert.equal(
-      printed.join("\n").includes("publishes no openapi.yaml and asyncapi.yaml"),
-      true,
-      printed.join("\n"),
-    );
-    assert.equal(
-      readFileSync(specPath(root, "openapi.yaml"), "utf8"),
-      "# PLACEHOLDER\n",
-      "the old copy is left alone rather than invented",
-    );
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a release without a spec still yields a complete pin", async () => {
-  const { placeholderFields } = await import("./gateway-pin.mjs");
-  const { base, root } = sandbox();
-  try {
-    const result = bumpGateway({
-      root,
-      tag: TAG,
-      gh: fakeGh({ manifest: distManifest({ specs: false }), specs: {} }),
-      log: () => {},
-    });
-    assert.deepEqual(placeholderFields(result.pin), []);
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a tag that cannot be found writes nothing at all", () => {
-  const { base, root } = sandbox();
-  try {
-    const before = readFileSync(pinPath(root), "utf8");
-    assert.throws(
-      () => bumpGateway({ root, tag: "gateway-v9.9.9", gh: fakeGh() }),
-      /Gateway release gateway-v9\.9\.9 was not found/,
-    );
-    assert.equal(readFileSync(pinPath(root), "utf8"), before, "the pin is untouched");
-    assert.equal(readFileSync(specPath(root, "openapi.yaml"), "utf8"), "# PLACEHOLDER\n");
-    assert.deepEqual(
-      readdirSync(join(root, "gateway-pin")).sort(),
-      ["asyncapi.yaml", "openapi.yaml", "pin.json"],
-      "no temp file is left behind",
-    );
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a spec that disagrees with the checksum list fails before any write", () => {
-  const { base, root } = sandbox();
-  try {
-    const before = readFileSync(pinPath(root), "utf8");
-    assert.throws(
-      () =>
-        bumpGateway({
-          root,
-          tag: TAG,
-          gh: fakeGh({ specs: { "openapi.yaml": "tampered", "asyncapi.yaml": ASYNCAPI } }),
-        }),
-      /openapi\.yaml for gateway-v0\.4\.0 has sha256 [0-9a-f]{64}, but sha256\.sum records [0-9a-f]{64}/,
-    );
-    assert.equal(readFileSync(pinPath(root), "utf8"), before);
-    assert.equal(readFileSync(specPath(root, "openapi.yaml"), "utf8"), "# PLACEHOLDER\n");
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a dry run prints the diff and writes nothing", () => {
-  const { base, root } = sandbox();
-  try {
-    const before = readFileSync(pinPath(root), "utf8");
-    const result = bumpGateway({ root, tag: TAG, gh: fakeGh(), dryRun: true });
-    assert.equal(result.written, false);
-    assert.equal(readFileSync(pinPath(root), "utf8"), before);
-    assert.ok(result.diffs.some((diff) => diff.includes('+  "tag": "gateway-v0.4.0"')), result.diffs.join("\n"));
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-});
-
-test("a missing sha256.sum is named rather than silently skipped", () => {
-  const manifest = distManifest();
-  const view = releaseView({ manifest });
-  const withoutSum = JSON.stringify({
-    ...JSON.parse(view),
-    assets: JSON.parse(view)["assets"].filter((asset) => asset["name"] !== CHECKSUM_ASSET),
-  });
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ view: withoutSum }) }),
-    /publishes no sha256\.sum asset/,
-  );
-});
-
-test("a missing dist-manifest.json is named rather than silently skipped", () => {
-  const manifest = distManifest();
-  const view = releaseView({ manifest });
-  const withoutManifest = JSON.stringify({
-    ...JSON.parse(view),
-    assets: JSON.parse(view)["assets"].filter((asset) => asset["name"] !== DIST_MANIFEST_ASSET),
-  });
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ view: withoutManifest }) }),
-    /publishes no dist-manifest\.json asset/,
-  );
-});
-
-test("a target missing from the manifest is refused by pin field", () => {
-  const manifest = distManifest();
-  delete manifest.artifacts["gateway-aarch64-unknown-linux-gnu.tar.xz"];
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ manifest }) }),
-    /targets\.aarch64-unknown-linux-gnu\.asset is absent from dist-manifest\.json/,
-  );
-});
-
-test("a checksum that disagrees between the two sources is refused, naming both", () => {
-  const manifest = distManifest();
-  manifest.checksumSum[0] = `${"0".repeat(64)} *gateway-x86_64-pc-windows-msvc.zip`;
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ manifest }) }),
-    /targets\.x86_64-pc-windows-msvc\.sha256 is [0-9a-f]{64} in dist-manifest\.json but [0-9a-f]{64} in sha256\.sum/,
-  );
-});
-
-test("a release digest that disagrees with the manifest is refused", () => {
-  const manifest = distManifest();
-  const view = JSON.parse(releaseView({ manifest }));
-  const windows = view["assets"].find((asset) => asset["name"] === assetFor("x86_64-pc-windows-msvc"));
-  windows["digest"] = `sha256:${"1".repeat(64)}`;
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ manifest, view: JSON.stringify(view) }) }),
-    /but the release states [0-9a-f]{64}/,
-  );
-});
-
-test("a target whose release asset states no digest is refused by pin field", () => {
-  const manifest = distManifest();
-  const view = JSON.parse(releaseView({ manifest }));
-  const linux = view["assets"].find((asset) => asset["name"] === assetFor("x86_64-unknown-linux-gnu"));
-  delete linux["digest"];
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ manifest, view: JSON.stringify(view) }) }),
-    /targets\.x86_64-unknown-linux-gnu\.sha256 is absent from the release's asset list for gateway-x86_64-unknown-linux-gnu\.tar\.xz/,
-  );
-});
-
-test("a target with no published size is refused rather than pinned as zero", () => {
-  const manifest = distManifest();
-  const sizes = sizesFor();
-  sizes.set(assetFor("x86_64-apple-darwin"), null);
-  assert.throws(
-    () => downloadRelease({ tag: TAG, gh: fakeGh({ manifest, sizes }) }),
-    /targets\.x86_64-apple-darwin\.size is absent from the release's asset list/,
-  );
-});
-
-test("a manifest whose version disagrees with the tag is refused", () => {
-  const manifest = distManifest();
-  manifest.releases[0].app_version = "0.5.0";
-  assert.throws(
-    () => releaseVersion(manifest, TAG),
-    /records app_version 0\.5\.0, so the tag does not name the release it points at/,
-  );
-});
-
-test("the version comes from the tag, so min_gateway is always derivable", () => {
-  assert.equal(versionFromTag("gateway-v0.3.0"), "0.3.0");
-  assert.equal(versionFromTag("gateway-v1.2.3-rc.1"), "1.2.3-rc.1");
-  assert.throws(() => versionFromTag("gateway"), /does not end in a version/);
-  assert.equal(releaseVersion({}, TAG), "0.4.0", "a manifest with no version still pins the tag's");
-});
-
-test("a manifest naming two executables is refused", () => {
-  const manifest = distManifest();
-  manifest.artifacts[assetFor("x86_64-unknown-linux-gnu")].assets[1].name = "other-gateway";
-  assert.throws(() => executableName(manifest), /names runvil-gateway and other-gateway executables/);
-});
-
-test("a manifest naming no executable is refused", () => {
-  const manifest = distManifest();
-  for (const artifact of Object.values(manifest.artifacts)) {
-    if (artifact.kind === "executable-zip") {
-      artifact.assets = artifact.assets.filter((asset) => asset.kind !== "executable");
-    }
-  }
-  assert.throws(() => executableName(manifest), /names no executables for the released archives/);
-});
-
-test("a checksum line that does not parse names its line number", () => {
-  assert.throws(
-    () => parseChecksumSum(`${"a".repeat(64)} *ok.tar.xz\nnot a checksum\n`),
-    /sha256\.sum line 2 does not read as "<sha256> <asset>"/,
-  );
-  assert.throws(() => parseChecksumSum("\n \n"), /sha256\.sum lists no asset checksums/);
-});
-
-test("the checksum list accepts the two-space form and both cases of hex", () => {
-  const sums = parseChecksumSum(`${"A".repeat(64)}  some.tar.xz\n`);
-  assert.equal(sums.get("some.tar.xz"), "a".repeat(64));
-});
-
-test("an ambiguous triple is refused rather than pinned by guess", () => {
-  const manifest = distManifest();
-  const artifact = manifest.artifacts[assetFor("x86_64-unknown-linux-gnu")];
-  manifest.artifacts["gateway-x86_64-unknown-linux-gnu.tar.gz"] = { ...artifact };
-  manifest.checksumSum.push(`${digestFor("x86_64-unknown-linux-gnu")} *gateway-x86_64-unknown-linux-gnu.tar.gz`);
-  assert.throws(
-    () =>
-      selectTargets({
-        manifest,
-        checksums: parseChecksumSum(checksumSum(manifest)),
-        sizes: sizesFor(),
-        digests: new Map(TARGETS.map((target) => [assetFor(target), digestFor(target)])),
-      }),
-    /targets\.x86_64-unknown-linux-gnu\.asset is ambiguous/,
-  );
-});
-
-test("the built pin carries every five target entries in release order", () => {
-  const { pin } = downloadRelease({ tag: TAG, gh: fakeGh() });
-  assert.deepEqual(Object.keys(pin["targets"]), TARGETS);
-  assert.equal(pin["pin_format"], 1);
-  assert.equal(pin["executable"], "runvil-gateway");
-  assert.equal(pin["spec"]["asyncapi"]["path"], "gateway-pin/asyncapi.yaml");
-});
-
-test("buildPin leaves out a spec the release did not publish", () => {
-  const { pin } = downloadRelease({
-    tag: TAG,
-    gh: fakeGh({ manifest: distManifest({ specs: false }), specs: {} }),
-  });
-  assert.deepEqual(pin["spec"], {});
-  assert.deepEqual(Object.keys(pin["targets"]), TARGETS);
-});
-
-test("the diff shows only the changed lines with a little context", () => {
-  const before = "a\nb\nc\nd\n";
-  const after = "a\nb\nCHANGED\nd\n";
-  const diff = renderDiff("pin.json", before, after);
-  assert.ok(diff.includes("-c"), diff);
-  assert.ok(diff.includes("+CHANGED"), diff);
-  assert.ok(diff.includes(" b"), diff);
-  assert.equal(renderDiff("pin.json", before, before), "pin.json: unchanged");
-});
-
-test("a download leaves no scratch directory behind", () => {
-  const before = readdirSync(tmpdir()).filter((name) => name.startsWith("runvil-bump-gateway-"));
-  downloadRelease({ tag: TAG, gh: fakeGh() });
-  const after = readdirSync(tmpdir()).filter((name) => name.startsWith("runvil-bump-gateway-"));
-  assert.deepEqual(after, before);
-});
-
-test("a failed gh download propagates its message", () => {
-  const gh = (args) => {
-    if (args[1] === "view") {
-      return releaseView({ manifest: distManifest() });
-    }
-    throw new Error("gh release download failed: HTTP 404");
-  };
-  assert.throws(() => downloadRelease({ tag: TAG, gh }), /HTTP 404/);
-  assert.equal(existsSync(join(tmpdir(), "does-not-exist")), false);
-});
-
-test("every target entry names the archive its own triple builds", () => {
-  const { pin } = downloadRelease({ tag: TAG, gh: fakeGh() });
-  for (const target of TARGETS) {
-    assert.equal(pin["targets"][target]["asset"], assetFor(target));
-    assert.equal(pin["targets"][target]["sha256"], digestFor(target));
-  }
-});
-
-test("buildPin keeps the repository it was given", () => {
-  const pin = buildPin({
-    tag: TAG,
-    repository: REPOSITORY,
-    version: "0.4.0",
-    executable: "runvil-gateway",
-    targets: Object.fromEntries(
-      TARGETS.map((target) => [target, { asset: assetFor(target), sha256: digestFor(target), size: 1 }]),
-    ),
-    specs: {},
-  });
-  assert.equal(pin["repository"], REPOSITORY);
-  assert.equal(pin["min_gateway"], "0.4.0");
-});
diff --git a/crates/workshop/ui/test/docs-claims.mjs b/tools/docs-claims.mjs
similarity index 65%
rename from crates/workshop/ui/test/docs-claims.mjs
rename to tools/docs-claims.mjs
index 44c715940..ab7c1ea1f 100644
--- a/crates/workshop/ui/test/docs-claims.mjs
+++ b/tools/docs-claims.mjs
@@ -1,17 +1,16 @@
 // Guard: the repository's prose follows the root AGENTS.md. Every
 // rulebook uses Engine, Harness, Host, and Plugin as the Definitions
-// section defines them, and neither the root AGENTS.md nor the
-// Pack-facing crates' comments describe Pack activation. Reads
-// the files with node:fs rather than importing anything, so the check
-// needs no bundle and runs in the plain SPA suite.
-// Run: node --test test/docs-claims.mjs
+// section defines them, and the root AGENTS.md never describes Pack
+// activation. Reads the files with node:fs rather than importing anything,
+// so the check needs Node and no install.
+// Run: node --test tools/docs-claims.mjs
 import assert from "node:assert/strict";
 import { readdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
 
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
 /** Every line of `file` (relative to the repo root) matching `phrase`, a string or a RegExp, tagged with its number. */
 async function offendingLines(file, phrase) {
@@ -29,13 +28,10 @@ async function offendingLines(file, phrase) {
 // `## Invariants`) as instructions, so each one uses the four words one way.
 // Inline and fenced code is skipped, and so is the Definitions section itself,
 // whose rule text names the words it restricts.
-const SKIP_DIRS = new Set([".git", "node_modules", "target", "dist"]);
-// Network and outside-tool phrases that keep a lowercase "host".
-const HOST_ALLOWED = /host-and-address|self-hosted|github-hosted/gi;
-// Other senses that keep a lowercase "engine" or "harness".
-const TERM_ALLOWED = /speech engine|database engine|test harness/gi;
-// Other programs' plugins, which keep a lowercase "plugin".
-const PLUGIN_ALLOWED = /Tauri plugin|ProseMirror plugin|esbuild plugin|NSIS plugin/gi;
+//
+// The three checkouts CI places inside this one are skipped: each holds
+// the rulebooks of its own repository, which its own scan reads.
+const SKIP_DIRS = new Set([".git", "target", "runvil-workshop", "runvil-docs", "runvil-harness"]);
 
 async function* walk(dir) {
   for (const entry of await readdir(dir, { withFileTypes: true })) {
@@ -90,18 +86,14 @@ test("rulebooks use Engine, Harness, Host, and Plugin as the root AGENTS.md defi
   const offenders = [];
   for (const { file, number, text } of await rulebookLines()) {
     const where = `${file}:${number}: ${text.trim()}`;
-    if (/\bhost(s|ed|ing)?\b|\bhost-/.test(text.replace(HOST_ALLOWED, " "))) {
+    if (/\bhost(s|ed|ing)?\b|\bhost-/.test(text)) {
       offenders.push(`${where} (lowercase "host": required "Host" for the application, another word for any other sense)`);
     }
-    // The scan applies one rule everywhere, the Gateway tree included: a
-    // Gateway rulebook that means the speech engine says "speech engine",
-    // which TERM_ALLOWED allows.
-    const terms = /(?<![-_/:\w])(engine|harness)(?![-_/:\w])/;
-    if (terms.test(text.replace(TERM_ALLOWED, " "))) {
+    if (/(?<![-_/:\w])(engine|harness)(?![-_/:\w])/.test(text)) {
       offenders.push(`${where} (lowercase "engine" or "harness": required "Engine" or "Harness" for the defined term)`);
     }
-    if (/(?<![-_/:\w])plugins?(?![-_/:\w])/.test(text.replace(PLUGIN_ALLOWED, " "))) {
-      offenders.push(`${where} (lowercase "plugin": required "Plugin" for the defined term, or the other program's name, such as "Tauri plugin")`);
+    if (/(?<![-_/:\w])plugins?(?![-_/:\w])/.test(text)) {
+      offenders.push(`${where} (lowercase "plugin": required "Plugin" for the defined term)`);
     }
   }
   assert.deepEqual(offenders, [], "rulebook lines break the root AGENTS.md Definitions");
@@ -109,27 +101,8 @@ test("rulebooks use Engine, Harness, Host, and Plugin as the root AGENTS.md defi
 
 // Packs are installed once, when the Host sets up, and each run makes its
 // own instance of each Pack it holds and takes a snapshot of them, so docs
-// say a Pack is made for each run, never activated. Comment lines are
-// checked, not code, so a local variable keeps its name.
-const PLUGIN_DOC_DIRS = [
-  "crates/workshop/plugin-std",
-  "crates/workshop/plugin-bashkit",
-];
-
-test("the root AGENTS.md and the Pack-facing crates' comments never describe Pack activation", async () => {
+// say a Pack is made for each run, never activated.
+test("the root AGENTS.md never describes Pack activation", async () => {
   const offenders = await offendingLines("AGENTS.md", /activat/i);
-  for (const dir of PLUGIN_DOC_DIRS) {
-    for await (const full of walk(path.join(repoRoot, dir))) {
-      if (!full.endsWith(".rs")) {
-        continue;
-      }
-      const file = path.relative(repoRoot, full).split(path.sep).join("/");
-      (await readFile(full, "utf8")).split("\n").forEach((line, index) => {
-        if (line.trimStart().startsWith("//") && /activat/i.test(line)) {
-          offenders.push(`${file}:${index + 1}: ${line.trim()}`);
-        }
-      });
-    }
-  }
   assert.deepEqual(offenders, [], "a doc still says Packs are activated; say installed, snapshotted, or declared");
 });
diff --git a/tools/fetch-gateway-sidecar.mjs b/tools/fetch-gateway-sidecar.mjs
deleted file mode 100644
index c11e10d84..000000000
--- a/tools/fetch-gateway-sidecar.mjs
+++ /dev/null
@@ -1,313 +0,0 @@
-// Obtains the Gateway sidecar Workshop bundles: either the pinned release
-// binary for one target, or a stub for compile-only jobs.
-//
-// The pin in `gateway-pin/pin.json` names the release and the sha256 of
-// every asset. This script downloads (or reuses a cached copy of) one
-// asset, checks its size and sha256 against the pin, extracts the
-// executable, and hands it to `stage-gateway-sidecar.mjs`, which owns the
-// Tauri naming rule and the destination. A mismatch fails loudly with both
-// hashes, because a silently wrong Gateway is worse than no build.
-//
-// Usage:
-//   node tools/fetch-gateway-sidecar.mjs [--target <triple>] [--cache-dir <path>]
-//                                        [--verify-attestation] [--stub]
-//
-// `--stub` writes a placeholder file at the path Tauri expects and
-// downloads nothing, so a job that only compiles the app needs no release.
-// `--verify-attestation` additionally asks `gh release verify-asset` about
-// the downloaded archive.
-
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-import { extractExecutable } from "./gateway-archive.mjs";
-import {
-  PLACEHOLDER,
-  TARGETS,
-  placeholderFields,
-  placeholderReport,
-  readPin,
-  releaseAssetUrl,
-  requireFilledPin,
-  targetEntry,
-} from "./gateway-pin.mjs";
-import {
-  gatewayBinaryName,
-  markGatewaySidecarPinned,
-  stageGatewaySidecar,
-} from "./stage-gateway-sidecar.mjs";
-
-const REPOSITORY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-/** The stub's bytes: a recognizable text, never runnable as a Gateway. */
-const STUB_CONTENT =
-  "This is a placeholder staged by tools/fetch-gateway-sidecar.mjs --stub.\n" +
-  "It stands in for the Gateway sidecar so compile-only jobs need no release.\n" +
-  "It is not an executable. Stage the real pinned binary before shipping.\n";
-
-/** The host triple a build on this machine targets. */
-export function hostTarget() {
-  const key = `${process.platform}-${process.arch}`;
-  const triples = {
-    "win32-x64": "x86_64-pc-windows-msvc",
-    "win32-arm64": "aarch64-pc-windows-msvc",
-    "darwin-arm64": "aarch64-apple-darwin",
-    "darwin-x64": "x86_64-apple-darwin",
-    "linux-x64": "x86_64-unknown-linux-gnu",
-    "linux-arm64": "aarch64-unknown-linux-gnu",
-  };
-  const triple = triples[key];
-  if (triple === undefined) {
-    throw new Error(`no Gateway target matches this machine (${key}); pass --target <triple>`);
-  }
-  return triple;
-}
-
-/** The default download cache: `RUNVIL_GATEWAY_CACHE`, else the user's cache directory. */
-export function defaultCacheDir() {
-  const fromEnvironment = process.env["RUNVIL_GATEWAY_CACHE"];
-  if (fromEnvironment !== undefined && fromEnvironment !== "") {
-    return fromEnvironment;
-  }
-  const base =
-    process.platform === "win32"
-      ? process.env["LOCALAPPDATA"] ?? join(homedir(), "AppData", "Local")
-      : process.env["XDG_CACHE_HOME"] ?? join(homedir(), ".cache");
-  return join(base, "runvil", "gateway-sidecar");
-}
-
-/** Lowercase hex sha256 of `bytes`. */
-export function sha256Hex(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-/**
- * Throws unless `bytes` match the pin's recorded size and sha256, naming
- * both hashes and both sizes.
- */
-export function verifyAsset(bytes, entry, asset) {
-  if (bytes.length !== entry.size) {
-    throw new Error(
-      `Gateway asset ${asset} is ${bytes.length} bytes, but the pin records ${entry.size} bytes`,
-    );
-  }
-  const actual = sha256Hex(bytes);
-  if (actual !== entry.sha256) {
-    throw new Error(
-      `Gateway asset ${asset} sha256 is ${actual}, but the pin records ${entry.sha256}`,
-    );
-  }
-  return actual;
-}
-
-/** Downloads `url` and returns its bytes, failing on any non-200 answer. */
-async function downloadBytes(url) {
-  const response = await fetch(url, { redirect: "follow" });
-  if (!response.ok) {
-    throw new Error(`downloading ${url} failed: ${response.status} ${response.statusText}`);
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-
-/** How a `gh` subprocess is run: a seam the tests replace. */
-function runGh(args) {
-  const result = spawnSync("gh", args, { encoding: "utf8" });
-  if (result.error !== undefined && result.error !== null) {
-    throw new Error(`could not run gh ${args.join(" ")}: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    const detail = (result.stderr || result.stdout || "").trim();
-    throw new Error(`gh ${args.join(" ")} failed${detail === "" ? "" : `: ${detail}`}`);
-  }
-  return result.stdout;
-}
-
-/**
- * Ensures the pinned archive for `target` is in the cache and verified,
- * returning its path. A cache hit is re-verified on every run: the pin is
- * the authority, not the cache.
- */
-async function ensureArchive(pin, target, cacheDir, { download }) {
-  const entry = targetEntry(pin, target);
-  const url = releaseAssetUrl(pin, entry.asset);
-  const cached = join(cacheDir, pin.tag, entry.asset);
-  if (existsSync(cached)) {
-    const bytes = readFileSync(cached);
-    try {
-      verifyAsset(bytes, entry, entry.asset);
-      return { path: cached, downloaded: false, url };
-    } catch {
-      // A cached file that no longer matches the pin is stale: refetch it
-      // rather than failing, so a re-pinned cache heals itself.
-      rmSync(cached, { force: true });
-    }
-  }
-  const bytes = await download(url);
-  verifyAsset(bytes, entry, entry.asset);
-  mkdirSync(dirname(cached), { recursive: true });
-  writeFileSync(cached, bytes);
-  return { path: cached, downloaded: true, url };
-}
-
-/**
- * Obtains and stages the sidecar. Returns what was staged and how.
- *
- * `download` and `gh` are seams for the tests; production uses `fetch` and
- * the real `gh` executable.
- */
-export async function fetchGatewaySidecar(options = {}) {
-  const {
-    root = REPOSITORY_ROOT,
-    target = hostTarget(),
-    cacheDir = defaultCacheDir(),
-    stub = false,
-    verifyAttestation = false,
-    download = downloadBytes,
-    gh = runGh,
-  } = options;
-  const binary = gatewayBinaryName(target);
-  if (!TARGETS.includes(target)) {
-    throw new Error(
-      `unsupported Gateway target ${target}; the pin records ${TARGETS.join(", ")}`,
-    );
-  }
-  if (stub) {
-    return stageStub({ root, target, cacheDir, binary });
-  }
-  const pin = readPin(root);
-  if (pin.executable === PLACEHOLDER) {
-    throw new Error("gateway-pin/pin.json still holds a placeholder in executable");
-  }
-  try {
-    requireFilledPin(pin, { source: "gateway-pin/pin.json", target });
-  } catch (error) {
-    // A person running this before the pin is filled needs the whole list,
-    // not just the fields one target reads, so the report follows the
-    // refusal.
-    throw new Error(`${error.message}\n${placeholderReport(pin, { source: "gateway-pin/pin.json" })}`);
-  }
-  const entry = targetEntry(pin, target);
-  const archive = await ensureArchive(pin, target, cacheDir, { download });
-  if (verifyAttestation) {
-    gh(["release", "verify-asset", pin.tag, archive.path, "--repo", pin.repository]);
-  }
-  const extracted = extractExecutable(entry.asset, readFileSync(archive.path), binary);
-  if (extracted === null) {
-    throw new Error(`Gateway asset ${entry.asset} holds no ${binary}`);
-  }
-  const scratch = mkdtempSync(join(cacheDir, "extract-"));
-  try {
-    const source = join(scratch, binary);
-    writeFileSync(source, extracted);
-    const staged = stageGatewaySidecar({ root, target, source });
-    markGatewaySidecarPinned({ root, target, kind: "release", tag: pin.tag });
-    return {
-      staged,
-      target,
-      tag: pin.tag,
-      version: pin.version,
-      asset: entry.asset,
-      url: archive.url,
-      downloaded: archive.downloaded,
-      stub: false,
-    };
-  } finally {
-    rmSync(scratch, { force: true, recursive: true });
-  }
-}
-
-/** Writes the placeholder file and stages it, downloading nothing. */
-function stageStub({ root, target, cacheDir, binary }) {
-  const directory = join(cacheDir, "stub");
-  mkdirSync(directory, { recursive: true });
-  const source = join(directory, binary);
-  writeFileSync(source, STUB_CONTENT);
-  const staged = stageGatewaySidecar({ root, target, source });
-  markGatewaySidecarPinned({ root, target, kind: "stub" });
-  return {
-    staged,
-    target,
-    tag: null,
-    version: null,
-    asset: null,
-    url: null,
-    downloaded: false,
-    stub: true,
-  };
-}
-
-function parseArguments(args) {
-  const values = new Map();
-  const flagNames = new Set(["--stub", "--verify-attestation"]);
-  const valueNames = new Set(["--target", "--cache-dir"]);
-  const flags = new Set();
-  for (let index = 0; index < args.length; index += 1) {
-    const name = args[index];
-    if (flagNames.has(name)) {
-      if (flags.has(name) || values.has(name)) {
-        throw new Error(`duplicate fetch argument: ${name}`);
-      }
-      flags.add(name);
-      continue;
-    }
-    if (!valueNames.has(name)) {
-      throw new Error(
-        "usage: fetch-gateway-sidecar.mjs [--target <triple>] [--cache-dir <path>] " +
-          "[--verify-attestation] [--stub]",
-      );
-    }
-    const value = args[index + 1];
-    if (value === undefined) {
-      throw new Error(`missing value for fetch argument: ${name}`);
-    }
-    if (values.has(name)) {
-      throw new Error(`duplicate fetch argument: ${name}`);
-    }
-    values.set(name, value);
-    index += 1;
-  }
-  return {
-    target: values.get("--target"),
-    cacheDir: values.get("--cache-dir"),
-    stub: flags.has("--stub"),
-    verifyAttestation: flags.has("--verify-attestation"),
-  };
-}
-
-async function main(args) {
-  const parsed = parseArguments(args);
-  const options = { stub: parsed.stub, verifyAttestation: parsed.verifyAttestation };
-  if (parsed.target !== undefined) {
-    options.target = parsed.target;
-  }
-  if (parsed.cacheDir !== undefined) {
-    options.cacheDir = parsed.cacheDir;
-  }
-  const result = await fetchGatewaySidecar(options);
-  if (result.stub) {
-    console.log(`staged a stub for ${result.target} at ${result.staged}`);
-    console.log("this file is not a runnable Gateway; never ship a build made with --stub");
-    return;
-  }
-  console.log(
-    `${result.downloaded ? "downloaded" : "reused"} ${result.asset} (${result.url}), ` +
-      `sha256 verified against the pin for ${result.tag}`,
-  );
-  console.log(`staged ${result.target} from Gateway ${result.version} at ${result.staged}`);
-}
-
-if (
-  process.argv[1] !== undefined &&
-  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-  try {
-    await main(process.argv.slice(2));
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-}
diff --git a/tools/fetch-gateway-sidecar.test.mjs b/tools/fetch-gateway-sidecar.test.mjs
deleted file mode 100644
index 3992954b1..000000000
--- a/tools/fetch-gateway-sidecar.test.mjs
+++ /dev/null
@@ -1,355 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { gzipSync } from "node:zlib";
-import test from "node:test";
-
-import {
-  fetchGatewaySidecar,
-  hostTarget,
-  sha256Hex,
-  verifyAsset,
-} from "./fetch-gateway-sidecar.mjs";
-import { PLACEHOLDER, TARGETS, parsePin, placeholderReport, renderPin } from "./gateway-pin.mjs";
-
-const WINDOWS = "x86_64-pc-windows-msvc";
-const LINUX = "x86_64-unknown-linux-gnu";
-const BINARY = "runvil-gateway";
-const EXECUTABLE_BYTES = "the gateway executable";
-
-/** A gzipped tar holding one `runvil-gateway` under a release directory name. */
-function releaseArchive() {
-  const header = Buffer.alloc(512, 0);
-  header.write("runvil-gateway-x86_64-unknown-linux-gnu/runvil-gateway", 0, 100, "utf8");
-  header.write("0000644\0", 100, "utf8");
-  header.write("0000000\0", 108, "utf8");
-  header.write("0000000\0", 116, "utf8");
-  const size = Buffer.byteLength(EXECUTABLE_BYTES);
-  header.write(`${size.toString(8).padStart(11, "0")}\0`, 124, "utf8");
-  header.write("00000000000\0", 136, "utf8");
-  header.write("        ", 148, "utf8");
-  header.write("0", 156, "utf8");
-  header.write("ustar\0", 257, "utf8");
-  header.write("00", 263, "utf8");
-  const body = Buffer.alloc(512, 0);
-  body.write(EXECUTABLE_BYTES, 0, "utf8");
-  return gzipSync(Buffer.concat([header, body, Buffer.alloc(1024, 0)]));
-}
-
-/** A pin whose Linux target matches `bytes`. */
-function pinFor(bytes) {
-  const targets = {};
-  for (const target of TARGETS) {
-    targets[target] = { asset: "PLACEHOLDER", sha256: PLACEHOLDER, size: 0 };
-  }
-  targets[LINUX] = {
-    asset: "runvil-gateway-x86_64-unknown-linux-gnu.tar.gz",
-    sha256: sha256Hex(bytes),
-    size: bytes.length,
-  };
-  return {
-    pin_format: 1,
-    repository: "cppalliance/runvil-gateway",
-    tag: "gateway-v0.4.0",
-    version: "0.4.0",
-    executable: "runvil-gateway",
-    min_gateway: "0.4.0",
-    spec: {
-      openapi: { path: "gateway-pin/openapi.yaml", sha256: "a".repeat(64) },
-      asyncapi: { path: "gateway-pin/asyncapi.yaml", sha256: "b".repeat(64) },
-    },
-    targets,
-  };
-}
-
-/** A pin whose every field is still a placeholder. */
-function placeholderPin() {
-  return {
-    pin_format: 1,
-    repository: "cppalliance/runvil-gateway",
-    tag: PLACEHOLDER,
-    version: PLACEHOLDER,
-    executable: BINARY,
-    min_gateway: PLACEHOLDER,
-    spec: {
-      openapi: { path: "gateway-pin/openapi.yaml", sha256: PLACEHOLDER },
-      asyncapi: { path: "gateway-pin/asyncapi.yaml", sha256: PLACEHOLDER },
-    },
-    targets: Object.fromEntries(
-      TARGETS.map((target) => [target, { asset: PLACEHOLDER, sha256: PLACEHOLDER, size: 0 }]),
-    ),
-  };
-}
-
-/** A pin whose every field is filled, so a consumer may use it. */
-function filledPin() {
-  const pin = pinFor(Buffer.from("unused"));
-  for (const target of TARGETS) {
-    pin["targets"][target] = {
-      asset: `runvil-gateway-${target}.tar.gz`,
-      sha256: "d".repeat(64),
-      size: 10,
-    };
-  }
-  return pin;
-}
-
-/** A temporary repository root holding `pin`, with a download cache beside it. */
-function sandbox(pin = pinFor(releaseArchive())) {
-  const base = mkdtempSync(join(tmpdir(), "runvil-fetch-gateway-"));
-  const root = join(base, "repo");
-  mkdirSync(join(root, "gateway-pin"), { recursive: true });
-  writeFileSync(join(root, "gateway-pin", "pin.json"), renderPin(pin));
-  return { base, root, cache: join(base, "cache") };
-}
-
-function cleanup(base) {
-  rmSync(base, { force: true, recursive: true });
-}
-
-test("stub mode stages a file at Tauri's path without downloading", async () => {
-  const { base, root, cache } = sandbox();
-  try {
-    let downloads = 0;
-    const result = await fetchGatewaySidecar({
-      root,
-      target: LINUX,
-      cacheDir: cache,
-      stub: true,
-      download: async () => {
-        downloads += 1;
-        return Buffer.alloc(0);
-      },
-    });
-    assert.equal(downloads, 0, "the stub path downloads nothing");
-    assert.equal(
-      result.staged,
-      join(root, "crates", "workshop", "desktop", "binaries", "runvil-gateway-x86_64-unknown-linux-gnu"),
-    );
-    assert.ok(existsSync(result.staged));
-    assert.match(readFileSync(result.staged, "utf8"), /not an executable/);
-    assert.equal(result.stub, true);
-    assert.ok(
-      existsSync(`${result.staged}.pinned`),
-      "a stub is marked so the desktop build script leaves it in place",
-    );
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("stub mode needs no pin, so a fresh checkout can compile", async () => {
-  const base = mkdtempSync(join(tmpdir(), "runvil-fetch-gateway-"));
-  try {
-    const result = await fetchGatewaySidecar({
-      root: base,
-      target: WINDOWS,
-      cacheDir: join(base, "cache"),
-      stub: true,
-    });
-    assert.equal(
-      result.staged,
-      join(base, "crates", "workshop", "desktop", "binaries", "runvil-gateway-x86_64-pc-windows-msvc.exe"),
-    );
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("a real fetch verifies the archive, extracts it, and stages it", async () => {
-  const archive = releaseArchive();
-  const { base, root, cache } = sandbox(pinFor(archive));
-  try {
-    const result = await fetchGatewaySidecar({
-      root,
-      target: LINUX,
-      cacheDir: cache,
-      download: async () => archive,
-    });
-    assert.equal(result.downloaded, true);
-    assert.equal(result.tag, "gateway-v0.4.0");
-    assert.equal(readFileSync(result.staged, "utf8"), EXECUTABLE_BYTES);
-    assert.ok(
-      existsSync(`${result.staged}.pinned`),
-      "a verified download is marked so the desktop build script keeps it",
-    );
-    // The archive is cached under the tag, so the next run refetches nothing.
-    assert.ok(existsSync(join(cache, "gateway-v0.4.0", "runvil-gateway-x86_64-unknown-linux-gnu.tar.gz")));
-    let downloads = 0;
-    const second = await fetchGatewaySidecar({
-      root,
-      target: LINUX,
-      cacheDir: cache,
-      download: async () => {
-        downloads += 1;
-        return archive;
-      },
-    });
-    assert.equal(downloads, 0, "the cached archive is reused");
-    assert.equal(second.downloaded, false);
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("a checksum mismatch fails loudly and reports both hashes", async () => {
-  const archive = releaseArchive();
-  const pin = pinFor(archive);
-  pin["targets"][LINUX]["sha256"] = createHash("sha256").update("other").digest("hex");
-  const { base, root, cache } = sandbox(pin);
-  try {
-    await assert.rejects(
-      () => fetchGatewaySidecar({ root, target: LINUX, cacheDir: cache, download: async () => archive }),
-      (error) => {
-        assert.match(error.message, /sha256 is [0-9a-f]{64}, but the pin records [0-9a-f]{64}/);
-        assert.ok(error.message.includes(sha256Hex(archive)), error.message);
-        assert.ok(error.message.includes(pin["targets"][LINUX]["sha256"]), error.message);
-        return true;
-      },
-    );
-    assert.equal(
-      existsSync(join(root, "crates", "workshop", "desktop", "binaries", "runvil-gateway-x86_64-unknown-linux-gnu")),
-      false,
-      "a mismatch stages nothing",
-    );
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("a size mismatch fails before the hash is reported as the problem", () => {
-  const bytes = Buffer.from("payload");
-  assert.throws(
-    () => verifyAsset(bytes, { sha256: sha256Hex(bytes), size: 99 }, "asset.tar.gz"),
-    /is 7 bytes, but the pin records 99 bytes/,
-  );
-});
-
-test("a placeholder pin refuses to fetch and names the fields to fill", async () => {
-  const { base, root, cache } = sandbox(parsePin(renderPin(placeholderPin())));
-  try {
-    await assert.rejects(
-      () => fetchGatewaySidecar({ root, target: LINUX, cacheDir: cache, download: async () => Buffer.alloc(0) }),
-      /still holds placeholders/,
-    );
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("an archive missing the executable names what it expected", async () => {
-  const header = Buffer.alloc(512, 0);
-  header.write("pkg/README.md", 0, 100, "utf8");
-  header.write("0000644\0", 100, "utf8");
-  header.write("0000000\0", 108, "utf8");
-  header.write("0000000\0", 116, "utf8");
-  header.write("00000000003\0", 124, "utf8");
-  header.write("00000000000\0", 136, "utf8");
-  header.write("        ", 148, "utf8");
-  header.write("0", 156, "utf8");
-  const body = Buffer.alloc(512, 0);
-  body.write("abc", 0, "utf8");
-  const archive = gzipSync(Buffer.concat([header, body, Buffer.alloc(1024, 0)]));
-  const { base, root, cache } = sandbox(pinFor(archive));
-  try {
-    await assert.rejects(
-      () => fetchGatewaySidecar({ root, target: LINUX, cacheDir: cache, download: async () => archive }),
-      /holds no runvil-gateway/,
-    );
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("attestation verification calls gh release verify-asset once", async () => {
-  const archive = releaseArchive();
-  const { base, root, cache } = sandbox(pinFor(archive));
-  try {
-    const calls = [];
-    await fetchGatewaySidecar({
-      root,
-      target: LINUX,
-      cacheDir: cache,
-      verifyAttestation: true,
-      download: async () => archive,
-      gh: (args) => {
-        calls.push(args);
-        return "";
-      },
-    });
-    assert.equal(calls.length, 1);
-    assert.deepEqual(calls[0].slice(0, 2), ["release", "verify-asset"]);
-    assert.ok(calls[0].includes("gateway-v0.4.0"));
-    assert.ok(calls[0].includes("cppalliance/runvil-gateway"));
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("attestation is skipped unless asked for", async () => {
-  const archive = releaseArchive();
-  const { base, root, cache } = sandbox(pinFor(archive));
-  try {
-    let calls = 0;
-    await fetchGatewaySidecar({
-      root,
-      target: LINUX,
-      cacheDir: cache,
-      download: async () => archive,
-      gh: () => {
-        calls += 1;
-        return "";
-      },
-    });
-    assert.equal(calls, 0);
-  } finally {
-    cleanup(base);
-  }
-});
-
-test("the placeholder report names every unfilled field and the complete case", () => {
-  const report = placeholderReport(placeholderPin(), { source: "gateway-pin/pin.json" });
-  assert.match(report, /gateway-pin\/pin\.json still has 20 unfilled field/);
-  for (const field of [
-    "tag",
-    "version",
-    "min_gateway",
-    "spec.openapi.sha256",
-    "spec.asyncapi.sha256",
-    "targets.aarch64-unknown-linux-gnu.sha256",
-    "targets.x86_64-pc-windows-msvc.size",
-  ]) {
-    assert.ok(report.includes(field), `${field} missing from:\n${report}`);
-  }
-  assert.equal(placeholderReport(filledPin()), "the Gateway pin is complete");
-});
-
-test("host triple is one of the five released targets or a named refusal", () => {
-  const triple = hostTarget();
-  assert.ok(TARGETS.includes(triple) || triple === "aarch64-pc-windows-msvc", triple);
-});
-
-test("a target the pin does not record is refused before any download", async () => {
-  const { base, root, cache } = sandbox();
-  try {
-    let downloads = 0;
-    await assert.rejects(
-      () =>
-        fetchGatewaySidecar({
-          root,
-          target: "sparc-unknown-linux-gnu",
-          cacheDir: cache,
-          download: async () => {
-            downloads += 1;
-            return Buffer.alloc(0);
-          },
-        }),
-      /unsupported Gateway target sparc-unknown-linux-gnu/,
-    );
-    assert.equal(downloads, 0);
-  } finally {
-    cleanup(base);
-  }
-});
diff --git a/tools/gateway-archive.mjs b/tools/gateway-archive.mjs
deleted file mode 100644
index 71d569474..000000000
--- a/tools/gateway-archive.mjs
+++ /dev/null
@@ -1,245 +0,0 @@
-// Reading one executable out of a release archive.
-//
-// The Gateway's releases are built by cargo-dist, which publishes a zip for
-// Windows and an xz-compressed tar for the macOS and Linux targets. Node
-// ships no tar, zip, or xz reader, and adding a dependency to run one build
-// step is not worth it, so the zip and the gzipped tar are read by hand and
-// the xz tar is handed to the system `tar`, which every platform the
-// Workshop builds on ships: bsdtar on macOS and Windows, GNU tar on Linux.
-// Every other shape is refused by name.
-
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, join } from "node:path";
-import { gunzipSync, inflateRawSync } from "node:zlib";
-
-const TAR_BLOCK = 512;
-const ZIP_LOCAL_HEADER = 0x04034b50;
-const ZIP_CENTRAL_HEADER = 0x02014b50;
-const ZIP_END_OF_CENTRAL_DIRECTORY = 0x06054b50;
-const ZIP_STORED = 0;
-const ZIP_DEFLATED = 8;
-const ZIP64_SENTINEL = 0xffffffff;
-
-/** The archive formats a Gateway release asset may use, by extension. */
-export const ARCHIVE_FORMATS = [".tar.gz", ".tgz", ".tar.xz", ".zip"];
-
-/**
- * Extracts the file named `wanted` (matched on its base name) from `bytes`,
- * choosing the reader by the asset's extension. Returns `null` when the
- * archive holds no such file for the formats read here, so the caller names
- * what it expected. An xz tar reports the same case by throwing, because
- * `tar` treats a member it cannot find as an error rather than an empty
- * answer, and that error already names both the archive and the member.
- */
-export function extractExecutable(assetName, bytes, wanted) {
-  const lower = assetName.toLowerCase();
-  if (lower.endsWith(".zip")) {
-    return extractZip(bytes, wanted);
-  }
-  if (lower.endsWith(".tar.gz") || lower.endsWith(".tgz")) {
-    return extractTarGz(bytes, wanted);
-  }
-  if (lower.endsWith(".tar.xz")) {
-    return extractTarXz(assetName, bytes, wanted);
-  }
-  throw new Error(
-    `unsupported Gateway archive ${assetName}; expected one of ${ARCHIVE_FORMATS.join(", ")}`,
-  );
-}
-
-/** Reads a NUL-terminated string from `buffer` at `offset`, at most `length` bytes. */
-function readString(buffer, offset, length) {
-  const slice = buffer.subarray(offset, offset + length);
-  const end = slice.indexOf(0);
-  return slice.toString("utf8", 0, end === -1 ? slice.length : end);
-}
-
-/** Extracts the file named `wanted` from a gzipped tar archive. */
-export function extractTarGz(bytes, wanted) {
-  const tar = gunzipSync(bytes);
-  let offset = 0;
-  while (offset + TAR_BLOCK <= tar.length) {
-    const header = tar.subarray(offset, offset + TAR_BLOCK);
-    if (header.every((byte) => byte === 0)) {
-      break;
-    }
-    const name = readString(header, 0, 100);
-    const sizeText = readString(header, 124, 12).trim();
-    const size = sizeText === "" ? 0 : Number.parseInt(sizeText, 8);
-    if (!Number.isFinite(size) || size < 0) {
-      throw new Error(`malformed tar header for ${name || "<unnamed>"}`);
-    }
-    const type = header[156] === 0 ? "0" : String.fromCharCode(header[156]);
-    const prefix = readString(header, 345, 155);
-    const full = prefix === "" ? name : `${prefix}/${name}`;
-    offset += TAR_BLOCK;
-    const data = tar.subarray(offset, offset + size);
-    offset += Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
-    // Only regular files carry an executable; "0" is the plain-file type
-    // and a zero byte is what some writers put there instead.
-    if ((type === "0" || type === "7") && basename(full) === wanted) {
-      return Buffer.from(data);
-    }
-  }
-  return null;
-}
-
-/**
- * Extracts the file named `wanted` from an xz-compressed tar archive by
- * running the system `tar`, which reads xz on every platform the Workshop
- * builds on. The bytes go to a temporary file because `tar` reads a file
- * rather than a pipe, and the temporary directory is removed whatever the
- * outcome, so a failure leaves nothing behind.
- *
- * The member is named to `tar` as the exact path it carries, read from a
- * `-tJf` listing first. cargo-dist nests the executable under a release
- * directory, as in `gateway-aarch64-apple-darwin/runvil-gateway`, and a bare
- * base name is not a member path: both bsdtar and GNU tar answer "Not found
- * in archive" for it. A leading `./` is not needed, and the exact path
- * works whether or not the writer stored one.
- */
-export function extractTarXz(assetName, bytes, wanted) {
-  const scratch = mkdtempSync(join(tmpdir(), "runvil-gateway-archive-"));
-  try {
-    const archive = join(scratch, "archive.tar.xz");
-    writeFileSync(archive, bytes);
-    const member = tarMemberPath(archive, assetName, wanted);
-    if (member === null) {
-      throw new Error(`cannot read ${assetName}: the archive holds no ${wanted}`);
-    }
-    const output = join(scratch, "out");
-    mkdirSync(output, { recursive: true });
-    runTar(["-xJf", archive, "-C", output, "--", member], assetName);
-    const extracted = join(output, ...member.split("/"));
-    if (!existsSync(extracted)) {
-      throw new Error(`cannot read ${assetName}: tar reported success but wrote no ${member}`);
-    }
-    return readFileSync(extracted);
-  } finally {
-    rmSync(scratch, { force: true, recursive: true });
-  }
-}
-
-/**
- * The exact path inside `archive` whose base name is `wanted`, or `null`
- * when no member matches. Reads the listing rather than guessing a name,
- * because the writer's member naming is not this module's to assume.
- *
- * A member that would escape the extraction directory is refused: such a
- * path is not an executable to read but an archive to distrust, and reading
- * it would mean trusting the writer's idea of where the file sits.
- */
-function tarMemberPath(archive, assetName, wanted) {
-  const listing = runTar(["-tJf", archive], assetName);
-  for (const line of listing.split(/\r?\n/)) {
-    // A listing ends a directory's path with a slash, and a directory is not
-    // the executable even when its own name matches, so it is skipped rather
-    // than extracted and read as a file.
-    if (line === "" || line.endsWith("/")) {
-      continue;
-    }
-    const member = line.replace(/^\.\//, "");
-    if (basename(member) !== wanted) {
-      continue;
-    }
-    if (member.startsWith("/") || member.split("/").includes("..")) {
-      throw new Error(
-        `cannot read ${assetName}: member ${member} leaves the extraction directory`,
-      );
-    }
-    return member;
-  }
-  return null;
-}
-
-/**
- * Runs `tar` with `args`, refusing a non-zero exit with the archive's name
- * and whatever `tar` wrote to stderr. The arguments are an array and no
- * shell is involved, so a path holding spaces or metacharacters reaches
- * `tar` as a single argument. A missing executable is reported as such,
- * because an absent `tar` is the one environment where this path cannot
- * work.
- */
-function runTar(args, assetName) {
-  // A listing of a release archive is a handful of lines, but the cap is
-  // raised well past the 1 MiB default so a larger archive's `-tJf` listing
-  // cannot truncate into a failed spawn.
-  const result = spawnSync("tar", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-  if (result.error !== undefined && result.error !== null) {
-    if (result.error.code === "ENOENT") {
-      throw new Error(
-        `cannot read ${assetName}: the system tar is not on PATH, and unpacking an ` +
-          "xz-compressed archive needs it",
-      );
-    }
-    throw new Error(`cannot read ${assetName}: could not run tar: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    const detail = (result.stderr ?? "").trim();
-    const ending =
-      result.status === null
-        ? `tar was killed by signal ${result.signal ?? "unknown"}`
-        : `tar exited with status ${result.status}`;
-    throw new Error(
-      `cannot read ${assetName}: ${ending}${detail === "" ? "" : `: ${detail}`}`,
-    );
-  }
-  return result.stdout ?? "";
-}
-
-/** Extracts the file named `wanted` from a zip archive. */
-export function extractZip(bytes, wanted) {
-  const directory = findZipCentralDirectory(bytes);
-  let offset = directory.offset;
-  for (let index = 0; index < directory.count; index += 1) {
-    if (bytes.readUInt32LE(offset) !== ZIP_CENTRAL_HEADER) {
-      throw new Error("malformed zip central directory");
-    }
-    const method = bytes.readUInt16LE(offset + 10);
-    const compressedSize = bytes.readUInt32LE(offset + 20);
-    const nameLength = bytes.readUInt16LE(offset + 28);
-    const extraLength = bytes.readUInt16LE(offset + 30);
-    const commentLength = bytes.readUInt16LE(offset + 32);
-    const localOffset = bytes.readUInt32LE(offset + 42);
-    const name = bytes.toString("utf8", offset + 46, offset + 46 + nameLength);
-    offset += 46 + nameLength + extraLength + commentLength;
-    if (compressedSize === ZIP64_SENTINEL || localOffset === ZIP64_SENTINEL) {
-      throw new Error(`zip64 archives are not supported (${name}); publish a plain zip`);
-    }
-    if (basename(name) !== wanted) {
-      continue;
-    }
-    if (bytes.readUInt32LE(localOffset) !== ZIP_LOCAL_HEADER) {
-      throw new Error(`malformed zip local header for ${name}`);
-    }
-    const localNameLength = bytes.readUInt16LE(localOffset + 26);
-    const localExtraLength = bytes.readUInt16LE(localOffset + 28);
-    const dataStart = localOffset + 30 + localNameLength + localExtraLength;
-    const data = bytes.subarray(dataStart, dataStart + compressedSize);
-    if (method === ZIP_STORED) {
-      return Buffer.from(data);
-    }
-    if (method === ZIP_DEFLATED) {
-      return inflateRawSync(data);
-    }
-    throw new Error(`unsupported zip compression method ${method} for ${name}`);
-  }
-  return null;
-}
-
-/** Locates the zip end-of-central-directory record and the directory it points at. */
-function findZipCentralDirectory(bytes) {
-  const lowest = Math.max(0, bytes.length - 22 - 0xffff);
-  for (let offset = bytes.length - 22; offset >= lowest; offset -= 1) {
-    if (bytes.readUInt32LE(offset) !== ZIP_END_OF_CENTRAL_DIRECTORY) {
-      continue;
-    }
-    return {
-      count: bytes.readUInt16LE(offset + 10),
-      offset: bytes.readUInt32LE(offset + 16),
-    };
-  }
-  throw new Error("not a zip archive: no end-of-central-directory record");
-}
diff --git a/tools/gateway-archive.test.mjs b/tools/gateway-archive.test.mjs
deleted file mode 100644
index ade1bc261..000000000
--- a/tools/gateway-archive.test.mjs
+++ /dev/null
@@ -1,211 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-import { gzipSync } from "node:zlib";
-
-import {
-  ARCHIVE_FORMATS,
-  extractExecutable,
-  extractTarGz,
-  extractTarXz,
-  extractZip,
-} from "./gateway-archive.mjs";
-
-const BLOCK = 512;
-
-/** One tar header block for a regular file of `size` bytes. */
-function tarHeader(name, size) {
-  const header = Buffer.alloc(BLOCK, 0);
-  header.write(name, 0, 100, "utf8");
-  header.write("0000644\0", 100, "utf8");
-  header.write("0000000\0", 108, "utf8");
-  header.write("0000000\0", 116, "utf8");
-  header.write(`${size.toString(8).padStart(11, "0")}\0`, 124, "utf8");
-  header.write("00000000000\0", 136, "utf8");
-  header.write("        ", 148, "utf8");
-  header.write("0", 156, "utf8");
-  header.write("ustar\0", 257, "utf8");
-  header.write("00", 263, "utf8");
-  return header;
-}
-
-/** A gzipped tar archive holding `files`, each `{ name, content }`. */
-function tarGz(files) {
-  const blocks = [];
-  for (const file of files) {
-    const body = Buffer.from(file.content, "utf8");
-    blocks.push(tarHeader(file.name, body.length));
-    const padded = Buffer.alloc(Math.ceil(body.length / BLOCK) * BLOCK, 0);
-    body.copy(padded);
-    blocks.push(padded);
-  }
-  blocks.push(Buffer.alloc(BLOCK * 2, 0));
-  return gzipSync(Buffer.concat(blocks));
-}
-
-/** A stored (uncompressed) zip archive holding `files`. */
-function storedZip(files) {
-  const locals = [];
-  const central = [];
-  let offset = 0;
-  for (const file of files) {
-    const body = Buffer.from(file.content, "utf8");
-    const name = Buffer.from(file.name, "utf8");
-    const local = Buffer.alloc(30, 0);
-    local.writeUInt32LE(0x04034b50, 0);
-    local.writeUInt16LE(20, 4);
-    local.writeUInt32LE(0, 14);
-    local.writeUInt32LE(body.length, 18);
-    local.writeUInt32LE(body.length, 22);
-    local.writeUInt16LE(name.length, 26);
-    locals.push(local, name, body);
-    const entry = Buffer.alloc(46, 0);
-    entry.writeUInt32LE(0x02014b50, 0);
-    entry.writeUInt16LE(20, 4);
-    entry.writeUInt16LE(20, 6);
-    entry.writeUInt32LE(0, 16);
-    entry.writeUInt32LE(body.length, 20);
-    entry.writeUInt32LE(body.length, 24);
-    entry.writeUInt16LE(name.length, 28);
-    entry.writeUInt32LE(offset, 42);
-    central.push(entry, name);
-    offset += 30 + name.length + body.length;
-  }
-  const directory = Buffer.concat(central);
-  const localBytes = Buffer.concat(locals);
-  const end = Buffer.alloc(22, 0);
-  end.writeUInt32LE(0x06054b50, 0);
-  end.writeUInt16LE(files.length, 8);
-  end.writeUInt16LE(files.length, 10);
-  end.writeUInt32LE(directory.length, 12);
-  end.writeUInt32LE(localBytes.length, 16);
-  return Buffer.concat([localBytes, directory, end]);
-}
-
-/**
- * A temporary directory, removed when `body` returns. The xz fixtures are
- * built by the system `tar`, because Node cannot write xz and the reader
- * under test is `tar` itself.
- */
-function withScratch(body) {
-  const base = mkdtempSync(join(tmpdir(), "runvil-archive-test-"));
-  try {
-    return body(base);
-  } finally {
-    rmSync(base, { force: true, recursive: true });
-  }
-}
-
-/** Runs `tar` in `cwd`, failing the test with its stderr when it fails. */
-function tar(cwd, args) {
-  const result = spawnSync("tar", args, { cwd, encoding: "utf8" });
-  assert.equal(
-    result.status,
-    0,
-    `tar ${args.join(" ")} failed: ${result.error?.message ?? result.stderr}`,
-  );
-  return result.stdout;
-}
-
-/** An xz-compressed tar of `names` under `base`, each file holding its base name. */
-function tarXz(base, names) {
-  for (const name of names) {
-    const path = join(base, ...name.split("/"));
-    mkdirSync(join(path, ".."), { recursive: true });
-    writeFileSync(path, name.split("/").at(-1));
-  }
-  tar(base, ["-cJf", "fixture.tar.xz", "--", ...names]);
-  return readFileSync(join(base, "fixture.tar.xz"));
-}
-
-test("reads the executable out of a gzipped tar by its base name", () => {
-  const bytes = tarGz([
-    { name: "runvil-gateway-x86_64-unknown-linux-gnu/README.md", content: "read me" },
-    { name: "runvil-gateway-x86_64-unknown-linux-gnu/runvil-gateway", content: "ELF" },
-  ]);
-  assert.equal(extractTarGz(bytes, "runvil-gateway").toString("utf8"), "ELF");
-});
-
-test("reads the executable out of a zip by its base name", () => {
-  const bytes = storedZip([
-    { name: "runvil-gateway-x86_64-pc-windows-msvc/LICENSE", content: "license" },
-    { name: "runvil-gateway-x86_64-pc-windows-msvc/runvil-gateway.exe", content: "MZ" },
-  ]);
-  assert.equal(extractZip(bytes, "runvil-gateway.exe").toString("utf8"), "MZ");
-});
-
-test("an archive without the executable reports nothing rather than a guess", () => {
-  const bytes = tarGz([{ name: "pkg/README.md", content: "read me" }]);
-  assert.equal(extractTarGz(bytes, "runvil-gateway"), null);
-  assert.equal(extractZip(storedZip([{ name: "a.txt", content: "x" }]), "runvil-gateway"), null);
-});
-
-test("the extension picks the reader", () => {
-  const tar = tarGz([{ name: "b/runvil-gateway", content: "bin" }]);
-  assert.equal(extractExecutable("x.tar.gz", tar, "runvil-gateway").toString(), "bin");
-  assert.equal(extractExecutable("x.tgz", tar, "runvil-gateway").toString(), "bin");
-  const zip = storedZip([{ name: "b/runvil-gateway.exe", content: "bin" }]);
-  assert.equal(extractExecutable("x.zip", zip, "runvil-gateway.exe").toString(), "bin");
-});
-
-test("an unsupported archive extension is refused by name", () => {
-  assert.throws(() => extractExecutable("x.7z", Buffer.alloc(0), "runvil-gateway"), /unsupported Gateway archive x\.7z/);
-  assert.deepEqual(ARCHIVE_FORMATS, [".tar.gz", ".tgz", ".tar.xz", ".zip"]);
-});
-
-test("reads the executable out of an xz tar and ignores a decoy", () => {
-  withScratch((base) => {
-    // A directory whose own name matches the wanted file, at a different
-    // path: a listing ends it with a slash, and a matcher that trimmed the
-    // slash would pick it and then fail to read it as a file.
-    mkdirSync(join(base, "gateway-extras", "runvil-gateway"), { recursive: true });
-    const bytes = tarXz(base, [
-      "gateway-aarch64-apple-darwin/README.md",
-      "gateway-extras/runvil-gateway/decoy.txt",
-      "gateway-aarch64-apple-darwin/runvil-gateway.bak",
-      "gateway-aarch64-apple-darwin/runvil-gateway",
-    ]);
-    const extracted = extractTarXz("gateway-aarch64-apple-darwin.tar.xz", bytes, "runvil-gateway");
-    assert.equal(extracted.toString("utf8"), "runvil-gateway");
-    assert.equal(
-      extractExecutable("gateway-aarch64-apple-darwin.tar.xz", bytes, "runvil-gateway").toString("utf8"),
-      "runvil-gateway",
-    );
-  });
-});
-
-test("an xz tar without the wanted member throws and names both", () => {
-  withScratch((base) => {
-    const bytes = tarXz(base, ["gateway-x86_64-unknown-linux-gnu/README.md"]);
-    assert.throws(
-      () => extractTarXz("gateway-x86_64-unknown-linux-gnu.tar.xz", bytes, "runvil-gateway"),
-      (error) => {
-        assert.match(error.message, /gateway-x86_64-unknown-linux-gnu\.tar\.xz/);
-        assert.match(error.message, /runvil-gateway/);
-        return true;
-      },
-    );
-  });
-});
-
-test("a corrupt xz tar throws instead of returning empty bytes", () => {
-  withScratch((base) => {
-    const bytes = tarXz(base, ["pkg/runvil-gateway"]);
-    const truncated = bytes.subarray(0, bytes.length - 64);
-    assert.throws(
-      () => extractTarXz("gateway.tar.xz", truncated, "runvil-gateway"),
-      /cannot read gateway\.tar\.xz: tar exited with status \d+/,
-    );
-    assert.throws(
-      () => extractTarXz("gateway.tar.xz", Buffer.from("not an xz archive at all"), "runvil-gateway"),
-      /cannot read gateway\.tar\.xz: tar exited with status \d+/,
-    );
-  });
-});
-
-test("a non-zip buffer is refused rather than read as garbage", () => {
-  assert.throws(() => extractZip(Buffer.alloc(64, 7), "runvil-gateway.exe"), /not a zip archive/);
-});
diff --git a/tools/gateway-pin.mjs b/tools/gateway-pin.mjs
deleted file mode 100644
index 800a488d7..000000000
--- a/tools/gateway-pin.mjs
+++ /dev/null
@@ -1,241 +0,0 @@
-// The Gateway pin: the one file that records the release Workshop obtains
-// its sidecar from, plus the checksums that prove the bytes.
-//
-// Two scripts read it. `fetch-gateway-sidecar.mjs` downloads one target's
-// asset and verifies it against the recorded sha256; `bump-gateway.mjs`
-// rewrites it from a published release. Both refuse a placeholder: a pin
-// that names nothing must fail loudly, because a silent empty download
-// would ship a Workshop without its Gateway.
-//
-// The `spec` object may hold no entry. The Gateway repository publishes no
-// OpenAPI or AsyncAPI document with its releases, so a pin for those
-// releases records none, and an absent entry is a complete pin. An entry
-// that is present must carry a path and a real hash.
-
-import { readFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const REPOSITORY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-/** The directory holding the pin and the committed spec copies. */
-export const PIN_DIRECTORY = "gateway-pin";
-
-/** The pin's file name inside {@link PIN_DIRECTORY}. */
-export const PIN_FILE_NAME = "pin.json";
-
-/** The value that marks a field nobody has filled in yet. */
-export const PLACEHOLDER = "PLACEHOLDER";
-
-/** Every target triple a Gateway release must publish. */
-export const TARGETS = [
-  "x86_64-pc-windows-msvc",
-  "aarch64-apple-darwin",
-  "x86_64-apple-darwin",
-  "x86_64-unknown-linux-gnu",
-  "aarch64-unknown-linux-gnu",
-];
-
-/** The repository that publishes Gateway releases. */
-export const DEFAULT_RELEASE_REPOSITORY = "cppalliance/runvil-gateway";
-
-/** The spec keys a pin may record. A release publishes none of them today. */
-export const SPEC_KEYS = ["openapi", "asyncapi"];
-
-/** The absolute path of the pin file for the repository at `root`. */
-export function pinPath(root = REPOSITORY_ROOT) {
-  return join(root, PIN_DIRECTORY, PIN_FILE_NAME);
-}
-
-/** The absolute path of one committed spec copy for the repository at `root`. */
-export function specPath(root = REPOSITORY_ROOT, name) {
-  return join(root, PIN_DIRECTORY, name);
-}
-
-function requireObject(value, field, source) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${source}: ${field} must be a JSON object`);
-  }
-  return value;
-}
-
-function requireString(value, field, source) {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error(`${source}: ${field} must be a non-empty string`);
-  }
-  return value;
-}
-
-function requireNumber(value, field, source) {
-  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
-    throw new Error(`${source}: ${field} must be a non-negative integer`);
-  }
-  return value;
-}
-
-/**
- * Parses and shape-checks pin text. Shape checks only: a placeholder
- * value passes here and is refused later by the consumer that would have
- * used it, so a fresh pin stays readable while nobody can fetch from it.
- *
- * A spec entry may be absent. The Gateway repository publishes no spec, so
- * a pin for its releases records none, and an absent entry says exactly
- * that. An entry that is present must carry a path and a hash: a half
- * entry would read as a spec nobody can verify.
- */
-export function parsePin(text, source = PIN_FILE_NAME) {
-  let pin;
-  try {
-    pin = JSON.parse(text);
-  } catch (error) {
-    throw new Error(`${source}: not valid JSON: ${error.message}`);
-  }
-  requireObject(pin, "the pin", source);
-  if (pin["pin_format"] !== 1) {
-    throw new Error(`${source}: pin_format must be 1, got ${JSON.stringify(pin["pin_format"])}`);
-  }
-  requireString(pin["repository"], "repository", source);
-  requireString(pin["tag"], "tag", source);
-  requireString(pin["version"], "version", source);
-  requireString(pin["executable"], "executable", source);
-  requireString(pin["min_gateway"], "min_gateway", source);
-  const spec = requireObject(pin["spec"], "spec", source);
-  for (const name of SPEC_KEYS) {
-    const entry = spec[name];
-    if (entry === undefined) {
-      continue;
-    }
-    requireObject(entry, `spec.${name}`, source);
-    requireString(entry["path"], `spec.${name}.path`, source);
-    requireString(entry["sha256"], `spec.${name}.sha256`, source);
-  }
-  for (const name of Object.keys(spec)) {
-    if (!SPEC_KEYS.includes(name)) {
-      throw new Error(`${source}: spec.${name} is not one of ${SPEC_KEYS.join(", ")}`);
-    }
-  }
-  const targets = requireObject(pin["targets"], "targets", source);
-  for (const target of TARGETS) {
-    const entry = requireObject(targets[target], `targets.${target}`, source);
-    requireString(entry["asset"], `targets.${target}.asset`, source);
-    requireString(entry["sha256"], `targets.${target}.sha256`, source);
-    requireNumber(entry["size"], `targets.${target}.size`, source);
-  }
-  for (const target of Object.keys(targets)) {
-    if (!TARGETS.includes(target)) {
-      throw new Error(`${source}: targets.${target} is not one of the five release targets`);
-    }
-  }
-  return pin;
-}
-
-/** Reads and shape-checks the pin file of the repository at `root`. */
-export function readPin(root = REPOSITORY_ROOT) {
-  const path = pinPath(root);
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch (error) {
-    throw new Error(`cannot read the Gateway pin at ${path}: ${error.message}`);
-  }
-  return parsePin(text, path);
-}
-
-/** Renders a pin canonically: two-space indent and a trailing newline. */
-export function renderPin(pin) {
-  return `${JSON.stringify(pin, null, 2)}\n`;
-}
-
-/** One target's entry, refusing a triple the pin does not record. */
-export function targetEntry(pin, target) {
-  const entry = pin["targets"]?.[target];
-  if (entry === undefined) {
-    throw new Error(
-      `the Gateway pin records no target ${target}; recorded: ${Object.keys(pin["targets"] ?? {}).join(", ")}`,
-    );
-  }
-  return entry;
-}
-
-/**
- * Every field of `pin` that is still a placeholder, as dotted paths. An
- * empty list means the pin names a release a consumer may use.
- *
- * An absent spec entry is not a placeholder. The Gateway repository
- * publishes no spec, so a pin for its releases records none, and that is a
- * complete pin. An entry that is present and still holds `PLACEHOLDER` is
- * reported, because a half-filled spec would read as a hash nobody checked.
- */
-export function placeholderFields(pin) {
-  const found = [];
-  for (const field of ["tag", "version", "min_gateway"]) {
-    if (pin[field] === PLACEHOLDER) {
-      found.push(field);
-    }
-  }
-  for (const name of SPEC_KEYS) {
-    const entry = pin["spec"]?.[name];
-    if (entry === undefined) {
-      continue;
-    }
-    for (const field of ["path", "sha256"]) {
-      if (entry[field] === PLACEHOLDER) {
-        found.push(`spec.${name}.${field}`);
-      }
-    }
-  }
-  for (const [target, entry] of Object.entries(pin["targets"] ?? {})) {
-    if (entry.asset === PLACEHOLDER) {
-      found.push(`targets.${target}.asset`);
-    }
-    if (entry.sha256 === PLACEHOLDER) {
-      found.push(`targets.${target}.sha256`);
-    }
-    if (entry.size === 0) {
-      found.push(`targets.${target}.size`);
-    }
-  }
-  return found;
-}
-
-/**
- * Refuses a pin a consumer cannot use, naming the file and every field
- * still to fill in. `target` narrows the refusal to the fields that
- * target's download needs, so a half-filled pin fails only where it must.
- */
-export function requireFilledPin(pin, { source = PIN_FILE_NAME, target } = {}) {
-  let missing = placeholderFields(pin);
-  if (target !== undefined) {
-    missing = missing.filter(
-      (field) => !field.startsWith("targets.") || field.startsWith(`targets.${target}.`),
-    );
-  }
-  if (missing.length > 0) {
-    throw new Error(
-      `${source} still holds placeholders (${missing.join(", ")}); ` +
-        "run `node tools/bump-gateway.mjs <tag>` against a published Gateway release",
-    );
-  }
-}
-
-/**
- * A reader-facing report of every field still to fill in, or a sentence
- * saying the pin is complete. `tools/fetch-gateway-sidecar.mjs` prints this
- * when a person runs it before the pin is filled, so the failure names the
- * work rather than only the symptom.
- */
-export function placeholderReport(pin, { source = PIN_FILE_NAME } = {}) {
-  const fields = placeholderFields(pin);
-  if (fields.length === 0) {
-    return "the Gateway pin is complete";
-  }
-  return [
-    `${source} still has ${fields.length} unfilled field(s):`,
-    ...fields.map((field) => `  ${field}`),
-  ].join("\n");
-}
-
-/** The release download URL of one asset. */
-export function releaseAssetUrl(pin, asset) {
-  return `https://github.com/${pin["repository"]}/releases/download/${pin["tag"]}/${asset}`;
-}
diff --git a/tools/gateway-pin.test.mjs b/tools/gateway-pin.test.mjs
deleted file mode 100644
index 87c948575..000000000
--- a/tools/gateway-pin.test.mjs
+++ /dev/null
@@ -1,179 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-
-import {
-  PIN_DIRECTORY,
-  PLACEHOLDER,
-  TARGETS,
-  parsePin,
-  placeholderFields,
-  readPin,
-  releaseAssetUrl,
-  renderPin,
-  requireFilledPin,
-  specPath,
-  targetEntry,
-} from "./gateway-pin.mjs";
-
-const WINDOWS = "x86_64-pc-windows-msvc";
-const LINUX = "x86_64-unknown-linux-gnu";
-
-/** A filled pin: every field a consumer reads names a real release. */
-function filledPin() {
-  const targets = {};
-  for (const target of TARGETS) {
-    targets[target] = {
-      asset: `runvil-gateway-${target}.tar.gz`,
-      sha256: "a".repeat(64),
-      size: 1234,
-    };
-  }
-  return {
-    pin_format: 1,
-    repository: "cppalliance/runvil-gateway",
-    tag: "gateway-v0.4.0",
-    version: "0.4.0",
-    executable: "runvil-gateway",
-    min_gateway: "0.4.0",
-    spec: {
-      openapi: { path: "gateway-pin/openapi.yaml", sha256: "b".repeat(64) },
-      asyncapi: { path: "gateway-pin/asyncapi.yaml", sha256: "c".repeat(64) },
-    },
-    targets,
-  };
-}
-
-/** The committed pin, read once: the repository's real file. */
-function committedPin() {
-  return readPin();
-}
-
-/** A temporary repository root holding `pin` at the pin path. */
-function repositoryWith(pin) {
-  const root = mkdtempSync(join(tmpdir(), "runvil-gateway-pin-"));
-  mkdirSync(join(root, PIN_DIRECTORY), { recursive: true });
-  writeFileSync(join(root, PIN_DIRECTORY, "pin.json"), renderPin(pin));
-  return root;
-}
-
-test("the committed pin records all five release targets", () => {
-  const pin = committedPin();
-  assert.deepEqual(Object.keys(pin["targets"]).sort(), [...TARGETS].sort());
-  assert.equal(pin["executable"], "runvil-gateway");
-});
-
-test("the committed pin is complete and names a published release", () => {
-  const pin = committedPin();
-  assert.deepEqual(placeholderFields(pin), []);
-  assert.equal(requireFilledPin(pin, { source: "gateway-pin/pin.json" }), undefined);
-});
-
-test("a pin with no spec entry is complete, because the release publishes none", () => {
-  const pin = filledPin();
-  pin["spec"] = {};
-  assert.deepEqual(placeholderFields(pin), []);
-  assert.equal(requireFilledPin(pin, { source: "gateway-pin/pin.json" }), undefined);
-});
-
-test("a spec entry that still holds a placeholder is refused by name", () => {
-  const pin = filledPin();
-  pin["spec"]["openapi"]["sha256"] = PLACEHOLDER;
-  assert.deepEqual(placeholderFields(pin), ["spec.openapi.sha256"]);
-  assert.throws(() => requireFilledPin(pin, { source: "gateway-pin/pin.json" }), /spec\.openapi\.sha256/);
-});
-
-test("a placeholder pin is refused by name, not fetched", () => {
-  const pin = filledPin();
-  pin["tag"] = PLACEHOLDER;
-  pin["min_gateway"] = PLACEHOLDER;
-  pin["targets"][WINDOWS] = { asset: PLACEHOLDER, sha256: PLACEHOLDER, size: 0 };
-  assert.throws(
-    () => requireFilledPin(pin, { source: "gateway-pin/pin.json" }),
-    /still holds placeholders/,
-  );
-});
-
-test("a target-scoped refusal names only that target's unfilled fields", () => {
-  const pin = filledPin();
-  pin["targets"][WINDOWS]["sha256"] = PLACEHOLDER;
-  assert.equal(requireFilledPin(pin, { target: LINUX }), undefined);
-  assert.throws(() => requireFilledPin(pin, { target: WINDOWS }), /targets\.x86_64-pc-windows-msvc\.sha256/);
-});
-
-test("a filled pin passes the refusal", () => {
-  assert.equal(requireFilledPin(filledPin(), { target: WINDOWS }), undefined);
-  assert.deepEqual(placeholderFields(filledPin()), []);
-});
-
-test("parsing rejects an unknown pin format", () => {
-  const text = renderPin({ ...filledPin(), pin_format: 2 });
-  assert.throws(() => parsePin(text, "pin.json"), /pin_format must be 1/);
-});
-
-test("parsing rejects a missing target", () => {
-  const pin = filledPin();
-  delete pin["targets"][LINUX];
-  assert.throws(() => parsePin(renderPin(pin), "pin.json"), /targets\.x86_64-unknown-linux-gnu/);
-});
-
-test("parsing rejects a target outside the five released triples", () => {
-  const pin = filledPin();
-  pin["targets"]["aarch64-pc-windows-msvc"] = {
-    asset: "x",
-    sha256: "d".repeat(64),
-    size: 1,
-  };
-  assert.throws(() => parsePin(renderPin(pin), "pin.json"), /not one of the five release targets/);
-});
-
-test("parsing rejects a negative size rather than trusting it", () => {
-  const pin = filledPin();
-  pin["targets"][LINUX]["size"] = -1;
-  assert.throws(() => parsePin(renderPin(pin), "pin.json"), /size must be a non-negative integer/);
-});
-
-test("an unknown target triple is refused by name", () => {
-  assert.throws(() => targetEntry(filledPin(), "sparc-unknown-linux-gnu"), /records no target/);
-});
-
-test("rendering is canonical, so a rewrite only changes what changed", () => {
-  const pin = filledPin();
-  const rendered = renderPin(pin);
-  assert.ok(rendered.endsWith("}\n"));
-  assert.equal(renderPin(JSON.parse(rendered)), rendered);
-});
-
-test("the release URL names the pinned tag and asset", () => {
-  assert.equal(
-    releaseAssetUrl(filledPin(), "runvil-gateway-aarch64-apple-darwin.tar.gz"),
-    "https://github.com/cppalliance/runvil-gateway/releases/download/gateway-v0.4.0/runvil-gateway-aarch64-apple-darwin.tar.gz",
-  );
-});
-
-test("reading a repository's pin finds the file under gateway-pin", () => {
-  const root = repositoryWith(filledPin());
-  try {
-    const pin = readPin(root);
-    assert.equal(pin["tag"], "gateway-v0.4.0");
-    assert.equal(specPath(root, "openapi.yaml"), join(root, "gateway-pin", "openapi.yaml"));
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("a missing pin file reports the path it looked at", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-gateway-pin-"));
-  try {
-    assert.throws(() => readPin(root), /cannot read the Gateway pin at .*pin\.json/);
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("the committed pin records no spec, because the release publishes none", () => {
-  const pin = committedPin();
-  assert.deepEqual(pin["spec"], {}, "the Gateway repository publishes no spec to record");
-});
\ No newline at end of file
diff --git a/tools/gateway-tts-live.mjs b/tools/gateway-tts-live.mjs
deleted file mode 100644
index dd17ac925..000000000
--- a/tools/gateway-tts-live.mjs
+++ /dev/null
@@ -1,449 +0,0 @@
-// Live probe for the gateway speech surface. Dev-only; never in CI.
-//
-// Always builds the gateway first (`cargo build -p gateway`), so a stale
-// binary can never be probed against a recorded current commit. Boots the
-// fresh binary on an ephemeral loopback port with a throwaway
-// Together-backed profile and asserts the speech and voices surfaces
-// through the gateway's own responses.
-//
-// Invariant A19: the script never calls a vendor directly. The vendor key
-// comes from the process environment only (no dotenv parsing, no .env
-// reading) and is ferried only to the gateway subprocess environment; the
-// throwaway config contains the `api_key = "${TOGETHER_API_KEY}"`
-// interpolation reference. The key is never printed and never written to
-// any file by this script.
-//
-// Usage: `node tools/gateway-tts-live.mjs`. Exit 0 on skip (no key in the
-// environment) or when every assertion passes, 1 otherwise.
-
-import { spawn, spawnSync } from "node:child_process";
-import {
-  closeSync,
-  existsSync,
-  mkdtempSync,
-  openSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { createServer } from "node:net";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const REPOSITORY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-const KEY_ENV_VAR = "TOGETHER_API_KEY";
-const TOGETHER_MODEL = "canopylabs/orpheus-3b-0.1-ft";
-const GATEWAY_MODEL = "orpheus";
-const PROFILE_NAME = "tts-live";
-const VOICES = ["tara", "leah", "jess", "leo", "dan", "mia", "zac", "zoe"];
-// Local-only shared secret for the throwaway config's [server] api_key; not
-// a real credential, never leaves the loopback listener.
-const GATEWAY_KEY = "tts-live-throwaway-local-key";
-const PROBE_TEXT =
-  "Runvil gateway live probe: the quick brown fox jumps over the lazy dog.";
-const EMOTION_TEXT =
-  "Angle-bracket emotion tags must reach the provider untouched. <laugh>";
-const READY_TIMEOUT_MS = 90_000;
-const READY_POLL_MS = 250;
-const CALL_TIMEOUT_MS = 180_000;
-const STOP_GRACE_MS = 10_000;
-const LOG_TAIL_CHARS = 2_000;
-
-function sleep(ms) {
-  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
-}
-
-export function renderConfig({ port }) {
-  const voices = VOICES.map((voice) => JSON.stringify(voice)).join(", ");
-  return `config-version = 0
-
-[server]
-bind = "127.0.0.1:${port}"
-api_key = "${GATEWAY_KEY}"
-
-[[endpoint]]
-id = "together"
-protocol = "openai"
-base_url = "https://api.together.xyz/v1"
-api_key = "\${TOGETHER_API_KEY}"
-
-[[model]]
-name = "${GATEWAY_MODEL}"
-kind = "speech"
-description = "Orpheus 3B conversational speech synthesis (live probe)"
-upstream = "${TOGETHER_MODEL}"
-endpoints = ["together"]
-context = 8192
-voices = [${voices}]
-
-[[profile]]
-name = "${PROFILE_NAME}"
-models = ["${GATEWAY_MODEL}"]
-`;
-}
-
-function gatewayBinaryPath(repo) {
-  const name =
-    process.platform === "win32" ? "runvil-gateway.exe" : "runvil-gateway";
-  return join(repo, "target", "debug", name);
-}
-
-function buildGateway({ repo }) {
-  const result = spawnSync("cargo", ["build", "-p", "gateway"], {
-    cwd: repo,
-    stdio: "inherit",
-  });
-  if (result.error) {
-    throw result.error;
-  }
-  if (result.status !== 0) {
-    throw new Error(`cargo build -p gateway exited with status ${result.status}`);
-  }
-}
-
-function spawnGatewayBinary({ binary, configPath, profile, env, logPath }) {
-  const logFd = openSync(logPath, "a");
-  try {
-    return spawn(
-      binary,
-      ["--config", configPath, "--profile", profile, "--no-tray"],
-      { env, stdio: ["ignore", logFd, logFd] },
-    );
-  } finally {
-    closeSync(logFd);
-  }
-}
-
-function freePort() {
-  return new Promise((resolvePort, reject) => {
-    const probe = createServer();
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const { port } = probe.address();
-      probe.close(() => resolvePort(port));
-    });
-  });
-}
-
-function logTail(logPath) {
-  try {
-    return readFileSync(logPath, "utf8").slice(-LOG_TAIL_CHARS);
-  } catch {
-    return "<no gateway log>";
-  }
-}
-
-async function waitReady({ port, proc, fetchImpl, timeoutMs, pollMs, readTail }) {
-  const deadline = Date.now() + timeoutMs;
-  const url = `http://127.0.0.1:${port}/v1/models`;
-  while (Date.now() < deadline) {
-    if (proc.exitCode !== null || proc.signalCode !== null) {
-      throw new Error(
-        `gateway exited during boot (code ${proc.exitCode ?? proc.signalCode}); log tail:\n${readTail()}`,
-      );
-    }
-    try {
-      const response = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${GATEWAY_KEY}` },
-        signal: AbortSignal.timeout(2_000),
-      });
-      if (response.status === 200) {
-        return;
-      }
-    } catch {
-      // Not up yet: connection refused or a timed-out poll attempt.
-    }
-    await sleep(pollMs);
-  }
-  throw new Error(
-    `gateway did not serve within ${Math.round(timeoutMs / 1000)}s; log tail:\n${readTail()}`,
-  );
-}
-
-async function stopGateway(proc) {
-  if (proc.exitCode !== null || proc.signalCode !== null) {
-    return;
-  }
-  const exited = new Promise((resolveExit) =>
-    proc.once("exit", () => resolveExit(true)),
-  );
-  proc.kill("SIGTERM");
-  const graceful = await Promise.race([
-    exited,
-    sleep(STOP_GRACE_MS).then(() => false),
-  ]);
-  if (graceful || proc.exitCode !== null || proc.signalCode !== null) {
-    return;
-  }
-  proc.kill("SIGKILL");
-  await Promise.race([exited, sleep(STOP_GRACE_MS)]);
-}
-
-async function speechCreate({ baseUrl, body, fetchImpl, timeoutMs }) {
-  try {
-    const response = await fetchImpl(`${baseUrl}/audio/speech`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${GATEWAY_KEY}`,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    const audio = Buffer.from(await response.arrayBuffer());
-    return {
-      ok: response.ok,
-      status: response.status,
-      contentType: response.headers.get("content-type") ?? "",
-      transferEncoding: response.headers.get("transfer-encoding") ?? "",
-      contentLength: response.headers.get("content-length") ?? "",
-      bytes: audio.length,
-      body: audio,
-    };
-  } catch (error) {
-    return { ok: false, status: null, error: String(error).slice(0, 300) };
-  }
-}
-
-async function voicesCall({ baseUrl, fetchImpl, timeoutMs }) {
-  try {
-    const response = await fetchImpl(`${baseUrl}/audio/voices`, {
-      headers: { authorization: `Bearer ${GATEWAY_KEY}` },
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    let payload = null;
-    try {
-      payload = await response.json();
-    } catch {
-      payload = null;
-    }
-    return { ok: response.ok, status: response.status, json: payload };
-  } catch {
-    return { ok: false, status: null, json: null };
-  }
-}
-
-function isMp3(body) {
-  return (
-    body.subarray(0, 3).toString("latin1") === "ID3" ||
-    (body.length > 1 && body[0] === 0xff && (body[1] & 0xe0) === 0xe0)
-  );
-}
-
-function isWav(body) {
-  return (
-    body.length > 11 &&
-    body.subarray(0, 4).toString("latin1") === "RIFF" &&
-    body.subarray(8, 12).toString("latin1") === "WAVE"
-  );
-}
-
-function describeSpeech(result) {
-  if (!result.ok) {
-    return `status=${result.status} error=${JSON.stringify(result.error ?? "")}`;
-  }
-  return (
-    `status=${result.status} content-type=${JSON.stringify(result.contentType)} ` +
-    `transfer-encoding=${JSON.stringify(result.transferEncoding)} ` +
-    `content-length=${JSON.stringify(result.contentLength)} ` +
-    `bytes=${result.bytes} magic=${result.body.subarray(0, 4).toString("hex")}`
-  );
-}
-
-function createReporter(log) {
-  const failures = [];
-  return {
-    failures,
-    check(label, condition, detail) {
-      log(`${condition ? "PASS" : "FAIL"} ${label}: ${detail}`);
-      if (!condition) {
-        failures.push(label);
-      }
-    },
-    observe(label, detail) {
-      log(`NOTE ${label}: ${detail}`);
-    },
-  };
-}
-
-async function runSpeechSurface({
-  baseUrl,
-  model,
-  fetchImpl,
-  callTimeoutMs,
-  reporter,
-}) {
-  const call = (body) =>
-    speechCreate({ baseUrl, body, fetchImpl, timeoutMs: callTimeoutMs });
-
-  const defaultCall = await call({ model, voice: "tara", input: PROBE_TEXT });
-  reporter.observe("speech default format", describeSpeech(defaultCall));
-  reporter.check(
-    "default format is mp3",
-    defaultCall.ok &&
-      defaultCall.contentType.split(";")[0].trim() === "audio/mpeg" &&
-      defaultCall.bytes > 0 &&
-      isMp3(defaultCall.body),
-    describeSpeech(defaultCall),
-  );
-  reporter.check(
-    "default response is streamed",
-    defaultCall.ok && defaultCall.contentLength === "",
-    `content-length=${JSON.stringify(defaultCall.contentLength ?? "")} ` +
-      `transfer-encoding=${JSON.stringify(defaultCall.transferEncoding ?? "")}`,
-  );
-
-  const wav = await call({
-    model,
-    voice: "tara",
-    input: PROBE_TEXT,
-    response_format: "wav",
-  });
-  reporter.observe("speech wav", describeSpeech(wav));
-  reporter.check(
-    "wav format maps to audio/wav with a RIFF body",
-    wav.ok &&
-      wav.contentType.split(";")[0].trim() === "audio/wav" &&
-      wav.bytes > 0 &&
-      isWav(wav.body),
-    describeSpeech(wav),
-  );
-
-  const emotion = await call({ model, voice: "tara", input: EMOTION_TEXT });
-  reporter.observe("emotion-tag input", describeSpeech(emotion));
-  reporter.check(
-    "emotion-tag input returns 200 with audio",
-    emotion.ok && emotion.bytes > 0,
-    describeSpeech(emotion),
-  );
-
-  const voices = await voicesCall({ baseUrl, fetchImpl, timeoutMs: callTimeoutMs });
-  const entries =
-    voices.json && Array.isArray(voices.json.voices) ? voices.json.voices : null;
-  const ids = entries ? entries.map((entry) => entry?.id) : [];
-  const sorted = [...VOICES].sort();
-  reporter.check(
-    "voices union shape",
-    voices.ok &&
-      entries !== null &&
-      JSON.stringify(ids) === JSON.stringify(sorted) &&
-      entries.every(
-        (entry) => entry && typeof entry === "object" && entry.name === entry.id,
-      ),
-    `status=${voices.status} ids=${JSON.stringify(ids)}`,
-  );
-
-  // `instructions` is a named optional wire field; `sample_rate` and the
-  // bogus field exercise the verbatim passthrough. All three must come
-  // back 2xx.
-  for (const [field, value] of [
-    ["instructions", "Speak with a calm tone."],
-    ["sample_rate", 44100],
-    ["runvil_probe", 1],
-  ]) {
-    const probe = await call({ model, voice: "tara", input: PROBE_TEXT, [field]: value });
-    reporter.check(`field '${field}' tolerated`, probe.ok, describeSpeech(probe));
-  }
-
-  reporter.observe(
-    "429/503 envelopes",
-    "not provoked against the paid provider; covered by the Rust integration suite",
-  );
-}
-
-export async function runProbe({
-  env = process.env,
-  repo = REPOSITORY_ROOT,
-  log = console.log,
-  build = buildGateway,
-  spawnGateway = spawnGatewayBinary,
-  fetchImpl = fetch,
-  readyTimeoutMs = READY_TIMEOUT_MS,
-  readyPollMs = READY_POLL_MS,
-  callTimeoutMs = CALL_TIMEOUT_MS,
-} = {}) {
-  const key = env[KEY_ENV_VAR];
-  if (!key) {
-    log(
-      `SKIP: ${KEY_ENV_VAR} is not set in the process environment; the live speech probe did not run.`,
-    );
-    return 0;
-  }
-
-  const reporter = createReporter(log);
-  let scratch;
-  try {
-    await build({ repo });
-    const binary = gatewayBinaryPath(repo);
-    if (!existsSync(binary)) {
-      throw new Error(
-        `cargo build finished but the gateway binary is missing: ${binary}`,
-      );
-    }
-    const port = await freePort();
-    scratch = mkdtempSync(join(tmpdir(), "runvil-tts-live-"));
-    const configPath = join(scratch, "gateway.toml");
-    writeFileSync(configPath, renderConfig({ port }), "utf8");
-    const logPath = join(scratch, "gateway.log");
-    const proc = spawnGateway({
-      binary,
-      configPath,
-      profile: PROFILE_NAME,
-      env: { ...env, [KEY_ENV_VAR]: key },
-      logPath,
-    });
-    try {
-      await waitReady({
-        port,
-        proc,
-        fetchImpl,
-        timeoutMs: readyTimeoutMs,
-        pollMs: readyPollMs,
-        readTail: () => logTail(logPath),
-      });
-      log(`gateway up on 127.0.0.1:${port} (throwaway profile '${PROFILE_NAME}')`);
-      await runSpeechSurface({
-        baseUrl: `http://127.0.0.1:${port}/v1`,
-        model: GATEWAY_MODEL,
-        fetchImpl,
-        callTimeoutMs,
-        reporter,
-      });
-    } finally {
-      await stopGateway(proc);
-    }
-  } catch (error) {
-    log(`FAIL: ${error instanceof Error ? error.message : String(error)}`);
-    return 1;
-  } finally {
-    if (scratch) {
-      rmSync(scratch, { force: true, recursive: true, maxRetries: 5, retryDelay: 100 });
-    }
-  }
-
-  if (reporter.failures.length > 0) {
-    log(
-      `LIVE FAIL: ${reporter.failures.length} assertion(s) failed: ${reporter.failures.join(", ")}`,
-    );
-    return 1;
-  }
-  log("LIVE OK: every assertion passed");
-  return 0;
-}
-
-if (
-  process.argv[1] !== undefined &&
-  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-  runProbe().then(
-    (code) => {
-      process.exitCode = code;
-    },
-    (error) => {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exitCode = 1;
-    },
-  );
-}
diff --git a/tools/gateway-tts-live.test.mjs b/tools/gateway-tts-live.test.mjs
deleted file mode 100644
index 1468f1bb6..000000000
--- a/tools/gateway-tts-live.test.mjs
+++ /dev/null
@@ -1,262 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import {
-  closeSync,
-  mkdirSync,
-  mkdtempSync,
-  openSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-
-import { renderConfig, runProbe } from "./gateway-tts-live.mjs";
-
-// A fake credential: the secret-free test needs a canary value to hunt for,
-// and the ferrying test needs a value the fake gateway can compare against.
-const CANARY = "ttest-canary-not-a-real-key-9f8e7d6c";
-
-// The gateway double: a Node script that parses --config for its bind port
-// and serves canned speech, voices, and readiness responses on loopback.
-// Behavior modes arrive through its environment, exactly where the real
-// gateway would find TOGETHER_API_KEY.
-const FAKE_GATEWAY_SOURCE = `
-import { readFileSync, writeFileSync } from "node:fs";
-import { createServer } from "node:http";
-
-const configPath = process.argv[process.argv.indexOf("--config") + 1];
-const config = readFileSync(configPath, "utf8");
-const port = Number(config.match(/bind = "127\\.0\\.0\\.1:(\\d+)"/)[1]);
-const mode = process.env.FAKE_GATEWAY_MODE ?? "ok";
-if (process.env.FAKE_KEY_SINK) {
-  const seen = process.env.TOGETHER_API_KEY;
-  const expected = process.env.FAKE_EXPECT_KEY;
-  const verdict = seen === undefined ? "absent" : seen === expected ? "match" : "mismatch";
-  writeFileSync(process.env.FAKE_KEY_SINK, verdict);
-}
-if (mode === "exit-now") {
-  console.error("fake gateway refusing to boot");
-  process.exit(1);
-}
-const MP3 = Buffer.from([0x49, 0x44, 0x33, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10]);
-const WAV = Buffer.concat([
-  Buffer.from("RIFF", "latin1"),
-  Buffer.alloc(4),
-  Buffer.from("WAVE", "latin1"),
-  Buffer.alloc(8),
-]);
-const VOICE_IDS = ["dan", "jess", "leah", "leo", "mia", "tara", "zac", "zoe"];
-
-if (mode === "never-listen") {
-  setInterval(() => {}, 1000);
-} else {
-  const server = createServer((request, response) => {
-    const url = new URL(request.url, "http://127.0.0.1");
-    if (url.pathname === "/v1/models") {
-      response.writeHead(200, { "content-type": "application/json" });
-      response.end("{}");
-      return;
-    }
-    if (url.pathname === "/v1/audio/voices") {
-      response.writeHead(200, { "content-type": "application/json" });
-      response.end(JSON.stringify({ voices: VOICE_IDS.map((id) => ({ id, name: id })) }));
-      return;
-    }
-    if (url.pathname === "/v1/audio/speech" && request.method === "POST") {
-      let body = "";
-      request.on("data", (chunk) => {
-        body += chunk;
-      });
-      request.on("end", () => {
-        if (mode === "error500") {
-          response.writeHead(500, { "content-type": "application/json" });
-          response.end(JSON.stringify({ error: { message: "upstream exploded" } }));
-          return;
-        }
-        const parsed = JSON.parse(body);
-        const wav = parsed.response_format === "wav" || mode === "wrong-format";
-        response.writeHead(200, {
-          "content-type": wav ? "audio/wav" : "audio/mpeg",
-          "transfer-encoding": "chunked",
-        });
-        response.end(wav ? WAV : MP3);
-      });
-      return;
-    }
-    response.writeHead(404, { "content-type": "application/json" });
-    response.end(JSON.stringify({ error: { message: "not found" } }));
-  });
-  server.listen(port, "127.0.0.1");
-}
-`;
-
-function makeHarness(t, mode, { withKey = true } = {}) {
-  const dir = mkdtempSync(join(tmpdir(), "tts-live-test-"));
-  t.after(() => rmSync(dir, { force: true, recursive: true, maxRetries: 5, retryDelay: 100 }));
-  const fakePath = join(dir, "fake-gateway.mjs");
-  writeFileSync(fakePath, FAKE_GATEWAY_SOURCE, "utf8");
-  const sinkPath = join(dir, "key-sink.txt");
-  const repo = join(dir, "repo");
-  const binaryDir = join(repo, "target", "debug");
-  mkdirSync(binaryDir, { recursive: true });
-  const binaryName =
-    process.platform === "win32" ? "runvil-gateway.exe" : "runvil-gateway";
-  writeFileSync(join(binaryDir, binaryName), "fake binary", "utf8");
-
-  const lines = [];
-  const events = [];
-  const spawned = [];
-  const env = {
-    ...process.env,
-    FAKE_GATEWAY_MODE: mode,
-    FAKE_KEY_SINK: sinkPath,
-    FAKE_EXPECT_KEY: CANARY,
-  };
-  if (withKey) {
-    env.TOGETHER_API_KEY = CANARY;
-  } else {
-    delete env.TOGETHER_API_KEY;
-  }
-  const deps = {
-    env,
-    repo,
-    log: (line) => lines.push(line),
-    build: async () => {
-      events.push("build");
-    },
-    spawnGateway: ({ configPath, profile, env: childEnv, logPath }) => {
-      events.push("spawn");
-      const logFd = openSync(logPath, "a");
-      const child = spawn(
-        process.execPath,
-        [fakePath, "--config", configPath, "--profile", profile, "--no-tray"],
-        { env: childEnv, stdio: ["ignore", logFd, logFd] },
-      );
-      closeSync(logFd);
-      spawned.push(child);
-      return child;
-    },
-    readyTimeoutMs: 5_000,
-    readyPollMs: 50,
-    callTimeoutMs: 5_000,
-  };
-  return { lines, events, spawned, deps, sinkPath };
-}
-
-function assertAllDead(spawned) {
-  assert.ok(spawned.length > 0, "at least one gateway child was spawned");
-  for (const child of spawned) {
-    assert.notEqual(
-      child.exitCode ?? child.signalCode,
-      null,
-      "the gateway subprocess was terminated",
-    );
-  }
-}
-
-test("passes against a conforming gateway and ferries the key only to the subprocess", async (t) => {
-  const { lines, spawned, deps, sinkPath } = makeHarness(t, "ok");
-  const code = await runProbe(deps);
-  assert.equal(code, 0);
-  const output = lines.join("\n");
-  assert.match(output, /gateway up on 127\.0\.0\.1:\d+/);
-  assert.match(output, /PASS default format is mp3/);
-  assert.match(output, /PASS default response is streamed/);
-  assert.match(output, /PASS wav format maps to audio\/wav with a RIFF body/);
-  assert.match(output, /PASS emotion-tag input returns 200 with audio/);
-  assert.match(output, /PASS voices union shape/);
-  assert.match(output, /PASS field 'instructions' tolerated/);
-  assert.match(output, /PASS field 'sample_rate' tolerated/);
-  assert.match(output, /PASS field 'runvil_probe' tolerated/);
-  assert.match(output, /LIVE OK: every assertion passed/);
-  assert.equal(readFileSync(sinkPath, "utf8"), "match");
-  assertAllDead(spawned);
-});
-
-test("always builds the gateway before booting it", async (t) => {
-  const { events, deps } = makeHarness(t, "ok");
-  const code = await runProbe(deps);
-  assert.equal(code, 0);
-  assert.deepEqual(events.slice(0, 2), ["build", "spawn"]);
-  assert.equal(events.filter((event) => event === "build").length, 1);
-});
-
-test("fails loudly when the gateway exits during boot", async (t) => {
-  const { lines, spawned, deps } = makeHarness(t, "exit-now");
-  const code = await runProbe(deps);
-  assert.equal(code, 1);
-  const output = lines.join("\n");
-  assert.match(output, /gateway exited during boot/);
-  assert.match(output, /refusing to boot/);
-  assertAllDead(spawned);
-});
-
-test("fails when the gateway never serves within the readiness deadline", async (t) => {
-  const { lines, spawned, deps } = makeHarness(t, "never-listen");
-  deps.readyTimeoutMs = 600;
-  const code = await runProbe(deps);
-  assert.equal(code, 1);
-  assert.match(lines.join("\n"), /did not serve within/);
-  assertAllDead(spawned);
-});
-
-test("fails when the speech surface answers an error envelope", async (t) => {
-  const { lines, spawned, deps } = makeHarness(t, "error500");
-  const code = await runProbe(deps);
-  assert.equal(code, 1);
-  const output = lines.join("\n");
-  assert.match(output, /FAIL default format is mp3: status=500/);
-  assert.match(output, /LIVE FAIL: \d+ assertion\(s\) failed/);
-  assertAllDead(spawned);
-});
-
-test("fails when a response violates the speech contract", async (t) => {
-  const { lines, spawned, deps } = makeHarness(t, "wrong-format");
-  const code = await runProbe(deps);
-  assert.equal(code, 1);
-  const output = lines.join("\n");
-  assert.match(output, /FAIL default format is mp3/);
-  assert.match(output, /PASS wav format maps to audio\/wav with a RIFF body/);
-  assertAllDead(spawned);
-});
-
-test("terminates the gateway subprocess on success and on failure", async (t) => {
-  for (const mode of ["ok", "error500", "exit-now"]) {
-    const { spawned, deps } = makeHarness(t, mode);
-    await runProbe(deps);
-    assertAllDead(spawned);
-  }
-});
-
-test("skips with exit 0 when TOGETHER_API_KEY is absent from the environment", async (t) => {
-  const { lines, deps } = makeHarness(t, "ok", { withKey: false });
-  deps.build = async () => {
-    throw new Error("build must not run without a key");
-  };
-  deps.spawnGateway = () => {
-    throw new Error("spawn must not run without a key");
-  };
-  const code = await runProbe(deps);
-  assert.equal(code, 0);
-  assert.match(lines.join("\n"), /SKIP: TOGETHER_API_KEY is not set/);
-});
-
-test("never prints the key and the config contains only the interpolation reference", async (t) => {
-  const { lines, deps, sinkPath } = makeHarness(t, "ok");
-  const code = await runProbe(deps);
-  assert.equal(code, 0);
-  assert.ok(
-    !lines.join("\n").includes(CANARY),
-    "the key never appears in the probe output",
-  );
-  const config = renderConfig({ port: 12345 });
-  assert.ok(!config.includes(CANARY), "the config never contains the key value");
-  assert.ok(
-    config.includes('api_key = "${TOGETHER_API_KEY}"'),
-    "the config contains only the interpolation reference",
-  );
-  assert.equal(readFileSync(sinkPath, "utf8"), "match");
-});
diff --git a/tools/stage-gateway-sidecar.mjs b/tools/stage-gateway-sidecar.mjs
deleted file mode 100644
index 06fa21b6d..000000000
--- a/tools/stage-gateway-sidecar.mjs
+++ /dev/null
@@ -1,191 +0,0 @@
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const REPOSITORY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-function targetNames(target) {
-  if (!/^[A-Za-z0-9_]+(?:-[A-Za-z0-9_]+){2,}$/.test(target)) {
-    throw new Error(`invalid target triple: ${target}`);
-  }
-  const extension = target.split("-").includes("windows") ? ".exe" : "";
-  return {
-    binary: `runvil-gateway${extension}`,
-    sidecar: `runvil-gateway-${target}${extension}`,
-  };
-}
-
-export function gatewayBinaryName(target) {
-  return targetNames(target).binary;
-}
-
-export function gatewaySidecarName(target) {
-  return targetNames(target).sidecar;
-}
-
-/**
- * The file tauri.conf.json's `externalBin` entry resolves for `target`.
- * This is the one owner of that naming rule: the fetch script, the build
- * pipeline, and CI all ask for the path rather than spelling it again.
- */
-export function gatewaySidecarPath({ root = REPOSITORY_ROOT, target }) {
-  return join(
-    root,
-    "crates",
-    "workshop",
-    "desktop",
-    "binaries",
-    gatewaySidecarName(target),
-  );
-}
-
-export function stageGatewaySidecar({ root = REPOSITORY_ROOT, target, source }) {
-  const expectedSourceName = gatewayBinaryName(target);
-  const sourcePath = resolve(source);
-  if (!existsSync(sourcePath)) {
-    throw new Error(`Gateway source binary does not exist: ${sourcePath}`);
-  }
-  if (!lstatSync(sourcePath).isFile()) {
-    throw new Error(`Gateway source binary is not a file: ${sourcePath}`);
-  }
-  if (basename(sourcePath) !== expectedSourceName) {
-    throw new Error(
-      `Gateway source binary must be named ${expectedSourceName} for ${target}`,
-    );
-  }
-
-  const destination = gatewaySidecarPath({ root, target });
-  mkdirSync(dirname(destination), { recursive: true });
-  copyFileSync(sourcePath, destination);
-  if (process.platform !== "win32") {
-    // `copyFileSync` writes the destination with the default mode, so the
-    // source's executable bit is lost and a bundled Gateway lands in the deb
-    // at 0644. Tauri's deb bundler copies this file with `fs::copy` and then
-    // writes the tar header in `HeaderMode::Deterministic`, which keeps only
-    // the owner execute bit: 0755 here becomes 0755 in `usr/bin`, and 0644
-    // here becomes 0644 there. Windows has no such bit to set.
-    chmodSync(destination, 0o755);
-  }
-  return destination;
-}
-
-/**
- * Writes the marker beside the staged sidecar that records what it is:
- * `kind` is `release` for a binary checked against the pin, with `tag`
- * naming its release, or `stub` for the compile-only placeholder. The
- * desktop build script and `cargo workshop` read `kind`, so a developer is
- * told when the sidecar a build reuses is only a placeholder.
- */
-export function markGatewaySidecarPinned({ root = REPOSITORY_ROOT, target, kind = "release", tag = null }) {
-  const marker = gatewaySidecarPinMarkerPath({ root, target });
-  mkdirSync(dirname(marker), { recursive: true });
-  writeFileSync(
-    marker,
-    `${JSON.stringify({ kind, tag }, null, 2)}\n`,
-  );
-  return marker;
-}
-
-/**
- * The marker's record, or `null` when the sidecar was not staged by the
- * fetch script. A malformed marker still counts as a marker, and its kind
- * is reported as unknown rather than assumed to be a release.
- */
-export function readGatewaySidecarPin({ root = REPOSITORY_ROOT, target }) {
-  const marker = gatewaySidecarPinMarkerPath({ root, target });
-  let text;
-  try {
-    text = readFileSync(marker, "utf8");
-  } catch {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(text);
-    return { kind: typeof parsed["kind"] === "string" ? parsed["kind"] : "unknown", tag: parsed["tag"] ?? null };
-  } catch {
-    return { kind: "unknown", tag: null };
-  }
-}
-
-/**
- * The marker beside the staged sidecar recording what it is. Named so the
- * sidecar's own name stays exactly what Tauri expects; the marker sits next
- * to it and is never bundled.
- */
-export function gatewaySidecarPinMarkerPath({ root = REPOSITORY_ROOT, target }) {
-  return `${gatewaySidecarPath({ root, target })}.pinned`;
-}
-
-export function removeGatewaySidecar({ root = REPOSITORY_ROOT, target }) {
-  const destination = gatewaySidecarPath({ root, target });
-  rmSync(destination, { force: true });
-  rmSync(gatewaySidecarPinMarkerPath({ root, target }), { force: true });
-  return destination;
-}
-
-function parseArguments(args) {
-  const [action, ...options] = args;
-  if (action !== "stage" && action !== "remove" && action !== "path") {
-    throw new Error("usage: stage-gateway-sidecar.mjs <stage|remove|path> --target <triple> [--source <path>]");
-  }
-
-  const values = new Map();
-  for (let index = 0; index < options.length; index += 2) {
-    const name = options[index];
-    const value = options[index + 1];
-    if ((name !== "--target" && name !== "--source") || value === undefined) {
-      throw new Error(`invalid sidecar argument: ${name ?? "<missing>"}`);
-    }
-    if (values.has(name)) {
-      throw new Error(`duplicate sidecar argument: ${name}`);
-    }
-    values.set(name, value);
-  }
-
-  const target = values.get("--target");
-  if (target === undefined) {
-    throw new Error("missing required sidecar argument: --target");
-  }
-  const source = values.get("--source");
-  if (action === "stage" && source === undefined) {
-    throw new Error("missing required sidecar argument: --source");
-  }
-  if (action !== "stage" && source !== undefined) {
-    throw new Error(`${action} does not accept --source`);
-  }
-  return { action, source, target };
-}
-
-function main(args) {
-  const { action, source, target } = parseArguments(args);
-  if (action === "path") {
-    console.log(gatewaySidecarPath({ target }));
-    return;
-  }
-  const path =
-    action === "stage"
-      ? stageGatewaySidecar({ source, target })
-      : removeGatewaySidecar({ target });
-  console.log(`${action === "stage" ? "staged" : "removed"} ${path}`);
-}
-
-if (
-  process.argv[1] !== undefined &&
-  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-}
diff --git a/tools/stage-gateway-sidecar.test.mjs b/tools/stage-gateway-sidecar.test.mjs
deleted file mode 100644
index abf322a65..000000000
--- a/tools/stage-gateway-sidecar.test.mjs
+++ /dev/null
@@ -1,267 +0,0 @@
-import assert from "node:assert/strict";
-import {
-  chmodSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-
-import {
-  gatewayBinaryName,
-  gatewaySidecarName,
-  gatewaySidecarPath,
-  markGatewaySidecarPinned,
-  readGatewaySidecarPin,
-  removeGatewaySidecar,
-  stageGatewaySidecar,
-} from "./stage-gateway-sidecar.mjs";
-
-test("maps the Windows target to Tauri's suffixed executable name", () => {
-  assert.equal(
-    gatewaySidecarName("x86_64-pc-windows-msvc"),
-    "runvil-gateway-x86_64-pc-windows-msvc.exe",
-  );
-  assert.equal(
-    gatewayBinaryName("x86_64-pc-windows-msvc"),
-    "runvil-gateway.exe",
-  );
-});
-
-test("maps the Linux target to Tauri's suffix without an extension", () => {
-  assert.equal(
-    gatewaySidecarName("x86_64-unknown-linux-gnu"),
-    "runvil-gateway-x86_64-unknown-linux-gnu",
-  );
-  assert.equal(
-    gatewayBinaryName("x86_64-unknown-linux-gnu"),
-    "runvil-gateway",
-  );
-});
-
-test("maps every valid non-Windows target without an extension", () => {
-  for (const target of [
-    "aarch64-apple-darwin",
-    "x86_64-apple-darwin",
-    "aarch64-unknown-linux-gnu",
-  ]) {
-    assert.equal(gatewayBinaryName(target), "runvil-gateway");
-    assert.equal(
-      gatewaySidecarName(target),
-      `runvil-gateway-${target}`,
-    );
-  }
-});
-
-test("maps other valid Windows targets with an executable extension", () => {
-  assert.equal(
-    gatewaySidecarName("x86_64-pc-windows-gnu"),
-    "runvil-gateway-x86_64-pc-windows-gnu.exe",
-  );
-});
-
-test("rejects a malformed target triple", () => {
-  assert.throws(() => gatewaySidecarName("../outside"), /invalid target triple/);
-});
-
-test("reports the one path tauri.conf.json's externalBin resolves", () => {
-  const root = join("repo");
-  assert.equal(
-    gatewaySidecarPath({ root, target: "x86_64-pc-windows-msvc" }),
-    join(
-      root,
-      "crates",
-      "workshop",
-      "desktop",
-      "binaries",
-      "runvil-gateway-x86_64-pc-windows-msvc.exe",
-    ),
-  );
-  assert.equal(
-    gatewaySidecarPath({ root, target: "aarch64-apple-darwin" }),
-    join(
-      root,
-      "crates",
-      "workshop",
-      "desktop",
-      "binaries",
-      "runvil-gateway-aarch64-apple-darwin",
-    ),
-  );
-});
-
-test("rejects a missing source binary", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  try {
-    assert.throws(
-      () =>
-        stageGatewaySidecar({
-          root,
-          target: "x86_64-pc-windows-msvc",
-          source: join(root, "target", "debug", "runvil-gateway.exe"),
-        }),
-      /source binary does not exist/,
-    );
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("rejects a source binary whose platform name mismatches the target", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway");
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "linux gateway");
-    assert.throws(
-      () =>
-        stageGatewaySidecar({
-          root,
-          target: "x86_64-pc-windows-msvc",
-          source,
-        }),
-      /source binary must be named runvil-gateway\.exe/,
-    );
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("stages and removes the real source file under Tauri's target name", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway.exe");
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "compiled gateway");
-
-    const staged = stageGatewaySidecar({
-      root,
-      target: "x86_64-pc-windows-msvc",
-      source,
-    });
-    assert.equal(
-      staged,
-      join(
-        root,
-        "crates",
-        "workshop",
-        "desktop",
-        "binaries",
-        "runvil-gateway-x86_64-pc-windows-msvc.exe",
-      ),
-    );
-    assert.equal(readFileSync(staged, "utf8"), "compiled gateway");
-
-    assert.equal(
-      removeGatewaySidecar({
-        root,
-        target: "x86_64-pc-windows-msvc",
-      }),
-      staged,
-    );
-    assert.throws(() => readFileSync(staged), /ENOENT/);
-    assert.throws(() => readFileSync(`${staged}.pinned`), /ENOENT/);
-    assert.equal(
-      removeGatewaySidecar({
-        root,
-        target: "x86_64-pc-windows-msvc",
-      }),
-      staged,
-    );
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("the staged sidecar keeps an executable mode for the Linux bundlers", () => {
-  // `copyFileSync` writes the destination with the default mode, so without
-  // an explicit `chmodSync` the staged Gateway is 0644 and Tauri's deb and
-  // AppImage bundlers carry that through to `usr/bin`. The assertion is
-  // skipped on Windows, where `chmodSync` only toggles the read-only flag and
-  // `statSync().mode` reports 0666 for any writable file. CI runs these tools'
-  // tests on Linux and Windows, so the assertion is live on the platform that
-  // ships the deb.
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway");
-  const target = "x86_64-unknown-linux-gnu";
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "downloaded gateway");
-    // Start from a mode with no execute bits at all, so a passing assertion
-    // cannot come from the umask or from the source file's own mode.
-    chmodSync(source, 0o644);
-
-    const staged = stageGatewaySidecar({ root, target, source });
-
-    if (process.platform === "win32") {
-      assert.equal(
-        statSync(staged).mode & 0o777,
-        0o666,
-        "Windows reports 0666 for any writable file, so the execute bit cannot be asserted here",
-      );
-      return;
-    }
-    assert.equal(statSync(staged).mode & 0o777, 0o755);
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("marking a staged sidecar pinned records which kind it was", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway");
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "downloaded gateway");
-    const target = "x86_64-unknown-linux-gnu";
-    const staged = stageGatewaySidecar({ root, target, source });
-    const marker = markGatewaySidecarPinned({ root, target, kind: "release", tag: "gateway-v0.4.0" });
-    assert.equal(marker, `${staged}.pinned`);
-    assert.deepEqual(readGatewaySidecarPin({ root, target }), {
-      kind: "release",
-      tag: "gateway-v0.4.0",
-    });
-    // Removal takes the marker with the sidecar, so a sidecar staged
-    // later never reads this one's record.
-    removeGatewaySidecar({ root, target });
-    assert.throws(() => readFileSync(marker), /ENOENT/);
-    assert.equal(readGatewaySidecarPin({ root, target }), null);
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("a stub marker is distinguishable from a release marker", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway");
-  const target = "x86_64-apple-darwin";
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "placeholder");
-    stageGatewaySidecar({ root, target, source });
-    markGatewaySidecarPinned({ root, target, kind: "stub" });
-    assert.equal(readGatewaySidecarPin({ root, target }).kind, "stub");
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
-
-test("a hand-written or corrupt marker reads as unknown, not as a release", () => {
-  const root = mkdtempSync(join(tmpdir(), "runvil-sidecar-"));
-  const source = join(root, "target", "debug", "runvil-gateway");
-  const target = "x86_64-apple-darwin";
-  try {
-    mkdirSync(join(root, "target", "debug"), { recursive: true });
-    writeFileSync(source, "placeholder");
-    const staged = stageGatewaySidecar({ root, target, source });
-    writeFileSync(`${staged}.pinned`, "this sidecar came from somewhere\n");
-    assert.equal(readGatewaySidecarPin({ root, target }).kind, "unknown");
-  } finally {
-    rmSync(root, { force: true, recursive: true });
-  }
-});
diff --git a/vibelight.toml b/vibelight.toml
index 6148335ae..8bb57f4c8 100644
--- a/vibelight.toml
+++ b/vibelight.toml
@@ -3,9 +3,7 @@
 workspace = true
 follow = ["**"]
 exclude = [
-    "crates/build-ui",  # build tooling
     "crates/build-user-guide",  # build tooling
-    "crates/build-workshop",  # run by the cargo alias `workshop`
     "crates/build-xtask",  # run by the cargo alias `xtask`
 ]
 out = ".vibelight"