# PRD: Crate Decomposition

## Problem

`agent-doc-orchestration` is still an aggregation crate. `agent-doc-core` was
deleted after its policy moved into focused crates; it must not come back as an
empty facade. Remaining orchestration policy should live in focused domain
crates, because mixed effect/policy modules make realtime and turn invariants
easier to regress accidentally.

This PRD tracks the extraction work needed to keep deleted core APIs gone and
make orchestration small enough that it is an adapter rather than a God crate.

## Goals

- Keep `agent-doc-core` deleted; move new domain policy out of
  `agent-doc-orchestration`.
- Keep durable system rules in the canonical specs:
  [Real-Time Workflow Authority](../../specs/14-realtime-workflow.md) and
  [Turn Lifecycle Authority](../../specs/15-turn-lifecycle.md).
- Keep extraction work visible, testable, and incrementally shippable.
- Prefer small manageable dependency graphs at natural seams over broad
  layer-by-layer migrations.
- Treat the focused crates as the greenfield Rust API; internal callers import
  those crates directly instead of preserving old facade paths.
- Retire deprecated internal names as seams move. Extracted Rust APIs should use
  current domain names rather than carrying aliases such as `pending_cmd` when
  the canonical concept is tracked work or backlog.

## Non-Goals

- Do not complete every extraction in one patch.
- Prefer extracting small, manageable dependency graphs that align with existing
  crate seams over sweeping layer-by-layer moves.
- Do not rename `agent-doc-orchestration` in the same patch as behavior
  extraction. Deprecation should be an explicit final step after callers are
  migrated to focused crates.
- Do not move effectful code into pure crates.
- Do not weaken the operator-visible document authority invariant to make
  extraction easier.

## Current Extraction Map

## Coarse Extraction Ledger

Use this ledger when a round intentionally moves a whole coherent graph before
its internal seams are fully split. Coarse moves are acceptable when they delete
orchestration ownership quickly, but each entry must name the follow-up seams so
the next passes can split the moved graph without rediscovering the debt.

### Coarse Commit Coverage

This coverage table backfills the coarse extraction rounds that happened before
the ledger existed and records the recent large-chunk turns. The detailed ledger
rows below remain the source of truth for moved graphs and follow-up seams.

| Commit(s) | Ledger row(s) |
|---|---|
| `539eabb9` | Focused IO crate wave; Codex hook blocked-stop sidecar IO |
| `bf6b1735`, `a0bb0402`, `571c7d0a`, `664504cd`, `b5a4b32c`, `21f3fc3f`, `039981a3`, `328936a1`, `c27e67b3`, `79b4677f`, `e401939a`, `19ac1edf`, `31474257`, `4adf538e`, `66541752`, `9f6ad677`, `5bcfc07b` | Legacy route/controller policy wave |
| `27a7a849`, `882f1219`, `e320fd49`, `f6c4f88f`, `702e980c`, `73abc196`, `8dce5536`, `b0ebca68`, `571c7d0a` | Legacy write/realtime/session-check policy wave |
| `6bc00090`, `39ad285a`, `56f965b6`, `10a3b66e`, `a5d24044` | Legacy git/sync/frontmatter helper wave |
| `6bc00090`, `42d504fc`, `0a8e273b`, `971cb2e2`, `b4c9f10c`, `8dce5536`, `5bcfc07b`, `664504cd`, `c95eced6`, `e24a3fca` | Legacy supervisor/agent runtime IO wave |
| `1c57b988`, `41b388ab`, `b4c9f10c`, `8dce5536` | Legacy memory/queue/harness adapter wave |
| `96ac3af1` | Agent backend process adapters; Supervisor process runtime adapters |
| `2811d37e` | Orchestration facade deletion sweep |
| `8c008cea` | Cycle state sidecar IO |
| `016184a3` | Operation-log facade deletion |
| `fc5d5de9` | Realtime admission cycle opener |
| `e41a6004` | Workflow doctor/autofix IO |
| `d30b9b13`, `cd553da8`, `8000c8cf`, `c8ed0f7c`, `c2e6ca12` | State backbone chart and observer graph |
| `ebade5a9` | State wire subscription boundary |
| `0a95a821`, `160e9f4b` | Turn-scope sidecar IO |
| `614a8819`, `c886927e`, `5c19aee1` | Transcript context and model-tier graph |
| `486913a7`, `0a24fa2e`, `1cb21bb6` | Prompt-cache policy and history IO |
| `76df51a7` | Session accretion IO adapter |
| `f32e1b61` | Response capture IO adapter |
| `b3e3edd4` | Prompt and state observer IO |
| `05ce84af` | Watch daemon IO |
| `44c998d8` | GC IO host |
| `0a71ce02` | GC/watch CLI effect adapter cleanup |
| `af1b5d32`, `539eabb9` | Controller dashboard policy and IO |
| `001d5390` | Controller admin command IO host |
| `8c3efe03` | Queue command, pipeline mirror, and write-queue adapter batch |
| `d4f20b8c` | CRDT relay host IO |
| `b23eb844` | Lazily run-context graph |
| `1c0abe65` | Queue continuation host IO |
| `35752f5c` | Tracked-work command and done-archive IO |
| `1e486e4f` | Session-check guard IO adapter batch |
| `7fbe726a` | Focus command host IO |
| `369280b0` | Session actor store and mailbox IO |
| `5dc7c322` | Session registration and projection IO |
| `0f90f7cf` | Project controller runtime IO |
| `d6387afa` | Sync and resync runtime IO graph |
| `c65b9260` | Compact command archive/write IO graph |
| `af54bb9f` | Document realtime authority IO graph |
| `e756b12c` | Claim command binding IO graph |
| `7af46f2c` | Stream command writeback IO graph |
| `6ea5c5a8` | Queue consume writeback IO graph |
| `78e75cd1` | Route session target resolution IO graph |
| `ecd969f4` | Route startup helper IO batch |
| `6f15ffee` | Route startup ready-wait and post-claim sync IO batch |
| `49a6c666` | Route busy-pane recovery and supervisor runtime IO graph |
| `da5cdb60` | Route dispatch target and restart handoff IO graph |
| `0563061f` | Route dispatch recovery and fresh-target validation IO graph |
| `bfb83245` | Codex hook session-state sidecar IO graph |
| `41ae534c` | Route dispatch-start tracking IO graph |
| `2073ba18` | Route dispatch-only proof and recycle gate IO graph |
| `11e26f1b` | Route direct-pane dispatch IO graph |
| `20f66b17` | Route auto-start dispatch-ready reverify IO graph |
| `abf90980` | Route dispatch transport and proof IO graph |
| `ae620145` | Route authoritative actor controller IO graph |
| `99eeab7c` | Route turn admission projection IO graph |
| `359f2a09` | Route launch contract reuse IO graph; Route dispatch-only send/retry IO graph |
| `8706e30c` | Route startup/provision IO graph |
| `c7b9b3e0` | Route pane-resolution helper IO batch |
| `d34d00b1` | Editor IPC live-editor targeting IO batch |
| `a855ff2c` | Document realtime visible-write guard IO graph; Template backlog normalization IO graph |
| `4d6b1519` | Session-check detect IO graph |
| `1aa6c3d8` | Session-check pending guard IO graph |
| `673e96fe` | Session-check response and closeout guard IO graph |
| `4bda3dd0` | Write normalization and response materialization IO graph |
| `a70ec642` | Write pending capture and done guard IO graph |
| `cf021437` | Preflight maintenance IO graph |
| `b46da7ce` | Closeout transaction and recovery IO graph |
| `8029773b` | Session-check command and closeout runtime IO graph |
| `e87f2b63` | Repair pending response sidecar IO graph |
| `c63b3151` | Repair pending direct-call migration |
| `ffe93ea7` | Git commit transaction IO graph |
| `d4f60843` | Retired supervisor CRDT replica IPC adapter graph |
| `0d76cc87` | Supervisor PTY process primitives graph |
| Current round | Supervisor PTY thread loop graph; Supervisor process observer adapter graph; Supervisor IPC command handler graph; Supervisor IPC state snapshot adapter graph; Supervisor IPC lifecycle adapter graph; Supervisor IPC inject delivery adapter graph; Supervisor live detection adapter graph; Route-owned completion process loop graph; Preflight layout health and repair IO graph; Preflight auto-GC and stale actor cleanup IO graph; Preflight debounce wait IO graph; Preflight stale install and editor-plugin warning IO graph; Preflight harness and content-policy warning IO graph; Preflight semantic advisory warning graph; Route startup production facade demotion; Route startup test-only provisioning facade deletion; Session-check production facade demotion; Session-check test-only command facade deletion; Session-check test-only source module deletion; Flow closeout effects facade demotion; Flow test-only source module deletion; Orchestration test support helper graph; Top-level focused crate re-export facade deletion batch; Write visible-guard re-export facade deletion; Write stale-snapshot convergence IO graph; Write IPC de-wedge and stale-supervisor recycle IO graph; Write editor convergence IO graph; Route pane-resolution waiting-input recovery IO graph; Route pane-resolution optimistic busy dispatch IO graph; Route pane-resolution busy retry IO graph; Route dispatch-only pane resolver IO graph; Post-response hook concrete effects IO graph; Route managed pane resolver IO graph; Route diagnostic and dispatch bug-report sink IO graph; Route dispatch queue writeback IO graph; Route document preparation IO graph; Route authoritative actor ready-wait IO graph; Route queue facade deletion batch; Route closeout drain IO graph; Route authoritative dispatch loop IO graph; Route command runtime IO graph |
| Current round | Flow integration suite relocation |
| Current round | Write file-IPC delivery proof loop; Write IPC transport delivery-loop delegation; Write IPC repair decision model extraction; Write visible-write write-through IO graph; Write IPC normalization redelivery IO graph; Write IPC sidecar repair-decision builder; Write IPC visible-state repair IO graph; Write IPC full-content redelivery proof IO graph; Write IPC disabled full-content transport IO graph; Write IPC snapshot and CRDT persistence IO graph; Write IPC snapshot adoption repair and forensics IO graph; Write IPC snapshot semantic convergence and adoption diagnostics graph; Write IPC snapshot adoption guard IO graph; Write IPC already-applied snapshot authority IO graph; Write IPC reposition transport IO graph; Write IPC patch payload synthesis IO graph; Write IPC transport graph; Write IPC production transport facade demotion; Direct-run prompt and auto-queue IO graph; Direct-run runtime and owner-pane IO graph; Direct-run command runtime and writeback IO graph; Direct-run production facade demotion; Supervisor start launch spec and stderr redirect IO graph; Start admission and session registration IO graph; Git committed historical snapshot repair IO graph; Repair commit-boundary and backlog reap IO graph; Repair stale preflight recovery IO graph; Repair stale-capture retirement IO graph; Repair strict empty-response closeout coordinator seam; Commit-seam free-text queue strike IO graph; Codex Stop continuation context IO graph; Write convergence test-wrapper re-export facade deletion; Codex hook user-prompt-submit tracking IO graph; Write convergence fixture coverage relocation; Route pane-resolution test adapter delegation; Route tmux mock-agent test helper graph |
| Current round | Write/repair empty-response command-boundary inversion; Write commit-boundary closeout adapter inversion; Route invocation state and entrypoint IO graph; Route test-only invocation facade deletion |
| Current round | Repair orphaned response replay/writeback IO graph; Repair orphaned response replay/writeback port split; Repair template normalization IO graph |
| Current round | Git pre-stage response/prompt artifact repair IO graph |
| Current round | Git guard-marker cleanup convergence IO graph |
| Current round | Git boundary reposition IO graph |
| Current round | Git committed single-boundary invariant self-heal IO graph |
| Current round | Git transient worktree and closeout sidecar cleanup IO graph |
| Current round | Git postcommit worktree proof and IPC reposition safety IO graph |
| Current round | Git already-committed closeout finalization IO graph |
| Current round | Git successful commit reconciliation IO graph |
| Current round | Git active capture materialization guard IO graph |
| Current round | Git live-buffer precommit guard IO graph |
| Current round | Git post-commit local drift handoff IO graph |
| Current round | Git commit result reporting IO graph |
| Current round | Git commit lifecycle coordinator IO graph |
| Current round | Repair recovery coordinator IO graph |
| Current round | Preflight IPC dogfood note append IO graph |
| Current round | Direct-run test-only source module deletion |
| Current round | Direct-run integration suite relocation |
| Current round | Git commit boundary test-suite relocation |
| Current round | Git commit runtime facade deletion |
| Current round | Git commit integration suite relocation |
| Current round | Preflight command runtime extraction |
| Current round | Session-check integration suite relocation |
| Current round | Preflight maintenance runtime write-effect adapter graph |
| Current round | Preflight cycle-completion coordinator and runtime effects |
| Current round | Preflight direct write-authority and template-normalization edge removal |
| Current round | Repair empty-response recovery callback inversion |
| Current round | Route document-prep write-authority edge removal |
| Current round | Codex hook write-authority edge removal |
| Current round | Codex Stop runtime extraction |
| Current round | Start idle-queue writeback edge removal |
| Current round | Start command runtime extraction |
| Current round | Write IPC transport convergence effect-provider edge removal |
| Current round | Crate-root runtime write-provider edge removal |
| Current round | Pipeline frontmatter runtime facade deletion |
| Current round | Write runtime effect facade deletion |
| Current round | Write public write-authority facade deletion |
| Current round | Write required-closeout facade demotion |
| Current round | Write run_command facade demotion |
| Current round | Write run_entry public facade demotion |
| Current round | WriteFlags public DTO demotion |
| Current round | Route command effects facade demotion |
| Current round | Route library facade deletion |
| Current round | Route integration suite relocation |
| Current round | Repair runtime recovery callback IO graph |
| Current round | Repair coordinator direct-call edge removal |
| Current round | Repair run facade deletion |
| Current round | Template response prompt-order repair IO graph |
| Current round | Direct-run compaction diff guard IO graph |
| Current round | Write command request DTO graph |
| Current round | Write strict empty-response repair back-edge removal |
| Current round | Write command runtime crate extraction |
| Current round | Repair replay write-runtime adapter extraction |
| Current round | Repair command bridge extraction |
| Current round | Repair test-only source module deletion |
| Current round | Preflight output DTO graph |
| Current round | Preflight linked-document change detection IO graph |
| Current round | Preflight claims-log IO graph |
| Current round | Preflight baseline content IO graph |
| Current round | Preflight explicit backlog target requirement IO graph |
| Current round | Preflight prompt cleanup runtime IO graph |
| Current round | Preflight route-queue snapshot recovery graph |
| Current round | Preflight IPC truncation recovery graph |
| Current round | Preflight closeout-drift recovery runtime graph |
| Current round | Preflight sweep owner graph |
| Current round | Route CLI entrypoint facade demotion |
| Current round | Route document write authority IO graph |
| Current round | Backlog command runtime effects provider |
| Current round | Status runtime write effects provider |
| Current round | Route runtime effect bundle assembly |
| Current round | Closeout/session-check/repair runtime effects graph; Direct-run runtime effects graph |
| Current round | Orchestration workspace retirement |

| Coarse graph | Moved from | Moved to | Why it moved as a chunk | Fine-grained follow-up seams |
|---|---|---|---|---|
| Focused IO crate wave | `agent-doc-orchestration/src/{snapshot.rs,diff_io.rs,template_io.rs,status_cmd.rs,startup_miss.rs,supervisor/ipc.rs,flow/*.rs}` and related facade adapters | `agent-doc-{archive,codex-hook,controller,diff,flow,git,hooks,ipc,lease,lint,memory,merge,ops-log,prompt-context,repair,response-replay,session-registry,snapshot,status,sync,template,workflow}-io` plus focused domain crates | Commit `539eabb9` created the first broad homes for file/process/socket/sidecar adapters and deleted many orchestration-owned facade modules in one batch so later rounds had real crate seams to move into. | Split the broad IO wave by durable domain once call sites settle; keep pure policy in non-IO crates; keep deleting compatibility re-exports so callers import focused crates directly instead of rebuilding an orchestration facade layer. |
| Legacy route/controller policy wave | `agent-doc-orchestration/src/{route*.rs,route/*.rs,project_controller*.rs,start*.rs,repair.rs}` | `agent-doc-controller`, `agent-doc-supervisor`, `agent-doc-workflow`, `agent-doc-tmux`, and `agent-doc-tmux-commands` | Backfills the pre-ledger route/controller extraction run from commits `21f3fc3f` through `5bcfc07b`: dispatch targets, busy-pane decisions, status classification, restart/idle handling, supervisor replacement, crash policy, and capture policy moved as broad policy batches before the coarse ledger existed. | Finish moving remaining route/project-controller authority into focused controller/supervisor IO crates; split pure dispatch/status decisions from tmux/session lookup effects; delete compatibility helper modules once callers point at focused crates directly. |
| Legacy write/realtime/session-check policy wave | `agent-doc-orchestration/src/{write.rs,write/*,session_check*.rs,session_check/*,flow/closeout.rs}` | `agent-doc-document`, `agent-doc-document-realtime`, `agent-doc-queue`, `agent-doc-turn`, `agent-doc-workflow`, and `agent-doc-flow` | Backfills commits `27a7a849`, `882f1219`, `e320fd49`, `f6c4f88f`, `702e980c`, `73abc196`, and `8dce5536`, which extracted convergence normalization, realtime write policy, queue consume, response replay, partial staging, queue-head guards, closeout drift, and IPC protocol helpers as larger policy slices. | Split deterministic markdown/write normalization from live-authority and realtime effects; keep session-check predicates in workflow/turn policy crates; move remaining IPC transport effects to focused IO without re-embedding write policy in orchestration. |
| Legacy git/sync/frontmatter helper wave | `agent-doc-orchestration/src/{git.rs,sync.rs,resync.rs,resync/*,frontmatter_io.rs}` | `agent-doc-git`, `agent-doc-sync`, `agent-doc-sync-io`, `agent-doc-frontmatter`, `agent-doc-frontmatter-io`, and `agent-doc-process-owner-io` | Backfills commits `6bc00090`, `39ad285a`, `56f965b6`, `10a3b66e`, `a5d24044`, and later sync/process-owner splits that moved git diff/status policy, sync scope/status/lock policy, process-owner inspection, and frontmatter session IO out of orchestration as domain clusters. | Keep splitting the moved sync/resync graph inside `agent-doc-sync-io`; retire the runtime effects port by extracting commit, repair, session-check, and provision-pane callbacks into focused crates; remove duplicate git/frontmatter helper predicates from orchestration. |
| Sync and resync runtime IO graph | `agent-doc-orchestration/src/{sync.rs,sync/*,resync.rs,resync/*}` | `agent-doc-sync-io/src/{sync.rs,sync/*,resync.rs,resync/*}` | `sync` and `resync` were one mutually coupled reconciliation graph over tmux layout, registry repair, pane ownership proof, safe-passive pruning, dead-pane capture, layout repair, and post-sync doctor repair. Moving both together deleted orchestration ownership without inventing a fake split between reconciliation and cleanup. | Split layout, registry projection, pane-repair/closeout recovery, prune/stash cleanup, and safe-passive debounce into smaller sync IO modules; extract the temporary `SyncRuntimeEffects` callbacks for git commit, session-check drift, repair replay, stale-preflight closeout, and route provision-pane into focused crates so the CLI adapter disappears. |
| Compact command archive/write IO graph | `agent-doc-orchestration/src/compact.rs` | `agent-doc-compact-io/src/lib.rs` | Compact owns one user-visible archive/write command graph: archive file creation/indexing, projection guards, CRDT refresh, editor-buffer flush, authoritative compact closeout, and VCS refresh verification. Moving it whole deletes orchestration ownership while leaving the still-tangled write/commit callbacks behind a temporary runtime-effects port. | Split archive file creation/indexing into `agent-doc-archive-io`, projection guard policy into `agent-doc-document`, editor convergence/flush into document realtime IO, and the temporary `CompactRuntimeEffects` callbacks for commit/write/stale-snapshot guard once the write/git graph moves. |
| Document realtime authority IO graph | `agent-doc-orchestration/src/realtime_model.rs` | `agent-doc-document-realtime-io/src/lib.rs` | The durable editor-buffer read authority feed, stale-committed-buffer autoheal, editor broadcast fan-out, dead-editor liveness filtering, targeted IPC patch sidecar creation, and realtime ops-log markers form one document-authority IO graph over debounce sidecars, git blobs, project roots, IPC, plugin-owner liveness, and atomic sidecar writes. Moving it whole deletes the orchestration `realtime_model` owner while keeping pure authority policy in `agent-doc-document-realtime`. | Split durable live-buffer feed, stale-buffer autoheal, and broadcast patch delivery into narrower modules; keep read-authority decisions in `agent-doc-document-realtime`; move patch-sidecar write policy toward IPC IO once write/ipc leaves orchestration. |
| Document realtime visible-write guard IO graph | `agent-doc-orchestration/src/write.rs` visible-write idle/current/reconcile guard implementation and tests | `agent-doc-document-realtime-io/src/lib.rs` | The visible-write guard is one effect graph over debounce typing sidecars, live-buffer divergence, realtime write-policy events, ops-log/flow logging, and disk drift re-read. Moving it whole deletes `write.rs` ownership and keeps pure policy in `agent-doc-document-realtime`. | Split typing debounce wait, live-buffer target proof, and disk-drift reconcile logging into narrower realtime IO modules; move remaining write convergence adapters out of orchestration once document write authority is focused. |
| Claim command binding IO graph | `agent-doc-orchestration/src/claim.rs` | `agent-doc-claim-io/src/lib.rs` | Claim is one command-binding IO graph over tmux pane selection, cross-session guard logging, empty-document scaffold writes, session registry updates, project config defaulting, snapshot initialization, watch startup, sync prune, and route provisioning. Moving it whole deletes the orchestration claim facade while keeping pure claim admission in `agent-doc-controller`, claim binding policy in `agent-doc-supervisor`, and document scaffold policy in `agent-doc-document`. | Split git commit, route pane provisioning, sync prune, and cross-root owner-pane checks out of the temporary `ClaimRuntimeEffects`/direct IO graph once git/route/sync are focused enough; keep claim scaffold/defaulting in `agent-doc-document` and claim admission in `agent-doc-controller`. |
| Stream command writeback IO graph | `agent-doc-orchestration/src/stream.rs` | `agent-doc-stream-io/src/lib.rs` | Stream is one command writeback graph over streaming-agent submission, prompt-context assembly, session accretion, periodic CRDT/template replacement flushes, editor IPC-first writeback, partial checkpoints, pending recovery, resume frontmatter writes, lint gating, snapshot/CRDT persistence, and post-write hooks. Moving it whole deletes the orchestration stream facade while making the remaining git/write/repair/hook effects explicit in a CLI-side runtime port. | Split streaming runtime callbacks for git commit, pending recovery, atomic write authority, IPC flush, and post-write hooks into focused crates once git/write/repair leave orchestration; keep stream prompt/rendering policy in prompt-context and agent streaming contracts in turn-executor. |
| Post-response hook concrete effects IO graph | `agent-doc-orchestration/src/lib.rs` post-response hook effect helpers and duplicate root CLI helpers in `src/main.rs` | `agent-doc-hooks-io/src/lib.rs` as `default_post_response_hook_effects` with direct capture/memory/lease/plugin-owner IO dependencies | The concrete post-write/post-commit hook effect graph has no orchestration dependencies: active capture loading, capture metadata shaping, tsift-memory closeout, local-model lease reap, and stale JetBrains consumer cleanup all call focused IO crates directly. Moving the whole graph deletes the orchestration hook bridge and the duplicate CLI helper while reducing orchestration's direct dependency surface. | Keep hook event dispatch and concrete hook closeout effects in `agent-doc-hooks-io`; split capture metadata shaping only if capture lifecycle grows its own event projection API; route stream/write callers directly to `default_post_response_hook_effects` instead of reintroducing command facades. |
| Template backlog normalization IO graph | `agent-doc-orchestration/src/write/materialize.rs` and `agent-doc-orchestration/src/write.rs` pending replace enforcement/capture helpers and tests | `agent-doc-template-io/src/backlog_normalization.rs` | Backlog normalization is one file-backed template/backlog mutation IO graph over parsing current components, backfilling IDs, preserving non-item structure, visible-write guard, ops-log, and cycle-state pending mutation/done id markers. Moving it whole deletes orchestration ownership and avoids a write facade. | Split pure backlog patch normalization/backfill policy into `agent-doc-element-backlog` or `agent-doc-template`, keep file writes/cycle-state/logging in IO, and continue extracting write-time pending checks and document-convergence callbacks from orchestration. |
| Write normalization and response materialization IO graph | `agent-doc-orchestration/src/write/{normalize.rs,materialize.rs}` | `agent-doc-template-io/src/{write_normalize.rs,response_materialization_io.rs}` with run, preflight, repair, orchestrate-dispatch, write, and IPC callers importing focused template IO directly | Imperative-response contract enforcement, template-mode override detection, safe user-prompt normalization with snapshot/HEAD reads and ops-log metrics, IPC response-materialization proof logging, partial-materialization retry cleanup, and the moved unit tests shared one write/template IO graph around template response materialization and exchange normalization. Moving them together deletes two orchestration write submodules; orchestration keeps only a tiny stale-supervisor recycle callback adapter where the IPC proof logger still needs write-convergence effects. | Split the stale-supervisor recycle callback into focused IPC/write-convergence IO so the local write adapter can disappear; reduce `agent-doc-template-io` dependencies by moving pure normalization tests to the pure owner crates; continue shrinking write convergence and IPC transport callbacks now that pending checks have moved. |
| Write pending capture and done guard IO graph | `agent-doc-orchestration/src/write/pending_checks.rs` plus the review-done source guard in `agent-doc-orchestration/src/write.rs` | `agent-doc-session-check-io/src/write_pending_checks.rs` with write/run-entry callers importing `agent_doc_session_check_io` directly and passing explicit backlog-effects/pending-maintenance ports | Prewrite/precommit pending-capture gates, pending-done/malformed tracked-item gates, auto-done application, review-done source enforcement, closeout pending-maintenance detection, typed closeout guard logging, and the focused unit tests share one cycle-state/capture/frontmatter/backlog/document/ops-log/session-check IO graph. Moving them together deletes the `write/pending_checks.rs` orchestration submodule and moves guard policy beside the existing session-check IO guard-mode and pending-capture adapters while leaving orchestration to sequence write effects. | Split guard-result wording and pending-capture projection calls from durable file reads; split auto-done mutation into a narrower backlog IO service; move closeout pending-maintenance writeback out of the orchestration preflight callback when preflight maintenance has a focused port; replace broad `WriteFlags` conversion with narrower call-site inputs as run/write paths continue to shrink. |
| Preflight maintenance IO graph | `agent-doc-orchestration/src/preflight/maintenance.rs` plus adjacent preflight helper/test fixtures | `agent-doc-preflight-io/src/lib.rs` with preflight, write, route, and closeout callers importing focused preflight IO directly and orchestration supplying only `PreflightMaintenanceWriteEffects` | Pending tracked-work maintenance, gate verification, queue inspection/maintenance, free-text admission, backlog queue sync, queue-control binding, queue convergence, in-progress marker sync, selected/deferred queue state events, live editor queue convergence, snapshot sync, and tests shared one preflight maintenance graph over document/queue/backlog/frontmatter/cycle/snapshot/IPC/state-backbone/memory IO. Moving it together deletes the last preflight maintenance submodule and removes the closeout pending-maintenance callback to orchestration preflight. | Split pending tracked-work maintenance from queue maintenance; move queue live-buffer convergence to queue/document realtime IO; split state-event emission; replace the broad write-effects port with a focused document write authority crate when write convergence leaves orchestration; split free-text admission config/harness reads from queue mutation. |
| Preflight layout health and repair IO graph | `agent-doc-orchestration/src/preflight.rs` session-drift auto-resync, superseded drift-session cleanup, base-index repair counter/reset, tmux layout inspection, and duplicate-claim detection | `agent-doc-preflight-io/src/layout.rs` with the preflight command importing focused layout adapters directly | Layout health is one tmux/session-registry/sync IO graph with no orchestration callbacks. Moving it whole removes another production preflight responsibility from orchestration while keeping the command graph unchanged and making the remaining preflight extraction mostly about repair/commit/write/session-check effects. | Split read-only layout inspection from mutating drift/base-index repair if the command runtime needs a probe-only port; move remaining preflight command body to `agent-doc-preflight-io` behind narrow commit/write/repair/session-check effects. |
| Preflight cycle-completion coordinator and runtime effects | `agent-doc-orchestration/src/preflight.rs` interrupted-cycle recovery/commit/session-check coordinator (`enforce_cycle_completion`), missing-commit recovery, open-cycle repair/commit retry, bypassed-response marker hinting, IPC dogfood note append sequencing, resume success/block audit rows, and the concrete repair/commit/session-check/bypassed-response effect provider | `agent-doc-preflight-io/src/lib.rs` as `enforce_cycle_completion` behind `PreflightCycleCompletionEffects`, plus `agent-doc-preflight-runtime-io/src/lib.rs` as `preflight_cycle_completion_effects` with orchestration injecting the still-write-bound repair coordinator and the closeout-runtime session-check effects while write replay is still inside orchestration | The interrupted-cycle guard is a preflight use-case graph: it decides how preflight resumes or fails closed before diffing. The concrete runtime provider was a second, smaller graph over a repair coordinator callback, commit, session inspection, and bypassed-response detection; moving it into preflight runtime IO makes the duplicate recovery policy and runtime wiring discoverable together while removing another concrete effect holder from orchestration without creating a preflight-runtime/repair-runtime/closeout-runtime dependency cycle. | Move the remaining repair coordinator injection after write replay/apply exits orchestration; Move session-check runtime effects into a cycle-free focused owner or Keep them injected until closeout-runtime no longer depends on preflight-runtime; Split `PreflightCycleCompletionEffects` into repair, commit, session-inspection, and bypassed-response evidence ports only if alternate runtimes need independent ports. |
| Preflight IPC dogfood note append IO graph | `agent-doc-orchestration/src/preflight.rs` `append_latest_ipc_dogfood_note` and `append_ipc_dogfood_note_for_diagnostic` over dogfood-root gating, IPC diagnostic lookup, exchange note formatting/deduplication, file write, and ops-log marker | `agent-doc-preflight-io/src/lib.rs` as `append_latest_ipc_dogfood_note` and `append_ipc_dogfood_note_for_diagnostic`, with `enforce_cycle_completion` calling the focused appender directly | IPC diagnostic dogfood note append is preflight-specific recovery IO, not a generic orchestration callback. Moving it beside the cycle-completion coordinator removes a callback method, keeps the user-document dogfood gate discoverable, and centralizes duplicated IPC diagnostic note policy in preflight IO. | Split dogfood-root detection, latest diagnostic lookup, exchange note synthesis/dedupe, atomic file write, and ops-log marker into narrower ports if a future non-file writer needs to reuse this appender without direct disk writes. |
| Preflight auto-GC and stale actor cleanup IO graph | `agent-doc-orchestration/src/preflight/run.rs` `PreflightGcControllerEffects`, daily state-db coordination throttle, stale starting actor cleanup, and controller-backed GC configuration | `agent-doc-preflight-io/src/gc.rs` with the preflight command calling `agent_doc_preflight_io::gc::run_preflight_auto_gc(file)` | The preflight auto-GC path is one controller/GC/project-root IO graph with no orchestration callbacks. Moving it whole deletes another production helper from the command runtime and keeps stale actor cleanup beside the focused GC adapter instead of inside orchestration. | Split stale starting actor cleanup from coordination-throttled broad GC if they need different scheduling; move remaining preflight command body to `agent-doc-preflight-io` behind narrow commit/write/repair/session-check effects. |
| Preflight debounce wait IO graph | `agent-doc-orchestration/src/preflight.rs` `preflight_debounce_ms` and visible-mutation typing wait plus `agent-doc-orchestration/src/preflight/run.rs` mtime/typing debounce loop and `start/idle_watch.rs` debounce config caller | `agent-doc-preflight-io/src/debounce.rs` with preflight and idle-watch callers importing focused debounce adapters directly | Preflight debounce is one editor-typing/file-mtime IO graph over frontmatter debounce config, typing sidecars, ops-log deferral evidence, and tracing. Moving it together deletes duplicate debounce config parsing from orchestration and lets preflight command code sequence waits without owning sidecar polling. | Split remaining private debounce config helper inside `agent-doc-preflight-io/src/lib.rs` from the public module helper; split pre-mutation fail-closed wait from post-claims settle wait if callers need separate policy knobs. |
| Preflight stale install and editor-plugin warning IO graph | `agent-doc-orchestration/src/preflight.rs` stale install artifact warning, expected editor-plugin version baking, plugin version comparison/deduplication, and live-buffer plugin warning tests plus the editor-version half of `agent-doc-orchestration/build.rs` | `agent-doc-preflight-io/src/warnings.rs` and `agent-doc-preflight-io/build.rs`, with preflight importing focused warning adapters directly | Stale binary/plugin warnings are one read-only preflight warning graph over install freshness, supervisor artifact classification, live editor sidecars, and build-time editor plugin versions. Moving it whole removes warning policy and build-script editor-source reads from orchestration while keeping preflight sequencing unchanged. | Split stale install freshness from live editor plugin version warnings if they need different release cadence; move remaining preflight command body to `agent-doc-preflight-io` behind narrow commit/write/repair/session-check effects. |
| Preflight harness and content-policy warning IO graph | `agent-doc-orchestration/src/preflight/run.rs` initial harness mismatch/stale-supervisor/Codex-network warning assembly plus late post-exchange comment, component-attr, preset-collision, stale-install, and stale-plugin warning aggregation | `agent-doc-preflight-io/src/warnings.rs` as `initial_warnings` and `content_and_staleness_warnings`, with preflight sequencing logging the returned warnings | These warnings are one read-only preflight advisory graph over model-tier policy, controller freshness, workflow content policy, git root lookup, install freshness, and live editor sidecars. Moving the aggregation whole removes warning construction from the command runtime and leaves orchestration only to sequence and print warnings. | Split model-tier/harness warnings from content-policy warnings once preflight command ownership moves; keep stale install/plugin warnings in focused warning modules and move remaining warning-producing command effects as their owner crates emerge. |
| Preflight semantic advisory warning graph | `agent-doc-orchestration/src/preflight/run.rs` semantic completion retrieval warning/match formatting | `agent-doc-preflight-io/src/warnings.rs` as `semantic_completion_warnings`, with preflight retaining only warning vector sequencing | Completion-memory advisories remain a read-only preflight graph. Semantic merge conflicts are no longer preflight warnings: closeout projects them as cycle-local reactive state and clears them at the next turn boundary. | Move remaining queue-stall and stuck-capture warning construction with their owner effects. |
| Closeout transaction and recovery IO graph | `agent-doc-orchestration/src/flow/closeout.rs` production closeout transaction, recovery evidence/classification adapters, stale-capture mutation primitive, terminal-proof ledger, fallback-patch cleanup, and direct production callers | `agent-doc-flow-io/src/closeout.rs` with production callers importing focused closeout IO directly and orchestration supplying only `CloseoutEffects` for commit, preflight maintenance, session-check, repair cancel, IPC degraded lookup, and pipeline frontmatter | The closeout path is one transaction/recovery graph over CRDT delivery barriers, git commit retries, pending-maintenance reap, session-check enforcement, terminal proof ledger rows, compacted-capture reconciliation, fallback-patch cleanup, recovery evidence, stale-capture retirement, metadata-drift restore/commit, and closeout guard flow logging. Moving it together deletes production ownership from orchestration and leaves the old closeout module as a test-only adapter instead of a runtime facade. | Split `CloseoutEffects` into narrower ports for commit/session-check/preflight/repair/write IPC; move the remaining test tail into `agent-doc-flow-io` once it no longer needs orchestration fixtures; split terminal proof ledger, stale-capture mutation, compacted-capture reconciliation, and metadata-drift recovery into smaller closeout IO modules; move session-check recovery detections behind focused closeout/session-check read models to shrink the effects surface. |
| Session-check command and closeout runtime IO graph | `agent-doc-orchestration/src/session_check.rs` production command/runtime body: status/report types, CLI `run*`, `inspect*`, closeout enforcement, late-IPC self-heal, uncommitted closeout drift classification, queue continuation final-gate handling, startup-miss warning cleanup, ops-log fallback inspection, blocked-closeout diagnostics, duplicate patchback detection, and direct production guard sweep | `agent-doc-session-check-io/src/command.rs` with orchestration retaining only the `SessionCheckEffects` port for closeout recovery hint rendering, atomic writes, historical snapshot repair, and missing commit-boundary recovery plus the existing orchestration-heavy test module | The remaining session-check production body was one runtime graph over cycle state, queue continuation markers, realtime document reads, guard adapters, ops-log fallback state, startup-miss IO, supervisor/controller warnings, closeout recovery hints, git side-effect messaging, and a few still-orchestration write/git/repair effects. Moving it together deleted production ownership from orchestration and left only a temporary effects/test tail. | Split `SessionCheckEffects` into narrower recovery/write/git/repair ports; move the retained orchestration test module into `agent-doc-session-check-io` once fixtures no longer need orchestration globals; split queue continuation final-gate printing from read-only inspection; move closeout recovery hint classification fully into closeout/session-check IO when git/repair recovery ports are focused. |
| Session-check production facade demotion | `agent-doc-orchestration/src/session_check.rs` public production wrappers plus `src/main.rs`, `src/mcp.rs`, and orchestration runtime callers still routed through `agent_doc_orchestration::session_check` or `crate::session_check` | `agent-doc-session-check-io/src/command.rs` direct `agent_doc_session_check_io::{run_with_options,inspect,inspect_with_warnings,enforce_clean_closeout,detect_uncommitted_closeout_drift*}` calls with `agent_doc_orchestration::session_check_effects()` / `crate::session_check_effects()`, while `agent-doc-orchestration/src/lib.rs` temporarily kept only a test-only source shim | The focused session-check runtime already owned command behavior; the remaining public orchestration module had become a facade. Demoting it to test-only and moving every production caller to the focused crate removed another public orchestration API without changing the shared recovery/write/git effects port. | Move the test-only session-check boundary tests into `agent-doc-session-check-io`; split `session_check_effects` into narrower closeout-recovery, atomic-write, snapshot-repair, and missing-commit-boundary ports; retire the root effects provider once git/write/repair closeout callbacks are focused. |
| Session-check test-only command facade deletion | `agent-doc-orchestration/src/session_check.rs` retained test-only `pub use agent_doc_session_check_io`, `run_with_options`, `inspect`, `inspect_with_warnings`, and `enforce_clean_closeout` wrappers around the focused command runtime | `agent-doc-session-check-io/src/command.rs` direct `agent_doc_session_check_io::{run_with_options,inspect,inspect_with_warnings,enforce_clean_closeout}` calls inside the remaining orchestration session-check tests with `crate::session_check_effects()` before the tests moved out of `src/` | After production callers moved, the retained test module still reintroduced public-looking command facade names. Deleting those wrappers made the remaining tests exercise the focused session-check IO API directly and prevented the orchestration module from keeping a hidden command surface. | Move the remaining session-check boundary tests into `agent-doc-session-check-io`; split `SessionCheckEffects` into narrower recovery/write/git/repair ports so those tests no longer need orchestration globals. |
| Session-check test-only source module deletion | `agent-doc-orchestration/src/session_check.rs` remaining 7k-line test-only source module with historical session-check boundary coverage, local inspect helpers, and direct calls into focused command/guard IO through orchestration effects providers | `agent-doc-orchestration/tests/session_check.rs` as an integration test using `agent_doc_session_check_io::*` plus explicit focused `agent_doc_document_realtime_io::RUNTIME_PIPELINE_FRONTMATTER_EFFECTS` and closeout/session-check runtime providers | The session-check source file no longer owned production behavior; keeping it under `src/` preserved a fake orchestration module and made progress look smaller than it was. Moving the whole remaining boundary suite out of the source tree deletes the shim in one coarse pass while making the remaining broad effects dependency explicit through focused runtime crates instead of public orchestration effects handles. | Move the remaining orchestration-bound session-check tests into `agent-doc-session-check-io`; retire the remaining temporary public effects handles once git/write/repair/frontmatter closeout callbacks are focused. |
| Session-check integration suite relocation | `agent-doc-orchestration/tests/session_check.rs` historical session-check boundary integration suite with broad closeout-runtime effects, realtime frontmatter mutation fixtures, ops-log/snapshot/cycle-state setup, queue continuation probes, and IPC/session-registry regression coverage | `agent-doc-session-check-io/tests/session_check.rs` with explicit dev-dependencies on closeout runtime, IPC, prompt-lines, session registry, sqlite, supervisor, and shared test support | The suite no longer needed orchestration source modules or root effects providers; moving it whole deletes another orchestration-owned test surface and makes the remaining broad session-check fixture graph visible on the focused crate that owns the command/guard IO. | Split the broad session-check effects fixtures into smaller owner-crate suites; move pure guard/prompt/queue policy cases toward `agent-doc-workflow`, `agent-doc-turn`, or `agent-doc-queue`; keep closeout-runtime and IPC/session-registry fixtures only where the runtime edge is under test. |
| Flow closeout effects facade demotion | `agent-doc-orchestration/src/flow/mod.rs` public production `closeout_effects` facade plus `src/main.rs`, `src/session_actor_cmd.rs`, and orchestration runtime callers still routed through `agent_doc_orchestration::flow` or `crate::flow` | Direct calls into `agent-doc-flow-io` via `agent_doc_flow_io::closeout::*` with `agent_doc_orchestration::closeout_effects()` / `crate::closeout_effects()`, leaving the temporary closeout boundary tests as the only flow source-module users before the next deletion pass | The closeout transaction/recovery runtime already lives in `agent-doc-flow-io`; the remaining production `flow` module had become an effects-provider facade. Demoting it to test-only removed another public orchestration API and kept the broad closeout callback port explicit at the temporary crate-root boundary. | Split `CloseoutEffects` into narrower commit, session-check, preflight-maintenance, repair-cancel, write-IPC, and pipeline-frontmatter ports; the test-only flow source module deletion is tracked in the next row; retire the root effects provider once those callbacks live in focused crates. |
| Flow test-only source module deletion | `agent-doc-orchestration/src/flow/{mod.rs,closeout.rs}` test-only flow event coverage and closeout boundary tests that still compiled as an orchestration source module | `agent-doc-orchestration/tests/{flow_closeout.rs,flow_events.rs}` integration tests calling `agent_doc_flow_io::closeout::*` through `agent_doc_orchestration::closeout_effects()` plus local focused frontmatter/plugin-owner fixtures | The flow source tree no longer owned production behavior, but keeping it under `src/` preserved a fake orchestration module and hid that the remaining closeout tests are boundary coverage for the broad temporary effects port. Moving the tests out deletes the source module entirely, keeps the coverage running, and makes the remaining blocker explicit: the tests still need orchestration's git/write/repair/session-check effect bundle until that port is split. | Move the remaining orchestration-bound closeout effect fixtures into `agent-doc-flow-io` after the git/write/repair effects split; split the broad `CloseoutEffects` port into focused commit, session-check, preflight-maintenance, repair-cancel, write-IPC, and pipeline-frontmatter ports; then remove the root closeout effect provider. |
| Flow integration suite relocation | `agent-doc-orchestration/tests/{flow_closeout.rs,flow_events.rs}` historical closeout and flow-event integration suites | `agent-doc-flow-io/tests/{flow_closeout.rs,flow_events.rs}` with closeout tests using `agent-doc-closeout-runtime-io` and flow-event coverage importing focused event producers directly | The flow tests no longer needed orchestration fixtures after closeout runtime effects moved out. Moving the pair to `agent-doc-flow-io` deletes another orchestration-owned test suite and keeps closeout/flow-event boundary coverage beside the focused IO owner. | Split broad closeout fixtures between `agent-doc-flow-io` and smaller owner crates as effect ports narrow; keep pure flow-event vocabulary assertions in `agent-doc-flow` once cross-crate event producers have stable test helpers. |
| Closeout/session-check/repair runtime effects graph | `agent-doc-orchestration/src/lib.rs` crate-root `OrchestrationRepairIoEffects`, `OrchestrationSessionCheckEffects`, `OrchestrationCloseoutEffects`, `REPAIR_IO_EFFECTS`, `session_check_effects`, `closeout_effects`, and `closeout_recovery_hint` plus production callers | `agent-doc-closeout-runtime-io/src/lib.rs` with callers importing focused runtime effects directly | The closeout/session/repair callbacks form one runtime cycle: closeout invokes session-check and repair cancel; session-check invokes repair boundary recovery and closeout hints; repair recovery mutations invoke closeout recovery mutation application. Moving the whole provider graph deletes orchestration root authority without inventing a fake layer split. | Split `RuntimeRepairIoEffects`, `RuntimeSessionCheckEffects`, and `RuntimeCloseoutEffects` when their mutual callbacks are broken; Move repair replay/write callbacks after `write` extraction; delete remaining orchestration repair coordinator references once `RepairCoordinatorEffects` has focused runtime providers. |
| Direct-run runtime effects graph | `agent-doc-orchestration/src/lib.rs` crate-root `OrchestrationDirectRunEffects` and `DIRECT_RUN_EFFECTS` plus CLI direct-run dispatch references | `agent-doc-run-runtime-io/src/lib.rs` with CLI and tests importing `DIRECT_RUN_EFFECTS` directly | Direct-run production effects are one command callback bundle over commit, template normalization, document write authority, queue-consume writeback, closeout completion, and recursive-cycle abandonment. Moving the bundle whole matches the focused direct-run command graph already in `agent-doc-run-io` and deletes the orchestration root provider. | Split commit, template normalization, queue writeback, closeout completion, and cycle-abandon callbacks after write/closeout ports narrow; Move direct-run integration fixture coverage into `agent-doc-run-runtime-io` or `agent-doc-run-io`; Keep CLI calling focused crates directly. |
| Orchestration test support helper graph | `agent-doc-orchestration/src/test_support.rs` process-global env lock, live plugin owner lease seeding, temp git document fixtures, fake IPC ack listeners, and convergence fixture documents used by orchestration tests | `agent-doc-test-support/src/lib.rs` as a shared test-support crate used by `agent-doc-orchestration` dev-dependencies | The helper module had no orchestration-local dependencies but kept test-only env/IPC/git fixture ownership inside the God crate. Moving it whole deletes an internal test facade and lets future moved integration tests reuse focused helpers without depending on orchestration internals. | Move remaining orchestration integration fixtures into focused IO crate test helpers; split fake IPC listeners from markdown fixture strings if more crates consume them; keep process-global locking in one shared test-support crate. |
| Route tmux mock-agent test helper graph | `agent-doc-orchestration/src/route.rs` route-local tmux serialization locks, cwd guard, pane polling/send helpers, mock agent binary writers, and mock agent launch/prompt wait helpers shared by route startup and pane-resolution tests | `agent-doc-test-support/src/lib.rs` with `route.rs` retaining only a test-only `pub(crate) use` adapter for existing fixture modules | These helpers are pure test infrastructure over tmux-router, tmux capture IO, env locking, and temporary executable scripts. Keeping them in `route.rs` forced route-startup and pane-resolution fixture moves to depend on orchestration internals. Moving the whole helper graph creates a shared test fixture surface without introducing a route-IO/orchestration cycle. | Move route startup and pane-resolution tests into focused route IO fixtures; split tmux locks from mock binary writers if non-route crates start consuming only one side; keep route-specific actor-record fixtures out of test-support until they have a focused route-IO test home. |
| Repair pending response sidecar IO graph | `agent-doc-orchestration/src/repair.rs` `save_pending`/`clear_pending` production bodies | `agent-doc-repair-io/src/pending.rs` with orchestration retaining compatibility wrappers for existing write/run/codex-hook callers | Pending response durability, capture-state recording, pending-path creation, pre-response cleanup, and write-applied capture marking are one sidecar IO graph around repair recovery. Moving it whole keeps pending response persistence beside blocked repair payload persistence and removes another write/repair side effect from orchestration. | Point write, run, stream/sync effects, Codex hook, and tests at `agent_doc_repair_io::pending` directly, then delete the orchestration wrappers; split capture recording from pending-file storage only if capture lifecycle IO gets a narrower home; add a narrower pending-response port for stream/sync once their runtime effects shrink. |
| Repair pending direct-call migration | `agent-doc-orchestration/src/repair.rs` compatibility wrappers plus write/run/Codex-hook/root runtime-effect callers still routing through `crate::repair`/`agent_doc_orchestration::repair` | Direct `agent_doc_repair_io::pending::{save_pending,clear_pending}` imports at production/test call sites targeting `agent-doc-repair-io/src/pending.rs`, with the orchestration wrapper functions deleted | The sidecar graph had already moved; retaining wrappers would rebuild the facade layer the extraction is trying to remove. Migrating all current callers in one batch makes repair IO the real owner and turns orchestration repair back into replay/recovery logic only. | Move the remaining stream/sync runtime-effect pending ports once those crates can depend on repair IO directly; keep blocked-payload and pending-response sidecars in repair IO unless capture lifecycle gets a narrower storage crate. |
| Git commit transaction IO graph | `agent-doc-orchestration/src/git.rs` repo commit lock, parent submodule pointer update, ignored-path detection, snapshot staging, hash-object/update-index fallback, commit execution, and retryable index-lock error classification | `agent-doc-git-io/src/transaction.rs` exported through `agent-doc-git-io/src/lib.rs`, with orchestration importing `agent_doc_git_io::transaction::{CommitLock,CommitTransactionError,stage_and_commit_once,update_parent_submodule_pointer}` | These helpers form one process-level git transaction over the repo lock, git index, object database, and commit command. Moving them together deletes the coarse git-process ownership chunk from orchestration without dragging the document/snapshot/live-buffer policy decisions into git IO. | Move the remaining commit-seam document policy out of `agent-doc-orchestration/src/git.rs` in smaller seams: queue-head strike, snapshot/head drift repair, boundary reposition/self-heal, live-editor materialization guards, post-commit sidecar refresh, and final commit outcome logging. |
| Git committed historical snapshot repair IO graph | `agent-doc-orchestration/src/git.rs` committed-historical snapshot drift repair over stale snapshots, HEAD/current exchange normalization, turn-scope drift filtering, visible-rebase guard, ops-log audit rows, and snapshot persistence | `agent-doc-repair-io/src/lib.rs` as `repair_committed_historical_snapshot_drift`, with git commit, repair replay, and `SessionCheckEffects` callers importing focused repair IO directly | The repair path was a cohesive commit-seam recovery graph rather than raw git plumbing: it reads snapshot/HEAD/current content, classifies committed historical response drift, preserves compacted visible state via write-convergence guard, and writes repair audit/snapshot sidecars. Moving it into repair IO avoids a `git-io` dependency cycle and removes another document-repair decision from orchestration `git.rs`. | Split visible-rebase guard and historical mutation classification; move pure exchange/head normalization decisions into document/turn policy; narrow `SessionCheckEffects` so snapshot repair no longer reaches through the orchestration root. |
| Repair commit-boundary and backlog reap IO graph | `agent-doc-orchestration/src/repair.rs` missing commit-boundary recovery, completed backlog reap repair, explicit preflight cancel recovery, committed-capture replay detection, visible-response recovery extraction, and HEAD/current equality checks over cycle-state, ops-log, HEAD/snapshot verification, capture commit markers, backlog/archive mutation, snapshot sync, and terminal guard logging | `agent-doc-repair-io/src/lib.rs` as `recover_missing_commit_boundary`, `repair_completed_backlog_items`, `cancel_preflight_cycle`, `historical_committed_capture_replay`, `visible_response_patch_from_document`, and `head_already_matches_current_doc`, with orchestration supplying only `RepairIoEffects` for atomic visible writes and pipeline-frontmatter terminal marking | These recovery paths shared the same repair IO authority shape: they decide a durable repair from sidecars/current document/git state, mutate document/snapshot/capture/cycle sidecars, and emit repair audit events. Moving them together keeps repair recovery beside the existing historical snapshot repair and replaces direct orchestration ownership with a narrow effect port. | Split commit-boundary, preflight-cancel, replay detection, and backlog reap effects; move backlog reap pure policy into backlog/document crates; split replay-detection helpers from mutation helpers; retire `RepairIoEffects` once document write authority and pipeline-frontmatter terminal marking leave the orchestration root. |
| Repair stale preflight recovery IO graph | `agent-doc-orchestration/src/repair.rs` stale `preflight_started` recovery over cycle-state, snapshots, committed patchback visibility, bypassed-response/unstarted-prompt detection, empty-cycle abandonment, terminal frontmatter marking, and closeout guard logging | `agent-doc-repair-io/src/lib.rs` as `repair_stale_preflight_started_cycle`, with orchestration supplying only `RepairIoEffects` for visible writes and terminal frontmatter updates | This recovery path is one repair IO graph: it reads current/snapshot/git/cycle sidecars, classifies whether the visible response is recoverable, stale, empty, bypassed, or ambiguous, then commits/abandons the cycle and logs the recovery outcome. Moving it with the other repair graphs removes another long decision body from orchestration while preserving the existing narrow repair effects port. | Split empty-cycle abandonment, bypassed-response detection, committed patchback recovery, and terminal frontmatter effects; move pure stale-cycle classification into turn/document policy; move bypassed-response and first-unstarted-prompt probes behind a smaller session-check read model; retire `RepairIoEffects` after visible write authority and terminal frontmatter updates leave orchestration. |
| Repair stale-capture retirement IO graph | `agent-doc-orchestration/src/repair.rs` stale-capture retirement, manual escaped-tail removal respect, replay-baseline drift evidence, captured-heading supersession checks, and closeout stale-capture mutation dispatch | `agent-doc-repair-io/src/lib.rs` as `retire_stale_capture_if_drifted` and `respect_manual_exchange_tail_removal_if_safe`, with orchestration supplying only `RepairIoEffects` for the closeout recovery mutation callback | Stale capture retirement is one repair-sidecar graph over capture state, replay-baseline drift, snapshot/current tail comparison, workflow-owned retirement policy, closeout stale-capture mutation, ops-log rows, and capture/pending cleanup. Moving it as a batch removes another capture-recovery decision body from orchestration and keeps capture repair evidence gathering beside the focused repair sidecar owner. | Split closeout stale-capture mutation into a narrower repair/capture effects port; move remaining template normalization repair from orchestration once write normalization and atomic write authority are focused; continue shrinking `RepairIoEffects` by extracting visible-write and pipeline-frontmatter callbacks. |
| Repair strict empty-response closeout coordinator seam | `agent-doc-orchestration/src/write.rs` strict empty-stdin closeout coordinator and `WriteFlags`-coupled recovery call sites | `agent-doc-orchestration/src/repair.rs` as `recover_empty_response_for_strict_closeout`, with write entry points passing primitive strict/pending flags and tests asserting the repair-owned boundary | The coordinator belongs to repair because it sequences repair replay, committed-HEAD response restoration, and dedupe-only drift recovery. Moving it out of write breaks the write-to-repair ownership cycle at the entry seam without prematurely moving the then-write-backed low-level recovery helpers. | Move the remaining write-command recovery bridge after `CommandOptions`/`CommitMode` leave `write.rs`; keep the committed-HEAD and dedupe-only callbacks in the focused runtime IO owner. |
| Commit-seam free-text queue strike IO graph | `agent-doc-orchestration/src/git.rs` capture-response lookup, best-effort commit-seam answered free-text queue strike, force-disk queue writeback dispatch, snapshot strike sync, and `commit_seam_free_text_strike` audit logging | `agent-doc-queue-io/src/queue_consume.rs` as `strike_answered_free_text_heads_at_commit_seam`, with `git.rs` supplying only the existing `QueueConsumeWriteEffects` implementation | This graph is queue-consume IO, not git plumbing: it reads cycle/capture sidecars for the response body, matches answered free-text queue heads, writes document/snapshot queue strikes, and emits queue-specific audit rows. Moving it beside `strike_answered_free_text_queue_heads` removes another commit-seam helper from orchestration while preserving the existing writeback effects boundary. | Split capture lookup from queue strike writeback; move capture response-body resolution into capture IO if more commit/repair seams need it; narrow the document realtime queue-writeback runtime provider once document write authority leaves orchestration. |
| Retired supervisor CRDT replica IPC adapter graph | `agent-doc-orchestration/src/start/supervisor_io.rs` legacy CRDT replica register/deregister/update/pull/ack/awareness handlers, base64/JSON response mapping, and direct relay calls | `agent-doc-controller-io` owns the project controller `crdt_replica` RPC on `.agent-doc/controller.sock`; supervisor IPC no longer carries editor CRDT traffic | The editor buffer authority belongs at the CP boundary. Keeping replica methods on the supervisor made each editor resolve a session-owned socket and let detached editor state bypass the controller route that arbitrates live-buffer authority. | Keep supervisor IPC limited to supervisor lifecycle/state/inject commands; route editor CRDT operations through CP/controller relay APIs and keep negative serde tests proving legacy supervisor CRDT wire methods are rejected. |
| Supervisor PTY process primitives graph | `agent-doc-orchestration/src/start.rs` `SharedPtyWriter`, interruptible fd/write helpers, stop self-pipe, and `SupervisorShared` output buffer/screen state plus call sites in `start/detection.rs` and `start/run.rs` | `agent-doc-supervisor-process/src/{shared_writer.rs,output_state.rs}` with orchestration importing the focused process primitives | The shared writer, stop signal, bounded recent-output buffer, and alacritty-backed visible-screen projection are one process-owned PTY state graph used by reader/writer threads, auto-trigger injection, permission-prompt translation, resize handling, and prompt detection. Moving them together removes low-level process mechanics from orchestration while leaving actor lifecycle, tmux pane probing, and idle-watch policy in orchestration until their effect ports are narrow enough. | Move `spawn_reader_thread`/`spawn_writer_thread` next behind callbacks for output recording, prompt-ready transition, permission-prompt stdin normalization, and input diagnostics; then move supervisor IPC inject/restart/stop handling behind a state/effects trait; keep pure prompt/readiness policy in `agent-doc-supervisor` and process/fd mechanics in `agent-doc-supervisor-process`. |
| Supervisor PTY thread loop graph | `agent-doc-orchestration/src/start/supervisor_io.rs` `spawn_reader_thread`, Unix/non-Unix `spawn_writer_thread`, PTY filter/stdout forwarding, stdin poll/stop-pipe forwarding, stale-Ctrl-D suppression, permission-prompt translation logging, Ctrl-C/Ctrl-D forwarding flags, and thread-exit tests | `agent-doc-supervisor-process/src/io_threads.rs`, with orchestration implementing `PtyReaderObserver` and `StdinForwardObserver` for `SupervisorShared` | The reader/writer loops are one process-owned graph over PTY filtering, fd polling, stop cancellation, shared-writer locking, and input diagnostics. Moving them together follows the previous PTY primitive extraction and leaves orchestration with only callback decisions for prompt-ready transition, output-state recording, and permission-prompt normalization. | Move supervisor IPC inject/restart/stop/state handling behind a state/effects trait; move prompt permission normalization into a focused supervisor input policy once it no longer reads orchestration output state directly; keep shrinking `SupervisorShared` until `start/supervisor_io.rs` becomes a socket-handler adapter or disappears. |
| Supervisor process observer adapter graph | `agent-doc-orchestration/src/start/supervisor_io.rs` direct `PtyReaderObserver` and `StdinForwardObserver` impls over prompt-ready transition, stale-Ctrl-D suppression flags, and OpenCode permission-prompt stdin normalization | `agent-doc-supervisor-process-io/src/lib.rs` as `SupervisorProcessIoObserver` plus `SupervisorProcessIoState`, with orchestration implementing only actor-ready transition and stale-input flag access | The thread loops and live detection had already moved, but orchestration still implemented the process traits directly and therefore owned the observer callback graph. Moving the adapter into a focused bridge crate avoids a supervisor-io/supervisor-process dependency cycle while making the spawn site pass an explicit process observer wrapper. | Split the `SupervisorProcessIoState` adapter into prompt-ready transition, stale-Ctrl-D latch, and permission-normalization traits; Move the actor-ready transition state out of `SupervisorShared`; decide whether the bridge crate collapses into supervisor IO after the cycle-state/startup-miss dependency is split. |
| Supervisor start launch spec and stderr redirect IO graph | `agent-doc-orchestration/src/start/run.rs` harness launch-spec assembly, per-harness `agent_args` precedence, model/workspace/no-MCP argument synthesis, Codex network env mutation/diagnostics, managed-capability proof requirement detection, route-owned TUI stderr redirect pathing, Unix stderr fd save/dup2/restore, and launch/redirect session-log events | `agent-doc-supervisor-process-io/src/lib.rs` as `HarnessLaunchSpec`, `build_harness_launch_spec`, `SupervisorStderrRedirect`, and `SupervisorLaunchLog`, with orchestration retaining only a session-log/console sink adapter | Launch spec construction and stderr redirection were one supervisor process-start IO slice over frontmatter/config/env/git workspace args, Codex launch policy, managed-capability contracts, log-file pathing, and Unix fd effects. Moving them together shrinks `start/run.rs` without forcing the full supervisor loop across the crate boundary before `SupervisorShared` is ready to move. | Split launch-spec argument synthesis from Codex network diagnostics and managed-capability proof detection; split stderr redirect into a narrower process-fd module; move the remaining start-loop child launch/restart/adoption graph once actor lifecycle, session-log, and `SupervisorShared` state ports are smaller. |
| Start admission and session registration IO graph | `agent-doc-orchestration/src/start/run.rs` startup document/session preparation, queue-journal replay, start session-log/status sink, stale controller actor GC, route-owned stderr redirect lifetime, tmux availability/current-pane proof, recursive owner-pane refusal, startup-miss supersession cleanup, existing-owner fail-closed checks, project-session relocation/rebind, sessions registry registration, ownership generation logging, controller `start_session` retry during recycle, document `session_start` hooks, and supervisor-host gate logging | `agent-doc-start-io/src/lib.rs` as `prepare_start_runtime`, `StartRuntime`, start session-log helpers, session-owner IO adapters, and relocation/rebind helpers, with `start/run.rs` continuing from snapshot validation into the child supervision loop | The startup admission half of `agent-doc start` is one coherent IO graph over document frontmatter, queue journal sidecars, session logs, tmux owner evidence, sessions registry, project controller CAS, startup-miss markers, and doc hooks. Moving it as a chunk removes several hundred lines of orchestration runtime setup while leaving the long-lived child loop behind until `SupervisorShared`, idle-watch, and commit/write effect ports are narrower. | Split `StartRuntime` into document prep, owner admission, registration, and controller lifecycle; move the remaining snapshot validation and child launch/restart/adoption loop once commit effects and `SupervisorShared` state adapters no longer require orchestration. |
| Supervisor IPC command handler graph | `agent-doc-orchestration/src/start/supervisor_io.rs` supervisor IPC method dispatch over state/pid, inject/clear delivery, restart/stop/stop-agent mutations, and capability-proof gating | `agent-doc-supervisor-io/src/ipc.rs` as `handle_supervisor_ipc` plus `SupervisorIpcHandlerState`, with orchestration implementing the concrete `SupervisorShared` state/effect adapter | The socket transport already lived in supervisor IO, but the decoded method handler still lived in orchestration and re-owned protocol gating, state JSON construction, and command branching. Moving the whole command handler behind a narrow state/effects trait lets supervisor IO own the supervisor-only IPC command graph while editor CRDT traffic stays on the CP/controller route. | Split the `SupervisorIpcHandlerState` adapter into narrower state snapshot, prompt delivery, and lifecycle mutation traits; move remaining PTY prompt-normalization and live-pane detection callbacks out of `SupervisorShared`; keep CRDT relay calls out of supervisor IPC. |
| Supervisor IPC state snapshot adapter graph | `agent-doc-orchestration/src/start/supervisor_io.rs` state/pid snapshot construction, actor runtime field projection, editor-sync debounce status collection, and JSON shaping for IPC `State` responses | `agent-doc-supervisor-io/src/ipc.rs` as `supervisor_ipc_state_snapshot` plus `SupervisorIpcSnapshotState`, with orchestration implementing only concrete field accessors | The IPC command handler had moved, but state snapshot assembly still lived in orchestration and re-owned editor-sync JSON shaping. Moving the snapshot builder into supervisor IO keeps IPC response shaping beside IPC command handling while leaving process/runtime storage behind a field-access trait. | Split the `SupervisorIpcSnapshotState` adapter into actor-runtime identity, process liveness, and editor-sync source traits; Move actor runtime storage out of `SupervisorShared`; keep CRDT relay dispatch out of supervisor IO until the cycle-state/startup-miss dependency cycle is broken. |
| Supervisor IPC lifecycle adapter graph | `agent-doc-orchestration/src/start/supervisor_io.rs` inject/clear actor transitions, restart mode/request/reexec selection, stop/stop-agent flags, and child-kill sequencing for supervisor IPC commands | `agent-doc-supervisor-io/src/ipc.rs` as `mark_supervisor_*` and `request_supervisor_*` helpers plus `SupervisorIpcLifecycleState`, with orchestration implementing only transition, flag, stale-binary, and child-kill effects | The IPC command handler had moved but the command lifecycle semantics still lived in orchestration as trait method bodies. Moving the lifecycle helper graph into supervisor IO keeps restart/stop/inject command behavior beside IPC dispatch while leaving concrete actor-store and process effects behind a focused state trait. | Split the `SupervisorIpcLifecycleState` adapter into actor-transition, restart-request, stop-request, and child-termination traits; Move restart/reexec state out of `SupervisorShared`; keep durable actor-state writes in orchestration until session actor lifecycle effects are focused. |
| Supervisor IPC inject delivery adapter graph | `agent-doc-orchestration/src/start/supervisor_io.rs` pane-vs-child-PTY inject delivery branch, supervisor input diagnostics, harness submit profile selection, LF-to-CR normalization, and no-active-session error mapping | `agent-doc-supervisor-io/src/ipc.rs` as `deliver_supervisor_inject` plus `SupervisorInjectDeliveryState`, with orchestration implementing only pane id, harness name, and child-PTY write access | The decoded IPC handler had moved, but inject/clear delivery still lived in orchestration and re-owned transport branching and input diagnostics. Moving the whole delivery adapter into supervisor IO keeps command delivery beside IPC handling while avoiding the ops-log dependency cycle by using a no-file input-diagnostic sink. | Split the `SupervisorInjectDeliveryState` adapter into pane delivery and child-writer traits; Move child-writer ownership out of `SupervisorShared` with the remaining PTY supervisor state; keep durable ops-log sinks out of supervisor IO unless the cycle-state dependency is broken. |
| Supervisor live detection adapter graph | `agent-doc-orchestration/src/start/detection.rs` live child-output recording, prompt-visible detection, actor ready/busy probes, direct tmux pane dispatch/busy/payload evidence, help-screen detection, and OpenCode permission-prompt stdin normalization | `agent-doc-supervisor-io/src/detection.rs` as `SupervisorDetectionState` plus live detection adapter functions, with orchestration implementing only the concrete `SupervisorShared` field access | This graph was already an IO adapter over focused pure supervisor detection policy and tmux/controller/prompt-normalization effects. Moving the whole module deletes the `start/detection.rs` facade and lets supervisor IO own live detection behavior while orchestration keeps only the `SupervisorShared` state projection. | Split the `SupervisorDetectionState` adapter into output-buffer, actor-state, live-pane capture, and permission-prompt traits; Move route-owned live-pane busy evidence and prompt-ready transition callbacks out of `start.rs`; keep pure prompt/readiness policy in `agent-doc-supervisor`. |
| Route-owned completion process loop graph | `agent-doc-orchestration/src/start.rs` route-owned completion thread loop, cycle-state-to-route-owned-facts adapter, document liveness file-read adapter, ready/busy log cadence, reap decision sequencing, child-stop request, and focused route-owned tests | `agent-doc-supervisor-process/src/route_owned_completion.rs`, with orchestration implementing `RouteOwnedCompletionState` for `SupervisorShared` | The route-owned completion loop is one process graph over cycle-state polling, route-owned reap policy, process liveness checks, session-log/ops-log emission, and child termination. Moving it together deletes another `start.rs` ownership chunk while keeping only live supervisor state probes in orchestration. | Split session-log formatting from process polling; move live-pane busy evidence into a supervisor-process/detection state adapter once `SupervisorShared` shrinks; keep pure route-owned liveness/reap decisions in `agent-doc-supervisor` and move any remaining file-read adapters out of orchestration instead of rebuilding start facades. |
| Route startup production facade demotion | `agent-doc-orchestration/src/route/startup.rs` production wrapper module around `agent_doc_route_io::startup::{auto_start, provision_pane, try_provision_pane, auto_start_*}` | Direct focused `agent-doc-route-io` calls plus `agent-doc-orchestration/src/route.rs` retaining only `#[cfg(test)] mod startup` for the existing route-startup tests | The startup/provisioning runtime had already moved to `agent-doc-route-io`; the remaining orchestration module was a production facade with no runtime callers. Demoting it to test-only removes that facade from production compilation without dropping the focused route-startup coverage. | Move the test-only route startup fixture tail into `agent-doc-route-io` once remaining route helpers and tmux fixtures are focused; continue with `route/pane_resolution.rs`, which still owns real runtime routing logic and should move as a larger route-resolution graph after its `super::*` helpers are narrowed. |
| Route startup test-only provisioning facade deletion | `agent-doc-orchestration/src/route/startup.rs` retained `auto_start`, `provision_pane`, `try_provision_pane`, and `auto_start_*` test wrappers around `agent_doc_route_io::startup` | `agent-doc-route-io/src/startup.rs` direct `agent_doc_route_io::startup::provision_pane(..., route_startup_effects())` calls inside the remaining route-startup tests | After the production graph moved, the test module still reintroduced the same startup/provisioning facade names locally. Deleting the wrappers makes even the retained tests exercise the focused route IO API directly and keeps orchestration from regrowing a convenience startup layer. | Move the remaining route-startup integration tests to `agent-doc-route-io` or shared route fixtures once their dependencies on orchestration effect bundles and helper records are narrowed. |
| Session-check detect IO graph | `agent-doc-orchestration/src/session_check/detect.rs` | `agent-doc-session-check-io/src/detect.rs` with direct callers in `agent-doc-orchestration/src/{session_check.rs,preflight.rs,preflight/run.rs,flow/closeout.rs}` and `src/main.rs` | The replay/cancel/submodule/prompt-tail detectors shared one CycleContext-backed session-check IO graph over working-tree reads, HEAD/snapshot cache lookups, cycle state, gitlink drift, ops-log events, workflow guard messages, and response-replay classifiers. Moving it whole deleted the orchestration `detect.rs` submodule while leaving the still-tangled uncommitted closeout drift composer in orchestration. | Split replay detection, gitlink guard logging, and prompt-tail guard adapters into narrower session-check IO modules; Move the remaining uncommitted closeout drift composer once repair/commit recovery hints have focused ports; keep late-IPC regression tests at the orchestration boundary until write effects move. |
| Session-check pending guard IO graph | `agent-doc-orchestration/src/session_check/pending_guards.rs` plus pending-capture helper projections from `agent-doc-orchestration/src/write/pending_checks.rs` | `agent-doc-session-check-io/src/{pending_guards.rs,pending_capture.rs}` with write/session-check callers importing `agent_doc_session_check_io` directly | Pending-capture and pending-done guards share one session-check IO graph over cycle state, capture records, guard-mode resolution, markdown reference reads, promised backlog/plan projections, tracked-work completion policy, and workflow guard-result assembly. Moving it as one chunk deletes the orchestration `pending_guards` module and removes the session-check side of the old `write` helper dependency. | Split pending-capture projections from pending-done tracked-work file reads; move guard-result assembly toward pure workflow/turn policy where possible; replace broad `CycleContext` guard-mode inputs with a narrower session-check read model; continue extracting the remaining write-time pending checks and cycle-state mutation adapters from orchestration. |
| Session-check response and closeout guard IO graph | `agent-doc-orchestration/src/session_check/{response_guards.rs,closeout_guards.rs}` | `agent-doc-session-check-io/src/{response_guards.rs,closeout_guards.rs}` with session-check, preflight, repair, git, run, closeout-flow, and Codex-hook callers importing `agent_doc_session_check_io` directly | Dropped queue/exchange prompt guards, queue response contamination, completed pending reap, snapshot-committed and missing-response-body checks, blocked closeout follow-up, gated-phase split, queue-audit partial completion, open-cycle messaging, unresolved exchange-tail scans, bypassed response detection, and active/uncommitted drift adapters all shared the same CycleContext/cycle/capture/snapshot/ops-log/session-state graph. Moving them together deletes two orchestration submodules and keeps the guard adapters behind the focused session-check IO boundary. | Split closeout recovery hint/state classification from `flow/closeout` into focused closeout recovery IO or a narrow callback port; split active-session drift and Codex hook fact reads from pure document-drift adapters; move the remaining uncommitted closeout drift composition out of orchestration once git repair/commit effects have ports; collapse temporary orchestration test wrappers as call sites settle. |
| Queue consume writeback IO graph | `agent-doc-orchestration/src/write/queue_consume.rs` | `agent-doc-queue-io/src/queue_consume.rs` | Queue-consume writeback is one closeout graph over queue-head planning, proof recording, snapshot synchronization, owner-pane wedge reset, state-event emission, free-text/id-backed/noise strikes, and editor-aware document convergence. Moving it whole deletes the orchestration write submodule instead of preserving a queue-consume facade while keeping pure queue policy in `agent-doc-queue`. | Split the temporary `QueueConsumeWriteEffects` callbacks for atomic write and editor convergence once document write authority has a focused IO home; split proof/state-event recording from document mutation if queue consumption needs a narrower test host; keep pure queue-head classification and response-proof policy in `agent-doc-queue`. |
| Editor IPC live-editor targeting IO batch | `agent-doc-orchestration/src/write/ipc/transport.rs` live-editor target selection, operator-authority probing, payload targeting, and focused unit tests | `agent-doc-ipc-io/src/editor_target.rs` | Live-editor IPC target selection is one transport-side IO graph over plugin-owner leases, live-buffer sidecars, document realtime target policy, and ops-log targeting diagnostics. Moving it together lets write IPC transport and convergence call focused IPC IO directly instead of preserving helper ownership inside orchestration. | Move the remaining file-patch/socket-patch transport graph out of `agent-doc-orchestration/src/write/ipc/transport.rs` once stale-supervisor short-circuit, closeout guard logging, snapshot repair decisions, and editor convergence callbacks have focused ports; Split payload construction from ack polling and repair redelivery inside IPC IO afterward. |
| Route session target resolution IO graph | `agent-doc-orchestration/src/route/session_resolution.rs` | `agent-doc-route-io/src/session_resolution.rs` | Route target-session resolution is one tmux/session-registry IO graph over context-session normalization, project `tmux_session` pins, shared sync scope roots, live tmux session validation, explicit lazy-claim pane filtering, previous stash-pane preservation, and registered-pane lookup. Moving it whole creates a focused route IO home instead of preserving a route submodule facade in orchestration while keeping pure route text predicates in `agent-doc-controller` and sync scope policy in `agent-doc-sync`. | Move the remaining route pane-resolution, startup, dispatch-only, dispatch, and admission-projection IO graphs into `agent-doc-route-io` in larger chunks; split pure admission/proof/retry policy back to `agent-doc-controller`; keep tmux observation primitives in `agent-doc-tmux-io` and session mutation in `agent-doc-session-registry-io`. |
| Route startup helper IO batch | `agent-doc-orchestration/src/route/startup.rs` | `agent-doc-route-io/src/{startup_debounce.rs,startup_harness.rs,startup_locks.rs}` | Route startup had three small but cohesive helper graphs that no longer need orchestration internals: startup lock acquisition over `agent-doc-fs`/`fs2`, frontmatter/global-config harness resolution over `CycleContext`, and pre-route debounce waiting over editor typing sidecars plus file mtime. Moving them together widens the focused route IO home without keeping helper facades in orchestration. | Move the remaining startup provisioning, ready-wait callers' dispatch recovery glue, and fresh-start ack adapters in larger chunks once dispatch, pane-resolution, and supervisor IPC dependencies are narrow enough; keep pure readiness/ack decisions in controller/supervisor crates and route effects in `agent-doc-route-io`. |
| Route startup ready-wait and post-claim sync IO batch | `agent-doc-orchestration/src/route/startup.rs` and `agent-doc-orchestration/src/route.rs` | `agent-doc-route-io/src/{startup_ready.rs,startup_sync.rs}` | Ready-wait, fresh-start idle preservation, and post-claim sync are one route startup IO slice over tmux pane captures/liveness, harness readiness predicates, prompt-detection diagnostics, fresh-start admission policy, registry window discovery, and sync layout reconciliation. Moving them together also moves the shared `AgentReadyWaitOutcome` type out of orchestration so busy-pane, admission-projection, dispatch-only, and startup callers consume the focused route IO API directly. | Move startup provisioning, ready-wait callers' dispatch recovery glue, and pane-resolution startup handoff in larger chunks once the dispatch/supervisor IPC seams are narrow enough; keep pure admission/diagnostic policy in controller/supervisor crates and route effects in `agent-doc-route-io`. |
| Route startup/provision IO graph | `agent-doc-orchestration/src/route/startup.rs` production startup/provision functions and route-owned fresh-start dispatch/projection path | `agent-doc-route-io/src/startup.rs` | Auto-start, provision, try-provision, startup locking/session targeting, pane creation, route-owned start command submission, dispatch-ready reverify, fresh-start dispatch, dispatch-only fresh-send, routed admission projection, startup-miss diagnostics, and stash eviction form one route startup IO graph. Moving the production graph as a chunk deletes orchestration ownership while leaving the old test tail and a thin effects adapter behind until route bug/diagnostic sinks move. | Split pane creation, start-command submission, dispatch-ready handoff, fresh-start dispatch, admission projection/startup-miss diagnostics, and the temporary `RouteStartupEffects` port into narrower route IO modules once pane-resolution and route bug sinks leave orchestration; move the test tail to route IO when it no longer needs orchestration fixtures. |
| Route pane-resolution helper IO batch | `agent-doc-orchestration/src/route.rs` route-local startup-miss/runtime/pane cleanup/probe helpers used by pane resolution | `agent-doc-route-io/src/pane_resolution.rs` | Startup-miss fact/provenance assembly, repeated session-loss fail-closed checks, lazy-claim agent-process probing, failed fresh-route pane cleanup, and controller actor-state adaptation are one shared pane-resolution support graph. Moving the batch deletes route.rs ownership now and unblocks a larger pane-resolution move without dragging queue/write effects into route IO. | Move `agent-doc-orchestration/src/route/pane_resolution.rs` production graph into `agent-doc-route-io::pane_resolution` once `route_via_authoritative_actor` queue/write effects are narrowed; Split cleanup, startup-miss, and actor-state adapters further if they grow. |
| Route pane-resolution waiting-input recovery IO graph | `agent-doc-orchestration/src/route/pane_resolution.rs` waiting-input fresh-restart recovery and stash-rescue helpers plus the `agent-doc-orchestration/src/route.rs` authoritative-actor recovery call site | `agent-doc-route-io/src/pane_resolution.rs` with orchestration passing the explicit `DispatchOnlyRouteEffects` bundle | The recoverable waiting-input path is one pane-resolution IO graph over supervisor fresh restart, startup-miss session-log baseline capture, fresh dispatch target recovery, stash-window rescue, dispatch-target re-registration, and dispatch-only direct-pane reopen. Moving it together removes another production pane-resolution slice from orchestration while keeping queue/diagnostic/write callbacks outside route IO behind the existing dispatch-only effects port. | Move the remaining dispatch-only pane resolver, busy retry/optimistic dispatch, and auto-start fallback graph into `agent-doc-route-io::pane_resolution` once `route_via_authoritative_actor`, busy diagnostics, and route queue mutation callbacks are narrowed; Split stash rescue from recovery if it becomes shared beyond pane resolution. |
| Route pane-resolution optimistic busy dispatch IO graph | `agent-doc-orchestration/src/route/pane_resolution.rs` optimistic busy-pane direct dispatch helper used by the busy auto-fix/interrupt recovery path | `agent-doc-route-io/src/pane_resolution.rs` with orchestration passing explicit `RouteDispatchEffects` and `RouteAdmissionEffects` bundles | The optimistic busy dispatch path is one pane-resolution IO graph over authoritative-pane dispatch-target registration, route dispatch proof submission, routed admission-projection waiting, ops-log/eprintln diagnostics, and the fallback pane selection after busy recovery remains inconclusive. Moving it as a slice keeps the recursive busy-retry resolver in orchestration for now while deleting another concrete dispatch/projection sequence from it. | Move the remaining busy auto-fix retry resolver into `agent-doc-route-io::pane_resolution` after `emit_busy_route_diagnostic`, recursive reroute callbacks, and route queue mutation effects are narrowed; Split optimistic dispatch from routed admission-projection waiting if the effect bundles shrink further. |
| Route pane-resolution busy retry IO graph | `agent-doc-orchestration/src/route/pane_resolution.rs` busy-pane auto-fix/interrupt recovery retry helper and registered/lazy-claim retry call sites | `agent-doc-route-io/src/pane_resolution.rs` with orchestration passing a resolver retry callback plus `RouteBusyPaneRetryEffects` | Busy retry is one pane-resolution IO graph over scoped auto-fix, supervisor restart/fresh restart, restart handoff, interrupt recovery, busy diagnostics, Codex optimistic dispatch fallback, dispatch-target registration, and routed admission-projection waiting. Moving it whole deletes the remaining busy recovery helper from orchestration while keeping resolver recursion explicit at the caller boundary. | Split `RouteBusyPaneRetryEffects` into narrower diagnostic, dispatch, and projection ports; Move the remaining registered-pane/lazy-claim resolver branches into route IO once `route_via_authoritative_actor` and auto-start callbacks are narrowed; Split Codex optimistic dispatch from busy recovery if it becomes shared independently. |
| Route dispatch-only pane resolver IO graph | `agent-doc-orchestration/src/route/pane_resolution.rs` production dispatch-only resolver body and `agent-doc-orchestration/src/route.rs` dispatch-only mode call site | `agent-doc-route-io/src/pane_resolution.rs` with orchestration passing an authoritative-actor route callback plus `DispatchOnlyRouteEffects` and `RouteStartupEffects` | Dispatch-only pane resolution is one route IO graph over dispatch registry lookup, authoritative actor projection, degraded actor direct submit authorization, associated-pane ambiguity guards, stash rescue, direct-pane reopen, lazy claim, and dispatch-only auto-start fallback. Moving production as a chunk removes the largest dispatch-only pane-resolution body from orchestration while keeping closeout/queue mutation inside the authoritative-actor callback. | Split the authoritative-actor callback into focused closeout/queue route effects; Move the remaining test-only dispatch-only adapter body into route IO fixtures; Split associated-pane guard handling and auto-start fallback into narrower route IO helpers once the normal resolver moves. |
| Route managed pane resolver IO graph | `agent-doc-orchestration/src/route/pane_resolution.rs` production managed resolver body and `agent-doc-orchestration/src/route.rs` managed mode call site | `agent-doc-route-io/src/pane_resolution.rs` with orchestration passing an authoritative-actor route callback plus `ManagedPaneResolutionEffects` | Managed pane resolution is one route IO graph over dispatch registry lookup, authoritative actor projection, startup-miss cleanup/fail-closed/restart, associated-pane ambiguity guards, supervisor-backed registered-pane reuse, launch-contract reapplication, existing-pane readiness/busy retry, lazy claim, and managed auto-start fallback. Moving production as a chunk makes the orchestration pane-resolution module test-only while keeping closeout/queue mutation inside the authoritative-actor callback. | Split `ManagedPaneResolutionEffects` into narrower diagnostic, dispatch, ack, and startup ports; Move the test-only managed resolver fixtures into route IO; Split startup-miss handling, associated-pane guards, registered-pane reuse, and lazy-claim/autostart paths as smaller route IO modules once route bug/diagnostic sinks move. |
| Route pane-resolution test adapter delegation | `agent-doc-orchestration/src/route/pane_resolution.rs` duplicated test-only managed and dispatch-only resolver bodies | `agent-doc-route-io/src/pane_resolution.rs::resolve_or_create_pane*` with orchestration forwarding only the retained test entry points and concrete route effect bundles | The production pane-resolution graph already lives in route IO; keeping full duplicated resolver bodies under the orchestration test module preserved a fake implementation surface and made the retained tests exercise copied code instead of the focused owner. Replacing the bodies with forwarding adapters deletes another coarse block without waiting for every fixture to move. | Move the retained pane-resolution tests into `agent-doc-route-io`; Split `ManagedPaneResolutionEffects`, `DispatchOnlyRouteEffects`, and `RouteBusyPaneRetryEffects` into narrower ports; then delete the orchestration test adapter module entirely. |
| Route diagnostic and dispatch bug-report sink IO graph | `agent-doc-orchestration/src/route.rs` route startup/busy tmux diagnostics, route-dispatch bug backlog filing, route actor generation lookup, and ops-log path projection | `agent-doc-route-io/src/diagnostics.rs` with runtime bug-report effects calling focused backlog IO directly | The diagnostic sink is one route IO graph over tmux user messages, controller diagnostic text, route-dispatch bug item shaping, project bug-target resolution, actor-generation lookup, ops-log path projection, and route failure backlog filing. Moving the body deletes another route-owned side-effect cluster from orchestration, and the runtime bug-report callback now uses the focused backlog IO provider instead of an orchestration-local effect. | Split backlog filing from tmux diagnostics if route bug sinks need a dedicated crate/port; keep pure diagnostic wording in `agent-doc-controller`; move the remaining route effect bundle assembly once closeout/repair/session-check callbacks leave orchestration. |
| Backlog command runtime effects provider | `agent-doc-orchestration/src/lib.rs` `BacklogCommandEffects` runtime write/convergence provider plus `agent-doc-orchestration/src/{write.rs,route.rs}` call sites that injected `crate::BACKLOG_COMMAND_EFFECTS` | `agent-doc-element-backlog-runtime-io/src/lib.rs` as `RUNTIME_BACKLOG_COMMAND_EFFECTS`, with route dispatch bug filing in `agent-doc-route-io/src/diagnostics.rs` and write paths importing the focused provider directly | Backlog command mutation needs document realtime convergence and write provenance, but that runtime provider was still rooted in orchestration and shared by write pending mutations, precommit pending-done repair, and route dispatch bug filing. Moving it to a dedicated backlog runtime adapter makes duplicate backlog write policy discoverable, avoids a dependency cycle in low-level backlog IO, and removes a crate-root runtime provider from orchestration. | Split force-disk pending-write diagnostics from editor-aware backlog convergence if backlog runtime IO grows multiple sinks; Move write pending/status mutation orchestration into focused write command IO after `CommandOptions`/`CommitMode` leave `write.rs`; keep route bug filing in route diagnostics. |
| Status runtime write effects provider | `agent-doc-orchestration/src/write.rs` private `WriteStatusEffects` adapter, `STATUS_EFFECTS`, and `set_status_with_options` injection of write convergence, document write provenance, and ops-log effects | `agent-doc-status-io/src/lib.rs` as `RuntimeStatusWriteEffects`, `RUNTIME_STATUS_WRITE_EFFECTS`, and `set_with_runtime_options`, with write command callers using the focused runtime entrypoint directly | Status writeback already lived in the focused status IO crate, but its concrete runtime effects still lived in the write command module. Moving the provider beside the status command flow makes status write authority discoverable in one crate and deletes another private orchestration effect holder without touching the larger write runtime. | Split forced-disk status audit logging from editor-aware convergence if status IO needs alternate sinks; Move the remaining status write command helper into focused write command IO once `write.rs` command sequencing leaves orchestration; Keep pure status projection in `agent-doc-document`. |
| Route runtime effect bundle assembly | `agent-doc-orchestration/src/route.rs` local route dispatch, admission-projection, busy-pane retry, queue writeback, document-prep, dispatch-only, startup, dispatch-only queue enqueue, and dispatch-only startup-timeout effect builders plus `src/main.rs` production route-startup effect callers | `agent-doc-route-io/src/runtime_effects.rs`, with `src/main.rs` calling `agent_doc_route_io::runtime_effects::route_startup_effects()` directly | Once route document write authority and route dispatch bug filing had focused runtime providers, most route effect bundles were pure assembly over route IO callbacks. Moving the batch deletes another route facade layer and leaves orchestration with only the bundles still tied to closeout, repair, preflight, and session-check callbacks. | Split the remaining route command effects around `route_managed_pane_resolution_effects`, `route_authoritative_actor_effects`, and `route_closeout_drain_effects` after repair/session-check/closeout runtime providers leave orchestration; Move retained route startup/pane-resolution tests into `agent-doc-route-io`. |
| Route dispatch queue writeback IO graph | `agent-doc-orchestration/src/route.rs` route dispatch queue enqueue/activation, inactive queue-head detection, queue lock acquisition, snapshot sync, and queue writeback diagnostics | `agent-doc-route-io/src/queue_dispatch.rs` with orchestration injecting only the editor-aware document convergence callback through `RouteQueueEffects` | The route queue writeback path is one effect graph over route queue policy calls, file-backed queue lock paths, frontmatter queue-active parsing, committed snapshot checks, queue mutation writes, snapshot sync, and ops-log diagnostics. Moving it as a chunk deletes another concrete route side-effect cluster while keeping document write authority behind the existing orchestration write callback. | Split inactive queue-head detection from writeback locking once a read-only route queue view exists; Move the remaining `RouteQueueEffects` write callback after document write authority leaves orchestration; keep pure route queue policy in `agent-doc-queue`. |
| Route document preparation IO graph | `agent-doc-orchestration/src/route.rs` route document opt-in validation, session UUID insertion, snapshot/HEAD preservation reads, duplicate prompt residue cleanup, and route pre-dispatch document writeback logging | `agent-doc-route-io/src/document_prep.rs` with orchestration injecting only the editor-aware document convergence callback through `RouteDocumentPrepEffects` | The pre-dispatch document preparation path is one effect graph over route document reads, frontmatter session validation/mutation, snapshot and HEAD preservation inputs, template duplicate-prompt cleanup policy calls, route-visible diagnostics, and editor-aware document convergence. Moving it as a chunk removes another route-owned document side-effect cluster while keeping write authority behind the existing orchestration callback. | Split duplicate prompt cleanup into a pure/template-facing policy adapter if route-specific logging grows; Move the remaining `RouteDocumentPrepEffects` write callback after document write authority leaves orchestration; keep session frontmatter mutation in frontmatter IO and duplicate cleanup policy in `agent-doc-template`. |
| Route authoritative actor ready-wait IO graph | `agent-doc-orchestration/src/route.rs` starting authoritative-actor ready wait, timeout override logging, controller barrier classification adaptation, starting-timeout sidecar persistence, flow-event emission, and timeout diagnostics | `agent-doc-route-io/src/authoritative_actor.rs` with route passing only the scoped wait-for-ready override value | The ready-wait path is one route actor IO graph over tmux pane readiness proof, authoritative actor reloads, supervisor runtime dispatch eligibility, starting-timeout sidecars, route flow/ops telemetry, and timeout diagnostics. Moving it into the existing authoritative-actor IO owner removes another large route function without introducing a facade; orchestration now only supplies the per-invocation timeout override. | Split timeout-sidecar persistence from actor readiness polling if the actor module grows; Move the remaining timeout override state into a route command context so route.rs no longer owns thread-local wait policy; keep prompt-ready barrier policy in `agent-doc-controller`. |
| Route queue facade deletion batch | `agent-doc-orchestration/src/route.rs` local route queue enqueue, exchange-slash idle-drain, and inactive-head activation wrapper functions plus tests that called them as route-owned helpers | Direct calls to `agent-doc-route-io/src/queue_dispatch.rs` functions with explicit `RouteQueueEffects` injection | The queue writeback graph already moved to route IO, but the local pass-through functions preserved the old orchestration API shape. Deleting them as a batch keeps the focused route-io queue owner as the only runtime API and makes the remaining document-write authority callback visible at each route decision point. | Move the remaining `RouteQueueEffects` write callback after document write authority leaves orchestration; Split the dispatch-only queued-prompt adapter once `DispatchOnlyRouteEffects` accepts the focused queue outcome directly; Keep route tests calling focused route-io APIs with explicit effects instead of local helpers. |
| Route closeout drain IO graph | `agent-doc-orchestration/src/route.rs` open-cycle closeout drain, pending-maintenance/repair/session-check retry loop, concurrent-finalize retry classification, closeout-block dispatch classification, active queue-head read, and route drain telemetry | `agent-doc-route-io/src/closeout_drain.rs` with orchestration injecting only preflight maintenance, repair, session-check, and closeout-recovery effect callbacks | The closeout drain path is one graph over cycle-state sidecars, pending-maintenance reaping, repair/session-check validation, concurrent-finalize retry classification, route ops telemetry, queue-continuation reads, and controller closeout-block dispatch decisions. Moving it as a chunk deletes another large route local function pair while keeping still-internal repair/preflight/closeout effects behind a narrow effects port. | Split the preflight, repair, and session-check callbacks after those runtime effects have focused route-io ports; Move the closeout recovery effects port once flow closeout effects are focused; Keep controller retry/block policy in `agent-doc-controller`. |
| Route authoritative dispatch loop IO graph | `agent-doc-orchestration/src/route.rs` authoritative actor reroute loop, closeout-pre-drain integration, actor-state refresh/recovery, queue fallback/activation, supervisor/direct-pane dispatch selection, routed admission-projection waiting, and dispatch-only busy/refusal handling | `agent-doc-route-io/src/authoritative_dispatch.rs` with `agent-doc-route-io/src/pane_resolution.rs` calling it directly through `RouteAuthoritativeActorEffects` | The authoritative reroute path is one decision/effect loop over route closeout drain, queue writeback, actor lifecycle recovery, tmux pane evidence, focused controller dispatch policy, supervisor IPC, direct-pane dispatch-only send, and routed turn admission projection. Moving it whole deletes the largest remaining production callback seam from `route.rs` and lets pane resolution call focused route IO directly instead of handing control back to orchestration. | Split the queue, dispatch, closeout, and wait-override effect callbacks once those adapters stop depending on orchestration-local document write authority and scoped route state; keep pure dispatch decisions in `agent-doc-controller` and keep actor binding/ready-wait in `authoritative_actor`. |
| Route command runtime IO graph | `agent-doc-orchestration/src/route.rs` top-level route command runtime: stale registry prune, queue cooldown marker cleanup, debounce, document preparation, frontmatter/global-config harness resolution, absolute path resolution, target-session resolution, managed/dispatch-only pane resolver dispatch, route-success cleanup, and failed fresh-pane cleanup | `agent-doc-route-io/src/command.rs` with orchestration passing a `RouteCommandEffects` bundle built from existing focused route IO effect adapters | The top-level route command path is one coordinator graph over sync prune, queue marker cleanup, route document prep, run-context/frontmatter reads, harness trigger override, target session resolution, managed versus dispatch-only pane resolution, and route terminal cleanup. Moving it whole deletes orchestration ownership of the route command runtime while leaving only concrete document-write, closeout, maintenance, and dispatch-bug backlog callbacks in the adapter. | Split the remaining `RouteCommandEffects` bundle once document write authority, preflight maintenance, closeout repair/session-check, and backlog bug filing stop depending on orchestration-local callbacks; move the test-only route startup/pane-resolution fixture tail into `agent-doc-route-io`; then delete the remaining route facade helpers. |
| Route invocation state and entrypoint IO graph | `agent-doc-orchestration/src/route.rs` route entrypoint wrappers, scoped wait-for-ready override state, and force-disk route-write state | `agent-doc-route-io/src/invocation.rs` with orchestration passing only a `RouteCommandEffects` bundle and reading invocation state from focused route IO callbacks | The production route command runtime had already moved, but orchestration still owned the per-invocation thread-local state and public wrapper chain. Moving that state and wrapper chain into route IO makes the focused crate own the command entrypoint lifetime while orchestration stays a concrete effects adapter. | Split `RouteCommandEffects` into document-write, closeout-drain, route-dispatch, queue-writeback, diagnostics, and startup ports; move the remaining route startup and pane-resolution tests into `agent-doc-route-io`; then remove the compatibility `agent_doc_orchestration::route` wrappers once CLI callers can use route IO directly. |
| Route test-only invocation facade deletion | `agent-doc-orchestration/src/route.rs` retained `#[cfg(test)] pub fn run*` wrappers over focused route invocation APIs | `agent-doc-route-io/src/invocation.rs` remains the invocation owner; orchestration keeps only a private `run_with_tmux` helper for retained child-module route tests | The production route entrypoints had already moved to `agent-doc-route-io`, but unused test-only wrappers still rebuilt the old invocation API shape and produced dead-code warnings once made private. Deleting the unused wrappers and keeping only the helper still used by route startup tests shrinks the retained fixture surface without changing production routing. | Move the remaining route startup and pane-resolution tests into `agent-doc-route-io`; then delete the final private `run_with_tmux` helper and the test-only `RouteMode` import from orchestration. |
| Write/repair empty-response command-boundary inversion | `agent-doc-orchestration/src/write/run_entry.rs` strict empty-response recovery calls into `crate::repair` | `agent-doc-orchestration/src/repair.rs::run_write_command_with_empty_response_recovery` with `src/main.rs` routing write/finalize through the repair-owned command boundary | The recovery policy already belonged to repair, but the write entry paths still called back into repair on empty stdin, preserving a `write -> repair` runtime edge. Moving the recovery decision to the command boundary makes write return a canonical empty-response error and lets repair coordinate strict closeout recovery without write depending on repair. | Move replay/write callbacks out of repair behind a focused repair IO effects port; move the remaining repair tests out of write modules; then extract the repair coordinator once its write callbacks are narrow. |
| Write commit-boundary closeout adapter inversion | `agent-doc-orchestration/src/write.rs` direct `crate::git::commit(file)` calls in best-effort commit, committed-HEAD recovery, and dedupe-only drift recovery | `agent-doc-orchestration/src/write.rs::commit_via_closeout_effects` calling the root `CloseoutEffects` commit port | Write still needs the commit boundary, but directly importing `git` kept a `write -> git` edge while git also calls write authority. Routing those commits through the closeout effect adapter removes the direct module dependency and leaves git binding in the root effects provider. | Split `CloseoutEffects` into commit, preflight-maintenance, repair-cancel, session-check, and frontmatter ports; then move the git commit flow into `agent-doc-git-io` behind a local DTO/effects trait without exposing cyclic crate types. |
| Repair orphaned response replay/writeback IO graph | `agent-doc-orchestration/src/repair.rs` orphaned response replay block, strict CRDT/template replay helpers, replay materialization guard, blocked replay payload closeout, non-git template/append writeback, and recovered free-text queue-head strike | `agent-doc-repair-io/src/lib.rs` behind `RepairReplayWriteEffects`, with orchestration injecting the trapped write command/template/append/queue-strike operations | Orphaned-response repair is one coherent recovery graph over durable captures, replay-payload classification, strict write replay, materialization proof, pending cleanup, capture replay marking, and queue-head strike cleanup. Moving it together deletes the largest `repair -> write` concrete type cluster while keeping the current write command DTO local to orchestration until the write command runtime is extracted. | The replay callback port is split; move the write command DTO/runtime into a focused write command crate; then move or delete the temporary `OrchestrationRepairReplayWriteEffects` adapter and strict empty-response coordinator after write no longer lives in orchestration. |
| Repair orphaned response replay/writeback port split | `agent-doc-repair-io/src/lib.rs::RepairReplayWriteEffects` broad repair callback trait plus `agent-doc-orchestration/src/repair.rs::OrchestrationRepairReplayWriteEffects` monolithic implementation | `agent-doc-repair-io::{RepairStrictReplayWriteEffects,RepairFallbackWriteEffects,RepairRecoveredQueueHeadEffects}` with `RepairReplayWriteEffects` retained as the composite bound | The orphaned-response replay graph was already extracted, but its callback seam still hid strict write-command replay, non-git template/append fallback writes, and recovered queue-head cleanup behind one port. Splitting the port makes the remaining write-bound callbacks discoverable independently and turns the next coarse write-command extraction into a smaller DTO/runtime move instead of another broad repair adapter rewrite. | Move the write command DTO/runtime into a focused write command crate; then move or delete the temporary `OrchestrationRepairReplayWriteEffects` adapter and strict empty-response coordinator after write no longer lives in orchestration. |
| Repair template normalization IO graph | `agent-doc-orchestration/src/repair.rs` duplicate exchange opener/close/scaffold/tail repair, answered stale-boundary reposition, response/prompt order repair, transcript prompt-prefix normalization, snapshot adoption decision, and template-normalized persistence | `agent-doc-repair-io/src/lib.rs` behind `RepairTemplateWriteEffects`, with orchestration injecting only atomic document write plus the remaining focused template write helpers | Template repair normalization is one policy/effect graph over focused template, diff, snapshot, session-check, and turn helpers. Moving it as a chunk deletes another `repair -> write` cluster and leaves only the precise template/structure helper effects as a port instead of keeping the whole normalization policy in orchestration. | Move `normalize_template_structure_or_fail_preserving` out of `RepairTemplateWriteEffects`; collapse `RepairTemplateWriteEffects` into the repair IO adapter once structure normalization no longer needs an injected method; move the remaining repair tests into `agent-doc-repair-io`. |
| Git pre-stage response/prompt artifact repair IO graph | `agent-doc-orchestration/src/git.rs` `dedupe_snapshot_and_worktree_before_commit`, response-block dedupe before staging, duplicate prompt artifact repair against snapshot, snapshot save/log calls, and worktree atomic writes | `agent-doc-git-io/src/pre_stage_repair.rs` behind `CommitPreStageRepairEffects`, with orchestration injecting snapshot save, atomic write, and ops-log effects | The pre-stage repair path is one commit-prep graph over snapshot/worktree response dedupe, exchange prompt-prefix equivalence, clean snapshot rewriting, focused duplicate-prompt repair, and binary-owned worktree fixes. Moving it together deletes another `git.rs -> write.rs` helper edge and turns two direct atomic-write calls into an explicit git IO effects seam. | Split `CommitPreStageRepairEffects` into snapshot store, document write, and op-log ports when the whole commit transaction moves; move the remaining guard-marker strip, boundary reposition, transient worktree repair, and closeout mark/queue journal paths behind the same focused commit effects trait. |
| Git guard-marker cleanup convergence IO graph | `agent-doc-orchestration/src/git.rs` `strip_guard_markers_from_disk`, snapshot guard-marker cleanup, working-tree guard-marker cleanup, and editor-aware convergence write call | `agent-doc-git-io/src/guard_marker_cleanup.rs` behind `GuardMarkerCleanupEffects`, with orchestration injecting snapshot load/save, file read, and document convergence write effects | Guard-marker cleanup is one commit-side cleanup graph over transient document markers, binary-owned snapshot writes, and live-editor-safe file convergence. Moving it into git IO removes another concrete write-convergence call from the commit module while keeping the editor-aware write authority injected. | Split this cleanup port into the broader git commit effects trait once the commit transaction shell moves; move boundary reposition and transient worktree repair next so post-commit cleanup is owned by focused git IO rather than orchestration. |
| Git boundary reposition IO graph | `agent-doc-orchestration/src/git.rs` `reposition_boundary_in_snapshot`, active-run guard, snapshot boundary collapse, working-tree boundary reposition, post-commit prompt-prefix normalization, file-IPC reposition delivery, and direct atomic-write fallback | `agent-doc-git-io/src/boundary_reposition.rs` behind `BoundaryRepositionEffects`, with orchestration injecting active-run detection, snapshot load/save, IPC listener and file-IPC delivery, file read, and atomic write effects | Boundary reposition is one commit-side normalization graph over binary-owned snapshot collapse, editor-race avoidance, focused prompt-prefix normalization, file-IPC delivery, and fallback disk write. Moving it together deletes the largest remaining boundary-normalization body from `git.rs` while preserving all high-level write/IPC effects as explicit ports. | Split `BoundaryRepositionEffects` into active-run, snapshot-store, IPC delivery, and document-write ports; move the committed single-boundary invariant self-heal and transient worktree repair behind the same focused git commit cleanup effects; delete the remaining test-only local assumptions once git commit tests move to `agent-doc-git-io`. |
| Git committed single-boundary invariant self-heal IO graph | `agent-doc-orchestration/src/git.rs` `enforce_committed_single_boundary_invariant`, committed HEAD boundary counting, collapse-to-single-boundary snapshot save, and follow-up collapse commit | `agent-doc-git-io/src/boundary_invariant.rs` behind `BoundaryInvariantEffects`, with orchestration injecting snapshot save and ops-log effects | The self-heal is one post-commit git IO cleanup graph over committed HEAD reads, boundary invariant detection, deterministic collapse, snapshot persistence, follow-up transaction staging, and audit logging. Moving it whole keeps the committed-artifact repair beside the git transaction/reposition owners and removes another direct committed-HEAD cleanup body from orchestration. | Split `BoundaryInvariantEffects` into snapshot-store and log ports when the broader commit effects trait lands; move transient worktree repair and closeout sidecar refresh next so post-commit cleanup is owned by focused git IO. |
| Git transient worktree and closeout sidecar cleanup IO graph | `agent-doc-orchestration/src/git.rs` `vcs_refresh_signal_path`, `refresh_live_closeout_sidecars`, `repair_stale_agent_response_collapse_worktree`, `repair_clean_head_if_only_transient_worktree_drift`, VCS refresh signal writes, CRDT sidecar refresh, stale response-collapse repair, and clean-HEAD transient drift repair | `agent-doc-git-io/src/transient_cleanup.rs` behind `TransientCleanupEffects`, with orchestration injecting atomic writes, snapshot save, CRDT save, project-root/IPC probes, VCS signal writes, and ops-log effects | Transient cleanup is one post-commit/no-op cleanup graph over committed HEAD reads, safe worktree repair, CRDT/editor sidecar refresh, fallback VCS refresh signaling, and audit logging. Moving it together removes the remaining concrete write/snapshot/sidecar cleanup body from `git.rs` while preserving cycle-sensitive effects as explicit ports to avoid git-io dependency cycles. | Split `TransientCleanupEffects` into document-write, snapshot-store, sidecar-refresh, VCS-refresh, and log ports when the broader commit cleanup effects trait lands; move postcommit worktree proof and already-committed closeout finalization next so commit cleanup/reporting is owned by focused git IO. |
| Git postcommit worktree proof and IPC reposition safety IO graph | `agent-doc-orchestration/src/git.rs` `emit_postcommit_worktree_check`, committed HEAD/current worktree replay-normalized proof logging, and `should_send_post_commit_ipc_reposition` exchange-only safety decision | `agent-doc-git-io/src/post_commit_cleanup.rs` behind `PostCommitCleanupEffects`, with orchestration injecting file reads and ops-log effects | The postcommit proof and reposition safety decision are one committed-HEAD reporting graph over git revision reads, replay-normalized content hashing, exchange-only change classification, and observe-only audit logging. Moving them together removes another policy/reporting body from `git.rs` while keeping local disk reads and ops-log writes injected. | Split `PostCommitCleanupEffects` into read and log ports when the broader commit cleanup effects trait lands; move already-committed closeout finalization and commit-success side-effect reconciliation next so git commit reporting is owned by focused git IO. |
| Git already-committed closeout finalization IO graph | `agent-doc-orchestration/src/git.rs` `finalize_already_committed_noop`, no-op lifecycle logging, closeout commit flow event, pipeline frontmatter commit marking, capture commit marking, and queue-continuation marker reconciliation | `agent-doc-git-io/src/post_commit_cleanup.rs` as `finalize_already_committed_noop` behind `PostCommitCleanupEffects`, with orchestration injecting lifecycle, flow, cycle-state, capture, queue-continuation, and ops-log effects | The already-committed closeout finalizer is one commit-reporting graph over the HEAD-current no-op branch: it emits the no-op proof, marks durable cycle/capture state, records closeout flow completion, and reconciles the auto-queue continuation marker. Moving it into git IO keeps already-current reporting beside postcommit proof/reposition cleanup and leaves only concrete side-effect adapters in orchestration. | Split `PostCommitCleanupEffects` into lifecycle-log, flow-event, cycle-state, capture-state, queue-continuation, read, and log ports; move commit-success side-effect reconciliation next so both successful and already-current commit reporting share one focused cleanup owner. |
| Git successful commit reconciliation IO graph | `agent-doc-orchestration/src/git.rs` successful commit lifecycle logging, closeout commit flow event, pipeline frontmatter commit marking, capture commit marking, auto-queue continuation marker reconciliation, review-phase drain proof logging, and post-commit hook/event firing | `agent-doc-git-io/src/post_commit_cleanup.rs` as `finalize_successful_commit` behind `PostCommitCleanupEffects`, with orchestration injecting snapshot/file reads, lifecycle/log effects, cycle-state, capture-state, queue-continuation, session-id, and hooks effects | Successful commit reconciliation is the sibling of the already-current finalizer: it turns a committed blob into durable closeout side effects, continuation proof, and post-commit hooks. Moving it with the already-current path makes post-commit reporting and side-effect reconciliation focused in git IO while preserving concrete side-effect adapters in orchestration. | Split `PostCommitCleanupEffects` into lifecycle-log, flow-event, cycle-state, capture-state, queue-continuation, session, hooks, read, and log ports; move ignored-path/error reporting and commit-output result logging next so the remaining commit result handling is focused. |
| Git active capture materialization guard IO graph | `agent-doc-orchestration/src/git.rs` `ensure_active_capture_materialized_for_head_current_noop`, `ensure_active_capture_materialized_for_commit`, active capture state projection, staged-content response materialization proof, missing-capture ops-log row, closeout guard event, and fail-closed commit error | `agent-doc-git-io/src/capture_materialization_guard.rs` behind `CaptureMaterializationGuardEffects`, with orchestration injecting active capture load, ops-log, and closeout guard event effects | The active-capture guard is one commit-safety graph: before already-current no-op closeout or snapshot staging, it proves the captured response body is materialized in the content that will close the cycle. Moving it into git IO keeps commit fail-closed policy beside the staging/cleanup owner while keeping capture storage and flow logging injected. | Split `CaptureMaterializationGuardEffects` into capture-read, log, and closeout-guard ports when the broader commit guard effects trait lands; move live-editor materialization guard and post-commit drift handoff logging next so the remaining commit guard/reporting seams are focused. |
| Git live-buffer precommit guard IO graph | `agent-doc-orchestration/src/git.rs` `ensure_no_live_editor_buffer_ahead_of_disk`, live-buffer divergence lookup, staged snapshot/live-buffer equality proof, materialized operator insertion allowance, live-buffer block logging, closeout guard event, and fail-closed stale-disk error | `agent-doc-git-io/src/live_buffer_guard.rs` behind `LiveBufferGuardEffects`, with orchestration injecting live-buffer snapshot lookup, ops-log, and closeout guard event effects | The live-buffer guard is one precommit safety graph over editor sidecar state and staged/file content: it allows synchronized or already-materialized operator edits and blocks stale-disk commits when the editor buffer is ahead. Moving it into git IO keeps the remaining commit guard policy with the focused commit owner while leaving debounce storage and flow logging as injected effects. | Split `LiveBufferGuardEffects` into debounce-read, log, and closeout-guard ports when the broader commit guard effects trait lands; move post-commit local drift handoff logging and cycle-terminal prompt handoff next so `git.rs` retains less guard/reporting policy. |
| Git post-commit local drift handoff IO graph | `agent-doc-orchestration/src/git.rs` already-current local-drift handoff logging, user-follow-up prompt handoff detection, terminal-cycle no-op disposition, and `post_commit_local_drift` audit rows | `agent-doc-git-io/src/post_commit_cleanup.rs` as `log_already_current_local_drift_handoff` behind `PostCommitCleanupEffects`, with orchestration injecting cycle-terminal state and ops-log effects | The drift handoff is part of the already-current post-commit reporting graph: it decides whether HEAD-current closeout should continue, or stop after logging a prompt handoff when later local user follow-up edits belong to the next cycle. Moving it beside the already-committed/successful finalizers keeps commit result reporting focused and removes another cycle-state/logging policy block from `git.rs`. | Split `PostCommitCleanupEffects` into lifecycle-log, flow-event, cycle-state, capture-state, queue-continuation, read, and log ports; move ignored-path/error reporting and commit-output result logging next so the remaining commit outcome surface is focused. |
| Git commit result reporting IO graph | `agent-doc-orchestration/src/git.rs` ignored untracked path reporting, commit stdout summary filtering, failed commit status logging, and fatal commit error audit rows | `agent-doc-git-io/src/commit_result_reporting.rs` behind `CommitResultReportingEffects`, with orchestration injecting only the ops-log sink | Commit result reporting is one git-process outcome graph over ignored-path fail-closed handling, concise commit result emission, and failure/error audit rows. Moving it together keeps the transaction loop in orchestration focused on retry/stage control flow while focused git IO owns how command results are reported. | Split stdout summary emission from ops-log writes if a non-CLI caller needs silent reporting; fold this reporting port into a broader commit transaction effects seam once commit attempt orchestration moves. |
| Git commit lifecycle coordinator IO graph | `agent-doc-orchestration/src/git.rs` `commit_with_outcome` lifecycle coordinator over repo/submodule routing, queue head strike, snapshot/head/file drift guards, commit-boundary repair, frontmatter self-heal, pre-stage normalization, commit retry loop, post-commit cleanup, and VCS refresh result assembly | `agent-doc-commit-io/src/lib.rs` as `commit_with_outcome` behind `CommitCoordinatorPorts`, with orchestration injecting the existing focused git/write/repair/queue/cleanup effects | The full commit lifecycle is a use-case coordinator, not low-level git IO: it depends on `agent-doc-git-io` plus write convergence, repair, queue, session-check, flow, capture, and IPC crates, several of which already depend on `git-io`. Moving it to a separate commit coordinator crate avoids dependency cycles and makes duplicate commit policy discoverable in one named owner while leaving orchestration as concrete adapters and tests. | Split `CommitCoordinatorPorts` into commit admission, snapshot/head drift guard, pre-stage normalization, transaction, and post-commit cleanup ports; keep raw git mechanics in `agent-doc-git-io` and commit lifecycle policy in `agent-doc-commit-io`. |
| Git commit boundary test-suite relocation | `agent-doc-orchestration/src/git.rs` 5k-line historical commit boundary suite, git fixture helper module, boundary reposition/post-commit cleanup direct-effect assertions, and queue-consume commit-seam regression coverage | `agent-doc-orchestration/tests/git.rs` as integration coverage calling `agent_doc_commit_io::commit` plus explicit focused runtime effect providers for boundary reposition, post-commit cleanup, and queue-consume writeback | The production `git.rs` module had already shrunk to concrete commit-effect adapters over focused `agent-doc-commit-io` and `agent-doc-git-io`; keeping the huge test tail in `src/` obscured that remaining shape. Moving the suite out made the source module's true production surface visible while preserving the boundary coverage until the concrete effects split. | Move the remaining commit-boundary tests into `agent-doc-commit-io` and focused `agent-doc-git-io` fixtures once fixture dependencies are narrowed; keep deleting hidden public effect handles as direct-effect assertions move beside the focused owner. |
| Git commit runtime facade deletion | `agent-doc-orchestration/src/git.rs` public `git::commit`/`git::commit_with_outcome` facade, concrete commit runtime effect providers, write-convergence/queue/pipeline-frontmatter adapters, and CLI/compact/preflight/start/notify/extract call sites importing the orchestration git module | `agent-doc-commit-io/src/lib.rs` as the default `commit`/`commit_with_outcome` runtime API, `commit_with_ports_outcome` for injectable tests, and `agent-doc-document-realtime-io/src/lib.rs` as the focused runtime write-authority/queue/pipeline provider set | The remaining `git.rs` file was a facade over the commit coordinator plus concrete runtime ports. Deleting it forces callers to import the discoverable commit lifecycle owner directly, keeps raw git mechanics in `agent-doc-git-io`, and moves write-authority runtime effects beside realtime document authority instead of leaving them hidden in orchestration. | Move the integration test suite from `agent-doc-orchestration/tests/git.rs` into focused `agent-doc-commit-io`/`agent-doc-git-io` fixtures; split `CommitCoordinatorPorts` into smaller admission, staging, transaction, cleanup, queue, and write-authority port groups; remove transitional orchestration write aliases once write callers import realtime/write focused providers directly. |
| Git commit integration suite relocation | `agent-doc-orchestration/tests/git.rs` historical commit-boundary integration suite with git fixtures, IPC receipt mocks, snapshot/cycle-state setup, and direct assertions over focused commit/git runtime effects | `agent-doc-commit-io/tests/git.rs` with explicit dev-dependencies for controller IO, element-boundary parsing, merge helpers, serde JSON, and temp git repositories | The suite now exercises `agent-doc-commit-io` directly and no longer needs the orchestration package as its test host. Moving it whole deletes another orchestration-owned test surface while keeping commit lifecycle regressions beside the commit coordinator crate. | Split commit-boundary fixtures between `agent-doc-commit-io` and `agent-doc-git-io`; move pure boundary parsing and merge assertions toward pure owner crates; keep IPC/socket and temp-repo fixtures only where the commit coordinator edge is under test. |
| Preflight maintenance runtime write-effect adapter graph | `agent-doc-orchestration/src/preflight.rs` concrete `PreflightMaintenanceWriteEffects` provider and `write`/`route`/wrapper call sites reaching back through `crate::preflight::PREFLIGHT_MAINTENANCE_WRITE_EFFECTS` | `agent-doc-preflight-runtime-io/src/lib.rs`, with `agent-doc-preflight-io` retaining the pure trait and maintenance algorithms and orchestration importing the focused runtime adapter directly | The maintenance write adapter is a runtime bridge between preflight policy and document realtime write authority. Moving it out breaks a `write -> preflight` ownership edge without forcing `agent-doc-preflight-io` to depend back on `agent-doc-document-realtime-io`, which would recreate a crate cycle through flow IO. | Split the runtime adapter once write command extraction lands: keep provenance/current-buffer authority in document realtime IO, keep convergence orchestration in write-converge IO, and move remaining preflight command sequencing out of `agent-doc-orchestration/src/preflight.rs`. |
| Preflight prompt cleanup runtime IO graph | `agent-doc-orchestration/src/preflight.rs` out-of-exchange prompt relocation, duplicate answered prompt-tail cleanup, post-exchange duplicate prompt-comment cleanup, template/snapshot normalization, document-authority writes, and ops-log markers | `agent-doc-preflight-runtime-io/src/lib.rs` as public cleanup helpers called by `agent-doc-orchestration/src/preflight/run.rs` | These cleanup steps are concrete preflight runtime effects over template repair policy, snapshot/head preservation evidence, document realtime write authority, and audit logging. Moving them together removes another private preflight helper cluster from orchestration without forcing pure `agent-doc-preflight-io` to depend on document realtime or snapshot IO. | Move the remaining preflight command sequencing and route-queue snapshot commit-boundary recovery into focused runtime owners; split template repair, snapshot preservation, and write authority ports if non-file callers need this cleanup graph. |
| Preflight route-queue snapshot recovery graph | `agent-doc-orchestration/src/preflight.rs` route-owned auto-queue snapshot commit-boundary recovery, drained-queue recovery classifier, queue-state normalization, prompt-bearing diff filtering, commit attempt, run-context invalidation, and ops-log markers | `agent-doc-preflight-runtime-io/src/lib.rs` as `recover_route_queue_snapshot_commit_boundary` and `detect_route_queue_snapshot_commit_boundary_recoverable` | The route-queue recovery is a concrete preflight runtime graph over cycle state, snapshot-vs-HEAD evidence, route queue policy, diff classification, commit IO, and audit logging. Moving it whole removes another private preflight recovery body from orchestration and keeps queue-specific commit-boundary recovery beside the other preflight runtime adapters. | Split classifier evidence from the commit/log side effect if route or session-check needs read-only reuse; move remaining preflight command sequencing and IPC truncation recovery into focused runtime owners. |
| Preflight IPC truncation recovery graph | `agent-doc-orchestration/src/preflight.rs` `#ipctruncrecover` live-editor save barrier, socket/file-signal save delivery, visible-write receipt polling, flushed-buffer committed-exchange preservation proof, snapshot reset to HEAD, and audit markers | `agent-doc-preflight-runtime-io/src/lib.rs` as `recover_ipc_truncated_worktree_from_editor_buffer` with a private visible-write receipt poll helper | IPC truncation recovery is a concrete preflight runtime graph over editor/debounce IPC, project-root lookup, session-check prompt-drift guard, document write-normalization proof, snapshot IO, write-converge receipt polling, and ops-log markers. Moving it whole removes another recovery body from orchestration while keeping it beside the other preflight runtime recovery adapters. | Split editor save delivery, visible-write receipt polling, and committed-exchange preservation proof into narrower ports if write-IPC or session-check needs to reuse them; move remaining JB conflict and late-IPC overapplication recovery out of orchestration. |
| Preflight closeout-drift recovery runtime graph | `agent-doc-orchestration/src/preflight.rs` `enforce_no_uncommitted_closeout_drift`, JB cache-conflict accept duplicate replay repair, late-IPC response overapplication repair, JB cancel auto-commit recovery, IPC truncation recovery sequencing, and final uncommitted-closeout drift bail/logging | `agent-doc-preflight-runtime-io/src/lib.rs` as `enforce_no_uncommitted_closeout_drift`, with `agent-doc-orchestration/src/preflight/run.rs` passing only the existing session-check effects port | These branches form one ordered preflight recovery graph around the same snapshot/HEAD/live-editor closeout invariant. Moving the whole graph deletes the orchestration-owned recovery body while making duplicated JB/late-IPC/route/IPCtrunc recovery policy discoverable in one runtime crate. | Split duplicate-replay repair, late-IPC overapplication repair, JB cancel auto-commit, IPC truncation recovery, and final drift detection into smaller runtime modules once their read-only detectors/effect ports are stable; shrink the temporary session-check effects port so runtime no longer needs an orchestration effect provider. |
| Preflight sweep owner graph | `agent-doc-orchestration/src/preflight.rs` stale-sweep actor/session-registry owner lookup, foreign-owned skip decision, owner-warning and skip audit logging | `agent-doc-preflight-io/src/sweep.rs` with `agent-doc-orchestration/src/preflight/run.rs` importing focused sweep helpers directly | The stale-sweep owner logic is a self-contained preflight IO graph over controller actor bindings, session registry keys, workflow skip policy, and ops-log diagnostics. Moving it whole deletes another private orchestration helper cluster and makes sweep ownership policy discoverable next to the rest of preflight IO. | Split actor-binding owner evidence from session-registry fallback if sync/preflight share it; move remaining stale actor cleanup sequencing from `preflight/run.rs` once the command runner leaves orchestration. |
| Route CLI entrypoint facade demotion | `agent-doc-orchestration/src/route.rs` public route wrapper chain/`RouteMode` re-export plus `src/main.rs` production `route` command dispatch through `agent_doc_orchestration::route::{RouteMode,run_with_force_disk}` | `agent-doc-route-io/src/invocation.rs` direct `run_with_force_disk` call from `src/main.rs` plus `agent-doc-route-io/src/command.rs` `RouteMode`, with orchestration exposing only `route_command_effects()` and retaining wrapper functions/RouteMode alias as test-only fixtures | The route command runtime and invocation state already live in `agent-doc-route-io`; keeping CLI dispatch through orchestration preserved a production facade around the focused owner. Demoting the wrappers to test-only makes the production path call the focused crate directly while leaving the broad concrete effects bundle explicit. | Split `route_command_effects` into document-write, closeout, queue, diagnostics, startup, and authoritative-actor providers so the remaining route effects adapter can move out of orchestration; move the retained route tests into `agent-doc-route-io` and delete the test-only wrappers. |
| Preflight direct write-authority and template-normalization edge removal | `agent-doc-orchestration/src/preflight.rs` and `src/preflight/run.rs` direct `crate::write::atomic_write_pub` calls plus `crate::write::normalize_template_structure_or_fail` and the duplicated template structure normalization helper body in `agent-doc-orchestration/src/write.rs` | `agent-doc-document-realtime-io::atomic_write_through_authority` for preflight document writes and `agent-doc-template-io::{normalize_template_structure_or_fail,normalize_template_structure_or_fail_preserving,lift_pending_from_exchange_safe}` for template structure normalization | This removes the remaining `preflight -> write` concrete dependency edge and moves duplicated template normalization policy to the focused template IO owner. Preflight now reaches document authority and template normalization directly instead of using write command internals as a facade. | Move the remaining preflight command sequencing out of `agent-doc-orchestration/src/preflight.rs`; relocate the write.rs template-normalization tests beside `agent-doc-template-io`. |
| Repair empty-response recovery callback inversion | `agent-doc-orchestration/src/write.rs` missing-committed-response recovery, dedupe-only drift recovery, and local closeout commit helper used as `agent-doc-repair-io::RepairCoordinatorEffects` callbacks | `agent-doc-repair-io` remains the coordinator owner, with temporary concrete callback bodies moved to `agent-doc-orchestration/src/repair.rs` beside the strict empty-response recovery bridge | The callbacks are repair recovery policy, not write command policy. Moving them beside `recover_empty_response_for_strict_closeout` removes another `repair -> write` callback dependency and makes the remaining write dependency explicit: replay still needs the write command DTO until that command runtime is extracted. | Split the remaining write-command replay bridge after `CommandOptions`/`CommitMode` leave `write.rs`; keep the callback bodies in the focused repair runtime IO crate. |
| Route document-prep write-authority edge removal | `agent-doc-orchestration/src/route.rs` route document-prep adapter calling `crate::write::atomic_write_pub` and `crate::write::WRITE_CONVERGENCE_EFFECTS` | `agent-doc-document-realtime-io::{atomic_write_through_authority,RUNTIME_WRITE_CONVERGENCE_EFFECTS}` used directly by the route adapter while route document-prep policy remains in `agent-doc-route-io` | Route document preparation already lives in focused route IO; the orchestration adapter only needed document authority and convergence effects. Retargeting it removes a `route -> write` ownership edge without changing route behavior. | Split direct route repair closeout from document-prep writes; keep the follow-on route document write authority row as the owner of the extracted callback's remaining seams. |
| Route document write authority IO graph | `agent-doc-orchestration/src/route.rs` route-owned document write callback for queue dispatch/document prep, force-disk route writeback, editor-aware convergence, route writeback audit logging, and content hash evidence | `agent-doc-route-io/src/document_write.rs` as `route_write_document`, with `RouteQueueEffects` and `RouteDocumentPrepEffects` in orchestration importing the focused callback | After route command, queue dispatch, and document preparation moved to route IO, the remaining route document write callback was a concrete IO graph over force-disk writes, document realtime authority, write convergence, ops-log telemetry, and content hashing. Moving it deletes orchestration ownership of route document write authority while preserving the existing effect bundle shape. | Split force-disk diagnostic logging from editor convergence if route write authority needs separate sinks; Move `route_command_effects` out of orchestration once closeout, repair/session-check, diagnostics, startup, and bug-report providers are focused. |
| Codex hook write-authority edge removal | `agent-doc-orchestration/src/codex_hook.rs` queue-consume writeback and required closeout calls routed through `crate::write` | `agent-doc-document-realtime-io::RUNTIME_QUEUE_CONSUME_WRITEBACK_EFFECTS` for queue writeback and `agent-doc-flow-io::closeout::complete_required_closeout` for closeout commit boundaries | Codex Stop recovery already depends on focused repair and queue IO; routing queue writeback and closeout through `write.rs` preserved a hidden hook-to-write ownership edge. Retargeting makes the hook adapter depend on the real owners directly. | Move the remaining Codex Stop repair replay callbacks into a focused hook/runtime adapter once repair replay no longer needs `crate::repair`; Split repeated-queue recovery note formatting from closeout side effects. |
| Start idle-queue writeback edge removal | `agent-doc-orchestration/src/start.rs` idle queue slash-command completion consuming queue heads through `crate::write::QUEUE_CONSUME_WRITEBACK_EFFECTS` | `agent-doc-document-realtime-io::RUNTIME_QUEUE_CONSUME_WRITEBACK_EFFECTS` used directly by the start adapter while queue consume policy remains in `agent-doc-queue-io` | Start idle-watch queue completion only needs the queue writeback runtime provider. Importing it through `write.rs` preserved another hidden start-to-write dependency with no write-command behavior involved. | Move idle queue completion into a focused start runtime IO adapter once start admission/idle-watch effects are split; keep queue writeback provided by document realtime authority. |
| Write IPC transport convergence effect-provider edge removal | `agent-doc-orchestration/src/write/ipc/transport.rs` socket/file transport and transport regression tests repeatedly borrowing `crate::write::WRITE_CONVERGENCE_EFFECTS` | `agent-doc-document-realtime-io::RUNTIME_WRITE_CONVERGENCE_EFFECTS` used directly by the write IPC transport graph while convergence policy stays in `agent-doc-write-converge-io` | The transport graph only needs the runtime convergence effect provider; reaching back through the parent write command module preserved a hidden transport-to-write ownership edge across production and regression paths. Retargeting the repeated call sites in one batch keeps the remaining IPC extraction surface visible and avoids another local facade. | Move the remaining write IPC transport graph into focused write IPC runtime IO once snapshot adoption, legacy ack-content demotion, full-content redelivery, and repair-decision callbacks are split; keep convergence effects supplied by document realtime authority. |
| Crate-root runtime write-provider edge removal | `agent-doc-orchestration/src/lib.rs` backlog, repair, session-check, and direct-run effect adapters borrowing `crate::write` for convergence, atomic write authority, queue writeback, provenance, and required closeout | `agent-doc-document-realtime-io::{RUNTIME_WRITE_CONVERGENCE_EFFECTS,RUNTIME_QUEUE_CONSUME_WRITEBACK_EFFECTS,atomic_write_through_authority,record_document_write_provenance}` plus `agent-doc-flow-io::closeout::complete_required_closeout` | The crate-root adapters are transitional effect wiring; these call sites needed runtime document authority and closeout effects, not write command sequencing. Retargeting them as one batch removes another hidden root-to-write provider edge while leaving the real write-command replay DTO bridge explicit. | Move the remaining repair write-replay adapter after `write.rs` exits orchestration; then delete the temporary `OrchestrationRepairReplayWriteEffects` bridge in `repair.rs`. |
| Pipeline frontmatter runtime facade deletion | `agent-doc-orchestration/src/lib.rs` public `PIPELINE_FRONTMATTER_EFFECTS` / `PipelineFrontmatterEffects` re-export plus orchestration source and integration-test call sites importing the alias | `agent-doc-document-realtime-io::RUNTIME_PIPELINE_FRONTMATTER_EFFECTS` direct calls from orchestration modules/tests | The pipeline frontmatter write authority already lives in document realtime IO; the orchestration root re-export rebuilt a public facade and hid the real owner. Rewriting all call sites in one batch removes another crate-root runtime handle and makes pipeline-frontmatter authority discoverable in the focused crate. | Move remaining route/start/preflight/write tests that still need pipeline-frontmatter fixtures into focused crates; Split pipeline-frontmatter mutation ports only if non-document-realtime runtimes need alternate authorities. |
| Write runtime effect facade deletion | `agent-doc-orchestration/src/write.rs` public `WRITE_CONVERGENCE_EFFECTS`, `QUEUE_CONSUME_WRITEBACK_EFFECTS`, `WriteConvergenceEffects`, and `QueueConsumeWritebackEffects` re-exports plus CLI/write/IPC call sites importing those aliases | Direct `agent-doc-document-realtime-io::{RUNTIME_WRITE_CONVERGENCE_EFFECTS,RUNTIME_QUEUE_CONSUME_WRITEBACK_EFFECTS}` calls from CLI and orchestration write modules | The write command module was still acting as a public runtime-effect facade for document realtime IO. Rewriting all call sites in one batch removes the last write-module runtime authority aliases, makes convergence/queue-writeback ownership discoverable in document realtime IO, and shrinks `write.rs` toward command sequencing only. | Move remaining write command runtime sequencing into focused command IO crates; Split the repair replay bridge after `CommandOptions`/`CommitMode` leave `write.rs`; Move remaining write IPC transport tests into `agent-doc-write-ipc-io`. |
| Write public write-authority facade deletion | `agent-doc-orchestration/src/write.rs` public `atomic_write_pub`, `atomic_write_if_current_pub`, and `record_document_write_provenance` wrappers plus CLI adapters importing document writes through `agent_doc_orchestration::write` | Direct `agent-doc-document-realtime-io::{atomic_write_through_authority,record_document_write_provenance}` calls from CLI adapters while `write.rs` keeps only its private command-internal `atomic_write` helper | Document write authority already belongs to document realtime IO; the public write-module wrappers preserved an orchestration facade for unrelated CLI commands such as undo, convert, extract, migrate, reset, serve, compact, backlog, and stream. Rewriting those call sites in one batch removes the public write-authority surface and keeps `write.rs` scoped to command sequencing. | Move remaining CLI document-write adapters to focused command IO crates; Split `write.rs` private `atomic_write` behind a focused write-command runtime port once write command sequencing leaves orchestration; Move the remaining orchestrate response writeback call off `agent_doc_orchestration::write` after write command DTO extraction. |
| Write required-closeout facade demotion | `agent-doc-orchestration/src/write.rs` public `complete_required_closeout` wrapper over focused flow closeout runtime effects | Private `write.rs` commit-boundary helper calling `agent-doc-flow-io::closeout::complete_required_closeout` for required write commits only | No external caller used the wrapper; leaving it public preserved a write-module facade over the focused closeout command. Making it private keeps required closeout sequencing local to the remaining write command runtime while preventing new callers from routing closeout through orchestration write. | Split write command commit-boundary sequencing after write command DTO extraction; Move the remaining IPC closeout regression fixture to focused write IPC/flow tests when the test wrapper leaves orchestration. |
| Write run_command facade demotion | `agent-doc-orchestration/src/write.rs::run_command` public wrapper over the write command runtime | `agent-doc-orchestration/src/repair.rs::run_write_command_with_empty_response_recovery` remains the CLI write/finalize bridge while `run_command` is private to the remaining write module | No external caller used `agent_doc_orchestration::write::run_command`; production write/finalize paths already enter through the repair-owned strict-empty-response recovery boundary. Demoting the raw command entrypoint prevents callers from bypassing repair recovery while the write command runtime is still inside orchestration. | Move write command runtime sequencing into focused command IO, then delete the remaining repair-owned command bridge once strict empty-response recovery can inject a focused write runner. |
| Write run_entry public facade demotion | `agent-doc-orchestration/src/write.rs` `pub use run_entry::*` plus public `agent-doc-orchestration/src/write/run_entry.rs` write/apply entrypoints | `agent-doc-orchestration/src/write/run_entry.rs` crate-visible helpers behind `pub(crate) use run_entry::*` while the remaining repair adapter calls the write helpers internally | No external caller used the raw run-entry write/apply functions; CLI write/finalize already enter through the repair-owned recovery bridge, and orphaned-response repair calls the apply helpers inside the crate. Demoting the batch removes another public write-module facade without moving behavior before the write runtime extraction is ready. | Move write command runtime sequencing into focused command IO, then split append/template apply helpers into the focused write runtime or repair writeback port and delete the crate-visible re-export. |
| WriteFlags public DTO demotion | `agent-doc-orchestration/src/write.rs::WriteFlags` public runtime flag struct exposed after the write entrypoints became crate-visible | `agent-doc-orchestration/src/write.rs` crate-visible `WriteFlags` consumed only by the remaining write module and run-entry helpers | Once `run_entry` stopped being public, no external caller could legitimately construct `WriteFlags`. Demoting it removes another public write command DTO from orchestration and keeps the only exported write request type in the focused `agent-doc-write-command-io::CommandOptions` path. | Move write command runtime sequencing into focused command IO; then either fold `WriteFlags` into the focused runtime internals or replace it with narrower injected option structs. |
| Route command effects facade demotion | `agent-doc-orchestration/src/route.rs::runtime_route_command_effects` public production factory plus `src/main.rs` calling route command effects through `agent_doc_orchestration::route` | `src/main.rs` calls `agent_doc_route_io::runtime_effects::route_command_effects(route_repair_closeout)` directly; `agent-doc-orchestration/src/route.rs` and its module export are retained only for internal route tests | The route command/runtime/invocation graph already lives in `agent-doc-route-io`; the remaining public orchestration route factory only supplied a repair-closeout callback. Moving that injection to the CLI demotes `agent_doc_orchestration::route` from production API to test fixture and makes the focused route owner visible at the call site. | Move remaining route unit fixtures into `agent-doc-route-io` or a focused route test-support crate; then delete the test-only orchestration route module entirely. |
| Route library facade deletion | `agent-doc-orchestration/src/lib.rs` `#[cfg(test)] pub mod route` plus the retained route fixture compiling as `agent_doc_orchestration::route` from `agent-doc-orchestration/src/route*.rs` | `agent-doc-orchestration/tests/route.rs` and `agent-doc-orchestration/tests/route/*.rs` as integration-test-only fixtures while production and test-library callers use `agent-doc-route-io` directly | After production route command effects moved to `agent-doc-route-io`, the remaining `route` module was a test-only library facade that still made `agent_doc_orchestration::route` appear as an in-crate API. Demoting it to integration-test fixtures removes the route module and its fixture files from the orchestration library source tree while preserving the historical route regression coverage. | Move the integration fixture into `agent-doc-route-io` or a shared route test-support crate after the temporary repair-closeout callback and tmux fixtures no longer require the orchestration package. |
| Route integration suite relocation | `agent-doc-orchestration/tests/route.rs and agent-doc-orchestration/tests/route/*.rs` historical route command, startup, and pane-resolution integration fixtures with tmux mock-agent helpers, supervisor IPC mocks, runtime-effect bundle assertions, and ignored live-tmux cases | `agent-doc-route-io/tests/route.rs and agent-doc-route-io/tests/route/*.rs` with explicit dev-dependencies on repair-command runtime effects, route test support, element helpers, and turn executor policy | The route production runtime and effect bundle assembly now live in `agent-doc-route-io`; the retained fixtures no longer need the orchestration package as their test host. Moving the whole route suite deletes the last large route-owned test surface from orchestration and keeps startup/pane-resolution regressions beside the focused route IO owner. | Split route startup and pane-resolution fixtures into narrower route IO and test-support suites; move pure dispatch and prompt-ready policy assertions toward `agent-doc-controller`, `agent-doc-supervisor`, or `agent-doc-turn-executor`; keep live tmux tests ignored and routed through the existing tmux CI path. |
| Orchestration workspace retirement | `agent-doc-orchestration/Cargo.toml` plus root workspace member, root dependency, and publish-order entries that kept the empty package active | Focused crates plus root `Cargo.toml` and `Makefile` without an active `agent-doc-orchestration` build/publish edge | After all source modules and integration suites moved out, the remaining package was an empty historical shell but still participated in workspace builds, root dependency resolution, and crate publish ordering. Retiring it from those active lists removes the old God-crate build edge without deleting the directory that existing extraction guards use as a historical sentinel. | Delete the historical `agent-doc-orchestration` directory once stale guard tests and release archaeology references no longer need a sentinel path; Split any remaining documentation references toward the focused owner crates. |
| Repair runtime recovery callback IO graph | `agent-doc-orchestration/src/repair.rs` committed-HEAD response recovery and dedupe-only working-tree drift recovery callback bodies, plus write/transport regression call sites reaching back through `crate::repair` for those callbacks | `agent-doc-repair-runtime-io/src/lib.rs` as `recover_missing_committed_head_response` and `recover_dedupe_only_drift`, with orchestration injecting those focused callbacks into `agent-doc-repair-io::RepairCoordinatorEffects` | These callbacks are concrete repair runtime IO, not repair coordinator policy or write command logic: they read HEAD/current content, apply visible write authority, save snapshots, and cross the commit boundary. Moving them together removes another write-to-repair back edge and makes strict empty-response recovery callbacks discoverable outside orchestration. | Split commit, snapshot save, visible-write idle guard, and atomic write into injectable ports if another runtime needs different authority; move the remaining strict empty-response bridge after write command DTO extraction. |
| Repair coordinator direct-call edge removal | `agent-doc-orchestration/src/{lib.rs,preflight.rs,preflight/run.rs,codex_hook.rs,route.rs}` production callers invoking `crate::repair::{run,run_with_queue_completion_ids,repair}` plus the concrete coordinator-effect assembly embedded in `agent-doc-orchestration/src/lib.rs` | Direct `agent-doc-repair-io::{run,run_with_queue_completion_ids,repair}` calls using `agent-doc-repair-runtime-io::repair_coordinator_effects` with the temporary `agent-doc-orchestration/src/repair.rs` write-replay adapter injected | The repair coordinator already lives in `agent-doc-repair-io`; production callers only needed concrete runtime effects. Moving the coordinator assembly into `agent-doc-repair-runtime-io` removes another crate-root authority holder while keeping the still-write-bound replay adapter explicit in `repair.rs`. | Move the remaining `OrchestrationRepairReplayWriteEffects` write-replay adapter after `write.rs` exits orchestration; then keep `agent-doc-orchestration/src/repair.rs` only as the temporary write-command recovery bridge or delete it. |
| Repair run facade deletion | `agent-doc-orchestration/src/repair.rs::run` public wrapper over the focused repair coordinator | `agent-doc-repair-io::run` remains the only run-repair coordinator entrypoint; orchestration keeps only the currently used `repair` CLI bridge and write-command recovery bridge | No production caller used `agent_doc_orchestration::repair::run`; keeping it public rebuilt the facade that the coordinator extraction had already bypassed for route, preflight, Codex hook, and runtime callers. Deleting the public wrapper prevents new code from reintroducing an orchestration repair-run path while a test-only helper keeps retained repair fixtures compiling until those fixtures move. | Move or delete the remaining public `repair` and `run_write_command_with_empty_response_recovery` bridges after write command extraction moves `OrchestrationRepairReplayWriteEffects` out of orchestration. |
| Template response prompt-order repair IO graph | `agent-doc-orchestration/src/write.rs` local `repair_response_prompt_order_for_file` wrapper and crate-root repair template effect method calling back into `crate::write` for response/prompt order repair | `agent-doc-template-io::repair_response_prompt_order_for_file`, backed by focused exchange prompt-order policy and ops-log side effects | Response/prompt order repair is template exchange normalization, not write command runtime. Moving the path-taking/logging wrapper beside the rest of template IO removes another root/repair effect dependency on `write.rs` and makes the prompt-order repair owner discoverable. | Move the remaining response-precedes-prompt rejection guard and final-template duplicate prompt repair path out of `write.rs`; collapse `RepairTemplateWriteEffects` once normalize-template-structure injection is no longer needed. |
| Direct-run compaction diff guard IO graph | `agent-doc-orchestration/src/lib.rs` `DirectRunEffects::guard_no_exchange_compaction_request_for_diff` calling `crate::write`, plus write-owned public guard exposure | `agent-doc-run-io::guard_no_exchange_compaction_request_for_diff`, backed by focused diff directive detection and workflow compaction command guidance | Direct-run diff admission is part of the direct-run IO graph, not write command runtime. Moving the guard helper lets direct-run effects call their focused owner and turns the remaining write guard into private write-path validation only. | Move the write-path `guard_no_exchange_compaction_request_between` tests and baseline/current diff guard into focused write command/runtime IO once the write command DTO leaves orchestration. |
| Write command request DTO graph | `agent-doc-orchestration/src/write.rs` `CommandOptions`/`CommitMode` request data, `agent-doc-orchestration/src/write/run_entry.rs` `TemplateApplyOptions`, and crate-root repair replay construction using those orchestration-owned types | `agent-doc-write-command-io/src/lib.rs`, consumed directly by orchestration write and repair replay adapters | The write command request/commit-mode/template-apply option contract has no orchestration runtime dependencies and is shared by CLI write, repair replay, strict empty-response recovery, and template repair application. Moving it first makes the remaining write-runtime extraction a concrete graph over behavior rather than a hidden dependency on orchestration-owned DTOs. | Move the write command runtime/replay entrypoints, split `WriteFlags` and empty-response recovery ports, and relocate append/template apply helpers once their private write helpers have focused owners. |
| Write strict empty-response repair back-edge removal | `agent-doc-orchestration/src/write.rs` and `agent-doc-orchestration/src/write/ipc/transport.rs` regression tests calling `crate::repair::recover_empty_response_for_strict_closeout` | Direct `agent-doc-repair-io::recover_empty_response_for_strict_closeout(agent_doc_repair_runtime_io::repair_coordinator_effects(...), ...)` calls using the focused repair coordinator runtime API | The strict empty-response recovery coordinator already lives in `agent-doc-repair-io`; these tests only needed the concrete runtime effect bundle. Retargeting them removes the remaining write-to-repair source back-edge without preserving an orchestration repair facade path in write tests. | Move the write-command empty-response recovery bridge out of `agent-doc-orchestration/src/repair.rs` once the write command runtime/replay entrypoint leaves orchestration. |
| Write command runtime crate extraction | `agent-doc-orchestration/src/write.rs`, `agent-doc-orchestration/src/write/run_entry.rs`, `agent-doc-orchestration/src/write/ipc.rs`, and `agent-doc-orchestration/src/write/ipc/transport.rs` write command sequencing, append/template repair apply helpers, stream/IPC branch orchestration, visible-write/queue/session guards, and the regression suite still coupled to those private helpers | `agent-doc-write-runtime-io/src/{lib.rs,run_entry.rs,ipc.rs,ipc/transport.rs}` with `src/mcp.rs`, `src/orchestrate.rs`, and `agent-doc-orchestration/src/repair.rs` calling the focused runtime directly | The write runtime had already shed public write-authority and effect-provider facades, leaving a large but mostly self-contained command graph whose only production internal orchestration edge was repair replay. Moving the whole graph at once deletes `pub mod write` from orchestration, makes the remaining repair replay bridge depend on a focused runtime crate, and keeps the tangled write/IPC tests beside the behavior they cover instead of blocking the coarse extraction. | Split `agent-doc-write-runtime-io` into command entry, repair replay/apply, visible-write convergence, and test-fixture modules; move the remaining IPC transport fixtures into `agent-doc-write-ipc-io`; then move or delete `OrchestrationRepairReplayWriteEffects` once repair can own a focused write-replay adapter without depending on orchestration. |
| Repair replay write-runtime adapter extraction | `agent-doc-orchestration/src/repair.rs::OrchestrationRepairReplayWriteEffects` plus preflight/Codex hook `repair_coordinator_effects(&crate::repair::REPAIR_REPLAY_WRITE_EFFECTS)` injection sites | `agent-doc-write-runtime-io::REPAIR_REPLAY_WRITE_EFFECTS` implemented by `RuntimeRepairReplayWriteEffects`, with orchestration repair/preflight/hook modules injecting the focused static directly | Once the write runtime lived outside orchestration, the repair replay adapter no longer needed private orchestration access. Moving the strict replay, fallback template/append replay, and recovered queue-head strike implementation into the write-runtime owner removes the last concrete repair-write adapter body from `agent-doc-orchestration/src/repair.rs` and makes repair replay behavior discoverable beside the command runtime it drives. | Move the remaining public repair command bridge (`run_write_command_with_empty_response_recovery` and `repair`) into focused repair/write runtime APIs; relocate the repair integration tests out of `agent-doc-orchestration/src/repair.rs`; then delete the orchestration repair facade. |
| Repair command bridge extraction | `agent-doc-orchestration/src/repair.rs::{repair,run_write_command_with_empty_response_recovery}` production facade plus CLI, sync, session-actor, and route-test callers importing repair through orchestration | `agent-doc-repair-command-io/src/lib.rs` as the default repair command bridge combining `agent-doc-repair-io`, `agent-doc-repair-runtime-io`, and `agent-doc-write-runtime-io`, with production callers importing it directly and `agent-doc-orchestration/src/repair.rs` compiled only for retained in-crate tests | After the repair coordinator, runtime callbacks, and replay write adapter moved out, the remaining production `repair.rs` surface was only a facade over focused crates. Moving that default command bridge into a small focused crate deletes `agent_doc_orchestration::repair` as a production API while preserving the same strict empty-response and repair command behavior. | Relocate the repair integration tests out of `agent-doc-orchestration/src/repair.rs` into `agent-doc-repair-command-io` or focused repair IO fixtures; then delete the test-only orchestration repair module. |
| Repair test-only source module deletion | `agent-doc-orchestration/src/repair.rs` retained repair boundary tests and local default-effect wrappers after the production repair command bridge moved | `agent-doc-repair-command-io/tests/repair.rs` as integration coverage using focused repair IO, repair runtime IO, and write runtime IO directly | The production repair command bridge already lived in `agent-doc-repair-command-io`; keeping the large retained repair suite in orchestration preserved the last source module and made the crate look like it still owned repair behavior. Moving the whole test suite deletes the final `agent-doc-orchestration/src` module while keeping the repair boundary coverage beside the focused command bridge. | Split long-running repair fixtures between `agent-doc-repair-io`, `agent-doc-repair-runtime-io`, and `agent-doc-repair-command-io` once their effect dependencies are narrower; shrink the command-bridge integration suite to command-boundary cases only. |
| Preflight output DTO graph | `agent-doc-orchestration/src/preflight.rs` `PreflightOutput`, `RelatedDocChange`, and serialization-only JSON field helpers, plus external callers importing the output type through orchestration | `agent-doc-preflight-io/src/lib.rs`, consumed directly by orchestration preflight and orchestrate callers | The preflight JSON output contract is a focused preflight IO surface, not orchestration behavior. Moving the DTO beside `PreflightWarning`/`GateVerifyResult` makes the protocol shape discoverable in one crate and removes another public type dependency on `agent_doc_orchestration::preflight`. | Split linked-document change detection and output assembly from preflight command runtime; move remaining preflight run output construction after the diff/session/queue helpers have focused owners. |
| Preflight linked-document change detection IO graph | `agent-doc-orchestration/src/preflight.rs` local `links_cache_dir`, `check_url_link`, `check_linked_docs`, `recent_commit_summary`, URL fetch/cache dependency, and cache-dir unit coverage | `agent-doc-preflight-io/src/lib.rs` as the linked-document change detection surface beside `RelatedDocChange` | The linked-doc graph is preflight IO over frontmatter links, `.agent-doc/links_cache`, URL fetch/HTML markdown conversion, local related-file existence, and git revision summaries. Moving it as a chunk makes duplicate related-document policy discoverable beside the preflight output contract instead of leaving dead/private orchestration helpers. | Move output assembly callers onto the focused linked-change detector as needed; Split URL fetch/cache effects behind a port if tests need network-free coverage. |
| Preflight claims-log IO graph | `agent-doc-orchestration/src/preflight.rs` local `claims_log_path`, `read_claims`, `read_and_truncate_claims`, preflight/run claim consumption, and claims-log unit coverage | `agent-doc-preflight-io/src/lib.rs` as `claims_log_path`, `read_claims`, and `read_and_truncate_claims`, with preflight/run importing the focused helpers directly | Claims-log lookup and truncation is a preflight IO adapter over project-root discovery and `.agent-doc/claims.log`; keeping it in orchestration hid a small durable protocol beside the command runtime. Moving the whole graph makes the claims surface discoverable next to the preflight JSON output contract and linked-doc IO. | Split claim-log path discovery from destructive truncation if another caller needs read-only access; Move remaining preflight baseline-file write IO into focused preflight IO. |
| Preflight baseline content IO graph | `agent-doc-orchestration/src/preflight.rs` local `save_baseline_content`, baseline-file write path, MPS baseline-model mirror, and preflight/run baseline refresh call sites | `agent-doc-preflight-io/src/lib.rs` as `save_baseline_content`, with preflight/run importing the focused helper directly | Baseline persistence is preflight IO over the baseline sidecar path, disk write, optional MPS model mirror, and ops-log sink. Moving it beside the output DTO and claims/link IO keeps the durable preflight JSON input sidecars discoverable instead of leaving another filesystem helper in orchestration. | Split baseline path resolution from disk/model writes if baseline persistence needs alternate authorities; Move the remaining preflight diff/session output assembly after command runtime state narrows. |
| Preflight explicit backlog target requirement IO graph | `agent-doc-orchestration/src/preflight.rs` local `explicit_backlog_target_requirements`, cross-document review enforcement, target frontmatter parsing, tracked-work fingerprinting, and preflight/run target requirement assembly | `agent-doc-preflight-io/src/lib.rs` as `explicit_backlog_target_requirements`, with preflight/run importing the focused helper directly | Explicit backlog target requirement collection is preflight IO over linked target documents, frontmatter security-review policy, and durable cycle-state requirement DTOs. Moving it beside the rest of preflight IO makes cross-document target duplication discoverable outside orchestration command sequencing. | Split cross-document review reads from tracked-work fingerprint extraction if non-preflight callers need target requirement facts; Move remaining preflight prompt-contract output assembly after diff/session graph narrows. |
| Repair recovery coordinator IO graph | `agent-doc-orchestration/src/repair.rs` `run`, `run_with_queue_completion_ids`, `repair`, and strict empty-response closeout coordination over pending/capture replay selection, visible-response recovery, stale-cycle repair, commit-boundary/backlog repair, dedupe proof, snapshot adoption, replay writeback, required closeout, and interrupted-session fail-closed handling | `agent-doc-repair-io/src/lib.rs` as `RepairCoordinatorEffects`, `run_with_queue_completion_ids`, `recover_empty_response_for_strict_closeout`, and `repair`, with orchestration injecting write replay, closeout, session-check, and runtime recovery callbacks | The recovery coordinator is a repair use-case graph: it selects the durable repair source, sequences repair IO primitives, and decides when a repaired document must cross the closeout boundary. Moving it beside the repair sidecars makes duplicate repair policy discoverable in `agent-doc-repair-io` and leaves orchestration as concrete adapter callbacks. | Split `RepairCoordinatorEffects` into replay-write, closeout, session-check, pending/capture source selection, and empty-response recovery ports; move replay-write effects after `CommandOptions`/`CommitMode` leave `write.rs`. |
| Route busy-pane recovery and supervisor runtime IO graph | `agent-doc-orchestration/src/route/busy_pane.rs` and route-local supervisor/provenance helpers in `agent-doc-orchestration/src/route.rs` | `agent-doc-route-io/src/{busy_pane.rs,pane_provenance.rs,supervisor_runtime.rs}` | Busy-pane recovery is one route IO graph over readiness polling, scoped resync fix, test recovery hooks, supervisor health/restart IPC, tmux interrupt delivery, pane provenance capture, and existing-pane busy/focus classification. Moving it with the shared supervisor/provenance helpers deletes the orchestration busy-pane module and lets pane-resolution, dispatch-only, admission-projection, authoritative-actor, and route parent callers consume the focused route IO API directly. | Move pane-resolution and dispatch-only busy retry loops as the next coarse chunks now that supervisor IPC/provenance and busy recovery APIs live in `agent-doc-route-io`; keep pure dispatch decisions in `agent-doc-controller` and supervisor runtime policy in `agent-doc-supervisor`. |
| Route dispatch target and restart handoff IO graph | `agent-doc-orchestration/src/route/dispatch.rs` and `agent-doc-orchestration/src/route/pane_resolution.rs` | `agent-doc-route-io/src/{dispatch_target.rs,restart_handoff.rs}` | Dispatch target binding and restart handoff form one shared route IO seam over canonical dispatch paths, registry bind validation, tmux window projection, live-owner proof, supervisor restart registry polling, associated-pane adoption, and registry projection after handoff. Moving them together removes the shared registration/handoff effects from orchestration while keeping dispatch-only, pane-resolution, admission-projection, startup, and route parent callers on a focused route IO API. | Move pane-resolution and dispatch-only busy retry loops next; split fresh-dispatch target validation from direct-pane dispatch once the remaining dispatch callbacks are narrow enough; keep pure bind/match decisions in `agent-doc-controller` and registry storage in `agent-doc-session-registry-io`. |
| Route dispatch recovery and fresh-target validation IO graph | `agent-doc-orchestration/src/route.rs` and `agent-doc-orchestration/src/route/dispatch.rs` | `agent-doc-route-io/src/dispatch_recovery.rs` | Fresh dispatch target validation and starting-pane recovery polling are one route IO graph over dispatch registry loading, canonical dispatch paths, same-session handoff selection, cross-file bind rejection, startup-miss session-log polling, registered-pane confirmation, retry budgets, tmux liveness, and dispatch-target re-registration. Moving them together removes another shared dispatch-only/startup/pane-resolution recovery seam from orchestration while leaving pure decisions in `agent-doc-controller` and startup-miss status storage in `agent-doc-supervisor-io`. | Move the dispatch-only send/retry graph next; split route queue activation, authoritative-actor callbacks, and direct-pane submission proof adapters so the remaining pane-resolution dispatch-only paths can collapse into `agent-doc-route-io`. |
| Route dispatch-start tracking IO graph | `agent-doc-orchestration/src/route.rs` routed dispatch-start tracker helpers and tests | `agent-doc-route-io/src/dispatch_start.rs` | Codex hook visibility checks, hook-backed active-session proof tracking, OpenCode pane pre-capture, dispatch-start proof fact assembly, tmux polling, and tracker tests form one routed dispatch-start IO graph over focused Codex hook IO, tmux capture, harness prompt classification, and controller proof policy. Moving it together removes the tracker from orchestration while keeping route/dispatch adapters as callers. | Move the dispatch-only send/retry graph and direct-pane proof adapters next; split pure proof policy remains in `agent-doc-controller`, while hook sidecar storage stays in `agent-doc-codex-hook-io` and tmux capture stays in route IO. |
| Route dispatch-only proof and recycle gate IO graph | `agent-doc-orchestration/src/route/dispatch_only.rs` accepted-only proof gate helpers, recycle-in-flight wait block, proof outcome formatting helpers, and unit tests | `agent-doc-route-io/src/dispatch_only/proof.rs` | The dispatch-only pre-submit recycle settle gate, hook-aware proof requirement, accepted-only failure logging/flow-event/route-submit blocking, dispatch-only proof outcome formatting, and proof-gate tests form one route IO graph over supervisor recycle markers, route-submit in-flight sidecars, flow logs, ops logs, Codex hook visibility, and controller proof/message policy. Moving it together deleted the proof/recycle gate from orchestration before the larger send/retry loop moved. | Split recycle-settle polling, dispatch-start proof classification adaptation, route-submit blocked marking, and proof bug-report effects into narrower proof modules once dispatch-only send/retry stops sharing the same transport surface. |
| Route launch contract reuse IO graph | `agent-doc-orchestration/src/route.rs` launch-contract reuse helpers for harness clear, managed capability proof, and Codex reopen | `agent-doc-route-io/src/launch_contract.rs` | The launch-contract reuse path is one route IO graph over Codex hook clear prompts, managed capability proof status, supervisor restart/rebind, startup ready waiting, dispatch-target registration, restart handoff, and operator diagnostics. Moving it first made the dispatch-only send/retry graph independent of route.rs internals without preserving a facade. | Split managed capability proof lookup, supervisor restart handoff, ready-wait retry, and dispatch-target registration into narrower route IO ports; Move remaining startup/pane-resolution callers onto the focused launch-contract helper before extracting those modules. |
| Route dispatch-only send/retry IO graph | `agent-doc-orchestration/src/route/dispatch_only.rs` send/retry loop plus dispatch-only call sites in `agent-doc-orchestration/src/route.rs`, `route/pane_resolution.rs`, and `route/startup.rs` | `agent-doc-route-io/src/dispatch_only.rs` | Dispatch-only sending, queue activation, starting-pane authoritative readiness probing, active-turn busy queuing, busy-pane recovery retry, direct-pane versus supervisor IPC delivery selection, dispatch-start proof handoff, and route-submit in-flight marking form one route IO graph. Moving it together deletes the orchestration `route/dispatch_only.rs` module while making route queue mutation, diagnostics, startup timeout, and bug filing explicit injected effects. | Split the route queue mutation effect port, starting-pane readiness probe, busy diagnostics, direct/supervisor delivery adapters, and route bug-report sink into narrower modules; Move the remaining pane-resolution/startup dispatch-only wrappers once those ports are focused. |
| Route direct-pane dispatch IO graph | `agent-doc-orchestration/src/route/dispatch.rs` direct-pane command submit, acceptance polling, Enter/full-resend retry, late Enter-resubmit, dead-shell guard, submit observation/latency logging, route pane snapshot helpers from `agent-doc-orchestration/src/route.rs`, and related tests | `agent-doc-route-io/src/direct_pane_dispatch.rs` | The direct-pane route path is one tmux-facing IO graph over command text injection, harness submit-profile keys, pane capture polling, protected prompt input snapshots, recycle-in-flight settle/re-poll, direct-pane submit observations, latency ops-log lines, route pane snapshot persistence, and controller direct-pane policy. Moving it together deletes the concrete direct-pane submit/retry side effects from orchestration while leaving the higher-level dispatch-start proof wait, busy short-circuit, supervisor IPC path, and route bug backlog filing as remaining adapters. | Split route dispatch bug backlog filing out of `route.rs`; then split the direct-pane submit helper graph further by acceptance polling, retry/resubmit, and snapshot logging once the dispatch transport module settles. |
| Route auto-start dispatch-ready reverify IO graph | `agent-doc-orchestration/src/route/dispatch.rs` auto-start dispatch-ready block/reverify helpers and caller in `agent-doc-orchestration/src/route/startup.rs` | `agent-doc-route-io/src/startup_ready.rs` | The cold-start pre-send reverify graph is one route startup IO slice over tmux pane capture/current-command lookup, harness ready-prompt detection, bare-shell classification, controller `AutoStartDispatchBlock` policy, and ops-log fail-closed/confirmed telemetry. Moving it with startup readiness keeps auto-start dispatch gating beside the existing fresh-start readiness polling instead of leaving a dispatch helper facade in orchestration. | Move the remaining startup provisioning and route bug backlog filing into focused route IO ports; split proof waits and bug filing before collapsing the rest of startup orchestration adapters. |
| Route dispatch transport and proof IO graph | `agent-doc-orchestration/src/route/dispatch.rs` dispatch transport/proof module plus callers in `agent-doc-orchestration/src/route.rs`, `route/{startup.rs,pane_resolution.rs,admission_projection.rs,dispatch_only.rs}` | `agent-doc-route-io/src/dispatch.rs` | Supervisor IPC dispatch, direct-pane routed reopen wrappers, route-submit in-flight guards, dispatch-start proof waits, busy-pane queued short-circuit telemetry, route latency/submit observations, direct-pane late-resubmit proof retries, and snapshot capture on unproven dispatch form one route dispatch IO graph. Moving it together deletes the orchestration `route/dispatch.rs` module and lets route callers invoke `agent-doc-route-io::dispatch` directly while keeping document-backlog bug filing and tmux user diagnostics as explicit route-owned effect sinks. | Split the moved `dispatch.rs` internally: supervisor IPC transport, direct-pane proof wait, busy queued diagnostic, and bug-report effect callback should become narrower modules once route bug backlog filing leaves `route.rs`; then move the remaining pane-resolution/startup orchestration adapters into route IO. |
| Route authoritative actor controller IO graph | `agent-doc-orchestration/src/route/authoritative_actor.rs` plus actor-state and capability-proof helpers from `agent-doc-orchestration/src/route.rs` | `agent-doc-route-io/src/authoritative_actor.rs` | Authoritative actor binding, controller dispatch authorization/coalescing, stale queue-pause recovery, starting-timeout recovery, lifecycle marking, harness-mismatch defer handling, capability-proof status lookup, and actor state conversions are one route controller IO graph over the SQLite actor store, supervisor runtime/config/session logs, Codex hook clear prompts, and controller queue-control RPC. Moving it together deletes the orchestration `route/authoritative_actor.rs` module and makes the remaining route adapters import focused actor IO directly. | Split capability-proof status into a managed-capability module if it grows; split controller authorization/recovery from actor lifecycle marking once pane-resolution and dispatch-only move; keep route queue/document mutation effects in orchestration until those have focused ports. |
| Route turn admission projection IO graph | `agent-doc-orchestration/src/route/admission_projection.rs` plus prompt-bearing drift adapters from `agent-doc-orchestration/src/session_check/closeout_guards.rs` | `agent-doc-route-io/src/admission_projection.rs` and `agent-doc-session-check-io/src/prompt_bearing.rs` | Routed turn admission is one route IO graph over the controller-owned `TurnAdmissionProjectionOperation::{Current, Await}` subscription, prompt-bearing drift context discovery, unchanged-projection controller policy, startup-miss sidecars, fresh supervisor restart retry, ready-wait recovery, dispatch-target handoff, managed reopen dispatch, and startup-miss/busy diagnostics. Moving it together deletes the orchestration `route/admission_projection.rs` module; the prompt-bearing drift detector moved to session-check IO first so route IO does not depend back on orchestration. | Split projection waiting, fresh-restart retry, and startup-miss sidecar recording into narrower route IO modules; Move startup-miss and busy diagnostics out of the orchestration effects adapter once route bug/diagnostic sinks have focused ports; Keep route queue/document mutation tests in orchestration until queue writeback has a focused route port. |
| Legacy supervisor/agent runtime IO wave | `agent-doc-orchestration/src/{supervisor/*,agent/{claude.rs,codex.rs},start/*}` | `agent-doc-supervisor`, `agent-doc-supervisor-io`, `agent-doc-supervisor-process`, `agent-doc-turn-executor`, `agent-doc-harness`, and `agent-doc-ipc-protocol` | Backfills commits `6bc00090`, `42d504fc`, `0a8e273b`, `971cb2e2`, `b4c9f10c`, `8dce5536`, `5bcfc07b`, `c95eced6`, and `e24a3fca`, which moved terminal filtering, PTY start command, supervisor config/env/screen/cwd/IPC protocol, managed capability, and Claude/Codex/OpenCode launch parsing out in broad runtime chunks. | Separate pure runtime policy from process/PTY/file IO; keep command launch and managed-capability protocol out of orchestration; shrink remaining `start` adapters around injected effects. |
| Legacy memory/queue/harness adapter wave | `agent-doc-orchestration/src/{memory_cmd.rs,queue_continuation.rs,hooks.rs,run.rs,agent/codex.rs,write/ipc.rs}` | `agent-doc-memory`, `agent-doc-queue-io`, `agent-doc-lease`, `agent-doc-harness`, `agent-doc-ipc-protocol`, and `agent-doc-turn` | Backfills commits `1c57b988`, `41b388ab`, `b4c9f10c`, and `8dce5536`, where memory compaction/session helpers, continuation-marker adapters, owner-pane/self-invocation policy, managed capability, and Codex Stop-hook IPC helpers moved in clustered adapter passes. | Split memory store policy from command IO; keep queue marker storage and Stop-hook detection in queue/turn crates; move remaining run/hook orchestration callbacks behind focused IO clients. |
| Agent backend process adapters | `agent-doc-orchestration/src/agent/{claude.rs,codex.rs,junie.rs,opencode.rs}` | `agent-doc-agent-io/src/agent/*` | Concrete child-process launch, streaming parse, stderr handling, retry, and per-agent environment adapters share one process boundary. Moving them together removed the agent CLI backend tree from orchestration without splitting protocol and process concerns prematurely. | Split CLI-specific stream/protocol parsing from process spawning; keep shared launch vocabulary in `agent-doc-turn-executor`; move only concrete executable effects through `agent-doc-agent-io`. |
| Supervisor process runtime adapters | `agent-doc-orchestration/src/supervisor/{in_process.rs,pty.rs}` and `agent-doc-orchestration/src/session_liveness.rs` | `agent-doc-supervisor-process/src/{in_process.rs,pty.rs,session_liveness.rs}` | PTY child adoption, process liveness, re-exec handoff, stdin injection, raw kill/wait, and in-process supervisor ticking form one concrete supervisor process graph. Moving it as a chunk kept lifecycle policy in `agent-doc-supervisor` and process effects in `agent-doc-supervisor-process`. | Split Unix raw child operations, PTY plumbing, and pure reattach/tick decisions; keep restart/handoff policy in `agent-doc-supervisor` and only side-effectful process adapters here. |
| Orchestration facade deletion sweep | `agent-doc-orchestration/src/{agent.rs,commit_integrity.rs}` plus root module compatibility re-exports | Focused crates and direct caller imports, including `agent-doc-agent-io`, `agent-doc-document`, `agent-doc-controller`, and `agent-doc-tmux-*` | Commit `2811d37e` removed the temporary extraction facades after the focused crates existed, converting old root paths into direct crate imports in one pass. | Keep no-facade guard tests current; delete aliases as soon as callers move; avoid adding new root module wrappers for extracted crates. |
| Cycle state sidecar IO | `agent-doc-orchestration/src/cycle_state.rs` | `agent-doc-cycle-state-io/src/lib.rs` | The cycle sidecar schema, atomic JSON persistence, phase event logging, pending/dropped prompt bookkeeping, queue-head facts, and checkpoint metadata are one durable crash-recovery record. Moving it as one graph deleted orchestration ownership of cycle state storage. | Split schema/pathing/atomic writes from higher-level lifecycle bookkeeping; keep phase transition policy in `agent-doc-turn`; separate queue/backlog checkpoint fields if they become independent stores. |
| Operation-log facade deletion | `agent-doc-orchestration/src/ops_log.rs` plus broad direct-call rewrites | `agent-doc-ops-log-io/src/lib.rs` with callers importing `agent_doc_ops_log_io` directly | Commit `016184a3` removed the orchestration ops-log facade after the focused IO crate existed and rewired session-check, preflight, write, route, repair, capture, prompt, and CLI surfaces to call the focused crate directly. | Split `ops.log` text append/read adapters from `cycles.jsonl` serialization and rotation if they diverge; keep metadata assembly in callers and never reintroduce an orchestration ops-log facade. |
| Realtime admission cycle opener | `agent-doc-orchestration/src/admit.rs` | `agent-doc-cycle-state-io/src/lib.rs` | Realtime admission is a lightweight cycle-open contract: read the document, resolve current visible content through an injected authority, load the model snapshot through an injected adapter, open durable preflight state, and emit one admission event. Moving the whole module deleted another orchestration facade while keeping realtime resolution and ops-log effects outside cycle-state IO. | Split the admitted-output JSON shell from the cycle-open service if more command surfaces need it; keep snapshot and ops-log adapters injected until their dependency graph is acyclic. |
| Workflow doctor/autofix IO | `agent-doc-orchestration/src/{doctor.rs,autofix.rs}` | `agent-doc-workflow-io/src/{doctor.rs,autofix.rs}` | Doctor and autofix are one workflow diagnostic/remediation IO surface over durable JSON captures, cycle state, ops logs, git state, proof ledgers, and live orchestration probes. Moving both together deleted two orchestration modules while preserving live session-check, controller, and editor-buffer facts behind an injected `WorkflowDoctorEffects` seam. | Split durable fact readers from live probe adapters; move controller inspection and realtime buffer divergence into focused IO crates so the CLI effects adapter disappears; keep pure invariant/autofix policy in `agent-doc-workflow`. |
| State backbone chart and observer graph | `agent-doc-orchestration/src/state_backbone.rs` plus `agent-doc-orchestration/src/adstatechart_snapshot.rs` observers | `agent-doc-state-backbone` and `agent-doc-state-observer-io` | Backfills the state-model extraction from commits `d30b9b13`, `cd553da8`, `8000c8cf`, `c8ed0f7c`, and `c2e6ca12`: state path/protocol helpers, local-process Harel chart state/event models, and observer adapters moved together so realtime state could become a first-class crate graph. | Split pure chart/event vocabulary from observer/read-model adapters; keep live observation in state-observer IO; route generated FFI/state subscriptions through focused crates without restoring orchestration state facades. |
| State wire subscription boundary | `agent-doc-orchestration/src/state_wire.rs` and `agent-doc-workflow/src/state_wire.rs` | `agent-doc-state-wire` | Commit `ebade5a9` moved the state subscription wire protocol as one graph after the backbone existed, deleting both orchestration and workflow facades instead of preserving duplicate subscription shims. | Split wire payload encoding from callback dispatch if the protocol grows; keep `agent-doc-state-wire` depending on the backbone directly; keep orchestration/workflow source facades deleted. |
| Turn-scope sidecar IO | `agent-doc-orchestration/src/turn_scope_store.rs` plus turn-scope callers in `agent-doc-orchestration/src/{run.rs,git.rs,preflight/run.rs,write/converge.rs}` | `agent-doc-turn-scope-io` with turn policy in `agent-doc-turn` | Backfills commits `0a95a821` and `160e9f4b`, which moved session-cycle turn scope derivation and durable turn-scope sidecar reads/writes as a coherent lifecycle graph. | Split pure affectedness/authority decisions from sidecar pathing and filesystem IO; keep call sites importing `agent-doc-turn-scope-io` directly; avoid recreating a `turn_scope_store` root facade. |
| Transcript context and model-tier graph | `agent-doc-orchestration/src/context_pct.rs` plus context/model helpers in preflight and Codex hook adapters | `agent-doc-model-tier/src/{context_usage.rs,context_transcript_io.rs}` | Backfills commits `614a8819`, `c886927e`, and `5c19aee1`: transcript token parsing, context-window percentage, clear/no-clear diagnostics, model attribution, and transcript locator IO moved together behind the model-tier boundary. | Split deterministic context parsing from transcript filesystem discovery if another harness needs it; keep preflight and Codex hooks as adapters; do not restore a `context_pct` orchestration module. |
| Prompt-cache policy and history IO | `agent-doc-orchestration/src/prompt_cache.rs` plus run prompt-assembly helpers | `agent-doc-prompt-cache` and `agent-doc-prompt-cache-io` | Backfills commits `486913a7`, `0a24fa2e`, and `1cb21bb6`, where cache-boundary rendering, replay-key policy, miss-cause ranking, trend checks, and JSONL effectiveness history moved as one cache subsystem. | Split pure cache economics/ranking from history file IO; keep run prompt assembly importing focused cache APIs directly; keep queue tombstone and cache history side effects out of orchestration. |
| Codex hook blocked-stop sidecar IO | `agent-doc-orchestration/src/codex_hook.rs` blocked-stop persistence helpers | `agent-doc-codex-hook-io/src/lib.rs` | The blocked Stop-hook payload sidecar, project-root discovery, root tracking, and content hashing form one hook-owned durable sidecar graph. Moving it together kept Codex hook command handling in orchestration while deleting sidecar storage policy from that module. | Split project-root enumeration from blocked-payload persistence if hook IO expands; keep sqlite/tmux/session effects out of Codex hook IO; do not re-add blocked-stop storage helpers to `codex_hook.rs`. |
| Codex hook session-state sidecar IO graph | `agent-doc-orchestration/src/codex_hook.rs` active-session state helpers plus callers in `agent-doc-orchestration/src/{route.rs,route/authoritative_actor.rs,preflight/run.rs,start/idle_watch.rs,repair.rs,session_check.rs,session_check/closeout_guards.rs}` and root CLI adapters in `src/{plan.rs,session_actor_cmd.rs}` | `agent-doc-codex-hook-io/src/lib.rs` | The active Codex session JSON schema, session sidecar pathing, cross-root load/save/clear fanout, latest prompt lookup, external prompt recording, current-session environment lookup, and clear-prompt classifier form one hook-owned durable sidecar graph. Moving it together lets route/preflight/repair/session-check/CLI callers import focused Codex hook IO directly instead of routing through the orchestration hook module. | Move route dispatch-start tracker into `agent-doc-route-io` now that it can depend on focused Codex hook IO; split stop-hook decision policy from hook session-state IO if it grows; keep tmux/sqlite/controller effects out of `agent-doc-codex-hook-io`. |
| Codex hook user-prompt-submit tracking IO graph | `agent-doc-orchestration/src/codex_hook.rs` `UserPromptSubmit` payload parsing/tracking helpers and prompt-tracking tests, plus root `src/main.rs` hook dispatcher | `agent-doc-codex-hook-io/src/lib.rs` with `src/main.rs` calling `agent_doc_codex_hook_io::handle_user_prompt_submit()` directly | Codex prompt-submit handling is a hook-sidecar IO graph: it parses Codex hook JSON, resolves the harness-native `agent-doc <file>` invocation even with instruction preambles, preserves the previously tracked document for non-invocation prompt bodies, fans session state out across tracking roots, records exact clear-prompt timestamps, and persists session state without stop-closeout/write/git effects. Moving it with its tests removes another command facade from orchestration while keeping the Stop-hook policy in place for the next split. | Move Stop-hook decision policy behind an explicit effect port; keep repair/write/git/session-check effects out of hook sidecar IO. |
| Session accretion IO adapter | `agent-doc-orchestration/src/session_accretion.rs` | `agent-doc-session-accretion-io/src/lib.rs` | File content metrics, session-log metrics, startup-miss facts, frontmatter/project-config opt-ins, and recent-compaction markers feed one accretion report boundary around the pure `agent-doc-session-accretion` policy. | Move more deterministic metric reduction into `agent-doc-session-accretion`; split recent-compaction marker IO from report assembly; keep startup/session-log reads in focused IO crates. |
| Response capture IO adapter | `agent-doc-orchestration/src/capture.rs` | `agent-doc-capture-io/src/lib.rs` | The durable response-capture ledger, partial checkpoints, replay validation, capture lifecycle updates, and cycle-state coordination are one recovery graph around captured model output. Moving it whole removed capture sidecar ownership from orchestration. | Split capture path/schema helpers from atomic store operations; keep capture-state transitions in `agent-doc-workflow`/`agent-doc-turn`; isolate cycle-state advancement behind a narrower focused IO dependency. |
| Prompt and state observer IO | `agent-doc-orchestration/src/prompt.rs` and `agent-doc-orchestration/src/adstatechart_snapshot.rs` | `agent-doc-prompt-io/src/lib.rs` and `agent-doc-state-observer-io/src/lib.rs` | Prompt detection/answering and advisory state-chart observation are read-only operator-observation adapters over tmux, frontmatter, live-buffer, IPC, cycle, and install freshness facts. They moved together as observation surfaces rather than policy layers. | Keep pure prompt parsing/navigation in `agent-doc-turn-executor-tmux`; split state-observer fact collection by source crate; avoid letting observer IO feed write/commit authority. |
| Watch daemon IO | `agent-doc-orchestration/src/document_watcher.rs` and `agent-doc-orchestration/src/watch.rs` daemon internals | `agent-doc-watch-io/src/daemon.rs` | The daemon PID file, notify watcher, registry rescan, file-watch delivery, stream capture polling, loop prevention, and controller document-change effects run as one long-lived watch process. Moving the daemon graph deleted orchestration ownership while preserving injected effects. | Split PID/process control, session discovery, file-watch delivery, stream capture polling, and controller effects; keep pure watch authority in `agent-doc-document-realtime` and projection policy in `agent-doc-document`. |
| GC IO host | `agent-doc-orchestration/src/gc.rs` | `agent-doc-gc-io/src/lib.rs` | The orphan sidecar scanner, stale socket cleanup, typing/status/repair/codex-hook retention cleanup, and stale actor cleanup run as one project-root maintenance pass. Moving the whole graph removed orchestration ownership while preserving the injected `GcControllerEffects` boundary. | Split pure retention/path classification from filesystem deletes; keep controller actor cleanup behind effects; consider smaller modules for sidecar-family scanners once the orchestration crate no longer owns the maintenance surface. |
| GC/watch CLI effect adapter cleanup | `agent-doc-orchestration/src/{gc.rs,watch.rs}` remaining effect adapters | `src/main.rs` CLI effects plus `agent-doc-gc-io` and `agent-doc-watch-io` direct command dispatch | The focused crates already owned GC and watch runtime logic; this pass deleted the last orchestration wrapper modules and moved the concrete project-controller, stream, session-actor, and run-context effect bindings to the binary boundary. | Move controller/state-event and stream-flush effect bindings out of the CLI once `project_controller`, `session_actor`, and stream write authority have focused IO homes; keep PID, daemon, observation, and retention logic in the focused IO crates. |
| Controller dashboard policy and IO | `agent-doc-orchestration/src/dashboard.rs` | `agent-doc-controller/src/fleet.rs`, `agent-doc-controller-io/src/dashboard.rs`, and `src/dashboard_cmd.rs` | Backfills the dashboard extraction from commits `af1b5d32` and `539eabb9`: fleet model/rendering policy moved into the controller crate, dashboard snapshot/render IO moved into controller IO, and the orchestration dashboard facade was deleted as one control-plane chunk. | Split controller-inspection effects from session-registry/pane-liveness snapshot assembly; keep pure dashboard row/finding rendering in `agent-doc-controller`; keep CLI code as effect wiring only. |
| Controller admin command IO host | `agent-doc-orchestration/src/admin.rs` | `agent-doc-admin-io/src/lib.rs` plus `src/main.rs` `CliAdminControllerEffects` | Admin list/detect/inspect/queue/reap/handoff/projection commands are one operator control-plane host over controller state, session registry, project-root resolution, JSON/plain rendering, and tmux liveness. Moving the host deletes the orchestration admin module while keeping concrete project-controller/tmux/session-registry effects at the binary boundary. | Split JSON view structs from project-controller RPC structs once controller RPC types move to a focused crate; move recycle/reap-stale-controller admin subcommands behind focused controller IO effects; keep dashboard IO separate so controller-io stays free of SQLite. |
| Queue command, pipeline mirror, and write-queue adapter batch | `agent-doc-orchestration/src/{queue_cmd.rs,pipeline_frontmatter.rs,write_queue.rs}` | `agent-doc-queue-io/src/queue_cmd.rs`, `agent-doc-cycle-state-io/src/pipeline_frontmatter.rs`, and focused queue IO direct calls through `agent-doc-orchestration/src/lib.rs` effect adapters | This pass batches three small-but-user-visible hosts: queue command rendering now lives with queue IO behind injected write effects, pipeline frontmatter terminal/mirror writes live with cycle-state IO behind injected convergence effects, and write serialization calls focused queue IO directly instead of retaining an orchestration module. | Move the remaining queue write effects out of `write.rs`; move the pipeline convergence effect out of orchestration once document convergence has a focused IO port; move the session-actor submitter when `session_actor` leaves orchestration. |
| CRDT relay host IO | `agent-doc-orchestration/src/crdt_relay_host.rs` | `agent-doc-crdt-relay-io/src/lib.rs` | The live relay cutover depends on a per-document hub registry, authority gate, disk projection recovery, and editor replica delivery snapshots that share one runtime boundary. Moving it as one host graph avoided rebuilding a partial relay facade in orchestration. | Separate hub-registry lifecycle from disk projection recovery and supervisor IPC payload adapters; keep pure CRDT relay policy in `agent-doc-document-realtime` and merge primitives in `agent-doc-merge`. |
| Lazily run-context graph | `agent-doc-orchestration/src/graph.rs` | `agent-doc-run-context-io/src/lib.rs` | `CycleContext` and `ActorContext` are one lazily dependency graph over project-root/config/snapshot/frontmatter/cycle/head/session-registry slots. The graph had no hard orchestration dependency, so the entire source could move cleanly. | Split short-lived CLI `CycleContext` slots from long-lived `ActorContext` invalidation slots if the graph grows; keep file/config/snapshot/session-registry loaders as focused IO dependencies, not orchestration callbacks. |
| Queue continuation host IO | `agent-doc-orchestration/src/queue_continuation.rs` | `agent-doc-queue-io/src/queue_continuation.rs` | The detector, durable marker reconcile, marker scan, and Codex Stop-hook fallback ownership gate are one queue I/O host around existing queue policy and marker storage. Moving the host deletes the orchestration source file while preserving controller actor authority via an injected callback. | Move pure queue policy regression tests into `agent-doc-queue`; split snapshot/recycle-yield host adapters around `detect`; replace the actor-binding callback with focused controller IO once the controller RPC client is extracted. |
| Top-level focused crate re-export facade deletion batch | `agent-doc-orchestration/src/lib.rs` root compatibility re-exports for `crdt_relay_host`, `graph`, and `queue_continuation` plus internal/external callers still using those public paths | `agent-doc-crdt-relay-io`, `agent-doc-run-context-io`, and `agent-doc-queue-io::queue_continuation` direct imports at production/test call sites, with no root orchestration re-export aliases | The underlying source files were already extracted, but the root `pub use` aliases kept `agent-doc-orchestration` as a public compatibility facade. Removing all three in one batch forces callers onto the focused crates without changing runtime behavior. | Split the remaining root effects providers and delete them once git/write/repair callbacks are focused; keep root `lib.rs` as transitional command adapters only, not a crate re-export surface. |
| Write visible-guard re-export facade deletion | `agent-doc-orchestration/src/write.rs` public `guard_visible_write_idle` re-export plus `agent-doc-orchestration/src/run.rs` callers using `write::guard_visible_write_idle` | Direct `agent-doc-document-realtime-io::guard_visible_write_idle` import in `agent-doc-orchestration/src/run.rs`, while `write.rs` keeps only crate-private guard imports it actually sequences | The visible-write idle guard already belongs to focused document realtime IO. Removing the public write-module re-export avoids rebuilding a write facade for a single focused adapter. | Move the remaining visible-write convergence sequencing out of `write.rs`; Split direct-run writeback from command writeback once write authority has focused ports. |
| Write stale-snapshot convergence IO graph | `agent-doc-orchestration/src/write/converge.rs` stale snapshot reset guard, active-capture response preservation, compact-origin/scope provenance checks, snapshot/CRDT rebase writes, and reset-drift diagnostics | `agent-doc-write-converge-io/src/lib.rs` with write/git/preflight callers importing the focused guard directly | The stale snapshot reset guard is one convergence-side effect graph over pure realtime drift policy plus cycle, capture, snapshot, CRDT, turn-scope, compaction, and ops-log sidecars. Moving it together creates a focused write-convergence IO home instead of keeping those decisions inside the orchestration write split. | Split live-prompt drift recovery, editor convergence, and IPC fallback adapters into `agent-doc-write-converge-io`; Move remaining orchestration write/converge tests beside focused IO once the live-prompt recovery graph moves; keep callers on focused crate imports instead of reintroducing a write/converge re-export. |
| Write IPC de-wedge and stale-supervisor recycle IO graph | `agent-doc-orchestration/src/write/{ipc.rs,ipc/transport.rs,converge.rs}` de-wedge marker sidecars, visible-write receipt polling, IPC timeout latch, stale-supervisor write short-circuit, and stale IPC recycle scheduling | `agent-doc-write-converge-io/src/lib.rs` with write IPC transport, live-prompt convergence, idle-watch, template proof logging, and flow closeout callers importing the focused helpers directly | The de-wedge latch, visible-write receipt, and stale-supervisor recycle path are one write-convergence sidecar graph around editor IPC proof, socket degradation, and stale process recovery. Moving it together eliminates the local `write::ipc`/`write::converge` helper ownership and deletes the closeout/idle-watch adapter through orchestration. | Split editor convergence payload construction, file-IPC fallback, detached disk fallback, and live-prompt drift recovery into `agent-doc-write-converge-io`; move remaining helper-only IPC tests beside the focused sidecar crate while keeping end-to-end `try_ipc` tests in orchestration until transport leaves. |
| Write editor convergence IO graph | `agent-doc-orchestration/src/write/converge.rs` live-prompt drift recovery, editor convergence payload construction, live-buffer authority refresh, visible-write mismatch refresh, detached-disk fallback decision, and file-IPC convergence fallback sequencing | `agent-doc-write-converge-io/src/lib.rs` as `EditorConvergenceEffects`, with orchestration supplying only queued atomic document writes and the still-local file-IPC poller through document realtime runtime effects | The editor convergence path is one write-convergence IO graph over realtime write policy, live-buffer sidecars, plugin-owner leases, socket IPC proof, visible-write receipts, file-IPC fallback, snapshot/CRDT persistence, and ops-log/cycle-state diagnostics. Moving it together removes production convergence ownership from `write/converge.rs` while keeping the still-unextracted file-IPC poller explicit as an effects seam rather than a hidden facade. | Move the file-IPC poller and its status/rejection-receipt/content validation into a focused IPC/write-convergence IO waiter, preferably with an evented filesystem-notify backend plus polling fallback; move the retained test-only convergence coverage into `agent-doc-write-converge-io`; split queued atomic write authority out of orchestration once the session actor write queue moves. |
| Write file-IPC delivery proof loop | `agent-doc-orchestration/src/write/ipc/transport.rs` inline `write_ipc_and_poll` file-IPC patch delivery loop plus the convergence callback in `agent-doc-orchestration/src/write.rs`: atomic patch write, committed-cycle fence, lazily `EditorPatchRejected` receipt handling, no-ack proof logging, fallback-patch cleanup, and delivered/not-delivered handoff | `agent-doc-write-converge-io/src/lib.rs` as `FileIpcDeliveryOptions`, `write_file_ipc_and_poll_delivery`, and narrow `EditorConvergenceEffects` proof callbacks, with `write_ipc_and_poll` delegating to the focused delivery proof before running local post-consumption repair | The file fallback delivery loop is a reusable proof graph around a durable patch file: write the patch atomically, prove the plugin consumed or rejected it, fail closed when the active cycle has already committed, and log timeout evidence without writing directly to the document. Moving it whole removes duplicated production file-IPC polling from orchestration while keeping post-consumption snapshot/response repair in the transport for the next split. | Move the remaining post-consumption visible-write snapshot repair, response-materialization validation, and CRDT/snapshot persistence out of `write/ipc/transport.rs`; replace the delivery wait with an evented notify/inotify backend where available while preserving the current polling fallback for degraded or cross-platform file IPC. |
| Write IPC transport delivery-loop delegation | `agent-doc-orchestration/src/write/ipc/transport.rs` `write_ipc_and_poll` local atomic-write/poll/rejection-receipt/timeout prefix and duplicate proof logging | `agent-doc-write-converge-io::write_file_ipc_and_poll_delivery`, called from `write_ipc_and_poll` through `agent-doc-document-realtime-io::RUNTIME_WRITE_CONVERGENCE_EFFECTS` before local snapshot repair starts | The main transport path and convergence fallback now share one delivery proof loop, so orchestration no longer has a second copy of patch-file polling semantics. This was split as a delegation pass because the post-delivery repair graph is still tangled with IPC snapshot adoption, visible-buffer authority, response materialization, and CRDT persistence. | Extract the post-delivery repair graph next: visible-write receipt adoption, stale visible-buffer preference, response-materialization proof, live-exchange visible-write guard, IPC snapshot drift/duplication guards, visible-state repair, visible-write write-through, snapshot save, and CRDT save. |
| Write IPC repair decision model extraction | `agent-doc-orchestration/src/write/ipc.rs` local `EditorBadStateFingerprint` and `IpcRepairDecision` state machine embedded inside the IO-heavy IPC repair module | `agent-doc-ipc-protocol/src/lib.rs` beside `IpcSnapshotSource` and `IpcDiskRepairReason`, with orchestration importing the focused protocol model directly | The repair decision is a pure protocol-domain graph: it tracks snapshot source, disk-repair reason, bad editor-state proof, prefix-normalization lines, dedupe repair, and visible-redelivery intent without touching filesystem, socket, snapshot, or CRDT effects. Moving it now shrinks the tangled post-delivery repair module and gives the remaining IO split a clearer model boundary. | Extract the post-delivery repair effect graph around this model: snapshot-adoption guards, stale visible-write snapshot vs visible-buffer preference, missing-response materialization, full-content redelivery, disk write-through, snapshot save, and CRDT save should move into a focused write IPC repair IO crate or protocol-adjacent IO seam. |
| Write visible-write write-through IO graph | `agent-doc-orchestration/src/write/ipc.rs` local live-buffer key resolution, visible-write disk-write proof, bounded typing-settle/forward-reconcile loop, live-buffer sync marker, and visible-write disk write-through helper | `agent-doc-write-converge-io/src/lib.rs` as focused visible-write proof/reconcile/write-through functions, using `EditorConvergenceEffects::atomic_write` for the final visible document write | This graph is effectful but already belongs to write convergence: it samples live-buffer sidecars, waits out active typing, reconciles stale visible-write snapshots to newer operator-authoritative buffers, gates whole-buffer disk writes through realtime authority policy, and records sync markers. Moving it whole removes another post-delivery IPC repair island from orchestration while preserving the session-actor write authority through the existing effects port. | Move the remaining post-delivery IPC repair orchestration into the same focused boundary: sidecar adoption, missing-response materialization, full-content visible repair redelivery, duplicate/prompt-drift guards, snapshot save, and CRDT save should follow once their filesystem/snapshot dependencies are separated from template normalization. |
| Write IPC normalization redelivery IO graph | `agent-doc-orchestration/src/write/ipc.rs` local missing-operator-text authority gate, stale-committed-buffer autoheal, visible-write receipt observation proof, socket/file narrow normalization repair delivery, and normalization fallback sequencing | `agent-doc-write-converge-io/src/lib.rs` as focused redelivery authority and narrow normalization repair functions, with orchestration passing only the still-local full-content fallback callback | The normalization redelivery path is a write-convergence IO graph over live-buffer sidecars, committed-blob recovery, socket IPC, file-IPC patch queues, visible-write receipts, project-root resolution, and ops-log proof. Moving it whole removes another visible-state repair island from orchestration while leaving the still-tangled full-content transport behind an explicit callback seam. | Move snapshot-adoption guards, visible-write write-through persistence, snapshot save, and CRDT save as the remaining post-delivery repair graph. |
| Write IPC sidecar repair-decision builder | `agent-doc-orchestration/src/write/ipc.rs` local `ipc_repair_decision_from_sidecar` visible-write receipt normalization divergence classifier, duplicate-prompt cleanup call, prefix observation logging, and repair decision construction | `agent-doc-write-converge-io/src/lib.rs` as `ipc_repair_decision_from_sidecar`, using focused exchange policy/IO and IPC protocol models directly | The visible-write receipt repair decision is the front door to the post-delivery repair graph: it classifies stripped prompt-prefix sidecars, normalizes the rejected editor snapshot, dedupes prompt artifacts, logs prefix/duplicate counts, and returns the protocol repair decision. Moving it removes another decision island from orchestration and keeps redelivery-side repair decisions beside their IO proof adapters. | Move snapshot-adoption guards, visible-write write-through persistence, snapshot save, and CRDT save into the focused IPC repair IO boundary; then split pure sidecar classification from filesystem/socket proof if it grows. |
| Write IPC visible-state repair IO graph | `agent-doc-orchestration/src/write/ipc.rs` local `repair_ipc_decision_visible_state` visible-state proof logger, live-drift in-cycle editor recovery, normalization/full-content redelivery dispatch, no-disk-write convergence marker, and retry-required diagnostics | `agent-doc-write-converge-io/src/lib.rs` as `repair_ipc_decision_visible_state`, with orchestration passing `EditorConvergenceEffects` and the low-level full-content transport callback explicitly | Visible-state repair is one proof graph over the IPC repair decision model, live-buffer sidecars, socket listener availability, editor convergence recovery, normalization redelivery, full-content repair fallback, cycle-state retry markers, stale-supervisor recycle requests, and ops-log diagnostics. Moving it deletes the local orchestration facade while preserving the full-content transport as an explicit callback seam for the next extraction. | Split snapshot-adoption guards, visible-write write-through persistence, snapshot save, and CRDT save out of `write/ipc.rs` and `write/ipc/transport.rs` so the post-delivery repair graph can move as a larger coarse chunk. |
| Write IPC full-content redelivery proof IO graph | `agent-doc-orchestration/src/write/ipc.rs` local `redeliver_full_content_repair_to_editor` and test-only `redeliver_ipc_dedupe_to_editor`: bad-state file proof, missing-operator-text authority gate, whole-buffer delivery decision, live-buffer divergence guard, disabled full-content transport handoff, and redelivery outcome logging | `agent-doc-write-converge-io/src/lib.rs` as `redeliver_full_content_repair_to_editor`, with orchestration passing only the still-local disabled full-content response-fallback transport callback | Full-content repair redelivery is one write-convergence proof graph: it validates the bad visible state before replacement, blocks stale or operator-diverged buffers, applies the whole-buffer authority table, reuses the focused missing-operator-text gate, and logs success/not-consumed/error outcomes. Moving it makes visible-state repair own redelivery semantics in the focused crate while leaving the disabled transport/cycle cleanup as the next explicit callback seam. | Move snapshot-adoption guards, visible-write write-through persistence, snapshot save, and CRDT save as the remaining post-delivery repair graph. |
| Write IPC disabled full-content transport IO graph | `agent-doc-orchestration/src/write/ipc/transport.rs` local `try_ipc_full_content*` disabled whole-document IPC functions, full-content scope rejection logging, authority rejection logging, stale-supervisor short-circuit, and committed-cycle fallback cleanup | `agent-doc-write-converge-io/src/lib.rs` as focused `try_ipc_full_content*`, `full_content_ipc_scope_allows`, and `log_full_content_ipc_disabled`, with orchestration passing `EditorConvergenceEffects` for terminal closeout guard logging and stale fallback patch cleanup | The disabled full-content path is not a transport implementation anymore; it is a write-convergence proof graph that refuses unsafe whole-buffer editor replacement while preserving diagnostics, stale-supervisor recycle, scope/authority rejection, and committed-cycle cleanup. Moving it makes the redelivery callback and the normal patch diagnostics point at the same focused owner. | Move snapshot-adoption guards out of `write/ipc.rs`/`transport.rs`, then split any remaining test-only IPC repair fixtures. |
| Write IPC snapshot and CRDT persistence IO graph | `agent-doc-orchestration/src/write/ipc.rs` already-applied socket snapshot persistence and duplicated `agent-doc-orchestration/src/write/ipc/transport.rs` socket/file IPC snapshot-save plus CRDT-save blocks | `agent-doc-write-converge-io/src/lib.rs` as strict `save_document_snapshot_and_crdt` and non-fatal `save_ipc_snapshot_and_crdt_nonfatal` helpers | The post-IPC persistence mechanics are one focused sidecar graph over markdown snapshot save, per-document CRDT save, ops-log success/failure markers, and non-fatal transport recovery semantics. Moving it removes duplicated socket/file IPC save blocks while preserving the stricter already-applied adoption path. | Split snapshot-adoption guards, visible-state repair sequencing, and remaining test-only IPC fixtures so `write/ipc.rs` keeps only branch orchestration. |
| Write IPC snapshot adoption repair and forensics IO graph | `agent-doc-orchestration/src/write/ipc.rs` local socket visible-write missing-response materialization and IPC full-prompt corruption forensic logger | `agent-doc-write-converge-io/src/lib.rs` as focused `materialize_missing_response_for_socket_visible_write_drift` and `log_ipcfullprompt_corruption_if_any`, with forensic sidecar writes delegated to `agent-doc-ipc-forensics-io` | Missing-response rescue and IPC full-prompt forensic capture are post-adoption write-convergence effects, not command orchestration. Moving both together removes direct forensic sidecar ownership and visible-write drift repair mutation from `write/ipc.rs` while preserving transport call sites. | Move the remaining snapshot-adoption guard decisions, stale-supervisor refusal hook, and semantic/forward-merge convergence helpers out of `write/ipc.rs`. |
| Write IPC snapshot semantic convergence and adoption diagnostics graph | `agent-doc-orchestration/src/write/ipc.rs` local semantic merge convergence helper and allowed-adoption diagnostic logger | `agent-doc-write-converge-io/src/lib.rs` as focused `try_semantic_merge_convergence` and `log_ipc_snapshot_adoption_allowed`, with queue prompt-drift checks imported from `agent-doc-queue` | Semantic merge gating and allowed-adoption diagnostics are snapshot adoption convergence policy around visible-write/live editor snapshots. Moving them together keeps the remaining orchestration guard as branch sequencing while the AST/queue/drop-response safety checks live in the focused write-convergence owner. | Move the remaining snapshot-adoption guard decisions and stale-supervisor refusal hook out of `write/ipc.rs`; then split test-only IPC fixtures. |
| Write IPC snapshot adoption guard IO graph | `agent-doc-orchestration/src/write/ipc.rs` live-prompt drift adoption guard, prompt-duplication adoption guard, stale-supervisor content_ours refusal hook, dropped prompt/queue evidence recording, semantic visible-write carry-forward logging, and forward-merge repair decision branches | `agent-doc-write-converge-io/src/lib.rs` as focused `guard_ipc_snapshot_adoption_against_live_prompt_drift*` and `guard_ipc_snapshot_adoption_against_prompt_duplication*`, with production stale-supervisor warning lookup and injected-warning test seams | The adoption guards are one write-convergence IO graph over IPC repair decisions, realtime drift policy, queue prompt-drift policy, cycle-state proof sidecars, ops-log/flow diagnostics, stale-supervisor recycling evidence, semantic merge visible-write persistence, and visible-repair flags. Moving them together leaves orchestration to sequence transport branches while the focused crate owns the snapshot authority state machine. | Split already-applied socket snapshot adoption, stale visible-write visible-content preference, and remaining test-only IPC repair fixtures out of `write/ipc.rs`; keep extracting post-delivery transport repair until IPC orchestration only sequences calls. |
| Write IPC already-applied snapshot authority IO graph | `agent-doc-orchestration/src/write/ipc.rs` stale visible-write visible-content preference, already-applied socket content_ours snapshot persistence, missing-response visible repair proof, snapshot response/prompt dedupe, visible-write write-through/snapshot save sequencing, and proof/fallback diagnostics | `agent-doc-write-converge-io/src/lib.rs` as focused `prefer_visible_content_over_stale_visible_write_snapshot`, `persist_already_applied_socket_content_ours_snapshot`, `dedupe_consecutive_response_blocks`, and `dedupe_ipc_snapshot_content`, with orchestration injecting only `EditorConvergenceEffects` for visible-idle and atomic-write effects | The already-applied path is a coherent snapshot authority state machine over socket ACK errors, visible-write receipts, visible editor buffers, prompt-drift checks, duplicate-prompt cleanup, response materialization proof, disk write-through, CRDT/snapshot persistence, and file-IPC fallback decisions. Moving it together removes another post-delivery authority graph from `write/ipc.rs` while preserving transport as branch orchestration. | Split remaining transport delivery loops and test-only IPC repair fixtures out of `write/ipc.rs`/`write/ipc/transport.rs`; then break `agent-doc-write-converge-io` into smaller durable visible-write, redelivery, and snapshot-authority modules once orchestration is thin. |
| Write IPC reposition transport IO graph | `agent-doc-orchestration/src/write/ipc/transport.rs`, `agent-doc-orchestration/src/write/ipc.rs`, and reposition/IPC gate callers/tests in `agent-doc-orchestration/src/{git.rs,write.rs,write/run_entry.rs}` | `agent-doc-write-ipc-io/src/lib.rs` with callers importing `IpcResult`, `patch_response_headings_already_in_head`, `queue_file_ipc_reposition_boundary`, `try_ipc_reposition_boundary`, and `FileIpcRepositionResult` directly | Boundary reposition, IPC result typing, and the late-fallback HEAD-heading gate are one high-level write-IPC transport chunk over socket reposition messages, file-IPC reposition patch queueing, existing-patch deferral, cycle/baseline generation tokens, prefix-normalization targets, socket timeout degradation, stale fallback cleanup, and response-in-HEAD proof. Moving it together creates a focused write IPC transport crate instead of keeping these APIs as `write::ipc` exports; closeout cleanup/sentinel callers now import `agent-doc-flow-io` directly. | Split file-patch payload construction from socket send/fallback handling; move the remaining patch transport `try_ipc` branch into `agent-doc-write-ipc-io` once closeout guard logging, patch JSON synthesis, and post-delivery repair callbacks are narrow enough; keep protocol classification in `agent-doc-ipc-protocol`, closeout cleanup in `agent-doc-flow-io`, and low-level sockets/file signals in `agent-doc-ipc-io`. |
| Write IPC patch payload synthesis IO graph | `agent-doc-orchestration/src/write/ipc/transport.rs` plus payload synthesis tests in `agent-doc-orchestration/src/{write.rs,write/run_entry.rs}` | `agent-doc-write-ipc-io/src/lib.rs` as `build_ipc_patches_json` with `write/ipc/transport.rs` and `write/run_entry.rs` importing the focused builder directly | Socket/file IPC patch payload synthesis is one chunk over file-backed current-document reads, frontmatter filtering, append/replace operation selection, deterministic boundary seeding, boundary/node IDs, unmatched exchange/output synthesis, existing-content dedupe, and prefix normalization. Moving it with its tests keeps the payload graph beside the reposition transport APIs and removes another duplicate write-IPC owner from orchestration. | Split pure payload policy from file read/eprintln diagnostics; move the remaining `try_ipc` branch once closeout guard logging and post-delivery repair callbacks narrow; keep normalization policy in `agent-doc-document-realtime` and boundary lookup in `agent-doc-element-boundary`. |
| Write IPC transport graph | `agent-doc-orchestration/src/write/ipc/transport.rs` production socket-first/file-IPC `try_ipc` body, payload targeting, socket delivery status handling, durable file-IPC fallback handoff, visible-write receipt adoption, already-applied socket snapshot persistence, response-materialization validation, visible-state repair, snapshot/CRDT persistence, and exchange write diagnostics | `agent-doc-write-ipc-io/src/transport.rs` as `try_ipc_with_effects`, with orchestration retaining only a `try_ipc` test wrapper that supplies document realtime convergence effects and legacy tests | These branches are one high-level write IPC transport graph over socket delivery, durable file-IPC fallback, focused protocol vocabulary, editor-target projections, write-convergence repair callbacks, and IPC proof logging. Moving the whole production graph into `agent-doc-write-ipc-io` makes the existing write IPC crate own actual delivery instead of only reposition/payload helpers, while the narrow `EditorConvergenceEffects` port preserves the current document write authority seam. | Move remaining write IPC transport tests and the orchestration wrapper into `agent-doc-write-ipc-io`; split socket delivery status handling, file-IPC post-consumption repair, visible-write receipt adoption, already-applied snapshot persistence, exchange diagnostics, and the file notification backend into smaller transport/convergence modules while preserving durable polling fallback. |
| Write IPC production transport facade demotion | `agent-doc-orchestration/src/write/ipc/transport.rs` production `try_ipc` wrapper plus root stream/runtime callers still routed through `agent_doc_orchestration::write::try_ipc` | Direct `agent_doc_write_ipc_io::try_ipc_with_effects` calls from `agent-doc-orchestration/src/write/run_entry.rs` and `src/main.rs`, with `agent-doc-orchestration/src/write/ipc/transport.rs` compiled only as a test-only wrapper over `agent-doc-write-ipc-io/src/transport.rs` | The focused write IPC crate already owns the transport body. Keeping a public orchestration `try_ipc` wrapper rebuilt a production facade over the focused owner and let new callers keep using `write::try_ipc`. Demoting the wrapper to test-only removes the production API while preserving legacy transport regression fixtures until they move. | Move remaining write IPC transport tests into `agent-doc-write-ipc-io`; split socket delivery status handling, file-IPC post-consumption repair, visible-write receipt adoption, already-applied snapshot persistence, exchange diagnostics, and the file notification backend into smaller transport/convergence modules while preserving durable polling fallback. |
| Direct-run prompt and auto-queue IO graph | `agent-doc-orchestration/src/run.rs` direct-run diff synthesis, typed active-queue prompt projection, auto-queue continuation decisions, prompt cache routing, and stable/volatile prompt assembly | `agent-doc-run-io/src/lib.rs`, with orchestration retaining only the command runtime that calls `compute_run_diff`, `build_prompt`, `prompt_cache_routing_affinity`, and `should_continue_auto_queue` directly | Direct runs share one coherent IO graph over snapshot diffing, typed queue state events, session-accretion context reset, prompt-cache replay keys, document SSH context, prompt-bearing diff extraction, and response-context pack assembly. Moving it together deletes another production policy body from `run.rs` without forcing a fake layer split before the queue and prompt seams have narrower modules. | Move remaining direct-run prompt and queue tests into `agent-doc-run-io`; split prompt assembly, typed queue projection, session-accretion context reset, and diff synthesis into submodules once the command runtime shell shrinks further. |
| Direct-run runtime and owner-pane IO graph | `agent-doc-orchestration/src/run.rs` stderr redirect policy, run heartbeat/progress markers, preflight/write-applied cycle markers, owner-pane self-invocation detection, queue-edit closeout deferral, recursive Codex diagnostics, and dispatch timeout detail rendering | `agent-doc-run-io/src/lib.rs`, with orchestration retaining the command runtime and passing focused document realtime pipeline-frontmatter effects into abandoned-cycle marking | These helpers formed one direct-run runtime IO graph over project-root log files, stderr FD redirection, cycle-state sidecars, snapshot/current-document reads, actor/session registry lookup, tmux current-pane proof, owner-pane recursion policy, and ops-log diagnostics. Moving them as a chunk shrinks `run.rs` to sequencing while keeping the still-shared pipeline-frontmatter write authority explicit. | Split stderr redirection, cycle markers/heartbeat, owner-pane recursion, queue-edit deferral, and dispatch timeout helpers into smaller `agent-doc-run-io` modules; move remaining direct-run tests into the focused crate; replace the temporary pipeline-frontmatter effect argument once run/write/git cycle mutation ports are focused. |
| Direct-run command runtime and writeback IO graph | `agent-doc-orchestration/src/run.rs` direct-run outer auto-queue loop, single-run dispatch sequencing, malformed-frontmatter repair, session ensure, dry-run prompt-cache diagnostics, branch/precommit handoff, child-agent submit/timeout handling, response capture/writeback, direct-run append/template merge, CRDT merge persistence, resume update, per-document flock, and direct-run atomic-write path | `agent-doc-run-io/src/lib.rs` behind `DirectRunEffects`, with orchestration retaining only concrete commit/write/queue-consume/closeout/template-normalization/abandoned-cycle callbacks | After prompt, runtime, and owner-pane helpers moved, the remaining `run_once` body was a single command runtime graph over focused diff/prompt/queue/cycle/template/merge/agent crates plus a small set of orchestration effects. Moving the graph as one chunk deletes direct-run sequencing ownership from orchestration instead of peeling one branch at a time, while keeping write/git authority explicit in the effects port. | Split `DirectRunEffects` into commit, writeback, queue-consume, closeout, and cycle-abandon ports; move remaining direct-run tests into `agent-doc-run-io`; split append/template response writeback, dry-run diagnostics, and child-agent dispatch into smaller run-IO modules; retire the orchestration wrapper once CLI callers can depend on the focused run-IO command API directly. |
| Direct-run production facade demotion | `agent-doc-orchestration/src/run.rs` public production `run`/`run_with_context` wrappers and concrete `DirectRunEffects` adapter still serving root CLI run dispatch | Direct `agent_doc_run_io::run` calls from `src/main.rs` through `agent_doc_orchestration::DIRECT_RUN_EFFECTS` into `agent-doc-run-io/src/lib.rs`, with `agent-doc-orchestration/src/run.rs` demoted to a test-only direct-run boundary module | The direct-run runtime already lived in `agent-doc-run-io`; leaving a public orchestration `run` module kept a production facade alive for no behavior. Moving the concrete effects adapter to the crate root and pointing CLI dispatch at the focused crate removes another public orchestration API while preserving the explicit temporary commit/write/queue/closeout/cycle-abandon effect bundle. | Move remaining direct-run tests into `agent-doc-run-io` and split `DirectRunEffects`; move the concrete effects provider out of the orchestration root once commit/write/queue/closeout/cycle mutation ports have focused owners. |
| Direct-run test-only source module deletion | `agent-doc-orchestration/src/run.rs` test-only direct-run boundary coverage that still compiled as an orchestration source module | `agent-doc-orchestration/tests/direct_run.rs` integration tests calling `agent_doc_run_io` directly and using `agent_doc_orchestration::DIRECT_RUN_EFFECTS` only for the temporary concrete effect adapter | Production direct-run ownership had already moved to `agent-doc-run-io`, so the remaining `#[cfg(test)] mod run` kept a fake source-module seam alive. Moving the tests out of `src/` deletes the module entirely while preserving boundary coverage against the focused run IO API and the explicit temporary effects provider. | Move the remaining direct-run integration tests into `agent-doc-run-io` once `DirectRunEffects` no longer needs orchestration's commit/write/queue/closeout/cycle callbacks; split the root effects provider by those focused ports. |
| Direct-run integration suite relocation | `agent-doc-orchestration/tests/direct_run.rs` historical direct-run integration suite covering prompt/cache routing, active queue projection, run-cycle markers, writeback, queue consume, closeout, and direct runtime effects | `agent-doc-run-io/tests/direct_run.rs` with an explicit dev-dependency on `agent-doc-run-runtime-io` for the still-broad concrete effect provider | The direct-run tests already exercised the focused `agent-doc-run-io` API and only needed the focused runtime effects crate for temporary concrete callbacks. Moving the suite whole deletes the direct-run test surface from orchestration and puts the direct-run behavior regressions beside the command owner. | Split direct-run effects fixtures into commit, writeback, queue-consume, closeout, and cycle-abandon suites; move pure prompt/cache/queue projection assertions into smaller run or queue modules once the runtime effects port narrows. |
| Codex Stop continuation context IO graph | `agent-doc-orchestration/src/codex_hook.rs` and `agent-doc-orchestration/src/start/idle_watch.rs` Codex MCP detection, transcript context-percent lookup, queue context-reset reason resolution, Stop-continuation clear proof logging, and queue-continuation ops logging | `agent-doc-codex-hook-io/src/lib.rs`, with the Stop handler calling `codex_continuation_clear_reason`, `codex_queue_context_reset_reason`, `agent_doc_mcp_configured_for`, and continuation log helpers directly | The Stop hook and idle watcher shared one Codex-specific context IO graph over project-root hook state, `.codex/config.toml`, Codex transcript JSONL discovery, session-accretion reset policy, model-tier clear decisions, and ops-log proof lines. Moving it as a chunk lets the existing hook IO crate own Codex continuation context instead of leaving it as production policy in the Stop handler. | Split MCP config detection, transcript lookup, session-accretion reset policy, and continuation proof logging into smaller `agent-doc-codex-hook-io` modules; move the remaining Stop closeout/repeated-queue recovery graph behind explicit repair/write/session-check effect ports. |
| Codex Stop runtime extraction | `agent-doc-orchestration/src/codex_hook.rs` Stop payload parsing, closeout recovery, repeated queue-head recovery, auto-queue continuation, blocked payload capture, and Stop-hook tests | `agent-doc-codex-stop-io/src/lib.rs` with `src/main.rs` calling `agent_doc_codex_stop_io::handle_stop()` directly | The remaining Codex Stop handler had no internal orchestration dependencies; it was a self-contained runtime graph over focused hook sidecars, repair, queue, session-check, closeout, git, and document authority crates. Moving it whole deletes the production Codex hook facade instead of peeling one branch at a time. | Split Stop payload parsing, queue-continuation decision policy, repeated queue recovery, blocked-payload capture notes, repair replay, and closeout completion into narrower modules/effect ports inside `agent-doc-codex-stop-io`; keep sidecar ownership in `agent-doc-codex-hook-io`. |
| Start command runtime extraction | `agent-doc-orchestration/src/start.rs` plus `agent-doc-orchestration/src/start/{run.rs,idle_watch.rs,supervisor_io.rs}` long-lived supervisor loop, idle queue watch, supervisor IPC adapter, route-owned reap handling, and start-runtime tests | `agent-doc-start-runtime-io/src/{lib.rs,run.rs,idle_watch.rs,supervisor_io.rs}` with `src/main.rs` calling `agent_doc_start_runtime_io::{run,run_with_reap_policy}` directly | The remaining `start` module had only internal `super::*` edges and depended on focused start, supervisor, tmux, queue, document, and process crates. Moving the whole command host deletes the production start facade from orchestration instead of extracting one helper at a time. | Split `SupervisorShared`, idle-watch queue completion, supervisor IPC lifecycle/delivery, child launch/restart/adoption, and route-owned reap callbacks into narrower start-runtime/supervisor modules; keep admission/session-owner setup in `agent-doc-start-io`. |
| Preflight command runtime extraction | `agent-doc-orchestration/src/preflight.rs` plus `agent-doc-orchestration/src/preflight/run.rs` command sequencing, cycle-completion wiring, recovery/diff/output assembly, and preflight command tests | `agent-doc-preflight-command-io/src/{lib.rs,run.rs}` with `src/main.rs` calling `agent_doc_preflight_command_io::{run_with_options,PreflightOptions}` directly | The remaining preflight module had no internal orchestration dependencies; it was a command host over focused preflight, runtime, repair, write, closeout, queue, diff, and session crates. Moving it whole deletes the last production orchestration module while preserving the follow-up seams in the focused preflight command crate. | Split cycle-completion effect wiring, preflight recovery sequencing, queue/diff/output assembly, warning collection, and test fixtures into narrower preflight-command/preflight-runtime modules; keep pure and reusable IO helpers in `agent-doc-preflight-io`. |
| Write convergence test-wrapper re-export facade deletion | `agent-doc-orchestration/src/write.rs` crate-visible `pub(crate) use converge::*` plus IPC tests calling convergence wrappers through `super::*` | Direct `agent-doc-write-converge-io::try_editor_converge` calls in `agent-doc-orchestration/src/write/ipc.rs` tests, with `write/converge.rs` remaining private and `#[cfg(test)]` only | Production write convergence already lives in `agent-doc-write-converge-io`; the crate-visible re-export rebuilt an orchestration facade for tests and let sibling modules depend on wrapper names instead of the focused owner. Deleting the re-export makes the remaining test module private fixture coverage rather than a local API surface. | Move the remaining `write/converge.rs` fixture coverage into `agent-doc-write-converge-io` or focused integration tests once its temporary `WRITE_CONVERGENCE_EFFECTS` dependency is split; keep production callers importing `agent-doc-write-converge-io` directly. |
| Write convergence fixture coverage relocation | `agent-doc-orchestration/src/write/converge.rs` test-only convergence wrappers and regression fixture coverage | `agent-doc-write-converge-io/src/convergence_fixture_tests.rs` with a local `EditorConvergenceEffects` fixture adapter | The production convergence graph already lives in `agent-doc-write-converge-io`; keeping its regression fixture in orchestration preserved a fake test-only source module and a dependency on `WRITE_CONVERGENCE_EFFECTS`. Moving the entire fixture deletes the orchestration module hook while keeping the broad regression coverage beside the focused convergence implementation. | Split the test-only convergence effects adapter by durable sidecar family; move pure policy assertions into pure crates where they no longer need filesystem/socket fixtures; keep orchestration write effects as explicit production adapters only until write authority leaves orchestration. |
| Tracked-work command and done-archive IO | `agent-doc-orchestration/src/backlog_cmd.rs` plus done-archive helpers in `agent-doc-orchestration/src/preflight.rs` | `agent-doc-element-backlog-io/src/{backlog_cmd.rs,done_archive.rs}` | Backlog, icebox, review, and completed-item archive mutations are one user-visible tracked-work command host. Moving it whole deletes the orchestration backlog facade while keeping document convergence and provenance as injected effects. | Split command rendering from document mutation adapters; move remaining pending-maintenance archive callers out of `preflight/maintenance.rs`; replace the orchestration convergence/provenance effect adapter once document writes have a focused IO port. |
| Session-check guard IO adapter batch | `agent-doc-orchestration/src/session_check/{backlog_guards.rs,partial_staging.rs,queue_head_guards.rs,queue_head_provenance_guards.rs}` plus guard-mode resolvers in `agent-doc-orchestration/src/session_check/pending_guards.rs` | `agent-doc-session-check-io/src/{backlog_guards.rs,partial_staging.rs,queue_head_guards.rs,queue_head_provenance_guards.rs,guard_modes.rs}` | Backlog replay checks, partial-closeout/partial-staging checks, no-response/reaped queue-head checks, free-text/id-backed queue-head provenance checks, and guard-mode resolution all adapt persisted cycle/capture/git/archive/document context into focused workflow/queue/turn/backlog policy. Moving them together deletes four orchestration guard hosts and points write/session-check callers at the focused IO boundary directly. | Split durable fact readers from guard-result assembly once the remaining `pending_guards`, `closeout_guards`, and `response_guards` adapters leave orchestration; move queue-head provenance tests toward pure `agent-doc-queue` fixtures where possible; replace `CycleContext` arguments with a narrower session-check read model. |
| Focus command host IO | `agent-doc-orchestration/src/focus.rs` | `agent-doc-focus-io/src/lib.rs` plus `src/focus_effects.rs` effect adapter | The focus command is one user-visible tmux navigation host over frontmatter/session-registry reads, live-owner reconciliation, stash-window surfacing, and local actor projection. Moving it whole deletes the orchestration focus facade while keeping the remaining sync/session-actor lookups behind a binary-owned effect port. | Split stash-window promotion and live-owner lookup out of `sync.rs` into focused tmux/sync IO crates; move local actor projection behind focused controller/session-actor IO; add non-live-tmux unit coverage around `FocusEffects` before removing the binary adapter. |
| Session actor store and mailbox IO | `agent-doc-orchestration/src/session_actor.rs` | `agent-doc-session-actor-io/src/lib.rs` | Session actor generation/CAS storage, legacy projection migration, harness detection, direct state transitions, and the in-process document mailbox form one control-plane actor graph. Moving it whole deletes the orchestration session_actor facade and makes callers import focused actor IO directly. | Split SQLite actor-store migration/projection emission from in-process mailbox runtime; move controller bootstrap/projection metadata back into controller IO; remove the remaining orchestration write-queue submitter once write authority leaves orchestration. |
| Session registration and projection IO | `agent-doc-orchestration/src/sessions.rs` | `agent-doc-session-registry-io/src/registration.rs` | Session registration, supervisor rebind session-log events, actor-backed sessions projection, projection diagnostics, tmux window lookup, and registry snapshot writes form one registry IO graph. Moving it whole deleted the orchestration `sessions` facade and made route/sync/start/CLI callers import focused registration IO directly. | Split actor-backed sessions projection and projection diagnostics from tmux registration writes; move remaining project-controller projection wrappers into focused controller IO; replace local sessions aliases in orchestration callers with narrower registration/projection imports. |
| Project controller runtime IO | `agent-doc-orchestration/src/project_controller.rs` and `agent-doc-orchestration/src/project_controller/rpc.rs` | `agent-doc-controller-io/src/project_controller.rs` and `agent-doc-controller-io/src/project_controller/rpc.rs` | Commit `0f90f7cf` moved the project-local controller socket, RPC, state-store, admin, recycle, supervisor-replacement, layout, and actor-projection runtime as one controller IO graph and deleted the orchestration root `project_controller` facade while keeping route auto-start and force-disk queue consume behind a binary-installed effects port. | Split RPC client/server wire protocol from SQLite actor-store projection, process/recycle scans, supervisor replacement, admin rendering, and sessions projection; replace the runtime-effects port with focused queue and route IO ports as those seams move. |

| Responsibility | Destination | Current status |
|---|---|---|
| Element descriptors and local element models | `agent-doc-element-*` plus `agent-doc-element-registry` | Active. Queue item lifecycle now lives in `agent-doc-element-queue`; review-list projection/filtering and ungate-task planning now live in `agent-doc-element-review`; tracked-work ops-proof completion classification now lives in `agent-doc-element-backlog`; orchestration no longer owns those element state/projection models. |
| Queue syntax, scheduling, and drainability | `agent-doc-queue` + `agent-doc-queue-io` | Active. Pure queue parsing, id-backed `do #id` directive target extraction, graph-task explicit-`do` target extraction, queue command/prompt classification, queue response heading/head-id matching, free-text response-proof matching, free-text vs id-backed queue-head classification, registered-preset/tracked-directive head classification, queue activation-trigger text recognition, queue prompt preservation identity matching, queue deletion identity/count comparison, preemption/edit-owner rules, backlog-to-queue sync request collection, one-shot queue-sync request/report policy, id-backed queue-head closeout/removal decisions, free-text queue-head identity/presence/residue projection, tracked-work priority/dependency projection, queue-continuation drainability/noise/context-reset policy, operator-authored prompt identity detection, and continuation guidance wording live in `agent-doc-queue`; one-shot backlog-to-queue file mutation/report adapters, file-backed queue-continuation detection, queue journal sidecar record/replay/clear, queue-consumption proof recording and stages, continuation markers, tombstones, controller pause, write-queue, drain-stall, and context-clear in-flight sidecars live in `agent-doc-queue-io`. Orchestration keeps controller-state, lifecycle, command printing, and mutation adapters, with callers importing proof stages and snapshot readers from focused IO crates directly. The old manual-addition compatibility shim and queue-journal facade are deleted. |
| Cross-element document projection | `agent-doc-document` | Active for queue projection, element-model composition, markdown outline projection, active document identity/collision projection, commit-seam frontmatter integrity policy, and pure status/top-backlog/stale-supervisor marker projection. |
| Status writeback effects | `agent-doc-document` + `agent-doc-status-io` | Active. Pure status component replacement, top-backlog sentence reconciliation, and stale-supervisor marker projection live in `agent-doc-document`; status command document reads, force-disk writeback, status-set audit formatting, editor-aware convergence dispatch, document write provenance, and ops-log runtime effects live in `agent-doc-status-io`. The write command calls `agent_doc_status_io::set_with_runtime_options` directly; orchestration no longer keeps a `status_cmd` facade or private status effects adapter. |
| Work graph / Auto-DAG scheduling | `agent-doc-work-graph` | Active. Source-agnostic graph classification, graph-evidence validation, schedule model, task parser, session-review guard classifier, schedule blocker wording, node readiness/state-transition policy, schedule decision vocabulary, batch progress policy, orchestration-batch flow-event mapping, and rendering live here so markdown documents, cross-document sources, and external PM adapters can feed the same dependency model. |
| Cross-cutting workflow kernel | `agent-doc-workflow` | Active. Pure evidence-to-decision-to-mutation/proof workflow policy for stale supervisors, queue drainability, captured responses, live-buffer drift, and session-cycle prompt/finalize policy including prompt-target extraction plus the machine-readable invariant catalog live here; shared flow-event vocabulary and field-safe log rendering live in `agent-doc-flow`, flow-event logging through an injected sink lives in `agent-doc-flow-io`, while focused policy crates own their domain-specific event construction. Orchestration keeps evidence gathering, effects, doctor/autofix adapters, and the final concrete ops-log sink, but no `flow::proof` facade. Serialization and focused pure document/diff dependencies are allowed; orchestration/git/editor IPC/sqlite/tmux dependencies are not. |
| Workflow proof/playback IO | `agent-doc-workflow-io` | Active. Operation proof ledger pathing, append/read helpers, convergence blocked-boundary playback schema, artifact pathing/writes, canonical ops-log message formatting, and document initialization sequencing live in `agent-doc-workflow-io`. Orchestration injects only the concrete ops-log sink when a convergence boundary blocks and the concrete git commit function when a document enters the lifecycle. |
| Operation-log file IO | `agent-doc-ops-log-io` | Active. `ops.log` and `cycles.jsonl` append/read adapters, session-check ops-log readers, size-based rotation, `CycleEntry` JSONL serialization, timestamp formatting, content hashing, and git HEAD hash lookup live here. Callers import `CycleEntry` and ops-log readers from the focused IO crate directly; orchestration keeps only the concrete sink surface plus `CycleContext`/frontmatter/cycle-state tracking metadata assembly and passes that metadata into the focused IO crate. |
| Template-mode patch parsing, sanitization, repair, response materialization, and replay validation | `agent-doc-template` + `agent-doc-template-io` | Active. Pure patch parsing, patch content sanitization, patchback shape classification, orchestrate patchback contract policy, child template response normalization plus its flow-event mapping, template structure guard flow-event policy, response write-proof/materialization policy, strict response-heading policy, replay-payload validation, component mutation, boundary repositioning, and duplicate prompt/tail repair live in `agent-doc-template`; injected-sink template patchback parse/log adapters, template structure guard logging, IPC payload response-materialization probe adapters, and file/config-backed template patch application and template-info adapters live in `agent-doc-template-io`; orchestration keeps write/file adapters and only supplies the concrete ops-log sink. |
| Diff annotation, prompt-bearing classification, and diff IO | `agent-doc-diff` + `agent-doc-diff-io` | Active. Pure comment stripping, post-exchange comment directive scanning, unified-diff helpers, slash/preset/directive extraction, prompt-bearing change classification, unstarted prompt-bearing change selection, bare prompt-prefix target slicing, and partial-staging changed-literal/path-relatedness policy live in `agent-doc-diff`; editor-buffer stability waits, snapshot mtime copy-on-read checks, and stale-snapshot recovery diff computation live in `agent-doc-diff-io`. `agent-doc-snapshot-io` exposes the focused `SnapshotStore` adapter and callers pass it to focused diff IO directly; orchestration no longer keeps a `diff_io` facade or a diff snapshot-store facade. |
| Frontmatter and project config parsing | `agent-doc-frontmatter` + `agent-doc-frontmatter-io` + `agent-doc-project-config-io` | Active. Document frontmatter schema, project config types, pure parsing/serialization helpers, formatted-document session-initialization predicate, and pending/review/auto-done guard precedence/defaulting live in `agent-doc-frontmatter`; file/config-backed frontmatter adapters, formatted-document session UUID file assignment, plus cached `ResolvedSshContext` parsing live in `agent-doc-frontmatter-io`; file-backed project config loading, migration, saving, and tmux-session helpers live in `agent-doc-project-config-io`. Callers use the focused crates directly rather than routing through `config` or orchestration. |
| Finalize lint gate adapter | `agent-doc-lint-io` | Active. Tagpath agent-doc lint invocation, finding classification/emission, lint gate CLI/frontmatter/project-config mode resolution, and skip/block message formatting live here. Frontmatter owns the pure lint-mode policy; orchestration write/stream call focused lint IO directly and inject only ops-log markers. |
| Global user config | `agent-doc-config` | Active. Global `~/.config/agent-doc/config.toml` schema, agent/terminal/execution-mode config types, and file-backed loading live here. CLI and orchestration callers import `agent_doc_config` directly; orchestration must not keep a `config` module facade. |
| Filesystem helper primitives | `agent-doc-fs` | Extracted. Project-root discovery and optional file reads live here; orchestration and CLI callers use `agent_doc_fs` directly rather than routing through `snapshot` or an orchestration `fs_util` facade. |
| Snapshot sidecar IO | `agent-doc-snapshot-io` | Active. Locked markdown snapshot load/save/delete, diff-baseline resolve with git HEAD/worktree fallback, the focused diff `SnapshotStore` adapter, initial snapshot creation, snapshot-vs-HEAD commit verification, rename detection, hash-based state sidecar migration, pre-response snapshot sidecars, model-projected baseline sidecars, model-projection probe logging, raw CRDT byte-sidecar locks/read-write-delete, markdown-to-overlay sidecar writes, and CRDT merge-base sidecar adaptation live here behind injected ops-log/editor-op sinks where needed. Document initialization sequencing moved to `agent-doc-workflow-io`, which composes session UUID assignment, focused snapshot initialization/migration, and an injected git baseline commit; orchestration no longer keeps a snapshot module or facade. Markdown load/save/resolve, pre-response, raw CRDT, model-baseline, diff-store, reset markdown-delete, rename-migration, and CRDT merge-base callers import `agent-doc-snapshot-io` directly. Pure CRDT merge-base resolution and log-event vocabulary live in `agent-doc-document-realtime`; per-node merge-state sidecar adapters and document CRDT persistence live in `agent-doc-merge-io`; git HEAD/worktree recovery fallback decisions compose through `agent-doc-git-io`; session registry path rewrites for renamed documents live in `agent-doc-session-registry-io`. |
| Git directory/path and checkpoint IO | `agent-doc-git-io` | Active. Git toplevel/superproject/gitdir resolution, git-worktree detection, pane-cwd resolution, session branch/squash assembly, tracked-status and commit-mtime helpers, side-effect-note rendering, HEAD/revision content reads, workspace-access `--add-dir` assembly, commit-lock pathing, revision/HEAD worktree fallback recovery decisions, parent/submodule gitlink drift detection, partial-staging git evidence plus companion-finding assembly, checkpoint command adapters, and sibling commit IO live here. Orchestration calls focused helpers directly and must not keep git-directory, git-worktree detection, pane-cwd, session branch/squash, tracked-status/side-effect-note, commit-mtime, HEAD/revision-read, revision-fallback, submodule-drift, checkpoint-tag, partial-staging git evidence, or workspace-access argument facades. |
| Editor visual syntax tokenization | `agent-doc-syntax` | Active. Pure visual token spans for editor integrations live here; FFI remains the ABI adapter. |
| Log timestamp formatting/parsing | `agent-doc-log-time` | Active. Pure log timestamp helpers live here; orchestration log writers/readers call it directly and must not re-export it through `ops_log`. |
| Lease/request TTL freshness and local-model lease IO | `agent-doc-lease` + `agent-doc-lease-io` | Active. The shared saturating timestamp freshness rule and pure `tsift local-model lease reap` argument policy live in `agent-doc-lease`; hook-side project-root/registry checks and `tsift local-model lease reap --unload-empty --json` process execution live in `agent-doc-lease-io`. Domain modules call focused lease policy directly and keep only their own sidecar schema/path/env adapters. |
| Exchange topic-section parsing | `agent-doc-topic` | Active. Pure `### Re:` exchange section splitting and boundary-tail stripping live here; compaction/archive code consumes the parser directly. |
| C/JNA editor ABI | `agent-doc-ffi` | Active. Pure C-ABI exports for editor integrations live here and depend on focused crates directly; the main crate remains the cdylib adapter. |
| Pure merge / conflict policy | `agent-doc-merge` + `agent-doc-merge-io` + `agent-doc-op-capture-io` | Active. Semantic merge, frontmatter-aware CRDT merge, CRDT state-vector sync, per-cell merge projection, merge write-ownership phases, events, transition table, liveness facts, and disk-write predicate live in `agent-doc-merge`; git merge-file effects, op-capture-aware CRDT merge adaptation with injected ops-log sink, and per-node CRDT merge-state sidecar load/save adapters live in `agent-doc-merge-io`; editor op-capture sidecar persistence, base-hash memoing, editor-op gate lookup, clear, and GC live in `agent-doc-op-capture-io`. Orchestration imports focused crates directly. The `merge_contents` re-export plus the deleted `merge`, `merge_control_state_machine`, and `op_capture` facades must not return. |
| Turn lifecycle, operation log, and turn-scope affectedness | `agent-doc-turn` | Active. Lifecycle consumes realtime handoff proof and owns commit policy. Cycle phase transitions and labels, repair outcome/cancel/stale-preflight vocabulary, repair labels and doctor wording, closeout guard reason labels, terminal outcome policy, and closeout guard flow-event mapping, append response heading normalization, imperative response contract classification, future-work response signals, closeout response text normalization, closeout prompt/response text matching, exchange-tail unresolved/prompt-only/response-heading policy, direct patchback heading classification, response/done-signal parsing, reaped queue-directive response-loss detection, free-text queue response-proof/residue detection, partial-closeout shipped/remaining-work detection, blocked follow-up closeout detection, gated-phase split body detection, queue-audit partial-completion collapse detection, closeout metadata-drift authoritative-side policy, closeout recovery mutation reason labels, closeout recovery state/action decision mapping, closeout recovery evidence-to-state classification, closeout content-component signature policy, session-check ops-log event vocabulary, turn-scope manifests, affectedness classification, and queue-continuation stall classification live here; orchestration imports `CyclePhase`, repair outcomes, closeout guard/signal/recovery policy, exchange-tail policy, response text policy, heuristics, and drain-stall policy directly from `agent_doc_turn` and owns only sidecar persistence, command adapters, and the concrete closeout guard ops-log sink. |
| Response replay file effects | `agent-doc-turn` + `agent-doc-response-replay-io` | Active. Pure response replay/application policy, duplicate response detection, and deduped document construction live in `agent-doc-turn`; dedupe command file reads, injected document-write/snapshot sequencing, and stale patch sidecar cleanup live in `agent-doc-response-replay-io`. The CLI command adapter injects the remaining editor-aware writer and snapshot store directly; orchestration no longer keeps a dedupe facade. |
| Model tier and context usage | `agent-doc-model-tier` | Active. Harness model-tier resolution, harness alias canonicalization, preflight harness-mismatch warning facts, response-header model attribution, transcript token aggregation, Claude transcript path composition, model context-window lookup, Codex token-count percentage parsing, and the context-clear clear/no-clear diagnostic decision live here; orchestration keeps only JSON/file-backed transcript discovery/read adapters and calls the focused API directly. |
| Prompt-cache boundary and effectiveness policy | `agent-doc-prompt-cache` | Active. Stable-prefix boundary rendering, replay-key construction, prompt-cache sample types, miss-cause ranking, trend checks, and operator-readable miss ranking live here; orchestration keeps only JSONL history file adapters and run prompt assembly calls the focused crate directly. |
| Prompt-context rendering and assembly | `agent-doc-prompt-context` + `agent-doc-prompt-context-io` | Active. Pure prompt rendering, document-section rendering, remote-host-scope wording, bounded response context, active-format requirements, and loaded-context ledger policy live in `agent-doc-prompt-context`; prompt-target extraction wiring, response-TOC injection, frontmatter/SSH-context parsing, and document-section assembly adapters live in `agent-doc-prompt-context-io`. Prompt builders pass cached `CycleContext` SSH context into focused IO directly; orchestration no longer keeps a prompt-context facade. |
| Codex hook sidecar IO | `agent-doc-codex-hook-io` | Active. Blocked Stop-hook payload sidecars, project-root discovery, root tracking, content hashing, active Codex session state JSON, session sidecar pathing, cross-root load/save/clear fanout, latest prompt lookup, external prompt recording, current-session environment lookup, and clear-prompt classification live here. Orchestration keeps the Stop-hook command decision flow, while route/preflight/repair/session-check/CLI adapters import focused sidecar IO directly. |
| Hook registry and document hook dispatch | `agent-doc-hooks-io` | Active. Agent-kit hook registry fire/poll adapters, document frontmatter hook command execution, hook event payload emission, claim/layout events, harness/model substitution for document hooks, post-response capture metadata shaping, function-backed and default concrete post-response effect adapters, active capture loading, tsift-memory closeout, local-model lease reap, stale JetBrains cleanup, and post-commit closeout sequencing live here. Orchestration no longer exposes `hooks`, `hook_effects`, or concrete post-response hook effect facades. |
| Editor IPC protocol and transport | `agent-doc-ipc-protocol` + `agent-doc-ipc-io` | Active. Pure IPC message construction, ack/error classification, early-ack markers, callback payload schema, file-IPC payload policy, IPC snapshot/repair reason vocabulary, and full-content repair redelivery labels/messages live in `agent-doc-ipc-protocol`; Unix/named-pipe socket send/listener adapters, ack timeout handling, per-connection listener threading, VS Code-style file-signal writers, and live-editor payload targeting over plugin-owner/live-buffer sidecars live in `agent-doc-ipc-io`. The orchestration `ipc_socket` facade is deleted; write IPC transport and convergence import `agent_doc_ipc_io::editor_target` directly, and the root FFI listener injects the ops-log sink through `start_listener_with_logger`. |
| Semantic memory ranking and closeout IO | `agent-doc-memory` + `agent-doc-memory-io` | Active. Semantic memory search/result ranking, tracked-work/done response event shaping, queue-strike matching, and archive parsing live in `agent-doc-memory`; session-memory file/database indexing/search adapters, done-archive reads, semantic completion retrieval, hook-side tsift-memory closeout adaptation, project-root/memory-db checks, response-summary command arguments, git HEAD lookup, and `tsift memory capture-agent-doc-closeout` spawning live in `agent-doc-memory-io`. Orchestration loads active captures, calls focused session-memory IO from preflight, and sequences hook closeout only. |
| Session accretion and compaction freshness | `agent-doc-session-accretion` + `agent-doc-session-accretion-io` | Active. Pure session-accretion thresholds, restart/session-log classification, guidance, clear-threshold resolution, queue-context-reset opt-in, and context-reset reason policy live in `agent-doc-session-accretion`; recent exchange-compaction marker record/load/freshness IO, file-backed queue-context-reset opt-in and clear-threshold resolution, plus `cycles.jsonl` and session-log metric readers live in `agent-doc-session-accretion-io`. Orchestration gathers document/frontmatter facts for report evaluation and calls the focused crates directly. |
| Session registry policy and snapshot IO | `agent-doc-session-registry` + `agent-doc-session-registry-io` | Active. Pure session registry key selection, session-id lookup, stale pane-binding removal, registry-entry construction, and replace/insert mutation policy live in `agent-doc-session-registry`; canonical `.agent-doc/sessions.json` path construction, JSON load/save, locked deregistration, loaded-registry normalization via `tmux-router`, canonical file-entry lookup, point-in-time registry lookup adapters, and locked session file-path rewrite after document rename live in `agent-doc-session-registry-io`. Root CLI and orchestration callers import registry IO directly for snapshots; controller dispatch-registry and supervisor startup-miss adapters compose with it for generic registry file IO; route callers import `agent-doc-controller-io::dispatch_registry` directly instead of routing through orchestration dispatch facades; orchestration `sessions` now keeps only registration/rebind/supervisor metadata side-effect sequencing and delegates pure mutation, persistence, and rebind session-log emission through focused crates. |
| Executor vocabulary | `agent-doc-turn-executor` | Active. Turn executor model vocabulary, managed capability-proof retry/timeout/status-message policy, auto-trigger readiness deadline policy, Codex resume launch argument policy, idle-queue drain/context-clear readiness policy, pure agent streaming output parsing/contract, and pane-capture delta/line-window policy now live here; orchestration should call the focused API directly. |
| Tmux observations and command effects | `agent-doc-tmux`, `agent-doc-tmux-commands`, `agent-doc-tmux-io`, `agent-doc-turn-executor-tmux`, `tmux-router` | Active starter crates; orchestration still has transitional tmux code. Focus pane selection, pane-position geometry parsing/selection, and bare-shell foreground-command classification now live in `agent-doc-tmux`; harness submit profiles, submit diagnostic labels, submit-text normalization, text/Enter command builders, and structured input diagnostic formatting/hash/gating now live in `agent-doc-tmux-commands`; target pane PID/window ID/window name/session/current-command observations, current-pane env-or-tmux resolution, in-tmux environment detection, pane capture, guarded pane joins, logged key sends, logged submitted-text sends, pane-position list-panes query adapters, and named-window checks live in `agent-doc-tmux-io`, and route/resync/sync/claim/run/watch/prompt/write/preflight adapters call them directly instead of routing through session facades. The old session-local `Multiplexer` abstraction is gone; `sessions` no longer owns tmux observation, capture, guarded-join, key-send, submitted-text, env-check, or registry snapshot facades and only retains registration/rebind helpers. `sessions` no longer re-exports tmux-router or tmux-submit policy; callers import `tmux_router`, `agent_doc_tmux`, `agent_doc_tmux_io`, `agent_doc_tmux_commands`, and `agent_doc_session_registry_io` directly. |
| Sync scope, layout, and lock policy | `agent-doc-sync` + `agent-doc-sync-io` + `agent-doc-process-owner-io` | Active. Scope-root/path-list normalization, layout-state paths, latency-budget rendering, sync-repair stamp paths, rename-debounce constants, prune-state update policy, window-index normalization policy, duplicate synthetic registry candidate selection, safe-passive lock/prune messages, resync target matching, sync frontmatter-status message policy, and stale orphaned sync-lock owner classification live in `agent-doc-sync`; lock-file acquisition, Linux `/proc` lock-owner inspection, stale-owner kill effects, sync frontmatter-status writeback, sync/resync reconciliation, registry repair, pane ownership proof, dead-pane capture, layout repair, prune/stash cleanup, and sync tests now live in `agent-doc-sync-io`; `pgrep`/`ps` process-tree traversal plus live agent-doc owner-process recognition live in `agent-doc-process-owner-io` and compose with pure controller command-line policy. Orchestration only supplies a temporary runtime-effects adapter for commit, repair, session-check, and route provisioning until those seams move. |
| SQLite-backed persistence | `agent-doc-sqlite` | Active. Actor storage record/state types and project-controller status/storage helper types live here and are imported directly; orchestration must not re-export them through `session_actor` or `project_controller`. |
| Document realtime scheduler | `agent-doc-document-realtime` | Active. Owns editor/disk read-authority policy, editor/disk authority states, apply scheduling states, CRDT authority policy, CRDT merge-base overlay classification/log-event/rebuild-intent policy, verification handoff vocabulary, pure live-editor delivery target selection, write/watch authority predicates and watch-gate policy types, visible-write/source-proof/reconnect/editorless-disk write policy plus its document-mutation flow-event mapping, exchange response-block parsing, safe historical exchange-reduction classification, live-prompt-drift recovery target policy, dropped-prompt containment checks, ACK-mismatch recovery classification, safe out-of-band agent-doc mutation classification, committed historical mutation classification, reaped pending-id reintroduction detection, and the inter-turn document convergence gate. Orchestration no longer keeps a `flow::document_mutation` facade or a `realtime_model` module. |
| Document realtime IO adapters | `agent-doc-document-realtime-io` | Active. Durable live-buffer feed resolution, stale-behind-committed-buffer autoheal, editor broadcast fan-out, dead-editor liveness filtering, targeted IPC patch sidecar creation, and realtime ops-log markers live here. Pure authority and broadcast planning stay in `agent-doc-document-realtime`; orchestration, MCP, FFI, simulation, preflight, write, and session-check call this focused IO crate directly. |
| Claim command binding IO | `agent-doc-claim-io` | Active. Claim command tmux pane resolution, cross-session guard logging, empty-document scaffold writes, session registry registration, project config defaulting, snapshot initialization, claim log append, sync prune, cross-root owner-pane guard, watch startup, and injected git/provision effects live here. Pure claim admission stays in `agent-doc-controller`, pure claim binding stays in `agent-doc-supervisor`, and document scaffold/defaulting stays in `agent-doc-document`; orchestration no longer owns or exports a claim module. |
| Stream command writeback IO | `agent-doc-stream-io` | Active. Stream command validation, streaming-agent submission, prompt-context assembly, periodic CRDT/template replacement flushes, partial response checkpoints, resume-id writes, lint gating, snapshot/CRDT persistence, and IPC-first flush refusal policy live here behind injected git/write/repair/hook effects. Orchestration no longer owns or exports a stream module. |
| Queue consume writeback IO | `agent-doc-queue-io` | Active. Queue-consume document mutation, proof recording, snapshot synchronization, owner-pane wedge reset, state-event emission, free-text/id-backed/noise strike commands, and skip diagnostics live in `agent-doc-queue-io::queue_consume` behind injected writeback effects. Pure queue-head selection, queue response proof policy, and AST node operations remain in `agent-doc-queue`; orchestration supplies only the temporary writeback adapter until document write authority leaves orchestration. |
| Route session, pane, startup, and dispatch IO | `agent-doc-route-io` | Active. Top-level route command runtime, stale registry prune, cooldown marker cleanup, route target-session resolution, context-session fallback handling, project `tmux_session` pin validation, shared sync scope root lookup, explicit lazy-claim target filtering, previous stash-pane preservation, registered-pane-in-session lookup, startup lock acquisition, route startup harness resolution, pre-route debounce waiting, startup/provision pane creation, route-owned start command submission, ready-wait polling/outcomes, fresh-start idle preservation, auto-start dispatch-ready reverify IO, fresh-start dispatch/dispatch-only send, startup-miss diagnostics and pane-resolution helper fact/provenance/cleanup/probe adapters, managed and dispatch-only pane resolver runtime branches, post-claim sync layout reconciliation, dispatch target binding, restart handoff polling, supervisor runtime/provenance helpers, busy-pane recovery, fresh dispatch recovery validation, routed dispatch-start tracking/proof polling, launch-contract reuse IO, dispatch-only send/retry plus proof/recycle gate IO, direct-pane submit/acceptance/resubmit IO, route dispatch transport/proof IO, authoritative actor binding/authorization/lifecycle/capability-proof/ready-wait IO, authoritative actor reroute dispatch loop IO, routed turn admission projection/retry/unchanged-projection IO, route diagnostics, dispatch-bug filing, route dispatch queue writeback, route document preparation, and route runtime effect bundle assembly for managed pane resolution, authoritative actor dispatch, closeout drain, pending maintenance, session inspection, and closeout recovery decisions live in `agent-doc-route-io::{command,authoritative_actor,authoritative_dispatch,session_resolution,startup,startup_locks,startup_harness,startup_debounce,startup_ready,startup_sync,pane_resolution,dispatch_target,restart_handoff,supervisor_runtime,pane_provenance,busy_pane,dispatch_recovery,dispatch_start,launch_contract,dispatch_only,direct_pane_dispatch,dispatch,admission_projection,diagnostics,queue_dispatch,document_prep,runtime_effects}`. Pure route text predicates and dispatch decisions remain in `agent-doc-controller`; prompt-bearing drift detection lives in `agent-doc-session-check-io`; orchestration injects only the temporary repair-closeout callback into production route runtime effects while repair replay still depends on orchestration; Codex hook sidecar storage remains in `agent-doc-codex-hook-io`; tmux observation helpers remain in `agent-doc-tmux-io`; session registry persistence remains in `agent-doc-session-registry-io`. |
| Closeout and direct-run runtime effects | `agent-doc-closeout-runtime-io` + `agent-doc-run-runtime-io` | Active. Runtime closeout, session-check, and repair-recovery effect providers now live in `agent-doc-closeout-runtime-io`, including `CloseoutEffects`, `SessionCheckEffects`, `RepairIoEffects`, closeout recovery hints, preflight-maintenance closeout calls, commit callbacks, and committed/abandoned frontmatter writes. Runtime direct-run effects now live in `agent-doc-run-runtime-io`, including commit, template normalization, authoritative document writes, queue-consume writeback, closeout completion, and recursive-cycle abandon callbacks. Orchestration no longer owns `REPAIR_IO_EFFECTS`, `session_check_effects`, `closeout_effects`, `closeout_recovery_hint`, or `DIRECT_RUN_EFFECTS`; it retains only the repair replay write callbacks while `write` is still inside orchestration. Follow-up seams: move `RepairReplayWriteEffects` once write replay/apply exits orchestration; split closeout preflight-maintenance callbacks from repair recovery callbacks if they stop forming one runtime cycle; then remove route/write/preflight references to orchestration repair coordinator. |
| Watch daemon and controller-watch IO | `agent-doc-watch-io` | Active. Watch daemon PID sidecars, process liveness probes, focused `is_running` liveness composition, the process-wide controller-owned watcher registry, write-provenance filtering, content-hash observation, and file-watch state-event construction live here. `agent-doc-document-realtime` keeps the pure watch-gate/delivery vocabulary; orchestration only submits accepted watch observations through the session actor, appends the resulting state event, and calls focused watch liveness IO directly without keeping an `is_running` facade. |
| Editor debounce and sidecars | `agent-doc-debounce` | Active. Typing debounce state, live-buffer sidecars, editor sync barriers, write-provenance records, and live-buffer classification diagnostics live here; orchestration consumes the sidecar API directly. |
| Editor plugin ownership and stale cleanup | `agent-doc-plugin-owner` + `agent-doc-plugin-owner-io` | Active. Plugin-owner lease schema/path/election, owner liveness, CRDT authority observation, and JetBrains cleanup filename policy live in `agent-doc-plugin-owner`; hook-side stale consumer/live-buffer filesystem traversal, dead-PID removal, and testable cleanup IO live in `agent-doc-plugin-owner-io`. Hook closeout sequencing/logging and the concrete stale-cleanup call live in `agent-doc-hooks-io`. |
| Supervisor model and process effects | `agent-doc-supervisor`, `agent-doc-supervisor-process` | Active. Pure state/recovery decisions, supervisor config precedence, auto-install retry policy, stale install-artifact classification, stale host-supervisor binary identity checks, process lifecycle decisions, harness-change restart policy, child crash/restart policy, supervisor prompt/exit-code policy, restart-continuation policy, child-launch planning, idle-pane/ready-busy reconcile policy, route-owned reap and document-liveness policy, missing-pane session-loss event policy, registered-owner startup-miss supersession policy, write-wedge recycle evidence classification, self-kill action/escalation/cmdline policy, post-child-exit run-loop dispatch, and controller handoff state now live in `agent-doc-supervisor`; process handoff state for `execve` re-entry, detached child reaping, terminal resize effects, PTY shared-writer/stop-pipe mechanics, supervisor-owned output/screen projection, PTY reader/stdin-forwarder thread loops, and the route-owned completion polling/reap loop now live in `agent-doc-supervisor-process`. The old `start::decisions`, `supervisor::state`, `supervisor::resize`, `detached_child`, and project-controller config helper facades are deleted; orchestration imports the focused crates directly. |
| Start command IO | `agent-doc-start-io` + `agent-doc-start-runtime-io` | Active. Startup document/session preparation, queue-journal replay, start session-log/status helpers, stale controller actor cleanup, route-owned stderr redirect guard lifetime, tmux/current-pane proof, recursive owner-pane refusal, startup-miss supersession cleanup, existing-owner fail-closed checks, project-session relocation/rebind, sessions registry registration, ownership generation logging, project-controller `start_session` retry during recycle, document `session_start` hooks, and supervisor-host gate logging live in `agent-doc-start-io`; the long-lived child supervisor loop, idle-watch, supervisor IPC adapter, route-owned reap handling, and start-runtime tests now live in `agent-doc-start-runtime-io`. Orchestration no longer exposes a production `start` facade. |
| Supervisor marker, session-log, and socket I/O | `agent-doc-supervisor-io` | Active. Startup-miss marker paths, marker read/write/clear helpers, supervisor session-log append/status/diagnostic readers, recent session-loss window readers, missing-pane session-loss log append adapter, registry-rebind transition/superseded/session-end log emission, registry-aware startup-miss supersession/take sequencing plus its session-registry-backed lookup adapter, supervisor CWD resolution, supervisor config env/file reads, recycle sidecar adapters including Path-based recycle-request scheduling, and supervisor IPC socket pathing/listener/framing/liveness probes live here. Orchestration no longer exposes `startup_miss`, `startup_miss_registry`, `schedule_supervisor_recycle_for_doc`, or `supervisor::ipc` facades; call sites import the focused IO modules directly while orchestration keeps process/tmux/document adapters. |
| Controller RPC/CAS | `agent-doc-controller` | Active. Controller stores/apply decisions; it does not own supervisor policy. Pure controller command-line recognition, cross-document owner command-line classification, controller status/freshness/control-plane projection, dispatch admission helpers for in-flight coalescing, authoritative-actor runtime guard classification, authoritative actor effective-state selection, dispatch-start proof classification, fresh-start admission outcome policy, routed admission-projection requirement/unchanged-projection policy, route trigger matching, Codex shell-search blocker recognition, context-session normalization, stash-window name classification, routed reopen decision/action/prompt-ready-barrier policy, route submit-observation vocabulary/log rendering, routed trigger payload admission, route latency status/log rendering, route dispatch diagnostic message templates, duplicate-pane route diagnostic templates, route-dispatch bug backlog item templates, dispatch-only delivery/proof outcome vocabulary and log/refusal templates, routed reopen timeout budgets, direct-pane submit acceptance/outcome/dispatch-start-wait/poll-state/Enter-resubmit/resubmit-proof-log policy, dispatch-only starting-pane retry budgets, starting-timeout recovery classification, route closeout-block action selection, route startup-miss recovery classification, operator reopen classification, operator-clear guard policy, stale-generation redirect parsing, stale-queue pause recovery, dispatch-only busy/probe gates, route-drain retry classification, recycle debounce, force-recycle bypass, and claim cross-session admission now live in `agent-doc-controller`; controller process liveness/identity/boot-time, dispatch-registry IO, and the project-controller socket/RPC/state-store runtime now live in `agent-doc-controller-io`; orchestration imports focused helpers directly while route callers remain adapters over tmux, file, flow, queue-consume, and auto-start effects. Claim command IO now lives in `agent-doc-claim-io`. |
| Controller dashboard IO | `agent-doc-controller` + `agent-doc-controller-io` | Active. Pure fleet model/rendering lives in `agent-doc-controller`; project-root resolution, snapshot assembly, JSON/terminal rendering loop, and dashboard polling live in `agent-doc-controller-io` behind injected actor-store, session-registry, pane-liveness, and controller-inspect effects. The CLI command adapter supplies those concrete effects directly; orchestration no longer keeps a dashboard facade. |

## Core Split Targets

| Current module | Target crate | Notes |
|---|---|---|
| `component.rs` | `agent-doc-element::element` | Extracted. Element parsing is element/document syntax; keep parser pure and file-IO free. |
| `pending.rs` | `agent-doc-element-backlog` / `agent-doc-tracked-work` | Tracked work parsing and lifecycle should be shared by backlog, review, icebox, and done. Started: ordered tracked-work `#id` scanning and batch-prepend add policy live in `agent-doc-element-backlog`; review-list projection/filtering and review ungate-task planning moved to `agent-doc-element-review`; orchestration keeps file-backed mutation adapters. |
| `queue_item_lifecycle.rs` | `agent-doc-element-queue` | Extracted. |
| `template.rs` / template patchback, sanitization, response materialization, and template IO | `agent-doc-template` + `agent-doc-template-io` | Extracted. Pure patch parsing, patch content sanitization, patchback shape classification, orchestrate patchback contract policy, child template response normalization plus its flow-event mapping, template structure guard flow-event policy, response write-proof/materialization policy, strict response-heading policy, component mutation, boundary repositioning, and repair helpers live in `agent-doc-template`; injected-sink patchback parse/log adapters, template structure guard logging, IPC payload response-materialization probe adapters, and file/config-backed patch application and template-info wrappers live in `agent-doc-template-io`; file adapters and concrete ops-log emission stay in orchestration adapters. |
| `replay_guard.rs` | `agent-doc-template` | Extracted. Replay payload shape validation lives beside template patch parsing because patch-bearing replay depends on `parse_patches`. |
| `crdt.rs`, `crdt_sync.rs`, `cell_doc.rs` | `agent-doc-merge` | Extracted. Pure CRDT/merge math, per-cell projection, and state-vector sync primitives live in `agent-doc-merge`; transport/authority adapters stay in orchestration/realtime layers. |
| `diff.rs` | `agent-doc-diff` + `agent-doc-diff-io` | Extracted. Pure prompt-bearing classification, slash/preset/directive extraction, post-exchange comment directive scanning, diff annotation, unstarted prompt-bearing change selection, bare prompt-prefix target slicing, and partial-staging changed-literal/path-relatedness policy live in `agent-doc-diff`; editor-buffer stability waits, snapshot mtime copy-on-read checks, and stale-snapshot recovery diff computation live in `agent-doc-diff-io`; `agent-doc-snapshot-io` exposes the focused snapshot-store adapter directly to callers. |
| `frontmatter.rs` | `agent-doc-frontmatter` + `agent-doc-frontmatter-io` | Extracted together with pure project config parsing. File/config-backed and cached-context wrappers live in `agent-doc-frontmatter-io`; orchestration caches the focused context type and no longer keeps a `frontmatter_io` facade. |
| `op_log.rs`, `turn_scope.rs` | `agent-doc-turn` + `agent-doc-sqlite` + `agent-doc-ops-log-io` | Extracted. Session-check operation-event vocabulary, semantic-diff-to-op conversion, turn-scope manifests, and affectedness classification live with the turn lifecycle model; durable sqlite append semantics, timestamping, and semantic-diff op-log persistence live in `agent-doc-sqlite`; text/JSONL operation-log file IO lives in `agent-doc-ops-log-io`. Orchestration no longer keeps a `preflight/semantic_diff` facade and only calls the focused semantic diff builder plus sqlite persistence helper. |
| `heuristics.rs`, response text normalization, closeout response/done-signal parsing | `agent-doc-turn` | Extracted. Pending-capture recommendation detection, explicit no-follow-up response detection, future-work response signals, append response heading normalization, imperative response contract classification, closeout response text normalization, closeout prompt/response text matching, exchange-tail unresolved/prompt-only/response-heading policy, direct patchback heading classification, response/done-signal parsing, reaped queue-directive response-loss detection, free-text queue response-proof/residue detection, partial-closeout shipped/remaining-work detection, blocked follow-up closeout detection, gated-phase split body detection, and queue-audit partial-completion collapse detection are turn closeout policy; orchestration only applies the resulting signal to guards and file/cycle adapters. |
| `syntax.rs` | `agent-doc-syntax` | Extracted. Editor-facing visual tokenization is pure document syntax; FFI/editor integrations stay as adapters. |
| `topic.rs` | `agent-doc-topic` | Extracted. Exchange topic section parsing is pure text segmentation shared by compaction/archive flows. |
| `ffi.rs` | `agent-doc-ffi` | Extracted. C/JNA ABI exports depend on focused crates directly. The final core audit moved lossless-tree projection and node-keyed patch ABI ownership out of the root cdylib module; the root now only force-links those focused exports. Pure sync-lock acquisition policy moved to `agent-doc-sync`, leaving the FFI host with atomics, clocks, and editor effects only. |

`agent-doc-core` itself is deleted. Focused crates are the only Rust API
surface for extracted policy.

## Orchestration Split Targets

| Current area | Target crate | Notes |
|---|---|---|
| `write`, `compact`, editor convergence | `agent-doc-document-realtime` plus `agent-doc-merge` | Realtime scheduling, owner selection, delivery, and verification should leave orchestration. Live editor delivery target selection, write/watch authority predicates, visible-write idle/source-proof/full-content replacement policy plus document-mutation flow-event mapping, reconnect-buffer policy, editorless disk fallback policy, exchange response-block parsing, safe historical exchange-reduction classification, live-prompt-drift recovery target policy, dropped-prompt containment checks, ACK-mismatch recovery classification, safe out-of-band agent-doc mutation classification, committed historical mutation classification, reaped pending-id reintroduction detection, and the inter-turn convergence gate are pure in `agent-doc-document-realtime`; merge write-ownership is pure in `agent-doc-merge`; orchestration is only adapting current sidecar/editor/git/file IO into those decisions and injecting the concrete flow/ops log sinks. |
| Editor debounce, live-buffer sidecars, write provenance | `agent-doc-debounce` | Extracted. Cross-process typing markers, durable live-buffer snapshots, editor sync barrier polling, write-provenance sidecars, and live-buffer classification diagnostics live in the focused sidecar crate. |
| `preflight`, queue maintenance | `agent-doc-preflight-command-io`, `agent-doc-preflight-io`, `agent-doc-document`, `agent-doc-element-backlog`, `agent-doc-element-queue`, `agent-doc-queue`, `agent-doc-diff`, `agent-doc-turn`, `agent-doc-work-graph`, `agent-doc-supervisor` | Preflight consumes parse/projection/supervisor facts; it should not own queue, tracked-work, or supervisor semantics. Completed: the preflight command host moved to `agent-doc-preflight-command-io`; preflight pending tracked-work maintenance, gate verification, queue inspection/maintenance, free-text admission, queue convergence, snapshot sync, and focused tests moved to `agent-doc-preflight-io`; queue item lifecycle moved to `agent-doc-element-queue`; tracked-work ops-proof completion classification moved to `agent-doc-element-backlog`; id-backed queue directive target parsing, graph-task explicit-`do` target extraction, queue command/prompt classification, free-text response-proof matching, free-text/id-backed queue-head classification, queue activation-trigger text recognition, queue deletion identity/count comparison, backlog-to-queue sync request collection, one-shot queue-sync request/report policy, tracked-work priority/dependency projection, queue continuation drainability/noise/context-reset policy, and guidance wording moved to `agent-doc-queue`; post-exchange comment directive scanning moved to `agent-doc-diff`; pure Auto-DAG classification/rendering, graph-evidence validation, schedule model/task parser/session-review guard/state-transition kernel, schedule decision vocabulary, batch progress policy, and orchestration-batch flow-event mapping moved to `agent-doc-work-graph`; cycle phase transitions moved to `agent-doc-turn`; stale install-artifact classification moved to `agent-doc-supervisor`; orchestration keeps no production preflight facade. |
| Transcript context usage / clear source | `agent-doc-model-tier` plus orchestration `context_pct` adapters | Completed for pure transcript token aggregation, Claude project transcript path composition, model-window percentage, Codex `token_count` parsing, clear/no-clear diagnostic decision, preflight harness alias/mismatch facts, and agent-model attribution. Orchestration should only locate/read transcript files and adapt preflight JSON output around `agent_doc_model_tier`. |
| Prompt-cache prompt assembly and effectiveness history | `agent-doc-prompt-cache` plus orchestration `prompt_cache` adapters | Completed for pure boundary rendering, replay-key construction, effectiveness trend checks, and miss-cause ranking. Orchestration should only append/load JSONL effectiveness history and supply run-specific routing/adapter facts to `agent_doc_prompt_cache`. |
| `start`, `supervisor`, stale actor reaping | `agent-doc-supervisor`, `agent-doc-supervisor-process`, `agent-doc-controller` | Distinguish pure supervisor state from process effects and controller storage. Completed: recycle/install/restart lifecycle policy, retry bounds, boot-resume policy, stale-drain yield policy, supervisor config precedence, agent-change restart policy, child crash/restart policy, supervisor prompt/exit-code policy, restart-continuation policy, child-launch planning, idle-pane and ready-busy reconcile policy, route-owned reap and document-liveness policy, write-wedge recycle evidence classification, self-kill action/escalation/cmdline policy, post-child-exit dispatch, and controller handoff policy moved to `agent-doc-supervisor`; `execve` re-entry handoff state, terminal resize effects, detached child reaping, PTY shared-writer/stop-pipe mechanics, supervisor-owned output/screen projection, PTY reader/stdin-forwarder loops, and route-owned completion polling/reap moved to `agent-doc-supervisor-process`; the transitional `start::decisions`, `supervisor::state`, `supervisor::resize`, and `detached_child` facades are gone, and orchestration keeps only idle-watch/process/tmux/document/file adapters. |
| Idle queue / executor readiness | `agent-doc-turn-executor` | Completed for pure idle queue drain, context-reset, clear-settle, dedup, between-turn enqueue planning, managed capability-proof retry/timeout/status-message policy, auto-trigger monitor/deadline policy, Codex resume launch argument policy, pure agent streaming output parsing/contract, and stream-capture delta/line-window policy. Orchestration should only observe pane/editor/config/agent-process facts and call the executor policy. |
| `route`, `project_controller`, `state_store`, `claim` | `agent-doc-controller` + `agent-doc-controller-io` | Route and claim should become adapters to controller admission and actor bindings. Started: command-line recognition and cross-document owner command-line classification moved to `agent-doc-controller::command_line`; controller status/freshness/control-plane projection moved to `agent-doc-controller::status`; dispatch coalescing, authoritative-actor runtime guard classification, authoritative actor effective-state selection, dispatch-start proof classification, fresh-start admission outcome policy, routed admission-projection requirement/unchanged-projection policy, route trigger matching, Codex shell-search blocker recognition, context-session normalization, stash-window name classification, routed reopen decision/action/prompt-ready-barrier policy plus routed-reopen flow-event mapping, route submit-observation vocabulary/log rendering, routed trigger payload admission, route latency status/log rendering, route dispatch diagnostic message templates, duplicate-pane route diagnostic templates, route-dispatch bug backlog item templates, dispatch-only delivery/proof outcome vocabulary and log/refusal templates, routed reopen timeout budgets, direct-pane submit acceptance/outcome/dispatch-start-wait/poll-state/Enter-resubmit/resubmit-proof-log policy, dispatch-only starting-pane retry budgets, starting-timeout recovery classification, closeout-block action selection, startup-miss recovery classification, stale-generation retry parsing, stale-queue recovery, dispatch-only busy/probe gates, and route-drain retry classification moved to `agent-doc-controller::dispatch`; operator-clear guard policy and flow-event mapping moved to `agent-doc-controller::operator_clear`; controller recycle debounce and force bypass moved to `agent-doc-controller::recycle`; claim cross-session admission moved to `agent-doc-controller::claim`; controller process-scan/liveness helpers, dispatch-registry adapters, editor route-error clear/log adapter, durable starting-actor timeout records, fleet dashboard snapshot/render loop, and the project-controller socket/RPC/state-store runtime moved to `agent-doc-controller-io`; orchestration still owns route/sync/start/file adapters and flow-specific runtime logging, and imports controller IO helpers directly instead of re-exporting or wrapping them through route/project-controller submodules. |
| `tmux`, pane probing, command execution | `agent-doc-tmux-*`, `agent-doc-turn-executor-tmux` | Use pure command builders, typed observations, and focused pane-selection decisions. |
| `session_check`, closeout recovery classification | `agent-doc-turn` plus `agent-doc-queue`, `agent-doc-frontmatter`, and document realtime projections | Session check consumes lifecycle/realtime/queue/config facts; it should not re-own source authority, queue-head semantics, or frontmatter/project guard precedence. Queue-continuation stall classification, closeout guard reason labels, terminal outcome policy, closeout guard flow-event mapping, exchange-tail unresolved/prompt-only/response-heading policy, closeout response text normalization, response/done-signal parsing, reaped queue-directive response-loss detection, free-text queue response-proof detection, partial-closeout shipped/remaining-work detection, blocked follow-up closeout detection, gated-phase split body detection, queue-audit partial-completion collapse detection, closeout metadata-drift authoritative-side policy, closeout recovery mutation reason labels, closeout recovery state/action decision mapping, closeout recovery evidence-to-state classification, and closeout content-component signature policy are now in `agent-doc-turn`; id-backed queue-head closeout/removal decisions and free-text queue-head identity/presence/residue projection are in `agent-doc-queue`; guard-mode precedence/defaulting is in `agent-doc-frontmatter`; unstarted prompt-bearing diff selection is in `agent-doc-diff`; orchestration persists the one-shot marker and adapts file/cycle/config state. |

## Acceptance Criteria

- `agent-doc-core` is absent from the workspace and from crate dependencies.
- `agent-doc-orchestration` is absent from the workspace and filesystem. New
policy lands in a focused crate; there is no legacy facade or retired nested
Cargo package for tools to discover and index.
- Internal and in-repo public Rust paths use focused crates directly; extracted
APIs are not kept alive through `agent-doc-core` or root-crate facades.
- Deprecated internal names are renamed to the current canonical names during
  extraction unless a user-visible CLI/document compatibility path explicitly
  requires a deprecation window.
- Each extracted crate has at least one meaningful unit test or compile-time
dependency-boundary test.
- `tests/core_decomposition.rs` pins the deleted legacy paths, focused owners,
pure-crate dependency direction, and root-cdylib ABI-adapter boundary.
- `tests/orchestration_decomposition.rs` pins the deleted orchestration package,
direct focused imports, and the focused owners for turn, realtime document,
supervisor/controller, editor, tmux, route, closeout, and repair behavior.
- The workspace builds and the focused extraction tests pass.

## Retired `agent-doc-orchestration`

The transition is complete. Production callers import focused crates directly,
and the root binary is the only CLI effect adapter. The retired package,
manifest, timestamp `build.rs`, source shell, and compile-baseline document were
deleted so Cargo and IDE project discovery cannot resurrect the old broad
dependency graph.

The final ownership audit is:

| Responsibility | Focused owner |
|---|---|
| Turn and queue/exchange lifecycle | `agent-doc-turn`, `agent-doc-queue`, and focused element crates |
| Realtime document scheduling and authority | `agent-doc-document-realtime` plus `agent-doc-document-realtime-io` |
| Supervisor and controller state | `agent-doc-supervisor`, `agent-doc-supervisor-io`, `agent-doc-controller`, and `agent-doc-controller-io` |
| Editor and tmux integration | `agent-doc-editor-surface*`, `agent-doc-tmux*`, and `agent-doc-turn-executor-tmux` |
| Route/session ownership | `agent-doc-route-io`, `agent-doc-session-actor-io`, and `agent-doc-session-registry-io` |
| Closeout, commit, and recovery | `agent-doc-closeout-runtime-io`, `agent-doc-commit-io`, and `agent-doc-repair*-io` |
| CLI/start/run/write command effects | root CLI plus the focused `agent-doc-{start,run,write,preflight}-*-io` crates |

## Completion Signal

This PRD is complete: both legacy aggregation crates are deleted, focused owners
hold the durable behavior, and architecture tests reject facade or dependency
regressions.
