• [new] Permanent auth failure path: auth.permanent_failure.set / auth.refresh.permanent_failure with RefreshTokenRejected, user-facing expiry message, and refresh-chain short-circuit (ServerRejected) so sampling does not keep retrying a dead session.
• [new] Auth recovery events when the on-disk token is expired and authority refresh fails, directing re-auth via grok login.
• [new] auth 401 attribution context (consumer, mint age, expiry skew, stale-snapshot flag) on unauthorized responses.
• [new] oidc try_refresh_pure terminal error with invalid_grant / revoked refresh token details when OIDC refresh cannot proceed.
• [new] model catalog refresh failed when catalog fetch cannot run without auth (had_real_catalog=false).
• [new] auth: prepare_sampling_config has no session key when preparing sampling under expired API-key auth.
• [changed] Auth init/selection with no valid cached session: default_auth_method_id is xai.api_key; ACP auth method list is ["xai.api_key","grok.com"] (no cached_token); init token state reports has_current=false, is_expired=true.
• [changed] Model catalog fetch runs with has_auth=false and no longer emits the auth-refresh watcher success/update/notify sequence on this path.
• [changed] Trace upload decision defaults locally (telemetry_source/trace_upload_source=default, no remote settings) instead of remote-gated values.
• [removed] Cached-token happy path events: cached_token check, disk write/enrichment update, auth.refresh.success, and OIDC refresh success.
• [removed] Model catalog success surfaces: fetch succeeded, client notify, and auth refresh watcher triggered/updated.
• [removed] Entire bundled/ tree from CLI home (agents, personas, roles, skills, and manifest).
• [removed] Top-level worktrees.db.