• [new] Auth file lock path: auth lock: attempting acquire / auth lock: acquired with path/pid/timeout, and on-disk auth.json.lock
• [new] Permanent-failure handling: auth.permanent_failure.set, auth.refresh.permanent_failure, and auth: refresh_chain short-circuit on permanent failure (e.g. RefreshTokenRejected / ServerRejected) with session-expired guidance to run grok login
• [new] Recovery events when disk token is expired and refresh-from-authority fails
• [new] OIDC refresh trace: oidc refresh enter, oidc refresh attempting idp, oidc try_refresh_pure enter, and oidc try_refresh_pure terminal error (e.g. invalid_grant / refresh token revoked)
• [new] auth 401 attribution context (consumer, mint age, expiry skew, stale snapshot)
• [new] auth: prepare_sampling_config has no session key when sampling cannot proceed without a session
• [new] Model catalog fetch path: model catalog: fetching and model catalog refresh failed (including had_real_catalog)
• [changed] Auth init/selection when token missing or expired: default_auth_method_id / started method prefer xai.api_key; ACP auth_methods omit cached_token; init reports has_current=false, is_expired=true
• [changed] Trace upload decision defaults to off (telemetry_mode=false, upload_reason=feature_off) instead of remote-enabled proxy upload
• [removed] Cached-token auth path events (auth cached_token check, cached_token handler set, priority override over xai.api_key) and auth init user_info check
• [removed] model catalog: notifying clients
• [removed] Entire bundled/ tree (agents, personas, roles, skills, manifest) from the runtime home layout
• [removed] Home top-level upload_queue, managed_config.lock, managed_config_cache.json, requirements.toml, and worktrees.db