M6 (opportunistic earlier): hygiene sweep — reuse/simplification/tooling-perf leftovers (R1-R3 R5 R6, S1-S8, P6 P7)

[Blind-Striker]

Source: multi-agent review of PR #16; all R/S items UNVERIFIED-FINDER (maintenance/drift observations), P6/P7 CONFIRMED tooling-only. 2026-08-13. M-anchor: swept opportunistically whenever a listed file is touched (most live in binder/emitters M2 reworks anyway); anything still open at M6 operational closure is resolved there — nothing on this list survives the M series.

Reuse / drift:

• R1 compile probe re-types the provenance header (tests/OpenCode.Sdk.Tools.Tests/Support/GeneratedSourceCompiler.cs:50-53) instead of GenerationProvenance.HasHeader → wording change causes false duplicate-type reds. Use the shared helper (or a shared byte/span helper).
• R2 PipelineTests reimplements UserAgentPolicy.Compose (PipelineTests.cs:307-315) — derive expectations through the policy; keep one metadata-integration test.
• R3 Basic-auth tests rebuild the header with hard-coded opencode (PipelineTests.cs:52,69) vs Pipeline.BasicUser — centralize the expected wire credential in a test contract constant/builder; do not expose production privates solely for tests.
• R5 nullable readonly field emission duplicated (ClientEmitter.cs:99-105, EnvelopeEmitter.cs:53-60) → EmissionSyntax if both stay structurally identical.
• R6 SchemaNameResolver reparses GraphKeyBuilder.UnionBranch's marker=value format ad hoc with silent whole-token fallback (SchemaNameResolver.cs:102-113) → centralize branch-key format/parse; refuse malformed identities.

Simplification (maintainer picks scope; none delays correctness):

• S1 one-field PendingOperationPlan → IReadOnlyList<string> · S2 primary-ctor mirror fields (OperationPlanBinder.cs:200-207) · S3 RefuseNull/RefuseNullTags → one generic (:529-539) · S4 unused client param in EmitPipelineAssignments (ClientEmitter.cs:194-204) · S5 unused client in EmitHandleFactory (:283-307) · S6 duplicated ctor guard/assignment syntax (:181-230) · S7 stored IsHandleOperation derivable from Plan.Parameters (OperationPlanBinder.cs:186-197,237) · S8 constant ClientPlan.Namespace (ClientPlan.cs:7).

Tooling perf (speed matters in tooling — standing posture; fix when in the file):

• P6 GenerationWriter triple-reads every owned file + whole-file HasHeader split + repeated ResolveOwnedPath normalization (GenerationWriter.cs:40,48,57,250) → fold provenance into the before-snapshot read, span header compare, cache validated paths per run.
• P7 WriteSourcesAsync copies every ReadOnlyMemory<byte> via ToArray() (:149) before the formatter rewrites files → stream/memory write seam on IFileSystem; only skip formatting with proof of canonical bytes.

[Blind-Striker]

PR #26 verification (2026-08-14) adds seven low-severity hygiene items to this sweep — verifier detail in the transient .scratchpad/ultra-review-m2/verify/RESULTS.json (ids below), durable record here:

• V26 · QueryRequestPlan.DerivesFromListRequest and per-property IsInherited encode one fact twice; a mismatch silently mis-emits. Collapse to a single source of truth (or a construction-time invariant).
• V31 · No-change generate --verify rereads and rewrites the complete generated set (provenance pass + two snapshots + format over unchanged bytes). Tooling-perf only.
• V32 · SchemaAliasApplier reconstructs the full projected document for one sparse alias. Tooling-perf only.
• V33 · Identical internal response-DTO shapes are emitted once per operation (SessionResponseEnvelope ≡ SessionCreateResponseEnvelope); shape-keyed dedup would shrink the registry.
• V34 · UnionNormalizer's oneOf purity wall duplicates the anyOf predicate verbatim — unify so a future constraint cannot fork the mirrored rules.
• V35 · ResponseAdapterEmitter.CreateSuccess duplicates the common status/payload initializer for the cursor arm — unify.
• V36 · BoundOperation.Group is dead state since grouping moved to the curated client name — delete.

[Blind-Striker]

The 1ee8c30 review adds confirmed correctness riders to the tooling areas already owned here.

GenerationWriter safety and recovery

• Output-root symlink: RefuseSymbolicLinks checks children but not OutputRoot itself, so a symlinked root can redirect writes outside the intended physical tree.
• Linux case-variant foreign file: an unmanifested Models/widget.cs does not block planned Models/Widget.cs; exact File.Exists misses the case-insensitive ownership collision and both files remain.
• Interrupted write recovery: cancellation/failure after a new source write but before manifest commit leaves a file the next run refuses as unmanifested. Manual cleanup works, but automatic retry is poisoned.

Add real-filesystem tests where the fake cannot model case/symlink behavior. Correctness must land before P6/P7 writer optimization.

Small correctness/hygiene riders

• SpecDocument.Schemas retains a caller-owned dictionary despite the immutable SpecIR contract; take an ordinal defensive copy.
• Expected command failures bypass configured file logging; route domain exceptions through MEL. Exit-code policy can remain a separate decision, but the log file must contain the failure.

Trigger: next GenerationWriter/tool-error handling change; no later than M6 operational closure.

[Blind-Striker]

Hosted CI evidence for a new tooling-test determinism rider: run 32128587050 attempt 1 failed only on Windows in OperationPlanBinderTests.Bind_Should_Refuse_A_Payload_Name_Colliding_With_Record_Members(PrintMembers). Microsoft.OpenApi ingestion translated a RegexMatchTimeoutException at the document boundary; the same test and full Windows matrix passed unchanged on attempt 2 at the identical SHA 7123627, while Linux/macOS were green. This was unrelated to the alias increment and was not hidden or retried locally. If it recurs, investigate reader regex timeout behavior under Windows/parallel test load and add deterministic containment rather than a retry/skip. Evidence: https://github.com/Blind-Striker/opencode-sdk-dotnet/actions/runs/32128587050

[Blind-Striker]

Status 2026-09-14: still an opportunistic M6 sweep; nothing here blocks the preview line. R1–R3 and S-items remain drift observations to take when the file is next open; P6/P7 remain tooling-perf leftovers in GenerationWriter.