[qduc]

Closes #139 (part of #65). Draft: for the owner's team to integrate; not to be marked ready or merged from here.

Branch note: the issue asked for cloud/dead-bridge. This session can only push to claude/zealous-volta-dfwldh, so the work is here. main (d7bf2ff) is merged in rather than rebased, because a force-push was not permitted.

No user-visible behaviour is meant to change, with one intended exception: --help no longer marks serve, acp and discord as unavailable (group I asked for this).

What changed

Reachability guard (step 1). New rewrite/scripts/check-reachability.mjs runs in CI next to check-layers.mjs. It walks every static, type-only, re-export and dynamic import from rewrite/src/app/cli.ts, and fails on any rewrite/src file it never reaches unless reachability-allowlist.json gives a reason. It takes about 0.6 s.

• Seeded failure: adding rewrite/src/tools/seeded-unreached.ts exits 1 with unreached from rewrite/src/app/cli.ts: rewrite/src/tools/seeded-unreached.ts.
• Before: 359 of 395 files reached (36 unreached).
• After: 354 of 359 reached, with 5 allowlisted (listed below).

Deletions.

• E1: host/in-process.ts, protocol/{projection,commands}.ts, session/{local-store,reducer}.ts, engine/loop.ts, engine/adopted/, most of session/adopted/, config/{scoped-settings,memory}.ts, model/scripted.ts and tools/notes.ts. Also gone: the bridge contracts in each layer's index.ts (Engine, Host, Connection, Projection, Session, SessionStore and SettingsSource).
• Bench: every c1/c2/c3a probe, source-app.mts, the native-tracer fixture, direct-manual-unknown-capacity.mts (its target session/direct-command-compaction.ts was replaced by engine/turn-model-compaction.ts), their tsconfigs and their CI step.
• E2: encodeCanonicalEvent and canonicalEventStream (agent-wire v1).
• E3:
  • app/run.ts (run, prepareResume, its version walker). withGenerationGuard moved first, to app/generation-guard.ts.
  • renderTurn and HeadlessEvent, the clients/headless.ts Client contract, directAcpWorkspaces, and reresolve/admitRoot.
  • The app-side publishTask/Branch/Notice forwarding. No app code ever supplied it, so DirectConversationRuntime.deps now excludes it.
  • Compactor, prepareDirectHistoryRetry/Rewind, isMessageBody and DIRECT_LEGACY_JSON_FINAL_WINDOW_AVAILABLE.

To find dead exports (not just dead files), I used a throwaway checker-based probe, run to a fixpoint, plus a tsc --noUnusedLocals diff against main. Neither probe is committed.

hops (step 3). bench/hops.mts now runs the real cli.ts in-process as a headless prompt against a local fake OpenAI-compatible provider. It reports the chain of files active at the provider's HTTP request, starting from the client's submit. Output:

message path: 14 hops through 14 files (4 in source/); 114 file transitions before folding
layers: clients -> host -> protocol -> session -> engine -> app -> model -> source
  rewrite/src/clients/headless/direct.ts
  rewrite/src/host/in-process-direct.ts
  rewrite/src/protocol/direct-commands.ts
  rewrite/src/session/direct-session.ts
  rewrite/src/session/conversation-turn.ts
  rewrite/src/engine/turn.ts
  rewrite/src/engine/turn-model.ts
  rewrite/src/app/generation-guard.ts
  rewrite/src/app/direct-application-models.ts
  rewrite/src/model/provider.ts
  source/providers/openai-chat-completions-model.ts
  source/providers/openai-compatible-response-normalizer.ts
  source/providers/fetch/compose.ts
  source/providers/fetch/composer.ts
PASS message path within budget

The budget is now { maxHops: 14, maxFiles: 14 }; it was 29/7 on the bridge.

Docs (step 4).

• The README's layer table, rules, "How a message travels" and "Where an approval waits" now follow the direct-* files.
• The native-tracer and C2 sections are gone.
• "Owner scope" now says that "dropped" means no parity work. MCP, ACP, the profiles and the sandbox are all still wired.
• Every index.ts header, the layer READMEs, the INTEGRATION docs and the file headers no longer mention the bridge, LocalSessionStore, app/run.ts or scoped settings.

Group I.

• Help text: next's --help starred serve, acp and discord as unavailable, even though they dispatch and no flag is refused any more. The footnote now prints only while some flag is refused. --profile uses legacy's wording.
• cli.ts comments: the ones claiming --fork and --ssh are still refused are gone.
• Effort validators: app/README now names all three. /effort uses VALID_REASONING_EFFORTS instead of a third hand-kept copy, and its messages are byte-identical.
• Duplicates merged:
  • CREDENTIALS now lives in app/credential-settings.ts.
  • LOCAL_ONLY/REMOTE_UNAVAILABLE became SSH_LOCAL_ONLY_TOOLS.
  • warnIfSandboxUnavailable is shared in app/sandbox-warning.ts, and both commands print the same lines as before.
  • --version reads source's installationVersion.
• Renames:
  • createAppSettings and createDirectSettingsService became one function, createSettingsService.
  • The loadSurface alias was dropped in favour of createToolSurface.
  • DirectOrchestratorQuestions became DirectTaskQuestions.

Size: 152 files changed, +759 / −18,139.

• rewrite/src: 395 → 359 .ts/.tsx files, 63,692 → 55,974 lines.
• rewrite/bench: −9,718 lines.

Kept, with reasons

• session/adopted/conversation-log.ts + network.ts (allowlisted). The offline v3 migration (scripts/conversation-migration/v3-input.mjs) imports validateSessionFact from the emitted module. Only the validator and its types remain; the CanonicalSessionLog writer and loaders are gone.
• session/direct-import.ts (allowlisted). migration-command.mjs imports it.
• protocol/index.ts, session/index.ts (allowlisted). Nothing imports them, but they are the per-layer maps the fresh-reader check reads.
• Agent-wire v2 (server-wire-v2.ts), createGatewayAssertion, MemoryReplayLedger, directHostConfigFailure. [port C6] host/: server host over the gateway's transport #80 was reopened with "existing work and artifacts stay; gates remain closed". Web is deferred, not dropped.
• updateView, cancelForeground, the three terminal-size sources. All are in clients/tui/, which the issue says to leave alone. Follow-up.
• applyModelFlags (ACP) vs applyModelOverrides (CLI). Not a plain duplicate: the messages differ, each matching its legacy command, and only the CLI has the picker. Merging them would change output.
• readFacts. bench/m1-direct.mjs loads it from dist.
• clients/tui/INTEGRATION.md. Every backticked path and symbol in it still resolves, and I found nothing stale I could verify, so it is unchanged.

The generated native-log property used to build two items through engine/adopted/conversion.ts#inputToItem. It now builds the same item shapes literally, and pnpm verify:generated --target native --runs 100 passes. After the deletions, the direct build still emits every rewrite/dist module the migration scripts import. It no longer emits 51 modules, including legacy AgentClient.

Fresh-reader check

A context-free subagent got only rewrite/README.md and the seven index.ts files. It traced the path correctly: cli → direct-launch-headless → clients/headless/direct.ts → host/in-process-direct.ts → protocol/direct-commands.ts → DirectSession/Conversation → startTurn, where conversation-turn.ts appends facts then accept(token) → turn-model → app registry + generation-guard → model/provider.ts. On the way back, one DirectProjection per session in in-process-direct-attachment.ts fans out to every connection. It also got the approval wait right: interaction_required, the turn waits in memory, conversation-turn.ts writes the pending interaction, an answer command reaches TurnHandle.answer, and after a crash the turn reopens as interrupted.

It flagged these problems, all fixed in d738d35:

• The README's "production files are the direct-/turn/conversation*/server-* families" claim was false.
• "14 hops" came with no list, and "down the layers" was wrong while app/ sits below engine/.
• config/index.ts still said "settings and profiles".
• host/index.ts didn't mention the attachment and didn't say the web wire is gated.
• The README said both "reopened" and "ended" for an interrupted turn.

Points it raised that I left alone: retry ownership between model/retry.ts and direct-recovery*, and some unexplained symbol names (DirectDraft, ToolContextSeed).

Checks

Tested revision: the tree of fd861da (identical to the rebased commit that was tested). The suites ran before the last two doc-only commits, which change no code.

• pnpm install && pnpm build && node rewrite/scripts/build.mjs: pass. Needs pnpm ≥ 11; pnpm 10 reports the lockfile as broken.
• pnpm exec tsc -p rewrite/tsconfig.json: pass.
• node rewrite/scripts/check-layers.mjs: pass (521 edges).
• node rewrite/scripts/check-reachability.mjs: pass.
• node rewrite/scripts/check-complexity.mjs: pass. No file is over 500 lines any more, and every ceiling is removed.
• pnpm typecheck: pass.
• NODE_ENV=test pnpm exec vitest run --config vitest.e2e.config.ts source/direct-: 97 of 98 passed. The one failure is in direct-settings.e2e.test.ts, at teardown: ENOTEMPTY: rmdir .../home, with no failed assertion. It fails the same way on unmodified main d7bf2ff (3 of 6 isolated runs), and on this branch it failed 1 of 3 isolated reruns. The cause is that afterEach kills the PTY without waiting for the child to exit, then removes its directory. The lesson is recorded in the testing skill.
• pnpm test:provider-black-box: 252 passed, 8 skipped.
• Also passing: rewrite/bench/m1-direct.mjs (33/33 rows), parity headless-plain-answer settings-batch against the direct build, parity/inventory.mjs, and hops.mts.

Not run: the full scripts/run-ci-lane.mjs lanes and the old-CLI parity check.

---

Generated by Claude Code